@cello-protocol/daemon 0.0.207 → 0.0.209

package/dist/standing-receivers.js

@@ -3,7 +3,7 @@ import { SessionConnectionGater } from "./session-connection-gater.js";
 import { relayOnlyState, publishableEndpoint } from "./relay-only.js";
 import { extractErrorMessage } from "./error-message.js";
 import { randomBytes, randomUUID } from "node:crypto";
-import { relayPeerIdOf, heldRelayIdsOf, CIRCUIT_RELAY_ID, SR_RESERVATION_MAX_RETRIES, REVIVE_RESERVATION_CANDIDATES, REVIVE_RESERVATION_TIMEOUT_MS, } from "./session-node-types.js";
+import { relayPeerIdOf, heldRelayIdsOf, SR_RESERVATION_MAX_RETRIES, REVIVE_RESERVATION_CANDIDATES, REVIVE_RESERVATION_TIMEOUT_MS, RELEASE_TELL_BUDGET_MS, OFFER_RESERVATION_GRACE_MS, clientSideAskFault, holdsCircuit, stopWhenSettled, } from "./session-node-types.js";
 import { STANDING_RECEIVER_AGENT_NAME } from "./types.js";
 export class StandingReceivers {
     #ctx;
@@ -25,310 +25,474 @@ export class StandingReceivers {
     }
     async #startReceiverNode(agentName, sessionId, gater, candidateCircuitAddrs, correlationId) {
         /**
-         * 032-RELAYSPREAD — **ONE SEED FOR THE RECEIVER, REUSED ACROSS RELAYS**, replacing
-         * DOD-M12B-SESSION-SEED-1's seed-per-candidate.
+         * 054-SRSPLIT — **ONE NODE. IT STARTS ON TCP, THEN TAKES ITS RESERVATIONS IN PLACE.**
          *
-         * The agent is ONE identity and must be dialable at ONE peer id through any of its circuits, so
-         * every reservation this walk collects has to belong to the same key. A seed per relay would
-         * give the agent a different peer id down each circuit — N half-agents, none of them the one
-         * the counterparty was told to dial.
+         * This used to be a walk of throwaway PROBE nodes — one built per relay to find out whether that
+         * relay would grant, torn down, and then a FINAL node rebuilt carrying every granted address in
+         * its constructor. The probes existed for exactly one reason: a circuit listener was fixed at
+         * node creation, so the only way to ask a relay anything was to build a node to ask with.
          *
-         * ⚠️ THE RULE THIS REPLACES WAS RIGHT ABOUT ITS OWN CASE, so here is what changed and what did
-         * not. Its hazard is real and survives: a rejected candidate is torn down while its `start()`
-         * may still be in flight, so two nodes can briefly be live on this peer id. Two things bound it
-         * now, and neither existed when that rule was written:
-         *   - **THE ONE THAT CARRIES THE WEIGHT: DOD-M15-ASSIGN-1** made a standing receiver's gater
-         *     admit NOBODY inbound until a session offer names the dialer. The old rule's stated danger
-         *     — "sharing this gater, so it admits dials … an open endpoint under our advertised id" —
-         *     is not true of this gater any more. `#startReceiverNode` has exactly one caller and it
-         *     constructs that gater with `allowedPeerId: null` and an empty reserved set, so an
-         *     overlapping candidate is an endpoint that refuses everyone.
-         *   - the teardown is chained onto the candidate's OWN start promise (the `#buildRevivedNode`
-         *     pattern, verified against libp2p 3.3.2: `stop()` returns immediately unless the status is
-         *     `started`, and through the whole timeout window it is `starting`, so the old unawaited
-         *     `stop()` stopped nothing). ⚠️ This bounds the LEAK, not the OVERLAP — a timed-out
-         *     candidate is not awaited and the walk moves straight to the next one on the same seed, so
-         *     overlap is the normal shape of that case, not a remote possibility. It guarantees the
-         *     loser dies, and nothing more.
-         * `#buildRevivedNode` already runs a fixed identity through this same walk for the same reason.
+         * `listenOnCircuit` (unit 1) removed that constraint, and this is the simplification it unlocks:
+         * build the receiver ONCE, and for each relay prove and ask on the node that will keep it.
+         *
+         * ⚠️ **AND IT CLOSES THE DEFECT UNIT 1 LEFT STANDING, which was recorded here rather than
+         * fixed.** The final node was built with `circuitRelayListenAddrs`, so libp2p asked at start on
+         * a fresh connection that had proved nothing on itself. It worked only because the relay
+         * remembers a proof for `PROVEN_PEER_MEMORY_MS` — two minutes, in the OTHER repo — and when that
+         * memory had expired the original refused-ask collision came back for the one node that IS the
+         * agent's front door. There is no constructor-time ask left, so that dependency is gone, and
+         * `spread.grant_not_bound` — the event that existed to catch the proof expiring between the walk
+         * and the rebuild — has nothing left to report.
+         *
+         * ⚠️ **ONE SEED, and it still matters** (032-RELAYSPREAD). The agent is ONE identity and must be
+         * dialable at ONE peer id through any of its circuits. That is now structural rather than
+         * maintained: there is one node, so there is one key, and a second identity has nowhere to come
+         * from. The old hazard this note used to carry — an abandoned probe still starting on the
+         * receiver's seed — cannot occur, because no probe is built.
          */
         const receiverSeed = randomBytes(32);
-        /** Circuit addresses whose relay ACTUALLY GRANTED this identity a reservation. */
-        const grantedAddrs = [];
-        // For `spread.grant_not_bound` below: the walk's own duration is measured against the relay's
-        // two-minute proof memory, so it has to be a number rather than an inference.
-        const walkStartedAt = Date.now();
-        for (const circuitAddr of candidateCircuitAddrs) {
-            const candidateSeed = receiverSeed;
-            /**
-             * DOD-M15-RELAYSLOTS-1 — **TWO ATTEMPTS PER RELAY: ask, prove, ask again.**
-             *
-             * The relay now refuses a reservation from a peer that has not shown it belongs to a
-             * registered agent. A brand-new receiver has shown nothing, so its FIRST ask is refused —
-             * expected, not a failure. It then authenticates over `/cello/relay/1.0.0`, which tells the
-             * relay this transport identity is a registered agent's, and asks again on a fresh connection
-             * carrying the SAME identity (that is what reusing `candidateSeed` buys).
-             *
-             * ⚠️ It has to be two connections, and that was measured rather than chosen. Taking the
-             * reservation by hand on the same connection as the proof DOES get a slot — and libp2p then
-             * announces no circuit address for it, because it only announces addresses for reservations
-             * its own relay-discovery made. The agent would hold a slot nobody could dial through.
-             */
-            let candidateGranted = false;
-            // Set when the relay refused the AGENT rather than being unwilling itself: every other relay
-            // in the pool answers identically, so the walk ends here rather than reproducing it N times.
-            let candidateRefusedAgent = false;
-            for (let attempt = 0; attempt < 2; attempt++) {
-                const candidate = await this.createAgentNode(agentName, {
-                    sessionId,
-                    connectionGater: gater,
-                    nodeType: "standing_receiver",
-                    circuitRelayListenAddrs: [circuitAddr],
-                    transportPrivateKey: candidateSeed,
-                });
-                let timer;
-                const timedOut = Symbol("reservation_timeout");
-                let outcome = "failed";
-                let error = "";
-                // KEEP THE START PROMISE. Every candidate now carries the receiver's identity, so an
-                // abandoned one must be reliably torn down rather than best-effort — and only its own start
-                // promise says when it is stoppable (see the seed note above).
-                const startP = candidate.start();
-                try {
-                    outcome = await Promise.race([
-                        startP.then(() => "started"),
-                        new Promise((resolve) => {
-                            timer = setTimeout(() => resolve(timedOut), this.#ctx.srReservationTimeoutMs);
-                        }),
-                    ]);
-                }
-                catch (err) {
-                    error = extractErrorMessage(err);
-                }
-                finally {
-                    if (timer !== undefined)
-                        clearTimeout(timer);
-                }
-                // The only proof that counts: the relay actually GRANTED the reservation.
-                // start() resolving is not enough — a relay that is out of reservation slots
-                // completes the handshake and simply grants nothing, leaving a node that looks
-                // started and is reachable by nobody.
-                if (outcome === "started" && candidate.listenAddresses().some((a) => a.includes("/p2p-circuit"))) {
-                    candidateGranted = true;
-                    // The probe has done its job: this relay grants THIS identity. Tear it down and ask the
-                    // next relay — the reservation is re-taken by the final node below, which is the only one
-                    // that can listen on every granted address at once. AWAITED, because the next probe comes
-                    // up on this same peer id.
-                    try {
-                        await candidate.stop();
-                    }
-                    catch { /* it may never have finished starting */ }
-                    break;
-                }
-                /**
-                 * No reservation. On the FIRST attempt that is the expected answer for a receiver that has
-                 * not proved itself yet, so prove and go round once more. `proveReservation` opens its own
-                 * stream from this node, which is what binds this transport identity to the agent at the
-                 * relay; the relay remembers it across the reconnect below.
-                 */
-                if (attempt === 0 && outcome === "started") {
-                    const verdict = await this.#ctx.proveToRelay(agentName, circuitAddr, candidate, correlationId, true);
-                    // AWAITED, not fire-and-forget: the retry rebuilds on this same transport identity, and two
-                    // live nodes sharing one peer id is the defect DOD-M12B-SESSION-SEED-1 exists to prevent.
