@cello-protocol/daemon 0.0.193 → 0.0.195

package/dist/session-node-manager.d.ts

@@ -5,8 +5,10 @@
  *   1. Per-session nodes: fresh transport key + Peer ID, connectionGater allows
  *      only the designated counterparty. Created during cello_initiate_session
  *      (outbound) or cello_await_session (inbound, via standing receiver handoff).
- *   2. Standing receiver node: pre-created, open gater, kept alive at all times.
- *      Handed to the first inbound session; immediately replaced.
+ *   2. Standing receiver node: pre-created, kept alive at all times, handed to the first inbound
+ *      session and immediately replaced. Its gater is NOT open — `DOD-M15-ASSIGN-1` made it admit
+ *      nobody inbound until a session offer names the dialer (see `standing-receivers.ts`). This
+ *      line said "open gater" for as long as that was true and for a while after it was not.
  *   3. 32-node cap: enforced before any new node is created.
  *   4. Session status in the DB: active → sealed (on close) or interrupted
  *      (on graceful shutdown or SIGKILL-restart detection).
@@ -21,509 +23,326 @@ import { type DaemonDatabase } from "./sqlcipher-db.js";
 import { type RefusalKind } from "./refusal-reasons.js";
 import type { Stream } from "@libp2p/interface";
 import type { Logger, SessionRecord, SealReadinessView } from "./types.js";
-import { SessionConnectionGater } from "./session-connection-gater.js";
 import { SessionTree, type WritableSessionTreeLeafKind } from "./session-tree.js";
 import { type CelloNode, type IAutoNatService } from "@cello-protocol/transport";
 import type { KeyProvider } from "@cello-protocol/crypto";
 import { type SessionEphemeral } from "@cello-protocol/crypto";
 import { type ParkEnvelope } from "./park-envelope.js";
-import { AgentRelayClient, type RelayAssignmentCarry, type RelayAuthRefusal, type RelayWitnessAlert } from "./session-relay-client.js";
-/**
- * One row in an agent's witness-alert list — DOD-M15-CORROBORATE-1 review F1. Deduped on
- * `(witness relay, session)`, so a repeated observation raises `occurrences` rather than taking
- * another slot in a bounded list.
- */
-export interface WitnessAlertNotice {
-    /** `${relayId}::${sessionIdHex}` — the dedupe key, not shown to anyone. */
-    key: string;
-    alert: RelayWitnessAlert;
-    occurrences: number;
-    /**
-     * When this witness first said it. Held SEPARATELY from `alert.observedAt`, because a later
-     * repeat can replace `alert` (a provable one supersedes an unprovable one) and that must not
-     * silently move the first sighting forward — an operator reading "first observed" wants to know
-     * when this started, not when the strongest version of it arrived.
-     */
-    firstObservedAt: number;
-    lastObservedAt: number;
-}
+import { AgentRelayClient, type RelayAuthRefusal, type RelayWitnessAlert } from "./session-relay-client.js";
 import { RelayReceiptStore, type RelayReceipt } from "./relay-receipt-store.js";
 import { SessionSealLeafStore, type SealCarryLeaf } from "./session-seal-leaf-store.js";
+import { SessionOwnChainStore } from "./session-own-chain-store.js";
 import type { SealUpgradeReadiness } from "./seal-upgrade.js";
 import type { SealFrontierLeaf } from "./seal-frontier-verify.js";
 import { type QuarantineFrameMeta } from "./quarantine-framing.js";
 import { type SecurityGatewayClient } from "@cello-protocol/gateway";
 /**
- * DOD-CAP-SELF-HEAL-1 — how long an interrupted session keeps consuming a cap slot.
- *
- * ATTRIBUTION ALONE DID NOT FIX THIS, and the reason is worth keeping. Recording who ended a
- * session only works for sessions ended after the recording started: every row written before the
- * column existed is unlabelled, and an unlabelled row counts. So the operator's actual backlog —
- * five finished conversations that were blocking two of their own agents — was untouched by it.
- * Attribution can never clear history, and history is what fills a cap.
- *
- * Age can. An interrupted session nobody has touched for hours is debris, not a live obligation,
- * and that is true whether our restart or their disconnect produced it.
- *
- * D18 SURVIVES BECAUSE THE ATTACK IS A RATE. The disconnect-evasion peer has to drop and reopen
- * faster than this window to gain anything, so everything it churns is recent and everything it
- * churns still counts. What ages out is the thing that was never an attack: a conversation that
- * finished. An attacker who waits out the window to gain one slot per window is not evading the
- * bound, they are obeying a slower one — and the global anti-swarm cap still applies on top.
- *
- * Two hours: comfortably longer than any churn worth attacking with, comfortably shorter than
- * "yesterday's conversation still blocks me".
- */
-/**
- * DOD-M12B-RESERVATION-RETRY-1 — how many times to re-ask for a refused reservation before saying
- * the agent is undialable and stopping. Bounded because a reservation is scarce and a fleet that
- * retries forever is how a relay is exhausted. With the 5-minute base and doubling, five retries
- * span about 2.5 hours.
- */
-export declare const SR_RESERVATION_MAX_RETRIES = 5;
-/**
- * DOD-M15-RELAYSLOTS-1 — how long an agent skips a relay that refused it for a relay-side fault.
- *
- * Ten minutes: long enough that the agent is not re-asking a relay that cannot serve it every time
- * its receiver rebuilds, short enough that when someone fixes that relay the agent finds it again
- * without needing its own restart. The fault is on somebody else's machine and nobody tells us when
- * it is fixed, so this has to expire on its own.
- */
-export declare const RELAY_QUARANTINE_MS: number;
-export declare const CAP_INTERRUPTED_TTL_MS: number;
-/**
- * DOD-M12B-ABANDON-NOTIFY-1 — what happened when we tried to tell the counterparty we hung up.
- *
- * A REASON, not a boolean. The three causes are not interchangeable, and collapsing them made the
- * operator's guidance blame the network for a session this side had already torn down — which is
- * the most common case, since force-abandon is largely used on `interrupted` sessions and those
- * have no node left to send on.
- *
- * `told: true` means the bytes left this node. There is no acknowledgement, so it is not proof the
- * far side acted — a counterparty on an older client does not understand the frame and keeps
- * calling. The guidance says so rather than promising they will stop.
- */
-export interface AbandonNoticeResult {
-    told: boolean;
-    reason: "sent" | "no_local_node" | "send_failed";
-}
-/**
- * DOD-M12B-ACK-1 — why a session is impaired, and what became of the content that revealed it.
- *
- * `cause` separates "your own message did not reach them" (`direct_send`) from "our acknowledgement
- * to them did not go out" (`delivery_ack`) — on the second the operator sent nothing at all, so a
- * surface that talks about their last send is describing a message they never wrote.
- *
- * `retained` is what makes it safe to advise. A parked or durably-queued message must NOT be
- * resent — a resend takes a second canonical position, which is this milestone's founding defect.
- * A LOST one must be, and `cello_send` has already said so. `unknown` means do not claim either.
- */
-export interface SessionImpairment {
-    /**
-     * `content_key` added by `029c` review F7: a send that failed because this machine had no content
-     * encryption key — never agreed, or gone between the preflight and the seal — is a LOCAL key
-     * fault, not a transport one. Reported as `direct_send` it sent the operator to inspect a
-     * connection that was working.
-     */
-    cause: "direct_send" | "delivery_ack" | "content_key";
-    retained: "parked" | "durable" | "lost" | "unknown";
-}
-/** Anti-drip-feed: cumulative RECEIVED bytes per session at the UNKNOWN tier (= the grid's UNKNOWN
- *  byte cap). Higher tiers get more (DEFAULT_TIER_BOUNDS); no tier is unbounded (INV-TIER-BOUND). */
-export declare const ABUSE_MAX_SESSION_RECEIVED_BYTES: number;
-/** Anti-drip-feed via many sessions: active sessions an UNKNOWN counterparty may hold open at once
- *  (= the grid's UNKNOWN per-sender cap). */
-export declare const ABUSE_MAX_SESSIONS_PER_UNKNOWN_SENDER: number;
-/** Anti-swarm: total active sessions from ALL UNKNOWN-tier counterparties combined, per agent. A
- *  scalar across the whole unknown pool — not per-tier — so it stays a standalone const. */
-export declare const ABUSE_MAX_UNKNOWN_SESSIONS_GLOBAL = 50;
-/**
- * M7 DOD-SPINE-6 / MSG-001-3b: the inputs a session node needs to connect to the relay
- * as the Structure-2 witness (relay endpoint from the FROST-signed assignment + the
- * agent's K_local identity + the 16-byte session id). Optional on node creation: when
- * absent (or connect fails), the session still works over the direct content path — the
- * relay just doesn't witness the leaf yet.
- */
-export interface RelayConnectParams {
-    relayPeerId: string;
-    relayAddrs: string[];
-    keyProvider: KeyProvider;
-    senderPubkey: Uint8Array;
-    sessionIdBytes: Uint8Array;
-    /**
-     * FED-OPTIONB-SETUP-001 (Option B): the directory-signed relay assignment the client presents to its
-     * chosen relay (replaces the directory→relay dial). Absent for direct-mode and on the restart/persisted
-     * reconnect path (the relay already recorded the session at first establishment) — the client then just
-     * reconnects without re-recording.
-     */
-    assignment?: RelayAssignmentCarry;
-}
-/**
- * DOD-PARK-DRAIN-1: why the parked-mailbox drain is being asked to run.
- *
- * `standing_receiver_ready` — a receiver was just installed, first time or rebuilt. The rebuild is
- * the case that matters: content parks precisely because the relay link died, and the watchdog
- * rebuild is that same event seen from the client side.
- * `periodic_backstop` — nothing happened; this is the slow sweep that keeps a missed trigger from
- * stranding content until someone restarts the daemon. Drains are deduped and delete-on-confirm,
- * so an extra one costs a pull.
- */
-export type ParkedDrainReason = "standing_receiver_ready" | "periodic_backstop"
-/**
- * DOD-M12B-SESSION-SEED-1 (case B): a session that was interrupted has just been revived, so the
- * content the counterparty parked while we had no node can finally be fetched. Reviving the node
- * without draining leaves the operator looking at a healthy session with no new mail.
- */
- | "session_revived"
-/**
- * DOD-M12B-LEAF-TRIGGERS-FETCH-1: the relay told us a specific message exists — we hold its hash
- * and its canonical sequence — and its plaintext never arrived on the direct path. Measured live
- * 2026-08-18: the leaf landed in ONE second and the bytes took 102, because nothing connected the
- * two facts.
- */
- | "witnessed_leaf_unresolved";
-/**
- * Adapter interface for session node creation. Allows test injection of a
- * failing factory (AC-007) without touching the real libp2p stack.
- * The adapter pattern is mandatory per outline.md constraints.
- */
-export interface ISessionNodeFactory {
-    createNode(config: SessionNodeConfig): Promise<CelloNode>;
-}
-export interface SessionNodeConfig {
-    sessionId: string;
-    connectionGater?: SessionConnectionGater;
-    /**
-     * DOD-M15-RELAYONLY-1: this agent has asked never to be directly reachable, so the factory must
-     * omit dcutr from the node's service set.
-     *
-     * ⚠️ NOT a duplicate of filtering the published addresses. Those two things stop DIFFERENT
-     * disclosures: the filter controls what the DIRECTORY is told, and dcutr talks to the peer
-     * directly. Its whole job is to upgrade a relayed connection into a direct one, and the inbound
-     * side starts the upgrade — which is exactly a standing receiver. Leaving it on means the agent
-     * routes over the relay precisely as asked and then hole-punches to a direct connection anyway,
-     * with every test still green because the leak happens inside libp2p after the assertions.
-     */
-    relayOnly?: boolean;
-    /**
-     * CELLO-M7-TRANSPORT-001: role of the node, forwarded to createNode to tune the
-     * libp2p service set (dcutr is included for 'session' dialers, omitted for the
-     * 'standing_receiver'). AutoNAT is present for both.
-     */
-    nodeType?: "session" | "standing_receiver";
-    /**
-     * M7-SESSION-003 (AC-005): keepalive ping interval for the session node so a
-     * counterparty that vanishes without a clean close is detected within a bounded
-     * window. Factories should forward this to createNode({ keepAliveIntervalMs }).
-     */
-    keepAliveIntervalMs?: number;
-    /**
-     * DOD-NAT-REACHABILITY-1: circuit-relay listen addresses
-     * (`<relay-multiaddr>/p2p/<relay-peer-id>/p2p-circuit`) the node should take
-     * reservations on. Each entry makes libp2p reserve a slot with that relay and
-     * advertise the relayed address via getMultiaddrs() — which is what makes a
-     * NAT'd standing receiver dialable at all. A dead relay in this list degrades
-     * (no reservation, WARN) — it never fails node creation.
-     */
-    circuitRelayListenAddrs?: string[];
-    /**
-     * DOD-M12B-SESSION-SEED-1: the 32-byte Ed25519 seed this node's transport identity is derived
-     * from, so a node that is torn down can be rebuilt at the SAME peer id.
-     *
-     * Without it libp2p generates the key internally and the id is unrecoverable — which is why a
-     * laptop-close session cannot come back today: a rebuilt node could dial the counterparty, but
-     * the counterparty holds an id that no longer exists.
-     *
-     * PER SESSION, NEVER PER AGENT. Each standing receiver mints its own; at handoff the seed becomes
-     * that session's and the replacement receiver mints a fresh one. That preserves the recorded
-     * 2026-04-11 rationale for ephemeral ids (a passive observer must not be able to correlate one
-     * agent's sessions across days) while making the id stable WITHIN the one session an observer can
-     * already correlate by watching the connection.
-     */
-    transportPrivateKey?: Uint8Array;
-    /**
-     * DOD-M12B-SESSION-SEED-1 (case B review HIGH-1): bind a ROUTABLE interface, not loopback.
-     *
-     * Ordinary session nodes dial OUT and need no inbound reachability, so the factory gives them
-     * `127.0.0.1`. But a session node that reached its role by PROMOTION inherited the standing
-     * receiver's `0.0.0.0` bind and its circuit-relay reservation — which is every session node in
-     * production. A REBUILT one does not inherit anything, so without this it comes back on loopback
-     * with no relay address: the peer id is preserved and the counterparty still cannot reach us,
-     * which is precisely the half of the promise revival exists to keep. Preserving the id only
-     * matters because the circuit address `/p2p/<relay>/p2p-circuit/p2p/<sessionPeerId>` embeds it —
-     * and that is the address that was not being taken.
-     */
-    inboundReachable?: boolean;
-}
-/** DAEMON-004: a piece of content received and verified, awaiting cello_receive. */
-interface ReceivedContentEntry {
-    contentHex: string;
-    senderPubkey: string;
-    sequenceNumber: number;
-}
-type CreateSessionResult = {
-    ok: true;
-    peerId: string;
-    addrs: string[];
-} | {
-    ok: false;
-    reason: string;
-    guidance: string;
-};
-/**
- * DOD-M12B-REVIVAL-BOUND-1 — how long an interrupted session stays revivable before it is closed.
- *
- * 24 hours. The bound exists because of Andre's 2026-08-18 tenet — *"leave nothing open that is no
- * longer needed"* — and its value is set by the case it must not break: a laptop closed for the
- * night. A window shorter than a night's sleep would abandon exactly the sessions case A/B exist to
- * rescue, which is why this is not zero and not an hour.
- *
- * It is deliberately a plain constant and not a setting. A per-operator knob here is a knob that
- * turns the guarantee off, and the guarantee is the security property, not a preference.
- */
-export declare const REVIVAL_WINDOW_MS: number;
-/**
- * DOD-M12B-REVIVAL-BOUND-1 — how often the revival bound is applied.
- *
- * Hourly. The window is 24 hours, so the worst-case overshoot is ~4% of the bound, and the pass is
- * one DB walk with no network in it. Boot-only was the first build and it is not a bound at all: a
- * daemon left up for a week never applies it, and a long-lived daemon is the normal case.
- */
-export declare const REVIVAL_BOUND_SWEEP_MS: number;
-/** DOD-M12B-SESSION-SEED-1: per-relay deadline when a revived node asks for a circuit reservation.
