@cello-protocol/daemon 0.0.192 → 0.0.194

package/dist/session-own-chain-store.d.ts

@@ -0,0 +1,65 @@
+/**
+ * `DOD-M15-SELFCHAIN-1` — what THIS agent last said in a session, so the next thing it says can
+ * link to it.
+ *
+ * ─── Why this exists at all ───────────────────────────────────────────────────────────────────
+ *
+ * A sender signs `last_seen_hash`: the hash of the last message they RECEIVED. That chains across
+ * the two parties and never chains a sender to themselves — so when one party sends twice in a
+ * row, both of their messages carry the same acknowledgement, because nothing arrived in between.
+ * Nothing in the signed bytes tells them apart.
+ *
+ * The relay-assigned position cannot fill the gap: it is assigned AFTER the sender signs, so a
+ * sender can never sign their own position. The relay's receipt does pin it — but the receipt goes
+ * to the SENDER, so whoever hands a conversation to a new relay holds no receipt for the
+ * counterparty's messages and can reorder any run of them.
+ *
+ * `prev_own_hash` closes it, and this store is the thing that can answer what to put in it.
+ *
+ * ─── Why a dedicated table rather than reading one that exists ────────────────────────────────
+ *
+ * Three candidates were examined and each fails for a different reason:
+ *
+ *   - **`SessionTree`** stores leaf hashes and no authorship, so it cannot say which leaves are
+ *     ours.
+ *   - **`transcript`** knows `direction` but carries no content hash column.
+ *   - **`session_seal_leaves`** knows the sender and the signed bytes, and is keyed by the RELAY's
+ *     `sequence_number` — so it holds nothing for a message that was never witnessed. `033-ACKEMIT`
+ *     Part 0b measured exactly that gap and it is still open.
+ *
+ * The self link must hold on the unwitnessed path too — a conversation that ran while the relay was
+ * down is precisely the one whose order gets disputed later — so the producer cannot depend on a
+ * relay having been there. One row per (agent, session), written wherever this daemon signs.
+ *
+ * ⚠️ PERSISTED, because the chain must survive a restart. An in-memory tracker would silently start
+ * a new chain after a daemon restart mid-conversation, and the counterparty would refuse every
+ * message after it with no way to tell that from tampering.
+ */
+import type { DaemonDatabase } from "./sqlcipher-db.js";
+import type { Logger } from "./types.js";
+export declare class SessionOwnChainStore {
+    #private;
+    constructor(db: DaemonDatabase, logger: Logger);
+    /**
+     * The content hash of this agent's own previous message in this session, or `null` when it has
+     * not sent one yet.
+     *
+     * ⚠️ `null` MEANS "I HAVE NOT SPOKEN HERE", AND THE CALLER MUST NOT TREAT IT AS "SKIP THE LINK".
+     * The first message of a session carries the session GENESIS as its self link — a defined value,
+     * derived per session. Substituting an absent field, or a shared constant like 32 zero bytes,
+     * would give a first message a link that is presentable for any conversation.
+     */
+    lastOwnHash(agentPubkeyHex: string, sessionIdHex: string): Uint8Array | null;
+    /**
+     * Record what this agent just sent, so the next message links to it.
+     *
+     * ⚠️ CALLED AFTER THE SEND SUCCEEDS, NEVER BEFORE. Recording first and failing to send would skip
+     * a link over a message that never existed, and every later message would be refused by the
+     * counterparty for a reason that names tampering. Recording after means a retry re-uses the same
+     * predecessor, which is exactly right — a retransmission is the same message.
+     */
+    record(agentPubkeyHex: string, sessionIdHex: string, contentHash: Uint8Array, atMs: number): void;
+    /** Drop a session's chain record. Called when the session is destroyed. */
+    forget(agentPubkeyHex: string, sessionIdHex: string): void;
+}
+//# sourceMappingURL=session-own-chain-store.d.ts.map

package/dist/session-own-chain-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-own-chain-store.d.ts","sourceRoot":"","sources":["../src/session-own-chain-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAYzC,qBAAa,oBAAoB;;gBAInB,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM;IAM9C;;;;;;;;OAQG;IACH,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI;IA2B5E;;;;;;;OAOG;IACH,MAAM,CAAC,cAAc,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAUjG,2EAA2E;IAC3E,MAAM,CAAC,cAAc,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI;CAK3D"}

package/dist/session-own-chain-store.js

@@ -0,0 +1,75 @@
+const CREATE_SQL = `
+  CREATE TABLE IF NOT EXISTS session_own_chain (
+    agent_pubkey   TEXT NOT NULL,
+    session_id     TEXT NOT NULL,
+    last_own_hash  TEXT NOT NULL,
+    updated_at     INTEGER NOT NULL,
+    PRIMARY KEY (agent_pubkey, session_id)
+  );
+`;
+export class SessionOwnChainStore {
+    #db;
+    #logger;
+    constructor(db, logger) {
+        this.#db = db;
+        this.#logger = logger;
+        this.#db.exec(CREATE_SQL);
+    }
+    /**
+     * The content hash of this agent's own previous message in this session, or `null` when it has
+     * not sent one yet.
+     *
+     * ⚠️ `null` MEANS "I HAVE NOT SPOKEN HERE", AND THE CALLER MUST NOT TREAT IT AS "SKIP THE LINK".
