@cello-protocol/daemon 0.0.225 → 0.0.227

package/dist/content-park.js

@@ -1,1309 +0,0 @@
-/**
- * The content park: relay store-and-forward, and recovery from it.
- *
- * When a counterparty is offline, content is PARKED on the relay — encrypted, so the relay never
- * sees plaintext — and pulled when they come back. autoRecoverForAgent is what runs on reconnect.
- *
- * TWO-PHASE ON PURPOSE, and this is the pattern that unblocks the rest of the daemon:
- *
- *   createContentPark(deps)      — constructed EARLY, because autoRecoverForAgent is called from
- *                                  BOOT-TIME paths (an agent's onConnected, and the seal upgrade's
- *                                  content gate) that run long before the IPC handler map exists.
- *   .registerHandlers(handlers)  — called LATER, once that map does exist.
- *
- * Fusing the two would force construction after the handler map, which puts autoRecoverForAgent in
- * the TEMPORAL DEAD ZONE for every boot-time caller — the daemon then dies at startup with "cannot
- * access before initialization". Separating construction from registration is what makes a module's
- * POSITION IN THE FILE stop mattering, which is the whole reason startDaemon could be taken apart.
- */
-// `createHash` is gone: the annex verifier's hardcoded `sha256(0x00 ‖ content)` became
-// `contentHashFor`, so this file no longer computes a content hash without asking which algorithm
-// the sender used (`DOD-M15-SEALWIRE-1` part B2a).
-import { randomUUID } from "node:crypto";
-import { ContentParkClient, ContentParkRefusedError, ContentParkUnreachableError } from "./content-park-client.js";
-import { extractErrorMessage } from "./error-message.js";
-// DOD-M15-DELIVERYACK-1 unit 1: the mailbox also carries acknowledgements of OUR messages, parked
-// because this daemon was down when the counterparty read one. Same five rules, other road.
-import { acceptParkedDeliveryAck } from "./session-delivery-acks.js";
-import { decodeParkEnvelope, sealParkEnvelope } from "./park-envelope.js";
-import { contentHashFor, resolveContentHashAlg, isKnownContentHashAlg, CONTENT_HASH_ALGS } from "./wire-content-hash.js";
-import { PARK_REFUSAL_REASONS, PARK_REFUSAL_NOTICE, TERMINAL_SESSION_STATUSES, } from "./park-refusals.js";
-export function createContentPark(deps) {
-    const { logger, sessionNodeManager, agents, getKeyProvider, securityGateway } = deps;
-    const newParkClient = deps.makeContentParkClient ?? ((o) => new ContentParkClient(o));
-    /**
-     * `041-PARKSTUCK` Unit 2 — **THE PARK DRAIN'S REFUSALS REACH A PERSON.**
-     *
-     * Every branch below already wrote a `reason`, an `impact` and a `guidance`, at ERROR, addressed
-     * to nobody: the drain runs unattended, its return value goes to an IPC caller that in production
-     * is `autoRecoverForAgent`, and that only tallies counts into a log line. So the operator's whole
-     * account of a message that never leaves the mailbox was the INGEST reason recorded one layer up
-     * — `session_committed`, which is where the message was turned away on arrival, not why it is
-     * stuck. Naming the exit point instead of the cause is the substitution this project's debugging
-     * discipline is written against, and pointed at an operator it is a dead end: there is no next
-     * hop, and `daemon.log` is not an affordance.
-     *
-     * ⚠️ **BOTH REASONS REACH THE INBOX, and neither replaces the other.** They answer different
-     * questions — one says the conversation is closed, this one says why the message cannot leave —
-     * and the notice store keys on (session, reason), so they sit side by side rather than
-     * overwriting.
-     */
-    /**
-     * ⚠️ **IT RETURNS THE REFUSAL RECORD, AND THAT IS THE ENFORCEMENT — review H3, second half.**
-     *
-     * The first version only wrote the notice, and the caller pushed its own `{ reason }` object
-     * separately. So a future branch could push a reason and forget to note it, and the enforcer
-     * could not see the difference: its scan asked only whether the reason NAME appeared somewhere in
-     * the file, which a bare `refusals.push({ reason })` satisfies on its own.
-     *
-     * Constructing the record HERE makes the pairing structural rather than remembered — the only way
-     * to get a park reason into the drain's refusal list is to have already told the operator about
-     * it. `dod-m15-inboxcause-1.test.ts` then has something it can actually check.
-     */
-    function noteParkRefusal(agentName, sessionId, contentHash, reason, ctx) {
-        // `noteContentRefusal` does not throw — a persistence failure logs and falls back to memory —
-        // so this needs no guard of its own, and adding one would hide the ERROR it already emits.
-        sessionNodeManager.noteContentRefusal(agentName, sessionId, reason, PARK_REFUSAL_NOTICE[reason](ctx));
-        return { contentHash, sessionId, reason };
-    }
-    // MSG-001-3b: content-park deposit/pull IPC handlers. These drive the daemon's
-    // ContentParkClient directly so the daemon↔relay store-and-forward transport can be
-    // proven (J-CONTENT increment 1) before the send/receive-path integration. The relay
-    // multiaddr (with /p2p/<peerId>) comes from the session assignment's relay endpoint;
-    // dials run from the standing receiver (open-gater) node.
-    /**
-     * ⚠️ THE `/p2p/` SEGMENT IS SHAPE-CHECKED — review HIGH-1.
-     *
-     * This used to accept whatever followed `/p2p/`, so a truncated or mistyped multiaddr became a
-     * "peer id" that only `newStream` rejected, four layers down, as `invalid_peer_id` — and the
-     * deposit then reported it as a relay that could not be REACHED. A payload fault wearing a
-     * network fault's name is the substitution this milestone is named for.
-     *
-     * This proves the segment is a plausible base58btc peer id, NOT that the peer exists — the
-     * multibase/multihash decode still happens in the transport, and `invalid_peer_id` is still
-     * mapped honestly below for anything this misses. It is defence in depth on the cheapest fault,
-     * not a replacement for the mapping.
-     */
-    const PEER_ID_SHAPE = /^(1[1-9A-HJ-NP-Za-km-z]{47,52}|Qm[1-9A-HJ-NP-Za-km-z]{44}|12D3Koo[1-9A-HJ-NP-Za-km-z]{45,50})$/;
-    const parseRelayPeer = (multiaddr) => {
-        if (!multiaddr)
-            return null;
-        // Up to the next `/`, so a CIRCUIT address (`…/p2p/<relay>/p2p-circuit/p2p/<target>`) yields the
-        // relay rather than `<relay>/p2p-circuit` — which the old form produced and only `newStream`
-        // ever rejected, four layers down, as an invalid peer id.
-        const peerId = multiaddr.split("/p2p/")[1]?.split("/")[0];
-        return peerId && PEER_ID_SHAPE.test(peerId) ? { peerId, addr: multiaddr } : null;
-    };
-    /**
-     * DOD-M15-PARKCONN-1 review HIGH-1 — **ONE STREAM FAILURE IS SIX FAULTS, AND ONLY TWO ARE ABOUT
-     * REACHING THE RELAY.**
-     *
-     * `#open` wraps every `newStream` rejection, because the dial evidence it collects is worth having
-     * on all of them. Labelling them all `relay_unreachable` is a different question, and getting it
-     * wrong reproduces the exact defect this unit exists to remove: `invalid_peer_id` is a MALFORMED
-     * ARGUMENT, `node_stopped` is THIS daemon's own transport, and `protocol_not_supported` means the
-     * connection worked and the relay does not speak content-park. Telling any of those three
-     * "the relay could not be reached — retry once it is up" sends the operator to the network for a
-     * fault that is not there, and the guidance is the half an operator actually reads.
-     *
-     * Reasons come from `core/transport/src/node.ts` (`newStream` + `mapStreamError`). An unknown one
-     * gets a neutral label rather than a reachability claim, because the default is where this class
-     * of defect hides.
-     */
-    const parkTransportFault = (reason, relayPeerId) => {
-        switch (reason) {
-            case "no_connection":
-            case "connection_lost":
-                return {
-                    reason: `relay_unreachable:${reason}`,
-                    guidance: `Relay ${relayPeerId} could not be reached from this daemon (${reason}), so nothing was deposited and no content was lost. ` +
-                        `Retry once the relay is up. A conversation cannot be moved to a different relay from here — the park relay comes from the ` +
-                        `session assignment — so if this relay stays down, broker a new session with cello_initiate_session.`,
-                };
-            case "invalid_peer_id":
-                return {
-                    reason: "relay_address_invalid",
-                    guidance: `The /p2p/ segment of the relayMultiaddr is not a usable peer id, so no relay was ever contacted. The relay is not at fault ` +
-                        `and retrying will not help. Pass the relay endpoint from the session assignment verbatim — a truncated paste is the usual cause.`,
-                };
-            case "node_stopped":
-                return {
-                    reason: "daemon_transport_stopped",
-                    guidance: `This daemon's own transport is stopped, so the relay was never asked. Nothing was deposited. This is local: restart the ` +
-                        `daemon, or start the agent with cello_start_agent if it was stopped deliberately.`,
-                };
-            case "protocol_not_supported":
-                return {
-                    reason: "relay_protocol_unsupported",
-                    guidance: `Relay ${relayPeerId} is CONNECTED and does not speak the content-park protocol — a version skew, not an outage. Retrying ` +
-                        `will not change it. Use a relay running a build that carries content-park, or update this one.`,
-                };
-            case "limited_connection_refused":
-                return {
-                    reason: "relay_limited_connection",
-                    guidance: `Relay ${relayPeerId} allowed only a limited (relayed) connection and refused a content-park stream on it. CELLO's own paths ` +
-                        `always permit limited connections, so this points at a defect on this side rather than at the relay; report it with the daemon log.`,
-                };
-            default:
-                return {
-                    reason: `park_stream_failed:${reason}`,
-                    guidance: `The content-park stream to relay ${relayPeerId} could not be opened (${reason}), and nothing was deposited. This daemon has no ` +
-                        `specific remedy for that reason — the dial detail below is the evidence to report.`,
-                };
-        }
-    };
-    /** The IPC refusal for a content-park stream that could not be opened, with the dial evidence. */
-    const parkTransportRefusal = (err) => {
-        const fault = parkTransportFault(err.reason, err.relayPeerId);
-        const dials = err.dialFailures.length > 0
-            ? ` Dials tried: ${err.dialFailures.map((f) => `${f.addr} → ${f.error}`).join("; ")}.`
-            : ` No dial was refused, so the connection existed a moment ago or was never attempted.`;
-        return {
-            ok: false,
-            reason: fault.reason,
-            guidance: fault.guidance + dials,
-            // DoD 1: recoverable from the RESPONSE as well as the log — this caller has no daemon log.