- *  Three seconds — a relay that has a slot answers well inside it, and one that does not never
- *  answers at all (measured: 10,002ms and still waiting). */
-export declare const REVIVE_RESERVATION_TIMEOUT_MS = 3000;
-/** How many relays a revival will ask before settling for a plain node. Two: the worst case is then
- *  ~6s to a usable session, against a measured "never" for the unbounded form. */
-export declare const REVIVE_RESERVATION_CANDIDATES = 2;
-/**
- * DOD-M12B-LEAF-TRIGGERS-FETCH-1 — how long the DIRECT path gets before we go and fetch content the
- * relay has already told us about.
- *
- * Two seconds. The witness leaf and the plaintext are separate deliveries, and on a healthy session
- * the direct content normally lands within milliseconds of the leaf — so fetching the instant a leaf
- * arrives would put a relay round trip on the hot path of every message in every session, which is a
- * self-inflicted load problem. Waiting forever is what cost 102 seconds. Two seconds is far above
- * the healthy direct latency and far below anything a person would notice.
- */
-export declare const LEAF_FETCH_GRACE_MS = 2000;
-/**
- * DOD-M15-REFUSALTERMINAL-1 — the refusal reasons no retry can ever get past.
- *
- * MEASURED LIVE 2026-09-04: one message aimed at a conversation the counterparty had already
- * closed, refused `session_committed` and re-fetched roughly twice a second for 62 hours across
- * several daemon restarts — 232,056 refusal events on that one session and a 484 MB `daemon.log`.
- *
- * **WHY `session_committed` QUALIFIES.** A committed session carries a signature over its contents.
- * Nothing can be appended to it by anyone — not the counterparty, not us — so there is no future
- * state in which this content is accepted. That is the bar, and it is the whole bar.
- *
- * **⚠️ DO NOT ADD A REASON WITHOUT MEETING IT.** A reason wrongly called terminal silently drops a
- * message that would have arrived on the next try, which is worse than the loop this set exists to
- * end. The tempting ones and why each fails:
- *
- *   - `content_hash_mismatch` — the fetch is BY CONTENT HASH, and a later fetch may retrieve a
- *     correct copy from a different relay. Retrying can succeed.
- *   - `sender_unresolved` — the sender may become resolvable when a profile arrives or a directory
- *     syncs. Retrying can succeed.
- *   - `session_orphaned` — `024-ORPHANTRIAGE` owns that path and decides its disposition.
- *   - `session_size_limit_exceeded` — the cap IS monotonic, but its bound is a setting, and an
- *     operator who raises it must be able to un-stick the conversation.
- *   - a transient screener block — transient is in its name.
- */
-/**
- * ⚠️ NOT the same concept as `session-terminal-refusal.ts` (`DOD-MP-SESSION-RETIRE-1`), which is the
- * RELAY terminally refusing one of OUR SENDS. This set is about INBOUND content this side will
- * never accept. Two "terminal refusal" ideas live in this daemon and they point in opposite
- * directions — review F9.
- */
-export declare const TERMINAL_REFUSAL_REASONS: ReadonlySet<string>;
-/**
- * DOD-M15-REFUSALTERMINAL-1 review F3 — how long a FAILED read of the terminal-refusal rows is
- * backed off for, per session.
- *
- * A minute: long enough that a database throwing on every witnessed leaf produces one ERROR rather
- * than one per message (the exact log growth this unit exists to end), short enough that a disk
- * which recovers is noticed within a message or two rather than at the next restart.
- */
-export declare const TERMINAL_REFUSAL_READ_RETRY_MS = 60000;
-/**
- * DOD-M15-REFUSALTERMINAL-1 review F7 — how many terminally-refused content hashes are remembered
- * per session.
- *
- * The counterparty chooses how many rows this table gets: one per distinct message aimed at a
- * closed conversation, written even after the byte cap has stopped retaining evidence. 512 matches
- * `MAX_REFUSED_PARKED_ENTRIES`, is far above any honest volume for a conversation that has ENDED,
- * and bounds the table at (sessions × 512) small rows.
- */
-export declare const MAX_TERMINAL_REFUSALS_PER_SESSION = 512;
-/**
- * DOD-M15-REFUSALTERMINAL-1 — ONE refusal, TWO counts, and the NAMES are the fix.
- *
- * The inbox reported `times: 58` for a refusal that had fired tens of thousands of times, and the
- * code was not wrong — the sentence describing it was. One number is "since you last dismissed this
- * conversation" and the other is "ever". Neither may be called `times`, because that is the word an
- * operator, and an agent deciding whether to escalate, reads as a lifetime figure.
- */
-export interface RefusalNotice {
-    sessionId: string;
-    reason: string;
-    kind: RefusalKind;
-    impact: string;
-    guidance: string;
-    /** Refusals of this reason on this session since the last `cello_dismiss` — which DELETES the
-     *  notice row, restarting this counter at 1. Zero dismissals and it equals `timesTotal`. */
-    timesSinceDismissed: number;
-    /**
-     * Every refusal of this reason on this session, from the first one, untouched by dismissal.
-     *
-     * OMITTED, never guessed, when the notice is served from the in-memory fallback — that path
-     * exists precisely because the database write failed, so no durable total was ever written, and
-     * reporting the smaller number twice would put the original lie back with two names on it.
-     *
-     * MUTUALLY EXCLUSIVE with `timesTotalAtLeast`: a figure and a floor are different claims and
-     * must not share a name.
-     */
-    timesTotal?: number;
-    /**
-     * A LOWER BOUND on the lifetime count, for a row SEEDED at upgrade from a notice that already
-     * existed — review F1c.
-     *
-     * The seed is that notice's `count`, which is refusals since the last dismissal, so the true
-     * figure is at least this and may be far more: on the machine this unit was written for, the
-     * notice read 58 and the log held 232,056 refusal events. Reporting 58 as `timesTotal` would be
-     * the original defect with the new name on it. "At least 58" is true; "58" is not.
-     */
-    timesTotalAtLeast?: number;
-    repeat?: boolean;
-}
-/**
- * DOD-M15-SEALWIRE-1 bullet 5, SENT half — our own authorship proof for a message we sent.
- *
- * Deliberately the SAME shape as the received half's `verifiedAuthorship`, because the transcript
- * column pair is the same and a second shape would invite a second meaning. What differs is the
- * ATTRIBUTION the row records: a sent row is `self_authored` (we PRODUCED this signature), never
- * `verified_signature` (we CHECKED someone else's). Same bytes, different claim.
- */
-export interface SentAuthorship {
-    senderPubkey: Uint8Array;
-    senderSig: Uint8Array;
-}
-/**
- * ─── 033-ACKEMIT: the three things that can be wrong with an ACKNOWLEDGEMENT ─────────────────────
- *
- * All three are `unusable` — the message is refused and the session lives. None of them is an
- * identity fault: by the time any is returned the signature has verified, the signer IS this
- * session's counterparty, and the claim is about this content in this conversation. What is wrong is
- * what the claim says the sender had SEEN.
- *
- * They are three names and not one because the operator's next move differs for each, and because an
- * investigator who cannot tell "your counterparty is on an older build" from "your counterparty
- * acknowledged something you never sent" is looking at the wrong half of the problem.
- *
- * ⚠️ **NAME WHAT WAS OBSERVED, NEVER AN INFERRED CONCLUSION** (`DOD-M15-ERRSTRING-1`). Not one of
- * these says "peer is malicious" — a mismatch is equally what a genuine software fault on the other
- * side looks like, and an error that names a party the code did not check is this milestone's
- * founding defect.
- */
-/** A v1 claim: it carries no `last_seen_hash`, so it asserts a POSITION and no content at all. */
-declare const AUTHORSHIP_ACK_HASH_ABSENT = "ack_hash_absent";
-/** The hash names content this side does not hold at the position the claim names. */
-declare const AUTHORSHIP_ACK_HASH_MISMATCH = "ack_hash_mismatch";
-/** The hash names content this side has never held — not in the tree, and not held pending a gap. */
-declare const AUTHORSHIP_ACK_HASH_UNKNOWN = "ack_hash_unknown_content";
-/**
- * The set that routes an `unusable` reason to the acknowledgement wording rather than the generic
- * one. A SET, not a string prefix test: a name-shaped check would silently adopt any future reason
- * someone happens to call `ack_*`, and give it a sentence written for these four.
- */
-export type AckHashReason = typeof AUTHORSHIP_ACK_HASH_ABSENT | typeof AUTHORSHIP_ACK_HASH_MISMATCH | typeof AUTHORSHIP_ACK_HASH_UNKNOWN;
-/**
- * One row of a session's durable transcript as a reader sees it.
- *
- * DOD-M15-REFUSEDEVIDENCE-1: `'quarantined'` is a message that was received and REFUSED. Its `text`
- * is the withholding statement, never the payload — the storage is complete and only the READ is
- * redacted. `withheld` is present exactly on those rows so a caller can style or skip them without
- * string-matching the statement.
+ * One row in an agent's witness-alert list — DOD-M15-CORROBORATE-1 review F1. Deduped on
+ * `(witness relay, session)`, so a repeated observation raises `occurrences` rather than taking
+ * another slot in a bounded list.
  */
-export interface TranscriptEntry {
-    sequence: number;
-    direction: "sent" | "received" | "quarantined";
-    text: string;
-    createdAt: number;
-    refusalReason?: string;
-    withheld?: true;
-    /** Named to end in `guidance` on purpose: that suffix is what the vocabulary layer rewrites, so a
-     *  CLI reader is told `cello quarantined` and an MCP reader `cello_quarantined`. */
-    withheld_guidance?: string;
-}
-/** A retained refused message, read back whole. The payload is handed out FRAMED, never raw. */
-export interface QuarantinedRecord {
-    sequence: number;
-    reason: string;
-    content: Uint8Array;
-    senderPubkeyHex: string | null;
-    senderSig: Uint8Array | null;
-    attribution: string;
-    createdAt: number;
-}
+import { type AbandonNoticeResult, type CreateSessionResult, type ISessionNodeFactory, type ParkedDrainReason, type QuarantinedRecord, type ReceivedContentEntry, type RefusalNotice, type RelayConnectParams, type SentAuthorship, type SessionImpairment, type TranscriptEntry, type WitnessAlertNotice } from "./session-node-types.js";
+export { ABUSE_MAX_SESSIONS_PER_UNKNOWN_SENDER, ABUSE_MAX_SESSION_RECEIVED_BYTES, ABUSE_MAX_UNKNOWN_SESSIONS_GLOBAL, type AbandonNoticeResult, type AckHashReason, CAP_INTERRUPTED_TTL_MS, type ISessionNodeFactory, LEAF_FETCH_GRACE_MS, MAX_TERMINAL_REFUSALS_PER_SESSION, type ParkedDrainReason, type QuarantinedRecord, RELAY_QUARANTINE_MS, REVIVAL_BOUND_SWEEP_MS, REVIVAL_WINDOW_MS, REVIVE_RESERVATION_CANDIDATES, REVIVE_RESERVATION_TIMEOUT_MS, type RefusalNotice, type RelayConnectParams, SR_RESERVATION_MAX_RETRIES, type SentAuthorship, type SessionImpairment, type SessionNodeConfig, TERMINAL_REFUSAL_READ_RETRY_MS, TERMINAL_REFUSAL_REASONS, type TranscriptEntry, type WitnessAlertNotice, } from "./session-node-types.js";
 export declare class SessionNodeManager {
     #private;
     setDetachedRelayClientBuilder(fn: (agentName: string, relayPeerId: string, relayAddrs: string[], stores: {
         receiptStore?: RelayReceiptStore;
         sealLeafStore?: SessionSealLeafStore;
+        ownChainStore?: SessionOwnChainStore;
         onlineToken: () => Uint8Array | undefined;
     }) => AgentRelayClient | undefined): void;
     /**
-     * Record what one relay says it saw on one of this agent's sessions, for the operator to read.
+     * Why this agent's standing receiver could not hold a reservation, in words the person running it
+     * can act on — or null when the last attempt succeeded or none has been made.
      *
-     * ⚠️ **IT DOES NOT FREEZE THE SESSION, AND THAT IS THE DESIGN.** A client freezing on its OWN
-     * verification is safe: it limits only what that client trusts. Freezing on a REMOTE party's
-     * say-so hands any single relay the power to end any conversation it carries, and to write an
-     * accusatory record about a counterparty who did nothing. The identity freeze stays where it is —
-     * on this daemon's own check of an inbound frame — and this surfaces a second, independent
-     * observation next to it. One witness reports; it does not rule.
+     * This is the surface DoD clause 7 is about: the assertion that matters is what the CLIENT can
+     * show someone, not what the relay wrote in its own log.
      */
+    getStandingReceiverRefusal(agentName: string): (RelayAuthRefusal & {
+        relayPeerId: string;
+    }) | null;
+    /** ─── DELEGATORS — the standing-receiver API other files call ───────────────────────── */
+    standingReceiverAbsenceReason(agentName: string): "daemon_shutting_down" | "standing_receiver_creating" | "agent_offline" | "no_standing_receiver";
+    getStandingReceiverInfo(agentName: string): {
+        peerId: string;
+        addrs: string[];
+    } | null;
+    getStandingReceiverReady(agentName?: string): boolean;
+    getStandingReceiverNode(agentName?: string): CelloNode | null;
+    getStandingReceiverReachability(agentName: string): "reserved" | "retrying" | "unreachable" | "absent";
+    getStandingReceiverAutoNat(): IAutoNatService | null;
+    getStandingReceiverAllowedPeer(agentName: string): string | null;
+    admitOfferedDialer(agentName: string, initiatorSessionPeerId: string, sessionIdHex: string): "narrowed" | "no_receiver" | "no_peer_named";
+    getOfferedDialer(agentName: string, sessionIdHex: string): string | null;
+    clearOfferedDialer(agentName: string, sessionIdHex: string): void;
+    revokeOfferedDialer(agentName: string, sessionIdHex: string, offeredPeerId: string | null): void;
+    /** ─── DELEGATORS — the leaf-record API other files call ─────────────────────────────── */
+    recordSessionGenesis(agentName: string, sessionId: string, participantA: Uint8Array, participantB: Uint8Array, sessionTimestamp: number): void;
+    setSessionGenesisForTest(agentName: string, sessionId: string, genesis: Uint8Array): void;
+    recordCertifiedLeafSet(agentName: string, sessionId: string, signedLeaves: readonly SealFrontierLeaf[], sealedRootHex: string, correlationId?: string): boolean;
+    noteCertifiedLeafSetUnavailable(agentName: string, sessionId: string, state: "not_carried_absent_party" | "not_carried_present_party", detail: string): void;
+    getCertifiedLeafSet(agentName: string, sessionId: string): string[] | null;
+    getCertifiedLeafSetState(agentName: string, sessionId: string): {
+        state: string;
+        detail: string | null;
+    } | null;
+    /** ─── DELEGATORS — the held-content seams other files call ──────────────────────────── */
+    holdOwnLeafForTest(agentName: string, sessionId: string, canonicalSeq: number, contentHashHex: string): void;
+    /** ─── DELEGATORS — the witness-alert API other files call ────────────────────────────── */
     recordRelayWitnessAlert(agentName: string, alert: RelayWitnessAlert): void;
-    /** The witness alerts an agent has been told about, oldest first, one row per witness+session. */
     getWitnessAlerts(agentName: string): ReadonlyArray<WitnessAlertNotice>;
-    /** Whether this agent's alert list hit its cap, so the inbox can say the list is incomplete. */
     witnessAlertsTruncated(agentName: string): boolean;
+    /** ─── DELEGATORS — the liveness API other files call, unchanged by the split ───────────── */
+    getSessionLiveness(agentName: string, sessionId: string): "alive" | "impaired" | "gone" | "unknown";
+    getSessionImpairment(agentName: string, sessionId: string): SessionImpairment | null;
+    markSessionLivenessForTest(agentName: string, sessionId: string, state: "alive" | "impaired" | "gone"): void;
+    /** ─── DELEGATORS — the test seams other files call, unchanged by the split ─────────────── */
+    mintSessionEphemeralForTest(agentName: string, sessionId: string): void;
+    sessionEphemeralPublicForTest(agentName: string, sessionId: string): Uint8Array | null;
+    setSessionEphemeralForTest(agentName: string, sessionId: string, ephemeral: SessionEphemeral): void;
+    setSessionContentKeyForTest(agentName: string, sessionId: string, key: Uint8Array): void;
+    forgetSessionContentKeyForTest(agentName: string, sessionId: string): void;
+    signOwnEphemeralForTest(agentName: string, sessionId: string): Promise<{
+        ephemeralPublic: Uint8Array;
+        signature: Uint8Array;
+    } | null>;
+    handleEphemeralFrameForTest(agentName: string, sessionId: string, frame: {
+        ephemeralPublic?: Uint8Array;
+        signature?: Uint8Array;
+    }, correlationId?: string): Promise<void>;
+    /** ─── DELEGATORS — the refusal-notice API other files call, unchanged by the split ────────── */
+    noteContentRefusal(agentName: string, sessionId: string, reason: string, detail: {
+        kind: RefusalKind;
+        impact: string;
+        guidance: string;
+    }): void;
+    takeContentRefusals(agentName: string, sessionId: string, consumerId: string): Array<Omit<RefusalNotice, "sessionId">>;
+    dismissContentRefusals(agentName: string, sessionId: string): number;
+    takeAgentContentRefusals(agentName: string, consumerId: string): {
+        notices: RefusalNotice[];
+        truncated: boolean;
+    };
     /**
-     * Review F7: a relay sent a witness alert this build could not read or could not verify.
