@cello-protocol/daemon 0.0.225 → 0.0.227

package/dist/session-content-handlers.js

@@ -1,1382 +0,0 @@
-/**
- * cello_send and cello_receive — the content path.
- *
- * The two biggest handlers in the daemon, and the two I had put on a DO-NOT-CUT list. That list was
- * written before anything had been measured, and it was wrong: these close over eleven things, not
- * the whole daemon. They are listed below, which is the point of the move.
- *
- * They stay TOGETHER because they are two halves of one state machine — the read cursor. cello_send
- * appends to the daemon-owned tree; cello_receive advances the per-connection cursor and the durable
- * watermark. Splitting them would put the cursor's writer and its reader in different modules.
- */
-// `wireContentHash` is no longer imported here: every outbound hash in this file now comes from
-// `SessionNodeManager.contentHashForSession`, which returns the hash and its ALGORITHM together
-// (`DOD-M15-SEALWIRE-1` part B2b). A direct call would be a hash computed without deciding — or
-// recording — how it was made, which is the state that made a version skew look like a tamper.
-import { randomUUID } from "node:crypto";
-import { LEAF_KIND_MSG } from "./session-relay-client.js";
-import { MAX_CONTENT_BYTES } from "@cello-protocol/protocol-types";
-import { TIER } from "./contacts-tier-migration.js";
-import { GATEWAY_UNAVAILABLE, GOVERNANCE_TIMEOUT } from "@cello-protocol/gateway";
-import { isAutoReplyMarked } from "./away-detection.js";
-import { REFUSAL_COUNT_GUIDANCE, REFUSAL_KIND_GUIDANCE } from "./refusal-reasons.js";
-import { extractErrorMessage } from "./error-message.js";
-import { SESSION_CLOSED_GUIDANCE, SESSION_CLOSED_REASON, SESSION_SEALING_IMPACT, closedSessionImpact, isClosedStatus } from "./session-closed.js";
-import { replyLag } from "./reply-lag.js";
-/** Whether the other side's latest replies were written before they saw this side's newest message. */
-function replyLagFor(snm, agentName, sessionId) {
-    // Runs AFTER the read position moved, so a throw here would lose the messages being handed over.
-    // The warning is optional; the messages are not.
-    try {
-        const db = snm.getDb();
-        const row = db.prepare("SELECT k_local_pubkey FROM agents WHERE agent_id = ?").get(snm.resolveAgentId(agentName));
-        return row ? replyLag(db, row.k_local_pubkey, sessionId) : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-/**
- * DOD-M12B-AWAY-MARK-1 — what a reader needs to know the moment it sees a marked message.
- *
- * Written for the failure it prevents, not the mechanism: an agent reads an away reply, concludes a
- * person answered, and tells its operator a conversation is under way. Two agents did exactly that
- * to each other for a morning on 2026-08-17. So it leads with "nobody read your message", and it
- * says what the reader should do instead of replying into an empty room.
- */
-/**
- * DOD-M15-REFUSED-INBOUND-SILENT-1 — spread the operator's unshown refusals into a reply, or
- * nothing at all.
- *
- * A spread rather than a field so the key is ABSENT when there is nothing to say. An always-present
- * `refusals: []` is a field readers learn to skip, and this is precisely the field that explains
- * why a conversation went quiet — it has to be unusual to be read.
- *
- * Draining is the point: the operator is told once per reason per session. The count travels with
- * it, so "this happened 90 times" is visible without announcing it 90 times.
- */
-/**
- * ⚠️ RETURNS THE ADVICE WITH THE NOTICE, and that pairing is the fix — not a convenience.
- *
- * The drain is DESTRUCTIVE: whoever reads first consumes the notice. When only the quiet exit
- * carried the "waiting will not help" sentence, a catch-up read (`--since-seq -1`, the stateless
- * door the refusals elsewhere point people at) drained the refusal into a payload with no advice at
- * all — and the operator's NEXT blocking read then said "call again and keep waiting", because the
- * notice was already gone. The catch-up door destroyed the one sentence that made it actionable and
- * replaced it with the advice this whole line exists to stop.
- *
- * Returning them together means no call site can take one without the other. A future exit that
- * spreads this gets the advice for free; that is the property, and it is why the guidance does not
- * live at the call sites any more.
- */
-function refusalsField(mgr, agentName, sessionId, 
-/**
- * WHO is being shown this. Without it the first window to read consumed the notice for every
- * other window attending the same agent — the defect the delivery loop below was rewritten to
- * remove, re-created on a different surface.
- */
-consumerId) {
-    const refusals = mgr.takeContentRefusals(agentName, sessionId, consumerId);
-    if (refusals.length === 0)
-        return {};
-    /**
-     * COMPOSED FROM THE KINDS PRESENT — review F4, and the same rule the inbox door follows.
-     *
-     * One fixed sentence said "received and REFUSED — not verified, neither ingested nor shown". True
-     * of the three hash-verification reasons it was written for; false of a screener block, which was
-     * verified, IS in the chain, and WAS acknowledged; false of a transcript write failure; and
-     * pointing at the wrong party entirely for `delivery_impaired`, which is this side's own send.
-     */
-    const kindsPresent = new Set(refusals.map((r) => r.kind));
-    const refusal_guidance = Object.keys(REFUSAL_KIND_GUIDANCE)
-        .filter((k) => kindsPresent.has(k))
-        // Prefixed with the kind (review N7) so two paragraphs that read as contradicting each other —
-        // "received and REFUSED" beside "NOTHING WAS REFUSED BY THIS AGENT" — can each be joined to the
-        // rows they are about.
-        .map((k) => `[kind: ${k}] ${REFUSAL_KIND_GUIDANCE[k]}`)
-        .join("\n\n");
-    return {
-        refusals: refusals.map((r) => ({
-            reason: r.reason, kind: r.kind, impact: r.impact, guidance: r.guidance,
-            times_since_dismissed: r.timesSinceDismissed,
-            ...(r.timesTotal === undefined ? {} : { times_total: r.timesTotal }),
-            ...(r.timesTotalAtLeast === undefined ? {} : { times_total_at_least: r.timesTotalAtLeast }),
-            // `041-PARKSTUCK`: the cadence beside the count, so a loop is not read as a crowd.
-            ...(r.recurrence === undefined ? {} : { recurrence: r.recurrence }),
-            ...(r.repeat === true ? { repeat: true } : {}),
-        })),
-        // DOD-M15-REFUSALTERMINAL-1 review F4: the counts need their sentence at BOTH doors. Without
-        // it this one hands an agent the small number with nothing saying it is not the lifetime one —
-        // which is the whole defect, moved rather than fixed.
-        refusal_guidance: `${refusal_guidance}\n\n${REFUSAL_COUNT_GUIDANCE}`,
-    };
-}
-const AUTO_REPLY_GUIDANCE = "At least one message here is an AUTOMATIC reply generated by the counterparty's daemon because " +
-    "nobody was attending that agent — no person and no agent read what you sent. Do not treat it as " +
-    "an answer, do not report a conversation is happening, and do not infer anything from its " +
-    "content. Your message is queued and will be read when their operator returns.\n\n" +
-    "THE MARK IS A ONE-WAY SIGNAL. `auto_reply: true` means machine-generated. Its ABSENCE means " +
-    "nothing — the mark is produced by the SENDER's daemon, so an older build, a third-party client, " +
-    "or anyone who simply omits it sends automatic replies with no mark at all. An unmarked message " +
-    "is NOT evidence a person wrote it. Never tell the operator a human replied because a message " +
-    "was unmarked.";
-/**
- * DOD-M15-SEALWIRE-1 bullet 5, SENT half — the proof for a message THIS agent sent.
- *
- * Present only when the relay WITNESSED the leaf: an unwitnessed send never put a Structure-1 on the
- * wire, so there is nothing signed to store, and the row must record `self_authored` with no proof
- * rather than imply one. `sendContent` returns it per-send rather than stashing it by session,
- * because a side map hands a caller the wrong send's signature the moment two are in flight.
- */
-/**
- * Did the RELAY witness this leaf — the single fact every `witnessed` in this file is read from.
- *
- * `016-RELAYLOSS` review HIGH-2. The first version of the fix put `witnessed` on two of `cello_send`'s
- * FIVE return paths, which defeats the reason it was added at all: a field that is present on some
- * outcomes and absent on others cannot be branched on, and its absence reads as an older daemon
- * rather than as an answer. Worse, the two it missed are the two that matter most — the diverged
- * path is reachable ONLY after an unwitnessed leaf, and the durably-queued path is the one
- * production takes when the relay is also the transport (behind NAT, content and witness die
- * together), where it was telling operators "No action needed."
- *
- * Read off the PLACEMENT, not re-derived from the sequence number, so this and the
- * `session.tree.own_leaf_unwitnessed` ERROR beside it can never disagree about the same send.
- *
- * ⚠️ A HELD leaf (`placed: false`) is WITNESSED, and that is not a special case being papered over.
- * A leaf is held precisely BECAUSE the relay assigned it a position beyond this side's tail — being
- * held is itself proof of an assignment. Reporting `witnessed: false` there would tell an operator
- * their record had lost a message when the opposite is true.
- */
-export function wasWitnessed(p) {
-    return p.placed ? p.unwitnessed !== true : true;
-}
-/**
- * The durably-queued path's guidance: the relay's OWN words, plus what a missing witness costs.
- *
- * **Exported so the test can call THIS rather than re-implement it.** The first version of the
- * composition test rebuilt the string inline and asserted on its own copy — which stays green if
- * production stops composing entirely, and is therefore the hollow shape this milestone keeps
- * finding. A rule worth pinning has to be pinned on the code that runs.
- *
- * The rule, and why it is a composition rather than a choice: `upstream` is where the relay's own
- * retry window reaches the operator ("try again in about 45 seconds"), and a rate-limited park is
- * unwitnessed BY CONSTRUCTION — so choosing between the two messages silently drops the more
- * specific one exactly when it is most useful. Both are true at once and the operator needs both.
- *
- * The default splits on `witnessed` for one reason only: "No action needed" is false for a leaf the
- * relay never recorded.
- */
-export function queuedSendGuidance(upstream, witnessed) {
-    const base = upstream
-        ?? (witnessed
-            ? "The message is queued and will be re-sent automatically when the relay link is back. No action needed."
-            : "The message is queued and will be re-sent automatically when the relay link is back.");
-    if (witnessed)
-        return base;
-    return base
-        + " The relay did NOT witness this leaf, so your record is now one leaf ahead of it. "
-        + "Ordering does not repair itself: the next message the relay does witness will report this "
-        + "session as diverged, and a diverged session can never be sealed with the counterparty. The "
-        + "re-send is automatic — do not send it again yourself. If the receipt matters, close rather "
-        + "than continuing.";
-}
-export function sentAuthorship(r) {
-    /**
-     * ⚠️ NOT `r.ok ? …` — that made two of the five call sites DEAD BY CONSTRUCTION.