-                    try {
-                        await candidate.stop();
-                    }
-                    catch { /* it may never have finished starting */ }
-                    /**
-                     * DOD-M15-RELAYSLOTS-1 clause 9 — **A CLIENT-SIDE REFUSAL ENDS THE WALK.**
-                     *
-                     * `slot_cap_exceeded` and an expired or missing token are classified `tryAnotherRelay:
-                     * false` because they reproduce on every relay in the pool: the cap is per AGENT, and the
-                     * token comes from the directory, not from here. Walking on costs a node build and two
-                     * dials per remaining relay to arrive at the same answer, and it makes one client-side
-                     * fault look like a fleet-wide outage in the logs. The refusal is already recorded where
-                     * `cello_status` reads it, so stopping is not silence.
-                     */
-                    if (verdict === "refused_this_agent") {
-                        this.#ctx.srLastRejectionReason.set(agentName, "relay_refused_this_agent");
-                        this.#ctx.logger.warn("session.standing_receiver.relay.rejected", {
-                            agentName,
-                            circuitAddr,
-                            reason: "relay_refused_this_agent",
-                            attempts: attempt + 1,
-                            correlationId,
-                            impact: "the relay refused this AGENT rather than this relay being unwilling or " +
-                                "unwell, so every other relay would refuse it identically. Stopped here; " +
-                                "cello_status carries the cause and what to do about it.",
-                        });
-                        candidateRefusedAgent = true;
-                        break;
-                    }
-                    /**
-                     * ⚠️ RETRY ONLY WHAT A PROOF CAN FIX. The second attempt exists because the relay now
-                     * remembers this transport identity; if the proof did not land, it remembers nothing and
-                     * the retry is a node build and a dial spent to be refused identically. Only `proven`
-                     * earns the retry — everything else moves to the next relay.
-                     */
-                    if (verdict !== "proven") {
-                        this.#ctx.srLastRejectionReason.set(agentName, "relay_proof_refused");
-                        this.#ctx.logger.warn("session.standing_receiver.relay.rejected", {
-                            agentName,
-                            circuitAddr,
-                            reason: "relay_proof_refused",
-                            attempts: attempt + 1,
-                            correlationId,
-                            impact: "this relay would not take the agent's proof, so it will refuse the retry the " +
-                                "same way. Moving to the next relay rather than asking this one twice.",
-                        });
-                        break;
-                    }
-                    continue;
-                }
-                const rejectionReason = outcome === "started"
-                    ? /**
-                       * ⚠️ Review MEDIUM-7 — **"STARTED" DOES NOT MEAN THE RELAY ANSWERED.** A circuit listen
-                       * entry sets `FaultTolerance.NO_FATAL`, and `start()` only throws when the DIRECT
-                       * listener fails, so a relay that is simply DOWN resolves `started` with no circuit
-                       * address — indistinguishable, here, from a relay that answered and granted nothing.
-                       * Reporting that as `relay_granted_no_reservation` sends the operator to look at relay
-                       * capacity for what is a network fault. An open connection to the relay peer is the
-                       * thing that separates them, and we have one to ask.
-                       */
-                        (candidate.getConnections().some((c) => c.peerId === relayPeerIdOf(circuitAddr))
-                            ? "relay_granted_no_reservation"
-                            : "relay_unreachable")
-                    : outcome === "failed"
-                        ? "relay_unreachable"
-                        : "reservation_did_not_complete_in_time";
-                this.#ctx.srLastRejectionReason.set(agentName, rejectionReason);
-                this.#ctx.logger.warn("session.standing_receiver.relay.rejected", {
-                    agentName,
-                    circuitAddr,
-                    reason: rejectionReason,
-                    attempts: attempt + 1,
-                    ...(error !== "" ? { error } : {}),
-                    correlationId,
-                });
-                // Abandon it — but on its OWN settlement, never best-effort. `start()` may still be parked on
-                // a dial, and this candidate carries the receiver's identity: an unawaited `stop()` on a node
-                // whose status is still `starting` returns without stopping anything, and the node then goes
-                // live on our peer id with nothing left holding a reference to kill it.
-                void startP.then(() => candidate.stop().catch(() => { }), () => { });
-                break;
-            }
-            if (candidateGranted)
-                grantedAddrs.push(circuitAddr);
-            // 032-RELAYSPREAD: DO NOT BREAK ON THE FIRST GRANT. The walk used to stop here, which is why
-            // an agent held exactly one reservation and losing that relay cost it every NAT'd caller for
-            // however long detection happened to take. It now asks every remaining relay.
-            if (candidateRefusedAgent)
-                break;
-        }
         /**
-         * THE RECEIVER, listening on EVERY granted circuit address.
-         *
-         * One node per agent, as before — what changed is how many circuits it announces. Each address
-         * here belongs to a relay that granted THIS seed moments ago and therefore still remembers the
-         * identity, so the final node's first ask is the one that succeeds; the two-attempt dance was
-         * already paid per relay in the walk.
-         *
-         * ⚠️ RACED AGAINST A DEADLINE, and that is measured rather than cautious: `#buildRevivedNode`
-         * records a live 2026-08-18 result where a node handed two relay addresses at once with no
-         * deadline never finished starting at all (10,002ms and counting). Its identity was unproven at
-         * both relays, which is not this case — but "not this case" is a prediction, and the standing
-         * receiver is the thing that makes an agent reachable, so it does not wait on one.
-         *
-         * An empty `grantedAddrs` yields the plain TCP floor, exactly as before: reachable by peers
-         * that can dial directly, and loud about it (`session.standing_receiver.reservation.none`).
+         * Relay peers are allowed OUTBOUND before the node starts. Unchanged and load-bearing: our own
+         * gater would otherwise refuse our own dial, and refreshes must keep working after
+         * `setAllowedPeer()` narrows the inbound gate to a session counterparty (DOD-M15-ASSIGN-1).
+         * The gater still admits NOBODY inbound here.
          */
+        for (const addr of candidateCircuitAddrs) {
+            const relayPeerId = relayPeerIdOf(addr);
+            if (relayPeerId)
+                gater.setAllowedOutboundPeer(relayPeerId);
+        }
         const node = await this.createAgentNode(agentName, {
             sessionId,
             connectionGater: gater,
             nodeType: "standing_receiver",
-            ...(grantedAddrs.length > 0 ? { circuitRelayListenAddrs: grantedAddrs } : {}),
+            // NO `circuitRelayListenAddrs` — nothing is asked for at start. See the note above.
             transportPrivateKey: receiverSeed,
         });
-        if (grantedAddrs.length === 0) {
-            await node.start();
-            return { node, seed: receiverSeed };
+        await node.start();
+        /**
+         * ⚠️ **THE WALK IS GONE — 055-ONDEMAND, and this is the capacity change itself.**
+         *
+         * The receiver used to visit every relay it had ever heard of and hold a slot on each, for the
+         * life of the login, against the chance that somebody called. Demand was `agents × relays`, so
+         * the tenth relay added a tenth of the fleet's demand and one relay's worth of capacity, and
+         * the ratio `agents / slots-per-relay` never improved however many relays were run.
+         *
+         * **An idle agent now holds ZERO.** A reservation is taken when an offer arrives, on the relay
+         * the directory names (`takeReservationForSession`), and given back at the seal. Demand becomes
+         * `live sessions × 1`.
+         *
+         * **What makes that safe, and it is the reason this is not a reachability regression:**
+         *   - The relay's MAILBOX consults no reservation. Deposit authenticates the depositor by their
+         *     Noise peer id; pull is a signature challenge on the recipient and is an OUTBOUND dial. So
+         *     store-and-forward keeps working with nothing held.
+         *   - The WITNESS is a separate dial on the relay's own protocol. Nothing about the seal, the
+         *     hash chain or the transcript depended on a reservation.
+         *   - A cold call to a LOGGED-OUT agent was already refused with nothing queued, so no
+         *     capability is lost — there was never an answering machine to lose.
+         *
+         * The candidate list is still passed in and still used: it is what the offer path reserves
+         * against when it needs to, and what `cello_status` reports as relays this agent could use.
+         */
+        this.#ctx.logger.info("session.standing_receiver.idle", {
+            agentName,
+            relaysAvailable: candidateCircuitAddrs.length,
+            correlationId,
+            impact: "this agent holds no relay reservation while idle, by design. One is taken on the " +
+                "relay the directory names when a session is offered, and given back at the seal.",
+        });
+        return { node, seed: receiverSeed };
+    }
+    /**
+     * 054-SRSPLIT — **TAKE ONE RESERVATION, ON A NODE THAT IS ALREADY RUNNING.**
+     *
+     * The whole relay handshake for one relay: prove over `/cello/relay/1.0.0` on a connection we
+     * open, then ask libp2p's own transport manager to listen on the circuit. The relay grants on the
+     * first ask because it marks `slot.provenForReservation` per CONNECTION at auth time and libp2p's
+     * reservation store reuses the open connection rather than dialling a new one (measured live
+     * 2026-09-08; `DOD-M15-RELAYPROVE-ORDER-1`).
+     *
+     * ⚠️ **THE NODE IS NOT STOPPED BETWEEN THE PROOF AND THE ASK.** The relay marks the CONNECTION,
+     * not the peer id, so closing it throws away the very thing that makes the ask succeed.
