@cello-protocol/daemon 0.0.192 → 0.0.194

package/dist/session-node-manager.js

@@ -59,6 +59,7 @@ import { extractErrorMessage } from "./error-message.js";
 import { terminalRelayRefusal } from "./session-terminal-refusal.js";
 import { RelayReceiptStore } from "./relay-receipt-store.js";
 import { SessionSealLeafStore } from "./session-seal-leaf-store.js";
+import { SessionOwnChainStore } from "./session-own-chain-store.js";
 import { certifiedLeafSetFrom } from "./sealed-leaf-set.js";
 import { addColumnIfMissing } from "./column-birth.js";
 import { quarantineRedaction, retentionSentence } from "./quarantine-framing.js";
@@ -488,6 +489,20 @@ const AUTHORSHIP_SESSION_MISMATCH = "session_mismatch";
  * side looks like, and an error that names a party the code did not check is this milestone's
  * founding defect.
  */
+/**
+ * `DOD-M15-SELFCHAIN-1` — the sender's link to their OWN previous message names content this side
+ * did not receive from them as their last one.
+ *
+ * ⚠️ THIS IS THE ONE THAT MEANS THE ORDER OF THE CONVERSATION IS IN DISPUTE, and it is why it is
+ * named apart from the acknowledgement reasons above rather than folded in with them. Those say the
+ * sender is wrong about what WE said; this says they are wrong about what THEY said, which is the
+ * only thing they cannot be honestly mistaken about for long.
+ *
+ * ⚠️ AND IT STILL NAMES WHAT WAS OBSERVED, NEVER A CONCLUSION. The same signal is produced by a
+ * peer reordering a conversation and by a peer whose own chain record went out of step after a
+ * restart, and this side cannot tell them apart.
+ */
+const AUTHORSHIP_SELF_CHAIN_MISMATCH = "self_chain_mismatch";
 /** A v1 claim: it carries no `last_seen_hash`, so it asserts a POSITION and no content at all. */
 const AUTHORSHIP_ACK_HASH_ABSENT = "ack_hash_absent";
 /** The hash names content this side does not hold at the position the claim names. */
@@ -583,6 +598,14 @@ function carryContentHashInputs(carry) {
     }
     return inputs;
 }
+/**
+ * How many of the counterparty's content hashes a session remembers for the self-link check.
+ *
+ * Bounded because a peer feeds it. 256 covers any realistic gap in our own copy of a conversation —
+ * a held message, one the inbound screen refused, one lost in flight — while keeping the memory a
+ * single session can cost fixed. Past the cap the check gets STRICTER, never looser.
+ */
+const SELF_CHAIN_MEMORY = 256;
 export class SessionNodeManager {
     #factory;
     #logger;
@@ -599,6 +622,8 @@ export class SessionNodeManager {
     #relayReceiptStore = null;
     /** FED-OPTIONB-SEAL-001: the per-session leaf log (both parties) carried at a unilateral seal. */
     #sealLeafStore = null;
+    /** `DOD-M15-SELFCHAIN-1` — this agent's own last message per session, so the next one links to it. */
+    #ownChainStore = null;
     // M9-CORE-001: the inbound screening seam. Every byte that reaches the agent passes
     // through #appendVerifiedContent's buffer write; screenInbound gates it there, on every
     // arrival path (direct, held-release, recovered-park). Defaults to always-allow when no
@@ -678,6 +703,7 @@ export class SessionNodeManager {
             client = this.#detachedRelayClientBuilder?.(agentName, ep.relayPeerId, [...ep.relayAddrs], {
                 receiptStore: this.#relayReceiptStore ?? undefined,
                 sealLeafStore: this.#sealLeafStore ?? undefined,
+                ownChainStore: this.#ownChainStore ?? undefined,
                 // DOD-M15-RELAYSLOTS-1: read at each auth, never snapshotted — the token expires hourly.
                 onlineToken: () => this.getDirectoryOnlineToken(agentName),
             });
@@ -791,6 +817,7 @@ export class SessionNodeManager {
             client = this.#detachedRelayClientBuilder?.(agentName, relayPeerId, [baseRelayAddr], {
                 receiptStore: this.#relayReceiptStore ?? undefined,
                 sealLeafStore: this.#sealLeafStore ?? undefined,
+                ownChainStore: this.#ownChainStore ?? undefined,
                 // DOD-M15-RELAYSLOTS-1: read at each auth, never snapshotted — the token expires hourly.
                 onlineToken: () => this.getDirectoryOnlineToken(agentName),
             });
@@ -1143,6 +1170,8 @@ export class SessionNodeManager {
     /** The reason the last reservation attempt was refused, per agent — captured at the rejection so
      *  the retry and give-up can name a CAUSE instead of only their own exit point. */
     #srLastRejectionReason = new Map();
+    /** 032-RELAYSPREAD: when this agent's receiver was last re-spread, so it never rides the 30s grid. */
+    #srLastRespreadAt = new Map();
     #srReservationRetry = new Map();
     #reservationWatchdog = null;
     /** DOD-PARK-DRAIN-1: how often the backstop drain rides the watchdog grid — see #parkedDrainBackstopTick. */
@@ -1993,6 +2022,20 @@ export class SessionNodeManager {
         this.#logger.info("persist.db.opened", { encrypted: true, migrated: migration.migrated });
         // PERSIST-002: the identity store (agents + manifest_state) lives in the same encrypted DB.
         ensureIdentitySchema(this.#db);
+        /**
+         * ⚠️ THE OWN-CHAIN STORE IS BUILT HERE, NOT LAZILY INSIDE THE RELAY-CLIENT BUILDERS —
+         * `DOD-M15-SELFCHAIN-1`, review F2.
+         *
+         * It was constructed only when a relay client was attached, so a session that never attached one
+         * left it null: nothing was ever recorded, and every message that side sent carried the same
+         * self link. That is the exact defect this unit exists to close, on the path its own comments
+         * call the one that matters most — a conversation that ran while the relay was down is precisely
+         * the one whose order gets disputed later.
+         *
+         * The chain belongs to the AGENT and the SESSION. The relay is how the conversation travels; it
+         * is not what makes the conversation provable.
+         */
+        this.#ownChainStore = new SessionOwnChainStore(this.#db, this.#logger);
         this.#db.exec(`
       CREATE TABLE IF NOT EXISTS sessions (
         session_id TEXT NOT NULL,
@@ -4596,6 +4639,20 @@ export class SessionNodeManager {
                     "Close an existing session before starting a new one.",
             };
         }
+        /**
+         * ⚠️ THE "NO ASSIGNMENT" REFUSAL IS NOT HERE, AND THE PLACE IT MOVED TO IS THE POINT.
+         *
+         * `DOD-M15-SELFCHAIN-1`, ruled 2026-09-06: a session offered with no directory assignment is
+         * suspicious and must be refused and surfaced. It was briefly enforced HERE, and that was the
+         * wrong door: `createSessionNode` also runs on this agent's OWN outbound path, where the
+         * counterparty has no say in whether an assignment exists. A refusal there fires on our own
+         * initiations and says nothing about anyone's conduct.
+         *
+         * A counterparty can only attempt it INBOUND, so that is where it is refused and recorded —
+         * see `inbound-sessions.ts`. What remains true here is the correctness backstop: a session with
+         * no anchor cannot sign a chained message, so the SEND path refuses (`session_unchainable`)
+         * rather than emitting a message whose place could never be proven.
+         */
         // The session node N_A: either a FRESH ephemeral node (default), or — for the initiator
         // path (reuseStandingReceiver) — the standing receiver handed off as the session node. The
         // latter makes N_A's peer id equal the SESSION endpoint the initiator ADVERTISED to the
@@ -6146,6 +6203,7 @@ export class SessionNodeManager {
         this.#standingReceivers.clear();
         this.#srReservationRetry.clear();
         this.#srLastRejectionReason.clear();
+        this.#srLastRespreadAt.clear();
         // Release the SQLite handle so the DB file is no longer held open after shutdown
         // (review L5). Queries guard on `#db === null` and degrade to empty/null.
         if (this.#db) {
@@ -7273,6 +7331,19 @@ export class SessionNodeManager {
         if (assignment) {
             return computeGenesisPrevRoot(assignment.participantA, assignment.participantB, Uint8Array.from(Buffer.from(sessionId, "hex")), assignment.sessionTimestamp);
         }
+        /**
+         * ⚠️ THE IN-MEMORY RECORD, READ BEFORE THE DATABASE — and this ordering is the fix, not a
+         * cache.