-            dialFailures: err.dialFailures,
-        };
-    };
-    // MSG-001-3b (increment 3): RECOVER parked content. Pulls the recipient's parked entries,
-    // decrypts each IN-DAEMON (openContentSeal — the relay never sees plaintext), and routes the
-    // plaintext through ingestReceivedContent — the SAME inbound chokepoint as a direct receive
-    // (M9 single-funnel AC). The content completes the recipient's transcript view of an already-
-    // witnessed message so it can be read (cello_receive) and the session bilaterally sealed
-    // (DOD-INT-2). This is content-completion, NOT a resumption — the session stays interrupted.
-    // DOD-MSG-4: pull a recipient agent's parked mailbox from ONE relay and recover each entry through
-    // the inbound funnel (decode envelope → verify+order the signed Structure2 → ingest). Shared by the
-    // explicit IPC handler and the auto-recover-on-reconnect trigger below.
-    async function recoverParkedFromRelay(recipientAgent, relayPeerId, relayAddrs) {
-        const kp = getKeyProvider(recipientAgent.name);
-        if (!kp)
-            return { ok: false, reason: "signing_key_unavailable" };
-        if (!kp.openContentSeal)
-            return { ok: false, reason: "cannot_unseal" };
-        const node = sessionNodeManager.getStandingReceiverNode();
-        // Name the CAUSE, not the exit point (review F6): one label stood for "still building",
-        // "agent never came online", "shutting down" and "none exists", and it is the label that
-        // misdescribed this incident 102 times.
-        if (!node)
-            return { ok: false, reason: sessionNodeManager.standingReceiverAbsenceReason(recipientAgent.name) };
-        const recipientPubkey = recipientAgent.pubkey ?? "";
-        const client = newParkClient({ relayPeerId, relayAddrs, logger });
-        let entries;
-        try {
-            entries = await client.pull(node, Buffer.from(recipientPubkey, "hex"), kp);
-        }
-        catch (err) {
-            /**
-             * DOD-M15-RELAYAUTH-1 review HIGH-3 — a REFUSAL is not an empty mailbox, and the distinction
-             * is the whole point of this branch. Falling through with `[]` would report
-             * `{ok:true, pulled:0, recovered:0}` — "nothing was waiting for you" — for a relay that
-             * explicitly said it would not release this agent's content. Same defect shape as the
-             * refused-entry comment directly below, one layer further out.
-             */
-            if (err instanceof ContentParkRefusedError) {
-                logger.warn("content.recover.refused", { agentName: recipientAgent.name, relayPeerId, reason: err.reason });
-                return { ok: false, reason: `relay_refused_pull:${err.reason}` };
-            }
-            /**
-             * Review MEDIUM-2 — the transport wrap reaches here too, and rethrowing it made
-             * `content_park_recover` answer `internal_error` / "An unexpected error occurred" for a relay
-             * that is simply down. `content_park_recover` is one of the three failures this order was
-             * written from, so this is the live path, not a hypothetical.
-             */
-            if (err instanceof ContentParkUnreachableError) {
-                const refusal = parkTransportRefusal(err);
-                return { ok: false, reason: refusal.reason, guidance: refusal.guidance };
-            }
-            throw err;
-        }
-        let recovered = 0;
-        // SEC-1 / review M2: a REFUSED entry must not vanish behind `ok:true`. Report it — an operator
-        // seeing {ok:true, pulled:3, recovered:0} would otherwise have three messages evaporate with the
-        // only explanation buried in the daemon log. This is both the injection signal and, given the
-        // deliberate no-tolerant-window rollout, the lagging-peer signal.
-        const refusals = [];
-        // AC7: one correlationId per recover flow, threaded through every event it emits.
-        const correlationId = randomUUID();
-        for (const e of entries) {
-            const unsealed = await kp.openContentSeal(e.ciphertext);
-            if (!unsealed) {
-                logger.warn("content.recover.unseal_failed", { sessionId: e.sessionIdHex, contentHash: e.contentHashHex });
-                continue;
-            }
-            // SEC-1: authenticate THEN ingest — fused in recoverParkedEntry, which is now the ONLY way
-            // parked content can enter the transcript. It verifies the sender's signature over
-            // (session_id, recipient_pubkey, content_hash) and that the signer is this session's
-            // counterparty, and it still verifies + records the DOD-MSG-4 ordering record when present.
-            // Relay deposit is unauthenticated and the seal is anonymous, so WITHOUT this gate anyone
-            // holding the recipient's public key — the relay above all — could inject content that gets
-            // attributed to the honest counterparty and then notarized by the bilateral seal.
-            const contentHashBytes = Buffer.from(e.contentHashHex, "hex");
-            const ingest = await sessionNodeManager.recoverParkedEntry(recipientAgent.name, e.sessionIdHex, Buffer.from(recipientPubkey, "hex"), unsealed, contentHashBytes, correlationId);
-            /**
-             * DOD-M15-DELIVERYACK-1 unit 1 — THE ENTRY WAS AN ACKNOWLEDGEMENT OF ONE OF OUR MESSAGES.
-             *
-             * The counterparty read something we sent while this daemon was DOWN, could not reach us
-             * directly, and left the signed acknowledgement here. It is not content: it appends no leaf,
-             * enters no transcript, and is not counted as a recovered message — counting it would report
-             * mail this operator never received.
-             *
-             * The envelope gate inside `recoverParkedEntry` has already proved the depositor is this
-             * session's counterparty. `acceptParkedDeliveryAck` runs the SECOND, independent check — the
-             * acknowledgement's own signature, against the key the SESSION recorded — plus the same bind
-             * and the same idempotence the live route uses. Two different keys, two different questions,
-             * and both must pass.
-             *
-             * CONFIRM-DELETE ONLY ON ACCEPTANCE, the same rule content follows: a refused entry is left in
-             * the mailbox so a forgery cannot evict itself, and so a transient local fault (no database,
-             * a failed write) does not destroy evidence we could have kept on the next drain.
-             */
-            if (ingest.ok && "deliveryAck" in ingest) {
-                /**
-                 * WRAPPED, because a LOCAL fault here must not cost the rest of the drain — review F3.
-                 *
-                 * `getDb()` and `resolveAgentId()` both throw, and an escape from this loop takes every
-                 * REMAINING entry with it, messages included, unread, reported to the caller as a generic
-                 * internal error. The content path never had this shape because `recoverParkedEntry` owns
-                 * its own failures. The entry is left in the mailbox, so the next drain retries it.
-                 */
-                let accepted;
-                try {
-                    accepted = acceptParkedDeliveryAck({
-                        db: sessionNodeManager.getDb(),
-                        logger,
-                        agentId: sessionNodeManager.resolveAgentId(recipientAgent.name),
-                        agentName: recipientAgent.name,
-                        sessionId: e.sessionIdHex,
-                        mailboxSlotHex: e.contentHashHex,
-                        counterpartyPubkeyHex: sessionNodeManager.getSessionRecord(recipientAgent.name, e.sessionIdHex)?.counterparty_pubkey,
-                        ack: ingest.deliveryAck,
-                        correlationId,
-                    });
-                }
-                catch (err) {
-                    logger.error("content.delivery.ack.parked.accept_failed", {
-                        agentName: recipientAgent.name, sessionId: e.sessionIdHex, correlationId,
-                        error: extractErrorMessage(err),
-                        impact: "a local fault stopped this side storing an acknowledgement it had already recovered. " +
-                            "The entry stays in the mailbox and the next drain retries it; the rest of the " +
-                            "mailbox, messages included, is still drained",
-                    });
-                    continue;
-                }
-                if (accepted.ok) {
-                    try {
-                        await client.confirm(node, Buffer.from(recipientPubkey, "hex"), contentHashBytes, kp);
-                    }
-                    catch (err) {
-                        // The proof is stored; failing to clear the mailbox slot costs one redundant drain,
-                        // which the stored row then absorbs. Never a reason to report the recovery as failed.
-                        logger.warn("content.park.confirm.failed", {
-                            sessionId: e.sessionIdHex, contentHash: e.contentHashHex,
-                            entryKind: "delivery_ack", error: extractErrorMessage(err),
-                        });
-                    }
-                }
-                /**
-                 * ⚠️ A REFUSED ACKNOWLEDGEMENT IS NOT ADDED TO `refusals`, AND THE STRUCTURAL GUARD IN
-                 * `dod-m15-inboxcause-1` IS WHAT CAUGHT ME PUTTING IT THERE.
-                 *
-                 * That list is mail the operator did not receive, and every entry in it raises a notice
-                 * telling them so. An acknowledgement is not mail: nothing of theirs is missing, nobody is
-                 * waiting on it, and the notice would read as an accusation about the counterparty — which
-                 * is the single inference this unit forbids. It is logged (inside `acceptParkedDeliveryAck`)
-                 * and left in the mailbox unconfirmed, exactly as a refused message is, so a forgery cannot
-                 * evict itself and a local fault can be retried on the next drain.
-                 */
-                continue;
-            }
-            if (ingest.ok && ingest.held) {
-                // DOD-MSG-4 (review finding #4): a held entry is NOT yet an appended leaf — its sequence is
-                // the FUTURE canonical index, not a completed recovery. Do not count it as recovered; log it
-                // distinctly so the tally reflects leaves actually written, not content still queued in memory.
-                logger.info("content.recover.held", { sessionId: e.sessionIdHex, contentHash: e.contentHashHex, canonicalSeq: ingest.sequenceNumber });
-            }
-            else if (ingest.ok && ingest.screenedOut) {
-                // M9 (code-review LOW-3): a terminal-screened recovered entry IS durably leafed (so it must be
-                // confirm-deleted, below) but was NEVER delivered to the agent — do not count it as a delivered
-                // recovery, and log it distinctly so observability separates "delivered" from "leafed-but-screened".
