@cello-protocol/daemon 0.0.188 → 0.0.190

package/dist/session-node-manager.js

@@ -23,14 +23,14 @@
 import { contentHashFor, resolveContentHashAlg, CONTENT_HASH_ALGS } from "./wire-content-hash.js";
 import { CAPACITY_REASONS } from "./refusal-reasons.js";
 import { onPeerSaltFrame, ownSaltFrame, SALT_ADOPTION_LABEL_MAX, SALT_ADOPTION_LABELS, SALT_FREEZE_GUIDANCE, } from "./session-salt-agreement.js";
-import { CONTENT_ENCRYPTION_REASONS, CONTENT_ENCRYPTION_GUIDANCE, SESSION_CONTENT_ENCRYPTION_V1, } from "./content-encryption-status.js";
+import { CONTENT_ENCRYPTION_REASONS, CONTENT_ENCRYPTION_GUIDANCE, CONTENT_ENCRYPTION_INBOUND_GUIDANCE, SESSION_CONTENT_ENCRYPTION_V1, } from "./content-encryption-status.js";
 import { openEncryptedDatabase, resolveDbKey, dbKeyPathFor, } from "./sqlcipher-db.js";
 import { migrateToEncryptedIfNeeded } from "./identity-migration.js";
 import { ensureIdentitySchema } from "./db-identity-store.js";
 import { migrateSessionTablesToAgentId } from "./agent-id-migration.js";
 import { TIER, normalizeTier, isKnownTierValue, tierBoundsFor, DEFAULT_TIER_BOUNDS, migrateContactsAddTierMetadata } from "./contacts-tier-migration.js";
 import { normalizeContactPubkey, foldContactPubkeyCase } from "./contact-pubkey-case.js";
-import { REFUSAL_KINDS } from "./refusal-reasons.js";
+import { REFUSAL_KINDS, relayAckHashRefusalNotice } from "./refusal-reasons.js";
 import { migrateCborBlobsToCanonical } from "./cbor-blob-migration.js";
 import { ensureTrustSignalSchema } from "./trust-signal-store.js";
 import { boundSettingKey, settableTierName, isValidSettingKey, awayTierSettingKey, AWAY_DEFAULT_KEY } from "./agent-settings-keys.js";
@@ -38,7 +38,7 @@ import { publishableEndpoint, relayOnlyState } from "./relay-only.js";
 import { randomUUID, createHash, randomBytes } from "node:crypto";
 import * as lp from "it-length-prefixed";
 import { decode } from "cbor-x";
-import { encodeCbor, decodeStructure1 } from "@cello-protocol/protocol-types";
+import { encodeCbor, decodeStructure1, encodeStructure1, computeGenesisPrevRoot } from "@cello-protocol/protocol-types";
 import { MAX_SESSION_NODES, STANDING_RECEIVER_AGENT_NAME } from "./types.js";
 import { SessionConnectionGater } from "./session-connection-gater.js";
 import { SessionTree, sessionTreeLeafKindFromDb } from "./session-tree.js";
@@ -286,6 +286,28 @@ const REDIAL_COOLDOWN_MS = 15_000;
  * span about 2.5 hours.
  */
 export const SR_RESERVATION_MAX_RETRIES = 5;
+/** The relay peer id inside a `/…/p2p/<relay>/p2p-circuit/…` address. */
+const CIRCUIT_RELAY_ID = /\/p2p\/([^/]+)\/p2p-circuit/;
+/**
+ * 032-RELAYSPREAD — the relays a node ACTUALLY HOLDS a circuit with, read off the addresses it is
+ * announcing. One entry per relay, deduped.
+ *
+ * This is the single definition of "a reservation is held", and it is deliberately the strictest
+ * one available: an ANNOUNCED circuit address. `start()` resolving is not enough — a relay out of
+ * reservation slots completes the handshake, grants nothing, and leaves a node that looks started
+ * and is dialable by nobody. Nor is a candidate address enough: a candidate is a relay we asked.
+ */
+function heldRelayIdsOf(node) {
+    const ids = new Set();
+    for (const addr of node.listenAddresses()) {
+        if (!addr.includes("/p2p-circuit"))
+            continue;
+        const id = CIRCUIT_RELAY_ID.exec(addr)?.[1];
+        if (id !== undefined)
+            ids.add(id);
+    }
+    return [...ids];
+}
 /**
  * DOD-M15-RELAYSLOTS-1 — how long an agent skips a relay that refused it for a relay-side fault.
  *
@@ -381,6 +403,155 @@ export const REVIVE_RESERVATION_CANDIDATES = 2;
  * the healthy direct latency and far below anything a person would notice.
  */
 export const LEAF_FETCH_GRACE_MS = 2_000;
+/**
+ * DOD-M15-REFUSALTERMINAL-1 — the refusal reasons no retry can ever get past.
+ *
+ * MEASURED LIVE 2026-09-04: one message aimed at a conversation the counterparty had already
+ * closed, refused `session_committed` and re-fetched roughly twice a second for 62 hours across
+ * several daemon restarts — 232,056 refusal events on that one session and a 484 MB `daemon.log`.
+ *
+ * **WHY `session_committed` QUALIFIES.** A committed session carries a signature over its contents.
+ * Nothing can be appended to it by anyone — not the counterparty, not us — so there is no future
+ * state in which this content is accepted. That is the bar, and it is the whole bar.
+ *
+ * **⚠️ DO NOT ADD A REASON WITHOUT MEETING IT.** A reason wrongly called terminal silently drops a
+ * message that would have arrived on the next try, which is worse than the loop this set exists to
+ * end. The tempting ones and why each fails:
+ *
+ *   - `content_hash_mismatch` — the fetch is BY CONTENT HASH, and a later fetch may retrieve a
+ *     correct copy from a different relay. Retrying can succeed.
+ *   - `sender_unresolved` — the sender may become resolvable when a profile arrives or a directory
+ *     syncs. Retrying can succeed.
+ *   - `session_orphaned` — `024-ORPHANTRIAGE` owns that path and decides its disposition.
+ *   - `session_size_limit_exceeded` — the cap IS monotonic, but its bound is a setting, and an
+ *     operator who raises it must be able to un-stick the conversation.
+ *   - a transient screener block — transient is in its name.
+ */
+/**
+ * ⚠️ NOT the same concept as `session-terminal-refusal.ts` (`DOD-MP-SESSION-RETIRE-1`), which is the
+ * RELAY terminally refusing one of OUR SENDS. This set is about INBOUND content this side will
+ * never accept. Two "terminal refusal" ideas live in this daemon and they point in opposite
+ * directions — review F9.
+ */
+export const TERMINAL_REFUSAL_REASONS = new Set(["session_committed"]);
+/**
+ * DOD-M15-REFUSALTERMINAL-1 review F3 — how long a FAILED read of the terminal-refusal rows is
+ * backed off for, per session.
+ *
+ * A minute: long enough that a database throwing on every witnessed leaf produces one ERROR rather
+ * than one per message (the exact log growth this unit exists to end), short enough that a disk
+ * which recovers is noticed within a message or two rather than at the next restart.
+ */
+export const TERMINAL_REFUSAL_READ_RETRY_MS = 60_000;
+/**
+ * DOD-M15-REFUSALTERMINAL-1 review F7 — how many terminally-refused content hashes are remembered
+ * per session.
+ *
+ * The counterparty chooses how many rows this table gets: one per distinct message aimed at a
+ * closed conversation, written even after the byte cap has stopped retaining evidence. 512 matches
+ * `MAX_REFUSED_PARKED_ENTRIES`, is far above any honest volume for a conversation that has ENDED,
+ * and bounds the table at (sessions × 512) small rows.
+ */
+export const MAX_TERMINAL_REFUSALS_PER_SESSION = 512;
+/**
+ * The `unusable` reason for a proof that is real and describes some OTHER message.
+ *
+ * ⚠️ NOT `"content_hash_mismatch"` — review §6. That string is already the refusal reason for the
+ * RECEIVER's own recompute failing (`ingestReceivedContent`), which is a tamper signal about the
+ * BODY. This one says the sender's signed claim is about different content. Two different failures
+ * sharing one name is a collision an operator grepping the log walks straight into.
+ */
+const AUTHORSHIP_CONTENT_HASH_MISMATCH = "authorship_hash_mismatch";
+/**
+ * The `unusable` reason for a proof that is real, is by the right signer, describes this content —
+ * and was signed for a DIFFERENT conversation. A replay, not a forgery.
+ *
+ * Every one of those properties has been ESTABLISHED by the time this is returned; see the ordering
+ * note in `#verifyAuthorshipClaim`. An earlier version of this sentence was true of the intent and
+ * not of the code, because the check ran before the signature was verified.
+ */
+const AUTHORSHIP_SESSION_MISMATCH = "session_mismatch";
+/**
+ * ─── 033-ACKEMIT: the three things that can be wrong with an ACKNOWLEDGEMENT ─────────────────────
+ *
+ * All three are `unusable` — the message is refused and the session lives. None of them is an
+ * identity fault: by the time any is returned the signature has verified, the signer IS this
+ * session's counterparty, and the claim is about this content in this conversation. What is wrong is
+ * what the claim says the sender had SEEN.
+ *
+ * They are three names and not one because the operator's next move differs for each, and because an
+ * investigator who cannot tell "your counterparty is on an older build" from "your counterparty
+ * acknowledged something you never sent" is looking at the wrong half of the problem.
+ *
+ * ⚠️ **NAME WHAT WAS OBSERVED, NEVER AN INFERRED CONCLUSION** (`DOD-M15-ERRSTRING-1`). Not one of
+ * these says "peer is malicious" — a mismatch is equally what a genuine software fault on the other
+ * side looks like, and an error that names a party the code did not check is this milestone's
+ * founding defect.
+ */
+/** A v1 claim: it carries no `last_seen_hash`, so it asserts a POSITION and no content at all. */
+const AUTHORSHIP_ACK_HASH_ABSENT = "ack_hash_absent";
+/** The hash names content this side does not hold at the position the claim names. */
+const AUTHORSHIP_ACK_HASH_MISMATCH = "ack_hash_mismatch";
+/** The hash names content this side has never held — not in the tree, and not held pending a gap. */
+const AUTHORSHIP_ACK_HASH_UNKNOWN = "ack_hash_unknown_content";
+const ACK_HASH_REASONS = new Set([
+    AUTHORSHIP_ACK_HASH_ABSENT,
+    AUTHORSHIP_ACK_HASH_MISMATCH,
+    AUTHORSHIP_ACK_HASH_UNKNOWN,
+]);
+/**
+ * ⚠️ **THE REFUSALS THAT SAY THIS ARE THE ONES WHERE THE REFUSAL DOES NOT HOLD — NOT ALL OF THEM.**
+ *
+ * It said "EVERY INBOUND REFUSAL SAYS THIS", and review F5 measured that: fifteen call sites file a
+ * refusal notice in this file and four carry this sentence — the three encryption causes and the
+ * authorship one. The rest MUST NOT. A screened-out message is deliberately never delivered by any
+ * route, and a transcript write failure lost content that was already accepted; promising either
+ * operator a second chance would be a lie in the opposite direction. Rewritten rather than deleted,
+ * because "EVERY" read as a rule and the next person to add a refusal would have applied it blindly.
+ *
+ * Where it DOES apply: refusing an inbound frame sends back no delivery acknowledgement, so a CELLO
+ * sender's TTF backstop parks a copy in the relay mailbox — sealed to this agent's LONG-TERM
+ * IDENTITY key, not the session key — and recovery opens that one whatever went wrong with the
+ * direct copy.
+ *
+ * ⚠️ AND ONLY WHEN THIS MACHINE CAN OPEN ONE. See `REFUSAL_NO_OTHER_ROUTE`; the choice is made by
+ * `#mailboxRouteAvailable`, never by a caller writing the sentence into a literal.
+ */
+const REFUSAL_MAY_STILL_ARRIVE = "IT MAY STILL REACH YOU BY THE OTHER ROUTE: a refusal sends back no acknowledgement, so a CELLO " +
+    "counterparty's agent parks a copy in the relay mailbox and this side opens that one with your " +
+    "long-term key instead of this session's. If it arrives, it arrives without whatever this check " +
+    "was unable to confirm — and if they are not running CELLO, there is no such copy and it will " +
+    "not arrive.";
+/**
+ * ⚠️ **THE OTHER ROUTE DOES NOT EXIST ON THIS MACHINE, AND SAYING SO IS THE POINT** — review F2.
+ *
+ * Opening a mailbox copy needs `KeyProvider.openContentSeal`, which is OPTIONAL: a threshold or
+ * signing-only provider does not implement it, and an agent loaded without a provider has none at
+ * all. `content-park.ts` refuses both — `signing_key_unavailable`, `cannot_unseal`.
+ *
+ * That is the SAME condition `CONTENT_ENCRYPTION_REASONS.NO_LOCAL_IDENTITY` reports. So on the one
+ * refusal that names a missing local identity, the reassurance above was false: both routes are shut
+ * by one cause, permanently, for every message on every session of that agent — and the operator was
+ * told to wait for a delivery that cannot happen. That is the H1 defect exactly: a refusal
+ * announcing a better outcome than it delivers.
+ */
+const REFUSAL_NO_OTHER_ROUTE = "AND IT WILL NOT REACH YOU BY THE OTHER ROUTE EITHER: the relay mailbox copy is opened with this " +
+    "agent's long-term identity key, which is the very thing this machine is missing. One cause shuts " +
+    "both routes, and it will keep shutting them until the agent is loaded with its identity key. Do " +
+    "not wait for this message to turn up.";
+/**
+ * Constant-shape byte equality for the two binding checks. Lifted rather than hand-rolled a second
+ * time — `seal-frontier-verify` has the same helper for the same comparison, and two copies of
+ * "are these the same bytes" is two things to keep true.
+ */
+function bytesEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    for (let i = 0; i < a.length; i++)
+        if (a[i] !== b[i])
+            return false;
+    return true;
+}
 /**
  * The relay's peer id out of a circuit listen address, or `null` if the address does not name one.
  *
@@ -548,7 +719,10 @@ export class SessionNodeManager {
          */
         const claimedRegistration = !client.hasSession(sessionId);
         if (claimedRegistration) {
-            client.registerSession(sessionId, node);
+            // 033-ACKEMIT: the seal transport submits a ctrl leaf like any other, so it needs the same
+            // acknowledgement seed. It carries no assignment of its own, so the genesis is supplied here
+            // from the session's own active entry rather than derived inside the client.
+            client.registerSession(sessionId, node, undefined, undefined, this.#sessionGenesisPrevRoot(agentName, sessionId));
         }
         else {
             /**
@@ -877,9 +1051,10 @@ export class SessionNodeManager {
     // initiator (consuming its agent's standing receiver) and the responder (consuming its agent's)
     // would contend for a single node and thrash. Keyed by agentName. A creation-in-flight guard set
     // prevents two concurrent ensure() calls from building two nodes for the same agent.
-    // `hasReservation`: this receiver came up holding a /p2p-circuit address. The
-    // watchdog uses it to tell "lost its reservation" (must recover) apart from
-    // "never had one" (already degraded, and already loud) — see #reservationWatchdogTick.
+    // `relayPeerIds`: the relays this receiver holds an announced circuit through. The watchdog reads
+    // it as a COUNT — zero tells "never had one" (already degraded, and already loud) apart from a
+    // loss, and a drop that leaves it non-empty is a lost relay the agent can absorb without being
+    // rebuilt. See #reservationWatchdogTick.
     /**
      * DOD-M12B-SESSION-SEED-1 — session id → the transport seed its node identity derives from.
      *
@@ -911,6 +1086,21 @@ export class SessionNodeManager {
     /** In-flight grace timers, keyed session+hash, so a redelivered leaf does not schedule a second
      *  fetch for the same content — a slow relay must not be turned into a storm against itself. */
     #leafFetchTimers = new Map();
+    /**
+     * DOD-M15-REFUSALTERMINAL-1: content hashes refused for a reason no retry can get past — a READ
+     * CACHE over `terminal_content_refusals`, never the record itself.
+     *
+     * ⚠️ **NOT the same fact as `#resolvedContent`, and collapsing them is the trap.** "Resolved"
+     * means we HAVE the content. Terminally refused means we have it and are never accepting it.
+     * Filing one under the other tells the next reader that refused content was delivered.
+     */
+    #terminallyRefused = new Map();
+    /** Sessions whose terminal-refusal rows have been read from the database into the map above.
+     *  Nothing ever un-marks content, so a loaded set only grows and can never go stale. */
+    #terminalRefusalsLoaded = new Set();
+    /** DOD-M15-REFUSALTERMINAL-1 review F3: when the load above last FAILED, per session. Bounds the
+     *  retry and the ERROR to once a minute instead of once per witnessed leaf. */
+    #terminalRefusalsReadFailedAt = new Map();
     /** Test seam: collapse the grace window so a test does not have to wait two real seconds. The
      *  window itself is covered by its own case. */
     #leafFetchGraceMs = LEAF_FETCH_GRACE_MS;
@@ -1324,6 +1514,26 @@ export class SessionNodeManager {
      * entry is removed the moment it is reconciled.
      */
     #unreadableAlgSeen = new Map();
+    /**
+     * `DOD-M15-AUTHORSHIP-ABSENT-1` review H1, widened by `029c` review F4 — the content hashes this
+     * side refused ON THE DIRECT PATH, for any reason, so the park path can say so when the same
+     * message arrives the other way.
+     *
+     * One map rather than one per refusal: what the park path needs to know is "did we turn this
+     * content away and tell somebody so", and the reason is already on the notice.
+     *
+     * **The silence this closes.** A direct-path refusal sends no delivery ACK, so the sender's TTF
+     * backstop parks the message and it arrives through the relay mailbox seconds later — where the
+     * ENVELOPE's signature is what authenticates it, and recovery correctly accepts it. So the
+     * message is delivered, with no per-message proof, moments after the operator was told it was
+     * refused. Nothing tied the two events together, which is the same shape the algorithm refusal
+     * above already had and the same remedy.
+     *
+     * Same bounded shape and the same reason: it is fed entirely by a remote party, so losing an
+     * entry costs one reconciliation line and an unbounded map would be a leak with a peer's hand on
+     * the tap.
+     */
+    #refusedOnDirectPath = new Map();
     // DOD-MSG-4 (strict in-order): the RELAY is the ordering authority (Structure 2). For each
     // message the relay witnesses, it delivers B a (content_hash -> canonical sequence) binding via
     // the leaf_deliver stream. B records it here — keyed #k(agent,session) -> (contentHashHex -> seq)
@@ -1345,6 +1555,18 @@ export class SessionNodeManager {
      * permanently less provable than the identical message that did not, for a reason with nothing to
      * do with authorship.
      */
+    /**
+     * 033-ACKEMIT review F1 — what this side has ACTUALLY RECEIVED, per session: the canonical
+     * position and the content hash at it.
+     *
+     * ⚠️ **IT MIRRORS THE RELAY CLIENT'S `#lastSeen` RATHER THAN REPLACING IT, and the duplication is
+     * deliberate.** The submit path needs the value on the client, because that is where the claim is
+     * built; the unwitnessed content path needs it here, because a session with no relay client has no
+     * client to read it from. Both are written from ONE place — `#noteAcknowledgeable` below — so they
+     * cannot come to disagree, and the client is preferred on read because it also sees leaves the
+     * relay delivered that never came through this path.
+     */
+    #lastAck = new Map();
     #heldContent = new Map();
     // DOD-MSG-4: the relay's high-water canonical sequence for this session — the largest sequence the
     // relay has witnessed (max over leaf_deliver). Keyed #k(agent,session). EXPOSED for the next
@@ -1838,6 +2060,24 @@ export class SessionNodeManager {
             // sealed record so it survives a daemon restart and is readable on the cert-read surface
             // (cello_get_sealed_receipt). JSON string with hex-encoded pubkeys; NULL until sealed.
             // Inline idempotent migration (NOT Flyway — this is the client-side SQLite, AC-011).
+            /**
+             * 033-ACKEMIT — THE SESSION'S GENESIS PREV_ROOT, and it is persisted for ONE reason: a
+             * restart.
+             *
+             * It is a pure function of the two participant keys, the session id and the SESSION
+             * TIMESTAMP — and the timestamp arrives on the directory-signed relay assignment and lives
+             * nowhere else. A session restored from this table after a daemon restart re-registers with
+             * no assignment in hand, so without this column the daemon could not say what the first
+             * message of that session acknowledges, and every send on it would be refused rather than
+             * signed. Deriving is still preferred where the assignment IS in memory; this is what makes
+             * the derivation survive the process.
+             *
+             * NULL for every session opened before this column existed. Those sessions acknowledge
+             * nothing until the counterparty has sent something — they claim position 0 with no hash,
+             * which asserts nothing rather than asserting a position they cannot back — and from the
+             * first leaf they receive they acknowledge content like any other session.
+             */
+            "ALTER TABLE sessions ADD COLUMN genesis_prev_root BLOB",
             "ALTER TABLE sessions ADD COLUMN seal_legibility TEXT",
             "ALTER TABLE sessions ADD COLUMN sealed_root_hex TEXT",
             // M7 legibility-TBS-binding (responder verify): the counterparty's FROST primary (group)
@@ -2111,9 +2351,17 @@ export class SessionNodeManager {
         -- else — which is the whole point of a notarized record.
         --
         -- sender_sig holds one of TWO things, and which one is told by direction:
-        --   RECEIVED row -> the Structure-2 signature, stored ONLY after the receiver verified it
-        --                   against the pubkey inside the sender's own signed bytes
-        --                   (#recordFrameOrdering). Verified, never claimed.
+        --   RECEIVED row -> the sender's signature over their own Structure-1 bytes, carried on the
+        --                   content frame BESIDE those bytes, stored ONLY after the receiver
+        --                   verified it against the pubkey inside them (#verifyAuthorshipClaim).
+        --                   Verified, never claimed.
+        --                   ⚠️ THIS USED TO READ "the Structure-2 signature ... (#recordFrameOrdering)"
+        --                   and it named a real place: until DOD-M15-AUTHORSHIP-ABSENT-1 the only
+        --                   copy of that signature this side ever saw was the one the RELAY had
+        --                   committed at Structure-2 index 3, so a message with no relay record had
+        --                   no checkable author at all. Rewritten rather than deleted: an auditor
+        --                   reading the old sentence goes looking for Structure-2 bytes that, on a
+        --                   relay-degraded message, do not exist.
         --   SENT row     -> OUR OWN signature over the Structure-1 bytes we put on the wire, taken
         --                   from the submit result. Produced, not verified — there was no
         --                   counterparty in the act, so it must NEVER be labelled verified_signature.
@@ -2121,11 +2369,16 @@ export class SessionNodeManager {
         -- ⚠️ self_authored COVERS TWO PROVENANCES, and sender_sig IS NOT NULL is the discriminator.
         -- Named here because it is the same shape this column exists to prevent, one level up: a
         -- provable sent row and an unprovable one share a label, so a reader keying on attribution
-        -- alone cannot tell them apart. An unprovable sent row is legitimate — an UNWITNESSED send
-        -- never put a Structure 1 on the wire, so there is nothing signed to store — but the reader
-        -- has to be told where the distinction lives, or it will be rediscovered as a bug.
+        -- alone cannot tell them apart.
         --   self_authored + sender_sig NOT NULL -> we wrote it and can prove we did
-        --   self_authored + sender_sig NULL     -> we wrote it; the relay never witnessed it
+        --   self_authored + sender_sig NULL     -> we wrote it; no proof was stored for this row
+        --
+        -- ⚠️ THE NULL CASE USED TO READ "the relay never witnessed it", and DOD-M15-AUTHORSHIP-ABSENT-1
+        -- made that false. Every content frame now carries this side's signature over its own
+        -- Structure 1 whether or not a relay witnessed the leaf, so an unwitnessed send is provable
+        -- too. Rewritten rather than deleted: the old sentence is why a NULL here was read as
+        -- ordinary. It is not ordinary now — it means this machine could not sign at all, or the row
+        -- came by a path that carries no proof, and both are worth a second look.