-     *
-     * Both live inside `if (!sendResult.ok)`, so an `ok`-gated read is unconditionally `undefined`
-     * there: the durably-queued send — witnessed, signed, only the direct hand-off failed — wrote a
-     * row with no proof while the proof sat in the result. The union now carries `authorship` on the
-     * failure member too, so read it off whichever shape arrived.
-     */
-    return r.authorship;
-}
-export function registerSessionContentHandlers(deps) {
-    const { handlers, logger, sessionNodeManager, securityGateway, retryQueue, getConnState, resolveCurrentAgent, NO_CURRENT_AGENT_RESPONSE, getConnectionCursor, advanceConnectionCursor, clearTelegramRung, attendanceCount, sendClaims, } = deps;
-    /**
-     * DOD-COATTEND-SENDWINDOW-1 (review F1) — sessions with a send ON THE WIRE right now.
-     *
-     * The frontier comparison alone was not enough, and the reasoning that produced it had a hole:
-     * it is TRUE that a send cannot be refused after `sendContent` (the counterparty already holds
-     * the message, and refusing would strand the session with disagreeing frontiers — the
-     * DOD-FRONTIER-STRAND-1 shape). It does NOT follow that checking only before it is sufficient.
-     * `sendContent` IS the last await, and the wider one: it awaits the relay hash submit, the
-     * stream open and the stream close — a network round trip in production, against the gateway
-     * round trip the frontier check covers. Reproduced by review on a real daemon with two real IPC
-     * connections: two `ok: true`, two frames on the wire, two leaves.
-     *
-     * So the window is closed by a CLAIM rather than a later check. A sibling that finds the claim
-     * held is refused BEFORE its own wire call — nothing is on the wire, nothing is stranded, and the
-     * strand argument that ruled out a post-wire refusal never applies.
-     *
-     * Keyed (agent, session): the race is two connections replying into ONE conversation. Held in the
-     * factory closure, which runs once per daemon, so it is exactly as long-lived as the handler set.
-     */
-    /**
-     * DOD-COATTEND-VISIBLE-1 AC6 (review F2) — attendance as reported ON A RESPONSE.
-     *
-     * `attendanceCount` walks the connections that explicitly called `cello_use_agent`. A connection
-     * can reach these handlers WITHOUT having done so, through `resolveCurrentAgent`'s sole-online
-     * fallback — which is not exotic: it is every `cello` CLI invocation with no persisted selection,
-     * and any MCP client that skipped the call. Such a reader was not counted, INCLUDING ITSELF, and
-     * was handed `attendance: 0` — told that zero sessions attend the agent it is reading.
-     *
-     * That is worse than the missing field this AC set out to fix: not absent, but a definite
-     * negative that is false. The caller is holding the response, so at least one session is on this
-     * agent by construction. A response can never honestly say 0.
-     */
-    const attendingNow = (agentName) => Math.max(1, attendanceCount(agentName));
-    // ─── CELLO-M7-DAEMON-004: cello_send (live send + daemon-owned tree append) ──
-    handlers.set("cello_send", async (params, connectionId) => {
-        const connState = getConnState(connectionId);
-        // CC-3 / M8C-AUTOSTART-1 F18: explicit { agent } > current > sole online agent.
-        const agentName = resolveCurrentAgent(connState, params?.agent);
-        if (!agentName)
-            return NO_CURRENT_AGENT_RESPONSE;
-        // round-2 BLOCKING: read the snake_case public field cello-mcp.ts actually sends.
-        const sessionId = params?.session_id;
-        const contentStr = typeof params?.content === "string" ? params.content : undefined;
-        if (!sessionId || contentStr === undefined) {
-            return { ok: false, reason: "missing_params", guidance: "Provide 'session_id' (hex) and 'content' (string) parameters." };
-        }
-        // DOD-LOOP-1: the (agent, session_id) lookup is itself the ownership scope.
-        const record = sessionNodeManager.getSessionRecord(agentName, sessionId);
-        if (!record) {
-            return { ok: false, reason: "session_not_found", guidance: "No session found with this ID. Check cello_sessions for active sessions." };
-        }
-        if (record.agent_name !== agentName) {
-            return { ok: false, reason: "session_not_owned", guidance: "This session belongs to a different agent. Call cello_use_agent to switch to the agent that owns it, then retry." };
-        }
-        /**
-         * ─── A CLOSED CONVERSATION CANNOT BE ADDED TO — `DOD-M15-CLOSEDSESSION-1` ───────────────────
-         *
-         * BEFORE THE WIRE, BEFORE THE REVIVAL, BEFORE THE SCREENING. Nothing is placed, nothing reaches
-         * the relay, and nothing reports `delivered`.
-         *
-         * **Why it sits ahead of the revival rather than inside it.** `reviveIfNeededForSend` already
-         * refuses a sealed row — as `session_terminal`, a name about resurrection — but it is reached
-         * only through `record.status !== "active"`, and the case measured live had a row that still
-         * read `active`. Session `9d253bce…`: this side's own seal leaf was submitted and
-         * auto-acknowledged, the ceremony's status write had not happened yet, and the send sailed past
-         * every status check in the daemon. The relay had retired the session at the seal, so the hash
-         * submit failed `relay_session_gone`, the leaf was appended unwitnessed, and the operator was
-         * handed a paragraph about relay witnessing and ordering divergence — all true, none of it the
-         * point, and the counterparty refused the bytes as `ack_hash_unknown_content`.
-         *
-         * **Two facts, one refusal, and only local state is consulted.** The status row and this side's
-         * own seal commitment are both unambiguous and both ours. `relay_session_gone` is deliberately
-         * NOT one of them: `delivery-session-suspects.ts` refuses to make it terminal on evidence — the
-         * relay defaults to an in-memory store, so a restart tells every client the same string for
-         * sessions that are perfectly alive.
-         */
-        if (isClosedStatus(record.status)) {
-            logger.info("session.send.refused_closed", {
-                sessionId, agentName, status: record.status, trigger: "status",
-                impact: closedSessionImpact(record.status),
-            });
-            return { ok: false, reason: SESSION_CLOSED_REASON, impact: closedSessionImpact(record.status), guidance: SESSION_CLOSED_GUIDANCE };
-        }
-        if (sessionNodeManager.hasCommittedSealLeaf(agentName, sessionId)) {
-            logger.info("session.send.refused_closed", {
-                sessionId, agentName, status: record.status, trigger: "seal_committed",
-                impact: SESSION_SEALING_IMPACT,
-            });
-            return { ok: false, reason: SESSION_CLOSED_REASON, impact: SESSION_SEALING_IMPACT, guidance: SESSION_CLOSED_GUIDANCE };
-        }
-        if (record.status !== "active") {
-            /**
-             * DOD-M12B-SESSION-SEED-1 — THE DEMAND EDGE. Before this, an interrupted session refused here
-             * forever: a transport event could take a session out of `active` and no code path anywhere
-             * put one back, so a laptop close ended the conversation permanently even though both
-             * processes were alive and both peer ids still valid.
-             *
-             * The operator sending IS the demand, and it is the only trigger — nothing revives on a timer
-             * (the REDIAL-1 discipline, and Andre's tenet: a background rebuilder would hold a dialable
-             * endpoint open for a session nobody is using).
-             *
-             * A session that cannot be revived still refuses, and says WHY — `session_terminal` for one
-             * that has ended, `session_identity_lost` for one whose keypair died with a daemon restart.
-             * The second is the one an operator most needs named: it means waiting for a reconnect is
-             * pointless and the session should be closed for its receipt.
-             */
-            const revived = await sessionNodeManager.reviveIfNeededForSend(agentName, sessionId);
-            if (!revived.ok) {
-                return {
-                    ok: false,
-                    reason: revived.reason,
-                    guidance: revived.guidance
-                        ?? `Session is '${record.status}', not active. Content can only be sent on an active session.`,
-                };
-            }
-        }
-        // M8C-CURSOR-1: read-before-write gate. current_seq is the tree's highest leaf index
-        // (message_count is kept in sync with leafCount on every append, both directions — DAEMON-004
-        // finding #2), so it reflects EVERY message in the session regardless of which connection sent
-        // or received it. If this connection hasn't read up to current_seq (e.g. a second attended
-        // session on the same agent that hasn't polled since the other connection's last send), refuse
-        // rather than let it send blind — the WhatsApp-group-chat model. Runs BEFORE the
-        // governance-decisions parsing below: an access-control gate must short-circuit before any
-        // unrelated prep work for a send that may not be allowed to proceed at all.
-        //
-        // The gate consults TWO authorities and passes if EITHER says the caller is caught up:
-        //
-        //   1. the connection cursor (in-memory, per-connection) — satisfied by a long-lived client
-        //      like the MCP shim, which holds one socket for the whole session.
-        //
-        //   2. the persisted per-(agent, session) read watermark. A STATELESS client CANNOT satisfy
-        //      authority 1: the `cello` CLI runs a fresh process, and therefore a fresh connection, per
-        //      command, so it always presents cursor -1. Without the watermark, every CLI send is
-        //      refused forever once the counterparty has spoken — as is every send from a RECONNECTING
-        //      MCP client, whose new connectionId also resets the cursor to -1. Do not remove it.
-        //
-        // What the gate protects, precisely: an agent must never reply to COUNTERPARTY content nobody
-        // on its side has seen. That guarantee is durable — it survives the socket.
-        //
-        // What it deliberately does NOT protect: a message this agent SENT from a different local
-        // connection does not block. Two attended windows on one agent do not gate each other, because
-        // locally-authored content is not "unread counterparty content" — the AGENT wrote it. The
-        // principal is the agent, not the socket, and the daemon cannot referee which of an operator's
-        // own windows a human is looking at. This is deliberate; do not "fix" it.
-        const currentSeq = record.message_count - 1;
-        // DOD-COATTEND-SENDWINDOW-1: the frontier AS THIS SEND SAW IT. Re-read immediately before the
-        // wire, below — anything that moved it in between is a leaf this send was never checked
-        // against.
-        const frontierAtGate = sessionNodeManager.getSessionTree(agentName, sessionId).size();
-        const connectionCursor = getConnectionCursor(connectionId, sessionId);
-        const unreadReceived = sessionNodeManager.getUnreadReceivedCount(agentName, sessionId);
-        const caughtUp = connectionCursor >= currentSeq || unreadReceived === 0;
-        if (!caughtUp) {
-            // M8C-CURSOR-1 (reviewer MEDIUM fix): every sibling rejection in this handler logs; this
-            // gate must too — a security-relevant control-flow path with no observability is a gap.
