@cello-protocol/daemon 0.0.208 → 0.0.210

package/dist/standing-receivers.js

@@ -3,7 +3,7 @@ import { SessionConnectionGater } from "./session-connection-gater.js";
 import { relayOnlyState, publishableEndpoint } from "./relay-only.js";
 import { extractErrorMessage } from "./error-message.js";
 import { randomBytes, randomUUID } from "node:crypto";
-import { relayPeerIdOf, heldRelayIdsOf, CIRCUIT_RELAY_ID, SR_RESERVATION_MAX_RETRIES, REVIVE_RESERVATION_CANDIDATES, REVIVE_RESERVATION_TIMEOUT_MS, clientSideAskFault, holdsCircuit, stopWhenSettled, } from "./session-node-types.js";
+import { relayPeerIdOf, heldRelayIdsOf, SR_RESERVATION_MAX_RETRIES, REVIVE_RESERVATION_CANDIDATES, REVIVE_RESERVATION_TIMEOUT_MS, RELEASE_TELL_BUDGET_MS, OFFER_RESERVATION_GRACE_MS, clientSideAskFault, holdsCircuit, stopWhenSettled, } from "./session-node-types.js";
 import { STANDING_RECEIVER_AGENT_NAME } from "./types.js";
 export class StandingReceivers {
     #ctx;
@@ -25,426 +25,474 @@ export class StandingReceivers {
     }
     async #startReceiverNode(agentName, sessionId, gater, candidateCircuitAddrs, correlationId) {
         /**
-         * 032-RELAYSPREAD — **ONE SEED FOR THE RECEIVER, REUSED ACROSS RELAYS**, replacing
-         * DOD-M12B-SESSION-SEED-1's seed-per-candidate.
+         * 054-SRSPLIT — **ONE NODE. IT STARTS ON TCP, THEN TAKES ITS RESERVATIONS IN PLACE.**
          *
-         * The agent is ONE identity and must be dialable at ONE peer id through any of its circuits, so
-         * every reservation this walk collects has to belong to the same key. A seed per relay would
-         * give the agent a different peer id down each circuit — N half-agents, none of them the one
-         * the counterparty was told to dial.
+         * This used to be a walk of throwaway PROBE nodes — one built per relay to find out whether that
+         * relay would grant, torn down, and then a FINAL node rebuilt carrying every granted address in
+         * its constructor. The probes existed for exactly one reason: a circuit listener was fixed at
+         * node creation, so the only way to ask a relay anything was to build a node to ask with.
          *
-         * ⚠️ THE RULE THIS REPLACES WAS RIGHT ABOUT ITS OWN CASE, so here is what changed and what did
-         * not. Its hazard is real and survives: a rejected candidate is torn down while its `start()`
-         * may still be in flight, so two nodes can briefly be live on this peer id. Two things bound it
-         * now, and neither existed when that rule was written:
-         *   - **THE ONE THAT CARRIES THE WEIGHT: DOD-M15-ASSIGN-1** made a standing receiver's gater
-         *     admit NOBODY inbound until a session offer names the dialer. The old rule's stated danger
-         *     — "sharing this gater, so it admits dials … an open endpoint under our advertised id" —
-         *     is not true of this gater any more. `#startReceiverNode` has exactly one caller and it
-         *     constructs that gater with `allowedPeerId: null` and an empty reserved set, so an
-         *     overlapping candidate is an endpoint that refuses everyone.
-         *   - the teardown is chained onto the candidate's OWN start promise (the `#buildRevivedNode`
-         *     pattern, verified against libp2p 3.3.2: `stop()` returns immediately unless the status is
-         *     `started`, and through the whole timeout window it is `starting`, so the old unawaited
-         *     `stop()` stopped nothing). ⚠️ This bounds the LEAK, not the OVERLAP — a timed-out
-         *     candidate is not awaited and the walk moves straight to the next one on the same seed, so
-         *     overlap is the normal shape of that case, not a remote possibility. It guarantees the
-         *     loser dies, and nothing more.
-         * `#buildRevivedNode` already runs a fixed identity through this same walk for the same reason.
+         * `listenOnCircuit` (unit 1) removed that constraint, and this is the simplification it unlocks:
+         * build the receiver ONCE, and for each relay prove and ask on the node that will keep it.
+         *
+         * ⚠️ **AND IT CLOSES THE DEFECT UNIT 1 LEFT STANDING, which was recorded here rather than
+         * fixed.** The final node was built with `circuitRelayListenAddrs`, so libp2p asked at start on
+         * a fresh connection that had proved nothing on itself. It worked only because the relay
+         * remembers a proof for `PROVEN_PEER_MEMORY_MS` — two minutes, in the OTHER repo — and when that
+         * memory had expired the original refused-ask collision came back for the one node that IS the
+         * agent's front door. There is no constructor-time ask left, so that dependency is gone, and
+         * `spread.grant_not_bound` — the event that existed to catch the proof expiring between the walk
+         * and the rebuild — has nothing left to report.
+         *
+         * ⚠️ **ONE SEED, and it still matters** (032-RELAYSPREAD). The agent is ONE identity and must be
+         * dialable at ONE peer id through any of its circuits. That is now structural rather than
+         * maintained: there is one node, so there is one key, and a second identity has nowhere to come
+         * from. The old hazard this note used to carry — an abandoned probe still starting on the
+         * receiver's seed — cannot occur, because no probe is built.
          */
         const receiverSeed = randomBytes(32);
-        /** Circuit addresses whose relay ACTUALLY GRANTED this identity a reservation. */
-        const grantedAddrs = [];
-        // For `spread.grant_not_bound` below: the walk's own duration is measured against the relay's
-        // two-minute proof memory, so it has to be a number rather than an inference.
-        const walkStartedAt = Date.now();
-        for (const circuitAddr of candidateCircuitAddrs) {
-            const candidateSeed = receiverSeed;
-            /**
-             * DOD-M15-RELAYPROVE-ORDER-1 — **ONE NODE, ONE ASK: prove, then reserve.**
-             *
-             * The relay refuses a reservation from a peer that has not shown it belongs to a registered
-             * agent. This candidate therefore comes up with **no circuit address in its listen set** —
-             * TCP/WS only — so libp2p asks nobody for anything at start. We dial the relay, prove over
-             * `/cello/relay/1.0.0`, and only then ask libp2p's own transport manager to listen on the
-             * circuit. The relay grants on that first ask because it sets `slot.provenForReservation` per
-             * CONNECTION at auth time, and libp2p's reservation store reuses the connection we proved on.
-             *
-             * ⚠️ **THIS REPLACES "ask, be refused, prove, ask again", AND THE CLAIM THAT FORCED IT WAS
-             * FALSE.** The old comment here read: *"It has to be two connections, and that was measured
-             * rather than chosen. Taking the reservation by hand on the same connection as the proof DOES
-             * get a slot — and libp2p then announces no circuit address for it, because it only announces
-             * addresses for reservations its own relay-discovery made."* Its first clause described
-             * taking the slot BY HAND over a raw HOP stream. Asking libp2p's transport manager is a
-             * different act: the reservation is then libp2p's own, and it announces the address. Measured
-             * live 2026-09-08 against the Virginia relay (libp2p 3.3.11, circuit-relay-v2 4.2.13) —
-             * granted on the first ask in 708ms, circuit address announced, no new connection opened.
-             *
-             * What the old shape cost: libp2p's answer to the refused first ask is to restart its
-             * connection manager, closing every connection — including the one the proof was riding — so
-             * the proof had to be retried on a fresh node. Two node builds and four dials per relay,
-             * 5.4–9.3s to a first reservation, against 3.1s dial-to-reachable here.
-             */
-            let candidateGranted = false;
-            // Set when the relay refused the AGENT rather than being unwilling itself: every other relay
-            // in the pool answers identically, so the walk ends here rather than reproducing it N times.
-            let candidateRefusedAgent = false;
-            /**
-             * Whether the proof branch already named this candidate's failure. Without it the generic
-             * rejection below fires a SECOND `relay.rejected` for the same candidate, with a reason
-             * derived from a connection state rather than from the verdict the relay actually gave — the
-             * specific cause overwritten by a generic one, one frame later, which is the exact shape
-             * Invariant 3 forbids.
-             */
-            let rejectionNamed = false;
-            /**
-             * The ask's own promise, when one was made. The abandonment below has to wait on THIS as well
-             * as on `start()`: the reservation is taken here now, so a node torn down while its ask is
-             * still in flight can be granted late and come up on the receiver's advertised peer id with
-             * nothing holding a reference to kill it.