-                logger.info("content.recover.screened_out", { sessionId: e.sessionIdHex, contentHash: e.contentHashHex, sequenceNumber: ingest.sequenceNumber });
-                try {
-                    await client.confirm(node, Buffer.from(recipientPubkey, "hex"), contentHashBytes, kp);
-                }
-                catch (err) {
-                    logger.warn("content.recover.confirm.failed", { sessionId: e.sessionIdHex, contentHash: e.contentHashHex, error: extractErrorMessage(err) });
-                }
-            }
-            else if (ingest.ok) {
-                // DOD-MSG-4 (review #3): count leaves ACTUALLY written — the directly-ingested leaf PLUS any
-                // held out-of-order entries this ingest unblocked (appendedCount), not just 1.
-                recovered += ingest.appendedCount ?? 1;
-                logger.info("content.recovered", { sessionId: e.sessionIdHex, contentHash: e.contentHashHex, sequenceNumber: ingest.sequenceNumber });
-                // Delete-on-confirm (review #1): the entry is now durably ingested (a fresh leaf, or a dedup
-                // of one already present), so confirm-delete it from the relay mailbox. The relay is
-                // delete-on-CONFIRM, not delete-on-pull — without this the queue never drains and every
-                // reconnect re-pulls the whole history. Held entries are deliberately NOT confirmed (not yet
-                // durable). Best-effort: a failed confirm leaves the entry to be re-pulled + deduped next time.
-                try {
-                    await client.confirm(node, Buffer.from(recipientPubkey, "hex"), contentHashBytes, kp);
-                }
-                catch (err) {
-                    logger.warn("content.recover.confirm.failed", { sessionId: e.sessionIdHex, contentHash: e.contentHashHex, error: extractErrorMessage(err) });
-                }
-            }
-            else if (ingest.reason === "session_committed") {
-                // M12-P17: the session ENDED before this arrived. It can never join that chain — appending
-                // would change `sealed_root` and invalidate the notarization — but it is VERIFIED content
-                // (SEC-1 authenticated it above; that is what separates this branch from the one below), and
-                // discarding it silently loses a real message the operator was actually sent.
-                //
-                // Without this branch the entry is refused and never confirm-deleted, so every drain pulls,
-                // verifies and refuses it again — measured at ~120 repeats per message, forever, while the
-                // operator never sees it once. Noisy invisible loss.
-                //
-                // ORDER IS LOAD-BEARING: annex FIRST, confirm-delete SECOND, and only if the annex committed.
-                // A crash between them must lose nothing. Reversed, or delete-on-best-effort, converts the
-                // loop into PERMANENT SILENT loss — strictly worse than the bug.
-                // Review F1: annex `env.content`, NOT `unsealed`. `unsealed` is the whole CBOR park envelope
-                // — every other consumer decodes it first (recoverParkedEntry does exactly this before
-                // ingesting). Storing the envelope and then deleting the relay copy on the strength of it
-                // would leave the operator an unreadable blob as the ONLY surviving copy: the loop stops,
-                // the message is still never read, and now nothing else holds it. That is the permanent
-                // silent loss the ordering above exists to prevent, arriving one line earlier.
-                //
-                // Review F5: the hash cross-check has to happen HERE too. `parkSig` covers
-                // (session_id, recipient_pubkey, content_hash) — it does NOT cover the envelope's `content`
-                // field, and this branch returns before `ingestReceivedContent`'s own check. Without it a
-                // relay holding the ciphertext could substitute content under a genuine hash, have it
-                // annexed, and have the real copy confirm-deleted. It also makes INSERT OR IGNORE sound:
-                // identical hash now genuinely means identical bytes.
-                // All three verdict branches below are covered by m12-p17-annex-screening.test.ts, driven
-                // through this real function with an injected park client and REAL sealed envelopes. The one
-                // that matters is TRANSIENT: collapsing it into the terminal branch would delete a good
-                // message because the screener was momentarily down — permanent loss caused by an outage.
-                // That exact confusion was injected and the test goes red on it.
-                let annexed = false;
-                let screenedOut = false;
-                /**
-                 * Did the terminal-screen branch actually KEEP the bytes? — verification NEW-2, which is
-                 * H1's defect one branch over and in the code H1 was written for.
-                 *
-                 * `quarantineRefusedInbound` answers `null` on the same four reachable paths, and this
-                 * branch confirm-deleted the relay copy regardless while its notice said "It is KEPT as
-                 * evidence" unconditionally. Declared out here rather than inside the `try` so the delete
-                 * and the notice can both read it.
-                 */
-                let screenRetained = false;
-                let screenDeferred = false;
-                /**
-                 * WHY the entry is stuck, for the caller — review B2a F5.
-                 *
-                 * Every non-annexing branch fell through to one `annex_write_failed`, at the very line whose
-                 * comment forbids exactly this: *"name why the entry is STUCK, not why ingest refused it."*
-                 * The annex write was never attempted in any of these cases. Four distinct causes shared a
-                 * label that named none of them, and the pre-existing hash-mismatch branch — a genuine
-                 * tamper — was one of the four.
-                 */
-                let annexRefusal = null;
-                /** The thrown message, carried into the operator's notice rather than left in the log. */
-                let annexErrorDetail = null;
-                /**
-                 * `041-PARKSTUCK` — CAN THIS EVER BE CHECKED AGAIN, or is the answer fixed for the rest of
-                 * time? Two different states, and only one of them is worth retrying.
-                 *
-                 * The status is read HERE rather than inferred from `ingest.reason`, because
-                 * `session_committed` covers THREE statuses and one of them — `seal_interrupted_pending` —
-                 * is documented as explicitly non-terminal. Collapsing them would release a message on a
-                 * session still moving toward a notarization.
-                 *
-                 * `null` when the record cannot be read, and that is NOT treated as terminal: an
-                 * unreadable record is "we do not know", and releasing on it would delete the only
-                 * surviving copy of a message on an assumption. Fail-closed costs another drain.
-                 */
-                const sessionRecord = sessionNodeManager.getSessionRecord(recipientAgent.name, e.sessionIdHex);
-                const sessionStatus = sessionRecord?.status ?? null;
-                const sessionTerminal = sessionStatus !== null && TERMINAL_SESSION_STATUSES.has(sessionStatus);
-                let saltReason = null;
-                let declaredAlgSeen = "(absent)";
-                /**
-                 * ⚠️ **WHICH STEP THREW — review M4, and without it one label spoke for four.**
-                 *
-                 * The `try` below opens at the decode and does not close until after the screen, the
-                 * quarantine and the annex write, so a throw from ANY of them was reported as
-                 * `annex_decode_failed`. This unit then promoted that label to an operator notice asserting
-                 * *"a wire or version difference, not a claim about the sender"* and sending them to a log
-                 * event that had not fired. It also contradicted the sibling comment below, which promises
-                 * `annex_write_failed` is *"only what it says — the annex write ran and failed"*.
-                 *
-                 * And the mislabel is the common case, not the rare one: `decodeParkEnvelope` already
-                 * succeeded on these exact bytes in `recoverParkedEntry` before ingest returned
-                 * `session_committed`, so a genuine decode failure here is close to unreachable.
-                 */
-                let decoded = false;
-                try {
-                    const env = decodeParkEnvelope(unsealed);
-                    decoded = true;
-                    /**
-                     * ⚠️ THE SECOND CONTENT-HASH VERIFIER — `DOD-M15-SEALWIRE-1` part B1 review F3, closed by
-                     * part B2a.
-                     *
-                     * This check exists on its own (review F5: `parkSig` does not cover `env.content`, and
-                     * this branch returns before `ingestReceivedContent`'s own cross-check ever runs), so it
-                     * is NOT covered by B1's discriminator. Correct today and provably so — **no sender salts
-                     * in this build**, so every parked entry in existence was hashed `sha256(0x00 ‖ content)`.
-                     *
-                     * ✅ FIXED IN PART B2a. The envelope carries the algorithm from v3 onward and this check
-                     * now runs under it, so the re-pull loop it would otherwise have caused — refuse, keep the
-                     * relay copy, pull again, refuse again — cannot happen. The other site is
-                     * `session-node-manager.ts`'s `recoverParkedEntry`; both were changed together, because
-                     * fixing one and leaving the other is how this defect was created.
-                     */
-                    /**
-                     * TWO CAUSES, TWO REFUSALS — review B2a F2, and the first version collapsed them.
-                     *
-                     * "We cannot read the algorithm name" and "we hold no salt" are structurally different and
-                     * they send the operator to different places. One guidance string served both, and for the
-                     * salt case both halves of it were wrong: the counterparty's version is irrelevant, and
-                     * *"delivered once this daemon can verify it"* is a promise this daemon cannot keep — the
-                     * salt row is not coming back, so the entry loops on every drain forever.
-                     *
-                     * The DIRECT path already splits these (`content_hash_alg_unknown` vs
-                     * `content_hash_salt_unavailable`, B1 review F6). Collapsing them here undid, on the park
-                     * route, a distinction already paid for on the other one.
-                     *
-                     * It is not an edge case: `DOD-M15-SEALWIRE-1`'s own pass-1 F9 records that a park-only
-                     * session never agrees a salt, because the announcement hangs off `onPeerConnect`. So a
-                     * null salt is the DEFAULT for exactly the sessions whose content arrives this way.
-                     */
-                    const alg = resolveContentHashAlg(env.contentHashAlg);
-                    declaredAlgSeen = env.contentHashAlg ?? "(absent)";
-                    /**
-                     * `getSessionContentSaltState`, NOT `getSessionContentSalt` — `041-PARKSTUCK` Unit 2.
-                     *
-                     * A bare `null` answers "no salt was ever agreed" and "a salt row is here and this
-                     * machine cannot read it" identically, and those send the operator to opposite places:
-                     * one to the conversation, the other to their own disk. The hashing path is unchanged —
-                     * this reads the same salt through the same method, and only the REASON is new.
-                     */
-                    const saltState = alg.ok
-                        ? sessionNodeManager.getSessionContentSaltState(recipientAgent.name, e.sessionIdHex)
-                        : null;
-                    const sessionSalt = saltState?.salt ?? null;
-                    if (saltState !== null && saltState.salt === null)
-                        saltReason = saltState.reason;
-                    let computed = null;
-                    // Discriminated BEFORE the call rather than recovered from a thrown string, so the two
-                    // causes are branches rather than message-matching.