         --
         -- attribution is NOT NULL ON PURPOSE, and it is the load-bearing column. There is a soft
         -- path — session.content.ordering.decode_failed falls back to hash-dedup — that ingests a
@@ -2135,7 +2388,7 @@ export class SessionNodeManager {
         -- nothing distinguishes them. Forcing every writer to name which it is makes silent NULL
         -- impossible rather than merely discouraged.
         sender_pubkey TEXT,             -- from INSIDE the sender's signed bytes; NULL unless verified
-        sender_sig BLOB,                -- the VERIFIED Structure-2 signature; NULL unless verified
+        sender_sig BLOB,                -- the VERIFIED sender signature over structure1_cbor (see above); NULL unless verified
         attribution TEXT NOT NULL DEFAULT 'local_session_state',  -- verified_signature | self_authored | local_session_state
         PRIMARY KEY (agent_id, session_id, sequence, direction)
       )
@@ -2349,6 +2602,129 @@ export class SessionNodeManager {
         last_at INTEGER NOT NULL,
         PRIMARY KEY (agent_id, session_id, reason)
       )
+    `);
+        /**
+         * DOD-M15-REFUSALTERMINAL-1 — the lifetime refusal count, which `content_refusal_notices` is
+         * NOT and never was.
+         *
+         * `cello_dismiss` DELETEs the notice row (`dismissContentRefusals`), so `notices.count` restarts
+         * at 1 after every dismissal. That is correct for the notice — the operator said "I know" and
+         * the next announcement should describe what happened since — and it is exactly why the number
+         * shown beside it cannot be described as a lifetime figure. Live on 2026-09-04 an inbox reported
+         * `times: 58` for a refusal that had fired tens of thousands of times.
+         *
+         * A separate table rather than a column, because the two have different lifetimes: this one is
+         * never deleted by anything an operator does. Same key, so the read is one LEFT JOIN.
+         */
+        this.#db.exec(`
+      CREATE TABLE IF NOT EXISTS content_refusal_totals (
+        agent_id TEXT NOT NULL,
+        session_id TEXT NOT NULL,
+        reason TEXT NOT NULL,
+        total INTEGER NOT NULL,
+        first_at INTEGER NOT NULL,
+        last_at INTEGER NOT NULL,
+        -- 1 when this row was SEEDED from an existing notice at upgrade rather than counted from
+        -- the first refusal. Its total is then a LOWER BOUND, not a figure, and the drain reports
+        -- it under a different field name so a reader cannot mistake one for the other.
+        seeded INTEGER NOT NULL DEFAULT 0,
+        PRIMARY KEY (agent_id, session_id, reason)
+      )
+    `);
+        /**
+         * ⚠️ **THE BACKFILL, and without it this unit ships the original lie with the new name on it.**
+         *
+         * Review finding 1. A new table is created EMPTY. Every daemon that already has refusal notices
+         * — including the one that produced this incident, whose notice sat at 58 — would report
+         * `times_since_dismissed: 59` beside a `times_total` of **1**, on the very field the guidance
+         * tells an operator to judge severity by. Smaller than the number it exists to dwarf.
+         *
+         * `count` is the best figure available at upgrade and it is a LOWER BOUND: dismissals before
+         * this build deleted history nothing can recover. So the row is marked `seeded` and reported as
+         * "at least", never as a total. A lower bound is a true statement; `total = 1` is not.
+         *
+         * `INSERT OR IGNORE` makes it idempotent and self-healing — it fills only rows that do not
+         * exist, so a real counted total is never overwritten by a seeded one, and running it at every
+         * boot costs one indexed scan of a table bounded by (sessions × reasons).
+         */
+        /**
+         * ⚠️ **AND `CREATE TABLE IF NOT EXISTS` IS A NO-OP AGAINST A TABLE THAT ALREADY EXISTS** —
+         * review F1b, and it is the same hazard `DOD-M12B-INDEX-1` records for `held_content.origin`
+         * three hundred lines above.
+         *
+         * The table shipped one commit earlier WITHOUT `seeded`, and that build ran on a real daemon to
+         * take this unit's live measurement. On that machine the `CREATE` does nothing, the backfill
+         * below names a column that is not there, and the throw comes out of schema init — **the daemon
+         * does not open at all.** The one machine that most needs the backfill is the one it would have
+         * bricked.
+         */
+        try {
+            this.#db.exec("ALTER TABLE content_refusal_totals ADD COLUMN seeded INTEGER NOT NULL DEFAULT 0");
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            if (!/duplicate column name/i.test(msg))
+                throw err;
+        }
+        this.#db.exec(`
+      INSERT OR IGNORE INTO content_refusal_totals
+        (agent_id, session_id, reason, total, first_at, last_at, seeded)
+      SELECT agent_id, session_id, reason, count, first_at, last_at, 1
+        FROM content_refusal_notices
+    `);
+        /**
+         * ⚠️ **THE INVARIANT: a lifetime total can never be SMALLER than a since-dismissal count.**
+         * Caught on the live daemon, not by review — the inbox read
+         * `times_since_dismissed: 78, times_total: 12`.
+         *
+         * `INSERT OR IGNORE` above only fills rows that are ABSENT. A row that already exists but began
+         * counting AFTER the notice did — the totals table shipped one commit before `seeded`, so its
+         * rows default to 0 and claim to be exact — is left alone, and then presents a partial tally as
+         * a lifetime figure. Smaller than the number beside it, which is the tell.
+         *
+         * `count` resets on dismissal and `total` does not, so in healthy operation `total >= count`
+         * always. `count > total` therefore means one thing only: this row's total did not start at the
+         * beginning. Repaired to the best floor available and marked `seeded`, because that is what it
+         * is. Runs at every boot — it is also the repair for a totals write that failed while the
+         * notice's succeeded.
+         */
+        this.#db.exec(`
+      UPDATE content_refusal_totals
+         SET total = (SELECT n.count FROM content_refusal_notices n
+                       WHERE n.agent_id = content_refusal_totals.agent_id
+                         AND n.session_id = content_refusal_totals.session_id
+                         AND n.reason = content_refusal_totals.reason),
+             seeded = 1
+       WHERE EXISTS (SELECT 1 FROM content_refusal_notices n
+                      WHERE n.agent_id = content_refusal_totals.agent_id
+                        AND n.session_id = content_refusal_totals.session_id
+                        AND n.reason = content_refusal_totals.reason
+                        AND n.count > content_refusal_totals.total)
+    `);
+        /**
+         * DOD-M15-REFUSALTERMINAL-1 — content this agent will never accept, so the daemon stops going
+         * to fetch it.
+         *
+         * **DURABLE BECAUSE THE DEFECT CROSSED RESTARTS.** The 62-hour loop spanned several `cello
+         * login` cycles; a marker held in a `Set` on the manager would have passed every test and
+         * shipped nothing.
+         *
+         * NOT the `'quarantined'` transcript row, which is the natural candidate and does not work: it
+         * is keyed on the BYTES, and the fetch scheduler is keyed on the content hash the sender
+         * committed to. On the two refusals where those provably differ (a tamper, an algorithm we
+         * cannot read) the row cannot answer the question this table is asked.
+         *
+         * Keyed on `agent_id` — the stable key. `agent_name` is a display label.
+         */
+        this.#db.exec(`
+      CREATE TABLE IF NOT EXISTS terminal_content_refusals (
+        agent_id TEXT NOT NULL,
+        session_id TEXT NOT NULL,
+        content_hash TEXT NOT NULL,
+        reason TEXT NOT NULL,
+        marked_at INTEGER NOT NULL,
+        PRIMARY KEY (agent_id, session_id, content_hash)
+      )
     `);
         this.#db.exec(`
       CREATE TABLE IF NOT EXISTS content_refusal_reads (
@@ -3467,6 +3843,25 @@ export class SessionNodeManager {
      * a reason the caller is expected to log.
      */
     #quarantineRefusedContent(agentName, sessionId, reason, content, contentHashHex, opts) {
+        const sequence = this.#retainRefusedContent(agentName, sessionId, reason, content, contentHashHex, opts);
+        /**
+         * DOD-M15-REFUSALTERMINAL-1 — **THE FUNNEL, and the reason it lives here.**
+         *
+         * Every refusal that retains evidence passes through this method carrying its reason and its
+         * content hash, so this is the one place where "which reasons stop the work" can be a LIST
+         * rather than a decision copied into seven branches. `TERMINAL_REFUSAL_REASONS` decides; the
+         * six other reasons that reach here — a hash mismatch, an unreadable algorithm, a missing salt,
+         * an unresolved sender, an orphaned session, a terminal screen block — all keep retrying, and
+         * each of them can succeed on a later attempt.
+         *
+         * AFTER the retention, deliberately: the evidence has to exist before anything stops going to
+         * look for the message.
+         */
+        this.#considerTerminalRefusal(agentName, sessionId, contentHashHex, reason);
+        return sequence;
+    }
+    /** DOD-M15-REFUSEDEVIDENCE-1: the retention itself. Reached only through the funnel above. */
+    #retainRefusedContent(agentName, sessionId, reason, content, contentHashHex, opts) {
         if (!this.#db)
             return null;
         try {
@@ -3835,7 +4230,9 @@ export class SessionNodeManager {
         const sr = this.#standingReceivers.get(agentName);
         if (!sr)
             return "absent";
-        if (sr.hasReservation && sr.relayPeerId !== undefined)
+        // AT LEAST ONE. Holding two circuits and losing one leaves the agent perfectly dialable, so it
+        // is not "retrying" — reporting it as such sends an operator hunting a fault that is not there.
+        if (sr.relayPeerIds.length > 0)
             return "reserved";
         const retry = this.#srReservationRetry.get(agentName);
         return retry !== undefined && retry.attempts > SR_RESERVATION_MAX_RETRIES ? "unreachable" : "retrying";
@@ -3858,6 +4255,21 @@ export class SessionNodeManager {
      * counterparty_session_* fields. Read-only — does NOT consume the standing receiver
      * (unlike acceptSession, which hands it off).
      */
+    /**
+     * 032-RELAYSPREAD — would this receiver ADMIT an inbound dial from this relay?
+     *
+     * The gater's inbound carve-out is the security-sensitive half of the spread: only relays whose
+     * own reservation is confirmed held earn it, so a directory that merely NAMES a relay cannot dial
+     * in behind the gate. Nothing could observe that from outside the manager, and the review found
+     * the consequence: substituting the CANDIDATE list for the held list at the `setReservedRelayPeers`
+     * call kept every test in the unit green while shipping exactly that hole. A guard whose wiring
+     * cannot be observed is a guard nothing can test.
+     *
+     * Reads the live gater rather than a copy, so it cannot drift from what the gate actually does.
+     */
+    isRelayCarvedOutInbound(agentName, relayPeerId) {
+        return this.#standingReceivers.get(agentName)?.gater.holdsInboundCarveOut(relayPeerId) ?? false;
+    }
     getStandingReceiverInfo(agentName) {
         // DOD-LOOP-1: the initiator advertises ITS OWN agent's standing receiver, which it then reuses
         // as the session node — so the advertised endpoint matches the node the counterparty dials.
@@ -4431,8 +4843,22 @@ export class SessionNodeManager {
                 this.#relayClients.set(clientKey, client);
             }
             const sessionIdHexForRelay = Buffer.from(relay.sessionIdBytes).toString("hex");
-            client.registerSession(sessionIdHexForRelay, node, this.#relayLeafHandler(agentName, sessionId, correlationId), relay.assignment);
+            /**
+             * ⚠️ THE GENESIS IS WRITTEN BEFORE THE REGISTRATION, NOT AFTER — review F10.
+             *
+             * `#sessionGenesisPrevRoot` reads the entry's assignment first and the stored column second,
+             * and BOTH were still unset at this line: the entry's assignment is set below and the column
+             * is written below that. So the argument was always `undefined` here on a first attach, and
+             * the seed only survived because `registerSession` falls back to deriving one from the
+             * assignment it is handed. That is a dead argument standing next to a live fallback, which
+             * reads as deliberate and is the shape a later edit removes the wrong half of.
+             */
             const entry = this.#activeNodes.get(this.#k(agentName, sessionId));
+            if (entry)
+                entry.relayAssignment = relay.assignment;
+            if (relay.assignment)
+                this.#persistGenesisPrevRoot(agentName, sessionId, relay.assignment);
+            client.registerSession(sessionIdHexForRelay, node, this.#relayLeafHandler(agentName, sessionId, correlationId), relay.assignment, this.#sessionGenesisPrevRoot(agentName, sessionId));
             if (entry) {
                 entry.relayClient = client;
                 entry.relaySessionIdBytes = relay.sessionIdBytes;
@@ -4441,7 +4867,8 @@ export class SessionNodeManager {
                 entry.relayPeerId = relay.relayPeerId;
                 entry.relayAddrs = relay.relayAddrs;
                 // Review H1: the dial path needs the credential in hand, not just the endpoint.
-                entry.relayAssignment = relay.assignment;
+                // (Set above, before `registerSession`, so the genesis lookup it does has something to
+                // find — see the note there.)
                 // MSG-2 startup-flush: also PERSIST it, so a restart's crash-backstop flush (which runs
                 // before the in-memory entry exists) can deposit un-acked content to the same relay.
                 try {
@@ -4557,6 +4984,10 @@ export class SessionNodeManager {
             }
             // registerSession presents the assignment eagerly (see its own comment). No leaf handler: this
             // relay is not witnessing the session, it only needs the binding that authorizes the dial.
+            // 033-ACKEMIT: no genesis is passed and none is needed. This client is not witnessing the
+            // session — it never submits — and `registerSession` derives a seed from the assignment
+            // anyway. Reaching into the session record for one here would also be reaching with the RELAY
+            // session id, which is not the key that record is stored under.
             client.registerSession(sessionIdHex, node, undefined, relay.assignment);
             this.#logger.info("session.relay.assignment.presented_to_reservation_relay", {
                 agentName,
@@ -5326,7 +5757,20 @@ export class SessionNodeManager {
         // session ends, most sharply for `session_committed` — a refusal that exists only because the
         // session was already sealed. Dropping them at seal would delete exactly the ones a sealed
         // session produces. Growth is one row per (session, reason), i.e. proportional to `sessions`.
+        /**
+         * DOD-M15-REFUSALTERMINAL-1 review F7 — named because this list is the documented teardown set.
+         *
+         * `#terminallyRefused` and `#terminalRefusalsLoaded` are a READ CACHE over
+         * `terminal_content_refusals` and are dropped here with everything else in-memory; the durable
+         * rows stay, for the same reason the notices do — the question they answer outlives the
+         * session, and a fresh check reloads them on demand. `#terminalRefusalsReadFailedAt` goes too,
+         * so a torn-down session's back-off does not delay the first read after it is revived.
+         */
+        this.#terminallyRefused.delete(key);
+        this.#terminalRefusalsLoaded.delete(key);
+        this.#terminalRefusalsReadFailedAt.delete(key);
         this.#unreadableAlgSeen.delete(key);
+        this.#refusedOnDirectPath.delete(key);
         this.#responderSealSubmitted.delete(key);
         // DOD-MSG-4: drop the strict-in-order bookkeeping (witness map, held plaintext, high-water)
         // so a torn-down session retains no stale ordering state or buffered plaintext.
@@ -6802,6 +7246,76 @@ export class SessionNodeManager {
      * on first access (so it survives a restart — AC-007). Never returns null;
      * an unknown session yields an empty tree.
      */
+    /**
+     * The session's genesis prev_root — what its FIRST message acknowledges, before anything has been
+     * received (033-ACKEMIT).
+     *
+     * DERIVED FIRST, STORED SECOND — and this docblock used to say "derived, never stored", which
+     * stopped being true inside this same unit. Rewritten rather than deleted: a reader who believed
+     * the first sentence would delete the column read below as redundant, and take the restart case
+     * with it.
+     *
+     * The live assignment is authoritative, because it is the thing the value is defined by. The
+     * stored column covers the one case the derivation cannot: a session restored after a restart
+     * re-registers with no assignment, and the session TIMESTAMP the genesis needs lives nowhere
+     * else.
+     *
+     * `undefined` when neither is available. The callers do not paper over that — they say, in the
+     * log and in the claim itself, that this session acknowledges nothing yet.
+     */
+    #sessionGenesisPrevRoot(agentName, sessionId) {
+        const assignment = this.#activeNodes.get(this.#k(agentName, sessionId))?.relayAssignment;
+        if (assignment) {
+            return computeGenesisPrevRoot(assignment.participantA, assignment.participantB, Uint8Array.from(Buffer.from(sessionId, "hex")), assignment.sessionTimestamp);
+        }
+        /**
+         * THE RESTART CASE. A session restored from the database re-registers with no assignment, so
+         * the derivation above has nothing to work from and the stored copy is the only answer. Read
+         * second, never first: the live assignment is authoritative, and a stored value that ever
+         * disagreed with it would be the more dangerous of the two to prefer.
+         */
+        const row = this.#db
+            ?.prepare("SELECT genesis_prev_root FROM sessions WHERE agent_id = ? AND session_id = ?")
+            .get(this.#requireAgentId(agentName), sessionId);
+        const stored = row?.genesis_prev_root;
+        const bytes = stored instanceof Uint8Array ? stored : Buffer.isBuffer(stored) ? new Uint8Array(stored) : null;
+        // A stored value of the wrong width is not a genesis. Refusing it here sends the caller down its
+        // own named refusal, which is a better outcome than signing an acknowledgement of 17 bytes.
+        return bytes && bytes.length === 32 ? bytes : undefined;
+    }
+    /**
+     * Persist the session's genesis prev_root, once, at the moment the assignment arrives.
+     *
+     * `WHERE genesis_prev_root IS NULL` rather than a plain update: the value cannot legitimately
+     * change for the life of a session, so the second writer is either redundant or wrong, and the
+     * first write is the one derived closest to the assignment that opened the session.
+     */
+    #persistGenesisPrevRoot(agentName, sessionId, assignment) {
+        if (!this.#db)
+            return;
+        try {
+            const genesis = computeGenesisPrevRoot(assignment.participantA, assignment.participantB, Uint8Array.from(Buffer.from(sessionId, "hex")), assignment.sessionTimestamp);
+            this.#db
+                .prepare("UPDATE sessions SET genesis_prev_root = ? WHERE agent_id = ? AND session_id = ? AND genesis_prev_root IS NULL")
+                .run(Buffer.from(genesis), this.#requireAgentId(agentName), sessionId);
+        }
+        catch (err) {
+            /**
+             * LOUD, AND IT DOES NOT BLOCK. Losing this row costs the session its acknowledgements after a
+             * restart — sends are then refused by name until the counterparty speaks — and that is a far
+             * smaller harm than failing the session open that is in progress. Reported at ERROR because
+             * the failure is invisible until a restart that may be days away.
+             */
+            this.#logger.error("session.genesis.persist.failed", {
+                agentName, sessionId,
+                error: err instanceof Error ? err.message : String(err),
+                impact: "this session's starting point was not written to the database. Everything works until " +
+                    "this daemon restarts; after that, a send on this session is refused until the " +
+                    "counterparty has sent something, because the daemon cannot say what its first message " +
+                    "acknowledges.",
+            });
+        }
+    }
     getSessionTree(agentName, sessionId) {
         const key = this.#k(agentName, sessionId);
         const cached = this.#trees.get(key);
@@ -6997,7 +7511,7 @@ export class SessionNodeManager {
                     entry.extraRelayClientKeys = [...(entry.extraRelayClientKeys ?? []), clientKey];
                 }
                 // No leaf handler: this relay is not witnessing the session, it only needs the binding.
-                client.registerSession(sessionIdHex, entry.node, undefined, assignment);
+                client.registerSession(sessionIdHex, entry.node, undefined, assignment, this.#sessionGenesisPrevRoot(agentName, sessionId));
                 const recorded = await client.recordAssignmentAndWait(entry.node, sessionIdHex);
                 if (recorded) {
                     this.#logger.info("session.transport.dial_authorized", {
@@ -7107,6 +7621,12 @@ export class SessionNodeManager {
         // the leaf_deliver witness stream / arrival order.
         let orderingS1;
         let orderingS2;
+        /**
+         * `DOD-M15-AUTHORSHIP-ABSENT-1`: the sender's signature over `orderingS1`, when the relay
+         * witnessed this leaf. Undefined when it did not — and the frame builder below then signs a
+         * Structure 1 of its own rather than shipping a frame with nothing to check.
+         */
+        let orderingSig;
         /**
          * DOD-M15-SEALWIRE-1 bullet 5, SENT half. Our own Ed25519 signature over `orderingS1`.
          *
@@ -7135,6 +7655,11 @@ export class SessionNodeManager {
                 if (witnessed.ok) {
                     orderingS1 = witnessed.structure1_cbor;
                     orderingS2 = witnessed.structure2_cbor;
+                    // `DOD-M15-AUTHORSHIP-ABSENT-1`: the signature that goes ON THE FRAME beside `orderingS1`.
+                    // Captured here, next to the bytes it signs, because a signature assigned anywhere else
+                    // could end up beside a different Structure 1 — a proof next to the wrong signed bytes is
+                    // worse than no proof, since it looks checkable and fails.
+                    orderingSig = witnessed.sender_signature;
                     /**
                      * PAIRED WITH THE BYTES IT SIGNS, in one place, so the two can never be assigned apart.
                      *
@@ -7154,8 +7679,10 @@ export class SessionNodeManager {
                          * tell "the relay never witnessed this" from "we witnessed it, held the proof, and
                          * dropped it decoding our own bytes."
                          *
-                         * And the asymmetry with the received half is the argument. `#recordFrameOrdering` is
-                         * soft because the COUNTERPARTY supplied those bytes — an absence we cannot resolve.
+                         * And the asymmetry with the received half is the argument. The received half is soft
+                         * about a missing ORDERING record (`#recordFrameOrdering`) because the COUNTERPARTY
+                         * supplied those bytes — an absence we cannot resolve. It is not soft about a missing
+                         * authorship proof any more; `DOD-M15-AUTHORSHIP-ABSENT-1` refuses that outright.
                          * Here **we produced them**, in `session-relay-client.ts`, moments earlier. A failure
                          * means our own encoder and decoder disagree: an internal invariant break that would
                          * strip authorship from every sent row for the life of the process. Soft is still right
@@ -7204,7 +7731,7 @@ export class SessionNodeManager {
                              * two different submits would all have been persisted as a row that **looks checkable
                              * to an auditor and fails** — strictly worse than the honest unproven row it replaced.
                              *
-                             * The received half has always done this (`#recordFrameOrdering` verifies before
+                             * The received half has always done this (`#verifyAuthorshipClaim` verifies before
                              * storing and treats a failure as fatal). The sent half did not, and every ingredient
                              * was already in scope on this line.
                              *
@@ -7351,6 +7878,43 @@ export class SessionNodeManager {
                         ...(witnessed.detail === undefined ? {} : { detail: witnessed.detail }),
                         correlationId,
                     });
+                    /**
+                     * ─── 033-ACKEMIT: THIS ONE REACHES THE OPERATOR, NOT JUST THE LOG ─────────────────────
+                     *
+                     * Every other refusal on this branch is an availability answer — the relay is busy, the
+                     * session is not recorded, the stream died — and the send degrades to unwitnessed, which
+                     * is the documented path. These two are not availability. The WITNESS is telling us that
+                     * the acknowledgement this daemon signed disagrees with the record, and that is a
+                     * statement about the integrity of the conversation.
