@cello-protocol/daemon 0.0.227 → 0.0.228

package/dist/session-node-manager.js

@@ -0,0 +1,2998 @@
+/**
+ * CELLO Daemon — SessionNodeManager
+ *
+ * Manages the lifecycle of all ephemeral session nodes:
+ *   1. Per-session nodes: fresh transport key + Peer ID, connectionGater allows
+ *      only the designated counterparty. Created during cello_initiate_session
+ *      (outbound) or cello_await_session (inbound, via standing receiver handoff).
+ *   2. Standing receiver node: pre-created, kept alive at all times, handed to the first inbound
+ *      session and immediately replaced. Its gater is NOT open — `DOD-M15-ASSIGN-1` made it admit
+ *      nobody inbound until a session offer names the dialer (see `standing-receivers.ts`). This
+ *      line said "open gater" for as long as that was true and for a while after it was not.
+ *   3. 32-node cap: enforced before any new node is created.
+ *   4. Session status in the DB: active → sealed (on close) or interrupted
+ *      (on graceful shutdown or SIGKILL-restart detection).
+ *
+ * Interrupted-session detection runs BEFORE the IPC socket opens, so a client cannot observe a
+ * stale 'active' row from a previous process.
+ */
+import { CAPACITY_REASONS } from "./refusal-reasons.js";
+import { ownSaltFrame } from "./session-salt-agreement.js";
+import { CONTENT_ENCRYPTION_REASONS, CONTENT_ENCRYPTION_GUIDANCE } from "./content-encryption-status.js";
+import { openEncryptedDatabase, resolveDbKey, dbKeyPathFor, } from "./sqlcipher-db.js";
+import { migrateToEncryptedIfNeeded } from "./identity-migration.js";
+import { ensureIdentitySchema } from "./db-identity-store.js";
+import { TIER } from "./contacts-tier-migration.js";
+import { normalizeContactPubkey } from "./contact-pubkey-case.js";
+import { settableTierName, awayTierSettingKey, AWAY_DEFAULT_KEY } from "./agent-settings-keys.js";
+import * as lp from "it-length-prefixed";
+import { encodeCbor } from "@cello-protocol/protocol-types";
+import { STANDING_RECEIVER_AGENT_NAME } from "./types.js";
+import { CELLO_CONTENT_PROTOCOL_ID } from "@cello-protocol/transport";
+// `PARK_ENVELOPE_REASONS` is deliberately NOT imported here. The reason codes are compared inside
+// `park-envelope.ts` itself (`parkRefusalGuidance`) and asserted in its own test; this file only ever
+// receives the already-classified `ParkAuthFailure`, so importing the code table here would invite a
+// second, drifting copy of the classification logic.
+import { decodeParkEnvelope } from "./park-envelope.js";
+import { extractErrorMessage } from "./error-message.js";
+import { AuthorshipVerifier } from "./authorship-verification.js";
+import { InboundRefusals } from "./inbound-refusals.js";
+import { SessionRecords } from "./session-records.js";
+import { ParkRecovery } from "./park-recovery.js";
+import { SessionSalts } from "./session-salts.js";
+import { ensureSessionSchema } from "./session-schema.js";
+import { SessionQueries } from "./session-queries.js";
+import { RefusalNotices } from "./refusal-notices.js";
+import { SessionEphemerals } from "./session-ephemerals.js";
+import { SessionLiveness } from "./session-liveness.js";
+import { WitnessAlerts } from "./witness-alerts.js";
+import { HeldContent } from "./held-content.js";
+import { SessionLeafRecords } from "./session-leaf-records.js";
+import { SessionContentSender } from "./session-content-send.js";
+import { SessionContentIngest } from "./session-content-ingest.js";
+import { SessionSeal } from "./session-seal.js";
+import { SessionRelay } from "./session-relay.js";
+import { SessionLifecycle } from "./session-lifecycle.js";
+import { sendDeliveryAck } from "./session-delivery-acks.js";
+import { SESSION_CLOSED_REASON, sessionClosedState } from "./session-closed.js";
+import { StandingReceivers } from "./standing-receivers.js";
+import { storeRecoveredPosition } from "./recovered-position.js";
+import { ChannelLogStore } from "./channel-log-store.js";
+import { SessionOwnChainStore } from "./session-own-chain-store.js";
+/**
+ * One row in an agent's witness-alert list — DOD-M15-CORROBORATE-1 review F1. Deduped on
+ * `(witness relay, session)`, so a repeated observation raises `occurrences` rather than taking
+ * another slot in a bounded list.
+ */
+import { mergeRelayEndpoints } from "./relay-endpoints.js"; // directory pool beats saved rows
+import { ABUSE_MAX_UNKNOWN_SESSIONS_GLOBAL, heldRelayIdsOf, PARKED_DRAIN_BACKSTOP_DEFAULT_MS, SALT_AGREEMENT_WAIT_MS, CONTENT_MAX_INBOUND_STREAMS, LEAF_FETCH_GRACE_MS } from "./session-node-types.js";
+// Re-exported so this module's public surface is unchanged by the split: every existing
+// importer of session-node-manager.js keeps working, and no test moves an import path.
+export { ABUSE_MAX_SESSIONS_PER_UNKNOWN_SENDER, ABUSE_MAX_SESSION_RECEIVED_BYTES, ABUSE_MAX_UNKNOWN_SESSIONS_GLOBAL, CAP_INTERRUPTED_TTL_MS, LEAF_FETCH_GRACE_MS, MAX_TERMINAL_REFUSALS_PER_SESSION, RELAY_QUARANTINE_MS, REVIVAL_BOUND_SWEEP_MS, REVIVAL_WINDOW_MS, REVIVE_RESERVATION_CANDIDATES, REVIVE_RESERVATION_TIMEOUT_MS, SR_RESERVATION_MAX_RETRIES, TERMINAL_REFUSAL_READ_RETRY_MS, TERMINAL_REFUSAL_REASONS, } from "./session-node-types.js";
+export class SessionNodeManager {
+    #factory;
+    #logger;
+    #dbPath;
+    #db = null;
+    /**
+     * DOD-COATTEND-1 (review F2): sessions whose RECEIVED transcript row failed to write, and are
+     * therefore holding content that can never be delivered. Read by `cello_receive` so the timeout
+     * answer names the local failure instead of telling the operator to keep waiting on a
+     * counterparty who already sent. Keyed (agent, session) → the leaf sequences that were lost.
+     */
+    #undeliverableSeqs = new Map();
+    /** RELAYSIG-1: shared immutable store of the relay's signed ordering-record receipts (keyed by agent). */
+    #relayReceiptStore = null;
+    /** FED-OPTIONB-SEAL-001: the per-session leaf log (both parties) carried at a unilateral seal. */
+    #sealLeafStore = null;
+    #channelLogStore = null; /** M16 007-PUBLOG: every artifact a local channel published, beside the seal-leaf log. */
+    getChannelLogStore() { return (this.#channelLogStore ??= new ChannelLogStore(this.getDb(), this.#logger)); }
+    /** `DOD-M15-SELFCHAIN-1` — this agent's own last message per session, so the next one links to it. */
+    #ownChainStore = null;
+    // M9-CORE-001: the inbound screening seam. Every byte that reaches the agent passes
+    // through `session-content-ingest.ts`'s appendVerifiedContent buffer write; screenInbound gates
+    // it there, on every
+    // arrival path (direct, held-release, recovered-park). Defaults to always-allow when no
+    // gateway is configured (SI-001: still a verdict, not an ungated pass).
+    #securityGateway;
+    #activeNodes = new Map();
+    // M7 DOD-SPINE-6 / MSG-001-3b: ONE relay witness client per AGENT (keyed by agent name).
+    // The relay authenticates and keys delivery by the agent's K_local pubkey, so all of an
+    // agent's sessions share one authenticated relay stream (each frame carries session_id).
+    #relayClients = new Map();
+    /**
+     * M12-P15: build a relay client for a session that has NO in-memory node.
+     *
+     * Injected by the composition root because it needs the agent's K_local and pubkey, which this
+     * manager deliberately does not hold. Only consulted on the detached seal path — an ACTIVE session
+     * always uses its own registered client.
+     */
+    /**
+     * DOD-M15-RELAYSLOTS-1: `onlineToken` is REQUIRED on the dependency bag, not optional. Every
+     * relay client needs the directory's token or the relay refuses it a reservation slot, and the
+     * failure is invisible from the client side — the agent comes up, reports itself online, and is
+     * reachable by nobody. Making it required means a call site that forgets to pass it is a type
+     * error rather than an agent that quietly stops being dialable.
+     */
+    #detachedRelayClientBuilder = null;
+    setDetachedRelayClientBuilder(fn) {
+        this.#detachedRelayClientBuilder = fn;
+    }
+    /**
+     * Review F7: relays that sent a witness alert this build could not read or verify, per agent.
+     * Peer id → cause + count. NO session and NO party: it reports that our witness layer is not
+     * working, never anything about a participant.
+     */
+    #witnessUnreadable = new Map();
+    /**
+     * DOD-M15-RELAYSLOTS-1: the last relay refusal per agent, with the advice that goes with it.
+     * Written where the refusal is actually known; read by whatever tells the operator.
+     */
+    #srRelayRefusal = new Map();
+    /**
+     * Why this agent's standing receiver could not hold a reservation, in words the person running it
+     * can act on — or null when the last attempt succeeded or none has been made.
+     *
+     * This is the surface DoD clause 7 is about: the assertion that matters is what the CLIENT can
+     * show someone, not what the relay wrote in its own log.
+     */
+    getStandingReceiverRefusal(agentName) {
+        return this.#srRelayRefusal.get(agentName) ?? null;
+    }
+    /**
+     * DOD-M15-RELAYSLOTS-1 review M1 — **replace the relay's guess with the directory's fact.**
+     *
+     * The relay can only say "no token was presented"; the DIRECTORY knows why there was none, and
+     * the two most useful answers point somewhere the relay's own advice does not. Left alone,
+     * `online_token_required` tells the operator to check that their agent is reaching a directory —
+     * which, in the `not_registered_here` case, it plainly is.
+     */
+    #withDirectoryCause(agentName, refusal) {
+        if (refusal.reason !== "online_token_required")
+            return refusal;
+        const absent = this.#directoryOnlineTokenAbsent.get(agentName);
+        if (absent === "not_registered_here") {
+            return {
+                ...refusal,
+                advice: "The directory this agent is connected to holds no profile for its key, so it " +
+                    "issued no token and no relay will grant a reservation. The directory connection itself " +
+                    "is fine — either this agent registered against a different sovereign node and its " +
+                    "profile has not replicated here yet, or it is not registered at all.",
+            };
+        }
+        if (absent === "issue_failed") {
+            return {
+                ...refusal,
+                advice: "The directory could not issue this agent a token — its own lookup or signing " +
+                    "failed. That is a fault on the directory, not on this agent or on any relay; it usually " +
+                    "clears on the next connection.",
+            };
+        }
+        return refusal;
+    }
+    // DOD-LOOP-1: the standing receiver is PER-AGENT, not per-daemon. A daemon hosting two agents
+    // (the loopback case) needs each agent to have its OWN inbound receiver node — otherwise the
+    // initiator (consuming its agent's standing receiver) and the responder (consuming its agent's)
+    // would contend for a single node and thrash. Keyed by agentName. A creation-in-flight guard set
+    // prevents two concurrent ensure() calls from building two nodes for the same agent.
+    // `relayPeerIds`: the relays this receiver holds an announced circuit through. The watchdog reads
+    // it as a COUNT — zero tells "never had one" (already degraded, and already loud) apart from a
+    // loss, and a drop that leaves it non-empty is a lost relay the agent can absorb without being
+    // rebuilt. See `#reservationWatchdogTick` in `session-relay.ts`.
+    /**
+     * DOD-M12B-SESSION-SEED-1 — session id → the transport seed its node identity derives from.
+     *
+     * **DELIBERATELY NOT ON `ActiveSessionEntry`.** That entry is deleted the instant a session is
+     * interrupted (`markInterruptedWithDetails` and `destroySessionNode` both do it), which is exactly
+     * the moment the seed becomes necessary — storing it there would destroy it precisely when the
+     * session needs to come back. It has to outlive the NODE without outliving the SESSION.
+     *
+     * Andre's 2026-08-18 tenet is the lifetime rule: *"it should be possible to revive that session on
+     * those peer IDs. But after that, those peer IDs and that peer connection needs to be shut down."*
+     * So this map is cleared in the same step that writes a terminal status (`SessionLifecycle.updateSessionStatus`),
+     * not on a later sweep — and the bytes are zeroed before the reference is dropped, because a seed
+     * that stays readable in the heap is exactly the "left open" the tenet forbids.
+     *
+     * It holds the counterparty's session peer id alongside the seed, and not for convenience: that
+     * value lives ONLY on `ActiveSessionEntry` and is destroyed with it on interruption, so without a
+     * copy here we could rebuild our own identity and still not know who to let back in. Both halves
+     * of the revival have the same lifetime, so they are destroyed in one step.
+     *
+     * In memory only, never persisted. A daemon restart genuinely destroys these identities, which is
+     * why restart is `RESTART-SEAL-1`'s case (resolve with a receipt) and not a revival case.
+     */
+    #sessionSeeds = new Map();
+    /** DOD-M12B-SESSION-SEED-1: see setRetryDrainHook — fired when a session is revived. */
+    #retryDrainHook = null;
+    /**
+     * 036-GODFILE Part 1 — WHO SENT THIS, AND DID THEY SEE WHAT THEY CLAIM.
+     *
+     * It owns the two maps it maintains (`#receivedFromCounterparty`, `#lastFromCounterparty`), which
+     * nothing else in the daemon reads. Everything else it needs is listed explicitly in the context
+     * object rather than handed over as `this` — the manager's private state stays private, and a
+     * reader can see the whole of what authorship verification is allowed to touch in one place.
+     *
+     * ⚠️ BUILT IN THE CONSTRUCTOR, not as a field initializer. Field initializers run in declaration
+     * order, and this one closes over `#logger`, so declaring it above `#logger` made it read an
+     * uninitialized field — caught by tsc, and silent at runtime if it had been assigned later.
+     */
+    #authorship;
+    /**
+     * 036-GODFILE Parts 3+4 — everything that happens to an inbound message we will NOT deliver.
+     *
+     * It owns the five remote-fed maps it bounds. The manager used to clear them by hand in cache
+     * eviction, which is why they are gone from here: a caller that had to know five field names
+     * in order to forget a session knew too much, and a sixth would have been missed in silence.
+     */
+    #refusals;
+    /**
+     * 036-GODFILE — contacts and tiers, agent settings, the transcript, and session divergence.
+     *
+     * Everything the daemon REMEMBERS about a conversation, as opposed to what it does with a
+     * message in flight. Its context is five items, which is why it was a seam.
+     */
+    #records;
+    /**
+     * 036-GODFILE Part 6 — the relay store-and-forward mailbox: depositing content the counterparty
+     * could not take live, recovering it when they return, and the backstop sweep that drains it
+     * even when a trigger is missing.
+     */
+    #park;
+    /**
+     * 037-SESSIONCORE Unit 1 — the per-session content salt, and the eleven maps it maintains.
+     *
+     * Those eleven were the largest single block of the twenty-four per-session containers that
+     * `#evictSessionCaches` cleared by hand. They leave with the code that fills them.
+     */
+    #salts;
+    /**
+     * 037-SESSIONCORE — the methods that are SQL and nothing else.
+     *
+     * Grouped by SHAPE rather than subject: "holds no state, calls nothing but the agent-id lookup,
+     * and actually touches the database" is a property a reader can check on any one of them
+     * without knowing which subsystem it serves.
+     *
+     * ⚠️ THE `touches the database` CLAUSE IS LOAD-BEARING. A first pass grouped on "holds no state"
+     * alone and swept in `#evictPeersOutsideGate` (`session-lifecycle.ts`), which operates on libp2p connections and is not
+     * SQL at all. A source-scanning parity test caught the mis-grouping; the filter now requires the
+     * method to name `#db`.
+     */
+    #queries;
+    /**
+     * 037-SESSIONCORE — the refusals an operator can actually see.
+     *
+     * A refusal whose only consumer is the log is not a control: from the receiving operator's
+     * chair the conversation just goes quiet, and they conclude the other person stopped replying.
+     */
+    #notices;
+    /**
+     * 037-SESSIONCORE — the throwaway per-session keypair and the content key its halves agree.
+     *
+     * It owns the four maps that hold the secrets, which is the right place for them: the teardown
+     * that ZEROES them lives beside the code that mints them, rather than being one line in a
+     * cache-eviction method that has to remember every map in the class.
+     */
+    #ephemerals;
+    /**
+     * 037-SESSIONCORE — connection liveness, and the impairment that explains a degraded session.
+     */
+    #liveness;
+    /**
+     * 037-SESSIONCORE — what a relay reported seeing, when it does not reconcile with our record.
+     */
+    #witness;
+    /**
+     * 037-SESSIONCORE — content we have verified but cannot show yet, because it arrived ahead of
+     * a gap. The MAP stays shared: ingest, placeOwnLeaf and sealReadiness all read it, and two
+     * sources of truth for "what are we holding" would be worse than one shared one.
+     */
+    #held;
+    /**
+     * 037-SESSIONCORE — the two durable facts about a session's leaves: where the chain starts
+     * (the genesis prev-root) and which leaves the directory attested.
+     */
+    #leafRecords;
+    /**
+     * The hot path, in two halves — the message going out, and the message coming in. Together they
+     * are the single largest piece that left this class.
+     *
+     * They are separate because they share almost nothing: outbound reaches nothing inbound at all,
+     * and inbound reaches exactly one thing outbound (settling the acknowledgement for a message we
+     * sent, which arrives on the stream the receiver is already reading). The seven methods further
+     * down that delegate to them stay on this class because 451 call sites across the daemon and its
+     * tests name them here; the rest of their surface is reached as `#contentIn.…` / `#contentOut.…`.
+     */
+    #contentOut;
+    #contentIn;
+    /**
+     * Closing a conversation and proving it closed — readiness, the SEAL leaf, the carry, the
+     * certificate, and the auto-acknowledgement gate. Eleven of its methods keep delegators below
+     * because 86 call sites outside this class name them on the manager.
+     */
+    #seal;
+    /**
+     * Talking to the blind witness: connecting a session to its relay, proving key possession, holding
+     * and renewing the circuit reservation that keeps this agent reachable behind a NAT, quarantining
+     * a relay that misbehaves, and detaching cleanly.
+     */
+    #relay;
+    /**
+     * A session's life: opened, accepted, connected, revived on the peer id the counterparty still
+     * holds, moved between statuses, and torn down. The last of the four paths to leave this class.
+     */
+    #life;
+    // CELLO-M7-TRANSPORT-001: the directory-node multiaddrs serving as AutoNAT probers (SI-002).
+    // Empty () => [] when the directory is in 'reconnecting' state — AutoNAT cannot run and
+    // dialability stays the conservative default.
+    #autoNatProbers;
+    /**
+     * 037-SESSIONCORE — the always-listening node, one per agent.
+     *
+     * Its maps are passed BY REFERENCE rather than moved: the reservation watchdog and the relay
+     * paths still read them and stayed behind, and two sources of truth for "which agents have a
+     * receiver" would be worse than one shared one.
+     */
+    #receivers;
+    /** ─── DELEGATORS — the standing-receiver API other files call ───────────────────────── */
+    standingReceiverAbsenceReason(agentName) { return this.#receivers.standingReceiverAbsenceReason(agentName); }
+    getStandingReceiverInfo(agentName) { return this.#receivers.getStandingReceiverInfo(agentName); }
+    getStandingReceiverReady(agentName) { return this.#receivers.getStandingReceiverReady(agentName); }
+    getStandingReceiverNode(agentName) { return this.#receivers.getStandingReceiverNode(agentName); }
+    getStandingReceiverReachability(agentName) { return this.#receivers.getStandingReceiverReachability(agentName); }
+    getStandingReceiverAutoNat() { return this.#receivers.getStandingReceiverAutoNat(); }
+    getStandingReceiverAllowedPeer(agentName) { return this.#receivers.getStandingReceiverAllowedPeer(agentName); }
+    admitOfferedDialer(a, p, sid) { return this.#receivers.admitOfferedDialer(a, p, sid); }
+    takeReservationForSession(a, c, cid, offerSid) { return this.#receivers.takeReservationForSession(a, c, cid, offerSid); } // 055-ONDEMAND
+    // 056-SLOTDEAD — the RE-TAKE, for a live session whose circuit died. Exposed so the outage-and-
+    // recovery path can be driven end to end; the offer path alone is the wrong half of the pair.
+    retakeReservationOn(a, node, c, cid) { return this.#receivers.retakeReservationOn(a, node, c, cid); }
+    getStandingReceiverRelayIds(a) { return [...(this.#standingReceivers.get(a)?.relayPeerIds ?? [])]; } // 055-ONDEMAND
+    /** 055-ONDEMAND — a live session's own node. Its circuit is not the receiver's; see the release path. */
+    getSessionNodeForTest(a, sid) { return this.#activeNodes.get(this.#k(a, sid))?.node ?? null; }
+    getOfferedDialer(agentName, sessionIdHex) { return this.#receivers.getOfferedDialer(agentName, sessionIdHex); }
+    clearOfferedDialer(agentName, sessionIdHex) { return this.#receivers.clearOfferedDialer(agentName, sessionIdHex); }
+    revokeOfferedDialer(agentName, sessionIdHex, offeredPeerId) { return this.#receivers.revokeOfferedDialer(agentName, sessionIdHex, offeredPeerId); }
+    /** ─── DELEGATORS — the leaf-record API other files call ─────────────────────────────── */
+    recordSessionGenesis(agentName, sessionId, participantA, participantB, sessionTimestamp, sessionSignature, relayAnchorHex) { return this.#leafRecords.recordSessionGenesis(agentName, sessionId, participantA, participantB, sessionTimestamp, sessionSignature, relayAnchorHex); }
+    /** 069-ORDERPROOF: the relay key this session's ordering attestations are verified against. */
+    sessionRelayAnchor(agentName, sessionId) { return this.#leafRecords.sessionRelayAnchor(agentName, sessionId); }
+    persistRelayAnchor(agentName, sessionId, relayAnchorHex) { return this.#leafRecords.persistRelayAnchor(agentName, sessionId, relayAnchorHex); }
+    setSessionGenesisForTest(agentName, sessionId, genesis) { return this.#leafRecords.setSessionGenesisForTest(agentName, sessionId, genesis); }
+    recordCertifiedLeafSet(agentName, sessionId, signedLeaves, sealedRootHex, correlationId) { return this.#leafRecords.recordCertifiedLeafSet(agentName, sessionId, signedLeaves, sealedRootHex, correlationId); }
+    noteCertifiedLeafSetUnavailable(agentName, sessionId, state, detail) { return this.#leafRecords.noteCertifiedLeafSetUnavailable(agentName, sessionId, state, detail); }
+    getCertifiedLeafSet(agentName, sessionId) { return this.#leafRecords.getCertifiedLeafSet(agentName, sessionId); }
+    getCertifiedLeafSetState(agentName, sessionId) { return this.#leafRecords.getCertifiedLeafSetState(agentName, sessionId); }
+    /** ─── DELEGATORS — the held-content seams other files call ──────────────────────────── */
+    holdOwnLeafForTest(agentName, sessionId, canonicalSeq, contentHashHex) { return this.#held.holdOwnLeafForTest(agentName, sessionId, canonicalSeq, contentHashHex); }
+    /** ─── DELEGATORS — the witness-alert API other files call ────────────────────────────── */
+    recordRelayWitnessAlert(agentName, alert) { return this.#witness.recordRelayWitnessAlert(agentName, alert); }
+    getWitnessAlerts(agentName) { return this.#witness.getWitnessAlerts(agentName); }
+    witnessAlertsTruncated(agentName) { return this.#witness.witnessAlertsTruncated(agentName); }
+    /** ─── DELEGATORS — the liveness API other files call, unchanged by the split ───────────── */
+    getSessionLiveness(agentName, sessionId) { return this.#liveness.getSessionLiveness(agentName, sessionId); }
+    getSessionImpairment(agentName, sessionId) { return this.#liveness.getSessionImpairment(agentName, sessionId); }
+    markSessionLivenessForTest(agentName, sessionId, state) { return this.#liveness.markSessionLivenessForTest(agentName, sessionId, state); }
+    /** ─── DELEGATORS — the test seams other files call, unchanged by the split ─────────────── */
+    mintSessionEphemeralForTest(agentName, sessionId) { return this.#ephemerals.mintSessionEphemeralForTest(agentName, sessionId); }
+    sessionEphemeralPublicForTest(agentName, sessionId) { return this.#ephemerals.sessionEphemeralPublicForTest(agentName, sessionId); }
+    setSessionEphemeralForTest(agentName, sessionId, ephemeral) { return this.#ephemerals.setSessionEphemeralForTest(agentName, sessionId, ephemeral); }
+    setSessionContentKeyForTest(agentName, sessionId, key) { return this.#ephemerals.setSessionContentKeyForTest(agentName, sessionId, key); }
+    forgetSessionContentKeyForTest(agentName, sessionId) { return this.#ephemerals.forgetSessionContentKeyForTest(agentName, sessionId); }
+    async signOwnEphemeralForTest(agentName, sessionId) { return this.#ephemerals.signOwnEphemeralForTest(agentName, sessionId); }
+    async handleEphemeralFrameForTest(agentName, sessionId, frame, correlationId = "test") { return this.#ephemerals.handleEphemeralFrameForTest(agentName, sessionId, frame, correlationId); }
+    /**
+     * ─── DELEGATORS — the refusal-notice API other files call, unchanged by the split ──────────
+     *
+     * ⚠️ **REFUSALS LOGGED AND FILED NOTHING, AND THAT IS WHY THIS API EXISTS.** The encryption gate's
+     * three causes each carried a good `impact` and `guidance` at ERROR and none of them called
+     * `noteContentRefusal`, so the sentences an operator needed were in a file they have no reason to
+     * open. From their chair a message never arrived and the conversation went quiet — the exact defect
+     * `DOD-M15-NO-SILENT-REFUSAL-1` was built to end, three checks above the one that respected it.
