@cello-protocol/daemon 0.0.189 → 0.0.191

package/dist/session-relay-client.js

@@ -31,7 +31,7 @@ var _a;
 import { createHash } from "node:crypto";
 import * as lp from "it-length-prefixed";
 import { decode } from "cbor-x";
-import { encodeCbor, decodeSealPayload, encodeStructure1, decodeStructure1 } from "@cello-protocol/protocol-types";
+import { encodeCbor, decodeSealPayload, encodeStructure1, decodeStructure1, computeGenesisPrevRoot } from "@cello-protocol/protocol-types";
 import { verify } from "@cello-protocol/crypto";
 import { extractErrorMessage } from "./error-message.js";
 import { evaluateRelayAck } from "./relay-receipt-store.js";
@@ -197,6 +197,22 @@ function buildWitnessAlertTbs(sessionId, reason, observedAt, submitterIsCounterp
     const body = encodeCbor([RELAY_WITNESS_DOMAIN, sessionId, reason, observedAt, submitterIsCounterparty]);
     return new Uint8Array(createHash("sha256").update(body).digest());
 }
+/**
+ * The genesis prev_root derivable from a relay assignment — 033-ACKEMIT.
+ *
+ * The carry holds both participant keys and the session timestamp, which with the session id are
+ * exactly `computeGenesisPrevRoot`'s inputs. Returns `undefined` when there is no assignment, and
+ * the caller then has no seed: absence is reported at the submit, never papered over.
+ *
+ * ⚠️ NOT 32 ZERO BYTES, and not any other constant. A value identical across every session is one
+ * an attacker can present for any session, which would make the first message's acknowledgement
+ * unfalsifiable exactly where it is most exposed.
+ */
+function genesisFromAssignment(sessionIdHex, assignment) {
+    if (!assignment)
+        return undefined;
+    return computeGenesisPrevRoot(assignment.participantA, assignment.participantB, Uint8Array.from(Buffer.from(sessionIdHex, "hex")), assignment.sessionTimestamp);
+}
 function toU8(v) {
     if (v instanceof Uint8Array)
         return v;
@@ -266,10 +282,25 @@ export class AgentRelayClient {
     #connecting = null;
     #closed = false;
     /**
-     * PER-SESSION highest relay-assigned sequence (session_id hex → seq). The relay's
-     * `seq_counter` is per session, and it rejects `last_seen_seq > seq_counter`, so each
-     * session's submit MUST carry that session's own high-water mark — NOT an agent-global
-     * one (which would make a newer session's first submit look ahead and get rejected).
+     * PER-SESSION acknowledgement state (session_id hex → the position AND the content at it).
+     *
+     * `seq` is the highest relay-assigned sequence. The relay's `seq_counter` is per session, and it
+     * rejects `last_seen_seq > seq_counter`, so each session's submit MUST carry that session's own
+     * high-water mark — NOT an agent-global one (which would make a newer session's first submit look
+     * ahead and get rejected).
+     *
+     * ⚠️ `hash` IS THE SAME FACT AS `seq`, WHICH IS WHY THEY LIVE IN ONE ENTRY — 033-ACKEMIT.
+     *
+     * `last_seen_seq` is a NUMBER: "I saw position 7" attests to a POSITION and never to CONTENT, so
+     * a signed acknowledgement was an unbacked number that only the relay's separate receipt gave any
+     * meaning to. `hash` is the content hash of the message AT that position, and the two are written
+     * together in `#bumpLastSeen` from ONE decode of ONE leaf. They cannot be assigned apart, so they
+     * cannot come to mean different messages — which is the defect this unit exists to remove, not a
+     * disagreement to reconcile later.
+     *
+     * Seeded at `registerSession` with `{ seq: 0, hash: genesisPrevRoot }`: the first message of a
+     * session has seen nothing, and that case is a DEFINED 32-byte value — the agreed starting point
+     * of this two-party chain — never a missing field and never a fallback to v1.
      */
     #lastSeen = new Map();
     /** The one outstanding submit's resolver (global FIFO — ack carries no session_id). */
@@ -320,17 +351,43 @@ export class AgentRelayClient {
      * (idempotent). Storing the node per session lets a pure-receiver session re-establish
      * the shared stream if the node that originally dialed is torn down.