-             */
-            let listenP;
-            /** Set when the ask failed for a fault of OURS, so it is not re-described as the relay's. */
-            let askFault;
-            const candidate = await this.createAgentNode(agentName, {
-                sessionId,
-                connectionGater: gater,
-                nodeType: "standing_receiver",
-                // NO `circuitRelayListenAddrs` — that is the whole change. A circuit address here is
-                // libp2p asking the relay before anything has proved, which is the refusal this removes.
-                transportPrivateKey: candidateSeed,
+        /**
+         * Relay peers are allowed OUTBOUND before the node starts. Unchanged and load-bearing: our own
+         * gater would otherwise refuse our own dial, and refreshes must keep working after
+         * `setAllowedPeer()` narrows the inbound gate to a session counterparty (DOD-M15-ASSIGN-1).
+         * The gater still admits NOBODY inbound here.
+         */
+        for (const addr of candidateCircuitAddrs) {
+            const relayPeerId = relayPeerIdOf(addr);
+            if (relayPeerId)
+                gater.setAllowedOutboundPeer(relayPeerId);
+        }
+        const node = await this.createAgentNode(agentName, {
+            sessionId,
+            connectionGater: gater,
+            nodeType: "standing_receiver",
+            // NO `circuitRelayListenAddrs` — nothing is asked for at start. See the note above.
+            transportPrivateKey: receiverSeed,
+        });
+        await node.start();
+        /**
+         * ⚠️ **THE WALK IS GONE — 055-ONDEMAND, and this is the capacity change itself.**
+         *
+         * The receiver used to visit every relay it had ever heard of and hold a slot on each, for the
+         * life of the login, against the chance that somebody called. Demand was `agents × relays`, so
+         * the tenth relay added a tenth of the fleet's demand and one relay's worth of capacity, and
+         * the ratio `agents / slots-per-relay` never improved however many relays were run.
+         *
+         * **An idle agent now holds ZERO.** A reservation is taken when an offer arrives, on the relay
+         * the directory names (`takeReservationForSession`), and given back at the seal. Demand becomes
+         * `live sessions × 1`.
+         *
+         * **What makes that safe, and it is the reason this is not a reachability regression:**
+         *   - The relay's MAILBOX consults no reservation. Deposit authenticates the depositor by their
+         *     Noise peer id; pull is a signature challenge on the recipient and is an OUTBOUND dial. So
+         *     store-and-forward keeps working with nothing held.
+         *   - The WITNESS is a separate dial on the relay's own protocol. Nothing about the seal, the
+         *     hash chain or the transcript depended on a reservation.
+         *   - A cold call to a LOGGED-OUT agent was already refused with nothing queued, so no
+         *     capability is lost — there was never an answering machine to lose.
+         *
+         * The candidate list is still passed in and still used: it is what the offer path reserves
+         * against when it needs to, and what `cello_status` reports as relays this agent could use.
+         */
+        this.#ctx.logger.info("session.standing_receiver.idle", {
+            agentName,
+            relaysAvailable: candidateCircuitAddrs.length,
+            correlationId,
+            impact: "this agent holds no relay reservation while idle, by design. One is taken on the " +
+                "relay the directory names when a session is offered, and given back at the seal.",
+        });
+        return { node, seed: receiverSeed };
+    }
+    /**
+     * 054-SRSPLIT — **TAKE ONE RESERVATION, ON A NODE THAT IS ALREADY RUNNING.**
+     *
+     * The whole relay handshake for one relay: prove over `/cello/relay/1.0.0` on a connection we
+     * open, then ask libp2p's own transport manager to listen on the circuit. The relay grants on the
+     * first ask because it marks `slot.provenForReservation` per CONNECTION at auth time and libp2p's
+     * reservation store reuses the open connection rather than dialling a new one (measured live
+     * 2026-09-08; `DOD-M15-RELAYPROVE-ORDER-1`).
+     *
+     * ⚠️ **THE NODE IS NOT STOPPED BETWEEN THE PROOF AND THE ASK.** The relay marks the CONNECTION,
+     * not the peer id, so closing it throws away the very thing that makes the ask succeed.
+     */
+    /**
+     * 055-ONDEMAND — **take a reservation for a SESSION, on the relay the directory named.**
+     *
+     * The public face of `#takeReservation` for the offer path. An idle agent holds nothing, so this
+     * is what makes it dialable, and it lasts only as long as the session that asked for it.
+     *
+     * Returns whether one was granted. A `false` is a degradation, not a failure: the counterparty
+     * can still reach this agent directly, or through the relay's store-and-forward. The one caller
+     * that must treat it as fatal is relay-only mode, which does so at its own guard.
+     */
+    /**
+     * 055-ONDEMAND — the abandoned-offer timers, keyed `agent::sessionIdHex`. See `#armOfferRelease`.
+     */
+    #offerReleaseTimers = new Map();
+    /**
+     * ⚠️ **AN OFFER THAT GOES QUIET MUST NOT KEEP A SLOT — `DOD-M15-OFFER-EXPIRY-1`, RELOCATED.**
+     *
+     * The story predicted this exactly: the permanently-open door units 2 and 3 removed does not take
+     * the defect with it, it moves it somewhere more expensive. The responder reserves the moment an
+     * offer arrives; an initiator that never dials — it aborted, the directory faulted — would leave a
+     * slot held on a SHARED relay until its TTL, two hours by default. That is a cost on the exact
+     * resource this whole story exists to conserve, and "released at seal" cannot cover it because
+     * there is no seal.
+     *
+     * ⚠️ **THE BUDGET IS NOT THE DIRECTORY'S 2-SECOND ACCEPT CLOCK, and picking that would be worse
+     * than not doing this at all.** The accept is only the start: the assignment still has to be
+     * FROST-signed by a threshold of directory nodes and delivered to both parties before either
+     * builds a session. Releasing on 2 s would take the slot out from under a session that was about
+     * to begin — turning a rare abandoned offer into a common broken one.
+     *
+     * No cancellation plumbing: the timer ASKS whether the session started. A session that began and
+     * has already sealed is also not live, and that case has already released through the seal path,
+     * where the teardown releases from the session's own node.
+     */
+    #armOfferRelease(agentName, sessionIdHex, circuitAddr, correlationId) {
+        const key = `${agentName}::${sessionIdHex}`;
+        const existing = this.#offerReleaseTimers.get(key);
+        if (existing !== undefined)
+            clearTimeout(existing);
+        const timer = setTimeout(() => {
+            this.#offerReleaseTimers.delete(key);
+            if (this.#ctx.shuttingDown())
+                return;
+            if (this.#ctx.sessionIsLive(agentName, sessionIdHex))
+                return; // it started; the seal owns it now
+            this.#ctx.logger.warn("session.reservation.offer_abandoned", {
+                agentName,
+                sessionIdHex,
+                circuitAddr,
+                heldForMs: OFFER_RESERVATION_GRACE_MS,
+                correlationId,
+                impact: "a relay slot was taken to answer an offer that never became a session — the " +
+                    "initiator did not dial. Given back rather than held until the relay's TTL, which is " +
+                    "two hours and is a cost on every other agent that relay serves.",
             });
-            let timer;
-            const timedOut = Symbol("reservation_timeout");
-            let outcome = "failed";
-            let error = "";
-            // KEEP THE START PROMISE. Every candidate now carries the receiver's identity, so an
-            // abandoned one must be reliably torn down rather than best-effort — and only its own start
-            // promise says when it is stoppable (see the seed note above).
-            const startP = candidate.start();
-            try {
-                outcome = await Promise.race([
-                    startP.then(() => "started"),
-                    new Promise((resolve) => {
-                        timer = setTimeout(() => resolve(timedOut), this.#ctx.srReservationTimeoutMs);
-                    }),
-                ]);
-            }
-            catch (err) {
-                error = extractErrorMessage(err);
-            }
-            finally {
-                if (timer !== undefined)
-                    clearTimeout(timer);
-            }
             /**
-             * The node is up on TCP/WS. Everything below is the relay handshake, in the order that works:
-             * prove, then ask. A failure at any step abandons this candidate and moves to the next relay
-             * — there is no second attempt, because there is no refusal left for one to recover from.
+             * ⚠️ THE RECEIVER'S OWN NODE, and at this point that is the right one: the offer never became a
+             * session, so nothing was promoted and the circuit is still on the standing receiver. (Had it
+             * been promoted, `sessionIsLive` above would have returned and we would not be here.)
              */
-            if (outcome === "started") {
-                /**
-                 * PROVE. `proveToRelay` dials the relay's base address from THIS node and authenticates
-                 * over `/cello/relay/1.0.0`, which is what marks this connection proven at the relay.