+         *
+         * `recordSessionGenesis` is called BEFORE the session node exists, because registering the
+         * session is what seeds the relay client's acknowledgement state and the seed has to be
+         * available by then. At that moment there is no session ROW to write to — `createSessionNode`
+         * inserts it — so a database-only record would still be empty at the one moment it is read.
+         * The row is written from this map when the insert happens, and read back after a restart.
+         */
+        const recorded = this.#sessionGenesis.get(this.#k(agentName, sessionId));
+        if (recorded)
+            return recorded;
         /**
          * THE RESTART CASE. A session restored from the database re-registers with no assignment, so
          * the derivation above has nothing to work from and the stored copy is the only answer. Read
@@ -7286,7 +7357,9 @@ export class SessionNodeManager {
         const bytes = stored instanceof Uint8Array ? stored : Buffer.isBuffer(stored) ? new Uint8Array(stored) : null;
         // A stored value of the wrong width is not a genesis. Refusing it here sends the caller down its
         // own named refusal, which is a better outcome than signing an acknowledgement of 17 bytes.
-        return bytes && bytes.length === 32 ? bytes : undefined;
+        if (bytes && bytes.length === 32)
+            return bytes;
+        return undefined;
     }
     /**
      * Persist the session's genesis prev_root, once, at the moment the assignment arrives.
@@ -7295,11 +7368,64 @@ export class SessionNodeManager {
      * change for the life of a session, so the second writer is either redundant or wrong, and the
      * first write is the one derived closest to the assignment that opened the session.
      */
+    /**
+     * Record the session's starting point from the ASSIGNMENT — `DOD-M15-SELFCHAIN-1`.
+     *
+     * ⚠️ **CALL THIS BEFORE `createSessionNode` / `acceptSession`, NOT AFTER.** Registering the
+     * session is what seeds the relay client's acknowledgement state, so the value has to exist by
+     * then; recorded afterwards, the first message of the session has nothing to chain to and is
+     * refused. Both the initiator and the responder derive this from the same FROST-signed assignment
+     * before they build anything.
+     *
+     * ⚠️ THE ANCHOR BELONGS TO THE SESSION, NOT TO THE RELAY, and treating it as the relay's was a
+     * real gap. It was derived only when a relay assignment CARRY was present — and that carry is
+     * built only for a relay-mode assignment that also carries a per-node relay signature. So a
+     * direct-mode session, brokered and FROST-signed exactly like any other, recorded no starting
+     * point at all, and every message on it had nothing to chain to.
+     *
+     * Both transport modes get their assignment from the same ceremony and derive the same value from
+     * it. The relay is how the conversation travels; it is not what makes the conversation provable.
+     */
+    recordSessionGenesis(agentName, sessionId, participantA, participantB, sessionTimestamp) {
+        this.#persistGenesisPrevRoot(agentName, sessionId, {
+            participantA, participantB, sessionTimestamp,
+        });
+    }
+    /**
+     * The starting point of each live session's chain, in memory.
+     *
+     * ⚠️ NOT A CACHE OF THE DATABASE — it is the only copy that exists at the moment the value is
+     * first needed. It is recorded before the session node is built, and the session ROW does not
+     * exist until that build inserts it (`#insertSessionRow` writes the column from here). The row is
+     * what survives a restart; this is what the session open itself reads.
+     */
+    #sessionGenesis = new Map();
     #persistGenesisPrevRoot(agentName, sessionId, assignment) {
+        let genesis;
+        try {
+            genesis = computeGenesisPrevRoot(assignment.participantA, assignment.participantB, Uint8Array.from(Buffer.from(sessionId, "hex")), assignment.sessionTimestamp);
+        }
+        catch (err) {
+            /**
+             * The DERIVATION failed, which is a different failure from the write below and must not be
+             * reported as one. It means the assignment's own fields are not what this function needs, and
+             * no amount of database health would help.
+             */
+            this.#logger.error("session.genesis.derive.failed", {
+                agentName, sessionId,
+                error: err instanceof Error ? err.message : String(err),
+                impact: "this session's starting point could not be computed from its assignment, so nothing " +
+                    "sent on it can be chained and every send will be refused by name. The session open " +
+                    "continues; the conversation cannot.",
+            });
+            return;
+        }
+        // The in-memory record FIRST, and unconditionally: it is what the session open reads, and it
+        // must not depend on a database write that may not have anywhere to land yet.
+        this.#sessionGenesis.set(this.#k(agentName, sessionId), genesis);
         if (!this.#db)
             return;
         try {
-            const genesis = computeGenesisPrevRoot(assignment.participantA, assignment.participantB, Uint8Array.from(Buffer.from(sessionId, "hex")), assignment.sessionTimestamp);
             this.#db
                 .prepare("UPDATE sessions SET genesis_prev_root = ? WHERE agent_id = ? AND session_id = ? AND genesis_prev_root IS NULL")
                 .run(Buffer.from(genesis), this.#requireAgentId(agentName), sessionId);
@@ -7940,6 +8066,10 @@ export class SessionNodeManager {
         // `finally` retires — same defect, other end, other cap (64 outbound per protocol per
         // connection). See the note on #handleContentStream's finally.
         let sendStream;
+        // 🔗 `DOD-M15-SELFCHAIN-1`: true when THIS side built the claim, so this side owns advancing its
+        // chain once the message has gone. Declared out here because the PARK path — which is also a
+        // delivery — runs in the catch below.
+        let ownClaimAwaitingSend = false;
         /**
          * 034-CARRYLEAF — HOISTED OUT OF THE TRY so the PARK path in the catch can carry them.
          *
@@ -7976,8 +8106,10 @@ export class SessionNodeManager {
             frameS1 = orderingS1;
             frameSig = orderingSig;
             let frameS2 = orderingS2;
+            // A relay-witnessed claim advanced the chain on its ack; this flag covers the other case.
             if (frameS1 === undefined || frameSig === undefined) {
                 const own = await this.#signOwnContentClaim(agentName, sessionId, entry, contentHash);
+                ownClaimAwaitingSend = true;
                 frameS1 = own.structure1;
                 frameSig = own.signature;
                 frameS2 = undefined;
@@ -8055,7 +8187,9 @@ export class SessionNodeManager {
              *
              * So the session key encrypts the copy that goes ON THE WIRE, below, and nothing else.
              */
-            this.#trackAwaitingAck(agentName, sessionId, content, contentHash, correlationId, orderingS1, orderingS2, contentHashAlg);
+            // 034-CARRYLEAF: the SIGNED claim and its domain ride the awaiting entry, so a message that
+            // ends up re-parked after a restart still reaches its recipient in a shape they can witness.
+            this.#trackAwaitingAck(agentName, sessionId, content, contentHash, correlationId, frameS1 ?? orderingS1, orderingS2, contentHashAlg, frameSig, leafKind);
             /**
              * THE WIRE COPY. `content_hash` above was computed over the PLAINTEXT and stays that way: the
              * transcript, the seal and the salted hash all depend on it meaning what it means today, and
@@ -8150,6 +8284,16 @@ export class SessionNodeManager {
             // A close that failed for a benign reason costs a redundant park, which the receiver dedups
             // on the content hash. A false delivered costs the message.
             await stream.close();
+            /**
+             * 🔗 THE MESSAGE HAS GONE, SO THE CHAIN ADVANCES — `DOD-M15-SELFCHAIN-1`, review F7.
+             *
+             * Below `stream.close()` deliberately: close waits for the write buffer to drain, so a reset
+             * mid-flush throws above this line and the bytes never left. Advancing before it would point
+             * the chain at a message the counterparty never saw, and every later message would then be
+             * refused by them for a reason that names tampering.