      */
-    registerSession(sessionIdHex, node, onLeafDeliver, assignment) {
+    registerSession(sessionIdHex, node, onLeafDeliver, assignment, 
+    /**
+     * 033-ACKEMIT — the session's genesis prev_root: what the FIRST message of this session
+     * acknowledges, before anything has been received.
+     *
+     * Supplied by the caller because `session-node-manager` is where the session record lives. When
+     * it is absent an ASSIGNMENT can still produce it (both participant keys and the session
+     * timestamp are on the carry), and that covers re-registration of a session whose row predates
+     * the column. When NEITHER is available the session has no seed, and its first submit claims
+     * position 0 with no hash — which asserts nothing about content and is therefore honest, rather
+     * than a claim about a position it cannot back.
+     */
+    genesisPrevRoot) {
         const existing = this.#sessions.get(sessionIdHex);
+        const carriedAssignment = assignment ?? existing?.assignment;
         this.#sessions.set(sessionIdHex, {
             node,
             onLeafDeliver: onLeafDeliver ?? (() => { }),
             // Carry the assignment forward across re-registration; never lose a recorded flag on re-register.
-            assignment: assignment ?? existing?.assignment,
+            assignment: carriedAssignment,
             recorded: existing?.recorded ?? false,
             recordRejected: existing?.recordRejected ?? false,
             recordTimedOut: existing?.recordTimedOut ?? false,
         });
+        /**
+         * SEED THE ACKNOWLEDGEMENT, and only when there is nothing to lose.
+         *
+         * A session that has already received a leaf holds a REAL `{ seq, hash }`; overwriting it with
+         * the genesis on a re-registration would walk the acknowledgement backwards to "I have seen
+         * nothing" for a conversation that is well underway — and the relay would then answer the next
+         * submit from a position we had already passed.
+         */
+        if (!this.#lastSeen.has(sessionIdHex)) {
+            const seed = genesisPrevRoot ?? genesisFromAssignment(sessionIdHex, carriedAssignment);
+            if (seed)
+                this.#lastSeen.set(sessionIdHex, { seq: 0, hash: seed });
+        }
         // Eagerly present the assignment so the relay records the session (binds peer IDs, creates the
         // session entry) BEFORE the first hash_submit or the counterparty's leaves arrive — the relay
         // rejects frames for a session it has not recorded. Best-effort + serialized on the submit chain
@@ -495,12 +552,25 @@ export class AgentRelayClient {
             catch { /* best-effort */ }
         }
     }
-    #bumpLastSeen(sessionIdHex, seq) {
+    /**
+     * Advance this session's acknowledgement to a counterparty leaf: the POSITION and the CONTENT
+     * AT IT, written together (033-ACKEMIT).
+     *
+     * `contentHash` comes from the same `decodeStructure1` of the same leaf that produced `seq`, so
+     * the pair describes one message by construction. There is no path that advances one without the
+     * other, and that is deliberate: a `last_seen_seq` and a `last_seen_hash` that could drift apart
+     * would let this daemon sign an acknowledgement of a message it never saw.
+     *
+     * Monotonic on `seq` — a re-delivery of an earlier leaf must not walk the acknowledgement
+     * backwards, and it must not swap the hash under an unchanged position either.
+     */
+    #bumpLastSeen(sessionIdHex, seq, contentHash) {
         if (seq < 0)
             return;
-        const prev = this.#lastSeen.get(sessionIdHex) ?? 0;
-        if (seq > prev)
-            this.#lastSeen.set(sessionIdHex, seq);
+        const prev = this.#lastSeen.get(sessionIdHex);
+        if (prev && seq <= prev.seq)
+            return;
+        this.#lastSeen.set(sessionIdHex, { seq, hash: contentHash });
     }
     /** True if this Structure-1 leaf was authored by US (sender_pubkey === our K_local). */
     #isOwnLeaf(structure1Cbor) {
@@ -587,15 +657,44 @@ export class AgentRelayClient {
                     // submit's paired in-flight values. Best-effort + separate from the receipt write.
