@cello-protocol/daemon 0.0.227 → 0.0.229

package/dist/park-recovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"park-recovery.js","sourceRoot":"","sources":["../src/park-recovery.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,uBAAuB,EAA0B,MAAM,oBAAoB,CAAC;AAElI,OAAO,EAAqE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AACxI,OAAO,EAAE,iBAAiB,EAAwB,MAAM,oBAAoB,CAAC;AAC7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AA4DzD,MAAM,OAAO,YAAY;IACd,IAAI,CAAc;IAE3B,YAAY,GAAgB,EAAE,qBAA6B;QACzD,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;QAChB,IAAI,CAAC,sBAAsB,GAAG,qBAAqB,CAAC;IACtD,CAAC;IAED;;;OAGG;IACH,gBAAgB,CAAC,GAAW;QAC1B,IAAI,CAAC,0BAA0B,GAAG,GAAG,CAAC;IACxC,CAAC;IAED,mBAAmB,GAAG,CAAC,CAAC;IACxB,eAAe,GAAG,4BAA4B,CAAC;IAC/C,gBAAgB,GAEL,IAAI,CAAC;IAChB,8FAA8F;IAC9F,gBAAgB,GAAoE,IAAI,CAAC;IACzF,6BAA6B,GAAG,KAAK,CAAC;IACtC;;;;;OAKG;IACH;;;;OAIG;IACM,qBAAqB,GAAG,IAAI,GAAG,EAA2B,CAAC;IACpE,0BAA0B,GAAG,CAAC,CAAC;IAC/B,6GAA6G;IAC7G,sBAAsB,CAAS;IAC/B,+DAA+D;IAC/D,eAAe,CAAC,KAAa,EAAE,KAAc;QAC3C,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC9C,IAAI,KAAK;YAAE,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC;QACxC,OAAO,IAAI,CAAC,mBAAmB,CAAC;IAClC,CAAC;IACD,0FAA0F;IAC1F,qBAAqB;QACnB,OAAO,IAAI,CAAC,mBAAmB,CAAC;IAClC,CAAC;IACD;;;;;;;;;;;;OAYG;IACH,kBAAkB,CAChB,EAAoa;QAEpa,IAAI,CAAC,gBAAgB,GAAG,EAAE,CAAC;IAC7B,CAAC;IACD;;;;;;;;;OASG;IACH,kBAAkB,CAAC,EAA0D;QAC3E,IAAI,CAAC,gBAAgB,GAAG,EAAE,CAAC;IAC7B,CAAC;IACD,8FAA8F;IAC9F,eAAe,CAAC,SAAiB,EAAE,MAAyB;QAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC;QACnC,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE;YAAE,OAAO;QACrC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,2FAA2F;YAC3F,2FAA2F;YAC3F,0FAA0F;YAC1F,kDAAkD;YAClD,IAAI,CAAC,IAAI,CAAC,6BAA6B,EAAE,CAAC;gBACxC,IAAI,CAAC,6BAA6B,GAAG,IAAI,CAAC;gBAC1C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,OAAO;QACT,CAAC;QACD,wFAAwF;QACxF,0FAA0F;QAC1F,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAChF,IAAI,CAAC;YACH,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE;gBACzD,SAAS;gBACT,MAAM;gBACN,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC;aAChC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD;;;;;;;;;OASG;IACH;;;;;;;;;OASG;IACH,KAAK,CAAC,WAAW,CAAC,SAAiB,EAAE,SAAiB,EAAE,cAAsB,EAAE,OAAmB,EAAE,cAAsC,EAAE,cAAsC,EAAE,cAAkC,EAAE,mBAAgC,EAAE,YAAqB;QAC9Q,gGAAgG;QAChG,wFAAwF;QACxF,IAAI,IAAI,CAAC,mBAAmB,GAAG,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC,mBAAmB,IAAI,CAAC,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE;gBACnD,SAAS;gBACT,WAAW,EAAE,cAAc;gBAC3B,MAAM,EAAE,+BAA+B;gBACvC,KAAK,EAAE,IAAI,CAAC,eAAe;gBAC3B,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC;QAC7D,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;QAChF,0FAA0F;QAC1F,gGAAgG;QAChG,gGAAgG;QAChG,+FAA+F;QAC/F,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,UAAU;YAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;QACnG,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC;gBACxB,iFAAiF;gBACjF,SAAS;gBACT,SAAS;gBACT,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;gBAC5C,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,cAAc;gBACd,OAAO;gBACP,gGAAgG;gBAChG,sGAAsG;gBACtG,cAAc;gBACd,cAAc;gBACd,4FAA4F;gBAC5F,sFAAsF;gBACtF,mBAAmB;gBACnB,wFAAwF;gBACxF,QAAQ,EAAE,YAAY;gBACtB,0FAA0F;gBAC1F,iFAAiF;gBACjF,cAAc;aACf,CAAC,CAAC;YACH,4FAA4F;YAC5F,0FAA0F;YAC1F,6FAA6F;YAC7F,oBAAoB;YACpB,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE;oBACnD,SAAS;oBACT,WAAW,EAAE,cAAc;oBAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,KAAK,EAAE,MAAM,CAAC,KAAK;iBACpB,CAAC,CAAC;gBACH,OAAO;oBACL,OAAO,EAAE,SAAS;oBAClB,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM;oBACpC,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACpF,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB;;;;;;;;;;;;eAYG;YACH,MAAM,KAAK,GAAG,GAAG,YAAY,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YAC5D,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE;gBACnD,SAAS;gBACT,WAAW,EAAE,cAAc;gBAC3B,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;gBACzE,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC;aAChC,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,SAAS;gBAClB,KAAK,EAAE,KAAK,EAAE,MAAM,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;aACnD,CAAC;QACJ,CAAC;IACH,CAAC;IACD;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,aAAa,CACjB,SAAiB,EACjB,SAAiB,EACjB,WAAmB,EACnB,OAAmB;QAEnB,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC;QACnC,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;QAChF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAChE,MAAM,kBAAkB,GAAG,KAAK,EAAE,kBAAkB,IAAI,MAAM,EAAE,mBAAmB,CAAC;QACpF,MAAM,KAAK,GAAG,KAAK,EAAE,WAAW,IAAI,KAAK,EAAE,UAAU;YACnD,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE;YAClE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC3D;;;;WAIG;QACH,IAAI,CAAC,kBAAkB;YAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC;QAC1F,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;QAC/C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC;gBACxB,SAAS;gBACT,SAAS;gBACT,kBAAkB;gBAClB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,cAAc,EAAE,WAAW;gBAC3B,OAAO,EAAE,OAAO;gBAChB,cAAc,EAAE,SAAS;aAC1B,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YACpF,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;QACjE,CAAC;IACH,CAAC;IAED;;oEAEgE;IAChE;;;;OAIG;IACH,6BAA6B,CAAC,SAAiB,EAAE,SAAiB;QAChE,OAAO,IAAI,CAAC,sBAAsB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC3D,CAAC;IACD;;;;;;;;;OASG;IACH,sBAAsB,CAAC,SAAiB,EAAE,SAAiB;QACzD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QACpD,gGAAgG;QAChG,+FAA+F;QAC/F,gGAAgG;QAChG,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE;gBACxD,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,uBAAuB;gBACrD,MAAM,EAAE,6GAA6G;aACtH,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,GAA8B,CAAC;QACnC,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,SAAS,CAAC;iBAC/C,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,cAAc,IAAI,CAAC,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC;QACnF,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE;gBACxD,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB;gBACjD,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC;gBAC/B,MAAM,EAAE,6GAA6G;aACtH,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,GAAG;YAAE,OAAO,MAAM,CAAC;QACxB,IAAI,CAAC;YACH,6FAA6F;YAC7F,0FAA0F;YAC1F,mBAAmB;YACnB,MAAM,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YAChD,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBACX,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE;oBACxD,yFAAyF;oBACzF,4FAA4F;oBAC5F,uFAAuF;oBACvF,4FAA4F;oBAC5F,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,0BAA0B,EAAE,gBAAgB,EAAE,EAAE,CAAC,MAAM;oBACrF,MAAM,EAAE,6GAA6G;iBACtH,CAAC,CAAC;gBACH,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC1E,OAAO;gBACL,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,mBAAmB,CAAC,cAAc,CAAC;gBACnG,cAAc,EAAE,GAAG,CAAC,cAAc;aACnC,CAAC;QACJ,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,8FAA8F;YAC9F,2FAA2F;YAC3F,4FAA4F;YAC5F,0CAA0C;YAC1C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE;gBACxD,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,4BAA4B;gBAC1D,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC;gBAC/B,MAAM,EAAE,6GAA6G;aACtH,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,kBAAkB,CACtB,SAAiB,EACjB,SAAiB,EACjB,eAA2B,EAC3B,QAAoB,EACpB,WAAuB,EACvB,aAAsB;QA8BtB,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAEhE,gGAAgG;QAChG,8FAA8F;QAC9F,8FAA8F;QAC9F,+FAA+F;QAC/F,8FAA8F;QAC9F,8FAA8F;QAC9F,MAAM,UAAU,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,IAAI,cAAc,EAAE,CAAC;QACrF,MAAM,UAAU,GAAG,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9D,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE;gBACvD,SAAS;gBACT,SAAS;gBACT,WAAW,EAAE,cAAc;gBAC3B,MAAM,EAAE,UAAU;gBAClB,MAAM,EAAE,IAAI;gBACZ,aAAa;aACd,CAAC,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QAC3C,CAAC;QAED,MAAM,GAAG,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,uBAAuB,CAAC;YACtC,GAAG;YACH,YAAY,EAAE,SAAS;YACvB,eAAe;YACf,WAAW;YACX,qBAAqB,EAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,mBAAmB;SAC7F,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,qFAAqF;YACrF,gFAAgF;YAChF,IAAI,CAAC,0BAA0B,CAAC,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAC5D,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE;gBACvD,SAAS;gBACT,SAAS;gBACT,WAAW,EAAE,cAAc;gBAC3B,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,eAAe,EAAE,GAAG,CAAC,OAAO;gBAC5B,aAAa;aACd,CAAC,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QAC/C,CAAC;QAED;;;;;;;;;;;;;;;;;WAiBG;QACH,MAAM,SAAS,GAAG,uBAAuB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvD,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE;gBACrD,SAAS,EAAE,SAAS,EAAE,aAAa;gBACnC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAC/D,WAAW,EAAE,cAAc;aAC5B,CAAC,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;QAC9C,CAAC;QAED,uFAAuF;QACvF,yFAAyF;QACzF,6FAA6F;QAC7F,+CAA+C;QAC/C,4FAA4F;QAC5F,2FAA2F;QAC3F,IAAI,YAAY,GAAkB,IAAI,CAAC;QACvC,IAAI,GAAG,CAAC,cAAc,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;YAC7C,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;QAC1I,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE;YAChD,SAAS;YACT,SAAS;YACT,WAAW,EAAE,cAAc;YAC3B,aAAa;SACd,CAAC,CAAC;QAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAiCG;QACH;;;;;;;;;;;;;WAaG;QACH,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,SAAS,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;QACrG;;;;;;WAMG;QACH;;;;;;;;;;;;;;;;;;;;;WAqBG;QACH,MAAM,oBAAoB,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,SAAS,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;QAC7G,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAClD,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,IAAI,SAAS;QACxF,uFAAuF;QACvF,oEAAoE;QACpE,GAAG,CAAC,cAAc,CACnB,CAAC;QACF;;;;;;;;;;;;;;;;;;;;WAoBG;QACH;;;;;;;;;;;;;;;;;;WAkBG;QACH,IACE,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI;YAChE,YAAY,KAAK,IAAI,IAAI,GAAG,CAAC,cAAc,IAAI,GAAG,CAAC,mBAAmB,EACtE,CAAC;YACD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;YAC1B,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7B,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;YACrI,CAAC;QACH,CAAC;QACD,IAAI,gBAAgB,KAAK,SAAS,IAAI,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YACvG,0FAA0F;YAC1F,yFAAyF;YACzF,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,SAAS,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;YAC5E,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE;gBAC9D,SAAS,EAAE,SAAS,EAAE,aAAa;gBACnC,WAAW,EAAE,cAAc;gBAC3B,gBAAgB;gBAChB,YAAY,EAAE,GAAG,CAAC,cAAc,IAAI,mBAAmB;gBACvD,MAAM,EAAE,uRAAuR;aAChS,CAAC,CAAC;QACL,CAAC;QACD;;;;;;;;;;;;;;;;;;;;WAoBG;QACH,IAAI,oBAAoB,IAAI,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YAC7F,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,wBAAwB,CAAC,SAAS,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;YAClF;;;;;;;;eAQG;YACH,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE;gBAC1D,SAAS,EAAE,SAAS,EAAE,aAAa;gBACnC,WAAW,EAAE,cAAc;gBAC3B,MAAM,EAAE,8dAA8d;gBACte,QAAQ,EAAE,wMAAwM;aACnN,CAAC,CAAC;QACL,CAAC;QACD;;;;;;;;;;;;WAYG;QACH,IAAI,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YACrE,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;QAC9E,CAAC;QACD;;;;;;;;;;;;;WAaG;QACH,IAAI,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC/D,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD;;;;;;OAMG;IACH,0BAA0B,CAAC,GAAW,EAAE,MAAuB;QAC7D,IAAI,IAAI,CAAC,qBAAqB,CAAC,IAAI,IAAI,0BAA0B,EAAE,CAAC;YAClE,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;YACxD,IAAI,CAAC,MAAM,CAAC,IAAI;gBAAE,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IACD;;;;;;;;;;;OAWG;IACH,uBAAuB,CAAC,GAAW;QACjC,IAAI,IAAI,CAAC,gBAAgB,KAAK,IAAI;YAAE,OAAO;QAC3C,IAAI,GAAG,GAAG,IAAI,CAAC,0BAA0B,GAAG,IAAI,CAAC,sBAAsB;YAAE,OAAO;QAChF,IAAI,CAAC,0BAA0B,GAAG,GAAG,CAAC;QACtC,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,CAAC;YAC3D,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC;gBAAE,SAAS,CAAC,qBAAqB;YAC7E,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;CACF"}

package/dist/park-refusals.d.ts

@@ -0,0 +1,147 @@
+/**
+ * CELLO Daemon — WHY A PARKED MESSAGE NEVER LEFT THE RELAY MAILBOX, said to the OPERATOR.
