@cello-protocol/daemon 0.0.227 → 0.0.228

package/dist/session-relay-client.js

@@ -0,0 +1,2876 @@
+var _a;
+/**
+ * Daemon-side relay witness client (PER AGENT).
+ *
+ * In CELLO the relay is the ordering/witness authority (Structure 2): it never sees
+ * plaintext (content is peer↔peer), only the SIGNED content-hash leaves. It assigns
+ * the canonical `sequence_number` and forwards each witnessed leaf to the counterparty
+ * (`leaf_deliver`). A `cello_send` whose hash the relay never witnessed has no canonical
+ * sequence and is not a complete CELLO message — so the session submits the message leaf
+ * hash here, in parallel with the direct content delivery.
+ *
+ * ONE stream per AGENT, not per session. The relay authenticates a stream by the agent's
+ * K_local pubkey and keys its delivery/queue maps by that pubkey (relay-node
+ * #handleRelayStream / #processHashSubmit), so a second stream for the same pubkey would
+ * OVERWRITE the first's delivery stream and steal its queued `leaf_deliver`s. The protocol
+ * is designed for one relay connection per agent identity multiplexing all that agent's
+ * sessions — every wire frame carries `session_id`. So this client is shared across an
+ * agent's sessions: submits are globally FIFO-serialized on the stream (a `hash_submit_ack`
+ * carries NO session_id, so at most one submit may be outstanding at a time and acks match
+ * the queue head in order), while inbound `leaf_deliver` (which DOES carry `session_id`) is
+ * routed to the owning session's handler.
+ *
+ * The stream is (re)dialed from whatever live session node is current at submit time, so it
+ * survives individual session teardown (the relay treats a same-pubkey reconnect as a
+ * reconnect, re-auths, and re-drains).
+ *
+ * The server contract this must match: `packages/relay/src/relay-node.ts`.
+ *
+ * Crypto: Ed25519 RFC 8032. Relay auth domain: "CELLO-RELAY-AUTH-v1".
+ */
+import { createHash } from "node:crypto";
+import * as lp from "it-length-prefixed";
+import { decode } from "cbor-x";
+import { encodeCbor, decodeSealPayload, encodeStructure1, decodeStructure1, computeGenesisPrevRoot, computeChainAnchor } from "@cello-protocol/protocol-types";
+import { encodeSessionLivenessQuery, decodeSessionLivenessResponse, encodeSessionAttendanceNotice, } from "@cello-protocol/protocol-types";
+import { verify } from "@cello-protocol/crypto";
+import { extractErrorMessage } from "./error-message.js";
+import { evaluateRelayAck, readSubmittedLeaf } from "./relay-receipt-store.js";
+import { lastSeenFromRecord } from "./resume-last-seen.js";
+import { reconnectWithBackoff, RELAY_RECONNECT_BASE_MS } from "./relay-reconnect.js";
+/**
+ * DOD-M15-AWAYSCOPE-1 — what a liveness query answers with.
+ *
+ * `refused` is kept separate from the values rather than folded into `liveness`, because it means
+ * something different: the relay declined to say, most likely because this caller is not a
+ * participant of the session it named. The liveness is 'unknown' either way — the operator surface
+ * shows the same thing — but a caller that wants to tell "the relay would not tell me" from "the
+ * relay does not know" can, and a log line that conflated them would send the next investigation
+ * looking at the counterparty instead of at the session id.
+ */
+/**
+ * The key an answer is matched to its question by: the two fields the RESPONSE carries back. One
+ * relay client serves every session an agent holds there, so two concurrent queries on one stream
+ * is ordinary — and an answer routed to whatever was asked last shows the wrong counterparty's row.
+ */
+function livenessKey(sessionId, counterpartyPubkey) {
+    return `${Buffer.from(sessionId).toString("hex")}:${Buffer.from(counterpartyPubkey).toString("hex")}`;
+}
+export const RELAY_PROTOCOL_ID = "/cello/relay/1.0.0";
+/**
+ * How long to wait before re-proving after a transport-class failure.
+ *
+ * Sized against the measured event, not guessed: libp2p logged
+ * `connection-manager closing 1 connections / stopped / started` inside 3ms, and the redial that
+ * followed completed ~1s later. A second is comfortably past the restart while still being
+ * invisible next to the ~5 minutes the previous behaviour cost (quarantine the relay, wait for the
+ * next reachability sweep).
+ */
+export const PROOF_RETRY_DELAY_MS = 1_000;
+export const RELAY_AUTH_DOMAIN = "CELLO-RELAY-AUTH-v1";
+/**
+ * DOD-WITNESS-STALL-1 — relay refusals that can NEVER resolve.
+ *
+ * `sendContent` treats a failed leaf-hash submit as a transient degradation: the content is real,
+ * the peer still gets it, and the canonical sequence is recovered later. That is correct for a relay
+ * that is briefly unreachable.
+ *
+ * It is WRONG for these two. They mean the relay has ended the session — there is no later, and
+ * nothing sent from here can ever enter the record. Collapsing them into the transient case is what
+ * let a conversation run for 68 minutes and 8 messages, every send reporting `delivered: true`,
+ * against a chain that had stopped growing.
+ *
+ * ENUMERATED, never pattern-matched. A substring rule like `reason.includes("sealed")` would absorb
+ * a future reason nobody has considered — which is the same collapse in a new coat.
+ */
+export const TERMINAL_RELAY_REFUSALS = new Set([
+    "session_sealed",
+    "session_not_found",
+    /**
+     * `DOD-M15-TERMINAL-REASON-1` split `session_sealed` into named causes, and this set is one of
+     * THREE places keyed on the old literal — a rename on the relay silently made a terminal refusal
+     * non-terminal here, which is the 68-minute defect above reopened by a string change.
+     *
+     * `seal_refused`: a directory READ the seal and rejected it. Terminal in the strongest sense —
+     * there is no later, and no retry can change a merits verdict.
+     *
+     * `seal_in_progress` is deliberately ABSENT. A seal in flight may still succeed, and after
+     * `DOD-M15-TRANSPORT-TERMINAL-1` the session can return to `active` — treating it as terminal
+     * would retire a conversation that is about to seal normally.
+     */
+    "seal_refused",
+    // The counterparty closed first: terminal for THIS SEND only, never retires (live 2026-09-13).
+    "session_closing",
+]);
+/** True when the relay has ended this session and no later submit can succeed. */
+export function isTerminalRelayRefusal(reason) {
+    return reason !== undefined && TERMINAL_RELAY_REFUSALS.has(reason);
+}
+/**
+ * DOD-M15-RELAYSLOTS-1 — **WHICH REFUSALS JUSTIFY TRYING A DIFFERENT RELAY.**
+ *
+ * We run several relays, so "move on to the next one" is always available — which is exactly why it
+ * needs a rule. Moving on from a problem that every relay will have turns one client-side fault into
+ * what looks like a fleet-wide outage, and the operator then goes looking for a broken relay.
+ *
+ * ENUMERATED, never pattern-matched, for the same reason `TERMINAL_RELAY_REFUSALS` is: a substring
+ * rule would silently absorb a future reason nobody has considered.
+ */
+const RELAY_SIDE_REFUSALS = new Set([
+    /**
+     * The relay holds no directory public key, so it can verify nothing and is refusing everyone.
+     * That is this relay being misconfigured, not us being wrong — another relay is the right move,
+     * and it is the whole reason we run more than one.
+     */
+    "online_token_no_directory_key",
+]);
+/**
+ * ─── WHOSE FAULT IS IT? — `DOD-M15-TOKENSTALE-1` ───────────────────────────────────────────────
+ *
+ * A SECOND question about the same refusal, and it is deliberately not `tryAnotherRelay` inverted.
+ * That one asks "would another relay help?"; this asks "is the broken thing ours?". They disagree
+ * on the case that matters: a slot cap is not worth failing over AND is entirely the relay's own
+ * answer about its own table — so reusing the failover flag to mean "our fault" would be right for
+ * the wrong reason, and would start telling operators their machine is broken when it is not.
+ *
+ * The consumer is the submit boundary. `#ensureConnected` returns a BOOLEAN, so every refusal below
+ * used to collapse into `relay_unavailable` — "the relay is unreachable", which is transient,
+ * somebody else's, and the documented reason a send degrades to an unwitnessed leaf and still
+ * reports success. An expired token is none of those. Measured live 2026-09-10: an agent reported
+ * `ok:true, delivered:true` on every send for over two days while the relay refused all thirteen
+ * authentications, and no conversation it held could produce a receipt.
+ *
+ * ⚠️ AN UNKNOWN REASON IS NOT LOCAL, and the direction of that default is a real choice. A future
+ * relay-side reason defaulting to "local" would accuse the reader's own machine, and a wrong
+ * accusation about your own setup costs more than a vague one about someone else's.
+ */
+const LOCAL_CREDENTIAL_REFUSALS = new Set([
+    "online_token_required",
+    "online_token_expired",
+    "online_token_pubkey_mismatch",
+]);
+export function isLocalCredentialRefusal(reason) {
+    return LOCAL_CREDENTIAL_REFUSALS.has(reason);
+}
+/**
+ * Classify a relay's auth refusal: what to tell the operator, and whether another relay would help.
+ *
+ * Everything not in `RELAY_SIDE_REFUSALS` defaults to "do not try another", and that default is the
+ * safe direction. A token problem reproduces identically on every relay in the fleet, so retrying
+ * around the fleet spends real time turning a client fault into an apparent outage — and a slot cap
+ * IS satisfiable elsewhere, but spreading to another relay papers over sessions that leaked and
+ * brings the same wall back on the next one.
+ */
+export function classifyRelayAuthRefusal(reason, extra = {}) {
+    const tryAnotherRelay = RELAY_SIDE_REFUSALS.has(reason);
+    let advice;
+    switch (reason) {
+        case "online_token_required":
+            advice = "This agent has no online token from a directory yet. It is issued when a directory " +
+                "marks the agent online, so this usually clears itself on the next directory connection. If " +
+                "it persists, the agent is not reaching any directory — check that first, not the relay.";
+            break;
+        case "online_token_expired":
+            /**
+             * ⚠️ THIS SENTENCE USED TO PROMISE A REFRESH THAT DOES NOT HAPPEN, and the promise is why the
+             * condition survived for days. It read: *"refreshed on the next directory connection"*. True,
+             * and useless — the token is issued only in the directory handshake, it lasts ONE HOUR, and a
+             * healthy agent does not make another connection. Measured on one box: a token at
+             * 2026-09-08 09:06 and the next over two days later.
+             *
+             * It now leads with the CONSEQUENCE, because the operator arrives here having been told every
+             * send succeeded, and names the one action that works today. The automatic refresh is
+             * `DOD-M15-TOKENSTALE-1` unit 2 and needs a directory frame that does not exist yet.
+             */
+            advice = "This agent's pass from the directory has expired, so the relay is refusing to " +
+                "witness anything it sends: messages still arrive, but nothing is being recorded as proof " +
+                "and no conversation can produce a receipt until this clears. It is NOT refreshed while the " +
+                "daemon keeps running — restart it (cello logout, then cello login) and the next session " +
+                "will be witnessed again. If it comes back within the hour, this machine's clock or its " +
+                "directory connection is the thing to look at.";
+            break;
+        case "online_token_signature_invalid":
+        case "online_token_malformed":
+        case "online_token_lifetime_too_long":
+            advice = "This relay would not accept the token this agent was issued. Most often the relay " +
+                "and the directory are not in the same consortium — check which directories this relay is " +
+                "configured to trust.";
+            break;
+        case "online_token_pubkey_mismatch":
+            advice = "The token names a different key from the one this agent signed with. That is an " +
+                "identity mix-up on this machine, not a relay problem.";
+            break;
+        case "online_token_no_directory_key":
+            advice = "This relay holds no directory public key, so it cannot verify anyone and is " +
+                "refusing every agent. Its operator needs to configure one; another relay will work now.";
+            break;
+        case "slot_cap_exceeded":
+            advice = extra.slotsHeld !== undefined && extra.slotCap !== undefined
+                ? `This agent already holds ${String(extra.slotsHeld)} of a maximum ${String(extra.slotCap)} ` +
+                    "reservations on this relay, and none is idle enough to reclaim. That is almost always " +
+                    "sessions that were never closed — close some and this clears. Moving to another relay " +
+                    "would work now and hit the same wall there."
+                : "This agent already holds the most reservations one agent may hold on this relay. That is " +
+                    "almost always sessions that were never closed — close some and this clears.";
+            break;
+        case "session_tuple_cap_exceeded":
+            advice = extra.slotsHeld !== undefined && extra.slotCap !== undefined
+                ? `You already have ${String(extra.slotsHeld)} conversations open with this counterparty, ` +
+                    `which is the maximum of ${String(extra.slotCap)} this relay allows between one pair of ` +
+                    "agents. Close some and try again — this is almost always conversations that were never " +
+                    "closed rather than ones anybody is still using."
+                : "You already have the maximum number of concurrent conversations open with this " +
+                    "counterparty. Close some and try again.";
+            break;
+        case "rate_limited":
+            advice = extra.retryAfterMs !== undefined
+                ? `This relay is throttling this agent; it clears on its own in about ${String(Math.ceil(extra.retryAfterMs / 1000))}s.`
+                : "This relay is throttling this agent; it clears on its own after the throttle window.";
+            break;
+        default:
+            advice = "This agent could not authenticate to this relay, so it cannot hold a reservation " +
+                "here and is reachable only over a direct connection.";
+    }
+    return {
+        reason,
+        advice,
+        tryAnotherRelay,
+        ...(extra.slotsHeld !== undefined ? { slotsHeld: extra.slotsHeld } : {}),
+        ...(extra.slotCap !== undefined ? { slotCap: extra.slotCap } : {}),
+        ...(extra.retryAfterMs !== undefined ? { retryAfterMs: extra.retryAfterMs } : {}),
+    };
+}
+/** Structure 1 leaf kind — these values match the relay's. Message leaf (the `cello_send` default). */
+export const LEAF_KIND_MSG = 0x00;
+/** Control leaf (SEAL etc.) — two distinct-sender ctrl leaves trigger directory notarization. */
+export const LEAF_KIND_CTRL = 0x02;
+/** Document-operation leaf (DOD-DOC-LEAF-1): a CRDT update riding the session tree. */
+export const LEAF_KIND_DOC = 0x04;
+/** Rejection leaf (DOD-DOC-LEAF-1): references the rejected update envelope's hash. */
+export const LEAF_KIND_REJECT = 0x05;
+const RELAY_AUTH_TIMEOUT_MS = 5_000;
+const HASH_SUBMIT_TIMEOUT_MS = 10_000;
+/**
+ * The Ed25519-signed payload that proves K_local ownership to the relay:
+ * SHA-256("CELLO-RELAY-AUTH-v1" || nonce || pubkey). The relay verifies the
+ * signature against exactly this hash (relay-node #handleRelayStream).
+ */
+export function buildRelayAuthPayload(nonce, pubkey) {
+    const domain = Buffer.from(RELAY_AUTH_DOMAIN, "utf8");
+    const authMsg = Buffer.concat([domain, nonce, pubkey]);
+    return new Uint8Array(createHash("sha256").update(authMsg).digest());
+}
+/**
+ * Rebuild the bytes a relay signs when it reports a witnessed forgery.
+ *
+ * ⚠️ **MIRRORED CODEC** — `packages/relay/src/leaf-witness.ts` `buildWitnessAlertTbs` in
+ * trustless-cello is the other half and the two MUST stay in sync. Both call `encodeCbor` from
+ * `@cello-protocol/protocol-types` rather than configuring an encoder, so the only thing that can
+ * drift is the field list, and both list it in one place.
+ */
+const RELAY_WITNESS_DOMAIN = "CELLO-RELAY-WITNESS-v1";
+function buildWitnessAlertTbs(sessionId, reason, observedAt, submitterIsCounterparty) {
+    const body = encodeCbor([RELAY_WITNESS_DOMAIN, sessionId, reason, observedAt, submitterIsCounterparty]);
+    return new Uint8Array(createHash("sha256").update(body).digest());
+}
+/**
+ * The genesis prev_root derivable from a relay assignment — 033-ACKEMIT.
+ *
+ * The carry holds both participant keys and the session timestamp, which with the session id are
+ * exactly `computeGenesisPrevRoot`'s inputs. Returns `undefined` when there is no assignment, and
+ * the caller then has no seed: absence is reported at the submit, never papered over.
+ *
+ * ⚠️ NOT 32 ZERO BYTES, and not any other constant. A value identical across every session is one
+ * an attacker can present for any session, which would make the first message's acknowledgement
+ * unfalsifiable exactly where it is most exposed.
+ */
+function genesisFromAssignment(sessionIdHex, assignment) {
+    if (!assignment?.sessionSignature)
+        return undefined;
+    const genesis = computeGenesisPrevRoot(assignment.participantA, assignment.participantB, Uint8Array.from(Buffer.from(sessionIdHex, "hex")), assignment.sessionTimestamp);
+    return computeChainAnchor(genesis, assignment.sessionSignature);
+}
+function toU8(v) {
+    if (v instanceof Uint8Array)
+        return v;
+    if (Buffer.isBuffer(v))
+        return new Uint8Array(v);
+    if (v && typeof v.subarray === "function") {
+        return v.subarray();
+    }
+    if (v && typeof v.slice === "function") {
+        return v.slice();
+    }
+    return new Uint8Array();
+}
+async function nextWithTimeout(iter, ms) {
+    let timer;
+    const timeout = new Promise((resolve) => {
+        timer = setTimeout(() => resolve({ value: undefined, done: true }), ms);
+    });
+    try {
+        const result = (await Promise.race([iter.next(), timeout]));
+        return { value: result.value, done: !!result.done };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * Per-AGENT relay witness client. Shared across all of an agent's sessions; one
+ * authenticated stream at a time (the relay keys by agent pubkey). Submits are FIFO and
+ * single-in-flight on the stream; `leaf_deliver` is routed by session_id.
+ */
+export class AgentRelayClient {
+    /**
+     * DOD-RELAY-KEEPALIVE-1 (review F4): the last error that ended this relay's reader.
+     * The reservation watchdog reports `relay_connection_gone` — an exit-point label derived from a
+     * poll, with the real abort reason already discarded. This carries the cause across to it.
+     */
+    #lastReaderError = null;
+    /** The cause of the most recent reader end, or null if it has not ended. */
+    getLastReaderError() {
+        return this.#lastReaderError;
+    }
+    #relayPeerId;
+    #relayAddrs;
+    #keyProvider;
+    #senderPubkey;
+    #logger;
+    #receiptStore;
+    #sealLeafStore;
+    #ownChainStore;
+    /**
+     * `DOD-M15-SELFCHAIN-1` — this agent's own last message per session, in memory.
+     *
+     * ⚠️ THE MAP IS THE CHAIN; THE STORE IS ITS DURABILITY. Separating them is deliberate. Within a
+     * running process the map is authoritative and always available, so a send never depends on a
+     * database being wired. Across a RESTART only the store can answer, and without it this daemon
+     * would silently start a new chain mid-conversation — the counterparty refusing every message
+     * after it, with no way to tell that from tampering.
+     *
+     * So a missing store is a durability gap, and never a reason to refuse a send: it is caused by our
+     * own wiring, never by anything a peer does, and refusing there would break the product to close a
+     * hole the peer cannot reach. It IS reported — once per client, at construction, by the error
+     * below. An earlier version of this comment promised that report and nothing emitted it, which is
+     * the shape that lets a wiring gap sit invisible until a restart days later.