+     */
+    /**
+     * 055-ONDEMAND — **take a reservation for a SESSION, on the relay the directory named.**
+     *
+     * The public face of `#takeReservation` for the offer path. An idle agent holds nothing, so this
+     * is what makes it dialable, and it lasts only as long as the session that asked for it.
+     *
+     * Returns whether one was granted. A `false` is a degradation, not a failure: the counterparty
+     * can still reach this agent directly, or through the relay's store-and-forward. The one caller
+     * that must treat it as fatal is relay-only mode, which does so at its own guard.
+     */
+    /**
+     * 055-ONDEMAND — the abandoned-offer timers, keyed `agent::sessionIdHex`. See `#armOfferRelease`.
+     */
+    #offerReleaseTimers = new Map();
+    /**
+     * ⚠️ **AN OFFER THAT GOES QUIET MUST NOT KEEP A SLOT — `DOD-M15-OFFER-EXPIRY-1`, RELOCATED.**
+     *
+     * The story predicted this exactly: the permanently-open door units 2 and 3 removed does not take
+     * the defect with it, it moves it somewhere more expensive. The responder reserves the moment an
+     * offer arrives; an initiator that never dials — it aborted, the directory faulted — would leave a
+     * slot held on a SHARED relay until its TTL, two hours by default. That is a cost on the exact
+     * resource this whole story exists to conserve, and "released at seal" cannot cover it because
+     * there is no seal.
+     *
+     * ⚠️ **THE BUDGET IS NOT THE DIRECTORY'S 2-SECOND ACCEPT CLOCK, and picking that would be worse
+     * than not doing this at all.** The accept is only the start: the assignment still has to be
+     * FROST-signed by a threshold of directory nodes and delivered to both parties before either
+     * builds a session. Releasing on 2 s would take the slot out from under a session that was about
+     * to begin — turning a rare abandoned offer into a common broken one.
+     *
+     * No cancellation plumbing: the timer ASKS whether the session started. A session that began and
+     * has already sealed is also not live, and that case has already released through the seal path,
+     * where the teardown releases from the session's own node.
+     */
+    #armOfferRelease(agentName, sessionIdHex, circuitAddr, correlationId) {
+        const key = `${agentName}::${sessionIdHex}`;
+        const existing = this.#offerReleaseTimers.get(key);
+        if (existing !== undefined)
+            clearTimeout(existing);
+        const timer = setTimeout(() => {
+            this.#offerReleaseTimers.delete(key);
+            if (this.#ctx.shuttingDown())
+                return;
+            if (this.#ctx.sessionIsLive(agentName, sessionIdHex))
+                return; // it started; the seal owns it now
+            this.#ctx.logger.warn("session.reservation.offer_abandoned", {
+                agentName,
+                sessionIdHex,
+                circuitAddr,
+                heldForMs: OFFER_RESERVATION_GRACE_MS,
+                correlationId,
+                impact: "a relay slot was taken to answer an offer that never became a session — the " +
+                    "initiator did not dial. Given back rather than held until the relay's TTL, which is " +
+                    "two hours and is a cost on every other agent that relay serves.",
+            });
+            /**
+             * ⚠️ THE RECEIVER'S OWN NODE, and at this point that is the right one: the offer never became a
+             * session, so nothing was promoted and the circuit is still on the standing receiver. (Had it
+             * been promoted, `sessionIsLive` above would have returned and we would not be here.)
+             */
+            const sr = this.#ctx.standingReceivers.get(agentName);
+            if (sr) {
+                void this.releaseSessionReservation(agentName, sr.node, sessionIdHex, correlationId)
+                    .catch(() => { });
+            }
+        }, OFFER_RESERVATION_GRACE_MS);
+        timer.unref?.();
+        this.#offerReleaseTimers.set(key, timer);
+    }
+    /**
+     * 055-ONDEMAND — re-take a circuit on a node that already exists, for a live session that lost it.
+     *
+     * ⚠️ **IT PROVES OVER THE DELIVERY PATH TOO.** `DOD-M15-RELAYAUTH-1` applies identically here: a
+     * holder that has not proven key possession has its reservation revoked inside the relay's grace
+     * window, about fifteen seconds. The first version of the re-take called the low-level ask
+     * directly and skipped it, so a re-taken circuit would have been revoked almost immediately while
+     * the log said "granted" — the same defect this unit already fixed one function up.
+     */
+    async retakeReservationOn(agentName, node, circuitAddr, correlationId) {
+        const relayPeerId = relayPeerIdOf(circuitAddr);
+        const outcome = await this.#takeReservation(agentName, node, circuitAddr, correlationId);
+        if (outcome !== "granted")
+            return false;
+        /**
+         * ⚠️ **THE OTHER HALF OF `reservation_lost` — 056-SLOTDEAD, review F4.**
+         *
+         * The loss trigger fires the moment a reservation goes, which is exactly when the relay link is
+         * down, so the pull it starts is aimed at a relay that cannot answer. Without something on the
+         * recovery, content the counterparty parked during the outage waits for the slow periodic
+         * backstop while the relay is healthy and this agent is connected to it again.
+         *
+         * **This path, and not the two that look like it.** The watchdog's `gained` branch was the
+         * first attempt and never fired — a take records the new circuit on the receiver itself, so by
+         * the next tick there is nothing left for the watchdog to see as gained; a test caught it, which
+         * is the only reason it is not still in the tree looking correct. `takeReservationForSession`
+         * was the second, and it double-drains: on a first login it fires moments after the install
+         * drain, for the same empty mailbox.
+         *
+         * A re-take is unambiguous. It happens only when a session that HAD a circuit lost it, which is
+         * exactly the outage whose recovery this is.
+         */
+        this.#ctx.park.fireParkedDrain(agentName, "reservation_regained");
+        if (relayPeerId) {
+            void this.#ctx.authenticateStandingReceiver(agentName, node, relayPeerId, circuitAddr, correlationId)
+                .catch((err) => {
+                this.#ctx.logger.warn("session.standing_receiver.relay_auth.failed", {
+                    agentName, relayPeerId, correlationId,
+                    error: extractErrorMessage(err),
+                    impact: "a live session re-took a circuit but did not prove key possession over the " +
+                        "delivery path, so the relay may revoke it inside its grace window.",
+                });
+            });
         }
+        return true;
+    }
+    async takeReservationForSession(agentName, circuitAddr, correlationId, 
+    /**
+     * ⚠️ **PRESENT ONLY ON THE OFFER PATH, AND THAT IS WHAT ARMS THE ABANDONED-OFFER RELEASE.**
+     *
+     * The first version reused `correlationId` for this, because the offer handler happens to pass
+     * the session id as its correlation id. Two meanings in one parameter is how a value ends up
+     * being trusted for something it was never chosen for: the watchdog's re-take passes a genuine
+     * correlation id, and it would have armed a timer keyed on a string that is not a session.
+     *
+     * Absent for the re-take path, which is by definition for a session that is already live.
+     */
+    offerSessionIdHex) {
+        const sr = this.#ctx.standingReceivers.get(agentName);
+        if (!sr) {
+            this.#ctx.logger.warn("session.reservation.on_demand.no_receiver", {
+                agentName,
+                circuitAddr,
+                correlationId,
+                impact: "there is no standing receiver to hold a reservation, so this agent cannot be " +
+                    "dialled for this session; it is reachable through the relay's store-and-forward only.",
+            });
+            return false;
+        }
+        // The relay must be dialable BEFORE we dial it — our own gater refuses otherwise, which is the
+        // same ordering the login walk uses and the one that cost a whole debugging session when it
+        // was missing.
+        const relayPeerId = relayPeerIdOf(circuitAddr);
+        if (relayPeerId)
+            sr.gater.setAllowedOutboundPeer(relayPeerId);
+        const outcome = await this.#takeReservation(agentName, sr.node, circuitAddr, correlationId);
         /**
-         * ⚠️ SLOW AND FAILED ARE DIFFERENT ANSWERS AND MUST NOT SHARE A BRANCH. Review F1: a single
-         * `.catch(() => false)` around this race collapsed every `start()` REJECTION into the deadline
-         * branch — and `CelloNodeImpl.start()` rejects by design, stopping the node and throwing
-         * `listen_failed` when no direct (non-circuit) listener materialised. That is the guard the
-         * transport keeps precisely so `FaultTolerance.NO_FATAL` cannot mask a real `EADDRINUSE`.
+         * ⚠️ **THE RECEIVER'S RECORD OF WHAT IT HOLDS MUST FOLLOW, or two things go quietly wrong.**
+         * `relayPeerIds` is what the reservation watchdog compares against to decide a reservation was
+         * LOST, and what `cello_status` reports as reachability. Left at its build-time value — empty,
+         * now that nothing is taken at login — the watchdog would see a held circuit it never recorded
+         * and `cello_status` would call a reachable agent unreachable.
          *
-         * Swallowed, it installed a STOPPED node as the agent's front door: no addresses to advertise,
-         * `#tryCreateStandingReceiver` never saw a failure so the M8B F14 retry never fired, and the
-         * operator was told the receiver "did not finish binding every circuit inside the deadline" and
-         * "is reachable through those" — sending them to the relay fleet for a port held by an orphan
-         * daemon on their own machine. The rejection is rethrown so it reaches
-         * `session.node.create.failed` with its own cause, exactly as it does on the no-relay path.