+                     *
+                     * `logger.warn` followed by a bare assignment is the exact shape Invariant 2's recurring
+                     * box names — a guard that fires correctly into a file nobody opens. The named surface is
+                     * `noteContentRefusal`, the same one every inbound refusal in this file uses, so it lands
+                     * where the operator already looks for "something was rejected and here is why".
+                     *
+                     * It does NOT stop the send. The relay refused to witness this leaf, so the message
+                     * degrades to unwitnessed exactly as any other refusal does and the operator keeps their
+                     * conversation; what changes is that they are told the record has stopped agreeing with
+                     * itself, at the moment it happens, instead of discovering it at the seal.
+                     */
+                    if (witnessed.reason === "ack_hash_mismatch" || witnessed.reason === "ack_hash_unverifiable") {
+                        const relayFault = witnessed.reason === "ack_hash_unverifiable";
+                        /**
+                         * THE SENTENCES LIVE IN `refusal-reasons.ts` — 033-ACKEMIT review F6. They were inline
+                         * here, behind a real relay answering a real refusal, so nothing could test them; and
+                         * the one that was wrong (a remedy naming a relay handover this system does not have)
+                         * was wrong for as long as that lasted.
+                         */
+                        const { impact, guidance } = relayAckHashRefusalNotice(relayFault, this.#mailboxRouteAvailable(agentName));
+                        this.#logger.error("session.relay.ack_hash.refused", {
+                            agentName, sessionId, correlationId, reason: witnessed.reason,
+                            ...(witnessed.detail === undefined ? {} : { detail: witnessed.detail }),
+                            impact, guidance,
+                        });
+                        this.noteContentRefusal(agentName, sessionId, witnessed.reason, {
+                            kind: REFUSAL_KINDS.REFUSED, impact, guidance,
+                        });
+                    }
                     relayRefusal = witnessed.reason;
                 }
             }
@@ -7372,6 +7936,72 @@ export class SessionNodeManager {
         // connection). See the note on #handleContentStream's finally.
         let sendStream;
         try {
+            /**
+             * ─── EVERY FRAME CARRIES ITS OWN PROOF — `DOD-M15-AUTHORSHIP-ABSENT-1` ────────────────────
+             *
+             * Structure 1 used to be built and signed INSIDE the relay submit, so a send the relay never
+             * witnessed put a frame on the wire with nothing on it to check — and the receiver, having no
+             * proof to compare, ingested it and attributed it anyway. There was always something to sign;
+             * nobody signed it.
+             *
+             * ⚠️ `structure2_cbor` IS DROPPED WHEN WE BUILD OUR OWN, and that pairing is load-bearing. The
+             * relay's record commits its copy of the sender's signature to the EXACT Structure 1 that was
+             * submitted; put it beside a Structure 1 built here (different timestamp, different
+             * last_seen_seq) and the receiver's cross-check fails against bytes that were never altered —
+             * a freeze on an honest message. The two travel together or the relay's half does not travel.
+             *
+             * ⚠️ SIGNED HERE, BEFORE THE SESSION KEY IS READ, and the order is load-bearing rather than
+             * tidy. `sessionKey` below is read once and used to seal the body several `await`s later; a
+             * key agreed with the counterparty inside that window leaves this side sealing under the key
+             * it captured while the far side has already moved on, and every message is refused as
+             * `decrypt_failed`. Signing costs two awaits, and putting them between the read and the seal
+             * widened that window enough to break the live two-node round trip. Measured, not reasoned
+             * about: seam-3 went red and both daemons logged `session.key.agreed` before the refusal.
+             */
+            let frameS1 = orderingS1;
+            let frameSig = orderingSig;
+            let frameS2 = orderingS2;
+            if (frameS1 === undefined || frameSig === undefined) {
+                const own = await this.#signOwnContentClaim(agentName, sessionId, entry, contentHash);
+                frameS1 = own.structure1;
+                frameSig = own.signature;
+                frameS2 = undefined;
+                /**
+                 * ⚠️ **AND OUR OWN TRANSCRIPT ROW GETS THE PROOF TOO** — review M3.
+                 *
+                 * `sentAuthorship` is set above only when the relay witnessed the leaf, because that was
+                 * the only path that ever produced a signature. This path produces one — and dropping it
+                 * here would leave the counterparty's transcript able to prove we wrote the message while
+                 * ours recorded `self_authored` with a NULL signature. That is exactly the half-provable
+                 * transcript `DOD-M15-SEALWIRE-1` bullet 5 exists to close, reappearing on the one path
+                 * that had no proof to lose before this unit and has one now.
+                 *
+                 * VERIFIED BEFORE IT IS STORED, the same discipline as the witnessed path: the pubkey comes
+                 * from INSIDE the bytes we signed, never from an agent lookup, and a pair that does not
+                 * verify is dropped loudly rather than persisted as a row that looks checkable and fails.
+                 * A failure here means this daemon's own encoder and decoder disagree.
+                 */
+                const s1Decoded = decodeStructure1(own.structure1);
+                const pk = s1Decoded.ok ? s1Decoded.fields.senderPubkey : undefined;
+                if (!s1Decoded.ok) {
+                    this.#logger.warn("session.sent.authorship.unavailable", {
+                        agentName, sessionId, correlationId, reason: "own_structure1_decode_failed",
+                        structure1Reason: s1Decoded.reason,
+                        impact: "this sent message is recorded with attribution 'self_authored' and NO signature, so the row asserts its author rather than proving one — even though this side signed the claim it put on the wire.",
+                        guidance: "We produced these bytes ourselves moments ago, so a decode failure here means this daemon's own encoder and decoder disagree. Treat it as an internal invariant break, not a peer problem.",
+                    });
+                }
+                else if (!verify(pk, own.structure1, own.signature)) {
+                    this.#logger.warn("session.sent.authorship.unavailable", {
+                        agentName, sessionId, correlationId, reason: "own_pair_does_not_verify",
+                        impact: "this sent message is recorded with attribution 'self_authored' and NO signature. The signature this side just produced does not verify against the key inside the bytes it signed.",
+                        guidance: "An internal invariant break: the signer and the encoder disagree. The message still went out; only the local proof was dropped.",
+                    });
+                }
+                else {
+                    sentAuthorship = { senderPubkey: pk, senderSig: own.signature };
+                }
+            }
             /**
              * 🚨 NO KEY, NO DIRECT SEND — `DOD-M15-EPHEMERAL-AUTH-1`, and there is no plaintext fallback.
              *
@@ -7383,11 +8013,12 @@ export class SessionNodeManager {
              * frame and a system that "carries on, degraded" gives up the body while the operator reads a
              * warning they have learned to scroll past. That is why this is a throw and not a warning.
              */
-            const encState = this.#contentEncryptionState(agentName, sessionId);
-            if (encState.key === null) {
-                throw new Error(`content_not_encryptable: ${encState.reason} — ${CONTENT_ENCRYPTION_GUIDANCE[encState.reason]}`);
+            // FAIL FAST, before a stream is opened for a message that cannot go out. The key this reads is
+            // NOT the one that seals the body — see the read beside `sealSessionContent` below.
+            const preflight = this.#contentEncryptionState(agentName, sessionId);
+            if (preflight.key === null) {
+                throw new Error(`content_not_encryptable: ${preflight.reason} — ${CONTENT_ENCRYPTION_GUIDANCE[preflight.reason]}`);
             }
-            const sessionKey = encState.key;
             const stream = await this.#openContentStream(agentName, sessionId, entry, correlationId);
             sendStream = stream;
             // AC-001/AC-003: arm the TTF tracking BEFORE the frame goes on the wire. The
@@ -7414,8 +8045,36 @@ export class SessionNodeManager {
              * THE WIRE COPY. `content_hash` above was computed over the PLAINTEXT and stays that way: the
              * transcript, the seal and the salted hash all depend on it meaning what it means today, and
              * the receiver decrypts before it verifies.
+             *
+             * ⚠️ **THE KEY IS READ HERE, ADJACENT TO THE SEAL, AND IT USED TO BE READ FAR ABOVE.**
+             *
+             * The read sat before `#openContentStream`, so the captured key crossed an `await` — several,
+             * once this unit added signing — before it sealed anything. A session key agreed with the
+             * counterparty inside that window left this side sealing under the key it captured while the
+             * far side had already moved on, and **every message was then refused as `decrypt_failed`**:
+             * a false tamper report on honest content, on both sides, for the life of the session.
+             *
+             * Not theoretical. It is what reddened four live-libp2p fixtures when identity keys were first
+             * wired into them — both daemons logged `session.key.agreed`, and the refusal followed.
+             *
+             * A window cannot be closed by reasoning about who wins it, only by removing it: nothing may
+             * run between the read and the seal. The preflight above stays because failing before a stream
+             * is opened is worth one extra read.
+             *
+             * ⚠️ THIS CLOSES THE LOCAL WINDOW AND NOT THE CLASS (review F8). The sender still seals at T
+             * and the receiver still decrypts at T+flight, so a re-key landing in THAT interval produces
+             * the same false tamper report. What is removed is the part this side controls; the rest is a
+             * property of there being two machines.
              */
-            const wireBody = sealSessionContent(sessionKey, content);
+            const sealState = this.#contentEncryptionState(agentName, sessionId);
+            if (sealState.key === null) {
+                // Reachable only if the key vanished between the preflight and here — a re-key or a
+                // teardown mid-send. Named as its own cause rather than reusing the preflight's, so a log
+                // reader can tell "never had one" from "had one and lost it while sending".
+                throw new Error(`content_not_encryptable: ${sealState.reason} — the key was present when this send began ` +
+                    `and gone by the time it sealed. ${CONTENT_ENCRYPTION_GUIDANCE[sealState.reason]}`);
+            }
+            const wireBody = sealSessionContent(sealState.key, content);
             const frame = encodeCbor({
                 type: "content_frame",
                 session_id: sessionId,
@@ -7428,9 +8087,12 @@ export class SessionNodeManager {
                 // DOD-MSG-4 (self-ordering): the relay's signed ordering record, so the receiver verifies +
                 // orders from the frame ALONE (no dependence on the separate leaf_deliver witness timing).
                 // structure1_cbor = sender-signed bytes (verify); structure2_cbor = relay's committed seq +
-                // prev_root (order). Omitted if the relay was unreachable — receiver falls back to the witness.
-                structure1_cbor: orderingS1,
-                structure2_cbor: orderingS2,
+                // prev_root (order). Structure 2 is omitted if the relay was unreachable — the receiver
+                // falls back to the witness stream for POSITION. Structure 1 and its signature are never
+                // omitted: `DOD-M15-AUTHORSHIP-ABSENT-1`, and a frame without them is refused on arrival.
+                structure1_cbor: frameS1,
+                sender_signature: frameSig,
+                structure2_cbor: frameS2,
                 // DOD-M15-SEALWIRE-1 part B2b: HOW `content_hash` was produced. An older peer ignores an
                 // unknown CBOR key, so emitting it is safe for every build in existence; a newer one reads
                 // it and verifies under the named algorithm instead of assuming.
@@ -7462,7 +8124,17 @@ export class SessionNodeManager {
             return { ok: true, delivered: true, ...(assignedSeq === undefined ? {} : { sequenceNumber: assignedSeq }), ...(sentAuthorship === undefined ? {} : { authorship: sentAuthorship }), ...(relayRefusal === undefined ? {} : { relayRefusal }) };
         }
         catch (err) {
-            this.#markSessionImpaired(agentName, sessionId, { cause: "direct_send", error: err instanceof Error ? err.message : String(err), correlationId });
+            /**
+             * Review F7: a content-key fault is NOT a transport fault, and labelling it `direct_send`
+             * points the operator at the connection when the connection is fine. `content_not_encryptable`
+             * is thrown twice above — once before the stream is opened, once at the seal — and both are
+             * about this machine's key state.
+             */
+            const failure = err instanceof Error ? err.message : String(err);
+            this.#markSessionImpaired(agentName, sessionId, {
+                cause: failure.startsWith("content_not_encryptable") ? "content_key" : "direct_send",
+                error: failure, correlationId,
+            });
             if (sendStream !== undefined) {
                 try {
                     sendStream.abort(err instanceof Error ? err : new Error(String(err)));
@@ -8041,6 +8713,27 @@ export class SessionNodeManager {
         }
         byHash.set(Buffer.from(contentHash).toString("hex"), declaredAlg);
     }
+    /**
+     * Remember that THIS frame was refused for carrying no usable proof of who wrote it, so the park
+     * path can say so when the same content arrives through the relay mailbox — review H1.
+     *
+     * Bounded for the same reason and by the same cap as `#noteUnreadableAlgFrame`: a peer sending
+     * unprovable frames feeds this map, so it drops the oldest rather than growing.
+     */
+    #noteRefusedOnDirectPath(agentName, sessionId, contentHash) {
+        const key = this.#k(agentName, sessionId);
+        let hashes = this.#refusedOnDirectPath.get(key);
+        if (!hashes) {
+            hashes = new Set();
+            this.#refusedOnDirectPath.set(key, hashes);
+        }
+        if (hashes.size >= MAX_UNREADABLE_ALG_FRAMES) {
+            const oldest = hashes.values().next();
+            if (!oldest.done)
+                hashes.delete(oldest.value);
+        }
+        hashes.add(Buffer.from(contentHash).toString("hex"));
+    }
     /**
      * ─── DOD-M15-NO-SILENT-REFUSAL-1: refusals the RECEIVING operator can actually see ────────────
      *
@@ -8090,16 +8783,61 @@ export class SessionNodeManager {
                 throw new Error("database is not open");
             const agentId = this.#requireAgentId(agentName);
             const now = Date.now();
-            // `count` grows on conflict; impact and guidance are refreshed, because a later refusal of the
-            // same reason may know more than the first (the salt branch has four causes and names them).
-            this.#db
-                .prepare(`INSERT INTO content_refusal_notices
+            /**
+             * ⚠️ **BOTH WRITES OR NEITHER — review F6, and the comment this replaces was wrong.**
+             *
+             * It argued that putting the totals insert in the same `try` made the two "fail together".
+             * It does not: each `.run()` autocommits, so the notice could persist and the total throw —
+             * and the `catch` then ALSO writes an in-memory fallback entry for a notice that is already
+             * in the table. The drain unions the two halves without deduplicating on (session, reason),
+             * so the operator would see the same refusal TWICE, once with a lifetime figure and once
+             * without, one of them blaming a disk fault. Before this unit a single statement made that
+             * state impossible; the second statement is what created it.
+             *
+             * `ROLLBACK` is best-effort because SQLite may have aborted the transaction already — the
+             * same shape `agent-id-migration.ts` uses — and it must never mask the original error.
+             */
+            this.#db.exec("BEGIN");
+            try {
+                // `count` grows on conflict; impact and guidance are refreshed, because a later refusal of the
+                // same reason may know more than the first (the salt branch has four causes and names them).
+                this.#db
+                    .prepare(`INSERT INTO content_refusal_notices
              (agent_id, session_id, reason, kind, impact, guidance, count, first_at, last_at)
            VALUES (?, ?, ?, ?, ?, ?, 1, ?, ?)
            ON CONFLICT(agent_id, session_id, reason) DO UPDATE SET
              count = count + 1, kind = excluded.kind, impact = excluded.impact,
              guidance = excluded.guidance, last_at = excluded.last_at`)
-                .run(agentId, sessionId, reason, detail.kind, detail.impact, detail.guidance, now, now);
+                    .run(agentId, sessionId, reason, detail.kind, detail.impact, detail.guidance, now, now);
+                /**
+                 * DOD-M15-REFUSALTERMINAL-1 — the lifetime tally, in the SAME `try` on purpose.
+                 *
+                 * If the notice write failed there is no notice to hang a total off, and the fallback below
+                 * has no durable counterpart to read — so the two must fail together. A total that survived a
+                 * failed notice would be a number nobody could see, and one that was written twice for a
+                 * retried notice would be worse than absent.
+                 */
+                this.#db
+                    .prepare(
+                // `seeded` stays whatever the row already has. A row seeded at upgrade remains a LOWER
+                // BOUND for the life of that (session, reason) — counting forward from an incomplete
+                // figure does not recover the refusals dismissal already erased, and clearing the flag
+                // would turn "at least 58" into a claimed total of 59.
+                `INSERT INTO content_refusal_totals
+             (agent_id, session_id, reason, total, first_at, last_at, seeded)
+           VALUES (?, ?, ?, 1, ?, ?, 0)
+           ON CONFLICT(agent_id, session_id, reason) DO UPDATE SET
+             total = total + 1, last_at = excluded.last_at`)
+                    .run(agentId, sessionId, reason, now, now);
+                this.#db.exec("COMMIT");
+            }
+            catch (inner) {
+                try {
+                    this.#db.exec("ROLLBACK");
+                }
+                catch { /* already aborted by SQLite */ }
+                throw inner;
+            }
         }
         catch (err) {
             this.#logger.error("session.refusal.persist.failed", {
@@ -8272,21 +9010,29 @@ export class SessionNodeManager {
              */
             const rows = (sessionId === undefined
                 ? this.#db
-                    .prepare(`SELECT n.session_id, n.reason, n.kind, n.impact, n.guidance, n.count, r.seen_count
+                    .prepare(`SELECT n.session_id, n.reason, n.kind, n.impact, n.guidance, n.count, r.seen_count,
+                        t.total AS lifetime_total, t.seeded AS lifetime_seeded
                    FROM content_refusal_notices n
                    LEFT JOIN content_refusal_reads r
                      ON r.agent_id = n.agent_id AND r.session_id = n.session_id
                     AND r.reason = n.reason AND r.consumer_id = ?
+                   LEFT JOIN content_refusal_totals t
+                     ON t.agent_id = n.agent_id AND t.session_id = n.session_id
+                    AND t.reason = n.reason
                   WHERE n.agent_id = ?
                     AND (r.seen_count IS NULL OR n.count >= r.seen_count * 10)
                   ORDER BY n.last_at DESC, n.rowid DESC LIMIT ?`)
                     .all(consumerId, agentId, MAX_REFUSALS_PER_READ + 1)
                 : this.#db
-                    .prepare(`SELECT n.session_id, n.reason, n.kind, n.impact, n.guidance, n.count, r.seen_count
+                    .prepare(`SELECT n.session_id, n.reason, n.kind, n.impact, n.guidance, n.count, r.seen_count,
+                        t.total AS lifetime_total, t.seeded AS lifetime_seeded
                    FROM content_refusal_notices n
                    LEFT JOIN content_refusal_reads r
                      ON r.agent_id = n.agent_id AND r.session_id = n.session_id
                     AND r.reason = n.reason AND r.consumer_id = ?
+                   LEFT JOIN content_refusal_totals t
+                     ON t.agent_id = n.agent_id AND t.session_id = n.session_id
+                    AND t.reason = n.reason
                   WHERE n.agent_id = ? AND n.session_id = ?
                     AND (r.seen_count IS NULL OR n.count >= r.seen_count * 10)
                   ORDER BY n.last_at DESC, n.rowid DESC LIMIT ?`)
@@ -8323,7 +9069,21 @@ export class SessionNodeManager {
                     kind: row.kind,
                     impact: row.impact,
                     guidance: row.guidance,
-                    count: row.count,
+                    timesSinceDismissed: row.count,
+                    /**
+                     * DOD-M15-REFUSALTERMINAL-1 — three states, and they are three different claims.
+                     *
+                     * A counted total is a FIGURE. A seeded row is a FLOOR, and says so by using a different
+                     * field name (review F1c). `null` means no totals row at all, which after the upgrade
+                     * backfill can only happen when the notice write itself failed — reported as ABSENT
+                     * rather than as the smaller number, because substituting it is the defect this unit
+                     * exists to remove.
+                     */
+                    ...(row.lifetime_total === null
+                        ? {}
+                        : row.lifetime_seeded === 1
+                            ? { timesTotalAtLeast: row.lifetime_total }
+                            : { timesTotal: row.lifetime_total }),
                     ...(firstTime ? {} : { repeat: true }),
                 });
             }
@@ -8359,9 +9119,12 @@ export class SessionNodeManager {
                     if (!oldest.done)
                         notice.surfacedTo.delete(oldest.value);
                 }
+                // `timesTotal` is deliberately absent: this notice exists because the durable write failed,
+                // so there is no lifetime record to report and inventing one from `notice.count` would
+                // restore the exact misreading this unit removes.
                 fromFallback.push({
                     sessionId: sid, reason, kind: notice.kind, impact: notice.impact,
-                    guidance: notice.guidance, count: notice.count,
+                    guidance: notice.guidance, timesSinceDismissed: notice.count,
                     ...(firstTime ? {} : { repeat: true }),
                 });
             }
@@ -8579,12 +9342,19 @@ export class SessionNodeManager {
     contentHashAlgIn, 
     /**
      * DOD-M15-SEALWIRE-1 bullet 5: the VERIFIED authorship proof for this message, when the caller
-     * has one. The caller is the only place that has it — `#recordFrameOrdering` verifies the
-     * signature against the key inside the sender's own signed bytes and matches the signer to this
-     * session's counterparty, and that result reaches here or nowhere.
+     * has one. The caller is the only place that has it — `#verifyAuthorshipClaim` verifies the
+     * signature the frame carries beside the sender's own signed bytes, against the key inside those
+     * bytes, and matches the signer to this session's counterparty. That result reaches here or
+     * nowhere.
+     *
+     * ⚠️ IT USED TO NAME `#recordFrameOrdering`, and that was accurate until
+     * `DOD-M15-AUTHORSHIP-ABSENT-1`: the signature arrived only inside the RELAY's Structure 2, so
+     * checking authorship needed a relay record. It does not now, and the old name sends a reader to
+     * a method that answers a different question. Rewritten, not deleted — that dependence is the
+     * defect the unit removed.
      *
-     * Optional, because the soft decode-failure path ingests without it. The row records which it
-     * was, so absence is never silent.
+     * Optional, because the PARK route ingests without it: recovered mail proves its sender by the
+     * mailbox envelope instead. The row records which it was, so absence is never silent.
      */
     verifiedAuthorship, 
     /**
@@ -8706,6 +9476,15 @@ export class SessionNodeManager {
             this.#quarantineRefusedContent(agentName, sessionId, "session_committed", content, contentHashHex, {
                 senderPubkeyHex: record.counterparty_pubkey ?? null, correlationId,
             });
+            /**
+             * DOD-M15-REFUSALTERMINAL-1 — the retention call above is also what STOPS THE WORK: it runs
+             * the terminal funnel, and `session_committed` is the one reason in it.
+             *
+             * Without that, the relay's next redelivery of the witness leaf armed another park fetch,
+             * which drained, verified, arrived here, and was refused again — measured at ~2 per second
+             * for 62 hours on one message. `#markContentResolved` could not be reused: this content did
+             * not land, and saying that it did is a lie a future reader would act on.
+             */
             // DOD-M15-NO-SILENT-REFUSAL-1. `currentStatus` on the log line carries the REAL status —
             // sealed, seal_interrupted_pending or abandoned — and the notice must not flatten those into
             // one claim, so it names the record as frozen rather than asserting which way it ended.
@@ -9575,38 +10354,200 @@ export class SessionNodeManager {
             this.#leafFetchTimers.delete(timerKey);
         }
     }
-    #scheduleLeafFetchIfUnresolved(agentName, sessionId, contentHashHex) {
-        const key = this.#k(agentName, sessionId);
-        if (this.#resolvedContent.get(key)?.has(contentHashHex))
-            return;
-        const timerKey = `${key}::${contentHashHex}`;
-        // ONE fetch per content hash. The relay redelivers, and a redelivery carries the same sequence —
-        // scheduling per redelivery turns a slow relay into a storm against itself.
-        if (this.#leafFetchTimers.has(timerKey))
+    /**
+     * DOD-M15-REFUSALTERMINAL-1 — the funnel. A refusal stops the work ONLY if its reason is in
+     * `TERMINAL_REFUSAL_REASONS`; every other reason keeps retrying, which is what makes a transient
+     * screener block or a version skew recoverable.