+     * ─── DELEGATORS — the query API other files call, unchanged by the split ────────────────────
+     */
+    listExpiredUnrevivableSessions(nowMs: number, windowMs: number): Array<{
+        agentName: string;
+        sessionId: string;
+        cause: string | null;
+    }>;
+    listRestartOrphanedSessions(): Array<{
+        agentName: string;
+        sessionId: string;
+        messageCount: number;
+        status: "interrupted" | "seal_interrupted_pending";
+    }>;
+    readQuarantined(agentName: string, sessionId: string, sequence?: number): QuarantinedRecord[];
+    getPinnedCounterpartyPrimary(agentName: string, counterpartyPubkeyHex: string): string | null;
+    recordSealedAnnex(agentName: string, sessionId: string, contentHashHex: string, content: Uint8Array, senderPubkeyHex: string | null): boolean;
+    findNextReceivedAfter(agentName: string, sessionId: string, afterSeq: number): {
+        sequence: number;
+        text: string;
+    } | null;
+    getSealInterruptedArtifacts(agentName: string, sessionId: string): {
+        role: string;
+        ownLeaf: unknown;
+        counterpartyLeaf: unknown;
+        merkleRoot: string;
+        nonce: string;
+    } | null;
+    getSessionsByStatus(status: "active" | "sealed" | "interrupted"): SessionRecord[];
+    recordRefusedSession(agentName: string, sessionId: string, reason: string): void;
+    getAgentRelayEndpoints(agentName: string): Array<{
+        relayPeerId: string;
+        relayAddrs: string[];
+    }>;
+    countActiveSessionsFromUnknownSenders(agentName: string): number;
+    getSealCertificate(agentName: string, sessionId: string): {
+        sealed_root: string;
+        legibility: unknown;
+    } | null;
+    setSessionName(agentName: string, sessionId: string, sessionName: string | null): boolean;
+    getPersistedRelayEndpoint(agentName: string, sessionId: string): {
+        relayPeerId: string;
+        relayAddrs: string[];
+    } | null;
+    markRestartSealGaveUp(agentName: string, sessionId: string, reason: string): void;
+    dismissSession(agentName: string, sessionId: string): {
+        ok: true;
+    } | {
+        ok: false;
+        reason: string;
+    };
+    agentNameForId(agentId: string): string | null;
+    getRenameNotices(agentName: string): Array<{
+        pubkey: string;
+        offered_name: string;
+        noticed_at: number;
+        moniker: string | null;
+    }>;
+    sessionsConsumingCap(agentName: string, counterpartyPubkey: string, limit?: number): string[];
+    advanceLastDeliveredSeq(agentName: string, sessionId: string, seq: number): void;
+    countActiveSessionsForCounterparty(agentName: string, counterpartyPubkey: string): number;
+    getSessionRecord(agentName: string, sessionId: string): SessionRecord | null;
+    hasDatabase(): boolean;
+    readSealedAnnex(agentName: string, sessionId?: string): Array<{
+        session_id: string;
+        content_hash: string;
+        sender_pubkey: string | null;
+        text: string;
+        arrived_at: number;
+    }>;
+    counterpartyAbandonedAt(agentName: string, sessionId: string): number | null;
+    getSealedRootHex(agentName: string, sessionId: string): string | null;
+    getLastDeliveredSeq(agentName: string, sessionId: string): number;
+    markSessionsInterruptedByLocalShutdownForTest(): void;
+    wasSessionRefused(agentName: string, sessionId: string): boolean;
+    countReceivedMessages(agentName: string, sessionId: string): number;
+    markInterruptedByCounterpartyForTest(agentName: string, sessionId: string): void;
+    recordSealCertificate(agentName: string, sessionId: string, sealedRootHex: string, legibilityJson: string): void;
+    recordCounterpartyPrimary(agentName: string, sessionId: string, primaryPubkeyHex: string): void;
+    /**
+     * ─── DELEGATORS — the salt API other files call, unchanged by the split ─────────────────────
      *
-     * Recorded so a version skew that silently kills the witness layer is visible to the operator
-     * instead of living only in a log file. Carries no session and no party by construction.
+     * `daemon.ts` and `session-content-handlers.ts` still say `manager.contentHashForSession(...)`.
+     * Keeping the surface identical is what lets the suite stand as evidence that this was a
+     * restructure and not a rewrite.
      */
+    setSaltContributionForTest(agentName: string, sessionId: string, contribution: Uint8Array): void;
+    forgetSaltContributionForTest(agentName: string, sessionId: string): void;
+    contentHashForSession(agentName: string, sessionId: string, content: Uint8Array): Promise<{
+        hash: Uint8Array;
+        alg: ContentHashAlg;
+    }>;
+    abandonUnsaltedHash(agentName: string, sessionId: string): void;
+    isContentSaltActive(agentName: string, sessionId: string): boolean;
+    markSaltPendingForTest(agentName: string, sessionId: string): void;
+    saltForHashingForTest(agentName: string, sessionId: string): Promise<{
+        salt: Uint8Array | null;
+        reason?: string;
+    }>;
+    /**
+     * ─── DELEGATORS — the mailbox API other files call, unchanged by the split ───────────────────
+     *
+     * `content-park.ts` and `daemon.ts` still say `manager.recoverParkedEntry(...)` and
+     * `manager.setContentParkHook(...)`. Keeping the surface identical is what lets the full suite
+     * stand as evidence that this was a move: a caller that had to change would mean the contract
+     * moved with it.
+     */
+    injectParkFault(count: number, cause?: string): number;
+    getParkFaultRemaining(): number;
+    setContentParkHook(fn: (args: {
+        agentName: string;
+        sessionId: string;
+        recipientPubkeyHex: string;
+        relayPeerId: string;
+        relayAddrs: readonly string[];
+        contentHashHex: string;
+        content: Uint8Array;
+        structure1Cbor?: Uint8Array;
+        structure2Cbor?: Uint8Array;
+        structure1Signature?: Uint8Array;
+        leafKind?: number;
+        contentHashAlg: string | undefined;
+    }) => Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        reason: string;
+        cause?: string;
+        retryAfterMs?: number;
+    }>): void;
+    setParkedDrainHook(fn: (agentName: string, reason: ParkedDrainReason) => void): void;
+    recoverOwnSealCtrlLeafForTest(agentName: string, sessionId: string): {
+        reportedRootHex: string;
+        sequenceNumber: number;
+    } | "none" | "unknown";
+    recoverParkedEntry(agentName: string, sessionId: string, recipientPubkey: Uint8Array, unsealed: Uint8Array, contentHash: Uint8Array, correlationId?: string): Promise<{
+        ok: true;
+        leafIndex: number;
+        sequenceNumber: number;
+        held?: boolean;
+        appendedCount?: number;
+        screenedOut?: boolean;
+    } | {
+        ok: false;
+        reason: string;
+    }>;
+    /**
+     * ─── DELEGATORS — the class API is unchanged by the split, deliberately ──────────────────────
+     *
+     * Every method below moved into `session-records.ts` with its implementation and its comments.
+     * These one-liners exist so that no CALLER had to change: `contact-handlers.ts`, the IPC surface
+     * and the tests all still say `manager.getTier(...)`. That is what lets the full suite stand as
+     * the evidence that this was a move and not a rewrite — a test that had to change would have
+     * meant behaviour moved (Rule B).
+     *
+     * They are the price of the split and they are the cheap half: one line each, no logic, and the
+     * prose that explains each rule lives beside the code that enforces it.
+     */
+    isContact(agentName: string, pubkey: string): boolean;
+    getTier(agentName: string, pubkey: string): number;
+    resolveTierBound(agentName: string, tier: number, field: "max_sessions" | "max_bytes"): number;
+    addContact(agentName: string, pubkey: string, moniker?: string | null, provenance?: string | null, tier?: number): void;
+    setContactMoniker(agentName: string, pubkey: string, moniker: string | null): boolean;
+    setContactSignalPref(agentName: string, pubkey: string, signalHash: string, present: boolean | null): void;
+    getContactSignalPrefs(agentName: string, pubkey: string): Map<string, boolean>;
+    setContactAwayMessage(agentName: string, pubkey: string, message: string | null): boolean;
+    setContactTier(agentName: string, pubkey: string, tier: number): boolean;
+    recordOfferedMoniker(agentName: string, pubkey: string, offered: string): void;
+    removeContact(agentName: string, pubkey: string): boolean;
+    getContactMoniker(agentName: string, pubkey: string): string | null;
+    listContacts(agentName: string): Array<{
+        pubkey: string;
+        added_at: number;
+        moniker: string | null;
+        tier: number | null;
+        provenance: string | null;
+        sealed_count: number;
+        last_spoke: number | null;
+    }>;
+    clearRenameNotice(agentName: string, pubkey: string): void;
+    clearPinnedCounterpartyPrimary(agentName: string, counterpartyPubkeyHex: string): number;
+    getTelegramSettings(): {
+        botToken: string;
+        allowlistedChatId: string;
+    } | null;
+    setTelegramSettings(botToken: string, allowlistedChatId: string): void;
+    getSetting(agentName: string, key: string): string | null;
+    deleteSetting(agentName: string, key: string): boolean;
+    setSetting(agentName: string, key: string, value: string): void;
+    getAllSettings(agentName: string): Array<{
+        key: string;
+        value: string;
+    }>;
     recordRelayWitnessUnreadable(agentName: string, relayPeerId: string, why: string): void;
-    /** Relays whose witness alerts this build could not read, for the agent's inbox. */
     getWitnessUnreadable(agentName: string): ReadonlyArray<{
         relayPeerId: string;
         why: string;
         count: number;
     }>;
-    /**
-     * Why this agent's standing receiver could not hold a reservation, in words the person running it
-     * can act on — or null when the last attempt succeeded or none has been made.
-     *
-     * This is the surface DoD clause 7 is about: the assertion that matters is what the CLIENT can
-     * show someone, not what the relay wrote in its own log.
-     */
-    getStandingReceiverRefusal(agentName: string): (RelayAuthRefusal & {
-        relayPeerId: string;
-    }) | null;
-    /**
-     * Record that this session's tree and the relay's counter have provably parted.
-     *
-     * Idempotent, and deliberately does NOT touch `updated_at`: that column drives the inbox's
-     * last-spoke ordering, and divergence is not activity.
-     */
+    recordTranscriptMessage(agentName: string, sessionId: string, sequence: number, direction: "sent" | "received" | "quarantined", plaintext: Uint8Array, correlationId?: string, authorship?: {
+        senderPubkey: Uint8Array;
+        senderSig: Uint8Array;
+    }, quarantineReason?: string, senderPubkeyHexOverride?: string | null): boolean;
+    readTranscript(agentName: string, sessionId: string): {
+        messages: TranscriptEntry[];
+        undecryptable: number;
+    };
+    getUnreadSummary(agentName: string): Array<{
+        session_id: string;
+        unread_count: number;
+        last_seq: number;
+    }>;
+    getEndedUnread(agentName: string): Array<{
+        session_id: string;
+        unread_count: number;
+        last_seq: number;
+        status: string;
+    }>;
+    getUnreadReceivedCount(agentName: string, sessionId: string): number;
     markSessionDiverged(agentName: string, sessionId: string): void;
-    /** Whether this session has provably parted from the relay's ordering. */
     isSessionDiverged(agentName: string, sessionId: string): boolean;
-    /** Arm the park-deposit fault. Returns the count now armed. */
-    injectParkFault(count: number, cause?: string): number;
     /** Arm the direct-send fault — makes the next N sends take the dial-failure path. */
     injectSendFault(count: number): number;
     /** DOD-M12B-ACK-1: arm the delivery-ACK write fault — the sibling of injectSendFault for the
@@ -534,9 +353,6 @@ export declare class SessionNodeManager {
     /** DOD-M12B-REDIAL-1: arm the connection-loss fault — the next N direct sends find no open
      *  connection, exactly as they do after any blip. See #connectionLossRemaining. */
     injectConnectionLoss(count: number): number;
-    getSendFaultRemaining(): number;
-    /** Remaining armed park faults — so a test can assert the fault was actually consumed. */
-    getParkFaultRemaining(): number;
     constructor(opts: {
         factory: ISessionNodeFactory;
         logger: Logger;
@@ -607,60 +423,6 @@ export declare class SessionNodeManager {
      * composition root (daemon.ts) after the RetryQueue exists.
      */
     setSessionTerminalHook(hook: (sessionId: string, terminalStatus: "sealed" | "abandoned") => void): void;
-    /**
-     * MSG-001-3b (2b): inject the live content-park deposit (seal + ContentParkClient.deposit).
-     * Injected by the composition root (daemon.ts). When absent, a not-confirmed send still records
-     * the durable awaiting entry (crash backstop) but does not deposit live.
-     * DOD-LEAVEMSG-1 (cello-unit-reviewer HIGH fix): the hook returns a TYPED result — `{ok:true}` or
-     * `{ok:false, reason}` — mirroring RetryQueue's ParkFn contract. It must NEVER resolve `{ok:true}`
-     * merely because it didn't throw: the production hook's own failure branches (standing receiver
-     * unavailable, relay explicitly rejects the deposit) log-and-return without throwing, and a
-     * throw-only contract would silently report those as success — the exact "system lies about its
-     * own health" bug the reviewer caught (a park that never happened reported to the operator as
-     * "dispatched to relay," with the durable retry_queue backstop skipped because sendContent's own
-     * caller only enqueues on an honest {ok:false}).
-     */
-    setContentParkHook(fn: (args: {
-        agentName: string;
-        sessionId: string;
-        recipientPubkeyHex: string;
-        relayPeerId: string;
-        relayAddrs: readonly string[];
-        contentHashHex: string;
-        content: Uint8Array;
-        structure1Cbor?: Uint8Array;
-        structure2Cbor?: Uint8Array;
-        structure1Signature?: Uint8Array;
-        leafKind?: number;
-        contentHashAlg: string | undefined;
-    }) => Promise<{
-        ok: true;
-    } | {
-        ok: false;
-        reason: string;
-        cause?: string;
-        retryAfterMs?: number;
-    }>): void;
-    /**
-     * DOD-PARK-DRAIN-1: inject the parked-mailbox drain (daemon.ts → contentPark.autoRecoverForAgent).
-     *
-     * The manager owns the two events that mean "content may be waiting for this agent on a relay":
-     * a standing receiver was (re)built, and the slow backstop sweep. It does not own the drain
-     * itself — that needs the agent's key provider and the inbound ingest funnel. So it calls out.
-     *
-     * Injected by the composition root, not passed to the constructor: the manager is built long
-     * before the content park exists (content-park.ts documents why that ordering is load-bearing).
-     */
-    setParkedDrainHook(fn: (agentName: string, reason: ParkedDrainReason) => void): void;
-    /**
-     * DOD-PARK-DRAIN-1 (review F6): why there is no standing-receiver node to dial from — named
-     * precisely, because `standing_receiver_unavailable` is the exit-point label that stood in for
-     * four different causes and misnamed this very incident 102 times.
-     *
-     * Only meaningful once `getStandingReceiverNode()` has returned null, which means NO agent on
-     * this daemon has a ready receiver — the dial node is not agent-scoped.