-                    let algFailure = null;
-                    if (!alg.ok) {
-                        // A name this build cannot read. NOT a hash mismatch: there is no value to compare
-                        // against, and reporting it as one would be a tamper claim for a version difference —
-                        // the same substitution `DOD-M15-SEALWIRE-1` part B1 removed on the direct path.
-                        algFailure = { reason: PARK_REFUSAL_REASONS.ANNEX_ALG_UNKNOWN, detail: `the sender named "${alg.value}"` };
-                    }
-                    else if (alg.alg !== CONTENT_HASH_ALGS.SHA256 && !sessionSalt) {
-                        algFailure = {
-                            reason: PARK_REFUSAL_REASONS.ANNEX_SALT_UNAVAILABLE,
-                            detail: `the sender used ${alg.alg} and this side holds no salt for the session (${saltReason ?? "unknown"})`,
-                        };
-                    }
-                    else {
-                        try {
-                            computed = contentHashFor(env.content, {
-                                alg: alg.alg,
-                                // OUR salt for the session. The envelope never carries one and could not be trusted
-                                // if it did — the salt is the shared secret that makes the hash unguessable.
-                                salt: sessionSalt,
-                            });
-                        }
-                        catch (err) {
-                            // Unreachable given the two checks above; kept so a future algorithm that throws for a
-                            // third reason cannot fall through into the mismatch branch and be called a tamper.
-                            algFailure = { reason: PARK_REFUSAL_REASONS.ANNEX_ALG_UNKNOWN, detail: extractErrorMessage(err) };
-                        }
-                    }
-                    if (algFailure !== null) {
-                        annexRefusal = algFailure.reason;
-                        logger.error(algFailure.reason === PARK_REFUSAL_REASONS.ANNEX_SALT_UNAVAILABLE
-                            ? "content.recover.annex.salt_unavailable"
-                            : "content.recover.annex.alg_unknown", {
-                            sessionId: e.sessionIdHex, contentHash: e.contentHashHex, agentName: recipientAgent.name,
-                            declaredAlg: env.contentHashAlg ?? "(absent)",
-                            detail: algFailure.detail,
-                            sessionStatus: sessionStatus ?? "(unreadable)",
-                            impact: "this parked message could not be CHECKED — not that it failed a check. It was not annexed. Nothing here says the sender did anything wrong.",
-                            guidance: algFailure.reason === PARK_REFUSAL_REASONS.ANNEX_SALT_UNAVAILABLE
-                                // Lifted from the direct path's equivalent, because the operator needs the same
-                                // answer wherever the message arrived. Deliberately does NOT promise delivery:
-                                // without the salt this entry cannot be verified on any future drain either.
-                                // DOD-M15-SALTSPLIT-1 review MEDIUM-3: "never completed" is now one of TWO ways to
-                                // hold no salt. The discard undoes an agreement that DID complete, so an operator
-                                // reading the old sentence would look for a failure that never happened.
-                                //
-                                // ⚠️ **THE LAST SENTENCE USED TO BE "close it and start a new one" — `041-PARKSTUCK`.**
-                                // It ran 731 times over 64 hours against a session that was ALREADY closed, and
-                                // closing it is what made the refusal permanent: the ingest side then refuses
-                                // `session_committed` on every drain. Naming an action the reader took three days
-                                // ago is worse than saying nothing. What replaces it branches on the status,
-                                // which this line has always had and never read.
-                                ? `This side holds no salt for the session, for one of two reasons. If session.salt.discarded is in the log, the agreement completed and this side then dropped its salt on purpose because the counterparty said it could never hold one. Otherwise the agreement never completed — look for session.salt.read.failed or session.salt.persist.failed. Either way their build is NOT the problem; do not ask them to upgrade. ${sessionTerminal
-                                    ? `This session is "${sessionStatus}" and cannot agree a salt ever again, so this message can never be checked — the relay copy is being released so it stops being re-pulled.`
-                                    : "This message stays on the relay and is re-checked on every drain; a salt is agreed while both sides are connected, so staying connected is what clears it."}`
-                                : "Their CELLO build is newer than this one: ask which version they run, and upgrade. The message stays on the relay and is delivered once this daemon can read that algorithm.",
-                            correlationId,
-                        });
-                    }
-                    else if (Buffer.from(computed).toString("hex") !== e.contentHashHex) {
-                        annexRefusal = PARK_REFUSAL_REASONS.ANNEX_HASH_MISMATCH;
-                        logger.error("content.recover.annex.hash_mismatch", {
-                            sessionId: e.sessionIdHex, contentHash: e.contentHashHex, agentName: recipientAgent.name,
-                            // The algorithm the comparison RAN UNDER. Without it a mismatch is unfalsifiable from
-                            // the log: "the bytes were altered" and "we checked it the wrong way" look identical.
-                            declaredAlg: env.contentHashAlg ?? "(absent → sha256)",
-                            impact: "content does not match its attested hash — NOT annexed, relay copy kept",
-                            correlationId,
-                        });
-                    }
-                    else {
-                        // M12-P17 (review F4): screen before storing. Same terminal-vs-transient split the live
-                        // inbound funnel uses, because the consequences are the same shape.
-                        const verdict = await securityGateway.screenInbound(env.content, {
-                            direction: "inbound", agentName: recipientAgent.name, sessionId: e.sessionIdHex, correlationId,
-                        });
-                        const terminalBlock = verdict.disposition === "block" && verdict.terminal === true;
-                        if (verdict.disposition !== "allow" && verdict.disposition !== "redact" && !terminalBlock) {
-                            // TRANSIENT (gateway down / timeout): keep the relay copy and re-screen next drain.
-                            // Fail-closed — never store unscreened content because the screen was unreachable.
-                            logger.warn("content.recover.annex.screen_unavailable", {
-                                sessionId: e.sessionIdHex, contentHash: e.contentHashHex,
-                                disposition: verdict.disposition, correlationId,
-                            });
-                            screenDeferred = true;
-                        }
-                        else if (terminalBlock) {
-                            /**
-                             * TERMINAL: the detector rejected the CONTENT itself, so identical bytes would be
-                             * rejected identically forever — leaving it on the relay would restore the re-pull
-                             * loop this drain exists to end. It is still dropped from the relay and still never
-                             * annexed (the annex is a READABLE record of the conversation, and this was never part
-                             * of it).
-                             *
-                             * ⚠️ **BUT IT IS NO LONGER DISCARDED — review F6.** This comment used to end *"and do
-                             * NOT store it"*, and that was the last route in the tree that threw a refused message
-                             * away. `DOD-M15-REFUSEDEVIDENCE-1` retains every other one, and shipped guidance now
-                             * tells operators that refused messages are kept — so this branch falsified a promise
-                             * on the case with the most evidence value in the product: hostile bytes aimed at a
-                             * conversation that has already been sealed.
-                             *
-                             * Quarantined, not annexed. The two are different answers to different questions: the
-                             * annex is what arrived late and is readable, quarantine is what was refused and is
-                             * withheld. Bounded by the same tier cap and deduped by content, so the loop stays
-                             * closed.
-                             */
-                            const kept = sessionNodeManager.quarantineRefusedInbound(recipientAgent.name, e.sessionIdHex, verdict.reason ?? "inbound_screen_blocked", env.content, e.contentHashHex, env.senderPubkey ? Buffer.from(env.senderPubkey).toString("hex") : null, correlationId);
-                            screenRetained = kept !== null;
-                            logger.warn("content.recover.annex.screened_out", {
-                                sessionId: e.sessionIdHex, contentHash: e.contentHashHex, agentName: recipientAgent.name,
-                                retained: kept !== null,
-                                impact: kept !== null
-                                    ? "content was terminally blocked by the inbound screen — NOT annexed, and RETAINED as quarantined evidence"
-                                    : "content was terminally blocked by the inbound screen and could NOT be retained — see session.content.quarantine.skipped or .failed",
-                                correlationId,
-                            });
-                            screenedOut = true;
-                        }
-                        else {
-                            // A redact verdict stores the ALTERED bytes, exactly as the live path delivers them.
-                            // Those no longer match `content_hash`, which is correct here: the annex is a readable
-                            // record, not chain content, and the hash column stays the entry's relay identity.
-                            const body = verdict.disposition === "redact" && verdict.content !== undefined
-                                ? new Uint8Array(verdict.content)
-                                : env.content;
-                            annexed = sessionNodeManager.recordSealedAnnex(recipientAgent.name, e.sessionIdHex, e.contentHashHex, body, env.senderPubkey ? Buffer.from(env.senderPubkey).toString("hex") : null);
-                        }
-                    }
-                }
-                catch (err) {
-                    annexRefusal = decoded
-                        ? PARK_REFUSAL_REASONS.ANNEX_WRITE_FAILED
-                        : PARK_REFUSAL_REASONS.ANNEX_DECODE_FAILED;
-                    annexErrorDetail = extractErrorMessage(err);
-                    logger.error(decoded ? "content.recover.annex.write_failed" : "content.recover.annex.decode_failed", {
-                        sessionId: e.sessionIdHex, contentHash: e.contentHashHex,
-                        impact: decoded
-                            ? "the envelope decoded and a later step threw — screening, retention or the annex write. NOT annexed, relay copy kept."
-                            : "envelope could not be decoded — NOT annexed, relay copy kept",
-                        error: annexErrorDetail, correlationId,
-                    });
-                }
-                if (annexed) {
-                    // Review F6: named under `content.recover.*` like its five siblings in this loop, so a
-                    // grep for the recovery family does not miss the one branch you most want to count.
-                    logger.info("content.recover.annexed", {
-                        sessionId: e.sessionIdHex, contentHash: e.contentHashHex, agentName: recipientAgent.name,
-                        reason: "session_committed", correlationId,
-                    });
-                    try {
-                        await client.confirm(node, Buffer.from(recipientPubkey, "hex"), contentHashBytes, kp);
-                    }
-                    catch (err) {
-                        // The annex holds it, so the message is safe; the relay copy simply gets re-pulled and
-                        // deduped by the INSERT OR IGNORE next time. Not data loss.
-                        logger.warn("content.recover.confirm.failed", { sessionId: e.sessionIdHex, contentHash: e.contentHashHex, error: extractErrorMessage(err) });
-                    }
-                }
-                else if (screenedOut) {
-                    /**
-                     * Terminal block: identical bytes are rejected identically forever, so the relay copy goes
-                     * or the re-pull loop returns.