                     const structure2Cbor = frame["structure2_cbor"] instanceof Uint8Array ? frame["structure2_cbor"] : undefined;
                     if (this.#sealLeafStore && structure2Cbor && structure1Cbor && this.#pendingLeafKind !== null) {
+                        /**
+                         * ⚠️ **THE AUTHOR COMES FROM THE SIGNED BYTES, AND THE RECEIPT ONLY ATTACHES TO OUR OWN
+                         * LEAF — 034-CARRYLEAF review F3.**
+                         *
+                         * This wrote `senderPubkeyHex: this.senderPubkeyHex` unconditionally, which was true for
+                         * as long as the only thing a client could submit was its own leaf. `witnessReceivedLeaf`
+                         * ended that: on a counter-submit `structure1Cbor` holds the COUNTERPARTY's bytes, so
+                         * this row labelled their leaf as ours — and attached a relay receipt to it, which is the
+                         * one thing that must never happen to a leaf we did not author, because a receipt is what
+                         * pins OUR leaves to a sequence we could otherwise renumber.
+                         *
+                         * It was inert on the wire by luck: `sender_pubkey_hex` is not transmitted and the
+                         * directory re-derives the author from `structure2_cbor`. It was never inert locally —
+                         * the store is `INSERT OR IGNORE` on `(agent, session, sequence)`, and the ack arrives
+                         * BEFORE the `leaf_deliver` echo, so this row won and the correct one was silently
+                         * dropped.
+                         *
+                         * Same rule as everywhere else on this path: the identity comes from inside the bytes
+                         * the author signed, never from an ambient value that happens to be right today.
+                         */
+                        const authored = decodeStructure1(structure1Cbor);
+                        const authorHex = authored.ok
+                            ? Buffer.from(authored.fields.senderPubkey).toString("hex")
+                            : this.senderPubkeyHex;
+                        const ourOwnLeaf = authorHex === this.senderPubkeyHex;
                         this.#sealLeafStore.store(this.senderPubkeyHex, ev.receipt.sessionIdHex, {
                             sequenceNumber: seq,
                             leafKind: this.#pendingLeafKind,
-                            senderPubkeyHex: this.senderPubkeyHex,
+                            senderPubkeyHex: authorHex,
                             structure2Cbor,
                             structure1Cbor,
-                            relayId: ev.receipt.relayId,
-                            relayTimestamp: ev.receipt.timestamp,
-                            relaySignatureHex: ev.receipt.signatureHex,
+                            ...(ourOwnLeaf
+                                ? {
+                                    relayId: ev.receipt.relayId,
+                                    relayTimestamp: ev.receipt.timestamp,
+                                    relaySignatureHex: ev.receipt.signatureHex,
+                                }
+                                : {}),
                         }, Date.now());
                     }
                 }
@@ -687,15 +786,100 @@ export class AgentRelayClient {
             const seq = typeof frame["sequence_number"] === "number" ? frame["sequence_number"] : -1;
             const sidHex = Buffer.from(toU8(frame["session_id"])).toString("hex");
             const s1 = toU8(frame["structure1_cbor"]);
-            // Advance last_seen_seq ONLY for a COUNTERPARTY leaf. The relay also echoes our OWN
+            /**
+             * ONE DECODE, TWO CONSUMERS — 033-ACKEMIT. The acknowledgement bump and the seal-leaf capture
+             * below both need the sender's own signed fields, and they must agree about which leaf they
+             * are looking at. Decoding twice would let a future edit change one read and not the other.
+             */
+            const deliveredS1 = decodeStructure1(s1);
+            // Advance last_seen ONLY for a COUNTERPARTY leaf. The relay also echoes our OWN
             // leaf back as a leaf_deliver — that must NOT advance it (same reason as the ack above).
             const authoredByUs = this.#isOwnLeaf(s1);
-            if (seq >= 0 && !authoredByUs)
-                this.#bumpLastSeen(sidHex, seq);
+            /**
+             * The POSITION and the CONTENT AT IT, from the counterparty's own signed bytes.