+             */
+            if (ownClaimAwaitingSend)
+                this.#advanceOwnChain(agentName, sessionId, entry, contentHash);
             this.#clearSessionImpairment(agentName, sessionId, "direct_send", correlationId);
             return { ok: true, delivered: true, ...(assignedSeq === undefined ? {} : { sequenceNumber: assignedSeq }), ...(sentAuthorship === undefined ? {} : { authorship: sentAuthorship }), ...(relayRefusal === undefined ? {} : { relayRefusal }) };
         }
@@ -8221,6 +8365,17 @@ export class SessionNodeManager {
              */
             const attempt = await this.#parkContent(agentName, sessionId, hashHex, content, frameS1, orderingS2, contentHashAlg, frameSig, leafKind);
             if (attempt.outcome === "parked") {
+                /**
+                 * 🔗 A PARK IS A DELIVERY, so the chain advances here too — `DOD-M15-SELFCHAIN-1`.
+                 *
+                 * The mailbox copy is sealed to the counterparty's long-term key and they WILL open it, so
+                 * the message is part of the conversation. Leaving the chain behind here would make this
+                 * side's next message link to something the counterparty has already moved past, and they
+                 * would refuse it as a broken chain — a false tamper report caused by our own relay being
+                 * briefly unreachable.
+                 */
+                if (ownClaimAwaitingSend)
+                    this.#advanceOwnChain(agentName, sessionId, entry, contentHash);
                 this.#noteImpairmentRetention(agentName, sessionId, "parked");
                 return { ok: true, delivered: false, parked: true, ...(assignedSeq === undefined ? {} : { sequenceNumber: assignedSeq }), ...(sentAuthorship === undefined ? {} : { authorship: sentAuthorship }), ...(relayRefusal === undefined ? {} : { relayRefusal }) };
             }
@@ -11784,6 +11939,17 @@ export class SessionNodeManager {
             throw new Error(`patchRelayClientForTest: no active node for (${agentName}, ${sessionId})`);
         entry.relayClient = relayClient;
         entry.relaySessionIdBytes = relaySessionIdBytes;
+        /**
+         * ⚠️ REGISTER THE SESSION TOO — the seam must leave the state production leaves.
+         *
+         * A relay client that has never been told about a session holds no starting point for it, and
+         * since `DOD-M15-SELFCHAIN-1` every submit on such a session is refused: there is nothing for
+         * the chain links to anchor to. Production always registers, because attaching a relay is what
+         * registration IS. A seam that attached the client and skipped the registration left fixtures
+         * exercising a refusal path, and the failure surfaced as "the seal never happened" in a test
+         * about away-mode replies.
+         */
+        relayClient.registerSession(Buffer.from(relaySessionIdBytes).toString("hex"), entry.node, undefined, entry.relayAssignment, this.#sessionGenesisPrevRoot(agentName, sessionId));
     }
     pushReceivedContentForTest(agentName, sessionId, seq, content, senderPubkey) {
         this.recordTranscriptMessage(agentName, sessionId, seq, "received", new TextEncoder().encode(content), "test");
@@ -11846,7 +12012,7 @@ export class SessionNodeManager {
      * route reads this map, and a v2 envelope omits the field entirely whenever the value is `sha256`,
      * which is every value in play today. That re-opened the exact finding the fix closed.
      */
-    #trackAwaitingAck(agentName, sessionId, content, contentHash, correlationId, structure1Cbor, structure2Cbor, contentHashAlg) {
+    #trackAwaitingAck(agentName, sessionId, content, contentHash, correlationId, structure1Cbor, structure2Cbor, contentHashAlg, structure1Signature, leafKind) {
         const hashHex = Buffer.from(contentHash).toString("hex");
         const ackKey = this.#k(agentName, sessionId);
         let bySession = this.#awaitingAck.get(ackKey);
@@ -11868,7 +12034,7 @@ export class SessionNodeManager {
         // B2b-1 review F2: the algorithm rides WITH the entry. The TTF-expiry park route reads this map
         // minutes later, in-process, and without it that copy names nothing (= sha256) while the direct
         // frame named something else — the same message, two claims about what it is, no restart needed.
-        bySession.set(hashHex, { timer, content, correlationId, structure1Cbor, structure2Cbor, contentHashAlg });
+        bySession.set(hashHex, { timer, content, correlationId, structure1Cbor, structure2Cbor, contentHashAlg, structure1Signature, leafKind });
     }
     /**
      * Resolve an awaiting-ACK entry on a `persisted` delivery ACK (AC-001/AC-002): cancel
@@ -11924,7 +12090,7 @@ export class SessionNodeManager {
             // M12-P12 (review pass 2): the ordering record travels on THIS path too. It is in hand — the
             // very next statement hands it to #parkContent — and a TTF row written without it re-parks in
             // arrival order, which is the divergent-leaf-index failure the durable columns exist to stop.
-            this.#onAwaitingTtf?.(agentName, sessionId, hashHex, entry.content, entry.structure1Cbor, entry.structure2Cbor, entry.contentHashAlg);
+            this.#onAwaitingTtf?.(agentName, sessionId, hashHex, entry.content, entry.structure1Cbor, entry.structure2Cbor, entry.contentHashAlg, entry.structure1Signature, entry.leafKind);
         }
         catch (err) {
             this.#logger.error("content.park.backstop.failed", {
@@ -12253,6 +12419,28 @@ export class SessionNodeManager {
          * content on the direct path, and the ingest below is what decides whether the other route
          * succeeded. Reading it after would race the clear.
          */
+        /**
+         * ⚠️ **REFUSING AN UNNOTARIZABLE MAILBOX MESSAGE WAS TRIED HERE AND REVERTED — recorded so the
+         * next attempt starts from what actually blocks it, not from the compatibility argument that
+         * does not.**
+         *
+         * The mailbox is the remaining route for the withholding attack: a counterparty who parks a
+         * message with no ordering record AND no signature over its ordering claim delivers something
+         * readable that can never enter a receipt. The obvious fix is to refuse it here.
+         *
+         * **It cannot ship yet, and the reason is our OWN path, not an older peer's.** `SEC-1` AC5 is
+         * explicit: the crash-backstop shape — signed by the sender, no ordering record — is legal and
+         * must be accepted. That envelope is produced when content is queued before anything witnessed
+         * it, and from the recipient's side it is INDISTINGUISHABLE from an attacker's stripped one. So
+         * this refusal rejects our own crash recovery along with the attack.
+         *
+         * **What closes it:** make the crash backstop sign an ordering claim at enqueue time, the way
+         * the live park path now does (`#signOwnContentClaim` already produces exactly this artifact).
+         * Then "no ordering record and no signed claim" is a shape only a modified client emits, and
+         * refusing it costs nothing real. The retry queue already carries the two columns for it —
+         * `structure1_sig` and `leaf_kind` — which were added for this and are populated on the live
+         * path today.
+         */
         const refusedForAuthorship = this.#refusedOnDirectPath.get(memoKey)?.has(contentHashHex) === true;
         const result = await this.ingestReceivedContent(agentName, sessionId, env.content, contentHash, correlationId, recoveredSeq ?? undefined, 
         // The envelope's own claim, verbatim — `undefined` on a v2 envelope, which resolves to
@@ -13142,9 +13330,31 @@ export class SessionNodeManager {
      * on which side of the send it sat on.
      */
     setSessionGenesisForTest(agentName, sessionId, genesis) {
-        this.#db
-            ?.prepare("UPDATE sessions SET genesis_prev_root = ? WHERE agent_id = ? AND session_id = ?")
-            .run(Buffer.from(genesis), this.#requireAgentId(agentName), sessionId);
+        /**
+         * ⚠️ WRITES THE SAME MAP PRODUCTION WRITES, deliberately — `DOD-M15-SELFCHAIN-1`.
+         *
+         * This seam exists because a fixture builds a session below the paths that derive a starting
+         * point from a directory assignment; it does NOT exist to install a second, quieter source of
+         * the value. Sharing the map means a fixture and a real session read through exactly the same
+         * lookup, so a change to that lookup cannot pass the tests while breaking production.
+         *
+         * ⚠️ CALL IT BEFORE `createSessionNode`, the same rule production follows: registering the
+         * session is what seeds the relay client's acknowledgement state, and a value recorded after
+         * that leaves the first send with nothing to chain to.