-                 *
-                 * ⚠️ THE NODE STAYS UP. The old shape stopped it here, because the reservation was about to
-                 * be asked for by a rebuilt node. Stopping it now would close the very connection the relay
-                 * marked proven, and the ask below would be refused — the connection is the thing carrying
-                 * the property, not the peer id.
-                 */
-                const verdict = await this.#ctx.proveToRelay(agentName, circuitAddr, candidate, correlationId, true);
-                /**
-                 * ⚠️ **A PROOF THAT NEVER REACHED A VERDICT IS NOT A REFUSAL** — and the ask goes ahead.
-                 *
-                 * `unavailable` means no relay answer was obtained at all: no relay client is wired, the
-                 * dial failed, the stream threw. `proveReservation` already draws exactly this line for its
-                 * own retry (*"`true`/`false` are VERDICTS; `transport_failed` means no verdict was reached
-                 * and the question is still open"*), and it is the line that matters here for a second
-                 * reason: **not every relay gates reservations.** A relay that never asks for a proof
-                 * grants on the first ask, and refusing to ask because our own proof machinery was
-                 * unavailable would make this client unable to reserve with it at all — a capability lost
-                 * to a precaution.
-                 *
-                 * The cost of asking anyway is one refused ask against a gated relay we could not prove to
-                 * — which is what the whole walk used to do on every relay, every time.
-                 */
-                if (verdict === "refused_this_agent" || verdict === "refused_try_another_relay") {
-                    /**
-                     * DOD-M15-RELAYSLOTS-1 clause 9 — **A CLIENT-SIDE REFUSAL ENDS THE WALK.**
-                     *
-                     * `slot_cap_exceeded` and an expired or missing token are classified `tryAnotherRelay:
-                     * false` because they reproduce on every relay in the pool: the cap is per AGENT, and
-                     * the token comes from the directory, not from here. Walking on costs a node build and
-                     * a dial per remaining relay to arrive at the same answer, and it makes one client-side
-                     * fault look like a fleet-wide outage in the logs. The refusal is already recorded where
-                     * `cello_status` reads it, so stopping is not silence.
-                     *
-                     * ⚠️ **THE BOUNDARY THIS BRANCH RESTS ON IS ENFORCED IN `proveToRelay`, NOT HERE.** It
-                     * returns `unavailable` whenever no relay verdict was reached — including a proof that
-                     * failed for a transport reason, which it used to label `refused_try_another_relay`
-                     * (review HIGH-1). Stated as where the property lives rather than asserted as a fact
-                     * about this branch: a comment claiming "only a verdict reaches here" is true only for
-                     * as long as that producer keeps its side, and the producer is in another file.
-                     */
-                    const proofReason = verdict === "refused_this_agent" ? "relay_refused_this_agent" : "relay_proof_refused";
-                    this.#ctx.srLastRejectionReason.set(agentName, proofReason);
-                    this.#ctx.logger.warn("session.standing_receiver.relay.rejected", {
-                        agentName,
-                        circuitAddr,
-                        reason: proofReason,
-                        correlationId,
-                        impact: proofReason === "relay_refused_this_agent"
-                            ? "the relay refused this AGENT rather than this relay being unwilling or " +
-                                "unwell, so every other relay would refuse it identically. Stopped here; " +
-                                "cello_status carries the cause and what to do about it."
-                            : "this relay would not take the agent's proof. Moving to the next relay.",
-                    });
-                    if (verdict === "refused_this_agent")
-                        candidateRefusedAgent = true;
-                    rejectionNamed = true;
-                    try {
-                        await candidate.stop();
-                    }
-                    catch { /* it may never have finished starting */ }
-                }
-                else {
-                    /**
-                     * ⚠️ **A PROOF THAT NEVER REACHED A VERDICT IS NOT A REFUSAL** — and the ask goes ahead.
-                     *
-                     * `unavailable` means no relay answer was obtained at all: no relay client is wired, the
-                     * dial failed, the stream threw. `proveReservation` already draws exactly this line for its
-                     * own retry (*"`true`/`false` are VERDICTS; `transport_failed` means no verdict was reached
-                     * and the question is still open"*), and it matters here for a second reason: **not every
-                     * relay gates reservations.** One that never asks for a proof grants on the first ask, and
-                     * refusing to ask because our own proof machinery was unavailable would make this client
-                     * unable to reserve with it at all — a capability lost to a precaution.
-                     *
-                     * The cost of asking anyway is one refused ask against a gated relay we could not prove to,
-                     * which is what the walk used to spend on every relay, every time.
-                     */
-                    if (verdict === "unavailable") {
-                        this.#ctx.logger.warn("session.standing_receiver.prove.no_verdict", {
-                            agentName,
-                            circuitAddr,
-                            correlationId,
-                            impact: "no proof verdict was obtained from this relay — no relay client is wired, or " +
-                                "it could not be reached. Asking for the reservation anyway: a relay that does not " +
-                                "gate them grants it, and one that does refuses an ask that cost a single dial.",
-                        });
-                    }
-                    /**
-                     * ASK — ONCE, on the connection we just proved on. Raced against the same budget the whole
-                     * candidate used to get, because this is now the only part that talks to the relay.
-                     */
-                    let listenTimer;
-                    const listenTimedOut = Symbol("listen_timeout");
-                    let listenOutcome = listenTimedOut;
-                    // INSIDE the try. A node that cannot take the ask at all throws SYNCHRONOUSLY, and outside
-                    // the try that escapes the whole walk instead of failing this one candidate.
-                    try {
-                        listenP = candidate.listenOnCircuit(circuitAddr);
-                        listenOutcome = await Promise.race([
-                            listenP.then(() => "asked"),
-                            new Promise((resolve) => {
-                                listenTimer = setTimeout(() => resolve(listenTimedOut), this.#ctx.srReservationTimeoutMs);
-                            }),
-                        ]);
-                    }
-                    catch (err) {
-                        error = extractErrorMessage(err);
-                        // Review HIGH-2: a fault of OURS keeps its own name all the way to the operator, instead
-                        // of being re-described from the connection state as something the relay did.
-                        askFault = clientSideAskFault(err);
-                        listenOutcome = listenTimedOut;
-                    }
-                    finally {
-                        if (listenTimer !== undefined)
-                            clearTimeout(listenTimer);
-                    }
-                    // The only proof that counts: the relay actually GRANTED the reservation. `listen()`
-                    // resolving is not enough — a relay that is out of reservation slots completes the
-                    // handshake and simply grants nothing, leaving a node that looks started and is reachable
-                    // by nobody.
-                    if (listenOutcome === "asked" && holdsCircuit(candidate)) {
-                        candidateGranted = true;
-                        // The probe has done its job: this relay grants THIS identity. Tear it down and ask the
-                        // next relay — the reservation is re-taken by the final node below, which is the only one
-                        // that can listen on every granted address at once. AWAITED, because the next probe comes
-                        // up on this same peer id.
-                        try {
-                            await candidate.stop();
-                        }
-                        catch { /* it may never have finished starting */ }
-                    }
-                }
-            }
-            if (!candidateGranted && !rejectionNamed) {
-                const rejectionReason = 
-                // A CLIENT-SIDE FAULT KEEPS ITS OWN NAME, and it is checked FIRST because everything below
-                // infers a cause from the relay connection — which is intact and irrelevant when the ask
-                // never left this process (review HIGH-2).
-                askFault !== undefined
-                    ? askFault
-                    : outcome === "started"
-                        ? /**
-                           * ⚠️ Review MEDIUM-7 — **"ASKED" DOES NOT MEAN THE RELAY ANSWERED.** A relay that is
-                           * simply DOWN yields no circuit address — indistinguishable, here, from a relay that
-                           * answered and granted nothing. Reporting that as `relay_granted_no_reservation` sends
-                           * the operator to look at relay capacity for what is a network fault. An open
-                           * connection to the relay peer is the thing that separates them, and we have one to
-                           * ask. (Reachable now only in the narrow case where the proof landed and the
-                           * connection died before the ask — the proof branch above owns every other route to a
-                           * dead relay, and names it.)
-                           */
-                            (candidate.getConnections().some((c) => c.peerId === relayPeerIdOf(circuitAddr))
-                                ? "relay_granted_no_reservation"
-                                : "relay_unreachable")
-                        : outcome === "failed"
-                            ? "relay_unreachable"
-                            : "reservation_did_not_complete_in_time";
-                this.#ctx.srLastRejectionReason.set(agentName, rejectionReason);
-                this.#ctx.logger.warn("session.standing_receiver.relay.rejected", {
-                    agentName,
-                    circuitAddr,
-                    reason: rejectionReason,
-                    ...(error !== "" ? { error } : {}),
-                    correlationId,
-                });
-                // Abandon it — but on its OWN settlement, never best-effort. `start()` may still be parked on
-                // a dial, and this candidate carries the receiver's identity: an unawaited `stop()` on a node
-                // whose status is still `starting` returns without stopping anything, and the node then goes
-                // live on our peer id with nothing left holding a reference to kill it.