-            // Both authorities are logged, so the next reader can tell WHICH one refused.
-            logger.warn("session.send.blocked", {
-                sessionId,
-                currentSeq,
-                lastReadSeq: connectionCursor,
-                unreadReceived,
-                connectionId,
-                agentName,
-                // AC2 asks the event to NAME the authority that refused (review F7). Reaching this branch
-                // means BOTH authorities said no — the gate passes if EITHER is satisfied — so there is no
-                // "binding one" to report and the ternary I first wrote here was dead: `connectionCursor <
-                // currentSeq` is always true at this point, so it could only ever print `unread_watermark`,
-                // and an operator filtering for `connection_cursor` would get zero hits forever and
-                // conclude cursor refusals do not exist. That is the defect F7 was raised to fix, rebuilt
-                // (review H2). The true statement is that both are false; `lastReadSeq` and
-                // `unreadReceived` above already carry which is how far off.
-                authority: "cursor_and_watermark",
-            });
-            return {
-                ok: false,
-                reason: "session_not_current",
-                current_seq: currentSeq,
-                last_read_seq: connectionCursor,
-                unread_received: unreadReceived,
-                // DOD-ONBOARD-HELP-1 §5: say what is wrong and what to do, in that order, in plain words.
-                // The old text opened with the internal noun ("this agent hasn't read…"); a refused send is
-                // the most common wall a new operator hits, so it leads with the COUNT and the FIX. The
-                // session id is interpolated so the remedy is copy-pasteable, not a template to fill in.
-                // Rendered per surface at the IPC boundary — a CLI caller sees `cello receive <id>`.
-                guidance: `${unreadReceived} unread message(s) — run cello_receive ${sessionId} first to read them, then send again. (Or cello_transcript ${sessionId} for the whole conversation.) You are blocked from replying to something you haven't read.`,
-            };
-        }
-        // M9-FEED-001 §6: the agent's governance re-send decisions, keyed by the flagId a prior `warn`
-        // returned. Optional; validated shape only (the gateway re-scans + applies them, INV-4). A
-        // malformed map is ignored rather than failing the send (the gateway will just re-warn).
-        const rawDecisions = params?.governance_decisions;
-        let governanceDecisions;
-        if (rawDecisions && typeof rawDecisions === "object" && !Array.isArray(rawDecisions)) {
-            const valid = {};
-            for (const [k, v] of Object.entries(rawDecisions)) {
-                if (v === "redact" || v === "allow_once" || v === "allow_always")
-                    valid[k] = v;
-            }
-            if (Object.keys(valid).length > 0)
-                governanceDecisions = valid;
-        }
-        const correlationId = randomUUID();
-        const contentBytes = new TextEncoder().encode(contentStr);
-        // CELLO-M7-MSG-001 (AC-013/AC-018/AC-021): enforce the 1 MB application content cap
-        // BEFORE any transmission or hash/leaf production. This replaces the silent oversize
-        // decode-failure → desync: the send is rejected with a distinct, diagnosable reason
-        // and actionable guidance; no content frame is transmitted, no leaf is appended, and
-        // the session stays usable.
-        if (contentBytes.length > MAX_CONTENT_BYTES) {
-            logger.warn("content.rejected.too_large", {
-                sessionId,
-                contentSize: contentBytes.length,
-                cap: MAX_CONTENT_BYTES,
-                correlationId,
-            });
-            return {
-                ok: false,
-                reason: "content_too_large",
-                guidance: `This message is ${contentBytes.length} bytes, over the ${MAX_CONTENT_BYTES}-byte (1 MB) per-message content cap. Split it into multiple messages each under the cap, or use the large-object/file transfer path for large payloads (not cello_send). Nothing was sent and the session is still active — retry with smaller content.`,
-            };
-        }
-        const recipientPubkey = record.counterparty_pubkey;
-        // M9 outbound screening seam (INV-5/SI-001). Screen BEFORE anything reaches the wire. The
-        // gateway verdict drives the four cello_send outcomes (M9-FEED-001): block / warn → NOT sent;
-        // allow → sent as-is; redact → sent in ALTERED form. A configured-but-unreachable gateway fails
-        // closed (block, gateway_unavailable), so a screening outage can never let content out ungated.
-        const outboundVerdict = await securityGateway.screenOutbound(contentBytes, {
-            direction: "outbound",
-            agentName: record.agent_name,
-            sessionId,
-            correlationId,
-            ...(governanceDecisions !== undefined ? { governanceDecisions } : {}),
-        });
-        if (outboundVerdict.disposition === "block") {
-            if (outboundVerdict.reason === GOVERNANCE_TIMEOUT) {
-                logger.error("security.gateway.timeout", { sessionId, reason: outboundVerdict.reason, correlationId });
-            }
-            else if (outboundVerdict.reason === GATEWAY_UNAVAILABLE) {
-                logger.error("security.gateway.unavailable", { direction: "outbound", reason: outboundVerdict.reason, correlationId });
-            }
-            else {
-                logger.info("security.verdict.returned", { disposition: "block", sessionId, reason: outboundVerdict.reason, correlationId });
-            }
-            return {
-                ok: false,
-                reason: outboundVerdict.reason ?? "blocked_by_governance",
-                guidance: outboundVerdict.guidance ??
-                    "This message was blocked by the security gateway and was NOT sent. The session is still active.",
-                blocks: (outboundVerdict.events ?? []).filter((e) => e.disposition === "block"),
-            };
-        }
-        if (outboundVerdict.disposition === "warn") {
-            logger.info("security.verdict.returned", { disposition: "warn", sessionId, correlationId });
-            return {
-                ok: false,
-                reason: "governance_warn",
-                guidance: outboundVerdict.guidance ??
-                    "This message was held for a governance decision and was NOT sent. Re-send the same content with a " +
-                        "governance_decisions map ({flagId: redact | allow_once | allow_always}) to resolve each flagged item.",
-                flags: (outboundVerdict.events ?? []).filter((e) => e.disposition === "warn"),
-            };
-        }
-        // FAIL-CLOSED (code-review MED): a `redact` verdict MUST carry the redacted content. If it ever
-        // arrives without it, sending the original `contentBytes` would leak the pre-redaction draft — the
-        // one place M9 could fail OPEN. Treat it as a block, never an allow-original. (Unreachable today:
-        // the gateway always includes content on redact; this is the defensive floor.)
-        if (outboundVerdict.disposition === "redact" && outboundVerdict.content === undefined) {
-            logger.error("security.verdict.redact_without_content", { sessionId, correlationId });
-            return {
-                ok: false,
-                reason: "redact_without_content",
-                guidance: "The security gateway returned a redact verdict without the redacted content. To avoid " +
-                    "leaking the original, nothing was sent. This is a gateway fault — check the gateway logs and retry.",
-            };
-        }
-        // allow or redact → send. On redact the ALTERED bytes are what go on the wire AND what the leaf
-        // hash binds — the transcript records what was actually sent, not the pre-redaction draft.
-        const modified = outboundVerdict.disposition === "redact" && outboundVerdict.content !== undefined;
-        const sendBytes = modified ? new Uint8Array(outboundVerdict.content) : contentBytes;
-        /**
-         * `DOD-M15-SEALWIRE-1` part B2b — the hash and its ALGORITHM come from one decision point.
-         *
-         * Four outbound sites compute a content hash. Each of them independently deciding whether to
-         * salt is the defect `wire-content-hash.ts` was created to end (its header: the expression was
-         * written out five times, the last two got it wrong, and it took two live daemons to find),
-         * with a worse failure mode — a message hashed one way and LABELLED another is refused by every
-         * peer, including a correct one.
-         */
-        const { hash: contentHash, alg: contentHashAlg } = await sessionNodeManager.contentHashForSession(record.agent_name, sessionId, sendBytes);
-        const contentHashHex = Buffer.from(contentHash).toString("hex");
-        // ─── DOD-COATTEND-SENDWINDOW-1 (§4): re-check the gate, in the same synchronous window as the
-        //     act that makes this message irreversible ───────────────────────────────────────────────
-        //
-        // NO AWAIT MAY BE INTRODUCED BETWEEN THIS CHECK AND `sendContent` BELOW. The check is only
-        // worth anything because nothing can interleave between it and the wire; adding an await here
-        // reopens exactly the window it closes, silently, while leaving code that still looks correct.
-        //
-        // WHY HERE AND NOT AT `appendSessionLeaf`, WHICH IS WHAT AC1 ASKS FOR. AC1 copies the inbound
-        // pattern (`session-node-manager.ts:3682-3695`), where the append IS the commit point.
-        // Outbound it is not: `sendContent` puts the message ON THE WIRE and runs BEFORE the append, so
-        // by the append the counterparty already holds it. Refusing there would leave them holding
-        // content this side never leafed — the two frontiers disagree, neither will co-sign, and the
-        // session is unsealable except by forfeiting the receipt. That is DOD-FRONTIER-STRAND-1, the
-        // defect that left `dbb93dfc…` stranded for a week, manufactured on purpose to satisfy the
-        // letter of an AC. The purpose of AC1 is "re-check where it still matters"; outbound, that is
-        // the wire.
-        //
-        // WHY A FRONTIER COMPARISON RATHER THAN RE-RUNNING `caughtUp`. AC3: the gate's second authority
-        // is the PERSISTED read watermark, which is AGENT-scoped — so the moment ANY connection reads,
-        // `unreadReceived === 0` for every one of them, and re-running the gate would pass a racing
-        // sibling exactly as it passed the first time. That agent-scoping is DOD-CURSOR-DURABLE-1
-        // behaving as its own §6 predicted: right for stateless clients, wrong for this. So the tighten
-        // is stated AGAINST it rather than around it — this asks a question the watermark cannot
-        // answer: "did the session move under me while I was gone?"
-        const frontierNow = sessionNodeManager.getSessionTree(agentName, sessionId).size();
-        const claimedAt = sendClaims.claimedAt(agentName, sessionId);
-        if (claimedAt !== undefined) {
-            // A sibling is between its own frontier check and its append RIGHT NOW. Its leaf does not
-            // exist yet, so the comparison below cannot see it — this is the half of the window a
-            // frontier check structurally cannot cover, whatever it is compared against.
-            logger.warn("session.send.blocked", {
-                sessionId, agentName, connectionId, correlationId,
-                authority: "sibling_send_in_flight",
-                claimHeldMs: Date.now() - claimedAt,
-            });
-            // B2b-2 review F3: this send produced NOTHING — no leaf, no wire, no peer copy — so the
-            // unsalted hash computed above must not keep this session unsalted for its life.