+         * Read from the NODE rather than appended to, and deduped by relay: libp2p announces one
+         * address per relay listen address, so a five-address relay would otherwise count five times.
          */
-        let deadline;
-        let startError;
-        const started = node.start().then(() => "ok", (err) => { startError = err; return "failed"; });
-        const outcome = await Promise.race([
-            started,
-            new Promise((resolve) => {
-                // Per granted relay: each circuit listener is its own dial and its own reservation, so a
-                // pool of three must not be judged on a budget sized for one.
-                deadline = setTimeout(() => resolve("slow"), this.#ctx.srReservationTimeoutMs * grantedAddrs.length);
-            }),
-        ]);
-        if (deadline !== undefined)
-            clearTimeout(deadline);
-        if (outcome === "failed")
-            throw startError;
+        const heldNow = heldRelayIdsOf(sr.node);
+        this.#ctx.standingReceivers.set(agentName, { ...sr, relayPeerIds: heldNow });
         /**
-         * GRANTED IN THE WALK, REFUSED AT INSTALL — a distinct fact and, until this line, an invisible
-         * one. The receiver would simply report `reservationsHeld: 2` where 3 relays granted, with
-         * nothing naming which relay went missing or why.
+         * ⚠️ **A RELAY THAT GRANTED MUST BE ADMITTED INBOUND, OR THE RESERVATION BUYS NOTHING.**
+         *
+         * The gater's inbound carve-out is the security-sensitive half of a reservation: only relays
+         * whose own grant is confirmed earn it, so a directory that merely NAMES a relay cannot dial us
+         * through it. That set was built once from what the login walk held — empty now — so an
+         * on-demand reservation would have been taken, announced, and then refused by OUR OWN gater
+         * when the counterparty dialled through it.
+         *
+         * Recomputed from what the node HOLDS, never from what was asked: being named by the directory
+         * must not buy a foothold, and under on-demand the directory is what names the relay.
+         */
+        sr.gater.setReservedRelayPeers(heldNow);
+        /**
+         * ⚠️ **DOD-M15-RELAYAUTH-1 STILL APPLIES, AND IT NO LONGER FIRES ON ITS OWN.**
+         *
+         * That auth is a SECOND proof, over the DELIVERY path, and it is what keeps the relay from
+         * revoking a reservation whose holder has not proven key possession to it — the grace window is
+         * about fifteen seconds. It used to run in the receiver build, over the circuits the login walk
+         * had just collected. Nothing is collected there any more, so without this line an on-demand
+         * reservation would be taken and then quietly revoked mid-session, and the agent would go
+         * unreachable while every log said the reservation was granted.
          *
-         * ⚠️ IT HAS A KNOWN CAUSE AND A CROSS-REPO CLOCK. The walk stops the granted candidate and the
-         * node below RE-ASKS, which works because the relay remembers the proof — for
-         * `PROVEN_PEER_MEMORY_MS = 2 minutes` (`relay-connection-gater.ts`, trustless-cello). The walk
-         * costs up to `#srReservationTimeoutMs` × 2 attempts per relay, so a pool of three at the
-         * 15s default can spend 90 seconds before the final node asks relay 1 again. The earliest
-         * proof can expire before it is used, and that is what this event catches.
+         * Best-effort and unawaited, exactly as it is in the build path: a failure here costs the
+         * relay's own grace-window revoke, which the watchdog already treats as an ordinary loss.
          */
-        const boundRelays = new Set(heldRelayIdsOf(node));
-        const grantedButUnbound = grantedAddrs
-            .map((a) => CIRCUIT_RELAY_ID.exec(a)?.[1])
-            .filter((id) => id !== undefined && !boundRelays.has(id));
-        if (grantedButUnbound.length > 0) {
-            this.#ctx.logger.warn("session.standing_receiver.spread.grant_not_bound", {
+        if (outcome === "granted" && offerSessionIdHex !== undefined) {
+            this.#armOfferRelease(agentName, offerSessionIdHex, circuitAddr, correlationId);
+        }
+        if (outcome === "granted" && relayPeerId) {
+            void this.#ctx.authenticateStandingReceiver(agentName, sr.node, relayPeerId, circuitAddr, correlationId)
+                .catch((err) => {
+                this.#ctx.logger.warn("session.standing_receiver.relay_auth.failed", {
+                    agentName, relayPeerId, correlationId,
+                    error: extractErrorMessage(err),
+                    impact: "this agent has a reservation the relay may revoke within its grace window, " +
+                        "because key possession was not proven over the delivery path.",
+                });
+            });
+        }
+        return outcome === "granted";
+    }
+    /**
+     * 055-ONDEMAND — **GIVE THIS SESSION'S SLOT BACK, FROM THE NODE THAT ACTUALLY HOLDS IT.**
+     *
+     * ⚠️ **THE FIRST VERSION LOOKED THE NODE UP BY AGENT NAME AND ALWAYS FOUND THE WRONG ONE.** When a
+     * session opens, the standing receiver is PROMOTED: `session-lifecycle` deletes it from
+     * `standingReceivers`, moves that exact node into `activeNodes`, and builds a fresh empty receiver
+     * behind it. So by seal time `standingReceivers.get(agentName)` is the new idle node, holding
+     * nothing — the release read `[]`, returned immediately, and told the relay nothing. The slot the
+     * offer took lived on the promoted node and died with it, invisible to the relay, held for the
+     * full TTL. **A release that always no-ops is worse than none: it logs success.**
+     *
+     * ⚠️ **AND THE CROSS-SESSION RECOMPUTE THE ORDER ASKED FOR IS UNNECESSARY, which is the good news
+     * in the correction.** libp2p's shared `reservationStore` is shared *within one node*. Each live
+     * session owns its OWN node, so sealing one cannot clear another session's refresh timers. There
+     * is nothing to recompute: this node is being torn down anyway, so tell its relays and drop its
+     * circuits. Re-deriving that removed a whole class of drift rather than managing it.
+     */
+    async releaseSessionReservation(agentName, node, sessionId, correlationId) {
+        const held = heldRelayIdsOf(node);
+        if (held.length === 0)
+            return;
+        for (const relayPeerId of held) {
+            /**
+             * ⚠️ BOUNDED, BECAUSE THIS RUNS INSIDE A TEARDOWN. Telling a relay means dialling it, and an
+             * unreachable one would otherwise hold the seal open for as long as its dial takes. Measured
+             * the hard way: unbounded, this hung fourteen unrelated suites at 237s each. A seal waiting on
+             * a courtesy is worse than a slot held until its TTL.
+             */
+            await Promise.race([
+                this.#ctx.tellRelayReleased(agentName, relayPeerId, node, correlationId),
+                new Promise((r) => setTimeout(r, RELEASE_TELL_BUDGET_MS).unref?.()),
+            ]);
+        }
+        // Local half. The node is going away regardless; this stops it announcing a route it no longer
+        // holds for whatever is left of its life.
+        try {
+            await node.releaseAllCircuits();
+        }
+        catch (err) {
+            this.#ctx.logger.debug("session.reservation.release.local_failed", {
+                agentName, sessionId, correlationId, error: extractErrorMessage(err),
+                // The node is being torn down either way, so this costs nothing beyond a few more seconds
+                // of announcing a route that is already gone at the relay. Deliberately NOT claiming the
+                // watchdog repairs it (review MEDIUM-11): this unit removed the rebuild that used to.
+                impact: "the session's node keeps announcing a circuit it has released, until it stops.",
+            });
+        }
+        this.#ctx.logger.info("session.reservation.released", {
+            agentName,
+            sessionId,
+            releasedRelays: held,
+            correlationId,
+            impact: "the slot this session borrowed is back in the relay's table, rather than held until " +
+                "its two-hour TTL.",
+        });
+    }
+    async #takeReservation(agentName, node, circuitAddr, correlationId) {
+        const verdict = await this.#ctx.proveToRelay(agentName, circuitAddr, node, correlationId, true);
+        if (verdict === "refused_this_agent" || verdict === "refused_try_another_relay") {
+            const reason = verdict === "refused_this_agent" ? "relay_refused_this_agent" : "relay_proof_refused";
+            this.#ctx.srLastRejectionReason.set(agentName, reason);
+            this.#ctx.logger.warn("session.standing_receiver.relay.rejected", {
                 agentName,
-                relayPeerIds: grantedButUnbound,
-                relaysGranted: grantedAddrs.length,
-                reservationsHeld: boundRelays.size,
-                walkMs: Date.now() - walkStartedAt,
+                circuitAddr,
+                reason,
                 correlationId,
-                impact: "these relays granted this agent a reservation during the walk and then bound no " +
-                    "circuit on the receiver itself, so the agent is reachable through fewer relays than it " +
-                    "earned. The relay remembers a proof for two minutes; if walkMs is near or past that, " +
-                    "the proof expired before the receiver asked and the walk is what needs shortening — " +
-                    "not the relay fleet.",
+                impact: verdict === "refused_this_agent"
+                    ? "the relay refused this AGENT rather than being unwilling or unwell, so every other " +
+                        "relay would refuse it identically. Stopped here; cello_status carries the cause."