+     */
+    #ownChain = new Map();
+    /**
+     * `DOD-M15-SELFCHAIN-1` — each session's GENESIS, kept apart from `#lastSeen`, and keeping them
+     * apart is the entire point of this field.
+     *
+     * `#lastSeen` is seeded with the genesis at registration and then ADVANCES as the counterparty
+     * speaks. So after the counterparty's first message it holds THEIR last content hash, not the
+     * starting point. Reading it as the self link's fallback handed a sender the other party's hash
+     * for their own first message, which the relay then refused — and, worse, told the innocent
+     * counterparty their chain was broken. This map never advances, so it is always the right answer
+     * to "what does a party who has not spoken here yet link to?".
+     */
+    #genesis = new Map();
+    /** DOD-M15-RELAYSLOTS-1 — read fresh at every auth. See `AgentRelayClientOpts.onlineToken`. */
+    #onlineToken;
+    /** DOD-M15-CORROBORATE-1 — where a relay's witness alert goes. See the opt of the same name. */
+    #onWitnessAlert;
+    /** DOD-M15-CORROBORATE-1 review F7 — where an UNREADABLE witness alert goes. */
+    #onWitnessUnreadable;
+    /**
+     * DOD-M15-RELAYSLOTS-1: the last refusal this relay gave us, classified. Kept because a log line
+     * reaches neither the operator asking why their agent is unreachable nor the code deciding
+     * whether a different relay would do any better.
+     */
+    #lastAuthRefusal = null;
+    /**
+     * review F6 — which credential refusal we have already explained in full, so a condition that
+     * lasts until a relogin is explained once rather than on every send. Reset with the refusal
+     * itself, so the next occurrence after a recovery is a first occurrence again.
+     */
+    #loggedCredentialRefusal = null;
+    /** The last classified auth refusal from this relay, or null if the last attempt succeeded. */
+    getLastAuthRefusal() {
+        return this.#lastAuthRefusal;
+    }
+    /**
+     * Drop any verdict from an earlier attempt — review HIGH-2.
+     *
+     * A METHOD rather than an inline `= null`, deliberately: assigning the field directly narrows its
+     * type to `null` for the rest of the enclosing method, and the later
+     * `#lastAuthRefusal?.reason` read then fails to compile against `never`. Clearing through a call
+     * keeps the declared type and says what the reset is for.
+     */
+    #clearAuthRefusal() {
+        this.#loggedCredentialRefusal = null;
+        this.#lastAuthRefusal = null;
+    }
+    #stream = null;
+    #connecting = null;
+    #closed = false;
+    #reconnectRetryMs = RELAY_RECONNECT_BASE_MS;
+    #reconnecting = false;
+    /**
+     * PER-SESSION acknowledgement state (session_id hex → the position AND the content at it).
+     *
+     * `seq` is the highest relay-assigned sequence, advanced by an ack or a deliver. The relay's
+     * `seq_counter` is per session and it rejects `last_seen_seq > seq_counter`, so each session's
+     * submit MUST carry that session's own high-water mark — NOT an agent-global one (which would make a newer session's first submit look
+     * ahead and get rejected).
+     *
+     * ⚠️ `hash` IS THE SAME FACT AS `seq`, WHICH IS WHY THEY LIVE IN ONE ENTRY — 033-ACKEMIT.
+     *
+     * `last_seen_seq` is a NUMBER: "I saw position 7" attests to a POSITION and never to CONTENT, so
+     * a signed acknowledgement was an unbacked number that only the relay's separate receipt gave any
+     * meaning to. `hash` is the content hash of the message AT that position, and the two are written
+     * together in `#bumpLastSeen` from ONE decode of ONE leaf. They cannot be assigned apart, so they
+     * cannot come to mean different messages — which is the defect this unit exists to remove, not a
+     * disagreement to reconcile later.
+     *
+     * Seeded at `registerSession` with `{ seq: 0, hash: genesisPrevRoot }`: the first message of a
+     * session has seen nothing, and that case is a DEFINED 32-byte value — the agreed starting point
+     * of this two-party chain — never a missing field and never a fallback to v1.
+     */
+    #lastSeen = new Map();
+    /** The one outstanding submit's resolver (global FIFO — ack carries no session_id). */
+    #pendingAck = null;
+    // The sender-signed structure1_cbor of the in-flight submit, paired with its ack so the
+    // SubmitResult can carry it (the ack itself only returns the relay's structure2_cbor).
+    #pendingStructure1 = null;
+    /**
+     * DOD-M15-SEALWIRE-1 bullet 5 (sent half) — OUR signature over the in-flight `#pendingStructure1`,
+     * paired with its ack for the same reason that one is: the ack returns the relay's record, never
+     * ours. Cleared wherever `#pendingStructure1` is cleared; the two must never drift apart, because
+     * a signature paired with the WRONG signed bytes is worse than no signature at all.
+     */
+    #pendingSignature = null;
+    // The in-flight submit's leaf kind (0x00 msg / 0x02 ctrl), paired with its ack so
+    // #captureReceipt can persist it alongside the Structure2/Structure1 carry bytes for the unilateral seal.
+    #pendingLeafKind = null;
+    /** The session_id hex of the in-flight submit, so its ack updates the right #lastSeen. */
+    #pendingAckSessionHex = null;
+    /**
+     * Resolver for the in-flight `client_record_assignment` ack. The ack carries
+     * no session_id (like hash_submit_ack), so at most one record is in flight; records are serialized on
+     * the same `#submitChain` as submits, guaranteeing no overlap.
+     */
+    #pendingRecord = null;
+    /**
+     * 054-SRSPLIT — the in-flight `relay_release_reservation`. At most one: releases are rare and
+     * serialized on the shared stream, exactly like `#pendingRecord`, whose ack also carries no id.
+     */
+    #pendingRelease = null;
+    /**
+     * DOD-M15-AWAYSCOPE-1 — in-flight liveness queries, keyed `sessionIdHex:counterpartyHex`.
+     *
+     * ⚠️ A MAP, NOT A SLOT, and the first version was a slot. One `AgentRelayClient` serves EVERY
+     * session an agent holds on a relay and both callers fan out with `Promise.all`, so `cello status`
+     * with two open conversations fired two queries on one stream: the second overwrote the first's
+     * resolver, the first answer resolved the WRONG session's promise, and the other waited the full
+     * submit timeout — blowing the caller's budget so every row came back unenriched. With more than
+     * one session the feature did nothing, and when it did something it could show the wrong
+     * counterparty. The key is what the RESPONSE carries, so an answer is matched to its question.
+     */
+    #pendingLiveness = new Map();
+    /** Serializes submits so only one is in flight at a time across all sessions. */
+    #submitChain = Promise.resolve();
+    /** session_id hex → { the live node to (re)dial from, inbound leaf handler, Option-B assignment to present }. */
+    #sessions = new Map();
+    constructor(opts) {
+        this.#relayPeerId = opts.relayPeerId;
+        this.#relayAddrs = opts.relayAddrs;
+        this.#keyProvider = opts.keyProvider;
+        this.#senderPubkey = opts.senderPubkey;
+        this.#logger = opts.logger;
+        this.#receiptStore = opts.receiptStore;
+        this.#sealLeafStore = opts.sealLeafStore;
+        this.#ownChainStore = opts.ownChainStore;
+        if (!this.#ownChainStore) {
+            /**
+             * ONCE PER CLIENT, AT CONSTRUCTION, and at ERROR because the consequence is invisible until a
+             * restart that may be days away — at which point this daemon silently starts a new chain
+             * mid-conversation and the counterparty refuses everything after it, for a reason that names
+             * tampering.
+             */
+            this.#logger.error("session.relay.own_chain.store_absent", {
+                relayPeerId: opts.relayPeerId,
+                impact: "this relay client was wired without a durable record of what this agent has said. " +
+                    "Conversations work until the daemon restarts; after a restart, mid-conversation, this " +
+                    "side starts a new chain and the counterparty refuses every message after it as though " +
+                    "the record had been altered.",
+            });
+        }
+        this.#onlineToken = opts.onlineToken;
+        this.#onWitnessAlert = opts.onWitnessAlert;
+        this.#onWitnessUnreadable = opts.onWitnessUnreadable;
+        if (opts.reconnectRetryMs !== undefined)
+            this.#reconnectRetryMs = opts.reconnectRetryMs;
+    }
+    /** The agent's K_local public key as hex — the responder identity for auto-acknowledge. */
+    get senderPubkeyHex() {
+        return Buffer.from(this.#senderPubkey).toString("hex");
+    }
+    /**
+     * Register a session's inbound leaf handler + a live node to (re)dial the relay from
+     * (idempotent). Storing the node per session lets a pure-receiver session re-establish
+     * the shared stream if the node that originally dialed is torn down.
+     */
+    registerSession(sessionIdHex, node, onLeafDeliver, assignment, 
+    /**
+     * 033-ACKEMIT — the session's genesis prev_root: what the FIRST message of this session
+     * acknowledges, before anything has been received.
+     *
+     * Supplied by the caller because `session-node-manager` is where the session record lives. When
+     * it is absent an ASSIGNMENT can still produce it (both participant keys and the session
+     * timestamp are on the carry), and that covers re-registration of a session whose row predates
+     * the column.
+     *
+     * ⚠️ WHEN NEITHER IS AVAILABLE THE SESSION CANNOT SUBMIT AT ALL — and this sentence used to say
+     * the opposite, that the first submit would claim position 0 with no hash. That shape no longer
+     * exists: `DOD-M15-SELFCHAIN-1` made both chain links required, so a session with no starting
+     * point has nothing for them to anchor to and every submit on it is refused by name. Registering
+     * without a seed is therefore a real fault, not a degraded mode.
+     */
+    genesisPrevRoot, 
+    /**
+     * 069-ORDERPROOF — the relay key this session's ordering attestations verify under, from
+     * `relay_id` on the directory-signed assignment. Supplied by the caller because
+     * `session-node-manager` is where the durable copy lives, exactly as with the genesis above.
+     *
+     * ⚠️ ABSENT IS NOT A DEGRADED MODE. A session with no anchor refuses every attestation that
+     * arrives on it, by name, because the only alternative is checking a signature against a key
+     * the signer handed us.
+     */
+    relayAnchorHex) {
+        const existing = this.#sessions.get(sessionIdHex);
+        const carriedAssignment = assignment ?? existing?.assignment;
+        // The anchor is carried forward for the same reason the assignment is: a re-registration with
+        // nothing in hand must not silently strip a session of the key it verifies against.
+        const carriedAnchor = relayAnchorHex ?? carriedAssignment?.relayPubkeyHex ?? existing?.relayAnchorHex;
+        this.#sessions.set(sessionIdHex, {
+            node,
+            onLeafDeliver: onLeafDeliver ?? (() => { }),
+            // Carry the assignment forward across re-registration; never lose a recorded flag on re-register.
+            assignment: carriedAssignment,
+            ...(carriedAnchor ? { relayAnchorHex: carriedAnchor } : {}),
+            recorded: existing?.recorded ?? false,
+            recordRejected: existing?.recordRejected ?? false,
+            recordTimedOut: existing?.recordTimedOut ?? false,
+        });
+        /**
+         * SEED THE ACKNOWLEDGEMENT, never backwards. A session that already received a leaf holds a REAL
+         * `{ seq, hash }`; the genesis must not overwrite it. And a RESUMED session starts from what its
+         * durable record says it saw, never from 0 — the gap that left interrupted sessions unsealable
+         * (see resume-last-seen.ts).
+         */
+        const genesis = genesisPrevRoot ?? genesisFromAssignment(sessionIdHex, carriedAssignment);
+        if (genesis)
+            this.#genesis.set(sessionIdHex, genesis);
+        if (!this.#lastSeen.has(sessionIdHex) && genesis)
+            this.#lastSeen.set(sessionIdHex, { seq: 0, hash: genesis });
+        const resumed = this.#sealLeafStore ? lastSeenFromRecord(this.#sealLeafStore, this.#logger, this.#senderPubkey, sessionIdHex) : undefined;
+        if (resumed)
+            this.#bumpLastSeen(sessionIdHex, resumed.seq, resumed.hash);
+        // Eagerly present the assignment so the relay records the session (binds peer IDs, creates the
+        // session entry) BEFORE the first hash_submit or the counterparty's leaves arrive — the relay
+        // rejects frames for a session it has not recorded. Best-effort + serialized on the submit chain
+        // (the ack carries no session_id, so no overlap).
+        if (assignment) {
+            this.#submitChain = this.#submitChain
+                .then(() => this.#doRecord(node, sessionIdHex))
+                .then(() => undefined, () => undefined);
+        }
+    }
+    /**
+     * DOD-M15-RELAYAUTH-1 review H1 — **present the assignment and WAIT for the relay to say it
+     * recorded it.**
+     *
+     * `registerSession` above presents eagerly and forgets: the record is queued onto the submit chain
+     * and nobody can observe when it lands. That is correct for the witness relay, where the only
+     * requirement is "before the first submit". It is NOT sufficient for the relay that GATES A DIAL,
+     * because there the record is a precondition of an action we are about to take on another thread
+     * of the protocol — and losing that race denies a legitimate dial (review H1).
+     *
+     * Chained on `#submitChain` exactly like `#doSubmit`, so it cannot interleave with a submit on the
+     * same stream. Idempotent by construction: `#doRecord` returns `true` immediately once the session
+     * is recorded, so calling this straight after `registerSession` waits for the record that call
+     * already queued rather than sending a second one.
+     *
+     * Returns whether the relay recorded it. NEVER throws — a caller must be free to proceed on false
+     * (a dial that might be denied still beats no dial at all).
+     */
+    async recordAssignmentAndWait(node, sessionIdHex) {
+        const run = this.#submitChain.then(() => this.#doRecord(node, sessionIdHex));
+        this.#submitChain = run.then(() => undefined, () => undefined);
+        return run.catch(() => false);
+    }
+    /**
+     * Present the directory-signed assignment to the relay. Idempotent
+     * (no-op once `recorded`, or when the session has no assignment — direct/persisted/legacy sessions).
+     * The relay reconstructs the TBS and verifies the per-node directory signature against any consortium
+     * key. On success the session is recorded; the send/ack is single-in-flight (mirrors #doSubmit).
+     */
+    async #doRecord(node, sessionIdHex) {
+        if (this.#closed)
+            return false;
+        const sess = this.#sessions.get(sessionIdHex);
+        if (!sess || !sess.assignment)
+            return true;
+        // Nothing to PRESENT. The carry may exist only to name the relay this session's attestations
+        // verify against; there is no frame to send and nothing to wait for, so the submit proceeds.
+        if (!sess.assignment.assignmentSignature)
+            return true;
+        if (sess.recorded)
+            return true;
+        // Terminal rejection: a relay that cleanly rejected this assignment will reject it
+        // again — stop re-presenting so a misconfigured/forged case can't storm the shared stream.
+        if (sess.recordRejected)
+            return false;
+        if (!(await this.#ensureConnected(node)))
+            return false;
+        const stream = this.#stream;
+        if (!stream)
+            return false;
+        const a = sess.assignment;
+        const frame = encodeCbor({
+            type: "client_record_assignment",
+            session_id: new Uint8Array(Buffer.from(sessionIdHex, "hex")),
+            participant_a: a.participantA,
+            participant_b: a.participantB,
+            session_timestamp: a.sessionTimestamp,
+            initiator_session_peer_id: a.initiatorSessionPeerId,
+            counterparty_session_peer_id: a.counterpartySessionPeerId,
+            assignment_signature: a.assignmentSignature,
+            session_signature: a.sessionSignature,
+        });
+        let resolveRec;
+        const ackPromise = new Promise((r) => { resolveRec = r; });
+        this.#pendingRecord = resolveRec;
+        try {
+            stream.send(lp.encode.single(frame));
+        }
+        catch (err) {
+            if (this.#pendingRecord === resolveRec)
+                this.#pendingRecord = null;
+            this.#logger.warn("session.relay.record.send.failed", { relayPeerId: this.#relayPeerId, error: extractErrorMessage(err) });
+            return false;
+        }
+        let timer;
+        const timeout = new Promise((r) => { timer = setTimeout(() => r("timeout"), HASH_SUBMIT_TIMEOUT_MS); });
+        try {
+            const result = await Promise.race([ackPromise, timeout]);
+            if (result === "ok") {
+                sess.recorded = true;
+                sess.recordTimedOut = false;
+                this.#logger.info("session.relay.assignment.recorded", { relayPeerId: this.#relayPeerId, sessionShort: sessionIdHex.slice(0, 16) });
+                return true;
+            }
+            if (result === "timeout") {
+                // ONLY here reset the stream: a late ack on this superseded stream would settle a LATER submit's
+                // resolver (FIFO desync). recorded stays false ⇒ a transient timeout is retried on reconnect.
+                this.#resetStream();
+                sess.recordTimedOut = true;
+                this.#logger.warn("session.relay.assignment.record.timeout", { relayPeerId: this.#relayPeerId, sessionShort: sessionIdHex.slice(0, 16) });
+                return false;
+            }
+            if (result === "rejected") {
+                // The relay cleanly rejected (assignment_invalid) — the ack already arrived, the stream is HEALTHY.
+                // Do NOT reset (that would tear down sibling sessions' in-flight submits). Mark terminal so we stop
+                // re-presenting. The session has no relay witness; sends still complete via the direct path
+                // (sovereign-node redundancy) and a hash_submit will fail loud (session_not_found) — diagnosable.
+                sess.recordRejected = true;
+                this.#logger.warn("session.relay.assignment.record.rejected", { relayPeerId: this.#relayPeerId, sessionShort: sessionIdHex.slice(0, 16) });
+                return false;
+            }
+            // "closed": the stream dropped while the record was in flight (settled by the reader/close path).
+            // Transient — no reset needed (already gone); recorded stays false ⇒ retried on reconnect.
+            return false;
+        }
+        finally {
+            clearTimeout(timer);
+            if (this.#pendingRecord === resolveRec)
+                this.#pendingRecord = null;
+        }
+    }
+    /** Remove a session; caller closes the client when no sessions remain. */
+    unregisterSession(sessionIdHex) {
+        this.#sessions.delete(sessionIdHex);
+        this.#lastSeen.delete(sessionIdHex);
+        this.#genesis.delete(sessionIdHex);
+    }
+    hasSessions() {
+        return this.#sessions.size > 0;
+    }
+    /**
+     * Is THIS session already registered on this client?
+     *
+     * DOD-M15-RELAYLEAK-1 (review MEDIUM-5). The detached seal transport releases its registration
+     * when the submit finishes, and "did I register it, or did I find it already there?" is the
+     * difference between releasing my own and **pulling a live one out from under a concurrent
+     * caller** — which closes the client that caller is mid-`submitLeaf` on. `hasSessions()` cannot
+     * answer it: it is a count, and by then the id is in the set either way.
+     */
+    hasSession(sessionIdHex) {
+        return this.#sessions.has(sessionIdHex);
+    }
+    /** Settle the one outstanding submit (if any) exactly once. */
+    #settlePending(r) {
+        const resolve = this.#pendingAck;
+        this.#pendingAck = null;
+        this.#pendingAckSessionHex = null;
+        this.#pendingStructure1 = null;
+        this.#pendingSignature = null;
+        this.#pendingLeafKind = null;
+        if (resolve)
+            resolve(r);
+    }
+    /**
+     * Tear down the current stream (drops it so the next submit re-dials). Used on a submit
+     * timeout: because `hash_submit_ack` carries no session_id, ack↔submit matching is purely
+     * FIFO, so a LATE ack from a timed-out submit would settle the NEXT submit's resolver and
+     * shift every subsequent ack by one. Resetting the stream prevents that desync (the relay
+     * re-auths + re-drains on the reconnect).