+     * The first message of a session carries the session GENESIS as its self link — a defined value,
+     * derived per session. Substituting an absent field, or a shared constant like 32 zero bytes,
+     * would give a first message a link that is presentable for any conversation.
+     */
+    lastOwnHash(agentPubkeyHex, sessionIdHex) {
+        const row = this.#db
+            .prepare(`SELECT last_own_hash FROM session_own_chain WHERE agent_pubkey = ? AND session_id = ?`)
+            .get(agentPubkeyHex, sessionIdHex);
+        if (!row || typeof row.last_own_hash !== "string")
+            return null;
+        const bytes = Buffer.from(row.last_own_hash, "hex");
+        if (bytes.length !== 32) {
+            /**
+             * A stored value that is not a hash is a corrupt local record, and the honest answer is to say
+             * so and behave as if nothing were stored — the next message then chains to the session
+             * genesis, which the counterparty will refuse, which is the correct loud outcome. Returning
+             * the malformed bytes would sign a link nobody can check; returning null silently would hide
+             * a corrupt database behind a first-message claim.
+             */
+            this.#logger.error("session.selfchain.stored_hash_malformed", {
+                session: sessionIdHex,
+                storedWidth: bytes.length,
+                impact: "this agent's own chain record for this session is corrupt, so the next message it sends " +
+                    "will not link to the previous one and the counterparty will refuse it. The conversation " +
+                    "cannot continue on this machine until the session is restarted.",
+            });
+            return null;
+        }
+        return new Uint8Array(bytes);
+    }
+    /**
+     * Record what this agent just sent, so the next message links to it.
+     *
+     * ⚠️ CALLED AFTER THE SEND SUCCEEDS, NEVER BEFORE. Recording first and failing to send would skip
+     * a link over a message that never existed, and every later message would be refused by the
+     * counterparty for a reason that names tampering. Recording after means a retry re-uses the same
+     * predecessor, which is exactly right — a retransmission is the same message.
+     */
+    record(agentPubkeyHex, sessionIdHex, contentHash, atMs) {
+        this.#db
+            .prepare(`INSERT INTO session_own_chain (agent_pubkey, session_id, last_own_hash, updated_at)
+         VALUES (?, ?, ?, ?)
+         ON CONFLICT(agent_pubkey, session_id) DO UPDATE SET last_own_hash = excluded.last_own_hash, updated_at = excluded.updated_at`)
+            .run(agentPubkeyHex, sessionIdHex, Buffer.from(contentHash).toString("hex"), atMs);
+    }
+    /** Drop a session's chain record. Called when the session is destroyed. */
+    forget(agentPubkeyHex, sessionIdHex) {
+        this.#db
+            .prepare(`DELETE FROM session_own_chain WHERE agent_pubkey = ? AND session_id = ?`)
+            .run(agentPubkeyHex, sessionIdHex);
+    }
+}
+//# sourceMappingURL=session-own-chain-store.js.map

package/dist/session-own-chain-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-own-chain-store.js","sourceRoot":"","sources":["../src/session-own-chain-store.ts"],"names":[],"mappings":"AAwCA,MAAM,UAAU,GAAG;;;;;;;;CAQlB,CAAC;AAEF,MAAM,OAAO,oBAAoB;IACtB,GAAG,CAAiB;IACpB,OAAO,CAAS;IAEzB,YAAY,EAAkB,EAAE,MAAc;QAC5C,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC;QACd,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC5B,CAAC;IAED;;;;;;;;OAQG;IACH,WAAW,CAAC,cAAsB,EAAE,YAAoB;QACtD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG;aACjB,OAAO,CAAC,uFAAuF,CAAC;aAChG,GAAG,CAAC,cAAc,EAAE,YAAY,CAA2C,CAAC;QAC/E,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QACpD,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACxB;;;;;;eAMG;YACH,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,yCAAyC,EAAE;gBAC5D,OAAO,EAAE,YAAY;gBACrB,WAAW,EAAE,KAAK,CAAC,MAAM;gBACzB,MAAM,EACJ,0FAA0F;oBAC1F,0FAA0F;oBAC1F,iEAAiE;aACpE,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,cAAsB,EAAE,YAAoB,EAAE,WAAuB,EAAE,IAAY;QACxF,IAAI,CAAC,GAAG;aACL,OAAO,CACN;;sIAE8H,CAC/H;aACA,GAAG,CAAC,cAAc,EAAE,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;IACvF,CAAC;IAED,2EAA2E;IAC3E,MAAM,CAAC,cAAsB,EAAE,YAAoB;QACjD,IAAI,CAAC,GAAG;aACL,OAAO,CAAC,yEAAyE,CAAC;aAClF,GAAG,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;IACvC,CAAC;CACF"}

package/dist/session-relay-client.d.ts

@@ -3,6 +3,7 @@ import { type KeyProvider } from "@cello-protocol/crypto";
 import type { Logger } from "./types.js";
 import { type RelayReceiptStore } from "./relay-receipt-store.js";
 import type { SessionSealLeafStore } from "./session-seal-leaf-store.js";
+import type { SessionOwnChainStore } from "./session-own-chain-store.js";
 export declare const RELAY_PROTOCOL_ID = "/cello/relay/1.0.0";
 export declare const RELAY_AUTH_DOMAIN = "CELLO-RELAY-AUTH-v1";
 /** Structure 1 leaf kind: 0x00 = message, 0x02 = control (matches the relay). */
@@ -147,6 +148,12 @@ export interface AgentRelayClientOpts {
      * directory's OFFLINE tree rebuild. Optional — when absent, no leaf log is kept.