+                    : "this relay would not take the agent's proof. Moving to the next relay.",
             });
+            return verdict === "refused_this_agent" ? "refused_this_agent" : "declined";
         }
-        if (outcome === "slow") {
-            // NOT a teardown, and now this line means only what it says: the node is starting and has not
-            // finished. It is installed with whatever circuits did materialise, because some reachability
-            // beats none and the reservation watchdog is what settles the rest.
-            this.#ctx.logger.warn("session.standing_receiver.spread.slow_start", {
+        /**
+         * ⚠️ **A PROOF THAT REACHED NO VERDICT IS NOT A REFUSAL** — `unavailable` means the relay never
+         * answered (no client wired, or unreachable), and NOT every relay gates reservations. Refusing
+         * to ask because our own proof path was unavailable would lose the ability to reserve with an
+         * ungated relay entirely. The boundary is enforced in `proveToRelay`, which returns
+         * `unavailable` for exactly this (review HIGH-1 on unit 1).
+         */
+        if (verdict === "unavailable") {
+            this.#ctx.logger.warn("session.standing_receiver.prove.no_verdict", {
                 agentName,
-                relaysGranted: grantedAddrs.length,
-                circuitAddrs: node.listenAddresses().filter((a) => a.includes("/p2p-circuit")).length,
-                budgetMs: this.#ctx.srReservationTimeoutMs * grantedAddrs.length,
+                circuitAddr,
                 correlationId,
-                impact: "the receiver did not finish binding every circuit it was granted inside the " +
-                    "deadline, so it is being installed with the circuits it has. It is reachable through " +
-                    "those; the reservation watchdog re-checks the rest on its next tick.",
+                impact: "no proof verdict was obtained from this relay. Asking for the reservation anyway: " +
+                    "a relay that does not gate them grants it, and one that does refuses an ask that cost a " +
+                    "single dial.",
             });
         }
-        return { node, seed: receiverSeed };
+        let askFault;
+        let error = "";
+        let timer;
+        const timedOut = Symbol("listen_timeout");
+        let outcome = timedOut;
+        try {
+            /**
+             * ⚠️ **AN ABANDONED ASK NOW LANDS ON A NODE THAT LIVES ON** — review MEDIUM-5, and it is the
+             * mirror image of the hazard the old probe teardown existed for.
+             *
+             * When a probe timed out it was destroyed, so a grant arriving late died with it. There is
+             * one long-lived node now: a late grant ADDS a circuit address after the walk has counted
+             * what it holds, so the receiver would advertise a relay that is in neither `sr.relayPeerIds`
+             * nor the gater's reserved set — the ledger and the advertised addresses disagreeing, which
+             * is what the watchdog then churns on.
+             *
+             * So a late grant is GIVEN BACK rather than kept. Releasing costs a dial; keeping it costs a
+             * disagreement no operator can see, and a slot on a relay we already decided against.
+             */
+            const askP = node.listenOnCircuit(circuitAddr).then(() => "asked");
+            void askP.catch(() => { });
+            outcome = await Promise.race([
+                askP,
+                new Promise((resolve) => {
+                    timer = setTimeout(() => resolve(timedOut), this.#ctx.srReservationTimeoutMs);
+                }),
+            ]);
+            if (outcome === timedOut) {
+                void askP.then(() => {
+                    this.#ctx.logger.warn("session.standing_receiver.reservation.late_grant_released", {
+                        agentName,
+                        circuitAddr,
+                        correlationId,
+                        impact: "this relay answered after the walk had moved on, so its circuit was not " +
+                            "counted or advertised. Given back rather than held: a slot nobody knows about is " +
+                            "one the relay cannot reuse and this agent cannot rely on. ⚠️ This drops EVERY " +
+                            "circuit — libp2p's reservation store is shared across listeners and cannot " +
+                            "release one — so the receiver is rebuilt by the watchdog, which is the correct " +
+                            "outcome: a walk whose result is already wrong should be redone, not patched.",
+                    });
+                    return node.releaseAllCircuits().catch(() => false);
+                }, () => { });
+            }
+        }
+        catch (err) {
+            error = extractErrorMessage(err);
+            // A fault of OURS keeps its own name rather than being re-derived from the relay connection,
+            // which is intact and irrelevant when the ask never left this process (review HIGH-2).
+            askFault = clientSideAskFault(err);
+        }
+        finally {
+            if (timer !== undefined)
+                clearTimeout(timer);
+        }
+        // The only proof that counts: an ANNOUNCED circuit address on this relay. `listen()` resolving
+        // is not enough — a relay at its slot cap completes the handshake and grants nothing.
+        const relayPeerId = relayPeerIdOf(circuitAddr);
+        if (outcome === "asked" && node.listenAddresses().some((a) => a.split("/").includes("p2p-circuit") && (relayPeerId === null || a.includes(`/p2p/${relayPeerId}/`)))) {
+            return "granted";
+        }
+        /**
+         * ⚠️ **THE CONNECTION CHECK APPLIES TO BOTH OUTCOMES** — review MEDIUM-6.
+         *
+         * "Asked" does not mean the relay answered: a relay that is down yields no circuit address,
+         * indistinguishable here from one that answered and granted nothing. An open connection is what
+         * separates them, and we have one to ask.
+         *
+         * The first version of this rewrite applied that check only to the `asked` branch, so a HUNG
+         * ask short-circuited to `reservation_did_not_complete_in_time` — latency — when the relay was
+         * simply gone. That is a name for where the failure surfaced, not for what went wrong, in a
+         * unit whose headline is that behaviour does not change.
+         */
+        const connectedToRelay = node.getConnections().some((c) => c.peerId === relayPeerId);
+        const reason = askFault !== undefined
+            ? askFault
+            : !connectedToRelay
+                ? "relay_unreachable"
+                : outcome === "asked"
+                    ? "relay_granted_no_reservation"
+                    : "reservation_did_not_complete_in_time";
+        this.#ctx.srLastRejectionReason.set(agentName, reason);
+        this.#ctx.logger.warn("session.standing_receiver.relay.rejected", {
+            agentName,
+            circuitAddr,
+            reason,
+            ...(error !== "" ? { error } : {}),
+            correlationId,
+        });
+        return "declined";
     }
     /** One standing-receiver create attempt (extracted for the M8B F14 retry loop). */
     async #tryCreateStandingReceiver(agentName, correlationId) {
@@ -413,43 +577,28 @@ export class StandingReceivers {
         });
         autoNat.emitInitialResult();
         /**
-         * EVERY RELAY THE NODE ACTUALLY HOLDS A CIRCUIT WITH — derived from the addresses the node
-         * holds, never from `reservations.addrs`.
+         * ⚠️ **A RECEIVER IS INSTALLED HOLDING NOTHING, AND THAT IS NOW A CONSTANT — 056-SLOTDEAD.**
+         *
+         * This block used to derive what the node had come up holding: `heldRelayIdsOf(node)`, the
+         * matching circuit addresses, the count for the reachability line, and the gater's inbound
+         * carve-out. Every one of those read the result of the login walk. `#startReceiverNode` returns
+         * a TCP-only node now (055-ONDEMAND), so all four were computing `[]` — reachable, referenced,
+         * and unable to produce a different answer on any input.
          *
-         * The old code read `reservations.addrs[0]`'s relay id as a fallback, and its own comment
-         * called the hazard "dormant while the pool is size 1; the pool is designed to be larger."
-         * THIS UNIT IS WHAT MAKES THE POOL LARGER, so the dormant case wakes up: candidate 0 refusing
-         * while candidate 1 grants recorded a relay we are not connected to, the watchdog found it
-         * absent on every tick forever, and it rebuilt on the 30-second grid — churning the very
-         * reservations this unit exists to conserve. A candidate is a relay we ASKED; only a held
-         * address is a relay that ANSWERED, and the fallback conflated the two.
+         * The distinction the deleted comment was defending — a CANDIDATE is a relay we asked, a HELD
+         * address is one that answered — is still the rule, and it still lives in `heldRelayIdsOf`. It
+         * is enforced where a reservation is actually taken (`takeReservationForSession`) and where one
+         * is checked (the watchdog), which is where it belongs. Nothing is held here to check.
          *
-         * The fallback's own stated worry stands, and is answered by the count rather than by the
-         * candidate list: if a transport ever reports a circuit address without the relay's peer id in
-         * `/p2p/<id>/p2p-circuit` form, that address yields no id and is not counted as held — so the
-         * receiver reads as degraded and gets rebuilt, instead of reading as healthy against a relay
-         * nobody is connected to. Degrading toward "rebuild" is the safe direction; the other one is
-         * the silent unreachability this whole file exists to kill.
+         * The gater is left as constructed: its reserved set starts empty, and `takeReservationForSession`
+         * widens it for the one relay that grants. Setting it to `[]` here only restated that.
          */
-        const heldRelayPeerIds = heldRelayIdsOf(node);
-        const circuitAddrs = heldRelayPeerIds.length;
-        const heldCircuitAddrs = node.listenAddresses().filter((a) => a.includes("/p2p-circuit"));
-        // DOD-M15-ASSIGN-1 review N3, widened by 032-RELAYSPREAD: the relays this receiver actually
-        // reserved with earn the inbound AutoNAT carve-out — nothing else does. Populated only from
-        // reservations that genuinely completed, so a directory that merely NAMES a relay cannot dial
-        // in behind it, however many relays it names.