+     *
+     * Both surfaces, always: the ERROR is the durable forensic record an investigation reads days
+     * later, and the notice is the control — the thing that actually reaches the person.
+     */
+    noteContentRefusal(agentName, sessionId, reason, detail) { return this.#notices.noteContentRefusal(agentName, sessionId, reason, detail); }
+    takeContentRefusals(agentName, sessionId, consumerId) { return this.#notices.takeContentRefusals(agentName, sessionId, consumerId); }
+    dismissContentRefusals(agentName, sessionId) { return this.#notices.dismissContentRefusals(agentName, sessionId); }
+    takeAgentContentRefusals(agentName, consumerId) { return this.#notices.takeAgentContentRefusals(agentName, consumerId); }
+    /**
+     * ─── DELEGATORS — the query API other files call, unchanged by the split ────────────────────
+     */
+    listExpiredUnrevivableSessions(nowMs, windowMs) { return this.#queries.listExpiredUnrevivableSessions(nowMs, windowMs); }
+    listRestartOrphanedSessions() { return this.#queries.listRestartOrphanedSessions(); }
+    readQuarantined(agentName, sessionId, sequence) { return this.#queries.readQuarantined(agentName, sessionId, sequence); }
+    getPinnedCounterpartyPrimary(agentName, counterpartyPubkeyHex) { return this.#queries.getPinnedCounterpartyPrimary(agentName, counterpartyPubkeyHex); }
+    recordSealedAnnex(agentName, sessionId, contentHashHex, content, senderPubkeyHex) { return this.#queries.recordSealedAnnex(agentName, sessionId, contentHashHex, content, senderPubkeyHex); }
+    findNextReceivedAfter(agentName, sessionId, afterSeq) { return this.#queries.findNextReceivedAfter(agentName, sessionId, afterSeq); }
+    getSealInterruptedArtifacts(agentName, sessionId) { return this.#queries.getSealInterruptedArtifacts(agentName, sessionId); }
+    getSessionsByStatus(status) { return this.#queries.getSessionsByStatus(status); }
+    recordRefusedSession(agentName, sessionId, reason) { return this.#queries.recordRefusedSession(agentName, sessionId, reason); }
+    getAgentRelayEndpoints(agentName) { return mergeRelayEndpoints(this.#directoryRelayEndpoints.get(agentName), this.#queries.getAgentRelayEndpoints(agentName)); }
+    countActiveSessionsFromUnknownSenders(agentName) { return this.#queries.countActiveSessionsFromUnknownSenders(agentName); }
+    getSealCertificate(agentName, sessionId) { return this.#queries.getSealCertificate(agentName, sessionId); }
+    setSessionName(agentName, sessionId, sessionName) { return this.#queries.setSessionName(agentName, sessionId, sessionName); }
+    getPersistedRelayEndpoint(agentName, sessionId) { return this.#queries.getPersistedRelayEndpoint(agentName, sessionId); }
+    markRestartSealGaveUp(agentName, sessionId, reason) { return this.#queries.markRestartSealGaveUp(agentName, sessionId, reason); }
+    dismissSession(agentName, sessionId) { return this.#queries.dismissSession(agentName, sessionId); }
+    agentNameForId(agentId) { return this.#queries.agentNameForId(agentId); }
+    getRenameNotices(agentName) { return this.#queries.getRenameNotices(agentName); }
+    sessionsConsumingCap(agentName, counterpartyPubkey, limit = 10) { return this.#queries.sessionsConsumingCap(agentName, counterpartyPubkey, limit); }
+    advanceLastDeliveredSeq(agentName, sessionId, seq) { return this.#queries.advanceLastDeliveredSeq(agentName, sessionId, seq); }
+    countActiveSessionsForCounterparty(agentName, counterpartyPubkey) { return this.#queries.countActiveSessionsForCounterparty(agentName, counterpartyPubkey); }
+    getSessionRecord(agentName, sessionId) { return this.#queries.getSessionRecord(agentName, sessionId); }
+    hasDatabase() { return this.#queries.hasDatabase(); }
+    readSealedAnnex(agentName, sessionId) { return this.#queries.readSealedAnnex(agentName, sessionId); }
+    counterpartyAbandonedAt(agentName, sessionId) { return this.#queries.counterpartyAbandonedAt(agentName, sessionId); }
+    getSealedRootHex(agentName, sessionId) { return this.#queries.getSealedRootHex(agentName, sessionId); }
+    getLastDeliveredSeq(agentName, sessionId) { return this.#queries.getLastDeliveredSeq(agentName, sessionId); }
+    markSessionsInterruptedByLocalShutdownForTest() { return this.#queries.markSessionsInterruptedByLocalShutdownForTest(); }
+    wasSessionRefused(agentName, sessionId) { return this.#queries.wasSessionRefused(agentName, sessionId); }
+    countReceivedMessages(agentName, sessionId) { return this.#queries.countReceivedMessages(agentName, sessionId); }
+    markInterruptedByCounterpartyForTest(agentName, sessionId) { return this.#queries.markInterruptedByCounterpartyForTest(agentName, sessionId); }
+    /**
+     * M7-SESSION-004 (AC-005): persist the seal certificate's legibility object with the
+     * sealed record. Stored as a JSON string (hex-encoded pubkeys) so it round-trips a
+     * daemon restart and is returned intact on the cert-read surface. The caller normalises
+     * the raw wire legibility (Uint8Array pubkeys) into a JSON-safe shape before storing.
+     * Best-effort: a session row may not yet exist (the seal arrived before the row was
+     * persisted); in that case we no-op rather than throw — the cert still flows through the
+     * live return path. The legibility content is identical regardless of delivery timing.
+     *
+     * ⚠️ THIS BLOCK WAS STRANDED WHEN THE METHOD BECAME A DELEGATOR. It stayed behind and ended up
+     * stacked on top of `markSealed`'s own doc block, so that method showed two descriptions and the
+     * first one described a different method entirely — and the seal split then carried it into
+     * `session-seal.ts`, where `recordSealCertificate` does not appear at all. Returned to the call
+     * it describes. The row-writing itself lives in `session-queries.ts`.
+     */
+    recordSealCertificate(agentName, sessionId, sealedRootHex, legibilityJson) { return this.#queries.recordSealCertificate(agentName, sessionId, sealedRootHex, legibilityJson); }
+    recordCounterpartyPrimary(agentName, sessionId, primaryPubkeyHex) { return this.#queries.recordCounterpartyPrimary(agentName, sessionId, primaryPubkeyHex); }
+    /**
+     * ─── DELEGATORS — the salt API other files call, unchanged by the split ─────────────────────
+     *
+     * `daemon.ts` and `session-content-handlers.ts` still say `manager.contentHashForSession(...)`.
+     * Keeping the surface identical is what lets the suite stand as evidence that this was a
+     * restructure and not a rewrite.
+     */
+    setSaltContributionForTest(agentName, sessionId, contribution) { return this.#salts.setSaltContributionForTest(agentName, sessionId, contribution); }
+    forgetSaltContributionForTest(agentName, sessionId) { return this.#salts.forgetSaltContributionForTest(agentName, sessionId); }
+    async contentHashForSession(agentName, sessionId, content) { return this.#salts.contentHashForSession(agentName, sessionId, content); }
+    abandonUnsaltedHash(agentName, sessionId) { return this.#salts.abandonUnsaltedHash(agentName, sessionId); }
+    isContentSaltActive(agentName, sessionId) { return this.#salts.isContentSaltActive(agentName, sessionId); } // `expectSaltAgreement` is PRODUCTION (DOD-M15-AWAYSALT-1 — the away ack calls it before hashing);
+    // it also arms the teardown-must-settle regression seam (037-SESSIONCORE) below.
+    expectSaltAgreement(agentName, sessionId) { return this.#salts.markSaltPending(agentName, sessionId); }
+    saltForHashingForTest(agentName, sessionId) { return this.#salts.saltForHashing(agentName, sessionId); }
+    /**
+     * ─── DELEGATORS — the mailbox API other files call, unchanged by the split ───────────────────
+     *
+     * `content-park.ts` and `daemon.ts` still say `manager.recoverParkedEntry(...)` and
+     * `manager.setContentParkHook(...)`. Keeping the surface identical is what lets the full suite
+     * stand as evidence that this was a move: a caller that had to change would mean the contract
+     * moved with it.
+     */
+    injectParkFault(count, cause) { return this.#park.injectParkFault(count, cause); }
+    getParkFaultRemaining() { return this.#park.getParkFaultRemaining(); }
+    setContentParkHook(fn) { return this.#park.setContentParkHook(fn); }
+    setParkedDrainHook(fn) { return this.#park.setParkedDrainHook(fn); }
+    recoverOwnSealCtrlLeafForTest(agentName, sessionId) { return this.#park.recoverOwnSealCtrlLeafForTest(agentName, sessionId); }
+    async recoverParkedEntry(agentName, sessionId, recipientPubkey, unsealed, contentHash, correlationId) { return this.#park.recoverParkedEntry(agentName, sessionId, recipientPubkey, unsealed, contentHash, correlationId); }
+    /**
+     * ─── DELEGATORS — the class API is unchanged by the split, deliberately ──────────────────────
+     *
+     * Every method below moved into `session-records.ts` with its implementation and its comments.
+     * These one-liners exist so that no CALLER had to change: `contact-handlers.ts`, the IPC surface
+     * and the tests all still say `manager.getTier(...)`. That is what lets the full suite stand as
+     * the evidence that this was a move and not a rewrite — a test that had to change would have
+     * meant behaviour moved (Rule B).
+     *
+     * They are the price of the split and they are the cheap half: one line each, no logic, and the
+     * prose that explains each rule lives beside the code that enforces it.
+     */
+    isContact(agentName, pubkey) { return this.#records.isContact(agentName, pubkey); }
+    getTier(agentName, pubkey) { return this.#records.getTier(agentName, pubkey); }
+    resolveTierBound(agentName, tier, field) { return this.#records.resolveTierBound(agentName, tier, field); }
+    addContact(agentName, pubkey, moniker, provenance, tier = TIER.UNKNOWN) { return this.#records.addContact(agentName, pubkey, moniker, provenance, tier); }
+    setContactMoniker(agentName, pubkey, moniker) { return this.#records.setContactMoniker(agentName, pubkey, moniker); }
+    setContactSignalPref(agentName, pubkey, signalHash, present) { return this.#records.setContactSignalPref(agentName, pubkey, signalHash, present); }
+    getContactSignalPrefs(agentName, pubkey) { return this.#records.getContactSignalPrefs(agentName, pubkey); }
+    setContactAwayMessage(agentName, pubkey, message) { return this.#records.setContactAwayMessage(agentName, pubkey, message); }
+    setContactTier(agentName, pubkey, tier) { return this.#records.setContactTier(agentName, pubkey, tier); }
+    recordOfferedMoniker(agentName, pubkey, offered) { return this.#records.recordOfferedMoniker(agentName, pubkey, offered); }
+    removeContact(agentName, pubkey) { return this.#records.removeContact(agentName, pubkey); }
+    getContactMoniker(agentName, pubkey) { return this.#records.getContactMoniker(agentName, pubkey); }
+    listContacts(agentName) { return this.#records.listContacts(agentName); }
+    clearRenameNotice(agentName, pubkey) { return this.#records.clearRenameNotice(agentName, pubkey); }
+    clearPinnedCounterpartyPrimary(agentName, counterpartyPubkeyHex) { return this.#records.clearPinnedCounterpartyPrimary(agentName, counterpartyPubkeyHex); }
+    getTelegramSettings() { return this.#records.getTelegramSettings(); }
+    setTelegramSettings(botToken, allowlistedChatId) { return this.#records.setTelegramSettings(botToken, allowlistedChatId); }
+    getSetting(agentName, key) { return this.#records.getSetting(agentName, key); }
+    deleteSetting(agentName, key) { return this.#records.deleteSetting(agentName, key); }
+    setSetting(agentName, key, value) { return this.#records.setSetting(agentName, key, value); }
+    getAllSettings(agentName) { return this.#records.getAllSettings(agentName); }
+    recordRelayWitnessUnreadable(agentName, relayPeerId, why) { return this.#records.recordRelayWitnessUnreadable(agentName, relayPeerId, why); }
+    getWitnessUnreadable(agentName) { return this.#records.getWitnessUnreadable(agentName); }
+    recordTranscriptMessage(agentName, sessionId, sequence, direction, plaintext, correlationId, authorship, quarantineReason, senderPubkeyHexOverride) { return this.#records.recordTranscriptMessage(agentName, sessionId, sequence, direction, plaintext, correlationId, authorship, quarantineReason, senderPubkeyHexOverride); }
+    readTranscript(agentName, sessionId) { return this.#records.readTranscript(agentName, sessionId); }
+    getUnreadSummary(agentName) { return this.#records.getUnreadSummary(agentName); }
+    getEndedUnread(agentName) { return this.#records.getEndedUnread(agentName); }
+    getUnreadReceivedCount(agentName, sessionId) { return this.#records.getUnreadReceivedCount(agentName, sessionId); }
+    markSessionDiverged(agentName, sessionId) { return this.#records.markSessionDiverged(agentName, sessionId); }
+    /**
+     * DOD-M15-CLOSEDSESSION-1 — has THIS side committed its half of the seal? The state a status row
+     * cannot show; the reasoning is in `session-closed.ts`.
+     *
+     * ⚠️ THE MARK IS MEMORY-ONLY, so the durable evidence is the second half of the answer (review
+     * F7). `#responderSealSubmitted` is cleared on teardown, so a daemon that stopped between the
+     * ctrl-leaf submit and the ceremony's status write comes back with an `active` row and no mark —
+     * and the original defect reproduces on the first send. Our own SEAL ctrl leaf is in
+     * `session_seal_leaves`, which is what the seal path itself consults before submitting a second.
+     *
+     * `"unknown"` — the read FAILED — is deliberately not treated as closed. It is the answer a
+     * broken database gives, and wedging every live session shut on it would be a far worse failure
+     * than the window it would close.
+     */
+    hasCommittedSealLeaf(agentName, sessionId) {
+        if (this.#responderSealSubmitted.has(this.#k(agentName, sessionId)))
+            return true;
+        const durable = this.#park.recoverOwnSealCtrlLeaf(agentName, sessionId);
+        return durable !== "none" && durable !== "unknown";
+    }
+    /** DOD-M15-CLOSEDSESSION-1 test seam: commit this side's half with no relay, by marking the REAL map production reads. */
+    markSealLeafCommittedForTest(agentName, sessionId) { this.#responderSealSubmitted.set(this.#k(agentName, sessionId), null); }
+    isSessionDiverged(agentName, sessionId) { return this.#records.isSessionDiverged(agentName, sessionId); }
+    /** DOD-M12B-LEAF-TRIGGERS-FETCH-1: content hashes this session has actually resolved — ingested,
+     *  held, or authored by us. A witnessed leaf whose hash is in here needs no fetch. */
+    #resolvedContent = new Map();
+    /** In-flight grace timers, keyed session+hash, so a redelivered leaf does not schedule a second
+     *  fetch for the same content — a slow relay must not be turned into a storm against itself. */
+    #leafFetchTimers = new Map();
+    /** Test seam: collapse the grace window so a test does not have to wait two real seconds. The
+     *  window itself is covered by its own case. */
+    #leafFetchGraceMs = LEAF_FETCH_GRACE_MS;
+    #standingReceivers = new Map();
+    #standingReceiverCreating = new Set();
+    // M8B F14: agents that SHOULD have a standing receiver — marked by
+    // ensureStandingReceiverForAgent (cello_start_agent / the inbound accept path) and
+    // unmarked by removeStandingReceiverForAgent (cello_set_agent_offline). Consulted by the
+    // teardown re-arm so a session-node teardown never re-arms an offline agent.
+    #agentsWantingReceiver = new Set();
+    // M8B F14: standing-receiver create retry schedule (see constructor opts).
+    #srRetryDelaysMs;
+    /** DOD-NAT-REACHABILITY-1: reservation deadline — see #startReceiverNode. */
+    #srReservationTimeoutMs;
+    /** DOD-NAT-REACHABILITY-1: watchdog for a SILENTLY lost reservation. */
+    #srWatchdogIntervalMs;
+    #srReservationRetryMs;
+    /**
+     * DOD-M12B-RESERVATION-RETRY-1: per-agent re-attempt state for a receiver the relay refused a
+     * reservation to. `attempts` counts RETRIES, not the creation attempt.
+     */
+    /** The reason the last reservation attempt was refused, per agent — captured at the rejection so
+     *  the retry and give-up can name a CAUSE instead of only their own exit point. */
+    #srLastRejectionReason = new Map();
+    /** 032-RELAYSPREAD: when this agent's receiver was last re-spread, so it never rides the 30s grid. */
+    #srReservationRetry = new Map();
+    #reservationWatchdog = null;
+    // Agents whose removeStandingReceiverForAgent ran while an #ensureStandingReceiver for them was
+    // in flight (parked on createNode/start, so the map had no entry to delete yet). The in-flight
+    // ensure checks this after start() and tears the fresh node down instead of installing an SR for
+    // an agent that has since gone offline (cello_set_agent_offline race). A fresh ensure clears it.
+    #standingReceiverRemoving = new Set();
+    // Set once gracefulShutdown begins. The standing-receiver replacement that
+    // acceptSession kicks off runs un-awaited (AC-003), so it can be in flight when
+    // shutdown starts; #createStandingReceiver checks this flag and stops a freshly
+    // built node instead of leaving an orphan bound to a TCP port (review M2).
+    #shuttingDown = false;
+    // DAEMON-004: lazily-loaded in-memory cache of each session's daemon-owned
+    // Merkle tree. The authoritative store is the session_tree_leaves table —
+    // the cache is rebuilt from it on first access (so it survives a restart).
+    #trees = new Map();
+    // DAEMON-004: per-session FIFO buffer of verified received content awaiting
+    // cello_receive. Populated by `session-content-ingest.ts` — ingestReceivedContent and the
+    // content stream handler.
+    // F1-b: a terminal answer for a sealed session, set at seal teardown BEFORE the
+    // received-content buffer is evicted. A blocking cello_receive waiting when the seal
+    // fires returns this instead of hanging or 404ing; `unreadCount` tells the caller how
+    // many buffered messages were dropped (still durable — read via cello_get_transcript).
+    // This map is deliberately NOT cleared by #evictSessionCaches (it must outlive teardown);
+    // it holds one tiny entry per sealed session for the daemon's lifetime and is cleared on
+    // restart. Idempotent: a sealed session always answers "sealed" to a receive.
+    #sessionTerminal = new Map();
+    // M7-SESSION-003: per-session direct-path counterparty liveness, observed on the
+    // session node's onPeerConnect ('alive') / onPeerDisconnect ('gone'). This is
+    // the liveness authority for direct sessions (relay sessions query the relay
+    // instead). NEVER the directory (SI-002). Read by exactly three consumers: the
+    // half-open reaper, both status surfaces, and cello_receive. No seal path reads
+    // it — the coupling to sealing runs through the receive guidance, which turns
+    // 'gone' into "call cello_close_session".
+    // DOD-M12B-ACK-1 adds 'impaired': connection up, our writes on it failing. It sits BELOW
+    // 'alive' and never above 'gone' — see #markSessionImpaired.
+    // DOD-M12B-ACK-1: WHY a session is impaired and what became of the content. Separate from the
+    // state above because the state is what surfaces print and this is what they must explain.
+    // DOD-M12B-STRAND-1: sessions whose durable holds have been read back. One read per session per
+    // process; the Map is the working copy from then on.
+    // DOD-M12B-SEAL-STUCK-1: sessions whose post-restore release has been attempted. Separate from
+    // #heldRestored so a READ-ONLY probe can hydrate without performing (or consuming) the release.
+    // DOD-M12B-SEAL-STUCK-1: sessions whose ordering state THIS PROCESS has observed — a relay
+    // witness recorded for it. `#witnessedSeq` is memory-only, so for a session that predates this
+    // daemon "no gap recorded" means "not recorded", not "no gap", and that difference decides
+    // whether we may tell an operator the session is safe to close.
+    #orderingObserved = new Set();
+    // DOD-M12B-INDEX-1: sessions whose tree and whose relay counter have provably parted. A diverged
+    // session can never produce a root the counterparty agrees with, so it must never be reported as
+    // safe to close — the close would be signed, refused as `leaf_count_mismatch`, and the receipt
+    // lost for good.
+    // DOD-M15-FRAME-1 (review F1): sessions frozen because a frame failed to verify against the
+    // expected counterparty. Consulted by `reviveSessionNode` — a teardown writes `interrupted`,
+    // which is the REVIVABLE status, so without this the next `cello_receive` silently rebuilt the
+    // session and re-admitted the same peer. NOT cleared by `#evictSessionCaches`: the freeze is a
+    // fact about the session, not about the node that was torn down to enforce it.
