@cello-protocol/daemon 0.0.211 → 0.0.213

package/dist/relay-receipt-store.js

@@ -1,8 +1,8 @@
 /**
- * CELLO Daemon — RelayReceiptStore (M8B DOD-RELAYSIG-1)
+ * CELLO Daemon — RelayReceiptStore (DOD-M15-ORDERPROOF-1, was M8B DOD-RELAYSIG-1)
  *
  * The relay is the ordering/witness authority: it assigns a canonical sequence number to each submitted
- * content-hash leaf and signs an ACK over it (PERSIST-012, relay-node `buildRelayAckTbs`). This store is the
+ * content-hash leaf and signs an ATTESTATION over it (relay-node `buildRelayAckTbs`). This store is the
  * client's IMMUTABLE record of those signed attestations — durable evidence that the relay assigned a
  * specific sequence to a specific hash at a specific time. The receipt is what lets the client later prove
  * (or dispute) the relay's ordering, and is the building block the client carries to the directory at seal
@@ -10,6 +10,18 @@
  *
  * Verification is an Ed25519 check that MUST stay byte-compatible with the relay's signer.
  *
+ * ⚠️ **THE KEY IT IS CHECKED AGAINST IS THE POINT — 069-ORDERPROOF.** This module used to verify the
+ * signature against `relay_id`, a key carried inside the very frame being checked, and its own comment
+ * called that "SELF-CONSISTENCY". It is not a check: anyone who can write the frame can mint a key, sign
+ * any ordering they like with it, and put the key in the field we verify against. The key now comes from
+ * `relay_id` on the **directory-signed `SessionAssignment`**, which is inside the FROST-signed TBS the
+ * client already verifies — something neither the relay nor either participant can rewrite.
+ *
+ * ⚠️ **AND ABSENT IS NOT FINE.** Missing, malformed and mismatched are ONE outcome (`refused`), because
+ * a party holding no attestation for a message is in exactly the state a corrupted one leaves them in.
+ * Whoever can cause the absence must not get a softer answer than whoever can cause the corruption — and
+ * the party who can cause the absence is the relay, the party the check exists to constrain.
+ *
  * IMMUTABILITY (SI-003): the unique unit of a relay attestation is a POSITION — (agent, session, sequence)
  * — not a content hash. The same plaintext ("ok") legitimately produces the same content hash at DIFFERENT
  * sequences (per-session relay counter; repeated content within a session), so the table is keyed on the
@@ -20,31 +32,92 @@
  * Crypto: Ed25519 (RFC 8032), SHA-256 (FIPS 180-4). TBS = SHA-256(hash_bytes || seq_BE4 || ts_BE8).
  */
 import { verify, buildRelayAckTbs } from "@cello-protocol/crypto";
+import { decodeStructure1 } from "@cello-protocol/protocol-types";
 /**
- * Verify a relay ACK signature against the (relayId-derived) relay pubkey. Returns true iff the signature
- * is exactly 64 bytes and Ed25519-verifies over TBS = SHA-256(hash_bytes || seq_BE4 || ts_BE8) — the same
- * TBS the relay signs (`buildRelayAckTbs`). A forged sequence number changes the TBS, so its signature fails.
+ * Verify a relay ordering attestation against a relay pubkey the CALLER supplies — and the caller
+ * must have got it from the directory-signed assignment, never from the frame.
+ *
+ * Returns true iff every field is well-formed and the 64-byte Ed25519 signature verifies over
+ * TBS = SHA-256(DOMAIN ‖ session_id ‖ content_hash ‖ seq_BE4 ‖ running_root ‖ ts_BE8) — the same
+ * statement the relay signs. A forged sequence, a swapped session or a rewritten prefix all change
+ * the TBS, so each fails.
+ *
+ * A wrong-length field returns FALSE rather than throwing: these bytes come off a wire the relay
+ * controls, and a malformed length must refuse this attestation, not take down the frame handler.
  */
-export function verifyRelayAck(contentHash, sequenceNumber, timestamp, signature, relayPubkey) {
+export function verifyRelayAck(sessionId, contentHash, sequenceNumber, runningRoot, timestamp, signature, relayPubkey) {
     if (signature.length !== 64)
         return false;
-    const tbs = buildRelayAckTbs(contentHash, sequenceNumber, timestamp);
+    if (sessionId.length !== 16 || contentHash.length !== 32 || runningRoot.length !== 32)
+        return false;
+    const tbs = buildRelayAckTbs(sessionId, contentHash, sequenceNumber, runningRoot, timestamp);
     return verify(relayPubkey, tbs, signature);
 }
 /**
- * Evaluate a relay ACK: decide whether it yields a storable, signature-verified receipt. This is the
- * verify-gates-store decision in isolation (so it is unit-testable without the relay stream) — a forged
- * signature returns `invalid_signature` and MUST NOT be stored (DoD: "a forged sequence is rejected").
+ * Read back the leaf we just submitted, so the relay's attestation has something to be checked
+ * against — the step BEFORE `evaluateRelayAck`, and the one that decides whether the check can run
+ * at all.
+ *
+ * ⚠️ "COULD NOT RUN THE CHECK" IS NOT "THE CHECK PASSED" — 069-ORDERPROOF.
+ *
+ * Both failures here used to be waved through by the caller, which settled the send `ok` having
+ * verified nothing: the absent-versus-verified collapse this unit exists to remove, reproduced at
+ * the one point where nothing was left to verify with. These are our OWN just-signed bytes, so a
+ * hostile relay cannot steer into either — unreachable in practice, which is a different claim from
+ * safe to wave through, and the distinction is the one that decays under later edits.
+ *
+ * `"none"` is the honest third answer: no submit was made, so no attestation is owed and none is
+ * missing. It is the only one of the three that does not reject.
+ */
+export function readSubmittedLeaf(structure1Cbor, seq) {
+    if (seq < 0)
+        return { kind: "none" };
+    if (!structure1Cbor)
+        return { kind: "unreadable", event: "relay.receipt.leaf_absent" };
+    // Structure 1 = [version, content_hash(32), sender_pubkey(32), session_id(16), last_seen_seq, ts],
+    // plus last_seen_hash(32) at index 6 on a v2 claim (020-ACKHASH). content_hash is index 1 and
+    // session_id index 3 in both.