-        gater.setReservedRelayPeers(heldRelayPeerIds);
-        // The re-spread clock starts HERE, at the build, not at the epoch. Otherwise the first decay
-        // re-spreads instantly — undoing the "a lost relay does not rebuild the receiver" rule seconds
-        // after it fires, and changing the peer id of an agent that just lost one relay of three. The
-        // ratchet this guards against runs over hours; nothing about it needs answering in a second.
-        this.#ctx.srLastRespreadAt.set(agentName, Date.now());
         this.#ctx.standingReceivers.set(agentName, {
             node,
             gater,
             autoNat,
             seed,
-            relayPeerIds: heldRelayPeerIds,
+            relayPeerIds: [],
         });
         this.#ctx.logger.info("session.node.created", {
             sessionId,
@@ -457,69 +606,74 @@ export class StandingReceivers {
             sessionPeerId: node.getPeerId(),
             correlationId,
         });
-        // DOD-M15-RELAYAUTH-1: authenticate to the reservation relay NOW, not when a session first
-        // needs one. The relay times out a reservation nobody has proven key possession for
-        // (relay-connection-gater.ts, trustless-cello) — proving it here, instead of waiting for a
-        // real session to exist, is what keeps this reservation alive past that grace window.
-        // Best-effort and unawaited: a failure here costs nothing beyond the relay's own grace-window
-        // revoke, which the reservation watchdog already treats as an ordinary lost reservation.
-        // ONCE PER HELD RELAY. Each relay revokes independently — it times out the reservation of any
-        // peer that has not proven key possession TO IT — so proving to one of three and calling the
-        // receiver authenticated would lose the other two circuits about fifteen seconds later, which
-        // is the same silent unreachability with two more relays paying for it.
-        for (const relayPeerId of heldRelayPeerIds) {
-            const heldCircuitAddr = heldCircuitAddrs.find((a) => a.includes(`/p2p/${relayPeerId}/p2p-circuit`));
-            if (heldCircuitAddr === undefined)
-                continue;
-            void this.#ctx.authenticateStandingReceiver(agentName, node, relayPeerId, heldCircuitAddr, correlationId)
-                .catch((err) => {
-                this.#ctx.logger.warn("session.standing_receiver.relay_auth.failed", {
-                    agentName,
-                    relayPeerId,
-                    error: extractErrorMessage(err),
-                    correlationId,
-                });
-            });
-        }
-        // DOD-NAT-REACHABILITY-1 observability: how reachable did this receiver come up? Zero held
-        // while relays were offered means every relay refused or was unreachable — the agent is deaf
-        // to NAT'd initiators (public ones can still connect directly). That must be LOUD, not a quiet
-        // shrug.
-        //
-        // 032-RELAYSPREAD — TWO NUMBERS, SO TWO NAMES. Both events used to carry one field,
-        // `reservationsRequested`, holding `reservations.addrs.length` — the size of the CANDIDATE
-        // list, under a name that reads as a count of asks. That is why "the client already requests a
-        // reservation with every relay it knows" read as true in an audit: the outcome was one and the
-        // request was one too, and a single field could report neither.
-        //   relaysOffered    — how many relays were in the candidate list (deduped by relay peer id in
-        //                      `#reservationCircuitAddrs`, so it counts relays, not addresses).
-        //   reservationsHeld — how many reservations this node actually holds, counted the only way
-        //                      that proves a grant: ANNOUNCED /p2p-circuit listen addresses. `start()`
-        //                      resolving is not enough — a relay out of reservation slots completes the
-        //                      handshake, grants nothing, and leaves a node that looks started and is
-        //                      dialable by nobody.
+        /**
+         * ⚠️ **DOD-M15-RELAYAUTH-1'S INSTALL-TIME PROOF IS GONE — 056-SLOTDEAD, and it could not have
+         * run since 055-ONDEMAND.**
+         *
+         * It read: *"authenticate to the reservation relay NOW, not when a session first needs one"* —
+         * because the relay revokes a reservation whose holder has not proven key possession to it, and
+         * a login-time slot had to survive that grace window with no session in sight. It looped over
+         * the relays this receiver held. It holds none, so the loop's body never executed.
+         *
+         * **The requirement it served is not gone; it moved, and it moved to the stronger place.** A
+         * reservation is now taken by `takeReservationForSession`, which proves FIRST and asks second on
+         * the same connection (`DOD-M15-RELAYPROVE-ORDER-1`). "Proven before the slot exists" is
+         * structural there, rather than a second best-effort call racing a grace window.
+         */
+        /**
+         * DOD-NAT-REACHABILITY-1 observability: what did this receiver come up able to use?
+         *
+         * ⚠️ **`reservationsHeld` WAS DROPPED, NOT RENAMED — 056-SLOTDEAD.** It carried
+         * `heldRelayIdsOf(node).length` and was the one number in this line an operator would act on.
+         * Since 055-ONDEMAND a receiver is installed holding nothing by design, so it reported `0` on
+         * every healthy login for every agent — a measurement that had become a constant while still
+         * reading as a measurement. That is worse than not reporting it: the number an operator trusts
+         * to mean "this agent is deaf" now means nothing at all.
+         *
+         * `relaysOffered` stays and is still a real count: how many relays are in the candidate list
+         * (deduped by relay peer id in `reservationCircuitAddrs`, so it counts relays, not addresses).
+         * **Zero of them is the condition worth seeing here** — an agent with no candidate cannot take a
+         * slot when an offer arrives, and will refuse the call.
+         *
+         * What an agent actually holds is reported where it is now decided: `session.offer.reservation`
+         * at the moment a slot is asked for, and `getStandingReceiverReachability` for `cello_status`.
+         */
         this.#ctx.logger.info("session.standing_receiver.reachability", {
             agentName,
             relaysOffered: reservations.addrs.length,
-            reservationsHeld: circuitAddrs,
             correlationId,
         });
-        if (reservations.addrs.length > 0 && circuitAddrs === 0) {
-            this.#ctx.logger.warn("session.standing_receiver.reservation.none", {
-                agentName,
-                relaysOffered: reservations.addrs.length,
-                // Zero by this branch's own condition, and stated rather than implied: the event reads
-                // "offered 3, held 0" on its own, without the reader having to find the gate above it.
-                reservationsHeld: circuitAddrs,
-                relayPeerIds: reservations.relayPeerIds,
-                correlationId,
-            });
-        }
+        /**
+         * ⚠️ **`reservation.none` IS NOT EMITTED AT BUILD ANY MORE — 055-ONDEMAND.**
+         *
+         * It means *"this agent is offered relays and holds none, so nobody behind NAT can dial it"* —
+         * a warn that fired 481 times over 17 days and drove a whole retry story. Under on-demand,
+         * holding none at build is the DESIGN: a slot is taken when an offer arrives and given back at
+         * the seal. Leaving the warn here would fire it on every healthy login for every agent, which
+         * is not a smaller version of the old problem but a worse one — an alarm that is wrong every
+         * time trains its reader to ignore the one time it is right.
+         *
+         * The condition it named still has a home. `session.offer.reservation` reports `granted: false`
+         * when an offer could not get a circuit — the moment it actually costs someone something — and
+         * the watchdog's re-take path reports a live session that lost one.
+         *
+         * ⚠️ **AND ITS DEBUG-LEVEL REPLACEMENT WENT TOO — 056-SLOTDEAD, review F10.** A
+         * `session.standing_receiver.idle_no_reservation` line survived here, guarded on
+         * `reservations.addrs.length > 0 && circuitAddrs === 0`. The second term was always true once
+         * the login walk was deleted, so the guard was really just "this agent has candidates" and the
+         * line fired on every healthy install for every agent — a second event, under a name that reads
+         * as a fault, asserting the same by-design state the `idle` line above already reports with its
+         * `relaysAvailable` count. Two lines per install saying "normal" is how a log stops being read.
+         */
         // DOD-PARK-DRAIN-1: this agent has a receiver again — drain whatever parked while it did not.
-        // Fired from the ONE place every path converges on (first ensure, the watchdog rebuild after a
-        // lost reservation, and the auth_ok rebuild), because the defect this closes was a trigger
-        // hooked to the wrong connection: content parks when the RELAY link dies, and the drain was
-        // waiting on DIRECTORY SIGNALING to reconnect — which it never had to, having never dropped.
+        // The defect this closes was a trigger hooked to the wrong connection: content parks when the
+        // RELAY link dies, and the drain was waiting on DIRECTORY SIGNALING to reconnect — which it
+        // never had to, having never dropped.
+        //
+        // 056-SLOTDEAD: this used to be the ONE place every path converged on, because a lost
+        // reservation rebuilt the receiver and arrived back here. The rebuilds are gone, so this now
+        // covers the INSTALL only, and the loss has its own trigger (`reservation_lost`) at the point
+        // the loss is noticed.
         this.#ctx.park.fireParkedDrain(agentName, "standing_receiver_ready");
         return { outcome: "installed" };
     }
@@ -576,72 +730,6 @@ export class StandingReceivers {
             this.#ctx.standingReceiverCreating.delete(agentName);
         }
     }
-    /**
-     * Replace an agent's reservation-less standing receiver with one that reserves.
-     *
-     * Deliberately NOT removeStandingReceiverForAgent()+ensureStandingReceiverForAgent():
-     * the public remove CLEARS #agentsWantingReceiver, so a cello_set_agent_offline landing in
-     * the window while node.stop() is awaited would find no map entry and no creating
-     * marker, leave no tombstone, and the re-ensure would then RESURRECT a receiver for
-     * an agent that asked to go dark — accepting inbound sessions for an offline agent.