+    //
+    // DOD-M15-SEALWIRE-1 (part A): a MAP, not a Set, and the value is load-bearing. It was a Set when
+    // the identity freeze was the only freeze, so `reviveSessionNode` could hardcode its refusal —
+    // *"a message failed to verify against the expected counterparty's key"*. A salt disagreement now
+    // freezes through the same path, and that sentence would accuse a counterparty who did nothing:
+    // the ordinary cause is two builds that do not match. The refusal carries the freezing site's own
+    // words instead.
+    #frozenSessions = new Map();
+    /**
+     * Resolve an agent's long-term identity signer.
+     *
+     * Injected after construction, like `setParkedDrainHook`, because the daemon builds its agent key
+     * providers after this manager exists. Absent resolver, or an agent it does not know, means this
+     * side cannot sign its ephemeral — reported as `NO_LOCAL_IDENTITY` rather than quietly skipping
+     * the exchange, because "we could not" and "they would not" send the operator to opposite
+     * machines.
+     */
+    #keyProviderResolver = null;
+    /** Test-only observer of decoded inbound content frames — see `observeInboundContentFramesForTest`. */
+    #inboundFrameObserver = null;
+    // DOD-M12B-ACK-1: pending linger-resets for inbound content streams the peer has not closed.
+    // Held so shutdown can drop them rather than leave timers pointing at a torn-down node.
+    #lingeringStreams = new Set();
+    // M7-UPGRADE-002: sessions whose content integrity could NOT be verified (a content_hash
+    // mismatch = tamper was observed). The auto-acknowledge gate (SI-002) refuses to auto-co-sign
+    // for a desynced session — B must never blind-sign a tail it cannot verify. Keyed by sessionId hex.
+    //
+    // DOD-M15-SEALWIRE-1 part B1 (review F1): a MAP, not a Set, and the value is the whole fix.
+    //
+    // It was a Set because a content_hash mismatch was the only way in, so "present" could mean
+    // "tampered". B1 added two more ways for a frame to fail verification — an algorithm we cannot
+    // read, and a salted frame we hold no salt for — and BOTH ARE ORDINARY. An honest peer on a newer
+    // build produces the first. So the gate must still fire (never sign content you could not verify)
+    // while the LABEL must not accuse anyone: `unverifiable` is not `tampered`.
+    //
+    // One structure with two labels rather than two sets, deliberately: a second set is a second thing
+    // for every gate to remember to consult, and the one that gets forgotten is the one that matters.
+    #contentDesynced = new Map();
+    // DOD-MSG-4 (strict in-order): the RELAY is the ordering authority (Structure 2). For each
+    // message the relay witnesses, it delivers B a (content_hash -> canonical sequence) binding via
+    // the leaf_deliver stream. B records it here — keyed #k(agent,session) -> (contentHashHex -> seq)
+    // — and orders its transcript by THIS, never by a sender-stamped field (sovereign-node: B does
+    // not trust the counterparty for ordering). When B has no witness for an arriving hash
+    // (relay-degraded), it falls back to arrival-order append.
+    #witnessedSeq = new Map();
+    /**
+     * DOD-M15-SEALPRECOND-1 — our OWN leaves the relay has ordered and this tree has not yet placed,
+     * keyed #k(agent,session) -> (contentHashHex -> assigned leaf index). `#witnessedSeq` above holds
+     * only the COUNTERPARTY's, so nothing in the seal gate could see a send of ours between the relay
+     * assigning its sequence and `placeOwnLeaf` writing it — the window the 2026-09-11 close signed
+     * a two-leaf root inside, losing the receipt for both sides.
+     */
+    #ownLeavesOrdered = new Map();
+    // DOD-MSG-4: out-of-order direct arrivals. A content frame whose canonical sequence is AHEAD of
+    // the next expected leaf is HELD here (keyed #k(agent,session) -> (canonicalSeq -> entry)) instead
+    // of being appended out of order. Once the missing in-between sequence(s) land (recovered from the
+    // relay mailbox), #releaseHeld drains the held entries in canonical order. content is plaintext in
+    // memory only — evicted on teardown, same as the other per-session caches.
+    /**
+     * DOD-M15-SEALWIRE-1 bullet 5 — `authorship` rides the held entry.
+     *
+     * A SENT message that lands ahead of our tree tail is held here and its transcript row is written
+     * later, on release. The hold happens AFTER the submit, so it was signed exactly like an unheld
+     * one — without carrying the proof through, a message that happened to queue behind a gap became
+     * permanently less provable than the identical message that did not, for a reason with nothing to
+     * do with authorship.
+     */
+    /**
+     * 033-ACKEMIT review F1 — what this side has ACTUALLY RECEIVED, per session: the canonical
+     * position and the content hash at it.
+     *
+     * ⚠️ **IT MIRRORS THE RELAY CLIENT'S `#lastSeen` RATHER THAN REPLACING IT, and the duplication is
+     * deliberate.** The submit path needs the value on the client, because that is where the claim is
+     * built; the unwitnessed content path needs it here, because a session with no relay client has no
+     * client to read it from. Both are written from ONE place — `noteAcknowledgeable`, in
+     * `session-content-ingest.ts` — so they
+     * cannot come to disagree, and the client is preferred on read because it also sees leaves the
+     * relay delivered that never came through this path.
+     */
+    #lastAck = new Map();
+    #heldContent = new Map();
+    // DOD-MSG-4: the relay's high-water canonical sequence for this session — the largest sequence the
+    // relay has witnessed (max over leaf_deliver). Keyed #k(agent,session). EXPOSED for the next
+    // sub-increment (catch-up-before-live: on reconnect, hold live arrivals until the tree reaches this
+    // so a fresh message can't append ahead of earlier ones still parked) — it is NOT yet consumed by
+    // the gate, which today holds purely on the per-message `canonicalSeq > nextExpected` test.
+    #highWaterSeq = new Map();
+    // M7-UPGRADE-002: sessions for which B has already submitted its responder SEAL leaf (via
+    // auto-ack OR cello_close_session). Idempotency guard — A's SEAL ctrl leaf may be delivered
+    // more than once (and the relay echoes leaves), so auto-ack fires AT MOST ONCE per session.
+    // M8B FINDING-1: the value carries the first successful submit's reportedRootHex/sequenceNumber
+    // (null while the submit is still in flight), so a RETRY close can escalate to a unilateral
+    // seal with the original reported root instead of deadlocking on seal_pending_bilateral.
+    #responderSealSubmitted = new Map();
+    // M7-SESSION-001 (M-1 PUSH): optional callback fired when a session changes
+    // state, so the composition root can dispatch a session_state_changed
+    // notification to live MCP clients. Injected via a setter AFTER construction
+    // because the NotificationDispatcher is built later than this manager in
+    // daemon.ts (it depends on the IPC server). Never required — when unset,
+    // state changes are persisted and logged but no push notification is emitted.
+    /**
+     * Fix #1 EXTENSION (cross-node seal-liveness), injected by daemon.ts because the broker-dial
+     * machinery (consortium roster + visiting connections) lives above this class.
+     *
+     * The AUTO-ACKNOWLEDGE path below submits a seal leaf, and the directory answers it within ~60ms
+     * by pushing `seal_verified` to the INITIATOR. On a cross-node session the initiator released its
+     * visiting connection to the broker after setup, so that push finds no stream, the directory
+     * ENQUEUES the frame instead, and the seal blocks forever waiting for a co-signature it never
+     * asked for. close-session-handler already guards its own path this way; the auto-ack path did
+     * not, and it is the path that fires FIRST whenever the counterparty closes first.
+     *
+     * Unset (single-node / M6 back-compat) is fine: the initiator is reachable on its home stream.
+     */
+    #ensureSealBroker;
+    #onSessionStateChanged = null;
+    // M8C-MSGWAKE-1 (channel stage 2): fired when a verified inbound message is buffered for
+    // cello_receive, so the daemon can push a content-free `cello_message` doorbell. Wired in
+    // daemon.ts (depends on the notification dispatcher). Content-free by signature — carries only
+    // agent / session / senderPubkey, NEVER the plaintext (INV-CONTENTFREE).
+    #onContentArrived = null;
+    /**
+     * M14 / DOD-DOC-INBOUND-2: the document-layer interception, injected by the composition root.
+     *
+     * Returns whether the document layer CONSUMED the frame. Absent (the default) means every frame
+     * is conversation, exactly as before — the document layer cannot change message handling by being
+     * unwired, which is the property that lets it be wired incrementally.
+     *
+     * It is handed the decrypted CONTENT, unlike `#onContentArrived`, which is content-free by
+     * signature. That is unavoidable: deciding whether bytes are a document frame requires the bytes.
+     * The router it calls never logs them.
+     */
+    /**
+     * ⚠️ THE RETURN TYPE USED TO DECLARE `ok?: boolean; reason?: string`, AND THE PRODUCER CANNOT
+     * SUPPLY EITHER. Narrowed so reading them is a compile error rather than a silent `undefined`.
+     *
+     * The implementation is `DocumentFrameRouter.routeSync`, whose own return type
+     * (`FrameClassification`) is exactly `{consumed:false} | {consumed:true; kind}` — it has no such
+     * fields at all. The wider shape here was a promise only this declaration made, and it was
+     * assignable precisely because the extra members were optional.
+     *
+     * It is not an oversight in the router: `routeSync` dispatches with `void this.#enqueue(...)`, so
+     * when it returns, the frame has been classified and queued and **no verdict exists yet**. A
+     * synchronous caller cannot be told an asynchronous outcome.
+     *
+     * **The cost of the lie was a wrong lead.** `j-stale-session`'s investigation read those fields'
+     * absence from every log line as "the router returned neither" and filed it as the next thread to
+     * pull. There was no thread: a JSON logger omits `undefined`, so a field that can never be set is
+     * indistinguishable from one that was set to nothing. The verdict lives on
+     * `document.frame.refused`, joined by `correlationId`.
+     */
+    #onDocumentFrame = null;
+    /**
+     * DOD-DOC-SCREEN-CLASSIFY-1: the classify-only half of the hook above — is this a document
+     * frame, deciding nothing else. Injected together with it so the two cannot disagree about what
+     * a document frame is. Null means every frame takes the full inbound screen, exactly as before
+     * the document layer existed.
+     */
+    #isDocumentFrame = null;
+    // A send is NOT fire-and-forget. After a content_frame is delivered over the direct session
+    // channel, the sender arms a TTF timer and waits for an unsigned, transport-authenticated
+    // `persisted` delivery ACK on the same /cello/content/1.0.0 protocol. A persisted ACK cancels the
+    // timer (content.delivery.acked); TTF expiry hands the content to the park backstop.
+    // Keyed sessionId → contentHashHex → entry.
+    #awaitingAck = new Map();
+    // TTF (time-to-flush) for an un-acked content entry. Injectable so tests can drive
+    // expiry deterministically; production default sits in the Part-4 proposed 10–30s band.
+    #contentTtfMs = 20_000;
+    // CELLO-M7-MSG-001: side-effect hooks the composition root wires to the durable
+    // retry_queue (and, in 3b, the relay park deposit). Injected after construction
+    // because RetryQueue is built later in daemon.ts. When unset, the awaiting-ACK timer
+    // still fires and the ACK still resolves — only the durable crash-backstop is skipped.
+    // DOD-RETRYQ-STRAND-1: fired on the transition INTO a status from which no resend can ever
+    // succeed, so durable state keyed to that session gets a disposition instead of stranding.
+    // Injected after construction because RetryQueue is built later in daemon.ts.
+    #onSessionTerminal = null;
+    #onAwaitingPersisted = null;
+    #onAwaitingTtf = null;
+    // M12-P12 verification: force the next N park deposits to be REFUSED, so the failure this unit
+    // fixes can be produced on demand instead of waited for. The real failure is a race — the deposit
+    // is refused only in the seconds-long window while the sender's standing receiver rebuilds — and
+    // no CLI lever reaches that window: set-agent-offline leaves an open session's node serving, and
+    // the CLI refuses a send from an offline agent. Without this the fix ships unwatched.
+    // INERT unless the daemon is started with CELLO_FAULT_INJECTION=1; the IPC handler that sets it
+    // refuses outright otherwise, so a normal daemon cannot be talked into dropping messages.
+    // The incident needs BOTH halves: the direct dial has to fail (or the park path is never entered
+    // — measured, the counterparty's session node accepts the frame and reports delivered:true even
+    // with its agent away), and the park deposit that follows has to be refused. One without the
+    // other reproduces nothing.
+    #sendFaultRemaining = 0;
+    // DOD-M12B-ACK-1 — the same seam for the delivery-ACK write. See injectAckFault.
+    #ackFaultRemaining = 0;
+    // DOD-M12B-REDIAL-1 — makes the next N `newStream` calls report the connection as gone, BEFORE
+    // the node is touched. The sibling of injectSendFault for the one condition that used to end a
+    // conversation permanently; a real connection drop is not reproducible in-process.
+    #connectionLossRemaining = 0;
+    // DOD-M12B-REDIAL-1: the counterparty addresses this session dialled, kept so it can dial them
+    // again. They arrived in the FROST-signed assignment and were used once and dropped, which is
+    // why nothing could ever re-dial.
+    #counterpartyAddrs = new Map();
+    // DOD-M12B-REDIAL-1: when this session may next attempt a re-dial. Continuous re-dialling is what
+    // produced the 2026-08-17 notification storm, so a burst of sends against a peer that is gone
+    // costs one attempt, not one per message.
+    #redialNotBefore = new Map();
+    /** Arm the direct-send fault — makes the next N sends take the dial-failure path. */
+    injectSendFault(count) {
+        this.#sendFaultRemaining = Math.max(0, count);
+        return this.#sendFaultRemaining;
+    }
+    /** DOD-M12B-ACK-1: arm the delivery-ACK write fault — the sibling of injectSendFault for the
+     *  path that fails on a LISTENING agent. Without it the ACK failure branch (which impairs the
+     *  session and, until this milestone, could never clear it again) is unreachable from a test:
+     *  a listener sends no content, so the direct-send fault never fires for it. */
+    injectAckFault(count) {
+        this.#ackFaultRemaining = Math.max(0, count);
+        return this.#ackFaultRemaining;
+    }
+    /** DOD-M12B-REDIAL-1: arm the connection-loss fault — the next N direct sends find no open
+     *  connection, exactly as they do after any blip. See #connectionLossRemaining. */
+    injectConnectionLoss(count) {
+        this.#connectionLossRemaining = Math.max(0, count);
+        return this.#connectionLossRemaining;
+    }
+    // M12-P12: the durable enqueue for a park deposit that FAILED. Distinct from onTtf because the
+    // cause is distinct — nothing timed out here, the deposit was refused — and an event named for
+    // the wrong cause is how this path stayed invisible.
+    // M12-P13 (review HIGH-1): returns whether the content is ACTUALLY queued. `false` means the
+    // queue dropped it (today: the content-derived dedupe key collided), and the caller must then not
+    // claim durability — nor commit the leaf that claim now authorises.
+    #onParkFailed = null;
+    constructor(opts) {
+        this.#factory = opts.factory;
+        this.#logger = opts.logger;
+        // REQUIRED, no fallback (INV-9, audit finding). This check used to read
+        // `opts.securityGateway ?? new PassthroughGatewayClient()` — the identical shape as the defect
+        // that reopened this milestone, one layer down and still shipping in the binary. `daemon.ts`
+        // was hardened to throw while this constructor was not, so the inbound screen had a silent
+        // always-allow path that nothing in the product reached TODAY and any future refactor could.
+        // "Currently unreachable" is a property of today's call sites, not of the code.
+        //
+        // ⚠️ CHECKED AND ASSIGNED FIRST, ahead of every collaborator: the content pipeline below is
+        // handed this client by value, and a constructor cannot hand out a field it has not set. It also
+        // means a caller that forgot to screen is told before the manager builds anything.
+        if (!opts.securityGateway) {
+            throw new Error("SessionNodeManager: securityGateway is required (INV-9). The inbound screen has no " +
+                "always-allow fallback, because that fallback is how the entire security layer shipped " +
+                "inert. Pass a real client, or new PassthroughGatewayClient() from a test that " +
+                "deliberately does not screen.");
+        }
+        this.#securityGateway = opts.securityGateway;
+        // ⚠️ BUILT FIRST, AND THE ORDER IS LOAD-BEARING: `#authorship` and `#refusals` close over
+        // `this.#records`. Nothing invokes them during construction today (every context member is a
+        // lazy arrow), but tsc caught this exact class once on `#logger`, and the next line added to
+        // this constructor is the one that would pay for it.
+        this.#records = new SessionRecords({
+            logger: this.#logger,
+            db: () => this.#db,
+            sessionKey: (a, sid) => this.#k(a, sid),
+            requireAgentId: (a) => this.#requireAgentId(a),
+            witnessUnreadable: this.#witnessUnreadable,
+        });
+        this.#authorship = new AuthorshipVerifier({
+            logger: this.#logger,
+            sessionKey: (a, sid) => this.#k(a, sid),
+            getSessionRecord: (a, sid) => this.#queries.getSessionRecord(a, sid),
+            getSessionTree: (a, sid) => this.getSessionTree(a, sid),
+            isSessionDiverged: (a, sid) => this.#records.isSessionDiverged(a, sid),
+            sessionGenesisPrevRoot: (a, sid) => this.#leafRecords.sessionGenesisPrevRoot(a, sid),
+            relaySessionIdBytes: (a, sid) => this.#activeNodes.get(this.#k(a, sid))?.relaySessionIdBytes,
+            heldContentFor: (a, sid) => this.#heldContent.get(this.#k(a, sid)),
+        });
+        this.#refusals = new InboundRefusals({
+            logger: this.#logger,
+            // A function, not a value: the database is opened after construction, so a snapshot taken
+            // here would be null for the life of the process.
+            db: () => this.#db,
+            sessionKey: (a, sid) => this.#k(a, sid),
+            requireAgentId: (a) => this.#requireAgentId(a),
+            cancelLeafFetch: (key, hashHex) => this.#contentIn.cancelLeafFetch(key, hashHex),
+            noteContentRefusal: (a, sid, reason, detail) => this.#notices.noteContentRefusal(a, sid, reason, detail),
+            recordTranscriptMessage: (...args) => this.#records.recordTranscriptMessage(...args),
+            recordWitnessedSequence: (a, sid, h, n) => this.recordWitnessedSequence(a, sid, h, n),
+            getTier: (a, pk) => this.#records.getTier(a, pk),
+            resolveTierBound: (a, t, f) => this.#records.resolveTierBound(a, t, f),
+            mailboxRouteAvailable: (a) => this.#mailboxRouteAvailable(a),
+            receivedBytesTotal: (a, sid) => this.#queries.getReceivedBytesTotal(a, sid),
+            verifyAuthorshipClaim: (a, sid, s1, sig, h) => this.#authorship.verifyAuthorshipClaim(a, sid, s1, sig, h),
+        });
+        this.#park = new ParkRecovery({
+            logger: this.#logger,
+            refusals: this.#refusals,
+            shuttingDown: () => this.#shuttingDown,
+            sessionKey: (a, sid) => this.#k(a, sid),
+            requireAgentId: (a) => this.#requireAgentId(a),
+            ownPubkeyHex: (a) => this.#queries.ownPubkeyHex(a),
+            activeEntry: (key) => this.#activeNodes.get(key),
+            agentsWithLiveReceiver: () => this.#standingReceivers.keys(),
+            agentWantsReceiver: (a) => this.#agentsWantingReceiver.has(a),
+            getSessionRecord: (a, sid) => this.#queries.getSessionRecord(a, sid),
+            getSealCarry: (pk, sid) => this.#seal.getSealCarry(pk, sid),
+            getSessionTree: (a, sid) => this.getSessionTree(a, sid),
+            recordOrderingRecord: (a, sid, s1, s2, h, cid) => this.recordOrderingRecord(a, sid, s1, s2, h, cid),
+            ingestReceivedContent: (a, sid, c, h, cid, seq, alg) => this.ingestReceivedContent(a, sid, c, h, cid, seq, alg),
+            witnessReceivedLeaf: (a, sid, h, s1, sig, kind, cid) => this.#contentIn.witnessReceivedLeaf(a, sid, h, s1, sig, kind, cid),
+            noteAcknowledgeable: (a, sid, seq, h) => this.#contentIn.noteAcknowledgeable(a, sid, seq, h),
+            sendDeliveryAck: (a, sid, h, cid) => { void sendDeliveryAck(contentCtx, a, sid, h, cid); },
+            persistedRelayEndpoint: (a, sid) => this.#queries.getPersistedRelayEndpoint(a, sid),
+        }, opts.parkedDrainBackstopMs ?? PARKED_DRAIN_BACKSTOP_DEFAULT_MS);
+        this.#salts = new SessionSalts({
+            logger: this.#logger,
+            db: () => this.#db,
+            sessionKey: (a, sid) => this.#k(a, sid),
+            requireAgentId: (a) => this.#requireAgentId(a),
+            activeEntry: (key) => this.#activeNodes.get(key),
+            getSessionTree: (a, sid) => this.getSessionTree(a, sid),
+            getSessionRecord: (a, sid) => this.#queries.getSessionRecord(a, sid),
+            heldContentFor: (key) => this.#heldContent.get(key),
+            ensureHeldRestored: (a, sid, opts) => this.#held.ensureHeldRestored(a, sid, opts),
+            awaitingAck: this.#awaitingAck,
+            contentEncryptionState: (a, sid) => this.#ephemerals.contentEncryptionState(a, sid),
+            freezeSession: (a, sid, reason, narrative, cid) => this.#freezeSession(a, sid, reason, narrative, cid),
+            sendSaltFrame: (a, sid, cid, override) => this.#sendSaltFrame(a, sid, cid, override),
+        });
+        this.#queries = new SessionQueries({
+            logger: this.#logger,
+            db: () => this.#db,
+            requireAgentId: (a) => this.#requireAgentId(a),
+            sessionKey: (a, sid) => this.#k(a, sid),
+            unkey: (key, agentName) => this.#unk(key, agentName),
+        });
+        this.#notices = new RefusalNotices({
+            logger: this.#logger,
+            queries: this.#queries,
+            db: () => this.#db,
+            requireAgentId: (a) => this.#requireAgentId(a),
+            sessionKey: (a, sid) => this.#k(a, sid),
+            unkey: (key, agentName) => this.#unk(key, agentName),
+        });
+        this.#ephemerals = new SessionEphemerals({
+            logger: this.#logger,
+            sessionKey: (a, sid) => this.#k(a, sid),
+            activeEntry: (key) => this.#activeNodes.get(key),
+            keyProvider: (a) => this.#keyProviderResolver?.(a),
+            freezeSessionForKeyRefusal: (a, sid, reason, cid) => this.#freezeSessionForKeyRefusal(a, sid, reason, cid),
+        });
+        this.#liveness = new SessionLiveness({
+            logger: this.#logger,
+            queries: this.#queries,
+            notices: this.#notices,
+            ephemerals: this.#ephemerals,
+            counterpartyAddrs: this.#counterpartyAddrs,
+            sessionKey: (a, sid) => this.#k(a, sid),
+            activeEntry: (key) => this.#activeNodes.get(key),
+            sendSaltFrame: (a, sid, cid, override) => this.#sendSaltFrame(a, sid, cid, override),
+        });
+        this.#witness = new WitnessAlerts({ logger: this.#logger });
+        this.#held = new HeldContent({
+            logger: this.#logger,
+            queries: this.#queries,
+            records: this.#records,
+            db: () => this.#db,
+            sessionKey: (a, sid) => this.#k(a, sid),
+            requireAgentId: (a) => this.#requireAgentId(a),
+            heldContent: this.#heldContent,
+            witnessedSeq: this.#witnessedSeq,
+            getSessionTree: (a, sid) => this.getSessionTree(a, sid),
+            appendSessionLeaf: (a, sid, kind, h, cid) => this.appendSessionLeaf(a, sid, kind, h, cid),
+            appendVerifiedContent: (a, sid, c, h, pk, cid, orig, auth) => this.#contentIn.appendVerifiedContent(a, sid, c, h, pk, cid, orig, auth),
+        });
+        this.#leafRecords = new SessionLeafRecords({
+            logger: this.#logger,
+            queries: this.#queries,
+            db: () => this.#db,
+            sessionKey: (a, sid) => this.#k(a, sid),
+            requireAgentId: (a) => this.#requireAgentId(a),
+            activeEntry: (key) => this.#activeNodes.get(key),
+        });
+        /**
+         * ⚠️ **CONSTRUCTED LAST OF THE COLLABORATORS, and the reason is the same one written above
+         * `#records`:** every collaborator below is handed to it BY VALUE, so each has to already
+         * exist. `#receivers` is built after this and is not reachable from the content path.