+     *
+     * One place decides, so "is this reason terminal?" is answerable from the set rather than from
+     * thirteen call sites.
+     */
+    #considerTerminalRefusal(agentName, sessionId, contentHashHex, reason) {
+        if (!TERMINAL_REFUSAL_REASONS.has(reason))
             return;
-        const timer = setTimeout(() => {
-            this.#leafFetchTimers.delete(timerKey);
-            if (this.#resolvedContent.get(key)?.has(contentHashHex))
-                return; // the direct path won
-            if (this.#shuttingDown)
-                return;
-            this.#logger.info("session.content.leaf_unresolved.fetch", {
-                agentName,
-                sessionId,
-                contentHash: contentHashHex,
-                graceMs: this.#leafFetchGraceMs,
-                impact: "the relay told us this message exists and its plaintext never arrived directly — "
-                    + "fetching it now instead of waiting for the periodic sweep",
-            });
-            this.#fireParkedDrain(agentName, "witnessed_leaf_unresolved");
-        }, this.#leafFetchGraceMs);
-        timer.unref?.();
-        this.#leafFetchTimers.set(timerKey, timer);
+        this.#markContentTerminallyRefused(agentName, sessionId, contentHashHex, reason);
     }
-    /** DOD-M12B-LEAF-TRIGGERS-FETCH-1 test seams. */
-    setLeafFetchGraceMsForTest(ms) { this.#leafFetchGraceMs = ms; }
-    markContentPresentForTest(agentName, sessionId, contentHashHex) {
-        this.#markContentResolved(agentName, sessionId, contentHashHex);
+    /**
+     * DOD-M15-REFUSALTERMINAL-1: this content can NEVER be accepted on this session — cancel the
+     * pending fetch and make sure no future one is scheduled, across restarts.
+     *
+     * The durable write comes FIRST and the in-memory cache second, so a process that dies between
+     * them wakes up with the stop still in force. A failed write is announced at ERROR and the
+     * in-memory mark is still taken: the loop stops for the life of THIS process, and the log says
+     * plainly that it will resume after a restart. That is a degraded stop, not a silent one.
+     */
+    #markContentTerminallyRefused(agentName, sessionId, contentHashHex, reason) {
+        const key = this.#k(agentName, sessionId);
+        /**
+         * Read BEFORE the write, so the announcement below fires on the TRANSITION rather than on every
+         * re-refusal. The same message can be refused again by a drain triggered for another reason, and
+         * an INFO line per repeat is a smaller version of the noise this unit exists to remove.
+         *
+         * The durable write is still ATTEMPTED every time, deliberately: `INSERT OR IGNORE` costs
+         * nothing when the row is already there, and skipping it would mean a write that failed once —
+         * the branch that logs the error below — never got another chance to succeed.
+         */
+        const alreadyKnown = this.#isTerminallyRefused(agentName, sessionId, contentHashHex);
+        try {
+            if (!this.#db)
+                throw new Error("database is not open");
+            const agentId = this.#requireAgentId(agentName);
+            this.#db
+                .prepare(`INSERT OR IGNORE INTO terminal_content_refusals
+             (agent_id, session_id, content_hash, reason, marked_at)
+           VALUES (?, ?, ?, ?, ?)`)
+                .run(agentId, sessionId, contentHashHex, reason, Date.now());
+            /**
+             * ⚠️ **BOUNDED, because the counterparty chooses how many rows exist — review F7.**
+             *
+             * One row per distinct content hash aimed at a closed conversation, and the funnel that calls
+             * this runs even when the byte cap has already stopped RETENTION. So a peer who has exhausted
+             * the session's storage budget can still write rows here, indefinitely, on a table nothing
+             * else deletes. Every sibling store in this file is bounded (`MAX_UNREADABLE_ALG_FRAMES`, the
+             * tier byte cap, `MAX_REFUSAL_READERS`); this one was not.
+             *
+             * Oldest-dropped, so the newest refusals keep their stop and the loop stays closed for what
+             * is arriving now. A dropped row costs at most one extra fetch for content nobody is sending
+             * any more — the pre-fix behaviour for that one hash, and nothing worse.
+             */
+            const dropped = this.#db
+                .prepare(`DELETE FROM terminal_content_refusals
+            WHERE agent_id = ? AND session_id = ? AND content_hash NOT IN (
+              SELECT content_hash FROM terminal_content_refusals
+               WHERE agent_id = ? AND session_id = ?
+               ORDER BY marked_at DESC LIMIT ${MAX_TERMINAL_REFUSALS_PER_SESSION}
+            )`)
+                .run(agentId, sessionId, agentId, sessionId);
+            if (Number(dropped.changes) > 0) {
+                // Loud, because it means a counterparty has aimed more than the cap's worth of distinct
+                // messages at one closed conversation — which is abuse, not ordinary traffic.
+                this.#logger.warn("session.content.terminal_refusal.evicted", {
+                    agentName, sessionId, dropped: Number(dropped.changes),
+                    cap: MAX_TERMINAL_REFUSALS_PER_SESSION,
+                    impact: "more distinct messages have been refused on this closed conversation than the cap keeps a record of, so the oldest stops were dropped. If one of those arrives again it costs one wasted fetch; nothing is delivered and nothing is lost.",
+                });
+            }
+        }
+        catch (err) {
+            this.#logger.error("session.content.terminal_refusal.persist.failed", {
+                agentName, sessionId, reason,
+                contentHash: contentHashHex,
+                error: extractErrorMessage(err),
+                impact: "this message can never be accepted on this conversation, and that fact could not be written down. Fetching for it stops while this daemon runs, and RESUMES after the next restart — which is the loop that filled a log with a quarter of a million refusals for one message.",
+                guidance: "This is a fault on THIS machine, not with the counterparty. Check free disk space and the permissions on ~/.cello; session.refusal.persist.failed in this log usually appears alongside it with the underlying error.",
+            });
+        }
+        let set = this.#terminallyRefused.get(key);
+        if (!set) {
+            set = new Set();
+            this.#terminallyRefused.set(key, set);
+        }
+        set.add(contentHashHex);
+        // The same cancellation `#markContentResolved` performs, for the opposite fact: an already-armed
+        // grace timer must not fire for content we have just decided never to accept.
+        const timerKey = `${key}::${contentHashHex}`;
+        const t = this.#leafFetchTimers.get(timerKey);
+        if (t !== undefined) {
+            clearTimeout(t);
+            this.#leafFetchTimers.delete(timerKey);
+        }
+        if (!alreadyKnown) {
+            this.#logger.info("session.content.terminal_refusal", {
+                agentName, sessionId, reason,
+                contentHash: contentHashHex,
+                impact: "no further attempt will be made to fetch this message. The conversation it was sent to is closed and signed, so no retry could ever have succeeded.",
+            });
+        }
+    }
+    /**
+     * DOD-M15-REFUSALTERMINAL-1: has this content already been refused terminally?
+     *
+     * Reads the durable rows for a session ONCE and caches them, so the hot path — a witnessed leaf
+     * on a healthy session — costs one `Set` lookup rather than a query per message. A read failure
+     * returns `false`: the cost is the loop continuing, which is the pre-fix behaviour, and it is
+     * announced rather than swallowed. Answering `true` on a failed read would be the dangerous
+     * direction, because it silently stops fetching content that was never refused.
+     */
+    #isTerminallyRefused(agentName, sessionId, contentHashHex) {
+        const key = this.#k(agentName, sessionId);
+        /**
+         * ⚠️ **A FAILING READ MUST NOT BE RETRIED PER MESSAGE — review F3.**
+         *
+         * The loaded flag is set only on success, so a database that throws (a full disk, a corrupt
+         * page) sent this method back to SQLite on EVERY witnessed leaf, logged an ERROR each time, and
+         * — because nothing was ever cached — made `alreadyKnown` false forever, so the mark's INFO
+         * fired on every refusal too. That is the ~2/s log growth this unit exists to end, reproduced
+         * by its own fix in the failure mode.
+         *
+         * Backed off instead: one attempt per session per minute, so the read still recovers when the
+         * disk does, and the ERROR is bounded rather than proportional to traffic.
+         */
+        const failedAt = this.#terminalRefusalsReadFailedAt.get(key);
+        const backedOff = failedAt !== undefined && Date.now() - failedAt < TERMINAL_REFUSAL_READ_RETRY_MS;
+        if (!this.#terminalRefusalsLoaded.has(key) && !backedOff && this.#db) {
+            try {
+                const rows = this.#db
+                    .prepare("SELECT content_hash FROM terminal_content_refusals WHERE agent_id = ? AND session_id = ?")
+                    .all(this.#requireAgentId(agentName), sessionId);
+                let set = this.#terminallyRefused.get(key);
+                if (!set) {
+                    set = new Set();
+                    this.#terminallyRefused.set(key, set);
+                }
+                for (const r of rows)
+                    set.add(r.content_hash);
+                this.#terminalRefusalsLoaded.add(key);
+                this.#terminalRefusalsReadFailedAt.delete(key);
+            }
+            catch (err) {
+                this.#terminalRefusalsReadFailedAt.set(key, Date.now());
+                this.#logger.error("session.content.terminal_refusal.read.failed", {
+                    agentName, sessionId,
+                    error: extractErrorMessage(err),
+                    retryInMs: TERMINAL_REFUSAL_READ_RETRY_MS,
+                    impact: "the record of messages this conversation can never accept could not be read, so this daemon may keep fetching one of them. Nothing is lost; the cost is repeated work and log noise. The read is retried once a minute rather than on every message, so this line is bounded — its absence for a while does NOT mean the fault cleared.",
+                    guidance: "This is a fault on THIS machine, not with any counterparty. Check free disk space and the permissions on ~/.cello; the error above carries SQLite's own message.",
+                });
+            }
+        }
+        return this.#terminallyRefused.get(key)?.has(contentHashHex) === true;
+    }
+    #scheduleLeafFetchIfUnresolved(agentName, sessionId, contentHashHex) {
+        const key = this.#k(agentName, sessionId);
+        if (this.#resolvedContent.get(key)?.has(contentHashHex))
+            return;
+        // DOD-M15-REFUSALTERMINAL-1: a refusal nothing can get past is the end of the work, not a
+        // reason to come back in two seconds.
+        if (this.#isTerminallyRefused(agentName, sessionId, contentHashHex))
+            return;
+        const timerKey = `${key}::${contentHashHex}`;
+        // ONE fetch per content hash. The relay redelivers, and a redelivery carries the same sequence —
+        // scheduling per redelivery turns a slow relay into a storm against itself.
+        if (this.#leafFetchTimers.has(timerKey))
+            return;
+        const timer = setTimeout(() => {
+            this.#leafFetchTimers.delete(timerKey);
+            if (this.#resolvedContent.get(key)?.has(contentHashHex))
+                return; // the direct path won
+            if (this.#shuttingDown)
+                return;
+            this.#logger.info("session.content.leaf_unresolved.fetch", {
+                agentName,
+                sessionId,
+                contentHash: contentHashHex,
+                graceMs: this.#leafFetchGraceMs,
+                impact: "the relay told us this message exists and its plaintext never arrived directly — "
+                    + "fetching it now instead of waiting for the periodic sweep",
+            });
+            this.#fireParkedDrain(agentName, "witnessed_leaf_unresolved");
+        }, this.#leafFetchGraceMs);
+        timer.unref?.();
+        this.#leafFetchTimers.set(timerKey, timer);
+    }
+    /** DOD-M12B-LEAF-TRIGGERS-FETCH-1 test seams. */
+    setLeafFetchGraceMsForTest(ms) { this.#leafFetchGraceMs = ms; }
+    markContentPresentForTest(agentName, sessionId, contentHashHex) {
+        this.#markContentResolved(agentName, sessionId, contentHashHex);
     }
     /**
      * DOD-MSG-4: the relay's high-water canonical sequence for this session (largest witnessed leaf),
@@ -9910,9 +10851,13 @@ export class SessionNodeManager {
     originalContent, 
     /**
      * DOD-M15-SEALWIRE-1 bullet 5: threaded from `ingestReceivedContent`, which is the only place
-     * that has it — `#recordFrameOrdering` verified this signature against the pubkey inside the
-     * sender's own signed bytes and matched the signer to this session's counterparty. It reaches
-     * the transcript row from here or not at all.
+     * that has it — `#verifyAuthorshipClaim` verified this signature (carried on the frame beside
+     * the bytes it signs) against the pubkey inside those bytes, and matched the signer to this
+     * session's counterparty. It reaches the transcript row from here or not at all.
+     *
+     * ⚠️ IT USED TO NAME `#recordFrameOrdering`, true until `DOD-M15-AUTHORSHIP-ABSENT-1` moved the
+     * check off the relay's record and onto the frame's own signature. Rewritten rather than
+     * deleted: the old name is the evidence of what authorship used to depend on.
      *
      * Undefined on the held-release and soft-fallback paths; the row records that as
      * `local_session_state` rather than leaving it indistinguishable from a proven one.
@@ -11257,6 +12202,14 @@ export class SessionNodeManager {
          */
         const memoKey = this.#k(agentName, sessionId);
         const priorDeclaredAlg = this.#unreadableAlgSeen.get(memoKey)?.get(contentHashHex);
+        /**
+         * `DOD-M15-AUTHORSHIP-ABSENT-1` review H1 — READ BEFORE THE INGEST, reported after it.
+         *
+         * Same reasoning as `priorDeclaredAlg` directly above: the memo says what THIS side did to this
+         * content on the direct path, and the ingest below is what decides whether the other route
+         * succeeded. Reading it after would race the clear.
+         */
+        const refusedForAuthorship = this.#refusedOnDirectPath.get(memoKey)?.has(contentHashHex) === true;
         const result = await this.ingestReceivedContent(agentName, sessionId, env.content, contentHash, correlationId, recoveredSeq ?? undefined, 
         // The envelope's own claim, verbatim — `undefined` on a v2 envelope, which resolves to
         // `sha256` and is exactly right for a peer that predates the field.
@@ -11297,6 +12250,48 @@ export class SessionNodeManager {
                 impact: "THIS EXACT MESSAGE was refused on the direct path because it named an algorithm this build cannot read, and the same content has now been accepted via the relay park under an algorithm this build CAN read. The refusal did not hold: the message was delivered by the other route.",
             });
         }
+        /**
+         * ⚠️ **THE AUTHORSHIP REFUSAL DOES NOT HOLD EITHER, AND THIS IS WHERE IT SAYS SO** — review H1.
+         *
+         * `DOD-M15-AUTHORSHIP-ABSENT-1` refuses a direct-path frame with no usable proof of who wrote
+         * it. Refusing sends no delivery ACK, so the sender's TTF backstop parks the message and it
+         * arrives here — where the ENVELOPE's signature over (session_id, recipient_pubkey,
+         * content_hash) is what authenticates it, and `authenticateParkedEntry` above has already
+         * accepted it. That is correct and it is deliberately NOT changed here: gating mail retrieval
+         * on a per-message record the relay-degraded path is allowed to omit is the false-positive shape
+         * this whole unit is careful to avoid, and the order that added the refusal scopes the park
+         * envelope out explicitly.
+         *
+         * What must not stand is the SILENCE. Without this line the operator reads "refused" and then
+         * watches the message appear, with nothing connecting the two — the same reconciliation gap the
+         * algorithm refusal above already pays for. What they need to know is the part that is really
+         * lost: the message arrived, and its INDIVIDUAL author is attested by the mailbox envelope
+         * rather than by a signature over that message's own bytes.
+         *
+         * Same `ok && !held && !screenedOut` predicate as above, and for the same reason: `ok` is not
+         * "delivered".
+         */
+        if (refusedForAuthorship && result.ok && result.held !== true && result.screenedOut !== true) {
+            const hashes = this.#refusedOnDirectPath.get(memoKey);
+            hashes?.delete(contentHashHex);
+            if (hashes && hashes.size === 0)
+                this.#refusedOnDirectPath.delete(memoKey);
+            /**
+             * ⚠️ RENAMED FROM `…authorship_refusal_reconciled` by `029c` review F4, because the memo it
+             * reads now covers EVERY direct-path refusal and not only the authorship one. Keeping the old
+             * name would have put "no usable proof of who wrote it" on a message that was actually
+             * refused for not decrypting — a wrong cause is worse than a general one.
+             *
+             * The specific reason is already on the operator's notice; what this event adds is that the
+             * refusal did not hold.
+             */
+            this.#logger.warn("content.recover.refusal_reconciled", {
+                agentName, sessionId, correlationId,
+                contentHash: contentHashHex,
+                impact: "THIS EXACT MESSAGE was refused on the direct path and the same content has now been accepted from the relay mailbox, where the sealed envelope proves the sender. The refusal did not hold: the message WAS delivered by the other route. What the direct path could not confirm is still unconfirmed — the mailbox proves WHO sent it and nothing about the check that refused it — so the receipt can show this message arrived without showing everything a directly-delivered one would.",
+                guidance: "Nothing to do about this message. The fix named on the original refusal still stands: until the cause clears, every message on this session takes the slower route and lands with less attached to it.",
+            });
+        }
         return result;
     }
     /**
@@ -11942,6 +12937,70 @@ export class SessionNodeManager {
         this.#sessionContentKeys.set(this.#k(agentName, sessionId), Uint8Array.from(key));
         this.#contentEncryptionReasons.delete(this.#k(agentName, sessionId));
     }
+    /**
+     * Record that a message ARRIVED and was accepted at a known canonical position — 033-ACKEMIT
+     * review F1.
+     *
+     * The one writer for both copies of the acknowledgement, so the claim this daemon signs says what
+     * it actually received rather than what the relay got round to delivering back to it.
+     *
+     * Monotonic, and it must be: a re-delivery or a recovered park of an EARLIER message must not walk
+     * the acknowledgement backwards, and must not swap the hash under an unchanged position.
+     */
+    #noteAcknowledgeable(agentName, sessionId, canonicalSeq, contentHash) {
+        // Relay sequences are 1-based; a canonical leaf index is 0-based. The claim carries the relay's
+        // number, because the relay is what checks it.
+        const relaySeq = canonicalSeq + 1;
+        if (relaySeq < 1)
+            return;
+        const key = this.#k(agentName, sessionId);
+        const prev = this.#lastAck.get(key);
+        if (prev && relaySeq <= prev.seq)
+            return;
+        this.#lastAck.set(key, { seq: relaySeq, hash: Uint8Array.from(contentHash) });
+        const entry = this.#activeNodes.get(key);
+        const sessionIdHex = entry?.relaySessionIdBytes
+            ? Buffer.from(entry.relaySessionIdBytes).toString("hex")
+            : sessionId;
+        entry?.relayClient?.noteReceivedLeaf(sessionIdHex, relaySeq, contentHash);
+    }
+    /**
+     * Test seam: put an own leaf in the HELD state instead of the tree — 033-ACKEMIT.
+     *
+     * The state `placeOwnLeaf` produces when the relay assigns a position ahead of our tail: the leaf
+     * exists on this side and is not in the tree, while the counterparty already has it from the relay
+     * and can acknowledge it. Reproducing it through the real hold map rather than by asserting the
+     * tree is short is what makes the acknowledgement test measure the case instead of a neighbour of
+     * it.
+     */
+    holdOwnLeafForTest(agentName, sessionId, canonicalSeq, contentHashHex) {
+        const key = this.#k(agentName, sessionId);
+        let held = this.#heldContent.get(key);
+        if (!held) {
+            held = new Map();
+            this.#heldContent.set(key, held);
+        }
+        held.set(canonicalSeq, { content: new Uint8Array(), contentHashHex, origin: "sent", kind: "msg" });
+    }
+    /**
+     * Test seam: put the session's genesis prev_root where a completed session open leaves it —
+     * 033-ACKEMIT.
+     *
+     * ⚠️ THE STATE IS THE PRODUCTION ONE; ONLY HOW IT GOT THERE IS SHORT-CIRCUITED, exactly as
+     * `setSessionContentKeyForTest` short-circuits the key exchange next door.
+     *
+     * In production this value is derived from the directory-signed relay assignment and written to
+     * the session row the moment the session learns it, so every real session has one. A fixture that
+     * builds a session node directly never sees an assignment — so without this seam every content
+     * test built on the fixture would be exercising the "no starting point" REFUSAL path instead of
+     * the thing it was written for, and would report that as a pass or a mysterious failure depending
+     * on which side of the send it sat on.
+     */
+    setSessionGenesisForTest(agentName, sessionId, genesis) {
+        this.#db
+            ?.prepare("UPDATE sessions SET genesis_prev_root = ? WHERE agent_id = ? AND session_id = ?")
+            .run(Buffer.from(genesis), this.#requireAgentId(agentName), sessionId);
+    }
     /**
      * Test seam: drop the agreed key while leaving the session up — the state before an exchange
      * completes, and after a teardown evicts one. Its mirror above is what a completed exchange
@@ -13450,41 +14509,649 @@ export class SessionNodeManager {
             });
         }
     }
+    /**
+     * `DOD-M15-AUTHORSHIP-ABSENT-1` — SIGN OUR OWN CLAIM, with no relay involved.
+     *
+     * The relay submit has always built these bytes and signed them (`session-relay-client.ts`); this
+     * is the same construction, for the path where no submit happens. It is not a fallback in the
+     * silent sense — it produces exactly the artifact the witnessed path produces, minus the relay's
+     * countersigned position, which was never part of the authorship claim.
+     *
+     * ⚠️ THROWS when this agent has no identity key, and the throw is the correct outcome. It lands in
+     * the direct-send catch, which parks the message to the relay mailbox exactly as a failed dial
+     * does — so the message is not lost, and the operator hears about a local fault instead of a
+     * counterparty who mysteriously stopped receiving. Shipping the frame unsigned would guarantee a
+     * refusal at the far end and blame the wrong machine for it.
+     */
+    async #signOwnContentClaim(agentName, sessionId, entry, contentHash) {
+        const signer = this.#keyProviderResolver?.(agentName);
+        if (!signer) {
+            throw new Error("content_not_signable: this machine has no identity key for this agent, so it cannot sign " +
+                "the message it is about to send and the counterparty would refuse it as unattributable");
+        }
+        // The 16-byte relay session id when this session has one, so a frame built here is
+        // byte-comparable with one built by the submit. Falling back to the local id is not a
+        // second meaning: for every session created without an assignment the two are the same value
+        // (`relaySessionIdBytes` is set from `sessionId` on exactly those paths).
+        const sessionIdBytes = entry.relaySessionIdBytes ?? Uint8Array.from(Buffer.from(sessionId, "hex"));
+        /**
+         * ⚠️ **THIS COMMENT USED TO READ "v1 DELIBERATELY" AND IT WAS RIGHT UNTIL NOW — 033-ACKEMIT.**
+         *
+         * It said `last_seen_hash` was `WITHHOLD-SEAL-1`'s emitter and "not owed here", and that a v1
+         * claim makes no content acknowledgement at all, "which is honest, where an invented one would
+         * not be." Accurate for `020-ACKHASH`, which shipped the reader only. It is rewritten rather
+         * than deleted because it is the sentence that would otherwise explain away the LAST production
+         * path still emitting v1 — and this unit's own Definition of Done is that a grep finds none.
+         *
+         * The reasoning it rested on has been answered: nothing is invented here. The acknowledgement
+         * is read from the same `#lastSeen` entry the submit reads, so a frame built on this path and
+         * one built by a submit make the same claim about the same message.
+         */
+        const sessionIdHexForAck = Buffer.from(sessionIdBytes).toString("hex");
+        /**
+         * The pair, from ONE accessor. Falling back to the session's genesis when there is no relay
+         * client at all is not an invention either: nothing has been witnessed on this session, so the
+         * honest acknowledgement is position 0 and the agreed starting point of the chain.