+     */
+    #resetStream() {
+        const stream = this.#stream;
+        this.#stream = null;
+        if (stream) {
+            try {
+                void stream.close();
+            }
+            catch { /* best-effort */ }
+        }
+    }
+    /**
+     * Advance this session's acknowledgement to a counterparty leaf: the POSITION and the CONTENT
+     * AT IT, written together (033-ACKEMIT).
+     *
+     * `contentHash` comes from the same `decodeStructure1` of the same leaf that produced `seq`, so
+     * the pair describes one message by construction. There is no path that advances one without the
+     * other, and that is deliberate: a `last_seen_seq` and a `last_seen_hash` that could drift apart
+     * would let this daemon sign an acknowledgement of a message it never saw.
+     *
+     * Monotonic on `seq` — a re-delivery of an earlier leaf must not walk the acknowledgement
+     * backwards, and it must not swap the hash under an unchanged position either.
+     */
+    #bumpLastSeen(sessionIdHex, seq, contentHash) {
+        if (seq < 0)
+            return;
+        const prev = this.#lastSeen.get(sessionIdHex);
+        if (prev && seq <= prev.seq)
+            return;
+        this.#lastSeen.set(sessionIdHex, { seq, hash: contentHash });
+    }
+    /** True if this Structure-1 leaf was authored by US (sender_pubkey === our K_local). */
+    #isOwnLeaf(structure1Cbor) {
+        // Structure 1 = [version, content_hash, sender_pubkey, session_id, last_seen_seq, ts], plus
+        // last_seen_hash at index 6 on a v2 claim (020-ACKHASH). sender_pubkey is index 2 in both.
+        const s1 = decodeStructure1(structure1Cbor);
+        /**
+         * ⚠️ `false` IS THE DANGEROUS DIRECTION, NOT THE CONSERVATIVE ONE — review F8, correcting a
+         * comment that claimed the opposite.
+         *
+         * It read "conservative: don't suppress a real counterparty leaf." At the call site, `false`
+         * means our OWN echoed leaf gets `#bumpLastSeen` applied — which the comment there says must not
+         * happen — and is written into the seal-leaf log as a COUNTERPARTY leaf. Returning `false`
+         * wrongly corrupts the log; returning `true` wrongly drops one witness signal.
+         *
+         * It stays `false` because the input set is bytes the relay already decoded and accepted, so an
+         * unreadable leaf here means this daemon and the relay disagree about a frame the relay passed —
+         * not a hostile peer. Widening it to every layout failure (it was only a CBOR throw before) does
+         * not change that: the relay's own decoder gates every path that reaches here.
+         */
+        if (!s1.ok)
+            return false;
+        return Buffer.from(s1.fields.senderPubkey).equals(Buffer.from(this.#senderPubkey));
+    }
+    /**
+     * The relay pubkey the DIRECTORY named for a session — 069-ORDERPROOF, and the only key a relay
+     * ordering attestation is ever checked against.
+     *
+     * It rides the assignment carry, which is built from an assignment whose FROST signature this
+     * daemon verified before the session began, so it is anchored to something the relay does not
+     * control. `undefined` means no such key was recorded, and every attestation on that session is
+     * then refused for want of an anchor — never accepted against whatever key the frame supplies.
+     */
+    #expectedRelayPubkeyHex(sessionIdHex) {
+        return this.#sessions.get(sessionIdHex)?.relayAnchorHex;
+    }
+    /**
+     * Verify a relay `hash_submit_ack`'s ordering attestation and durably store the receipt.
+     *
+     * The relay signs the session, the content hash, the position it assigned and the running root of
+     * the tree after this leaf. We verify it **against the relay key on the directory-signed
+     * assignment**, and refuse otherwise — missing, malformed and mismatched all take the one path.
+     *
+     * Returns true to REJECT the submit. A send must not settle ok on a position nothing witnessed.
+     */
+    #captureReceipt(frame, structure1Cbor, seq) {
+        // ⚠️ REJECTS WHEN THE CHECK COULD NOT BE RUN, not only when it failed — `readSubmittedLeaf`
+        // carries the reasoning. Both of these used to settle the send ok having verified nothing.
+        const leaf = readSubmittedLeaf(structure1Cbor, seq);
+        if (leaf.kind === "none")
+            return false;
+        if (leaf.kind === "unreadable") {
+            this.#logger.warn(leaf.event, { seq, structure1Reason: leaf.reason, impact: "this side cannot read the leaf it just submitted, so the relay's ordering attestation has " +
+                    "nothing to be checked against. The send is refused rather than settled on a position " +
+                    "nothing witnessed." });
+            return true;
+        }
+        const { contentHash, sessionId } = leaf;
+        const sessionIdHex = Buffer.from(sessionId).toString("hex");
+        const ev = evaluateRelayAck({
+            sessionId,
+            contentHash,
+            runningRoot: frame["running_root"] instanceof Uint8Array ? frame["running_root"] : undefined,
+            sessionIdHex,
+            agentPubkeyHex: this.senderPubkeyHex,
+            expectedRelayPubkeyHex: this.#expectedRelayPubkeyHex(sessionIdHex),
+            relayId: typeof frame["relay_id"] === "string" ? frame["relay_id"] : undefined,
+            relaySignature: frame["relay_signature"] instanceof Uint8Array ? frame["relay_signature"] : undefined,
+            timestamp: typeof frame["timestamp"] === "number" ? frame["timestamp"] : undefined,
+            sequenceNumber: seq,
+        });
+        switch (ev.kind) {
+            case "refused":
+                /**
+                 * ONE OUTCOME, and the cause is in the log rather than in the control flow.
+                 *
+                 * The submit is rejected for all five causes. A message whose position no assigned relay
+                 * attested has no ordering evidence behind it, and letting the send settle ok would report
+                 * a witnessed message that nothing witnessed. `attestation_absent` takes this path with the
+                 * rest deliberately: the party who can produce the absence is the relay, which is the party
+                 * the check exists to constrain, so a softer answer for absence is a mute button with our
+                 * own name on it.
+                 */
+                this.#logger.warn("relay.attestation.refused", {
+                    seq,
+                    session: sessionIdHex,
+                    cause: ev.cause,
+                    hashShort: Buffer.from(contentHash).toString("hex").slice(0, 16),
+                    impact: "the relay's ordering attestation for this message was refused, so this send did not " +
+                        "settle and no evidence was stored. This agent holds no proof of where this message " +
+                        "sits in the conversation, and nothing was recorded that could later be presented as one.",
+                });
+                return true;
+            case "store": {
+                if (!this.#receiptStore)
+                    return false;
+                try {
+                    const wrote = this.#receiptStore.store(ev.receipt, Date.now());
+                    if (wrote) {
+                        this.#logger.info("relay.receipt.stored", { seq, hashShort: ev.receipt.hashHex.slice(0, 16), relayShort: ev.receipt.relayId.slice(0, 16) });
+                    }
+                    // Record this OWN leaf in the seal-leaf log WITH its relay receipt (the
+                    // relay's signature pins content_hash→seq — the teeth that stop a supplier reordering its own
+                    // leaves). structure2_cbor rides the ack we just verified; structure1Cbor + the leaf kind are this
+                    // submit's paired in-flight values. Best-effort + separate from the receipt write.
+                    const structure2Cbor = frame["structure2_cbor"] instanceof Uint8Array ? frame["structure2_cbor"] : undefined;
+                    if (this.#sealLeafStore && structure2Cbor && structure1Cbor && this.#pendingLeafKind !== null) {
+                        /**
+                         * ⚠️ **THE AUTHOR COMES FROM THE SIGNED BYTES, AND THE RECEIPT ONLY ATTACHES TO OUR OWN
+                         * LEAF — 034-CARRYLEAF review F3.**
+                         *
+                         * This wrote `senderPubkeyHex: this.senderPubkeyHex` unconditionally, which was true for
+                         * as long as the only thing a client could submit was its own leaf. `witnessReceivedLeaf`
+                         * ended that: on a counter-submit `structure1Cbor` holds the COUNTERPARTY's bytes, so
+                         * this row labelled their leaf as ours — and attached a relay receipt to it, which is the
+                         * one thing that must never happen to a leaf we did not author, because a receipt is what
+                         * pins OUR leaves to a sequence we could otherwise renumber.
+                         *
+                         * It was inert on the wire by luck: `sender_pubkey_hex` is not transmitted and the
+                         * directory re-derives the author from `structure2_cbor`. It was never inert locally —
+                         * the store is `INSERT OR IGNORE` on `(agent, session, sequence)`, and the ack arrives
+                         * BEFORE the `leaf_deliver` echo, so this row won and the correct one was silently
+                         * dropped.
+                         *
+                         * Same rule as everywhere else on this path: the identity comes from inside the bytes
+                         * the author signed, never from an ambient value that happens to be right today.
+                         */
+                        const authored = decodeStructure1(structure1Cbor);
+                        const authorHex = authored.ok
+                            ? Buffer.from(authored.fields.senderPubkey).toString("hex")
+                            : this.senderPubkeyHex;
+                        const ourOwnLeaf = authorHex === this.senderPubkeyHex;
+                        this.#sealLeafStore.store(this.senderPubkeyHex, ev.receipt.sessionIdHex, {
+                            sequenceNumber: seq,
+                            leafKind: this.#pendingLeafKind,
+                            senderPubkeyHex: authorHex,
+                            structure2Cbor,
+                            structure1Cbor,
+                            ...(ourOwnLeaf
+                                ? {
+                                    relayId: ev.receipt.relayId,
+                                    relayTimestamp: ev.receipt.timestamp,
+                                    relaySignatureHex: ev.receipt.signatureHex,
+                                    ...(ev.receipt.runningRootHex ? { relayRunningRootHex: ev.receipt.runningRootHex } : {}),
+                                }
+                                : {}),
+                        }, Date.now());
+                    }
+                }
+                catch (err) {
+                    // A durable-evidence write failure must be LOUD — the relay will not re-emit this ack, so a
+                    // swallowed write permanently loses a verified receipt.
+                    this.#logger.error("relay.receipt.store_failed", { seq, error: extractErrorMessage(err) });
+                }
+                return false;
+            }
+        }
+    }
+    #dispatch(frame) {
+        const type = frame["type"];
+        if (type === "hash_submit_ack") {
+            const seq = typeof frame["sequence_number"] === "number" ? frame["sequence_number"] : -1;
+            // DO NOT advance #lastSeen here: the ack is for OUR OWN leaf. last_seen_seq must track
+            // the highest COUNTERPARTY sequence we've observed — the directory's causal check rejects a leaf
+            // whose last_seen_seq exceeds the max sequence of OTHER-sender leaves before it. Advancing on our
+            // own ack would inflate it and trip causal_chain_violated on a subsequent submit (e.g. the SEAL
+            // leaf after a sent message).
+            // Pair the relay's committed structure2_cbor with our in-flight structure1_cbor so
+            // the SubmitResult carries the full signed ordering record for the self-ordering content frame.
+            // Captured BEFORE #settlePending clears #pendingStructure1.
+            const s2 = frame["structure2_cbor"];
+            const structure2Cbor = s2 instanceof Uint8Array ? s2 : undefined;
+            const structure1Cbor = this.#pendingStructure1 ?? undefined;
+            // Captured with structure1Cbor and BEFORE #settlePending clears both — see #pendingSignature.
+            const senderSignature = this.#pendingSignature ?? undefined;
+            // Verify the relay's signed ordering record and durably store the receipt BEFORE
+            // settling (which clears #pendingStructure1, the source of the content hash + session id). A
+            // signed-but-INVALID ACK rejects the submit so the send does not settle ok on an unverified sequence.
+            const rejectSubmit = this.#captureReceipt(frame, structure1Cbor, seq);
+            this.#settlePending(rejectSubmit
+                /**
+                 * ONE REASON for every refusal cause — 069-ORDERPROOF Done When 3. A distinct reason per
+                 * cause would be observable, and the clause requires that a missing attestation and a
+                 * malformed one look the same from outside. The cause is named in the log line above.
+                 */
+                ? { ok: false, reason: "relay_ack_unverified" }
+                : seq >= 0
+                    ? { ok: true, sequence_number: seq, structure1_cbor: structure1Cbor, structure2_cbor: structure2Cbor, sender_signature: senderSignature }
+                    : { ok: false, reason: "relay_ack_malformed" });
+        }
+        else if (type === "session_liveness_response" || type === "session_liveness_refused") {
+            /**
+             * DOD-M15-AWAYSCOPE-1 — the relay's answer to "is my counterparty reachable, and is anyone
+             * attending it". Decoded through the shared codec rather than read field by field here: that
+             * codec is what refuses an attendance paired with a non-alive liveness, and re-reading the
+             * fields inline would quietly reintroduce the tolerance branch it exists to prevent.
+             *
+             * A REFUSAL resolves the waiter rather than dropping it. The relay refuses a query naming a
+             * session the caller is not in, and it deliberately does not say which of the two reasons —
+             * so the honest local answer is "unknown", not a hang until the timeout.
+             */
+            /**
+             * ⚠️ A REFUSAL NAMES NOTHING, so it cannot be matched. The relay refuses without echoing the
+             * session or the subject — deliberately, because telling "no such session" from "not your
+             * session" is the enumeration signal `DOD-M15-RELAYAUTH-1` closed. So there is nothing to key
+             * on, and the only sound reading is that every outstanding query on this stream was refused:
+             * the refusal is a property of the CALLER, and the caller is the same for all of them.
+             */
+            if (type === "session_liveness_refused") {
+                for (const r of this.#pendingLiveness.values())
+                    r({ liveness: "unknown", observedAt: 0, refused: true });
+                this.#pendingLiveness.clear();
+            }
+            else {
+                const decoded = decodeSessionLivenessResponse(encodeCbor(frame));
+                if (decoded === null) {
+                    // Malformed fails exactly like missing. A frame this build cannot read is not evidence of
+                    // anything, and reporting it as 'gone' would invent an observation nobody made. It also
+                    // cannot be matched to a waiter, so every outstanding query is answered 'unknown' rather
+                    // than left to time out on a stream that just proved it speaks a shape we cannot read.
+                    this.#logger.warn("session.relay.liveness.response_malformed", {
+                        relayPeerId: this.#relayPeerId,
+                        impact: "the counterparty's reachability is reported as unknown, which is what it is",
+                    });
+                    for (const r of this.#pendingLiveness.values())
+                        r({ liveness: "unknown", observedAt: 0 });
+                    this.#pendingLiveness.clear();
+                }
+                else {
+                    // MATCHED ON WHAT THE ANSWER ITSELF NAMES. Resolving the most recent waiter instead would
+                    // be right exactly once — when only one query is outstanding — and silently wrong the
+                    // moment an agent holds two conversations through one relay, which is ordinary.
+                    const key = livenessKey(decoded.session_id, decoded.counterparty_pubkey);
+                    const r = this.#pendingLiveness.get(key);
+                    if (r) {
+                        this.#pendingLiveness.delete(key);
+                        r({
+                            liveness: decoded.liveness,
+                            observedAt: decoded.observed_at,
+                            ...(decoded.attendance !== undefined ? { attendance: decoded.attendance } : {}),
+                            ...(decoded.attendance_observed_at !== undefined ? { attendanceObservedAt: decoded.attendance_observed_at } : {}),
+                        });
+                    }
+                    else {
+                        // A late answer to a query that already timed out, or one nobody asked for. Dropped —
+                        // handing it to a different session's waiter is exactly the defect this key exists for.
+                        this.#logger.debug("session.relay.liveness.response_unmatched", { relayPeerId: this.#relayPeerId });
+                    }
+                }
+            }
+        }
+        else if (type === "hash_submit_error") {
+            const reason = typeof frame["reason"] === "string" ? frame["reason"] : "relay_rejected";
+            // Carry the relay's `detail` through — see `SubmitResult`. Reading the class and discarding
+            // what happened is how a refusal arrives as a bare code with no cause attached to it.
+            const detail = typeof frame["detail"] === "string" ? frame["detail"] : undefined;
+            // DOD-M15-RELAYABUSE-1: the relay knows when its window clears and says so. Carried, not
+            // dropped — `#doSubmit` waits it out and resubmits, so a throttle never reaches the operator.
+            const rawRetry = frame["retry_after_ms"];
+            const retry_after_ms = typeof rawRetry === "number" && Number.isFinite(rawRetry) && rawRetry > 0 ? rawRetry : undefined;
+            const awaited = frame["awaited_seq"];
+            this.#settlePending({
+                ok: false, reason, ...(detail ? { detail } : {}), ...(retry_after_ms !== undefined ? { retry_after_ms } : {}),
+                ...(typeof awaited === "number" && Number.isInteger(awaited) && awaited > 0 ? { awaited_seq: awaited } : {}),
+            });
+        }
+        else if (type === "relay_release_ok") {
+            // 054-SRSPLIT. `released` is the relay's own answer to "did I actually hold one?" — a
+            // release of a slot we never had is a true `false`, not a failure, and the caller says so.
+            const r = this.#pendingRelease;
+            this.#pendingRelease = null;
+            if (r)
+                r(frame["released"] === true);
+        }
+        else if (type === "assignment_ok") {
+            // The relay verified + recorded our client-presented assignment.
+            const r = this.#pendingRecord;
+            this.#pendingRecord = null;
+            if (r)
+                r("ok");
+        }
+        else if (type === "assignment_invalid") {
+            // The relay rejected the assignment (e.g. directory_signature_invalid — not signed by any
+            // consortium directory). Fail LOUD: the session has no relay witness until this is resolved.
+            const reason = typeof frame["reason"] === "string" ? frame["reason"] : "unknown";
+            this.#logger.warn("session.relay.assignment.invalid", { relayPeerId: this.#relayPeerId, reason });
+            /**
+             * DOD-M15-RELAYSLOTS-1 review M2 — **the tuple cap has to reach the operator too.**
+             *
+             * Clause 7 says EVERY refusal reaches them with a cause and an affordance, and this one was
+             * arriving as `assignment_invalid` in a log. It is also the refusal most likely to hit a real
+             * person, for the reason the order itself gives: nobody knows what sessions they have open, so
+             * whoever hits it believes they have none. Routed through the same classifier and onto the
+             * same surface as every other relay refusal.
+             */
+            const concurrent = typeof frame["concurrent_sessions"] === "number" ? frame["concurrent_sessions"] : undefined;
+            const cap = typeof frame["session_cap"] === "number" ? frame["session_cap"] : undefined;
+            this.#lastAuthRefusal = classifyRelayAuthRefusal(reason, {
+                ...(concurrent !== undefined ? { slotsHeld: concurrent } : {}),
+                ...(cap !== undefined ? { slotCap: cap } : {}),
+            });
+            const r = this.#pendingRecord;
+            this.#pendingRecord = null;
+            if (r)
+                r("rejected");
+        }
+        else if (type === "leaf_deliver") {
+            const seq = typeof frame["sequence_number"] === "number" ? frame["sequence_number"] : -1;
+            const sidHex = Buffer.from(toU8(frame["session_id"])).toString("hex");
+            const s1 = toU8(frame["structure1_cbor"]);
+            /**
+             * ONE DECODE, TWO CONSUMERS — 033-ACKEMIT. The acknowledgement bump and the seal-leaf capture
+             * below both need the sender's own signed fields, and they must agree about which leaf they
+             * are looking at. Decoding twice would let a future edit change one read and not the other.