-     * Here the want-flag is left intact and re-checked after the stop: a concurrent stop
-     * clears it, and the rebuild correctly no-ops.
-     */
-    async rebuildStandingReceiver(agentName) {
-        try {
-            const sr = this.#ctx.standingReceivers.get(agentName);
-            if (sr) {
-                this.#ctx.standingReceivers.delete(agentName);
-                /**
-                 * DOD-M12B-SESSION-SEED-1 (review F8): drop it zeroed, like every other seed.
-                 *
-                 * (review F7, STILL DECIDED AGAINST — deliberately NOT reusing this seed for the
-                 * replacement — but its stated blocker is GONE and the reason has changed. Restated rather
-                 * than reworded, because a decision whose premise has been reversed is a decision nobody
-                 * has actually made.)
-                 *
-                 * Reuse is attractive: this receiver's peer id may already be inside a `session_offer_accept`
-                 * the counterparty is acting on, and a rebuild in that window is the documented "we record
-                 * an identity that no longer exists… every send in this direction parks forever" defect.
-                 *
-                 * The old blocker was that a preserved identity would reach the candidate loop, whose
-                 * rejected candidates were stopped WITHOUT awaiting `start()`, putting two live nodes on one
-                 * advertised peer id. **032-RELAYSPREAD already crossed that line**: the walk now runs one
-                 * shared seed through every candidate, with a settlement-chained teardown, and it is safe
-                 * there because the receiver's gater admits nobody inbound.
-                 *
-                 * What still stops reuse HERE is different and is about the OLD node, not the new one. This
-                 * rebuild path awaits `sr.node.stop()`, but a stop can hang on a stuck libp2p teardown, and
-                 * handing the replacement the same identity before the previous receiver is provably dead
-                 * would put two nodes on a peer id a COUNTERPARTY has been told to dial — which is not the
-                 * candidate case at all: that node has a content handler and can be promoted. Doing it
-                 * safely needs a bounded, verified teardown first. Still follow-on work.
-                 */
-                sr.seed.fill(0);
-                try {
-                    sr.autoNat.stop();
-                    await sr.node.stop();
-                }
-                catch (err) {
-                    this.#ctx.logger.warn("session.standing_receiver.teardown.failed", {
-                        agentName,
-                        error: extractErrorMessage(err),
-                    });
-                }
-            }
-            // The agent may have gone offline while we were stopping the old node. Its
-            // want-flag is the authority — never resurrect a receiver it disowned.
-            if (!this.#ctx.agentsWantingReceiver.has(agentName) || this.#ctx.shuttingDown())
-                return;
-            await this.ensureStandingReceiver(agentName);
-        }
-        catch (err) {
-            this.#ctx.logger.warn("session.standing_receiver.reservation.rebuild.failed", {
-                agentName,
-                error: extractErrorMessage(err),
-            });
-        }
-    }
     /**
      * DOD-M12B-SESSION-SEED-1 — build a revived session node that is REACHABLE, without ever hanging.
      *
@@ -685,21 +773,27 @@ export class StandingReceivers {
              * candidate and came up on the plain floor: alive, `active`, and dialable by nobody, with
              * every message in both directions forced through the relay park route.
              *
-             * Two attempts, exactly as `#startReceiverNode` does it, and for the same measured reason:
-             * a reservation taken by hand on the same connection as the proof yields no dialable address.
-             * The seed is fixed here — that is what a revival IS — so the second attempt necessarily
-             * carries the identity the relay just recorded.
+             * ⚠️ DOD-M15-RELAYPROVE-ORDER-1 — **ONE ATTEMPT NOW, exactly as `#startReceiverNode` does
+             * it.** This used to be two: ask, be refused, prove, ask again, justified by *"a reservation
+             * taken by hand on the same connection as the proof yields no dialable address."* That
+             * described taking the slot over a raw HOP stream; asking libp2p's own transport manager
+             * after the proof makes the reservation libp2p's own, and it announces the address. Measured
+             * live 2026-09-08. So the candidate comes up with no circuit address, proves, and asks once.
+             *
+             * The seed is fixed here — that is what a revival IS — so this node carries the identity the
+             * relay records, and it must STAY UP between the proof and the ask: the relay marks the
+             * CONNECTION proven, and stopping the node closes it.
              */
             let revivedNode;
             let terminalRefusal = false;
-            for (let attempt = 0; attempt < 2 && !terminalRefusal; attempt++) {
+            {
                 const candidate = await this.createAgentNode(agentName, {
                     sessionId,
                     connectionGater: gater,
                     nodeType: "session",
                     inboundReachable: true,
                     transportPrivateKey: seed,
-                    circuitRelayListenAddrs: [circuitAddr],
+                    // NO `circuitRelayListenAddrs` — libp2p must not ask before the proof below has landed.
                 });
                 // KEEP THE START PROMISE. Review HIGH-3: `libp2p.stop()` opens with
                 // `if (this.status !== 'started') return`, and during the whole timeout window the status is
@@ -714,82 +808,148 @@ export class StandingReceivers {
                     startP.then(() => true),
                     new Promise((res) => setTimeout(() => res(false), REVIVE_RESERVATION_TIMEOUT_MS).unref?.()),
                 ]).catch((err) => { startError = err; return false; });
-                if (started && candidate.listenAddresses().some((a) => a.includes("/p2p-circuit"))) {
-                    this.#ctx.logger.info("session.revive.reservation.granted", { agentName, sessionId, attempts: attempt + 1 });
-                    revivedNode = candidate;
-                    break;
-                }
                 /**
-                 * No reservation on the first attempt is the EXPECTED answer for a peer whose proof has
-                 * aged out. Prove and go round once more.
+                 * PROVE, THEN ASK — the same order as `#startReceiverNode`, for the same reason.
+                 *
+                 * `started` gates it because `libp2p.stop()` opens with `if (this.status !== 'started')
+                 * return`, so a timed-out candidate cannot be torn down here; that case falls through to the
+                 * settlement-chained teardown below, which is the only thing that reliably kills a
+                 * still-starting node.
                  *
-                 * Only when `started` is true: `libp2p.stop()` opens with `if (this.status !== 'started')
-                 * return`, so a timed-out candidate cannot be torn down here and rebuilding on its seed
-                 * would put two live nodes on one peer id. That case falls through to the settlement-chained
-                 * teardown below, which is the only thing that reliably kills a still-starting node.
+                 * ⚠️ THE CANDIDATE IS NOT STOPPED BETWEEN THE PROOF AND THE ASK. It used to be, because the
+                 * ask came from a rebuilt node. The relay marks the CONNECTION proven, so stopping here
+                 * would throw away the very thing that makes the next line succeed.
                  */
-                if (attempt === 0 && started) {
+                let proofDeclined = false;
+                /**
+                 * The ask's own promise, when one was made. The teardown below has to wait on THIS as well as
+                 * on `start()`: the node whose reservation is still in flight is the one that can come up
+                 * late holding this session's peer id, and `stop()` on a node mid-ask is the same no-op the
+                 * start-promise note describes.
+                 */
+                let listenP;
+                /** Set when the ask failed for a fault of OURS, so it is not re-described as the relay's. */
+                let askFault;
+                if (started) {
                     const verdict = await this.#ctx.proveToRelay(agentName, circuitAddr, candidate, sessionId, false);
-                    try {
-                        await candidate.stop();
-                    }
-                    catch { /* best-effort */ }
-                    if (verdict === "refused_this_agent") {
-                        // The refusal is about this AGENT, so the remaining candidates would answer identically.
-                        terminalRefusal = true;
+                    // A VERDICT DECLINES; NO VERDICT DOES NOT. `unavailable` means the relay never answered —
+                    // no client wired, or unreachable — and not every relay gates reservations, so the ask
+                    // still goes ahead. Same rule and same reasoning as `#startReceiverNode`.
+                    if (verdict === "refused_this_agent" || verdict === "refused_try_another_relay") {
+                        proofDeclined = true;
+                        // The agent-level refusal is about this AGENT, so the remaining candidates answer
+                        // identically.
+                        if (verdict === "refused_this_agent")
+                            terminalRefusal = true;
                         this.#ctx.logger.warn("session.revive.reservation.declined", {
                             agentName,
                             sessionId,
                             circuitAddr,
-                            reason: "relay_refused_this_agent",
-                            impact: "the relay refused this agent rather than being unwilling or unwell, so every " +
-                                "other relay refuses it the same way. The session comes up reachable only via the " +
-                                "relay park route; cello_status carries the cause.",
+                            reason: verdict === "refused_this_agent" ? "relay_refused_this_agent" : "relay_proof_refused",
+                            impact: verdict === "refused_this_agent"
+                                ? "the relay refused this agent rather than being unwilling or unwell, so every " +
+                                    "other relay refuses it the same way. The session comes up reachable only via " +
+                                    "the relay park route; cello_status carries the cause."
+                                : "this relay would not take the agent's proof. Trying the next relay.",
                         });
-                        break;
+                        try {
+                            await candidate.stop();
+                        }
+                        catch { /* best-effort */ }
                     }
-                    // Only a landed proof earns the retry — see the same rule in `#startReceiverNode`.