+ *
+ * `041-PARKSTUCK`. Every refusal the park drain can produce already had a `reason`, an `impact` and
+ * a `guidance` — written for a person, at ERROR, in `daemon.log`. None of them called
+ * `noteContentRefusal`, so no person ever received one. What the operator saw instead was the
+ * INGEST reason (`session_committed`), which says where the message was turned away on arrival and
+ * says nothing about why it will not leave: error substitution, in the one place there is no
+ * upstream for the reader to chase, because `daemon.log` is not an operator affordance.
+ *
+ * ⚠️ **A CLOSED SET WITH A TOTAL NOTICE MAP, for the reason `refusal-reasons.ts` gives.** The park
+ * drain pushed bare string literals into its refusal list, so a new branch could ship a reason the
+ * operator surface had never heard of and every test would stay green — a test cannot enumerate a
+ * code that does not exist yet, and a type can. Adding a member here without a notice below is a
+ * compile error.
+ *
+ * ⚠️ **THE GUIDANCE IS A FUNCTION OF THE SESSION'S STATUS, and that is the defect it exists to
+ * fix.** The salt branch's log line told operators *"this message will keep being re-pulled and
+ * re-refused until the session is closed, so close it and start a new one"* — for a session that
+ * had been closed three days earlier, which is what made the refusal permanent in the first place.
+ * Advice naming an action the reader already took is worse than silence: it spends the trust they
+ * would otherwise bring to the next notice.
+ */
+import { type RefusalKind } from "./refusal-reasons.js";
+/**
+ * Every reason the park drain can decline to file a parked message with.
+ *
+ * These are the ANNEX reasons — why the entry is STUCK — and they are deliberately distinct from
+ * the ingest reason that sits beside them on the same message. Both reach the inbox; the ingest one
+ * says the conversation is closed, this one says why the message cannot leave the mailbox.
+ */
+export declare const PARK_REFUSAL_REASONS: {
+    /** The sender named a salted algorithm and this side holds no usable salt for the session. */
+    readonly ANNEX_SALT_UNAVAILABLE: "annex_salt_unavailable";
+    /** The sender named a content-hash algorithm this build cannot compute. */
+    readonly ANNEX_ALG_UNKNOWN: "annex_alg_unknown";
+    /** The content does not match the hash the sender signed over. */
+    readonly ANNEX_HASH_MISMATCH: "annex_hash_mismatch";
+    /** The park envelope could not be decoded. */
+    readonly ANNEX_DECODE_FAILED: "annex_decode_failed";
+    /** The inbound screener was unreachable. TRANSIENT — the relay copy is kept and re-screened. */
+    readonly ANNEX_SCREEN_UNAVAILABLE: "annex_screen_unavailable";
+    /** The annex write itself ran and failed. */
+    readonly ANNEX_WRITE_FAILED: "annex_write_failed";
+    /**
+     * The inbound screener TERMINALLY blocked the content. Retained as quarantined evidence and
+     * deleted from the relay — the only park branch that destroys the remote copy on purpose.
+     *
+     * ⚠️ IT HAD NO OPERATOR SURFACE AT ALL — review M9. It is the branch with the strongest claim on
+     * an operator's attention (hostile bytes aimed at a conversation that is already closed) and the
+     * only one that deletes the relay's copy in silence, and its `impact` field was addressed to
+     * nobody. Unit 2's scope is every `content.recover.*` refusal, not only the one that loops.
+     */
+    readonly ANNEX_SCREENED_OUT: "annex_screened_out";
+};
+export type ParkRefusalReason = (typeof PARK_REFUSAL_REASONS)[keyof typeof PARK_REFUSAL_REASONS];
+/** What the notice writer knows about the message it is refusing. */
+export interface ParkRefusalContext {
+    /**
+     * The session's status as THIS daemon holds it, or `null` when the record could not be read.
+     *
+     * `null` is not "not terminal" — it is "we do not know", and the two must not collapse: the
+     * release in `content-park.ts` is gated on proven terminality, so an unreadable record keeps the
+     * relay copy rather than deleting it on an assumption.
+     */
+    readonly sessionStatus: string | null;
+    /**
+     * Has the relay copy been DELETED as a result of this refusal? Only the permanently-unverifiable
+     * exit sets it, and the sentence the operator reads changes completely on it.
+     */
+    readonly released: boolean;
+    /** The algorithm name the sender put in the envelope, or `(absent)`. */
+    readonly declaredAlg: string;
+    /**
+     * WHY there is no salt, for the salt branch only.
+     *
+     * `none` — no salt was ever agreed for this session. `unreadable` — a salt row EXISTS on this
+     * machine and could not be used (wrong width, or the read threw), which is local damage and sends
+     * the operator somewhere completely different. `null` for every other reason.