-                     *
-                     * ⚠️ **AND ONLY IF THE BYTES WERE ACTUALLY KEPT — verification NEW-2.** This deleted
-                     * unconditionally while asserting "retained as quarantined evidence above", which is H1's
-                     * defect reproduced in the branch H1 was written for. Screener-blocked content aimed at a
-                     * closed conversation is the highest-value evidence in the product; losing it because the
-                     * quarantine was full is the one outcome worse than it arriving again.
-                     */
-                    let screenReleased = false;
-                    if (screenRetained) {
-                        try {
-                            await client.confirm(node, Buffer.from(recipientPubkey, "hex"), contentHashBytes, kp);
-                            screenReleased = true;
-                        }
-                        catch (err) {
-                            logger.warn("content.recover.confirm.failed", { sessionId: e.sessionIdHex, contentHash: e.contentHashHex, error: extractErrorMessage(err) });
-                        }
-                    }
-                    else {
-                        logger.warn("content.recover.release.withheld", {
-                            sessionId: e.sessionIdHex, contentHash: e.contentHashHex, agentName: recipientAgent.name,
-                            reason: PARK_REFUSAL_REASONS.ANNEX_SCREENED_OUT,
-                            impact: "screener-blocked content could NOT be retained locally — see session.content.quarantine.skipped or .failed above — so the relay copy is KEPT rather than deleted. It will arrive and be blocked again, which is the lesser harm: deleting it would destroy the only record that this was ever sent.",
-                            guidance: "Free space for this conversation and the copy is retained on a later drain. cello_quarantined shows what it is already holding.",
-                            correlationId,
-                        });
-                    }
-                    /**
-                     * ⚠️ **THIS BRANCH TOLD THE OPERATOR NOTHING — review M9.**
-                     *
-                     * It is the only park branch that DELETES the relay's copy on purpose, and it is the one
-                     * with the strongest claim on an operator's attention: content rejected outright by the
-                     * screener, aimed at a conversation that has already closed. Its `impact` field was
-                     * written for a person and read by nobody, which is the pattern this whole unit exists to
-                     * end — and leaving it here while fixing the neighbouring branches would have been the
-                     * class fixed one instance at a time.
-                     *
-                     * Deliberately NOT pushed into `refusals`: that list is what the drain reports as STUCK,
-                     * and this entry is resolved — retained, and gone from the relay. The operator surface is
-                     * the part that was missing, not the stuck-list entry.
-                     */
-                    noteParkRefusal(recipientAgent.name, e.sessionIdHex, e.contentHashHex, PARK_REFUSAL_REASONS.ANNEX_SCREENED_OUT, { sessionStatus, released: screenReleased, retained: screenRetained, declaredAlg: declaredAlgSeen, saltReason, errorDetail: null });
-                }
-                else if (screenDeferred) {
-                    refusals.push(noteParkRefusal(recipientAgent.name, e.sessionIdHex, e.contentHashHex, PARK_REFUSAL_REASONS.ANNEX_SCREEN_UNAVAILABLE, { sessionStatus, released: false, declaredAlg: declaredAlgSeen, saltReason, errorDetail: null }));
-                }
-                else {
-                    // Keep the relay copy — it is now the only one. Review F7: name why the entry is STUCK,
-                    // not why ingest refused it. `annexRefusal` carries the branch that actually stopped it;
-                    // the bare `annex_write_failed` fallback is now only what it says — the annex write ran
-                    // and failed.
-                    const stuckReason = annexRefusal ?? PARK_REFUSAL_REASONS.ANNEX_WRITE_FAILED;
-                    /**
-                     * ─── `041-PARKSTUCK` Unit 1: THE EXIT THE SAFETY RULE DID NOT HAVE ────────────────────
-                     *
-                     * *"Never drop a message we could not verify"* is right, and it had no case for
-                     * verification being IMPOSSIBLE FOR THE REST OF TIME rather than merely failing now.
-                     * Every input to this decision is then immutable and the code re-derives the same answer
-                     * forever: measured at 731 refusals in 64 hours on one message, roughly one every five
-                     * minutes, with the operator never shown it once.
-                     *
-                     * All three conditions must hold, and the middle one is why this cannot widen:
-                     *   1. the session is TERMINAL (`sealed` / `abandoned`) — no salt can ever be agreed for
-                     *      it again, because agreement runs while both sides are connected;
-                     *   2. the sender named a SALTED algorithm, so a salt is required to check the bytes;
-                     *   3. this side holds no usable salt.
-                     *
-                     * ⚠️ EVERY OTHER REFUSAL IN THIS BRANCH STILL KEEPS THE RELAY COPY, deliberately. A
-                     * screener that is down comes back; a build that cannot compute an algorithm gets
-                     * upgraded; a decode failure is a version difference. Those answers CHANGE, so releasing
-                     * one drain early would lose a message that would have gone through — which is strictly
-                     * worse than the loop.
-                     *
-                     * ⚠️ **AND THE LOCAL COPY IS PROVEN, NEVER ASSUMED — review H1.**
-                     *
-                     * This comment used to assert that `ingestReceivedContent`'s `session_committed` exit
-                     * *had* quarantined the bytes, and gate on nothing. That claim is true on the ordinary
-                     * path and false on four reachable ones: no database, the conversation's byte budget
-                     * already spent, the row not stored, and a throwing write — each logging, in its own
-                     * words, that *nothing holds a copy of it*. The budget case is not exotic; it is the
-                     * ordinary shape of a long conversation that then ends.
-                     *
-                     * Deleting the relay's copy on the strength of an unchecked retention is delete-on-
-                     * best-effort, which the comment forty lines above forbids by name: *"annex FIRST,
-                     * confirm-delete SECOND, and only if the annex committed… delete-on-best-effort converts
-                     * the loop into PERMANENT SILENT loss — strictly worse than the bug."* So `retained` is
-                     * now a fact carried out of ingest, and a failed retention keeps the relay copy. The loop
-                     * is the lesser harm and it is loud while it lasts.
-                     */
-                    /**
-                     * ⚠️ **`saltReason === "none"` IS THE THIRD CONDITION, and leaving it out was a way to
-                     * destroy a message — review H2.**
-                     *
-                     * `getSessionContentSaltState` answers `unreadable` for THREE situations and only one of
-                     * them is permanent: the database is not open (a shutdown or startup race), the read
-                     * THREW, or the stored blob is the wrong width (real corruption). `getSessionSalt` also
-                     * returns null on a throwing read. So a SQLCipher lock or an IO blip on one drain makes a
-                     * perfectly good salt look absent — and without this clause the next line deletes the
-                     * relay's last copy of a message the FOLLOWING drain would have annexed.
-                     *
-                     * That is the order's explicit prohibition: a release one drain too early loses a message
-                     * that would have gone through. `none` is the only answer that cannot change back: no
-                     * salt row exists, and on a terminal session none can ever be written.
-                     *
-                     * The live `dcec3c3f…` case is `none` — there is not one `session.salt.*` event for that
-                     * session — so the loop this unit exists to stop still closes.
-                     */
-                    const releasable = stuckReason === PARK_REFUSAL_REASONS.ANNEX_SALT_UNAVAILABLE &&
-                        sessionTerminal &&
-                        saltReason === "none" &&
-                        ingest.retained === true;
-                    if (!releasable && stuckReason === PARK_REFUSAL_REASONS.ANNEX_SALT_UNAVAILABLE && sessionTerminal && saltReason === "none") {
-                        /**
-                         * The loop continues, and the reason it continues is a LOCAL storage failure rather than
-                         * anything about this message. Said out loud because otherwise this is indistinguishable
-                         * from the defect this unit fixed — the same refusal, at the same cadence, forever.
-                         */
-                        logger.warn("content.recover.release.withheld", {
-                            sessionId: e.sessionIdHex, contentHash: e.contentHashHex, agentName: recipientAgent.name,
-                            impact: "this message can never be checked and the relay copy would normally be dropped, but this daemon could NOT retain a local copy of it — see session.content.quarantine.skipped or .failed above. The relay copy is kept instead, so it will keep being pulled and refused, because deleting it would leave the message nowhere at all.",
-                            guidance: "Free space for this conversation and the copy is retained on a later drain, after which the loop stops on its own. A conversation that has spent its storage budget cannot retain more; cello_quarantined shows what it is already holding.",
-                            correlationId,
-                        });
-                    }
-                    /**
-                     * ⚠️ **REPORTED ON THE SUCCESS PATH — the notice is written AFTER the delete, never
-                     * before it.** `released` is what the operator's sentence turns on ("it is now gone" vs
-                     * "the relay still holds it"), and a confirm can fail. Deciding the wording from the
-                     * INTENT to release rather than from the release having happened is how a notice comes to
-                     * state a conclusion nothing has reached yet.
-                     */
-                    let released = false;
-                    if (releasable) {
-                        try {
-                            await client.confirm(node, Buffer.from(recipientPubkey, "hex"), contentHashBytes, kp);
-                            released = true;
-                            logger.warn("content.recover.released", {
-                                sessionId: e.sessionIdHex, contentHash: e.contentHashHex, agentName: recipientAgent.name,
-                                reason: stuckReason, sessionStatus, saltReason: saltReason ?? "(unknown)",
-                                impact: "this message can NEVER be checked — the conversation is closed, so no salt can ever be agreed for it — and the relay's copy has been deleted so it stops being pulled and refused on every drain. The content itself is retained locally as quarantined evidence and is readable with cello_quarantined.",
-                                guidance: "Nothing to retry and nothing to repair. If the message mattered, ask the sender OUT OF BAND to say it again in a NEW conversation.",
-                                correlationId,
-                            });
-                        }
-                        catch (err) {
-                            // The relay copy survives, so the loop continues for now and nothing is lost. Named
-                            // separately from `content.recover.confirm.failed` because on THIS branch the failed
-                            // delete is the whole reason the entry is still there.