+         */
+        this.#sessionGenesis.set(this.#k(agentName, sessionId), Uint8Array.from(genesis));
+        /**
+         * The durable half is BEST EFFORT. Some fixtures run against a database whose schema was never
+         * created, and a seam that threw there would turn "this fixture has no sessions table" into a
+         * failure of whatever it was actually testing. Harmless when the row does not exist yet either:
+         * `#insertSessionRow` writes the column from the map above.
+         */
+        try {
+            this.#db
+                ?.prepare("UPDATE sessions SET genesis_prev_root = ? WHERE agent_id = ? AND session_id = ?")
+                .run(Buffer.from(genesis), this.#requireAgentId(agentName), sessionId);
+        }
+        catch { /* see above — the in-memory half is the load-bearing one */ }
     }
     /**
      * Test seam: drop the agreed key while leaving the session up — the state before an exchange
@@ -14703,35 +14913,21 @@ export class SessionNodeManager {
             ?? (() => { const g = this.#sessionGenesisPrevRoot(agentName, sessionId); return g ? { seq: 0, hash: g } : undefined; })();
         if (!ack) {
             /**
-             * ⚠️ **v1, AND ONLY BECAUSE THERE IS NOTHING TO ACKNOWLEDGE — see `#verifyAcknowledgedContent`
-             * for the receiving half of the same rule, which is what makes this safe rather than a
-             * downgrade.**
+             * ⚠️ NO STARTING POINT MEANS NO SEND — `DOD-M15-SELFCHAIN-1`.
              *
-             * Reaching here means this session has no recorded starting point AND has received nothing.
-             * The claim it produces is `last_seen_seq: 0` with no hash: "I have seen nothing of yours, and
-             * I assert nothing about your content." That is honest, and it is not the fail-open the unit
-             * closes — the hole is a claim that names a POSITION with no content behind it, and this names
-             * no position. A receiver refuses a v1 claim the moment it acknowledges position 1 or beyond.
+             * This used to emit a shorter claim: `last_seen_seq: 0` with no hashes, on the argument that
+             * "I have seen nothing of yours" is honest and asserts nothing false. It IS honest, and it is
+             * no longer a shape this protocol has. Both chain links are required, and a session with no
+             * recorded starting point has nothing for them to anchor to.
              *
-             * It does not throw, and an earlier version did. Sessions brokered without a relay assignment
-             * are real — the directory does not always return one — and throwing there stopped those
-             * sessions sending at all, which trades a hole this claim does not have for a failure of the
-             * thing the product is for.
+             * Refusing costs a message on a session that was brokered without an assignment. Sending one
+             * costs the ability to prove the order of the whole conversation later, and the cost is
+             * invisible until someone disputes it — which is exactly the failure this unit exists to end.
+             * Refuse loudly, and say what to do about it.
              */
-            this.#logger.info("session.content.claim.unacknowledged", {
-                agentName, sessionId,
-                impact: "this message is signed with no acknowledgement of anything received, because this " +
-                    "session has no recorded starting point and nothing has arrived on it yet. It binds the " +
-                    "sender and the content as always; it makes no claim about the counterparty's messages.",
-            });
-            const bare = encodeStructure1({
-                contentHash,
-                senderPubkey: await signer.getPublicKey(),
-                sessionId: sessionIdBytes,
-                lastSeenSeq: 0,
-                timestamp: Date.now(),
-            });
-            return { structure1: bare, signature: await signer.sign(bare) };
+            throw new Error("session_unchainable: this session has no recorded starting point on this machine, so a " +
+                "message sent on it could not link to anything and its place in the conversation could " +
+                "never be proven. Restart the session so it is registered with its genesis.");
         }
         const structure1 = encodeStructure1({
             contentHash,
@@ -14743,9 +14939,76 @@ export class SessionNodeManager {
             lastSeenSeq: ack.seq,
             timestamp: Date.now(),
             lastSeenHash: ack.hash,
+            /**
+             * ─── THE SELF LINK ON THE UNWITNESSED PATH — `DOD-M15-SELFCHAIN-1` ────────────────────────
+             *
+             * This is the path that matters most for it. A conversation that ran while the relay was down
+             * is precisely the one whose order gets disputed later, so the chain cannot depend on a relay
+             * having been there to witness it.
+             *
+             * ⚠️ ONE CHAIN, READ THROUGH THE RELAY CLIENT FIRST. This used to read only the durable
+             * store, while the witnessed path reads an in-memory map first — so a session that mixed the
+             * two, which is every session where the relay comes and goes, walked two different chains and
+             * the lagging one produced a link the counterparty refuses.
+             *
+             * ⚠️ AND THE LAST FALLBACK IS THE SESSION GENESIS, NOT `ack.hash`. `ack.hash` is what the
+             * COUNTERPARTY last said; it is only the genesis until they have said anything. Falling back
+             * to it meant this agent's own first message linked to the other party's message — refused by
+             * every checker, and reported as tampering against a party that had done nothing.
+             */
+            prevOwnHash: this.#ownChainOf(agentName, sessionId, entry, await signer.getPublicKey())
+                ?? this.#sessionGenesisPrevRoot(agentName, sessionId)
+                ?? ack.hash,
         });
+        /**
+         * ⚠️ THE CHAIN IS NOT ADVANCED HERE, AND IT USED TO BE — review F7.
+         *
+         * `SessionOwnChainStore.record` says in capitals that it is called AFTER the send succeeds. This
+         * ran at signing time, before a stream was even opened. Any failure between here and delivery
+         * left the chain pointing at a message the counterparty never saw, and every later message was
+         * then refused by them for a reason that names tampering. A retransmission must re-use the same
+         * predecessor, because a retransmission is the same message.
+         *
+         * `#advanceOwnChain` is called by the send path at each point where the message has actually
+         * gone — the direct send, and the relay park that is the fallback for it.
+         */
         return { structure1, signature: await signer.sign(structure1) };
     }
+    /**
+     * This agent's own last message on a session, from the ONE chain both send paths share.
+     *
+     * `undefined` means it has not spoken here yet, which is the session genesis and not an absence.
+     * The caller supplies that; this does not guess.
+     */
+    #ownChainOf(agentName, sessionId, entry, ownPubkey) {
+        const relayHex = entry?.relaySessionIdBytes
+            ? Buffer.from(entry.relaySessionIdBytes).toString("hex")
+            : sessionId;
+        return entry?.relayClient?.lastOwnHash(relayHex)
+            ?? this.#ownChainStore?.lastOwnHash(Buffer.from(ownPubkey).toString("hex"), sessionId)
+            ?? undefined;
+    }
+    /**
+     * Record what this agent just sent — called ONLY once the message has actually gone.
+     *
+     * Writes through the relay client when there is one, so the in-memory chain the witnessed path
+     * reads and the durable row stay one chain rather than two. Falls back to the store directly for
+     * a session with no relay client at all, which is exactly the unwitnessed case this unit exists
+     * to cover.
+     */
+    #advanceOwnChain(agentName, sessionId, entry, contentHash) {
+        const relayHex = entry?.relaySessionIdBytes
+            ? Buffer.from(entry.relaySessionIdBytes).toString("hex")
+            : sessionId;
+        if (entry?.relayClient) {
+            entry.relayClient.noteOwnLeaf(relayHex, contentHash);
+            return;
+        }
+        const ownPubkeyHex = this.#ownPubkeyHex(agentName);
+        if (!ownPubkeyHex)
+            return;
+        this.#ownChainStore?.record(ownPubkeyHex, sessionId, contentHash, Date.now());
+    }
     /**
      * `DOD-M15-AUTHORSHIP-ABSENT-1` — DID THIS SENDER PROVE THEY WROTE THIS MESSAGE?
      *
@@ -14898,6 +15161,20 @@ export class SessionNodeManager {
         const ackVerdict = this.#verifyAcknowledgedContent(agentName, sessionId, s1.fields);
         if (ackVerdict)
             return ackVerdict;
+        /**
+         * ─── AND IT MUST LINK TO THEIR OWN PREVIOUS MESSAGE — `DOD-M15-SELFCHAIN-1` ──────────────────
+         *
+         * The check above asks whether they are right about what WE said. This one asks whether they
+         * are right about what THEY said, and it is the check that makes the ORDER of the conversation
+         * provable rather than merely its contents.