+    const s1 = decodeStructure1(structure1Cbor);
+    // The reason is carried because "we cannot read what we just wrote" and "we wrote a layout we
+    // cannot name" are different faults with the same symptom.
+    if (!s1.ok)
+        return { kind: "unreadable", event: "relay.receipt.undecodable_leaf", reason: s1.reason };
+    return { kind: "ok", contentHash: s1.fields.contentHash, sessionId: s1.fields.sessionId };
+}
+/**
+ * Evaluate a relay ordering attestation: decide whether it yields a storable, signature-verified
+ * receipt. This is the verify-gates-store decision in isolation, so it is unit-testable without the
+ * relay stream.
+ *
+ * `expectedRelayPubkeyHex` is the anchor and it is REQUIRED in substance: `undefined` refuses. It
+ * must come from `relay_id` on an assignment whose FROST signature has been verified.
  */
 export function evaluateRelayAck(params) {
-    const { contentHash, sessionIdHex, agentPubkeyHex, relayId, relaySignature, timestamp, sequenceNumber } = params;
-    if (!relayId || !relaySignature || timestamp === undefined)
-        return { kind: "unsigned" };
-    if (!/^[0-9a-fA-F]{64}$/.test(relayId))
-        return { kind: "bad_relay_id" };
-    const relayPubkey = new Uint8Array(Buffer.from(relayId, "hex"));
-    if (!verifyRelayAck(contentHash, sequenceNumber, timestamp, relaySignature, relayPubkey)) {
-        return { kind: "invalid_signature" };
+    const { sessionId, contentHash, runningRoot, sessionIdHex, agentPubkeyHex, expectedRelayPubkeyHex, relayId, relaySignature, timestamp, sequenceNumber, } = params;
+    if (!expectedRelayPubkeyHex || !/^[0-9a-fA-F]{64}$/.test(expectedRelayPubkeyHex)) {
+        return { kind: "refused", cause: "no_anchor" };
+    }
+    /**
+     * THE FRAME'S OWN CLAIM IS COMPARED, NEVER TRUSTED. The signature below is verified against the
+     * directory's key regardless, so this comparison adds no security on its own — what it adds is a
+     * NAMED cause. A relay that has been replaced mid-session produces a valid signature under a key
+     * the directory never named, and "this is not the relay you were assigned" is the sentence an
+     * operator can act on. `undefined` is not a mismatch: a relay omitting the field does not get to
+     * skip the check, it simply gets checked against the anchor with no label.
+     */
+    if (relayId !== undefined) {
+        if (!/^[0-9a-fA-F]{64}$/.test(relayId))
+            return { kind: "refused", cause: "bad_relay_id" };
+        if (relayId.toLowerCase() !== expectedRelayPubkeyHex.toLowerCase()) {
+            return { kind: "refused", cause: "relay_not_assigned" };
+        }
+    }
+    if (!relaySignature || timestamp === undefined || !runningRoot) {
+        return { kind: "refused", cause: "attestation_absent" };
+    }
+    const relayPubkey = new Uint8Array(Buffer.from(expectedRelayPubkeyHex, "hex"));
+    if (!verifyRelayAck(sessionId, contentHash, sequenceNumber, runningRoot, timestamp, relaySignature, relayPubkey)) {
+        return { kind: "refused", cause: "signature_invalid" };
     }
     return {
         kind: "store",
@@ -52,11 +125,12 @@ export function evaluateRelayAck(params) {
             hashHex: Buffer.from(contentHash).toString("hex"),
             agentPubkeyHex,
             sessionIdHex,
-            relayId,
-            relayPubkeyHex: relayId,
+            relayId: expectedRelayPubkeyHex,
+            relayPubkeyHex: expectedRelayPubkeyHex,
             sequenceNumber,
             timestamp,
             signatureHex: Buffer.from(relaySignature).toString("hex"),
+            runningRootHex: Buffer.from(runningRoot).toString("hex"),
         },
     };
 }
@@ -71,6 +145,9 @@ const CREATE_RELAY_RECEIPTS_SQL = `
     relay_timestamp  INTEGER NOT NULL,
     signature_hex    TEXT    NOT NULL,
     stored_at        INTEGER NOT NULL,
+    -- 069-ORDERPROOF: the running root the relay signed alongside the position (nullable — rows
+    -- written before this order have none, and they stay readable and sealable exactly as they are).
+    running_root_hex TEXT,
     -- FED-OPTIONB-SEAL-001: per-leaf carry bytes for the unilateral-seal offline rebuild (nullable).
     structure2_cbor  BLOB,
     structure1_cbor  BLOB,
@@ -100,6 +177,10 @@ export class RelayReceiptStore {
             ["structure2_cbor", "BLOB"],
             ["structure1_cbor", "BLOB"],
             ["leaf_kind", "INTEGER"],
+            // 069-ORDERPROOF. NULLABLE, like the three above: a session that predates this order keeps
+            // every receipt it already holds, opens, reads and seals unchanged, and simply has no root
+            // recorded for those positions.
+            ["running_root_hex", "TEXT"],
         ]) {
             if (!cols.has(name)) {
                 this.#db.exec(`ALTER TABLE relay_ack_receipts ADD COLUMN ${name} ${decl}`);
@@ -116,11 +197,11 @@ export class RelayReceiptStore {
         const existing = this.get(receipt.agentPubkeyHex, receipt.sessionIdHex, receipt.sequenceNumber);
         const info = this.#db
             .prepare(`INSERT OR IGNORE INTO relay_ack_receipts
-           (agent_pubkey, session_id, sequence_number, hash_hex, relay_id, relay_pubkey_hex, relay_timestamp, signature_hex, stored_at, structure2_cbor, structure1_cbor, leaf_kind)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+           (agent_pubkey, session_id, sequence_number, hash_hex, relay_id, relay_pubkey_hex, relay_timestamp, signature_hex, stored_at, structure2_cbor, structure1_cbor, leaf_kind, running_root_hex)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
             .run(receipt.agentPubkeyHex, receipt.sessionIdHex, receipt.sequenceNumber, receipt.hashHex, receipt.relayId, receipt.relayPubkeyHex, receipt.timestamp, receipt.signatureHex, storedAtMs, 
         // FED-OPTIONB-SEAL-001: carry bytes (null when absent — receipt-only rows).