-                    if (verdict !== "proven") {
-                        this.#ctx.logger.warn("session.revive.reservation.declined", {
-                            agentName,
-                            sessionId,
-                            circuitAddr,
-                            reason: "relay_proof_refused",
-                            impact: "this relay would not take the agent's proof, so asking it again would be " +
-                                "refused the same way. Trying the next relay.",
+                    else {
+                        /**
+                         * ASK — once, on the connection the proof was made on.
+                         *
+                         * ⚠️ **RACED AGAINST THE SAME DEADLINE `start()` USED TO CARRY, AND IT HAS TO BE.** The
+                         * measured production failure this whole loop exists for — 10,002ms and still waiting —
+                         * was a relay that never answered a reservation. That used to park `start()`, because a
+                         * circuit address in the constructor made start the moment libp2p asked. The ask is here
+                         * now, so a bare await here is the same hang with a new address: the revival never
+                         * returns and every send on that session is refused forever.
+                         *
+                         * A throw is not fatal — the grant check below is the only thing that decides, and it
+                         * reads the announced addresses.
+                         */
+                        // Wrapped, not bare: a node that cannot take the ask at all throws SYNCHRONOUSLY, and
+                        // `.catch()` on the race never sees that — it would escape the revival entirely.
+                        const asked = await (async () => {
+                            listenP = candidate.listenOnCircuit(circuitAddr);
+                            return Promise.race([
+                                listenP.then(() => true),
+                                new Promise((res) => setTimeout(() => res(false), REVIVE_RESERVATION_TIMEOUT_MS).unref?.()),
+                            ]);
+                        })().catch((err) => {
+                            startError = err;
+                            // Review HIGH-2, same rule as the receiver walk: a fault of OURS keeps its own name.
+                            askFault = clientSideAskFault(err);
+                            return false;
                         });
-                        break;
+                        if (!asked && askFault === undefined) {
+                            this.#ctx.logger.warn("session.revive.reservation.ask_timeout", {
+                                agentName,
+                                sessionId,
+                                circuitAddr,
+                                budgetMs: REVIVE_RESERVATION_TIMEOUT_MS,
+                                impact: "this relay took the proof and then never answered the reservation. Abandoned " +
+                                    "on the deadline and trying the next relay — a relay that does not answer must not " +
+                                    "be able to hold a session down.",
+                            });
+                        }
                     }
-                    continue;
                 }
-                // Started but granted nothing, or never started. Either way this node is not the one.
-                //
-                // Review MEDIUM-5: name WHICH of the three causes this was, the way `#startReceiverNode` does.
-                // "declined" alone stood for a relay that is full, a relay that is unreachable, and a relay
-                // that is merely slow — three different problems with three different responses, and the
-                // thrown error was discarded entirely.
-                const declineReason = started
-                    ? "relay_granted_no_reservation"
-                    : startError !== undefined
-                        ? "relay_unreachable"
-                        : "reservation_did_not_complete_in_time";
-                const isLast = circuitAddr === candidateAddrs.slice(0, REVIVE_RESERVATION_CANDIDATES).at(-1);
-                this.#ctx.logger.warn("session.revive.reservation.declined", {
-                    agentName,
-                    sessionId,
-                    circuitAddr,
-                    reason: declineReason,
-                    ...(startError !== undefined ? { error: extractErrorMessage(startError) } : {}),
-                    impact: isLast
-                        ? "no relay granted; the session comes up reachable only via the relay park route"
-                        : "trying the next relay",
-                });
-                // Teardown at SETTLEMENT, not now: a `stop()` issued while the node is still starting is a
-                // no-op (see above), so the only way to guarantee this node dies is to wait for its own start
-                // to finish first. Not awaited, so a hung start cannot hold the revival up — the point is that
-                // the teardown eventually happens, not that it happens before the next candidate.
-                void startP.then(() => candidate.stop().catch(() => { }), () => { });
-                break;
+                if (!proofDeclined && started && holdsCircuit(candidate)) {
+                    this.#ctx.logger.info("session.revive.reservation.granted", { agentName, sessionId });
+                    revivedNode = candidate;
+                    break;
+                }
+                if (!proofDeclined) {
+                    // Started but granted nothing, or never started. Either way this node is not the one.
+                    //
+                    // Review MEDIUM-5: name WHICH of the three causes this was, the way `#startReceiverNode` does.
+                    // "declined" alone stood for a relay that is full, a relay that is unreachable, and a relay
+                    // that is merely slow — three different problems with three different responses, and the
+                    // thrown error was discarded entirely.
+                    const declineReason = askFault !== undefined
+                        // A client-side fault, checked FIRST: everything below infers a cause from the relay, and
+                        // the relay had nothing to do with an ask that never left this process (review HIGH-2).
+                        ? askFault
+                        : !started
+                            ? startError !== undefined
+                                ? "relay_unreachable"
+                                : "reservation_did_not_complete_in_time"
+                            : // Started, proved, asked — and the ask is where a slow relay now shows up. An ask still in
+                                // flight is "did not complete in time"; one that returned with nothing is a relay that
+                                // answered and granted nothing.
+                                listenP !== undefined && !holdsCircuit(candidate)
+                                    ? "relay_granted_no_reservation"
+                                    : "reservation_did_not_complete_in_time";
+                    const isLast = circuitAddr === candidateAddrs.slice(0, REVIVE_RESERVATION_CANDIDATES).at(-1);
+                    this.#ctx.logger.warn("session.revive.reservation.declined", {
+                        agentName,
+                        sessionId,
+                        circuitAddr,
+                        reason: declineReason,
+                        ...(startError !== undefined ? { error: extractErrorMessage(startError) } : {}),
+                        impact: isLast
+                            ? "no relay granted; the session comes up reachable only via the relay park route"
+                            : "trying the next relay",
+                    });
+                    /**
+                     * Teardown at SETTLEMENT, not now: a `stop()` issued while the node is still starting is a
+                     * no-op (see above), so the only way to guarantee this node dies is to wait for its own work
+                     * to finish first. Not awaited, so a hung relay cannot hold the revival up — the point is that
+                     * the teardown eventually happens, not that it happens before the next candidate.
+                     *
+                     * ⚠️ **BOTH PROMISES, and the second one is new.** The abandoned candidate's outstanding work
+                     * used to be `start()`, because that is where the reservation was taken. It is the ASK now, so
+                     * waiting only on `start()` tears the node down while its reservation is still in flight —
+                     * and a late grant then brings a node up on THIS SESSION'S peer id, sharing the gater, with no
+                     * content handler and nothing holding a reference to kill it. That is the open endpoint
+                     * review HIGH-3 exists to prevent, reintroduced through a different promise.
+                     */
+                    stopWhenSettled(candidate, [startP, listenP], REVIVE_RESERVATION_TIMEOUT_MS * 2);
+                }
             }
             if (revivedNode)
                 return revivedNode;
@@ -975,8 +1135,43 @@ export class StandingReceivers {
         // is not "retrying" — reporting it as such sends an operator hunting a fault that is not there.
         if (sr.relayPeerIds.length > 0)
             return "reserved";
+        /**
+         * ⚠️ **A LIVE SESSION'S CIRCUIT COUNTS — 055-ONDEMAND, and without this the field measures the
+         * wrong node.**
+         *
+         * The standing receiver holds nothing while idle, by design. A session's circuit lives on the
+         * SESSION's node: the receiver was promoted into it and replaced. Reading only the receiver
+         * therefore reported `retrying` for an agent in a perfectly healthy conversation — a fault where
+         * there is none, on the surface an operator checks first.
+         */
+        if (this.#ctx.anyLiveSessionHoldsCircuit(agentName))
+            return "reserved";
         const retry = this.#ctx.srReservationRetry.get(agentName);
-        return retry !== undefined && retry.attempts > SR_RESERVATION_MAX_RETRIES ? "unreachable" : "retrying";
+        if (retry === undefined) {
+            /**
+             * ⚠️ **IDLE AND READY — DOD-M15-IDLE-READY-1, AND `retrying` HERE WAS NOT MERELY THE WRONG
+             * WORD.**
+             *
+             * Reaching this line means: a receiver exists, it holds no circuit, no live session holds one
+             * either, and **nothing has ever asked for one** — no retry state was recorded. Before
+             * 055-ONDEMAND that combination was rare and meant a real problem: an agent that wanted a slot
+             * at login and could not get one. An agent takes a slot when somebody calls now, so this is
+             * the ordinary resting state of every healthy idle agent on the fleet.
+             *
+             * Leaving it as `retrying` cost the field its only job. `retrying` said "we want a slot, we
+             * cannot get one, we are still trying" — and once every healthy agent says it, an agent that
+             * genuinely cannot get a slot is indistinguishable from one that is perfectly fine. A status
+             * that reads the same whether or not anything is wrong is not a status. Observed on two live
+             * agents the same afternoon: `reserved` on the published build, `retrying` on this one, with
+             * nothing different about whether anyone could reach them.
+             *
+             * ⚠️ **AND IT IS NOT `reserved`, which was the tempting one-liner.** `reserved` is a claim an
+             * operator acts on — a slot is held, so a counterparty behind a home router can dial in right
+             * now. That is false for an idle agent. Two different facts, so two different words.
+             */
+            return "ready";
+        }
+        return retry.attempts > SR_RESERVATION_MAX_RETRIES ? "unreachable" : "retrying";
     }
     /**
      * CELLO-M7-TRANSPORT-001: the AutoNAT service wrapping the current standing