+             */
+            const deliveredS1 = decodeStructure1(s1);
+            // Advance last_seen ONLY for a COUNTERPARTY leaf. The relay also echoes our OWN
+            // leaf back as a leaf_deliver — that must NOT advance it (same reason as the ack above).
+            const authoredByUs = this.#isOwnLeaf(s1);
+            /**
+             * The POSITION and the CONTENT AT IT, from the counterparty's own signed bytes.
+             *
+             * ⚠️ THE HASH COMES FROM INSIDE `structure1_cbor`, NEVER FROM AN ENVELOPE FIELD. The frame
+             * also carries `structure2_cbor`, which the RELAY built — taking the hash from there would key
+             * our acknowledgement on a value the witness supplies, and a tampering relay could then make
+             * us sign an acknowledgement of content the counterparty never sent. Index 1 of Structure 1 is
+             * inside the bytes the counterparty signed, so it is the one copy neither we nor the relay can
+             * move.
+             *
+             * A leaf whose layout this build cannot name advances NOTHING — position included. The
+             * previous code advanced `seq` from the envelope regardless, so an unreadable leaf could move
+             * the acknowledgement forward while leaving the hash behind it; refusing to advance keeps the
+             * pair describing one real message, and the relay's own decoder already gates what reaches
+             * here.
+             */
+            if (seq >= 0 && !authoredByUs) {
+                if (deliveredS1.ok) {
+                    this.#bumpLastSeen(sidHex, seq, deliveredS1.fields.contentHash);
+                }
+                else {
+                    this.#logger.warn("relay.leaf_deliver.unreadable", {
+                        seq,
+                        session: sidHex,
+                        structure1Reason: deliveredS1.reason,
+                        impact: "this delivered leaf could not be read, so this session's acknowledgement was NOT " +
+                            "advanced to it. The next message this agent sends will acknowledge the last leaf it " +
+                            "could read, which is honest — it never claims to have seen something it could not.",
+                    });
+                }
+            }
+            // Record the COUNTERPARTY's delivered leaf in the seal-leaf log (no relay
+            // receipt — the relay does not ack-sign a delivery to the recipient). It is pinned at seal by the
+            // absent party's sender_signature (unforgeable) + sequence contiguity against our receipt-pinned own
+            // leaves. Our OWN echoed leaf is skipped here (it is recorded WITH its receipt on the ack path).
+            /**
+             * ─── OUR OWN LEAF, WITNESSED BY SOMEBODY ELSE — 034-CARRYLEAF review F2 ──────────────────
+             *
+             * ⚠️ **WITHOUT THIS, MAKING THE COUNTERPARTY ABLE TO WITNESS OUR LEAF COST US THE RECEIPT.**
+             *
+             * When the counterparty counter-submits a leaf WE authored, the relay assigns it a position
+             * and delivers it to us — and `authoredByUs` is true, so the capture below skipped it. We
+             * never submitted it ourselves, so no ack ever arrived and the ack path never wrote a row
+             * either. The result was a permanent hole at that position in our own carry: the unilateral
+             * seal refused it as `seal_carry_noncontiguous`, and the bilateral one refused to co-sign a
+             * root it could not judge. **An honest sender whose relay hiccuped once lost the receipt for
+             * the entire conversation** — for a message sitting in their own transcript.
+             *
+             * So the leaf is stored, **with NO relay receipt**, because we hold none: nobody acked it to
+             * us. That asymmetry is exactly the one the seal design already relies on. A bilateral seal
+             * needs a contiguous chain and gets one. A UNILATERAL seal additionally requires every one of
+             * our OWN leaves to carry a receipt — so a party who never witnesses their own messages still
+             * cannot seal alone on them (`unilateral_own_leaf_unwitnessed`), which is precisely what
+             * `DOD-M15-WITHHOLD-SEAL-1` intends.
+             *
+             * `INSERT OR IGNORE` keeps whichever row lands first, and a real receipt-bearing row for the
+             * same position can only come from our own ack — which cannot exist here, or we would have
+             * submitted it ourselves.
+             */
+            if (this.#sealLeafStore && seq >= 0 && authoredByUs && deliveredS1.ok) {
+                const s2Own = frame["structure2_cbor"];
+                if (s2Own instanceof Uint8Array && s1.length > 0) {
+                    try {
+                        const wrote = this.#sealLeafStore.store(this.senderPubkeyHex, sidHex, {
+                            sequenceNumber: seq,
+                            leafKind: typeof frame["leaf_kind"] === "number" ? frame["leaf_kind"] : LEAF_KIND_MSG,
+                            senderPubkeyHex: this.senderPubkeyHex,
+                            structure2Cbor: s2Own,
+                            structure1Cbor: s1,
+                        }, Date.now());
+                        if (wrote) {
+                            this.#logger.info("relay.seal_leaf.own.witnessed_by_counterparty", {
+                                seq,
+                                session: sidHex,
+                                impact: "a message THIS agent wrote was witnessed by the counterparty rather than by us — " +
+                                    "our own submit did not land. The leaf is kept so this conversation can still be " +
+                                    "sealed together; sealing it alone would still need a receipt we do not hold.",
+                            });
+                        }
+                    }
+                    catch (err) {
+                        this.#logger.error("relay.seal_leaf.own.store_failed", { seq, session: sidHex, error: extractErrorMessage(err) });
+                    }
+                }
+            }
+            if (this.#sealLeafStore && seq >= 0 && !authoredByUs) {
+                const s2 = frame["structure2_cbor"];
+                const structure2Cbor = s2 instanceof Uint8Array ? s2 : undefined;
+                // Review F1: a raw positional read of index 2 with NO version and NO length check lived here
+                // — it accepted a v3 array, a 40-element array, anything with 32 bytes at index 2, and fed
+                // the result into the seal-leaf log as the counterparty's identity. It is in the same file as
+                // #isOwnLeaf and #captureReceipt and was simply missed by the order's reader list, which is
+                // exactly the "next layout change has to find them again" problem the shared decoder exists
+                // to end. Behaviour for every relay-accepted leaf is unchanged; the fail-open closes.
+                const senderHex = deliveredS1.ok
+                    ? Buffer.from(deliveredS1.fields.senderPubkey).toString("hex")
+                    : undefined;
+                if (structure2Cbor && s1.length > 0 && senderHex) {
+                    try {
+                        this.#sealLeafStore.store(this.senderPubkeyHex, sidHex, {
+                            sequenceNumber: seq,
+                            leafKind: typeof frame["leaf_kind"] === "number" ? frame["leaf_kind"] : LEAF_KIND_MSG,
+                            senderPubkeyHex: senderHex,
+                            structure2Cbor,
+                            structure1Cbor: s1,
+                        }, Date.now());
+                    }
+                    catch (err) {
+                        this.#logger.error("relay.seal_leaf.counterparty.store_failed", { seq, session: sidHex, error: extractErrorMessage(err) });
+                    }
+                }
+                else {
+                    this.#logger.warn("relay.seal_leaf.counterparty.capture_skipped", { seq, session: sidHex, hasS2: !!structure2Cbor, hasS1: s1.length > 0, hasSender: !!senderHex });
+                }
+            }
+            /**
+             * ─── THE RECIPIENT KEEPS THE ORDERING PROOF TOO — 069-ORDERPROOF unit 2 ──────────────────
+             *
+             * Before this, the relay's attestation went to the SENDER alone, on the submit
+             * acknowledgement. The recipient held no proof of where a single message of the conversation
+             * sat. That made one party's copy the only copy, which is the dependency this order exists to
+             * remove wearing a different coat.
+             *
+             * It is verified here exactly as on the send path — against the relay key the DIRECTORY named
+             * for this session, never `relay_id` on the frame — and an attestation that does not verify is
+             * refused and NOT stored. Nothing else changes: the leaf is still delivered to the session, the
+             * acknowledgement still advances, and no tree, root or leaf count is touched. This is evidence
+             * recorded beside the chain, never in it.
+             *
+             * Our own echoed leaf comes through here too. Storing it is a no-op — the ack path already
+             * wrote the same row at the same position, and the store is INSERT OR IGNORE — but it is not
+             * skipped, because the echo is the only copy a leaf COUNTER-SUBMITTED by the counterparty
+             * ever produces for us.
+             */
+            if (this.#receiptStore && seq >= 0 && deliveredS1.ok) {
+                const ev = evaluateRelayAck({
+                    sessionId: deliveredS1.fields.sessionId,
+                    contentHash: deliveredS1.fields.contentHash,
+                    runningRoot: frame["running_root"] instanceof Uint8Array ? frame["running_root"] : undefined,
+                    sessionIdHex: sidHex,
+                    agentPubkeyHex: this.senderPubkeyHex,
+                    expectedRelayPubkeyHex: this.#expectedRelayPubkeyHex(sidHex),
+                    relayId: typeof frame["relay_id"] === "string" ? frame["relay_id"] : undefined,
+                    relaySignature: frame["relay_signature"] instanceof Uint8Array ? frame["relay_signature"] : undefined,
+                    timestamp: typeof frame["timestamp"] === "number" ? frame["timestamp"] : undefined,
+                    sequenceNumber: seq,
+                });
+                if (ev.kind === "refused") {
+                    /**
+                     * LOUD, AND THE DELIVERY STILL LANDS. This is the one place the two halves differ, and
+                     * deliberately: on the send path a refusal means OUR message has no witness, so the send
+                     * must not settle. Here the counterparty's message has already been written and read —
+                     * dropping it would let a relay silence a conversation by withholding its own signature,
+                     * which hands the party the check constrains a far better weapon than the one it takes
+                     * away. So the message arrives and the evidence is recorded as absent.
+                     */
+                    this.#logger.warn("relay.attestation.delivered.refused", {
+                        seq,
+                        session: sidHex,
+                        cause: ev.cause,
+                        impact: "this message arrived, but the relay's proof of WHERE it sits in the conversation did " +
+                            "not, so this agent cannot later show a third party that this message was ordered here. " +
+                            "The message itself is unaffected and is in the transcript.",
+                    });
+                }
+                else {
+                    try {
+                        this.#receiptStore.store(ev.receipt, Date.now());
+                    }
+                    catch (err) {
+                        // A durable-evidence write failure is LOUD: the relay never re-sends a delivery, so a
+                        // swallowed write permanently loses this side's only copy of the ordering proof.
+                        this.#logger.error("relay.attestation.delivered.store_failed", {
+                            seq, session: sidHex, error: extractErrorMessage(err),
+                        });
+                    }
+                }
+            }
+            const session = this.#sessions.get(sidHex);
+            if (session && seq >= 0) {
+                session.onLeafDeliver({
+                    sequence_number: seq,
+                    leaf_kind: typeof frame["leaf_kind"] === "number" ? frame["leaf_kind"] : LEAF_KIND_MSG,
+                    structure1_cbor: s1,
+                    structure2_cbor: toU8(frame["structure2_cbor"]),
+                    // Tell the consumer whether this is our own echoed leaf (so the
+                    // auto-acknowledge gate never co-signs in response to its own SEAL ctrl leaf).
+                    authored_by_us: authoredByUs,
+                });
+            }
+        }
+        else if (type === "session_witness_alert") {
+            /**
+             * DOD-M15-CORROBORATE-1 — **the relay is telling us what it saw, and this is where it lands.**
+             *
+             * A relay is not trusted to send a well-formed frame any more than a peer is, so every field
+             * is checked before anything is reported. A frame that does not decode is a MISBEHAVING OR
+             * SKEWED RELAY, not an alert: reporting it as one would let a broken build manufacture
+             * accusations against a counterparty who did nothing. It is logged loudly and goes no further.
+             */
+            const sid = frame["session_id"];
+            const rawRelayId = frame["relay_id"];
+            const observedAt = frame["observed_at"];
+            const submitterIsCounterparty = frame["submitter_is_counterparty"];
+            const sidBytes = sid instanceof Uint8Array || Buffer.isBuffer(sid) ? toU8(sid) : new Uint8Array();
+            const wellFormed = sidBytes.length === 16
+                && (frame["reason"] === "leaf_signed_by_neither_participant"
+                    || frame["reason"] === "leaf_witnessed_by_counterparty")
+                && typeof observedAt === "number" && Number.isFinite(observedAt)
+                && typeof submitterIsCounterparty === "boolean"
+                && (rawRelayId === undefined || typeof rawRelayId === "string");
+            const unreadable = (why) => {
+                this.#logger.error("session.relay.witness.malformed", {
+                    relayPeerId: this.#relayPeerId,
+                    why,
+                    impact: "this relay sent a witness alert this build cannot read, so NOTHING has been " +
+                        "reported to the operator about it. Treat it as a relay fault or a version skew, not " +
+                        "as evidence about either participant.",
+                });
+                /**
+                 * Review F7 — **and it reaches a surface, not only this file.** If a version skew makes
+                 * every relay's alert unreadable, the witness layer is silently dead and the operator would
+                 * have no way to find that out. Deliberately carries NO session and NO party: it says a
+                 * relay sent something we could not read, and claims nothing about anyone.
+                 */
+                this.#onWitnessUnreadable?.(this.#relayPeerId, why);
+            };
+            if (!wellFormed) {
+                unreadable("field_shape");
+                return;
+            }
+            const sessionIdHex = Buffer.from(sidBytes).toString("hex");
+            /**
+             * ⚠️ **IT MUST BE A SESSION THIS CLIENT ACTUALLY HOLDS ON THIS RELAY** — review F2.
+             *
+             * `wellFormed` checks shape and shape only. Without this, any relay we are authenticated to
+             * could push alerts naming arbitrary session ids — including conversations carried by a
+             * DIFFERENT relay — and they would land in the operator's inbox as statements of fact about
+             * a counterparty. Combined with a bounded notice list that is the cheap mute: flood
+             * fabrications until the real one is gone.
+             */
+            if (!this.#sessions.has(sessionIdHex)) {
+                /**
+                 * ⚠️ **REFUSED AS AN ALERT, BUT NOT BINNED IN SILENCE** — fallback-finder HIGH 1.
+                 *
+                 * It cannot be reported as an observation about a conversation: a relay naming a session we
+                 * do not hold is exactly the fabrication the check above exists to stop, and rendering it
+                 * would put a claim about a counterparty in front of an operator on a stranger's say-so.
+                 *
+                 * But dropping it entirely was worse than it looked, because the relay's own copy is GONE by
+                 * then: its queue is keyed by PUBKEY and `drainWitnessAlerts` splices, so it hands over
+                 * everything it held for this agent the moment any client authenticates. The detached seal
+                 * client registers exactly ONE session and then authenticates — so a restart-then-seal on
+                 * one conversation destroyed a held alert about a different one, at both ends, and the
+                 * operator's inbox looked clean.
+                 *
+                 * So it goes to the same neutral surface a version skew does: something arrived that this
+                 * daemon could not place. No session, no party, no claim.
+                 */
+                this.#logger.error("session.relay.witness.unknown_session", {
+                    relayPeerId: this.#relayPeerId,
+                    session: sessionIdHex,
+                    impact: "not rendered as an observation — this relay named a session this client is not " +
+                        "holding. Reported to the operator as an unplaceable witness report, never as a claim " +
+                        "about a counterparty.",
+                });
+                this.#onWitnessUnreadable?.(this.#relayPeerId, "session_not_held_here");
+                return;
+            }
+            /**
+             * A DECLARED IDENTITY MUST BE PROVEN — review F3. `relay_id` is the hex of the key that signs
+             * every `hash_submit_ack`, so the same check that verifies a receipt verifies this. Missing,
+             * malformed and mismatched take ONE path: omitting the proof is the cheapest way to dodge it.
+             */
+            const alertReason = frame["reason"];
+            const rawSig = frame["witness_signature"];
+            const sigBytes = rawSig instanceof Uint8Array || Buffer.isBuffer(rawSig) ? toU8(rawSig) : null;
+            let verifiable = false;
+            if (typeof rawRelayId === "string") {
+                if (!/^[0-9a-fA-F]{64}$/.test(rawRelayId)) {
+                    unreadable("relay_id_not_a_pubkey");
+                    return;
+                }
+                if (!sigBytes || sigBytes.length !== 64) {
+                    unreadable("declared_relay_id_without_signature");
+                    return;
+                }
+                // THE REASON THE RELAY SENT, not a literal: the reason is inside the signed bytes, so
+                // verifying a different one than arrived would refuse every alert of the new kind.
+                const tbs = buildWitnessAlertTbs(sidBytes, alertReason, observedAt, submitterIsCounterparty);
+                if (!verify(new Uint8Array(Buffer.from(rawRelayId, "hex")), tbs, sigBytes)) {
+                    unreadable("witness_signature_invalid");
+                    return;
+                }
+                verifiable = true;
+            }
+            const alert = {
+                sessionIdHex,
+                reason: alertReason,
+                relayId: typeof rawRelayId === "string" ? rawRelayId : null,
+                observedAt,
+                submitterIsCounterparty,
+                witnessPeerId: this.#relayPeerId,
+                verifiable,
+            };
+            // BOTH halves, per Invariant 2: the log is the durable forensic record, and the callback is
+            // the half that actually reaches a person.
+            this.#logger.error("session.relay.witness.alert", {
+                relayPeerId: this.#relayPeerId,
+                session: alert.sessionIdHex,
+                relayId: alert.relayId ?? "(unnamed)",
+                submitterIsCounterparty: alert.submitterIsCounterparty,
+                verifiable: alert.verifiable,
+                observation: "one relay refused a leaf on this session because it verified against neither participant key",
+                impact: "nothing was added to the conversation record. This is ONE relay's observation and " +
+                    "establishes only that it saw and refused that submission — not who sent it.",
+            });
+            if (this.#onWitnessAlert)
+                this.#onWitnessAlert(alert);
+        }
+        else if (type === "relay_slot_reclaimed") {
+            /**
+             * DOD-M15-RELAYSLOTS-1 clause 8 — **the reaped party is told, and this is where it lands.**
+             *
+             * The relay reclaimed this agent's circuit reservation to free capacity. Without a branch
+             * here the frame fell off the end of this chain and was discarded in silence, which is the
+             * trap the order records in its own words: a refusal that only reaches the relay's log does
+             * not exist. From the agent's side the reservation simply stops working.
+             *
+             * Recorded as a refusal so it reaches `cello_status` through the same surface as every other
+             * relay refusal, with the same shape: a cause, and what to do about it.
+             */
+            const idleMs = typeof frame["idle_ms"] === "number" ? frame["idle_ms"] : undefined;
+            const detail = typeof frame["detail"] === "string" ? frame["detail"] : undefined;
+            this.#lastAuthRefusal = {
+                reason: "slot_reclaimed",
+                advice: detail ?? "This relay reclaimed your circuit reservation to free capacity because it " +
+                    "had carried no traffic for a long time. Your agent stays online and rebuilds its receiver " +
+                    "automatically; a new session will take a fresh reservation.",
+                // Not the relay's fault and not ours — it was under pressure and we were the quietest. The
+                // client rebuilds against the same pool, so there is nothing to fail over from.
+                tryAnotherRelay: false,
+            };
+            this.#logger.warn("session.relay.slot_reclaimed", {
+                relayPeerId: this.#relayPeerId,
+                ...(idleMs !== undefined ? { idleHours: Math.round(idleMs / 3_600_000) } : {}),
+                impact: "this relay reclaimed our circuit reservation to free capacity. Until a receiver is " +
+                    "rebuilt, this agent is reachable only over a direct connection.",
+            });
+        }
+        // session_interrupted / content_park_notify are out of scope here — session interruption
+        // is handled by the session node manager's dedicated relay-stream watcher.