+         */
+        const ack = entry.relayClient?.lastSeenAck(sessionIdHexForAck)
+            ?? this.#lastAck.get(this.#k(agentName, sessionId))
+            ?? (() => { const g = this.#sessionGenesisPrevRoot(agentName, sessionId); return g ? { seq: 0, hash: g } : undefined; })();
+        if (!ack) {
+            /**
+             * ⚠️ **v1, AND ONLY BECAUSE THERE IS NOTHING TO ACKNOWLEDGE — see `#verifyAcknowledgedContent`
+             * for the receiving half of the same rule, which is what makes this safe rather than a
+             * downgrade.**
+             *
+             * Reaching here means this session has no recorded starting point AND has received nothing.
+             * The claim it produces is `last_seen_seq: 0` with no hash: "I have seen nothing of yours, and
+             * I assert nothing about your content." That is honest, and it is not the fail-open the unit
+             * closes — the hole is a claim that names a POSITION with no content behind it, and this names
+             * no position. A receiver refuses a v1 claim the moment it acknowledges position 1 or beyond.
+             *
+             * It does not throw, and an earlier version did. Sessions brokered without a relay assignment
+             * are real — the directory does not always return one — and throwing there stopped those
+             * sessions sending at all, which trades a hole this claim does not have for a failure of the
+             * thing the product is for.
+             */
+            this.#logger.info("session.content.claim.unacknowledged", {
+                agentName, sessionId,
+                impact: "this message is signed with no acknowledgement of anything received, because this " +
+                    "session has no recorded starting point and nothing has arrived on it yet. It binds the " +
+                    "sender and the content as always; it makes no claim about the counterparty's messages.",
+            });
+            const bare = encodeStructure1({
+                contentHash,
+                senderPubkey: await signer.getPublicKey(),
+                sessionId: sessionIdBytes,
+                lastSeenSeq: 0,
+                timestamp: Date.now(),
+            });
+            return { structure1: bare, signature: await signer.sign(bare) };
+        }
+        const structure1 = encodeStructure1({
+            contentHash,
+            senderPubkey: await signer.getPublicKey(),
+            sessionId: sessionIdBytes,
+            // The highest counterparty position this session has seen, from the same source the submit
+            // reads — and now the content hash at it, taken from the same entry so the two cannot
+            // describe different messages.
+            lastSeenSeq: ack.seq,
+            timestamp: Date.now(),
+            lastSeenHash: ack.hash,
+        });
+        return { structure1, signature: await signer.sign(structure1) };
+    }
+    /**
+     * `DOD-M15-AUTHORSHIP-ABSENT-1` — DID THIS SENDER PROVE THEY WROTE THIS MESSAGE?
+     *
+     * The one place that answers it, for both callers, so "checked" cannot mean two different things
+     * in two places. It takes the signature as an ARGUMENT rather than digging it out of a structure,
+     * which is the whole of the fix: the signature used to be read only from `structure2_cbor` — the
+     * RELAY's record — so a receiver could not check authorship without a relay record, and refusing
+     * on its absence would have made the relay a precondition for reading mail. The content frame now
+     * carries the signature beside the bytes it signs, exactly as `hash_submit` always has, and this
+     * method does not care which of the two handed it over.
+     *
+     * It VERIFIES and it does not LOG. The severity of each verdict differs by caller — the content
+     * frame refuses an `unusable`, the park path shrugs at one — and a method that logged its own
+     * conclusion would either report a refusal that did not happen or stay silent on one that did.
+     */
+    #verifyAuthorshipClaim(agentName, sessionId, structure1Cbor, senderSignature, contentHash) {
+        // Structure 1 content_hash is index 1 and sender_pubkey index 2 in BOTH layouts — 020-ACKHASH
+        // appended last_seen_hash at 6 rather than inserting it, so neither read moved. A v2 claim
+        // decodes here exactly as a v1 one does; its hash is not consulted, because this unit ships
+        // reading and not enforcing.
+        const s1 = decodeStructure1(structure1Cbor);
+        // A layout this build cannot name yields no pubkey and no hash, so there is nothing to check the
+        // signature against. Its reason is carried out so an unreadable CLAIM and a wrong SIGNATURE stay
+        // distinguishable — they take the same outcome by different routes.
+        if (!s1.ok)
+            return { verdict: "unusable", reason: s1.reason };
+        const s1Hash = s1.fields.contentHash;
+        const s1Pubkey = s1.fields.senderPubkey;
+        // The SENDER's Ed25519 signature over the exact signed bytes — the same check the relay
+        // performs. `verify` never throws, so a wrong-width or garbage signature lands here as `false`:
+        // supplied and refuted, which is a different fact from not supplied at all.
+        if (!verify(s1Pubkey, structure1Cbor, senderSignature)) {
+            return { verdict: "refuted", reason: "bad_signature" };
+        }
+        // Sovereign-node cross-check: the signer MUST be THIS session's counterparty, not an unrelated
+        // key. Review M1: compare BYTES, not hex strings — `counterparty_pubkey` is stored verbatim from
+        // the IPC param and is never case-normalized, so a string compare would fail for a mixed-case
+        // pubkey and silently strip the canonical ordering from every message in that session.
+        const counterparty = this.getSessionRecord(agentName, sessionId)?.counterparty_pubkey;
+        if (!pubkeyMatchesHex(s1Pubkey, counterparty)) {
+            /**
+             * REFUTED when the counterparty is KNOWN and the signer is someone else.
+             *
+             * This is the session-open MITM detection from the 2026-08-21 T-of-N investigation, which
+             * found this check *"fires correctly, and its answer is thrown away."* A rogue quorum of the
+             * directories holding shares for agent B can sign a false SessionAssignment naming M's key as
+             * B's, and everything downstream is genuinely real — M signs with M's own valid key. Nothing
+             * is missing for A to notice. This comparison is where the substitution shows, because
+             * `counterparty_pubkey` comes from A's own request and is untouched by anything the directory
+             * returns.
+             *
+             * ⚠️ AN EARLIER VERSION OF THIS COMMENT ADDED "it shows only when the record is present" —
+             * true when the proof was optional, and no longer the shape of the code: a content frame with
+             * no checkable proof is refused before it reaches ingest, so M cannot decline to supply one
+             * and be admitted anyway. Rewritten rather than deleted, because that sentence is the evidence
+             * of what the gap was. The park envelope is the remaining path where the ordering record is
+             * genuinely optional, and there the sender's authorship is proven by the envelope's own
+             * signature instead.
+             *
+             * `verified_unmatched` stays soft deliberately: with no counterparty on record we cannot prove
+             * the signer either way, and refusing there would strand a session whose row we failed to read
+             * rather than one that is under attack. It is also the only signal the orphan branch has.
+             */
+            return counterparty
+                ? { verdict: "refuted", reason: "signer_not_counterparty" }
+                : { verdict: "verified_unmatched", senderPubkey: s1Pubkey };
+        }
+        /**
+         * ─── THE BINDING CHECKS RUN LAST, AND THE ORDER IS A SECURITY PROPERTY ───────────────────────
+         *
+         * ⚠️ **THEY USED TO RUN FIRST, AND THAT HANDED THE ATTACKER A FREEZE-SUPPRESSION SWITCH** —
+         * review of `029b`, and it is the finding that mattered most.
+         *
+         * Everything below this line is `unusable`: the message is REFUSED and the session lives.
+         * Everything above it is `refuted`: the session FREEZES. So a check that can answer `unusable`
+         * before the signature has been verified lets a peer choose the softer outcome — flip one
+         * unauthenticated byte of `session_id` inside your own claim and a garbage signature, or a
+         * signature by a MITM's own key, stops being an identity incident and becomes a quiet refusal.
+         * The session-open MITM detection this function exists to serve was bypassable by exactly the
+         * party it detects.
+         *
+         * So the order is: decode → SIGNATURE → SIGNER → then what the proof is about. By the time
+         * either check below runs, the claim provably came from this session's counterparty, and the
+         * only question left is which message and which conversation they made it for.
+         *
+         * `seal-frontier-verify` already does it in this order (verify at :55, session id at :77). This
+         * code had it inverted.
+         */
+        // The claim must bind to THIS content. A signature over somebody else's bytes verifies perfectly
+        // and proves nothing about this message — without this, one signed claim could be replayed onto
+        // every frame that follows it.
+        if (!bytesEqual(s1Hash, contentHash)) {
+            return { verdict: "unusable", reason: AUTHORSHIP_CONTENT_HASH_MISMATCH };
+        }
+        /**
+         * ⚠️ **AND IT MUST BIND TO THIS CONVERSATION** — review M4, ruled in by Andre 2026-09-04.
+         *
+         * Binding the content and the signer is not enough on its own: a claim the counterparty
+         * genuinely signed in another session verifies unchanged here for the same bytes. Not a
+         * stranger and not forged content — a real line of theirs, landing in a transcript it was never
+         * written for, with a signature that checks out. That is worse than an unsigned message,
+         * because the receipt then PROVES something that did not happen.
+         *
+         * `session_id` has been in Structure 1 since v1 and this path never read it.
+         * `seal-frontier-verify` already compares it; the live receive path simply did not.
+         *
+         * **THE TWO VALUES CANNOT DIVERGE, and that is what makes this safe to enforce.** Both are
+         * derived from ONE session id on each side, by construction:
+         *   initiator — `sessionId = hex(assignment.session_id)` (`initiate-session-handler`) and
+         *               `relayParams.sessionIdBytes = assignment.session_id` (`daemon.ts`);
+         *   responder — `acceptSession(parsed.sessionIdHex)` and
+         *               `sessionIdBytes = Buffer.from(parsed.sessionIdHex, "hex")` (`inbound-sessions`);
+         *   direct/persisted — `relaySessionIdBytes = Buffer.from(sessionId, "hex")`.
+         * The two names exist because one keys the in-memory maps and one goes on the wire, not because
+         * they can hold different values. Getting this wrong would refuse EVERY message on EVERY live
+         * session, so it is stated rather than assumed.
+         *
+         * REFUSED, not frozen — and the sentence is TRUE where it now stands. The signature has
+         * verified and the signer has been matched to this session's counterparty three lines above;
+         * what is wrong is only the conversation the claim was made for, which is a replay rather than
+         * an identity fault. Said because an earlier version of this comment made the same claim from
+         * ABOVE the verification, where none of it had happened yet.
+         */
+        const expectedSessionId = this.#activeNodes.get(this.#k(agentName, sessionId))?.relaySessionIdBytes
+            ?? Uint8Array.from(Buffer.from(sessionId, "hex"));
+        if (!bytesEqual(s1.fields.sessionId, expectedSessionId)) {
+            return { verdict: "unusable", reason: AUTHORSHIP_SESSION_MISMATCH };
+        }
+        /**
+         * ─── AND IT MUST ACKNOWLEDGE SOMETHING THAT WAS ACTUALLY SAID — 033-ACKEMIT ──────────────────
+         *
+         * **THIS IS THE HALF THAT NEEDS NO RELAY, and it is the reason the unit exists.** Everything the
+         * check consumes is on this machine: the counterparty's own signed bytes, and our own tree. We
+         * do not ask the relay what position 7 held — we already know, because we placed the leaf there.
+         *
+         * Until now a signed acknowledgement was a NUMBER. "I saw position 7" attests to a position and
+         * never to content, so the only thing binding the acknowledgement to a message was the relay's
+         * separate receipt over `content_hash ‖ seq ‖ timestamp`. Withhold the relay's half and the
+         * signed claim is an unbacked number — which is how a counterparty seals one message short.
+         * With the hash signed, the claim stands on its own and the relay is no longer load-bearing for
+         * it.
+         *
+         * It runs LAST for the reason the two checks above run last: everything from here down answers
+         * `unusable`, which refuses the message and leaves the session alive, while a `refuted` FREEZES
+         * it. A check that could answer before the signature and the signer were established would hand
+         * a peer a switch for choosing the softer outcome. By this line the claim provably came from
+         * this session's counterparty, about this content, in this conversation — the only question
+         * left is whether what they say they saw is what we sent.
+         */
+        const ackVerdict = this.#verifyAcknowledgedContent(agentName, sessionId, s1.fields);
+        if (ackVerdict)
+            return ackVerdict;
+        return { verdict: "verified", senderPubkey: s1Pubkey, senderSig: senderSignature };
+    }
+    /**
+     * Does this claim's `last_seen_hash` name content this side actually put at that position?
+     *
+     * Returns `undefined` when the acknowledgement holds, or the `unusable` verdict to refuse with.
+     * Split out of `#verifyAuthorshipClaim` so the three refusal causes can be named separately —
+     * a claim that carries NO hash, one that names a position we never reached, and one that names
+     * the wrong content — rather than collapsing into a single "the proof was bad".
+     *
+     * ⚠️ MISSING, MALFORMED AND MISMATCHED TAKE ONE PATH (§5). A v1 claim carries no content
+     * assertion at all, and treating that as "fine, skip the check" would recreate the fail-open this
+     * unit is closing one layer down: an attacker who wants to evade a mismatch check simply never
+     * supplies a checkable proof. `decodeStructure1` has already refused a v2 whose hash is the wrong
+     * width, so `lastSeenHash === null` here means exactly one thing — a v1 layout — and it is
+     * refused by its own name.
+     */
+    #verifyAcknowledgedContent(agentName, sessionId, fields) {
+        /**
+         * ⚠️ **A v1 CLAIM IS REFUSED THE MOMENT IT NAMES A POSITION — and accepted when it names none.
+         * The split is the whole rule, so it is stated rather than left to the reader.**
+         *
+         * `last_seen_seq >= 1` with no hash IS the defect: "I saw position 7" attests to a position and
+         * never to content, which is the unbacked number this unit exists to stop accepting. Treating
+         * that as "fine, skip the check" would recreate `DOD-M15-AUTHORSHIP-ABSENT-1` one layer down —
+         * an attacker evading a mismatch check simply never supplies a checkable proof.
+         *
+         * `last_seen_seq === 0` with no hash claims nothing about our messages, so there is no check to
+         * skip and nothing to bind. A sender genuinely in that state — a session brokered without a
+         * relay assignment, which the directory does not always return — has nothing to acknowledge,
+         * and refusing them would stop the product's own advertised journey to close a hole they are
+         * not in.
+         *
+         * **THE BOUND, SAID PLAINLY:** a peer can decline to bind by never acknowledging anything.
+         * That costs them their own ratification of our history rather than falsifying it, and it is
+         * the same under-claiming the relay has always allowed (it refuses a `last_seen_seq` that runs
+         * AHEAD of its counter, never one that lags). This unit does not change that either way, and
+         * the follow-on that does is the receiver submitting a hash for what it received.
+         */
+        if (fields.lastSeenHash === null) {
+            return fields.lastSeenSeq >= 1
+                ? { verdict: "unusable", reason: AUTHORSHIP_ACK_HASH_ABSENT }
+                : undefined;
+        }
+        /**
+         * THE GENESIS IS A VALUE, NEVER AN ABSENCE. The first message of a session has seen nothing, and
+         * that case is a defined 32 bytes — the agreed starting point of this two-party chain, derived
+         * from both keys, the session id and the session timestamp. Not 32 zero bytes: a constant
+         * identical across every session is one an attacker can present for any session, so the one
+         * position most exposed to a forged acknowledgement would be the only one nobody could check.
+         */
+        if (fields.lastSeenSeq <= 0) {
+            const genesis = this.#sessionGenesisPrevRoot(agentName, sessionId);
+            /**
+             * ⚠️ **SOFT HERE, AND THIS IS THE ONE BRANCH WHERE THAT IS NOT A FAIL-OPEN — the reasoning is
+             * the load-bearing part, so it is written down rather than assumed.**
+             *
+             * `last_seen_seq` 0 means "I have received nothing from you", and the hash that goes with it
+             * is the session's agreed starting point. It is a genuine value and this daemon always emits
+             * it — but as a CHECK it is close to redundant, because the thing it establishes (that this
+             * claim was made for THIS session) has already been established three lines above by the
+             * session-id binding, against a value derived from the same session id.
+             *
+             * **What an attacker gains by reaching this branch: nothing.** They cannot skip the real
+             * comparison by claiming 0, because claiming 0 is claiming to have acknowledged NOTHING of
+             * ours — it removes their own ratification of our history rather than falsifying it, and the
+             * positional check below is what a claim about our messages has to survive. And they cannot
+             * cause the absence either: whether we hold a genesis depends on our own assignment and our
+             * own database, never on anything they send.
+             *
+             * The alternative was refusing, and it would have been the wrong kind of strict: a session
+             * restored from a row written before this column existed holds no genesis, and every first
+             * message on it would be refused for something the counterparty did not do.
+             */
+            if (!genesis) {
+                this.#logger.info("session.content.ack_hash.genesis_unavailable", {
+                    agentName, sessionId,
+                    impact: "this message acknowledges nothing yet, and this side holds no recorded starting point " +
+                        "for the session, so the acknowledgement was not compared. The message is accepted: it " +
+                        "is already bound to this conversation by the session id inside the signed bytes.",
+                });
+                return undefined;
+            }
+            return bytesEqual(fields.lastSeenHash, genesis)
+                ? undefined
+                : { verdict: "unusable", reason: AUTHORSHIP_ACK_HASH_MISMATCH };
+        }
+        /**
+         * ─── THE ACKNOWLEDGED CONTENT MUST BE SOMETHING THIS SIDE ACTUALLY HOLDS ─────────────────────
+         *
+         * ⚠️ **AN EARLIER VERSION OF THIS CHECK WAS POSITION-ONLY AND HAD A HOLE THE ATTACKER COULD
+         * OPEN THEMSELVES. It is kept described, not deleted, because the false reasoning is the part
+         * worth not repeating.**
+         *
+         * It compared `hashAt(last_seen_seq - 1)` and WAIVED the whole comparison on a session marked
+         * diverged, on this stated ground: *"Who controls this absence? Not the peer: divergence is
+         * caused by OUR submit failing, and nothing the counterparty sends can produce it."*
+         *
+         * **That was false, and the party who could falsify it is the exact attacker this line names.**
+         * Send a message direct-only and never submit its hash: we have no ordering record, so it is
+         * appended at the tail and our tree runs one ahead of the relay's counter. Our very next send
+         * then gets an assigned position BEHIND our frontier, `placeOwnLeaf` takes its
+         * `position_behind_frontier` branch and calls `markSessionDiverged` — and from that moment every
+         * inbound acknowledgement skipped the check entirely. **One withheld message plus one reply from
+         * us disabled the guard, using the behaviour the guard exists to catch.**
+         *
+         * A second defect sat beside it: a claim naming a position our tree has not reached was refused
+         * outright, and a HELD own leaf is exactly that — `placeOwnLeaf` returns `{placed: false}` when
+         * the relay hands us a position ahead of our tail, so the leaf is not in the tree while the
+         * counterparty has already received it and is acknowledging it. We refused their reply for a
+         * transient gap on our own machine.
+         *
+         * **So the question asked is now about CONTENT, not about an index.** Is the hash they name
+         * something this side has — placed in the tree, or held pending a gap? That cannot be switched
+         * off by divergence (it consults no positions), it cannot false-refuse a held leaf, and it still
+         * refuses a hash we have never held, which is the falsehood the check exists to catch.
+         *
+         * The POSITION is then used only to make the check STRONGER where it is safe to: on a session
+         * whose indices still mean relay positions, the hash must sit exactly where they say it does.
+         * Divergence loses that strengthening and keeps the membership test, rather than losing both.
+         */
+        const tree = this.getSessionTree(agentName, sessionId);
+        const ackHex = Buffer.from(fields.lastSeenHash).toString("hex");
+        const heldHere = this.#heldContent.get(this.#k(agentName, sessionId));
+        const held = heldHere ? [...heldHere.values()].some((e) => e.contentHashHex === ackHex) : false;
+        if (tree.indexOfHash(ackHex) === -1 && !held) {
+            return { verdict: "unusable", reason: AUTHORSHIP_ACK_HASH_UNKNOWN };
+        }
+        /**
+         * THE POSITIONAL STRENGTHENING. Skipped — with a WARN, never silently — when this side's indices
+         * no longer mean relay positions, or when the leaf at that position is still held. Neither is
+         * a pass: the membership test above has already run and refused anything we do not hold.
+         */
+        const atPosition = tree.hashAt(fields.lastSeenSeq - 1);
+        if (this.isSessionDiverged(agentName, sessionId) || atPosition === null) {
+            this.#logger.warn("session.content.ack_hash.position_unverifiable", {
+                agentName, sessionId, lastSeenSeq: fields.lastSeenSeq,
+                diverged: this.isSessionDiverged(agentName, sessionId),
+                impact: "the acknowledged content IS in this side's record, so the claim was accepted — but its " +
+                    "POSITION was not checked, because this session's local positions no longer line up with " +
+                    "the relay's, or the leaf at that position has not been placed yet.",
+            });
+            return undefined;
+        }
+        return ackHex === atPosition
+            ? undefined
+            : { verdict: "unusable", reason: AUTHORSHIP_ACK_HASH_MISMATCH };
+    }
+    /**
+     * `DOD-M15-AUTHORSHIP-ABSENT-1` — the refusal an inbound frame gets when its authorship cannot be
+     * established. NOT a freeze: see `AuthorshipVerdict` for why those are different facts.
+     *
+     * Both surfaces, always. The ERROR is the durable forensic record an investigation reads days
+     * later; the notice is the CONTROL — the thing that actually reaches the operator, who otherwise
+     * watches a conversation go quiet and concludes the other person stopped replying.
+     */
+    #refuseUnprovenAuthorship(agentName, sessionId, reason, contentHash, detail, correlationId) {
+        /**
+         * ⚠️ **THREE REASONS, THREE SENTENCES — AND THE THIRD USED TO BORROW THE SECOND'S** (review of
+         * `029b`, and it is the operator half of the same finding as the check order).
+         *
+         * A replayed claim is the one branch on this path that is potentially ADVERSARIAL: a real,
+         * valid, correctly-signed line of your counterparty's, presented in a conversation it was not
+         * written for. It was reaching the operator under the `unusable` wording, which says the proof
+         * was "unreadable, or signed over different content" — neither is true — and under guidance
+         * telling them to go and ask their counterparty to upgrade. A version number is not the
+         * question, and sending someone to chase one spends their attention on the wrong thing.
+         */
+        const impact = reason === "authorship_proof_absent"
+            ? "a message arrived carrying no proof of who wrote it, so it was NOT ingested, NOT shown and NOT attributed to anyone. Every message in this conversation has to be provable to whoever reads its receipt later, and this one could not be."
+            : reason === "authorship_wrong_conversation"
+                ? "a message arrived carrying a VALID signature by this conversation's counterparty — made for a DIFFERENT conversation. The same message, or an old one of theirs, was presented here. It was NOT ingested, NOT shown and NOT added to this conversation's record."
+                /**
+                 * 033-ACKEMIT. Says what was OBSERVED — the two records disagree about what was said —
+                 * and stops there. It does NOT say the counterparty is lying: the same signal is what a
+                 * genuine fault on their side looks like, and naming a conclusion the code did not reach
+                 * is the error-fidelity defect this milestone was opened for.
+                 */
+                /**
+                 * ⚠️ THREE CAUSES, THREE SENTENCES — review F5. They shared one, and it described none of
+                 * them properly: an ABSENT acknowledgement has no part that "does not match", because it
+                 * has no part at all.
+                 *
+                 * All three say what was OBSERVED and stop there. None says the counterparty is lying:
+                 * the same signal is what a genuine fault on their side looks like, and naming a
+                 * conclusion the code did not reach is the error-fidelity defect this milestone exists
+                 * for.
+                 */
+                : reason === AUTHORSHIP_ACK_HASH_ABSENT
+                    ? "a message arrived that is genuinely from your counterparty and genuinely about this conversation — and it does not say which of your messages they had received. Their build is older than yours: a message has to say what it is answering, so that nobody can later leave your last message out of the receipt. It was NOT ingested and NOT shown."
