@cello-protocol/daemon 0.0.189 → 0.0.191

package/dist/session-node-manager.js

@@ -30,7 +30,7 @@ import { ensureIdentitySchema } from "./db-identity-store.js";
 import { migrateSessionTablesToAgentId } from "./agent-id-migration.js";
 import { TIER, normalizeTier, isKnownTierValue, tierBoundsFor, DEFAULT_TIER_BOUNDS, migrateContactsAddTierMetadata } from "./contacts-tier-migration.js";
 import { normalizeContactPubkey, foldContactPubkeyCase } from "./contact-pubkey-case.js";
-import { REFUSAL_KINDS } from "./refusal-reasons.js";
+import { REFUSAL_KINDS, relayAckHashRefusalNotice } from "./refusal-reasons.js";
 import { migrateCborBlobsToCanonical } from "./cbor-blob-migration.js";
 import { ensureTrustSignalSchema } from "./trust-signal-store.js";
 import { boundSettingKey, settableTierName, isValidSettingKey, awayTierSettingKey, AWAY_DEFAULT_KEY } from "./agent-settings-keys.js";
@@ -38,7 +38,7 @@ import { publishableEndpoint, relayOnlyState } from "./relay-only.js";
 import { randomUUID, createHash, randomBytes } from "node:crypto";
 import * as lp from "it-length-prefixed";
 import { decode } from "cbor-x";
-import { encodeCbor, decodeStructure1, encodeStructure1 } from "@cello-protocol/protocol-types";
+import { encodeCbor, decodeStructure1, encodeStructure1, computeGenesisPrevRoot } from "@cello-protocol/protocol-types";
 import { MAX_SESSION_NODES, STANDING_RECEIVER_AGENT_NAME } from "./types.js";
 import { SessionConnectionGater } from "./session-connection-gater.js";
 import { SessionTree, sessionTreeLeafKindFromDb } from "./session-tree.js";
@@ -286,6 +286,28 @@ const REDIAL_COOLDOWN_MS = 15_000;
  * span about 2.5 hours.
  */
 export const SR_RESERVATION_MAX_RETRIES = 5;
+/** The relay peer id inside a `/…/p2p/<relay>/p2p-circuit/…` address. */
+const CIRCUIT_RELAY_ID = /\/p2p\/([^/]+)\/p2p-circuit/;
+/**
+ * 032-RELAYSPREAD — the relays a node ACTUALLY HOLDS a circuit with, read off the addresses it is
+ * announcing. One entry per relay, deduped.
+ *
+ * This is the single definition of "a reservation is held", and it is deliberately the strictest
+ * one available: an ANNOUNCED circuit address. `start()` resolving is not enough — a relay out of
+ * reservation slots completes the handshake, grants nothing, and leaves a node that looks started
+ * and is dialable by nobody. Nor is a candidate address enough: a candidate is a relay we asked.
+ */
+function heldRelayIdsOf(node) {
+    const ids = new Set();
+    for (const addr of node.listenAddresses()) {
+        if (!addr.includes("/p2p-circuit"))
+            continue;
+        const id = CIRCUIT_RELAY_ID.exec(addr)?.[1];
+        if (id !== undefined)
+            ids.add(id);
+    }
+    return [...ids];
+}
 /**
  * DOD-M15-RELAYSLOTS-1 — how long an agent skips a relay that refused it for a relay-side fault.
  *
@@ -449,6 +471,34 @@ const AUTHORSHIP_CONTENT_HASH_MISMATCH = "authorship_hash_mismatch";
  * not of the code, because the check ran before the signature was verified.
  */
 const AUTHORSHIP_SESSION_MISMATCH = "session_mismatch";
+/**
+ * ─── 033-ACKEMIT: the three things that can be wrong with an ACKNOWLEDGEMENT ─────────────────────
+ *
+ * All three are `unusable` — the message is refused and the session lives. None of them is an
+ * identity fault: by the time any is returned the signature has verified, the signer IS this
+ * session's counterparty, and the claim is about this content in this conversation. What is wrong is
+ * what the claim says the sender had SEEN.
+ *
+ * They are three names and not one because the operator's next move differs for each, and because an
+ * investigator who cannot tell "your counterparty is on an older build" from "your counterparty
+ * acknowledged something you never sent" is looking at the wrong half of the problem.
+ *
+ * ⚠️ **NAME WHAT WAS OBSERVED, NEVER AN INFERRED CONCLUSION** (`DOD-M15-ERRSTRING-1`). Not one of
+ * these says "peer is malicious" — a mismatch is equally what a genuine software fault on the other
+ * side looks like, and an error that names a party the code did not check is this milestone's
+ * founding defect.
+ */
+/** A v1 claim: it carries no `last_seen_hash`, so it asserts a POSITION and no content at all. */
+const AUTHORSHIP_ACK_HASH_ABSENT = "ack_hash_absent";
+/** The hash names content this side does not hold at the position the claim names. */
+const AUTHORSHIP_ACK_HASH_MISMATCH = "ack_hash_mismatch";
+/** The hash names content this side has never held — not in the tree, and not held pending a gap. */
+const AUTHORSHIP_ACK_HASH_UNKNOWN = "ack_hash_unknown_content";
+const ACK_HASH_REASONS = new Set([
+    AUTHORSHIP_ACK_HASH_ABSENT,
+    AUTHORSHIP_ACK_HASH_MISMATCH,
+    AUTHORSHIP_ACK_HASH_UNKNOWN,
+]);
 /**
  * ⚠️ **THE REFUSALS THAT SAY THIS ARE THE ONES WHERE THE REFUSAL DOES NOT HOLD — NOT ALL OF THEM.**
  *
@@ -669,7 +719,10 @@ export class SessionNodeManager {
          */
         const claimedRegistration = !client.hasSession(sessionId);
         if (claimedRegistration) {
-            client.registerSession(sessionId, node);
+            // 033-ACKEMIT: the seal transport submits a ctrl leaf like any other, so it needs the same
+            // acknowledgement seed. It carries no assignment of its own, so the genesis is supplied here
+            // from the session's own active entry rather than derived inside the client.
+            client.registerSession(sessionId, node, undefined, undefined, this.#sessionGenesisPrevRoot(agentName, sessionId));
         }
         else {
             /**
@@ -998,9 +1051,10 @@ export class SessionNodeManager {
     // initiator (consuming its agent's standing receiver) and the responder (consuming its agent's)
     // would contend for a single node and thrash. Keyed by agentName. A creation-in-flight guard set
     // prevents two concurrent ensure() calls from building two nodes for the same agent.
-    // `hasReservation`: this receiver came up holding a /p2p-circuit address. The
-    // watchdog uses it to tell "lost its reservation" (must recover) apart from
-    // "never had one" (already degraded, and already loud) — see #reservationWatchdogTick.
+    // `relayPeerIds`: the relays this receiver holds an announced circuit through. The watchdog reads
+    // it as a COUNT — zero tells "never had one" (already degraded, and already loud) apart from a
+    // loss, and a drop that leaves it non-empty is a lost relay the agent can absorb without being
+    // rebuilt. See #reservationWatchdogTick.
     /**
      * DOD-M12B-SESSION-SEED-1 — session id → the transport seed its node identity derives from.
      *
@@ -1501,6 +1555,18 @@ export class SessionNodeManager {
      * permanently less provable than the identical message that did not, for a reason with nothing to
      * do with authorship.
      */
+    /**
+     * 033-ACKEMIT review F1 — what this side has ACTUALLY RECEIVED, per session: the canonical
+     * position and the content hash at it.
+     *
+     * ⚠️ **IT MIRRORS THE RELAY CLIENT'S `#lastSeen` RATHER THAN REPLACING IT, and the duplication is
+     * deliberate.** The submit path needs the value on the client, because that is where the claim is
+     * built; the unwitnessed content path needs it here, because a session with no relay client has no
+     * client to read it from. Both are written from ONE place — `#noteAcknowledgeable` below — so they
+     * cannot come to disagree, and the client is preferred on read because it also sees leaves the
+     * relay delivered that never came through this path.
+     */
+    #lastAck = new Map();
     #heldContent = new Map();
     // DOD-MSG-4: the relay's high-water canonical sequence for this session — the largest sequence the
     // relay has witnessed (max over leaf_deliver). Keyed #k(agent,session). EXPOSED for the next
@@ -1821,7 +1887,7 @@ export class SessionNodeManager {
      * when its value is `undefined` — forces each of the three callers to state what this message was
      * hashed under, so a new fourth caller cannot omit it by accident.
      */
-    async #parkContent(agentName, sessionId, contentHashHex, content, structure1Cbor, structure2Cbor, contentHashAlg) {
+    async #parkContent(agentName, sessionId, contentHashHex, content, structure1Cbor, structure2Cbor, contentHashAlg, structure1Signature, parkLeafKind) {
         // Fault injection FIRST, so it reproduces the real shape: the refusal happens at the same point
         // the live hook refuses (before any deposit), with the same event and the same `cause`.
         if (this.#parkFaultRemaining > 0) {
@@ -1857,6 +1923,11 @@ export class SessionNodeManager {
                 // on recover too (sealed INTO the ciphertext envelope — INV-3: the relay still sees only ciphertext).
                 structure1Cbor,
                 structure2Cbor,
+                // 034-CARRYLEAF: the author's signature over `structure1Cbor`, so the RECIPIENT can witness
+                // this leaf if its author never does. Without it the mailbox route stays truncatable.
+                structure1Signature,
+                // 034-CARRYLEAF: the leaf DOMAIN, so a recovered leaf is never witnessed under a guess.
+                leafKind: parkLeafKind,
                 // B2b: the park route must name the same algorithm the direct frame did, or the recipient
                 // verifies the same message two different ways depending on which route it took.
                 contentHashAlg,
@@ -1994,6 +2065,24 @@ export class SessionNodeManager {
             // sealed record so it survives a daemon restart and is readable on the cert-read surface
             // (cello_get_sealed_receipt). JSON string with hex-encoded pubkeys; NULL until sealed.
             // Inline idempotent migration (NOT Flyway — this is the client-side SQLite, AC-011).
+            /**
+             * 033-ACKEMIT — THE SESSION'S GENESIS PREV_ROOT, and it is persisted for ONE reason: a
+             * restart.
+             *
+             * It is a pure function of the two participant keys, the session id and the SESSION
+             * TIMESTAMP — and the timestamp arrives on the directory-signed relay assignment and lives
+             * nowhere else. A session restored from this table after a daemon restart re-registers with
+             * no assignment in hand, so without this column the daemon could not say what the first
+             * message of that session acknowledges, and every send on it would be refused rather than
+             * signed. Deriving is still preferred where the assignment IS in memory; this is what makes
+             * the derivation survive the process.
+             *
+             * NULL for every session opened before this column existed. Those sessions acknowledge
+             * nothing until the counterparty has sent something — they claim position 0 with no hash,
+             * which asserts nothing rather than asserting a position they cannot back — and from the
+             * first leaf they receive they acknowledge content like any other session.
+             */
+            "ALTER TABLE sessions ADD COLUMN genesis_prev_root BLOB",
             "ALTER TABLE sessions ADD COLUMN seal_legibility TEXT",
             "ALTER TABLE sessions ADD COLUMN sealed_root_hex TEXT",
             // M7 legibility-TBS-binding (responder verify): the counterparty's FROST primary (group)
@@ -4146,7 +4235,9 @@ export class SessionNodeManager {
         const sr = this.#standingReceivers.get(agentName);
         if (!sr)
             return "absent";
-        if (sr.hasReservation && sr.relayPeerId !== undefined)
+        // AT LEAST ONE. Holding two circuits and losing one leaves the agent perfectly dialable, so it
+        // is not "retrying" — reporting it as such sends an operator hunting a fault that is not there.
+        if (sr.relayPeerIds.length > 0)
             return "reserved";
         const retry = this.#srReservationRetry.get(agentName);
         return retry !== undefined && retry.attempts > SR_RESERVATION_MAX_RETRIES ? "unreachable" : "retrying";
@@ -4169,6 +4260,21 @@ export class SessionNodeManager {
      * counterparty_session_* fields. Read-only — does NOT consume the standing receiver
      * (unlike acceptSession, which hands it off).
      */
+    /**
+     * 032-RELAYSPREAD — would this receiver ADMIT an inbound dial from this relay?
+     *
+     * The gater's inbound carve-out is the security-sensitive half of the spread: only relays whose
+     * own reservation is confirmed held earn it, so a directory that merely NAMES a relay cannot dial
+     * in behind the gate. Nothing could observe that from outside the manager, and the review found
+     * the consequence: substituting the CANDIDATE list for the held list at the `setReservedRelayPeers`
+     * call kept every test in the unit green while shipping exactly that hole. A guard whose wiring
+     * cannot be observed is a guard nothing can test.
+     *
+     * Reads the live gater rather than a copy, so it cannot drift from what the gate actually does.
+     */
+    isRelayCarvedOutInbound(agentName, relayPeerId) {
+        return this.#standingReceivers.get(agentName)?.gater.holdsInboundCarveOut(relayPeerId) ?? false;
+    }
     getStandingReceiverInfo(agentName) {
         // DOD-LOOP-1: the initiator advertises ITS OWN agent's standing receiver, which it then reuses
         // as the session node — so the advertised endpoint matches the node the counterparty dials.