+             *
+             * ⚠️ THE HASH COMES FROM INSIDE `structure1_cbor`, NEVER FROM AN ENVELOPE FIELD. The frame
+             * also carries `structure2_cbor`, which the RELAY built — taking the hash from there would key
+             * our acknowledgement on a value the witness supplies, and a tampering relay could then make
+             * us sign an acknowledgement of content the counterparty never sent. Index 1 of Structure 1 is
+             * inside the bytes the counterparty signed, so it is the one copy neither we nor the relay can
+             * move.
+             *
+             * A leaf whose layout this build cannot name advances NOTHING — position included. The
+             * previous code advanced `seq` from the envelope regardless, so an unreadable leaf could move
+             * the acknowledgement forward while leaving the hash behind it; refusing to advance keeps the
+             * pair describing one real message, and the relay's own decoder already gates what reaches
+             * here.
+             */
+            if (seq >= 0 && !authoredByUs) {
+                if (deliveredS1.ok) {
+                    this.#bumpLastSeen(sidHex, seq, deliveredS1.fields.contentHash);
+                }
+                else {
+                    this.#logger.warn("relay.leaf_deliver.unreadable", {
+                        seq,
+                        session: sidHex,
+                        structure1Reason: deliveredS1.reason,
+                        impact: "this delivered leaf could not be read, so this session's acknowledgement was NOT " +
+                            "advanced to it. The next message this agent sends will acknowledge the last leaf it " +
+                            "could read, which is honest — it never claims to have seen something it could not.",
+                    });
+                }
+            }
             // Record the COUNTERPARTY's delivered leaf in the seal-leaf log (no relay
             // receipt — the relay does not ack-sign a delivery to the recipient). It is pinned at seal by the
             // absent party's sender_signature (unforgeable) + sequence contiguity against our receipt-pinned own
             // leaves. Our OWN echoed leaf is skipped here (it is recorded WITH its receipt on the ack path).
+            /**
+             * ─── OUR OWN LEAF, WITNESSED BY SOMEBODY ELSE — 034-CARRYLEAF review F2 ──────────────────
+             *
+             * ⚠️ **WITHOUT THIS, MAKING THE COUNTERPARTY ABLE TO WITNESS OUR LEAF COST US THE RECEIPT.**
+             *
+             * When the counterparty counter-submits a leaf WE authored, the relay assigns it a position
+             * and delivers it to us — and `authoredByUs` is true, so the capture below skipped it. We
+             * never submitted it ourselves, so no ack ever arrived and the ack path never wrote a row
+             * either. The result was a permanent hole at that position in our own carry: the unilateral
+             * seal refused it as `seal_carry_noncontiguous`, and the bilateral one refused to co-sign a
+             * root it could not judge. **An honest sender whose relay hiccuped once lost the receipt for
+             * the entire conversation** — for a message sitting in their own transcript.
+             *
+             * So the leaf is stored, **with NO relay receipt**, because we hold none: nobody acked it to
+             * us. That asymmetry is exactly the one the seal design already relies on. A bilateral seal
+             * needs a contiguous chain and gets one. A UNILATERAL seal additionally requires every one of
+             * our OWN leaves to carry a receipt — so a party who never witnesses their own messages still
+             * cannot seal alone on them (`unilateral_own_leaf_unwitnessed`), which is precisely what
+             * `DOD-M15-WITHHOLD-SEAL-1` intends.
+             *
+             * `INSERT OR IGNORE` keeps whichever row lands first, and a real receipt-bearing row for the
+             * same position can only come from our own ack — which cannot exist here, or we would have
+             * submitted it ourselves.