+    }
+    /**
+     * Proactively establish the authenticated stream from `node`. The RECEIVER must connect
+     * before the counterparty submits, so the relay has its stream to deliver `leaf_deliver`
+     * to (otherwise the relay queues until the recipient connects). Best-effort.
+     */
+    async connect(node) {
+        return this.#ensureConnected(node);
+    }
+    /**
+     * DOD-M15-RELAYAUTH-1 review HIGH-1 — prove key possession FROM THIS NODE, on its own stream.
+     *
+     * ⚠️ **`connect()` CANNOT be used for this, and using it was the defect.** `#ensureConnected`
+     * returns `true` the moment `#stream` is non-null, and `#stream` belongs to whichever node
+     * connected FIRST. An agent legitimately runs several nodes against one relay — the node promoted
+     * into a live session, plus the replacement standing receiver built behind it — and they share
+     * one `AgentRelayClient` because the cache is keyed `${agent}::${relay}`. So calling `connect()`
+     * from the replacement receiver short-circuited on the session node's stream, sent nothing, and
+     * the relay never saw that receiver's transport identity: it revoked the reservation ~15s later,
+     * the watchdog rebuilt, and the agent churned on a ~45s loop holding no usable circuit address
+     * for as long as the conversation lasted. Any future "reuse the existing connection" optimisation
+     * here reintroduces exactly that.
+     *
+     * So this always opens its own short-lived stream from `node`, and marks it
+     * `purpose: "reservation"` so the relay proves possession WITHOUT rebinding the agent's delivery
+     * stream (which would steal the live session's inbound leaves — see the relay-side dispatch).
+     */
+    /**
+     * ⚠️ **THE FIRST ATTEMPT AFTER A COLD START IS EXPECTED TO FAIL, AND THAT IS NOT A FAULT ON
+     * EITHER SIDE.** Root-caused 2026-09-07 from libp2p's own debug log:
+     *
+     * ```
+     * circuit-relay listener: making reservation on relay
+     * reservation failed with status PERMISSION_DENIED     <- the relay's gate, working as designed
+     * could not add discovered relay
+     * connection-manager closing 1 connections / stopped / started
+     * ```
+     *
+     * libp2p's circuit-relay listener asks the relay for a reservation ON ITS OWN, before any CELLO
+     * code has proven anything. The relay's gate refuses an unproven peer — deliberately; its flow is
+     * *"asks, is refused, proves itself, and asks again"*. libp2p reacts to that refusal by discarding
+     * the relay and RESTARTING ITS CONNECTION MANAGER, which closes every connection — including the
+     * healthy one this proof is being opened on. Whichever lands first decides the outcome, so the
+     * failure is intermittent (measured 5/5, 2/4, 0/4, 1/6 across cold logins).
+     *
+     * **Both components are behaving as specified, so the refusal cannot be designed away from here** —
+     * removing it means either weakening the gate or reaching into libp2p's internal
+     * `transportManager.listen` to defer the circuit listener until after the proof. What the client
+     * CAN do is survive it: a transport-class failure is retried on a fresh connection, once.
+     *
+     * A REFUSAL IS NOT RETRIED. If the relay reached a verdict — no token, slot cap, misconfigured —
+     * the answer will be identical a second later, and retrying would spend the operator's reachability
+     * on a question already answered. Only a failure that never reached a verdict is retried.
+     */
+    async proveReservation(node) {
+        if (this.#closed)
+            return false;
+        const first = await this.#proveReservationOnce(node);
+        if (first !== "transport_failed")
+            return first;
+        /**
+         * The connection manager has just restarted, so the previous connection is gone and a fresh
+         * dial is required — which `#proveReservationOnce` does at its head. The brief wait is for
+         * libp2p to finish restarting; without it the redial races the restart it is recovering from.
+         */
+        await new Promise((r) => setTimeout(r, PROOF_RETRY_DELAY_MS));
+        if (this.#closed)
+            return false;
+        this.#logger.info("session.relay.reservation_proof.retry", {
+            relayPeerId: this.#relayPeerId,
+            afterMs: PROOF_RETRY_DELAY_MS,
+            impact: "the first proof never reached a verdict — the connection was destroyed under it, which is " +
+                "what libp2p does to a relay that just refused its automatic reservation. Retrying once on " +
+                "a fresh connection. If this succeeds the agent is reachable and nothing was wrong.",
+        });
+        const second = await this.#proveReservationOnce(node);
+        return second === true;
+    }
+    /**
+     * One attempt. `true`/`false` are VERDICTS (the relay answered); `"transport_failed"` means no
+     * verdict was reached and the question is still open — the distinction the retry above turns on.
+     */
+    async #proveReservationOnce(node) {
+        if (this.#closed)
+            return false;
+        /**
+         * ⚠️ **CLEAR THE REFUSAL FIRST — review HIGH-2.** `#lastAuthRefusal` is set when a relay REFUSES
+         * a proof on the merits, and cleared only on auth SUCCESS. Both early returns below are
+         * transport failures that never reach a verdict, so without this a stale refusal from an
+         * earlier attempt survives them — and `session-relay.ts` reads `getLastAuthRefusal()` off a
+         * CACHED client, writes it into `srRelayRefusal`, and quarantines the relay and rebuilds the
+         * receiver when it says `tryAnotherRelay`. One real refusal followed by a later transport blip
+         * would therefore explain the agent's unreachability with a cause that is no longer true, while
+         * churning receivers over it. A transport failure must leave no verdict behind.
+         */
+        this.#clearAuthRefusal();
+        /**
+         * A FAILED DIAL MUST NOT BE REPORTED AS A FAILED STREAM. This loop used to swallow every dial
+         * error and fall through to `newStream` regardless. `#connect()` below has always tracked this
+         * and logs `session.relay.dial.failed`; the two were written from one shape and this one lost
+         * the check.
+         *
+         * ⚠️ **This branch did NOT cause the cold-login failure** (measured 2026-09-07: the dial
+         * succeeds, because libp2p's `findExistingConnection` returns an already-open connection rather
+         * than dialling). It is a real gap on the malformed-address and limited-connection paths, and
+         * nothing more. Do not read its presence as the reachability fix.
+         */
+        let dialed = false;
+        let lastDialError = "";
+        for (const addr of this.#relayAddrs) {
+            try {
+                await node.dial(addr);
+                dialed = true;
+                break;
+            }
+            catch (err) {
+                lastDialError = extractErrorMessage(err);
+            }
+        }
+        if (!dialed && this.#relayAddrs.length > 0) {
+            this.#logger.warn("session.relay.reservation_proof.failed", {
+                relayPeerId: this.#relayPeerId,
+                relayAddrs: this.#relayAddrs,
+                reason: "dial",
+                error: lastDialError,
+                impact: "could not open a connection to this relay, so no proof was sent and the relay saw " +
+                    "nothing. The agent holds no reservation on it and is unreachable through it until a " +
+                    "later attempt succeeds. This is a REACHABILITY fault, not a rejection — the relay did " +
+                    "not refuse anything.",
+            });
+            return "transport_failed";
+        }
+        // TEMPORARY INSTRUMENT (2026-09-07): snapshot immediately BEFORE newStream. Paired with the
+        // snapshot in the catch, this localises the destruction to the newStream call itself rather
+        // than "sometime around the failure".
+        const snap = () => node.getConnections().map((c) => ({
+            toThisRelay: c.peerId === this.#relayPeerId,
+            peer: c.peerId.slice(0, 16),
+            status: c.status,
+            muxer: c.muxerStatus,
+            streams: c.streamCount,
+            protocols: c.streamProtocols,
+        }));
+        const before = snap();
+        let stream;
+        try {
+            stream = await node.newStream(this.#relayPeerId, RELAY_PROTOCOL_ID);
+        }
+        catch (err) {
+            /**
+             * ⚠️ **DO NOT COLLAPSE THIS TO `reason: "stream"`.** `CelloNode.newStream` throws STRUCTURED
+             * errors — plain objects, not `Error`s — whose `reason` is the only field that says what
+             * happened. This site used to overwrite it with the literal `"stream"`, so every distinct
+             * cause reached the operator as one line. Measured 2026-09-07: a whole clean-room
+             * investigation went to the relay servers because the cause was discarded at capture.
+             *
+             * The set is whatever `mapStreamError` returns — deliberately NOT enumerated here, because
+             * the first version of this comment listed four of the six and the two it missed
+             * (`protocol_not_supported`, `limited_connection_refused`) are exactly the ones a redial
+             * cannot fix.
+             *
+             * ⚠️ **`connection_lost` IS THE CATCH-ALL, NOT A DIAGNOSIS** (`node.ts` says so). It covers a
+             * dead muxer on a live socket, a per-protocol stream cap, and a remote reset during
+             * multistream negotiation alike. **`muxerStatus` is what separates them**, which is why the
+             * connections are dumped below: the transport exposes that field for this exact question and
+             * without it the next cold-login failure is guessed at again.
+             *
+             * And note what this does NOT establish: the relay's handler only runs AFTER negotiation
+             * succeeds, so a relay that reset the stream mid-negotiation would log nothing either. Relay
+             * silence is not relay innocence.
+             */
+            const raw = (err ?? {});
+            const reason = typeof raw.reason === "string" ? raw.reason : "stream";
+            this.#logger.warn("session.relay.reservation_proof.failed", {
+                relayPeerId: this.#relayPeerId,
+                relayAddrs: this.#relayAddrs,
+                nodePeerId: node.getPeerId(),
+                reason,
+                error: extractErrorMessage(err),
+                // The discriminator. `status` is the SOCKET; `muxerStatus` is the layer that carries data
+                // and the one `newStream` checks first — a connection reading open/closed is the P5 shape.
+                connsBeforeNewStream: before,
+                connsAtFailure: snap(),
+                nodeStatusAtFailure: node.lifecycleStatus?.() ?? "(unavailable)",
+                impact: "no proof was sent, so this relay granted no reservation and the agent is unreachable " +
+                    "through it until a later attempt succeeds. The relay did not refuse anything — it may " +
+                    "never have seen the stream.",
+            });
+            return "transport_failed";
+        }
+        try {
+            const iter = lp.decode(stream)[Symbol.asyncIterator]();
+            const ok = await this.#authenticate(stream, iter, "reservation");
+            this.#logger.info("session.relay.reservation_proof.result", {
+                relayPeerId: this.#relayPeerId,
+                nodePeerId: node.getPeerId(),
+                ok,
+                // DOD-M15-RELAYSLOTS-1: name the cause here too. `ok: false` alone sent people looking at
+                // the transport for what is usually a token or a cap.
+                ...(ok ? {} : { refusalReason: this.#lastAuthRefusal?.reason ?? "no_relay_verdict" }),
+            });
+            return ok;
+        }
+        finally {
+            await stream.close().catch(() => { });
+        }
+    }
+    /**
+     * 054-SRSPLIT — **TELL THE RELAY WE ARE DONE WITH OUR SLOT.**
+     *
+     * Resolves whether the relay confirmed it freed one. `false` covers "we held none" and "we could
+     * not reach the relay to say so" alike, and the caller must not read it as failure: releasing is
+     * tidy-up, and one that could not be delivered costs a slot until its TTL rather than breaking
+     * anything the agent is doing. Every path that returns false says why.
+     *
+     * ⚠️ **IT GOES ON THE LONG-LIVED DELIVERY STREAM, NOT A RESERVATION-PURPOSE ONE, AND THAT IS NOT
+     * A STYLE CHOICE.** The first version opened a fresh stream and authenticated with
+     * `purpose: "reservation"` — mirroring the proof. The relay's handler treats that purpose as a
+     * proof and nothing else: it answers `relay_auth_ok`, **closes the stream and returns without
+     * entering the message loop**. So the release frame went into a stream nobody was reading, the
+     * reply never came, and the verb was inert while every test passed. Found in review, not by the
+     * suite.
+     *
+     * ⚠️ **THE FRAME CARRIES NO PEER ID, deliberately.** The relay frees the peer this connection
+     * authenticated as. A peer id on the wire would let any registered agent free another's.
+     */
+    /**
+     * DOD-M15-AWAYSCOPE-1 — tell this relay whether anyone is attending this agent, for one session.
+     *
+     * ── WHY THIS EXISTS AT ALL ──────────────────────────────────────────────────────────────────────
+     *
+     * An unattended agent used to answer inbound messages with its away greeting. That greeting took a
+     * hash-chain leaf inside a live conversation, and on session `e7dd3f43…` it cost two operators a
+     * completed conversation's receipt, permanently. The fact itself is worth telling — a counterparty
+     * mid-exchange genuinely needs to know whether to wait — but it is a fact ABOUT the session, not a
+     * sentence IN it. So it rides here instead, and takes no leaf.
+     *
+     * ── FIRE AND FORGET, AND THAT IS THE DESIGN ─────────────────────────────────────────────────────
+     *
+     * Nothing is awaited and the relay sends no ack. The notice may be dropped, duplicated or arrive
+     * out of order; `observed_at` settles it, last-write-wins. A failure changes nothing the operator
+     * is doing — the counterparty reads "unknown" until the next notice, which is what is true.
+     *
+     * ⚠️ NO RETRY, NO QUEUE. Anything that made this reliable would want ordering, ordering wants a
+     * witness, and a witnessed position is how machine chatter reached the leaf set. A status hint
+     * that is allowed to be lost is the safe shape.
+     */
+    announceAttendance(node, sessionId, attendance) {
+        if (this.#closed)
+            return;
+        void (async () => {
+            try {
+                if (!(await this.#ensureConnected(node)))
+                    return;
+                const stream = this.#stream;
+                if (!stream)
+                    return;
+                stream.send(lp.encode.single(encodeSessionAttendanceNotice({
+                    type: "session_attendance_notice",
+                    session_id: sessionId,
+                    attendance,
+                    // OUR clock, stated plainly. The relay bounds it against its own and refuses a value too
+                    // far ahead rather than clamping — clamping would turn a hostile timestamp into a valid
+                    // recent one, and this client is the code an adversary gets to rewrite.
+                    observed_at: Date.now(),
+                })));
+                this.#logger.debug("session.relay.attendance.announced", {
+                    relayPeerId: this.#relayPeerId,
+                    sessionId: Buffer.from(sessionId).toString("hex").slice(0, 16),
+                    attendance,
+                });
+            }
+            catch (err) {
+                this.#logger.debug("session.relay.attendance.announce_failed", {
+                    relayPeerId: this.#relayPeerId,
+                    error: extractErrorMessage(err),
+                    impact: "the counterparty reads 'unknown' for this agent until the next notice lands",
+                });
+            }
+        })();
+    }
+    /**
+     * DOD-M15-AWAYSCOPE-1 — ask the relay about the counterparty: reachable, and attended?
+     *
+     * Two facts with two producers, which is why they are separate fields. `liveness` is the RELAY's
+     * observation — it holds that agent's standing connection or it does not. `attendance` is the far
+     * DAEMON's assertion about itself, which the relay was told and repeats; absent whenever
+     * `liveness` is not 'alive', because a daemon nobody can reach asserts nothing.
+     *
+     * ⚠️ EVERY FAILURE ANSWERS 'unknown', never 'gone'. A timeout, a dead stream, a refusal and an
+     * unparseable frame all mean "this side learned nothing"; reporting any as `gone` invents an
+     * observation nobody made, and `gone` is the value that tells an operator their peer has left.
+     */
+    /**
+     * Test-only seams for the liveness query path, which cannot be reached any other way.
+     *
+     * ⚠️ THEY EXIST BECAUSE A ONE-SESSION FAKE HID A REAL DEFECT. Every other test of this feature
+     * stubs `queryLiveness` outright, so the code that matches an ANSWER to its QUESTION never ran —
+     * and it was wrong: a single resolver slot handed one session's answer to another session's
+     * promise the moment an agent held two conversations through one relay, which is ordinary.
+     * Reaching that code needs a live stream and a dispatched frame, and both are private.
+     *
+     * Named `ForTest` like `__setLastActivityAtForTest` and `patchRelayClientForTest`, and doing
+     * nothing production does not: one installs the stream a dial would have produced, the other
+     * feeds the reader loop a frame the relay would have sent.
+     */
+    installStreamForTest(stream) { this.#stream = stream; }
+    dispatchForTest(frame) { this.#dispatch(frame); }
+    async queryLiveness(sessionId, counterpartyPubkey) {
+        const unknown = { liveness: "unknown", observedAt: 0 };
+        if (this.#closed)
+            return unknown;
+        /**
+         * ⚠️ IT DOES NOT DIAL — the one place in this client that refuses to connect. Every other caller
+         * here does the operator's work; this one serves a READ (`cello status`, `cello sessions`), and
+         * a status command that opens a connection as a side effect changes what it is reporting on. It
+         * would also make a read of a dozen sessions pay a dial each, against a budget measured in what
+         * a person waits at a terminal. The cost is small and precise: right after a daemon restart a
+         * status read says 'unknown' instead of dialling; the first real message establishes the stream.
+         */
+        const stream = this.#stream;
+        if (!stream)
+            return unknown;
+        let resolveLiveness;
+        const answer = new Promise((r) => { resolveLiveness = r; });
+        const key = livenessKey(sessionId, counterpartyPubkey);
+        this.#pendingLiveness.set(key, resolveLiveness);
+        try {
+            stream.send(lp.encode.single(encodeSessionLivenessQuery({
+                type: "session_liveness_query",
+                session_id: sessionId,
+                counterparty_pubkey: counterpartyPubkey,
+            })));
+        }
+        catch (err) {
+            this.#pendingLiveness.delete(key);
+            this.#logger.debug("session.relay.liveness.query_failed", {
+                relayPeerId: this.#relayPeerId, error: extractErrorMessage(err),
+            });
+            return unknown;
+        }
+        let timer;
+        const timeout = new Promise((r) => { timer = setTimeout(() => r("timeout"), HASH_SUBMIT_TIMEOUT_MS); });
+        try {
+            const result = await Promise.race([answer, timeout]);
+            if (result === "timeout") {
+                // NOT a stream reset, for the same reason a release timeout is not: a liveness query is not
+                // ordered against anything, so tearing the shared stream down would cost every sibling
+                // session its in-flight submits to tidy up one status read.
+                this.#pendingLiveness.delete(key);
+                this.#logger.debug("session.relay.liveness.query_timeout", { relayPeerId: this.#relayPeerId });
+                return unknown;
+            }
+            return result;
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    async releaseReservation(node) {
+        if (this.#closed)
+            return false;
+        if (!(await this.#ensureConnected(node))) {
+            this.#logger.warn("session.relay.reservation_release.failed", {
+                relayPeerId: this.#relayPeerId,
+                reason: "not_connected",
+                impact: "this relay was not told the slot is free, so it holds it until the reservation " +
+                    "TTL expires. Nothing the agent is doing is affected.",
+            });
+            return false;
+        }
+        const stream = this.#stream;
+        if (!stream)
+            return false;
+        let resolveRel;
+        const relPromise = new Promise((r) => { resolveRel = r; });
+        this.#pendingRelease = resolveRel;
+        try {
+            stream.send(lp.encode.single(encodeCbor({ type: "relay_release_reservation" })));
+        }
+        catch (err) {
+            if (this.#pendingRelease === resolveRel)
+                this.#pendingRelease = null;
+            this.#logger.warn("session.relay.reservation_release.failed", {
+                relayPeerId: this.#relayPeerId,
+                reason: "send",
+                error: extractErrorMessage(err),
+                impact: "the relay holds the slot until its TTL expires.",
+            });
+            return false;
+        }
+        let timer;
+        const timeout = new Promise((r) => { timer = setTimeout(() => r("timeout"), HASH_SUBMIT_TIMEOUT_MS); });
+        try {
+            const result = await Promise.race([relPromise, timeout]);
+            if (result === "timeout") {
+                // NOT a stream reset. A release is not ordered against anything — no ack of a later frame
+                // can be settled by a late reply to this one, because the reader clears the resolver — so
+                // tearing the stream down would cost sibling sessions their in-flight submits for a tidy-up.