-            sessionNodeManager.abandonUnsaltedHash(agentName, sessionId);
-            return {
-                ok: false,
-                reason: "session_moved_under_send",
-                in_flight: true,
-                // Says "may have sent" (review L4): the in-flight send can still fail and be queued for
-                // retry, in which case nothing was said and there is nothing to read. Promising the operator
-                // a reply that does not exist sends them to an unchanged transcript to look for it.
-                guidance: `Another session on this agent is sending into this conversation right now, so nothing was sent. Wait a moment, then check cello_transcript ${sessionId} — they may have already answered — before deciding whether your reply still applies. Do not simply resend.`,
-            };
-        }
-        if (frontierNow !== frontierAtGate) {
-            logger.warn("session.send.blocked", {
-                sessionId, agentName, connectionId, correlationId,
-                authority: "frontier_moved_during_send",
-                frontierAtGate, frontierNow,
-            });
-            // B2b-2 review F3: nothing was sent, so release the unsalted hash's permanent closure. This
-            // path got MORE likely with B2b-2 — the salt wait widens the interval this check watches.
-            sessionNodeManager.abandonUnsaltedHash(agentName, sessionId);
-            return {
-                ok: false,
-                reason: "session_moved_under_send",
-                frontier_at_gate: frontierAtGate,
-                frontier_now: frontierNow,
-                // Says LEAF, not "message" (review F6). The frontier counts leaves, and a leaf can exist
-                // with no transcript row — a security-gateway terminal block commits one and never records
-                // the text. Promising N messages in the transcript and delivering fewer sends the operator
-                // hunting for content that was screened out and is not there.
-                guidance: `The conversation moved while this message was being prepared — the session's record gained ${frontierNow - frontierAtGate} leaf/leaves from another session on this agent or from the counterparty, so nothing was sent. Read what arrived with cello_transcript ${sessionId} (a leaf that was screened out has no readable text and will not appear there), then decide whether your reply still applies. Do not simply resend: another session may have already answered.`,
-            };
-        }
-        // THE CLAIM — taken in the same synchronous window as the check above (no await between them),
-        // and released the instant the wire call settles.
-        //
-        // Releasing there is safe and is not an oversight: after `await sendContent` resolves, the
-        // continuation runs the `finally`, the ok-check and `appendSessionLeaf` WITHOUT YIELDING, so no
-        // other connection can observe the gap. By the time one runs again the frontier has either
-        // moved (append happened → its own frontier comparison catches it) or the send failed and
-        // nothing was committed (→ it is free to try). `finally` rather than a plain call so a throw
-        // cannot wedge the session into permanent refusal.
-        sendClaims.claim(agentName, sessionId);
-        let sendResult;
-        try {
-            sendResult = await sessionNodeManager.sendContent(record.agent_name, sessionId, sendBytes, new Uint8Array(contentHash), correlationId, LEAF_KIND_MSG, contentHashAlg);
-        }
-        finally {
-            sendClaims.release(agentName, sessionId);
-        }
-        if (!sendResult.ok) {
-            // DB-001 / dead-channel contract: never silently drop, never desync. Preserve
-            // the content in the durable retry_queue so it is retried on reconnect, and
-            // surface a named, diagnosable failure.
-            //
-            // M12-P13 (review MEDIUM-4): NOT on the durable path. `drainSession` — this nonce queue's
-            // only consumer — has no production caller, so every row it writes is permanent: unbounded
-            // growth plus a second copy of the message plaintext at rest. On a durable failure the
-            // awaiting-ACK queue already holds the content and actually drains, so writing here too
-            // stored the same plaintext twice and drained neither copy from this table.
-            if (!sendResult.durable) {
-                // B2b-2 review F3: a non-durable failure means the message is GONE — it reached no leaf, no
-                // peer, and the queue below has no production consumer. Nothing exists to split a
-                // transcript, so this session must not stay unsalted for its life over it.
-                sessionNodeManager.abandonUnsaltedHash(agentName, sessionId);
-                const nonce = randomUUID();
-                try {
-                    retryQueue.enqueue(sessionId, new TextEncoder().encode(nonce), sendBytes);
-                }
-                catch (err) {
-                    logger.error("session.content.queue.failed", {
-                        sessionId,
-                        error: extractErrorMessage(err),
-                        correlationId,
-                    });
-                }
-            }
-            logger.warn("session.content.send.failed", {
-                sessionId,
-                recipientPubkey,
-                reason: sendResult.reason,
-                errorMessage: sendResult.error,
-                durable: sendResult.durable,
-                cause: sendResult.cause,
-                correlationId,
-            });
-            // M12-P13: a DURABLY QUEUED message still owns the sequence the relay witnessed for it before
-            // direct delivery was ever attempted — the same reasoning that makes a parked message occupy
-            // its leaf position below. Leaving the hole here is what stalls the far side: `nextExpected`
-            // is this tree's size, so the counterparty's next message arrives at a sequence this tree can
-            // never reach and is held behind the gap forever (found live 2026-08-05, M12 Entry 89).
-            // A LOST message gets no leaf — that would commit a sequence no content will ever fill, and
-            // the two roots could then never seal.
-            if (sendResult.durable) {
-                // DOD-M12B-INDEX-1: at the position the relay assigned, not at whatever the tail is. When
-                // this side has a gap the two differ, and committing at the tail puts our leaf at someone
-                // else's index — which parts the two roots and makes the next seal terminal.
-                const placed = sessionNodeManager.placeOwnLeaf(record.agent_name, sessionId, contentHashHex, sendBytes, sendResult.sequenceNumber, correlationId, "msg", sentAuthorship(sendResult));
-                // `sequence_number` is a LEAF INDEX or nothing. Reporting the relay's number when no leaf
-                // exists hands the caller a value that matches no leaf on this side, and anything that
-                // feeds it to a cursor is then wrong.
-                const queuedLeaf = placed.placed ? placed.leafIndex : -1;
-                if (placed.placed) {
-                    sessionNodeManager.recordTranscriptMessage(record.agent_name, sessionId, queuedLeaf, "sent", sendBytes, correlationId, sentAuthorship(sendResult));
-                    advanceConnectionCursor(connectionId, sessionId, queuedLeaf);
-                }
-                logger.info(placed.placed ? "session.content.queued.committed" : "session.content.queued.held", {
-                    sessionId, sequenceNumber: queuedLeaf, heldAt: placed.placed ? undefined : placed.heldAt,
-                    contentHash: contentHashHex, correlationId,
-                });
-                return {
-                    ok: false,
-                    reason: sendResult.reason,
-                    /**
-                     * DOD-M15-RELAYABUSE-1 review MEDIUM-7 — **THE CODE MUST CROSS THE BOUNDARY, NOT JUST THE
-                     * PARAGRAPH.**
-                     *
-                     * `reason` here is `session_stream_unavailable` — an EXIT-POINT label. The actual cause
-                     * (throttled / this counterparty's mailbox is full / the relay's store is full / this
-                     * build cannot seal the algorithm) was computed, logged, and then left inside the English
-                     * `guidance`. So an MCP caller wanting to tell "wait 45 seconds" from "another relay will
-                     * not help" was back to substring-matching prose — which is exactly what `cause` was added
-                     * to stop. Three newly-distinguishable causes had just landed and none of them reached the
-                     * agent that would act on them.
-                     */
-                    ...(sendResult.cause !== undefined ? { cause: sendResult.cause } : {}),
-                    queued: true,
-                    // Carried on BOTH paths: without it a caller cannot tell "queued and in the record" from
-                    // "queued and not in the record yet".
-                    ...(placed.placed ? {} : { held: true }),
-                    sequence_number: queuedLeaf,
-                    /**
-                     * ⚠️ THE BRANCH PRODUCTION ACTUALLY TAKES — review HIGH-2, and the reason the loopback
-                     * journey could not find it. Behind NAT the direct path runs over the relay's circuit, so
-                     * a relay outage kills the transport and the witness TOGETHER and the send lands here
-                     * rather than on the delivered path. On the harness the two are independent, the direct
-                     * send succeeds, and this branch is never reached.
-                     *
-                     * It was answering "No action needed" for a leaf the relay never witnessed.
-                     */
-                    witnessed: wasWitnessed(placed),
-                    /**
-                     * ⚠️ COMPOSED, NEVER CHOSEN — the first version of this fix CHOSE, and that discarded a
-                     * shipped guarantee. Caught deterministically by the `013-ABSENCE` lane in
-                     * `dod-m15-park-envelope-coded-error.test.ts`.
-                     *
-                     * A RATE-LIMITED park is unwitnessed BY CONSTRUCTION, so making the whole string
-                     * conditional on witnessing threw away `sendResult.guidance` — which is where the relay's
-                     * own retry window lives ("about 45 seconds"). That is Invariant 3 aimed back at this
-                     * unit: a downstream handler replacing an upstream descriptive value with a generic one.
-                     * The upstream sentence is more specific than anything this layer can produce, and a
-                     * missing witness does not make it less true.
-                     *
-                     * Both facts hold at once and the operator needs both — what the relay said to do, and
-                     * what the missing witness will cost. So upstream is kept VERBATIM and the unwitnessed
-                     * note is APPENDED to it, by `queuedSendGuidance`, which the test calls directly rather
-                     * than re-implementing.
-                     */
-                    guidance: queuedSendGuidance(sendResult.guidance, wasWitnessed(placed)),
-                };
-            }
-            return {
-                ok: false,
-                reason: sendResult.reason,
-                // DOD-M15-RELAYABUSE-1 review MEDIUM-7: the machine-readable cause crosses here too — see
-                // the note on the queued return above. `reason` is the exit point; `cause` is what happened.
-                ...(sendResult.cause !== undefined ? { cause: sendResult.cause } : {}),
-                // M12-P12 (review pass 2): sendContent knows whether the content is actually recoverable;
-                // this boundary used to overwrite that with one sentence promising a retry for EVERY
-                // failure — including a persist that threw, where the message is simply gone, and a session
-                // with no relay, where the direct nonce queue it names has no production drain. Telling an
-                // operator "it will be retried" about a lost message is the same lie that let the original
-                // defect sit unnoticed; the caller's own guidance wins whenever it has one.
-                guidance: sendResult.guidance ?? "The content could not be delivered over the session stream right now, and no relay is configured for this session — it is NOT queued for automatic retry. Send it again once the counterparty is reachable; check cello_status for their status.",
-            };
-        }
-        // Delivered directly OR dispatched to relay (DOD-LEAVEMSG-1) — either way the content is now
-        // part of the daemon-owned tree: the relay witness (R1) already assigned it a sequence before
-        // direct delivery was even attempted, so a parked message occupies the SAME leaf position it
-        // would have taken if delivered live. Append once, for both outcomes.