+             */
+            if (this.#sealLeafStore && seq >= 0 && authoredByUs && deliveredS1.ok) {
+                const s2Own = frame["structure2_cbor"];
+                if (s2Own instanceof Uint8Array && s1.length > 0) {
+                    try {
+                        const wrote = this.#sealLeafStore.store(this.senderPubkeyHex, sidHex, {
+                            sequenceNumber: seq,
+                            leafKind: typeof frame["leaf_kind"] === "number" ? frame["leaf_kind"] : LEAF_KIND_MSG,
+                            senderPubkeyHex: this.senderPubkeyHex,
+                            structure2Cbor: s2Own,
+                            structure1Cbor: s1,
+                        }, Date.now());
+                        if (wrote) {
+                            this.#logger.info("relay.seal_leaf.own.witnessed_by_counterparty", {
+                                seq,
+                                session: sidHex,
+                                impact: "a message THIS agent wrote was witnessed by the counterparty rather than by us — " +
+                                    "our own submit did not land. The leaf is kept so this conversation can still be " +
+                                    "sealed together; sealing it alone would still need a receipt we do not hold.",
+                            });
+                        }
+                    }
+                    catch (err) {
+                        this.#logger.error("relay.seal_leaf.own.store_failed", { seq, session: sidHex, error: extractErrorMessage(err) });
+                    }
+                }
+            }
             if (this.#sealLeafStore && seq >= 0 && !authoredByUs) {
                 const s2 = frame["structure2_cbor"];
                 const structure2Cbor = s2 instanceof Uint8Array ? s2 : undefined;
@@ -705,9 +889,8 @@ export class AgentRelayClient {
                 // #isOwnLeaf and #captureReceipt and was simply missed by the order's reader list, which is
                 // exactly the "next layout change has to find them again" problem the shared decoder exists
                 // to end. Behaviour for every relay-accepted leaf is unchanged; the fail-open closes.
-                const s1Decoded = decodeStructure1(s1);
-                const senderHex = s1Decoded.ok
-                    ? Buffer.from(s1Decoded.fields.senderPubkey).toString("hex")
+                const senderHex = deliveredS1.ok
+                    ? Buffer.from(deliveredS1.fields.senderPubkey).toString("hex")
                     : undefined;
                 if (structure2Cbor && s1.length > 0 && senderHex) {
                     try {
@@ -1220,6 +1403,28 @@ export class AgentRelayClient {
          */
         return this.submitLeaf(node, sessionId, contentHash, leafKind, null);
     }
+    /**
+     * ─── WITNESS A LEAF THIS AGENT RECEIVED BUT DID NOT AUTHOR — 034-CARRYLEAF ────────────────────
+     *
+     * **This is what closes `DOD-M15-WITHHOLD-SEAL-1`.** Until it existed, `submitMessageHash` had
+     * one production caller on the SEND path, so nothing ever witnessed a message that was RECEIVED.
+     * A counterparty who delivered a message directly and never submitted its hash left the relay's
+     * account of the conversation one message short — permanently — and a unilateral seal then agreed
+     * with the witness. Every leaf validly signed, nothing false, the last thing said simply absent.
+     *
+     * **The teeth are the author's own signature.** It arrived on the content frame beside the bytes
+     * it signs, this daemon verified it before ingesting anything, and it cannot be forged here. The
+     * relay verifies it again against the session's assignment before sequencing — so what this hands
+     * over is a claim the author made and cannot disown.
+     *
+     * ⚠️ **THE BYTES ARE PASSED THROUGH, NEVER REBUILT.** A signature is over the encoded bytes, and
+     * the one measured cost of forgetting that on this exact structure was a daemon-local encoder
+     * emitting a timestamp as float64 where the published one promotes to uint64 — same value,
+     * different signed bytes, refused by everyone.
+     */
+    async witnessReceivedLeaf(node, sessionId, contentHash, leafKind, carried) {
+        return this.submitLeaf(node, sessionId, contentHash, leafKind, null, carried);
+    }
     /**
      * Submit a leaf hash of a given kind (0x00 message / 0x02 control) to the relay. The SEAL
      * ctrl leaf rides this path: two distinct-sender ctrl leaves in the relay's
@@ -1263,7 +1468,15 @@ export class AgentRelayClient {
      * before any test runs. Every caller must now say what this leaf carries, and `submitMessageHash`
      * says `null` in one visible place instead of by saying nothing at all.
      */
-    async submitLeaf(node, sessionId, contentHash, leafKind, contentBytes) {
+    async submitLeaf(node, sessionId, contentHash, leafKind, contentBytes, 
+    /**
+     * 034-CARRYLEAF — a leaf THIS AGENT DID NOT AUTHOR, carried on its author's behalf.