+                this.#logger.warn("session.relay.reservation_release.failed", {
+                    relayPeerId: this.#relayPeerId,
+                    reason: "no_reply",
+                    impact: "the relay did not answer, so it holds the slot until its TTL expires.",
+                });
+                return false;
+            }
+            this.#logger.info("session.relay.reservation_release.result", {
+                relayPeerId: this.#relayPeerId,
+                nodePeerId: node.getPeerId(),
+                released: result,
+            });
+            return result;
+        }
+        finally {
+            clearTimeout(timer);
+            if (this.#pendingRelease === resolveRel)
+                this.#pendingRelease = null;
+        }
+    }
+    /** Ensure an authenticated stream exists, (re)dialing from `node` if needed. */
+    async #ensureConnected(node) {
+        if (this.#closed)
+            return false;
+        if (this.#stream)
+            return true;
+        if (this.#connecting)
+            return this.#connecting;
+        this.#connecting = this.#connect(node).finally(() => { this.#connecting = null; });
+        return this.#connecting;
+    }
+    async #connect(node) {
+        /**
+         * ⚠️ DROP THE PREVIOUS ATTEMPT'S VERDICT FIRST — `DOD-M15-TOKENSTALE-1` review F4, and the same
+         * reasoning `#proveReservationOnce` already carries in capitals twelve lines from here.
+         *
+         * `#lastAuthRefusal` is cleared only on auth SUCCESS. Both failure exits below — the dial and
+         * the stream open — are transport failures that never reach a verdict at all, so without this
+         * they return `false` carrying whatever an earlier attempt left behind.
+         *
+         * That was survivable while the submit boundary answered `relay_unavailable` for every `false`.
+         * It is not now: this unit makes that boundary REPORT the stored refusal, so a stale
+         * `online_token_expired` would relabel a relay that is genuinely down as our own dead
+         * credential — sending the operator to restart their daemon over somebody else's outage, and
+         * stripping the seal fallbacks that exist for exactly that outage. Clearing here is what makes
+         * the promotion mean "this attempt's verdict" instead of "some past verdict".
+         */
+        this.#clearAuthRefusal();
+        // Best-effort dial: newStream auto-dials a known peer, but the relay's addrs may not
+        // be in the peerstore yet, so dial each addr first. One success is enough.
+        let dialed = false;
+        let lastDialError = "";
+        for (const addr of this.#relayAddrs) {
+            try {
+                await node.dial(addr);
+                dialed = true;
+                break;
+            }
+            catch (err) {
+                lastDialError = extractErrorMessage(err);
+            }
+        }
+        if (!dialed && this.#relayAddrs.length > 0) {
+            this.#logger.warn("session.relay.dial.failed", {
+                relayPeerId: this.#relayPeerId,
+                relayAddrs: this.#relayAddrs,
+                error: lastDialError,
+            });
+            return false;
+        }
+        let stream;
+        try {
+            stream = await node.newStream(this.#relayPeerId, RELAY_PROTOCOL_ID);
+        }
+        catch (err) {
+            /**
+             * Same error substitution as `proveReservation`'s stream branch, and on the MORE important
+             * path — this is the stream that carries `leaf_deliver` into a live session. `newStream`'s
+             * structured `reason` was being dropped here too, leaving `connection_lost`, a stream cap and
+             * a refused protocol indistinguishable while a conversation is running.
+             */
+            const raw = (err ?? {});
+            this.#logger.warn("session.relay.stream.failed", {
+                relayPeerId: this.#relayPeerId,
+                reason: typeof raw.reason === "string" ? raw.reason : "stream",
+                error: extractErrorMessage(err),
+                relayConnections: node
+                    .getConnections()
+                    .filter((c) => c.peerId === this.#relayPeerId)
+                    .map((c) => ({ status: c.status, muxerStatus: c.muxerStatus, streams: c.streamCount })),
+            });
+            return false;
+        }
+        // ONE shared lp.decode iterator for the whole stream lifetime — splitting it signals
+        // EOF to the relay's single-iterator reader and breaks subsequent reads.
+        const iter = lp.decode(stream)[Symbol.asyncIterator]();
+        if (!(await this.#authenticate(stream, iter)))
+            return false;
+        this.#stream = stream;
+        this.#logger.info("session.relay.connected", { relayPeerId: this.#relayPeerId });
+        this.#startReader(stream, iter);
+        return true;
+    }
+    async #authenticate(stream, iter, purpose) {
+        const challengeRes = await nextWithTimeout(iter, RELAY_AUTH_TIMEOUT_MS);
+        if (challengeRes.done || challengeRes.value === undefined) {
+            this.#logger.warn("session.relay.auth.failed", { relayPeerId: this.#relayPeerId, reason: "no_challenge" });
+            return false;
+        }
+        let challenge;
+        try {
+            challenge = decode(toU8(challengeRes.value));
+        }
+        catch {
+            this.#logger.warn("session.relay.auth.failed", { relayPeerId: this.#relayPeerId, reason: "challenge_decode" });
+            return false;
+        }
+        if (challenge["type"] !== "relay_auth_challenge") {
+            this.#logger.warn("session.relay.auth.failed", { relayPeerId: this.#relayPeerId, reason: "not_challenge" });
+            return false;
+        }
+        const nonce = toU8(challenge["nonce"]);
+        if (nonce.length !== 32) {
+            this.#logger.warn("session.relay.auth.failed", { relayPeerId: this.#relayPeerId, reason: "bad_nonce" });
+            return false;
+        }
+        const authSig = await this.#keyProvider.sign(buildRelayAuthPayload(nonce, this.#senderPubkey));
+        /**
+         * DOD-M15-RELAYSLOTS-1: read the token NOW, not at construction — it is reissued on every
+         * signaling reconnect and the one this client was built with is usually already gone.
+         *
+         * When there is none we send the auth anyway. Declining to try would replace a named refusal
+         * from the relay (`online_token_required`, which says what is wrong and what to do) with
+         * silence on both sides — and silence is what an operator reads as "the product is broken".
+         */
+        const onlineToken = this.#onlineToken?.();
+        if (!onlineToken) {
+            this.#logger.warn("session.relay.auth.no_online_token", {
+                relayPeerId: this.#relayPeerId,
+                impact: "authenticating without the directory's online token. The relay will refuse this and " +
+                    "will not let this node keep a circuit reservation, so the agent is reachable by nobody " +
+                    "over this relay. The usual cause is that no directory connection has been established " +
+                    "yet; the next signaling connect issues a token and the receiver re-authenticates.",
+            });
+        }
+        try {
+            stream.send(lp.encode.single(encodeCbor({
+                type: "relay_auth_response",
+                pubkey: this.#senderPubkey,
+                signature: authSig,
+                // DOD-M15-RELAYAUTH-1: absent for the ordinary session auth (which also registers this
+                // stream as the agent's delivery target). `"reservation"` proves possession from THIS
+                // node's transport identity and nothing more — see proveReservation().
+                ...(purpose ? { purpose } : {}),
+                // DOD-M15-RELAYSLOTS-1: opaque bytes from the directory, forwarded verbatim. The client
+                // never parses them — a format it does not read is a format it cannot get wrong.
+                ...(onlineToken ? { online_token: onlineToken } : {}),
+            })));
+        }
+        catch (err) {
+            this.#logger.warn("session.relay.auth.failed", { relayPeerId: this.#relayPeerId, reason: "response_send", error: extractErrorMessage(err) });
+            return false;
+        }
+        const ackRes = await nextWithTimeout(iter, RELAY_AUTH_TIMEOUT_MS);
+        if (ackRes.done || ackRes.value === undefined) {
+            this.#logger.warn("session.relay.auth.failed", { relayPeerId: this.#relayPeerId, reason: "no_auth_ok" });
+            return false;
+        }
+        let ackFrame;
+        try {
+            ackFrame = decode(toU8(ackRes.value));
+        }
+        catch {
+            this.#logger.warn("session.relay.auth.failed", { relayPeerId: this.#relayPeerId, reason: "auth_ok_decode" });
+            return false;
+        }
+        if (ackFrame["type"] !== "relay_auth_ok") {
+            /**
+             * DOD-M15-RELAYABUSE-1 review F2 — **THE RELAY SAYS WHY, AND WE USED TO THROW IT AWAY.**
+             *
+             * `relay_auth_failed` carries a `reason` — `rate_limited`, `signature_invalid`, `nonce_expired`,
+             * `nonce_reused`, `nonce_unknown` — and, when throttled, a `retry_after_ms`. This branch
+             * collapsed all of them into the single word `auth_rejected`, so a throttled agent looked
+             * exactly like a bad signature, which looked exactly like a dead relay. That is precisely the
+             * distinction the order that added those refusals set out to create, undone at the last hop.
+             *
+             * The difference matters to whoever is looking: `rate_limited` clears by itself and says when;
+             * `signature_invalid` never clears and means a key or clock problem; a nonce failure means the
+             * handshake raced and an immediate retry is the right move. One label for all three sends
+             * someone to look for a broken relay in all three cases.
+             */
+            const relayReason = typeof ackFrame["reason"] === "string" ? ackFrame["reason"] : undefined;
+            const retryAfterMs = typeof ackFrame["retry_after_ms"] === "number" ? ackFrame["retry_after_ms"] : undefined;
+            /**
+             * DOD-M15-RELAYSLOTS-1: keep the refusal, do not merely log it.
+             *
+             * Everything below writes an excellent warn line into a file nobody opens. The operator who
+             * runs `cello_use_agent` and finds their agent unreachable never sees it, and the daemon
+             * deciding whether another relay would help cannot read it either. So the classified refusal
+             * — reason, what to do about it, and whether to fail over — is stored where both can reach it.
+             */
+            const slotsHeld = typeof ackFrame["slots_held"] === "number" ? ackFrame["slots_held"] : undefined;
+            const slotCap = typeof ackFrame["slot_cap"] === "number" ? ackFrame["slot_cap"] : undefined;
+            this.#lastAuthRefusal = classifyRelayAuthRefusal(ackFrame["type"] === "relay_auth_failed" ? (relayReason ?? "auth_rejected") : "unexpected_frame", {
+                ...(slotsHeld !== undefined ? { slotsHeld } : {}),
+                ...(slotCap !== undefined ? { slotCap } : {}),
+                ...(retryAfterMs !== undefined ? { retryAfterMs } : {}),
+            });
+            this.#logger.warn("session.relay.auth.failed", {
+                relayPeerId: this.#relayPeerId,
+                reason: ackFrame["type"] === "relay_auth_failed" ? (relayReason ?? "auth_rejected") : "unexpected_frame",
+                ...(retryAfterMs !== undefined ? { retryAfterMs } : {}),
+                impact: relayReason === "rate_limited"
+                    ? "this relay is throttling us; it clears on its own after the stated window, and until it does this agent cannot reserve or witness here"
+                    : "this agent could not authenticate to this relay, so it cannot witness leaves or hold a reservation here",
+            });
+            return false;
+        }
+        // DOD-M15-RELAYSLOTS-1: a success clears the stored refusal, so a stale one is never reported
+        // as the current state of a relay that has since started admitting us.
+        this.#lastAuthRefusal = null;
+        return true;
+    }
+    #startReader(stream, iter) {
+        void (async () => {
+            try {
+                while (!this.#closed && this.#stream === stream) {
+                    const res = await iter.next();
+                    if (res.done || res.value === undefined)
+                        break;
+                    // The await above can suspend across a #resetStream() (timeout) that supersedes this
+                    // stream. Re-check identity before dispatching so a late frame from a stale stream
+                    // (e.g. a buffered ack for a timed-out submit) can't bump/settle the wrong session.
+                    if (this.#stream !== stream)
+                        break;
+                    let frame;
+                    try {
+                        frame = decode(toU8(res.value));
+                    }
+                    catch {
+                        continue;
+                    }
+                    this.#dispatch(frame);
+                }
+            }
+            catch (err) {
+                // WARN, not debug (DOD-RELAY-KEEPALIVE-1 review F4). This is the ONLY place the cause of a
+                // dead relay link survives: the watchdog that notices later reports `relay_connection_gone`,
+                // which names where it noticed, not why. At debug, 2,061 of these went untraced through a
+                // launch — the reader ending is not routine, it means in-flight submits just failed.
+                this.#logger.warn("session.relay.reader.ended", { relayPeerId: this.#relayPeerId, error: extractErrorMessage(err) });
+                this.#lastReaderError = extractErrorMessage(err);
+            }
+            finally {
+                // Stream gone — clear it so the next submit re-dials, and fail any in-flight submit.
+                if (this.#stream === stream)
+                    this.#stream = null;
+                this.#settlePending({ ok: false, reason: "relay_stream_closed" });
+                // Settle an in-flight record too, so #doRecord doesn't
+                // wait the full timeout on a dropped stream. "closed" is transient (not a directory rejection) ⇒
+                // recorded stays false and it is retried after reconnect.
+                {
+                    const r = this.#pendingRecord;
+                    this.#pendingRecord = null;
+                    if (r)
+                        r("closed");
+                }
+                // 054-SRSPLIT: settle an in-flight release too — `false`, because the relay was not told.
+                {
+                    const r = this.#pendingRelease;
+                    this.#pendingRelease = null;
+                    if (r)
+                        r(false);
+                }
+                // DOD-M15-AWAYSCOPE-1: and an in-flight liveness query, so a status read does not wait its
+                // whole timeout on a stream that is already gone. "unknown" is the honest answer.
+                {
+                    for (const r of this.#pendingLiveness.values())
+                        r({ liveness: "unknown", observedAt: 0 });
+                    this.#pendingLiveness.clear();
+                }
+                // A receiving session never submits, so nothing else re-dials: reconnect so queued leaf_delivers arrive.
+                if (!this.#closed && this.#sessions.size > 0)
+                    void this.#reconnectFromAnySession();
+            }
+        })();
+    }
+    /** Re-establish the shared stream from any session's node, retrying while one depends on it — see `relay-reconnect.ts`. */
+    async #reconnectFromAnySession() {
+        if (this.#reconnecting)
+            return;
+        this.#reconnecting = true;
+        const stranded = () => !this.#closed && this.#stream === null && this.#sessions.size > 0;
+        await reconnectWithBackoff({
+            relayPeerId: this.#relayPeerId, logger: this.#logger, baseMs: this.#reconnectRetryMs, shouldStop: () => !stranded(), refusal: () => this.#lastAuthRefusal,
+            connectOnce: async () => { for (const { node } of this.#sessions.values())
+                if (await this.#ensureConnected(node))
+                    return true; return false; },
+        }).finally(() => { this.#reconnecting = false; });
+        if (stranded())
+            void this.#reconnectFromAnySession(); // a reader that ended during the loop's exit saw the flag set
+    }
+    /**
+     * Submit a session's CONTENT-leaf hash to the relay. Connects/re-connects from `node` if needed.
+     * Globally FIFO across the agent's sessions (the ack has no session_id).
+     *
+     * `leafKind` defaults to MESSAGE, which is what `cello_send` wants. It is a PARAMETER because
+     * the document path needs 0x04/0x05: the seal certificate is computed by the directory from the
+     * leaves the RELAY witnessed, and `seal-legibility.ts` excludes doc/reject leaves from
+     * `final_message` and from `answered` — guards that could never fire while this method hardcoded
+     * MSG for every caller. See `document-leaf-kind-on-the-wire.test.ts` for what that cost.
+     */
+    async submitMessageHash(node, sessionId, contentHash, 
+    /**
+     * REQUIRED — `DOD-M15-SEALWIRE-1` B2b-1 pass-2 F3. This default was the last one on the path,
+     * and it is the reason a test passing `undefined` for `leafKind` looked correct: the value was
+     * silently rebuilt as MESSAGE one hop below the parameter the fix had just made required. Its
+     * one production caller always passes explicitly, so the default was dead and misleading.
+     */
+    leafKind) {
+        /**
+         * `null`, and it is now IMPOSSIBLE to omit — see `submitLeaf`'s note on why the parameter is
+         * required. A message leaf's content belongs to the operator and never reaches the relay.
+         */
+        return this.submitLeaf(node, sessionId, contentHash, leafKind, null);
+    }
+    /**
+     * ─── WITNESS A LEAF THIS AGENT RECEIVED BUT DID NOT AUTHOR — 034-CARRYLEAF ────────────────────
+     *
+     * **This is what closes `DOD-M15-WITHHOLD-SEAL-1`.** Until it existed, `submitMessageHash` had
+     * one production caller on the SEND path, so nothing ever witnessed a message that was RECEIVED.
+     * A counterparty who delivered a message directly and never submitted its hash left the relay's
+     * account of the conversation one message short — permanently — and a unilateral seal then agreed
+     * with the witness. Every leaf validly signed, nothing false, the last thing said simply absent.
+     *
+     * **The teeth are the author's own signature.** It arrived on the content frame beside the bytes
+     * it signs, this daemon verified it before ingesting anything, and it cannot be forged here. The
+     * relay verifies it again against the session's assignment before sequencing — so what this hands
+     * over is a claim the author made and cannot disown.
+     *
+     * ⚠️ **THE BYTES ARE PASSED THROUGH, NEVER REBUILT.** A signature is over the encoded bytes, and
+     * the one measured cost of forgetting that on this exact structure was a daemon-local encoder
+     * emitting a timestamp as float64 where the published one promotes to uint64 — same value,
+     * different signed bytes, refused by everyone.
+     */
+    async witnessReceivedLeaf(node, sessionId, contentHash, leafKind, carried) {
+        return this.submitLeaf(node, sessionId, contentHash, leafKind, null, carried);
+    }
+    /**
+     * Submit a leaf hash of a given kind (0x00 message / 0x02 control) to the relay. The SEAL
+     * ctrl leaf rides this path: two distinct-sender ctrl leaves in the relay's
+     * log trigger the directory's FROST notarization (relay `#maybeProcessSeal`).
+     *
+     * ─── `contentBytes` — `DOD-M15-SEALWIRE-1` bullets 3+4, THE SENDER LEG ───────────────────────
+     *
+     * The SEAL leaf's own payload, carried alongside its hash. Without it the directory holds a
+     * SHA-256 pre-image and nothing else, so the client's SIGNED `final_root` — the one value in the
+     * whole seal that the relay cannot produce — is unrecoverable, and every root check the directory
+     * can make compares the relay against itself.
+     *
+     * ⚠️ THIS PARAMETER PUTS LEAF CONTENT ON THE RELAY, AND THE RELAY IS THE PARTY THIS PROTOCOL
+     * EXISTS TO KEEP CONTENT AWAY FROM (INV-3: a forwarding relay sees ciphertext).
+     *
+     * It is safe for a SEAL ctrl leaf and for nothing else. The payload is `[session_id, final_root,
+     * close_timestamp, "PENDING"]` and the relay already knows all four — it assigned the session,
+     * built the tree the root comes from, and stamped the leaf. Nothing is disclosed. That reasoning
+     * stops dead at the next leaf kind: a `msg` leaf's content is the operator's plaintext and a `doc`
+     * leaf's is their document.