@@ -4742,8 +4848,22 @@ export class SessionNodeManager {
                 this.#relayClients.set(clientKey, client);
             }
             const sessionIdHexForRelay = Buffer.from(relay.sessionIdBytes).toString("hex");
-            client.registerSession(sessionIdHexForRelay, node, this.#relayLeafHandler(agentName, sessionId, correlationId), relay.assignment);
+            /**
+             * ⚠️ THE GENESIS IS WRITTEN BEFORE THE REGISTRATION, NOT AFTER — review F10.
+             *
+             * `#sessionGenesisPrevRoot` reads the entry's assignment first and the stored column second,
+             * and BOTH were still unset at this line: the entry's assignment is set below and the column
+             * is written below that. So the argument was always `undefined` here on a first attach, and
+             * the seed only survived because `registerSession` falls back to deriving one from the
+             * assignment it is handed. That is a dead argument standing next to a live fallback, which
+             * reads as deliberate and is the shape a later edit removes the wrong half of.
+             */
             const entry = this.#activeNodes.get(this.#k(agentName, sessionId));
+            if (entry)
+                entry.relayAssignment = relay.assignment;
+            if (relay.assignment)
+                this.#persistGenesisPrevRoot(agentName, sessionId, relay.assignment);
+            client.registerSession(sessionIdHexForRelay, node, this.#relayLeafHandler(agentName, sessionId, correlationId), relay.assignment, this.#sessionGenesisPrevRoot(agentName, sessionId));
             if (entry) {
                 entry.relayClient = client;
                 entry.relaySessionIdBytes = relay.sessionIdBytes;
@@ -4752,7 +4872,8 @@ export class SessionNodeManager {
                 entry.relayPeerId = relay.relayPeerId;
                 entry.relayAddrs = relay.relayAddrs;
                 // Review H1: the dial path needs the credential in hand, not just the endpoint.
-                entry.relayAssignment = relay.assignment;
+                // (Set above, before `registerSession`, so the genesis lookup it does has something to
+                // find — see the note there.)
                 // MSG-2 startup-flush: also PERSIST it, so a restart's crash-backstop flush (which runs
                 // before the in-memory entry exists) can deposit un-acked content to the same relay.
                 try {
@@ -4868,6 +4989,10 @@ export class SessionNodeManager {
             }
             // registerSession presents the assignment eagerly (see its own comment). No leaf handler: this
             // relay is not witnessing the session, it only needs the binding that authorizes the dial.
+            // 033-ACKEMIT: no genesis is passed and none is needed. This client is not witnessing the
+            // session — it never submits — and `registerSession` derives a seed from the assignment
+            // anyway. Reaching into the session record for one here would also be reaching with the RELAY
+            // session id, which is not the key that record is stored under.
             client.registerSession(sessionIdHex, node, undefined, relay.assignment);
             this.#logger.info("session.relay.assignment.presented_to_reservation_relay", {
                 agentName,
@@ -7126,6 +7251,76 @@ export class SessionNodeManager {
      * on first access (so it survives a restart — AC-007). Never returns null;
      * an unknown session yields an empty tree.
      */
+    /**
+     * The session's genesis prev_root — what its FIRST message acknowledges, before anything has been
+     * received (033-ACKEMIT).
+     *
+     * DERIVED FIRST, STORED SECOND — and this docblock used to say "derived, never stored", which
+     * stopped being true inside this same unit. Rewritten rather than deleted: a reader who believed
+     * the first sentence would delete the column read below as redundant, and take the restart case
+     * with it.
+     *
+     * The live assignment is authoritative, because it is the thing the value is defined by. The
+     * stored column covers the one case the derivation cannot: a session restored after a restart
+     * re-registers with no assignment, and the session TIMESTAMP the genesis needs lives nowhere
+     * else.
+     *
+     * `undefined` when neither is available. The callers do not paper over that — they say, in the
+     * log and in the claim itself, that this session acknowledges nothing yet.
+     */
+    #sessionGenesisPrevRoot(agentName, sessionId) {
+        const assignment = this.#activeNodes.get(this.#k(agentName, sessionId))?.relayAssignment;
+        if (assignment) {
+            return computeGenesisPrevRoot(assignment.participantA, assignment.participantB, Uint8Array.from(Buffer.from(sessionId, "hex")), assignment.sessionTimestamp);
+        }
+        /**
+         * THE RESTART CASE. A session restored from the database re-registers with no assignment, so
+         * the derivation above has nothing to work from and the stored copy is the only answer. Read
+         * second, never first: the live assignment is authoritative, and a stored value that ever
+         * disagreed with it would be the more dangerous of the two to prefer.
+         */
+        const row = this.#db
+            ?.prepare("SELECT genesis_prev_root FROM sessions WHERE agent_id = ? AND session_id = ?")
+            .get(this.#requireAgentId(agentName), sessionId);
+        const stored = row?.genesis_prev_root;
+        const bytes = stored instanceof Uint8Array ? stored : Buffer.isBuffer(stored) ? new Uint8Array(stored) : null;
+        // A stored value of the wrong width is not a genesis. Refusing it here sends the caller down its
+        // own named refusal, which is a better outcome than signing an acknowledgement of 17 bytes.
+        return bytes && bytes.length === 32 ? bytes : undefined;
+    }
+    /**
+     * Persist the session's genesis prev_root, once, at the moment the assignment arrives.
+     *
+     * `WHERE genesis_prev_root IS NULL` rather than a plain update: the value cannot legitimately
+     * change for the life of a session, so the second writer is either redundant or wrong, and the
+     * first write is the one derived closest to the assignment that opened the session.
+     */
+    #persistGenesisPrevRoot(agentName, sessionId, assignment) {
+        if (!this.#db)
+            return;
+        try {
+            const genesis = computeGenesisPrevRoot(assignment.participantA, assignment.participantB, Uint8Array.from(Buffer.from(sessionId, "hex")), assignment.sessionTimestamp);
+            this.#db
+                .prepare("UPDATE sessions SET genesis_prev_root = ? WHERE agent_id = ? AND session_id = ? AND genesis_prev_root IS NULL")
+                .run(Buffer.from(genesis), this.#requireAgentId(agentName), sessionId);
+        }
+        catch (err) {
+            /**
+             * LOUD, AND IT DOES NOT BLOCK. Losing this row costs the session its acknowledgements after a
+             * restart — sends are then refused by name until the counterparty speaks — and that is a far
+             * smaller harm than failing the session open that is in progress. Reported at ERROR because
+             * the failure is invisible until a restart that may be days away.
+             */
+            this.#logger.error("session.genesis.persist.failed", {
+                agentName, sessionId,
+                error: err instanceof Error ? err.message : String(err),
+                impact: "this session's starting point was not written to the database. Everything works until " +
+                    "this daemon restarts; after that, a send on this session is refused until the " +
+                    "counterparty has sent something, because the daemon cannot say what its first message " +
+                    "acknowledges.",
+            });
+        }
+    }
     getSessionTree(agentName, sessionId) {
         const key = this.#k(agentName, sessionId);
         const cached = this.#trees.get(key);
@@ -7321,7 +7516,7 @@ export class SessionNodeManager {
                     entry.extraRelayClientKeys = [...(entry.extraRelayClientKeys ?? []), clientKey];
                 }
                 // No leaf handler: this relay is not witnessing the session, it only needs the binding.
-                client.registerSession(sessionIdHex, entry.node, undefined, assignment);
+                client.registerSession(sessionIdHex, entry.node, undefined, assignment, this.#sessionGenesisPrevRoot(agentName, sessionId));
                 const recorded = await client.recordAssignmentAndWait(entry.node, sessionIdHex);
                 if (recorded) {
                     this.#logger.info("session.transport.dial_authorized", {
@@ -7688,6 +7883,43 @@ export class SessionNodeManager {
                         ...(witnessed.detail === undefined ? {} : { detail: witnessed.detail }),
                         correlationId,
                     });
+                    /**
+                     * ─── 033-ACKEMIT: THIS ONE REACHES THE OPERATOR, NOT JUST THE LOG ─────────────────────
+                     *
+                     * Every other refusal on this branch is an availability answer — the relay is busy, the
+                     * session is not recorded, the stream died — and the send degrades to unwitnessed, which
+                     * is the documented path. These two are not availability. The WITNESS is telling us that
+                     * the acknowledgement this daemon signed disagrees with the record, and that is a
+                     * statement about the integrity of the conversation.
+                     *
+                     * `logger.warn` followed by a bare assignment is the exact shape Invariant 2's recurring
+                     * box names — a guard that fires correctly into a file nobody opens. The named surface is
+                     * `noteContentRefusal`, the same one every inbound refusal in this file uses, so it lands
+                     * where the operator already looks for "something was rejected and here is why".
+                     *
+                     * It does NOT stop the send. The relay refused to witness this leaf, so the message
+                     * degrades to unwitnessed exactly as any other refusal does and the operator keeps their
+                     * conversation; what changes is that they are told the record has stopped agreeing with
+                     * itself, at the moment it happens, instead of discovering it at the seal.
+                     */
+                    if (witnessed.reason === "ack_hash_mismatch" || witnessed.reason === "ack_hash_unverifiable") {
+                        const relayFault = witnessed.reason === "ack_hash_unverifiable";
+                        /**
+                         * THE SENTENCES LIVE IN `refusal-reasons.ts` — 033-ACKEMIT review F6. They were inline
+                         * here, behind a real relay answering a real refusal, so nothing could test them; and
+                         * the one that was wrong (a remedy naming a relay handover this system does not have)
+                         * was wrong for as long as that lasted.
+                         */
+                        const { impact, guidance } = relayAckHashRefusalNotice(relayFault, this.#mailboxRouteAvailable(agentName));
+                        this.#logger.error("session.relay.ack_hash.refused", {
+                            agentName, sessionId, correlationId, reason: witnessed.reason,
+                            ...(witnessed.detail === undefined ? {} : { detail: witnessed.detail }),
+                            impact, guidance,
+                        });
+                        this.noteContentRefusal(agentName, sessionId, witnessed.reason, {
+                            kind: REFUSAL_KINDS.REFUSED, impact, guidance,
+                        });
+                    }
                     relayRefusal = witnessed.reason;
                 }
             }
@@ -7708,6 +7940,16 @@ export class SessionNodeManager {
         // `finally` retires — same defect, other end, other cap (64 outbound per protocol per
         // connection). See the note on #handleContentStream's finally.
         let sendStream;
+        /**
+         * 034-CARRYLEAF — HOISTED OUT OF THE TRY so the PARK path in the catch can carry them.
+         *
+         * The park copy is built when the direct send fails, which is inside the catch below; declaring
+         * these in the try left the parked envelope with only the relay-WITNESSED claim, so a message
+         * its author deliberately did not witness was parked with no ordering claim at all and could
+         * never be witnessed by its recipient.
+         */
+        let frameS1;
+        let frameSig;
         try {
             /**
              * ─── EVERY FRAME CARRIES ITS OWN PROOF — `DOD-M15-AUTHORSHIP-ABSENT-1` ────────────────────
@@ -7731,8 +7973,8 @@ export class SessionNodeManager {
              * widened that window enough to break the live two-node round trip. Measured, not reasoned
              * about: seam-3 went red and both daemons logged `session.key.agreed` before the refusal.
              */
-            let frameS1 = orderingS1;
-            let frameSig = orderingSig;
+            frameS1 = orderingS1;
+            frameSig = orderingSig;
             let frameS2 = orderingS2;
             if (frameS1 === undefined || frameSig === undefined) {
                 const own = await this.#signOwnContentClaim(agentName, sessionId, entry, contentHash);
@@ -7870,6 +8112,21 @@ export class SessionNodeManager {
                 // unknown CBOR key, so emitting it is safe for every build in existence; a newer one reads
                 // it and verifies under the named algorithm instead of assuming.
                 content_hash_alg: contentHashAlg,
+                /**
+                 * 034-CARRYLEAF review F5 — WHICH LEAF DOMAIN this content belongs to.
+                 *
+                 * Documents and rejection envelopes ride this same frame, and the receiver had no way to
+                 * recover their kind: it appended them locally as "doc" from its own inspection of the
+                 * body, while anything it witnessed on the sender's behalf went to the relay as a MESSAGE
+                 * leaf. The certified root is over content hashes, so no root diverges — but the relay's
+                 * canonical log and the carried `leaf_kind` would describe the leaf as something it is not,
+                 * and a leaf kind selects a HASH DOMAIN everywhere else in this protocol.
+                 *
+                 * Same argument as `content_hash_alg` beside it: an older peer ignores an unknown CBOR key,
+                 * so emitting it is safe for every build in existence, and a receiver that does not see it
+                 * declines to witness rather than guessing (see `#witnessReceivedLeaf`).