-     */
-    standingReceiverAbsenceReason(agentName: string): "daemon_shutting_down" | "standing_receiver_creating" | "agent_offline" | "no_standing_receiver";
     initialize(): Promise<void>;
     /**
      * Get the underlying DatabaseSync handle.
@@ -673,16 +435,6 @@ export declare class SessionNodeManager {
      * encrypted DB file.
      */
     getDb(): DaemonDatabase;
-    /**
-     * DOD-M15-RELAYONLY-1: is the settings store readable RIGHT NOW?
-     *
-     * ⚠️ Exists because `getSetting` cannot answer it. That method returns `null` for BOTH "the key is
-     * unset" and "there is no database", and a security setting must tell those apart: unset-means-off
-     * is correct, db-gone-means-off publishes the operator's real address during the shutdown window.
-     * `getDb()` cannot stand in either — it THROWS when there is no database, which on a catch-less
-     * ceremony path is worse than the wrong answer.
-     */
-    hasDatabase(): boolean;
     /**
      * RELAYSIG-1: the durably-stored, signature-verified relay ordering-record receipts for an agent
      * (optionally a single session). Empty when no receipts have been recorded yet. Read-only.
@@ -753,137 +505,6 @@ export declare class SessionNodeManager {
      */
     countersignedThroughSeqFromCarry(agentPubkeyHex: string, sessionIdHex: string): number | null;
     getSealCarry(agentPubkeyHex: string, sessionIdHex: string): SealCarryLeaf[];
-    /**
-     * DOD-LOG-1 / PERSIST-002 (AC-010): append one readable message to the durable transcript, keyed
-     * by the canonical leaf `sequence` so it joins to the committed hash chain. The blob is stored as
-     * plaintext bytes: the whole DB is SQLCipher-encrypted at rest, so there is no per-column cipher.
-     * Idempotent on replay (INSERT OR IGNORE). Never throws into the caller's content path — but it
-     * REPORTS: returns false when the row did not land, so a caller for whom the row is a delivery
-     * precondition can fail instead of proceeding (review F2). Before Tier 1 the return value would
-     * have been pointless, because `cello_receive` served content from the in-memory buffer and the
-     * lost row only cost the unread count. Delivery reads the transcript now, so a swallowed received
-     * row is TOTAL content loss and the caller has to know.
-     */
-    recordTranscriptMessage(agentName: string, sessionId: string, sequence: number, 
-    /**
-     * DOD-M15-REFUSEDEVIDENCE-1 adds `'quarantined'` — received and REFUSED, kept as evidence and
-     * never delivered. It goes through THIS writer rather than a second one so that the attribution
-     * rule, the blob handling and the write-failure logging cannot drift between a delivered message
-     * and a refused one. One store, one writer.
-     */
-    direction: "sent" | "received" | "quarantined", plaintext: Uint8Array, correlationId?: string, 
-    /**
-     * DOD-M15-SEALWIRE-1 bullet 5: the VERIFIED authorship proof, when there is one.
-     *
-     * Optional because there legitimately is not always one — the ordering decode can fail SOFT and
-     * the message is still ingested via hash-dedup. Optional is NOT the same as unremarked: absence
-     * is written into the row as `attribution = 'local_session_state'`, so a reader can tell a row
-     * whose author was proven from one whose author was assumed. That distinction is the bullet.
-     */
-    authorship?: {
-        senderPubkey: Uint8Array;
-        senderSig: Uint8Array;
-    }, 
-    /** Required on a `'quarantined'` row and meaningless on any other: WHY it was refused. */
-    quarantineReason?: string, 
-    /**
-     * DOD-M15-REFUSEDEVIDENCE-1: the sender's key when there is one but no verified signature to go
-     * with it. A refused frame often has an identified sender and an unusable proof — a tampered
-     * message is still FROM someone — and dropping the key because the signature failed would throw
-     * away the half of the attribution that survived.
-     */
-    senderPubkeyHexOverride?: string | null): boolean;
-    /**
-     * DOD-LOG-1: read a session's durable transcript back (after a restart), decrypted and ordered by
-     * canonical sequence then direction. A blob that fails to decrypt (tamper/wrong key) is skipped
-     * with a loud log rather than crashing the read.
-     */
-    readTranscript(agentName: string, sessionId: string): {
-        messages: TranscriptEntry[];
-        undecryptable: number;
-    };
-    /**
-     * DOD-COATTEND-1 (review F5) — the single next RECEIVED message after `afterSeq`, or null.
-     *
-     * The delivery path asks this question inside a 20 ms poll, so it is asked ~47 times a second per
-     * blocked connection — ~1,400 times over a default 30 s receive. Answering it with
-     * `readTranscript()` meant, every single time: SELECT every row of the session with no predicate
-     * and no limit, `TextDecoder().decode()` every blob in it, build the array, then `.find()` one
-     * row and discard the rest. On a 200-message session with three co-attending connections blocking
-     * — which is the M8D use case, not a worst case — that is tens of thousands of blob decodes per
-     * second on the daemon's single synchronous SQLCipher handle, contending with the write path.
-     *
-     * The predicate belongs in SQL. This is O(1) on the existing (agent_id, session_id, sequence)
-     * key and decodes exactly the one blob it returns.
-     */
-    findNextReceivedAfter(agentName: string, sessionId: string, afterSeq: number): {
-        sequence: number;
-        text: string;
-    } | null;
-    /** The highest RECEIVED transcript sequence delivered to the operator for (agent, session).
-     *  -1 when nothing has been delivered yet (so a seq-0 message reads as unread). */
-    getLastDeliveredSeq(agentName: string, sessionId: string): number;
-    /** Advance the read watermark (delivery marks read). MONOTONIC — never lowers, so a replayed or
-     *  out-of-order cello_receive cannot un-read already-read messages. */
-    advanceLastDeliveredSeq(agentName: string, sessionId: string, seq: number): void;
-    /** INBOX-1 (N2): per-session unread summary for an agent — sessions that have RECEIVED transcript
-     *  messages beyond the read watermark, excluding terminal sessions (sealed, abandoned,
-     *  seal_interrupted_pending) which belong in getEndedUnread instead.
-     *  Sessions with no sessions row are treated as non-terminal (LEFT JOIN).
-     *  Content-free (counts + ids + last seq, never message text); a COUNT/MAX query, no decrypt. */
-    getUnreadSummary(agentName: string): Array<{
-        session_id: string;
-        unread_count: number;
-        last_seq: number;
-    }>;
-    /** DOD-SEALED-INBOX-1: terminal sessions with unread received messages that have not been
-     *  dismissed. These are answering-machine style messages left in an ENDED session — the operator
-     *  can read them via cello_transcript but cannot advance the watermark via cello_receive.
-     *  Only returned when read_at IS NULL (not yet dismissed).
-     *
-     *  DOD-SEALED-INBOX-2: named `getEndedUnread`, not `getSealedUnread`, and it SELECTS `s.status`.
-     *  All four #TERMINAL_STATUSES belong here — that part was always right — but only `sealed` is
-     *  NOTARIZED. The old name and the caller's hardcoded `session_state: "sealed"` asserted a
-     *  cryptographic receipt for `abandoned`, `interrupted` and `seal_interrupted_pending` sessions,
-     *  which have none. Callers must render the row's own status; there is nothing to infer from
-     *  membership in this list beyond "it ended". */
-    getEndedUnread(agentName: string): Array<{
-        session_id: string;
-        unread_count: number;
-        last_seq: number;
-        status: string;
-    }>;
-    /** DOD-SEALED-INBOX-1: mark a terminal session as dismissed — sets read_at to now.
-     *  Only valid for terminal sessions; active/interrupted sessions return session_not_terminal. */
-    dismissSession(agentName: string, sessionId: string): {
-        ok: true;
-    } | {
-        ok: false;
-        reason: string;
-    };
-    /**
-     * DOD-CURSOR-DURABLE-1: how many RECEIVED messages in THIS session the agent has not read —
-     * the durable half of the read-before-write gate. Same predicate as getUnreadSummary (shared
-     * constant above), scoped to one session.
-     *
-     * This is DURABLE and PER-AGENT, where the send gate's other authority (the connection cursor) is
-     * in-memory and per-connection. It is what lets a stateless client — the `cello` CLI, one process
-     * per command — prove it has read the counterparty, which a dead socket's cursor never can.
-     *
-     * FAILS CLOSED: an uninitialized DB returns a positive count (treated as "unread"), never 0. A 0
-     * here unblocks a send; guessing 0 from a broken DB would silently defeat the gate.
-     */
-    getUnreadReceivedCount(agentName: string, sessionId: string): number;
-    /** M8C-CONTACT-1: is this pubkey a known contact of this agent? */
-    isContact(agentName: string, pubkey: string): boolean;
-    /** DOD-TIER-1: the reachability tier for a counterparty of this agent. The RESULT is total — an
-     *  absent contact row (undefined), a NULL `tier`, or a corrupt out-of-range value all resolve to
-     *  UNKNOWN via `normalizeTier`, so the return is always in 0..4 and guards the JS `null >= 0`/`0 ||
-     *  1`/`grid[99]` traps. It is a SECURITY read (Step 2 gates inbound bounds on it), so it FAILS
-     *  CLOSED, never open: an uninitialized DB throws (same contract as addContact) rather than
-     *  silently returning UNKNOWN and admitting a BLOCKED sender; an unresolvable/retired agent name
-     *  throws via #requireAgentId. Both are invariant violations a caller must surface, not swallow. */
-    getTier(agentName: string, pubkey: string): number;
     /** DOD-TIER-4: the DISPLAY/relationship check — is this counterparty a genuine contact (KNOWN or
      *  above)? Replaces the old binary `isContact` for behaviour that keyed on "we have a relationship"
      *  (e.g. the away-response wording). An UNKNOWN-tier contact (a mere row) is NOT known. */
@@ -893,127 +514,12 @@ export declare class SessionNodeManager {
      *  relay mailbox (LEAVEMSG-1), out of scope for this unit; defined here as the seam. Being merely
      *  KNOWN is NOT enough to auto-accept — whitelisting is the deliberate `cello_contact_set_tier` act. */
     isAutoAccept(agentName: string, pubkey: string): boolean;
-    /** DOD-TIER-BOUNDS-SETTINGS: the effective bound for (agent, tier, field) — a per-agent SETTINGS
-     *  override if one is set and valid, else the hardcoded grid default (DEFAULT_TIER_BOUNDS). With no
-     *  settings this is byte-identical to Step 2 (the daemon runs on defaults alone). A stored value
-     *  that is somehow non-positive/non-finite (should be impossible — validated at SET time) falls back
-     *  to the grid default rather than removing the bound (INV-TIER-BOUND, defensive). BLOCKED is never
-     *  settable — it always returns the fixed grid value (0). */
-    resolveTierBound(agentName: string, tier: number, field: "max_sessions" | "max_bytes"): number;
-    /** M8C-CONTACT-1: pin a contact at add time — idempotent (re-adding an existing contact is a
-     *  no-op, never refreshes added_at; identity does not get re-resolved). MONIKER-3 AC2: an
-     *  optional pet name; a NEW non-null moniker on re-add updates it, absence leaves it untouched.
-     *  THROWS on an invalid moniker — callers validate first; this is the can-never-be-stored
-     *  backstop (same contract as DbIdentityStore.setMoniker).
-     *
-     *  DOD-TIER-1/4: a NEW row is stamped `tier` (never NULL) and an optional `provenance`
-     *  ('accepted' | 'initiated' | null). The `tier` defaults to the least-privilege UNKNOWN floor —
-     *  a caller GRANTS trust by passing a higher tier explicitly. Every production creation path is a
-     *  deliberate operator action and passes KNOWN (initiate, engage/reply, explicit cello_contact_add
-     *  — DEC-AB-1). INSERT OR IGNORE means an EXISTING contact is untouched — tier and provenance pin
-     *  at first add, exactly as `added_at`/`moniker` already do; re-adding never downgrades a contact
-     *  the operator has since promoted. Raising the tier later is `cello_contact_set_tier`'s job. */
-    addContact(agentName: string, pubkey: string, moniker?: string | null, provenance?: string | null, tier?: number): void;
-    /** MONIKER-3 AC3: rename (string) or clear (null) an EXISTING contact's pet name. Returns false
-     *  when no such contact — fail-loud at the caller, never a silent no-op success. Same
-     *  validate-throw backstop as addContact. */
-    setContactMoniker(agentName: string, pubkey: string, moniker: string | null): boolean;
-    /**
-     * M10B / DOD-END-SURFACE-1 — decide whether ONE signal is presented to ONE counterparty.
-     *
-     * `present: null` CLEARS the choice, which is not the same as `false`: cleared means "no opinion,
-     * use the signal's own default", while false means "specifically not this person". Collapsing
-     * them would make an operator unable to undo an omission without knowing what the default was.
-     *
-     * Deliberately does NOT require an existing contact row, unlike the tier/moniker/away setters. A
-     * decision about what to disclose is meaningful before a relationship is established — indeed
-     * that is when it matters most — and refusing here would force the operator to add someone as a
-     * contact in order to withhold something from them.
-     */
-    setContactSignalPref(agentName: string, pubkey: string, signalHash: string, present: boolean | null): void;
-    /**
-     * The explicit per-counterparty choices for this contact: signal hash → present.
-     *
-     * A signal ABSENT from this map has no choice recorded and falls back to its own
-     * `default_present`. Returns an EMPTY map on an uninitialised DB rather than throwing, because
-     * this is a preference read on the presentation path and losing preferences must not break a
-     * session — but note the direction that failure takes: with no preferences, `default_present`
-     * decides, and consent still gates everything upstream in SQL. It can therefore only fall back to
-     * the operator's standing default, never to disclosing something consent has not cleared.
-     */
-    getContactSignalPrefs(agentName: string, pubkey: string): Map<string, boolean>;
-    /** DOD-AWAY-TIER-1: set (or clear, with null) a contact's per-contact away message. Returns false
-     *  when no such contact — fail-loud at the caller (same contract as setContactMoniker/setContactTier). */
-    setContactAwayMessage(agentName: string, pubkey: string, message: string | null): boolean;
     /** DOD-AWAY-TIER-1: resolve the most-specific CUSTOM away text for a counterparty, most-specific
      *  first: per-contact `away_message` → per-tier away setting → agent default away setting. Returns
      *  null when none is configured, so the CALLER applies the system default (code) — making the full
      *  four-level resolution TOTAL. A pure read; the resolved text is screened on the outbound path by
      *  the caller like any content (SI — it does not bypass the gateway). */
     resolveAwayMessage(agentName: string, pubkey: string): string | null;
-    /** DOD-CONTACT-VIEW-1: set an EXISTING contact's reachability tier. Returns false when no such
-     *  contact — fail-loud at the caller, never a silent no-op success (same contract as
-     *  setContactMoniker). The caller validates the tier is a known constant BEFORE calling; this
-     *  stores whatever it is handed (the handler is the validation boundary). */
-    setContactTier(agentName: string, pubkey: string, tier: number): boolean;
-    /** DOD-RENAME-1 (Option C): record a self-declared name a peer offered, at the moment the offer is
-     *  SEEN. The stored local pet name (contacts.moniker) is SACROSANCT — this only ever touches
-     *  last_offered_moniker and the notice queue, never the moniker (AC2). A rename NOTICE is queued
-     *  only when the peer is a contact the operator has PERSONALLY NAMED (moniker non-null), a name was
-     *  seen BEFORE (last_offered_moniker non-null), and the new offer DIFFERS (AC3). The first-ever
-     *  offer just records the baseline (no notice); a repeat of the same name is idempotent (AC4).
-     *  Called only when a moniker WAS offered (caller-guarded), so silence never clears the baseline
-     *  (AC5). Limitation: last_offered_moniker updates only on the RECEIVING side of an offer, so rename
-     *  detection works only for peers who INITIATE to you — a property, not a bug. */
-    recordOfferedMoniker(agentName: string, pubkey: string, offered: string): void;
-    /** DOD-RENAME-1: pending rename notices for an agent, oldest first (surfaced in
-     *  cello_check_notifications — an INBOX pull, never a real-time push). */
-    getRenameNotices(agentName: string): Array<{
-        pubkey: string;
-        offered_name: string;
-        noticed_at: number;
-        moniker: string | null;
-    }>;
-    /** DOD-RENAME-1: clear a pending rename notice — the operator acted (adopted a name or removed the
-     *  contact). Idempotent (no notice → no-op). Fail-closed on a missing DB, like the writes above. */
-    clearRenameNotice(agentName: string, pubkey: string): void;
-    /** M8C-CONTACT-1: known stays known until explicitly removed. */
-    removeContact(agentName: string, pubkey: string): boolean;
-    /**
-     * Forget the pinned threshold group key for a counterparty, so the next session re-pins.