+         *
+         * `mgr` exists because the getters below need the MANAGER's fields, and a getter written in an
+         * object literal binds `this` to the literal. The alternative — capturing the values — is the
+         * defect that once left `keyProvider` frozen at `null`, so signing stopped and sessions fell
+         * back to unencrypted content with the whole suite green. Anything the manager can REPLACE
+         * after this line is reached through a getter; anything it cannot is passed straight through.
+         */
+        // The rule is right about the pattern it was written for — `var self = this` standing in for a
+        // closure. This is the one case the language forces: a `get` in an object literal binds `this`
+        // to the LITERAL, so a getter cannot reach the manager's fields without a name for it. The
+        // alternative is passing the values, which is the defect this whole block exists to avoid.
+        // eslint-disable-next-line @typescript-eslint/no-this-alias
+        const mgr = this;
+        const contentCtx = {
+            logger: this.#logger,
+            securityGateway: this.#securityGateway,
+            hasCommittedSealLeaf: (a, sid) => mgr.hasCommittedSealLeaf(a, sid),
+            records: this.#records,
+            authorship: this.#authorship,
+            refusals: this.#refusals,
+            park: this.#park,
+            salts: this.#salts,
+            queries: this.#queries,
+            notices: this.#notices,
+            ephemerals: this.#ephemerals,
+            liveness: this.#liveness,
+            held: this.#held,
+            leafRecords: this.#leafRecords,
+            // One Map object each, shared — never a copy. See the context's own note.
+            activeNodes: this.#activeNodes,
+            awaitingAck: this.#awaitingAck,
+            heldContent: this.#heldContent,
+            witnessedSeq: this.#witnessedSeq,
+            ownLeavesOrdered: this.#ownLeavesOrdered,
+            leafFetchTimers: this.#leafFetchTimers,
+            lastAck: this.#lastAck,
+            resolvedContent: this.#resolvedContent,
+            undeliverableSeqs: this.#undeliverableSeqs,
+            highWaterSeq: this.#highWaterSeq,
+            counterpartyAddrs: this.#counterpartyAddrs,
+            lingeringStreams: this.#lingeringStreams,
+            redialNotBefore: this.#redialNotBefore,
+            orderingObserved: this.#orderingObserved,
+            // Settable after this point — `#contentTtfMs` is overridden from `opts` three lines below.
+            get shuttingDown() { return mgr.#shuttingDown; },
+            get contentTtfMs() { return mgr.#contentTtfMs; },
+            get leafFetchGraceMs() { return mgr.#leafFetchGraceMs; },
+            get ownChainStore() { return mgr.#ownChainStore; },
+            // Wired by the composition root long after construction; `null` until then, and `null` is an
+            // answer the pipeline reports rather than papers over.
+            get onParkFailed() { return mgr.#onParkFailed; },
+            get onContentArrived() { return mgr.#onContentArrived; },
+            get onDocumentFrame() { return mgr.#onDocumentFrame; },
+            get isDocumentFrame() { return mgr.#isDocumentFrame; },
+            get onAwaitingPersisted() { return mgr.#onAwaitingPersisted; },
+            get inboundFrameObserver() { return mgr.#inboundFrameObserver; },
+            // Read AND decremented by the pipeline, so these are the one place a pair is needed.
+            get sendFaultRemaining() { return mgr.#sendFaultRemaining; },
+            set sendFaultRemaining(v) { mgr.#sendFaultRemaining = v; },
+            get ackFaultRemaining() { return mgr.#ackFaultRemaining; },
+            set ackFaultRemaining(v) { mgr.#ackFaultRemaining = v; },
+            get connectionLossRemaining() { return mgr.#connectionLossRemaining; },
+            set connectionLossRemaining(v) { mgr.#connectionLossRemaining = v; },
+            sessionKey: (a, sid) => this.#k(a, sid),
+            keyProvider: (a) => this.#keyProviderResolver?.(a),
+            getSessionTree: (a, sid) => this.getSessionTree(a, sid),
+            appendSessionLeaf: (a, sid, kind, h, cid) => this.appendSessionLeaf(a, sid, kind, h, cid),
+            mailboxRouteAvailable: (a) => this.#mailboxRouteAvailable(a),
+            streamCensus: (node, peerId) => this.#streamCensus(node, peerId),
+            freezeOnIdentityFailure: (a, sid, reason, cid) => this.#freezeOnIdentityFailure(a, sid, reason, cid),
+            handleTtfExpiry: (a, sid, hashHex) => this.#handleTtfExpiry(a, sid, hashHex),
+            markContentUnverifiable: (a, sid, why) => this.#markContentUnverifiable(a, sid, why),
+            maybeAutoAcknowledgeSeal: (a, sid, cid) => this.#seal.maybeAutoAcknowledgeSeal(a, sid, cid),
+            ownChainOf: (a, sid, entry, ownPubkey) => this.#ownChainOf(a, sid, entry, ownPubkey),
+            updateSessionStatus: (a, sid, status, by) => this.#life.updateSessionStatus(a, sid, status, by),
+            abandonSession: (a, sid) => this.#life.abandonSession(a, sid),
+            connectToCounterparty: (a, sid, addrs) => this.#life.connectToCounterparty(a, sid, addrs),
+            destroySessionNode: (a, sid, reason) => this.#life.destroySessionNode(a, sid, reason),
+            retireOnCounterpartyAbandon: (a, sid, cid) => this.#life.retireOnCounterpartyAbandon(a, sid, cid),
+        };
+        // The sender first: the receiver holds it, and nothing holds the receiver.
+        this.#contentOut = new SessionContentSender(contentCtx);
+        this.#contentIn = new SessionContentIngest(contentCtx, this.#contentOut);
+        this.#dbPath = opts.dbPath;
+        if (typeof opts.contentTtfMs === "number" && opts.contentTtfMs > 0) {
+            this.#contentTtfMs = opts.contentTtfMs;
+        }
+        this.#autoNatProbers = opts.autoNatProbers ?? (() => []);
+        this.#srRetryDelaysMs = opts.standingReceiverRetryDelaysMs ?? [1_000, 5_000, 15_000];
+        this.#srReservationTimeoutMs = opts.standingReceiverReservationTimeoutMs ?? 15_000;
+        // ⚠️ BUILT AFTER the retry/timeout settings it captures. Those come from `opts` with defaults
+        // applied HERE, and a collaborator constructed above them would capture `undefined` — the
+        // same class tsc caught on `#logger`. Duplicating the defaults at the call site would be
+        // worse: two places deciding one number is how they stop agreeing.
+        this.#receivers = new StandingReceivers({
+            logger: this.#logger,
+            records: this.#records,
+            park: this.#park,
+            factory: this.#factory,
+            db: () => this.#db,
+            shuttingDown: () => this.#shuttingDown,
+            sessionKey: (a, sid) => this.#k(a, sid),
+            standingReceivers: this.#standingReceivers,
+            standingReceiverCreating: this.#standingReceiverCreating,
+            agentsWantingReceiver: this.#agentsWantingReceiver,
+            srReservationRetry: this.#srReservationRetry,
+            srLastRejectionReason: this.#srLastRejectionReason,
+            directoryRelayEndpoints: this.#directoryRelayEndpoints,
+            standingReceiverRemoving: this.#standingReceiverRemoving,
+            srRetryDelaysMs: this.#srRetryDelaysMs,
+            srReservationTimeoutMs: this.#srReservationTimeoutMs,
+            autoNatProbers: () => this.#autoNatProbers(),
+            proveToRelay: (a, circuitAddr, node, cid, surface) => this.#relay.proveToRelay(a, circuitAddr, node, cid, surface),
+            tellRelayReleased: (a, relayPeerId, node, cid) => this.#relay.tellRelayReleased(a, relayPeerId, node, cid),
+            reservationCircuitAddrs: (a) => this.#relay.reservationCircuitAddrs(a),
+            // 055-ONDEMAND — the abandoned-offer release asks these two: did the session this offer was
+            // for actually start, and what do the agent's remaining live sessions still need?
+            sessionIsLive: (a, sid) => this.#activeNodes.has(this.#k(a, sid)),
+            // ⚠️ `heldRelayIdsOf`, NOT a substring test — 056-SLOTDEAD. This shipped asking only whether an
+            // address contains `p2p-circuit`, a looser definition than the rest of the daemon's. One that
+            // does not NAME its relay cannot be watched, proved to, or admitted inbound (`msg-018` says so),
+            // yet this reported `reserved` — an undialable agent looking healthy where an operator looks first.
+            anyLiveSessionHoldsCircuit: (a) => [...this.#activeNodes.values()]
+                .some((e) => e.agentName === a && heldRelayIdsOf(e.node).length > 0),
+            authenticateStandingReceiver: (a, node, relayPeerId, heldCircuitAddr, cid) => this.#relay.authenticateStandingReceiver(a, node, relayPeerId, heldCircuitAddr, cid),
+        });
+        /**
+         * ⚠️ BUILT AFTER `#receivers`, which it holds BY VALUE — the same ordering rule as every
+         * collaborator above, and the one tsc caught on `#logger`. The seal path falls back to the
+         * agent's standing receiver when an interrupted session has no node of its own, so a seal
+         * constructed before the receivers would have captured `undefined` for exactly the case it
+         * exists to serve.
+         *
+         * `mgr` again, and for the same reason as the content context above: the two seal stores are
+         * opened LAZILY — on first use, because they need a database that does not exist yet — and both
+         * sides must end up holding the SAME instance. Passing them by value would have handed this file
+         * a permanent `null` and let it open a second store over the same rows.
+         */
+        this.#seal = new SessionSeal({
+            logger: this.#logger,
+            records: this.#records,
+            queries: this.#queries,
+            park: this.#park,
+            held: this.#held,
+            leafRecords: this.#leafRecords,
+            receivers: this.#receivers,
+            db: () => this.#db,
+            activeNodes: this.#activeNodes,
+            heldContent: this.#heldContent,
+            witnessedSeq: this.#witnessedSeq,
+            ownLeavesOrdered: this.#ownLeavesOrdered,
+            highWaterSeq: this.#highWaterSeq,
+            orderingObserved: this.#orderingObserved,
+            contentDesynced: this.#contentDesynced,
+            responderSealSubmitted: this.#responderSealSubmitted,
+            relayClients: this.#relayClients,
+            get relayReceiptStore() { return mgr.#relayReceiptStore; },
+            set relayReceiptStore(v) { mgr.#relayReceiptStore = v; },
+            get sealLeafStore() { return mgr.#sealLeafStore; },
+            set sealLeafStore(v) { mgr.#sealLeafStore = v; },
+            get ensureSealBroker() { return mgr.#ensureSealBroker; },
+            set ensureSealBroker(v) { mgr.#ensureSealBroker = v; },
+            get onSessionStateChanged() { return mgr.#onSessionStateChanged; },
+            get ownChainStore() { return mgr.#ownChainStore; },
+            get detachedRelayClientBuilder() { return mgr.#detachedRelayClientBuilder; },
+            sessionKey: (a, sid) => this.#k(a, sid),
+            requireAgentId: (a) => this.#requireAgentId(a),
+            getSessionTree: (a, sid) => this.getSessionTree(a, sid),
+            getSessionTreeRootHex: (a, sid) => this.getSessionTreeRootHex(a, sid),
+            getDirectoryOnlineToken: (a) => this.getDirectoryOnlineToken(a),
+            getKeyProvider: (a) => this.#keyProviderResolver?.(a),
+            destroySessionSeed: (a, sid) => this.#life.destroySessionSeed(a, sid),
+            updateSessionStatus: (a, sid, status, by) => this.#life.updateSessionStatus(a, sid, status, by),
+        });
+        /**
+         * ⚠️ ALSO AFTER `#receivers`, and after `#contentIn` — both held by value. The reservation
+         * watchdog reads the standing receivers directly, and a witnessed leaf arriving on a relay
+         * stream is handed straight to the ingest side. Built before either, this would have captured
+         * `undefined` for the two things it exists to connect.
+         *
+         * The two stores and the watchdog handle are accessors for the same reason as the seal's: they
+         * are written after construction, and both sides must see one instance rather than each opening
+         * its own over the same rows.
+         */
+        this.#relay = new SessionRelay({
+            logger: this.#logger,
+            records: this.#records,
+            queries: this.#queries,
+            // 055-ONDEMAND: the watchdog re-takes a live session's circuit rather than rebuilding a
+            // receiver that would reserve nothing.
+            retakeReservationOn: (a, node, c, cid) => this.#receivers.retakeReservationOn(a, node, c, cid),
+            park: this.#park,
+            refusals: this.#refusals,
+            leafRecords: this.#leafRecords,
+            receivers: this.#receivers,
+            witness: this.#witness,
+            contentIn: this.#contentIn,
+            // DOD-M15-AWAYSCOPE-1: injected, and the daemon sets it in the composition root. The manager
+            // cannot answer it — attendance is an IPC-layer fact (who has claimed this agent), and this
+            // class is deliberately connection-agnostic.
+            currentAttendance: (agentName) => this.#currentAttendance(agentName),
+            db: () => this.#db,
+            activeNodes: this.#activeNodes,
+            relayClients: this.#relayClients,
+            standingReceivers: this.#standingReceivers,
+            agentsWantingReceiver: this.#agentsWantingReceiver,
+            directoryRelayEndpoints: this.#directoryRelayEndpoints,
+            relayQuarantine: this.#relayQuarantine,
+            srReservationRetry: this.#srReservationRetry,
+            srLastRejectionReason: this.#srLastRejectionReason,
+            srRelayRefusal: this.#srRelayRefusal,
+            get shuttingDown() { return mgr.#shuttingDown; },
+            get srReservationRetryMs() { return mgr.#srReservationRetryMs; },
+            get srWatchdogIntervalMs() { return mgr.#srWatchdogIntervalMs; },
+            get ownChainStore() { return mgr.#ownChainStore; },
+            get relayReceiptStore() { return mgr.#relayReceiptStore; },
+            set relayReceiptStore(v) { mgr.#relayReceiptStore = v; },
+            get sealLeafStore() { return mgr.#sealLeafStore; },
+            set sealLeafStore(v) { mgr.#sealLeafStore = v; },
+            get reservationWatchdog() { return mgr.#reservationWatchdog; },
+            set reservationWatchdog(v) { mgr.#reservationWatchdog = v; },
+            get detachedRelayClientBuilder() { return mgr.#detachedRelayClientBuilder; },
+            sessionKey: (a, sid) => this.#k(a, sid),
+            requireAgentId: (a) => this.#requireAgentId(a),
+            getDirectoryOnlineToken: (a) => this.getDirectoryOnlineToken(a),
+            withDirectoryCause: (a, refusal) => this.#withDirectoryCause(a, refusal),
+            markInterruptedWithDetails: (a, sid, n, source) => this.#life.markInterruptedWithDetails(a, sid, n, source),
+        });
+        /**
+         * ⚠️ LAST, because it holds every other collaborator by value — it is the path that stands a
+         * session up and tears it down, so it touches all of them. Anything added above this line is
+         * fine; anything added below and handed to it by value is the `undefined` capture this
+         * constructor has now been bitten by three times.
+         */
+        this.#life = new SessionLifecycle({
+            logger: this.#logger,
+            records: this.#records,
+            queries: this.#queries,
+            park: this.#park,
+            held: this.#held,
+            leafRecords: this.#leafRecords,
+            receivers: this.#receivers,
+            ephemerals: this.#ephemerals,
+            liveness: this.#liveness,
+            contentIn: this.#contentIn,
+            contentOut: this.#contentOut,
+            relay: this.#relay,
+            db: () => this.#db,
+            activeNodes: this.#activeNodes,
+            standingReceivers: this.#standingReceivers,
+            standingReceiverCreating: this.#standingReceiverCreating,
+            agentsWantingReceiver: this.#agentsWantingReceiver,
+            counterpartyAddrs: this.#counterpartyAddrs,
+            sessionSeeds: this.#sessionSeeds,
+            frozenSessions: this.#frozenSessions,
+            sessionTerminal: this.#sessionTerminal,
+            get shuttingDown() { return mgr.#shuttingDown; },
+            get autoNatProbers() { return mgr.#autoNatProbers; },
+            get onSessionStateChanged() { return mgr.#onSessionStateChanged; },
+            get onSessionTerminal() { return mgr.#onSessionTerminal; },
+            get retryDrainHook() { return mgr.#retryDrainHook; },
+            sessionKey: (a, sid) => this.#k(a, sid),
+            requireAgentId: (a) => this.#requireAgentId(a),
+            resolveAgentId: (a) => this.resolveAgentId(a),
+            getSessionTree: (a, sid) => this.getSessionTree(a, sid),
+            evictSessionCaches: (a, sid) => this.#evictSessionCaches(a, sid),
+        });
+        this.#srWatchdogIntervalMs = opts.standingReceiverWatchdogIntervalMs ?? 30_000;
+        this.#srReservationRetryMs = opts.standingReceiverReservationRetryMs ?? 5 * 60_000;
+    }
+    /**
+     * CELLO-M7-MSG-001: wire the durable-backstop side effects of the awaiting-ACK
+     * lifecycle. `onPersisted` clears the durable retry_queue entry when a persisted ACK
+     * arrives; `onTtf` records/parks the un-acked content when the TTF timer fires.
+     * Injected by the composition root (daemon.ts) after the RetryQueue exists.
+     */
+    setAwaitingAckHooks(hooks) {
+        this.#onAwaitingPersisted = hooks.onPersisted ?? null;
+        this.#onAwaitingTtf = hooks.onTtf ?? null;
+        this.#onParkFailed = hooks.onParkFailed ?? null;
+    }
+    /**
+     * DOD-RETRYQ-STRAND-1: wire the disposition of durable state a session can no longer drain.
+     * Fires once per transition INTO a status from which no resend can succeed. Injected by the
+     * composition root (daemon.ts) after the RetryQueue exists.
+     */
+    setSessionTerminalHook(hook) {
+        this.#onSessionTerminal = hook;
+    }
+    // ─── Initialization ──────────────────────────────────────────────────────
+    async initialize() {
+        // Step 1: Open the SQLCipher database (DEC-1). The key is the single plaintext key file beside
+        // the DB (DEC-2). Fail-closed (SI-002/AC-011): resolveDbKey refuses to mint a fresh key over an
+        // existing DB, and openEncryptedDatabase throws db_encryption_key_mismatch on a wrong key — there
+        // is no plaintext fallback. Whole-DB encryption supersedes the old per-column cipher (AC-010).
+        // PERSIST-002 (AC-006): one-time migration of pre-story flat-file identity / a plaintext DB into
+        // the encrypted store, BEFORE the key is resolved and the DB opened. A no-op on a fresh install
+        // or an already-encrypted DB. Throws identity_migration_failed on a failed migration (DB-002).
+        const migration = migrateToEncryptedIfNeeded(this.#dbPath, this.#logger);
+        const dbKey = resolveDbKey(this.#dbPath, dbKeyPathFor(this.#dbPath));
+        this.#db = openEncryptedDatabase(this.#dbPath, dbKey, this.#logger);
+        this.#logger.info("persist.db.opened", { encrypted: true, migrated: migration.migrated });
+        // PERSIST-002: the identity store (agents + manifest_state) lives in the same encrypted DB.
+        ensureIdentitySchema(this.#db);
+        /**
+         * ⚠️ THE OWN-CHAIN STORE IS BUILT HERE, NOT LAZILY INSIDE THE RELAY-CLIENT BUILDERS —
+         * `DOD-M15-SELFCHAIN-1`, review F2.
+         *
+         * It was constructed only when a relay client was attached, so a session that never attached one
+         * left it null: nothing was ever recorded, and every message that side sent carried the same
+         * self link. That is the exact defect this unit exists to close, on the path its own comments
+         * call the one that matters most — a conversation that ran while the relay was down is precisely
+         * the one whose order gets disputed later.
+         *
+         * The chain belongs to the AGENT and the SESSION. The relay is how the conversation travels; it
+         * is not what makes the conversation provable.
+         */
+        this.#ownChainStore = new SessionOwnChainStore(this.#db, this.#logger);
+        ensureSessionSchema(this.#db, this.#logger, () => this.#records.loadDivergedFromDb());
+        // Step 2: Detect interrupted sessions (SIGKILL detection — AC-010).
+        // Any 'active' row in a freshly-started daemon is a remnant of a prior
+        // killed process. Batch-update to 'interrupted' before IPC opens.
+        // DOD-AGENT-ID-JOINKEY-1: this sweep spans EVERY agent, so it cannot resolve one name up front.
+        // It scopes its UPDATE by the row's own agent_id and LEFT JOINs `agents` only to LOG a human
+        // name. LEFT, not INNER: an inner join would silently skip a session whose agent row is missing,
+        // leaving it 'active' forever — a stuck row hidden by the query that was meant to find it. An
+        // orphan is instead marked interrupted like any other AND reported loudly.
+        const activeRows = this.#db
+            .prepare(`SELECT s.session_id, s.agent_id, a.agent_name
+         FROM sessions s LEFT JOIN agents a ON a.agent_id = s.agent_id
+         WHERE s.status = 'active'`)
+            .all();
+        if (activeRows.length > 0) {
+            const now = Date.now();
+            const interruptedAt = new Date(now).toISOString();
+            for (const row of activeRows) {
+                try {
+                    this.#db
+                        .prepare(
+                    // DOD-CAP-SELF-HEAL-1: OURS. This is the boot sweep finding sessions a previous
+                    // process left `active`; the counterparty did nothing, so they are not charged for it.
+                    "UPDATE sessions SET status = 'interrupted', updated_at = ?, interrupted_at = COALESCE(interrupted_at, ?), interrupted_by = 'local' WHERE agent_id = ? AND session_id = ?")
+                        .run(now, interruptedAt, row.agent_id, row.session_id);
+                    if (row.agent_name === null) {
+                        this.#logger.error("session.agent.orphaned", {
+                            sessionId: row.session_id,
+                            agentId: row.agent_id,
+                            impact: "session row references an agent_id with no agents row",
+                        });
+                    }
+                    this.#logger.warn("session.interrupted.detected", {
+                        sessionId: row.session_id,
+                        agentName: row.agent_name,
+                        source: "daemon_restart",
+                    });
+                }
+                catch (err) {
+                    this.#logger.error("session.interrupt.db.write.failed", {
+                        sessionId: row.session_id,
+                        error: extractErrorMessage(err),
+                    });
+                }
+            }
+        }
+        // DOD-LOOP-1: standing receivers are now PER-AGENT, created when each agent comes online
+        // (cello_start_agent → ensureStandingReceiverForAgent). No daemon-global receiver is created at
+        // init (no agent is online yet). The initiate/accept paths kick off creation on demand if missing.