+                 */
+                leaf_kind: leafKind,
             });
             // Injected dial failure — thrown from inside the try so it lands in exactly the catch the
             // real connection_lost lands in, and the whole downstream path (untrack → park → durable
@@ -7948,7 +8205,21 @@ export class SessionNodeManager {
                 ...this.#streamCensus(entry.node, entry.counterpartySessionPeerId),
                 correlationId,
             });
-            const attempt = await this.#parkContent(agentName, sessionId, hashHex, content, orderingS1, orderingS2, contentHashAlg);
+            /**
+             * ⚠️ **THE PARKED COPY CARRIES THE SIGNED CLAIM, NOT ONLY THE WITNESSED ONE — 034-CARRYLEAF
+             * review F1, and this is what closes the withholding attack on the MAILBOX route.**
+             *
+             * It passed `orderingS1`, which exists only when the relay witnessed this leaf — so a message
+             * the sender deliberately did not witness was parked with no ordering claim at all, and the
+             * recipient recovered it holding nothing the relay would accept as proof of authorship. They
+             * could read it and could never put it in a receipt.
+             *
+             * `frameS1`/`frameSig` are the pair the DIRECT frame carries for this same message: the
+             * relay's witnessed claim when there is one, and otherwise a claim this agent signed itself.
+             * Either way it is the author's signature over the author's own ordering claim, which is the
+             * only form the relay accepts when the recipient witnesses on their behalf.
+             */
+            const attempt = await this.#parkContent(agentName, sessionId, hashHex, content, frameS1, orderingS2, contentHashAlg, frameSig, leafKind);
             if (attempt.outcome === "parked") {
                 this.#noteImpairmentRetention(agentName, sessionId, "parked");
                 return { ok: true, delivered: false, parked: true, ...(assignedSeq === undefined ? {} : { sequenceNumber: assignedSeq }), ...(sentAuthorship === undefined ? {} : { authorship: sentAuthorship }), ...(relayRefusal === undefined ? {} : { relayRefusal }) };
@@ -12008,6 +12279,32 @@ export class SessionNodeManager {
          * wired, this line is the difference between an all-clear and a permanent silent discard — and
          * finding that then costs more than the clause costs now.
          */
+        /**
+         * ─── WITNESS A RECOVERED MESSAGE ITS SENDER NEVER WITNESSED — 034-CARRYLEAF review F1 ────────
+         *
+         * The mailbox route's half of the withholding fix. `recoveredSeq` absent means no relay ordering
+         * record came with it, which is the same shape the direct path treats as "their submit never
+         * happened" — and it is reached the same two ways: their relay was briefly unreachable, or they
+         * are withholding on purpose.
+         *
+         * ⚠️ THE SIGNATURE COMES FROM THE ENVELOPE, AND ONLY A v4 ENVELOPE HAS ONE. `parkSig`
+         * authenticates the DEPOSIT — it signs `(session_id, recipient_pubkey, content_hash)` — and the
+         * relay will not accept it, because a counter-submit is admissible only against the author's own
+         * signature over their own ordering claim. A v2 or v3 envelope therefore cannot be witnessed on
+         * its author's behalf, and is left alone rather than guessed at.
+         *
+         * **So this route is closed against a peer running a stock client, and open to one that
+         * deliberately emits an older envelope.** Requiring v4 is the step that closes it completely,
+         * and it waits on nothing in the field emitting v2 or v3 — the same tolerate-then-enforce
+         * sequence every bilateral wire change in this milestone follows.
+         */
+        if (result.ok && result.held !== true && result.screenedOut !== true &&
+            recoveredSeq === null && env.structure1Cbor && env.structure1Signature) {
+            const kind = env.leafKind;
+            if (typeof kind === "number") {
+                this.#witnessReceivedLeaf(agentName, sessionId, contentHash, env.structure1Cbor, env.structure1Signature, kind, correlationId);
+            }
+        }
         if (priorDeclaredAlg !== undefined && result.ok && result.held !== true && result.screenedOut !== true) {
             // Cleared ONLY on a real reconciliation. Clearing on the lookup (as this did) forgets the
             // refusal even when the recovery fails, so the next genuine reconciliation says nothing.
@@ -12710,6 +13007,145 @@ export class SessionNodeManager {
         this.#sessionContentKeys.set(this.#k(agentName, sessionId), Uint8Array.from(key));
         this.#contentEncryptionReasons.delete(this.#k(agentName, sessionId));
     }
+    /**
+     * Hand the relay a leaf this agent RECEIVED whose author never submitted it — 034-CARRYLEAF.
+     *
+     * **The attack this closes:** somebody sends you something, declines to have it witnessed, and
+     * seals one message short. The relay's account really does end before their last message, so your
+     * receipt does too — every leaf validly signed, nothing false, the last thing said simply absent.
+     *
+     * **Why this is admissible and not a forgery:** the bytes are theirs, the signature over them is
+     * theirs, and `#verifyAuthorshipClaim` verified it against this session's counterparty before a
+     * word of it was ingested. The relay verifies it again against the directory-signed assignment.
+     * Nothing here is asserted by us except that we received it.
+     *
+     * ⚠️ BEST-EFFORT, AND ITS FAILURE IS NOT SILENT. If the relay cannot be reached, the message is
+     * still delivered and read — refusing it would make the relay a precondition for reading mail,
+     * which is the thing every unit on this path has been careful not to do. What is lost is only the
+     * guarantee that it can enter a receipt, and that surfaces where the operator can act on it: the
+     * seal's own pre-flight refuses a gapped chain by name (`seal_carry_noncontiguous`) with guidance,
+     * so the consequence reaches them at the moment it matters rather than as a log line here.
+     */
+    #witnessReceivedLeaf(agentName, sessionId, contentHash, structure1Cbor, senderSignature, 
+    /** The domain the AUTHOR assigned this leaf, read off their frame — never guessed (review F5). */
+    leafKind, correlationId) {
+        const entry = this.#activeNodes.get(this.#k(agentName, sessionId));
+        if (!entry?.relayClient || !entry.relaySessionIdBytes) {
+            this.#logger.warn("session.content.witness_received.unavailable", {
+                agentName, sessionId, correlationId,
+                impact: "a message arrived that its sender never had witnessed, and this side has no relay client " +
+                    "for the session, so it could not be witnessed here either. It is delivered and readable; " +
+                    "it cannot enter a notarized receipt until some party witnesses it.",
+            });
+            return;
+        }
+        void entry.relayClient
+            .witnessReceivedLeaf(entry.node, entry.relaySessionIdBytes, contentHash, leafKind, {
+            structure1Cbor,
+            senderSignature,
+        })
+            .then((res) => {
+            if (res.ok) {
+                this.#logger.info("session.content.witness_received", {
+                    agentName, sessionId, correlationId, relaySequence: res.sequence_number,
+                    impact: "this side witnessed a message its SENDER did not. The leaf now holds a canonical " +
+                        "position, so it can appear in a receipt whatever the sender does next.",
+                });
+                // It has a position now, so it can be acknowledged like any other received message.
+                this.#noteAcknowledgeable(agentName, sessionId, res.sequence_number - 1, contentHash);
+                return;
+            }
+            /**
+             * `counter_submit_duplicate` is NOT a failure and must not be logged as one: it means this
+             * relay already holds the leaf, which is the outcome we wanted. It fires on the ordinary
+             * race where the sender's own submit lands while ours is in flight.
+             */
+            if (res.reason === "counter_submit_duplicate") {
+                this.#logger.info("session.content.witness_received.already_held", {
+                    agentName, sessionId, correlationId,
+                    impact: "the relay already held this leaf — its sender witnessed it after all, or in parallel with us.",
+                });
+                return;
+            }
+            this.#logger.error("session.content.witness_received.failed", {
+                agentName, sessionId, correlationId, reason: res.reason,
+                ...(res.detail === undefined ? {} : { detail: res.detail }),
+                impact: "a message arrived that its sender never had witnessed, and this side could not witness " +
+                    "it either. It is delivered and readable. What is at risk is the RECEIPT: if this " +
+                    "message is still unwitnessed when the conversation is sealed, the seal will refuse a " +
+                    "gapped chain by name rather than quietly leaving it out.",
+            });
+        })
+            .catch((err) => {
+            this.#logger.error("session.content.witness_received.threw", {
+                agentName, sessionId, correlationId, error: extractErrorMessage(err),
+            });
+        });
+    }
+    /**
+     * Record that a message ARRIVED and was accepted at a known canonical position — 033-ACKEMIT
+     * review F1.
+     *
+     * The one writer for both copies of the acknowledgement, so the claim this daemon signs says what
+     * it actually received rather than what the relay got round to delivering back to it.
+     *
+     * Monotonic, and it must be: a re-delivery or a recovered park of an EARLIER message must not walk
+     * the acknowledgement backwards, and must not swap the hash under an unchanged position.
+     */
+    #noteAcknowledgeable(agentName, sessionId, canonicalSeq, contentHash) {
+        // Relay sequences are 1-based; a canonical leaf index is 0-based. The claim carries the relay's
+        // number, because the relay is what checks it.
+        const relaySeq = canonicalSeq + 1;
+        if (relaySeq < 1)
+            return;
+        const key = this.#k(agentName, sessionId);
+        const prev = this.#lastAck.get(key);
+        if (prev && relaySeq <= prev.seq)
+            return;
+        this.#lastAck.set(key, { seq: relaySeq, hash: Uint8Array.from(contentHash) });
+        const entry = this.#activeNodes.get(key);
+        const sessionIdHex = entry?.relaySessionIdBytes
+            ? Buffer.from(entry.relaySessionIdBytes).toString("hex")
+            : sessionId;
+        entry?.relayClient?.noteReceivedLeaf(sessionIdHex, relaySeq, contentHash);
+    }
+    /**
+     * Test seam: put an own leaf in the HELD state instead of the tree — 033-ACKEMIT.
+     *
+     * The state `placeOwnLeaf` produces when the relay assigns a position ahead of our tail: the leaf
+     * exists on this side and is not in the tree, while the counterparty already has it from the relay
+     * and can acknowledge it. Reproducing it through the real hold map rather than by asserting the
+     * tree is short is what makes the acknowledgement test measure the case instead of a neighbour of
+     * it.
+     */
+    holdOwnLeafForTest(agentName, sessionId, canonicalSeq, contentHashHex) {
+        const key = this.#k(agentName, sessionId);
+        let held = this.#heldContent.get(key);
+        if (!held) {
+            held = new Map();
+            this.#heldContent.set(key, held);
+        }
+        held.set(canonicalSeq, { content: new Uint8Array(), contentHashHex, origin: "sent", kind: "msg" });
+    }
+    /**
+     * Test seam: put the session's genesis prev_root where a completed session open leaves it —
+     * 033-ACKEMIT.
+     *
+     * ⚠️ THE STATE IS THE PRODUCTION ONE; ONLY HOW IT GOT THERE IS SHORT-CIRCUITED, exactly as
+     * `setSessionContentKeyForTest` short-circuits the key exchange next door.
+     *
+     * In production this value is derived from the directory-signed relay assignment and written to
+     * the session row the moment the session learns it, so every real session has one. A fixture that
+     * builds a session node directly never sees an assignment — so without this seam every content
+     * test built on the fixture would be exercising the "no starting point" REFUSAL path instead of
+     * the thing it was written for, and would report that as a pass or a mysterious failure depending
+     * on which side of the send it sat on.
+     */
+    setSessionGenesisForTest(agentName, sessionId, genesis) {
+        this.#db
+            ?.prepare("UPDATE sessions SET genesis_prev_root = ? WHERE agent_id = ? AND session_id = ?")
+            .run(Buffer.from(genesis), this.#requireAgentId(agentName), sessionId);
+    }
     /**
      * Test seam: drop the agreed key while leaving the session up — the state before an exchange
      * completes, and after a teardown evicts one. Its mirror above is what a completed exchange
@@ -14243,18 +14679,70 @@ export class SessionNodeManager {
         // second meaning: for every session created without an assignment the two are the same value
         // (`relaySessionIdBytes` is set from `sessionId` on exactly those paths).
         const sessionIdBytes = entry.relaySessionIdBytes ?? Uint8Array.from(Buffer.from(sessionId, "hex"));
+        /**
+         * ⚠️ **THIS COMMENT USED TO READ "v1 DELIBERATELY" AND IT WAS RIGHT UNTIL NOW — 033-ACKEMIT.**
+         *
+         * It said `last_seen_hash` was `WITHHOLD-SEAL-1`'s emitter and "not owed here", and that a v1
+         * claim makes no content acknowledgement at all, "which is honest, where an invented one would
+         * not be." Accurate for `020-ACKHASH`, which shipped the reader only. It is rewritten rather
+         * than deleted because it is the sentence that would otherwise explain away the LAST production
+         * path still emitting v1 — and this unit's own Definition of Done is that a grep finds none.
+         *
+         * The reasoning it rested on has been answered: nothing is invented here. The acknowledgement
+         * is read from the same `#lastSeen` entry the submit reads, so a frame built on this path and
+         * one built by a submit make the same claim about the same message.
+         */
+        const sessionIdHexForAck = Buffer.from(sessionIdBytes).toString("hex");
+        /**
+         * The pair, from ONE accessor. Falling back to the session's genesis when there is no relay
+         * client at all is not an invention either: nothing has been witnessed on this session, so the
+         * honest acknowledgement is position 0 and the agreed starting point of the chain.