+     *
+     * So both directions are REFUSED rather than tidied, and refused HERE rather than at the relay:
+     *
+     *   - content on a non-ctrl leaf → the relay would refuse the whole frame, but only after the
+     *     operator's words had already crossed the wire to the party that must not have them, and the
+     *     refusal would destroy their send rather than protect it.
+     *   - a ctrl leaf with NO payload → this was the actual defect. `submitSealLeaf` computed the
+     *     payload, hashed it, and had nowhere to put it, so it was dropped. The seal still succeeded,
+     *     the relay still acked, and three hops later the directory reported `not_carried` and blamed
+     *     the relay's build version — for a value the client never sent. Four reviewed legs shipped
+     *     over that silence. A dropped argument now fails on the machine that dropped it.
+     *
+     * ⚠️ REQUIRED, AND `| null` RATHER THAN `?` — THE TYPE IS THE GUARD.
+     *
+     * I first wrote this optional and covered it with tests. Then I ran the revert test that mattered:
+     * drop the argument at the one call site that must pass it, exactly reproducing the original
+     * defect. **All five new tests stayed green.** An optional parameter makes the defect a silent,
+     * type-legal omission — which is precisely how it shipped through four reviews the first time.
+     *
+     * Required means the omission is a COMPILE ERROR, caught by the gate on the machine that made it,
+     * before any test runs. Every caller must now say what this leaf carries, and `submitMessageHash`
+     * says `null` in one visible place instead of by saying nothing at all.
+     */
+    async submitLeaf(node, sessionId, contentHash, leafKind, contentBytes, 
+    /**
+     * 034-CARRYLEAF — a leaf THIS AGENT DID NOT AUTHOR, carried on its author's behalf.
+     *
+     * Absent for every ordinary send, where this client builds and signs its own claim. Present
+     * only when witnessing something received whose author never submitted it — see
+     * `witnessReceivedLeaf`.
+     */
+    carried) {
+        if (contentBytes !== null && leafKind !== LEAF_KIND_CTRL) {
+            // Logged at ERROR and returned: a caller reaching this line is trying to hand the relay
+            // operator content, and the log must carry it even if the caller swallows the result.
+            this.#logger.error("session.relay.submit.content_not_permitted", {
+                relayPeerId: this.#relayPeerId,
+                leafKind,
+                impact: "the submit was NOT sent. Only a SEAL ctrl leaf may carry its content to the relay; every other leaf kind's content belongs to the operator.",
+                guidance: "Pass contentBytes only with LEAF_KIND_CTRL. If a new leaf kind genuinely needs to disclose its content to the relay, that is a protocol decision, not a call-site one.",
+            });
+            return { ok: false, reason: "content_not_permitted_for_leaf_kind" };
+        }
+        if (contentBytes === null && leafKind === LEAF_KIND_CTRL) {
+            this.#logger.error("session.relay.submit.seal_payload_missing", {
+                relayPeerId: this.#relayPeerId,
+                impact: "the seal leaf was NOT sent. Sending it without its payload produces a certificate the directory cannot check against any participant's signed transcript — silently, and reported downstream as the RELAY being on an old build.",
+                guidance: "A ctrl leaf on this path is a SEAL leaf; pass the encodeSealPayload bytes whose SHA-256(0x02 ‖ payload) is the contentHash argument.",
+            });
+            return { ok: false, reason: "seal_payload_not_carried" };
+        }
+        if (contentBytes !== null) {
+            /**
+             * ⚠️ THE BYTES MUST BE A SEAL PAYLOAD FOR THIS SESSION, AND THEY MUST HASH TO THE HASH BEING
+             * SIGNED — review pass 2, MEDIUM-1 and HIGH-1. The kind check alone was not the property this
+             * parameter's whole justification rests on.
+             *
+             * The justification is: *"the payload is [session_id, final_root, close_timestamp, "PENDING"]
+             * and the relay already knows all four, so nothing is disclosed."* The code enforced
+             * `leafKind === CTRL` and nothing else — so a caller passing a ctrl leaf with four kilobytes
+             * of the operator's text would have transmitted it, and been refused only at the relay, AFTER
+             * it crossed the wire to the party that must not have it. That is the precise harm the local
+             * guard exists to prevent, and the relay learned this same lesson at its own review (H1 in
+             * `relay-frames.ts`) one file over. I wrote the weaker version anyway.
+             *
+             * THE HASH BINDING IS THE MORE IMPORTANT HALF, and it closes a mutant that survived pass 1's
+             * type hardening. Making the parameter required catches an OMITTED argument; it cannot catch a
+             * SUBSTITUTED one. A caller that re-derives the payload instead of passing the one it hashed
+             * — a second `encodeSealPayload` call, a fresh `Date.now()` — compiles, and the mismatch
+             * surfaces at the directory as `seal_payload_unbound`, whose guidance reads *"someone between
+             * them and here altered or fabricated the payload — the relay is the only party on that path.
+             * Treat this as relay tampering, not a version mismatch."*
+             *
+             * **A client-side derivation slip would be published as a named accusation against a healthy
+             * relay operator.** Checking it here makes it a local refusal on the machine that caused it.
+             */
+            const rederived = new Uint8Array(createHash("sha256").update(new Uint8Array([LEAF_KIND_CTRL])).update(contentBytes).digest());
+            if (!Buffer.from(rederived).equals(Buffer.from(contentHash))) {
+                this.#logger.error("session.relay.submit.seal_payload_unbound", {
+                    relayPeerId: this.#relayPeerId,
+                    impact: "the seal leaf was NOT sent. The payload does not hash to the content_hash this leaf signs, so the directory would have reported it as RELAY TAMPERING — a named accusation against a node that did nothing wrong.",
+                    guidance: "Pass the SAME bytes that produced contentHash. Re-deriving the payload at the call site produces a different close_timestamp and breaks the binding.",
+                });
+                return { ok: false, reason: "seal_payload_unbound" };
+            }
+            const decoded = decodeSealPayload(contentBytes);
+            if (!decoded || !Buffer.from(decoded.session_id).equals(Buffer.from(sessionId))) {
+                this.#logger.error("session.relay.submit.seal_payload_invalid", {
+                    relayPeerId: this.#relayPeerId,
+                    impact: "the submit was NOT sent. Only a SEAL payload for THIS session may be disclosed to the relay — arbitrary bytes on a ctrl leaf are still the operator's content, and a payload for another session is a replay.",
+                    guidance: decoded
+                        ? "The payload names a different session than the one being submitted."
+                        : "The bytes are not a decodable SEAL payload. Build them with encodeSealPayload.",
+                });
+                return { ok: false, reason: "seal_payload_invalid" };
+            }
+        }
+        // Chain on the prior submit so only one is outstanding at a time (FIFO). The ack
+        // carries no session_id, so concurrent submits on one stream would be ambiguous.
+        const run = this.#submitChain.then(() => this.#doSubmit(node, sessionId, contentHash, leafKind, contentBytes, carried));
+        // Keep the chain alive regardless of this submit's outcome.
+        this.#submitChain = run.then(() => undefined, () => undefined);
+        return run;
+    }
+    /**
+     * DOD-FIRSTMSG-WITNESS-1: `session_not_found` is TRANSIENT, not terminal.
+     *
+     * The relay answers it when it does not hold the session YET — the assignment record is still
+     * landing, or the counterparty recorded it and our own record raced ahead of the submit. Proven
+     * from the live log: in all 23 first-message failures the `assignment.recorded` event lands
+     * 5 ms – 2.1 s AFTER the rejected submit. The relay is reachable and answering; it is simply
+     * not ready.
+     *
+     * Before this, the rejection was returned to `sendContent`, which logged
+     * `session.relay.hash.submit.failed` and appended the leaf UNWITNESSED anyway. Nothing retried,
+     * so the relay's counter never counted that message and the local record stayed exactly one
+     * ahead for the life of the session. Because the bilateral certificate is rebuilt EXCLUSIVELY
+     * from relay-witnessed leaves, the sealed receipt omitted the conversation's opening message —
+     * and was issued regardless.
+     *
+     * Retrying re-presents the assignment first (idempotent — the relay answers `assignment_ok` on
+     * `session_already_exists`), which is also what supplies the wait: re-recording is a full
+     * round trip, so the retry cannot busy-spin against a relay that is still catching up.
+     *
+     * This does NOT collapse the two states the fix must tell apart:
+     *   - `session_not_found` — a reachable relay that does not hold the session yet → retry here.
+     *   - `relay_unavailable` / stream failures — a genuine outage → returned untouched, so
+     *     `sendContent` still degrades to an unwitnessed append and the inbox stays readable.
+     * Any other rejection (`session_sealed`, `not_a_participant`, signature failures) is terminal
+     * and returned as-is — retrying those would be pointless traffic masking a real state.
+     */
+    static #SESSION_NOT_FOUND_ATTEMPTS = 3;
+    /**
+     * DOD-M15-RELAYABUSE-1 review F1: how many times a throttled submit waits out the relay's stated
+     * window before the refusal is surfaced. Three, because the window is a fixed sliding minute —
+     * two waits clear any ordinary burst, and a third failure means something other than this
+     * sender's own volume is going on, which the operator should hear about.
+     */
+    static #RATE_LIMITED_ATTEMPTS = 3;
+    /** Used only when the relay names no window (an older relay, or a malformed value). */
+    static #RATE_LIMITED_FALLBACK_MS = 5_000;
+    /**
+     * Ceiling on a single wait, so a relay reporting an implausible window cannot park a send
+     * indefinitely — a hostile or misconfigured relay must not be able to stall a sender by
+     * answering `retry_after_ms: 3600000`. Past this the send fails and says so.
+     */
+    static #RATE_LIMITED_MAX_WAIT_MS = 65_000;
+    async #doSubmit(node, sessionId, contentHash, leafKind, contentBytes, carried) {
+        const sessionIdHex = Buffer.from(sessionId).toString("hex");
+        // Snapshotted BEFORE the first attempt, and it is the whole safety of this loop.
+        //
+        // The first-message race is BY DEFINITION a session we have not recorded yet. A session we DID
+        // record and that the relay now reports missing is a DIFFERENT state: the relay destroys a
+        // session on seal (relay-node.ts `confirmSeal`) and on idle sweep, and its store keeps NO
+        // tombstone — `recordSession` re-creates any absent key fresh (`seq_counter: 0`, empty
+        // leaf_log, status "active"). So `getSession` answers `session_not_found`, NOT `session_sealed`.
+        // Re-presenting our still-valid directory-signed assignment there would silently RESURRECT a
+        // sealed session on the relay: a ghost with an empty log, an idle timer and a delivery path,
+        // created by a client submit retry. Two ctrl leaves on it would drive a second notarization
+        // over a 1-leaf log for an already-certified session.
+        //
+        // The 2 post-seal failures in this defect's own evidence table are exactly that shape — they
+        // reported `session_not_found`, indistinguishable at the wire from the race — which is why
+        // this must be discriminated on OUR state, not on the relay's reason string.
+        const recordedBefore = this.#sessions.get(sessionIdHex)?.recorded === true;
+        let result = await this.#doSubmitOnce(node, sessionId, contentHash, leafKind, contentBytes, carried);
+        for (let attempt = 1; attempt < _a.#SESSION_NOT_FOUND_ATTEMPTS
+            && !recordedBefore
+            && !result.ok
+            && (result.reason === "session_not_found" || result.reason === "session_not_recorded")
+            && !this.#closed; attempt++) {
+            // Force the assignment to be re-presented: we never recorded this session, so the relay
+            // genuinely does not hold it yet. A session with no assignment to present (direct/legacy)
+            // re-submits without a record — still bounded, and it surfaces the same named failure
+            // rather than hanging.
+            const sess = this.#sessions.get(sessionIdHex);
+            if (sess)
+                sess.recorded = false;
+            this.#logger.info("session.relay.submit.retry", {
+                relayPeerId: this.#relayPeerId,
+                sessionShort: sessionIdHex.slice(0, 16),
+                attempt,
+                reason: result.reason,
+            });
+            result = await this.#doSubmitOnce(node, sessionId, contentHash, leafKind, contentBytes, carried);
+        }
+        /**
+         * DOD-M15-RELAYABUSE-1 review F1 — **A THROTTLE IS BACK-PRESSURE, NOT AN ERROR.** (Andre,
+         * 2026-08-31: retry on the relay's own timing; surface only if the retry also fails.)
+         *
+         * Without this the relay's `rate_limited` fell into the caller's catch-all: one log line, and
+         * `cello_send` returned `{ok:true, delivered:true}` for a message the relay had refused to
+         * witness — on the parked path telling the operator it was *"sealed, witnessed and on its way"*.
+         * The leaf went out unwitnessed with no sequence number, and the seal later covered a transcript
+         * missing it.
+         *
+         * This is the ONE refusal that is safely retryable and self-clearing, and the relay tells us
+         * exactly when. So we wait it out here, where the wait is invisible, rather than handing the
+         * agent an error for a condition that resolves in under a minute. Bounded: if the window is
+         * absent or implausible we fall back to a fixed wait, and after
+         * `#RATE_LIMITED_ATTEMPTS` the refusal is returned and the caller surfaces it — Option 2 as
+         * the fallback, not the first move.
+         */
+        for (let attempt = 1; attempt < _a.#RATE_LIMITED_ATTEMPTS
+            && !result.ok
+            && result.reason === "rate_limited"
+            && !this.#closed; attempt++) {
+            const waitMs = Math.min(result.retry_after_ms !== undefined ? result.retry_after_ms : _a.#RATE_LIMITED_FALLBACK_MS, _a.#RATE_LIMITED_MAX_WAIT_MS);
+            this.#logger.info("session.relay.submit.throttled", {
+                relayPeerId: this.#relayPeerId,
+                sessionShort: sessionIdHex.slice(0, 16),
+                attempt,
+                waitMs,
+                retryAfterMsFromRelay: result.retry_after_ms,
+                impact: "the relay is throttling this sender; waiting out its stated window and resubmitting — the message is NOT lost and the operator is not told, because this clears on its own",
+            });
+            await new Promise((r) => setTimeout(r, waitMs));
+            if (this.#closed)
+                break;
+            result = await this.#doSubmitOnce(node, sessionId, contentHash, leafKind, contentBytes, carried);
+        }
+        if (!result.ok && result.reason === "rate_limited") {
+            // Option 2, the fallback: it did not clear within our budget, so the caller must hear it
+            // rather than be told the message was witnessed.
+            this.#logger.warn("session.relay.submit.throttle_persisted", {
+                relayPeerId: this.#relayPeerId,
+                sessionShort: sessionIdHex.slice(0, 16),
+                attempts: _a.#RATE_LIMITED_ATTEMPTS,
+                impact: "this message was NOT witnessed by the relay — it has no sequence number and will not appear in the notarized record",
+            });
+        }
+        // The relay lost a session we had successfully recorded — sealed, idle-swept, or restarted.
+        // Report THAT, rather than letting the caller read a bare `session_not_found` that reads like
+        // the first-message race. Never re-present here: recreating it is the resurrection above.
+        if (recordedBefore && !result.ok && result.reason === "session_not_found") {
+            this.#logger.warn("session.relay.session.gone", {
+                relayPeerId: this.#relayPeerId,
+                sessionShort: sessionIdHex.slice(0, 16),
+                guidance: "the relay no longer holds a session it had recorded (sealed, idle-swept, or restarted) — not re-presented, because that would recreate it with an empty leaf log",
+            });
+            return { ok: false, reason: "relay_session_gone" };
+        }
+        return result;
+    }
+    async #doSubmitOnce(node, sessionId, contentHash, leafKind, contentBytes, carried) {
+        if (this.#closed)
+            return { ok: false, reason: "relay_client_closed" };
+        if (!(await this.#ensureConnected(node))) {
+            /**
+             * ─── OUR OWN DEAD CREDENTIAL IS NOT A RELAY OUTAGE — `DOD-M15-TOKENSTALE-1` ───────────────
+             *
+             * `#ensureConnected` answers with a BOOLEAN, so every reason a relay ever gave for refusing
+             * us arrived here as `false` and left as `relay_unavailable`. That word is a claim about the
+             * RELAY: unreachable, transient, someone else's, and the documented grounds on which a send
+             * appends an unwitnessed leaf and still reports success.
+             *
+             * An expired online token is the opposite on all four counts, and the cost of the mislabel is
+             * not cosmetic. Measured live 2026-09-10: an agent ran for over two days answering
+             * `ok:true, delivered:true` to every send while the relay refused all thirteen of its
+             * authentications. Nothing it said in that time could ever produce a receipt, and no surface
+             * anywhere said so — because the one place that knew called it a relay problem.
+             *
+             * `#lastAuthRefusal` already held the truth (`cello status` reads it); the submit path simply
+             * never looked. Only LOCAL refusals are promoted: a genuine relay fault keeps
+             * `relay_unavailable`, so this is a split rather than a rename, and the caller's existing
+             * degradation for a real outage is untouched.
+             */
+            const refusal = this.#lastAuthRefusal;
+            if (refusal && isLocalCredentialRefusal(refusal.reason)) {
+                /**
+                 * ⚠️ THE PROSE ONCE PER TRANSITION, THE REASON EVERY TIME — review F6.
+                 *
+                 * This condition lasts until a relogin by construction, and every send retries it. Logging
+                 * several hundred bytes of explanation on each one is the shape `96f3179b` measured four
+                 * commits earlier: a 176 MB log that was 95% one already-fixed defect repeating itself,
+                 * which hid the defect that produced it for eleven hours. The first occurrence carries
+                 * everything; the rest are countable without being unreadable.
+                 */
+                const firstOfThisRun = this.#loggedCredentialRefusal !== refusal.reason;
+                this.#loggedCredentialRefusal = refusal.reason;
+                if (firstOfThisRun) {
+                    this.#logger.error("session.relay.submit.local_credential_refusal", {
+                        relayPeerId: this.#relayPeerId,
+                        reason: refusal.reason,
+                        impact: "the relay refused THIS AGENT'S credential, so nothing it sends can be witnessed and no " +
+                            "conversation can produce a receipt. This is a fault on this machine and it does not " +
+                            "clear on its own — it is NOT the relay being unreachable.",
+                        guidance: refusal.advice,
+                    });
+                }
+                else {
+                    this.#logger.warn("session.relay.submit.local_credential_refusal.again", {
+                        relayPeerId: this.#relayPeerId, reason: refusal.reason,
+                    });
+                }
+                return { ok: false, reason: refusal.reason };
+            }
+            return { ok: false, reason: "relay_unavailable" };
+        }
+        const sessionIdHex = Buffer.from(sessionId).toString("hex");
+        // The relay records the session from the CLIENT-presented assignment. It MUST be recorded BEFORE
+        // the first hash_submit — the relay rejects a submit for an unknown session. Idempotent + no-op when
+        // there is no assignment to present (direct/persisted sessions). Runs inline on the submit chain (no re-chaining
+        // — #doSubmit is already a chain link), and may reset the stream on failure, so capture #stream after.
+        const recorded = await this.#doRecord(node, sessionIdHex);
+        const sess = this.#sessions.get(sessionIdHex);
+        if (!recorded && sess?.assignment) {
+            // DOD-FIRSTMSG-WITNESS-1 AC3: do NOT send a hash_submit for a session we know the relay does
+            // not hold. Previously this return value was discarded and the doomed frame went out anyway —
+            // the line this defect's producer→consumer trace names as THE gap. Two sub-states, kept apart:
+            //   - recordRejected  → TERMINAL (the relay refused the assignment as unverifiable). Retrying
+            //                       cannot help and would storm the shared stream.