+    }
+    // ─── Public API ──────────────────────────────────────────────────────────
+    /**
+     * Get the underlying DatabaseSync handle.
+     * Used by the composition root (daemon.ts) to pass to RetryQueue and
+     * NonceDedupStore — they share the same SQLCipher DB file (DAEMON-003 AC-008).
+     */
+    /**
+     * Get the underlying DaemonDatabase handle (the SQLCipher-backed adapter). Used by the
+     * composition root (daemon.ts) to pass to RetryQueue and NonceDedupStore — they share the same
+     * encrypted DB file.
+     */
+    getDb() {
+        if (!this.#db) {
+            throw new Error("SessionNodeManager not initialized — call initialize() first");
+        }
+        return this.#db;
+    }
+    // ─── M8C-INBOX-1 (N2/N3): read-watermark accessors ───────────────────────────
+    /** DOD-TIER-4: the DISPLAY/relationship check — is this counterparty a genuine contact (KNOWN or
+     *  above)? Replaces the old binary `isContact` for behaviour that keyed on "we have a relationship"
+     *  (e.g. the away-response wording). An UNKNOWN-tier contact (a mere row) is NOT known. */
+    isKnown(agentName, pubkey) {
+        return this.#records.getTier(agentName, pubkey) >= TIER.KNOWN;
+    }
+    /** DOD-TIER-4: the POLICY gate — may an inbound session from this counterparty be auto-accepted
+     *  when the operator is unattended (WHITELISTED or VIP)? The behavioural consumer is the offline
+     *  relay mailbox (LEAVEMSG-1), out of scope for this unit; defined here as the seam. Being merely
+     *  KNOWN is NOT enough to auto-accept — whitelisting is the deliberate `cello_contact_set_tier` act. */
+    isAutoAccept(agentName, pubkey) {
+        return this.#records.getTier(agentName, pubkey) >= TIER.WHITELISTED;
+    }
+    /** DOD-AWAY-TIER-1: resolve the most-specific CUSTOM away text for a counterparty, most-specific
+     *  first: per-contact `away_message` → per-tier away setting → agent default away setting. Returns
+     *  null when none is configured, so the CALLER applies the system default (code) — making the full
+     *  four-level resolution TOTAL. A pure read; the resolved text is screened on the outbound path by
+     *  the caller like any content (SI — it does not bypass the gateway). */
+    resolveAwayMessage(agentName, pubkey) {
+        // A public key is bytes; its hex case is not part of its identity. Normalized HERE so the
+        // query below cannot see two spellings of one contact — see `contact-pubkey-case.ts`.
+        pubkey = normalizeContactPubkey(pubkey);
+        if (!this.#db)
+            return null;
+        const agentId = this.#requireAgentId(agentName);
+        const row = this.#db
+            .prepare("SELECT away_message FROM contacts WHERE agent_id = ? AND pubkey = ?")
+            .get(agentId, pubkey);
+        if (row?.away_message != null) {
+            this.#logger.debug("contact.away.resolved", { agentName, pubkey, level: "contact" }); // obs AC
+            return row.away_message; // 1. per-contact
+        }
+        const tierName = settableTierName(this.#records.getTier(agentName, pubkey));
+        if (tierName !== null) {
+            const tierAway = this.#records.getSetting(agentName, awayTierSettingKey(tierName));
+            if (tierAway !== null) {
+                this.#logger.debug("contact.away.resolved", { agentName, pubkey, level: "tier" });
+                return tierAway; // 2. per-tier
+            }
+        }
+        const agentDefault = this.#records.getSetting(agentName, AWAY_DEFAULT_KEY);
+        // 3. agent default, else null → caller applies the system default (code). Level logged HERE.
+        this.#logger.debug("contact.away.resolved", { agentName, pubkey, level: agentDefault !== null ? "agent_default" : "system" });
+        return agentDefault;
+    }
+    /** M8C-ABUSE-1 + DOD-TIER-2/3: is a NEW inbound session from this counterparty within the
+     *  acceptance bounds? The per-sender cap is now the sender's TIER cap (DEFAULT_TIER_BOUNDS), not a
+     *  flat "3 for strangers, unbounded for contacts". This is where DOD-TIER-3 falls out for free: a
+     *  BLOCKED sender's cap is 0, so `perSender (>= 0) >= 0` refuses it through the SAME reason and the
+     *  SAME path an over-cap UNKNOWN takes — no separate blocked branch, no distinguishing oracle. The
+     *  global anti-swarm cap then applies ONLY to UNKNOWN-tier senders (KNOWN+ are trusted, not part of
+     *  the stranger pool; BLOCKED never reaches it). Checked BEFORE accepting a fresh inbound session
+     *  (counts reflect sessions already active, not yet counting this one). */
+    checkUnknownSenderAcceptanceBound(agentName, counterpartyPubkey) {
+        const tier = this.#records.getTier(agentName, counterpartyPubkey);
+        const perSenderCap = this.#records.resolveTierBound(agentName, tier, "max_sessions");
+        const perSender = this.#queries.countActiveSessionsForCounterparty(agentName, counterpartyPubkey);
+        if (perSender >= perSenderCap) {
+            // BYTE-IDENTICAL to every other refusal, deliberately — DOD-TIER-3. A BLOCKED sender and an
+            // over-cap UNKNOWN must be indistinguishable, or the refusal tells someone they are blocked.
+            // The operator's alarm needs numbers, so it asks for them SEPARATELY via capDiagnostics;
+            // hanging them off this object would put a distinguishing oracle in the return value.
+            return { ok: false, reason: CAPACITY_REASONS.ABUSE_BOUND_SESSIONS_PER_SENDER };
+        }
+        // The global stranger cap is only for the UNKNOWN pool. A KNOWN+ sender is past it by trust;
+        // a BLOCKED sender was already refused above (cap 0).
+        if (tier === TIER.UNKNOWN) {
+            const globalUnknown = this.#queries.countActiveSessionsFromUnknownSenders(agentName);
+            if (globalUnknown >= ABUSE_MAX_UNKNOWN_SESSIONS_GLOBAL) {
+                return { ok: false, reason: CAPACITY_REASONS.ABUSE_BOUND_UNKNOWN_SESSIONS_GLOBAL };
+            }
+        }
+        return { ok: true };
+    }
+    /**
+     * M7-SESSION-001 (M-1 PUSH): register the session-state-change callback.
+     * Called by the composition root (daemon.ts) after the NotificationDispatcher
+     * exists. Setter injection avoids a construction-order/circular dependency.
+     */
+    setOnSessionStateChanged(cb) {
+        this.#onSessionStateChanged = cb;
+    }
+    /**
+     * M8C-MSGWAKE-1: inject the content-arrival callback (daemon.ts → NotificationDispatcher.
+     * dispatchCelloMessage). Setter injection, same construction-order reason as above.
+     */
+    setOnContentArrived(cb) {
+        this.#onContentArrived = cb;
+    }
+    /** M14 / DOD-DOC-INBOUND-2: inject the document-frame interception. See the field's note. */
+    setOnDocumentFrame(cb, classifyOnly) {
+        this.#onDocumentFrame = cb;
+        this.#isDocumentFrame = classifyOnly ?? null;
+    }
+    /**
+     * DOD-LOOP-1: the session core is keyed by (agentName, sessionId), NOT sessionId alone. Two of
+     * the operator's own agents (the loopback case) can hold the two ends of the SAME session_id on
+     * ONE daemon, so a bare session_id is ambiguous between them. This composite string key — the
+     * agent name and the hex session id joined by a 0x1f unit separator (which appears in neither) —
+     * is the key for every in-memory session-core map (#activeNodes, #trees,
+     * #contentDesynced, #responderSealSubmitted, #awaitingAck) and for the per-session maps the
+     * collaborators own, which build the same key the same way. #relayClients is already per-agent
+     * (its own key), and the standing receivers are keyed by agent name directly.
+     */
+    #k(agentName, sessionId) {
+        return `${agentName}\x1f${sessionId}`;
+    }
+    /**
+     * The inverse of `#k`, for the ONE reader that has a key and needs the session id back: the
+     * unpersisted-refusal fallback, which is keyed like every other per-session map but is drained
+     * per AGENT rather than per session.
+     *
+     * Returns null when the key belongs to a different agent. Split on the FIRST separator only —
+     * `agentName` cannot contain 0x1f, so anything after the first one is the session id, and a
+     * greedy split would silently mis-attribute a key rather than reject it.
+     */
+    #unk(key, agentName) {
+        const sep = key.indexOf("\x1f");
+        if (sep < 0)
+            return null;
+        return key.slice(0, sep) === agentName ? key.slice(sep + 1) : null;
+    }
+    /**
+     * DOD-AGENT-ID-JOINKEY-1: resolve an agent's NAME to its STABLE agent_id. This is the ONE place a
+     * name becomes a key, and it is the boundary between the two worlds:
+     *
+     *   - ABOVE it, addressing by name is correct. The operator says `cello_use_agent { name }`, and
+     *     the in-memory maps (#k, standing receivers, keyProviders) key by name safely, because
+     *     name-addressing only ever resolves ACTIVE agents and the `agents_active_name` partial unique
+     *     index makes active names unique.
+     *   - BELOW it, only `agent_id` may touch SQL. `agent_name` is a mutable display attribute that a
+     *     retire frees for reuse; a table joined on it hands a new keypair the dead identity's rows.
+     *
+     * It resolves ONLY non-retired agents — a retired identity is gone from the runtime (`list` omits
+     * it, `start` returns agent_not_found), so no live surface may act as one.
+     *
+     * It THROWS on an unresolvable name rather than returning null. A null would flow into a
+     * `WHERE agent_id IS NULL` that quietly matches nothing: reads would return empty and writes would
+     * vanish, and the daemon would look healthy while losing an agent's data. Every caller has already
+     * resolved the agent before it gets here, so an unresolvable name is a bug in the caller, not a
+     * condition to absorb.
+     */
+    #requireAgentId(agentName) {
+        if (!this.#db)
+            throw new Error("agent_id_unresolved: database is not open");
+        const row = this.#db
+            .prepare("SELECT agent_id FROM agents WHERE agent_name = ? AND state != 'retired'")
+            .get(agentName);
+        if (!row) {
+            this.#logger.error("session.agent_id.unresolved", { agentName });
+            throw new Error(`agent_id_unresolved: no active agent named '${agentName}'. The session tables are keyed by the ` +
+                `stable agent_id (DOD-AGENT-ID-JOINKEY-1); scoping a query by an unresolvable name would ` +
+                `silently match nothing.`);
+        }
+        return row.agent_id;
+    }
+    /**
+     * DOD-AGENT-ID-JOINKEY-1: the public form of the name→stable-id resolver, for components that own
+     * agent-scoped tables of their own (RetryQueue) and must be handed the STABLE key, never a name.
+     * The daemon resolves ONCE, at its own boundary, exactly as this class does internally. Throws on
+     * an unresolvable name — see #requireAgentId for why null is not an option.
+     */
+    resolveAgentId(agentName) {
+        return this.#requireAgentId(agentName);
+    }
+    /**
+     * DOD-M12B-ACK-1 — live `/cello/content/1.0.0` stream counts on a session's direct path, or null
+     * when the session has no active node.
+     *
+     * Answerable at runtime on purpose, in the same spirit as getConnectionMonitorPolicy: the count
+     * is what decides whether the next send survives, and until this existed it could only be
+     * recovered by measuring a log after the fact. It is also what lets the regression assert that a
+     * slot was RELEASED, rather than that some particular number of messages happened to fit.
+     */
+    countSessionContentStreams(agentName, sessionId) {
+        const entry = this.#activeNodes.get(this.#k(agentName, sessionId));
+        if (!entry || typeof entry.node.countProtocolStreams !== "function")
+            return null;
+        return entry.node.countProtocolStreams(entry.counterpartySessionPeerId, CELLO_CONTENT_PROTOCOL_ID);
+    }
+    /**
+     * DOD-M12B-ACK-1 — the live content-stream counts for a peer, as log context.
+     *
+     * A diagnostic must not be able to break the failure path it describes, so a node that predates
+     * `countProtocolStreams` (test fakes do) yields no fields rather than throwing.
+     */
+    #streamCensus(node, peerId) {
+        if (typeof node.countProtocolStreams !== "function")
+            return {};
+        try {
+            const { inbound, outbound } = node.countProtocolStreams(peerId, CELLO_CONTENT_PROTOCOL_ID);
+            return { contentStreamsInbound: inbound, contentStreamsOutbound: outbound, contentStreamsInboundCap: CONTENT_MAX_INBOUND_STREAMS };
+        }
+        catch {
+            return {};
+        }
+    }
+    /** Drop the in-memory tree + received-content caches for a torn-down session (DOD-LOOP-1: per (agent, session)). */
+    #evictSessionCaches(agentName, sessionId) {
+        const key = this.#k(agentName, sessionId);
+        // F1-c: dropping a NON-empty received-content buffer means deliverable plaintext the app
+        // never read live is being discarded (still durable in the transcript). Make that silent
+        // drop diagnosable — it fires on both the destroy (sealed) and retire (sealing) paths.
+        // DOD-COATTEND-1: same correction as the terminal marker above — the buffer is no longer
+        // drained by delivery, so its length no longer means "unread". The watermark does.
+        const unreadCount = this.#records.getUnreadReceivedCount(agentName, sessionId);
+        if (unreadCount > 0) {
+            this.#logger.info("session.receive.buffer.evicted", { sessionId, agentName, unreadCount });
+        }
+        // READ BEFORE THE EVICTION. The held-content loss report below wants the tree size, and asking
+        // for it AFTER this line is not a read — `getSessionTree` misses the cache, reloads the whole
+        // leaf table from disk, and puts the tree straight back into `#trees`, so the diagnostic
+        // resurrects the state its own teardown exists to drop. Worse, that reload goes through
+        // `#requireAgentId`, which THROWS for a retired agent — and it would throw here, before the
+        // held content and high-water map below are cleared, on the abnormal path only.
+        const treeSizeBeforeEviction = this.#trees.get(key)?.size() ?? null;
+        this.#trees.delete(key);
+        // CELLO-M7-MSG-001: cancel any armed TTF timers so a torn-down session never
+        // fires a park backstop (or keeps a timer) after it is gone.
+        this.#contentOut.clearAwaitingForSession(agentName, sessionId);
+        // M7-SESSION-003: drop the direct-path liveness flag (the seal gate already read
+        // its verdict) so a destroyed/retired session retains no stale alive/gone state.
+        this.#liveness.evictSession(agentName, sessionId);
+        // M7-UPGRADE-002: drop the auto-acknowledge bookkeeping for a torn-down session.
+        this.#contentDesynced.delete(key);
+        /**
+         * DOD-M15-NO-SILENT-REFUSAL-1 review N2: the UNPERSISTED half IS torn down, and only that half.
+         * The in-memory fallback (now `RefusalNotices`' own, dropped by its `evictSession`) restores
+         * what the deleted Map did, so it belongs in the teardown set exactly as that Map did. Leaving it out meant a daemon that could not
+         * write to disk — already in trouble — grew without bound in memory as well. The durable rows
+         * stay, for the reason below.
+         */
+        this.#notices.evictSession(agentName, sessionId);
+        // DOD-M15-NO-SILENT-REFUSAL-1: the DURABLE notices are NOT torn down here, and the omission is
+        // deliberate — this list is the documented teardown set, so anything absent from it needs a
+        // reason. They live in `content_refusal_notices`, keyed on agent_id + session_id, and the
+        // question they answer ("why did that person stop replying?") is one an operator asks AFTER a
+        // session ends, most sharply for `session_committed` — a refusal that exists only because the
+        // session was already sealed. Dropping them at seal would delete exactly the ones a sealed
+        // session produces. Growth is one row per (session, reason), i.e. proportional to `sessions`.
+        /**
+         * DOD-M15-REFUSALTERMINAL-1 review F7 — named because this list is the documented teardown set.
+         *
+         * `#terminallyRefused` and `#terminalRefusalsLoaded` are a READ CACHE over
+         * `terminal_content_refusals` and are dropped here with everything else in-memory; the durable
+         * rows stay, for the same reason the notices do — the question they answer outlives the
+         * session, and a fresh check reloads them on demand. `#terminalRefusalsReadFailedAt` goes too,
+         * so a torn-down session's back-off does not delay the first read after it is revived.
+         */
+        this.#refusals.evictSession(agentName, sessionId);
+        this.#responderSealSubmitted.delete(key);
+        // DOD-MSG-4: drop the strict-in-order bookkeeping (witness map, held plaintext, high-water)
+        // so a torn-down session retains no stale ordering state or buffered plaintext.
+        this.#witnessedSeq.delete(key);
+        // DOD-M15-SEALPRECOND-1: a marker cannot outlive the node that would have placed it, or a
+        // revived session's every close is refused for a send that can no longer land.
+        this.#ownLeavesOrdered.delete(key);
+        /**
+         * DOD-M15-SEALWIRE-1 bullet 6 (part A) — both salt maps are CACHES and both go.
+         *
+         * The salt is re-read from `sessions.content_salt` on revival, which is the reason Decision #8
+         * persists it. The contribution is worthless once a salt exists, and if none was agreed yet, a
+         * revival minting a fresh one is correct: the peer either also holds nothing (both re-derive
+         * from the two current halves and reach the same bytes), or it derived against our old half
+         * while we were down — in which case the agreement refuses by name, which is the outcome
+         * Decision #10 asks for. What must never happen is a NEW contribution mid-session without a
+         * teardown, and that is why `#saltContributionFor` mints once rather than per send.
+         */
+        this.#salts.evictSession(agentName, sessionId);
+        // The throwaway secret is destroyed where the `#activeNodes` entry is DROPPED, not here — see
+        // `#destroySessionEphemeralFor`. This call is the belt to that braces: both teardown paths that
+        // evict have already dropped the entry, so it is a no-op for them, and it is what catches any
+        // future path that evicts without going through one of those.
+        this.#ephemerals.destroySessionEphemeralFor(agentName, sessionId);
+        /**
+         * B2b-2's three, and the pending one is SETTLED rather than dropped.
+         *
+         * A `delete` alone leaves any send waiting on that promise waiting until its own timer fires —
+         * five seconds of a torn-down session holding a message that has nowhere to go. `closed` is the
+         * truthful outcome: the agreement is over, because the session is.
+         *
+         * `#hashedWithoutSalt` and `#unsaltedAnnounced` go with the caches, and that is correct rather
+         * than merely tidy. A revived session re-derives its frontier from durable state — leaves, held
+         * rows, queued rows — so the adoption question is answered from disk, not from a flag that would
+         * be a stale in-memory claim about a process that no longer exists. Re-announcing the fallback
+         * once per revival is the right frequency too: it is what an operator reading a fresh log needs
+         * in order to know why this session has no salt.
+         */
+        // SALTSPLIT-1 HIGH-2 goes with its mirror. SETTLED, never deleted: a send awaiting the
+        // agreement must be TOLD the session is gone, not left waiting on a promise nobody resolves.
+        this.#salts.settleSaltPending(agentName, sessionId, "closed");
+        // HELD CONTENT IS LOST HERE, AND IT MUST SAY SO.
+        //
+        // These are frames we RECEIVED and VERIFIED and could not yet append, because the relay's
+        // canonical sequence put them ahead of our tree. Deleting the map drops them — the sender
+        // believes they were delivered, we never applied them, and until now nothing anywhere recorded
+        // that it happened.
+        //
+        // Found live: a document ack arrived, logged `session.content.held` for a one-slot gap, and was
+        // destroyed with the session three seconds later. The sender then re-sent that envelope 90
+        // times against a ceiling of 5, and every surface reported the delivery as merely pending.
+        //
+        // DOD-M12B-STRAND-1 — THIS IS NO LONGER AN EPITAPH. Dropping the Map now drops a CACHE: the
+        // frames are rows in `held_content`, and #restoreHeldContent brings them back the next time
+        // this session gets a node. `session.content.held.discarded` is kept, at WARN rather than
+        // ERROR, and only for what it now means — a gap is still open on a session going away, which
+        // is worth an alarm even though nothing is lost.
+        //
+        // It fires ONLY when the durable rows are confirmed present. A hold whose persist failed is a
+        // genuine loss and must not be reported with the same event as a survivor, so it gets its own
+        // error naming the count that is actually gone. The check is a COUNT against the store rather
+        // than a belief about the write that ran earlier.
+        const strandedHolds = this.#heldContent.get(key);
+        if (strandedHolds && strandedHolds.size > 0) {
+            const canonicalSeqs = [...strandedHolds.keys()].sort((a, b) => a - b);
+            // NULL means "we could not find out", and it must never render as "destroyed". The bare
+            // catch this replaces coerced a failed COUNT to 0, which then claimed every held frame had
+            // been lost — asserting a cause it had not established. It is not hypothetical:
+            // #requireAgentId THROWS for a retired agent, on this exact path, so retiring an agent with
+            // an open hold fabricated a data-loss alarm pointing at the persistence layer while the real
+            // fault was name resolution.
+            let durable = null;
+            try {
+                const row = this.#db?.prepare("SELECT COUNT(*) AS n FROM held_content WHERE agent_id = ? AND session_id = ?").get(this.#requireAgentId(agentName), sessionId);
+                durable = row?.n ?? 0;
+            }
+            catch (err) {
+                this.#logger.warn("session.content.held.durable_count.failed", {
+                    agentName, sessionId,
+                    impact: "cannot say whether the held frames are durable — reported as unknown, NOT as lost",
+                    error: extractErrorMessage(err),
+                });
+            }
+            const lost = durable === null ? null : strandedHolds.size - durable;
+            this.#logger.warn("session.content.held.discarded", {
+                agentName,
+                sessionId,
+                count: strandedHolds.size,
+                durable,
+                canonicalSeqs,
+                // NULL when the tree was not cached at teardown. Honest, and cheap — reloading the leaf
+                // table to fill in a diagnostic field is not worth a disk read on every teardown, let
+                // alone the cache resurrection it caused.
+                treeSize: treeSizeBeforeEviction,
+            });
+            if (lost !== null && lost > 0) {
+                this.#logger.error("session.content.held.lost", {
+                    agentName,
+                    sessionId,
+                    lost,
+                    held: strandedHolds.size,
+                    impact: "verified content was NOT written to held_content and is destroyed by this teardown — the sender was never acknowledged and believes it is still pending",
+                });
+            }
+        }
+        this.#heldContent.delete(key);
+        // DOD-M12B-STRAND-1: the hydration guard goes with the cache it guards. Without this, a session
+        // torn down and given a node again inside ONE process would never re-read its durable holds —
+        // the frames would sit in the table, unreleasable, which is indistinguishable from the loss
+        // this unit exists to stop.
+        this.#held.evictSession(agentName, sessionId);
+        // DOD-M15-DIVERGE-1: `#diverged` is NOT evicted here, and the omission is the point.
+        //
+        // It was, and that made the gate that reads it best-effort in exactly the population it targets.
+        // This eviction runs on EVERY teardown including `destroySessionNode` with a non-sealed reason,
+        // which writes status `interrupted` — one of the two statuses the seal gate is scoped to. So a
+        // session that diverged and was then torn down arrived at the gate with the fact already
+        // forgotten, and the read site cannot tell "not diverged" from "we forgot": both are
+        // `has() === false`, both read ready, and the close proceeds.