-                            logger.warn("content.recover.release.failed", {
-                                sessionId: e.sessionIdHex, contentHash: e.contentHashHex, agentName: recipientAgent.name,
-                                error: extractErrorMessage(err),
-                                impact: "the relay copy could not be deleted, so this message will be pulled and refused again on the next drain. Nothing is lost; the loop simply has not stopped yet.",
-                                correlationId,
-                            });
-                        }
-                    }
-                    refusals.push(noteParkRefusal(recipientAgent.name, e.sessionIdHex, e.contentHashHex, stuckReason, { sessionStatus, released, declaredAlg: declaredAlgSeen, saltReason, errorDetail: annexErrorDetail }));
-                }
-            }
-            else {
-                // M12-P18: content for a session WE REFUSED can be swept — deleting it acts on our own
-                // refusal decision, not on the content, so it does not violate the rule that a forgery must
-                // not evict itself. This is the fix for the counterparty_unknown re-pull loop (78 of 121
-                // stranded entries on one box): the abuse cap refused the session, no session row was ever
-                // created, so every drain re-pulled and re-refused the parked content forever.
-                if (sessionNodeManager.wasSessionRefused(recipientAgent.name, e.sessionIdHex)) {
-                    logger.info("content.recover.refused_session.swept", {
-                        sessionId: e.sessionIdHex, contentHash: e.contentHashHex, agentName: recipientAgent.name,
-                        reason: ingest.reason,
-                        impact: "content was parked for a session this agent refused — deleted from the relay, not re-pullable",
-                        correlationId,
-                    });
-                    try {
-                        await client.confirm(node, Buffer.from(recipientPubkey, "hex"), contentHashBytes, kp);
-                    }
-                    catch (err) {
-                        logger.warn("content.recover.confirm.failed", { sessionId: e.sessionIdHex, contentHash: e.contentHashHex, error: extractErrorMessage(err) });
-                    }
-                }
-                else {
-                    // SEC-1 (M2): carry the refusal out to the caller, not just to the log. Deliberately still
-                    // NOT confirm-deleted for a session we did NOT ourselves refuse — a forgery must not be
-                    // able to evict itself, and a genuine message we simply have no row for yet must survive.
-                    // M12-P17: this is also why `counterparty_unknown` is NOT annexed above — the content is
-                    // UNVERIFIED. The residual (a stranger's stranded content we never refused) needs
-                    // relay-side TTL, not client-side deletion.
-                    refusals.push({ contentHash: e.contentHashHex, sessionId: e.sessionIdHex, reason: ingest.reason });
-                    logger.warn("content.recover.ingest_failed", { sessionId: e.sessionIdHex, contentHash: e.contentHashHex, reason: ingest.reason, correlationId });
-                }
-            }
-        }
-        return { ok: true, recovered, pulled: entries.length, refused: refusals.length, refusals };
-    }
-    // DOD-MSG-4 (auto-recover-on-reconnect): when an agent comes online, drain its parked mailbox from
-    // every relay it has sessions on — symmetric to the SENDER's flushAwaitingContent. Without this,
-    // nothing in production pulls a recipient's store-and-forward mailbox and parked content is never
-    // delivered. Best-effort; a relay miss is retried on the next agent-online.
-    /**
-     * DOD-PARK-DRAIN-1 (review F1): one drain per agent at a time, and at most one re-run queued.
-     *
-     * The drain used to have two triggers; it now has five (agent start, receiver install, a
-     * reservation LOST, a reservation REGAINED, signaling reconnect, the periodic backstop — the
-     * middle pair replaced "every watchdog rebuild" in 056-SLOTDEAD, which is where the count came
-     * from). Under the relay churn this unit exists to survive, those arrive faster than a drain
-     * completes. Concurrent drains are
-     * NOT safe by dedup alone: ingestReceivedContent decides "already present" synchronously from
-     * the in-memory tree and then AWAITS the security gateway before appending, so two drains that
-     * pull the same parked entry can both pass that check and both append — a duplicate leaf, the
-     * frontier divergence the recovery path exists to avoid.
-     *
-     * Coalesced, not queued: a trigger that arrives mid-drain asks for exactly ONE more pass when
-     * the current one finishes. Ten rebuilds during one slow pull cost one re-run, not ten.
-     */
-    const draining = new Set();
-    /** agentName → the trigger of the coalesced re-run owed to it (absent = none owed). */
-    const drainRerunRequested = new Map();
-    async function autoRecoverForAgent(agentName, trigger = "unspecified") {
-        if (draining.has(agentName)) {
-            drainRerunRequested.set(agentName, trigger);
-            logger.debug("content.recover.auto.coalesced", { agentName, trigger });
-            return;
-        }
-        draining.add(agentName);
-        try {
-            let pass = trigger;
-            do {
-                drainRerunRequested.delete(agentName);
-                await drainOnce(agentName, pass);
-                pass = drainRerunRequested.get(agentName) ?? pass;
-            } while (drainRerunRequested.has(agentName));
-        }
-        finally {
-            draining.delete(agentName);
-            drainRerunRequested.delete(agentName);
-        }
-    }
-    async function drainOnce(agentName, trigger) {
-        const agent = agents.find((a) => a.name === agentName);
-        if (!agent?.pubkey)
-            return;
-        const relays = sessionNodeManager.getAgentRelayEndpoints(agentName);
-        if (relays.length === 0)
-            return;
-        let total = 0;
-        let refusedTotal = 0;
-        const refusedReasons = {};
-        let failed = 0;
-        for (const r of relays) {
-            try {
-                const res = await recoverParkedFromRelay(agent, r.relayPeerId, r.relayAddrs);
-                if (res.ok) {
-                    total += res.recovered;
-                    // F3: tally by reason so the unattended drain reports refusals it would otherwise swallow.
-                    refusedTotal += res.refused;
-                    for (const r2 of res.refusals)
-                        refusedReasons[r2.reason] = (refusedReasons[r2.reason] ?? 0) + 1;
-                }
-                else {
-                    // Review #2: a non-ok result (signing_key_unavailable / cannot_unseal / the precise
-                    // no-receiver cause) was previously silent — log the reason so a run where every relay
-                    // failed is distinguishable from "nothing was parked".
-                    failed++;
-                    logger.warn("content.recover.auto.relay_failed", { agentName, trigger, relayPeerId: r.relayPeerId, reason: res.reason });
-                }
-            }
-            catch (err) {
-                failed++;
-                // extractErrorMessage, NOT String(err): libp2p and the transport reject with structured
-                // plain objects, and String() renders every one of them "[object Object]". 102 of these
-                // fired during the 2026-08-04 incident and not one was diagnosable from the log.
-                logger.warn("content.recover.auto.failed", { agentName, trigger, stage: "relay", relayPeerId: r.relayPeerId, error: extractErrorMessage(err) });
-            }
-        }
-        // Emit the completion event UNCONDITIONALLY — not only when total > 0 — so a clean "nothing
-        // parked" run is observable, and distinct from an all-failed run.
-        // `refusedReasons` for the same reason as above (F3): the drain is the path that runs
-        // unattended, so if a refusal is invisible here it is invisible altogether. Counts by reason
-        // rather than per-entry, so a mailbox full of one fault does not become a wall of log.
-        logger.info("content.recover.auto.completed", {
-            agentName, trigger, recovered: total, relayCount: relays.length, failedRelays: failed,
-            refused: refusedTotal,
-            ...(Object.keys(refusedReasons).length > 0 ? { refusedReasons } : {}),
-        });
-    }
-    /** Phase 2: register the IPC handlers, once the handler map exists. */
-    function registerHandlers(handlers) {
-        /**
-         * ⚠️ THIS HANDLER HAS NO PRODUCTION CALLER, AND THAT IS WHY IT DRIFTED.
-         *
-         * Production parks through `#parkContent` (`daemon.ts`), which seals a SIGNED envelope via
-         * `sealParkEnvelope`. This IPC handler is reached only from the spine tests, and it deposited
-         * whatever bytes it was handed — so the tests were parking a shape production stopped producing
-         * when SEC-1 landed. `authenticateParkedEntry` then refused every one of them with
-         * `unsigned_envelope`, which `park-envelope.ts` calls "the ATTACKER shape". Three j-content tests
-         * were asserting downstream security properties — tamper detection, dedup, the post-seal
-         * straggler guard — that the code never reached, because the entry was thrown out one step
-         * earlier for a reason none of them mentioned.
-         *
-         * So `content` (plaintext hex) now parks the PRODUCTION way: same `sealParkEnvelope`, the sole
-         * signer, no second copy of the encoder anywhere near a test.
-         *
-         * **`contentHash` stays a separate parameter on purpose — it is NOT derived from `content`.**
-         * The signature covers `(sessionId, recipient, contentHash)` and deliberately does not bind the
-         * content, so a sender CAN sign an entry whose claimed hash does not match what is inside. That
-         * is a real malicious-sender case, it is what the recover path's hash cross-check exists to
-         * catch, and a caller that wants to exercise it must be able to state the two independently.
-         * Deriving the hash here would make that case unreachable and quietly hollow the tamper test.
-         *
-         * `ciphertext` (the raw path) is kept for the one caller that wants byte fidelity through the
-         * relay rather than envelope semantics.
-         */
-        const runDeposit = async (params, _connectionId) => {
-            /**
-             * `Buffer.from(x, "hex")` TRUNCATES at the first invalid pair instead of throwing — the trap
-             * `park-envelope.ts` already documents. Unvalidated, a typo'd `content` is signed and sealed at
-             * its truncated length and surfaces at the far end as `content_hash_mismatch`: a TAMPER verdict
-             * on a local argument mistake. Review MEDIUM-4.