-     *
-     * DOD-M15-OFFER-SIGNED-1 review F2 — WITHOUT THIS THE REFUSAL WAS PERMANENT. The identity-change
-     * check refuses a counterparty whose group key differs from the one recorded in an earlier
-     * session, and its guidance told the operator to confirm out of band and then remove the contact
-     * so the new identity is pinned afresh. `removeContact` deleted a row in `contacts`; the pin lives
-     * in `sessions.counterparty_primary_pubkey`, and nothing in the daemon ever cleared it.
-     *
-     * So an operator who did exactly as instructed — called their counterparty, confirmed the
-     * re-registration was genuine, removed the contact, retried — got the identical refusal, with no
-     * way out short of editing the database. A security control that cannot be reset by the person it
-     * protects is a lockout, and the printed remedy made it worse by reading as though it worked.
-     *
-     * Nulls the column rather than deleting the session rows: those rows are the transcript record,
-     * and a re-pin is not a reason to lose them.
-     */
-    clearPinnedCounterpartyPrimary(agentName: string, counterpartyPubkeyHex: string): number;
-    /** MONIKER-4: the operator's pet name for a pubkey (whoLabel's top tier), or null. Read-only
-     *  and tolerant of a not-yet-open DB (a missing label degrades the doorbell, never blocks it). */
-    getContactMoniker(agentName: string, pubkey: string): string | null;
-    /** M8C-CONTACT-1 + DOD-CONTACT-VIEW-1: list an agent's contacts, oldest-added first, each with its
-     *  pet name (MONIKER-3), tier + provenance (the address-book metadata), and a READ-side LEFT JOIN
-     *  against `sessions` for how many SEALED sessions were shared and when they last spoke (MAX
-     *  updated_at). No new stored data — a pure read. A contact with no sessions shows 0 / null (never),
-     *  not an error. The JOIN is scoped by agent_id so one agent's sessions never bleed into another's. */
-    listContacts(agentName: string): Array<{
-        pubkey: string;
-        added_at: number;
-        moniker: string | null;
-        tier: number | null;
-        provenance: string | null;
-        sealed_count: number;
-        last_spoke: number | null;
-    }>;
     /**
      * DOD-M15-REFUSEDEVIDENCE-1 — retain a message refused OUTSIDE `ingestReceivedContent`.
      *
@@ -1027,33 +533,9 @@ export declare class SessionNodeManager {
      * the logging are the ones every other refusal uses.
      */
     quarantineRefusedInbound(agentName: string, sessionId: string, reason: string, content: Uint8Array, contentHashHex: string, senderPubkeyHex: string | null, correlationId?: string): number | null;
-    /**
-     * DOD-M15-REFUSEDEVIDENCE-1: read retained refused messages back — all of a session's, or the one
-     * at `sequence`.
-     *
-     * Returns the RAW payload. Every caller that hands it to a reader must frame it first
-     * (`frameQuarantinedPayload`); nothing else in the tree may read this without doing so.
-     */
-    readQuarantined(agentName: string, sessionId: string, sequence?: number): QuarantinedRecord[];
     /** The metadata half of a framed quarantine read — everything known ABOUT the message, none of it
      *  taken from the message. Split out so the framing module never touches the database. */
     quarantineFrameMeta(agentName: string, sessionId: string, rec: QuarantinedRecord): QuarantineFrameMeta;
-    /** M8C-ABUSE-1: non-terminal sessions this agent currently holds with the given counterparty.
-     *  Reviewer HIGH fix (aeffb82f, D18): counting `status = 'active'` ONLY let a counterparty
-     *  evade the bound for free by disconnecting (a trivial, attacker-controlled action that flips
-     *  a session to 'interrupted' — markInterruptedWithDetails) and opening a fresh session,
-     *  repeated indefinitely. 'interrupted' sessions still accept content (ingestReceivedContent
-     *  explicitly allows both statuses) and are NOT terminal (sealed/seal_interrupted_pending are),
-     *  so they must still count against the bound. */
-    countActiveSessionsForCounterparty(agentName: string, counterpartyPubkey: string): number;
-    /** M8C-ABUSE-1 (anti-swarm) + DOD-TIER-2: non-terminal sessions this agent holds with UNKNOWN-tier
-     *  counterparties — the global cap counts across the whole stranger pool. A sender is exempt from
-     *  THIS pool iff it is a KNOWN+ contact (tier >= KNOWN); a bare stranger (no row → UNKNOWN) or an
-     *  explicitly UNKNOWN-tier contact both count. Keying on `tier >= KNOWN` (bounded to <= VIP so a
-     *  corrupt high value cannot grant pool-exemption) replaces the old row-existence proxy, which
-     *  would have let a merely-recorded UNKNOWN contact escape the anti-swarm cap. Same
-     *  'interrupted'-status fix as countActiveSessionsForCounterparty above. */
-    countActiveSessionsFromUnknownSenders(agentName: string): number;
     /** M8C-ABUSE-1 + DOD-TIER-2/3: is a NEW inbound session from this counterparty within the
      *  acceptance bounds? The per-sender cap is now the sender's TIER cap (DEFAULT_TIER_BOUNDS), not a
      *  flat "3 for strangers, unbounded for contacts". This is where DOD-TIER-3 falls out for free: a
@@ -1068,62 +550,6 @@ export declare class SessionNodeManager {
         ok: false;
         reason: CapacityReason;
     };
-    /** M8C-TGDOOR-1: the daemon-wide Telegram bot settings, or null if never configured. */
-    getTelegramSettings(): {
-        botToken: string;
-        allowlistedChatId: string;
-    } | null;
-    /** M8C-TGDOOR-1: persist (or replace) the singleton Telegram settings row. */
-    setTelegramSettings(botToken: string, allowlistedChatId: string): void;
-    /** DOD-SETTINGS-1: read a per-agent setting, or null if unset. The get-with-default is the CALLER's
-     *  job (an unset key falls back to the hardcoded grid/system default — the daemon runs correctly on
-     *  defaults alone, AC3). Returns null on a missing DB (settings are always optional). */
-    getSetting(agentName: string, key: string): string | null;
-    /**
-     * DOD-SETTINGS-1: DELETE a per-agent setting so the built-in default applies again.
-     *
-     * Deleting is NOT storing "". `getSetting` returns null for both, but the away-text resolver walks
-     * per-contact → per-tier → agent-default → system default, and an empty string is a VALUE that
-     * wins that walk and blanks the reply. Unsetting is the only way back to the default, and until
-     * this existed there was no way back at all: `cello_settings_set` accepted a string, refused an
-     * empty one, and told the caller to "pass null to clear" — a null it coerced to undefined and
-     * rejected as missing_params. Following that guidance from the CLI set the literal text "null",
-     * so an operator trying to remove their away message ended up broadcasting the word "null" to
-     * every caller.
-     *
-     * Returns whether a row was actually removed, so the handler can report what it did rather than
-     * claiming a clear it never performed.
-     */
-    deleteSetting(agentName: string, key: string): boolean;
-    /** DOD-SETTINGS-1: write a per-agent setting (upsert). Key VALIDATION is the handler's boundary
-     *  (isValidSettingKey); value validation for typed settings (finite bounds, etc.) belongs to the
-     *  specific consumer. Throws on a missing DB — a write that silently no-ops would be a lie. */
-    setSetting(agentName: string, key: string, value: string): void;
-    /** DOD-SETTINGS-1: all explicitly-set settings for an agent (the ones that OVERRIDE a default),
-     *  key-sorted. Unset keys are absent — the operator sees only what they changed. */
-    getAllSettings(agentName: string): Array<{
-        key: string;
-        value: string;
-    }>;
-    /** DOD-LOOP-1: whether the given agent has a standing receiver ready (any agent if omitted). */
-    getStandingReceiverReady(agentName?: string): boolean;
-    /**
-     * DOD-M12B-RESERVATION-RETRY-1 — whether a NAT'd peer can actually DIAL this agent.
-     *
-     * `standing_receiver_ready` answers "is there a receiver?", which is true for a plain TCP node
-     * that no relay would give a circuit reservation to. Behind NAT that node is reachable by nobody,
-     * and the difference was visible only in the log — where it was visible 481 times and nobody
-     * acted. `"retrying"` and `"unreachable"` are the states an operator can do something about.
-     *
-     *   reserved    — holds a circuit reservation; a NAT'd peer can dial it.
-     *   retrying    — no reservation yet, still re-asking on a backoff.
-     *   unreachable — no circuit reservation and the automatic re-attempts are spent, so only peers
-     *                 that can connect DIRECTLY will get in. It is not permanent: a directory
-     *                 reconnect carrying a DIFFERENT relay pool re-arms the budget, because a relay we
-     *                 have never tried is new information.
-     *   absent      — no receiver at all (the agent is not online).
-     */
-    getStandingReceiverReachability(agentName: string): "reserved" | "retrying" | "unreachable" | "absent";
     /**
      * The current standing receiver node's session-transport coordinates (peer id +
      * listen multiaddrs), or null if it is not ready. These are the addresses a local
@@ -1145,92 +571,6 @@ export declare class SessionNodeManager {
      * Reads the live gater rather than a copy, so it cannot drift from what the gate actually does.
      */
     isRelayCarvedOutInbound(agentName: string, relayPeerId: string): boolean;
-    getStandingReceiverInfo(agentName: string): {
-        peerId: string;
-        addrs: string[];
-    } | null;
-    /**
-     * DOD-M15-ASSIGN-1 — name the one peer allowed to dial this agent's standing receiver, at the
-     * moment the directory's `session_offer` says who is coming.
-     *
-     * This is what makes the receiver's deny-by-default safe. The offer names
-     * `initiator_session_peer_id`, and the responder answers it by advertising its OWN address in
-     * `session_offer_accept`. Narrowing here — BEFORE that answer goes out — means the door opens to
-     * exactly one peer at the same instant the address that reaches them is published, and never
-     * before. The initiator cannot know where to dial until the accept it triggers has been sent.
-     *
-     * Returns WHICH failure it was, never a bare false (review F6). The caller reports a distinct
-     * reason per cause: "no receiver" and "the directory named nobody" are different subsystems, and
-     * collapsing them sent the operator to the directory for a local problem. This method never
-     * widens the gate to compensate.
-     *
-     * Narrows INBOUND ONLY. The receiver is still the daemon's general-purpose dialer at this point
-     * — no assignment exists yet — so revoking its outbound latitude here would break content
-     * parking and restart-seal submission (review F2).
-     */
-    admitOfferedDialer(agentName: string, initiatorSessionPeerId: string, sessionIdHex: string): "narrowed" | "no_receiver" | "no_peer_named";
-    /**
-     * What the UNSIGNED offer claimed, so the SIGNED assignment can be checked against it.
-     *
-     * DOD-M15-OFFER-SIGNED-1. Decision 2 rules that the listening socket is "gated on the
-     * assignment", and the gate is narrowed from `session_offer` — a frame carrying no signature —
-     * because that is the only thing that arrives early enough. Timing forced the offer; it does not
-     * excuse trusting it.
-     *
-     * Keeping what the offer said turns the two frames into a CHECK ON EACH OTHER. The assignment is
-     * FROST-signed by the initiator's own threshold group, which no single directory can produce, and
-     * it names the same peer id. A directory that says one peer in the offer and another in the
-     * assignment is naming two different dialers for one session — which a truthful directory never
-     * does, and which is exactly the move a compromised one would make to slip a peer past the gate
-     * before the signed document arrives.
-     */
-    getOfferedDialer(agentName: string, sessionIdHex: string): string | null;
-    /**
-     * Which peer this agent's standing receiver is currently admitting INBOUND — `null` for nobody.
-     *
-     * Read-only, and it answers a question the daemon otherwise cannot: *"whose dial would this
-     * receiver accept right now?"* The gate is narrowed and re-closed from several paths (an offer
-     * arrives, an assignment is refused, a session is promoted), and until now the only way to know
-     * where it had ended up was to reproduce the sequence in your head.
-     *
-     * Added for `DOD-M15-RESPONDER-VERIFY-1`, where a refusal for one session was closing the gate a
-     * DIFFERENT session had narrowed — a defect with no observable symptom short of the second
-     * session's initiator being refused with "nothing invited it".
-     */
-    getStandingReceiverAllowedPeer(agentName: string): string | null;
-    /** Forget the offered dialer for ONE session — called on BOTH the claim and the refusal paths. */
-    clearOfferedDialer(agentName: string, sessionIdHex: string): void;
-    /**
-     * RE-CLOSE the standing receiver — but ONLY if this session is still the one holding it.
-     *
-     * DOD-M15-OFFER-SIGNED-1 review F4, then N1. The first version closed the gate unconditionally,
-     * and that was worse than the defect it fixed: an agent has ONE standing receiver with ONE allowed
-     * peer, so a refusal for session P closed the gate that offer Q had narrowed. Q's initiator —
-     * invited, legitimate — was then refused with *"nothing invited it"*, which this daemon had.
-     *
-     * That is the same cross-session interference F1 was written to remove, moved one method along,
-     * and triggerable the same way: one bogus offer/assignment pair collapses a concurrent real
-     * session.
-     *
-     * So the gate is closed only when it still names the peer THIS session opened it to. If a later
-     * offer has already re-narrowed it, that offer owns the receiver and its narrowing stands.
-     *
-     * NO EVICTION SWEEP, deliberately (N4). The sweep evicts by "not the allowed peer", and
-     * `getConnections()` returns OUTBOUND connections too — including the content-park and
-     * restart-seal dials this node makes as the daemon's general-purpose dialer, whose targets are on
-     * no allowlist by construction. Sweeping here hung those up, and the failure surfaced as
-     * `relay_unavailable`: a transport label for a local decision, which is the exact substitution
-     * that comment was written to prevent. The load-bearing control is `DOD-M15-FRAME-1`'s frame gate,
-     * which refuses what an unauthorised peer sends; closing the door is enough here.
-     */
-    revokeOfferedDialer(agentName: string, sessionIdHex: string, offeredPeerId: string | null): void;
-    /**
-     * The standing receiver's libp2p node — a general-purpose node usable for OUTBOUND dials that
-     * are not session-scoped (e.g. the content-park deposit/pull to the relay, MSG-001-3b). Its
-     * gater admits nobody INBOUND until a session names them (DOD-M15-ASSIGN-1), but leaves these
-     * outbound errands open. Returns null until the receiver is ready.
-     */
-    getStandingReceiverNode(agentName?: string): CelloNode | null;
     /**
      * The libp2p Peer ID of an active session's node (N_A for an initiated session), or
      * null if no active node exists for it. This is the initiator's session peer id that an
@@ -1238,14 +578,6 @@ export declare class SessionNodeManager {
      * its handed-off receiver to it). Read-only.
      */
     getSessionNodePeerId(agentName: string, sessionId: string): string | null;
-    /**
-     * CELLO-M7-TRANSPORT-001: the AutoNAT service wrapping the current standing
-     * receiver node, or null if the standing receiver is not ready. The composition
-     * root uses this as the daemon's runtime IAutoNatService — its getDialability()
-     * drives the SessionAssignment advertised address (AC-004/AC-019), and it is the
-     * source of the transport.autonat.result / transport.autonat.unavailable events.
-     */
-    getStandingReceiverAutoNat(): IAutoNatService | null;
     /**
      * M7-SESSION-001 (M-1 PUSH): register the session-state-change callback.
      * Called by the composition root (daemon.ts) after the NotificationDispatcher
@@ -1275,16 +607,6 @@ export declare class SessionNodeManager {
      * an unresolvable name — see #requireAgentId for why null is not an option.
      */
     resolveAgentId(agentName: string): string;
-    /**
-     * Reverse lookup: the display name of a stable agent_id, or null if no such agent.