-        receipt.structure2Cbor ? Buffer.from(receipt.structure2Cbor) : null, receipt.structure1Cbor ? Buffer.from(receipt.structure1Cbor) : null, receipt.leafKind ?? null);
+        receipt.structure2Cbor ? Buffer.from(receipt.structure2Cbor) : null, receipt.structure1Cbor ? Buffer.from(receipt.structure1Cbor) : null, receipt.leafKind ?? null, receipt.runningRootHex ?? null);
         const wrote = Number(info.changes) > 0;
         if (!wrote && existing && existing.hashHex !== receipt.hashHex) {
             // EQUIVOCATION: a relay re-attesting a DIFFERENT hash at an already-recorded position. The first
@@ -138,7 +219,7 @@ export class RelayReceiptStore {
     /** The stored receipt at an attestation position (agent, session, sequence), or undefined. */
     get(agentPubkeyHex, sessionIdHex, sequenceNumber) {
         const row = this.#db
-            .prepare(`SELECT agent_pubkey, session_id, sequence_number, hash_hex, relay_id, relay_pubkey_hex, relay_timestamp, signature_hex
+            .prepare(`SELECT agent_pubkey, session_id, sequence_number, hash_hex, relay_id, relay_pubkey_hex, relay_timestamp, signature_hex, running_root_hex
            FROM relay_ack_receipts WHERE agent_pubkey = ? AND session_id = ? AND sequence_number = ?`)
             .get(agentPubkeyHex, sessionIdHex, sequenceNumber);
         return row ? this.#rowToReceipt(row) : undefined;
@@ -147,11 +228,11 @@ export class RelayReceiptStore {
     getAll(agentPubkeyHex, sessionIdHex) {
         const rows = sessionIdHex
             ? this.#db
-                .prepare(`SELECT agent_pubkey, session_id, sequence_number, hash_hex, relay_id, relay_pubkey_hex, relay_timestamp, signature_hex
+                .prepare(`SELECT agent_pubkey, session_id, sequence_number, hash_hex, relay_id, relay_pubkey_hex, relay_timestamp, signature_hex, running_root_hex
                FROM relay_ack_receipts WHERE agent_pubkey = ? AND session_id = ? ORDER BY sequence_number ASC`)
                 .all(agentPubkeyHex, sessionIdHex)
             : this.#db
-                .prepare(`SELECT agent_pubkey, session_id, sequence_number, hash_hex, relay_id, relay_pubkey_hex, relay_timestamp, signature_hex
+                .prepare(`SELECT agent_pubkey, session_id, sequence_number, hash_hex, relay_id, relay_pubkey_hex, relay_timestamp, signature_hex, running_root_hex
                FROM relay_ack_receipts WHERE agent_pubkey = ? ORDER BY session_id, sequence_number ASC`)
                 .all(agentPubkeyHex);
         return rows.map((r) => this.#rowToReceipt(r));
@@ -164,7 +245,7 @@ export class RelayReceiptStore {
      */
     getSealLeaves(agentPubkeyHex, sessionIdHex) {
         const rows = this.#db
-            .prepare(`SELECT agent_pubkey, session_id, sequence_number, hash_hex, relay_id, relay_pubkey_hex, relay_timestamp, signature_hex, structure2_cbor, structure1_cbor, leaf_kind
+            .prepare(`SELECT agent_pubkey, session_id, sequence_number, hash_hex, relay_id, relay_pubkey_hex, relay_timestamp, signature_hex, running_root_hex, structure2_cbor, structure1_cbor, leaf_kind
            FROM relay_ack_receipts
           WHERE agent_pubkey = ? AND session_id = ? AND structure2_cbor IS NOT NULL AND structure1_cbor IS NOT NULL AND leaf_kind IS NOT NULL
           ORDER BY sequence_number ASC`)
@@ -186,6 +267,7 @@ export class RelayReceiptStore {
             sequenceNumber: row.sequence_number,
             timestamp: row.relay_timestamp,
             signatureHex: row.signature_hex,
+            ...(typeof row.running_root_hex === "string" ? { runningRootHex: row.running_root_hex } : {}),
         };
     }
 }

package/dist/relay-receipt-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"relay-receipt-store.js","sourceRoot":"","sources":["../src/relay-receipt-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AA8ClE;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,WAAuB,EACvB,cAAsB,EACtB,SAAiB,EACjB,SAAqB,EACrB,WAAuB;IAEvB,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,GAAG,GAAG,gBAAgB,CAAC,WAAW,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;IACrE,OAAO,MAAM,CAAC,WAAW,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;AAC7C,CAAC;AAYD;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAQhC;IACC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,MAAM,CAAC;IACjH,IAAI,CAAC,OAAO,IAAI,CAAC,cAAc,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IACxF,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IACxE,MAAM,WAAW,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IAChE,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,cAAc,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,CAAC,EAAE,CAAC;QACzF,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC;IACvC,CAAC;IACD,OAAO;QACL,IAAI,EAAE,OAAO;QACb,OAAO,EAAE;YACP,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;YACjD,cAAc;YACd,YAAY;YACZ,OAAO;YACP,cAAc,EAAE,OAAO;YACvB,cAAc;YACd,SAAS;YACT,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;SAC1D;KACF,CAAC;AACJ,CAAC;AAED,MAAM,yBAAyB,GAAG;;;;;;;;;;;;;;;;;CAiBjC,CAAC;AAEF,MAAM,OAAO,iBAAiB;IACnB,GAAG,CAAiB;IACpB,OAAO,CAAS;IAEzB,YAAY,EAAkB,EAAE,MAAc;QAC5C,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC;QACd,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACzC,IAAI,CAAC,wBAAwB,EAAE,CAAC;IAClC,CAAC;IAED;;;;;;OAMG;IACH,wBAAwB;QACtB,MAAM,IAAI,GAAG,IAAI,GAAG,CACjB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,uCAAuC,CAAC,CAAC,GAAG,EAA8B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAChH,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI;YACzB,CAAC,iBAAiB,EAAE,MAAM,CAAC;YAC3B,CAAC,iBAAiB,EAAE,MAAM,CAAC;YAC3B,CAAC,WAAW,EAAE,SAAS,CAAC;SAChB,EAAE,CAAC;YACX,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,6CAA6C,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAqB,EAAE,UAAkB;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;QAChG,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG;aAClB,OAAO,CACN;;qDAE6C,CAC9C;aACA,GAAG,CACF,OAAO,CAAC,cAAc,EACtB,OAAO,CAAC,YAAY,EACpB,OAAO,CAAC,cAAc,EACtB,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,cAAc,EACtB,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,YAAY,EACpB,UAAU;QACV,4EAA4E;QAC5E,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,EACnE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,EACnE,OAAO,CAAC,QAAQ,IAAI,IAAI,CACzB,CAAC;QACJ,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,IAAI,QAAQ,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC;YAC/D,iGAAiG;YACjG,6FAA6F;YAC7F,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,4BAA4B,EAAE;gBAC9C,UAAU,EAAE,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;gBAC/C,YAAY,EAAE,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;gBAC/C,GAAG,EAAE,OAAO,CAAC,cAAc;gBAC3B,iBAAiB,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;gBAChD,oBAAoB,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;aACnD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,8FAA8F;IAC9F,GAAG,CAAC,cAAsB,EAAE,YAAoB,EAAE,cAAsB;QACtE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG;aACjB,OAAO,CACN;qGAC6F,CAC9F;aACA,GAAG,CAAC,cAAc,EAAE,YAAY,EAAE,cAAc,CAAwC,CAAC;QAC5F,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnD,CAAC;IAED,wGAAwG;IACxG,MAAM,CAAC,cAAsB,EAAE,YAAqB;QAClD,MAAM,IAAI,GAAG,YAAY;YACvB,CAAC,CAAC,IAAI,CAAC,GAAG;iBACL,OAAO,CACN;8GACkG,CACnG;iBACA,GAAG,CAAC,cAAc,EAAE,YAAY,CAAC;YACtC,CAAC,CAAC,IAAI,CAAC,GAAG;iBACL,OAAO,CACN;uGAC2F,CAC5F;iBACA,GAAG,CAAC,cAAc,CAAC,CAAC;QAC3B,OAAQ,IAAuC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IACpF,CAAC;IAED;;;;;OAKG;IACH,aAAa,CAAC,cAAsB,EAAE,YAAoB;QACxD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG;aAClB,OAAO,CACN;;;uCAG+B,CAChC;aACA,GAAG,CAAC,cAAc,EAAE,YAAY,CAAmC,CAAC;QACvE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtB,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;YACxB,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC;YACvC,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC;YACvC,QAAQ,EAAE,CAAC,CAAC,SAAmB;SAChC,CAAC,CAAC,CAAC;IACN,CAAC;IAED,aAAa,CAAC,GAA4B;QACxC,OAAO;YACL,OAAO,EAAE,GAAG,CAAC,QAAkB;YAC/B,cAAc,EAAE,GAAG,CAAC,YAAsB;YAC1C,YAAY,EAAE,GAAG,CAAC,UAAoB;YACtC,OAAO,EAAE,GAAG,CAAC,QAAkB;YAC/B,cAAc,EAAE,GAAG,CAAC,gBAA0B;YAC9C,cAAc,EAAE,GAAG,CAAC,eAAyB;YAC7C,SAAS,EAAE,GAAG,CAAC,eAAyB;YACxC,YAAY,EAAE,GAAG,CAAC,aAAuB;SAC1C,CAAC;IACJ,CAAC;CACF;AAED,sFAAsF;AACtF,SAAS,IAAI,CAAC,CAAU;IACtB,IAAI,CAAC,YAAY,UAAU;QAAE,OAAO,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,UAAU,CAAC,CAAW,CAAC,CAAC;IAC3D,IAAI,CAAC,YAAY,WAAW;QAAE,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IACvD,OAAO,IAAI,UAAU,EAAE,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"relay-receipt-store.js","sourceRoot":"","sources":["../src/relay-receipt-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAsDlE;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAC5B,SAAqB,EACrB,WAAuB,EACvB,cAAsB,EACtB,WAAuB,EACvB,SAAiB,EACjB,SAAqB,EACrB,WAAuB;IAEvB,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,IAAI,WAAW,CAAC,MAAM,KAAK,EAAE,IAAI,WAAW,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACpG,MAAM,GAAG,GAAG,gBAAgB,CAAC,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;IAC7F,OAAO,MAAM,CAAC,WAAW,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;AAC7C,CAAC;AAyBD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,iBAAiB,CAC/B,cAAsC,EACtC,GAAW;IAEX,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACrC,IAAI,CAAC,cAAc;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;IACvF,mGAAmG;IACnG,8FAA8F;IAC9F,8BAA8B;IAC9B,MAAM,EAAE,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAC;IAC5C,8FAA8F;IAC9F,2DAA2D;IAC3D,IAAI,CAAC,EAAE,CAAC,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,gCAAgC,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC;IACtG,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;AAC5F,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAYhC;IACC,MAAM,EACJ,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EACjE,sBAAsB,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,cAAc,GAC3E,GAAG,MAAM,CAAC;IAEX,IAAI,CAAC,sBAAsB,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,sBAAsB,CAAC,EAAE,CAAC;QACjF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IACjD,CAAC;IACD;;;;;;;OAOG;IACH,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;QAC1F,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,sBAAsB,CAAC,WAAW,EAAE,EAAE,CAAC;YACnE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,IAAI,CAAC,cAAc,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,WAAW,EAAE,CAAC;QAC/D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IAC1D,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC,CAAC;IAC/E,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,CAAC,EAAE,