-        // DOD-M12B-INDEX-1: the relay assigned this message a position before delivery was attempted,
-        // and the leaf goes THERE. Appending at the tail is only right while this side has no gap; the
-        // first gap puts our own leaf at a position that belongs to a message of theirs we have not
-        // seen, which parts the two roots permanently. When the position is ahead of the tail the leaf
-        // is held — the bytes are already on the wire, so only the record waits, exactly as it does for
-        // a message we receive out of order.
-        const placement = sessionNodeManager.placeOwnLeaf(record.agent_name, sessionId, contentHashHex, sendBytes, sendResult.sequenceNumber, correlationId, "msg", sentAuthorship(sendResult));
-        if (!placement.placed) {
-            // NOT IN THE RECORD YET, and the caller is told so rather than handed a plain success.
-            // `sequence_number` stays -1 because no leaf exists: `held_at` carries the relay's position
-            // separately, so nothing mistakes a relay number for a leaf index.
-            return {
-                ok: true,
-                sequence_number: -1,
-                held: true,
-                held_at: placement.heldAt,
-                /**
-                 * TRUE, and it is not a courtesy default — review HIGH-2. A leaf is HELD precisely because
-                 * the relay assigned it a position beyond this side's tail, so being held is itself proof
-                 * that the relay witnessed it. Omitting the field here would leave an agent branching on
-                 * `witnessed !== true` reading a perfectly healthy message as a lost one.
-                 */
-                witnessed: wasWitnessed(placement),
-                // The screening verdict must survive this return, or an agent whose message was ALTERED is
-                // never told — the one thing a redact verdict exists to surface.
-                ...(modified ? { modified: true, transformations: (outboundVerdict.events ?? []).filter((e) => e.disposition === "redact") } : {}),
-                guidance: "The message was delivered — the counterparty has it. Its place in the record is waiting on an earlier message from them that has not arrived yet, so it is not in your transcript until that gap fills. Nothing to do, and do not resend: a resend takes a second position in the record.",
-            };
-        }
-        if (placement.diverged) {
-            // THE OPERATOR HEARS ABOUT IT. Their message is in their own transcript, but this side's tree
-            // is permanently ahead of the relay's counter, so the two can no longer agree on a root and
-            // this session will never produce a notarized receipt. Returning the ordinary success here —
-            // which is what the first build did — reports a healthy send on a conversation that has
-            // silently lost the one thing the protocol exists to produce.
-            logger.error("session.content.sent.diverged", {
-                sessionId, agentName: record.agent_name, sequenceNumber: placement.leafIndex, correlationId,
-                impact: "delivered and recorded locally, but this session can no longer be sealed bilaterally",
-            });
-            return {
-                ok: true,
-                sequence_number: placement.leafIndex,
-                diverged: true,
-                /**
-                 * ⚠️ THIS IS `true`, AND THE FIRST VERSION OF THIS COMMENT SAID OTHERWISE — review HIGH-B.
-                 *
-                 * The divergence branch is reached only when the relay DID assign a sequence, one behind
-                 * this side's frontier (`assignedSeq < nextExpected`). So the relay witnessed this leaf; it
-                 * witnessed it at a position our tree has already passed. `witnessed: true` is the honest
-                 * answer and `diverged: true` is the field that carries the bad news here.
-                 *
-                 * I had written that this return was "reachable only after an unwitnessed leaf" and would
-                 * otherwise report `witnessed: undefined`, so the operator could never see the `false` the
-                 * guidance told them to watch for. The first half is true — divergence is caused by an
-                 * earlier unwitnessed append — and the conclusion drawn from it was not: THIS send was
-                 * witnessed. Recorded rather than silently corrected, because a comment asserting the wrong
-                 * value of the field beside it is how the next reader learns the wrong model.
-                 */
-                witnessed: wasWitnessed(placement),
-                ...(modified ? { modified: true, transformations: (outboundVerdict.events ?? []).filter((e) => e.disposition === "redact") } : {}),
-                guidance: `The message was delivered and is in your transcript. But this session's record has drifted out of step with the relay's ordering, so it can no longer be sealed with the counterparty — there will be no notarized receipt for it. Keep talking if you want to; when you are finished, cello_close_session ${sessionId} { force: true } is the only way it can end. cello_transcript ${sessionId} is the record you keep.`,
-            };
-        }
-        const leafIndex = placement.leafIndex;
-        // DOD-LOG-1: persist the readable SENT plaintext to the durable transcript, keyed by the
-        // canonical leaf sequence so it joins the committed hash chain (survives restart).
-        // M9 merge fix: use sendBytes (the ALTERED bytes on a redact verdict), never the pre-redaction
-        // contentBytes — the leaf hash above already binds sendBytes; the transcript must match what
-        // actually went on the wire, not the pre-redaction draft (M9's own stated seam invariant).
-        /**
-         * ⚠️ THE RESULT IS READ, and a `false` is a HOLE in the record of what this side said.
-         *
-         * The leaf exists; the row does not. The operator's own message is then invisible to every
-         * reader of the transcript — including `away-inbox-oneshot.ts`, which asks exactly one question
-         * of it: "has a human spoken in this session?" A silent `false` answers no about a message that
-         * went out, and that answer ends the session. The inbound path has handled this case since
-         * `content_undeliverable`; the outbound path ignored it.
-         */
-        const rowWritten = sessionNodeManager.recordTranscriptMessage(record.agent_name, sessionId, leafIndex, "sent", sendBytes, correlationId, sentAuthorship(sendResult));
-        if (!rowWritten) {
-            sendClaims.noteRowMissing(record.agent_name, sessionId);
-            logger.error("session.send.transcript_row_failed", {
-                sessionId, agentName: record.agent_name, sequenceNumber: leafIndex, correlationId,
-                impact: "the message was sent and its leaf committed, but this side holds no readable copy of it. " +
-                    "The transcript under-reports what this agent said, and nothing that reads the transcript " +
-                    "to decide whether a human spoke here may treat this session as unspoken-in.",
-            });
-        }
-        // M8C-CURSOR-1: the sender authored this leaf — advance ITS OWN cursor so it doesn't get
-        // blocked by session_not_current on its own just-sent message.
-        advanceConnectionCursor(connectionId, sessionId, leafIndex);
-        // CC-1 (2026-07-07): operator engagement promotes the counterparty to a known contact. A
-        // committed reply — past the read-before-write gate, content now on the wire AND in the tree —
-        // IS the operator choosing to trust this sender; the inbound-accept path deliberately no longer
-        // auto-adds (that defeated screening + anti-spam). For an OUTBOUND session the counterparty is
-        // already a contact (cello_initiate_session added it), so this is an idempotent no-op there; it
-        // matters for inbound-originated sessions, where the reply is the trust signal. addContact is
-        // INSERT OR IGNORE — it never refreshes added_at. DOD-TIER-4 AC3: engaging (a committed reply into
-        // an inbound session I accepted) makes the counterparty KNOWN, provenance 'accepted'. For an
-        // OUTBOUND session the row already exists ('initiated', KNOWN) and INSERT OR IGNORE leaves it
-        // untouched — 'initiated' correctly wins there.
-        sessionNodeManager.addContact(record.agent_name, recipientPubkey, undefined, "accepted", TIER.KNOWN);
-        if (modified) {
-            logger.info("security.verdict.returned", { disposition: "redact", sessionId, sequenceNumber: leafIndex, correlationId });
-        }
-        if (!sendResult.delivered) {
-            // DOD-LEAVEMSG-1 (sender half): direct delivery failed but the sealed, hashed content was
-            // successfully deposited at the relay (pickup_queue) — this is a SUCCESS outcome, not a
-            // failure. The recipient's daemon pulls it via RELAYWAKE on next reconnect. Reporting this
-            // as ok:false (the pre-LEAVEMSG-1 behavior) misrepresented an in-flight message as lost.
-            logger.info("session.content.dispatched_to_relay", {
-                sessionId,
-                recipientPubkey,
-                contentHashHex,
-                sequenceNumber: leafIndex,
-                correlationId,
-            });
-            return {
-                ok: true,
-                sequence_number: leafIndex,
-                delivered: false,
-                reason: "dispatched_to_relay",
-                modified,
-                // Same fact, same shape, both branches — see the note on the delivered path below.
-                witnessed: wasWitnessed(placement),
-                /**
-                 * WHAT IS ACTUALLY TRUE, and the previous wording was neither.
-                 *
-                 * OBSERVED LIVE 2026-08-18. This exact response came back on a send that was delivered in
-                 * **8 seconds**, and the counterparty's agent read it and correctly reported "no change" —
-                 * because it is byte-identical to the response returned when the same send took THREE
-                 * MINUTES. The sender had no way to tell a good outcome from a bad one, and the rational
-                 * next move for anyone reading it is to send again, which produces a duplicate of a message
-                 * that was never lost.
-                 *
-                 * The old text also asserted a cause it does not know: *"delivered the next time the
-                 * counterparty's daemon reconnects."* The counterparty's daemon is frequently up the whole
-                 * time — this path is taken because the two SESSION NODES hold no direct connection to each
-                 * other, which is a different thing and points at a different party.
-                 *
-                 * So: say what happened, say what to expect, and claim nothing about their daemon.
-                 */
-                /**
-                 * `016-RELAYLOSS`: **"witnessed" IS NOT SOMETHING THIS STRING GETS TO ASSERT.**
-                 *
-                 * It said so unconditionally, and it is false on exactly the path this order measured: a
-                 * relay that stops answering fails the hash submit and the leaf is appended unwitnessed,
-                 * while the content can still reach the counterparty. The reassurance was then strictly
-                 * worse than silence — it named the property that had just been lost as the reason not to
-                 * worry. Claimed only when true; the rest of the sentence is unchanged and still right.
-                 */
-                /**
-                 * ⚠️ "NO ACTION IS NEEDED" IS CONDITIONAL TOO — review HIGH-C, and the same mistake the
-                 * queued path had already fixed one branch away.
-                 *
-                 * The first version left that reassurance unconditional and then contradicted it three
-                 * words later: no action is needed… BUT this session is on its way to being unsealable.
-                 * Telling the operator to relax and then telling them the conversation is dying is worse
-                 * than either sentence alone, because the one they act on is the first.
-                 *
-                 * This branch also named no remedy at all, while its two siblings both say to close. Same
-                 * situation, same advice.
-                 */
-                guidance: "Sent. This message went via the relay rather than a direct connection, so it is sealed"
-                    + (wasWitnessed(placement) ? ", witnessed" : "") + " and on its way — the counterparty "
-                    + "normally has it within seconds. "
-                    + "`delivered: false` means it did not go over a direct link, NOT that it failed. "
-                    + (wasWitnessed(placement)
-                        ? "No action is needed, and re-sending would duplicate it."