+        //
+        // Divergence is a fact about the DURABLE TREE, not about the live node — the tree keeps the
+        // misplaced leaf whether or not a node exists — so it does not belong to a cache keyed on node
+        // lifetime. It is cleared where it actually stops being true: `clearDivergedOnTerminal`, below.
+        //
+        // NOT YET DURABLE ACROSS A RESTART, stated here rather than left to be rediscovered — the same
+        // way `frontier-mismatch.ts` states its own trade. A daemon restart still empties this set, and
+        // unlike a frontier mismatch (re-detected by the very next close) divergence is only
+        // re-detected by the next send that gets an ack behind the frontier. Until it has a column, a
+        // restarted daemon can read a diverged session as ready. Tracked as `DOD-M15-DIVERGE-DURABLE-1`.
+        // DOD-M12B-SESSION-SEED-1: HAND THEM TO THE REVIVAL RECORD BEFORE DROPPING THEM. This eviction
+        // runs on every teardown, including the interruption a revival is meant to undo — so clearing
+        // the addresses here is what left a revived session unable to dial anyone. The revival record
+        // has exactly the right lifetime for them: it dies when the session reaches a terminal status.
+        const survivingAddrs = this.#counterpartyAddrs.get(key);
+        if (survivingAddrs && survivingAddrs.length > 0) {
+            const identity = this.#sessionSeeds.get(key);
+            if (identity)
+                identity.counterpartyAddrs = [...survivingAddrs];
+        }
+        this.#counterpartyAddrs.delete(key);
+        this.#redialNotBefore.delete(key);
+        this.#highWaterSeq.delete(key);
+    }
+    async gracefulShutdown() {
+        // DOD-NAT-REACHABILITY-1: stop the reservation watchdog before anything is torn
+        // down — a tick landing mid-shutdown would try to rebuild a receiver we are in
+        // the middle of stopping.
+        if (this.#reservationWatchdog !== null) {
+            clearInterval(this.#reservationWatchdog);
+            this.#reservationWatchdog = null;
+        }
+        // Signal any in-flight standing-receiver replacement to self-stop (review M2).
+        this.#shuttingDown = true;
+        // DOD-M12B-ACK-1: drop the inbound-content linger resets. The nodes they would reset are being
+        // torn down here anyway, so firing after this point is pure noise on the way out.
+        for (const timer of this.#lingeringStreams)
+            clearTimeout(timer);
+        this.#lingeringStreams.clear();
+        /**
+         * DOD-M15-RELAYLEAK-1 — **CLOSE THE RELAY CLIENTS. Shutdown never did.**
+         *
+         * This method stops every session NODE and left `#relayClients` untouched — verified by reading:
+         * the whole of `gracefulShutdown` referenced `relayClient` zero times. Each cached client holds
+         * an authenticated libp2p stream to a relay and a reader loop, so a `cello logout` left them
+         * open until the process itself exited.
+         *
+         * That is a real cost rather than untidiness: the relay counts a reservation per client and its
+         * slots are finite, so a daemon that restarts repeatedly consumes them faster than they are
+         * released, which is the "agents cannot get a reservation" failure the relay's own limits note
+         * describes from the other side.
+         *
+         * Best-effort and individually caught: teardown must not be the thing that throws. One client
+         * that refuses to close must not prevent the next from being released.
+         */
+        for (const [key, client] of this.#relayClients) {
+            try {
+                client.close();
+            }
+            catch (err) {
+                this.#logger.warn("session.relay_client.close_failed", {
+                    relayClientKey: key,
+                    reason: extractErrorMessage(err),
+                    impact: "one cached relay client did not close cleanly on shutdown; the rest are still released",
+                });
+            }
+        }
+        this.#relayClients.clear();
+        // Cancel every armed awaiting-ACK timer so an un-acked send (e.g. a rejected /
+        // tampered frame that never produced a `persisted` ACK) does not leave a 20s
+        // timer pinning the content + this manager in memory past teardown (review M1).
+        for (const bySession of this.#awaitingAck.values()) {
+            for (const entry of bySession.values())
+                clearTimeout(entry.timer);
+        }
+        this.#awaitingAck.clear();
+        // Mark ALL 'active' rows interrupted in SQLite — single batch UPDATE covers
+        // both in-memory managed nodes AND any rows that were inserted directly
+        // (e.g. by the binary AC-009 SIGTERM test inserting synthetic rows).
+        // This is the authoritative persistence step; in-memory map is secondary.
+        const now = Date.now();
+        if (!this.#db) {
+            this.#logger.error("session.interrupt.db.write.failed", {
+                sessionId: "__all__",
+                error: "db not initialized",
+            });
+        }
+        else {
+            const interruptedAt = new Date(now).toISOString();
+            try {
+                const res = this.#db.prepare(
+                // DOD-CAP-SELF-HEAL-1: OURS. Our own shutdown ended these, not the counterparty.
+                "UPDATE sessions SET status = 'interrupted', updated_at = ?, interrupted_at = COALESCE(interrupted_at, ?), interrupted_by = 'local' WHERE status = 'active'").run(now, interruptedAt);
+                /**
+                 * ⚠️ THE AUTHORITATIVE PERSISTENCE STEP WAS SILENT ON SUCCESS, AND THAT IS WHY ITS OWN TEST
+                 * CANNOT BE DIAGNOSED.
+                 *
+                 * `AC-009 (binary): SIGTERM marks active sessions interrupted` failed twice in a row on CI
+                 * and blocked a publish. The captured daemon log ends at `daemon.started` with nothing after
+                 * it — because the ONLY thing this block could ever log was a thrown error. So the evidence
+                 * is equally consistent with two very different failures:
+                 *
+                 *   - the shutdown never ran (signal handler, early exit, teardown ordering), or
+                 *   - it ran and the UPDATE matched ZERO rows (visibility, or the rows genuinely were not
+                 *     `active` at that moment).
+                 *
+                 * Nothing in the log separates them, so the test's own comment picked one — *"the daemon's
+                 * connection can begin its shutdown UPDATE against a snapshot that predates this commit"* —
+                 * added a `wal_checkpoint(TRUNCATE)` for it, and the test failed again. One diagnosis, one
+                 * fix, one recurrence: the point at which the diagnosis is the thing to doubt.
+                 *
+                 * `changes` was on the result object the whole time and nobody read it. It discriminates the
+                 * two outright, and this is the last line the daemon writes before it dies, so it is the last
+                 * thing anyone investigating a bad shutdown will see.
+                 *
+                 * ⚠️ INFO AND NOT AN ERROR EVEN AT ZERO. Zero is the ordinary case for a daemon with no
+                 * active sessions — most shutdowns. Making it a warning would fire on nearly every clean exit
+                 * and train operators to filter the one signal that matters.
+                 */
+                this.#logger.info("session.interrupt.db.write.complete", {
+                    sessionId: "__all__",
+                    rowsMarkedInterrupted: Number(res.changes),
+                    impact: Number(res.changes) === 0
+                        ? "no session rows were 'active' at shutdown, so none was marked interrupted. Ordinary for a daemon with no live sessions — but if a session WAS expected to be interrupted, the UPDATE ran and matched nothing, which is a visibility or state question and NOT a shutdown that failed to run."
+                        : "these sessions are recorded as interrupted by OUR OWN shutdown, so they can be resumed or sealed rather than read as abandoned.",
+                });
+            }
+            catch (err) {
+                this.#logger.error("session.interrupt.db.write.failed", {
+                    sessionId: "__all__",
+                    error: extractErrorMessage(err),
+                });
+            }
+        }
+        // Stop all session nodes, then emit session.node.destroyed only on success
+        // (mirrors destroySessionNode ordering: stop first, log destroyed after)
+        const stopPromises = [];
+        for (const entry of this.#activeNodes.values()) {
+            entry.autoNat.stop();
+            // M7 DOD-SPINE-6: detach from the agent relay client (closes it when its last
+            // session goes) — consistent with the other teardown paths.
+            this.#relay.detachSessionRelay(entry);
+            stopPromises.push(entry.node.stop().then(() => {
+                this.#logger.info("session.node.destroyed", {
+                    sessionId: entry.sessionId,
+                    agentName: entry.agentName,
+                    reason: "interrupted",
+                });
+            }).catch((err) => {
+                this.#logger.error("session.node.stop.failed", {
+                    sessionId: entry.sessionId,
+                    agentName: entry.agentName,
+                    error: extractErrorMessage(err),
+                    correlationId: entry.correlationId,
+                });
+            }));
+        }
+        // DOD-M12B-SHUTDOWN-1: BOUNDED. `node.stop()` awaits libp2p's own teardown, which has no
+        // deadline of its own — one connection that will not close holds this, and this holds the whole
+        // daemon. Measured 2026-08-17: `cello logout` acknowledged, then the process was still alive
+        // 30+ seconds later and needed a signal. An abandoned stop costs a socket the OS reclaims when
+        // we exit; an unbounded wait costs the exit itself.
+        await this.#life.boundedTeardown(Promise.all(stopPromises), "session_nodes", stopPromises.length);
+        this.#activeNodes.clear();
+        // Evict in-memory per-session caches (trees reload from SQLite; received-content
+        // plaintext must not survive shutdown in memory).
+        this.#trees.clear();
+        // DOD-M12B-SESSION-SEED-1 (review F5): transport identities are key material and belong in the
+        // same sentence as the plaintext above. Shutdown marks every active row `interrupted` by direct
+        // SQL, so no `SessionLifecycle.updateSessionStatus` destroy fires for them — without this, every live session's
+        // seed survives the shutdown in memory for as long as the process lingers.
+        for (const identity of this.#sessionSeeds.values())
+            identity.seed.fill(0);
+        this.#sessionSeeds.clear();
+        // 006-CRYPTO: the per-session throwaway secrets belong in the same sentence, for the same
+        // reason and with the same measured cause — shutdown marks rows `interrupted` by direct SQL, so
+        // no per-session teardown fires for them, and this process is known to linger (a `cello logout`
+        // was still alive 30+ seconds later). Without this, every live session's key survives the
+        // shutdown in memory for as long as it lingers.
+        this.#ephemerals.destroyAll();
+        // Stop ALL per-agent standing receivers (DOD-LOOP-1). In PARALLEL and BOUNDED: this was a
+        // sequential await per agent with no deadline, so five agents meant five chances for one stuck
+        // libp2p teardown to hold the exit — and it sits between the operator being told the daemon is
+        // stopping and the process actually going.
+        await this.#life.boundedTeardown(Promise.all([...this.#standingReceivers].map(async ([agentName, sr]) => {
+            sr.autoNat.stop();
+            try {
+                await sr.node.stop();
+            }
+            catch (err) {
+                this.#logger.error("session.node.stop.failed", {
+                    sessionId: "standing_receiver_shutdown",
+                    agentName: `${STANDING_RECEIVER_AGENT_NAME}:${agentName}`,
+                    error: extractErrorMessage(err),
+                    correlationId: "n/a",
+                });
+            }
+        })), "standing_receivers", this.#standingReceivers.size);
+        // Same reason: a receiver's seed is the identity it has already advertised in
+        // `session_offer_accept` for any session it is mid-handshake on.
+        for (const sr of this.#standingReceivers.values())
+            sr.seed.fill(0);
+        this.#standingReceivers.clear();
+        this.#srReservationRetry.clear();
+        this.#srLastRejectionReason.clear();
+        // Release the SQLite handle so the DB file is no longer held open after shutdown
+        // (review L5). Queries guard on `#db === null` and degrade to empty/null.
+        if (this.#db) {
+            try {
+                this.#db.close();
+            }
+            catch { /* already closed */ }
+            this.#db = null;
+        }
+    }
+    /**
+     * DOD-M12B-REVIVAL-BOUND-1 — close every session the revival window has expired.
+     *
+     * `abandonSession` is the right instrument and already exists: it flips the status FIRST and
+     * synchronously, annexes held content so the operator does not lose mail that has nowhere to go,
+     * and retires the node. It notarizes nothing, which is the point — we are closing a door, not
+     * asserting how it came to be open.
+     *
+     * One session's failure must not strand the rest, so each is caught and logged; the sweep runs at
+     * boot beside the restart-seal resolver and a throw there would take the daemon with it.
+     *
+     * @returns how many sessions actually flipped — not how many were attempted.
+     */
+    async closeExpiredUnrevivableSessions(nowMs, windowMs) {
+        // Stamp FIRST. A row with no clock cannot be evaluated by the query below, and this is the only
+        // thing that gives it one. Running it before every sweep is safe because the write is scoped to
+        // rows that have no timestamp yet.
+        this.#queries.stampMissingInterruptedAt(nowMs);
+        const expired = this.#queries.listExpiredUnrevivableSessions(nowMs, windowMs);
+        let closed = 0;
+        for (const s of expired) {
+            try {
+                if (await this.#life.abandonSession(s.agentName, s.sessionId)) {
+                    closed += 1;
+                    this.#logger.info("session.revival_bound.closed", {
+                        agentName: s.agentName,
+                        sessionId: s.sessionId,
+                        // The cause we could NOT establish is the reason this ends without a receipt — log it
+                        // so an operator asking "why no certificate?" gets the answer here.
+                        interruptedBy: s.cause ?? "unknown",
+                        windowMs,
+                        // NAME THE FORFEIT. Until this sweep ran, `cello_close_session` (without `force`) still
+                        // accepted this session — it takes `status IN ('active','interrupted')` — so the
+                        // operator could have come back days later and obtained a real seal. `abandoned` is in
+                        // TERMINAL_SEAL_REFUSALS, so after this they cannot. That is a deliberate trade (SI-001
+                        // forbids auto-sealing a session nobody chose to end) and it costs something real, so
+                        // it is stated rather than left implicit in a WHERE clause.
+                        forfeited: "a seal was still obtainable by hand until now; it is not after this",
+                    });
+                }
+            }
+            catch (err) {
+                this.#logger.warn("session.revival_bound.close.failed", {
+                    agentName: s.agentName,
+                    sessionId: s.sessionId,
+                    error: extractErrorMessage(err),
+                });
+            }
+        }
+        // UNCONDITIONAL. A sweep that found nothing and a sweep that never really ran must not produce
+        // the same silence — this line is the only proof the control executed at all.
+        this.#logger.info("session.revival_bound.sweep", { expired: expired.length, closed, windowMs });
+        if (closed !== expired.length) {
+            // Not arithmetic for the reader to do: a session the security control failed to close is one
+            // that is still interrupted and still accepting content.
+            this.#logger.warn("session.revival_bound.sweep.incomplete", {
+                expired: expired.length,
+                closed,
+                failed: expired.length - closed,
+                impact: "these sessions are still interrupted and still accept content from any peer that dials them",
+            });
+        }
+        return closed;
+    }
+    getSessionsForAgent(agentName) {
+        if (!this.#db)
+            return [];
+        // Scoped by the STABLE id. `agent_name` is not a column of `sessions` any more, so it is stamped
+        // back on for display — and it is exactly the name we just resolved the id FROM, so no join is
+        // needed and no stale copy can exist.
+        const rows = this.#db
+            .prepare("SELECT * FROM sessions WHERE agent_id = ? ORDER BY updated_at DESC")
+            .all(this.#requireAgentId(agentName));
+        return rows.map((r) => ({ ...this.#salts.saltStatusOf(r, agentName), agent_name: agentName }));
+    }
+    /**
+     * Every persisted session across ALL agents, most-recently-updated first. Backs the daemon-wide
+     * `cello sessions` CLI surface (which has no per-connection current agent, unlike the MCP
+     * cello_list_sessions). Classification + filtering + the count limit are applied by the caller.
+     */
+    getAllSessions() {
+        if (!this.#db)
+            return [];
+        // Spans EVERY agent, so no single name can be resolved up front: the display name is joined in
+        // from `agents`, its one source of truth. LEFT JOIN, not INNER — a session whose agent row is
+        // missing must still be listed (an invisible session is worse than an unnamed one).
+        return this.#db
+            .prepare(`SELECT s.*, a.agent_name AS agent_name
+         FROM sessions s LEFT JOIN agents a ON a.agent_id = s.agent_id
+         ORDER BY s.updated_at DESC`)
+            .all()
+            // The joined display name is what `#saltSuspended` is keyed on. NULL only where the agent row
+            // is missing — an orphaned session, which has no live in-memory state to be suspended in.
+            .map((r) => {
+            const row = r;
+            return this.#salts.saltStatusOf(row, row.agent_name ?? null);
+        });
+    }
+    // ─── The session-lifecycle path's public surface, kept on the manager ──────────────────────
+    //
+    // These thirteen live in `session-lifecycle.ts`; their documentation is there, next to the code
+    // it describes. They stay reachable here because 429 call sites outside this class name them on
+    // the manager — `createSessionNode` alone has 177. Signatures are DERIVED, not copied.
+    createSessionNode(...args) { return this.#life.createSessionNode(...args); }
+    acceptSession(...args) { return this.#life.acceptSession(...args); }
+    destroySessionNode(...args) { return this.#life.destroySessionNode(...args); }
+    retireSessionNode(...args) { return this.#life.retireSessionNode(...args); }
+    markInterruptedWithDetails(...args) { return this.#life.markInterruptedWithDetails(...args); }
+    connectToCounterparty(...args) { return this.#life.connectToCounterparty(...args); }
+    notifyCounterpartyAbandon(...args) { return this.#life.notifyCounterpartyAbandon(...args); }
+    retireOnCounterpartyAbandon(...args) { return this.#life.retireOnCounterpartyAbandon(...args); }
+    reviveSessionNode(...args) { return this.#life.reviveSessionNode(...args); }
+    reviveIfNeededForSend(...args) { return this.#life.reviveIfNeededForSend(...args); }
+    reviveIfNeededForRead(...args) { return this.#life.reviveIfNeededForRead(...args); }
+    abandonSession(...args) { return this.#life.abandonSession(...args); }
+    getSessionNodePeerId(...args) { return this.#life.getSessionNodePeerId(...args); }
+    /**
+     * ⚠️ EVERY TRIVIAL DELEGATOR IN THIS FILE IS ONE LINE, and that is a ratchet decision rather than
+     * a formatting preference. Thirty-seven of them were five lines each: a signature line, a
+     * `Parameters<>` line, a `ReturnType<>` line, a forward and a brace. That is ~150 lines of the
+     * budget spent on punctuation, in the file the `max-lines` pin exists to shrink — and it is
+     * budget that cannot then be spent on the comments this file's prose is actually for.
+     *
+     * The signatures stay DERIVED, which is the property that matters: a change to the moved method
+     * changes this one, so a copy can never drift from its original.
+     */
+    // ─── The relay path's public surface, kept on the manager ──────────────────────────────────
+    //
+    // These nine live in `session-relay.ts`; their documentation is there, next to the code it
+    // describes. They stay reachable here because 43 call sites outside this class name them on the
+    // manager. Signatures are DERIVED, not copied, for the same reason as the seal and content
+    // delegators: a copy is a second declaration free to drift from the first.
+    setDirectoryRelayEndpoints(...args) { return this.#relay.setDirectoryRelayEndpoints(...args); }
+    registerRelayStream(...args) { return this.#relay.registerRelayStream(...args); }
+    isRelayCarvedOutInbound(...args) { return this.#relay.isRelayCarvedOutInbound(...args); }
+    isRelayQuarantined(...args) { return this.#relay.isRelayQuarantined(...args); }
+    quarantineRefusedInbound(...args) { return this.#relay.quarantineRefusedInbound(...args); }
+    quarantineFrameMeta(...args) { return this.#relay.quarantineFrameMeta(...args); }
+    getRelayReceipts(...args) { return this.#relay.getRelayReceipts(...args); }
+    patchRelayClientForTest(...args) { return this.#relay.patchRelayClientForTest(...args); }
+    getSessionRelayForTest(...args) { return this.#relay.getSessionRelayForTest(...args); }
+    // ─── The seal path's public surface, kept on the manager ───────────────────────────────────
+    //
+    // These eleven live in `session-seal.ts`; their documentation is there, next to the code it
+    // describes. They stay reachable here because 86 call sites outside this class — the close
+    // handler, the seal coordinator, the escalation and certificate-pull paths, and `daemon.ts`
+    // itself — name them on the manager. Signatures are DERIVED for the same reason as the content
+    // delegators below: a copy is a second declaration free to drift from the first.
+    submitSealLeaf(...args) { return this.#seal.submitSealLeaf(...args); }
+    /**
+     * DOD-M15-AWAYSCOPE-1 — tell every relay this agent is talking through whether anyone is watching.
+     *
+     * ⚠️ THIS IS WHAT REPLACED THE AWAY REPLY. An unattended agent used to answer inbound messages
+     * with its greeting, which took a hash-chain leaf inside a live conversation and cost session
+     * `e7dd3f43…` its receipt on both machines. The fact is worth telling; it is a fact ABOUT the
+     * session, so it rides the out-of-band liveness frame and takes no leaf, enters no transcript, and
+     * is never seen by the counterparty's agent as a message.
+     *
+     * BEST EFFORT AND SILENT ON FAILURE, by design. A session with no relay (direct-only) is skipped;
+     * a send that fails is logged at debug inside the client. The cost of every failure is the same
+     * and it is small: the counterparty reads "unknown" until the next notice.
+     */
+    /**
+     * DOD-M15-AWAYSCOPE-1 — who answers "is anyone attending this agent". Set by the daemon.
+     *
+     * Defaults to `unattended` rather than throwing or guessing `attended`: before the composition
+     * root wires it, the truthful answer is that nobody has claimed anything. Defaulting the other
+     * way would tell a counterparty a person is watching during exactly the window in which the
+     * daemon has not finished starting.
+     */
+    #currentAttendance = () => "unattended";
+    setCurrentAttendanceSource(fn) {
+        this.#currentAttendance = fn;
+    }
+    announceAttendance(agentName, attendance) {
+        // The separator is `#k`'s own `\x1f`, not a colon — a colon is legal inside an agent name and
+        // the map has never used one. Getting this wrong is silent: the loop matches nothing and every
+        // announcement is skipped, with no error anywhere.
+        const prefix = this.#k(agentName, "");
+        for (const [key, entry] of this.#activeNodes) {
+            if (!key.startsWith(prefix))
+                continue;
+            if (!entry.relayClient || !entry.relaySessionIdBytes)
+                continue;
+            entry.relayClient.announceAttendance(entry.node, entry.relaySessionIdBytes, attendance);
+        }
+    }
+    /**
+     * DOD-M15-AWAYSCOPE-1 — ask the relay what it knows about the counterparty of ONE session.
+     *
+     * ⚠️ NOT `getSessionLiveness`, which is a different question with a different answer. That one is
+     * daemon-local: does THIS process hold a libp2p connection for the session, and it has a fourth
+     * value (`impaired`) the wire type does not. This one asks the RELAY, which sees the counterparty's
+     * standing connection even when this daemon has no direct link to them, and it is the only path
+     * that can carry attendance — because attendance is the far daemon's own assertion, relayed.
+     *
+     * Returns null when there is nothing to ask: no session, or a session with no relay behind it.
+     * That is distinct from an answer of 'unknown', which means the relay was asked and did not know.