-     *
-     * Deliberately INCLUDES retired agents. Its caller (the startup awaiting-content re-park) holds an
-     * agent_id read off a durable row and needs a name to find that agent's standing receiver. A
-     * retired agent resolves to its name and then has no standing receiver, so the park fails cleanly
-     * and loudly — which is correct. Filtering retired agents out here would instead make the row
-     * unattributable and the failure mute.
-     */
-    agentNameForId(agentId: string): string | null;
     /**
      * Create a new outbound session node.
      * Called during cello_initiate_session.
@@ -1293,18 +615,9 @@ export declare class SessionNodeManager {
      * @param agentName      Name of the initiating agent
      * @param counterpartyPubkey  Counterparty's K_local public key (hex)
      * @param counterpartyPeerId  Counterparty's session-layer Peer ID (for gater)
-     * @param correlationId  Correlation ID minted at session initiation
-     */
-    createSessionNode(sessionId: string, agentName: string, counterpartyPubkey: string, counterpartyPeerId: string, correlationId: string, reuseStandingReceiver?: boolean, relay?: RelayConnectParams): Promise<CreateSessionResult>;
-    /**
-     * M7-SESSION-003: read the direct-path counterparty liveness for a session.
-     * 'unknown' when no session node observation has occurred yet.
-     *
-     * DOD-M12B-ACK-1: 'impaired' is DAEMON-LOCAL and deliberately not on the relay's
-     * SessionLiveness wire type — the relay answers a different question (does it hold the
-     * recipient's standing connection) and its three states are a deployed bilateral contract.
+     * @param correlationId  Correlation ID minted at session initiation
      */
-    getSessionLiveness(agentName: string, sessionId: string): "alive" | "impaired" | "gone" | "unknown";
+    createSessionNode(sessionId: string, agentName: string, counterpartyPubkey: string, counterpartyPeerId: string, correlationId: string, reuseStandingReceiver?: boolean, relay?: RelayConnectParams): Promise<CreateSessionResult>;
     /**
      * DOD-M12B-ACK-1 — live `/cello/content/1.0.0` stream counts on a session's direct path, or null
      * when the session has no active node.
@@ -1318,9 +631,6 @@ export declare class SessionNodeManager {
         inbound: number;
         outbound: number;
     } | null;
-    /** DOD-M12B-ACK-1: why this session is impaired, for the surface that has to explain it. Null
-     *  when it is not impaired — a caller must not narrate a failure that is not current. */
-    getSessionImpairment(agentName: string, sessionId: string): SessionImpairment | null;
     /**
      * DOD-M12B-ABANDON-NOTIFY-1 — drive the REAL inbound content handler with one framed message and
      * a claimed peer identity.
@@ -1331,16 +641,6 @@ export declare class SessionNodeManager {
      * calls, including the authentication check, rather than a copy of its logic.
      */
     handleContentFrameForTest(agentName: string, sessionId: string, framedBytes: Uint8Array, remotePeerId?: string): Promise<void>;
-    /** DOD-CAP-SELF-HEAL-1 test seam: the shutdown sweep's effect, without a shutdown. Mirrors the
-     *  real UPDATE at gracefulShutdown so a test cannot pass against a label production never sets. */
-    markSessionsInterruptedByLocalShutdownForTest(): void;
-    /** DOD-CAP-SELF-HEAL-1 test seam: the counterparty's stream closing, without a real peer. */
-    markInterruptedByCounterpartyForTest(agentName: string, sessionId: string): void;
-    /** Test seam (same spirit as getDb()): seed per-session direct-path liveness, which is otherwise
-     *  only set by the live node's onPeerConnect/onPeerDisconnect (#wireSessionLiveness). Lets a
-     *  DB-seeded test exercise the CC-5 reaper's "alive counterparty must survive" gate without standing
-     *  up a real libp2p peer connection. */
-    markSessionLivenessForTest(agentName: string, sessionId: string, state: "alive" | "impaired" | "gone"): void;
     /**
      * Hand the standing receiver to an inbound session.
      * Called during cello_await_session.
@@ -1366,142 +666,6 @@ export declare class SessionNodeManager {
      */
     retireSessionNode(agentName: string, sessionId: string): Promise<void>;
     gracefulShutdown(): Promise<void>;
-    /**
-     * Return all sessions with a given status from SQLite.
-     * Used by cello status to surface interrupted sessions.
-     */
-    getSessionsByStatus(status: "active" | "sealed" | "interrupted"): SessionRecord[];
-    /**
-     * DOD-M12B-RESTART-SEAL-1 / DOD-M12B-PENDING-RESOLVE-1 — sessions that need a receipt and have
-     * nobody asking for one. TWO populations, one queue, each with its own safety argument.
-     *
-     * **(2) `seal_interrupted_pending` — a seal commitment nobody notarized.** Measured 2026-08-18 on
-     * the live store: 28 sessions, aged 0.3 to 12.8 days, one of them 14 messages long, 26 holding
-     * relay-witnessed seal leaves, and **not one with a sealed root**.
-     *
-     * **HALF OF THEM ARE NOT BILATERAL, and the first version of this comment claimed they were.**
-     * Measured split: 14 initiator rows, each carrying the counterparty's signed leaf — and 14
-     * responder rows with `counterparty_leaf = NULL`. A responder row is written by
-     * `inbound-seal-request.ts` from an UNSIGNED `seal_interrupted_request` frame, before its ack is
-     * even sent, so an ordinary send failure produces a one-sided pending row.
-     *
-     * So the licence is NOT "both parties signed". It is **somebody chose to end this**, on two
-     * branches: an initiator row carries the counterparty's signature, and a responder row exists
-     * because the counterparty sent a request to seal. And what makes the result VERIFIABLE is
-     * neither — it is that the directory rebuilds the tree from relay-witnessed leaves and checks
-     * their signatures, never consulting the commitment at all. The commitment is what makes it
-     * legitimate to ASK. (`close-session-handler.ts` states this in full; the first draft of this
-     * header contradicted it 200 lines away.) `PENDING-EXIT-1` built their exit and it works — but only when an operator runs
-     * `cello_close_session` on that session by hand, having somehow deduced they should. Nothing
-     * enumerated them, because both sweeps filtered `status = 'interrupted'`. An exit nobody is told
-     * about is not an exit.
-     *
-     * `interrupted_by` is deliberately NOT consulted for that population. It answers "did WE cause
-     * this, and may we therefore describe it" — and that is the wrong question once a seal was
-     * requested or signed. **SI-001 is not weakened:** it forbids notarizing *"a conversation nobody
-     * chose to end"*, and every row here was chosen to be ended by one side or the other. The only
-     * thing missing is the request to notarize it.
-     *
-     * **(1) `interrupted` — sessions our own stop orphaned, and only those.** Here `interrupted_by` is
-     * the whole safety argument. `'local'` means the boot sweep, the shutdown
-     * sweep, or the operator's own kill switch ended this session — nobody else did, and it cannot be
-     * resumed because the transport keypairs died with the process. Those are the ones the resolver
-     * may seal on its own.
-     *
-     * Everything else is excluded and must stay excluded:
-     *   'counterparty'        — they hung up. SI-001: the operator may still want to wait.
-     *   'relay_stream_close'  — our relay witness link ended; the session itself may be fine.
-     *   NULL                  — written before the column existed, so the cause is UNKNOWN. An
-     *                           unknown cause is not a licence to notarize; it is the reason not to.
-     *
-     * Same INNER JOIN discipline as getSessionsByStatus: a retired agent's rows are kept for
-     * accountability and are not resumable, so they are not offered for sealing either.
-     */
-    listRestartOrphanedSessions(): Array<{
-        agentName: string;
-        sessionId: string;
-        messageCount: number;
-        status: "interrupted" | "seal_interrupted_pending";
-    }>;
-    /**
-     * DOD-M12B-REVIVAL-BOUND-1 — interrupted sessions that can no longer be revived, and must close.
-     *
-     * Andre, 2026-08-18: *"after that, those peer IDs and that peer connection needs to be shut down.
-     * It is an open connection that a malicious agent can farm for."* The tenet is **leave nothing
-     * open that is no longer needed**, and the threat model is a daemon that has been reprogrammed —
-     * so the guarantee has to hold on the side that is not the attacker.
-     *
-     * WHAT IS OPEN. `ingestReceivedContent` refuses `sealed`, `seal_interrupted_pending` and
-     * `abandoned`, but deliberately ACCEPTS `interrupted` — that acceptance is the only reason
-     * recovery can work. Nothing else ever leaves `interrupted`, so it means accepts FOREVER.
-     *
-     * **THIS IS THE BACKSTOP, NOT THE COMPLEMENT.** The seal path gets first refusal on every
-     * local-cause session, because a session whose ending we can describe truthfully earns a
-     * notarized receipt. But "the seal path owns it" is not the same as "the seal path will finish
-     * it", and two populations fall through the gap between those:
-     *
-     *   - **The resolver gave up.** `markRestartSealGaveUp` writes only `restart_seal_gave_up_at`;
-     *     the status stays `interrupted`, and `listRestartOrphanedSessions` then excludes the row by
-     *     `restart_seal_gave_up_at IS NULL` so it is never retried. `TERMINAL_SEAL_REFUSALS` has ten
-     *     entries and the measured figure is that 59% of seals that start never finish, so this is
-     *     the common case, not a corner.
-     *   - **Zero-message local sessions.** The resolver requires `message_count > 0` — a dead
-     *     handshake is not worth a ceremony. It is still an open write surface.
-     *
-     * Excluding those left them permanently interrupted and permanently writable, which is the exact
-     * condition this line exists to end. And the population is about to become the majority: no row
-     * has ever carried `interrupted_by = 'local'` yet, and from the next shutdown onward every
-     * shutdown-orphaned session will. So the sweep takes a local-cause session once the seal path
-     * has either declined it or exhausted it — never before.
-     *
-     * **THE CLOCK MUST BE ONE THE COUNTERPARTY CANNOT MOVE.** The obvious fallback for a row with no
-     * `interrupted_at` is `updated_at` — and it is exactly wrong. `ingestReceivedContent` accepts
-     * content into an `interrupted` session (that acceptance is this whole line's premise), and a
-     * successful ingest runs `UPDATE sessions SET message_count = ?, updated_at = <now>`. So
-     * `updated_at` is a clock the reprogrammed peer holds: one message every 24 hours and the session
-     * never expires, forever. The fallback would have handed the attacker the off switch for the
-     * control built to stop them.
-     *
-     * Instead the missing timestamps are STAMPED ONCE, by `#stampMissingInterruptedAt` immediately
-     * before this query runs, and this query reads `interrupted_at` and nothing else. The stamp is
-     * written under `WHERE interrupted_at IS NULL`, so it is monotone — set once, never moved, by us
-     * and not by a peer. A legacy row therefore gets its full window starting from the first sweep
-     * that sees it, which is later than the true interruption but is the only bound that is sound.
-     *
-     * Same retired-agent INNER JOIN as the sibling query: a retired agent's rows are kept for
-     * accountability, are not resumable, and are not writable either.
-     *
-     * **THE TIME ARITHMETIC IS LOAD-BEARING, AND BOTH OBVIOUS FORMS OF IT ARE WRONG.** These two
-     * columns do not hold the same kind of value:
-     *
-     *   `interrupted_at`  TEXT,    an ISO-8601 string — `new Date(now).toISOString()`.
-     *   `updated_at`      INTEGER, epoch milliseconds.
-     *
-     * There are FOUR writers of `status = 'interrupted'`, not three. The fourth is
-     * `destroySessionNode` → `#updateSessionStatus(…, "interrupted", "local")`, which historically
-     * wrote `interrupted_by` and **no timestamp at all** — and it is the path that produced the two
-     * rows in Entry 41. It now stamps `interrupted_at` like the others, so NULL is a legacy state
-     * rather than one production keeps creating.
-     *
-     * So a bare `interrupted_at <= ?` against a numeric bound is **always false** — the column has
-     * TEXT affinity and the bound parameter has none, so SQLite applies TEXT affinity to the
-     * parameter and compares them as STRINGS (`'2026-08-18T05:32:04.183Z' <= 1755000000000` → 0).
-     * The query silently returns nothing forever and reads as "nothing has expired yet". And
-     * `CAST(interrupted_at AS
-     * INTEGER)` is worse than useless: SQLite casts by taking the leading digits, so
-     * `'2026-08-18T05:32:04Z'` becomes **2026**, which is older than any epoch bound. That form
-     * abandons every interrupted session on the next boot, immediately, whatever its age. It was
-     * written, and `session-001`/`cello-list-sessions` failed on it in the gate.
-     *
-     * `strftime('%s', …) * 1000` parses the ISO string properly and returns NULL for anything it
-     * cannot parse — so a malformed or differently-formatted value falls through the COALESCE to
-     * `updated_at` rather than being read as the year 2026.
-     */
-    listExpiredUnrevivableSessions(nowMs: number, windowMs: number): Array<{
-        agentName: string;
-        sessionId: string;
-        cause: string | null;
-    }>;
     /**
      * DOD-M12B-REVIVAL-BOUND-1 — close every session the revival window has expired.
      *
@@ -1516,18 +680,6 @@ export declare class SessionNodeManager {
      * @returns how many sessions actually flipped — not how many were attempted.
      */
     closeExpiredUnrevivableSessions(nowMs: number, windowMs: number): Promise<number>;
-    /**
-     * DOD-M12B-RESTART-SEAL-1 — record that automatic sealing has exhausted this session.
-     *
-     * Durable on purpose. The resolver's attempt budget is in memory, so without this the budget
-     * resets on every boot and a session that can never seal costs five directory ceremonies a day
-     * for the life of the machine.
-     *
-     * IT IS NOT A DEAD END FOR THE OPERATOR. The row keeps status `interrupted`, so a manual
-     * `cello_close_session` still works on it and — since DOD-M12B-INTERRUPTED-ESCALATE-1 — still
-     * escalates to a unilateral seal. This column only withdraws the session from AUTOMATIC retries.
-     */
-    markRestartSealGaveUp(agentName: string, sessionId: string, reason: string): void;
     getSessionsForAgent(agentName: string): SessionRecord[];
     /**
      * Every persisted session across ALL agents, most-recently-updated first. Backs the daemon-wide
@@ -1564,7 +716,6 @@ export declare class SessionNodeManager {
      * annexed, not stranded), which the early return skipped entirely.
      */
     markSealed(agentName: string, sessionId: string): boolean;
-    recordSealCertificate(agentName: string, sessionId: string, sealedRootHex: string, legibilityJson: string): void;
     /**
      * M8B FINDING-6 (cascade-2): persist a seal certificate for a session that may have NO local
      * `sessions` row. recordSealCertificate above is an `UPDATE ... WHERE` — a SILENT no-op when the
@@ -1576,85 +727,6 @@ export declare class SessionNodeManager {
      * derives it from the notification's present_pubkey.
      */
     recordSealCertificateEnsuringRow(agentName: string, sessionId: string, counterpartyPubkeyHex: string, sealedRootHex: string, legibilityJson: string): void;
-    /**
-     * M7 legibility-TBS-binding (responder verify): record the counterparty's FROST primary (group)
-     * pubkey from the FROST-signed SessionAssignment, so the responder can VERIFY the bilateral seal
-     * signature locally. Best-effort — a missing row (race) is a no-op; the seal then falls back to
-     * accept-without-verify (still sound: the live frame arrives over the authenticated Noise channel).
-     */
-    /**
-     * The counterparty's threshold group key as this agent has seen it BEFORE — trust on first use.
-     *
-     * DOD-M15-OFFER-SIGNED-1 / RESPONDER-VERIFY-1. The responder does not verify the assignment's
-     * signature (deferred to SESSION-004), so every field in it is whatever the directory said. That
-     * makes a same-frame check circular: a compromised directory just says the same thing twice.
-     *
-     * This is the one anchor the responder holds that a directory CANNOT retroactively change — its
-     * own memory of previous sessions with this counterparty. A directory that names a different
-     * threshold group key for someone you have already talked to is either substituting an identity
-     * or has been compromised since; neither is a session to accept quietly.
-     *
-     * THE BOUND, stated rather than glossed: this is worth nothing on FIRST contact, which is the
-     * definition of trust-on-first-use. It hardens every session after it, which is where a long-lived
-     * counterparty relationship actually lives.