      */
     sealLeafStore?: SessionSealLeafStore;
+    /**
+     * `DOD-M15-SELFCHAIN-1` — what this agent last said in each session, so the next message links to
+     * it. Optional on the type because test harnesses construct a client without one; when it is
+     * absent this daemon cannot chain to itself and says so rather than signing an unlinked claim.
+     */
+    ownChainStore?: SessionOwnChainStore;
     /**
      * DOD-M15-RELAYSLOTS-1: the current directory-issued online token for this agent, or `undefined`
      * when the directory has not issued one (not connected yet, or this key is not a registered
@@ -272,9 +279,13 @@ export declare class AgentRelayClient {
      * Supplied by the caller because `session-node-manager` is where the session record lives. When
      * it is absent an ASSIGNMENT can still produce it (both participant keys and the session
      * timestamp are on the carry), and that covers re-registration of a session whose row predates
-     * the column. When NEITHER is available the session has no seed, and its first submit claims
-     * position 0 with no hash — which asserts nothing about content and is therefore honest, rather
-     * than a claim about a position it cannot back.
+     * the column.
+     *
+     * ⚠️ WHEN NEITHER IS AVAILABLE THE SESSION CANNOT SUBMIT AT ALL — and this sentence used to say
+     * the opposite, that the first submit would claim position 0 with no hash. That shape no longer
+     * exists: `DOD-M15-SELFCHAIN-1` made both chain links required, so a session with no starting
+     * point has nothing for them to anchor to and every submit on it is refused by name. Registering
+     * without a seed is therefore a real fault, not a degraded mode.
      */
     genesisPrevRoot?: Uint8Array): void;
     /**
@@ -463,6 +474,27 @@ export declare class AgentRelayClient {
         seq: number;
         hash: Uint8Array;
     } | undefined;
+    /**
+     * This agent's OWN last message on a session — what its next message's self link must name.
+     *
+     * ⚠️ EXPOSED BECAUSE THERE MUST BE ONE CHAIN, NOT TWO. The unwitnessed send path lives in
+     * `session-node-manager` and was reading only the durable store, while the witnessed path reads
+     * this in-memory map first. A session that mixed the two — which is every session where the relay
+     * comes and goes — was walking two different chains, and the one that lagged produced a link the
+     * counterparty refuses.
+     *
+     * `undefined` means this agent has not spoken on this session yet, which is the session GENESIS
+     * and not an absence. The caller supplies it; this class does not guess.
+     */
+    lastOwnHash(sessionIdHex: string): Uint8Array | undefined;
+    /**
+     * Record what this agent just sent on a path this client did not carry — the UNWITNESSED send.
+     *
+     * The two paths share one chain (see `lastOwnHash`), so a direct send has to advance it here too.
+     * Without this, a conversation that ran while the relay was down advanced nothing, and the first
+     * witnessed message after it linked to something long superseded.
+     */
+    noteOwnLeaf(sessionIdHex: string, contentHash: Uint8Array): void;
     close(): void;
 }
 //# sourceMappingURL=session-relay-client.d.ts.map

package/dist/session-relay-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-relay-client.d.ts","sourceRoot":"","sources":["../src/session-relay-client.ts"],"names":[],"mappings":"AAkCA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAU,KAAK,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,OAAO,EAAoB,KAAK,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AACpF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAGzE,eAAO,MAAM,iBAAiB,uBAAuB,CAAC;AACtD,eAAO,MAAM,iBAAiB,wBAAwB,CAAC;AACvD,iFAAiF;AACjF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,uBAAuB,EAAE,WAAW,CAAC,MAAM,CAgBtD,CAAC;AAEH,kFAAkF;AAClF,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAE1E;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,OAAO,CAAC;IACzB,+EAA+E;IAC/E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAqBD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,EACd,KAAK,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAO,GAC1E,gBAAgB,CA+DlB;AAED,eAAO,MAAM,aAAa,IAAO,CAAC;AAClC,iGAAiG;AACjG,eAAO,MAAM,cAAc,IAAO,CAAC;AACnC,uFAAuF;AACvF,eAAO,MAAM,aAAa,IAAO,CAAC;AAClC,uFAAuF;AACvF,eAAO,MAAM,gBAAgB,IAAO,CAAC;AAKrC;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,GAAG,UAAU,CAIvF;AAED,MAAM,WAAW,gBAAgB;IAC