+                    : reason === AUTHORSHIP_ACK_HASH_MISMATCH
+                        ? "a message arrived that is genuinely from your counterparty — and it names a DIFFERENT message of yours in the position where your own record holds one. Both sides agree the message exists; you disagree about which one sits there. It was NOT ingested and NOT shown."
+                        : reason === AUTHORSHIP_ACK_HASH_UNKNOWN
+                            ? "a message arrived that is genuinely from your counterparty — and it says they received something from you that this side has no record of ever holding. It was NOT ingested and NOT shown. This is the check that stops someone quietly rewriting what was said before the receipt is made."
+                            : "a message arrived whose proof of authorship could not be checked against it — it was unreadable, or it was signed over different content. It was NOT ingested, NOT shown and NOT attributed to anyone.";
+        /**
+         * ⚠️ THE VERB IS THE COUNTERPARTY'S, AND THE GUIDANCE SAYS SO. The reader is the RECEIVING
+         * operator, and there is nothing on their machine to change — the missing signature is produced
+         * on the sender's. Telling them to do something local would be an affordance that resolves to
+         * nothing. So it names the one move that works (tell them to upgrade) and the one that settles
+         * the other explanation (confirm out of band), and it stops at two.
+         *
+         * ⚠️ **IT USED TO OPEN "Nothing was shown and nothing was stored." THAT SENTENCE WAS FALSE** —
+         * review H1, and it is kept here rather than deleted because it is the exact shape this
+         * milestone exists to catch: a refusal that announces a stronger outcome than it delivers.
+         *
+         * Refusing sends no delivery ACK, so the sender's TTF backstop parks the message and it arrives
+         * through the relay mailbox seconds later, where the ENVELOPE's signature authenticates it and
+         * recovery accepts it — correctly, and with no per-message proof. So the message may well be
+         * delivered, moments after the operator was told it was not. The reconciliation is logged
+         * (`content.recover.refusal_reconciled`) and the sentence below now says what is
+         * actually true of this path: nothing was shown YET, and this refusal does not stop the copy
+         * coming the other way.
+         */
+        const guidance = reason === "authorship_wrong_conversation"
+            ? "STOPPED ON PURPOSE, and this one is NOT a version problem — do not go and ask them about " +
+                "their build. The signature is real and it is theirs; what is wrong is that it was made for " +
+                "another conversation, so something replayed it into this one. That is either software on " +
+                "one of your machines re-sending an old message into the wrong session, or someone in " +
+                "between doing it deliberately. ONE thing to do: ask your counterparty OUT OF BAND (a " +
+                "channel that is not this one) whether they meant to send this, before you continue here."
+            /**
+             * ⚠️ **THIS BRANCH SHIPPED AS `NaNcopy in the relay mailbox…` AND NOTHING NOTICED** — review
+             * F1, and it is worth more than the one-line fix.
+             *
+             * Splitting the guidance in two dropped the opening literal and left behind the `+` that had
+             * joined it, which is not a concatenation with nothing on its left — it is a UNARY PLUS on the
+             * next string. `+"REACH YOU BY…"` is `NaN`, and `NaN + "copy in the relay mailbox…"` is a
+             * perfectly good string. So the flagship refusal of this whole milestone reached the operator
+             * beginning mid-word with `NaN`, with its "STOPPED ON PURPOSE" framing and its reason gone.
+             *
+             * **The test was green because it asked the wrong question.** The only assertion on this
+             * string was `.toMatch(/upgrade/i)`, and "tell them to upgrade" survives at the tail. A
+             * substring match on a sentence cannot see that the sentence lost its head — so the assertion
+             * below pins what it OPENS with, which a truncation cannot survive.
+             */
+            /**
+             * 033-ACKEMIT — TWO PATHS, AND THE FIRST IS THE ONE THAT ACTUALLY HAPPENS.
+             *
+             * Capped at two (Invariant 4): an affordance list that enumerates everything is a menu. The
+             * verb is the counterparty's in both cases — there is nothing to change on this machine — so
+             * it names the one move that fixes the likely cause and the one that settles the other.
+             */
+            /**
+             * ⚠️ AND THREE REMEDIES, because the shared one was WRONG for two of the three. It told the
+             * reader their counterparty's build was probably old — which is impossible for a claim that
+             * carries an acknowledgement, since only a newer build sends one — and then told them to
+             * abandon the conversation. Two is the cap on each (Invariant 4); the verb is the
+             * counterparty's in every case, because there is nothing to change on this machine.
+             */
+            : reason === AUTHORSHIP_ACK_HASH_ABSENT
+                ? "STOPPED ON PURPOSE, and this is NOT about their signature — it verified. " +
+                    (this.#mailboxRouteAvailable(agentName) ? REFUSAL_MAY_STILL_ARRIVE : REFUSAL_NO_OTHER_ROUTE) +
+                    " Their build is older than yours and does not say what it has received. Ask which version " +
+                    "they are running and tell them to upgrade — only they can fix it, and this will keep " +
+                    "happening until they do."
+                : reason === AUTHORSHIP_ACK_HASH_MISMATCH || reason === AUTHORSHIP_ACK_HASH_UNKNOWN
+                    ? "STOPPED ON PURPOSE, and this is NOT about their signature or their version — both are " +
+                        "fine. " +
+                        (this.#mailboxRouteAvailable(agentName) ? REFUSAL_MAY_STILL_ARRIVE : REFUSAL_NO_OTHER_ROUTE) +
+                        " Your record of this conversation and theirs have stopped agreeing about what you sent " +
+                        "them. Confirm with them OUT OF BAND what they actually received from you. If it matches " +
+                        "what you sent, this was a fault and a new session will clear it; if it does not, do not " +
+                        "carry on in this one."
+                    : "STOPPED ON PURPOSE. This copy was refused and the message itself was not kept. " +
+                        // Review F2: chosen from what THIS machine can do, not asserted. An agent with no identity
+                        // key cannot open a mailbox copy either, and telling them to wait for one would be the same
+                        // false promise on a different refusal.
+                        (this.#mailboxRouteAvailable(agentName) ? REFUSAL_MAY_STILL_ARRIVE : REFUSAL_NO_OTHER_ROUTE) +
+                        " Almost always their CELLO build is older than this one: a build from before message signing " +
+                        "does not attach a signature at all. Ask which version they are running, and tell them to " +
+                        "upgrade — this will keep happening until they do, and only they can fix it. If they are on " +
+                        "the SAME version as you, that explanation does not hold: confirm with them OUT OF BAND " +
+                        "before opening another session.";
+        this.#logger.error("session.content.refused", {
+            agentName, sessionId, correlationId, reason, ...detail, impact, guidance,
+        });
+        this.noteContentRefusal(agentName, sessionId, reason, { kind: REFUSAL_KINDS.REFUSED, impact, guidance });
+        // Armed AFTER the refusal is filed, so the memo can never claim a refusal that did not happen.
+        this.#noteRefusedOnDirectPath(agentName, sessionId, contentHash);
+    }
+    /**
+     * An inbound content frame refused before it could be read — the ENCRYPTION gate's three causes.
+     *
+     * ⚠️ **THESE LOGGED AND FILED NOTHING, AND THAT IS WHY THIS EXISTS.** All three carried a good
+     * `impact` and `guidance` at ERROR and none of them called `noteContentRefusal`, so the sentences
+     * an operator needed were in a file they have no reason to open. From their chair a message never
+     * arrived and the conversation went quiet — the exact defect `DOD-M15-NO-SILENT-REFUSAL-1` was
+     * built to end, on the same path, three checks above the one that respected it.
+     *
+     * Both surfaces, always: the ERROR is the durable forensic record an investigation reads days
+     * later, and the notice is the control — the thing that actually reaches the person.
+     */
+    /**
+     * Can a refused message still reach this operator through the relay mailbox? — review F2.
+     *
+     * Feature-detected, not assumed: `openContentSeal` is documented OPTIONAL on `KeyProvider`, and
+     * `content-park.ts` refuses recovery without it. Asking the same resolver `content-park.ts` asks
+     * is what keeps the sentence on the operator's screen tied to what their machine can actually do.
+     */
+    #mailboxRouteAvailable(agentName) {
+        const kp = this.#keyProviderResolver?.(agentName);
+        return kp !== undefined && typeof kp.openContentSeal === "function";
+    }
+    #refuseInboundContent(agentName, sessionId, reason, contentHash, detail, correlationId) {
+        // The sentence about the other route is chosen HERE, from what this machine can actually do —
+        // never written into a caller's literal, where it would be a promise nobody re-checked.
+        const guidance = `${detail.guidance} ${this.#mailboxRouteAvailable(agentName) ? REFUSAL_MAY_STILL_ARRIVE : REFUSAL_NO_OTHER_ROUTE}`;
+        this.#logger.error("session.content.refused", { agentName, sessionId, correlationId, reason, ...detail, guidance });
+        this.noteContentRefusal(agentName, sessionId, reason, {
+            kind: REFUSAL_KINDS.REFUSED, impact: detail.impact, guidance,
+        });
+        /**
+         * Review F4 — A PROMISE MADE HERE IS CLOSED IN `recoverParkedEntry`, not left standing.
+         *
+         * The guidance above tells the operator the message may arrive by the mailbox. Both sibling
+         * refusals on this path already arm a memo so the recovery can say the refusal did not hold;
+         * this one armed nothing, so a delivered message would have left a permanent alarm sitting in
+         * `cello_check_notifications` saying it had been turned away.
+         *
+         * Armed AFTER the notice is filed, so the memo can never claim a refusal that did not happen.
+         */
+        this.#noteRefusedOnDirectPath(agentName, sessionId, contentHash);
+    }
     #recordFrameOrdering(agentName, sessionId, structure1Cbor, structure2Cbor, contentHash, correlationId, source = "content_frame") {
         try {
-            // Structure 1 content_hash is index 1 and sender_pubkey index 2 in BOTH layouts — 020-ACKHASH
-            // appended last_seen_hash at 6 rather than inserting it, so neither read moved. A v2 claim
-            // decodes here exactly as a v1 one does; its hash is not consulted, because this unit ships
-            // reading and not enforcing.
-            const s1 = decodeStructure1(structure1Cbor);
             const s2 = decode(structure2Cbor);
-            const s1Hash = s1.ok ? s1.fields.contentHash : undefined;
-            const s1Pubkey = s1.ok ? s1.fields.senderPubkey : undefined;
             const seq = typeof s2?.[0] === "number" ? s2[0] : -1;
             const s2Sig = s2?.[3];
-            if (!(s1Hash instanceof Uint8Array) || !(s1Pubkey instanceof Uint8Array) || !(s2Sig instanceof Uint8Array) || seq < 1) {
+            if (!(s2Sig instanceof Uint8Array) || seq < 1) {
                 // SOFT: we could not read the record, so we learned nothing about the signer either way.
                 // Position falls back to the witness stream, exactly as an absent record does.
                 // The Structure 1 reason is carried so an unreadable RECORD and an unnamed LAYOUT are
                 // distinguishable in the log — they arrive at the same soft outcome by different routes.
+                const s1Layout = decodeStructure1(structure1Cbor);
                 this.#logger.warn("session.content.ordering.malformed", {
                     sessionId,
                     correlationId,
-                    ...(s1.ok ? {} : { structure1Reason: s1.reason }),
+                    ...(s1Layout.ok ? {} : { structure1Reason: s1Layout.reason }),
                 });
                 return { seq: null };
             }
-            // The framed ordering record must bind to THIS content (its hash) — else it orders the wrong bytes.
-            const contentHashHex = Buffer.from(contentHash).toString("hex");
-            if (Buffer.from(s1Hash).toString("hex") !== contentHashHex) {
-                // SOFT: the record does not describe this content. Nothing is proven about the signer's
-                // identity — only that this record and these bytes do not belong together.
-                this.#logger.warn("session.content.ordering.hash_mismatch", { sessionId, correlationId });
+            /**
+             * `DOD-M15-AUTHORSHIP-ABSENT-1` — the same verifier the content frame uses, handed the
+             * signature the RELAY committed (`structure2_cbor` index 3) instead of the one the frame
+             * carries. Two claims about the same message, and both must hold: if the relay's copy of the
+             * sender's signature does not verify against the bytes on the frame, one of them has been
+             * altered in flight.
+             *
+             * The verdicts map to this path's own severities, which are NOT the content frame's:
+             * an `unusable` record leaves POSITION unknown and is soft here, because position may always
+             * fall back to the witness stream. Identity is the half that may never be soft, and it is
+             * established before this is called.
+             */
+            const auth = this.#verifyAuthorshipClaim(agentName, sessionId, structure1Cbor, s2Sig, contentHash);
+            if (auth.verdict === "unusable") {
+                /**
+                 * ⚠️ **THE ACK CAUSES REACH THIS PATH TOO, AND THEY ARE NOT A DECODER PROBLEM** — review F7.
+                 *
+                 * `#verifyAuthorshipClaim` has two callers. This one is reached from park RECOVERY, where
+                 * it is the only authorship check that runs — so 033-ACKEMIT's acknowledgement causes
+                 * started arriving here and fell into the generic `else` below, which logs
+                 * `…ordering.malformed` and buries the cause in `structure1Reason`. That event name sends
+                 * the next reader to audit a decoder for a record that decoded perfectly.
+                 *
+                 * SOFT, like every other `unusable` on this path, and deliberately: position may always
+                 * fall back to the witness stream, and a recovered parked message is authenticated by the
+                 * ENVELOPE's own signature rather than by this. What changes is that the log says which
+                 * thing disagreed.
+                 */
+                if (ACK_HASH_REASONS.has(auth.reason)) {
+                    this.#logger.warn("session.content.ordering.ack_hash_unverified", {
+                        sessionId, correlationId, reason: auth.reason,
+                        impact: "a recovered message's acknowledgement of what its sender had received does not " +
+                            "reconcile with this side's record, so no canonical POSITION was taken from it. The " +
+                            "message itself is authenticated by its park envelope and is not refused here.",
+                    });
+                }
+                else if (auth.reason === AUTHORSHIP_CONTENT_HASH_MISMATCH) {
+                    // SOFT: the record does not describe this content. Nothing is proven about the signer's
+                    // identity — only that this record and these bytes do not belong together.
+                    this.#logger.warn("session.content.ordering.hash_mismatch", { sessionId, correlationId });
+                }
+                else if (auth.reason === AUTHORSHIP_SESSION_MISMATCH) {
+                    // Its own name, because `…malformed` points a reader at a decoder and this record decoded
+                    // perfectly — it belongs to another conversation. Unreachable in practice on this path:
+                    // `authenticateParkedEntry` binds `session_id` in the park TBS before anything is
+                    // unsealed, so a mismatched record cannot get this far. Named anyway, because an event
+                    // that lies about its cause is worse the day it does fire.
+                    this.#logger.warn("session.content.ordering.session_mismatch", { sessionId, correlationId });
+                }
+                else {
+                    this.#logger.warn("session.content.ordering.malformed", {
+                        sessionId, correlationId, structure1Reason: auth.reason,
+                    });
+                }
                 return { seq: null };
             }
-            // Verify the SENDER's Ed25519 signature over the exact signed bytes (structure1_cbor) — the same
-            // check the relay performs. Proves the counterparty committed to this (content_hash @ sequence).
-            if (!verify(s1Pubkey, structure1Cbor, s2Sig)) {
+            if (auth.verdict === "refuted" && auth.reason === "bad_signature") {
                 // FATAL. The sender supplied a signature and it does not verify against the key inside its
                 // own record. That is not an absence we could not resolve — it is a proof that failed.
                 this.#logger.warn("session.content.ordering.bad_signature", { sessionId, correlationId });
@@ -13494,55 +15161,23 @@ export class SessionNodeManager {
             // key. FAIL CLOSED (review L) — if the counterparty pubkey is unknown we cannot prove the signer,
             // so we do NOT trust the framed ordering record (fall back to the witness stream / arrival). The
             // "B does not trust the counterparty for ordering" invariant is non-negotiable; never fail open.
-            // Review M1: compare BYTES, not hex strings — `counterparty_pubkey` is stored verbatim from the
-            // IPC param and is never case-normalized, so a string compare would fail for a mixed-case
-            // pubkey and silently strip the canonical ordering from every message in that session.
-            const counterparty = this.getSessionRecord(agentName, sessionId)?.counterparty_pubkey;
-            if (!pubkeyMatchesHex(s1Pubkey, counterparty)) {
+            if (auth.verdict !== "verified") {
                 /**
-                 * FATAL when the counterparty is KNOWN and the signer is someone else. SOFT when we simply
-                 * do not know who the counterparty is.
+                 * FATAL when the counterparty is KNOWN and the signer is someone else (`refuted`). SOFT when
+                 * we simply do not know who the counterparty is (`verified_unmatched`) — the reasoning for
+                 * both, and the MITM substitution this catches, lives on `#verifyAuthorshipClaim`.
                  *
-                 * The fatal half is the session-open MITM detection from the 2026-08-21 T-of-N
-                 * investigation, which found this check *"fires correctly, and its answer is thrown away."*
-                 * A rogue quorum of the directories holding shares for agent B can sign a false
-                 * SessionAssignment naming M's key as B's, and everything downstream is genuinely real —
-                 * M signs with M's own valid key. Nothing is missing for A to notice. This comparison is
-                 * where the substitution shows, because `counterparty_pubkey` comes from A's own request
-                 * and is untouched by anything the directory returns.
-                 *
-                 * ⚠️ IT SHOWS ONLY WHEN THE RECORD IS PRESENT (review F3). An earlier version of this
-                 * comment said this was "the one place the substitution shows", full stop — and that
-                 * asserted a property the code does not have: M can decline to supply an ordering record
-                 * and be ingested without ever reaching this line. The caller logs
-                 * `session.content.ordering.absent` so the weaker case is at least visible, and closing it
-                 * needs a check that does not depend on the sender's cooperation — the relay's independent
-                 * copy, `DOD-M15-CORROBORATE-1`.
-                 *
-                 * The soft half stays soft deliberately: `counterparty_unknown` means we cannot prove the
-                 * signer either way, and refusing there would strand sessions whose record we failed to
-                 * read rather than sessions that are under attack.
+                 * The soft half is the one that matters HERE: `counterparty_unknown` means we cannot prove
+                 * the signer either way, so we decline to take a POSITION from a record we cannot attribute,
+                 * and the caller falls back to the witness stream. Nothing about the message is refused on
+                 * this path — that decision was already made, on the frame's own proof.
                  */
-                const reason = counterparty ? "signer_not_counterparty" : "counterparty_unknown";
+                const reason = auth.verdict === "refuted" ? auth.reason : "counterparty_unknown";
                 this.#logger.warn("session.content.ordering.wrong_signer", { sessionId, reason, correlationId });
-                /**
-                 * 024-ORPHANTRIAGE — THE VERIFIED SIGNER SURVIVES THE SESSION LOOKUP NOW.
-                 *
-                 * The `verify(...)` three lines above has already passed: whoever produced this record holds
-                 * the private key for the key inside their own signed bytes. That is session-independent —
-                 * it needs no `sessions` row and never did. The soft branch then threw it away, so the
-                 * orphan branch downstream had nothing to go on and told the operator to go and talk to
-                 * whoever sent it.
-                 *
-                 * Carried out only on the `counterparty_unknown` half. The fatal half needs nothing: the
-                 * session freezes and no triage runs.
-                 */
-                return counterparty
-                    ? { seq: null, fatal: { reason } }
-                    : { seq: null, verifiedSignerUnmatched: s1Pubkey };
+                return auth.verdict === "refuted" ? { seq: null, fatal: { reason } } : { seq: null };
             }
             // Verified — record the relay-assigned canonical sequence (1-based → 0-based leaf index) for the gate.
-            this.recordWitnessedSequence(agentName, sessionId, contentHashHex, seq - 1);
+            this.recordWitnessedSequence(agentName, sessionId, Buffer.from(contentHash).toString("hex"), seq - 1);
             this.#logger.info("session.content.ordering.recorded", {
                 sessionId,
                 canonicalSeq: seq - 1,
@@ -13550,18 +15185,15 @@ export class SessionNodeManager {
                 correlationId,
             });
             /**
-             * DOD-M15-SEALWIRE-1 bullet 5: return the VERIFIED proof, not just the position.
+             * THE POSITION, AND ONLY THE POSITION — `DOD-M15-AUTHORSHIP-ABSENT-1`.
              *
-             * Three lines above, `verify(s1Pubkey, structure1Cbor, s2Sig)` has already passed and the
-             * signer has been matched to this session's counterparty. That is the strongest statement
-             * this daemon ever makes about who wrote a message — and until now it was made, used to
-             * decide a sequence number, and then discarded. The transcript row that outlives it recorded
-             * only a direction.
-             *
-             * Returned rather than stashed, for the same reason `seq` is: a caller that has to go looking
-             * for it in a side map is a caller that will not.
+             * `DOD-M15-SEALWIRE-1` bullet 5 had this return the verified proof as well, because this was
+             * the only place a signer was ever checked and the transcript row needed it from somewhere.
+             * The frame now carries the sender's signature beside the bytes it signs and the caller
+             * verifies it before calling this at all, so the proof reaches the transcript from there. What
+             * this answers is the question it is named for: WHERE the relay says this message sits.
              */
-            return { seq: seq - 1, senderPubkey: s1Pubkey, senderSig: s2Sig };
+            return { seq: seq - 1 };
         }
         catch (err) {
             this.#logger.warn("session.content.ordering.decode_failed", {
@@ -13803,40 +15435,37 @@ export class SessionNodeManager {
             const encState = this.#contentEncryptionState(agentName, sessionId);
             let plaintextBody;
             if (declaredEncryption !== SESSION_CONTENT_ENCRYPTION_V1) {
-                this.#logger.error("session.content.refused", {
-                    agentName, sessionId, correlationId,
-                    reason: "content_encryption_absent_or_unknown",
+                this.#refuseInboundContent(agentName, sessionId, "content_encryption_absent_or_unknown", contentHash, {
                     declared: typeof declaredEncryption === "string" ? declaredEncryption : "(absent)",
-                    impact: "the frame did not say it was encrypted under this session's key, so it was refused unread. Nothing was shown and nothing was stored.",
+                    impact: "the frame did not say it was encrypted under this session's key, so it was refused unread — nothing was shown and this copy was not kept.",
                     guidance: "STOPPED ON PURPOSE. A message arrived that was not encrypted under this session's key. " +
                         "This build never sends one, so either something between you rewrote the frame, or your " +
                         "counterparty is running something that is not CELLO. Confirm with them OUT OF BAND " +
                         "before opening another session.",
-                });
+                }, correlationId);
                 return;
             }
             if (encState.key === null) {
-                this.#logger.error("session.content.refused", {
-                    agentName, sessionId, correlationId,
-                    reason: "no_session_key",
+                this.#refuseInboundContent(agentName, sessionId, "no_session_key", contentHash, {
                     detail: encState.reason,
                     impact: "an encrypted message arrived and this side has no agreed key to open it, so it was refused unread rather than shown as garbage.",
-                    guidance: CONTENT_ENCRYPTION_GUIDANCE[encState.reason],
-                });
+                    // Review F6: the RECEIVE-side wording. The send-side table explains what became of a
+                    // message this operator sent, which is the wrong direction entirely for a message they
+                    // cannot open.
+                    guidance: CONTENT_ENCRYPTION_INBOUND_GUIDANCE[encState.reason],
+                }, correlationId);
                 return;
             }
             const opened = openSessionContent(encState.key, contentBytes);
             if (opened === null) {
                 // GCM's tag is the only thing separating "not for us" from "modified in flight", and this
                 // side must not branch on which — that would be branching on attacker-controlled input.