-                //
-                // BOTH promises: the reservation is taken by the ASK now, so a candidate abandoned on the
-                // ask's deadline still has work in flight that `start()` settling says nothing about.
-                stopWhenSettled(candidate, [startP, listenP], this.#ctx.srReservationTimeoutMs * 2);
+            const sr = this.#ctx.standingReceivers.get(agentName);
+            if (sr) {
+                void this.releaseSessionReservation(agentName, sr.node, sessionIdHex, correlationId)
+                    .catch(() => { });
             }
-            if (candidateGranted)
-                grantedAddrs.push(circuitAddr);
-            // 032-RELAYSPREAD: DO NOT BREAK ON THE FIRST GRANT. The walk used to stop here, which is why
-            // an agent held exactly one reservation and losing that relay cost it every NAT'd caller for
-            // however long detection happened to take. It now asks every remaining relay.
-            if (candidateRefusedAgent)
-                break;
-        }
+        }, OFFER_RESERVATION_GRACE_MS);
+        timer.unref?.();
+        this.#offerReleaseTimers.set(key, timer);
+    }
+    /**
+     * 055-ONDEMAND — re-take a circuit on a node that already exists, for a live session that lost it.
+     *
+     * ⚠️ **IT PROVES OVER THE DELIVERY PATH TOO.** `DOD-M15-RELAYAUTH-1` applies identically here: a
+     * holder that has not proven key possession has its reservation revoked inside the relay's grace
+     * window, about fifteen seconds. The first version of the re-take called the low-level ask
+     * directly and skipped it, so a re-taken circuit would have been revoked almost immediately while
+     * the log said "granted" — the same defect this unit already fixed one function up.
+     */
+    async retakeReservationOn(agentName, node, circuitAddr, correlationId) {
+        const relayPeerId = relayPeerIdOf(circuitAddr);
+        const outcome = await this.#takeReservation(agentName, node, circuitAddr, correlationId);
+        if (outcome !== "granted")
+            return false;
         /**
-         * THE RECEIVER, listening on EVERY granted circuit address.
+         * ⚠️ **THE OTHER HALF OF `reservation_lost` — 056-SLOTDEAD, review F4.**
          *
-         * One node per agent, as before — what changed is how many circuits it announces. Each address
-         * here belongs to a relay that granted THIS seed moments ago and therefore still remembers the
-         * identity, so the final node's first ask is the one that succeeds; the two-attempt dance was
-         * already paid per relay in the walk.
+         * The loss trigger fires the moment a reservation goes, which is exactly when the relay link is
+         * down, so the pull it starts is aimed at a relay that cannot answer. Without something on the
+         * recovery, content the counterparty parked during the outage waits for the slow periodic
+         * backstop while the relay is healthy and this agent is connected to it again.
          *
-         * ⚠️ RACED AGAINST A DEADLINE, and that is measured rather than cautious: `#buildRevivedNode`
-         * records a live 2026-08-18 result where a node handed two relay addresses at once with no
-         * deadline never finished starting at all (10,002ms and counting). Its identity was unproven at
-         * both relays, which is not this case — but "not this case" is a prediction, and the standing
-         * receiver is the thing that makes an agent reachable, so it does not wait on one.
+         * **This path, and not the two that look like it.** The watchdog's `gained` branch was the
+         * first attempt and never fired — a take records the new circuit on the receiver itself, so by
+         * the next tick there is nothing left for the watchdog to see as gained; a test caught it, which
+         * is the only reason it is not still in the tree looking correct. `takeReservationForSession`
+         * was the second, and it double-drains: on a first login it fires moments after the install
+         * drain, for the same empty mailbox.
          *
-         * An empty `grantedAddrs` yields the plain TCP floor, exactly as before: reachable by peers
-         * that can dial directly, and loud about it (`session.standing_receiver.reservation.none`).
+         * A re-take is unambiguous. It happens only when a session that HAD a circuit lost it, which is
+         * exactly the outage whose recovery this is.
          */
-        const node = await this.createAgentNode(agentName, {
-            sessionId,
-            connectionGater: gater,
-            nodeType: "standing_receiver",
-            ...(grantedAddrs.length > 0 ? { circuitRelayListenAddrs: grantedAddrs } : {}),
-            transportPrivateKey: receiverSeed,
-        });
-        if (grantedAddrs.length === 0) {
-            await node.start();
-            return { node, seed: receiverSeed };
+        this.#ctx.park.fireParkedDrain(agentName, "reservation_regained");
+        if (relayPeerId) {
+            void this.#ctx.authenticateStandingReceiver(agentName, node, relayPeerId, circuitAddr, correlationId)
+                .catch((err) => {
+                this.#ctx.logger.warn("session.standing_receiver.relay_auth.failed", {
+                    agentName, relayPeerId, correlationId,
+                    error: extractErrorMessage(err),
+                    impact: "a live session re-took a circuit but did not prove key possession over the " +
+                        "delivery path, so the relay may revoke it inside its grace window.",
+                });
+            });
+        }
+        return true;
+    }
+    async takeReservationForSession(agentName, circuitAddr, correlationId, 
+    /**
+     * ⚠️ **PRESENT ONLY ON THE OFFER PATH, AND THAT IS WHAT ARMS THE ABANDONED-OFFER RELEASE.**
+     *
+     * The first version reused `correlationId` for this, because the offer handler happens to pass
+     * the session id as its correlation id. Two meanings in one parameter is how a value ends up
+     * being trusted for something it was never chosen for: the watchdog's re-take passes a genuine
+     * correlation id, and it would have armed a timer keyed on a string that is not a session.
+     *
+     * Absent for the re-take path, which is by definition for a session that is already live.
+     */
+    offerSessionIdHex) {
+        const sr = this.#ctx.standingReceivers.get(agentName);
+        if (!sr) {
+            this.#ctx.logger.warn("session.reservation.on_demand.no_receiver", {
+                agentName,
+                circuitAddr,
+                correlationId,
+                impact: "there is no standing receiver to hold a reservation, so this agent cannot be " +
+                    "dialled for this session; it is reachable through the relay's store-and-forward only.",
+            });
+            return false;
         }
+        // The relay must be dialable BEFORE we dial it — our own gater refuses otherwise, which is the
+        // same ordering the login walk uses and the one that cost a whole debugging session when it
+        // was missing.
+        const relayPeerId = relayPeerIdOf(circuitAddr);
+        if (relayPeerId)
+            sr.gater.setAllowedOutboundPeer(relayPeerId);
+        const outcome = await this.#takeReservation(agentName, sr.node, circuitAddr, correlationId);
         /**
-         * ⚠️ SLOW AND FAILED ARE DIFFERENT ANSWERS AND MUST NOT SHARE A BRANCH. Review F1: a single
-         * `.catch(() => false)` around this race collapsed every `start()` REJECTION into the deadline
-         * branch — and `CelloNodeImpl.start()` rejects by design, stopping the node and throwing
-         * `listen_failed` when no direct (non-circuit) listener materialised. That is the guard the
-         * transport keeps precisely so `FaultTolerance.NO_FATAL` cannot mask a real `EADDRINUSE`.
+         * ⚠️ **THE RECEIVER'S RECORD OF WHAT IT HOLDS MUST FOLLOW, or two things go quietly wrong.**
+         * `relayPeerIds` is what the reservation watchdog compares against to decide a reservation was
+         * LOST, and what `cello_status` reports as reachability. Left at its build-time value — empty,
+         * now that nothing is taken at login — the watchdog would see a held circuit it never recorded
+         * and `cello_status` would call a reachable agent unreachable.
          *
-         * Swallowed, it installed a STOPPED node as the agent's front door: no addresses to advertise,
-         * `#tryCreateStandingReceiver` never saw a failure so the M8B F14 retry never fired, and the
-         * operator was told the receiver "did not finish binding every circuit inside the deadline" and
-         * "is reachable through those" — sending them to the relay fleet for a port held by an orphan
-         * daemon on their own machine. The rejection is rethrown so it reaches
-         * `session.node.create.failed` with its own cause, exactly as it does on the no-relay path.
+         * Read from the NODE rather than appended to, and deduped by relay: libp2p announces one
+         * address per relay listen address, so a five-address relay would otherwise count five times.