/B,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,UAAU,CAAC;IAC5B,eAAe,EAAE,UAAU,CAAC;IAC5B;;;;;OAKG;IACH,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,gDAAgD;AAChD,MAAM,MAAM,YAAY,GACpB;IACE,EAAE,EAAE,IAAI,CAAC;IACT,eAAe,EAAE,MAAM,CAAC;IAKxB,eAAe,CAAC,EAAE,UAAU,CAAC;IAC7B,eAAe,CAAC,EAAE,UAAU,CAAC;IAC7B;;;;;;;;;;;;;OAaG;IACH,gBAAgB,CAAC,EAAE,UAAU,CAAC;CAC/B,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAGN,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,sEAAsE;IACtE,WAAW,EAAE,WAAW,CAAC;IACzB,iFAAiF;IACjF,YAAY,EAAE,UAAU,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,EAAE,MAAM,UAAU,GAAG,SAAS,CAAC;IAC3C;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,CAAC;IACpD;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAClE;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;;;OAQG;IACH,MAAM,EAAE,oCAAoC,GAAG,gCAAgC,CAAC;IAChF,oGAAoG;IACpG,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,yFAAyF;IACzF,uBAAuB,EAAE,OAAO,CAAC;IACjC;;;OAGG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;OAUG;IACH,UAAU,EAAE,OAAO,CAAC;CACrB;AAqBD;;;;;;GAMG;AACH;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,2DAA2D;IAC3D,cAAc,EAAE,UAAU,CAAC;IAC3B,oEAAoE;IACpE,eAAe,EAAE,UAAU,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,UAAU,CAAC;IACzB,YAAY,EAAE,UAAU,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,mBAAmB,EAAE,UAAU,CAAC;CACjC;AAsDD;;;;GAIG;AACH,qBAAa,gBAAgB;;IAO3B,4EAA4E;IAC5E,kBAAkB,IAAI,MAAM,GAAG,IAAI;IAwBnC,+FAA+F;IAC/F,kBAAkB,IAAI,gBAAgB,GAAG,IAAI;gBA6EjC,IAAI,EAAE,oBAAoB;IAatC,2FAA2F;IAC3F,IAAI,eAAe,IAAI,MAAM,CAE5B;IAED;;;;OAIG;IACH,eAAe,CACb,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,SAAS,EACf,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,EACjD,UAAU,CAAC,EAAE,oBAAoB;IACjC;;;;;;;;;;OAUG;IACH,eAAe,CAAC,EAAE,UAAU,GAC3B,IAAI;IAmCP;;;;;;;;;;;;;;;;;OAiBG;IACG,uBAAuB,CAAC,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAgFtF,0EAA0E;IAC1E,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI;IAK7C,WAAW,IAAI,OAAO;IAItB;;;;;;;;OAQG;IACH,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IA6hBzC;;;;OAIG;IACG,OAAO,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC;IAIhD;;;;;;;;;;;;;;;;;OAiBG;IACG,gBAAgB,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC;IAoQzD;;;;;;;;;OASG;IACG,iBAAiB,CACrB,IAAI,EAAE,SAAS,EACf,SAAS,EAAE,UAAU,EACrB,WAAW,EAAE,UAAU;IACvB;;;;;OAKG;IACH,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,YAAY,CAAC;IAQxB;;;;;;;;;;;;;;;;;;OAkBG;IACG,mBAAmB,CACvB,IAAI,EAAE,SAAS,EACf,SAAS,EAAE,UAAU,EACrB,WAAW,EAAE,UAAU,EACvB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,YAAY,CAAC;IAIxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA0CG;IACG,UAAU,CACd,IAAI,EAAE,SAAS,EACf,SAAS,EAAE,UAAU,EACrB,WAAW,EAAE,UAAU,EACvB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,UAAU,GAAG,IAAI;IAC/B;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,YAAY,CAAC;IA0ZxB,yFAAyF;IACzF;;;;;;;;;;;;;;;;;;;OAmBG;IACH,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,GAAG,IAAI;IAIvF;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,UAAU,CAAA;KAAE,GAAG,SAAS;IAIhF,KAAK,IAAI,IAAI;CAWd"}
+{"version":3,"file":"session-relay-client.d.ts","sourceRoot":"","sources":["../src/session-relay-client.ts"],"names":[],"mappings":"AAkCA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAU,KAAK,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC,OAAO,EAAoB,KAAK,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AACpF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAGzE,eAAO,MAAM,iBAAiB,uBAAuB,CAAC;AACtD,eAAO,MAAM,iBAAiB,wBAAwB,CAAC;AACvD,iFAAiF;AACjF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,uBAAuB,EAAE,WAAW,CAAC,MAAM,CAgBtD,CAAC;AAEH,kFAAkF;AAClF,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAE1E;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,OAAO,CAAC;IACzB,+EAA+E;IAC/E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAqBD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,EACd,KAAK,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAO,GAC1E,gBAAgB,CA+DlB;AAED,eAAO,MAAM,aAAa,IAAO,CAAC;AAClC,iGAAiG;AACjG,eAAO,MAAM,cAAc,IAAO,CAAC;AACnC,uFAAuF;AACvF,eAAO,MAAM,aAAa,IAAO,CAAC;AAClC,uFAAuF;AACvF,eAAO,MAAM,gBAAgB,IAAO,CAAC;AAKrC;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,GAAG,UAAU,CAIvF;AAED,MAAM,WAAW,gBAAgB;IAC/B,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,UAAU,CAAC;IAC5B,eAAe,EAAE,UAAU,CAAC;IAC5B;;;;;OAKG;IACH,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,gDAAgD;AAChD,MAAM,MAAM,YAAY,GACpB;IACE,EAAE,EAAE,IAAI,CAAC;IACT,eAAe,EAAE,