+         */
+        const ack = entry.relayClient?.lastSeenAck(sessionIdHexForAck)
+            ?? this.#lastAck.get(this.#k(agentName, sessionId))
+            ?? (() => { const g = this.#sessionGenesisPrevRoot(agentName, sessionId); return g ? { seq: 0, hash: g } : undefined; })();
+        if (!ack) {
+            /**
+             * ⚠️ **v1, AND ONLY BECAUSE THERE IS NOTHING TO ACKNOWLEDGE — see `#verifyAcknowledgedContent`
+             * for the receiving half of the same rule, which is what makes this safe rather than a
+             * downgrade.**
+             *
+             * Reaching here means this session has no recorded starting point AND has received nothing.
+             * The claim it produces is `last_seen_seq: 0` with no hash: "I have seen nothing of yours, and
+             * I assert nothing about your content." That is honest, and it is not the fail-open the unit
+             * closes — the hole is a claim that names a POSITION with no content behind it, and this names
+             * no position. A receiver refuses a v1 claim the moment it acknowledges position 1 or beyond.
+             *
+             * It does not throw, and an earlier version did. Sessions brokered without a relay assignment
+             * are real — the directory does not always return one — and throwing there stopped those
+             * sessions sending at all, which trades a hole this claim does not have for a failure of the
+             * thing the product is for.
+             */
+            this.#logger.info("session.content.claim.unacknowledged", {
+                agentName, sessionId,
+                impact: "this message is signed with no acknowledgement of anything received, because this " +
+                    "session has no recorded starting point and nothing has arrived on it yet. It binds the " +
+                    "sender and the content as always; it makes no claim about the counterparty's messages.",
+            });
+            const bare = encodeStructure1({
+                contentHash,
+                senderPubkey: await signer.getPublicKey(),
+                sessionId: sessionIdBytes,
+                lastSeenSeq: 0,
+                timestamp: Date.now(),
+            });
+            return { structure1: bare, signature: await signer.sign(bare) };
+        }
         const structure1 = encodeStructure1({
             contentHash,
             senderPubkey: await signer.getPublicKey(),
             sessionId: sessionIdBytes,
             // The highest counterparty position this session has seen, from the same source the submit
-            // reads. Zero when there is no relay client at all, which is honest: nothing has been
-            // witnessed on this session, so there is no position to acknowledge.
-            lastSeenSeq: entry.relayClient?.lastSeenSeq(Buffer.from(sessionIdBytes).toString("hex")) ?? 0,
+            // reads — and now the content hash at it, taken from the same entry so the two cannot
+            // describe different messages.
+            lastSeenSeq: ack.seq,
             timestamp: Date.now(),
-            // v1 DELIBERATELY. `last_seen_hash` (v2) is `WITHHOLD-SEAL-1`'s emitter and is not owed here;
-            // a v1 claim makes no content acknowledgement at all, which is honest, where an invented one
-            // would not be.
+            lastSeenHash: ack.hash,
         });
         return { structure1, signature: await signer.sign(structure1) };
     }
@@ -14386,8 +14874,178 @@ export class SessionNodeManager {
         if (!bytesEqual(s1.fields.sessionId, expectedSessionId)) {
             return { verdict: "unusable", reason: AUTHORSHIP_SESSION_MISMATCH };
         }
+        /**
+         * ─── AND IT MUST ACKNOWLEDGE SOMETHING THAT WAS ACTUALLY SAID — 033-ACKEMIT ──────────────────
+         *
+         * **THIS IS THE HALF THAT NEEDS NO RELAY, and it is the reason the unit exists.** Everything the
+         * check consumes is on this machine: the counterparty's own signed bytes, and our own tree. We
+         * do not ask the relay what position 7 held — we already know, because we placed the leaf there.
+         *
+         * Until now a signed acknowledgement was a NUMBER. "I saw position 7" attests to a position and
+         * never to content, so the only thing binding the acknowledgement to a message was the relay's
+         * separate receipt over `content_hash ‖ seq ‖ timestamp`. Withhold the relay's half and the
+         * signed claim is an unbacked number — which is how a counterparty seals one message short.
+         * With the hash signed, the claim stands on its own and the relay is no longer load-bearing for
+         * it.
+         *
+         * It runs LAST for the reason the two checks above run last: everything from here down answers
+         * `unusable`, which refuses the message and leaves the session alive, while a `refuted` FREEZES
+         * it. A check that could answer before the signature and the signer were established would hand
+         * a peer a switch for choosing the softer outcome. By this line the claim provably came from
+         * this session's counterparty, about this content, in this conversation — the only question
+         * left is whether what they say they saw is what we sent.
+         */
+        const ackVerdict = this.#verifyAcknowledgedContent(agentName, sessionId, s1.fields);
+        if (ackVerdict)
+            return ackVerdict;
         return { verdict: "verified", senderPubkey: s1Pubkey, senderSig: senderSignature };
     }
+    /**
+     * Does this claim's `last_seen_hash` name content this side actually put at that position?
+     *
+     * Returns `undefined` when the acknowledgement holds, or the `unusable` verdict to refuse with.
+     * Split out of `#verifyAuthorshipClaim` so the three refusal causes can be named separately —
+     * a claim that carries NO hash, one that names a position we never reached, and one that names
+     * the wrong content — rather than collapsing into a single "the proof was bad".
+     *
+     * ⚠️ MISSING, MALFORMED AND MISMATCHED TAKE ONE PATH (§5). A v1 claim carries no content
+     * assertion at all, and treating that as "fine, skip the check" would recreate the fail-open this
+     * unit is closing one layer down: an attacker who wants to evade a mismatch check simply never
+     * supplies a checkable proof. `decodeStructure1` has already refused a v2 whose hash is the wrong
+     * width, so `lastSeenHash === null` here means exactly one thing — a v1 layout — and it is
+     * refused by its own name.
+     */
+    #verifyAcknowledgedContent(agentName, sessionId, fields) {
+        /**
+         * ⚠️ **A v1 CLAIM IS REFUSED THE MOMENT IT NAMES A POSITION — and accepted when it names none.
+         * The split is the whole rule, so it is stated rather than left to the reader.**
+         *
+         * `last_seen_seq >= 1` with no hash IS the defect: "I saw position 7" attests to a position and
+         * never to content, which is the unbacked number this unit exists to stop accepting. Treating
+         * that as "fine, skip the check" would recreate `DOD-M15-AUTHORSHIP-ABSENT-1` one layer down —
+         * an attacker evading a mismatch check simply never supplies a checkable proof.
+         *
+         * `last_seen_seq === 0` with no hash claims nothing about our messages, so there is no check to
+         * skip and nothing to bind. A sender genuinely in that state — a session brokered without a
+         * relay assignment, which the directory does not always return — has nothing to acknowledge,
+         * and refusing them would stop the product's own advertised journey to close a hole they are
+         * not in.
+         *
+         * **THE BOUND, SAID PLAINLY:** a peer can decline to bind by never acknowledging anything.
+         * That costs them their own ratification of our history rather than falsifying it, and it is
+         * the same under-claiming the relay has always allowed (it refuses a `last_seen_seq` that runs
+         * AHEAD of its counter, never one that lags). This unit does not change that either way, and
+         * the follow-on that does is the receiver submitting a hash for what it received.
+         */
+        if (fields.lastSeenHash === null) {
+            return fields.lastSeenSeq >= 1
+                ? { verdict: "unusable", reason: AUTHORSHIP_ACK_HASH_ABSENT }
+                : undefined;
+        }
+        /**
+         * THE GENESIS IS A VALUE, NEVER AN ABSENCE. The first message of a session has seen nothing, and
+         * that case is a defined 32 bytes — the agreed starting point of this two-party chain, derived
+         * from both keys, the session id and the session timestamp. Not 32 zero bytes: a constant
+         * identical across every session is one an attacker can present for any session, so the one
+         * position most exposed to a forged acknowledgement would be the only one nobody could check.
+         */
+        if (fields.lastSeenSeq <= 0) {
+            const genesis = this.#sessionGenesisPrevRoot(agentName, sessionId);
+            /**
+             * ⚠️ **SOFT HERE, AND THIS IS THE ONE BRANCH WHERE THAT IS NOT A FAIL-OPEN — the reasoning is
+             * the load-bearing part, so it is written down rather than assumed.**
+             *
+             * `last_seen_seq` 0 means "I have received nothing from you", and the hash that goes with it
+             * is the session's agreed starting point. It is a genuine value and this daemon always emits
+             * it — but as a CHECK it is close to redundant, because the thing it establishes (that this
+             * claim was made for THIS session) has already been established three lines above by the
+             * session-id binding, against a value derived from the same session id.
+             *
+             * **What an attacker gains by reaching this branch: nothing.** They cannot skip the real
+             * comparison by claiming 0, because claiming 0 is claiming to have acknowledged NOTHING of
+             * ours — it removes their own ratification of our history rather than falsifying it, and the
+             * positional check below is what a claim about our messages has to survive. And they cannot
+             * cause the absence either: whether we hold a genesis depends on our own assignment and our
+             * own database, never on anything they send.
+             *
+             * The alternative was refusing, and it would have been the wrong kind of strict: a session
+             * restored from a row written before this column existed holds no genesis, and every first
+             * message on it would be refused for something the counterparty did not do.
+             */
+            if (!genesis) {
+                this.#logger.info("session.content.ack_hash.genesis_unavailable", {
+                    agentName, sessionId,
+                    impact: "this message acknowledges nothing yet, and this side holds no recorded starting point " +
+                        "for the session, so the acknowledgement was not compared. The message is accepted: it " +
+                        "is already bound to this conversation by the session id inside the signed bytes.",
+                });
+                return undefined;
+            }
+            return bytesEqual(fields.lastSeenHash, genesis)
+                ? undefined
+                : { verdict: "unusable", reason: AUTHORSHIP_ACK_HASH_MISMATCH };
+        }
+        /**
+         * ─── THE ACKNOWLEDGED CONTENT MUST BE SOMETHING THIS SIDE ACTUALLY HOLDS ─────────────────────
+         *
+         * ⚠️ **AN EARLIER VERSION OF THIS CHECK WAS POSITION-ONLY AND HAD A HOLE THE ATTACKER COULD
+         * OPEN THEMSELVES. It is kept described, not deleted, because the false reasoning is the part
+         * worth not repeating.**
+         *
+         * It compared `hashAt(last_seen_seq - 1)` and WAIVED the whole comparison on a session marked
+         * diverged, on this stated ground: *"Who controls this absence? Not the peer: divergence is
+         * caused by OUR submit failing, and nothing the counterparty sends can produce it."*
+         *
+         * **That was false, and the party who could falsify it is the exact attacker this line names.**
+         * Send a message direct-only and never submit its hash: we have no ordering record, so it is
+         * appended at the tail and our tree runs one ahead of the relay's counter. Our very next send
+         * then gets an assigned position BEHIND our frontier, `placeOwnLeaf` takes its
+         * `position_behind_frontier` branch and calls `markSessionDiverged` — and from that moment every
+         * inbound acknowledgement skipped the check entirely. **One withheld message plus one reply from
+         * us disabled the guard, using the behaviour the guard exists to catch.**
+         *
+         * A second defect sat beside it: a claim naming a position our tree has not reached was refused
+         * outright, and a HELD own leaf is exactly that — `placeOwnLeaf` returns `{placed: false}` when
+         * the relay hands us a position ahead of our tail, so the leaf is not in the tree while the
+         * counterparty has already received it and is acknowledging it. We refused their reply for a
+         * transient gap on our own machine.
+         *
+         * **So the question asked is now about CONTENT, not about an index.** Is the hash they name
+         * something this side has — placed in the tree, or held pending a gap? That cannot be switched
+         * off by divergence (it consults no positions), it cannot false-refuse a held leaf, and it still
+         * refuses a hash we have never held, which is the falsehood the check exists to catch.
+         *
+         * The POSITION is then used only to make the check STRONGER where it is safe to: on a session
+         * whose indices still mean relay positions, the hash must sit exactly where they say it does.
+         * Divergence loses that strengthening and keeps the membership test, rather than losing both.
+         */
+        const tree = this.getSessionTree(agentName, sessionId);
+        const ackHex = Buffer.from(fields.lastSeenHash).toString("hex");
+        const heldHere = this.#heldContent.get(this.#k(agentName, sessionId));
+        const held = heldHere ? [...heldHere.values()].some((e) => e.contentHashHex === ackHex) : false;
+        if (tree.indexOfHash(ackHex) === -1 && !held) {
+            return { verdict: "unusable", reason: AUTHORSHIP_ACK_HASH_UNKNOWN };
+        }
+        /**
+         * THE POSITIONAL STRENGTHENING. Skipped — with a WARN, never silently — when this side's indices
+         * no longer mean relay positions, or when the leaf at that position is still held. Neither is
+         * a pass: the membership test above has already run and refused anything we do not hold.