          */
-        let deadline;
-        let startError;
-        const started = node.start().then(() => "ok", (err) => { startError = err; return "failed"; });
-        const outcome = await Promise.race([
-            started,
-            new Promise((resolve) => {
-                // Per granted relay: each circuit listener is its own dial and its own reservation, so a
-                // pool of three must not be judged on a budget sized for one.
-                deadline = setTimeout(() => resolve("slow"), this.#ctx.srReservationTimeoutMs * grantedAddrs.length);
-            }),
-        ]);
-        if (deadline !== undefined)
-            clearTimeout(deadline);
-        if (outcome === "failed")
-            throw startError;
+        const heldNow = heldRelayIdsOf(sr.node);
+        this.#ctx.standingReceivers.set(agentName, { ...sr, relayPeerIds: heldNow });
         /**
-         * GRANTED IN THE WALK, REFUSED AT INSTALL — a distinct fact and, until this line, an invisible
-         * one. The receiver would simply report `reservationsHeld: 2` where 3 relays granted, with
-         * nothing naming which relay went missing or why.
+         * ⚠️ **A RELAY THAT GRANTED MUST BE ADMITTED INBOUND, OR THE RESERVATION BUYS NOTHING.**
          *
-         * ⚠️ IT HAS A KNOWN CAUSE AND A CROSS-REPO CLOCK. The walk stops the granted candidate and the
-         * node below RE-ASKS, which works because the relay remembers the proof — for
-         * `PROVEN_PEER_MEMORY_MS = 2 minutes` (`relay-connection-gater.ts`, trustless-cello).
+         * The gater's inbound carve-out is the security-sensitive half of a reservation: only relays
+         * whose own grant is confirmed earn it, so a directory that merely NAMES a relay cannot dial us
+         * through it. That set was built once from what the login walk held — empty now — so an
+         * on-demand reservation would have been taken, announced, and then refused by OUR OWN gater
+         * when the counterparty dialled through it.
+         *
+         * Recomputed from what the node HOLDS, never from what was asked: being named by the directory
+         * must not buy a foothold, and under on-demand the directory is what names the relay.
+         */
+        sr.gater.setReservedRelayPeers(heldNow);
+        /**
+         * ⚠️ **DOD-M15-RELAYAUTH-1 STILL APPLIES, AND IT NO LONGER FIRES ON ITS OWN.**
          *
-         * ⚠️ **AND THIS IS WHERE THE ORIGINAL COLLISION STILL LIVES** (review MEDIUM-3). The node built
-         * below carries `circuitRelayListenAddrs`, so libp2p asks at start, on a FRESH connection that
-         * has proved nothing on itself. `DOD-M15-RELAYPROVE-ORDER-1` removed the refused first ask from
-         * the WALK; the installed receiver still depends on the relay's two-minute peer memory, and when
-         * that memory has expired the whole original loop returns for it — refused ask, connection
-         * manager restart, connections closed. **It is mitigated by a cross-repo TTL, not removed.** The
-         * probe/final split is what forces it, and that split is what unit 2 of
-         * `M15-STORY-RESERVATIONS-ON-DEMAND` (splitting the standing receiver) deletes; the fix belongs
-         * there rather than in a second pass here.
+         * That auth is a SECOND proof, over the DELIVERY path, and it is what keeps the relay from
+         * revoking a reservation whose holder has not proven key possession to it — the grace window is
+         * about fifteen seconds. It used to run in the receiver build, over the circuits the login walk
+         * had just collected. Nothing is collected there any more, so without this line an on-demand
+         * reservation would be taken and then quietly revoked mid-session, and the agent would go
+         * unreachable while every log said the reservation was granted.
          *
-         * ⚠️ **THE BUDGET ARITHMETIC BELOW IS NOT WHAT IT WAS.** It used to read *"`#srReservationTimeoutMs`
-         * × 2 attempts per relay"* — there is one attempt now, but the wall clock did NOT halve: a
-         * candidate costs `start` + `proveToRelay` + `ask`, and **`proveToRelay` carries no deadline of
-         * its own at either call site**. So a pool of three can still exceed the two-minute memory, and
-         * the ceiling is now harder to state than it was, not easier. That missing deadline is recorded
-         * in `053-FIRSTASK`'s *Newly discovered*.
+         * Best-effort and unawaited, exactly as it is in the build path: a failure here costs the
+         * relay's own grace-window revoke, which the watchdog already treats as an ordinary loss.
          */
-        const boundRelays = new Set(heldRelayIdsOf(node));
-        const grantedButUnbound = grantedAddrs
-            .map((a) => CIRCUIT_RELAY_ID.exec(a)?.[1])
-            .filter((id) => id !== undefined && !boundRelays.has(id));
-        if (grantedButUnbound.length > 0) {
-            this.#ctx.logger.warn("session.standing_receiver.spread.grant_not_bound", {
+        if (outcome === "granted" && offerSessionIdHex !== undefined) {
+            this.#armOfferRelease(agentName, offerSessionIdHex, circuitAddr, correlationId);
+        }
+        if (outcome === "granted" && relayPeerId) {
+            void this.#ctx.authenticateStandingReceiver(agentName, sr.node, relayPeerId, circuitAddr, correlationId)
+                .catch((err) => {
+                this.#ctx.logger.warn("session.standing_receiver.relay_auth.failed", {
+                    agentName, relayPeerId, correlationId,
+                    error: extractErrorMessage(err),
+                    impact: "this agent has a reservation the relay may revoke within its grace window, " +
+                        "because key possession was not proven over the delivery path.",
+                });
+            });
+        }
+        return outcome === "granted";
+    }
+    /**
+     * 055-ONDEMAND — **GIVE THIS SESSION'S SLOT BACK, FROM THE NODE THAT ACTUALLY HOLDS IT.**
+     *
+     * ⚠️ **THE FIRST VERSION LOOKED THE NODE UP BY AGENT NAME AND ALWAYS FOUND THE WRONG ONE.** When a
+     * session opens, the standing receiver is PROMOTED: `session-lifecycle` deletes it from
+     * `standingReceivers`, moves that exact node into `activeNodes`, and builds a fresh empty receiver
+     * behind it. So by seal time `standingReceivers.get(agentName)` is the new idle node, holding
+     * nothing — the release read `[]`, returned immediately, and told the relay nothing. The slot the
+     * offer took lived on the promoted node and died with it, invisible to the relay, held for the
+     * full TTL. **A release that always no-ops is worse than none: it logs success.**
+     *
+     * ⚠️ **AND THE CROSS-SESSION RECOMPUTE THE ORDER ASKED FOR IS UNNECESSARY, which is the good news
+     * in the correction.** libp2p's shared `reservationStore` is shared *within one node*. Each live
+     * session owns its OWN node, so sealing one cannot clear another session's refresh timers. There
+     * is nothing to recompute: this node is being torn down anyway, so tell its relays and drop its
+     * circuits. Re-deriving that removed a whole class of drift rather than managing it.
+     */
+    async releaseSessionReservation(agentName, node, sessionId, correlationId) {
+        const held = heldRelayIdsOf(node);
+        if (held.length === 0)
+            return;
+        for (const relayPeerId of held) {
+            /**
+             * ⚠️ BOUNDED, BECAUSE THIS RUNS INSIDE A TEARDOWN. Telling a relay means dialling it, and an
+             * unreachable one would otherwise hold the seal open for as long as its dial takes. Measured
+             * the hard way: unbounded, this hung fourteen unrelated suites at 237s each. A seal waiting on
+             * a courtesy is worse than a slot held until its TTL.
+             */
+            await Promise.race([
+                this.#ctx.tellRelayReleased(agentName, relayPeerId, node, correlationId),
+                new Promise((r) => setTimeout(r, RELEASE_TELL_BUDGET_MS).unref?.()),
+            ]);
+        }
+        // Local half. The node is going away regardless; this stops it announcing a route it no longer
+        // holds for whatever is left of its life.
+        try {
+            await node.releaseAllCircuits();
+        }
+        catch (err) {
+            this.#ctx.logger.debug("session.reservation.release.local_failed", {
+                agentName, sessionId, correlationId, error: extractErrorMessage(err),
+                // The node is being torn down either way, so this costs nothing beyond a few more seconds
+                // of announcing a route that is already gone at the relay. Deliberately NOT claiming the
+                // watchdog repairs it (review MEDIUM-11): this unit removed the rebuild that used to.