MAAM,CAAC;IAKxB,eAAe,CAAC,EAAE,UAAU,CAAC;IAC7B,eAAe,CAAC,EAAE,UAAU,CAAC;IAC7B;;;;;;;;;;;;;OAaG;IACH,gBAAgB,CAAC,EAAE,UAAU,CAAC;CAC/B,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAGN,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,sEAAsE;IACtE,WAAW,EAAE,WAAW,CAAC;IACzB,iFAAiF;IACjF,YAAY,EAAE,UAAU,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC;;;;OAIG;IACH,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,EAAE,MAAM,UAAU,GAAG,SAAS,CAAC;IAC3C;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,CAAC;IACpD;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAClE;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;;;OAQG;IACH,MAAM,EAAE,oCAAoC,GAAG,gCAAgC,CAAC;IAChF,oGAAoG;IACpG,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,yFAAyF;IACzF,uBAAuB,EAAE,OAAO,CAAC;IACjC;;;OAGG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;OAUG;IACH,UAAU,EAAE,OAAO,CAAC;CACrB;AAqBD;;;;;;GAMG;AACH;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,2DAA2D;IAC3D,cAAc,EAAE,UAAU,CAAC;IAC3B,oEAAoE;IACpE,eAAe,EAAE,UAAU,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,UAAU,CAAC;IACzB,YAAY,EAAE,UAAU,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,mBAAmB,EAAE,UAAU,CAAC;CACjC;AAsDD;;;;GAIG;AACH,qBAAa,gBAAgB;;IAO3B,4EAA4E;IAC5E,kBAAkB,IAAI,MAAM,GAAG,IAAI;IAqDnC,+FAA+F;IAC/F,kBAAkB,IAAI,gBAAgB,GAAG,IAAI;gBA6EjC,IAAI,EAAE,oBAAoB;IA8BtC,2FAA2F;IAC3F,IAAI,eAAe,IAAI,MAAM,CAE5B;IAED;;;;OAIG;IACH,eAAe,CACb,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,SAAS,EACf,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,EACjD,UAAU,CAAC,EAAE,oBAAoB;IACjC;;;;;;;;;;;;;;OAcG;IACH,eAAe,CAAC,EAAE,UAAU,GAC3B,IAAI;IAoCP;;;;;;;;;;;;;;;;;OAiBG;IACG,uBAAuB,CAAC,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAgFtF,0EAA0E;IAC1E,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI;IAM7C,WAAW,IAAI,OAAO;IAItB;;;;;;;;OAQG;IACH,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IA6hBzC;;;;OAIG;IACG,OAAO,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC;IAIhD;;;;;;;;;;;;;;;;;OAiBG;IACG,gBAAgB,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC;IAoQzD;;;;;;;;;OASG;IACG,iBAAiB,CACrB,IAAI,EAAE,SAAS,EACf,SAAS,EAAE,UAAU,EACrB,WAAW,EAAE,UAAU;IACvB;;;;;OAKG;IACH,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,YAAY,CAAC;IAQxB;;;;;;;;;;;;;;;;;;OAkBG;IACG,mBAAmB,CACvB,IAAI,EAAE,SAAS,EACf,SAAS,EAAE,UAAU,EACrB,WAAW,EAAE,UAAU,EACvB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,YAAY,CAAC;IAIxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA0CG;IACG,UAAU,CACd,IAAI,EAAE,SAAS,EACf,SAAS,EAAE,UAAU,EACrB,WAAW,EAAE,UAAU,EACvB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,UAAU,GAAG,IAAI;IAC/B;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,YAAY,CAAC;IAggBxB,yFAAyF;IACzF;;;;;;;;;;;;;;;;;;;OAmBG;IACH,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,GAAG,IAAI;IAIvF;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,UAAU,CAAA;KAAE,GAAG,SAAS;IAIhF;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;IAMzD;;;;;;OAMG;IACH,WAAW,CAAC,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,GAAG,IAAI;IAKhE,KAAK,IAAI,IAAI;CAWd"}

package/dist/session-relay-client.js

@@ -262,6 +262,35 @@ export class AgentRelayClient {
     #logger;
     #receiptStore;
     #sealLeafStore;
+    #ownChainStore;
+    /**
+     * `DOD-M15-SELFCHAIN-1` — this agent's own last message per session, in memory.
+     *
+     * ⚠️ THE MAP IS THE CHAIN; THE STORE IS ITS DURABILITY. Separating them is deliberate. Within a
+     * running process the map is authoritative and always available, so a send never depends on a
+     * database being wired. Across a RESTART only the store can answer, and without it this daemon
+     * would silently start a new chain mid-conversation — the counterparty refusing every message
+     * after it, with no way to tell that from tampering.
+     *
+     * So a missing store is a durability gap, and never a reason to refuse a send: it is caused by our
+     * own wiring, never by anything a peer does, and refusing there would break the product to close a
+     * hole the peer cannot reach. It IS reported — once per client, at construction, by the error
+     * below. An earlier version of this comment promised that report and nothing emitted it, which is
+     * the shape that lets a wiring gap sit invisible until a restart days later.
+     */
+    #ownChain = new Map();
+    /**
+     * `DOD-M15-SELFCHAIN-1` — each session's GENESIS, kept apart from `#lastSeen`, and keeping them
+     * apart is the entire point of this field.