-     *
-     * Keyed on `counterparty_pubkey` — the K_local IDENTITY, which is the stable thing — not on a
-     * session id or a display name.
-     */
-    getPinnedCounterpartyPrimary(agentName: string, counterpartyPubkeyHex: string): string | null;
-    recordCounterpartyPrimary(agentName: string, sessionId: string, primaryPubkeyHex: string): void;
-    /**
-     * M7-SESSION-004 (AC-005/AC-006): read the persisted seal certificate for a session.
-     * Returns the sealed root and the parsed legibility object (JSON-safe, hex pubkeys), or
-     * null if the session is unknown or not yet sealed. This is the cert-read surface a
-     * reader (operator, agent, arbitrator) — possibly in a DIFFERENT process than the one
-     * that built the certificate — uses to determine receipt-not-assent, per-party frontiers,
-     * attestation modes, and whether the final message was answered.
-     */
-    getSealCertificate(agentName: string, sessionId: string): {
-        sealed_root: string;
-        legibility: unknown;
-    } | null;
-    /**
-     * DOD-M15-INCLUSION-1: keep the leaf set the certificate is signed over, so one message can later
-     * be proved to sit under it.
-     *
-     * REFUSES unless the hashes reproduce `sealedRootHex` — `certifiedLeafSetFrom` does that check and
-     * this method never bypasses it. That is what separates "the leaves the directory sent" from "the
-     * leaves the consortium signed", and only the second is worth storing: a proof built on the first
-     * would inherit whatever the directory chose to say.
-     *
-     * Idempotent (INSERT OR REPLACE keyed on leaf_index) so a re-delivered seal frame, or a unilateral
-     * seal later upgraded to bilateral, rewrites the same rows instead of failing or doubling them.
-     *
-     * @returns whether the set was accepted and stored.
-     */
-    recordCertifiedLeafSet(agentName: string, sessionId: string, signedLeaves: readonly SealFrontierLeaf[], sealedRootHex: string, correlationId?: string): boolean;
-    /**
-     * Record WHY this session does or does not have a certified leaf set.
-     *
-     * Public for the one case the manager cannot see: a seal frame that carried no signed leaves at
-     * all never reaches `recordCertifiedLeafSet`, and that absence is a permanent fact about the
-     * session for the party that observed it.
-     */
-    noteCertifiedLeafSetUnavailable(agentName: string, sessionId: string, state: "not_carried_absent_party" | "not_carried_present_party", detail: string): void;
-    /**
-     * The last thing that happened to this session's certified leaf set, or null if nothing has.
-     *
-     * Null here and a null from `getCertifiedLeafSet` together mean "no seal has been processed on
-     * this side yet" — which is a different sentence again from any of the recorded states.
-     */
-    getCertifiedLeafSetState(agentName: string, sessionId: string): {
-        state: string;
-        detail: string | null;
-    } | null;
-    /**
-     * The certified leaf set, in order, or null when none was stored for this session.
-     *
-     * Null is a REFUSAL upstream, never a fallback to the local tree: the two cover different leaves
-     * and substituting one for the other is how a proof comes to land on a root nobody signed.
-     */
-    getCertifiedLeafSet(agentName: string, sessionId: string): string[] | null;
     /**
      * M7-SESSION-001: Mark a session as interrupted with message count and timestamp.
      * Called when a relay session_interrupted frame arrives or a relay stream closes.
@@ -1697,81 +769,7 @@ export declare class SessionNodeManager {
         merkleRoot: string;
         nonce: string;
     }): boolean;
-    /**
-     * M7-SESSION-001 (H-1): read back the persisted bilateral commitment artifacts
-     * for a session. Returns null when none exist.
-     */
-    /**
-     * M12-P17: durably record verified content that arrived for an ALREADY-ENDED session.
-     *
-     * Returns true only when the row is committed — the caller confirm-deletes the relay copy on the
-     * strength of this answer, and the ORDER is load-bearing: annex first, delete second. A crash
-     * between them must lose nothing, so a failure here MUST report false and leave the relay copy
-     * alone. Getting that backwards converts a noisy re-pull loop into permanent silent loss, which is
-     * the outcome this whole unit exists to prevent.
-     */
-    recordSealedAnnex(agentName: string, sessionId: string, contentHashHex: string, content: Uint8Array, senderPubkeyHex: string | null): boolean;
-    /**
-     * M12-P18: record that this agent refused a session, so parked content that later arrives for it
-     * (and fails `counterparty_unknown`, because no session row exists) can be swept instead of
-     * re-pulled forever. Keeps the most recent REFUSED_SESSIONS_CAP per agent.
-     */
-    recordRefusedSession(agentName: string, sessionId: string, reason: string): void;
-    /** M12-P18: did this agent refuse this session? Consulted at drain to sweep orphaned parked content. */
-    wasSessionRefused(agentName: string, sessionId: string): boolean;
-    /** M12-P17: read the annex. Operator-initiated ONLY — never wired to a wake path or inbox count. */
-    readSealedAnnex(agentName: string, sessionId?: string): Array<{
-        session_id: string;
-        content_hash: string;
-        sender_pubkey: string | null;
-        text: string;
-        arrived_at: number;
-    }>;
-    getSealInterruptedArtifacts(agentName: string, sessionId: string): {
-        role: string;
-        ownLeaf: unknown;
-        counterpartyLeaf: unknown;
-        merkleRoot: string;
-        nonce: string;
-    } | null;
-    /**
-     * Return the session record for a specific sessionId, regardless of status.
-     * Used by cello_close_session to inspect session state.
-     */
-    getSessionRecord(agentName: string, sessionId: string): SessionRecord | null;
-    /**
-     * DOD-SESSION-NAME-1: set (string) or clear (null) THIS agent's name for a session.
-     *
-     * Returns false when the (agent_id, session_id) row does not exist — i.e. the session is not this
-     * agent's — so the caller refuses with session_not_found rather than reporting a silent success on
-     * a write that landed nowhere. Same contract as setContactMoniker.
-     *
-     * Ownership is the ONLY scope: the composite key IS the ownership check, and status is deliberately
-     * not consulted. A sealed session can be named — naming one long after the fact is the point — and
-     * a name is a local column, so writing it cannot touch the seal, a Merkle leaf, or the wire.
-     *
-     * The caller validates (validateSessionName) before calling; this stores what it is given.
-     */
-    setSessionName(agentName: string, sessionId: string, sessionName: string | null): boolean;
-    /**
-     * MSG-2 startup-flush: the persisted relay endpoint for a session, or null if none was
-     * recorded. Used by the crash-backstop flush, which runs at startup BEFORE the in-memory
-     * session entries exist, so it cannot use `entry.relayPeerId`.
-     */
-    getPersistedRelayEndpoint(agentName: string, sessionId: string): {
-        relayPeerId: string;
-        relayAddrs: string[];
-    } | null;
-    /**
-     * DOD-MSG-4 (auto-recover): the DISTINCT relay endpoints this agent has sessions on, so the daemon
-     * can pull the agent's parked mailbox from each on reconnect (the relay mailbox is keyed by recipient
-     * pubkey, so one pull per relay drains all of the agent's parked content there). Distinct by relay
-     * peer id.
-     */
-    getAgentRelayEndpoints(agentName: string): Array<{
-        relayPeerId: string;
-        relayAddrs: string[];
-    }>;
+    /** Loaded from SQLite on first access so it survives a restart (AC-007). NEVER null: an unknown session yields an EMPTY tree. */
     getSessionTree(agentName: string, sessionId: string): SessionTree;
     /** Current daemon-owned tree root for a session, as hex. */
     getSessionTreeRootHex(agentName: string, sessionId: string): string;
@@ -1923,118 +921,6 @@ export declare class SessionNodeManager {
      * reconciliation — same documented limitation as the UP-2 gate above.
      */
     getSealUpgradeReadiness(agentName: string, sessionId: string): SealUpgradeReadiness;
-    /**
-     * ─── DOD-M15-NO-SILENT-REFUSAL-1: refusals the RECEIVING operator can actually see ────────────
-     *
-     * Every inbound refusal already logs a `reason`, an `impact` and a `guidance` — and they are
-     * good. They had no reader. From the receiving operator's chair a refused message simply never
-     * arrives: the conversation goes quiet with a full explanation sitting in a file they have no
-     * reason to open, and they conclude the other person stopped replying.
-     *
-     * **DURABLE, and that is the half that makes this useful.** The predecessor kept notices in a
-     * `Map` on this instance and drained them on the receive path for one session. So a restart lost
-     * them, and an agent NOBODY IS ATTENDING lost them too — the connection is live, the daemon is
-     * up, and the notice only ever reaches whoever happens to call `cello_receive` on that exact
-     * session. `cello_check_notifications` now reads them as its own inbox category.
-     *
-     * **DEDUPLICATED PER SESSION PER REASON, and that is the design, not an optimisation.** A skewed
-     * peer turns one problem into a flood: the first refusal of a kind is the signal, the ninetieth is
-     * noise that trains the operator to ignore the surface. `count` keeps the scale visible without
-     * repeating the alert.
-     *
-     * **NEVER carries the content.** It failed verification; surfacing it is the injection path the
-     * cross-check exists to close. The operator learns that a message was refused and why — never
-     * what it said.
-     */
-    /**
-     * Record an inbound refusal for the operator. First of its kind per session is the signal.
-     *
-     * ⚠️ **DOES NOT THROW, and that is a decision with a cost — stated so it is not mistaken for an
-     * oversight.** Every call site here has already decided to refuse and is about to return a reason
-     * to its caller; a throw would replace that clean refusal with an exception on the ingest path,
-     * changing what the SENDER observes because this daemon could not file a note. So a persistence
-     * failure is logged at ERROR under `session.refusal.persist.failed`, carrying the reason, the
-     * impact and the guidance verbatim — the forensic record survives even when the operator-facing
-     * one does not. It is not silent; it is one surface short, and the log says which notice was lost.
-     */
-    noteContentRefusal(agentName: string, sessionId: string, reason: string, 
-    /**
-     * ALL THREE REQUIRED, and that is the enforcement rather than the convention.
-     *
-     * The DoD clause is "every reason calls this with an impact and a guidance", and an optional
-     * field makes that a thing a reviewer checks by reading thirteen call sites. `kind` is required
-     * for the same reason one level up: the header over a list of refusals is composed from it, and
-     * a notice that could omit it would silently inherit whichever header happened to be first.
-     */
-    detail: {
-        kind: RefusalKind;
-        impact: string;
-        guidance: string;
-    }): void;
-    /**
-     * DOD-M15-NO-SILENT-REFUSAL-1: the operator has seen these and does not want to see them again.
-     *
-     * ⚠️ **WITHOUT THIS THE NOTICES ARE PERMANENT, and that is what makes people stop reading the
-     * inbox.** "Already shown you" is tracked per WINDOW — a new MCP connection has been told nothing,
-     * so it is told everything. Someone on an older build messages you, you sort it out with them,
-     * they upgrade, and every new session you ever open still opens with that refusal.
-     *
-     * Dismissing does NOT turn anything off. If the cause fires again the notice comes back, because
-     * a fresh refusal writes a fresh row. The operator is saying "I know", not "stop telling me".
-     *
-     * Returns how many were cleared, so the caller can say so rather than claiming a silent success.
-     */
-    dismissContentRefusals(agentName: string, sessionId: string): number;
-    /**
-     * Drain the refusals a GIVEN CONSUMER has not been shown yet, and remember what it was shown.
-     *
-     * ─── Why this is keyed by consumer, and not by a single flag ──────────────────────────────────
-     *
-     * It used to set one `surfaced: boolean` on the notice. Two MCP windows attending the same agent
-     * is the ordinary case, and under that flag whoever read FIRST consumed the notice — the second
-     * window was told nothing, permanently. **That is the same defect `takeReceivedContent` had**, and
-     * the comment above the delivery loop in `session-content-handlers.ts` spells out why it was
-     * removed: *"reading is non-destructive by construction. Nothing one consumer does mutates state
-     * another consumer reads."*
-     *
-     * ─── Why the count has a reader ───────────────────────────────────────────────────────────────
-     *
-     * A reason RE-ANNOUNCES to a consumer when its count has grown by an order of magnitude since that
-     * consumer last saw it (1 → 10 → 100 → …), marked `repeat: true`. That keeps the first refusal the
-     * signal and the ninetieth silent, which is the dedup's point, while still making a skew that has
-     * swallowed hundreds of messages visible — at a handful of announcements per session, not one per
-     * message.
-     *
-     * ─── What a restart does, deliberately ────────────────────────────────────────────────────────
-     *
-     * The notices survive; the read state is keyed by IPC connection id, which does not. So after a
-     * restart every notice is unseen again and the next reader is told. That is the correct direction:
-     * a fresh window has not been told anything, and re-announcing costs one line where staying silent
-     * costs the whole point of storing it.
-     */
-    takeContentRefusals(agentName: string, sessionId: string, 
-    /**
-     * REQUIRED, deliberately — no default.
-     *
-     * It had one (`"default"`), and a default is the defect this method was rewritten to remove,
-     * lying in wait: any future call site that omits the argument silently shares ONE bucket across
-     * every window, the first reader consumes the notice for all the others, and nothing fails to
-     * compile and no test goes red. The parameter existing is not the protection; being unable to
-     * forget it is.
-     */
-    consumerId: string): Array<Omit<RefusalNotice, "sessionId">>;
-    /**
-     * DOD-M15-NO-SILENT-REFUSAL-1: every unshown refusal for an agent, ACROSS its sessions.
-     *
-     * The inbox's door. `takeContentRefusals` answers for one session because its caller already holds
-     * one; `cello_check_notifications` holds an agent and nothing else, and the case this whole line
-     * exists for is that nobody is attending any of that agent's sessions — so a per-session read
-     * cannot reach it. Same store, same per-consumer rule, same re-announce.
-     */
-    takeAgentContentRefusals(agentName: string, consumerId: string): {
-        notices: RefusalNotice[];
-        truncated: boolean;
-    };
     ingestReceivedContent(agentName: string, sessionId: string, content: Uint8Array, contentHash: Uint8Array, correlationId?: string, 
     /**
      * DOD-FRONTIER-STRAND-1 AC1: the relay-assigned canonical position for THIS message, taken from
@@ -2119,7 +1005,6 @@ export declare class SessionNodeManager {
      * are therefore undeliverable. Empty is the overwhelmingly normal case.
      */
     getUndeliverableSeqs(agentName: string, sessionId: string): readonly number[];
-    getHighWaterSeq(agentName: string, sessionId: string): number;
     /**
      * M12-P14: is this side's chain COMPLETE enough to be sealed?
      *
@@ -2184,18 +1069,6 @@ export declare class SessionNodeManager {
      *    `leaf_count_mismatch` back, which is terminal and costs the receipt for good.
      */
     sealReadinessView(agentName: string, sessionId: string): SealReadinessView;
-    /** DOD-M12B-INDEX-1 — this agent's own K_local pubkey, for attributing its own held content.
-     *  Null when it cannot be resolved: an UNATTRIBUTED annex row is true, a falsely attributed one
-     *  is not, and this is the record that outlives the session. */
-    /**
-     * Test seam for `#recoverOwnSealCtrlLeaf` (documented on the method itself, below). The
-     * distinction it draws — "there is none" versus "I could not tell" — is the whole safety
-     * property, and it had no coverage at any level.
-     */
-    recoverOwnSealCtrlLeafForTest(agentName: string, sessionId: string): {
-        reportedRootHex: string;
-        sequenceNumber: number;
-    } | "none" | "unknown";
     /**
      * DOD-M12B-ABANDON-NOTIFY-1 — tell the counterparty we have hung up. Best effort, never blocking.
      *
@@ -2238,12 +1111,6 @@ export declare class SessionNodeManager {
         mustClear: number;
         blocked: boolean;
     };
-    /** DOD-CAP-SELF-HEAL-1: the sessions with this counterparty that are consuming cap slots, oldest
-     *  first. The operator is told to close some — this is WHICH, because "close three of them" with
-     *  no list is not an instruction they can follow. */
-    sessionsConsumingCap(agentName: string, counterpartyPubkey: string, limit?: number): string[];
-    /** DOD-M12B-ABANDON-NOTIFY-1: has the counterparty told us they hung up? */
-    counterpartyAbandonedAt(agentName: string, sessionId: string): number | null;
     /**
      * DOD-M12B-INDEX-1 — commit THIS agent's own leaf at the position the relay assigned it.