+         */
+        const atPosition = tree.hashAt(fields.lastSeenSeq - 1);
+        if (this.isSessionDiverged(agentName, sessionId) || atPosition === null) {
+            this.#logger.warn("session.content.ack_hash.position_unverifiable", {
+                agentName, sessionId, lastSeenSeq: fields.lastSeenSeq,
+                diverged: this.isSessionDiverged(agentName, sessionId),
+                impact: "the acknowledged content IS in this side's record, so the claim was accepted — but its " +
+                    "POSITION was not checked, because this session's local positions no longer line up with " +
+                    "the relay's, or the leaf at that position has not been placed yet.",
+            });
+            return undefined;
+        }
+        return ackHex === atPosition
+            ? undefined
+            : { verdict: "unusable", reason: AUTHORSHIP_ACK_HASH_MISMATCH };
+    }
     /**
      * `DOD-M15-AUTHORSHIP-ABSENT-1` — the refusal an inbound frame gets when its authorship cannot be
      * established. NOT a freeze: see `AuthorshipVerdict` for why those are different facts.
@@ -14412,7 +15070,29 @@ export class SessionNodeManager {
             ? "a message arrived carrying no proof of who wrote it, so it was NOT ingested, NOT shown and NOT attributed to anyone. Every message in this conversation has to be provable to whoever reads its receipt later, and this one could not be."
             : reason === "authorship_wrong_conversation"
                 ? "a message arrived carrying a VALID signature by this conversation's counterparty — made for a DIFFERENT conversation. The same message, or an old one of theirs, was presented here. It was NOT ingested, NOT shown and NOT added to this conversation's record."
-                : "a message arrived whose proof of authorship could not be checked against it — it was unreadable, or it was signed over different content. It was NOT ingested, NOT shown and NOT attributed to anyone.";
+                /**
+                 * 033-ACKEMIT. Says what was OBSERVED — the two records disagree about what was said —
+                 * and stops there. It does NOT say the counterparty is lying: the same signal is what a
+                 * genuine fault on their side looks like, and naming a conclusion the code did not reach
+                 * is the error-fidelity defect this milestone was opened for.
+                 */
+                /**
+                 * ⚠️ THREE CAUSES, THREE SENTENCES — review F5. They shared one, and it described none of
+                 * them properly: an ABSENT acknowledgement has no part that "does not match", because it
+                 * has no part at all.
+                 *
+                 * All three say what was OBSERVED and stop there. None says the counterparty is lying:
+                 * the same signal is what a genuine fault on their side looks like, and naming a
+                 * conclusion the code did not reach is the error-fidelity defect this milestone exists
+                 * for.
+                 */
+                : reason === AUTHORSHIP_ACK_HASH_ABSENT
+                    ? "a message arrived that is genuinely from your counterparty and genuinely about this conversation — and it does not say which of your messages they had received. Their build is older than yours: a message has to say what it is answering, so that nobody can later leave your last message out of the receipt. It was NOT ingested and NOT shown."
+                    : reason === AUTHORSHIP_ACK_HASH_MISMATCH
+                        ? "a message arrived that is genuinely from your counterparty — and it names a DIFFERENT message of yours in the position where your own record holds one. Both sides agree the message exists; you disagree about which one sits there. It was NOT ingested and NOT shown."
+                        : reason === AUTHORSHIP_ACK_HASH_UNKNOWN
+                            ? "a message arrived that is genuinely from your counterparty — and it says they received something from you that this side has no record of ever holding. It was NOT ingested and NOT shown. This is the check that stops someone quietly rewriting what was said before the receipt is made."
+                            : "a message arrived whose proof of authorship could not be checked against it — it was unreadable, or it was signed over different content. It was NOT ingested, NOT shown and NOT attributed to anyone.";
         /**
          * ⚠️ THE VERB IS THE COUNTERPARTY'S, AND THE GUIDANCE SAYS SO. The reader is the RECEIVING
          * operator, and there is nothing on their machine to change — the missing signature is produced
@@ -14454,16 +15134,44 @@ export class SessionNodeManager {
              * substring match on a sentence cannot see that the sentence lost its head — so the assertion
              * below pins what it OPENS with, which a truncation cannot survive.
              */
-            : "STOPPED ON PURPOSE. This copy was refused and the message itself was not kept. " +
-                // Review F2: chosen from what THIS machine can do, not asserted. An agent with no identity
-                // key cannot open a mailbox copy either, and telling them to wait for one would be the same
-                // false promise on a different refusal.
-                (this.#mailboxRouteAvailable(agentName) ? REFUSAL_MAY_STILL_ARRIVE : REFUSAL_NO_OTHER_ROUTE) +
-                " Almost always their CELLO build is older than this one: a build from before message signing " +
-                "does not attach a signature at all. Ask which version they are running, and tell them to " +
-                "upgrade — this will keep happening until they do, and only they can fix it. If they are on " +
-                "the SAME version as you, that explanation does not hold: confirm with them OUT OF BAND " +
-                "before opening another session.";
+            /**
+             * 033-ACKEMIT — TWO PATHS, AND THE FIRST IS THE ONE THAT ACTUALLY HAPPENS.
+             *
+             * Capped at two (Invariant 4): an affordance list that enumerates everything is a menu. The
+             * verb is the counterparty's in both cases — there is nothing to change on this machine — so
+             * it names the one move that fixes the likely cause and the one that settles the other.
+             */
+            /**
+             * ⚠️ AND THREE REMEDIES, because the shared one was WRONG for two of the three. It told the
+             * reader their counterparty's build was probably old — which is impossible for a claim that
+             * carries an acknowledgement, since only a newer build sends one — and then told them to
+             * abandon the conversation. Two is the cap on each (Invariant 4); the verb is the
+             * counterparty's in every case, because there is nothing to change on this machine.
+             */
+            : reason === AUTHORSHIP_ACK_HASH_ABSENT
+                ? "STOPPED ON PURPOSE, and this is NOT about their signature — it verified. " +
+                    (this.#mailboxRouteAvailable(agentName) ? REFUSAL_MAY_STILL_ARRIVE : REFUSAL_NO_OTHER_ROUTE) +
+                    " Their build is older than yours and does not say what it has received. Ask which version " +
+                    "they are running and tell them to upgrade — only they can fix it, and this will keep " +
+                    "happening until they do."
+                : reason === AUTHORSHIP_ACK_HASH_MISMATCH || reason === AUTHORSHIP_ACK_HASH_UNKNOWN
+                    ? "STOPPED ON PURPOSE, and this is NOT about their signature or their version — both are " +
+                        "fine. " +
+                        (this.#mailboxRouteAvailable(agentName) ? REFUSAL_MAY_STILL_ARRIVE : REFUSAL_NO_OTHER_ROUTE) +
+                        " Your record of this conversation and theirs have stopped agreeing about what you sent " +
+                        "them. Confirm with them OUT OF BAND what they actually received from you. If it matches " +
+                        "what you sent, this was a fault and a new session will clear it; if it does not, do not " +
+                        "carry on in this one."
+                    : "STOPPED ON PURPOSE. This copy was refused and the message itself was not kept. " +
+                        // Review F2: chosen from what THIS machine can do, not asserted. An agent with no identity
+                        // key cannot open a mailbox copy either, and telling them to wait for one would be the same
+                        // false promise on a different refusal.
+                        (this.#mailboxRouteAvailable(agentName) ? REFUSAL_MAY_STILL_ARRIVE : REFUSAL_NO_OTHER_ROUTE) +
+                        " Almost always their CELLO build is older than this one: a build from before message signing " +
+                        "does not attach a signature at all. Ask which version they are running, and tell them to " +
+                        "upgrade — this will keep happening until they do, and only they can fix it. If they are on " +
+                        "the SAME version as you, that explanation does not hold: confirm with them OUT OF BAND " +
+                        "before opening another session.";
         this.#logger.error("session.content.refused", {
             agentName, sessionId, correlationId, reason, ...detail, impact, guidance,
         });
@@ -14546,7 +15254,29 @@ export class SessionNodeManager {
              */
             const auth = this.#verifyAuthorshipClaim(agentName, sessionId, structure1Cbor, s2Sig, contentHash);
             if (auth.verdict === "unusable") {
-                if (auth.reason === AUTHORSHIP_CONTENT_HASH_MISMATCH) {
+                /**
+                 * ⚠️ **THE ACK CAUSES REACH THIS PATH TOO, AND THEY ARE NOT A DECODER PROBLEM** — review F7.
+                 *
+                 * `#verifyAuthorshipClaim` has two callers. This one is reached from park RECOVERY, where
+                 * it is the only authorship check that runs — so 033-ACKEMIT's acknowledgement causes
+                 * started arriving here and fell into the generic `else` below, which logs
+                 * `…ordering.malformed` and buries the cause in `structure1Reason`. That event name sends
+                 * the next reader to audit a decoder for a record that decoded perfectly.
+                 *
+                 * SOFT, like every other `unusable` on this path, and deliberately: position may always
+                 * fall back to the witness stream, and a recovered parked message is authenticated by the
+                 * ENVELOPE's own signature rather than by this. What changes is that the log says which
+                 * thing disagreed.
+                 */
+                if (ACK_HASH_REASONS.has(auth.reason)) {
+                    this.#logger.warn("session.content.ordering.ack_hash_unverified", {
+                        sessionId, correlationId, reason: auth.reason,
+                        impact: "a recovered message's acknowledgement of what its sender had received does not " +
+                            "reconcile with this side's record, so no canonical POSITION was taken from it. The " +
+                            "message itself is authenticated by its park envelope and is not refused here.",
+                    });
+                }
+                else if (auth.reason === AUTHORSHIP_CONTENT_HASH_MISMATCH) {
                     // SOFT: the record does not describe this content. Nothing is proven about the signer's
                     // identity — only that this record and these bytes do not belong together.
                     this.#logger.warn("session.content.ordering.hash_mismatch", { sessionId, correlationId });
@@ -14970,7 +15700,28 @@ export class SessionNodeManager {
                 // A replayed claim gets its own name on BOTH surfaces, not just in the log context: it is
                 // the one `unusable` cause that may be adversarial, and it is the one the operator can act
                 // on. The others are a peer whose build or bytes we could not read.
-                this.#refuseUnprovenAuthorship(agentName, sessionId, authorship.reason === AUTHORSHIP_SESSION_MISMATCH ? "authorship_wrong_conversation" : "authorship_proof_unusable", contentHash, { detail: authorship.reason }, correlationId);
+                /**
+                 * 033-ACKEMIT — AND THE THREE ACKNOWLEDGEMENT CAUSES GET THEIR OWN SURFACE REASON, for the
+                 * same argument that gave the replay one: `authorship_proof_unusable` tells the operator the
+                 * proof was "unreadable, or signed over different content", and for these it is neither.
+                 * The proof is perfect; what it CLAIMS TO HAVE SEEN is wrong. Filing them under the generic
+                 * name would send someone to audit a decoder, and would spend the operator's attention
+                 * asking their counterparty about a version number that is not the question.
+                 */
+                this.#refuseUnprovenAuthorship(agentName, sessionId, authorship.reason === AUTHORSHIP_SESSION_MISMATCH
+                    ? "authorship_wrong_conversation"
+                    : ACK_HASH_REASONS.has(authorship.reason)
+                        /**
+                         * ⚠️ THE SPECIFIC CAUSE, NOT THE CLASS — review F5, and the diff's own comment on
+                         * `ACK_HASH_REASONS` had already said why: "the operator's next move differs for
+                         * each." It then collapsed all three into ONE surface reason carrying ONE sentence,
+                         * so the three names survived only in a log field nobody reads. For an absent
+                         * acknowledgement the shared impact was flatly false — there is no part that "does
+                         * not match", because there is no part — and for the other two the shared guidance
+                         * sent the reader to ask about a build version that cannot be the cause.
+                         */
+                        ? authorship.reason
+                        : "authorship_proof_unusable", contentHash, { detail: authorship.reason }, correlationId);
                 return;
             }
             if (authorship.verdict === "verified") {
@@ -15025,6 +15776,60 @@ export class SessionNodeManager {
             // acknowledged `persisted` — the sender's TTF→park backstop then guarantees the
             // missing-earlier message is fetchable, and dedup absorbs the redundant copy.
             if (ingest.ok && !ingest.held) {
+                /**
+                 * 033-ACKEMIT review F1 — ACKNOWLEDGE WHAT ARRIVED, HERE, not when the relay gets round to
+                 * delivering its copy back to us.
+                 *
+                 * Placed after a successful, non-held ingest deliberately: a HELD frame is not yet a durable
+                 * leaf and is not acknowledged `persisted` either, so claiming to have seen it would put a
+                 * position in our signed claim that our own record does not yet hold.
+                 *
+                 * `framedSeq` is the relay's canonical position taken from the sender's own signed ordering
+                 * record and verified before it got here. When it is absent the message arrived with no
+                 * ordering record — the withheld-submit case — and there is no position to acknowledge,
+                 * whatever we hold of the content. That limit is structural to a (position, content) pair
+                 * and it is what the carried-leaf follow-on closes.