+     *
+     * `#lastSeen` is seeded with the genesis at registration and then ADVANCES as the counterparty
+     * speaks. So after the counterparty's first message it holds THEIR last content hash, not the
+     * starting point. Reading it as the self link's fallback handed a sender the other party's hash
+     * for their own first message, which the relay then refused — and, worse, told the innocent
+     * counterparty their chain was broken. This map never advances, so it is always the right answer
+     * to "what does a party who has not spoken here yet link to?".
+     */
+    #genesis = new Map();
     /** DOD-M15-RELAYSLOTS-1 — read fresh at every auth. See `AgentRelayClientOpts.onlineToken`. */
     #onlineToken;
     /** DOD-M15-CORROBORATE-1 — where a relay's witness alert goes. See the opt of the same name. */
@@ -338,6 +367,22 @@ export class AgentRelayClient {
         this.#logger = opts.logger;
         this.#receiptStore = opts.receiptStore;
         this.#sealLeafStore = opts.sealLeafStore;
+        this.#ownChainStore = opts.ownChainStore;
+        if (!this.#ownChainStore) {
+            /**
+             * ONCE PER CLIENT, AT CONSTRUCTION, and at ERROR because the consequence is invisible until a
+             * restart that may be days away — at which point this daemon silently starts a new chain
+             * mid-conversation and the counterparty refuses everything after it, for a reason that names
+             * tampering.
+             */
+            this.#logger.error("session.relay.own_chain.store_absent", {
+                relayPeerId: opts.relayPeerId,
+                impact: "this relay client was wired without a durable record of what this agent has said. " +
+                    "Conversations work until the daemon restarts; after a restart, mid-conversation, this " +
+                    "side starts a new chain and the counterparty refuses every message after it as though " +
+                    "the record had been altered.",
+            });
+        }
         this.#onlineToken = opts.onlineToken;
         this.#onWitnessAlert = opts.onWitnessAlert;
         this.#onWitnessUnreadable = opts.onWitnessUnreadable;
@@ -359,9 +404,13 @@ export class AgentRelayClient {
      * Supplied by the caller because `session-node-manager` is where the session record lives. When
      * it is absent an ASSIGNMENT can still produce it (both participant keys and the session
      * timestamp are on the carry), and that covers re-registration of a session whose row predates
-     * the column. When NEITHER is available the session has no seed, and its first submit claims
-     * position 0 with no hash — which asserts nothing about content and is therefore honest, rather
-     * than a claim about a position it cannot back.
+     * the column.
+     *
+     * ⚠️ WHEN NEITHER IS AVAILABLE THE SESSION CANNOT SUBMIT AT ALL — and this sentence used to say
+     * the opposite, that the first submit would claim position 0 with no hash. That shape no longer
+     * exists: `DOD-M15-SELFCHAIN-1` made both chain links required, so a session with no starting
+     * point has nothing for them to anchor to and every submit on it is refused by name. Registering
+     * without a seed is therefore a real fault, not a degraded mode.
      */
     genesisPrevRoot) {
         const existing = this.#sessions.get(sessionIdHex);
@@ -383,10 +432,12 @@ export class AgentRelayClient {
          * nothing" for a conversation that is well underway — and the relay would then answer the next
          * submit from a position we had already passed.
          */
+        const genesis = genesisPrevRoot ?? genesisFromAssignment(sessionIdHex, carriedAssignment);
+        if (genesis)
+            this.#genesis.set(sessionIdHex, genesis);
         if (!this.#lastSeen.has(sessionIdHex)) {
-            const seed = genesisPrevRoot ?? genesisFromAssignment(sessionIdHex, carriedAssignment);
-            if (seed)
-                this.#lastSeen.set(sessionIdHex, { seq: 0, hash: seed });
+            if (genesis)
+                this.#lastSeen.set(sessionIdHex, { seq: 0, hash: genesis });
         }
         // Eagerly present the assignment so the relay records the session (binds peer IDs, creates the
         // session entry) BEFORE the first hash_submit or the counterparty's leaves arrive — the relay
@@ -508,6 +559,7 @@ export class AgentRelayClient {
     unregisterSession(sessionIdHex) {
         this.#sessions.delete(sessionIdHex);
         this.#lastSeen.delete(sessionIdHex);
+        this.#genesis.delete(sessionIdHex);
     }
     hasSessions() {
         return this.#sessions.size > 0;
@@ -1755,28 +1807,15 @@ export class AgentRelayClient {
          * AUTHOR's, already made. Logging "this submit acknowledges nothing" about it would be false,
          * and this daemon's own seed is irrelevant to a claim it did not write.
          */
-        if (!lastSeen && !carried) {
-            /**
-             * ⚠️ **v1, AND ONLY BECAUSE THERE IS NOTHING TO ACKNOWLEDGE.** Same rule as the content
-             * claim's, and the receiving half is `#verifyAcknowledgedContent` — a v1 claim is refused the
-             * moment it names position 1 or beyond, and accepted when it names none.
-             *
-             * Reaching here means the session was registered with no genesis and no assignment to derive
-             * one from, and no counterparty leaf has been delivered. `last_seen_seq: 0` with no hash says
-             * "I have seen nothing of yours", which is true, and asserts nothing about content — so it is
-             * not the unbacked number this unit exists to stop signing.