-                this.#logger.error("session.content.refused", {
-                    agentName, sessionId, correlationId,
-                    reason: "decrypt_failed",
+                this.#refuseInboundContent(agentName, sessionId, "decrypt_failed", contentHash, {
                     impact: "the message did not decrypt under this session's agreed key — it was modified in flight, or it was encrypted under a different key. Refused unread.",
-                    guidance: "STOPPED ON PURPOSE. Nothing was shown and nothing was stored. A message that fails this " +
-                        "check has either been altered on its way to you or was not encrypted for this session. " +
-                        "Confirm with your counterparty OUT OF BAND, then start a new session.",
-                });
+                    guidance: "STOPPED ON PURPOSE. Nothing was shown and this copy was not kept. A message that fails " +
+                        "this check has either been altered on its way to you or was not encrypted for this " +
+                        "session. Confirm with your counterparty OUT OF BAND, then start a new session.",
+                }, correlationId);
                 return;
             }
             plaintextBody = opened;
@@ -13854,6 +15483,12 @@ export class SessionNodeManager {
             // different fact, and it is now refused.
             const s1Cbor = frame["structure1_cbor"];
             const s2Cbor = frame["structure2_cbor"];
+            /**
+             * `DOD-M15-AUTHORSHIP-ABSENT-1` — the sender's own signature, carried BESIDE the bytes it
+             * signs, exactly as `hash_submit` has always carried it. This field is why identity no longer
+             * depends on the relay: it arrives whether or not a relay witnessed the message.
+             */
+            const senderSig = frame["sender_signature"];
             let framedSeq = null;
             /**
              * DOD-M15-SEALWIRE-1 bullet 5. Set ONLY when the ordering record verified — the signature
@@ -13869,37 +15504,108 @@ export class SessionNodeManager {
              * session record exists, so this stays `undefined` and nothing reads it.
              */
             let verifiedSignerUnmatched;
-            if (s1Cbor instanceof Uint8Array && s2Cbor instanceof Uint8Array) {
+            /**
+             * ─── NO PASSPORT, NO ENTRY — `DOD-M15-AUTHORSHIP-ABSENT-1` ───────────────────────────────
+             *
+             * ⚠️ **THIS COMMENT USED TO SAY THE OPPOSITE, AND THE SENTENCE IT REPLACES IS THE DEFECT.**
+             * It read: *"it means the per-message signer check is **opt-in for the sender** — a party that
+             * passed the peer gate and wants to avoid the comparison simply omits the proof."* That was an
+             * accurate description of the code, which is why it is rewritten here rather than deleted: it
+             * is the sentence a reader with a coding agent finds, and it must now describe what the code
+             * does. A frame that supplies nothing checkable is REFUSED. Omitting the proof buys the sender
+             * nothing except a message that does not arrive.
+             *
+             * The old reasoning was sound as far as it went — the signature was only ever DELIVERED inside
+             * the relay's Structure 2, so refusing on its absence would have made the relay a precondition
+             * for reading mail. It stopped one field short: the signature travels beside the bytes it
+             * signs now, on every content frame, so identity no longer needs the relay and position still
+             * does not require identity.
+             *
+             * ⚠️ REFUSED, NOT FROZEN. A frozen session is only cleared by opening a new one, and the
+             * overwhelmingly likely cause of an absent proof is a counterparty on an older build. The
+             * freeze is for a proof that FAILED (below, and in `#recordFrameOrdering`) — a positive fact
+             * about their key.
+             */
+            if (!(s1Cbor instanceof Uint8Array) || !(senderSig instanceof Uint8Array)) {
+                this.#refuseUnprovenAuthorship(agentName, sessionId, "authorship_proof_absent", contentHash, {
+                    // WHICH half is missing. A sender on an older build supplies neither; a stripped frame is
+                    // likelier to be missing one, and an investigator should not have to guess which.
+                    hasStructure1: s1Cbor instanceof Uint8Array,
+                    hasSenderSignature: senderSig instanceof Uint8Array,
+                }, correlationId);
+                return;
+            }
+            const authorship = this.#verifyAuthorshipClaim(agentName, sessionId, s1Cbor, senderSig, contentHash);
+            if (authorship.verdict === "refuted") {
+                /**
+                 * THE FORENSIC LINE, BEFORE THE FREEZE. `session.content.identity.frozen` records that a
+                 * session was stopped; this records WHICH check stopped it and on WHICH proof — the frame's
+                 * own signature, not the relay's copy of it. The two used to be the same event because there
+                 * was only one place a signer was checked; there are two now, and an investigation that
+                 * cannot tell them apart is looking at the wrong half of the wire.
+                 */
+                this.#logger.warn("session.content.authorship.refuted", {
+                    agentName, sessionId, correlationId, reason: authorship.reason,
+                    impact: "a message arrived with a proof of authorship that FAILED — it does not verify, or it is signed by a key that is not this session's counterparty. Nothing was ingested and the session is being frozen.",
+                });
+                await this.#freezeOnIdentityFailure(agentName, sessionId, authorship.reason, correlationId);
+                return;
+            }
+            if (authorship.verdict === "unusable") {
+                // A replayed claim gets its own name on BOTH surfaces, not just in the log context: it is
+                // the one `unusable` cause that may be adversarial, and it is the one the operator can act
+                // on. The others are a peer whose build or bytes we could not read.
+                /**
+                 * 033-ACKEMIT — AND THE THREE ACKNOWLEDGEMENT CAUSES GET THEIR OWN SURFACE REASON, for the
+                 * same argument that gave the replay one: `authorship_proof_unusable` tells the operator the
+                 * proof was "unreadable, or signed over different content", and for these it is neither.
+                 * The proof is perfect; what it CLAIMS TO HAVE SEEN is wrong. Filing them under the generic
+                 * name would send someone to audit a decoder, and would spend the operator's attention
+                 * asking their counterparty about a version number that is not the question.
+                 */
+                this.#refuseUnprovenAuthorship(agentName, sessionId, authorship.reason === AUTHORSHIP_SESSION_MISMATCH
+                    ? "authorship_wrong_conversation"
+                    : ACK_HASH_REASONS.has(authorship.reason)
+                        /**
+                         * ⚠️ THE SPECIFIC CAUSE, NOT THE CLASS — review F5, and the diff's own comment on
+                         * `ACK_HASH_REASONS` had already said why: "the operator's next move differs for
+                         * each." It then collapsed all three into ONE surface reason carrying ONE sentence,
+                         * so the three names survived only in a log field nobody reads. For an absent
+                         * acknowledgement the shared impact was flatly false — there is no part that "does
+                         * not match", because there is no part — and for the other two the shared guidance
+                         * sent the reader to ask about a build version that cannot be the cause.
+                         */
+                        ? authorship.reason
+                        : "authorship_proof_unusable", contentHash, { detail: authorship.reason }, correlationId);
+                return;
+            }
+            if (authorship.verdict === "verified") {
+                verifiedAuthorship = { senderPubkey: authorship.senderPubkey, senderSig: authorship.senderSig };
+            }
+            else {
+                verifiedSignerUnmatched = authorship.senderPubkey;
+            }
+            if (s2Cbor instanceof Uint8Array) {
                 const ordering = this.#recordFrameOrdering(agentName, sessionId, s1Cbor, s2Cbor, contentHash, correlationId);
                 if (ordering.fatal) {
                     await this.#freezeOnIdentityFailure(agentName, sessionId, ordering.fatal.reason, correlationId);
                     return;
                 }
                 framedSeq = ordering.seq;
-                if (ordering.senderPubkey !== undefined && ordering.senderSig !== undefined) {
-                    verifiedAuthorship = { senderPubkey: ordering.senderPubkey, senderSig: ordering.senderSig };
-                }
-                verifiedSignerUnmatched = ordering.verifiedSignerUnmatched;
             }
             else {
                 /**
-                 * Review F3 — THE WEAKER GUARANTEE MUST NOT BE INDISTINGUISHABLE FROM THE STRONGER ONE.
-                 *
-                 * A frame with no ordering record is still ingested, and that is correct: it is the
-                 * documented relay-degraded path, and refusing it would make the relay a precondition for
-                 * reading mail. But it means the per-message signer check is **opt-in for the sender** — a
-                 * party that passed the peer gate and wants to avoid the comparison simply omits the proof.
-                 * Silently, until now: nothing recorded that a message arrived unverified, so the log looked
-                 * identical to one where every message had been checked.
+                 * POSITION IS THE ONLY THING THAT CAN BE ABSENT NOW, and this event is about position.
                  *
-                 * Not fatal, and deliberately not: an absent record proves nothing about the signer, and
-                 * refusing on an absence would strand every relay-degraded session. What closes the omission
-                 * case is relay-side corroboration — `DOD-M15-CORROBORATE-1` — where the relay holds the
-                 * sender's signed hash independently and never routes it through this daemon.
+                 * It fires on the relay-degraded path, where the sender had no witnessed record to stamp
+                 * on. The message is ingested — its author is proven, above, by the frame's own signature —
+                 * and only its place in the canonical sequence falls back to the witness stream. Refusing
+                 * here would make the relay a precondition for reading mail, which is the thing this unit
+                 * was careful NOT to do.
                  */
                 this.#logger.info("session.content.ordering.absent", {
                     agentName, sessionId, correlationId,
-                    impact: "this frame carried no signed ordering record, so its SIGNER was not verified for this message — it was ingested on the strength of the authenticated transport alone",
+                    impact: "this frame carried no relay ordering record, so its POSITION in the canonical sequence is not known from the frame and falls back to the witness stream. Its AUTHOR was verified from the frame's own signature.",
                 });
             }
             // AC-001: carry the sender's correlationId from the frame into the receive
@@ -13925,6 +15631,22 @@ export class SessionNodeManager {
             // acknowledged `persisted` — the sender's TTF→park backstop then guarantees the
             // missing-earlier message is fetchable, and dedup absorbs the redundant copy.
             if (ingest.ok && !ingest.held) {
+                /**
+                 * 033-ACKEMIT review F1 — ACKNOWLEDGE WHAT ARRIVED, HERE, not when the relay gets round to
+                 * delivering its copy back to us.
+                 *
+                 * Placed after a successful, non-held ingest deliberately: a HELD frame is not yet a durable
+                 * leaf and is not acknowledged `persisted` either, so claiming to have seen it would put a
+                 * position in our signed claim that our own record does not yet hold.
+                 *
+                 * `framedSeq` is the relay's canonical position taken from the sender's own signed ordering
+                 * record and verified before it got here. When it is absent the message arrived with no
+                 * ordering record — the withheld-submit case — and there is no position to acknowledge,
+                 * whatever we hold of the content. That limit is structural to a (position, content) pair
+                 * and it is what the carried-leaf follow-on closes.
+                 */
+                if (framedSeq !== null)
+                    this.#noteAcknowledgeable(agentName, sessionId, framedSeq, contentHash);
                 void this.#sendDeliveryAck(agentName, sessionId, contentHash, correlationId);
             }
         }
@@ -14233,17 +15955,27 @@ export class SessionNodeManager {
                 /**
                  * DOD-M12B-SESSION-SEED-1 (review F8): drop it zeroed, like every other seed.
                  *
-                 * (review F7, DECIDED AGAINST — deliberately NOT reusing this seed for the replacement.)
+                 * (review F7, STILL DECIDED AGAINST — deliberately NOT reusing this seed for the
+                 * replacement — but its stated blocker is GONE and the reason has changed. Restated rather
+                 * than reworded, because a decision whose premise has been reversed is a decision nobody
+                 * has actually made.)
+                 *
                  * Reuse is attractive: this receiver's peer id may already be inside a `session_offer_accept`
                  * the counterparty is acting on, and a rebuild in that window is the documented "we record
-                 * an identity that no longer exists… every send in this direction parks forever" defect. But
-                 * a preserved identity would have to be handed to the candidate loop in
-                 * `#startReceiverNode`, whose rejected candidates are stopped WITHOUT awaiting `start()` —
-                 * so two nodes could be briefly live on one advertised peer id, which is review F1, a HIGH,
-                 * and the reason each candidate now mints its own. Fixing F7 properly means bounding and
-                 * awaiting the loser's teardown first, and an unawaited stop is precisely what the current
-                 * code chose to avoid a stuck libp2p teardown blocking receiver creation. Filed as
-                 * follow-on work rather than trading a MEDIUM fix for a HIGH regression.
+                 * an identity that no longer exists… every send in this direction parks forever" defect.
+                 *
+                 * The old blocker was that a preserved identity would reach the candidate loop, whose
+                 * rejected candidates were stopped WITHOUT awaiting `start()`, putting two live nodes on one
+                 * advertised peer id. **032-RELAYSPREAD already crossed that line**: the walk now runs one
+                 * shared seed through every candidate, with a settlement-chained teardown, and it is safe
+                 * there because the receiver's gater admits nobody inbound.
+                 *
+                 * What still stops reuse HERE is different and is about the OLD node, not the new one. This
+                 * rebuild path awaits `sr.node.stop()`, but a stop can hang on a stuck libp2p teardown, and
+                 * handing the replacement the same identity before the previous receiver is provably dead
+                 * would put two nodes on a peer id a COUNTERPARTY has been told to dial — which is not the
+                 * candidate case at all: that node has a content handler and can be promoted. Doing it
+                 * safely needs a bounded, verified teardown first. Still follow-on work.
                  */
                 sr.seed.fill(0);
                 try {
@@ -14455,7 +16187,19 @@ export class SessionNodeManager {
                     // "No relay would grant" and "there was no relay to ask" are different facts and lead to
                     // different places — the first at relay capacity, the second at this agent's directory
                     // connection. Without this they are the same sentence.
-                    reservationsRequested: (this.#directoryRelayEndpoints.get(agentName)?.length ?? 0) > 0,
+                    //
+                    // 032-RELAYSPREAD: this was also called `reservationsRequested` — the same mis-naming as
+                    // the reachability events, in its worst form, because here the value is a BOOLEAN under a
+                    // name that reads as a count. It is NOT `relaysOffered`: that field counts the merged
+                    // candidate list the walk actually asks (directory pool + persisted endpoints, minus
+                    // quarantine), and this reads the directory pool alone. Two populations must not share
+                    // one field name, so this one is named for what it measures.
+                    hadRelayToAsk: (this.#directoryRelayEndpoints.get(agentName)?.length ?? 0) > 0,
+                    // …and HOW MANY the walk actually asks, so this event stands on its own instead of
+                    // needing the last reachability line to be read beside it. Same population and same
+                    // meaning as `relaysOffered` everywhere else: the merged, quarantine-filtered candidate
+                    // list.
+                    relaysOffered: this.#reservationCircuitAddrs(agentName).addrs.length,
                     impact: "no relay would grant this agent a circuit reservation, so anyone behind NAT cannot reach or dial it — inbound sessions will only arrive from peers that can connect directly, and everything else falls back to the relay's store-and-forward",
                 });
             }
@@ -14500,11 +16244,27 @@ export class SessionNodeManager {
             // BOUNDED, never on this 30-second grid. A reservation is scarce: the relay holds it for its
             // full TTL even after the client disconnects, and churning attempts across a fleet is how a
             // relay is exhausted (`#startReceiverNode` records that hazard).
-            if (!sr.hasReservation || sr.relayPeerId === undefined) {
-                this.#retryReservationIfDue(agentName);
-                continue;
+            if (sr.relayPeerIds.length === 0) {
+                // …unless one has arrived since. Review F4, same class as the recompute below: the
+                // slow-start path installs a receiver before every circuit has bound, so "held nothing at
+                // install" is not the same fact as "holds nothing now". Adopting it here is what stops the
+                // retry ladder rebuilding a receiver that is already reachable.
+                const arrived = heldRelayIdsOf(sr.node)
+                    .filter((id) => sr.node.getConnections().some((c) => c.peerId === id && c.status === "open"));
+                if (arrived.length === 0) {
+                    this.#retryReservationIfDue(agentName);
+                    continue;
+                }
+                sr.relayPeerIds = arrived;
+                sr.gater.setReservedRelayPeers(arrived);
+                this.#logger.info("session.standing_receiver.reservation.gained", {
+                    agentName,
+                    relayPeerIds: arrived,
+                    reservationsHeld: arrived.length,
+                });
             }
-            // It has one — any earlier retry budget, and the reason the last attempt failed, are stale.
+            // It has at least one — any earlier retry budget, and the reason the last attempt failed, are
+            // stale.
             this.#srReservationRetry.delete(agentName);
             this.#srLastRejectionReason.delete(agentName);
             // Watch the CONNECTION to the relay, not the circuit address.
@@ -14522,24 +16282,106 @@ export class SessionNodeManager {
             // investigation turned on. Without the status check a registered corpse reads as "still
             // connected", the rebuild never fires, and the agent silently stops being reachable while
             // this loop reports it healthy. The comment above claimed liveness; only this tests it.
-            const stillConnected = sr.node.getConnections()
-                .some((c) => c.peerId === sr.relayPeerId && c.status === "open");
-            const stillAdvertising = sr.node.listenAddresses().some((a) => a.includes("/p2p-circuit"));
-            if (stillConnected && stillAdvertising)
+            // 032-RELAYSPREAD — PER RELAY, and the health question is now a COUNT.
+            //
+            // This used to evaluate one peer id and rebuild the entire standing receiver when it went
+            // false. With a pool of one that was the only thing it could do; with a pool of three it is
+            // the churn engine — every relay is another watchdog subject, and a full rebuild per loss
+            // multiplies the 30-second grid by the size of the pool while throwing away reservations that
+            // are perfectly healthy.
+            /**
+             * RECOMPUTED FROM THE NODE, never filtered down from the stored list. Review F4: filtering
+             * `sr.relayPeerIds` makes it SHRINK-ONLY, and a list that can only shrink cannot see a
+             * circuit arrive. Three things went wrong with that, and the first one happens routinely:
+             *   - the slow-start path installs the receiver before every circuit has bound, so a relay
+             *     that binds four seconds later was invisible to this watchdog and absent from the
+             *     gater's carve-out set FOREVER — its AutoNAT probe reply refused by our own gate;
+             *   - shrinking to zero then rebuilt a receiver that was announcing live circuits, which is
+             *     the exact defect this unit is against;
+             *   - anything that ever restores a circuit could not be counted.
+             * Reading the node's own addresses costs the same and has none of that.
+             */
+            const open = sr.node.getConnections().filter((c) => c.status === "open").map((c) => c.peerId);
+            const stillHeld = heldRelayIdsOf(sr.node).filter((id) => open.includes(id));
+            const lost = sr.relayPeerIds.filter((id) => !stillHeld.includes(id));
+            const gained = stillHeld.filter((id) => !sr.relayPeerIds.includes(id));
+            sr.relayPeerIds = stillHeld;
+            if (gained.length > 0) {
+                // A circuit this receiver did not have at install. Said out loud because it is the visible
+                // half of the slow-start case, and because it is the moment that relay earns its inbound
+                // carve-out — a silent widening of the gate is not something to do without a line.
+                this.#logger.info("session.standing_receiver.reservation.gained", {
+                    agentName,
+                    relayPeerIds: gained,
+                    reservationsHeld: stillHeld.length,
+                });
+            }
+            if (lost.length === 0) {
+                // Nothing lost. The gater still gets the current set, because `gained` may have widened it.
+                if (gained.length > 0)
+                    sr.gater.setReservedRelayPeers(stillHeld);
                 continue;
-            // DOD-RELAY-KEEPALIVE-1 (review F4): carry the CAUSE, not just the exit point.
-            // `relay_connection_gone` says where this was noticed — a poll of getConnections() — by which
-            // time the abort reason that actually killed the link is long discarded. The relay client for
-            // this (agent, relay) pair kept the error that ended its reader; that is the nearest thing to
-            // an upstream cause available here, and its absence is how 2,061 of these went untraced.
-            const upstreamReason = this.#relayClients.get(`${agentName}::${sr.relayPeerId}`)?.getLastReaderError();
-            this.#logger.warn("session.standing_receiver.reservation.lost", {
-                agentName,
-                relayPeerId: sr.relayPeerId,
-                reason: stillConnected ? "circuit_address_vanished" : "relay_connection_gone",
-                ...(upstreamReason ? { upstreamReason } : {}),
-            });
-            void this.#rebuildStandingReceiver(agentName);
+            }
+            // REVOKE FIRST. A relay whose reservation is gone must lose its inbound carve-out in the same
+            // breath as the loss is noticed, or the gater's bound quietly becomes "granted one once".
+            sr.gater.setReservedRelayPeers(stillHeld);
+            for (const relayPeerId of lost) {
+                // DOD-RELAY-KEEPALIVE-1 (review F4): carry the CAUSE, not just the exit point.
+                // `relay_connection_gone` says where this was noticed — a poll of getConnections() — by
+                // which time the abort reason that actually killed the link is long discarded. The relay
+                // client for this (agent, relay) pair kept the error that ended its reader; that is the
+                // nearest thing to an upstream cause available here, and its absence is how 2,061 of these
+                // went untraced.
+                const upstreamReason = this.#relayClients.get(`${agentName}::${relayPeerId}`)?.getLastReaderError();
+                this.#logger.warn("session.standing_receiver.reservation.lost", {
+                    agentName,
+                    relayPeerId,
+                    reason: open.includes(relayPeerId) ? "circuit_address_vanished" : "relay_connection_gone",
+                    ...(upstreamReason ? { upstreamReason } : {}),
+                    reservationsHeld: stillHeld.length,
+                    // The line an operator reads, and the two cases are not the same event at all.
+                    impact: stillHeld.length > 0
+                        ? "this agent still holds " + stillHeld.length + " other circuit reservation(s), so it "
+                            + "stays dialable from behind NAT and the receiver is NOT rebuilt. Losing one relay "
+                            + "costs this agent nothing it can feel."
+                        : "this agent now holds NO circuit reservation, so nobody behind a home router can "
+                            + "reach it. The receiver is being rebuilt against the rest of the pool.",
+                });
+            }
+            if (stillHeld.length === 0) {
+                // ZERO HELD IS STILL THE LOUD, STRUCTURAL CASE — the agent is unreachable behind NAT and
+                // only a new node can take a new reservation, because a circuit listener is fixed at node
+                // creation.
+                void this.#rebuildStandingReceiver(agentName);
+                continue;
+            }
+            /**
+             * STILL REACHABLE, SO THE RECEIVER STANDS, AND NOTHING ELSE HAPPENS HERE. That second half is
+             * the part worth reading, because the obvious next line is wrong twice over.
+             *
+             * **A LOST CONFIGURED CIRCUIT CANNOT BE RETAKEN BY THIS NODE.** Read out of
+             * `@libp2p/circuit-relay-v2@4.2.5`, not assumed: for an explicit relay address
+             * `transport/listener.js#listen()` is a ONE-SHOT — it reserves once and nothing calls it
+             * again; `reservation-store.js#removeReservation()` clears the refresh timeout and deletes
+             * the entry; and the listener's `_onAddRelayPeer` returns early for `type === 'configured'`,
+             * so even a later reservation would not be announced. A circuit listener is fixed at node
+             * creation, and the only thing that takes a new one is a NEW NODE — which is exactly the
+             * rebuild this branch exists to refuse.
+             *
+             * **AND RE-PROVING TO THE LOST RELAY WOULD REBUILD THE RECEIVER ANYWAY.** Review F3: an
+             * earlier version called `#authenticateStandingReceiver` here to "remove the relay-side
+             * reason for the revocation". That function ends with `if (refusal?.tryAnotherRelay) { …
+             * void this.#rebuildStandingReceiver(agentName); }` — and a dead or misconfigured relay is
+             * precisely the one that answers that way. So the common case was: lose relay A while
+             * holding B, decline to rebuild, prove to A, A refuses, rebuild the whole receiver and throw
+             * B's healthy reservation away. The churn engine, re-entered through the back door.