+         *
+         * **THIS IS THE HALF THAT NEEDS NO RELAY**, in the strongest sense: the expected value is the
+         * last message we received from them, which is a fact about our own inbox. A relay that is
+         * absent, slow, colluding or lying cannot change it, and cannot wave a broken chain past us.
+         */
+        const chainVerdict = this.#verifySenderSelfChain(agentName, sessionId, s1.fields);
+        if (chainVerdict)
+            return chainVerdict;
         return { verdict: "verified", senderPubkey: s1Pubkey, senderSig: senderSignature };
     }
     /**
@@ -14915,6 +15192,120 @@ export class SessionNodeManager {
      * width, so `lastSeenHash === null` here means exactly one thing — a v1 layout — and it is
      * refused by its own name.
      */
+    /**
+     * Does this claim link to the last message we actually received from this sender?
+     *
+     * ─── Why the expected value is our INBOX and not our tree ──────────────────────────────────────
+     *
+     * The tree holds every leaf in canonical order and records no authorship, so it cannot say which
+     * of them this sender wrote. What can is the acknowledgement state this daemon already keeps: the
+     * last content hash received from the counterparty, updated on every message as it is ingested.
+     * That IS their previous message, by definition.
+     *
+     * It is seeded at session registration with the session GENESIS, so a sender's first message has
+     * a real expected value rather than a special case — "they have not spoken here yet" is a value,
+     * derived per session, and not an absence.
+     *
+     * ⚠️ RUNS BEFORE THIS MESSAGE IS INGESTED, which is what makes the comparison meaningful: the
+     * state still holds their PREVIOUS message. Moving this after ingest would compare a message to
+     * itself and pass every time.
+     */
+    #verifySenderSelfChain(agentName, sessionId, fields) {
+        const key = this.#k(agentName, sessionId);
+        const genesis = this.#sessionGenesisPrevRoot(agentName, sessionId);
+        /**
+         * ⚠️ THE EXPECTED VALUE IS OUR INBOX — `#lastAck` — AND NOT THE SESSION GENESIS.
+         *
+         * `#lastFromCounterparty` is the last content hash we accepted FROM THIS COUNTERPARTY, written
+         * on every successful ingest. That IS their previous message, by definition. The genesis is only
+         * the answer before they have said anything.
+         *
+         * It used to read the relay client's acknowledgement with the genesis as a fallback, which is
+         * the same conflation the emitter had: on a session with no relay client the fallback never
+         * moved, so the counterparty's SECOND message was refused as a broken chain for the rest of the
+         * conversation. Four live-transport fixtures caught it the moment the emitter started producing
+         * a real chain.
+         */
+        const expected = this.#lastFromCounterparty.get(key) ?? genesis;
+        /**
+         * ⚠️ NO EXPECTED VALUE MEANS NO COMPARISON, AND THIS IS THE ONE PLACE THAT IS NOT A FAIL-OPEN —
+         * because of WHO CONTROLS THE ABSENCE. Whether this side holds a starting point for the session
+         * depends on our own assignment and our own database. Nothing the sender puts on the wire can
+         * cause it, so it is not a switch they can reach for. A session restored from a row written
+         * before this existed is the real case, and refusing there would refuse every message on it for
+         * something the counterparty did not do.
+         */
+        if (!expected) {
+            this.#logger.info("session.content.self_chain.unverifiable", {
+                agentName, sessionId,
+                impact: "this side holds no record of this sender's previous message in this session, so the " +
+                    "link inside their signed bytes was not compared. The message is accepted; it is already " +
+                    "bound to this conversation and to its author by the checks above.",
+            });
+            return undefined;
+        }
+        if (bytesEqual(fields.prevOwnHash, expected))
+            return undefined;
+        /**
+         * ─── OUR OWN GAP IS NOT THEIR TAMPERING, AND THE DIFFERENCE IS DECIDABLE ─────────────────────
+         *
+         * `expected` is the last message from them we ACCEPTED. Our record can legitimately be behind
+         * theirs: a message of theirs can arrive out of order and be HELD, be refused by the inbound
+         * screen, or be lost in flight. In every one of those cases their next message links to
+         * something real that we simply do not have at the front of our record — and refusing it would
+         * be a fabricated tamper report caused by our own gap, against a party that did nothing.
+         *
+         * So a link naming ANY message we have accepted from them is accepted, and the gap is reported
+         * as OUR problem. A link naming something we have never held from them is the actual accusation:
+         * it is either invented or it belongs to a conversation this is not.
+         *
+         * ⚠️ THIS IS DELIBERATELY WEAKER THAN THE RELAY'S CHECK, AND SAYING SO IS THE POINT. The relay
+         * holds the whole ordered log and refuses anything but the immediate predecessor; the directory
+         * does the same at seal time. This side holds only what reached it, so the strongest honest
+         * question it can ask is "did you name something you actually said to me?". Two strict checkers
+         * plus one honest one beats three checkers where the weakest one fabricates accusations.
+         */
+        const seen = this.#receivedFromCounterparty.get(key);
+        if (seen?.has(Buffer.from(fields.prevOwnHash).toString("hex"))) {
+            this.#logger.info("session.content.self_chain.behind", {
+                agentName, sessionId,
+                impact: "this message links to an earlier message from your counterparty than the last one this " +
+                    "side accepted, so this side's copy of the conversation has a gap in it. The message is " +
+                    "accepted — the link names something they really did send you. The gap is on this side.",
+            });
+            return undefined;
+        }
+        return { verdict: "unusable", reason: AUTHORSHIP_SELF_CHAIN_MISMATCH };
+    }
+    /**
+     * Every content hash accepted from the counterparty on a session, so a link to one of THEIR
+     * earlier messages can be told apart from a link to something they never sent.
+     *
+     * ⚠️ BOUNDED, because it is fed by a peer. A conversation must not cost unbounded memory because
+     * the other side kept talking: the oldest entries are dropped past the cap, and a link older than
+     * that is refused. That is the right way round — the cap makes the check STRICTER as it bites,
+     * never looser.
+     */
+    #receivedFromCounterparty = new Map();
+    /** The MOST RECENT of those, which is what an honest next message links to. */
+    #lastFromCounterparty = new Map();
+    #noteReceivedFromCounterparty(agentName, sessionId, contentHash) {
+        const key = this.#k(agentName, sessionId);
+        this.#lastFromCounterparty.set(key, Uint8Array.from(contentHash));
+        let seen = this.#receivedFromCounterparty.get(key);
+        if (!seen) {
+            seen = new Set();
+            this.#receivedFromCounterparty.set(key, seen);
+        }
+        seen.add(Buffer.from(contentHash).toString("hex"));
+        while (seen.size > SELF_CHAIN_MEMORY) {
+            // Sets iterate in insertion order, so the first entry is the oldest.
+            const oldest = seen.values().next().value;
+            if (oldest === undefined)
+                break;
+            seen.delete(oldest);
+        }
+    }
     #verifyAcknowledgedContent(agentName, sessionId, fields) {
         /**
          * ⚠️ **A v1 CLAIM IS REFUSED THE MOMENT IT NAMES A POSITION — and accepted when it names none.
@@ -14937,11 +15328,15 @@ export class SessionNodeManager {
          * AHEAD of its counter, never one that lags). This unit does not change that either way, and
          * the follow-on that does is the receiver submitting a hash for what it received.
          */
-        if (fields.lastSeenHash === null) {
-            return fields.lastSeenSeq >= 1
-                ? { verdict: "unusable", reason: AUTHORSHIP_ACK_HASH_ABSENT }
-                : undefined;
-        }
+        /**
+         * ⚠️ THE "NO ACKNOWLEDGEMENT AT ALL" BRANCH IS GONE, and its absence is the point.
+         *
+         * It used to accept a claim carrying no `last_seen_hash` as long as it also named no position —
+         * honest, and a shape a peer could choose. `DOD-M15-SELFCHAIN-1` deleted every layout that can
+         * express it: there is one Structure 1 and both chain links are required, so a claim without one
+         * does not decode at all and never reaches this method. `AUTHORSHIP_ACK_HASH_ABSENT` is kept as
+         * a reason because the wording that routes off it is still reachable from other callers.