-             *
-             * It does not refuse the submit, and an earlier version did. Sessions brokered without a
-             * relay assignment are real, and refusing there left them unable to be witnessed at all.
-             */
-            this.#logger.info("session.relay.submit.unacknowledged", {
-                relayPeerId: this.#relayPeerId,
-                session: sessionIdHex,
-                impact: "this submit acknowledges nothing: the session has no recorded starting point and no " +
-                    "counterparty leaf has arrived on it. The leaf is witnessed as normal; the claim simply " +
-                    "makes no assertion about what this agent has received.",
-            });
-        }
+        /**
+         * ⚠️ THE `session.relay.submit.unacknowledged` LOG THAT WAS HERE IS GONE, AND ITS ABSENCE IS
+         * DELIBERATE — `DOD-M15-SELFCHAIN-1`.
+         *
+         * It fired on exactly the condition the refusal below fires on (no seed, not a carried leaf)
+         * and told the operator "the leaf is witnessed as normal". That is now false: nothing is
+         * witnessed, the submit is refused. Two lines about one condition, one of them wrong, is how a
+         * reader ends up trusting the wrong one — so the refusal below is the only thing that speaks.
+         */
         // The published encoder from protocol-types — the ONE definition of the field order, pinned by
         // `structure1-canonical.json` (v1) and `structure1-v2-canonical.json` (v2). A second local copy
         // lived here until 020-ACKHASH; it drifted, and the drift was invisible because both copies
@@ -1799,13 +1838,97 @@ export class AgentRelayClient {
          * deliberately NOT consulted: `last_seen_seq` and `last_seen_hash` inside those bytes are the
          * AUTHOR's account of what THEY had seen, and they are not ours to restate.
          */
+        /**
+         * ─── BOTH CHAIN LINKS, UNCONDITIONALLY — `DOD-M15-SELFCHAIN-1` ───────────────────────────────
+         *
+         * `lastSeenHash` chains this sender to their COUNTERPARTY. `prevOwnHash` chains them to
+         * THEMSELVES. Neither is optional: a claim carrying one link is not a shape this protocol has,
+         * and `encodeStructure1` has no branch that emits one.
+         *
+         * ⚠️ THE CONDITIONAL SPREAD THAT USED TO BE HERE DEFEATED THE TYPE. Writing
+         * `...(x ? { lastSeenHash: x } : {})` satisfies a REQUIRED field as far as the compiler is
+         * concerned, so the one guard that should have made an unlinked claim impossible to write was
+         * silently inert. Pass both by value; let `tsc` do its job.
+         *
+         * ⚠️ NO SEED MEANS NO SEND. The seed is this session's genesis — the agreed starting point both
+         * links fall back to before anything has been said. A session registered with neither a genesis
+         * nor an assignment to derive one from has no such point, and the honest outcome is to refuse
+         * rather than sign a chain anchored to nothing. There is no degraded shape to fall back to and
+         * deliberately so: an unlinked message is invisible until the conversation's order is disputed,
+         * which is far too late for anyone to act on it.
+         */
+        const seed = lastSeen?.hash;
+        const genesis = this.#genesis.get(sessionIdHex);
+        if (!carried && !seed) {
+            this.#logger.error("session.relay.submit.unchainable", {
+                relayPeerId: this.#relayPeerId,
+                session: sessionIdHex,
+                impact: "this session has no recorded starting point on this machine, so a message sent on it " +
+                    "could not link to anything and its place in the conversation could never be proven. " +
+                    "The message was NOT sent. Restart the session so it is registered with its genesis.",
+            });
+            return { ok: false, reason: "session_unchainable" };
+        }
+        /**
+         * This agent's own previous message, or the session genesis when it has not spoken here yet.
+         * "I have not spoken" is a VALUE — derived per session, so it cannot be presented for a
+         * different conversation — never an absent field.
+         *
+         * The in-memory map first, then the durable store for the restart case, then the genesis. See
+         * `#ownChain` for why a missing store degrades durability rather than blocking the send.
+         */
+        let prevOwn;
+        if (!carried) {
+            /**
+             * ⚠️ THE LAST FALLBACK IS THE GENESIS, NOT `seed` — and `seed` is what it used to be.
+             *
+             * `seed` is `#lastSeen`, which ADVANCES as the counterparty speaks. So the moment the
+             * counterparty had said anything, a party sending their FIRST message linked to the
+             * counterparty's message instead of to the session's starting point. The relay expects the
+             * genesis for a sender's first leaf, so it refused — and then told the counterparty, who had
+             * done nothing, that this side's chain was broken. Every two-party conversation died on its
+             * second message and blamed the wrong party for it.
+             */
+            prevOwn = this.#ownChain.get(sessionIdHex)
+                ?? this.#ownChainStore?.lastOwnHash(this.senderPubkeyHex, sessionIdHex)
+                ?? genesis;
+            if (!prevOwn) {
+                /**
+                 * Unreachable while a seed exists — both come from the same registration — but stated as a
+                 * refusal rather than a non-null assertion. The one thing that must never happen here is
+                 * signing a self link chosen because it was the nearest value to hand.