+     */
+    async queryRelayLiveness(agentName, sessionId) {
+        const entry = this.#activeNodes.get(this.#k(agentName, sessionId));
+        if (!entry?.relayClient || !entry.relaySessionIdBytes)
+            return null;
+        const record = this.getSessionRecord(agentName, sessionId);
+        if (!record)
+            return null;
+        return entry.relayClient.queryLiveness(entry.relaySessionIdBytes, Uint8Array.from(Buffer.from(record.counterparty_pubkey, "hex")));
+    }
+    sealReadiness(...args) { return this.#seal.sealReadiness(...args); }
+    sealReadinessView(...args) { return this.#seal.sealReadinessView(...args); }
+    verifyCertifiedRoot(...args) { return this.#seal.verifyCertifiedRoot(...args); }
+    getSealCarry(...args) { return this.#seal.getSealCarry(...args); }
+    markSealed(...args) { return this.#seal.markSealed(...args); }
+    recordSealCertificateEnsuringRow(...args) { return this.#seal.recordSealCertificateEnsuringRow(...args); }
+    persistSealInterruptedCommitment(...args) { return this.#seal.persistSealInterruptedCommitment(...args); }
+    getSealUpgradeReadiness(...args) { return this.#seal.getSealUpgradeReadiness(...args); }
+    countersignedThroughSeqFromCarry(...args) { return this.#seal.countersignedThroughSeqFromCarry(...args); }
+    setEnsureSealBroker(...args) { return this.#seal.setEnsureSealBroker(...args); }
+    // ─── The content pipeline's public surface, kept on the manager ────────────────────────────
+    //
+    // Two of these live in `session-content-send.ts` and five in `session-content-ingest.ts`; the
+    // return types below say which. Their documentation is there, next to the code it describes.
+    // They stay reachable here because 451 call sites across the daemon and its tests name them on
+    // the manager, and moving those is a change to every caller for no gain.
+    //
+    // ⚠️ The signatures are DERIVED, not copied. `sendContent` alone carries ~60 lines of parameter
+    // documentation and a five-branch return type; a hand-copied duplicate of that is a second
+    // declaration that drifts from the first, silently, the moment either is edited. Deriving them
+    // makes drift impossible — a change to the moved signature is a change to this one.
+    ingestReceivedContent(...args) { return this.#contentIn.ingestReceivedContent(...args); }
+    /**
+     * ⚠️ **THE CHOKE POINT, AND THE GATE BELONGS HERE RATHER THAN ON `cello_send` ALONE — review F2.**
+     *
+     * `DOD-M15-CLOSEDSESSION-1` put a closed-session refusal on the `cello_send` handler, which is
+     * where the operator's sentence is shaped. Three other production callers place content leaves
+     * without passing through it — the document delivery transport, and both away-reply sends in the
+     * attendance wiring — and each reuses a session whose row says `active`, which is exactly the
+     * row the seal ceremony leaves standing while it finishes. So a document push could still land a
+     * leaf in a conversation this side had already sealed.
+     *
+     * This is the argument the inbound path already makes for its own shared gate: placing the check
+     * above the dispatch makes it the DEFAULT, so a fourth caller added later is covered by
+     * construction rather than by whoever adds it reading this comment.
+     *
+     * `durable: false` is the load-bearing field: it tells the caller nothing was witnessed and
+     * nothing was queued, so no leaf may be committed for this.
+     */
+    async sendContent(...args) {
+        const [agentName, sessionId] = args;
+        const closed = sessionClosedState(this.#queries.getSessionRecord(agentName, sessionId)?.status ?? null, this.hasCommittedSealLeaf(agentName, sessionId));
+        if (closed.closed) {
+            this.#logger.info("session.send.refused_closed", { agentName, sessionId, at: "sendContent", impact: closed.impact });
+            return { ok: false, reason: SESSION_CLOSED_REASON, error: closed.impact, durable: false };
+        }
+        return this.#contentOut.sendContent(...args);
+    }
+    /** DOD-M15-SEALPRECOND-1 — see SessionContentSender.noteOwnLeafOrdered. */
+    noteOwnLeafOrdered(...args) { return this.#contentOut.noteOwnLeafOrdered(...args); }
+    placeOwnLeaf(...args) { return this.#contentOut.placeOwnLeaf(...args); }
+    recordWitnessedSequence(...args) { return this.#contentIn.recordWitnessedSequence(...args); }
+    getUndeliverableSeqs(...args) { return this.#contentIn.getUndeliverableSeqs(...args); }
+    handleContentFrameForTest(...args) { return this.#contentIn.handleContentFrameForTest(...args); }
+    // ─── DAEMON-004: daemon-owned Merkle tree ──────────────────────────────────
+    /** Loaded from SQLite on first access so it survives a restart (AC-007). NEVER null: an unknown session yields an EMPTY tree. */
+    getSessionTree(agentName, sessionId) {
+        const key = this.#k(agentName, sessionId);
+        const cached = this.#trees.get(key);
+        if (cached)
+            return cached;
+        const tree = this.#queries.loadTreeFromDb(agentName, sessionId);
+        this.#trees.set(key, tree);
+        return tree;
+    }
+    /** Current daemon-owned tree root for a session, as hex. */
+    getSessionTreeRootHex(agentName, sessionId) {
+        return this.getSessionTree(agentName, sessionId).rootHex();
+    }
+    /**
+     * Append a leaf (by its 32-byte leaf-hash hex) to the daemon-owned tree,
+     * persist it, advance the root, and fire session.tree.appended.
+     *
+     * @returns the new leaf index and the recomputed root hex.
+     */
+    appendSessionLeaf(agentName, sessionId, kind, leafHashHex, correlationId) {
+        const tree = this.getSessionTree(agentName, sessionId);
+        const { leafIndex, newRootHex } = tree.appendLeafHash(kind, leafHashHex);
+        if (this.#db) {
+            try {
+                this.#db
+                    .prepare(`INSERT INTO session_tree_leaves
+             (agent_id, session_id, leaf_index, leaf_kind, leaf_hash_hex, created_at)
+             VALUES (?, ?, ?, ?, ?, ?)`)
+                    .run(this.#requireAgentId(agentName), sessionId, leafIndex, kind, leafHashHex, Date.now());
+                // DAEMON-004 (finding #2): keep sessions.message_count synced to the tree
+                // size. message_count is the bilateral leafCount the seal flow signs over
+                // (handleSealInterruptedFlow / the responder). If it diverged from the
+                // daemon-owned tree, a post-active-messaging seal would attest to a
+                // truncated transcript and the bilateral leafCount check would mismatch.
+                // The tree (leafIndex + 1 leaves) is authoritative; the column tracks it.
+                this.#db
+                    .prepare("UPDATE sessions SET message_count = ?, updated_at = ? WHERE agent_id = ? AND session_id = ?")
+                    .run(leafIndex + 1, Date.now(), this.#requireAgentId(agentName), sessionId);
+            }
+            catch (err) {
+                // A persist failure must be visible, not swallowed: the in-memory tree
+                // has advanced but the durable transcript has not, which would diverge
+                // on restart. Surface it loudly.
+                this.#logger.error("session.tree.persist.failed", {
+                    sessionId,
+                    leafIndex,
+                    error: extractErrorMessage(err),
+                    correlationId,
+                });
+            }
+        }
+        this.#logger.info("session.tree.appended", {
+            sessionId,
+            leafIndex,
+            newRootHex,
+            correlationId,
+        });
+        return { leafIndex, newRootHex };
+    }
+    #markContentUnverifiable(agentName, sessionId, why) {
+        const key = this.#k(agentName, sessionId);
+        if (why === "unverifiable" && this.#contentDesynced.get(key) === "tampered")
+            return;
+        this.#contentDesynced.set(key, why);
+    }
+    /** DOD-M12B-LEAF-TRIGGERS-FETCH-1 test seams. */
+    setLeafFetchGraceMsForTest(ms) { this.#leafFetchGraceMs = ms; }
+    markContentPresentForTest(agentName, sessionId, contentHashHex) {
+        this.#contentIn.markContentResolved(agentName, sessionId, contentHashHex);
+    }
+    /**
+     * DOD-CAP-SELF-HEAL-1 — the numbers behind a cap refusal, for the OPERATOR'S alarm only.
+     *
+     * Kept off `checkUnknownSenderAcceptanceBound`'s return on purpose. That refusal is byte-identical
+     * across tiers by design (DOD-TIER-3) so a blocked party cannot tell blocking from throttling;
+     * attaching the counts to it would put the oracle straight into the value the refusal path
+     * carries. This is a separate, purely local read, and nothing it returns crosses the wire.
+     */
+    capDiagnostics(agentName, counterpartyPubkey) {
+        const tier = this.#records.getTier(agentName, counterpartyPubkey);
+        const cap = this.#records.resolveTierBound(agentName, tier, "max_sessions");
+        const counted = this.#queries.countActiveSessionsForCounterparty(agentName, counterpartyPubkey);
+        return {
+            tier, cap, counted,
+            // How many to close to get UNDER the cap — not how many exist. At 5 against a cap of 3 the
+            // answer is 3, and "close 5" tells the operator to do more than the job needs.
+            mustClear: Math.max(0, counted - cap + 1),
+            blocked: tier === TIER.BLOCKED,
+        };
+    }
+    /**
+     * THE IN-MEMORY ARRIVAL BUFFER WAS HERE, with `takeReceivedContent`, `pushReceivedContentForTest`
+     * and `peekLatestReceivedContentHex`. All three are gone, and so is the buffer.
+     *
+     * It kept the plaintext of the last 32 messages of every live session in daemon memory for the
+     * life of the process. `cello_receive` stopped draining it at DOD-COATTEND-1, when delivery moved
+     * onto the durable transcript; the away responder's peek at its tail was the last reader, and
+     * DOD-M15-AWAYSCOPE-1 deleted that with the branch that answered an accepted session. What
+     * remained was every conversation this agent had, held in memory, for nobody.
+     *
+     * Tests that asked it "did this message reach the agent" now ask the transcript, which is what
+     * production serves — see `__tests__/helpers/received-rows.ts` for why the answer is the same.
+     */
+    /**
+     * F1-b: the terminal answer for a session that sealed while a blocking receive was (or could be)
+     * waiting. Idempotent — a sealed session always answers "sealed" to a receive. Null while active.
+     *
+     * DOD-TERMINAL-WAKE-1: the in-memory marker is written only by `destroySessionNode`, so it does
+     * NOT survive a restart — while the `sealed` row on disk does. Reading the absent marker as "not
+     * terminal" is what let a sealed session's unread message come back as live work hours later, and
+     * an agent obey a `[[STANDBY]]` directive out of a conversation that had already ended. Absent is
+     * not fine: fall through to the durable record, which is the authority the marker only caches.
+     */
+    peekTerminalMarker(agentName, sessionId) {
+        const cached = this.#sessionTerminal.get(this.#k(agentName, sessionId));
+        if (cached)
+            return cached;
+        // Only 'sealed' answers here. 'abandoned' forfeited its receipt and 'interrupted' /
+        // 'seal_interrupted_pending' can still complete, so none of them may claim a seal — the
+        // DOD-SEALED-INBOX-2 lesson, which is what makes this a status read and not a "is it over" read.
+        const record = this.#queries.getSessionRecord(agentName, sessionId);
+        if (record?.status !== "sealed")
+            return null;
+        return { type: "sealed", unreadCount: this.#records.getUnreadReceivedCount(agentName, sessionId) };
+    }
+    // ─── CELLO-M7-MSG-001: delivery ACK / TTF tracking (send side) ──────────────
+    /**
+     * TTF timer fired with no `persisted` ACK (AC-003/AC-019): hand the un-acked content
+     * to the park backstop (the durable retry_queue today; the relay store-and-forward
+     * deposit in 3b). The session is never killed and the operator is never interrupted —
+     * parking is best-effort durability.
+     */
+    #handleTtfExpiry(agentName, sessionId, hashHex) {
+        const ackKey = this.#k(agentName, sessionId);
+        const bySession = this.#awaitingAck.get(ackKey);
+        const entry = bySession?.get(hashHex);
+        if (!entry || !bySession)
+            return;
+        bySession.delete(hashHex);
+        if (bySession.size === 0)
+            this.#awaitingAck.delete(ackKey);
+        this.#logger.debug("content.delivery.ttf_expired", { sessionId, contentHash: hashHex });
+        try {
+            // M12-P12 (review pass 2): the ordering record travels on THIS path too. It is in hand — the
+            // very next statement hands it to #parkContent — and a TTF row written without it re-parks in
+            // arrival order, which is the divergent-leaf-index failure the durable columns exist to stop.
+            this.#onAwaitingTtf?.(agentName, sessionId, hashHex, entry.content, entry.structure1Cbor, entry.structure2Cbor, entry.contentHashAlg, entry.structure1Signature, entry.leafKind);
+        }
+        catch (err) {
+            this.#logger.error("content.park.backstop.failed", {
+                sessionId, contentHash: hashHex, error: extractErrorMessage(err),
+            });
+        }
+        // 2b: delivered to the wire but never confirmed `persisted` — deposit it to the relay
+        // store-and-forward so the recipient recovers it (at the witnessed sequence). The durable
+        // awaiting entry above remains the crash backstop. Carry the retained ordering record (review #1)
+        // so a TTF-parked entry self-orders on recover, exactly like the direct-dial-fail park.
+        // Fire-and-forget: unlike sendContent's live caller, nothing here is awaiting an IPC response
+        // to shape (the TTF timer fires long after cello_send already returned) — the deposit's own
+        // success/failure logging inside #parkContent is the only observability this path needs.
+        // B2b-1 review F2 — the THIRD `#parkContent` caller, and the one that was left unthreaded.
+        void this.#park.parkContent(agentName, sessionId, hashHex, entry.content, entry.structure1Cbor, entry.structure2Cbor, entry.contentHashAlg);
+    }
+    /**
+     * DOD-MSG-4 (self-ordering content frame): verify the relay's signed ordering record carried IN the
+     * content frame and record the canonical sequence for the strict-in-order gate — so ordering does
+     * not depend on the separate leaf_deliver witness arriving first. Best-effort: any failure (malformed,
+     * hash mismatch, bad signature, wrong signer) is logged and ignored — the content still ingests and
+     * orders via the witness stream / arrival, so a bad record cannot block delivery.
+     *
+     * structure1_cbor = [1, content_hash(32), sender_pubkey(32), session_id(16), last_seen_seq, ts] —
+     *   the EXACT bytes the sender signed (needed to verify; Structure2 omits session_id/last_seen/ts).
+     * structure2_cbor = [seq, sender_pubkey, content_hash, sender_signature, scan_result, prev_root].
+     */
+    /**
+     * DOD-MSG-4 (2b) / SEC-1: decode a park envelope. Legacy/unsigned shapes still DECODE so that
+     * `recoverParkedEntry` can refuse them BY NAME (`unsigned_envelope`) — decoding is not accepting.
+     * Encoding lives in park-envelope.ts and REQUIRES a sender signature (see SEC-1); it is not
+     * exposed here, so no caller can seal an unsigned envelope through this class.
+     */
+    decodeParkEnvelope(plaintext) {
+        return decodeParkEnvelope(plaintext);
+    }
+    /**
+     * DOD-MSG-4 (2b): public entry for the recover path to verify + record a parked entry's ordering
+     * record (the recover handler lives in daemon.ts, which has no access to the private method).
+     */
+    recordOrderingRecord(agentName, sessionId, structure1Cbor, structure2Cbor, contentHash, correlationId) {
+        // DOD-M15-FRAME-1: the POSITION only — this path does not act on `fatal`, because its identity proof is
+        // elsewhere and already fail-closed: the sealed envelope carries the sender's signature over
+        // (session_id, recipient_pubkey, content_hash), and a missing, bad, or wrong-signer envelope is refused.
+        // A second refusal on the ordering record would gate mail on a record the relay-degraded path may omit.
+        // The live direct path is where the ordering record IS the proof, and that is where `fatal` is consumed.
+        const seq = this.#refusals.recordFrameOrdering(agentName, sessionId, structure1Cbor, structure2Cbor, contentHash, correlationId, "park").seq;
+        let agentId = null;
+        try {
+            agentId = this.#requireAgentId(agentName);
+        }
+        catch { /* reported by storeRecoveredPosition */ }
+        if (seq !== null)
+            storeRecoveredPosition({ db: this.#db, logger: this.#logger, agentId, sessionId, canonicalSeq: seq, contentHash, structure1Cbor }); // see recovered-position.ts
+        return seq;
+    }
+    /**
+     * Stop a session whose counterparty's key could not be tied to them.
+     *
+     * Reuses the identity-freeze machinery rather than inventing a second way for a session to stop:
+     * the operator-facing shape, the refusal-to-revive, and the status write are already right there,
+     * and a second mechanism is a second thing to keep correct.
+     */
+    async #freezeSessionForKeyRefusal(agentName, sessionId, reason, correlationId) {
+        /**
+         * THE REASON IS RECORDED BEFORE THE TEARDOWN, AND SURVIVES IT — review F2.
+         *
+         * The teardown destroys this session's key material and used to clear the reason with it, so the
+         * listing recomputed `NOT_YET_AGREED` and the agent was told *"still agreeing its key, sending is
+         * held"* — a reassurance, for the one detection in this unit that means someone may be
+         * substituting keys on the connection. Its only real consumer was a log line.
+         */
+        this.#ephemerals.noteContentEncryptionReason(agentName, sessionId, CONTENT_ENCRYPTION_REASONS.KEY_REFUSED);
+        /**
+         * ⚠️ `"key_refused"`, NOT `"stream_close"` — review F3, and this is error substitution of the
+         * exact kind Invariant 3 names. `stream_close` is written to the row as
+         * `interrupted_by = 'relay_stream_close'`, so a key-authentication refusal was durably recorded
+         * as a relay problem and an operator debugging it would go and look at the relay fleet.
+         */
+        const stopped = await this.#life.markInterruptedWithDetails(agentName, sessionId, 0, "key_refused");
+        /**
+         * OBSERVE THE OUTCOME rather than asserting it — review F11. `markInterruptedWithDetails`
+         * returns early when the row is not `active`, so claiming "the session was stopped" here
+         * unconditionally would state something that did not happen.
+         */
+        this.#logger.error("session.key.session_stopped", {
+            agentName, sessionId, correlationId, reason,
+            stopped,
+            impact: stopped
+                ? "the session was stopped rather than continued unencrypted; a substituted key would otherwise have been handed exactly the plaintext it was reaching for"
+                : "the session was already not active, so nothing was torn down here — the refusal stands and no content was accepted",
+            guidance: CONTENT_ENCRYPTION_GUIDANCE[CONTENT_ENCRYPTION_REASONS.KEY_REFUSED],
+        });
+    }
+    /**
+     * Test seam: see every decoded inbound content frame, as it arrived.
+     *
+     * Review F4. The "bytes on the wire are ciphertext" claim needs the ACTUAL frame; asserting on a
+     * freshly sealed stand-in tests the crypto primitive and stays green when the send path is
+     * reverted to putting plaintext on the wire. There is no other way to reach the decoded frame from
+     * outside — the handler consumes it and hands ingest the plaintext.
+     *
+     * Read-only by construction: the callback receives the frame and cannot influence routing.
+     */
+    observeInboundContentFramesForTest(cb) {
+        this.#inboundFrameObserver = cb;
+    }
+    /** Injected by the daemon once its per-agent key providers exist. See `#keyProviderResolver`. */
+    setKeyProviderResolver(resolver) {
+        this.#keyProviderResolver = resolver;
+    }
+    /**
+     * Test seam: run the auto-acknowledge gate, exactly as the counterparty's SEAL ctrl leaf does.
+     *
+     * `DOD-M15-SEALWIRE-1` part B1, review F-B. The gate has ONE production call site — inside the
+     * relay leaf handler, behind `leaf_kind === CTRL && !authored_by_us` — so reaching it from a test
+     * needs a live relay client delivering a real ctrl leaf. The consequence was measured: my
+     * "tampered never downgrades" test wrapped its decisive assertion in
+     * `if (skipped.length > 0)`, which was ALWAYS FALSE, so the whole `content_tamper` vs
+     * `content_verification_unavailable` branch had no coverage anywhere in the repo and two mutants
+     * on it survived the full gate.
+     *
+     * It calls the REAL method (public on `SessionSeal` since the split, private before it) rather than reproducing its logic, so a test cannot pass
+     * against a decision production does not make.
+     */
+    runAutoAcknowledgeGateForTest(agentName, sessionId, correlationId = "test") {
+        this.#seal.maybeAutoAcknowledgeSeal(agentName, sessionId, correlationId);
+    }
+    /**
+     * Test seam: deliver an inbound salt frame, exactly as the content-stream decoder does.
+     *
+     * 006-CRYPTO finding 2. WHICH of the four reasons the peer gave decides what the operator is told,
+     * and reaching that decision from a test otherwise needs a second live daemon that has closed
+     * adoption for a specific reason — which is not something a counterparty can be asked to do on
+     * demand. The four labels are the whole point of the finding, so they need to be reachable.
+     *
+     * It calls the REAL private handler rather than reproducing its routing, so a test cannot pass
+     * against a decision production does not make. It takes the DECODED frame, so it deliberately
+     * does NOT stand in for the decoder above it — the length and vocabulary checks there have their
+     * own tests driving `handleContentFrameForTest`.
+     */
+    async handleSaltFrameForTest(agentName, sessionId, frame, correlationId = "test") {
+        await this.#salts.handleSaltFrame(agentName, sessionId, frame, correlationId);
+    }
+    /**
+    
+  
+    /**
+      /**
+     * TEST SEAM — put a session into the state a real one is in between announcing and being answered.
+     *
+     * Reaching that state for real needs a live counterparty connection, which the daemon-level fixtures
+     * do not have. It calls the same private registration the announce path calls, so it cannot drift.
+     */
+    markSaltAgreementPendingForTest(agentName, sessionId, boundMs) {
+        // ANNOUNCED, per this seam's contract above: "between ANNOUNCING and being answered" — AWAYSALT-1's speculative arm is the other state and settles differently.
+        this.#salts.markSaltPending(agentName, sessionId, boundMs, true);
+    }
+    getSessionContentSalt(agentName, sessionId) {
+        return this.#salts.getSessionSalt(agentName, sessionId);
+    }
+    /**
+     * THE SALT, OR WHY THERE ISN'T ONE — `DOD-M15-INCLUSION-1`, fallback-finder finding 2.
+     *
+     * `getSessionContentSalt` above answers `null` for THREE different situations, and a caller that
+     * turns that null into a sentence for an operator gets two of them wrong:
+     *
+     *   `none`       — no salt was ever agreed. The session really is unsalted.
+     *   `unreadable` — a salt row EXISTS and could not be used: the wrong width (corruption on this
+     *                  operator's own disk), or the read threw.
+     *
+     * The distinction is not cosmetic. `unreadable` means the session's leaves WERE hashed under a
+     * salt, so telling its operator *"this session's content hashes are UNSALTED … start a session
+     * while you are both connected"* is an affirmatively false statement about a security property
+     * their session has, and it points them at their counterparty over damage to their own database.
+     * That is the same defect `#getSessionSalt`'s own F8 note was written to end, re-committed one
+     * surface out.
+     *
+     * ⚠️ IT DELEGATES — there is no second read here. Calling `#getSessionSalt` first means the salt
+     * this reports is the salt the hashing path uses, including its cache and its wrong-width refusal.
+     * A parallel query would be free to disagree with it, which is the whole failure this returns a
+     * reason to prevent.
+     */
+    getSessionContentSaltState(agentName, sessionId) {
+        const salt = this.#salts.getSessionSalt(agentName, sessionId);
+        if (salt)
+            return { salt };
+        if (!this.#db)
+            return { salt: null, reason: "unreadable" };
+        try {
+            const row = this.#db
+                .prepare("SELECT length(content_salt) AS n FROM sessions WHERE agent_id = ? AND session_id = ?")