-             */
-            const hexOrNull = (v) => typeof v === "string" && v.length % 2 === 0 && /^[0-9a-fA-F]*$/.test(v) ? v : null;
-            const relay = parseRelayPeer(params?.relayMultiaddr);
-            const recipientPubkey = hexOrNull(params?.recipientPubkey);
-            const contentHash = hexOrNull(params?.contentHash);
-            const sessionId = hexOrNull(params?.sessionId);
-            const senderAgentName = params?.senderAgentName;
-            const hasCiphertext = params?.ciphertext !== undefined;
-            const hasContent = params?.content !== undefined;
-            if (!relay || !recipientPubkey || !contentHash || !sessionId) {
-                const bad = [
-                    !relay ? "relayMultiaddr (needs /p2p/<peerId>)" : null,
-                    recipientPubkey === null ? "recipientPubkey" : null,
-                    contentHash === null ? "contentHash" : null,
-                    sessionId === null ? "sessionId" : null,
-                ].filter(Boolean);
-                return { ok: false, reason: "missing_params", guidance: `Missing or not even-length hex: ${bad.join(", ")}. Hex is validated here because Buffer.from truncates silently, and a truncated value is signed and refused at the far end as a content hash mismatch.` };
-            }
-            if (!hasCiphertext && !hasContent) {
-                return { ok: false, reason: "missing_params", guidance: "Provide either `content` (plaintext hex — sealed and SIGNED here, the production shape) or `ciphertext` (hex — deposited verbatim, no envelope)." };
-            }
-            if (hasCiphertext && hasContent) {
-                return { ok: false, reason: "conflicting_params", guidance: "Provide `content` OR `ciphertext`, not both — they are two different deposit shapes and honouring one would silently discard the other." };
-            }
-            /**
-             * ⚠️ PARSED BEFORE THE BRANCH, and refused on the raw branch rather than dropped — review
-             * HIGH-2, and it was the same defect this parameter exists to prevent, reintroduced one branch
-             * over. It used to be read INSIDE the `content` branch, so `ciphertext` + `contentHashAlg`
-             * discarded the algorithm in silence: the far end then resolves the absent field to `sha256`,
-             * recomputes unsalted, and reports `content_hash_mismatch` — a tamper verdict on an honest
-             * message, with nothing on the sender side logging anything at all.
-             *
-             * A raw deposit has nowhere to PUT the name (there is no envelope), so naming one is a
-             * contradiction, not a preference. Refuse it.
-             */
-            let contentHashAlg;
-            const rawAlg = params?.contentHashAlg;
-            if (rawAlg !== undefined && rawAlg !== null) {
-                if (typeof rawAlg !== "string" || !isKnownContentHashAlg(rawAlg)) {
-                    return { ok: false, reason: "unknown_content_hash_alg", guidance: `This daemon cannot compute "${typeof rawAlg === "string" ? rawAlg : `(${typeof rawAlg})`}". Known algorithms: ${Object.values(CONTENT_HASH_ALGS).join(", ")}. Omit the field to mean ${CONTENT_HASH_ALGS.SHA256}.` };
-                }
-                if (hasCiphertext) {
-                    return { ok: false, reason: "conflicting_params", guidance: "`contentHashAlg` cannot ride with `ciphertext`: a raw deposit carries no envelope, so there is nowhere to record the algorithm and the far end would recompute under sha256 and report a content hash mismatch on honest content. Use `content` to deposit under a named algorithm." };
-                }
-                contentHashAlg = rawAlg;
-            }
-            const node = sessionNodeManager.getStandingReceiverNode();
-            if (!node) {
-                /**
-                 * DOD-M15-PARKCONN-1 — **NAME THE CAUSE, NOT THE EXIT POINT** (Invariant 3).
-                 *
-                 * `standing_receiver_unavailable` is the label that already misnamed this incident 102
-                 * times, which is why `standingReceiverAbsenceReason()` exists — and `recoverParkedFromRelay`
-                 * has used it since M12-P12 while this handler kept returning the bare label. The four causes
-                 * demand opposite responses: `standing_receiver_creating` clears in seconds and a retry
-                 * works; `agent_offline` never clears until the agent is started; `daemon_shutting_down`
-                 * means stop.
-                 *
-                 * The wire reason is unchanged — a caller matching on it keeps working — and the cause rides
-                 * alongside, which is the same shape the send path settled on.
-                 */
-                /**
-                 * ⚠️ THE GUESS USES THE SIGNABLE LIST, review MEDIUM-4 — the same filter the signing branch
-                 * below applies, and for the same reason it documents: a `load_failed` agent holds no key
-                 * provider, so counting it makes a daemon with ONE healthy agent say it cannot tell which.
-                 *
-                 * And a name that matches no agent is not an offline agent, review LOW-6:
-                 * `standingReceiverAbsenceReason("typo")` returns `agent_offline` because the name is simply
-                 * absent from the wanting-a-receiver set, so the operator was told to start an agent that
-                 * does not exist — a real verb pointed at nothing.
-                 */
-                const signableAgents = agents.filter((a) => a.state !== "load_failed");
-                const namedAgent = senderAgentName
-                    ? (signableAgents.some((a) => a.name === senderAgentName) ? senderAgentName : undefined)
-                    : (signableAgents.length === 1 ? signableAgents[0].name : undefined);
-                const cause = namedAgent
-                    ? sessionNodeManager.standingReceiverAbsenceReason(namedAgent)
-                    : senderAgentName
-                        ? "sender_agent_not_found"
-                        // Review LOW-5: zero is not "more than one". An agentless daemon was being told it had
-                        // several and could not say which.
-                        : signableAgents.length === 0
-                            ? "no_loadable_agent"
-                            : "unknown_agent";
-                const guidanceByCause = {
-                    standing_receiver_creating: "The standing receiver is still being built; retry this deposit in a few seconds.",
-                    agent_offline: `Agent '${namedAgent}' is not online, so this daemon has no node to deposit from. Start it with cello_start_agent.`,
-                    no_standing_receiver: "No agent on this daemon has a standing receiver; start an agent with cello_start_agent first.",
-                    daemon_shutting_down: "The daemon is shutting down — nothing was deposited, and retrying will not help until it is back up.",
-                    unknown_agent: `This daemon has no standing receiver and ${agents.filter((a) => a.state !== "load_failed").length} signable agents, so it cannot say which one is missing it; pass senderAgentName, or start an agent with cello_start_agent.`,
-                    sender_agent_not_found: `This daemon has no loadable agent named '${senderAgentName}', so there is nothing to check a standing receiver for. Check the name — cello_agents lists what this daemon holds.`,
-                    no_loadable_agent: "This daemon has no loadable agent at all, so it can never have a standing receiver. Create and register one, then start it with cello_start_agent.",
-                };
-                return { ok: false, reason: "standing_receiver_unavailable", cause, guidance: guidanceByCause[cause] ?? "The daemon's standing receiver is not ready yet; retry after startup." };
-            }
-            let payload;
-            if (hasContent) {
-                const content = hexOrNull(params?.content);
-                if (content === null) {
-                    return { ok: false, reason: "missing_params", guidance: "`content` is not even-length hex. It is validated because Buffer.from truncates silently, and a truncated body is sealed at the wrong length and refused at the far end as a content hash mismatch." };
-                }
-                /**
-                 * Which agent signs. Named explicitly when given; otherwise the only local agent that COULD
-                 * sign, and if there is more than one we REFUSE rather than pick — silently signing as the
-                 * wrong sender produces an entry the recipient authenticates against a pubkey nobody
-                 * expected, surfacing at recover time as a signature mismatch with no clue the wrong key was
-                 * chosen here.
-                 *
-                 * `load_failed` agents are excluded (review LOW-5): they hold no key provider, so listing
-                 * one as a candidate makes a daemon with one healthy agent report `ambiguous_sender` and
-                 * name a candidate that cannot sign.
-                 */
-                const signable = agents.filter((a) => a.state !== "load_failed");
-                const candidates = senderAgentName ? signable.filter((a) => a.name === senderAgentName) : signable;
-                if (candidates.length === 0) {
-                    return { ok: false, reason: "agent_not_found", guidance: senderAgentName ? `No local agent named '${senderAgentName}' that can sign this deposit.` : "This daemon has no loadable local agent to sign the deposit." };
-                }
-                if (candidates.length > 1) {
-                    return { ok: false, reason: "ambiguous_sender", guidance: `This daemon has ${candidates.length} signable agents (${candidates.map((a) => a.name).join(", ")}); pass senderAgentName to say which one signs.` };
-                }
-                const signerAgent = candidates[0];
-                /**
-                 * ⚠️ BIND THE SIGNATURE TO A SESSION THIS DAEMON ACTUALLY HOLDS — review HIGH-1.
-                 *
-                 * Both production producers derive `(sessionId, recipientPubkey)` from a session record;
-                 * this handler took them from the caller and signed whatever pair it was handed. A caller
-                 * passing the wrong session id or the wrong recipient therefore got a perfectly-formed
-                 * SIGNED entry, which the far end refuses as `bad_signature` / `signer_not_counterparty` —
-                 * **an attack verdict for a local argument mistake** — and a refused entry is deliberately
-                 * never confirm-deleted, so it re-pulls forever.
-                 *
-                 * `getSessionRecord` returns the row regardless of status, so a COMMITTED session still
-                 * resolves and the post-seal straggler case keeps working.
-                 */
-                const record = sessionNodeManager.getSessionRecord(signerAgent.name, sessionId);
-                if (!record) {
-                    return { ok: false, reason: "session_not_found", guidance: `Agent '${signerAgent.name}' holds no session ${sessionId.slice(0, 16)}…. Signing a park entry for a session this daemon does not hold produces bytes the recipient can only read as a forgery.` };
-                }
-                if ((record.counterparty_pubkey ?? "").toLowerCase() !== recipientPubkey.toLowerCase()) {
-                    return { ok: false, reason: "session_recipient_mismatch", guidance: `Session ${sessionId.slice(0, 16)}… has counterparty ${(record.counterparty_pubkey ?? "(none)").slice(0, 16)}…, not ${recipientPubkey.slice(0, 16)}…. Refused rather than signed: the entry would authenticate against a key the recipient never expects and be reported as a bad signature — an attack verdict for a wrong argument.` };
-                }
-                const signer = getKeyProvider(signerAgent.name);
-                if (!signer)
-                    return { ok: false, reason: "signing_key_unavailable", guidance: `Signing key for '${signerAgent.name}' is not loaded.` };
-                payload = await sealParkEnvelope({
-                    signer,
-                    sessionIdHex: sessionId,
-                    recipientPubkey: Buffer.from(recipientPubkey, "hex"),
-                    contentHash: Buffer.from(contentHash, "hex"),
-                    content: Buffer.from(content, "hex"),
-                    ...(contentHashAlg !== undefined ? { contentHashAlg } : {}),
-                });
-            }
-            else {
-                const ciphertext = hexOrNull(params?.ciphertext);
-                if (ciphertext === null) {
-                    return { ok: false, reason: "missing_params", guidance: "`ciphertext` is not even-length hex." };
-                }
-                payload = Buffer.from(ciphertext, "hex");
-            }
-            /**
-             * DOD-M15-PARKCONN-1 — **THE ODD HANDLER OUT NOW REFUSES LIKE ITS SIBLINGS, AND SAYS SO ONCE.**
-             *
-             * Every other exit above returns `{ ok: false, reason, guidance }`; this one ended in a bare
-             * `return await client.deposit(...)` with no catch and no log. An unreachable relay — the
-             * ordinary condition park exists for — therefore left the daemon as a THROW, which IPC shapes
-             * into `internal_error` + "An unexpected error occurred. Check daemon logs for details." The
-             * daemon logs held nothing either: this handler logged NOTHING AT ALL, which is why
-             * `019-PARKERROR` went looking for a deposit line and found none.