+         */
         /**
          * THE GENESIS IS A VALUE, NEVER AN ABSENCE. The first message of a session has seen nothing, and
          * that case is a defined 32 bytes — the agreed starting point of this two-party chain, derived
@@ -15086,13 +15481,26 @@ export class SessionNodeManager {
                  * conclusion the code did not reach is the error-fidelity defect this milestone exists
                  * for.
                  */
-                : reason === AUTHORSHIP_ACK_HASH_ABSENT
-                    ? "a message arrived that is genuinely from your counterparty and genuinely about this conversation — and it does not say which of your messages they had received. Their build is older than yours: a message has to say what it is answering, so that nobody can later leave your last message out of the receipt. It was NOT ingested and NOT shown."
-                    : reason === AUTHORSHIP_ACK_HASH_MISMATCH
-                        ? "a message arrived that is genuinely from your counterparty — and it names a DIFFERENT message of yours in the position where your own record holds one. Both sides agree the message exists; you disagree about which one sits there. It was NOT ingested and NOT shown."
-                        : reason === AUTHORSHIP_ACK_HASH_UNKNOWN
-                            ? "a message arrived that is genuinely from your counterparty — and it says they received something from you that this side has no record of ever holding. It was NOT ingested and NOT shown. This is the check that stops someone quietly rewriting what was said before the receipt is made."
-                            : "a message arrived whose proof of authorship could not be checked against it — it was unreadable, or it was signed over different content. It was NOT ingested, NOT shown and NOT attributed to anyone.";
+                /**
+                 * `DOD-M15-SELFCHAIN-1` — THE ORDER, NOT THE CONTENT, AND IT NEEDS ITS OWN WORDS.
+                 *
+                 * This reached the operator under the generic `authorship_proof_unusable` sentence, which
+                 * says the proof was "unreadable, or signed over different content". Neither is true: the
+                 * proof is perfect and it is about this conversation. What is in dispute is WHERE this
+                 * message sits — and telling someone their decoder failed sends them to audit the wrong
+                 * subsystem entirely. The reason's own comment claimed it was "named apart from the
+                 * acknowledgement reasons"; the surface collapsed it back, which is error substitution on
+                 * the strongest evidence this protocol can produce.
+                 */
+                : reason === AUTHORSHIP_SELF_CHAIN_MISMATCH
+                    ? "a message arrived that is genuinely from your counterparty, about this conversation, and correctly signed — and it names a message of THEIR OWN that they never sent you. Each message says which of their own came before it, and that is what fixes the ORDER of the conversation. This one points somewhere your record has never been. It was NOT ingested and NOT shown."
+                    : reason === AUTHORSHIP_ACK_HASH_ABSENT
+                        ? "a message arrived that is genuinely from your counterparty and genuinely about this conversation — and it does not say which of your messages they had received. Their build is older than yours: a message has to say what it is answering, so that nobody can later leave your last message out of the receipt. It was NOT ingested and NOT shown."
+                        : reason === AUTHORSHIP_ACK_HASH_MISMATCH
+                            ? "a message arrived that is genuinely from your counterparty — and it names a DIFFERENT message of yours in the position where your own record holds one. Both sides agree the message exists; you disagree about which one sits there. It was NOT ingested and NOT shown."
+                            : reason === AUTHORSHIP_ACK_HASH_UNKNOWN
+                                ? "a message arrived that is genuinely from your counterparty — and it says they received something from you that this side has no record of ever holding. It was NOT ingested and NOT shown. This is the check that stops someone quietly rewriting what was said before the receipt is made."
+                                : "a message arrived whose proof of authorship could not be checked against it — it was unreadable, or it was signed over different content. It was NOT ingested, NOT shown and NOT attributed to anyone.";
         /**
          * ⚠️ THE VERB IS THE COUNTERPARTY'S, AND THE GUIDANCE SAYS SO. The reader is the RECEIVING
          * operator, and there is nothing on their machine to change — the missing signature is produced
@@ -15148,30 +15556,63 @@ export class SessionNodeManager {
              * abandon the conversation. Two is the cap on each (Invariant 4); the verb is the
              * counterparty's in every case, because there is nothing to change on this machine.
              */
-            : reason === AUTHORSHIP_ACK_HASH_ABSENT
-                ? "STOPPED ON PURPOSE, and this is NOT about their signature — it verified. " +
+            : reason === AUTHORSHIP_SELF_CHAIN_MISMATCH
+                ? "STOPPED ON PURPOSE, and this is the most serious of these refusals. " +
                     (this.#mailboxRouteAvailable(agentName) ? REFUSAL_MAY_STILL_ARRIVE : REFUSAL_NO_OTHER_ROUTE) +
-                    " Their build is older than yours and does not say what it has received. Ask which version " +
-                    "they are running and tell them to upgrade — only they can fix it, and this will keep " +
-                    "happening until they do."
-                : reason === AUTHORSHIP_ACK_HASH_MISMATCH || reason === AUTHORSHIP_ACK_HASH_UNKNOWN
-                    ? "STOPPED ON PURPOSE, and this is NOT about their signature or their version — both are " +
-                        "fine. " +
-                        (this.#mailboxRouteAvailable(agentName) ? REFUSAL_MAY_STILL_ARRIVE : REFUSAL_NO_OTHER_ROUTE) +
-                        " Your record of this conversation and theirs have stopped agreeing about what you sent " +
-                        "them. Confirm with them OUT OF BAND what they actually received from you. If it matches " +
-                        "what you sent, this was a fault and a new session will clear it; if it does not, do not " +
-                        "carry on in this one."
-                    : "STOPPED ON PURPOSE. This copy was refused and the message itself was not kept. " +
-                        // Review F2: chosen from what THIS machine can do, not asserted. An agent with no identity
-                        // key cannot open a mailbox copy either, and telling them to wait for one would be the same
-                        // false promise on a different refusal.
+                    " Their signature is real and it is about this conversation. What does not hold is the " +
+                    "ORDER: this message names one of their own as the one before it, and that message was " +
+                    "never sent to you. Either something between you is rearranging what they say, or their " +
+                    "agent's record of what it has said went out of step. THIS SESSION IS NOW FROZEN — no " +
+                    "further message on it will be accepted, because carrying on writes a disputed order into " +
+                    "the receipt. Reach them OUT OF BAND — a channel that is not this one — and ask them to " +
+                    "read back the last few things they sent you. If it matches what you have, open a NEW " +
+                    "session; if it does not, do not."
+                : reason === AUTHORSHIP_ACK_HASH_ABSENT
+                    ? "STOPPED ON PURPOSE, and this is NOT about their signature — it verified. " +
                         (this.#mailboxRouteAvailable(agentName) ? REFUSAL_MAY_STILL_ARRIVE : REFUSAL_NO_OTHER_ROUTE) +
-                        " Almost always their CELLO build is older than this one: a build from before message signing " +
-                        "does not attach a signature at all. Ask which version they are running, and tell them to " +
-                        "upgrade — this will keep happening until they do, and only they can fix it. If they are on " +
-                        "the SAME version as you, that explanation does not hold: confirm with them OUT OF BAND " +
-                        "before opening another session.";
+                        " Their build is older than yours and does not say what it has received. Ask which version " +
+                        "they are running and tell them to upgrade — only they can fix it, and this will keep " +
+                        "happening until they do."
+                    /**
+                     * ⚠️ THESE TWO SHARED ONE SENTENCE, AND THE TEST THAT WAS MEANT TO CATCH THAT COULD NOT SEE
+                     * IT — `DOD-M15-SELFCHAIN-1`.
+                     *
+                     * The file's thesis is "three causes, three sentences", and it compared ABSENT against
+                     * MISMATCH and stopped. Mismatch and unknown-content shared a remedy the whole time; the pair
+                     * was never compared, so the defect the test existed for was live inside it.
+                     *
+                     * They are not the same situation. A MISMATCH means you both agree a message sits at that
+                     * position and disagree about which one — a record that has drifted. UNKNOWN CONTENT means
+                     * they are acknowledging something this side never held at all, which is the shape of content
+                     * being attributed to you that you did not send. The second is the more serious reading and
+                     * the operator's next move differs, so it gets its own sentence.