+                impact: "the session's node keeps announcing a circuit it has released, until it stops.",
+            });
+        }
+        this.#ctx.logger.info("session.reservation.released", {
+            agentName,
+            sessionId,
+            releasedRelays: held,
+            correlationId,
+            impact: "the slot this session borrowed is back in the relay's table, rather than held until " +
+                "its two-hour TTL.",
+        });
+    }
+    async #takeReservation(agentName, node, circuitAddr, correlationId) {
+        const verdict = await this.#ctx.proveToRelay(agentName, circuitAddr, node, correlationId, true);
+        if (verdict === "refused_this_agent" || verdict === "refused_try_another_relay") {
+            const reason = verdict === "refused_this_agent" ? "relay_refused_this_agent" : "relay_proof_refused";
+            this.#ctx.srLastRejectionReason.set(agentName, reason);
+            this.#ctx.logger.warn("session.standing_receiver.relay.rejected", {
                 agentName,
-                relayPeerIds: grantedButUnbound,
-                relaysGranted: grantedAddrs.length,
-                reservationsHeld: boundRelays.size,
-                walkMs: Date.now() - walkStartedAt,
+                circuitAddr,
+                reason,
                 correlationId,
-                impact: "these relays granted this agent a reservation during the walk and then bound no " +
-                    "circuit on the receiver itself, so the agent is reachable through fewer relays than it " +
-                    "earned. The relay remembers a proof for two minutes; if walkMs is near or past that, " +
-                    "the proof expired before the receiver asked and the walk is what needs shortening — " +
-                    "not the relay fleet.",
+                impact: verdict === "refused_this_agent"
+                    ? "the relay refused this AGENT rather than being unwilling or unwell, so every other " +
+                        "relay would refuse it identically. Stopped here; cello_status carries the cause."
+                    : "this relay would not take the agent's proof. Moving to the next relay.",
             });
+            return verdict === "refused_this_agent" ? "refused_this_agent" : "declined";
         }
-        if (outcome === "slow") {
-            // NOT a teardown, and now this line means only what it says: the node is starting and has not
-            // finished. It is installed with whatever circuits did materialise, because some reachability
-            // beats none and the reservation watchdog is what settles the rest.
-            this.#ctx.logger.warn("session.standing_receiver.spread.slow_start", {
+        /**
+         * ⚠️ **A PROOF THAT REACHED NO VERDICT IS NOT A REFUSAL** — `unavailable` means the relay never
+         * answered (no client wired, or unreachable), and NOT every relay gates reservations. Refusing
+         * to ask because our own proof path was unavailable would lose the ability to reserve with an
+         * ungated relay entirely. The boundary is enforced in `proveToRelay`, which returns
+         * `unavailable` for exactly this (review HIGH-1 on unit 1).
+         */
+        if (verdict === "unavailable") {
+            this.#ctx.logger.warn("session.standing_receiver.prove.no_verdict", {
                 agentName,
-                relaysGranted: grantedAddrs.length,
-                circuitAddrs: node.listenAddresses().filter((a) => a.includes("/p2p-circuit")).length,
-                budgetMs: this.#ctx.srReservationTimeoutMs * grantedAddrs.length,
+                circuitAddr,
                 correlationId,
-                impact: "the receiver did not finish binding every circuit it was granted inside the " +
-                    "deadline, so it is being installed with the circuits it has. It is reachable through " +
-                    "those; the reservation watchdog re-checks the rest on its next tick.",
+                impact: "no proof verdict was obtained from this relay. Asking for the reservation anyway: " +
+                    "a relay that does not gate them grants it, and one that does refuses an ask that cost a " +
+                    "single dial.",
             });
         }
-        return { node, seed: receiverSeed };
+        let askFault;
+        let error = "";
+        let timer;
+        const timedOut = Symbol("listen_timeout");
+        let outcome = timedOut;
+        try {
+            /**
+             * ⚠️ **AN ABANDONED ASK NOW LANDS ON A NODE THAT LIVES ON** — review MEDIUM-5, and it is the
+             * mirror image of the hazard the old probe teardown existed for.
+             *
+             * When a probe timed out it was destroyed, so a grant arriving late died with it. There is
+             * one long-lived node now: a late grant ADDS a circuit address after the walk has counted
+             * what it holds, so the receiver would advertise a relay that is in neither `sr.relayPeerIds`
+             * nor the gater's reserved set — the ledger and the advertised addresses disagreeing, which
+             * is what the watchdog then churns on.
+             *
+             * So a late grant is GIVEN BACK rather than kept. Releasing costs a dial; keeping it costs a
+             * disagreement no operator can see, and a slot on a relay we already decided against.
+             */
+            const askP = node.listenOnCircuit(circuitAddr).then(() => "asked");
+            void askP.catch(() => { });
+            outcome = await Promise.race([
+                askP,
+                new Promise((resolve) => {
+                    timer = setTimeout(() => resolve(timedOut), this.#ctx.srReservationTimeoutMs);
+                }),
+            ]);
+            if (outcome === timedOut) {
+                void askP.then(() => {
+                    this.#ctx.logger.warn("session.standing_receiver.reservation.late_grant_released", {
+                        agentName,
+                        circuitAddr,
+                        correlationId,
+                        impact: "this relay answered after the walk had moved on, so its circuit was not " +
+                            "counted or advertised. Given back rather than held: a slot nobody knows about is " +
+                            "one the relay cannot reuse and this agent cannot rely on. ⚠️ This drops EVERY " +
+                            "circuit — libp2p's reservation store is shared across listeners and cannot " +
+                            "release one — so the receiver is rebuilt by the watchdog, which is the correct " +
+                            "outcome: a walk whose result is already wrong should be redone, not patched.",
+                    });
+                    return node.releaseAllCircuits().catch(() => false);
+                }, () => { });
+            }
+        }
+        catch (err) {
+            error = extractErrorMessage(err);
+            // A fault of OURS keeps its own name rather than being re-derived from the relay connection,
+            // which is intact and irrelevant when the ask never left this process (review HIGH-2).
+            askFault = clientSideAskFault(err);
+        }
+        finally {
+            if (timer !== undefined)
+                clearTimeout(timer);
+        }
+        // The only proof that counts: an ANNOUNCED circuit address on this relay. `listen()` resolving
+        // is not enough — a relay at its slot cap completes the handshake and grants nothing.
+        const relayPeerId = relayPeerIdOf(circuitAddr);
+        if (outcome === "asked" && node.listenAddresses().some((a) => a.split("/").includes("p2p-circuit") && (relayPeerId === null || a.includes(`/p2p/${relayPeerId}/`)))) {
+            return "granted";
+        }
+        /**
+         * ⚠️ **THE CONNECTION CHECK APPLIES TO BOTH OUTCOMES** — review MEDIUM-6.
+         *
+         * "Asked" does not mean the relay answered: a relay that is down yields no circuit address,
+         * indistinguishable here from one that answered and granted nothing. An open connection is what
+         * separates them, and we have one to ask.
+         *
+         * The first version of this rewrite applied that check only to the `asked` branch, so a HUNG
+         * ask short-circuited to `reservation_did_not_complete_in_time` — latency — when the relay was
+         * simply gone. That is a name for where the failure surfaced, not for what went wrong, in a
+         * unit whose headline is that behaviour does not change.
+         */
+        const connectedToRelay = node.getConnections().some((c) => c.peerId === relayPeerId);
+        const reason = askFault !== undefined
+            ? askFault
+            : !connectedToRelay
+                ? "relay_unreachable"
+                : outcome === "asked"
+                    ? "relay_granted_no_reservation"
+                    : "reservation_did_not_complete_in_time";
+        this.#ctx.srLastRejectionReason.set(agentName, reason);
+        this.#ctx.logger.warn("session.standing_receiver.relay.rejected", {
+            agentName,
+            circuitAddr,
+            reason,
+            ...(error !== "" ? { error } : {}),
+            correlationId,
+        });
+        return "declined";
     }
     /** One standing-receiver create attempt (extracted for the M8B F14 retry loop). */
     async #tryCreateStandingReceiver(agentName, correlationId) {
@@ -529,43 +577,28 @@ export class StandingReceivers {
         });
         autoNat.emitInitialResult();
         /**
-         * EVERY RELAY THE NODE ACTUALLY HOLDS A CIRCUIT WITH — derived from the addresses the node
-         * holds, never from `reservations.addrs`.
+         * ⚠️ **A RECEIVER IS INSTALLED HOLDING NOTHING, AND THAT IS NOW A CONSTANT — 056-SLOTDEAD.**
+         *
+         * This block used to derive what the node had come up holding: `heldRelayIdsOf(node)`, the
+         * matching circuit addresses, the count for the reachability line, and the gater's inbound
+         * carve-out. Every one of those read the result of the login walk. `#startReceiverNode` returns
+         * a TCP-only node now (055-ONDEMAND), so all four were computing `[]` — reachable, referenced,
+         * and unable to produce a different answer on any input.
          *
-         * The old code read `reservations.addrs[0]`'s relay id as a fallback, and its own comment
-         * called the hazard "dormant while the pool is size 1; the pool is designed to be larger."