CAAC;QACjH,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;IACzD,CAAC;IAED,OAAO;QACL,IAAI,EAAE,OAAO;QACb,OAAO,EAAE;YACP,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;YACjD,cAAc;YACd,YAAY;YACZ,OAAO,EAAE,sBAAsB;YAC/B,cAAc,EAAE,sBAAsB;YACtC,cAAc;YACd,SAAS;YACT,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;YACzD,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;SACzD;KACF,CAAC;AACJ,CAAC;AAED,MAAM,yBAAyB,GAAG;;;;;;;;;;;;;;;;;;;;CAoBjC,CAAC;AAEF,MAAM,OAAO,iBAAiB;IACnB,GAAG,CAAiB;IACpB,OAAO,CAAS;IAEzB,YAAY,EAAkB,EAAE,MAAc;QAC5C,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC;QACd,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACzC,IAAI,CAAC,wBAAwB,EAAE,CAAC;IAClC,CAAC;IAED;;;;;;OAMG;IACH,wBAAwB;QACtB,MAAM,IAAI,GAAG,IAAI,GAAG,CACjB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,uCAAuC,CAAC,CAAC,GAAG,EAA8B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAChH,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI;YACzB,CAAC,iBAAiB,EAAE,MAAM,CAAC;YAC3B,CAAC,iBAAiB,EAAE,MAAM,CAAC;YAC3B,CAAC,WAAW,EAAE,SAAS,CAAC;YACxB,2FAA2F;YAC3F,2FAA2F;YAC3F,gCAAgC;YAChC,CAAC,kBAAkB,EAAE,MAAM,CAAC;SACpB,EAAE,CAAC;YACX,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,6CAA6C,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAqB,EAAE,UAAkB;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;QAChG,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG;aAClB,OAAO,CACN;;wDAEgD,CACjD;aACA,GAAG,CACF,OAAO,CAAC,cAAc,EACtB,OAAO,CAAC,YAAY,EACpB,OAAO,CAAC,cAAc,EACtB,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,cAAc,EACtB,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,YAAY,EACpB,UAAU;QACV,4EAA4E;QAC5E,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,EACnE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,EACnE,OAAO,CAAC,QAAQ,IAAI,IAAI,EACxB,OAAO,CAAC,cAAc,IAAI,IAAI,CAC/B,CAAC;QACJ,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,IAAI,QAAQ,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC;YAC/D,iGAAiG;YACjG,6FAA6F;YAC7F,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,4BAA4B,EAAE;gBAC9C,UAAU,EAAE,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;gBAC/C,YAAY,EAAE,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;gBAC/C,GAAG,EAAE,OAAO,CAAC,cAAc;gBAC3B,iBAAiB,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;gBAChD,oBAAoB,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;aACnD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,8FAA8F;IAC9F,GAAG,CAAC,cAAsB,EAAE,YAAoB,EAAE,cAAsB;QACtE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG;aACjB,OAAO,CACN;qGAC6F,CAC9F;aACA,GAAG,CAAC,cAAc,EAAE,YAAY,EAAE,cAAc,CAAwC,CAAC;QAC5F,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnD,CAAC;IAED,wGAAwG;IACxG,MAAM,CAAC,cAAsB,EAAE,YAAqB;QAClD,MAAM,IAAI,GAAG,YAAY;YACvB,CAAC,CAAC,IAAI,CAAC,GAAG;iBACL,OAAO,CACN;8GACkG,CACnG;iBACA,GAAG,CAAC,cAAc,EAAE,YAAY,CAAC;YACtC,CAAC,CAAC,IAAI,CAAC,GAAG;iBACL,OAAO,CACN;uGAC2F,CAC5F;iBACA,GAAG,CAAC,cAAc,CAAC,CAAC;QAC3B,OAAQ,IAAuC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IACpF,CAAC;IAED;;;;;OAKG;IACH,aAAa,CAAC,cAAsB,EAAE,YAAoB;QACxD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG;aAClB,OAAO,CACN;;;uCAG+B,CAChC;aACA,GAAG,CAAC,cAAc,EAAE,YAAY,CAAmC,CAAC;QACvE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtB,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;YACxB,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC;YACvC,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC;YACvC,QAAQ,EAAE,CAAC,CAAC,SAAmB;SAChC,CAAC,CAAC,CAAC;IACN,CAAC;IAED,aAAa,CAAC,GAA4B;QACxC,OAAO;YACL,OAAO,EAAE,GAAG,CAAC,QAAkB;YAC/B,cAAc,EAAE,GAAG,CAAC,YAAsB;YAC1C,YAAY,EAAE,GAAG,CAAC,UAAoB;YACtC,OAAO,EAAE,GAAG,CAAC,QAAkB;YAC/B,cAAc,EAAE,GAAG,CAAC,gBAA0B;YAC9C,cAAc,EAAE,GAAG,CAAC,eAAyB;YAC7C,SAAS,EAAE,GAAG,CAAC,eAAyB;YACxC,YAAY,EAAE,GAAG,CAAC,aAAuB;YACzC,GAAG,CAAC,OAAO,GAAG,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9F,CAAC;IACJ,CAAC;CACF;AAED,sFAAsF;AACtF,SAAS,IAAI,CAAC,CAAU;IACtB,IAAI,CAAC,YAAY,UAAU;QAAE,OAAO,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,UAAU,CAAC,CAAW,CAAC,CAAC;IAC3D,IAAI,CAAC,YAAY,WAAW;QAAE,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IACvD,OAAO,IAAI,UAAU,EAAE,CAAC;AAC1B,CAAC"}

package/dist/seal-carried-close.d.ts

@@ -0,0 +1,37 @@
+import { type SealCarryLeaf } from "./session-seal-leaf-store.js";
+import type { SessionSealContext } from "./session-seal.js";
+import type { DaemonDatabase } from "./sqlcipher-db.js";
+/** What the carried close needs from the seal path, and nothing more. */
+export interface CarriedCloseDeps {
+    readonly ctx: SessionSealContext;
+    readonly db: DaemonDatabase | null;
+    readonly getSealCarry: (agentPubkeyHex: string, sessionIdHex: string) => SealCarryLeaf[];
+}
+/**
+ * ═══ 070-CARRIEDSEAL — THE CLOSE THAT DOES NOT NEED ANYONE ELSE TO BE AWAKE ═══
+ *
+ * Returns the escalation values for a seal closed over evidence this side already holds, or
+ * `null` when this is not that situation and the caller should fail exactly as it did before.
+ *
+ * ⚠️ `null` IS THE DEFAULT, AND THAT IS THE SAFETY PROPERTY. Every way out of here that is not a
+ * successfully written terminus returns `null`, so the caller's original refusal stands with its
+ * original reason. A bug in this method costs the receipt this order was written to save; it
+ * cannot turn a relay's ruling into a seal.