+                .get(this.#requireAgentId(agentName), sessionId);
+            // A row with a non-empty blob that `#getSessionSalt` still refused is the corruption case: the
+            // bytes are there and they are not a salt. NULL or zero-length is a genuine absence.
+            const stored = row?.n ?? 0;
+            return { salt: null, reason: stored > 0 ? "unreadable" : "none" };
+        }
+        catch {
+            // The read that would tell us which case it is has itself failed, so "no salt was agreed" is
+            // exactly the thing we cannot assert.
+            return { salt: null, reason: "unreadable" };
+        }
+    }
+    /**
+     * Announce our state to the counterparty: a contribution if we hold no salt, a fingerprint if we
+     * do. Called on every counterparty connect — first connection, reconnect and revival alike — and
+     * on receiving a peer contribution.
+     *
+     * ⚠️ THIS PARAGRAPH USED TO SAY *"nothing hashes with the salt yet, so a frame that never lands
+     * costs nothing today"*, and ended by instructing the next unit not to carry it forward unchanged.
+     * **This is that unit, and pass 2 caught me leaving it** — I corrected the same claim inside
+     * `session.salt.announce.failed`'s `impact` in the previous pass and walked past the method header
+     * saying the opposite twenty lines above it.
+     *
+     * As it stands now: the SEND is still best-effort, but a frame that never lands is no longer free.
+     * A first send waiting on this agreement falls back to an unsalted hash, and that is permanent for
+     * the session. The catch therefore settles the pending under `announce_failed` rather than leaving
+     * the send to time out — so the cost is one dial attempt and an accurate reason, instead of five
+     * seconds and a diagnosis blaming the counterparty for a frame we never sent.
+     */
+    async #sendSaltFrame(agentName, sessionId, correlationId, override) {
+        const entry = this.#activeNodes.get(this.#k(agentName, sessionId));
+        if (!entry)
+            return;
+        // `override` is the repair and the mismatch notice: a frame the AGREEMENT chose, which is not
+        // the one our current state would produce. A side that holds a salt normally announces a
+        // fingerprint — the repair has it send its CONTRIBUTION instead, which is the whole mechanism.
+        /**
+         * `#saltState`, NOT a direct call to the minting accessor — review F15, and this one line was
+         * the difference between the safety argument written for the repair and the code that ran.
+         *
+         * It read `ownContribution: this.#salts.saltContributionFor(...)`, which mints unconditionally. Both
+         * arguments are evaluated, so a session that already held a salt got a fresh half minted into
+         * `#saltContributions` even though `ownSaltFrame` discards it on that branch — and
+         * `#evictSessionCaches` drops the half on every teardown while the salt stays on disk, so ANY
+         * revived session hit it, before any inbound frame could be handled.
+         *
+         * The consequence was not cosmetic. `#ownSaltHalf` never returned null, so `STATE_DIVERGENT`
+         * was dead code, and a revived session would REPAIR its counterparty onto a half its salt was
+         * never built from — then both sides froze on `salt_fingerprint_mismatch`, whose guidance sends
+         * the operator to compare build versions with a counterparty that did nothing wrong.
+         */
+        const state = this.#salts.saltState(agentName, sessionId);
+        const frame = override ?? ownSaltFrame(state);
+        if (!frame) {
+            // Neither a salt nor a half. `#saltState` does not produce this, so it is a defect rather
+            // than a state to paper over — and inventing a contribution here is exactly what F15 was.
+            this.#logger.error("session.salt.announce.failed", {
+                agentName, sessionId, correlationId, reason: "no_salt_and_no_contribution",
+                impact: "this side has neither an agreed salt nor a half to offer, so it announced nothing; no half was invented, because one minted now would not be the half any stored salt was built from",
+            });
+            return;
+        }
+        /**
+         * ⚠️ REGISTERED BEFORE THE DIAL, NOT AFTER IT — review Finding 2, and this ordering is the whole
+         * of constraint 2 for the case that actually happens.
+         *
+         * This sat after `await newStream(...)`, which negotiates the protocol with the peer and takes
+         * tens to hundreds of milliseconds. A `cello_send` landing inside that interval found nothing
+         * pending, took the park-only exit, hashed unsalted, and **closed adoption for the life of the
+         * session** — a session with a live counterparty and an agreement about to complete. The feature
+         * off forever, and the log telling the operator their counterparty was on an old build.
+         *
+         * That is precisely the failure constraint 2 exists to prevent, arriving by the one route the
+         * implementation did not cover: the gap between deciding to announce and the frame leaving.
+         *
+         * Park-only is untouched — it never reaches this line, because `#sendSaltFrame` returns at the
+         * `!entry` guard above when there is no active node. And a failed announce settles the waiter in
+         * the catch below rather than leaving a send to sit out the full bound for a frame that never
+         * left.
+         */
+        if (!frame.adoptionClosed)
+            this.#salts.markSaltPending(agentName, sessionId, SALT_AGREEMENT_WAIT_MS, true);
+        // Held outside the try so the catch can retire a stream that was opened and then failed to
+        // write — the same leak, and the same fix, as `#sendDeliveryAck` in `session-content-ingest.ts`.
+        let saltStream;
+        try {
+            const stream = await entry.node.newStream(entry.counterpartySessionPeerId, CELLO_CONTENT_PROTOCOL_ID);
+            saltStream = stream;
+            stream.send(lp.encode.single(encodeCbor({
+                type: "session_salt_agreement",
+                session_id: sessionId,
+                ...(frame.contribution ? { contribution: frame.contribution } : {}),
+                ...(frame.fingerprint ? { fingerprint: frame.fingerprint } : {}),
+                ...(frame.adoptionClosed ? { adoption_closed: frame.adoptionClosed } : {}),
+            })));
+            await stream.close();
+            this.#logger.debug("session.salt.announced", {
+                agentName, sessionId, correlationId,
+                /**
+                 * THREE STATES, not two. This read `fingerprint ? holds_salt : offering_contribution`, which
+                 * was exhaustive until the adoption refusal put a third frame on the wire — and a refusal
+                 * carries no fingerprint, so it logged as `offering_contribution`: the log claiming we asked
+                 * for a salt at the exact moment we told the peer we were declining one. An operator reading
+                 * the pair would see an offer that was never answered and go looking for a dropped frame.
+                 */
+                state: frame.adoptionClosed ? "adoption_closed" : frame.fingerprint ? "holds_salt" : "offering_contribution",
+            });
+        }
+        catch (err) {
+            /**
+             * ⚠️ RELEASE THE WAITER — the frame never left, so there is nothing to wait for.
+             *
+             * Registering before the dial (above) means a failed announce would otherwise leave a first
+             * send holding for the full five seconds against a frame that was never sent. Settling here
+             * makes the failure cost one dial attempt instead of the whole bound, and B2b-2 turned this
+             * from theory into something a user feels: it is the pause before their first message.
+             */
+            this.#salts.settleSaltPending(agentName, sessionId, "announce_failed");
+            this.#logger.warn("session.salt.announce.failed", {
+                agentName, sessionId, correlationId, error: extractErrorMessage(err),
+                // Review F1: this used to end "so no message is affected", which was FALSE in the situation
+                // it fires in — a one-sided announce is exactly what put the two sides out of step, and the
+                // peer used to freeze the session over it. It converges now, so the claim is true again;
+                // it is stated with its reason rather than as a bare reassurance.
+                //
+                // ⚠️ B2b-2 CHANGED THE LAST CLAUSE'S TRUTH. "Nothing hashes with the salt yet" was true for
+                // part A and is now false: a first send waiting on this agreement falls back to sha256 when
+                // it fails, which permanently unsalts the session. Not a message LOST — a protection not
+                // taken, and the sentence has to stop promising otherwise.
+                impact: "the counterparty was not told our salt state on this attempt. We re-announce on every reconnect, and a side that is out of step re-offers its half rather than refusing, so the agreement converges from here. No message is affected, but a first send waiting on this agreement now falls back to an unsalted hash, which is permanent for this session.",
+            });
+            if (saltStream !== undefined) {
+                try {
+                    saltStream.abort(err instanceof Error ? err : new Error(String(err)));
+                }
+                catch { /* already gone */ }
+            }
+        }
+    }
+    async #freezeOnIdentityFailure(agentName, sessionId, reason, correlationId) {
+        await this.#freezeSession(agentName, sessionId, reason, {
+            event: "session.content.identity.frozen",
+            observation: "a frame failed to verify against the expected counterparty's key; the session was frozen defensively; cause undetermined",
+            reviveReason: "session_frozen_identity_failure",
+            reviveGuidance: "This session was frozen because a message failed to verify against the expected counterparty's key. " +
+                "Cause undetermined — that signal looks the same whether someone was impersonating your counterparty or CELLO's own delivery mishandled a fallback, so it is recorded as an observation and nothing has been concluded about them.",
+            // Review F1: this said "no further content will be accepted on this session", which was FALSE
+            // as shipped — the next read revived it. It is true now, and it says how it is true, because
+            // an operator who reads "frozen" and then watches the session work again learns to distrust
+            // the log rather than the session.
+            impact: "the content was NOT ingested, NOT displayed and NOT attributed to anyone; the session will not be revived by a read or a send, and only a close or a fresh session moves it now",
+        }, correlationId);
+    }
+    /**
+     * Stop a session and refuse to revive it. Shared by the identity freeze and the salt
+     * disagreement, because the MECHANISM is identical — mark, then tear down — while the two have
+     * nothing else in common and must not describe each other. An identity failure is evidence about
+     * the counterparty; a salt disagreement is usually two builds that do not match, and telling an
+     * operator their counterparty failed a key check when they did not is worse than saying nothing.
+     * Hence the caller supplies both sentences.
+     */
+    async #freezeSession(agentName, sessionId, reason, narrative, correlationId) {
+        // Review F1: MARK BEFORE TEARING DOWN. `destroySessionNode` writes `interrupted`, which is the
+        // revivable status — if the mark landed after, a read racing the teardown could revive the
+        // session out from under the freeze.
+        //
+        // `reviveReason` is SPELLED OUT by the caller rather than built from `reason`. Deriving it looks
+        // tidier and silently changed a shipped contract: the identity freeze's `reason` is the specific
+        // ordering failure (`bad_signature`, `signer_not_counterparty`), so a derived code would have
+        // turned the stable `session_frozen_identity_failure` into a family of varying strings that no
+        // caller matches. Caught by that path's own test.
+        this.#frozenSessions.set(this.#k(agentName, sessionId), {
+            reason: narrative.reviveReason,
+            guidance: narrative.reviveGuidance,
+        });
+        // The EVENT NAME is the caller's, not this method's. Both freezes share a mechanism and nothing
+        // else, and a salt disagreement logged under `…identity.frozen` would tell an operator their
+        // counterparty failed a key check when they did not — a worse outcome than saying nothing.
+        this.#logger.error(narrative.event, {
+            agentName, sessionId, reason, correlationId,
+            observation: narrative.observation,
+            // Review F1: the identity path's impact line said "no further content will be accepted on this
+            // session", which was FALSE as shipped — the next read revived it. It is true now, and it says
+            // how it is true, because an operator who reads "frozen" and then watches the session work
+            // again learns to distrust the log rather than the session.
+            impact: narrative.impact,
+        });
+        try {
+            /**
+             * `"error"` maps to DB status `interrupted`, which is the SAME row an ordinary
+             * counterparty-gone teardown writes — so a freeze is distinguishable in the log and in
+             * behaviour, but not in the session record.
+             *
+             * ⚠️ THIS COMMENT USED TO SAY THE COLUMNS DID NOT EXIST. They do now: `frozen_at` and
+             * `frozen_reason` were added to `sessions` by the salt migration, which carried them for
+             * `DOD-M15-FREEZE-STATUS-1` so that two lanes would not both edit this file's migration list.
+             * What is still missing is a WRITER — that is `FREEZE-STATUS-1`'s work and it belongs to the
+             * other lane, so nothing here fills them in. The gap is unchanged; only the reason for it is.
+             */
+            await this.#life.destroySessionNode(agentName, sessionId, "error");
+        }
+        catch (err) {
+            // The refusal already happened — the content did not ingest. A teardown failure must not
+            // turn a successful refusal into a thrown handler, which would close the stream on a path
+            // that reads as "nothing arrived".
+            this.#logger.warn("session.content.identity.freeze_teardown_failed", {
+                agentName, sessionId, error: extractErrorMessage(err), correlationId,
+            });
+        }
+    }
+    /**
+     * This agent's own last message on a session, from the ONE chain both send paths share.
+     *
+     * `undefined` means it has not spoken here yet, which is the session genesis and not an absence.
+     * The caller supplies that; this does not guess.
+     */
+    #ownChainOf(agentName, sessionId, entry, ownPubkey) {
+        const relayHex = entry?.relaySessionIdBytes
+            ? Buffer.from(entry.relaySessionIdBytes).toString("hex")
+            : sessionId;
+        return entry?.relayClient?.lastOwnHash(relayHex)
+            ?? this.#ownChainStore?.lastOwnHash(Buffer.from(ownPubkey).toString("hex"), sessionId)
+            ?? undefined;
+    }
+    /**
+     * Can a refused message still reach this operator through the relay mailbox? — review F2.
+     *
+     * Feature-detected, not assumed: `openContentSeal` is documented OPTIONAL on `KeyProvider`, and
+     * `content-park.ts` refuses recovery without it. Asking the same resolver `content-park.ts` asks
+     * is what keeps the sentence on the operator's screen tied to what their machine can actually do.
+     */
+    #mailboxRouteAvailable(agentName) {
+        const kp = this.#keyProviderResolver?.(agentName);
+        return kp !== undefined && typeof kp.openContentSeal === "function";
+    }
+    // ─── Private helpers ──────────────────────────────────────────────────────
+    /**
+     * DOD-NAT-REACHABILITY-1 (Phase 2): relay endpoints the DIRECTORY handed this
+     * agent at signaling-auth time — the freshest, health-filtered view of the
+     * relay pool, and the only source a FRESH agent (no session history) has.
+     */
+    #directoryRelayEndpoints = new Map();
+    /**
+     * DOD-M15-RELAYSLOTS-1: the directory-issued online token per agent — the credential the relays
+     * above now require before they will let this agent hold a circuit reservation slot.
+     *
+     * Arrives with `signaling_auth_ok`, on the same frame as the relay endpoints and on the same
+     * cadence: every connect AND every reconnect. Held here rather than passed to a relay client at
+     * construction because it expires within the hour and the client outlives it — the client reads
+     * it through `getDirectoryOnlineToken` at each authentication.
+     */
+    #directoryOnlineTokens = new Map();
+    /**
+     * DOD-M15-RELAYSLOTS-1: accept the directory's online token for an agent. Called on every
+     * signaling connect and reconnect, which is what keeps it fresh.
+     */
+    setDirectoryOnlineToken(agentName, token) {
+        this.#directoryOnlineTokens.set(agentName, token);
+        this.#directoryOnlineTokenAbsent.delete(agentName);
+    }
+    /**
+     * DOD-M15-RELAYSLOTS-1 review M1: the directory issued no token, and this is which absence it was.
+     *
+     * Kept so the relay's eventual `online_token_required` refusal can be reported with the cause the
+     * DIRECTORY knew and the relay never learns — most importantly `not_registered_here`, where the
+     * generic advice ("check that you are reaching a directory") points at a connection that is
+     * working and away from the actual problem.
+     */
+    #directoryOnlineTokenAbsent = new Map();
+    setDirectoryOnlineTokenAbsent(agentName, reason) {
+        this.#directoryOnlineTokens.delete(agentName);
+        this.#directoryOnlineTokenAbsent.set(agentName, reason ?? "unstated");
+    }
+    /**
+     * The current token, or `undefined` when the directory has not issued one — either no directory
+     * connection yet, or this key has no agent profile there. Undefined is a real answer, not a
+     * missing one: the relay refuses without a token, which is the intended outcome for a key the
+     * directory does not recognise.
+     */
+    getDirectoryOnlineToken(agentName) {
+        return this.#directoryOnlineTokens.get(agentName);
+    }
+    /**
+     * DOD-NAT-REACHABILITY-1: circuit-relay listen addresses for an agent's known
+     * relays, so its standing receiver takes reservations and becomes dialable
+     * behind NAT. Sources, merged and deduped by relay peer id: the directory's
+     * auth-time relay pool (freshest — first), then the persisted relay endpoints
+     * of past sessions (getAgentRelayEndpoints — covers a directory that predates
+     * the auth_ok extension).
+     */
+    /**
+     * DOD-M15-RELAYSLOTS-1: relays this agent should skip, and until when — see the failover note in
+     * `reservationCircuitAddrs` (`session-relay.ts`). Keyed agent → relay peer id → expiry.
+     *
+     * Time-boxed rather than permanent because the fault is somebody else's to fix and we will not
+     * hear when they have: an operator sets the missing directory key and restarts, and this agent
+     * should find that relay again without needing its own restart.
+     */
+    #relayQuarantine = new Map();
+    /** DOD-M12B-SESSION-SEED-1 test seams: the counterparty addresses a re-dial depends on. Not
+     *  otherwise observable — they are set from a signed relay assignment that a fixture cannot mint. */
+    setCounterpartyAddrsForTest(agentName, sessionId, addrs) {
+        this.#counterpartyAddrs.set(this.#k(agentName, sessionId), [...addrs]);
+    }
+    getCounterpartyAddrsForTest(agentName, sessionId) {
+        return this.#counterpartyAddrs.get(this.#k(agentName, sessionId)) ?? [];
+    }
+    /** DOD-M12B-SESSION-SEED-1 test seam: drop a seed WITHOUT zeroing or a status change — what a
+     *  process restart does to it. The refusal that follows is the one an operator most needs named. */
+    forgetSessionSeedForTest(agentName, sessionId) {
+        this.#sessionSeeds.delete(this.#k(agentName, sessionId));
+    }
+    /**
+     * DOD-M12B-SESSION-SEED-1 — drain the direct-resend queue when a session comes back.
+     *
+     * `retryQueue.drainSession` had NO production caller. The send path enqueues into it on a failed
+     * delivery and tells the operator the message will be "retried on reconnect", and nothing ever
+     * reconnected it — the row sat there until the session went terminal and was reaped. Measured
+     * live 2026-08-18: two of the operator's messages went in, and the response told them both were
+     * lost and to send again, which is how a transcript gets duplicates.
+     *
+     * A revival IS the reconnect that sentence promised. This is the hook that makes it true.
+     */
+    setRetryDrainHook(fn) {
+        this.#retryDrainHook = fn;
+    }
+    /** DOD-M12B-SESSION-SEED-1 test seam: does this session still hold a revivable identity? */
+    hasSessionSeedForTest(agentName, sessionId) {
+        return this.#sessionSeeds.has(this.#k(agentName, sessionId));
+    }
+    getStandingReceiverSeedForTest(agentName) {
+        return this.#standingReceivers.get(agentName)?.seed;
+    }
+    async ensureStandingReceiverForAgent(agentName) {
+        this.#agentsWantingReceiver.add(agentName);
+        this.#relay.startReservationWatchdog();
+        await this.#receivers.ensureStandingReceiver(agentName);
+    }
+    async removeStandingReceiverForAgent(agentName) {
+        // M8B F14: the agent no longer wants a receiver — disarm the teardown re-arm.
+        this.#agentsWantingReceiver.delete(agentName);
+        // The directory hands these out at signaling-auth time, so a re-started agent
+        // gets a fresh set on its next connect — holding the old ones would keep a
+        // retired agent's relay list alive for the daemon's lifetime.
+        this.#directoryRelayEndpoints.delete(agentName);
+        // DOD-M12B-RESERVATION-RETRY-1: and the retry budget with them. A spent budget that survives an
+        // offline→online cycle is a LATCH: the new receiver gets no reservation, the watchdog finds
+        // `attempts` already past the cap, and returns having done nothing — no retry and not even a
+        // second give-up. The agent is undialable and the machinery is inert and mute until a daemon
+        // restart. Same reason the line above exists ("holding the old ones would keep a retired agent's
+        // relay list alive for the daemon's lifetime").
+        this.#srReservationRetry.delete(agentName);
+        this.#srLastRejectionReason.delete(agentName);
+        const sr = this.#standingReceivers.get(agentName);
+        if (!sr) {
+            // L1: an #ensureStandingReceiver for this agent may be in flight (parked on start(), so no
+            // map entry yet). Leave a tombstone — that ensure tears its fresh node down on completion
+            // instead of installing an SR for an agent that is now offline. Also drop any stale creating
+            // marker so a later start can re-ensure.
+            if (this.#standingReceiverCreating.has(agentName))
+                this.#standingReceiverRemoving.add(agentName);
+            return;
+        }
+        const removed = this.#standingReceivers.get(agentName);
+        this.#standingReceivers.delete(agentName);
+        // DOD-M12B-SESSION-SEED-1 (review F8): the operator took this agent offline — its advertised
+        // identity is not needed any more, and the tenet's rule is that nothing unneeded stays live.
+        removed?.seed.fill(0);
+        // Best-effort teardown, but NOT silent: a standing receiver that failed to stop keeps a libp2p
+        // node live on the network. For a removal/retire (a revocation-class action) that must be visible,
+        // so the caller and the operator can see the leak rather than trust a false "torn down". autoNat is
+        // inside the try too — its stop() throwing must not skip node.stop() or escape unlogged.
+        try {
+            sr.autoNat.stop();
+            await sr.node.stop();
+        }
+        catch (err) {
+            this.#logger.warn("session.standing_receiver.teardown.failed", {
+                agentName,
+                error: extractErrorMessage(err),
+            });
+        }
+    }
+    /** CC-5/F21: count of RECEIVED messages on a session — the "did the counterparty ever speak"
+     *  signal the dead-half-open reaper uses (message_count also counts our own auto-"Dispatched." ack,
+     *  so it is NOT a reliable half-open discriminator). Mirrors #getReceivedBytesTotal. */
+    /**
+     * DOD-M12B-REAP-HELD-1 — did the counterparty EVER establish? Counted from every place their
+     * messages can be, not just the one.
+     *
+     * OBSERVED LIVE 2026-08-18: the half-open reaper abandoned session `d28db475…` — twenty leaves in
+     * the chain and sixteen more frames verified and held, ten of them from the counterparty — while
+     * the restart-seal resolver was actively trying to notarize it. The receipt was forfeited.
+     *
+     * `countReceivedMessages` asks the TRANSCRIPT, and **held content never reaches the transcript**;
+     * it sits in `held_content` until it can join the chain. So the very condition that holds content
+     * — an interrupted session — is the condition that makes the counterparty's messages invisible,
+     * and a fully-established conversation reads identically to an offer nobody ever answered.
+     *
+     * `origin = 'received'` is load-bearing. Our OWN held frames prove nothing about them, and
+     * counting those would make every session we ever spoke into un-reapable — which is exactly the
+     * clutter the reaper exists to clear. D18 also depends on the zero case staying zero: reaping only
+     * genuinely 0-received ghosts is what stops a stranger whose first handshakes died from being
+     * locked out by the acceptance bound forever.
+     */
+    countEstablishedReceived(agentName, sessionId) {
+        if (!this.#db)
+            return 0;
+        const agentId = this.#requireAgentId(agentName);
+        const held = this.#db
+            .prepare("SELECT COUNT(*) AS n FROM held_content WHERE agent_id = ? AND session_id = ? AND origin = 'received'")
+            .get(agentId, sessionId);
+        return this.#queries.countReceivedMessages(agentName, sessionId) + (held?.n ?? 0);
+    }
+}
+//# sourceMappingURL=session-node-manager.js.map