+     *
+     * Absent for every ordinary send, where this client builds and signs its own claim. Present
+     * only when witnessing something received whose author never submitted it — see
+     * `witnessReceivedLeaf`.
+     */
+    carried) {
         if (contentBytes !== null && leafKind !== LEAF_KIND_CTRL) {
             // Logged at ERROR and returned: a caller reaching this line is trying to hand the relay
             // operator content, and the log must carry it even if the caller swallows the result.
@@ -1331,7 +1544,7 @@ export class AgentRelayClient {
         }
         // Chain on the prior submit so only one is outstanding at a time (FIFO). The ack
         // carries no session_id, so concurrent submits on one stream would be ambiguous.
-        const run = this.#submitChain.then(() => this.#doSubmit(node, sessionId, contentHash, leafKind, contentBytes));
+        const run = this.#submitChain.then(() => this.#doSubmit(node, sessionId, contentHash, leafKind, contentBytes, carried));
         // Keep the chain alive regardless of this submit's outcome.
         this.#submitChain = run.then(() => undefined, () => undefined);
         return run;
@@ -1379,7 +1592,7 @@ export class AgentRelayClient {
      * answering `retry_after_ms: 3600000`. Past this the send fails and says so.
      */
     static #RATE_LIMITED_MAX_WAIT_MS = 65_000;
-    async #doSubmit(node, sessionId, contentHash, leafKind, contentBytes) {
+    async #doSubmit(node, sessionId, contentHash, leafKind, contentBytes, carried) {
         const sessionIdHex = Buffer.from(sessionId).toString("hex");
         // Snapshotted BEFORE the first attempt, and it is the whole safety of this loop.
         //
@@ -1397,7 +1610,7 @@ export class AgentRelayClient {
         // reported `session_not_found`, indistinguishable at the wire from the race — which is why
         // this must be discriminated on OUR state, not on the relay's reason string.
         const recordedBefore = this.#sessions.get(sessionIdHex)?.recorded === true;
-        let result = await this.#doSubmitOnce(node, sessionId, contentHash, leafKind, contentBytes);
+        let result = await this.#doSubmitOnce(node, sessionId, contentHash, leafKind, contentBytes, carried);
         for (let attempt = 1; attempt < _a.#SESSION_NOT_FOUND_ATTEMPTS
             && !recordedBefore
             && !result.ok
@@ -1416,7 +1629,7 @@ export class AgentRelayClient {
                 attempt,
                 reason: result.reason,
             });
-            result = await this.#doSubmitOnce(node, sessionId, contentHash, leafKind, contentBytes);
+            result = await this.#doSubmitOnce(node, sessionId, contentHash, leafKind, contentBytes, carried);
         }
         /**
          * DOD-M15-RELAYABUSE-1 review F1 — **A THROTTLE IS BACK-PRESSURE, NOT AN ERROR.** (Andre,
@@ -1451,7 +1664,7 @@ export class AgentRelayClient {
             await new Promise((r) => setTimeout(r, waitMs));
             if (this.#closed)
                 break;
-            result = await this.#doSubmitOnce(node, sessionId, contentHash, leafKind, contentBytes);
+            result = await this.#doSubmitOnce(node, sessionId, contentHash, leafKind, contentBytes, carried);
         }
         if (!result.ok && result.reason === "rate_limited") {
             // Option 2, the fallback: it did not clear within our budget, so the caller must hear it
@@ -1476,7 +1689,7 @@ export class AgentRelayClient {
         }
         return result;
     }
-    async #doSubmitOnce(node, sessionId, contentHash, leafKind, contentBytes) {
+    async #doSubmitOnce(node, sessionId, contentHash, leafKind, contentBytes, carried) {
         if (this.#closed)
             return { ok: false, reason: "relay_client_closed" };
         if (!(await this.#ensureConnected(node)))
@@ -1512,22 +1725,85 @@ export class AgentRelayClient {
         const stream = this.#stream;
         if (!stream)
             return { ok: false, reason: "relay_unavailable" };
-        // This session's OWN high-water mark (NOT an agent-global one) — the relay's seq_counter
-        // is per session and rejects last_seen_seq > seq_counter.