+                 */
+                if (framedSeq !== null) {
+                    this.#noteAcknowledgeable(agentName, sessionId, framedSeq, contentHash);
+                }
+                else {
+                    /**
+                     * ─── WITNESS WHAT THEY DID NOT — 034-CARRYLEAF, and this is the line that closes
+                     * `DOD-M15-WITHHOLD-SEAL-1` ────────────────────────────────────────────────────────────
+                     *
+                     * No ordering record means the sender never asked the relay to witness this message. Two
+                     * things look identical from here: their relay was briefly unreachable, or they are
+                     * withholding it on purpose so it cannot appear in the receipt. **We do not need to tell
+                     * those apart, and that is the point** — the same action repairs both, and it costs the
+                     * honest case nothing.
+                     *
+                     * We hold their signature over their own bytes. So we hand it to the relay ourselves.
+                     */
+                    /**
+                     * ⚠️ **THE KIND COMES OFF THE FRAME, AND WITHOUT IT WE DECLINE TO WITNESS — review F5.**
+                     *
+                     * A leaf kind selects a HASH DOMAIN, and documents and rejection envelopes ride this same
+                     * frame. Hardcoding `msg` meant a document witnessed on its author's behalf entered the
+                     * relay's canonical log described as something it is not. A peer too old to send the field
+                     * is left alone rather than guessed at: witnessing their leaf under the wrong domain would
+                     * be a worse outcome than not witnessing it, because it puts a wrong statement in the
+                     * record instead of leaving a gap the seal can name.
+                     */
+                    const framedKind = frame["leaf_kind"];
+                    if (typeof framedKind === "number") {
+                        void this.#witnessReceivedLeaf(agentName, sessionId, contentHash, s1Cbor, senderSig, framedKind, correlationId);
+                    }
+                    else {
+                        this.#logger.info("session.content.witness_received.kind_unknown", {
+                            agentName, sessionId, correlationId,
+                            impact: "a message arrived that its sender never had witnessed, and the frame did not say " +
+                                "which leaf domain it belongs to — their build predates the field. It was NOT " +
+                                "witnessed on their behalf, because witnessing it under a guessed domain would put " +
+                                "a wrong statement in the record rather than leave a gap the seal can name.",
+                        });
+                    }
+                }
                 void this.#sendDeliveryAck(agentName, sessionId, contentHash, correlationId);
             }
         }
@@ -15333,17 +16138,27 @@ export class SessionNodeManager {
                 /**
                  * DOD-M12B-SESSION-SEED-1 (review F8): drop it zeroed, like every other seed.
                  *
-                 * (review F7, DECIDED AGAINST — deliberately NOT reusing this seed for the replacement.)
+                 * (review F7, STILL DECIDED AGAINST — deliberately NOT reusing this seed for the
+                 * replacement — but its stated blocker is GONE and the reason has changed. Restated rather
+                 * than reworded, because a decision whose premise has been reversed is a decision nobody
+                 * has actually made.)
+                 *
                  * Reuse is attractive: this receiver's peer id may already be inside a `session_offer_accept`
                  * the counterparty is acting on, and a rebuild in that window is the documented "we record
-                 * an identity that no longer exists… every send in this direction parks forever" defect. But
-                 * a preserved identity would have to be handed to the candidate loop in
-                 * `#startReceiverNode`, whose rejected candidates are stopped WITHOUT awaiting `start()` —
-                 * so two nodes could be briefly live on one advertised peer id, which is review F1, a HIGH,
-                 * and the reason each candidate now mints its own. Fixing F7 properly means bounding and
-                 * awaiting the loser's teardown first, and an unawaited stop is precisely what the current
-                 * code chose to avoid a stuck libp2p teardown blocking receiver creation. Filed as
-                 * follow-on work rather than trading a MEDIUM fix for a HIGH regression.
+                 * an identity that no longer exists… every send in this direction parks forever" defect.
+                 *
+                 * The old blocker was that a preserved identity would reach the candidate loop, whose
+                 * rejected candidates were stopped WITHOUT awaiting `start()`, putting two live nodes on one
+                 * advertised peer id. **032-RELAYSPREAD already crossed that line**: the walk now runs one
+                 * shared seed through every candidate, with a settlement-chained teardown, and it is safe
+                 * there because the receiver's gater admits nobody inbound.
+                 *
+                 * What still stops reuse HERE is different and is about the OLD node, not the new one. This
+                 * rebuild path awaits `sr.node.stop()`, but a stop can hang on a stuck libp2p teardown, and
+                 * handing the replacement the same identity before the previous receiver is provably dead
+                 * would put two nodes on a peer id a COUNTERPARTY has been told to dial — which is not the
+                 * candidate case at all: that node has a content handler and can be promoted. Doing it
+                 * safely needs a bounded, verified teardown first. Still follow-on work.
                  */
                 sr.seed.fill(0);
                 try {
@@ -15555,7 +16370,19 @@ export class SessionNodeManager {
                     // "No relay would grant" and "there was no relay to ask" are different facts and lead to
                     // different places — the first at relay capacity, the second at this agent's directory
                     // connection. Without this they are the same sentence.
-                    reservationsRequested: (this.#directoryRelayEndpoints.get(agentName)?.length ?? 0) > 0,
+                    //
+                    // 032-RELAYSPREAD: this was also called `reservationsRequested` — the same mis-naming as
+                    // the reachability events, in its worst form, because here the value is a BOOLEAN under a
+                    // name that reads as a count. It is NOT `relaysOffered`: that field counts the merged
+                    // candidate list the walk actually asks (directory pool + persisted endpoints, minus
+                    // quarantine), and this reads the directory pool alone. Two populations must not share
+                    // one field name, so this one is named for what it measures.
+                    hadRelayToAsk: (this.#directoryRelayEndpoints.get(agentName)?.length ?? 0) > 0,
+                    // …and HOW MANY the walk actually asks, so this event stands on its own instead of
+                    // needing the last reachability line to be read beside it. Same population and same
+                    // meaning as `relaysOffered` everywhere else: the merged, quarantine-filtered candidate
+                    // list.
+                    relaysOffered: this.#reservationCircuitAddrs(agentName).addrs.length,
                     impact: "no relay would grant this agent a circuit reservation, so anyone behind NAT cannot reach or dial it — inbound sessions will only arrive from peers that can connect directly, and everything else falls back to the relay's store-and-forward",
                 });
             }
@@ -15600,11 +16427,27 @@ export class SessionNodeManager {
             // BOUNDED, never on this 30-second grid. A reservation is scarce: the relay holds it for its
             // full TTL even after the client disconnects, and churning attempts across a fleet is how a
             // relay is exhausted (`#startReceiverNode` records that hazard).
-            if (!sr.hasReservation || sr.relayPeerId === undefined) {
-                this.#retryReservationIfDue(agentName);
-                continue;
+            if (sr.relayPeerIds.length === 0) {
+                // …unless one has arrived since. Review F4, same class as the recompute below: the
+                // slow-start path installs a receiver before every circuit has bound, so "held nothing at
+                // install" is not the same fact as "holds nothing now". Adopting it here is what stops the
+                // retry ladder rebuilding a receiver that is already reachable.
+                const arrived = heldRelayIdsOf(sr.node)
+                    .filter((id) => sr.node.getConnections().some((c) => c.peerId === id && c.status === "open"));
+                if (arrived.length === 0) {
+                    this.#retryReservationIfDue(agentName);
+                    continue;
+                }
+                sr.relayPeerIds = arrived;
+                sr.gater.setReservedRelayPeers(arrived);
+                this.#logger.info("session.standing_receiver.reservation.gained", {
+                    agentName,
+                    relayPeerIds: arrived,
+                    reservationsHeld: arrived.length,
+                });
             }
-            // It has one — any earlier retry budget, and the reason the last attempt failed, are stale.
+            // It has at least one — any earlier retry budget, and the reason the last attempt failed, are
+            // stale.
             this.#srReservationRetry.delete(agentName);
             this.#srLastRejectionReason.delete(agentName);
             // Watch the CONNECTION to the relay, not the circuit address.
@@ -15622,24 +16465,106 @@ export class SessionNodeManager {
             // investigation turned on. Without the status check a registered corpse reads as "still
             // connected", the rebuild never fires, and the agent silently stops being reachable while
             // this loop reports it healthy. The comment above claimed liveness; only this tests it.
-            const stillConnected = sr.node.getConnections()
-                .some((c) => c.peerId === sr.relayPeerId && c.status === "open");
-            const stillAdvertising = sr.node.listenAddresses().some((a) => a.includes("/p2p-circuit"));
-            if (stillConnected && stillAdvertising)
+            // 032-RELAYSPREAD — PER RELAY, and the health question is now a COUNT.
+            //
+            // This used to evaluate one peer id and rebuild the entire standing receiver when it went
+            // false. With a pool of one that was the only thing it could do; with a pool of three it is
+            // the churn engine — every relay is another watchdog subject, and a full rebuild per loss
+            // multiplies the 30-second grid by the size of the pool while throwing away reservations that
+            // are perfectly healthy.
+            /**
+             * RECOMPUTED FROM THE NODE, never filtered down from the stored list. Review F4: filtering
+             * `sr.relayPeerIds` makes it SHRINK-ONLY, and a list that can only shrink cannot see a
+             * circuit arrive. Three things went wrong with that, and the first one happens routinely:
+             *   - the slow-start path installs the receiver before every circuit has bound, so a relay
+             *     that binds four seconds later was invisible to this watchdog and absent from the
+             *     gater's carve-out set FOREVER — its AutoNAT probe reply refused by our own gate;
+             *   - shrinking to zero then rebuilt a receiver that was announcing live circuits, which is
+             *     the exact defect this unit is against;
+             *   - anything that ever restores a circuit could not be counted.
+             * Reading the node's own addresses costs the same and has none of that.
+             */
+            const open = sr.node.getConnections().filter((c) => c.status === "open").map((c) => c.peerId);
+            const stillHeld = heldRelayIdsOf(sr.node).filter((id) => open.includes(id));
+            const lost = sr.relayPeerIds.filter((id) => !stillHeld.includes(id));
+            const gained = stillHeld.filter((id) => !sr.relayPeerIds.includes(id));
+            sr.relayPeerIds = stillHeld;
+            if (gained.length > 0) {
+                // A circuit this receiver did not have at install. Said out loud because it is the visible
+                // half of the slow-start case, and because it is the moment that relay earns its inbound
+                // carve-out — a silent widening of the gate is not something to do without a line.
+                this.#logger.info("session.standing_receiver.reservation.gained", {
+                    agentName,
+                    relayPeerIds: gained,
+                    reservationsHeld: stillHeld.length,
+                });
+            }
+            if (lost.length === 0) {
+                // Nothing lost. The gater still gets the current set, because `gained` may have widened it.
+                if (gained.length > 0)
+                    sr.gater.setReservedRelayPeers(stillHeld);
                 continue;
-            // DOD-RELAY-KEEPALIVE-1 (review F4): carry the CAUSE, not just the exit point.
-            // `relay_connection_gone` says where this was noticed — a poll of getConnections() — by which
-            // time the abort reason that actually killed the link is long discarded. The relay client for
-            // this (agent, relay) pair kept the error that ended its reader; that is the nearest thing to
-            // an upstream cause available here, and its absence is how 2,061 of these went untraced.
-            const upstreamReason = this.#relayClients.get(`${agentName}::${sr.relayPeerId}`)?.getLastReaderError();
-            this.#logger.warn("session.standing_receiver.reservation.lost", {
-                agentName,
-                relayPeerId: sr.relayPeerId,
-                reason: stillConnected ? "circuit_address_vanished" : "relay_connection_gone",
-                ...(upstreamReason ? { upstreamReason } : {}),
-            });
-            void this.#rebuildStandingReceiver(agentName);
+            }
+            // REVOKE FIRST. A relay whose reservation is gone must lose its inbound carve-out in the same
+            // breath as the loss is noticed, or the gater's bound quietly becomes "granted one once".
+            sr.gater.setReservedRelayPeers(stillHeld);
+            for (const relayPeerId of lost) {
+                // DOD-RELAY-KEEPALIVE-1 (review F4): carry the CAUSE, not just the exit point.
+                // `relay_connection_gone` says where this was noticed — a poll of getConnections() — by
+                // which time the abort reason that actually killed the link is long discarded. The relay
+                // client for this (agent, relay) pair kept the error that ended its reader; that is the
+                // nearest thing to an upstream cause available here, and its absence is how 2,061 of these
+                // went untraced.
+                const upstreamReason = this.#relayClients.get(`${agentName}::${relayPeerId}`)?.getLastReaderError();
+                this.#logger.warn("session.standing_receiver.reservation.lost", {
+                    agentName,
+                    relayPeerId,
+                    reason: open.includes(relayPeerId) ? "circuit_address_vanished" : "relay_connection_gone",
+                    ...(upstreamReason ? { upstreamReason } : {}),
+                    reservationsHeld: stillHeld.length,
+                    // The line an operator reads, and the two cases are not the same event at all.
+                    impact: stillHeld.length > 0
+                        ? "this agent still holds " + stillHeld.length + " other circuit reservation(s), so it "
+                            + "stays dialable from behind NAT and the receiver is NOT rebuilt. Losing one relay "
+                            + "costs this agent nothing it can feel."