-         * THIS UNIT IS WHAT MAKES THE POOL LARGER, so the dormant case wakes up: candidate 0 refusing
-         * while candidate 1 grants recorded a relay we are not connected to, the watchdog found it
-         * absent on every tick forever, and it rebuilt on the 30-second grid — churning the very
-         * reservations this unit exists to conserve. A candidate is a relay we ASKED; only a held
-         * address is a relay that ANSWERED, and the fallback conflated the two.
+         * The distinction the deleted comment was defending — a CANDIDATE is a relay we asked, a HELD
+         * address is one that answered — is still the rule, and it still lives in `heldRelayIdsOf`. It
+         * is enforced where a reservation is actually taken (`takeReservationForSession`) and where one
+         * is checked (the watchdog), which is where it belongs. Nothing is held here to check.
          *
-         * The fallback's own stated worry stands, and is answered by the count rather than by the
-         * candidate list: if a transport ever reports a circuit address without the relay's peer id in
-         * `/p2p/<id>/p2p-circuit` form, that address yields no id and is not counted as held — so the
-         * receiver reads as degraded and gets rebuilt, instead of reading as healthy against a relay
-         * nobody is connected to. Degrading toward "rebuild" is the safe direction; the other one is
-         * the silent unreachability this whole file exists to kill.
+         * The gater is left as constructed: its reserved set starts empty, and `takeReservationForSession`
+         * widens it for the one relay that grants. Setting it to `[]` here only restated that.
          */
-        const heldRelayPeerIds = heldRelayIdsOf(node);
-        const circuitAddrs = heldRelayPeerIds.length;
-        const heldCircuitAddrs = node.listenAddresses().filter((a) => a.includes("/p2p-circuit"));
-        // DOD-M15-ASSIGN-1 review N3, widened by 032-RELAYSPREAD: the relays this receiver actually
-        // reserved with earn the inbound AutoNAT carve-out — nothing else does. Populated only from
-        // reservations that genuinely completed, so a directory that merely NAMES a relay cannot dial
-        // in behind it, however many relays it names.
-        gater.setReservedRelayPeers(heldRelayPeerIds);
-        // The re-spread clock starts HERE, at the build, not at the epoch. Otherwise the first decay
-        // re-spreads instantly — undoing the "a lost relay does not rebuild the receiver" rule seconds
-        // after it fires, and changing the peer id of an agent that just lost one relay of three. The
-        // ratchet this guards against runs over hours; nothing about it needs answering in a second.
-        this.#ctx.srLastRespreadAt.set(agentName, Date.now());
         this.#ctx.standingReceivers.set(agentName, {
             node,
             gater,
             autoNat,
             seed,
-            relayPeerIds: heldRelayPeerIds,
+            relayPeerIds: [],
         });
         this.#ctx.logger.info("session.node.created", {
             sessionId,
@@ -573,69 +606,74 @@ export class StandingReceivers {
             sessionPeerId: node.getPeerId(),
             correlationId,
         });
-        // DOD-M15-RELAYAUTH-1: authenticate to the reservation relay NOW, not when a session first
-        // needs one. The relay times out a reservation nobody has proven key possession for
-        // (relay-connection-gater.ts, trustless-cello) — proving it here, instead of waiting for a
-        // real session to exist, is what keeps this reservation alive past that grace window.
-        // Best-effort and unawaited: a failure here costs nothing beyond the relay's own grace-window
-        // revoke, which the reservation watchdog already treats as an ordinary lost reservation.
-        // ONCE PER HELD RELAY. Each relay revokes independently — it times out the reservation of any
-        // peer that has not proven key possession TO IT — so proving to one of three and calling the
-        // receiver authenticated would lose the other two circuits about fifteen seconds later, which
-        // is the same silent unreachability with two more relays paying for it.
-        for (const relayPeerId of heldRelayPeerIds) {
-            const heldCircuitAddr = heldCircuitAddrs.find((a) => a.includes(`/p2p/${relayPeerId}/p2p-circuit`));
-            if (heldCircuitAddr === undefined)
-                continue;
-            void this.#ctx.authenticateStandingReceiver(agentName, node, relayPeerId, heldCircuitAddr, correlationId)
-                .catch((err) => {
-                this.#ctx.logger.warn("session.standing_receiver.relay_auth.failed", {
-                    agentName,
-                    relayPeerId,
-                    error: extractErrorMessage(err),
-                    correlationId,
-                });
-            });
-        }
-        // DOD-NAT-REACHABILITY-1 observability: how reachable did this receiver come up? Zero held
-        // while relays were offered means every relay refused or was unreachable — the agent is deaf
-        // to NAT'd initiators (public ones can still connect directly). That must be LOUD, not a quiet
-        // shrug.
-        //
-        // 032-RELAYSPREAD — TWO NUMBERS, SO TWO NAMES. Both events used to carry one field,
-        // `reservationsRequested`, holding `reservations.addrs.length` — the size of the CANDIDATE
-        // list, under a name that reads as a count of asks. That is why "the client already requests a
-        // reservation with every relay it knows" read as true in an audit: the outcome was one and the
-        // request was one too, and a single field could report neither.
-        //   relaysOffered    — how many relays were in the candidate list (deduped by relay peer id in
-        //                      `#reservationCircuitAddrs`, so it counts relays, not addresses).
-        //   reservationsHeld — how many reservations this node actually holds, counted the only way
-        //                      that proves a grant: ANNOUNCED /p2p-circuit listen addresses. `start()`
-        //                      resolving is not enough — a relay out of reservation slots completes the
-        //                      handshake, grants nothing, and leaves a node that looks started and is
-        //                      dialable by nobody.
+        /**
+         * ⚠️ **DOD-M15-RELAYAUTH-1'S INSTALL-TIME PROOF IS GONE — 056-SLOTDEAD, and it could not have
+         * run since 055-ONDEMAND.**
+         *
+         * It read: *"authenticate to the reservation relay NOW, not when a session first needs one"* —
+         * because the relay revokes a reservation whose holder has not proven key possession to it, and
+         * a login-time slot had to survive that grace window with no session in sight. It looped over
+         * the relays this receiver held. It holds none, so the loop's body never executed.
+         *
+         * **The requirement it served is not gone; it moved, and it moved to the stronger place.** A
+         * reservation is now taken by `takeReservationForSession`, which proves FIRST and asks second on
+         * the same connection (`DOD-M15-RELAYPROVE-ORDER-1`). "Proven before the slot exists" is
+         * structural there, rather than a second best-effort call racing a grace window.
+         */
+        /**
+         * DOD-NAT-REACHABILITY-1 observability: what did this receiver come up able to use?
+         *
+         * ⚠️ **`reservationsHeld` WAS DROPPED, NOT RENAMED — 056-SLOTDEAD.** It carried
+         * `heldRelayIdsOf(node).length` and was the one number in this line an operator would act on.
+         * Since 055-ONDEMAND a receiver is installed holding nothing by design, so it reported `0` on
+         * every healthy login for every agent — a measurement that had become a constant while still
+         * reading as a measurement. That is worse than not reporting it: the number an operator trusts
+         * to mean "this agent is deaf" now means nothing at all.
+         *
+         * `relaysOffered` stays and is still a real count: how many relays are in the candidate list
+         * (deduped by relay peer id in `reservationCircuitAddrs`, so it counts relays, not addresses).
+         * **Zero of them is the condition worth seeing here** — an agent with no candidate cannot take a
+         * slot when an offer arrives, and will refuse the call.
+         *
+         * What an agent actually holds is reported where it is now decided: `session.offer.reservation`
+         * at the moment a slot is asked for, and `getStandingReceiverReachability` for `cello_status`.
+         */
         this.#ctx.logger.info("session.standing_receiver.reachability", {
             agentName,
             relaysOffered: reservations.addrs.length,
-            reservationsHeld: circuitAddrs,
             correlationId,
         });
-        if (reservations.addrs.length > 0 && circuitAddrs === 0) {
-            this.#ctx.logger.warn("session.standing_receiver.reservation.none", {
-                agentName,
-                relaysOffered: reservations.addrs.length,
-                // Zero by this branch's own condition, and stated rather than implied: the event reads
-                // "offered 3, held 0" on its own, without the reader having to find the gate above it.