+                     */
+                    : reason === AUTHORSHIP_ACK_HASH_MISMATCH
+                        ? "STOPPED ON PURPOSE, and this is NOT about their signature or their version — both are " +
+                            "fine. " +
+                            (this.#mailboxRouteAvailable(agentName) ? REFUSAL_MAY_STILL_ARRIVE : REFUSAL_NO_OTHER_ROUTE) +
+                            " Your record of this conversation and theirs have stopped agreeing about what you sent " +
+                            "them. Confirm with them OUT OF BAND what they actually received from you. If it matches " +
+                            "what you sent, this was a fault and a new session will clear it; if it does not, do not " +
+                            "carry on in this one."
+                        : reason === AUTHORSHIP_ACK_HASH_UNKNOWN
+                            ? "STOPPED ON PURPOSE, and this one is more serious than a record that has drifted. " +
+                                (this.#mailboxRouteAvailable(agentName) ? REFUSAL_MAY_STILL_ARRIVE : REFUSAL_NO_OTHER_ROUTE) +
+                                " They are acknowledging a message from you that this side has NEVER held — not at that " +
+                                "position, not anywhere. Either their record contains something you did not send, or " +
+                                "yours is missing something you did. Ask them OUT OF BAND to read you back what they " +
+                                "believe you sent. Do not continue this conversation until you know which of the two it " +
+                                "is: carrying on writes their version into the receipt."
+                            : "STOPPED ON PURPOSE. This copy was refused and the message itself was not kept. " +
+                                // Review F2: chosen from what THIS machine can do, not asserted. An agent with no identity
+                                // key cannot open a mailbox copy either, and telling them to wait for one would be the same
+                                // false promise on a different refusal.
+                                (this.#mailboxRouteAvailable(agentName) ? REFUSAL_MAY_STILL_ARRIVE : REFUSAL_NO_OTHER_ROUTE) +
+                                " Almost always their CELLO build is older than this one: a build from before message signing " +
+                                "does not attach a signature at all. Ask which version they are running, and tell them to " +
+                                "upgrade — this will keep happening until they do, and only they can fix it. If they are on " +
+                                "the SAME version as you, that explanation does not hold: confirm with them OUT OF BAND " +
+                                "before opening another session.";
         this.#logger.error("session.content.refused", {
             agentName, sessionId, correlationId, reason, ...detail, impact, guidance,
         });
@@ -15710,18 +16151,41 @@ export class SessionNodeManager {
                  */
                 this.#refuseUnprovenAuthorship(agentName, sessionId, authorship.reason === AUTHORSHIP_SESSION_MISMATCH
                     ? "authorship_wrong_conversation"
-                    : ACK_HASH_REASONS.has(authorship.reason)
-                        /**
-                         * ⚠️ THE SPECIFIC CAUSE, NOT THE CLASS — review F5, and the diff's own comment on
-                         * `ACK_HASH_REASONS` had already said why: "the operator's next move differs for
-                         * each." It then collapsed all three into ONE surface reason carrying ONE sentence,
-                         * so the three names survived only in a log field nobody reads. For an absent
-                         * acknowledgement the shared impact was flatly false — there is no part that "does
-                         * not match", because there is no part — and for the other two the shared guidance
-                         * sent the reader to ask about a build version that cannot be the cause.
-                         */
-                        ? authorship.reason
-                        : "authorship_proof_unusable", contentHash, { detail: authorship.reason }, correlationId);
+                    /**
+                     * `DOD-M15-SELFCHAIN-1` — its own name on the surface the operator reads, not only in a
+                     * log field. See the sentences in `#refuseUnprovenAuthorship`.
+                     */
+                    : authorship.reason === AUTHORSHIP_SELF_CHAIN_MISMATCH
+                        ? AUTHORSHIP_SELF_CHAIN_MISMATCH
+                        : ACK_HASH_REASONS.has(authorship.reason)
+                            /**
+                             * ⚠️ THE SPECIFIC CAUSE, NOT THE CLASS — review F5, and the diff's own comment on
+                             * `ACK_HASH_REASONS` had already said why: "the operator's next move differs for
+                             * each." It then collapsed all three into ONE surface reason carrying ONE sentence,
+                             * so the three names survived only in a log field nobody reads. For an absent
+                             * acknowledgement the shared impact was flatly false — there is no part that "does
+                             * not match", because there is no part — and for the other two the shared guidance
+                             * sent the reader to ask about a build version that cannot be the cause.
+                             */
+                            ? authorship.reason
+                            : "authorship_proof_unusable", contentHash, { detail: authorship.reason }, correlationId);
+                /**
+                 * ─── AND THE SESSION FREEZES — `DOD-M15-SELFCHAIN-1`, the escalation clause ──────────────
+                 *
+                 * ⚠️ ONLY THIS ONE OF THE `unusable` CAUSES FREEZES, and the split is the whole rule.
+                 *
+                 * The acknowledgement causes say the sender is wrong about what WE said, which a record
+                 * that has drifted produces honestly, and refusing the message is proportionate. This one
+                 * says they are wrong about what THEY said — the one thing a party cannot be honestly
+                 * mistaken about for long — so continuing writes a disputed order into the receipt. There
+                 * is nothing to gain from message N+1 on a conversation whose order is already in question.
+                 *
+                 * The freeze is what makes the refusal an ESCALATION rather than a dropped frame: it is
+                 * visible in the session's own state, not only in a notice the operator has to go and read.
+                 */
+                if (authorship.reason === AUTHORSHIP_SELF_CHAIN_MISMATCH) {
+                    await this.#freezeOnIdentityFailure(agentName, sessionId, authorship.reason, correlationId);
+                }
                 return;
             }
             if (authorship.verdict === "verified") {
@@ -15776,6 +16240,20 @@ export class SessionNodeManager {
             // acknowledged `persisted` — the sender's TTF→park backstop then guarantees the
             // missing-earlier message is fetchable, and dedup absorbs the redundant copy.
             if (ingest.ok && !ingest.held) {
+                /**
+                 * ─── THE SELF CHAIN IS PURELY CONTENT, SO IT ADVANCES HERE — `DOD-M15-SELFCHAIN-1` ───────
+                 *
+                 * ⚠️ NOT INSIDE `#noteAcknowledgeable`, and that placement was the bug. The acknowledgement
+                 * is a (POSITION, content) pair and needs the relay's number, so on a session the relay
+                 * never witnessed it is never written at all. The self link needs no position — it is one
+                 * party's hash chain over their own messages — so tying it to the acknowledgement meant the
+                 * receiver's record never moved on an unwitnessed session, and the counterparty's SECOND
+                 * message was refused as a broken chain for the rest of the conversation.
+                 *
+                 * That is the path this unit exists for: a conversation that ran while the relay was down is
+                 * precisely the one whose order gets disputed later.
+                 */
+                this.#noteReceivedFromCounterparty(agentName, sessionId, contentHash);
                 /**
                  * 033-ACKEMIT review F1 — ACKNOWLEDGE WHAT ARRIVED, HERE, not when the relay gets round to
                  * delivering its copy back to us.
@@ -15807,28 +16285,31 @@ export class SessionNodeManager {
                      * We hold their signature over their own bytes. So we hand it to the relay ourselves.
                      */
                     /**
-                     * ⚠️ **THE KIND COMES OFF THE FRAME, AND WITHOUT IT WE DECLINE TO WITNESS — review F5.**
+                     * ─── THE KIND COMES OFF THE FRAME, AND A FRAME WITHOUT ONE IS REFUSED ─────────────────
+                     *
+                     * A leaf kind selects a HASH DOMAIN — documents and rejection envelopes ride this same
+                     * frame — so witnessing under a guessed domain would put a wrong statement in the
+                     * canonical record.