+     */
+    readonly saltReason: "none" | "unreadable" | null;
+    /**
+     * The thrown message, for the two reasons that come from a `catch`.
+     *
+     * Review M4: the upstream cause must survive downstream (Invariant 3). A notice that says "it
+     * threw" without saying what it said sends the operator back to the log for the one fact that
+     * would have told them whether this is their disk, their build, or the sender.
+     */
+    readonly errorDetail: string | null;
+    /**
+     * Did this daemon actually KEEP the bytes? — verification NEW-2.
+     *
+     * Only the screened-out notice reads it today, and it reads it because saying "it is KEPT as
+     * evidence" when the quarantine refused the write is the same unchecked claim H1 removed from the
+     * release. Defaults to `true` for reasons that retain nothing of their own to describe.
+     */
+    readonly retained?: boolean;
+}
+/**
+ * The two session statuses from which nothing can change back.
+ *
+ * `seal_interrupted_pending` is deliberately NOT here — `types.ts` documents it as explicitly
+ * non-terminal, and a session still moving toward a notarization is not a session whose inputs are
+ * immutable. Excluding it costs a few more drains on a rare state and keeps the release honest.
+ */
+export declare const TERMINAL_SESSION_STATUSES: ReadonlySet<string>;
+/**
+ * The operator-facing notice for each park refusal — TOTAL over the reason set.
+ *
+ * A function per reason rather than a string, because two of them must know whether the session is
+ * closed before they can say anything true about what to do next.
+ */
+export declare const PARK_REFUSAL_NOTICE: Record<ParkRefusalReason, (ctx: ParkRefusalContext) => {
+    kind: RefusalKind;
+    impact: string;
+    guidance: string;
+}>;
+/**
+ * ⚠️ **HOW OFTEN, NOT JUST HOW MANY — `041-PARKSTUCK` Unit 2, property 2.**
+ *
+ * A count with no cadence beside it reads as that many separate events. On the machine this was
+ * written for, ONE message had been refused 731 times in 64 hours and the notice said `731`, which
+ * an operator reads as 731 messages going wrong rather than one going wrong every five minutes.
+ *
+ * Says only what the stored row proves: the number of refusals of this reason on this conversation,
+ * and the average gap across the span they cover. It does NOT claim one message — a reason can fire
+ * for several — because the row cannot tell them apart.
+ *
+ * `null` below three refusals or across a zero span: two points are not a cadence, and dividing by a
+ * zero span would print an interval that is an artifact of the clock rather than of the behaviour.
+ */
+export declare function refusalRecurrence(total: number, firstAt: number, lastAt: number, 
+/**
+ * Is `total` an exact count or a FLOOR? — review M5.
+ *
+ * A row seeded at upgrade takes its total from a notice's `count`, which resets on dismissal, so
+ * both the count and the span are lower bounds. The drain five lines away already reports a
+ * seeded row as `timesTotalAtLeast` for exactly this reason, and this sentence was asserting the
+ * same number as a figure right beside it — *"the original lie with the new name on it"*, which
+ * is the phrase `DOD-M15-REFUSALTERMINAL-1` used about the defect it removed.
+ *
+ * On the daemon this unit was written for the row IS seeded: the inbox reported
+ * `times_total_at_least: 731`, so the very first thing an unqualified sentence would have shipped
+ * is "it has fired 731 times" next to a field saying "at least".
+ */
+seeded: boolean): string | null;
+//# sourceMappingURL=park-refusals.d.ts.map

package/dist/park-refusals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"park-refusals.d.ts","sourceRoot":"","sources":["../src/park-refusals.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAiB,KAAK,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEvE;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB;IAC/B,8FAA8F;;IAE9F,2EAA2E;;IAE3E,kEAAkE;;IAElE,8CAA8C;;IAE9C,gGAAgG;;IAEhG,6CAA6C;;IAE7C;;;;;;;;OAQG;;CAEK,CAAC;AAEX,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,OAAO,oBAAoB,CAAC,CAAC;AAEjG,qEAAqE;AACrE,MAAM,WAAW,kBAAkB;IACjC;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,wEAAwE;IACxE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAAC;IAClD;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,EAAE,WAAW,CAAC,MAAM,CAAoC,CAAC;AA8G/F;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAAE,MAAM,CACtC,iBAAiB,EACjB,CAAC,GAAG,EAAE,kBAAkB,KAAK;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAkGrF,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM;AACd;;;;;;;;;;;;GAYG;AACH,MAAM,EAAE,OAAO,GACd,MAAM,GAAG,IAAI,CA+Bf"}

package/dist/park-refusals.js

@@ -0,0 +1,331 @@
+/**
+ * CELLO Daemon — WHY A PARKED MESSAGE NEVER LEFT THE RELAY MAILBOX, said to the OPERATOR.
+ *
+ * `041-PARKSTUCK`. Every refusal the park drain can produce already had a `reason`, an `impact` and
+ * a `guidance` — written for a person, at ERROR, in `daemon.log`. None of them called
+ * `noteContentRefusal`, so no person ever received one. What the operator saw instead was the
+ * INGEST reason (`session_committed`), which says where the message was turned away on arrival and
+ * says nothing about why it will not leave: error substitution, in the one place there is no
+ * upstream for the reader to chase, because `daemon.log` is not an operator affordance.
+ *
+ * ⚠️ **A CLOSED SET WITH A TOTAL NOTICE MAP, for the reason `refusal-reasons.ts` gives.** The park
+ * drain pushed bare string literals into its refusal list, so a new branch could ship a reason the
+ * operator surface had never heard of and every test would stay green — a test cannot enumerate a
+ * code that does not exist yet, and a type can. Adding a member here without a notice below is a
+ * compile error.
+ *
+ * ⚠️ **THE GUIDANCE IS A FUNCTION OF THE SESSION'S STATUS, and that is the defect it exists to
+ * fix.** The salt branch's log line told operators *"this message will keep being re-pulled and
+ * re-refused until the session is closed, so close it and start a new one"* — for a session that
+ * had been closed three days earlier, which is what made the refusal permanent in the first place.
+ * Advice naming an action the reader already took is worse than silence: it spends the trust they
+ * would otherwise bring to the next notice.
+ */
+import { REFUSAL_KINDS } from "./refusal-reasons.js";
+/**
+ * Every reason the park drain can decline to file a parked message with.
+ *
+ * These are the ANNEX reasons — why the entry is STUCK — and they are deliberately distinct from
+ * the ingest reason that sits beside them on the same message. Both reach the inbox; the ingest one
+ * says the conversation is closed, this one says why the message cannot leave the mailbox.