+                        : "this agent now holds NO circuit reservation, so nobody behind a home router can "
+                            + "reach it. The receiver is being rebuilt against the rest of the pool.",
+                });
+            }
+            if (stillHeld.length === 0) {
+                // ZERO HELD IS STILL THE LOUD, STRUCTURAL CASE — the agent is unreachable behind NAT and
+                // only a new node can take a new reservation, because a circuit listener is fixed at node
+                // creation.
+                void this.#rebuildStandingReceiver(agentName);
+                continue;
+            }
+            /**
+             * STILL REACHABLE, SO THE RECEIVER STANDS, AND NOTHING ELSE HAPPENS HERE. That second half is
+             * the part worth reading, because the obvious next line is wrong twice over.
+             *
+             * **A LOST CONFIGURED CIRCUIT CANNOT BE RETAKEN BY THIS NODE.** Read out of
+             * `@libp2p/circuit-relay-v2@4.2.5`, not assumed: for an explicit relay address
+             * `transport/listener.js#listen()` is a ONE-SHOT — it reserves once and nothing calls it
+             * again; `reservation-store.js#removeReservation()` clears the refresh timeout and deletes
+             * the entry; and the listener's `_onAddRelayPeer` returns early for `type === 'configured'`,
+             * so even a later reservation would not be announced. A circuit listener is fixed at node
+             * creation, and the only thing that takes a new one is a NEW NODE — which is exactly the
+             * rebuild this branch exists to refuse.
+             *
+             * **AND RE-PROVING TO THE LOST RELAY WOULD REBUILD THE RECEIVER ANYWAY.** Review F3: an
+             * earlier version called `#authenticateStandingReceiver` here to "remove the relay-side
+             * reason for the revocation". That function ends with `if (refusal?.tryAnotherRelay) { …
+             * void this.#rebuildStandingReceiver(agentName); }` — and a dead or misconfigured relay is
+             * precisely the one that answers that way. So the common case was: lose relay A while
+             * holding B, decline to rebuild, prove to A, A refuses, rebuild the whole receiver and throw
+             * B's healthy reservation away. The churn engine, re-entered through the back door.
+             *
+             * **THE BOUND, STATED PLAINLY BECAUSE IT IS A REAL SHORTFALL AGAINST THE DoD:** a lost
+             * circuit is gone until the receiver is next rebuilt for another reason. What the agent buys
+             * is that it never STOPS BEING REACHABLE while that is true — the surviving relays carry it,
+             * the loss is named in the log with its cause, and the lost relay's inbound carve-out is
+             * revoked above. That is availability, not restoration in place.
+             */
         }
     }
     /**
@@ -15838,20 +16763,42 @@ export class SessionNodeManager {
         }
     }
     async #startReceiverNode(agentName, sessionId, gater, candidateCircuitAddrs, correlationId) {
+        /**
+         * 032-RELAYSPREAD — **ONE SEED FOR THE RECEIVER, REUSED ACROSS RELAYS**, replacing
+         * DOD-M12B-SESSION-SEED-1's seed-per-candidate.
+         *
+         * The agent is ONE identity and must be dialable at ONE peer id through any of its circuits, so
+         * every reservation this walk collects has to belong to the same key. A seed per relay would
+         * give the agent a different peer id down each circuit — N half-agents, none of them the one
+         * the counterparty was told to dial.
+         *
+         * ⚠️ THE RULE THIS REPLACES WAS RIGHT ABOUT ITS OWN CASE, so here is what changed and what did
+         * not. Its hazard is real and survives: a rejected candidate is torn down while its `start()`
+         * may still be in flight, so two nodes can briefly be live on this peer id. Two things bound it
+         * now, and neither existed when that rule was written:
+         *   - **THE ONE THAT CARRIES THE WEIGHT: DOD-M15-ASSIGN-1** made a standing receiver's gater
+         *     admit NOBODY inbound until a session offer names the dialer. The old rule's stated danger
+         *     — "sharing this gater, so it admits dials … an open endpoint under our advertised id" —
+         *     is not true of this gater any more. `#startReceiverNode` has exactly one caller and it
+         *     constructs that gater with `allowedPeerId: null` and an empty reserved set, so an
+         *     overlapping candidate is an endpoint that refuses everyone.
+         *   - the teardown is chained onto the candidate's OWN start promise (the `#buildRevivedNode`
+         *     pattern, verified against libp2p 3.3.2: `stop()` returns immediately unless the status is
+         *     `started`, and through the whole timeout window it is `starting`, so the old unawaited
+         *     `stop()` stopped nothing). ⚠️ This bounds the LEAK, not the OVERLAP — a timed-out
+         *     candidate is not awaited and the walk moves straight to the next one on the same seed, so
+         *     overlap is the normal shape of that case, not a remote possibility. It guarantees the
+         *     loser dies, and nothing more.
+         * `#buildRevivedNode` already runs a fixed identity through this same walk for the same reason.
+         */
+        const receiverSeed = randomBytes(32);
+        /** Circuit addresses whose relay ACTUALLY GRANTED this identity a reservation. */
+        const grantedAddrs = [];
+        // For `spread.grant_not_bound` below: the walk's own duration is measured against the relay's
+        // two-minute proof memory, so it has to be a number rather than an inference.
+        const walkStartedAt = Date.now();
         for (const circuitAddr of candidateCircuitAddrs) {
-            // DOD-M12B-SESSION-SEED-1: A SEED PER CANDIDATE, NOT ONE FOR THE LOOP.
-            //
-            // A rejected candidate is stopped with an unawaited `void …then(() => candidate.stop())`
-            // while its `start()` may still be in flight, so two candidate nodes can briefly be live at
-            // once. Sharing one seed would give both the SAME peer id — and the loser would then be a
-            // second live node under the identity we advertise in `session_offer_accept`, sharing this
-            // gater (so it admits dials) with no content handler registered. Inbound arriving there goes
-            // nowhere, and it is an open endpoint under our advertised id: the "connection a malicious
-            // agent can farm for" the tenet names. Before seeds existed the loser had its own random key
-            // and was harmless; introducing a shared seed is what would have made it dangerous.
-            //
-            // Nothing reads the seed before the winner is installed, so per-candidate costs nothing.
-            const candidateSeed = randomBytes(32);
+            const candidateSeed = receiverSeed;
             /**
              * DOD-M15-RELAYSLOTS-1 — **TWO ATTEMPTS PER RELAY: ask, prove, ask again.**
              *
@@ -15866,7 +16813,7 @@ export class SessionNodeManager {
              * announces no circuit address for it, because it only announces addresses for reservations
              * its own relay-discovery made. The agent would hold a slot nobody could dial through.
              */
-            let candidateNode;
+            let candidateGranted = false;
             // Set when the relay refused the AGENT rather than being unwilling itself: every other relay
             // in the pool answers identically, so the walk ends here rather than reproducing it N times.
             let candidateRefusedAgent = false;
@@ -15882,9 +16829,13 @@ export class SessionNodeManager {
                 const timedOut = Symbol("reservation_timeout");
                 let outcome = "failed";
                 let error = "";
+                // KEEP THE START PROMISE. Every candidate now carries the receiver's identity, so an
+                // abandoned one must be reliably torn down rather than best-effort — and only its own start
+                // promise says when it is stoppable (see the seed note above).
+                const startP = candidate.start();
                 try {
                     outcome = await Promise.race([
-                        candidate.start().then(() => "started"),
+                        startP.then(() => "started"),
                         new Promise((resolve) => {
                             timer = setTimeout(() => resolve(timedOut), this.#srReservationTimeoutMs);
                         }),
@@ -15902,7 +16853,15 @@ export class SessionNodeManager {
                 // completes the handshake and simply grants nothing, leaving a node that looks
                 // started and is reachable by nobody.
                 if (outcome === "started" && candidate.listenAddresses().some((a) => a.includes("/p2p-circuit"))) {
-                    candidateNode = candidate;
+                    candidateGranted = true;
+                    // The probe has done its job: this relay grants THIS identity. Tear it down and ask the
+                    // next relay — the reservation is re-taken by the final node below, which is the only one
+                    // that can listen on every granted address at once. AWAITED, because the next probe comes
+                    // up on this same peer id.
+                    try {
+                        await candidate.stop();
+                    }
+                    catch { /* it may never have finished starting */ }
                     break;
                 }
                 /**
@@ -15990,27 +16949,125 @@ export class SessionNodeManager {
                     ...(error !== "" ? { error } : {}),
                     correlationId,
                 });
-                // Abandon it. start() may still be parked on a dial, so stop() is best-effort
-                // and must never block the fallback.
-                void Promise.resolve()
-                    .then(() => candidate.stop())
-                    .catch(() => { });
+                // Abandon it — but on its OWN settlement, never best-effort. `start()` may still be parked on
+                // a dial, and this candidate carries the receiver's identity: an unawaited `stop()` on a node
+                // whose status is still `starting` returns without stopping anything, and the node then goes
+                // live on our peer id with nothing left holding a reference to kill it.
+                void startP.then(() => candidate.stop().catch(() => { }), () => { });
                 break;
             }
-            if (candidateNode)
-                return { node: candidateNode, seed: candidateSeed };
+            if (candidateGranted)
+                grantedAddrs.push(circuitAddr);
+            // 032-RELAYSPREAD: DO NOT BREAK ON THE FIRST GRANT. The walk used to stop here, which is why
+            // an agent held exactly one reservation and losing that relay cost it every NAT'd caller for
+            // however long detection happened to take. It now asks every remaining relay.
             if (candidateRefusedAgent)
                 break;
         }
-        const plainSeed = randomBytes(32);
-        const plain = await this.#createAgentNode(agentName, {
+        /**
+         * THE RECEIVER, listening on EVERY granted circuit address.
+         *
+         * One node per agent, as before — what changed is how many circuits it announces. Each address
+         * here belongs to a relay that granted THIS seed moments ago and therefore still remembers the
+         * identity, so the final node's first ask is the one that succeeds; the two-attempt dance was
+         * already paid per relay in the walk.
+         *
+         * ⚠️ RACED AGAINST A DEADLINE, and that is measured rather than cautious: `#buildRevivedNode`
+         * records a live 2026-08-18 result where a node handed two relay addresses at once with no
+         * deadline never finished starting at all (10,002ms and counting). Its identity was unproven at
+         * both relays, which is not this case — but "not this case" is a prediction, and the standing
+         * receiver is the thing that makes an agent reachable, so it does not wait on one.
+         *
+         * An empty `grantedAddrs` yields the plain TCP floor, exactly as before: reachable by peers
+         * that can dial directly, and loud about it (`session.standing_receiver.reservation.none`).
+         */
+        const node = await this.#createAgentNode(agentName, {
             sessionId,
             connectionGater: gater,
             nodeType: "standing_receiver",
-            transportPrivateKey: plainSeed,
+            ...(grantedAddrs.length > 0 ? { circuitRelayListenAddrs: grantedAddrs } : {}),
+            transportPrivateKey: receiverSeed,
         });
-        await plain.start();
-        return { node: plain, seed: plainSeed };
+        if (grantedAddrs.length === 0) {
+            await node.start();
+            return { node, seed: receiverSeed };
+        }
+        /**
+         * ⚠️ SLOW AND FAILED ARE DIFFERENT ANSWERS AND MUST NOT SHARE A BRANCH. Review F1: a single
+         * `.catch(() => false)` around this race collapsed every `start()` REJECTION into the deadline
+         * branch — and `CelloNodeImpl.start()` rejects by design, stopping the node and throwing
+         * `listen_failed` when no direct (non-circuit) listener materialised. That is the guard the
+         * transport keeps precisely so `FaultTolerance.NO_FATAL` cannot mask a real `EADDRINUSE`.
+         *
+         * Swallowed, it installed a STOPPED node as the agent's front door: no addresses to advertise,
+         * `#tryCreateStandingReceiver` never saw a failure so the M8B F14 retry never fired, and the
+         * operator was told the receiver "did not finish binding every circuit inside the deadline" and
+         * "is reachable through those" — sending them to the relay fleet for a port held by an orphan
+         * daemon on their own machine. The rejection is rethrown so it reaches
+         * `session.node.create.failed` with its own cause, exactly as it does on the no-relay path.
+         */
+        let deadline;
+        let startError;
+        const started = node.start().then(() => "ok", (err) => { startError = err; return "failed"; });
+        const outcome = await Promise.race([
+            started,
+            new Promise((resolve) => {
+                // Per granted relay: each circuit listener is its own dial and its own reservation, so a
+                // pool of three must not be judged on a budget sized for one.
+                deadline = setTimeout(() => resolve("slow"), this.#srReservationTimeoutMs * grantedAddrs.length);
+            }),
+        ]);
+        if (deadline !== undefined)
+            clearTimeout(deadline);
+        if (outcome === "failed")
+            throw startError;
+        /**
+         * GRANTED IN THE WALK, REFUSED AT INSTALL — a distinct fact and, until this line, an invisible
+         * one. The receiver would simply report `reservationsHeld: 2` where 3 relays granted, with
+         * nothing naming which relay went missing or why.