-        const lastSeenForSession = this.#lastSeen.get(sessionIdHex) ?? 0;
+        /**
+         * ─── WHAT THIS SEND ACKNOWLEDGES — 033-ACKEMIT ───────────────────────────────────────────────
+         *
+         * This session's OWN high-water mark (NOT an agent-global one) — the relay's seq_counter is per
+         * session and rejects `last_seen_seq > seq_counter` — AND the content hash at that position,
+         * read from the one entry that holds both.
+         */
+        const lastSeen = this.#lastSeen.get(sessionIdHex);
+        /**
+         * ⚠️ **THIS COMMENT USED TO SAY "REFUSED, NOT DOWNGRADED", AND THE CODE UNDER IT DID REFUSE.**
+         * It is rewritten rather than deleted because a comment asserting a refusal that no longer
+         * happens is how the next reader comes to believe a guard exists where there is a fallback.
+         *
+         * There is no seed only when this session was registered with neither a genesis nor an
+         * assignment to derive one from, AND nothing has been received on it. The claim that goes out
+         * then is `last_seen_seq: 0` with no hash — "I have seen nothing of yours" — which is true and
+         * asserts nothing about content, so it is not the unbacked number this unit exists to stop
+         * signing. A claim that NAMES a position with no hash is the defect, and the receiving daemon
+         * refuses exactly that.
+         */
+        /**
+         * ⚠️ NOT FOR A CARRIED LEAF — 034-CARRYLEAF review F8. This branch describes THIS agent having
+         * nothing to acknowledge, and on a counter-submit the acknowledgement inside the bytes is the
+         * AUTHOR's, already made. Logging "this submit acknowledges nothing" about it would be false,
+         * and this daemon's own seed is irrelevant to a claim it did not write.
+         */
+        if (!lastSeen && !carried) {
+            /**
+             * ⚠️ **v1, AND ONLY BECAUSE THERE IS NOTHING TO ACKNOWLEDGE.** Same rule as the content
+             * claim's, and the receiving half is `#verifyAcknowledgedContent` — a v1 claim is refused the
+             * moment it names position 1 or beyond, and accepted when it names none.
+             *
+             * Reaching here means the session was registered with no genesis and no assignment to derive
+             * one from, and no counterparty leaf has been delivered. `last_seen_seq: 0` with no hash says
+             * "I have seen nothing of yours", which is true, and asserts nothing about content — so it is
+             * not the unbacked number this unit exists to stop signing.
+             *
+             * It does not refuse the submit, and an earlier version did. Sessions brokered without a
+             * relay assignment are real, and refusing there left them unable to be witnessed at all.
+             */
+            this.#logger.info("session.relay.submit.unacknowledged", {
+                relayPeerId: this.#relayPeerId,
+                session: sessionIdHex,
+                impact: "this submit acknowledges nothing: the session has no recorded starting point and no " +
+                    "counterparty leaf has arrived on it. The leaf is witnessed as normal; the claim simply " +
+                    "makes no assertion about what this agent has received.",
+            });
+        }
         // The published encoder from protocol-types — the ONE definition of the field order, pinned by
-        // `structure1-canonical.json`. A second local copy lived here until 020-ACKHASH; it drifted, and
-        // the drift was invisible because both copies "worked": it encoded a timestamp above 2^32-1 as a
-        // CBOR float64 while the published encoder (and every other TBS builder in this package) promotes
-        // it to a uint64. Same value, different signed bytes, and only the vector said which was canonical.
-        const structure1 = encodeStructure1({
+        // `structure1-canonical.json` (v1) and `structure1-v2-canonical.json` (v2). A second local copy
+        // lived here until 020-ACKHASH; it drifted, and the drift was invisible because both copies
+        // "worked": it encoded a timestamp above 2^32-1 as a CBOR float64 while the published encoder
+        // (and every other TBS builder in this package) promotes it to a uint64. Same value, different
+        // signed bytes, and only the vector said which was canonical.
+        //
+        // `lastSeenHash` is passed on EVERY send, so every claim this daemon signs is v2 and binds to
+        // content. Nothing here ever passes `undefined` — see the refusal above.