+ */
+export const PARK_REFUSAL_REASONS = {
+    /** The sender named a salted algorithm and this side holds no usable salt for the session. */
+    ANNEX_SALT_UNAVAILABLE: "annex_salt_unavailable",
+    /** The sender named a content-hash algorithm this build cannot compute. */
+    ANNEX_ALG_UNKNOWN: "annex_alg_unknown",
+    /** The content does not match the hash the sender signed over. */
+    ANNEX_HASH_MISMATCH: "annex_hash_mismatch",
+    /** The park envelope could not be decoded. */
+    ANNEX_DECODE_FAILED: "annex_decode_failed",
+    /** The inbound screener was unreachable. TRANSIENT — the relay copy is kept and re-screened. */
+    ANNEX_SCREEN_UNAVAILABLE: "annex_screen_unavailable",
+    /** The annex write itself ran and failed. */
+    ANNEX_WRITE_FAILED: "annex_write_failed",
+    /**
+     * The inbound screener TERMINALLY blocked the content. Retained as quarantined evidence and
+     * deleted from the relay — the only park branch that destroys the remote copy on purpose.
+     *
+     * ⚠️ IT HAD NO OPERATOR SURFACE AT ALL — review M9. It is the branch with the strongest claim on
+     * an operator's attention (hostile bytes aimed at a conversation that is already closed) and the
+     * only one that deletes the relay's copy in silence, and its `impact` field was addressed to
+     * nobody. Unit 2's scope is every `content.recover.*` refusal, not only the one that loops.
+     */
+    ANNEX_SCREENED_OUT: "annex_screened_out",
+};
+/**
+ * The two session statuses from which nothing can change back.
+ *
+ * `seal_interrupted_pending` is deliberately NOT here — `types.ts` documents it as explicitly
+ * non-terminal, and a session still moving toward a notarization is not a session whose inputs are
+ * immutable. Excluding it costs a few more drains on a rare state and keeps the release honest.
+ */
+export const TERMINAL_SESSION_STATUSES = new Set(["sealed", "abandoned"]);
+/** The one sentence every reader of a park refusal needs before the reason: nobody did anything wrong. */
+const NOT_THEIR_FAULT = "The sender's signature on this message VERIFIED, so nothing here says they did anything wrong " +
+    "and there is no version of theirs to ask about.";
+/**
+ * A closed conversation cannot be reopened, so "close it" is never the advice for one — but the
+ * reader still needs a next step, and for a released message the honest one is that there is none
+ * inside CELLO.
+ */
+function saltGuidance(ctx) {
+    /**
+     * ⚠️ THE TWO CAUSES SEND THE OPERATOR TO OPPOSITE PLACES — one to the conversation, one to their
+     * own disk — and only the first can ever be released. A message is dropped from the relay solely
+     * on `none`; `unreadable` keeps its copy, because the read that failed may succeed next drain.
+     * So the `unreadable` text below never appears beside "there is nothing to retry", and review H2
+     * measured the pair contradicting each other when it could.
+     */
+    const cause = ctx.saltReason === "unreadable"
+        ? "A salt row for this conversation EXISTS on this machine and could not be used — the read " +
+            "failed, or the stored value is the wrong shape. That is a fault on YOUR side, not anything " +
+            "the sender did, and it may simply be a database that was busy. Look for " +
+            "session.salt.read.failed in the daemon log; if it does not repeat, the next attempt will " +
+            "check this message normally."
+        : "No salt was ever agreed for this conversation, so there is nothing here to check the " +
+            "message against. Look for session.salt.persist.failed or session.salt.announce.failed in " +
+            "the daemon log for which half never completed.";
+    if (ctx.released) {
+        /**
+         * ⚠️ **IT NAMES WHERE THE BYTES STILL ARE — review M7, and the affordance was missing.**
+         *
+         * The reader is told a message existed, was never shown to them, and is gone from the relay.
+         * Without the next sentence that is a dead end, and the log line for the same event already
+         * said `cello_quarantined` — so the person who needed it was the only one not told.
+         *
+         * Safe to promise only because the release is now gated on the retention having SUCCEEDED
+         * (review H1). Before that gate this sentence would have been a lie on exactly the daemons
+         * where it mattered most.
+         */
+        return (`${cause} THERE IS NOTHING TO REPAIR AND NOTHING TO RETRY. This conversation is closed ` +
+            `("${ctx.sessionStatus}"), so no salt can ever be agreed for it and this message could never ` +
+            `have been checked on any future attempt. The relay's copy has now been dropped, which is what ` +
+            `stops it being pulled and refused every few minutes forever. THE MESSAGE ITSELF IS STILL HERE: ` +
+            `this agent kept the bytes it could not check, and cello_quarantined shows them — treat what ` +
+            `you read there as unverified, because the whole reason it is in there is that nothing could ` +
+            `confirm it arrived unaltered. If it matters, ask the sender OUT OF BAND — a channel that is ` +
+            `not this one — to say it again in a NEW conversation.`);
+    }
+    /**
+     * ⚠️ **IT DOES NOT ASK THE READER TO WORK OUT SOMETHING IT ALREADY KNOWS — review L10.**
+     *
+     * This read *"if the conversation is still open, staying connected is what fixes it; if it is
+     * already closed, nothing will"* — a hedge over a status this function is handed. In production
+     * the branch is reachable only when ingest returned `session_committed`, so the status is
+     * `seal_interrupted_pending` or a record that could not be read; the hedge is right for the
+     * second and lazy for the first.
+     */
+    if (ctx.sessionStatus === null) {
+        return (`${cause} The relay still holds this message and it is pulled again on every drain. This ` +
+            `agent could not read its own record of the conversation, so it cannot tell you whether the ` +
+            `conversation is still open — and that unreadable record is itself worth looking at. If the ` +
+            `conversation IS still open, being connected at the same time as your counterparty is what ` +
+            `agrees a salt and clears this.`);
+    }
+    /**
+     * ⚠️ **THREE PATHS REACH HERE NOW, AND ONLY ONE OF THEM IS ABOUT RECONNECTING — verification
+     * NEW-1.**
+     *
+     * Before the release was gated on `saltReason` and on the retention, terminal + no-salt ALWAYS
+     * released, so this branch only ever saw a non-terminal session. Those two fixes opened two more
+     * ways in — a terminal session whose bytes could not be retained, and a salt row that exists and
+     * could not be read — and the reconnection advice is wrong for both. Telling someone to get
+     * online at the same time as a counterparty on a `sealed` conversation names an action they
+     * cannot perform, which is this unit's own DoD clause turned on the unit.