-             *
-             * Only `ContentParkUnreachableError` is converted. Anything else still throws, because a
-             * blanket catch here would turn a genuine defect into a tidy refusal — the failure this
-             * milestone is named for.
-             */
-            const client = newParkClient({ relayPeerId: relay.peerId, relayAddrs: [relay.addr], logger });
-            try {
-                return await client.deposit(node, {
-                    recipientPubkey: Buffer.from(recipientPubkey, "hex"),
-                    contentHash: Buffer.from(contentHash, "hex"),
-                    sessionId: Buffer.from(sessionId, "hex"),
-                    ciphertext: payload,
-                });
-            }
-            catch (err) {
-                // Only the transport wrap is converted. A blanket catch here would turn a genuine defect
-                // into a tidy refusal — the failure this milestone is named for.
-                if (!(err instanceof ContentParkUnreachableError))
-                    throw err;
-                return parkTransportRefusal(err);
-            }
-        };
-        /**
-         * ⚠️ **THE RESULT LOG WRAPS THE WHOLE HANDLER, review MEDIUM-3.**
-         *
-         * It used to sit beside the two exits that reach the relay, so eleven refusals — every bad
-         * argument, `agent_not_found`, `session_not_found`, `session_recipient_mismatch` — still
-         * returned in total silence. That is the same hole `019-PARKERROR` fell into in this very
-         * handler, for a different reason: an operator greps for a deposit line and finds nothing.
-         *
-         * Wrapping rather than sprinkling is deliberate. A call per exit drifts the moment someone adds
-         * a fourteenth; a wrapper cannot miss one.
-         */
-        handlers.set("content_park_deposit", async (params, connectionId) => {
-            const res = (await runDeposit(params, connectionId));
-            const line = {
-                // Read off the CALLER's params: a refusal can fire before either is parsed, and a log line
-                // that omits which deposit it is about cannot be correlated with anything.
-                relayMultiaddr: typeof params?.["relayMultiaddr"] === "string" ? params["relayMultiaddr"] : undefined,
-                sessionId: typeof params?.["sessionId"] === "string" ? params["sessionId"] : undefined,
-                contentHash: typeof params?.["contentHash"] === "string" ? params["contentHash"] : undefined,
-                ok: res.ok === true,
-                ...(res.reason !== undefined ? { reason: res.reason } : {}),
-                ...(res.cause !== undefined ? { cause: res.cause } : {}),
-                // Review LOW-8: the relay's own "when" already rides on the response; dropping it from the
-                // log leaves an aggregated log unable to say when a throttled deposit clears.
-                ...(res.retryAfterMs !== undefined ? { retryAfterMs: res.retryAfterMs } : {}),
-            };
-            // NOT `content.park.deposit.result` — the ContentParkClient already emits that name one layer
-            // down, and two events from different layers under one name make an aggregated log unreadable
-            // (the same review finding as `content.park.pull.refused_by_relay`).
-            if (line.ok)
-                logger.info("content.park.deposit.ipc.result", line);
-            else
-                logger.warn("content.park.deposit.ipc.result", line);
-            return res;
-        });
-        handlers.set("content_park_pull", async (params, _connectionId) => {
-            const relay = parseRelayPeer(params?.relayMultiaddr);
-            const recipientPubkey = params?.recipientPubkey;
-            if (!relay || !recipientPubkey) {
-                return { ok: false, reason: "missing_params", guidance: "Provide relayMultiaddr (with /p2p/<peerId>) and recipientPubkey (hex)." };
-            }
-            // The recipient must be a local agent — its K_local signs the relay's auth challenge.
-            const recipientAgent = agents.find((a) => a.pubkey === recipientPubkey);
-            if (!recipientAgent)
-                return { ok: false, reason: "agent_not_found", guidance: "No local agent matches recipientPubkey; only the recipient can pull its own parked content." };
-            const kp = getKeyProvider(recipientAgent.name);
-            if (!kp)
-                return { ok: false, reason: "signing_key_unavailable", guidance: `Signing key for '${recipientAgent.name}' is not loaded.` };
-            const node = sessionNodeManager.getStandingReceiverNode();
-            if (!node)
-                return { ok: false, reason: "standing_receiver_unavailable", guidance: "The daemon's standing receiver is not ready yet; retry after startup." };
-            // Review LOW-9: the seam, like every other client in this file. This handler was still
-            // constructing directly, which is why its `#open` failure path had no unit coverage.
-            const client = newParkClient({ relayPeerId: relay.peerId, relayAddrs: [relay.addr], logger });
-            let entries;
-            try {
-                entries = await client.pull(node, Buffer.from(recipientPubkey, "hex"), kp);
-            }
-            catch (err) {
-                /**
-                 * Review MEDIUM-2 — `#open` is shared, so this handler now receives the same transport wrap
-                 * the deposit handler does. Rethrowing it turned an unreachable relay into
-                 * `internal_error` + "An unexpected error occurred" — the exact response this unit exists to
-                 * abolish, one handler over, on a path the order's own evidence names.
-                 */
-                if (err instanceof ContentParkUnreachableError)
-                    return parkTransportRefusal(err);
-                // DOD-M15-RELAYAUTH-1 review HIGH-3: a refusal must not be reported as an empty list.
-                if (err instanceof ContentParkRefusedError) {
-                    return {
-                        ok: false,
-                        reason: `relay_refused_pull:${err.reason}`,
-                        guidance: "This relay refused to release parked content for this agent — it is NOT an empty mailbox, " +
-                            "and content may still be waiting. A relay only recognises agents named by a session " +
-                            "assignment it has recorded, and it forgets them when it restarts. Establish a session " +
-                            "with this relay (cello_initiate_session) and retry, or pull from the relay that " +
-                            "brokered the session the content belongs to.",
-                    };
-                }
-                throw err;
-            }
-            return {
-                ok: true,
-                entries: entries.map((e) => ({ contentHash: e.contentHashHex, sessionId: e.sessionIdHex, ciphertext: Buffer.from(e.ciphertext).toString("hex") })),
-            };
-        });
-        handlers.set("content_park_recover", async (params, _connectionId) => {
-            const relay = parseRelayPeer(params?.relayMultiaddr);
-            const recipientPubkey = params?.recipientPubkey;
-            if (!relay || !recipientPubkey) {
-                return { ok: false, reason: "missing_params", guidance: "Provide relayMultiaddr (with /p2p/<peerId>) and recipientPubkey (hex)." };
-            }
-            const recipientAgent = agents.find((a) => a.pubkey === recipientPubkey);
-            if (!recipientAgent)
-                return { ok: false, reason: "agent_not_found", guidance: "No local agent matches recipientPubkey." };
-            const res = await recoverParkedFromRelay(recipientAgent, relay.peerId, [relay.addr]);
-            if (!res.ok) {
-                const guidanceByReason = {
-                    signing_key_unavailable: `Signing key for '${recipientAgent.name}' is not loaded.`,
-                    cannot_unseal: `Agent '${recipientAgent.name}' key provider cannot open content seals.`,
-                    standing_receiver_creating: "The daemon's standing receiver is still being built; retry in a few seconds.",
-                    agent_offline: `Agent '${recipientAgent.name}' is not online, so this daemon has no node to pull from. Start it with cello_start_agent.`,
-                    no_standing_receiver: "No agent on this daemon has a standing receiver; start an agent first.",
-                    daemon_shutting_down: "The daemon is shutting down.",
-                };
-                // The WIRE reason stays the documented contract string for every no-receiver cause
-                // (types.ts STANDING_RECEIVER_UNAVAILABLE); the precise cause rides in the guidance,
-                // where it helps the operator without breaking a consumer that branches on the reason.
-                const noReceiver = new Set(["standing_receiver_creating", "agent_offline", "no_standing_receiver", "daemon_shutting_down"]);
-                const wireReason = noReceiver.has(res.reason) ? "standing_receiver_unavailable" : res.reason;
-                /**
-                 * Review MEDIUM-2 — a guidance the drain already computed WINS, and the bare "Recover
-                 * failed." is the last resort rather than the answer for everything the table misses. That
-                 * default is not an affordance: it names no next step, which is what Invariant 4 forbids on
-                 * exactly this kind of response.
-                 */
-                return {
-                    ok: false,
-                    reason: wireReason,
-                    guidance: res.guidance ?? guidanceByReason[res.reason] ?? `Recover failed (${res.reason}) and this daemon has no specific remedy for that reason. The daemon log holds the detail — report it with the reason above.`,
-                };
-            }
-            /**
-             * `refusals` REACHES THE CALLER — review B2a pass-2 F3, "no consumer, no ship".
-             *
-             * `recoverParkedFromRelay` has always returned it and both callers dropped it: this handler
-             * returned only `{recovered, pulled}`, and `drainOnce` reads only `res.recovered`. So every
-             * refusal reason computed in that loop reached nothing but a vitest assertion — including the
-             * four this milestone added to tell a version skew from a tamper from a storage fault.
-             *
-             * Which made the pass-1 F5 fix a label with no reader, and three of its tests assertions on a
-             * channel nobody could observe. An operator seeing `{recovered: 0, pulled: 3}` had three
-             * messages evaporate with the explanation only in the daemon log.
-             */
-            return { ok: true, recovered: res.recovered, pulled: res.pulled, refused: res.refused, refusals: res.refusals };
-        });
-    }
-    // M12-P17: exported for the screening/annex tests. `autoRecoverForAgent` walks every relay the
-    // agent has a session on and swallows per-relay errors by design, so it cannot assert what one
-    // entry did; this is the single-relay drain the assertions need.
-    return { autoRecoverForAgent, registerHandlers, recoverParkedFromRelay };
-}
-//# sourceMappingURL=content-park.js.map