+ *
+ * The first gate is the important one: `RELAY_GAVE_NO_ANSWER` separates a relay that was not there
+ * from one that considered the leaf and declined it. Routing around a ruling is the thing a trust
+ * layer must never do, and "the submit failed" alone does not tell the two apart.
+ */
+export declare function closeOverCarriedEvidence(deps: CarriedCloseDeps, agentName: string, sessionId: string, cause: string, correlationId?: string, 
+/**
+ * The relay's standing verdict about THIS AGENT, when there is a relay client to ask. The reason
+ * string cannot carry it — see `relayRefusedUs` — so it is passed alongside.
+ */
+standingRefusal?: {
+    reason: string;
+} | null): Promise<{
+    ok: true;
+    sequenceNumber: number;
+    reportedRootHex: string;
+} | null>;
+//# sourceMappingURL=seal-carried-close.d.ts.map

package/dist/seal-carried-close.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seal-carried-close.d.ts","sourceRoot":"","sources":["../src/seal-carried-close.ts"],"names":[],"mappings":"AAUA,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,8BAA8B,CAAC;AACxF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD,yEAAyE;AACzE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAC;IACjC,QAAQ,CAAC,EAAE,EAAE,cAAc,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,aAAa,EAAE,CAAC;CAC1F;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,gBAAgB,EACtB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,aAAa,CAAC,EAAE,MAAM;AACtB;;;GAGG;AACH,eAAe,CAAC,EAAE;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,GAC1C,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAuJ/E"}

package/dist/seal-carried-close.js

@@ -0,0 +1,179 @@
+/**
+ * `DOD-M15-CARRIEDSEAL-1` — THE CLOSE THAT DOES NOT NEED ANYONE ELSE TO BE AWAKE.
+ *
+ * Extracted from `session-seal.ts` rather than written beside it, for the reason that file's own
+ * ratchet exists: a seal path that keeps growing in one place is how the second implementation of a
+ * seal gets written next to the first. There is exactly one caller.
+ */
+import { decodeStructure1 } from "@cello-protocol/protocol-types";
+import { buildLocalSealTerminus } from "./seal-local-terminus.js";
+import { RELAY_GAVE_NO_ANSWER, relayRefusedUs } from "./seal-relay-silence.js";
+import { SessionSealLeafStore } from "./session-seal-leaf-store.js";
+/**
+ * ═══ 070-CARRIEDSEAL — THE CLOSE THAT DOES NOT NEED ANYONE ELSE TO BE AWAKE ═══
+ *
+ * Returns the escalation values for a seal closed over evidence this side already holds, or
+ * `null` when this is not that situation and the caller should fail exactly as it did before.
+ *
+ * ⚠️ `null` IS THE DEFAULT, AND THAT IS THE SAFETY PROPERTY. Every way out of here that is not a
+ * successfully written terminus returns `null`, so the caller's original refusal stands with its
+ * original reason. A bug in this method costs the receipt this order was written to save; it
+ * cannot turn a relay's ruling into a seal.
+ *
+ * The first gate is the important one: `RELAY_GAVE_NO_ANSWER` separates a relay that was not there
+ * from one that considered the leaf and declined it. Routing around a ruling is the thing a trust
+ * layer must never do, and "the submit failed" alone does not tell the two apart.
+ */
+export async function closeOverCarriedEvidence(deps, agentName, sessionId, cause, correlationId, 
+/**
+ * The relay's standing verdict about THIS AGENT, when there is a relay client to ask. The reason
+ * string cannot carry it — see `relayRefusedUs` — so it is passed alongside.
+ */
+standingRefusal) {
+    if (!RELAY_GAVE_NO_ANSWER.has(cause))
+        return null;
+    if (relayRefusedUs(standingRefusal)) {
+        /**
+         * THE RELAY ANSWERED, AND THE ANSWER WAS NO. Sealing over carried evidence here would be
+         * routing around a ruling — the relay authenticated this agent and then refused it, and that
+         * refusal is a decision about us rather than an absence of anyone to ask.
+         */
+        deps.ctx.logger.warn("session.seal.local_terminus.relay_refused", {
+            agentName, sessionId, cause, relayReason: standingRefusal?.reason, correlationId,
+            impact: "the relay REFUSED this agent rather than being unreachable, so this side did not sign its own closing leaf. No receipt was produced and the session is untouched — closing around a refusal would put a record on the chain that the witness declined to witness.",
+            guidance: "Fix what the relay refused (cello status names it — an expired credential, a rate limit, or a capacity cap), then close again. If the relay is genuinely gone rather than refusing, the close will proceed on its own.",
+        });
+        return null;
+    }
+    const kp = deps.ctx.getKeyProvider(agentName);
+    if (!kp) {
+        // Not a silent skip: without this agent's key nothing here can be signed, and the operator's
+        // action ("start the agent") is different from every other reason a close fails.
+        deps.ctx.logger.warn("session.seal.local_terminus.key_unavailable", {
+            agentName, sessionId, cause, correlationId,
+            impact: "the relay could not be reached and this agent's key is not loaded, so the closing leaf could not be signed here either. No receipt was produced and nothing about the session changed.",
+            guidance: "Start the agent (cello_start_agent) and close again.",
+        });
+        return null;
+    }
+    const ownPubkey = new Uint8Array(await kp.getPublicKey());
+    const ownPubkeyHex = Buffer.from(ownPubkey).toString("hex");
+    const carry = deps.getSealCarry(ownPubkeyHex, sessionId);
+    /**
+     * The session id comes out of the LEAVES, not out of the caller's argument. The directory checks
+     * the terminus against the same session the carried leaves name, so reading it from anywhere
+     * else would let the two disagree — and this path exists precisely for the case where no live
+     * relay registration is around to be consulted.
+     */
+    const first = carry[0] ? decodeStructure1(carry[0].structure1Cbor) : null;
+    if (!first?.ok) {
+        /**
+         * TWO DIFFERENT FACTS, AND THEY SEND THE OPERATOR TO DIFFERENT PLACES. An empty carry means the
+         * conversation was never witnessed; an undecodable first leaf means the record IS here and is
+         * damaged. Reporting the second as the first sends someone looking for something that is not
+         * missing.