+            //   - anything else   → the record is in flight or transiently failed. Retryable.
+            // A session with NO assignment to present (direct/legacy) is not covered here: #doRecord
+            // returns true for it, so it still submits exactly as before.
+            if (sess.recordRejected)
+                return { ok: false, reason: "relay_assignment_rejected" };
+            // A TIMEOUT IS NOT "NOT READY YET". The retry below exists for a relay that has not finished
+            // registering the session — it answers in milliseconds. A record that timed out means the relay
+            // is not answering at all, and retrying spends HASH_SUBMIT_TIMEOUT_MS again per attempt on the
+            // chain SHARED by every session this agent holds on this relay. Classifying it as unreachable
+            // proceeds unwitnessed immediately, which is what AC2 asks for on an outage — the send is not
+            // lost, and one sick relay cannot hold an operator's other conversations for half a minute.
+            if (sess.recordTimedOut)
+                return { ok: false, reason: "relay_unavailable" };
+            return { ok: false, reason: "session_not_recorded" };
+        }
+        const stream = this.#stream;
+        if (!stream)
+            return { ok: false, reason: "relay_unavailable" };
+        /**
+         * ─── WHAT THIS SEND ACKNOWLEDGES — 033-ACKEMIT ───────────────────────────────────────────────
+         *
+         * This session's OWN high-water mark (NOT an agent-global one) — the relay's seq_counter is per
+         * session and rejects `last_seen_seq > seq_counter` — AND the content hash at that position,
+         * read from the one entry that holds both.
+         */
+        const lastSeen = this.#lastSeen.get(sessionIdHex);
+        /**
+         * ⚠️ **THIS COMMENT USED TO SAY "REFUSED, NOT DOWNGRADED", AND THE CODE UNDER IT DID REFUSE.**
+         * It is rewritten rather than deleted because a comment asserting a refusal that no longer
+         * happens is how the next reader comes to believe a guard exists where there is a fallback.
+         *
+         * There is no seed only when this session was registered with neither a genesis nor an
+         * assignment to derive one from, AND nothing has been received on it. The claim that goes out
+         * then is `last_seen_seq: 0` with no hash — "I have seen nothing of yours" — which is true and
+         * asserts nothing about content, so it is not the unbacked number this unit exists to stop
+         * signing. A claim that NAMES a position with no hash is the defect, and the receiving daemon
+         * refuses exactly that.
+         */
+        /**
+         * ⚠️ NOT FOR A CARRIED LEAF — 034-CARRYLEAF review F8. This branch describes THIS agent having
+         * nothing to acknowledge, and on a counter-submit the acknowledgement inside the bytes is the
+         * AUTHOR's, already made. Logging "this submit acknowledges nothing" about it would be false,
+         * and this daemon's own seed is irrelevant to a claim it did not write.
+         */
+        /**
+         * ⚠️ THE `session.relay.submit.unacknowledged` LOG THAT WAS HERE IS GONE, AND ITS ABSENCE IS
+         * DELIBERATE — `DOD-M15-SELFCHAIN-1`.
+         *
+         * It fired on exactly the condition the refusal below fires on (no seed, not a carried leaf)
+         * and told the operator "the leaf is witnessed as normal". That is now false: nothing is
+         * witnessed, the submit is refused. Two lines about one condition, one of them wrong, is how a
+         * reader ends up trusting the wrong one — so the refusal below is the only thing that speaks.
+         */
+        // The published encoder from protocol-types — the ONE definition of the field order, pinned by
+        // `structure1-canonical.json` (v1) and `structure1-v2-canonical.json` (v2). A second local copy
+        // lived here until 020-ACKHASH; it drifted, and the drift was invisible because both copies
+        // "worked": it encoded a timestamp above 2^32-1 as a CBOR float64 while the published encoder
+        // (and every other TBS builder in this package) promotes it to a uint64. Same value, different
+        // signed bytes, and only the vector said which was canonical.
+        //
+        // `lastSeenHash` is passed on EVERY send, so every claim this daemon signs is v2 and binds to
+        // content. Nothing here ever passes `undefined` — see the refusal above.
+        /**
+         * ⚠️ **A CARRIED LEAF IS SENT VERBATIM AND SIGNED BY NOBODY HERE — 034-CARRYLEAF.**
+         *
+         * When this agent is witnessing something it RECEIVED, the claim already exists: its author
+         * built it, signed it, and put it on the content frame. Re-encoding it would change the signed
+         * bytes and the relay would refuse a leaf that is perfectly valid. Signing it ourselves would be
+         * worse — it would turn their statement into ours, which is the one thing that must never happen
+         * to a record whose whole value is that each party's words are their own.
+         *
+         * So this branch takes the bytes as they arrived, and this agent's own acknowledgement state is
+         * deliberately NOT consulted: `last_seen_seq` and `last_seen_hash` inside those bytes are the
+         * AUTHOR's account of what THEY had seen, and they are not ours to restate.
+         */
+        /**
+         * ─── BOTH CHAIN LINKS, UNCONDITIONALLY — `DOD-M15-SELFCHAIN-1` ───────────────────────────────
+         *
+         * `lastSeenHash` chains this sender to their COUNTERPARTY. `prevOwnHash` chains them to
+         * THEMSELVES. Neither is optional: a claim carrying one link is not a shape this protocol has,
+         * and `encodeStructure1` has no branch that emits one.
+         *
+         * ⚠️ THE CONDITIONAL SPREAD THAT USED TO BE HERE DEFEATED THE TYPE. Writing
+         * `...(x ? { lastSeenHash: x } : {})` satisfies a REQUIRED field as far as the compiler is
+         * concerned, so the one guard that should have made an unlinked claim impossible to write was
+         * silently inert. Pass both by value; let `tsc` do its job.
+         *
+         * ⚠️ NO SEED MEANS NO SEND. The seed is this session's genesis — the agreed starting point both
+         * links fall back to before anything has been said. A session registered with neither a genesis
+         * nor an assignment to derive one from has no such point, and the honest outcome is to refuse
+         * rather than sign a chain anchored to nothing. There is no degraded shape to fall back to and
+         * deliberately so: an unlinked message is invisible until the conversation's order is disputed,
+         * which is far too late for anyone to act on it.
+         */
+        const seed = lastSeen?.hash;
+        const genesis = this.#genesis.get(sessionIdHex);
+        if (!carried && !seed) {
+            this.#logger.error("session.relay.submit.unchainable", {
+                relayPeerId: this.#relayPeerId,
+                session: sessionIdHex,
+                impact: "this session has no recorded starting point on this machine, so a message sent on it " +
+                    "could not link to anything and its place in the conversation could never be proven. " +
+                    "The message was NOT sent. Restart the session so it is registered with its genesis.",
+            });
+            return { ok: false, reason: "session_unchainable" };
+        }
+        /**
+         * This agent's own previous message, or the session genesis when it has not spoken here yet.
+         * "I have not spoken" is a VALUE — derived per session, so it cannot be presented for a
+         * different conversation — never an absent field.
+         *
+         * The in-memory map first, then the durable store for the restart case, then the genesis. See
+         * `#ownChain` for why a missing store degrades durability rather than blocking the send.
+         */
+        let prevOwn;
+        if (!carried) {
+            /**
+             * ⚠️ THE LAST FALLBACK IS THE GENESIS, NOT `seed` — and `seed` is what it used to be.
+             *
+             * `seed` is `#lastSeen`, which ADVANCES as the counterparty speaks. So the moment the
+             * counterparty had said anything, a party sending their FIRST message linked to the
+             * counterparty's message instead of to the session's starting point. The relay expects the
+             * genesis for a sender's first leaf, so it refused — and then told the counterparty, who had
+             * done nothing, that this side's chain was broken. Every two-party conversation died on its
+             * second message and blamed the wrong party for it.
+             */
+            prevOwn = this.#ownChain.get(sessionIdHex)
+                ?? this.#ownChainStore?.lastOwnHash(this.senderPubkeyHex, sessionIdHex)
+                ?? genesis;
+            if (!prevOwn) {
+                /**
+                 * Unreachable while a seed exists — both come from the same registration — but stated as a
+                 * refusal rather than a non-null assertion. The one thing that must never happen here is
+                 * signing a self link chosen because it was the nearest value to hand.
+                 */
+                this.#logger.error("session.relay.submit.unchainable", {
+                    relayPeerId: this.#relayPeerId,
+                    session: sessionIdHex,
+                    impact: "this session has an acknowledgement but no recorded starting point, so this agent's " +
+                        "own first message has nothing to link to. The message was NOT sent. Restart the " +
+                        "session so it is registered with its genesis.",
+                });
+                return { ok: false, reason: "session_unchainable" };
+            }
+        }
+        /**
+         * ⚠️ **A CARRIED LEAF IS SENT VERBATIM AND SIGNED BY NOBODY HERE — 034-CARRYLEAF.**
+         *
+         * When this agent is witnessing something it RECEIVED, the claim already exists: its author
+         * built it, signed it, and put it on the content frame. Re-encoding it would change the signed
+         * bytes and the relay would refuse a leaf that is perfectly valid. Signing it ourselves would be
+         * worse — it would turn their statement into ours, which is the one thing that must never happen
+         * to a record whose whole value is that each party's words are their own.
+         *
+         * So this branch takes the bytes as they arrived, and this agent's own chain state is
+         * deliberately NOT consulted: both links inside those bytes are the AUTHOR's account, and they
+         * are not ours to restate.
+         */
+        const structure1 = carried ? carried.structure1Cbor : encodeStructure1({
+            contentHash,
+            senderPubkey: this.#senderPubkey,
+            sessionId,
+            lastSeenSeq: lastSeen.seq,
+            timestamp: Date.now(),
+            lastSeenHash: seed,
+            prevOwnHash: prevOwn,
+        });
+        const signature = carried ? carried.senderSignature : await this.#keyProvider.sign(structure1);
+        const frame = encodeCbor({
+            type: "hash_submit",
+            session_id: sessionId,
+            leaf_kind: leafKind,
+            structure1_cbor: structure1,
+            sender_signature: signature,
+            /**
+             * `DOD-M15-SEALWIRE-1` bullets 3+4 — the SEAL payload, and ONLY on a ctrl leaf.
+             *
+             * ⚠️ MY REASON FOR THE SPREAD WAS MEASURABLY WRONG, AND THE TRUE RISK IS THE OPPOSITE ONE —
+             * review pass 2, MEDIUM-3, corrected rather than deleted.
+             *
+             * It said an explicit `content_bytes: undefined` *"encodes as a present CBOR key, and the
+             * relay's guard refuses a present-but-unusable value by voiding the whole frame — that would
+             * turn every ordinary message into a refused submit."* Measured through the production encoder:
+             * the key IS emitted (0xf7), but it decodes back to `undefined`, so the relay's guard never
+             * fires and the frame is **accepted with no payload**.
+             *
+             * So the mutation does not produce a loud federation-wide refusal. It produces a silent
+             * `not_carried` at the directory — exactly the silent downgrade this whole unit exists to kill,
+             * and a far worse outcome than the one I warned about. Writing the scarier consequence would
+             * have sent the next reader hunting an availability bug instead of a mute one.
+             *
+             * The spread is still correct, and the ANCHOR test is what pins it: `"content_bytes" in frame`
+             * is TRUE for the `undefined` mutant precisely because the key is present, so that assertion —
+             * not the relay — is what catches this.
+             *
+             * `submitLeaf` has already established that this is set if and only if `leafKind` is ctrl, and
+             * that the bytes are a SEAL payload for this session hashing to the signed `content_hash` —
+             * every direction refused there, at ERROR, before anything reaches the wire.
+             */
+            ...(contentBytes !== null ? { content_bytes: contentBytes } : {}),
+        });
+        // Set the resolver synchronously (no await between the in-flight check and the set):
+        // the submit chain guarantees no other submit runs concurrently, so #pendingAck is null.
+        let resolveAck;
+        const ackPromise = new Promise((r) => { resolveAck = r; });
+        this.#pendingAck = resolveAck;
+        this.#pendingAckSessionHex = sessionIdHex;
+        // Remember this submit's sender-signed structure1_cbor so its ack can return the full
+        // ordering record (the ack itself carries only the relay's structure2_cbor).
+        this.#pendingStructure1 = structure1;
+        this.#pendingSignature = signature;
+        this.#pendingLeafKind = leafKind;
+        try {
+            stream.send(lp.encode.single(frame));
+        }
+        catch (err) {
+            if (this.#pendingAck === resolveAck) {
+                this.#pendingAck = null;
+                this.#pendingAckSessionHex = null;
+                this.#pendingStructure1 = null;
+                this.#pendingSignature = null;
+                this.#pendingLeafKind = null;
+            }
+            this.#logger.warn("session.relay.submit.send.failed", { relayPeerId: this.#relayPeerId, error: extractErrorMessage(err) });
+            return { ok: false, reason: "relay_submit_send_failed" };
+        }
+        let timer;
+        const timeout = new Promise((r) => {
+            timer = setTimeout(() => r({ ok: false, reason: "relay_submit_timeout" }), HASH_SUBMIT_TIMEOUT_MS);
+        });
+        try {
+            const result = await Promise.race([ackPromise, timeout]);
+            // On timeout, reset the stream so a late ack can't settle a LATER submit (FIFO desync).
+            if (!result.ok && result.reason === "relay_submit_timeout")
+                this.#resetStream();
+            /**
+             * ─── ADVANCE THE SELF CHAIN, AND ONLY ON SUCCESS — `DOD-M15-SELFCHAIN-1` ──────────────────
+             *
+             * Recorded AFTER the relay acknowledged, never before. Advancing first and then failing to
+             * send would leave the chain pointing at a message that never existed, and every later message
+             * would be refused by the counterparty with a reason that names tampering — an outage
+             * reported as an attack.
+             *
+             * A retry therefore re-reads the same predecessor, which is exactly right: a retransmission is
+             * the same message, not the next one.
+             *
+             * NOT for a carried leaf. Those bytes are the AUTHOR's and this agent did not write them, so
+             * they are no part of this agent's own chain.
+             */
+            if (result.ok && !carried) {
+                // The map is the chain — always advanced. The store is its durability, advanced when wired.
+                this.#ownChain.set(sessionIdHex, contentHash);
+                try {
+                    this.#ownChainStore?.record(this.senderPubkeyHex, sessionIdHex, contentHash, Date.now());
+                }
+                catch (err) {
+                    this.#logger.error("session.selfchain.record.failed", {
+                        session: sessionIdHex,
+                        error: extractErrorMessage(err),
+                        impact: "this message was witnessed, but this agent could not record it as the link for its " +
+                            "next message — so the next one will chain to the wrong predecessor and the " +
+                            "counterparty will refuse it. Restart the session to re-anchor the chain.",
+                    });
+                }
+            }
+            return result;
+        }
+        finally {
+            clearTimeout(timer);
+            if (this.#pendingAck === resolveAck) {
+                this.#pendingAck = null;
+                this.#pendingAckSessionHex = null;
+                this.#pendingStructure1 = null;
+                this.#pendingSignature = null;
+                this.#pendingLeafKind = null;
+            }
+        }
+    }
+    /**
+     * Advance this session's acknowledgement from a message that ARRIVED — 033-ACKEMIT review F1.
+     *
+     * ⚠️ **`#bumpLastSeen` used to have exactly one caller, inside the `leaf_deliver` handler, so the
+     * acknowledgement tracked what the RELAY DELIVERED rather than what was RECEIVED.** On a direct
+     * session that is a real difference: the content arrives peer-to-peer and the relay's copy of the
+     * leaf follows separately, so until it did, this daemon signed an acknowledgement one message
+     * behind what it had actually read — and on a session where delivery never came back at all, the
+     * acknowledgement never moved.
+     *
+     * The order's own words are "the content hash of the last message this sender ACTUALLY RECEIVED".
+     * This is the caller that makes that true: the receive path calls it as soon as a message has been
+     * verified and ingested at a known canonical position.
+     *
+     * **THE POSITION IS STILL REQUIRED, and that is a real limit rather than an oversight.** The pair
+     * is (position, content-at-position), and the relay refuses a `last_seen_seq` that runs ahead of
+     * its counter — so a message that arrived with NO ordering record cannot be acknowledged by
+     * position at all, whatever we hold of it. That case is the withheld-submit attack itself, and it
+     * is closed by carrying the sender's signed leaf into the seal, not from here.
+     */
+    noteReceivedLeaf(sessionIdHex, relaySeq, contentHash) {
+        this.#bumpLastSeen(sessionIdHex, relaySeq, contentHash);
+    }
+    /**
+     * The POSITION and the CONTENT AT IT together — 033-ACKEMIT.
+     *
+     * ⚠️ **IT REPLACED `lastSeenSeq()`, WHICH IS DELETED RATHER THAN LEFT WIRED.** That accessor
+     * returned the position alone, and `session-node-manager`'s unwitnessed content claim was its
+     * only caller. Leaving it in place after this one took over would leave a second way to read half
+     * of a pair that must be read whole: a `last_seen_seq` paired with a `last_seen_hash` for a
+     * different message is worse than no acknowledgement at all, because it looks checkable and
+     * fails.
+     *
+     * `undefined` means this session has no acknowledgement to make, which the caller must handle
+     * rather than fill in.
+     */
+    lastSeenAck(sessionIdHex) {
+        return this.#lastSeen.get(sessionIdHex);
+    }
+    /**
+     * This agent's OWN last message on a session — what its next message's self link must name.
+     *
+     * ⚠️ EXPOSED BECAUSE THERE MUST BE ONE CHAIN, NOT TWO. The unwitnessed send path lives in
+     * `session-node-manager` and was reading only the durable store, while the witnessed path reads
+     * this in-memory map first. A session that mixed the two — which is every session where the relay
+     * comes and goes — was walking two different chains, and the one that lagged produced a link the
+     * counterparty refuses.
+     *
+     * `undefined` means this agent has not spoken on this session yet, which is the session GENESIS
+     * and not an absence. The caller supplies it; this class does not guess.
+     */
+    lastOwnHash(sessionIdHex) {
+        return this.#ownChain.get(sessionIdHex)
+            ?? this.#ownChainStore?.lastOwnHash(this.senderPubkeyHex, sessionIdHex)
+            ?? undefined;
+    }
+    /**
+     * Record what this agent just sent on a path this client did not carry — the UNWITNESSED send.
+     *
+     * The two paths share one chain (see `lastOwnHash`), so a direct send has to advance it here too.
+     * Without this, a conversation that ran while the relay was down advanced nothing, and the first
+     * witnessed message after it linked to something long superseded.
+     */
+    noteOwnLeaf(sessionIdHex, contentHash) {
+        this.#ownChain.set(sessionIdHex, contentHash);
+        this.#ownChainStore?.record(this.senderPubkeyHex, sessionIdHex, contentHash, Date.now());
+    }
+    close() {
+        this.#closed = true;
+        this.#settlePending({ ok: false, reason: "relay_client_closed" });
+        // Settle any in-flight record so #doRecord resolves promptly.
+        {
+            const r = this.#pendingRecord;
+            this.#pendingRecord = null;
+            if (r)
+                r("closed");
+        }
+        const stream = this.#stream;
+        this.#stream = null;
+        if (stream) {
+            try {
+                void stream.close();
+            }
+            catch { /* best-effort */ }
+        }
+    }
+}
+_a = AgentRelayClient;
+//# sourceMappingURL=session-relay-client.js.map