-                        : "Do not re-send — that would duplicate it. BUT the relay did NOT witness this leaf, so "
-                            + "the ordering authority has no copy of it and your record is a leaf ahead of the "
-                            + "relay's. Ordering does not repair itself: the next message the relay does witness "
-                            + "will report this session as diverged, and a diverged session can never be sealed "
-                            + "with the counterparty. If the receipt matters, close rather than continuing."),
-                ...(modified ? { transformations: (outboundVerdict.events ?? []).filter((e) => e.disposition === "redact") } : {}),
-            };
-        }
-        logger.info("session.content.sent", {
-            sessionId,
-            recipientPubkey,
-            contentHashHex,
-            sequenceNumber: leafIndex,
-            correlationId,
-        });
-        return {
-            ok: true,
-            sequence_number: leafIndex,
-            delivered: true,
-            modified,
-            /**
-             * ─── `016-RELAYLOSS`: THE ONE FACT THIS RESPONSE WAS MISSING ─────────────────────────────
-             *
-             * Measured, not supposed: with the relay black-holed mid-conversation, this send stalled ten
-             * seconds and returned exactly the object above — the same `ok`, the same `delivered`, and a
-             * `sequence_number` that is a LOCAL leaf index and therefore looks just as healthy. The
-             * daemon logged `session.tree.own_leaf_unwitnessed` at ERROR, correctly and in detail, into a
-             * file the agent cannot read. The operator's message arrived, they were told it succeeded,
-             * and the ordering authority has no copy of it.
-             *
-             * `witnessed` is stated on BOTH outcomes rather than only the bad one. A field that appears
-             * only when something is wrong cannot be relied on by a reader who has never seen it — its
-             * absence is indistinguishable from an older daemon, and "absence is not a pass" is the rule
-             * this milestone keeps re-learning. Present always, it is a fact the caller can branch on.
-             */
-            witnessed: wasWitnessed(placement),
-            /**
-             * ⚠️ THIS ONCE SAID *"send the next message normally — ordering re-establishes itself."* It
-             * was false, and it was the most damaging sentence in the unit that added it — review HIGH-1.
-             *
-             * `placeOwnLeaf` states the opposite sixty lines away: an unwitnessed append leaves this
-             * side's tree one leaf AHEAD of the relay's counter, so "from then on every ack comes back
-             * behind our frontier and the two can never agree again — the seal was already lost at the
-             * unwitnessed append, not here." The next WITNESSED send therefore takes the divergence
-             * branch and marks the session permanently unsealable. Telling the operator to keep talking
-             * was telling them to perform the act that makes the loss permanent.
-             *
-             * Which is this unit's own subject — a reassuring sentence asserting a property already lost
-             * — reproduced one clause later in its replacement. Kept as a comment, not quietly deleted,
-             * because the reasoning is the part that stops it coming back.
-             *
-             * `cello status` came out of the advice for the same reason: measured in this unit's own
-             * runs, its relay fields read identically during the outage and before it.
-             */
-            ...(wasWitnessed(placement)
-                ? {}
-                : {
-                    guidance: 
-                    /**
-                     * ⚠️ NOT "the counterparty's record cannot gain it" — review MED-D. On THIS branch the
-                     * direct send succeeded, and the receiving side appends unwitnessed content in arrival
-                     * order rather than refusing it (refusing would make the relay a precondition for
-                     * reading your mail). So they do get the message. What nobody gets is an independent
-                     * record that you sent it — which is the thing actually lost, and the thing the remedy
-                     * below is for. The old sentence would have had an operator conclude the conversation
-                     * was already broken bilaterally when the two trees may still agree.
-                     */
-                    "Delivered and in your transcript — but the relay did not witness it, so the ordering "
-                        + "authority has no copy of it: the counterparty has your message, and neither of you "
-                        + "has independent proof you sent it. Do NOT resend: "
-                        + "that adds a second copy to your record and does not witness the first. "
-                        + "ORDERING DOES NOT REPAIR ITSELF — your record is now one leaf ahead of the relay's, "
-                        + "so the next message the relay DOES witness will report this session as diverged, "
-                        + "and a diverged session can never be sealed with the counterparty. If the receipt "
-                        + "matters, stop sending and close now; if you keep talking, do it knowing this "
-                        + "conversation is unlikely to produce one.",
-                }),
-            // On a redact, tell the agent exactly what was transformed (the §6 sender-side surface).
-            ...(modified ? { transformations: (outboundVerdict.events ?? []).filter((e) => e.disposition === "redact") } : {}),
-        };
-    });
-    // ─── CELLO-M7-DAEMON-004 / F1-a: cello_receive (BLOCKING, session-scoped) ────────
-    // F1-a fix: the daemon port had dropped the blocking receive (the handler was a
-    // non-blocking buf.shift). It now BLOCKS up to timeout_ms, polling the received-content
-    // buffer — resolved by the next arrival, a terminal seal answer (F1-b), or timeout. This is
-    // the "blocking receive variant" the guidance names.
-    //
-    // ONE name (DOD-ONBOARD-HELP-1, Andre 2026-07-11). This was briefly registered under
-    // `cello_receive_session` as well — one implementation behind two names. That alias is DELETED:
-    // it accepted or joined nothing (inbound sessions are auto-accepted by the standing receiver),
-    // so it was a second name for a step that does not exist, and its help said otherwise.
-    const RECEIVE_DEFAULT_TIMEOUT_MS = 30000; // matches the cello-mcp shim's documented default
-    const handleReceive = async (params, connectionId) => {
-        const connState = getConnState(connectionId);
-        // CC-3 / M8C-AUTOSTART-1 F18: explicit { agent } > current > sole online agent.
-        const agentName = resolveCurrentAgent(connState, params?.agent);
-        if (!agentName)
-            return NO_CURRENT_AGENT_RESPONSE;
-        // Read the snake_case public field cello-mcp.ts actually sends.
-        const sessionId = params?.session_id;
-        if (!sessionId) {
-            return { ok: false, reason: "missing_params", guidance: "Provide 'session_id' (hex) to receive content for a specific session." };
-        }
-        const record = sessionNodeManager.getSessionRecord(agentName, sessionId);
-        // DOD-UNREAD-1 D4b: a TRANSCRIPT-ONLY session — received rows exist but no sessions row (the
-        // pre-D3/D4a phantom residue: the counterparty's reply landed while this side refused the
-        // session). Those rows are counted unread by getUnreadSummary, so cello_receive MUST be able
-        // to read them or the badge can never clear. Reading is a transcript operation: the read below
-        // works from the durable transcript alone. Only a session with NEITHER a row
-        // NOR transcript rows is truly not found.
-        let transcriptOnly = false;
-        if (!record) {
-            /**
-             * ⚠️ **QUARANTINED ROWS DO NOT MAKE A SESSION — review F4, and this is the clause
-             * `DOD-M15-REFUSEDEVIDENCE-1` names by surface.**
-             *
-             * Every other reader of this table pins `direction = 'received'`, which is what makes a
-             * refused message excluded by construction. This one counted rows. So after a
-             * `session_orphaned` retention — no `sessions` row, one quarantined row — `cello_receive`
-             * stopped answering `session_not_found` and began answering `session_not_live`, with guidance
-             * saying *"This session exists only as a durable transcript"*. Nothing deliverable is there
-             * and nobody opened it: the row is a probe someone aimed at an id. That is a milder shape of
-             * the phantom-session residue this whole design exists to avoid — a session id materialising
-             * in an operator surface because a stranger sent bytes at it.
-             */
-            const deliverable = sessionNodeManager
-                .readTranscript(agentName, sessionId)
-                .messages.filter((m) => m.direction !== "quarantined");
-            if (deliverable.length === 0) {
-                return { ok: false, reason: "session_not_found", guidance: "No session found with this ID. Check cello_sessions." };
-            }
-            transcriptOnly = true;
-        }
-        // (D4 review F3: the old `record.agent_name !== agentName` → session_not_owned branch was dead
-        // code — getSessionRecord is keyed by (agent_name, session_id), so a record can never belong to
-        // a different agent. A cross-agent session id simply has no record under this agent.)
-        /**
-         * DOD-M12B-SESSION-SEED-1 (case B) — return an interrupted session to `active` on a local read.
-         *
-         * WHAT THIS ACTUALLY BUYS, stated correctly after review MEDIUM-5. The first version of this
-         * comment claimed an operator who only reads "was stuck forever" and that parked content never
-         * drained. **Neither is true.** The park drain runs off the AGENT's standing receiver, not the
-         * session node; `ingestReceivedContent` deliberately accepts `interrupted`; and the backstop
-         * tick fires for every agent every 5 minutes. So case-B content already reached the transcript.
-         *
-         * What the read-triggered revival adds is real but narrower: the status returns to `active`, so
-         * the operator's own next send is not refused, and the drain happens NOW rather than up to five
-         * minutes from now.
-         *
-         * WHY A READ MAY TRIGGER THIS AND AN INBOUND DIAL MAY NOT. Andre's tenet is about what a REMOTE
-         * party can cause — *"an open connection that a malicious agent can farm for."* Reviving because
-         * a peer dialled us would hand that lever to the peer. A read is the OPERATOR asking, on their
-         * own machine, for their own session.
-         *
-         * Narrowed to `interrupted` (review LOW-7). `reviveSessionNode` refuses the other non-active
-         * statuses by DENYLIST, so an allowlist here is what stops a sixth status added later from being
-         * force-flipped to `active` by a read.
-         *
-         * AWAITED — a loopback bind, sub-millisecond, and the receive deadline is computed after this so
-         * revival latency does not eat the read window — but its RESULT NEVER BLOCKS THE READ. Reading a
-         * stored transcript is always allowed, including for a sealed session, where this refuses.
-         */
-        /**
-         * DOD-M12B-SESSION-SEED-1 (case B) — return an interrupted session to `active` on a local read.
-         *
-         * **NOT AWAITED, and that is a correction made under live fire on 2026-08-18.** The first
-         * version awaited it. At the time the rebuild only opened a loopback port, so a stall was not
-         * credible — review asked that exact question and got that exact answer. The rebuild was then
-         * changed to take a circuit-relay reservation, so that a counterparty could dial us again, and
-         * nobody re-asked it. A relay that does not answer has no deadline. `cello_receive` hung for
-         * over two minutes on a session whose message was already verified and sitting in the
-         * transcript, and no `since_seq` catch-up could get past it either, because this ran first.
-         *
-         * **Reading your own stored messages must never depend on the network.** The revival is an
-         * optimisation on top of a local read — it makes the session sendable again and pulls anything
-         * parked — and both are worth nothing if the read cannot complete. So it runs alongside.