+        /**
+         * ⚠️ **A CARRIED LEAF IS SENT VERBATIM AND SIGNED BY NOBODY HERE — 034-CARRYLEAF.**
+         *
+         * When this agent is witnessing something it RECEIVED, the claim already exists: its author
+         * built it, signed it, and put it on the content frame. Re-encoding it would change the signed
+         * bytes and the relay would refuse a leaf that is perfectly valid. Signing it ourselves would be
+         * worse — it would turn their statement into ours, which is the one thing that must never happen
+         * to a record whose whole value is that each party's words are their own.
+         *
+         * So this branch takes the bytes as they arrived, and this agent's own acknowledgement state is
+         * deliberately NOT consulted: `last_seen_seq` and `last_seen_hash` inside those bytes are the
+         * AUTHOR's account of what THEY had seen, and they are not ours to restate.
+         */
+        const structure1 = carried ? carried.structure1Cbor : encodeStructure1({
             contentHash,
             senderPubkey: this.#senderPubkey,
             sessionId,
-            lastSeenSeq: lastSeenForSession,
+            lastSeenSeq: lastSeen?.seq ?? 0,
             timestamp: Date.now(),
+            ...(lastSeen ? { lastSeenHash: lastSeen.hash } : {}),
         });
-        const signature = await this.#keyProvider.sign(structure1);
+        const signature = carried ? carried.senderSignature : await this.#keyProvider.sign(structure1);
         const frame = encodeCbor({
             type: "hash_submit",
             session_id: sessionId,
@@ -1609,8 +1885,44 @@ export class AgentRelayClient {
         }
     }
     /** The highest relay-assigned sequence observed for a given session (ack or deliver). */
-    lastSeenSeq(sessionIdHex) {
-        return this.#lastSeen.get(sessionIdHex) ?? 0;
+    /**
+     * Advance this session's acknowledgement from a message that ARRIVED — 033-ACKEMIT review F1.
+     *
+     * ⚠️ **`#bumpLastSeen` used to have exactly one caller, inside the `leaf_deliver` handler, so the
+     * acknowledgement tracked what the RELAY DELIVERED rather than what was RECEIVED.** On a direct
+     * session that is a real difference: the content arrives peer-to-peer and the relay's copy of the
+     * leaf follows separately, so until it did, this daemon signed an acknowledgement one message
+     * behind what it had actually read — and on a session where delivery never came back at all, the
+     * acknowledgement never moved.
+     *
+     * The order's own words are "the content hash of the last message this sender ACTUALLY RECEIVED".
+     * This is the caller that makes that true: the receive path calls it as soon as a message has been
+     * verified and ingested at a known canonical position.
+     *
+     * **THE POSITION IS STILL REQUIRED, and that is a real limit rather than an oversight.** The pair
+     * is (position, content-at-position), and the relay refuses a `last_seen_seq` that runs ahead of
+     * its counter — so a message that arrived with NO ordering record cannot be acknowledged by
+     * position at all, whatever we hold of it. That case is the withheld-submit attack itself, and it
+     * is closed by carrying the sender's signed leaf into the seal, not from here.
+     */
+    noteReceivedLeaf(sessionIdHex, relaySeq, contentHash) {
+        this.#bumpLastSeen(sessionIdHex, relaySeq, contentHash);
+    }
+    /**
+     * The POSITION and the CONTENT AT IT together — 033-ACKEMIT.
+     *
+     * ⚠️ **IT REPLACED `lastSeenSeq()`, WHICH IS DELETED RATHER THAN LEFT WIRED.** That accessor
+     * returned the position alone, and `session-node-manager`'s unwitnessed content claim was its
+     * only caller. Leaving it in place after this one took over would leave a second way to read half
+     * of a pair that must be read whole: a `last_seen_seq` paired with a `last_seen_hash` for a
+     * different message is worse than no acknowledgement at all, because it looks checkable and
+     * fails.
+     *
+     * `undefined` means this session has no acknowledgement to make, which the caller must handle
+     * rather than fill in.
+     */
+    lastSeenAck(sessionIdHex) {
+        return this.#lastSeen.get(sessionIdHex);
     }
     close() {
         this.#closed = true;