+             *
+             * **THE BOUND, STATED PLAINLY BECAUSE IT IS A REAL SHORTFALL AGAINST THE DoD:** a lost
+             * circuit is gone until the receiver is next rebuilt for another reason. What the agent buys
+             * is that it never STOPS BEING REACHABLE while that is true — the surviving relays carry it,
+             * the loss is named in the log with its cause, and the lost relay's inbound carve-out is
+             * revoked above. That is availability, not restoration in place.
+             */
         }
     }
     /**
@@ -14738,20 +16580,42 @@ export class SessionNodeManager {
         }
     }
     async #startReceiverNode(agentName, sessionId, gater, candidateCircuitAddrs, correlationId) {
+        /**
+         * 032-RELAYSPREAD — **ONE SEED FOR THE RECEIVER, REUSED ACROSS RELAYS**, replacing
+         * DOD-M12B-SESSION-SEED-1's seed-per-candidate.
+         *
+         * The agent is ONE identity and must be dialable at ONE peer id through any of its circuits, so
+         * every reservation this walk collects has to belong to the same key. A seed per relay would
+         * give the agent a different peer id down each circuit — N half-agents, none of them the one
+         * the counterparty was told to dial.
+         *
+         * ⚠️ THE RULE THIS REPLACES WAS RIGHT ABOUT ITS OWN CASE, so here is what changed and what did
+         * not. Its hazard is real and survives: a rejected candidate is torn down while its `start()`
+         * may still be in flight, so two nodes can briefly be live on this peer id. Two things bound it
+         * now, and neither existed when that rule was written:
+         *   - **THE ONE THAT CARRIES THE WEIGHT: DOD-M15-ASSIGN-1** made a standing receiver's gater
+         *     admit NOBODY inbound until a session offer names the dialer. The old rule's stated danger
+         *     — "sharing this gater, so it admits dials … an open endpoint under our advertised id" —
+         *     is not true of this gater any more. `#startReceiverNode` has exactly one caller and it
+         *     constructs that gater with `allowedPeerId: null` and an empty reserved set, so an
+         *     overlapping candidate is an endpoint that refuses everyone.
+         *   - the teardown is chained onto the candidate's OWN start promise (the `#buildRevivedNode`
+         *     pattern, verified against libp2p 3.3.2: `stop()` returns immediately unless the status is
+         *     `started`, and through the whole timeout window it is `starting`, so the old unawaited
+         *     `stop()` stopped nothing). ⚠️ This bounds the LEAK, not the OVERLAP — a timed-out
+         *     candidate is not awaited and the walk moves straight to the next one on the same seed, so
+         *     overlap is the normal shape of that case, not a remote possibility. It guarantees the
+         *     loser dies, and nothing more.
+         * `#buildRevivedNode` already runs a fixed identity through this same walk for the same reason.
+         */
+        const receiverSeed = randomBytes(32);
+        /** Circuit addresses whose relay ACTUALLY GRANTED this identity a reservation. */
+        const grantedAddrs = [];
+        // For `spread.grant_not_bound` below: the walk's own duration is measured against the relay's
+        // two-minute proof memory, so it has to be a number rather than an inference.
+        const walkStartedAt = Date.now();
         for (const circuitAddr of candidateCircuitAddrs) {
-            // DOD-M12B-SESSION-SEED-1: A SEED PER CANDIDATE, NOT ONE FOR THE LOOP.
-            //
-            // A rejected candidate is stopped with an unawaited `void …then(() => candidate.stop())`
-            // while its `start()` may still be in flight, so two candidate nodes can briefly be live at
-            // once. Sharing one seed would give both the SAME peer id — and the loser would then be a
-            // second live node under the identity we advertise in `session_offer_accept`, sharing this
-            // gater (so it admits dials) with no content handler registered. Inbound arriving there goes
-            // nowhere, and it is an open endpoint under our advertised id: the "connection a malicious
-            // agent can farm for" the tenet names. Before seeds existed the loser had its own random key
-            // and was harmless; introducing a shared seed is what would have made it dangerous.
-            //
-            // Nothing reads the seed before the winner is installed, so per-candidate costs nothing.
-            const candidateSeed = randomBytes(32);
+            const candidateSeed = receiverSeed;
             /**
              * DOD-M15-RELAYSLOTS-1 — **TWO ATTEMPTS PER RELAY: ask, prove, ask again.**
              *
@@ -14766,7 +16630,7 @@ export class SessionNodeManager {
              * announces no circuit address for it, because it only announces addresses for reservations
              * its own relay-discovery made. The agent would hold a slot nobody could dial through.
              */
-            let candidateNode;
+            let candidateGranted = false;
             // Set when the relay refused the AGENT rather than being unwilling itself: every other relay
             // in the pool answers identically, so the walk ends here rather than reproducing it N times.
             let candidateRefusedAgent = false;
@@ -14782,9 +16646,13 @@ export class SessionNodeManager {
                 const timedOut = Symbol("reservation_timeout");
                 let outcome = "failed";
                 let error = "";
+                // KEEP THE START PROMISE. Every candidate now carries the receiver's identity, so an
+                // abandoned one must be reliably torn down rather than best-effort — and only its own start
+                // promise says when it is stoppable (see the seed note above).
+                const startP = candidate.start();
                 try {
                     outcome = await Promise.race([
-                        candidate.start().then(() => "started"),
+                        startP.then(() => "started"),
                         new Promise((resolve) => {
                             timer = setTimeout(() => resolve(timedOut), this.#srReservationTimeoutMs);
                         }),
@@ -14802,7 +16670,15 @@ export class SessionNodeManager {
                 // completes the handshake and simply grants nothing, leaving a node that looks
                 // started and is reachable by nobody.
                 if (outcome === "started" && candidate.listenAddresses().some((a) => a.includes("/p2p-circuit"))) {
-                    candidateNode = candidate;
+                    candidateGranted = true;
+                    // The probe has done its job: this relay grants THIS identity. Tear it down and ask the
+                    // next relay — the reservation is re-taken by the final node below, which is the only one
+                    // that can listen on every granted address at once. AWAITED, because the next probe comes
+                    // up on this same peer id.
+                    try {
+                        await candidate.stop();
+                    }
+                    catch { /* it may never have finished starting */ }
                     break;
                 }
                 /**
@@ -14890,27 +16766,125 @@ export class SessionNodeManager {
                     ...(error !== "" ? { error } : {}),
                     correlationId,
                 });
-                // Abandon it. start() may still be parked on a dial, so stop() is best-effort
-                // and must never block the fallback.
-                void Promise.resolve()
-                    .then(() => candidate.stop())
-                    .catch(() => { });
+                // Abandon it — but on its OWN settlement, never best-effort. `start()` may still be parked on
+                // a dial, and this candidate carries the receiver's identity: an unawaited `stop()` on a node
+                // whose status is still `starting` returns without stopping anything, and the node then goes
+                // live on our peer id with nothing left holding a reference to kill it.
+                void startP.then(() => candidate.stop().catch(() => { }), () => { });
                 break;
             }
-            if (candidateNode)
-                return { node: candidateNode, seed: candidateSeed };
+            if (candidateGranted)
+                grantedAddrs.push(circuitAddr);
+            // 032-RELAYSPREAD: DO NOT BREAK ON THE FIRST GRANT. The walk used to stop here, which is why
+            // an agent held exactly one reservation and losing that relay cost it every NAT'd caller for
+            // however long detection happened to take. It now asks every remaining relay.
             if (candidateRefusedAgent)
                 break;
         }
-        const plainSeed = randomBytes(32);
-        const plain = await this.#createAgentNode(agentName, {
+        /**
+         * THE RECEIVER, listening on EVERY granted circuit address.
+         *
+         * One node per agent, as before — what changed is how many circuits it announces. Each address
+         * here belongs to a relay that granted THIS seed moments ago and therefore still remembers the
+         * identity, so the final node's first ask is the one that succeeds; the two-attempt dance was
+         * already paid per relay in the walk.
+         *
+         * ⚠️ RACED AGAINST A DEADLINE, and that is measured rather than cautious: `#buildRevivedNode`
+         * records a live 2026-08-18 result where a node handed two relay addresses at once with no
+         * deadline never finished starting at all (10,002ms and counting). Its identity was unproven at
+         * both relays, which is not this case — but "not this case" is a prediction, and the standing
+         * receiver is the thing that makes an agent reachable, so it does not wait on one.
+         *
+         * An empty `grantedAddrs` yields the plain TCP floor, exactly as before: reachable by peers
+         * that can dial directly, and loud about it (`session.standing_receiver.reservation.none`).
+         */
+        const node = await this.#createAgentNode(agentName, {
             sessionId,
             connectionGater: gater,
             nodeType: "standing_receiver",
-            transportPrivateKey: plainSeed,
+            ...(grantedAddrs.length > 0 ? { circuitRelayListenAddrs: grantedAddrs } : {}),
+            transportPrivateKey: receiverSeed,
         });
-        await plain.start();
-        return { node: plain, seed: plainSeed };
+        if (grantedAddrs.length === 0) {
+            await node.start();
+            return { node, seed: receiverSeed };
+        }
+        /**
+         * ⚠️ SLOW AND FAILED ARE DIFFERENT ANSWERS AND MUST NOT SHARE A BRANCH. Review F1: a single
+         * `.catch(() => false)` around this race collapsed every `start()` REJECTION into the deadline
+         * branch — and `CelloNodeImpl.start()` rejects by design, stopping the node and throwing
+         * `listen_failed` when no direct (non-circuit) listener materialised. That is the guard the
+         * transport keeps precisely so `FaultTolerance.NO_FATAL` cannot mask a real `EADDRINUSE`.
+         *
+         * Swallowed, it installed a STOPPED node as the agent's front door: no addresses to advertise,
+         * `#tryCreateStandingReceiver` never saw a failure so the M8B F14 retry never fired, and the
+         * operator was told the receiver "did not finish binding every circuit inside the deadline" and
+         * "is reachable through those" — sending them to the relay fleet for a port held by an orphan
+         * daemon on their own machine. The rejection is rethrown so it reaches
+         * `session.node.create.failed` with its own cause, exactly as it does on the no-relay path.
+         */
+        let deadline;
+        let startError;
+        const started = node.start().then(() => "ok", (err) => { startError = err; return "failed"; });
+        const outcome = await Promise.race([
+            started,
+            new Promise((resolve) => {
+                // Per granted relay: each circuit listener is its own dial and its own reservation, so a
+                // pool of three must not be judged on a budget sized for one.
+                deadline = setTimeout(() => resolve("slow"), this.#srReservationTimeoutMs * grantedAddrs.length);
+            }),
+        ]);
+        if (deadline !== undefined)
+            clearTimeout(deadline);
+        if (outcome === "failed")
+            throw startError;
+        /**
+         * GRANTED IN THE WALK, REFUSED AT INSTALL — a distinct fact and, until this line, an invisible
+         * one. The receiver would simply report `reservationsHeld: 2` where 3 relays granted, with
+         * nothing naming which relay went missing or why.
+         *
+         * ⚠️ IT HAS A KNOWN CAUSE AND A CROSS-REPO CLOCK. The walk stops the granted candidate and the
+         * node below RE-ASKS, which works because the relay remembers the proof — for
+         * `PROVEN_PEER_MEMORY_MS = 2 minutes` (`relay-connection-gater.ts`, trustless-cello). The walk
+         * costs up to `#srReservationTimeoutMs` × 2 attempts per relay, so a pool of three at the
+         * 15s default can spend 90 seconds before the final node asks relay 1 again. The earliest
+         * proof can expire before it is used, and that is what this event catches.
+         */
+        const boundRelays = new Set(heldRelayIdsOf(node));
+        const grantedButUnbound = grantedAddrs
+            .map((a) => CIRCUIT_RELAY_ID.exec(a)?.[1])
+            .filter((id) => id !== undefined && !boundRelays.has(id));
+        if (grantedButUnbound.length > 0) {
+            this.#logger.warn("session.standing_receiver.spread.grant_not_bound", {
+                agentName,
+                relayPeerIds: grantedButUnbound,
+                relaysGranted: grantedAddrs.length,
+                reservationsHeld: boundRelays.size,
+                walkMs: Date.now() - walkStartedAt,
+                correlationId,
+                impact: "these relays granted this agent a reservation during the walk and then bound no " +
+                    "circuit on the receiver itself, so the agent is reachable through fewer relays than it " +
+                    "earned. The relay remembers a proof for two minutes; if walkMs is near or past that, " +
+                    "the proof expired before the receiver asked and the walk is what needs shortening — " +
+                    "not the relay fleet.",
+            });
+        }
+        if (outcome === "slow") {
+            // NOT a teardown, and now this line means only what it says: the node is starting and has not
+            // finished. It is installed with whatever circuits did materialise, because some reachability
+            // beats none and the reservation watchdog is what settles the rest.
+            this.#logger.warn("session.standing_receiver.spread.slow_start", {
+                agentName,
+                relaysGranted: grantedAddrs.length,
+                circuitAddrs: node.listenAddresses().filter((a) => a.includes("/p2p-circuit")).length,
+                budgetMs: this.#srReservationTimeoutMs * grantedAddrs.length,
+                correlationId,
+                impact: "the receiver did not finish binding every circuit it was granted inside the " +
+                    "deadline, so it is being installed with the circuits it has. It is reachable through " +
+                    "those; the reservation watchdog re-checks the rest on its next tick.",
+            });
+        }
+        return { node, seed: receiverSeed };
     }
     /** One standing-receiver create attempt (extracted for the M8B F14 retry loop). */
     async #tryCreateStandingReceiver(agentName, correlationId) {
@@ -14932,11 +16906,15 @@ export class SessionNodeManager {
         }
         let node;
         /**
-         * DOD-M12B-SESSION-SEED-1 — the transport identity of the receiver that actually survived.
+         * DOD-M12B-SESSION-SEED-1 — the transport identity of this receiver.
          *
-         * Minted per CANDIDATE inside `#startReceiverNode` and returned with the winner, not minted
-         * here: a rejected candidate is stopped without awaiting its `start()`, so two candidates can
-         * be briefly live, and one shared seed would put both on the same advertised peer id.
+         * Minted ONCE inside `#startReceiverNode` and returned with the node, not minted here. It is
+         * one seed for the whole walk (032-RELAYSPREAD): the receiver reserves with every relay that
+         * grants, and an agent must be dialable at ONE peer id through any of its circuits, so every
+         * reservation has to belong to the same key. What makes that safe is DOD-M15-ASSIGN-1 — the
+         * gater above admits NOBODY inbound — not the teardown, which bounds how long a rejected
+         * candidate lives rather than preventing it from overlapping. See the seed note in
+         * `#startReceiverNode` for the full argument.
          *
          * FRESH EVERY TIME, which is the privacy property rather than an implementation detail. A
          * receiver serves at most one session (it is promoted into the session at handoff and replaced),
@@ -14990,39 +16968,39 @@ export class SessionNodeManager {
             probers: this.#autoNatProbers(),
         });
         autoNat.emitInitialResult();
-        const circuitAddrs = node.listenAddresses().filter((a) => a.includes("/p2p-circuit")).length;
-        // FROM THE ADDRESS THE NODE ACTUALLY HOLDS, not from `reservations.addrs[0]`.
-        //
-        // `#startReceiverNode` tries candidates in order and returns the FIRST that actually grants —
-        // so when candidate 0 refuses (the measured `relay_granted_no_reservation` case) and candidate 1
-        // grants, reading candidate 0's address records a relay we are not connected to. The watchdog
-        // then evaluates `getConnections().some(c => c.peerId === relayPeerId)` against that wrong peer,
-        // finds it false on every tick forever, and rebuilds on the 30-second grid — churning the very
-        // reservations this unit exists to conserve. Dormant while the pool is size 1; the pool is
-        // designed to be larger.
-        // PREFER the held address, FALL BACK to the candidate — strictly better than either alone.
-        // The held address is authoritative about which relay actually granted, but it is libp2p's
-        // string, not ours: if a transport ever reports the circuit address without the relay's peer id
-        // in `/p2p/<id>/p2p-circuit` form, reading only it would yield UNDEFINED, and an undefined
-        // relayPeerId makes the watchdog treat a perfectly healthy reservation as absent and rebuild it.
-        // That would be a regression on the single-relay case that works today. The candidate string is
-        // ours and always carries the id, so it is the safe floor.
-        const heldCircuitAddr = node.listenAddresses().find((a) => a.includes("/p2p-circuit"));
-        const CIRCUIT_RELAY_ID = /\/p2p\/([^/]+)\/p2p-circuit/;
-        const reservedRelayPeerId = circuitAddrs > 0
-            ? (heldCircuitAddr?.match(CIRCUIT_RELAY_ID)?.[1] ?? reservations.addrs[0]?.match(CIRCUIT_RELAY_ID)?.[1])
-            : undefined;
-        // DOD-M15-ASSIGN-1 review N3: the ONE relay this receiver actually reserved with earns the
-        // inbound AutoNAT carve-out — nothing else does. Set only when a reservation genuinely
-        // completed, so a directory that merely NAMES a relay cannot dial in behind it.
-        gater.setReservedRelayPeer(circuitAddrs > 0 && reservedRelayPeerId !== undefined ? reservedRelayPeerId : null);
+        /**
+         * EVERY RELAY THE NODE ACTUALLY HOLDS A CIRCUIT WITH — derived from the addresses the node
+         * holds, never from `reservations.addrs`.
+         *
+         * The old code read `reservations.addrs[0]`'s relay id as a fallback, and its own comment
+         * called the hazard "dormant while the pool is size 1; the pool is designed to be larger."
+         * THIS UNIT IS WHAT MAKES THE POOL LARGER, so the dormant case wakes up: candidate 0 refusing
+         * while candidate 1 grants recorded a relay we are not connected to, the watchdog found it
+         * absent on every tick forever, and it rebuilt on the 30-second grid — churning the very
+         * reservations this unit exists to conserve. A candidate is a relay we ASKED; only a held
+         * address is a relay that ANSWERED, and the fallback conflated the two.
+         *
+         * The fallback's own stated worry stands, and is answered by the count rather than by the
+         * candidate list: if a transport ever reports a circuit address without the relay's peer id in
+         * `/p2p/<id>/p2p-circuit` form, that address yields no id and is not counted as held — so the
+         * receiver reads as degraded and gets rebuilt, instead of reading as healthy against a relay
+         * nobody is connected to. Degrading toward "rebuild" is the safe direction; the other one is
+         * the silent unreachability this whole file exists to kill.
+         */
+        const heldRelayPeerIds = heldRelayIdsOf(node);
+        const circuitAddrs = heldRelayPeerIds.length;
+        const heldCircuitAddrs = node.listenAddresses().filter((a) => a.includes("/p2p-circuit"));
+        // DOD-M15-ASSIGN-1 review N3, widened by 032-RELAYSPREAD: the relays this receiver actually
+        // reserved with earn the inbound AutoNAT carve-out — nothing else does. Populated only from
+        // reservations that genuinely completed, so a directory that merely NAMES a relay cannot dial
+        // in behind it, however many relays it names.
+        gater.setReservedRelayPeers(heldRelayPeerIds);
         this.#standingReceivers.set(agentName, {
             node,
             gater,
             autoNat,
             seed,
-            hasReservation: circuitAddrs > 0,
-            ...(reservedRelayPeerId !== undefined ? { relayPeerId: reservedRelayPeerId } : {}),
+            relayPeerIds: heldRelayPeerIds,
         });
         this.#logger.info("session.node.created", {
             sessionId,
@@ -15036,31 +17014,54 @@ export class SessionNodeManager {
         // real session to exist, is what keeps this reservation alive past that grace window.
         // Best-effort and unawaited: a failure here costs nothing beyond the relay's own grace-window
         // revoke, which the reservation watchdog already treats as an ordinary lost reservation.
-        if (reservedRelayPeerId !== undefined && heldCircuitAddr !== undefined) {
-            void this.#authenticateStandingReceiver(agentName, node, reservedRelayPeerId, heldCircuitAddr, correlationId)
+        // ONCE PER HELD RELAY. Each relay revokes independently — it times out the reservation of any
+        // peer that has not proven key possession TO IT — so proving to one of three and calling the
+        // receiver authenticated would lose the other two circuits about fifteen seconds later, which
+        // is the same silent unreachability with two more relays paying for it.
+        for (const relayPeerId of heldRelayPeerIds) {
+            const heldCircuitAddr = heldCircuitAddrs.find((a) => a.includes(`/p2p/${relayPeerId}/p2p-circuit`));
+            if (heldCircuitAddr === undefined)
+                continue;
+            void this.#authenticateStandingReceiver(agentName, node, relayPeerId, heldCircuitAddr, correlationId)
                 .catch((err) => {
                 this.#logger.warn("session.standing_receiver.relay_auth.failed", {
                     agentName,
-                    relayPeerId: reservedRelayPeerId,
+                    relayPeerId,
                     error: extractErrorMessage(err),
                     correlationId,
                 });
             });
         }
-        // DOD-NAT-REACHABILITY-1 observability: how reachable did this receiver come
-        // up? circuitAddrs === 0 with reservations requested means every relay
-        // refused/was unreachable — the agent is deaf to NAT'd initiators (public
-        // ones can still connect directly). That must be LOUD, not a quiet shrug.
+        // DOD-NAT-REACHABILITY-1 observability: how reachable did this receiver come up? Zero held
+        // while relays were offered means every relay refused or was unreachable — the agent is deaf
+        // to NAT'd initiators (public ones can still connect directly). That must be LOUD, not a quiet
+        // shrug.
+        //
+        // 032-RELAYSPREAD — TWO NUMBERS, SO TWO NAMES. Both events used to carry one field,
+        // `reservationsRequested`, holding `reservations.addrs.length` — the size of the CANDIDATE
+        // list, under a name that reads as a count of asks. That is why "the client already requests a
+        // reservation with every relay it knows" read as true in an audit: the outcome was one and the
+        // request was one too, and a single field could report neither.
+        //   relaysOffered    — how many relays were in the candidate list (deduped by relay peer id in
+        //                      `#reservationCircuitAddrs`, so it counts relays, not addresses).
+        //   reservationsHeld — how many reservations this node actually holds, counted the only way
+        //                      that proves a grant: ANNOUNCED /p2p-circuit listen addresses. `start()`
+        //                      resolving is not enough — a relay out of reservation slots completes the
+        //                      handshake, grants nothing, and leaves a node that looks started and is
+        //                      dialable by nobody.
         this.#logger.info("session.standing_receiver.reachability", {
             agentName,
-            circuitAddrs,
-            reservationsRequested: reservations.addrs.length,
+            relaysOffered: reservations.addrs.length,
+            reservationsHeld: circuitAddrs,
             correlationId,
         });
         if (reservations.addrs.length > 0 && circuitAddrs === 0) {
             this.#logger.warn("session.standing_receiver.reservation.none", {
                 agentName,
-                reservationsRequested: reservations.addrs.length,
+                relaysOffered: reservations.addrs.length,
+                // Zero by this branch's own condition, and stated rather than implied: the event reads
+                // "offered 3, held 0" on its own, without the reader having to find the gate above it.
+                reservationsHeld: circuitAddrs,
                 relayPeerIds: reservations.relayPeerIds,
                 correlationId,
             });
@@ -15359,7 +17360,9 @@ export class SessionNodeManager {
                 }
                 this.#relayClients.set(clientKey, client);
             }
-            client.registerSession(sessionId, node, this.#relayLeafHandler(agentName, sessionId, correlationId));
+            // 033-ACKEMIT: a revived session re-registers with no assignment in hand, so the genesis comes
+            // from the entry that was just restored above.
+            client.registerSession(sessionId, node, this.#relayLeafHandler(agentName, sessionId, correlationId), undefined, this.#sessionGenesisPrevRoot(agentName, sessionId));
             const entry = this.#activeNodes.get(this.#k(agentName, sessionId));
             if (entry) {
                 entry.relayClient = client;