+                     *
+                     * ⚠️ **THIS USED TO DECLINE TO WITNESS AND DELIVER THE MESSAGE ANYWAY, "because a peer
+                     * too old to send the field should be left alone". THAT SENTENCE WAS INHERITED, NOT
+                     * DERIVED, AND IT LEFT THE WHOLE ATTACK OPEN.** CELLO is alpha with no users; there is no
+                     * older peer to protect. What the leniency actually bought was an opt-out: emit the shape
+                     * a 2026-09-04 build emitted, and your message is delivered AND cannot be witnessed —
+                     * which is precisely the withholding this line exists to stop, reachable by anyone
+                     * willing to modify their client.
                      *
-                     * A leaf kind selects a HASH DOMAIN, and documents and rejection envelopes ride this same
-                     * frame. Hardcoding `msg` meant a document witnessed on its author's behalf entered the
-                     * relay's canonical log described as something it is not. A peer too old to send the field
-                     * is left alone rather than guessed at: witnessing their leaf under the wrong domain would
-                     * be a worse outcome than not witnessing it, because it puts a wrong statement in the
-                     * record instead of leaving a gap the seal can name.
+                     * So it is refused. Missing, malformed and mismatched take one path (§5), and a peer that
+                     * cannot say which domain its own leaf belongs to has supplied an unusable proof.
                      */
                     const framedKind = frame["leaf_kind"];
-                    if (typeof framedKind === "number") {
-                        void this.#witnessReceivedLeaf(agentName, sessionId, contentHash, s1Cbor, senderSig, framedKind, correlationId);
-                    }
-                    else {
-                        this.#logger.info("session.content.witness_received.kind_unknown", {
-                            agentName, sessionId, correlationId,
-                            impact: "a message arrived that its sender never had witnessed, and the frame did not say " +
-                                "which leaf domain it belongs to — their build predates the field. It was NOT " +
-                                "witnessed on their behalf, because witnessing it under a guessed domain would put " +
-                                "a wrong statement in the record rather than leave a gap the seal can name.",
-                        });
+                    if (typeof framedKind !== "number") {
+                        this.#refuseUnprovenAuthorship(agentName, sessionId, "authorship_proof_unusable", contentHash, {
+                            detail: "leaf_kind_absent",
+                        }, correlationId);
+                        return;
                     }
+                    void this.#witnessReceivedLeaf(agentName, sessionId, contentHash, s1Cbor, senderSig, framedKind, correlationId);
                 }
                 void this.#sendDeliveryAck(agentName, sessionId, contentHash, correlationId);
             }
@@ -16564,8 +17045,68 @@ export class SessionNodeManager {
              * is that it never STOPS BEING REACHABLE while that is true — the surviving relays carry it,
              * the loss is named in the log with its cause, and the lost relay's inbound carve-out is
              * revoked above. That is availability, not restoration in place.
+             *
+             * WHICH LEAVES A RATCHET, and `#respreadIfDecayed` below is what stops it: relays are only
+             * ever lost between rebuilds, never regained, so an agent nobody talks to walks itself back
+             * down to one relay — the exact state this unit exists to get it out of.
              */
         }
+        for (const agentName of this.#standingReceivers.keys()) {
+            if (this.#agentsWantingReceiver.has(agentName))
+                this.#respreadIfDecayed(agentName);
+        }
+    }
+    /**
+     * 032-RELAYSPREAD — **AN IDLE AGENT MUST NOT RATCHET ITSELF BACK DOWN TO ONE RELAY.**
+     *
+     * Spreading happens when a receiver is BUILT, and between builds the count only falls: a lost
+     * circuit cannot be retaken by a running node (a circuit listener is fixed at node creation), and
+     * a relay the directory announces later is skipped while any circuit is held. An agent in
+     * conversation re-spreads constantly — the receiver is handed into each session and a fresh one
+     * is built behind it — so this is about the agent nobody has talked to for a day. It loses relays
+     * one at a time, nothing pulls it back up, and it ends up exactly where this unit found it:
+     * reachable through one relay, one relay away from being reachable through none.
+     *
+     * **THE COST OF FIXING IT IS A NEW PEER ID**, which is why it is fenced three ways rather than
+     * simply rebuilding on sight:
+     *   - **ONLY WHEN IDLE.** A rebuild replaces the receiver's transport identity, and a counterparty
+     *     may be holding the old one from a `session_offer_accept`. With a live session for this agent
+     *     we leave it alone — a degraded spread costs redundancy, a changed peer id mid-conversation
+     *     costs the conversation.
+     *   - **ONLY WHEN THERE IS SOMETHING TO GAIN.** Holding every relay that was offered is not decay.
+     *   - **ON ITS OWN SLOW CLOCK**, never the watchdog's 30-second grid. A reservation is scarce —
+     *     the relay holds it for its full TTL even after we disconnect — so this reuses the
+     *     reservation retry interval rather than inventing a faster one.
+     */
+    #respreadIfDecayed(agentName) {
+        if (this.#shuttingDown)
+            return;
+        const sr = this.#standingReceivers.get(agentName);
+        if (!sr || sr.relayPeerIds.length === 0)
+            return; // zero held is the loud path
+        for (const entry of this.#activeNodes.values()) {
+            if (entry.agentName === agentName)
+                return; // in conversation — hands off
+        }
+        const offered = this.#reservationCircuitAddrs(agentName).addrs.length;
+        if (sr.relayPeerIds.length >= offered)
+            return; // nothing to gain
+        const now = Date.now();
+        const last = this.#srLastRespreadAt.get(agentName) ?? 0;
+        if (now - last < this.#srReservationRetryMs)
+            return;
+        this.#srLastRespreadAt.set(agentName, now);
+        this.#logger.info("session.standing_receiver.respread", {
+            agentName,
+            reservationsHeld: sr.relayPeerIds.length,
+            relaysOffered: offered,
+            impact: "this agent is idle and holds fewer relay reservations than it was offered, so its " +
+                "receiver is being rebuilt to take the rest. Without this it can only lose relays between " +
+                "rebuilds, and an agent nobody talks to drifts back down to a single relay — one relay " +
+                "away from being unreachable behind NAT, which is the state this whole mechanism exists " +
+                "to keep it out of.",
+        });
+        void this.#rebuildStandingReceiver(agentName);
     }
     /**
      * DOD-PARK-DRAIN-1: the backstop sweep — every agent holding a standing receiver gets a drain
@@ -17178,6 +17719,11 @@ export class SessionNodeManager {
         // reservations that genuinely completed, so a directory that merely NAMES a relay cannot dial
         // in behind it, however many relays it names.
         gater.setReservedRelayPeers(heldRelayPeerIds);
+        // The re-spread clock starts HERE, at the build, not at the epoch. Otherwise the first decay
+        // re-spreads instantly — undoing the "a lost relay does not rebuild the receiver" rule seconds
+        // after it fires, and changing the peer id of an agent that just lost one relay of three. The
+        // ratchet this guards against runs over hours; nothing about it needs answering in a second.
+        this.#srLastRespreadAt.set(agentName, Date.now());
         this.#standingReceivers.set(agentName, {
             node,
             gater,
@@ -18130,11 +18676,20 @@ export class SessionNodeManager {
             return false;
         const now = Date.now();
         try {
+            /**
+             * ⚠️ THE SESSION'S STARTING POINT GOES IN AT INSERT — `DOD-M15-SELFCHAIN-1`.
+             *
+             * It is recorded before this row exists (the session open needs it before the node is built),
+             * so an UPDATE at that moment has nothing to match. Writing it here is what puts it on disk,
+             * and on disk is what lets the chain be resumed after a restart. `null` when nothing recorded
+             * one, which is a session whose sends will be refused by name rather than silently unlinked.
+             */
+            const genesis = this.#sessionGenesis.get(this.#k(agentName, sessionId));
             this.#db
                 .prepare(`INSERT INTO sessions
-           (session_id, agent_id, counterparty_pubkey, status, created_at, updated_at)
-           VALUES (?, ?, ?, ?, ?, ?)`)
-                .run(sessionId, this.#requireAgentId(agentName), counterpartyPubkey, status, now, now);
+           (session_id, agent_id, counterparty_pubkey, status, created_at, updated_at, genesis_prev_root)
+           VALUES (?, ?, ?, ?, ?, ?, ?)`)
+                .run(sessionId, this.#requireAgentId(agentName), counterpartyPubkey, status, now, now, genesis ? Buffer.from(genesis) : null);
             return true;
         }
         catch (err) {