+         *
+         * ⚠️ IT HAS A KNOWN CAUSE AND A CROSS-REPO CLOCK. The walk stops the granted candidate and the
+         * node below RE-ASKS, which works because the relay remembers the proof — for
+         * `PROVEN_PEER_MEMORY_MS = 2 minutes` (`relay-connection-gater.ts`, trustless-cello). The walk
+         * costs up to `#srReservationTimeoutMs` × 2 attempts per relay, so a pool of three at the
+         * 15s default can spend 90 seconds before the final node asks relay 1 again. The earliest
+         * proof can expire before it is used, and that is what this event catches.
+         */
+        const boundRelays = new Set(heldRelayIdsOf(node));
+        const grantedButUnbound = grantedAddrs
+            .map((a) => CIRCUIT_RELAY_ID.exec(a)?.[1])
+            .filter((id) => id !== undefined && !boundRelays.has(id));
+        if (grantedButUnbound.length > 0) {
+            this.#logger.warn("session.standing_receiver.spread.grant_not_bound", {
+                agentName,
+                relayPeerIds: grantedButUnbound,
+                relaysGranted: grantedAddrs.length,
+                reservationsHeld: boundRelays.size,
+                walkMs: Date.now() - walkStartedAt,
+                correlationId,
+                impact: "these relays granted this agent a reservation during the walk and then bound no " +
+                    "circuit on the receiver itself, so the agent is reachable through fewer relays than it " +
+                    "earned. The relay remembers a proof for two minutes; if walkMs is near or past that, " +
+                    "the proof expired before the receiver asked and the walk is what needs shortening — " +
+                    "not the relay fleet.",
+            });
+        }
+        if (outcome === "slow") {
+            // NOT a teardown, and now this line means only what it says: the node is starting and has not
+            // finished. It is installed with whatever circuits did materialise, because some reachability
+            // beats none and the reservation watchdog is what settles the rest.
+            this.#logger.warn("session.standing_receiver.spread.slow_start", {
+                agentName,
+                relaysGranted: grantedAddrs.length,
+                circuitAddrs: node.listenAddresses().filter((a) => a.includes("/p2p-circuit")).length,
+                budgetMs: this.#srReservationTimeoutMs * grantedAddrs.length,
+                correlationId,
+                impact: "the receiver did not finish binding every circuit it was granted inside the " +
+                    "deadline, so it is being installed with the circuits it has. It is reachable through " +
+                    "those; the reservation watchdog re-checks the rest on its next tick.",
+            });
+        }
+        return { node, seed: receiverSeed };
     }
     /** One standing-receiver create attempt (extracted for the M8B F14 retry loop). */
     async #tryCreateStandingReceiver(agentName, correlationId) {
@@ -16032,11 +17089,15 @@ export class SessionNodeManager {
         }
         let node;
         /**
-         * DOD-M12B-SESSION-SEED-1 — the transport identity of the receiver that actually survived.
+         * DOD-M12B-SESSION-SEED-1 — the transport identity of this receiver.
          *
-         * Minted per CANDIDATE inside `#startReceiverNode` and returned with the winner, not minted
-         * here: a rejected candidate is stopped without awaiting its `start()`, so two candidates can
-         * be briefly live, and one shared seed would put both on the same advertised peer id.
+         * Minted ONCE inside `#startReceiverNode` and returned with the node, not minted here. It is
+         * one seed for the whole walk (032-RELAYSPREAD): the receiver reserves with every relay that
+         * grants, and an agent must be dialable at ONE peer id through any of its circuits, so every
+         * reservation has to belong to the same key. What makes that safe is DOD-M15-ASSIGN-1 — the
+         * gater above admits NOBODY inbound — not the teardown, which bounds how long a rejected
+         * candidate lives rather than preventing it from overlapping. See the seed note in
+         * `#startReceiverNode` for the full argument.
          *
          * FRESH EVERY TIME, which is the privacy property rather than an implementation detail. A
          * receiver serves at most one session (it is promoted into the session at handoff and replaced),
@@ -16090,39 +17151,39 @@ export class SessionNodeManager {
             probers: this.#autoNatProbers(),
         });
         autoNat.emitInitialResult();
-        const circuitAddrs = node.listenAddresses().filter((a) => a.includes("/p2p-circuit")).length;
-        // FROM THE ADDRESS THE NODE ACTUALLY HOLDS, not from `reservations.addrs[0]`.
-        //
-        // `#startReceiverNode` tries candidates in order and returns the FIRST that actually grants —
-        // so when candidate 0 refuses (the measured `relay_granted_no_reservation` case) and candidate 1
-        // grants, reading candidate 0's address records a relay we are not connected to. The watchdog
-        // then evaluates `getConnections().some(c => c.peerId === relayPeerId)` against that wrong peer,
-        // finds it false on every tick forever, and rebuilds on the 30-second grid — churning the very
-        // reservations this unit exists to conserve. Dormant while the pool is size 1; the pool is
-        // designed to be larger.
-        // PREFER the held address, FALL BACK to the candidate — strictly better than either alone.
-        // The held address is authoritative about which relay actually granted, but it is libp2p's
-        // string, not ours: if a transport ever reports the circuit address without the relay's peer id
-        // in `/p2p/<id>/p2p-circuit` form, reading only it would yield UNDEFINED, and an undefined
-        // relayPeerId makes the watchdog treat a perfectly healthy reservation as absent and rebuild it.
-        // That would be a regression on the single-relay case that works today. The candidate string is
-        // ours and always carries the id, so it is the safe floor.
-        const heldCircuitAddr = node.listenAddresses().find((a) => a.includes("/p2p-circuit"));
-        const CIRCUIT_RELAY_ID = /\/p2p\/([^/]+)\/p2p-circuit/;
-        const reservedRelayPeerId = circuitAddrs > 0
-            ? (heldCircuitAddr?.match(CIRCUIT_RELAY_ID)?.[1] ?? reservations.addrs[0]?.match(CIRCUIT_RELAY_ID)?.[1])
-            : undefined;
-        // DOD-M15-ASSIGN-1 review N3: the ONE relay this receiver actually reserved with earns the
-        // inbound AutoNAT carve-out — nothing else does. Set only when a reservation genuinely
-        // completed, so a directory that merely NAMES a relay cannot dial in behind it.
-        gater.setReservedRelayPeer(circuitAddrs > 0 && reservedRelayPeerId !== undefined ? reservedRelayPeerId : null);
+        /**
+         * EVERY RELAY THE NODE ACTUALLY HOLDS A CIRCUIT WITH — derived from the addresses the node
+         * holds, never from `reservations.addrs`.
+         *
+         * The old code read `reservations.addrs[0]`'s relay id as a fallback, and its own comment
+         * called the hazard "dormant while the pool is size 1; the pool is designed to be larger."
+         * THIS UNIT IS WHAT MAKES THE POOL LARGER, so the dormant case wakes up: candidate 0 refusing
+         * while candidate 1 grants recorded a relay we are not connected to, the watchdog found it
+         * absent on every tick forever, and it rebuilt on the 30-second grid — churning the very
+         * reservations this unit exists to conserve. A candidate is a relay we ASKED; only a held
+         * address is a relay that ANSWERED, and the fallback conflated the two.
+         *
+         * The fallback's own stated worry stands, and is answered by the count rather than by the
+         * candidate list: if a transport ever reports a circuit address without the relay's peer id in
+         * `/p2p/<id>/p2p-circuit` form, that address yields no id and is not counted as held — so the
+         * receiver reads as degraded and gets rebuilt, instead of reading as healthy against a relay
+         * nobody is connected to. Degrading toward "rebuild" is the safe direction; the other one is
+         * the silent unreachability this whole file exists to kill.
+         */
+        const heldRelayPeerIds = heldRelayIdsOf(node);
+        const circuitAddrs = heldRelayPeerIds.length;
+        const heldCircuitAddrs = node.listenAddresses().filter((a) => a.includes("/p2p-circuit"));
+        // DOD-M15-ASSIGN-1 review N3, widened by 032-RELAYSPREAD: the relays this receiver actually
+        // reserved with earn the inbound AutoNAT carve-out — nothing else does. Populated only from
+        // reservations that genuinely completed, so a directory that merely NAMES a relay cannot dial
+        // in behind it, however many relays it names.
+        gater.setReservedRelayPeers(heldRelayPeerIds);
         this.#standingReceivers.set(agentName, {
             node,
             gater,
             autoNat,
             seed,
-            hasReservation: circuitAddrs > 0,
-            ...(reservedRelayPeerId !== undefined ? { relayPeerId: reservedRelayPeerId } : {}),
+            relayPeerIds: heldRelayPeerIds,
         });
         this.#logger.info("session.node.created", {
             sessionId,
@@ -16136,31 +17197,54 @@ export class SessionNodeManager {
         // real session to exist, is what keeps this reservation alive past that grace window.
         // Best-effort and unawaited: a failure here costs nothing beyond the relay's own grace-window
         // revoke, which the reservation watchdog already treats as an ordinary lost reservation.
-        if (reservedRelayPeerId !== undefined && heldCircuitAddr !== undefined) {
-            void this.#authenticateStandingReceiver(agentName, node, reservedRelayPeerId, heldCircuitAddr, correlationId)
+        // ONCE PER HELD RELAY. Each relay revokes independently — it times out the reservation of any
+        // peer that has not proven key possession TO IT — so proving to one of three and calling the
+        // receiver authenticated would lose the other two circuits about fifteen seconds later, which
+        // is the same silent unreachability with two more relays paying for it.
+        for (const relayPeerId of heldRelayPeerIds) {
+            const heldCircuitAddr = heldCircuitAddrs.find((a) => a.includes(`/p2p/${relayPeerId}/p2p-circuit`));
+            if (heldCircuitAddr === undefined)
+                continue;
+            void this.#authenticateStandingReceiver(agentName, node, relayPeerId, heldCircuitAddr, correlationId)
                 .catch((err) => {
                 this.#logger.warn("session.standing_receiver.relay_auth.failed", {
                     agentName,
-                    relayPeerId: reservedRelayPeerId,
+                    relayPeerId,
                     error: extractErrorMessage(err),
                     correlationId,
                 });
             });
         }
-        // DOD-NAT-REACHABILITY-1 observability: how reachable did this receiver come
-        // up? circuitAddrs === 0 with reservations requested means every relay
-        // refused/was unreachable — the agent is deaf to NAT'd initiators (public
-        // ones can still connect directly). That must be LOUD, not a quiet shrug.
+        // DOD-NAT-REACHABILITY-1 observability: how reachable did this receiver come up? Zero held
+        // while relays were offered means every relay refused or was unreachable — the agent is deaf
+        // to NAT'd initiators (public ones can still connect directly). That must be LOUD, not a quiet
+        // shrug.
+        //
+        // 032-RELAYSPREAD — TWO NUMBERS, SO TWO NAMES. Both events used to carry one field,
+        // `reservationsRequested`, holding `reservations.addrs.length` — the size of the CANDIDATE
+        // list, under a name that reads as a count of asks. That is why "the client already requests a
+        // reservation with every relay it knows" read as true in an audit: the outcome was one and the
+        // request was one too, and a single field could report neither.
+        //   relaysOffered    — how many relays were in the candidate list (deduped by relay peer id in
+        //                      `#reservationCircuitAddrs`, so it counts relays, not addresses).
+        //   reservationsHeld — how many reservations this node actually holds, counted the only way
+        //                      that proves a grant: ANNOUNCED /p2p-circuit listen addresses. `start()`
+        //                      resolving is not enough — a relay out of reservation slots completes the
+        //                      handshake, grants nothing, and leaves a node that looks started and is
+        //                      dialable by nobody.
         this.#logger.info("session.standing_receiver.reachability", {
             agentName,
-            circuitAddrs,
-            reservationsRequested: reservations.addrs.length,
+            relaysOffered: reservations.addrs.length,
+            reservationsHeld: circuitAddrs,
             correlationId,
         });
         if (reservations.addrs.length > 0 && circuitAddrs === 0) {
             this.#logger.warn("session.standing_receiver.reservation.none", {
                 agentName,
-                reservationsRequested: reservations.addrs.length,
+                relaysOffered: reservations.addrs.length,
+                // Zero by this branch's own condition, and stated rather than implied: the event reads
+                // "offered 3, held 0" on its own, without the reader having to find the gate above it.
+                reservationsHeld: circuitAddrs,
                 relayPeerIds: reservations.relayPeerIds,
                 correlationId,
             });
@@ -16459,7 +17543,9 @@ export class SessionNodeManager {
                 }
                 this.#relayClients.set(clientKey, client);
             }
-            client.registerSession(sessionId, node, this.#relayLeafHandler(agentName, sessionId, correlationId));
+            // 033-ACKEMIT: a revived session re-registers with no assignment in hand, so the genesis comes
+            // from the entry that was just restored above.
+            client.registerSession(sessionId, node, this.#relayLeafHandler(agentName, sessionId, correlationId), undefined, this.#sessionGenesisPrevRoot(agentName, sessionId));
             const entry = this.#activeNodes.get(this.#k(agentName, sessionId));
             if (entry) {
                 entry.relayClient = client;