+     */
+    if (ctx.saltReason === "unreadable") {
+        return (`${cause} The relay still holds this message and it is pulled again on every drain, so ` +
+            `nothing is lost while this lasts. Your counterparty is not involved and there is nothing to ` +
+            `ask them for: a salt for this conversation already exists on this machine and this machine ` +
+            `could not read it. If the read succeeds on a later drain the message is checked and handled ` +
+            `normally.`);
+    }
+    if (TERMINAL_SESSION_STATUSES.has(ctx.sessionStatus)) {
+        return (`${cause} This conversation is "${ctx.sessionStatus}" and cannot be reopened, so no salt can ` +
+            `ever be agreed for it and this message can never be checked — there is nothing to reconnect ` +
+            `to and nothing to retry. The relay's copy would normally be dropped for exactly that reason; ` +
+            `it is being KEPT only because this agent could not store a copy of its own, and deleting it ` +
+            `would leave the message nowhere at all. Free space for this conversation and it resolves ` +
+            `itself. If the message mattered, ask the sender OUT OF BAND to say it again in a NEW ` +
+            `conversation.`);
+    }
+    return (`${cause} The relay still holds this message and it is pulled again on every drain. A salt is ` +
+        `agreed while both sides are connected, so being online at the same time as your counterparty ` +
+        `is what clears this — the message is then checked and delivered on a later drain. This ` +
+        `conversation is "${ctx.sessionStatus}", which is not closed, so that can still happen.`);
+}
+/**
+ * The operator-facing notice for each park refusal — TOTAL over the reason set.
+ *
+ * A function per reason rather than a string, because two of them must know whether the session is
+ * closed before they can say anything true about what to do next.
+ */
+export const PARK_REFUSAL_NOTICE = {
+    [PARK_REFUSAL_REASONS.ANNEX_SALT_UNAVAILABLE]: (ctx) => ({
+        // REFUSED, never DEFERRED: nothing was recorded and nothing acknowledged, and — released or not
+        // — the sender's daemon is not going to fix this by resending.
+        kind: REFUSAL_KINDS.REFUSED,
+        impact: `A message you were sent could NOT BE CHECKED — not that it failed a check. ${NOT_THEIR_FAULT} ` +
+            `This side cannot recompute the fingerprint they committed to, because the shared secret that ` +
+            `fingerprint is built from does not exist here. ` +
+            (ctx.released
+                ? "It was never shown to you and it is now gone from the relay, so this conversation will stop reporting it."
+                : "It was never shown to you, and the relay still holds its copy."),
+        guidance: saltGuidance(ctx),
+    }),
+    [PARK_REFUSAL_REASONS.ANNEX_ALG_UNKNOWN]: (ctx) => ({
+        kind: REFUSAL_KINDS.DEFERRED,
+        impact: `A message you were sent was fingerprinted with a method this build cannot compute ` +
+            `("${ctx.declaredAlg}"), so it could not be checked and was not shown to you. ` +
+            `${NOT_THEIR_FAULT} The relay still holds it.`,
+        guidance: "Their CELLO build is NEWER than this one. Upgrade this agent's client; the message stays on " +
+            "the relay and is delivered on the next drain once this daemon can compute that method. " +
+            "Nothing to ask the sender for and nothing to resend.",
+    }),
+    [PARK_REFUSAL_REASONS.ANNEX_HASH_MISMATCH]: () => ({
+        kind: REFUSAL_KINDS.REFUSED,
+        impact: "A message you were sent does NOT match the fingerprint its sender signed over, so the bytes " +
+            "that arrived are not the bytes they committed to. It was not shown to you. This is the one " +
+            "park refusal that is evidence of tampering rather than of a version or storage difference — " +
+            "the party best placed to have done it is the relay that stored it.",
+        guidance: "Do not ask the sender to resend into this conversation. Confirm OUT OF BAND — a channel that " +
+            "is not this one — what they actually sent, and read the retained copy with cello_quarantined " +
+            "to compare. If it repeats with the same counterparty, stop using this conversation.",
+    }),
+    [PARK_REFUSAL_REASONS.ANNEX_DECODE_FAILED]: (ctx) => ({
+        kind: REFUSAL_KINDS.DEFERRED,
+        impact: "A parked message could not be decoded at all, so nothing about it could be checked and it " +
+            "was not shown to you. The relay still holds it. This is a wire or version difference, not a " +
+            "claim about the sender." + errorClause(ctx),
+        guidance: "If the sender is on a newer build, upgrading this client is the fix; the relay keeps the " +
+            "message meanwhile, and it is decoded on a later drain. Nothing to ask the sender for.",
+    }),
+    [PARK_REFUSAL_REASONS.ANNEX_SCREEN_UNAVAILABLE]: () => ({
+        // The one TRANSIENT reason in the set. A screener that is down comes back, and the message is
+        // re-screened on the next drain with nothing lost — so the operator must not be told to act.
+        kind: REFUSAL_KINDS.DEFERRED,
+        impact: "A parked message could not be screened because this agent's screener did not answer, so it " +
+            "was not stored and not shown to you. Nothing was lost: the relay keeps its copy and the " +
+            "message is screened again on the next drain.",
+        guidance: "Nothing to do unless it keeps happening. If it does, the screener on THIS machine is not " +
+            "running — look for content.recover.annex.screen_unavailable in the daemon log. Do not ask " +
+            "the sender for anything; they cannot see this and there is nothing for them to resend.",
+    }),
+    [PARK_REFUSAL_REASONS.ANNEX_SCREENED_OUT]: (ctx) => ({
+        /**
+         * WITHHELD, not BLOCKED — verification NEW-3. `BLOCKED`'s header asserts the message IS in the
+         * conversation's hash chain and the sender WAS acknowledged. Both hold for the live screener
+         * and neither holds here: the conversation is closed, so nothing was appended, and deleting a
+         * mailbox blob is not an acknowledgement. The header would have contradicted this impact.
+         */
+        kind: REFUSAL_KINDS.WITHHELD,
+        impact: "A message that arrived for this closed conversation was BLOCKED by this agent's screener — " +
+            "its content was rejected outright, not merely unrecognised. It was never shown to the agent " +
+            "and never added to the conversation's record." +
+            // ⚠️ NEW-2: retention is a FACT read back, never an assumption. Saying "it is KEPT" when the
+            // quarantine refused it is the claim H1 removed, reprinted one branch over.