+         */
+        const empty = carry.length === 0;
+        deps.ctx.logger.info("session.seal.local_terminus.no_carry", {
+            agentName, sessionId, cause, carryLength: carry.length,
+            reason: empty ? "seal_carry_empty" : "seal_carry_unreadable", correlationId,
+            impact: empty
+                ? "no witnessed leaf is held for this session, so there is no record to close over and no receipt to produce."
+                : "this session's first recorded leaf is on disk and cannot be decoded, so the record cannot be chained onto. The conversation is NOT missing — cello_transcript still shows it — but no receipt can be produced from this side.",
+        });
+        return null;
+    }
+    /**
+     * ⚠️ NO GENESIS, NO TERMINUS — and this used to be `?? new Uint8Array(32)`.
+     *
+     * The genesis is the session's agreed starting point, and it is what BOTH chain links fall back to
+     * for a party that has not spoken yet. Substituting thirty-two zero bytes does not fail: the
+     * directory's walk skips `prev_own_hash` for a sender's first leaf and never checks
+     * `last_seen_hash` at all, so the leaf notarizes and the counterparty — verifying against the real
+     * starting point — is the one who finds a link that does not reconcile. A silent substitution
+     * whose cost lands on the other party.
+     *
+     * The send path already refuses for exactly this reason ("no seed means no send… the honest
+     * outcome is to refuse rather than sign a chain anchored to nothing"). So does this.
+     */
+    const genesis = deps.ctx.leafRecords.sessionGenesisPrevRoot(agentName, sessionId);
+    if (!genesis) {
+        deps.ctx.logger.warn("session.seal.local_terminus.no_genesis", {
+            agentName, sessionId, cause, correlationId,
+            impact: "this session has no recorded starting point on this machine, so a closing leaf written here could not link to anything and its place in the conversation could never be proven. Nothing was signed and the session is untouched.",
+            guidance: "Close WITH your counterparty instead — a bilateral close does not need this value. cello_transcript still shows the conversation either way.",
+        });
+        return null;
+    }
+    const built = await buildLocalSealTerminus({
+        carry,
+        ownPubkeyHex,
+        ownPubkey,
+        sessionIdBytes: first.fields.sessionId,
+        genesis,
+        finalRootHex: deps.ctx.getSessionTreeRootHex(agentName, sessionId),
+        closeTimestamp: Date.now(),
+        sign: async (bytes) => new Uint8Array(await kp.sign(bytes)),
+    });
+    if (!built.ok) {
+        /**
+         * ⚠️ AN ALREADY-PLACED TERMINUS IS A SUCCESS BEING REPORTED AS A FAILURE — review MEDIUM-3.
+         *
+         * `seal_carry_own_ctrl_present` means a previous close already wrote our closing leaf. Returning
+         * `null` sent the caller to its original refusal, so an operator who closed successfully and then
+         * closed again — or whose reconnect retried for them — was told the RELAY was unavailable, for a
+         * session whose closing leaf is on their own disk. The terminus builder's own docblock says the
+         * caller must reuse the one that is there; nobody did.
+         *
+         * Reused rather than rebuilt: the leaf on disk is the one whose bytes were signed, and rebuilding
+         * would produce a different timestamp and therefore a different record.
+         */
+        if (built.reason === "seal_carry_own_ctrl_present") {
+            const existing = carry.find((l) => l.leafKind === 0x02 && l.senderPubkeyHex === ownPubkeyHex);
+            const priorS1 = existing ? decodeStructure1(existing.structure1Cbor) : null;
+            if (existing && priorS1?.ok) {
+                const priorRootHex = deps.ctx.getSessionTree(agentName, sessionId)
+                    .rootWithAppendedHex(Buffer.from(priorS1.fields.contentHash).toString("hex"));
+                deps.ctx.logger.info("session.seal.local_terminus.reused", {
+                    agentName, sessionId, cause, sequenceNumber: existing.sequenceNumber, correlationId,
+                    impact: "this side had already signed its closing leaf for this session, so the earlier one is carried again rather than a second being written. A second closing leaf would make the session unsealable by any directory, permanently.",
+                });
+                return { ok: true, sequenceNumber: existing.sequenceNumber, reportedRootHex: priorRootHex };
+            }
+        }
+        deps.ctx.logger.warn("session.seal.local_terminus.refused", {
+            agentName, sessionId, cause, reason: built.reason, correlationId,
+            impact: "the relay could not be reached and the record this side holds cannot be closed over as it stands, so no receipt was produced.",
+        });
+        return null;
+    }
+    if (!deps.ctx.sealLeafStore && deps.db) {
+        deps.ctx.sealLeafStore = new SessionSealLeafStore(deps.db, deps.ctx.logger);
+    }
+    const wrote = deps.ctx.sealLeafStore?.store(ownPubkeyHex, sessionId, built.leaf, Date.now()) ?? false;
+    if (!wrote) {
+        /**
+         * The store is INSERT OR IGNORE on the position, so a false means something already occupies
+         * it. Refusing is the only safe answer: carrying a leaf that is not the one on disk would
+         * present a record this daemon does not actually hold.
+         */
+        deps.ctx.logger.warn("session.seal.local_terminus.position_taken", {
+            agentName, sessionId, sequenceNumber: built.leaf.sequenceNumber, correlationId,
+            impact: "a leaf is already recorded at the position the closing leaf would take, so it was not written and no receipt was produced.",
+        });
+        return null;
+    }
+    // The reported root is the certified-root domain — content hashes, this leaf appended. The same
+    // derivation the relay path uses one method down, so both close paths report the same value for
+    // the same leaf set.