-         *
-         * WHY A READ MAY TRIGGER THIS AND AN INBOUND DIAL MAY NOT. Andre's tenet is about what a REMOTE
-         * party can cause — *"an open connection that a malicious agent can farm for."* Reviving because
-         * a peer dialled us would hand that lever to the peer. A read is the OPERATOR asking, on their
-         * own machine, for their own session.
-         *
-         * A refusal is no longer reported inline on this call; `session.revive.declined` names it in the
-         * log instead. That is the lesser evil against a read that never returns.
-         */
-        if (record && record.status === "interrupted") {
-            void sessionNodeManager.reviveIfNeededForRead(agentName, sessionId).catch(() => { });
-        }
-        // Catch-up mode is GONE (Andre, live test 2026-09-13): the ordinary read already returns
-        // everything unread. Refused by name so an old caller learns that, rather than being ignored.
-        if (params?.since_seq !== undefined) {
-            return {
-                ok: false,
-                reason: "since_seq_removed",
-                guidance: "since_seq no longer exists. Call cello_receive without it — it returns every unread message at once. For the whole conversation, use cello_transcript.",
-            };
-        }
-        /**
-         * ─── ONE READ, EVERY UNREAD MESSAGE, ONE BOOKMARK ───────────────────────────────────────────
-         *
-         * The bookmark is the agent's persisted watermark for this session. Everything received after it
-         * is handed over together and the bookmark moves to the last of them.
-         *
-         * It replaced three bookmarks, and the live test on 2026-09-13 shows why: catch-up moved two of
-         * them, the plain read consulted a third that belonged to the CONNECTION and started empty on
-         * every new one — so after catching up the next read re-served the old message, and every `/mcp`
-         * reconnect or `cello` CLI command started over at the oldest message in the conversation.
-         *
-         * The bookmark moves to the LAST message handed over, not through a gap-stopping walk. A hole —
-         * a blocked message, a document frame, a row that could not be decrypted — would otherwise strand
-         * every later message, re-served on every call. A row that could not be written is reported on
-         * the empty answer (`content_undeliverable`) rather than by holding the bookmark behind it.
-         */
-        const from = record ? record.counterparty_pubkey : null;
-        const takeUnread = () => {
-            const watermark = sessionNodeManager.getLastDeliveredSeq(agentName, sessionId);
-            // Asked ~47x/second while blocked, so the cheap SQL probe runs first and the transcript is
-            // decoded only when something is actually there.
-            if (!sessionNodeManager.findNextReceivedAfter(agentName, sessionId, watermark))
-                return null;
-            const unread = sessionNodeManager.readTranscript(agentName, sessionId).messages
-                .filter((m) => m.direction === "received" && m.sequence > watermark);
-            if (unread.length === 0)
-                return null;
-            sessionNodeManager.advanceLastDeliveredSeq(agentName, sessionId, unread[unread.length - 1].sequence);
-            clearTelegramRung(agentName, sessionId); // M8C-TGDOOR-1: read clears the ring
-            return Object.assign(unread, { previousWatermark: watermark });
-        };
-        const deliver = (unread, correlationId) => {
-            logger.info("session.receive.delivered", {
-                sessionId, agentName, connectionId, count: unread.length,
-                firstSequence: unread[0].sequence, lastSequence: unread[unread.length - 1].sequence,
-                attendance: attendanceCount(agentName), correlationId,
-            });
-            const lastText = unread[unread.length - 1].text.trimEnd();
-            // The turn signal belongs to the LAST message: it is what says whose move it is now.
-            const signalGuidance = lastText.endsWith("[[WRAP]]")
-                ? "Counterparty wrapped. Call cello_close_session now — do not reply."
-                : lastText.endsWith("[[OVER]]")
-                    ? "Counterparty's turn is done. Counterparty has indicated they are expecting a reply — use cello_send to reply."
-                    : /\[\[STANDBY EST:\d+m\]\]$/.test(lastText)
-                        ? "Counterparty is working and will follow up when done — no response expected. To block: call cello_receive with a longer timeout_ms. To check back later: schedule a cron and call cello_receive then."
-                        : undefined;
-            // DOD-M12B-AWAY-MARK-1: an away auto-reply is an ordinary message leaf, so without the mark a
-            // read is positive evidence a person answered. The content is passed through WHOLE.
-            const autoReplyCount = unread.filter((m) => isAutoReplyMarked(m.text)).length;
-            // A message that arrived but could not be written to the transcript has no row, so the
-            // bookmark just moved past it. Say so HERE, on the answer that crossed it — otherwise the
-            // operator sees only a gap in the sequence numbers (review of 86ec7524).
-            const lastSeq = unread[unread.length - 1].sequence;
-            // Only the lost messages THIS read moved past — the in-memory set is never pruned, so without
-            // the lower bound every later read would repeat the warning until a restart.
-            const readFrom = unread.previousWatermark ?? -1;
-            const crossed = sessionNodeManager.getUndeliverableSeqs(agentName, sessionId).filter((s) => s > readFrom && s <= lastSeq);
-            const lag = replyLagFor(sessionNodeManager, agentName, sessionId);
-            return {
-                ...(lag ? {
-                    reply_lag: lag,
-                    reply_lag_guidance: `Their last ${lag.replies} replies were written before they saw your message at position ${lag.your_unseen_seq}, so they may be answering something older. Check whether it reached them before assuming they disagree.`,
-                } : {}),
-                ok: true,
-                session_id: sessionId,
-                count: unread.length,
-                ...(crossed.length > 0 ? {
-                    undeliverable_sequences: [...crossed],
-                    undeliverable_guidance: `${crossed.length} message(s) arrived but could not be written to the local transcript, so they cannot be shown. This is a fault on THIS machine (check disk space and ~/.cello permissions), not the counterparty. Ask them to resend once it is fixed.`,
-                } : {}),
-                messages: unread.map((m) => ({
-                    sequence: m.sequence,
-                    content: m.text,
-                    from,
-                    ...(isAutoReplyMarked(m.text) ? { auto_reply: true } : {}),
-                })),
-                ...(autoReplyCount > 0 ? { auto_reply_guidance: AUTO_REPLY_GUIDANCE } : {}),
-                ...refusalsField(sessionNodeManager, agentName, sessionId, connectionId),
-                attendance: attendingNow(agentName),
-                ...(signalGuidance !== undefined ? { guidance: signalGuidance } : {}),
-            };
-        };
-        // D4b: a transcript-only session has no live node, so nothing new will ever arrive. Hand over
-        // what is unread without waiting; if nothing is, say where the history is.
-        if (transcriptOnly) {
-            const unread = takeUnread();
-            if (unread)
-                return deliver(unread, randomUUID());
-            return {
-                ok: false,
-                reason: "session_not_live",
-                attendance: attendingNow(agentName),
-                guidance: "This session exists only as a stored transcript and nothing in it is unread. Read the whole conversation with cello_transcript.",
-            };
-        }
-        const rawTimeout = params?.timeout_ms;
-        const timeoutMs = typeof rawTimeout === "number" && Number.isFinite(rawTimeout) && rawTimeout >= 0
-            ? rawTimeout
-            : RECEIVE_DEFAULT_TIMEOUT_MS;
-        const deadline = Date.now() + timeoutMs;
-        // DOD-COATTEND-VISIBLE-1 AC3: before this line the plain blocking receive wrote NOTHING to the
-        // log on ANY outcome — the only event in the path was `session.receive.since_seq`, which is the
-        // OTHER branch — so a session having its message taken by a sibling left no trace anywhere, for
-        // the operator in the moment or for anyone reading the log afterwards. One correlationId threads
-        // every exit below.
-        const receiveCorrelationId = randomUUID();
-        // Recomputed at EVERY exit, never snapshotted here (review MEDIUM): the loop below blocks for
-        // up to timeout_ms — 30 s by default — and sessions attach and detach inside that window. A
-        // count captured before the wait is stale exactly when it matters, and it is the number the
-        // operator reads and the number interpolated into the guidance. It is an O(connections) walk
-        // over a handful of entries; there is nothing to save by caching it.
-        for (;;) {
-            // TERMINAL FIRST (DOD-COATTEND-1). Reading the DURABLE RECORD means a sealed session's rows
-            // are still present, so a content read would keep delivering on a session that has already
-            // terminated — and F1-b's `session_sealed` answer would never be reached. Under the old
-            // destructive queue this ordering did not matter, because the seal EVICTED the buffer and the
-            // read found nothing. It matters now, so the terminal answer is checked before the record.
-            //
-            // F1-b: the session sealed while we were (or before we started) waiting — return the
-            //    terminal answer instead of hanging to timeout. unread_count reports messages that
-            //    were evicted unread (still durable — recoverable via cello_get_transcript).
-            const terminal = sessionNodeManager.peekTerminalMarker(agentName, sessionId);
-            if (terminal) {
-                const sealedRoot = sessionNodeManager.getSealedRootHex(agentName, sessionId);
-                // ⚠️ Unread messages are deliberately NOT handed over here, although that is the one place
-                // "every unread message" does not hold. A sealed conversation's leftover message is not live
-                // work: on 2026-08-05 an agent obeyed a [[STANDBY]] from a session that had ended. The
-                // operator is pointed at cello_transcript instead (DOD-TERMINAL-WAKE-1).
-                // AC3 covers "both outcomes" — got something / got nothing. This is the third exit from the
-                // same silent handler, and leaving it silent would reproduce the defect one branch over.
-                logger.info("session.receive.sealed", {
-                    sessionId, agentName, connectionId, attendance: attendanceCount(agentName),
-                    unreadCount: terminal.unreadCount, correlationId: receiveCorrelationId,
-                });
-                return {
-                    ok: true,
-                    type: "session_sealed",
-                    session_id: sessionId,
-                    ...(sealedRoot ? { sealed_root: sealedRoot } : {}),
-                    unread_count: terminal.unreadCount,
-                    attendance: attendingNow(agentName),
-                    // DOD-M15-REFUSED-INBOUND-SILENT-1: the LAST door, and without this it is a closed one.
-                    // This check runs FIRST in the loop, so once a session is sealed the quiet exit is
-                    // unreachable for it forever — and the guidance here sends the operator to
-                    // `cello_transcript`, which cannot show a message that was never ingested. The likely
-                    // sequence is exactly the bad one: skew, silence, the operator gives up and seals, and the
-                    // explanation becomes unreachable through every door they are pointed at.
-                    ...refusalsField(sessionNodeManager, agentName, sessionId, connectionId),
-                    guidance: terminal.unreadCount > 0
-                        ? `The session has been sealed by both parties. ${terminal.unreadCount} message(s) arrived that were not read live — call cello_transcript to retrieve the full sealed history. No further actions are required on this session.`
-                        : "The session has been sealed by both parties. The full history is available via cello_transcript. No further actions are required on this session.",
-                };
-            }
-            const unread = takeUnread();
-            if (unread)
-                return deliver(unread, receiveCorrelationId);
-            // 3) Out of time — non-blocking-equivalent empty answer.