+            (ctx.retained
+                ? " It is KEPT as evidence and cello_quarantined shows it."
+                : " THIS AGENT COULD NOT KEEP A COPY of it — see session.content.quarantine.skipped or .failed in the daemon log — so only this notice records that it was ever sent.") +
+            (ctx.released
+                ? " The relay's copy has been dropped so it stops arriving."
+                : " The relay still holds its copy, so it may arrive and be blocked again."),
+        guidance: "This is the protection working, and there is nothing to repair. Do not turn screening off " +
+            "to read it and do not ask the sender about it — if the content was hostile, telling them " +
+            "what was caught tells whoever sent it what to change. cello_quarantined shows it if you " +
+            "need to produce it.",
+    }),
+    [PARK_REFUSAL_REASONS.ANNEX_WRITE_FAILED]: (ctx) => ({
+        kind: REFUSAL_KINDS.DEFERRED,
+        impact: "A parked message decoded and then a later step failed on THIS machine — screening it, " +
+            "keeping it, or writing it into the record — so it was not shown to you. THIS IS A FAULT ON " +
+            "THIS MACHINE, not something the sender did. The relay keeps its copy, so nothing is lost " +
+            "yet." + errorClause(ctx),
+        guidance: "Check that this machine has disk space and that ~/.cello is writable, then wait for the next " +
+            "drain — the message is still on the relay and is retried. Do not ask the sender to resend.",
+    }),
+};
+/**
+ * ⚠️ **HOW OFTEN, NOT JUST HOW MANY — `041-PARKSTUCK` Unit 2, property 2.**
+ *
+ * A count with no cadence beside it reads as that many separate events. On the machine this was
+ * written for, ONE message had been refused 731 times in 64 hours and the notice said `731`, which
+ * an operator reads as 731 messages going wrong rather than one going wrong every five minutes.
+ *
+ * Says only what the stored row proves: the number of refusals of this reason on this conversation,
+ * and the average gap across the span they cover. It does NOT claim one message — a reason can fire
+ * for several — because the row cannot tell them apart.
+ *
+ * `null` below three refusals or across a zero span: two points are not a cadence, and dividing by a
+ * zero span would print an interval that is an artifact of the clock rather than of the behaviour.
+ */
+export function refusalRecurrence(total, firstAt, lastAt, 
+/**
+ * Is `total` an exact count or a FLOOR? — review M5.
+ *
+ * A row seeded at upgrade takes its total from a notice's `count`, which resets on dismissal, so
+ * both the count and the span are lower bounds. The drain five lines away already reports a
+ * seeded row as `timesTotalAtLeast` for exactly this reason, and this sentence was asserting the
+ * same number as a figure right beside it — *"the original lie with the new name on it"*, which
+ * is the phrase `DOD-M15-REFUSALTERMINAL-1` used about the defect it removed.
+ *
+ * On the daemon this unit was written for the row IS seeded: the inbox reported
+ * `times_total_at_least: 731`, so the very first thing an unqualified sentence would have shipped
+ * is "it has fired 731 times" next to a field saying "at least".
+ */
+seeded) {
+    if (!Number.isFinite(total) || total < 3)
+        return null;
+    const span = lastAt - firstAt;
+    if (!Number.isFinite(span) || span <= 0)
+        return null;
+    const everyMs = span / (total - 1);
+    /**
+     * ⚠️ **IT SAYS ONLY WHAT THE ROW PROVES — review M6, and the first version made two claims it
+     * could not.**
+     *
+     * Dropped: *"THIS REFUSAL IS A LOOP, NOT N SEPARATE EVENTS"*. This function serves EVERY reason
+     * in the drain, not only park ones, and a counterparty who keeps writing into a closed
+     * conversation generates N genuinely separate `session_committed` refusals — the notice would
+     * have told the operator they were not separate, beside guidance saying the sender "may not
+     * realise it ended". Its own doc comment already said a reason can fire for several messages.
+     *
+     * Dropped: *"It will keep firing at that rate until the cause is dealt with"*. Notices are
+     * durable and re-drained for every new consumer, so that prints long after a cause is resolved —
+     * including, immediately after this unit lands, on the released message whose impact in the SAME
+     * row says it is gone and will stop being reported.
+     *
+     * What is left is arithmetic over two stored timestamps and a count, which is all the row has.
+     */
+    const count = seeded ? `at least ${total} times` : `${total} times`;
+    return (`RECORDED ${count.toUpperCase()} on this conversation, about once every ` +
+        `${humanizeInterval(everyMs)} across ${humanizeInterval(span)} — so read the number as ONE ` +
+        `recurring refusal being counted, not as that many separate problems to work through` +
+        (seeded
+            ? ". The count began when this daemon was upgraded and dismissals are not counted, so the true figure may be far higher."
+            : "."));
+}
+/**
+ * The upstream error's own words, appended rather than replacing anything — Invariant 3.
+ *
+ * Empty when there was no throw, so a notice never carries a dangling "it said:" with nothing after.