      *
@@ -2332,12 +1199,6 @@ export declare class SessionNodeManager {
         type: "sealed";
         unreadCount: number;
     } | null;
-    /**
-     * F1-b: the durable sealed root hex for a session (written by recordSealCertificate on the
-     * bilateral path), or null if not recorded. Lets cello_receive echo the sealed root in its
-     * terminal answer without threading it through destroySessionNode.
-     */
-    getSealedRootHex(agentName: string, sessionId: string): string | null;
     /**
      * DOD-MSG-4 (self-ordering content frame): verify the relay's signed ordering record carried IN the
      * content frame and record the canonical sequence for the strict-in-order gate — so ordering does
@@ -2356,31 +1217,6 @@ export declare class SessionNodeManager {
      * exposed here, so no caller can seal an unsigned envelope through this class.
      */
     decodeParkEnvelope(plaintext: Uint8Array): ParkEnvelope;
-    /**
-     * SEC-1 — THE ONLY WAY PARKED CONTENT ENTERS THE TRANSCRIPT.
-     *
-     * Authentication and ingest are FUSED here on purpose, and must stay fused. A caller cannot ingest
-     * parked content without passing the signature gate, because this is the only entry point. Exposing
-     * a separate `decode → ingest` path — with the signature check as its own optional step — is a
-     * downgrade attack: an attacker omits the thing that triggers the check, and the check never runs.
-     * A gate the caller can skip by leaving a field out is not a gate.
-     *
-     * FAILS CLOSED. No signature / bad signature / signer is not this session's counterparty / no
-     * session at all → REFUSED, nothing is appended, nothing is written, and the caller MUST NOT
-     * confirm-delete the entry from the relay (a forgery must not be able to evict itself, and a
-     * genuine bug must not silently eat mail).
-     */
-    recoverParkedEntry(agentName: string, sessionId: string, recipientPubkey: Uint8Array, unsealed: Uint8Array, contentHash: Uint8Array, correlationId?: string): Promise<{
-        ok: true;
-        leafIndex: number;
-        sequenceNumber: number;
-        held?: boolean;
-        appendedCount?: number;
-        screenedOut?: boolean;
-    } | {
-        ok: false;
-        reason: string;
-    }>;
     /**
      * DOD-MSG-4 (2b): public entry for the recover path to verify + record a parked entry's ordering
      * record (the recover handler lives in daemon.ts, which has no access to the private method).
@@ -2423,109 +1259,6 @@ export declare class SessionNodeManager {
      * against a decision production does not make.
      */
     runAutoAcknowledgeGateForTest(agentName: string, sessionId: string, correlationId?: string): void;
-    setSaltContributionForTest(agentName: string, sessionId: string, contribution: Uint8Array): void;
-    /**
-     * Test seams: re-enter the mint path, and read back the PUBLIC half — 006-CRYPTO.
-     *
-     * `#mintSessionEphemeral` is idempotent because a reconnect can re-enter an activation path, and a
-     * second keypair mid-session would leave the two sides deriving against a moving value. Proving
-     * that needs the path called TWICE, and the alternative — driving a real reconnect — drags in node
-     * rebuild and relay reconnection, none of which the property is about. Same justification as
-     * `forgetSaltContributionForTest` above.
-     *
-     * It calls the REAL private method, so a test cannot pass against a decision production does not
-     * make. The reader returns the public half ONLY: a seam that could hand out the secret is a way
-     * for the secret to leave this object, which is the one thing the whole unit is about.
-     */
-    mintSessionEphemeralForTest(agentName: string, sessionId: string): void;
-    sessionEphemeralPublicForTest(agentName: string, sessionId: string): Uint8Array | null;
-    /**
-     * Test seam: INSTALL a keypair the caller already holds — the only way to prove ZEROING.
-     *
-     * Presence is easy to assert and is not the property. `destroySessionEphemeral` overwrites the
-     * buffer before the entry is dropped, and a mutant that drops without overwriting leaves the
-     * secret wherever the collector last moved it while passing every presence check — which is
-     * exactly what happened: the shutdown zeroing shipped with a surviving mutant, and the transport
-     * seeds four lines above it have the same untested gap today.
-     *
-     * The direction matters. Nothing here HANDS OUT a secret — the test supplies an object it already
-     * owns and then inspects its own reference. A reader that returned the live keypair would be a
-     * path for the secret to leave this object, which is the one thing this unit exists to prevent.
-     */
-    setSessionEphemeralForTest(agentName: string, sessionId: string, ephemeral: SessionEphemeral): void;
-    /**
-     * Test seam: put a session into the state a COMPLETED exchange leaves it in — 007-CRYPTO.
-     *
-     * A live send now requires an agreed key, because there is no plaintext path to fall back to. In
-     * production the exchange completes on connect, before any send. A fixture with no real peer never
-     * completes it, so without this every content test in the repo would be exercising the refusal
-     * path instead of the thing it was written for.
-     *
-     * ⚠️ IT SHORT-CIRCUITS HOW THE KEY GOT THERE, NEVER WHAT THE KEY IS FOR. The state it produces —
-     * a session holding an agreed content key — is exactly the production state, which is what makes
-     * it legitimate; `setSaltContributionForTest` exists for the same reason. Tests of the EXCHANGE
-     * itself drive the real signed frames and must not use this.
-     */
-    setSessionContentKeyForTest(agentName: string, sessionId: string, key: Uint8Array): void;
-    /**
-     * Test seam: put an own leaf in the HELD state instead of the tree — 033-ACKEMIT.
-     *
-     * The state `placeOwnLeaf` produces when the relay assigns a position ahead of our tail: the leaf
-     * exists on this side and is not in the tree, while the counterparty already has it from the relay
-     * and can acknowledge it. Reproducing it through the real hold map rather than by asserting the
-     * tree is short is what makes the acknowledgement test measure the case instead of a neighbour of
-     * it.
-     */
-    holdOwnLeafForTest(agentName: string, sessionId: string, canonicalSeq: number, contentHashHex: string): void;
-    /**
-     * Test seam: put the session's genesis prev_root where a completed session open leaves it —
-     * 033-ACKEMIT.
-     *
-     * ⚠️ THE STATE IS THE PRODUCTION ONE; ONLY HOW IT GOT THERE IS SHORT-CIRCUITED, exactly as
-     * `setSessionContentKeyForTest` short-circuits the key exchange next door.
-     *
-     * In production this value is derived from the directory-signed relay assignment and written to
-     * the session row the moment the session learns it, so every real session has one. A fixture that
-     * builds a session node directly never sees an assignment — so without this seam every content
-     * test built on the fixture would be exercising the "no starting point" REFUSAL path instead of
-     * the thing it was written for, and would report that as a pass or a mysterious failure depending
-     * on which side of the send it sat on.
-     */
-    setSessionGenesisForTest(agentName: string, sessionId: string, genesis: Uint8Array): void;
-    /**
-     * Test seam: drop the agreed key while leaving the session up — the state before an exchange
-     * completes, and after a teardown evicts one. Its mirror above is what a completed exchange
-     * leaves; both are needed, or a status field stuck in one position passes either test alone.
-     */
-    forgetSessionContentKeyForTest(agentName: string, sessionId: string): void;
-    /**
-     * Test seam: produce THIS side's signed ephemeral, using the manager's own identity resolver.
-     *
-     * For harnesses whose connectivity is one-directional — one side dials, so only one announce ever
-     * lands. Carrying the other side's half across with a REAL signature is what completes the
-     * exchange, and it beats seeding a key: a seeded key has no peer half recorded against it, so the
-     * first genuine announce replaces it and the two ends drift apart (which is correct behaviour —
-     * see the re-key guard — and exactly what made seeding fragile here).
-     *
-     * It signs with the same provider production signs with, so a test cannot pass against a signature
-     * production would have refused.
-     */
-    signOwnEphemeralForTest(agentName: string, sessionId: string): Promise<{
-        ephemeralPublic: Uint8Array;
-        signature: Uint8Array;
-    } | null>;
-    /**
-     * Test seam: deliver a peer's signed ephemeral, exactly as the content-stream decoder does.
-     *
-     * For harnesses whose connectivity is one-directional — one side dials, so only one announce ever
-     * lands — this is what completes the exchange instead of stuffing a key in. It runs the REAL
-     * verification and the REAL derivation, so a test cannot pass against a signature production would
-     * have refused.
-     */
-    handleEphemeralFrameForTest(agentName: string, sessionId: string, frame: {
-        ephemeralPublic?: Uint8Array;
-        signature?: Uint8Array;
-    }, correlationId?: string): Promise<void>;
     /**
      * Test seam: deliver an inbound salt frame, exactly as the content-stream decoder does.
      *
@@ -2541,76 +1274,10 @@ export declare class SessionNodeManager {
      */
     handleSaltFrameForTest(agentName: string, sessionId: string, frame: SaltAgreementFrame, correlationId?: string): Promise<void>;
     /**
-     * Test seam: drop this session's own half while leaving the stored salt in place — the state every
-     * teardown produces, because `#evictSessionCaches` clears the map and the row survives.
-     *
-     * It clears the SAME map the eviction clears rather than a stand-in, so a test cannot pass against
-     * a state the daemon never reaches. Reproducing it through a real teardown/revive would also drag
-     * in node rebuild and relay reconnection, none of which this is about.
-     */
-    forgetSaltContributionForTest(agentName: string, sessionId: string): void;
-    /**
-     * THE ONE PLACE THAT DECIDES HOW A SESSION'S OUTBOUND CONTENT IS HASHED —
-     * `DOD-M15-SEALWIRE-1` part B2b.
-     *
-     * Returns the hash AND the algorithm that produced it, together, because the two must not be
-     * decided separately. `wire-content-hash.ts` exists for exactly this reason and says so in its own
-     * header: the expression was written out at five call sites, the two added last got it wrong, and
-     * the failure was invisible — *"the send succeeds, `parked: false`, the sender's log says the frame
-     * left, and the receiver discards it at the authenticity check."* It took two real daemons.
-     *
-     * There are FOUR outbound sites (`session-content-handlers.ts`, two in `daemon.ts`,
-     * `document-delivery-transport.ts`). Once salting is switchable, each of them independently
-     * deciding whether to salt is that defect again with a worse failure mode — a message hashed one
-     * way and LABELLED another is refused by every peer, including a correct one.
-     *
-     * ⚠️ ASYNC, AND THAT IS THE POINT — B2b-2 constraint 2, not an implementation detail.
-     *
-     * The agreement is in flight while the operator composes their first message. Hash without waiting
-     * and it comes out unsalted, and that first unsalted hash closes adoption for the LIFE of the
-     * session (Decision #8, unit 1). Every session would fall back permanently while every log line
-     * about it stayed true — the feature present, wired, tested, and never once reached.
-     *
-     * The wait lives HERE rather than at the four call sites for the same reason `contentHashAlg` is a
-     * required parameter rather than a defaulted one: a site that forgets it must fail to compile. A
-     * caller that drops the `await` gets a `Promise` where bytes belong, which is a typecheck error;
-     * a caller that forgot to call a separate `awaitSaltSettled()` would silently send unsalted.
-     */
-    contentHashForSession(agentName: string, sessionId: string, content: Uint8Array): Promise<{
-        hash: Uint8Array;
-        alg: ContentHashAlg;
-    }>;
-    /**
-     * THIS SESSION'S UNSALTED HASH NEVER BECAME A MESSAGE — release the permanent closure it caused.
-     *
-     * ⚠️ REVIEW FINDING 3, and it is the opposite of the direction the flag was written to defend.
-     * `#hashedWithoutSalt` closes adoption at hash time, because for a session's first message the
-     * leaf is a network round trip away and every frontier count reads zero in between. Correct — but
-     * `cello_send` has three paths that compute the hash and then produce NOTHING: a sibling send
-     * holding the in-flight claim, the frontier moving under the send, and a non-durable send failure
-     * whose bytes go to a queue with no production consumer.
-     *
-     * In all three the session was permanently unsalted for a message that exists nowhere: no leaf, no
-     * wire, no copy at the peer. And B2b-2 made two of them MORE likely on a first message, because
-     * the five-second wait widens the very window the frontier re-check is watching.
-     *
-     * Only safe because it is called on paths that provably sent nothing. It deliberately does NOT
-     * clear `#unsaltedAnnounced`: the announcement was true when it fired and re-announcing on the
-     * retry would be the per-message flood Decision #15 forbids.
-     *
-     * ─── THREE OTHER SITES HASH AND MAY SEND NOTHING, AND ARE EXEMPT ON PURPOSE (pass 2, F8) ──────
-     *
-     * `daemon.ts`'s one-shot rejection and away reply, and `document-delivery-transport.ts`'s frame
-     * send, can all fail after hashing. None of them needs to abandon, and the reason is the same in
-     * each: every one is a REPLY. The inbound message that triggered it has already been leafed on
-     * this side, so `#saltAdoptionClosed` is already closed by the leaf count and would stay closed
-     * whatever this flag said. Calling abandon there would be a no-op that looks like a guarantee.
-     *
-     * Written down rather than left to be re-derived: the next reader's first question is why the
-     * list is three and not six.
-     */
-    abandonUnsaltedHash(agentName: string, sessionId: string): void;
+    
+  
     /**
+      /**
      * TEST SEAM — put a session into the state a real one is in between announcing and being answered.
      *
      * Reaching that state for real needs a live counterparty connection, which the daemon-level
@@ -2618,30 +1285,6 @@ export declare class SessionNodeManager {
      * the same private registration the announce path calls, so it cannot drift from it.
      */
     markSaltAgreementPendingForTest(agentName: string, sessionId: string, boundMs?: number): void;
-    /**
-     * PUBLIC read of a session's agreed salt — `DOD-M15-SEALWIRE-1` part B2a.
-     *
-     * `content-park.ts` runs a SECOND, independent content-hash verifier (the park signature does not
-     * cover the envelope content, so it checks before `ingestReceivedContent` is ever reached), and it
-     * hardcoded `sha256`. It needs the salt to verify a v3 envelope, and it is outside this class.
-     *
-     * Read-only and cache-backed, so exposing it adds no way to CHANGE the salt from outside — the
-     * only writer remains `#persistSessionSalt`, behind the one-salt-per-session predicate.
-     */
-    /**
-     * IS THIS SESSION ACTUALLY PROTECTED BY ITS SALT RIGHT NOW — pass 2, F3.
-     *
-     * Distinct from `getSessionContentSalt`, which is POSSESSION and is what the verifier needs: a
-     * message parked before suspension was hashed under this salt and must still be checkable against
-     * it, so that accessor must keep answering with the bytes.
-     *
-     * This one answers the OPERATOR's question, and it is a different question. A suspended session
-     * holds a salt it will not use, so every hash it produces is `sha256` — reporting `contentSalted:
-     * true` there is not a gap, it is an affirmatively false security claim on the surface whose own
-     * comment reads *"a security property must not be inferable from a gap."* Same predicate
-     * `#saltForHashing` uses, so the flag cannot drift from the behaviour it describes.
-     */
-    isContentSaltActive(agentName: string, sessionId: string): boolean;
     getSessionContentSalt(agentName: string, sessionId: string): Uint8Array | null;
     /**
      * THE SALT, OR WHY THERE ISN'T ONE — `DOD-M15-INCLUSION-1`, fallback-finder finding 2.
@@ -2850,7 +1493,6 @@ export declare class SessionNodeManager {
      * locked out by the acceptance bound forever.
      */
     countEstablishedReceived(agentName: string, sessionId: string): number;
-    countReceivedMessages(agentName: string, sessionId: string): number;
     /** CC-5/F21: unilaterally mark a session locally-terminal ("abandoned") — retire its live node and
      *  set the DB status, with NO bilateral seal (a dead half-open handshake has nothing to notarize).
      *  Used by cello_close_session { force } and the dead-half-open reaper. Idempotent: a missing/already-
@@ -2858,5 +1500,4 @@ export declare class SessionNodeManager {
      *  reviewer LOW: callers must not report a reap as successful when the write failed). */
     abandonSession(agentName: string, sessionId: string): Promise<boolean>;
 }
-export {};
 //# sourceMappingURL=session-node-manager.d.ts.map