-            const remaining = deadline - Date.now();
-            if (remaining <= 0) {
-                // ─── DOD-COATTEND-1 (review F2): a LOCAL failure must not wear the counterparty's label ───
-                //
-                // Content arrived, was verified and leafed, and its plaintext failed to reach the
-                // transcript. Since Tier 1 the transcript IS the delivery path, so that message can never
-                // be handed to any session. Every word of the empty answer below is wrong for this case:
-                // waiting cannot help, the transcript does not hold it, and "do not resend your last
-                // message" is aimed at the one party who could still fix it. Answer with the actual fault,
-                // above the branch that would otherwise substitute for it.
-                const undeliverable = sessionNodeManager.getUndeliverableSeqs(agentName, sessionId);
-                if (undeliverable.length > 0) {
-                    logger.error("session.receive.undeliverable", {
-                        sessionId, agentName, connectionId, sequences: undeliverable,
-                        attendance: attendanceCount(agentName), correlationId: receiveCorrelationId,
-                    });
-                    return {
-                        ok: true,
-                        count: 0,
-                        messages: [],
-                        reason: "content_undeliverable",
-                        attendance: attendingNow(agentName),
-                        // A local write failure and a refused message look identical from the operator's chair —
-                        // nothing arrived. Carrying the refusal here keeps the two distinguishable.
-                        ...refusalsField(sessionNodeManager, agentName, sessionId, connectionId),
-                        undeliverable_sequences: [...undeliverable],
-                        guidance: `${undeliverable.length} message(s) arrived but could not be written to the local transcript, so they cannot be delivered — this is a fault on THIS machine (check disk space and ~/.cello permissions; see transcript.message.record.failed in the daemon log), not a quiet counterparty. Do not wait: waiting cannot recover them. Ask the counterparty to resend once the local fault is fixed.`,
-                    };
-                }
-                const liveness = sessionNodeManager.getSessionLiveness(agentName, sessionId);
-                const attendance = attendanceCount(agentName);
-                // M8B F16: a dead session must not return the SAME null timeout as a
-                // quiet-but-healthy one. The liveness signal (session.liveness.changed → gone,
-                // tracked per session by the node manager) finally reaches the MCP surface here.
-                if (liveness === "gone") {
-                    logger.info("session.receive.empty", {
-                        sessionId, agentName, connectionId, timeoutMs, attendance,
-                        liveness, correlationId: receiveCorrelationId,
-                    });
-                    return {
-                        ok: true,
-                        count: 0,
-                        messages: [],
-                        attendance: attendingNow(agentName),
-                        // DOD-M15-NO-SILENT-REFUSAL-1 — the exit that does not merely stay silent, it MISLEADS.
-                        // A version-skewed peer never gets an ACK, so it eventually drops the direct path and
-                        // lands HERE, pre-empting the quiet exit. A wrong explanation plus an action is worse
-                        // than saying nothing at all.
-                        ...refusalsField(sessionNodeManager, agentName, sessionId, connectionId),
-                        reason: "counterparty_gone",
-                        liveness: "gone",
-                        /**
-                         * ⚠️ **NAMES WHAT WAS OBSERVED, AND `gone` IS A SMALLER FACT THAN IT SOUNDS.**
-                         *
-                         * The only thing that produced this state is `onPeerDisconnect` firing for the peer id
-                         * recorded as the counterparty's session peer — one libp2p connection went away. It
-                         * does not establish that they crashed, went offline, or left. The previous wording
-                         * said "it may have crashed or gone offline" and then told the operator to seal, which
-                         * is a network story for something that is very often a verification fault: a peer
-                         * whose messages this side keeps refusing is never acknowledged, drops the direct path,
-                         * and arrives here looking exactly like a crash.
-                         *
-                         * **And it must not lead with the seal.** A seal is irreversible and, taken on this
-                         * evidence, is precisely the truncated close DOD-M15-WITHHOLD-SEAL-1 exists to stop.
-                         * The refusals spread above are the thing to read first — when they are present they
-                         * ARE the reason, and none of them is fixed by sealing.
-                         */
-                        guidance: "The direct connection to the counterparty's session peer has dropped (liveness: gone). That is what was observed — it does not establish that they crashed or went offline. No more content will arrive on the direct path and a reply cannot reach them there. CHECK `refusals` — HERE IF PRESENT, AND IN cello_inbox EITHER WAY — BEFORE CONCLUDING ANYTHING: if this side has been refusing their messages, a refused sender is never acknowledged and eventually drops the connection, and that is a fault to fix rather than a counterparty who left. A refusal is shown once per window, so another window may already have taken it and this answer can be empty while the cause is real. Otherwise the ordinary causes are a restart, a network change, or them closing their agent — confirm out of band before concluding anything. Sealing with cello_close_session ENDS the conversation permanently and cannot be undone; do it when you have decided the conversation is over, not to clear this state. If you DO decide it is over and the counterparty never co-closes, a unilateral seal becomes available after the directory's delivery-grace window — that is the exit, not the first move.",
-                    };
-                }
-                // DOD-M12B-ACK-1: the same rule one step short of 'gone'. A session whose writes are
-                // failing looks EXACTLY like a quiet-but-healthy one from here — nothing arrives, and the
-                // old answer said "nothing arrived", so an operator waited. Measured 2026-08-17: one
-                // session reported healthy for 70 minutes while every message it sent was parking.
-                // Distinct from 'gone' on purpose: the connection is up, content may still arrive FROM
-                // them, and the session must not be steered toward a seal on this evidence.
-                if (liveness === "impaired") {
-                    const impairment = sessionNodeManager.getSessionImpairment(agentName, sessionId);
-                    logger.info("session.receive.empty", {
-                        sessionId, agentName, connectionId, timeoutMs, attendance,
-                        liveness, impairmentCause: impairment?.cause, impairmentRetained: impairment?.retained,
-                        correlationId: receiveCorrelationId,
-                    });
-                    // EVERY CLAUSE BELOW IS SOMETHING WE ACTUALLY KNOW. The first version of this branch
-                    // asserted that the message "was parked for the relay to hand over" and that the caller
-                    // must not resend — and both are false in real cases: a refused park whose durable
-                    // enqueue was dropped is GONE, and `cello_send` already told the caller to send it again.
-                    // A receive that contradicts that, later, while the agent is waiting, is worse than
-                    // silence. The failing write can also be an ACK we owed THEM, in which case the caller
-                    // sent nothing at all and has no last message to reason about.
-                    const what = impairment?.cause === "delivery_ack"
-                        ? "Our acknowledgement to the counterparty could not be sent (liveness: impaired) — this is about a receipt we owe them, not about anything you sent."
-                        // `029c` review F7: a content-key fault is LOCAL and the connection is fine. Saying "did
-                        // not reach the counterparty on the direct path" sends the operator to inspect a network
-                        // that is working, and to blame a peer who is not involved.
-                        : impairment?.cause === "content_key"
-                            ? "Your own last send could not be encrypted for this conversation, so it was never put on the wire (liveness: impaired). THIS IS A FAULT ON THIS MACHINE — the connection is fine and your counterparty is not involved."
-                            : "Your own last send did not reach the counterparty on the direct path (liveness: impaired).";
-                    const whatNext = impairment?.retained === "parked" ? " That message went to the relay to hand over instead — do NOT resend it: it is not lost, and a resend takes a second position in the record."
-                        : impairment?.retained === "durable" ? " That message is queued locally and will be re-sent automatically — do NOT resend it: an identical resend is not separately queued."
-                            : impairment?.retained === "lost" ? " That message could NOT be queued and is lost — send it again. (cello_send said the same when it failed.)"
-                                : "";
-                    return {
-                        ok: true,
-                        count: 0,
-                        messages: [],
-                        attendance: attendingNow(agentName),
-                        reason: "delivery_impaired",
-                        liveness: "impaired",
-                        // DOD-M15-REFUSED-INBOUND-SILENT-1, the item I filed POST-LAUNCH as "deferred, not
-                        // lost". Taken now instead: it was only safe to spread refusals into an exit once the
-                        // notice and its advice travel together (see `refusalsField`), and they do — so this
-                        // exit cannot carry the reason without also carrying what to do about it.
-                        ...refusalsField(sessionNodeManager, agentName, sessionId, connectionId),
-                        ...(impairment ? { impairment } : {}),
-                        guidance: `Nothing arrived. ${what}${whatNext} Their connection is still up, so content may still arrive and this can clear on its own — call cello_status for this session rather than assuming the counterparty is ignoring you.`,
-                    };
-                }
-                logger.info("session.receive.empty", {
-                    sessionId, agentName, connectionId, timeoutMs, attendance,
-                    liveness, correlationId: receiveCorrelationId,
-                });
-                // AC6: the QUIET answer carries it too. This is the exit a session with no doorbell to
-                // learn from is most likely to reach — it attached, found nothing waiting, and would
-                // otherwise have no way to know another window holds the same agent.
-                /**
-                 * DOD-M15-REFUSED-INBOUND-SILENT-1 — THE exit this line exists for.
-                 *
-                 * "I waited and nothing came" is the moment an operator concludes the other person stopped
-                 * replying. If messages ARE arriving and being refused, the reason is known, it is already
-                 * written to the log with impact and guidance, and this is the one place the person who
-                 * needs it is actually looking. Guidance below changes to match: telling someone to "call
-                 * again and keep waiting" while their peer's every message is being refused for a version
-                 * skew is advice that cannot work.
-                 */
-                const quietRefusals = refusalsField(sessionNodeManager, agentName, sessionId, connectionId);
-                return {
-                    ok: true,
-                    // The same shape as a read that found messages, so a caller reads `messages` either way.
-                    count: 0,
-                    messages: [],
-                    attendance: attendingNow(agentName),
-                    ...quietRefusals,
-                    // ONE source for the refusal advice (see `refusalsField`). It used to be written out
-                    // again here, which is how the batch exit came to carry the notice without it.
-                    // ONE source for the refusal advice (see `refusalsField`), and it is now the header for
-                    // the kinds actually present rather than one sentence that is false for most of them.
-                    guidance: quietRefusals.refusal_guidance !== undefined
-                        ? `No content arrived within timeout_ms. ${quietRefusals.refusal_guidance}`
-                        : "No content arrived within timeout_ms. Call cello_receive again to keep waiting — do not resend your last message. Or read cello_transcript for the full session history.",
-                };
-            }
-            await new Promise((r) => setTimeout(r, Math.min(20, remaining)));
-        }
-    };
-    handlers.set("cello_receive", handleReceive);
-}
-//# sourceMappingURL=session-content-handlers.js.map