+    const reportedRootHex = deps.ctx.getSessionTree(agentName, sessionId).rootWithAppendedHex(built.contentHashHex);
+    deps.ctx.logger.info("session.seal.local_terminus.placed", {
+        agentName, sessionId, cause,
+        sequenceNumber: built.leaf.sequenceNumber,
+        carryLength: carry.length,
+        correlationId,
+        impact: "the relay did not answer, so this side signed its own closing leaf over the record it already holds. The seal proceeds on carried evidence and needs no relay.",
+    });
+    return { ok: true, sequenceNumber: built.leaf.sequenceNumber, reportedRootHex };
+}
+//# sourceMappingURL=seal-carried-close.js.map

package/dist/seal-carried-close.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seal-carried-close.js","sourceRoot":"","sources":["../src/seal-carried-close.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,EAAE,oBAAoB,EAAsB,MAAM,8BAA8B,CAAC;AAWxF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAsB,EACtB,SAAiB,EACjB,SAAiB,EACjB,KAAa,EACb,aAAsB;AACtB;;;GAGG;AACH,eAA2C;IAE3C,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,cAAc,CAAC,eAAe,CAAC,EAAE,CAAC;QACpC;;;;WAIG;QACH,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,2CAA2C,EAAE;YAChE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,EAAE,aAAa;YAChF,MAAM,EAAE,mQAAmQ;YAC3Q,QAAQ,EAAE,wNAAwN;SACnO,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,6FAA6F;QAC7F,iFAAiF;QACjF,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,6CAA6C,EAAE;YAClE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa;YAC1C,MAAM,EAAE,wLAAwL;YAChM,QAAQ,EAAE,sDAAsD;SACjE,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAEzD;;;;;OAKG;IACH,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1E,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC;QACf;;;;;WAKG;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC;QACjC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE;YAC3D,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM;YACtD,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,uBAAuB,EAAE,aAAa;YAC3E,MAAM,EAAE,KAAK;gBACX,CAAC,CAAC,4GAA4G;gBAC9G,CAAC,CAAC,+NAA+N;SACpO,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,sBAAsB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAClF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE;YAC7D,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa;YAC1C,MAAM,EAAE,kOAAkO;YAC1O,QAAQ,EAAE,8IAA8I;SACzJ,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,sBAAsB,CAAC;QACzC,KAAK;QACL,YAAY;QACZ,SAAS;QACT,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;QACtC,OAAO;QACP,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAAC,SAAS,EAAE,SAAS,CAAC;QAClE,cAAc,EAAE,IAAI,CAAC,GAAG,EAAE;QAC1B,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;KAC5D,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd;;;;;;;;;;;WAWG;QACH,IAAI,KAAK,CAAC,MAAM,KAAK,6BAA6B,EAAE,CAAC;YACnD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,CAAC,eAAe,KAAK,YAAY,CAAC,CAAC;YAC9F,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC5E,IAAI,QAAQ,IAAI,OAAO,EAAE,EAAE,EAAE,CAAC;gBAC5B,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC;qBAC/D,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;gBAChF,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE;oBACzD,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE,aAAa;oBACnF,MAAM,EAAE,gOAAgO;iBACzO,CAAC,CAAC;gBACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE,eAAe,EAAE,YAAY,EAAE,CAAC;YAC9F,CAAC;QACH,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE;YAC1D,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,aAAa;YAChE,MAAM,EAAE,+HAA+H;SACxI,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;QACvC,IAAI,CAAC,GAAG,CAAC,aAAa,GAAG,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,CAAC,YAAY,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,KAAK,CAAC;IACtG,IAAI,CAAC,KAAK,EAAE,CAAC;QACX;;;;WAIG;QACH,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,4CAA4C,EAAE;YACjE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,aAAa;YAC9E,MAAM,EAAE,4HAA4H;SACrI,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gGAAgG;IAChG,gGAAgG;IAChG,qBAAqB;IACrB,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAChH,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE;QACzD,SAAS,EAAE,SAAS,EAAE,KAAK;QAC3B,cAAc,EAAE,KAAK,CAAC,IAAI,CAAC,cAAc;QACzC,WAAW,EAAE,KAAK,CAAC,MAAM;QACzB,aAAa;QACb,MAAM,EAAE,gKAAgK;KACzK,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,eAAe,EAAE,CAAC;AAClF,CAAC"}

package/dist/seal-certified-root-check.d.ts

@@ -0,0 +1,37 @@
+import type { SealCarryLeaf } from "./session-seal-leaf-store.js";
+/**
+ * REBUILD THE CERTIFIED ROOT FROM THIS DAEMON'S OWN LEAVES — `DOD-M15-SEALWIRE-1` bullet 2.
+ *
+ * The receipt used to prove only that the directory signed SOMETHING: the client took the sealed
+ * root off the wire, confirmed the directory's signature over those bytes, stored it, and threw
+ * away the root it had computed a step earlier. At co-signing time that means **your key signs a
+ * root you never checked.**
+ *
+ * Bullet 1 moved the certified root into the content-hash domain, which is the domain this daemon
+ * can actually rebuild — each carry leaf's `content_hash` is the leaf hash (RFC 6962 §2.1 "hash"
+ * leaves are used as-is), and the carry is ordered by the relay's canonical `sequence_number`,
+ * which is the order the directory rebuilds in.
+ *
+ * ─── Why this returns "cannot judge" instead of always answering ───────────────────────────
+ *
+ * A root comparison that is WRONG makes every session unsealable, and force-abandon — no receipt —
+ * becomes the only exit. That failure is worse than the one being guarded, and this file already
+ * carries two comments saying so about other gates.
+ *
+ * The carry is this daemon's view, and it is not guaranteed complete at the instant a certificate
+ * arrives: the counterparty's SEAL ctrl leaf is what TRIGGERS the seal, so it may not have been
+ * witnessed here yet. So completeness is checked FIRST, against the certificate's own leaf count.
+ * A short carry means this daemon cannot judge — which is a different answer from "the roots
+ * disagree", and conflating them would turn a local timing gap into an accusation.
+ */
+export declare function verifyCertifiedRoot(getSealCarry: (agentPubkeyHex: string, sessionIdHex: string) => SealCarryLeaf[], agentPubkeyHex: string, sessionIdHex: string, certifiedRoot: Uint8Array, certifiedLeafCount: number): {
+    verdict: "match";
+} | {
+    verdict: "mismatch";
+    ownRootHex: string | null;
+    detail: string;
+} | {
+    verdict: "cannot_judge";
+    reason: string;
+};
+//# sourceMappingURL=seal-certified-root-check.d.ts.map

package/dist/seal-certified-root-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seal-certified-root-check.d.ts","sourceRoot":"","sources":["../src/seal-certified-root-check.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAElE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,mBAAmB,CACjC,YAAY,EAAE,CAAC,cAAc,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,aAAa,EAAE,EAC/E,cAAc,EAAE,MAAM,EACtB,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,UAAU,EACzB,kBAAkB,EAAE,MAAM,GACzB;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,UAAU,CAAC;IAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CA6FzI"}