-                reservationsHeld: circuitAddrs,
-                relayPeerIds: reservations.relayPeerIds,
-                correlationId,
-            });
-        }
+        /**
+         * ⚠️ **`reservation.none` IS NOT EMITTED AT BUILD ANY MORE — 055-ONDEMAND.**
+         *
+         * It means *"this agent is offered relays and holds none, so nobody behind NAT can dial it"* —
+         * a warn that fired 481 times over 17 days and drove a whole retry story. Under on-demand,
+         * holding none at build is the DESIGN: a slot is taken when an offer arrives and given back at
+         * the seal. Leaving the warn here would fire it on every healthy login for every agent, which
+         * is not a smaller version of the old problem but a worse one — an alarm that is wrong every
+         * time trains its reader to ignore the one time it is right.
+         *
+         * The condition it named still has a home. `session.offer.reservation` reports `granted: false`
+         * when an offer could not get a circuit — the moment it actually costs someone something — and
+         * the watchdog's re-take path reports a live session that lost one.
+         *
+         * ⚠️ **AND ITS DEBUG-LEVEL REPLACEMENT WENT TOO — 056-SLOTDEAD, review F10.** A
+         * `session.standing_receiver.idle_no_reservation` line survived here, guarded on
+         * `reservations.addrs.length > 0 && circuitAddrs === 0`. The second term was always true once
+         * the login walk was deleted, so the guard was really just "this agent has candidates" and the
+         * line fired on every healthy install for every agent — a second event, under a name that reads
+         * as a fault, asserting the same by-design state the `idle` line above already reports with its
+         * `relaysAvailable` count. Two lines per install saying "normal" is how a log stops being read.
+         */
         // DOD-PARK-DRAIN-1: this agent has a receiver again — drain whatever parked while it did not.
-        // Fired from the ONE place every path converges on (first ensure, the watchdog rebuild after a
-        // lost reservation, and the auth_ok rebuild), because the defect this closes was a trigger
-        // hooked to the wrong connection: content parks when the RELAY link dies, and the drain was
-        // waiting on DIRECTORY SIGNALING to reconnect — which it never had to, having never dropped.
+        // The defect this closes was a trigger hooked to the wrong connection: content parks when the
+        // RELAY link dies, and the drain was waiting on DIRECTORY SIGNALING to reconnect — which it
+        // never had to, having never dropped.
+        //
+        // 056-SLOTDEAD: this used to be the ONE place every path converged on, because a lost
+        // reservation rebuilt the receiver and arrived back here. The rebuilds are gone, so this now
+        // covers the INSTALL only, and the loss has its own trigger (`reservation_lost`) at the point
+        // the loss is noticed.
         this.#ctx.park.fireParkedDrain(agentName, "standing_receiver_ready");
         return { outcome: "installed" };
     }
@@ -692,72 +730,6 @@ export class StandingReceivers {
             this.#ctx.standingReceiverCreating.delete(agentName);
         }
     }
-    /**
-     * Replace an agent's reservation-less standing receiver with one that reserves.
-     *
-     * Deliberately NOT removeStandingReceiverForAgent()+ensureStandingReceiverForAgent():
-     * the public remove CLEARS #agentsWantingReceiver, so a cello_set_agent_offline landing in
-     * the window while node.stop() is awaited would find no map entry and no creating
-     * marker, leave no tombstone, and the re-ensure would then RESURRECT a receiver for
-     * an agent that asked to go dark — accepting inbound sessions for an offline agent.
-     * Here the want-flag is left intact and re-checked after the stop: a concurrent stop
-     * clears it, and the rebuild correctly no-ops.
-     */
-    async rebuildStandingReceiver(agentName) {
-        try {
-            const sr = this.#ctx.standingReceivers.get(agentName);
-            if (sr) {
-                this.#ctx.standingReceivers.delete(agentName);
-                /**
-                 * DOD-M12B-SESSION-SEED-1 (review F8): drop it zeroed, like every other seed.
-                 *
-                 * (review F7, STILL DECIDED AGAINST — deliberately NOT reusing this seed for the
-                 * replacement — but its stated blocker is GONE and the reason has changed. Restated rather
-                 * than reworded, because a decision whose premise has been reversed is a decision nobody
-                 * has actually made.)
-                 *
-                 * Reuse is attractive: this receiver's peer id may already be inside a `session_offer_accept`
-                 * the counterparty is acting on, and a rebuild in that window is the documented "we record
-                 * an identity that no longer exists… every send in this direction parks forever" defect.
-                 *
-                 * The old blocker was that a preserved identity would reach the candidate loop, whose
-                 * rejected candidates were stopped WITHOUT awaiting `start()`, putting two live nodes on one
-                 * advertised peer id. **032-RELAYSPREAD already crossed that line**: the walk now runs one
-                 * shared seed through every candidate, with a settlement-chained teardown, and it is safe
-                 * there because the receiver's gater admits nobody inbound.
-                 *
-                 * What still stops reuse HERE is different and is about the OLD node, not the new one. This
-                 * rebuild path awaits `sr.node.stop()`, but a stop can hang on a stuck libp2p teardown, and
-                 * handing the replacement the same identity before the previous receiver is provably dead
-                 * would put two nodes on a peer id a COUNTERPARTY has been told to dial — which is not the
-                 * candidate case at all: that node has a content handler and can be promoted. Doing it
-                 * safely needs a bounded, verified teardown first. Still follow-on work.
-                 */
-                sr.seed.fill(0);
-                try {
-                    sr.autoNat.stop();
-                    await sr.node.stop();
-                }
-                catch (err) {
-                    this.#ctx.logger.warn("session.standing_receiver.teardown.failed", {
-                        agentName,
-                        error: extractErrorMessage(err),
-                    });
-                }
-            }
-            // The agent may have gone offline while we were stopping the old node. Its
-            // want-flag is the authority — never resurrect a receiver it disowned.
-            if (!this.#ctx.agentsWantingReceiver.has(agentName) || this.#ctx.shuttingDown())
-                return;
-            await this.ensureStandingReceiver(agentName);
-        }
-        catch (err) {
-            this.#ctx.logger.warn("session.standing_receiver.reservation.rebuild.failed", {
-                agentName,
-                error: extractErrorMessage(err),
-            });
-        }
-    }
     /**
      * DOD-M12B-SESSION-SEED-1 — build a revived session node that is REACHABLE, without ever hanging.
      *
@@ -1163,8 +1135,43 @@ export class StandingReceivers {
         // is not "retrying" — reporting it as such sends an operator hunting a fault that is not there.
         if (sr.relayPeerIds.length > 0)
             return "reserved";
+        /**
+         * ⚠️ **A LIVE SESSION'S CIRCUIT COUNTS — 055-ONDEMAND, and without this the field measures the
+         * wrong node.**
+         *
+         * The standing receiver holds nothing while idle, by design. A session's circuit lives on the
+         * SESSION's node: the receiver was promoted into it and replaced. Reading only the receiver
+         * therefore reported `retrying` for an agent in a perfectly healthy conversation — a fault where
+         * there is none, on the surface an operator checks first.
+         */
+        if (this.#ctx.anyLiveSessionHoldsCircuit(agentName))
+            return "reserved";
         const retry = this.#ctx.srReservationRetry.get(agentName);
-        return retry !== undefined && retry.attempts > SR_RESERVATION_MAX_RETRIES ? "unreachable" : "retrying";
+        if (retry === undefined) {
+            /**
+             * ⚠️ **IDLE AND READY — DOD-M15-IDLE-READY-1, AND `retrying` HERE WAS NOT MERELY THE WRONG
+             * WORD.**
+             *
+             * Reaching this line means: a receiver exists, it holds no circuit, no live session holds one
+             * either, and **nothing has ever asked for one** — no retry state was recorded. Before
+             * 055-ONDEMAND that combination was rare and meant a real problem: an agent that wanted a slot
+             * at login and could not get one. An agent takes a slot when somebody calls now, so this is
+             * the ordinary resting state of every healthy idle agent on the fleet.
+             *
+             * Leaving it as `retrying` cost the field its only job. `retrying` said "we want a slot, we
+             * cannot get one, we are still trying" — and once every healthy agent says it, an agent that
+             * genuinely cannot get a slot is indistinguishable from one that is perfectly fine. A status
+             * that reads the same whether or not anything is wrong is not a status. Observed on two live
+             * agents the same afternoon: `reserved` on the published build, `retrying` on this one, with
+             * nothing different about whether anyone could reach them.
+             *
+             * ⚠️ **AND IT IS NOT `reserved`, which was the tempting one-liner.** `reserved` is a claim an
+             * operator acts on — a slot is held, so a counterparty behind a home router can dial in right
+             * now. That is false for an idle agent. Two different facts, so two different words.
+             */
+            return "ready";
+        }
+        return retry.attempts > SR_RESERVATION_MAX_RETRIES ? "unreachable" : "retrying";
     }
     /**
      * CELLO-M7-TRANSPORT-001: the AutoNAT service wrapping the current standing