+                 */
+                this.#logger.error("session.relay.submit.unchainable", {
+                    relayPeerId: this.#relayPeerId,
+                    session: sessionIdHex,
+                    impact: "this session has an acknowledgement but no recorded starting point, so this agent's " +
+                        "own first message has nothing to link to. The message was NOT sent. Restart the " +
+                        "session so it is registered with its genesis.",
+                });
+                return { ok: false, reason: "session_unchainable" };
+            }
+        }
+        /**
+         * ⚠️ **A CARRIED LEAF IS SENT VERBATIM AND SIGNED BY NOBODY HERE — 034-CARRYLEAF.**
+         *
+         * When this agent is witnessing something it RECEIVED, the claim already exists: its author
+         * built it, signed it, and put it on the content frame. Re-encoding it would change the signed
+         * bytes and the relay would refuse a leaf that is perfectly valid. Signing it ourselves would be
+         * worse — it would turn their statement into ours, which is the one thing that must never happen
+         * to a record whose whole value is that each party's words are their own.
+         *
+         * So this branch takes the bytes as they arrived, and this agent's own chain state is
+         * deliberately NOT consulted: both links inside those bytes are the AUTHOR's account, and they
+         * are not ours to restate.
+         */
         const structure1 = carried ? carried.structure1Cbor : encodeStructure1({
             contentHash,
             senderPubkey: this.#senderPubkey,
             sessionId,
-            lastSeenSeq: lastSeen?.seq ?? 0,
+            lastSeenSeq: lastSeen.seq,
             timestamp: Date.now(),
-            ...(lastSeen ? { lastSeenHash: lastSeen.hash } : {}),
+            lastSeenHash: seed,
+            prevOwnHash: prevOwn,
         });
         const signature = carried ? carried.senderSignature : await this.#keyProvider.sign(structure1);
         const frame = encodeCbor({
@@ -1875,6 +1998,36 @@ export class AgentRelayClient {
             // On timeout, reset the stream so a late ack can't settle a LATER submit (FIFO desync).
             if (!result.ok && result.reason === "relay_submit_timeout")
                 this.#resetStream();
+            /**
+             * ─── ADVANCE THE SELF CHAIN, AND ONLY ON SUCCESS — `DOD-M15-SELFCHAIN-1` ──────────────────
+             *
+             * Recorded AFTER the relay acknowledged, never before. Advancing first and then failing to
+             * send would leave the chain pointing at a message that never existed, and every later message
+             * would be refused by the counterparty with a reason that names tampering — an outage
+             * reported as an attack.
+             *
+             * A retry therefore re-reads the same predecessor, which is exactly right: a retransmission is
+             * the same message, not the next one.
+             *
+             * NOT for a carried leaf. Those bytes are the AUTHOR's and this agent did not write them, so
+             * they are no part of this agent's own chain.
+             */
+            if (result.ok && !carried) {
+                // The map is the chain — always advanced. The store is its durability, advanced when wired.
+                this.#ownChain.set(sessionIdHex, contentHash);
+                try {
+                    this.#ownChainStore?.record(this.senderPubkeyHex, sessionIdHex, contentHash, Date.now());
+                }
+                catch (err) {
+                    this.#logger.error("session.selfchain.record.failed", {
+                        session: sessionIdHex,
+                        error: err instanceof Error ? err.message : String(err),
+                        impact: "this message was witnessed, but this agent could not record it as the link for its " +
+                            "next message — so the next one will chain to the wrong predecessor and the " +
+                            "counterparty will refuse it. Restart the session to re-anchor the chain.",
+                    });
+                }
+            }
             return result;
         }
         finally {
@@ -1928,6 +2081,34 @@ export class AgentRelayClient {
     lastSeenAck(sessionIdHex) {
         return this.#lastSeen.get(sessionIdHex);
     }
+    /**
+     * This agent's OWN last message on a session — what its next message's self link must name.
+     *
+     * ⚠️ EXPOSED BECAUSE THERE MUST BE ONE CHAIN, NOT TWO. The unwitnessed send path lives in
+     * `session-node-manager` and was reading only the durable store, while the witnessed path reads
+     * this in-memory map first. A session that mixed the two — which is every session where the relay
+     * comes and goes — was walking two different chains, and the one that lagged produced a link the
+     * counterparty refuses.
+     *
+     * `undefined` means this agent has not spoken on this session yet, which is the session GENESIS
+     * and not an absence. The caller supplies it; this class does not guess.
+     */
+    lastOwnHash(sessionIdHex) {
+        return this.#ownChain.get(sessionIdHex)
+            ?? this.#ownChainStore?.lastOwnHash(this.senderPubkeyHex, sessionIdHex)
+            ?? undefined;
+    }
+    /**
+     * Record what this agent just sent on a path this client did not carry — the UNWITNESSED send.
+     *
+     * The two paths share one chain (see `lastOwnHash`), so a direct send has to advance it here too.
+     * Without this, a conversation that ran while the relay was down advanced nothing, and the first
+     * witnessed message after it linked to something long superseded.
+     */
+    noteOwnLeaf(sessionIdHex, contentHash) {
+        this.#ownChain.set(sessionIdHex, contentHash);
+        this.#ownChainStore?.record(this.senderPubkeyHex, sessionIdHex, contentHash, Date.now());
+    }
     close() {
         this.#closed = true;
         this.#settlePending({ ok: false, reason: "relay_client_closed" });