+ */
+function errorClause(ctx) {
+    return ctx.errorDetail === null || ctx.errorDetail === "" ? "" : ` The failure said: ${ctx.errorDetail}.`;
+}
+/** A duration a person reads without converting it. Whole units, because a cadence is an estimate. */
+function humanizeInterval(ms) {
+    const s = Math.round(ms / 1000);
+    if (s < 60)
+        return `${Math.max(1, s)} second${s === 1 ? "" : "s"}`;
+    const m = Math.round(s / 60);
+    if (m < 60)
+        return `${m} minute${m === 1 ? "" : "s"}`;
+    const h = Math.round(m / 60);
+    if (h < 48)
+        return `${h} hour${h === 1 ? "" : "s"}`;
+    const d = Math.round(h / 24);
+    return `${d} days`;
+}
+//# sourceMappingURL=park-refusals.js.map

package/dist/park-refusals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"park-refusals.js","sourceRoot":"","sources":["../src/park-refusals.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,aAAa,EAAoB,MAAM,sBAAsB,CAAC;AAEvE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,8FAA8F;IAC9F,sBAAsB,EAAE,wBAAwB;IAChD,2EAA2E;IAC3E,iBAAiB,EAAE,mBAAmB;IACtC,kEAAkE;IAClE,mBAAmB,EAAE,qBAAqB;IAC1C,8CAA8C;IAC9C,mBAAmB,EAAE,qBAAqB;IAC1C,gGAAgG;IAChG,wBAAwB,EAAE,0BAA0B;IACpD,6CAA6C;IAC7C,kBAAkB,EAAE,oBAAoB;IACxC;;;;;;;;OAQG;IACH,kBAAkB,EAAE,oBAAoB;CAChC,CAAC;AA+CX;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAwB,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;AAE/F,0GAA0G;AAC1G,MAAM,eAAe,GACnB,gGAAgG;IAChG,iDAAiD,CAAC;AAEpD;;;;GAIG;AACH,SAAS,YAAY,CAAC,GAAuB;IAC3C;;;;;;OAMG;IACH,MAAM,KAAK,GACT,GAAG,CAAC,UAAU,KAAK,YAAY;QAC7B,CAAC,CAAC,2FAA2F;YAC3F,6FAA6F;YAC7F,0EAA0E;YAC1E,2FAA2F;YAC3F,8BAA8B;QAChC,CAAC,CAAC,uFAAuF;YACvF,2FAA2F;YAC3F,gDAAgD,CAAC;IACvD,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjB;;;;;;;;;;WAUG;QACH,OAAO,CACL,GAAG,KAAK,gFAAgF;YACxF,KAAK,GAAG,CAAC,aAAa,wEAAwE;YAC9F,gGAAgG;YAChG,iGAAiG;YACjG,8FAA8F;YAC9F,8FAA8F;YAC9F,8FAA8F;YAC9F,uDAAuD,CACxD,CAAC;IACJ,CAAC;IACD;;;;;;;;OAQG;IACH,IAAI,GAAG,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;QAC/B,OAAO,CACL,GAAG,KAAK,kFAAkF;YAC1F,6FAA6F;YAC7F,6FAA6F;YAC7F,4FAA4F;YAC5F,gCAAgC,CACjC,CAAC;IACJ,CAAC;IACD;;;;;;;;;;OAUG;IACH,IAAI,GAAG,CAAC,UAAU,KAAK,YAAY,EAAE,CAAC;QACpC,OAAO,CACL,GAAG,KAAK,gFAAgF;YACxF,8FAA8F;YAC9F,6FAA6F;YAC7F,8FAA8F;YAC9F,WAAW,CACZ,CAAC;IACJ,CAAC;IACD,IAAI,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;QACrD,OAAO,CACL,GAAG,KAAK,0BAA0B,GAAG,CAAC,aAAa,2CAA2C;YAC9F,8FAA8F;YAC9F,+FAA+F;YAC/F,8FAA8F;YAC9F,2FAA2F;YAC3F,uFAAuF;YACvF,eAAe,CAChB,CAAC;IACJ,CAAC;IACD,OAAO,CACL,GAAG,KAAK,uFAAuF;QAC/F,+FAA+F;QAC/F,yFAAyF;QACzF,oBAAoB,GAAG,CAAC,aAAa,mDAAmD,CACzF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAG5B;IACF,CAAC,oBAAoB,CAAC,sBAAsB,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACvD,gGAAgG;QAChG,+DAA+D;QAC/D,IAAI,EAAE,aAAa,CAAC,OAAO;QAC3B,MAAM,EACJ,8EAA8E,eAAe,GAAG;YAChG,+FAA+F;YAC/F,iDAAiD;YACjD,CAAC,GAAG,CAAC,QAAQ;gBACX,CAAC,CAAC,2GAA2G;gBAC7G,CAAC,CAAC,gEAAgE,CAAC;QACvE,QAAQ,EAAE,YAAY,CAAC,GAAG,CAAC;KAC5B,CAAC;IACF,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,EAAE,aAAa,CAAC,QAAQ;QAC5B,MAAM,EACJ,oFAAoF;YACpF,KAAK,GAAG,CAAC,WAAW,2DAA2D;YAC/E,GAAG,eAAe,4BAA4B;QAChD,QAAQ,EACN,8FAA8F;YAC9F,yFAAyF;YACzF,sDAAsD;KACzD,CAAC;IACF,CAAC,oBAAoB,CAAC,mBAAmB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QACjD,IAAI,EAAE,aAAa,CAAC,OAAO;QAC3B,MAAM,EACJ,8FAA8F;YAC9F,6FAA6F;YAC7F,8FAA8F;YAC9F,oEAAoE;QACtE,QAAQ,EACN,+FAA+F;YAC/F,+FAA+F;YAC/F,qFAAqF;KACxF,CAAC;IACF,CAAC,oBAAoB,CAAC,mBAAmB,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACpD,IAAI,EAAE,aAAa,CAAC,QAAQ;QAC5B,MAAM,EACJ,4FAA4F;YAC5F,8FAA8F;YAC9F,yBAAyB,GAAG,WAAW,CAAC,GAAG,CAAC;QAC9C,QAAQ,EACN,2FAA2F;YAC3F,uFAAuF;KAC1F,CAAC;IACF,CAAC,oBAAoB,CAAC,wBAAwB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QACtD,8FAA8F;QAC9F,6FAA6F;QAC7F,IAAI,EAAE,aAAa,CAAC,QAAQ;QAC5B,MAAM,EACJ,6FAA6F;YAC7F,0FAA0F;YAC1F,8CAA8C;QAChD,QAAQ,EACN,2FAA2F;YAC3F,4FAA4F;YAC5F,wFAAwF;KAC3F,CAAC;IACF,CAAC,oBAAoB,CAAC,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACnD;;;;;WAKG;QACH,IAAI,EAAE,aAAa,CAAC,QAAQ;QAC5B,MAAM,EACJ,6FAA6F;YAC7F,8FAA8F;YAC9F,+CAA+C;YAC/C,6FAA6F;YAC7F,4EAA4E;YAC5E,CAAC,GAAG,CAAC,QAAQ;gBACX,CAAC,CAAC,yDAAyD;gBAC3D,CAAC,CAAC,oKAAoK,CAAC;YACzK,CAAC,GAAG,CAAC,QAAQ;gBACX,CAAC,CAAC,0DAA0D;gBAC5D,CAAC,CAAC,yEAAyE,CAAC;QAChF,QAAQ,EACN,4FAA4F;YAC5F,2FAA2F;YAC3F,0FAA0F;YAC1F,qBAAqB;KACxB,CAAC;IACF,CAAC,oBAAoB,CAAC,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACnD,IAAI,EAAE,aAAa,CAAC,QAAQ;QAC5B,MAAM,EACJ,wFAAwF;YACxF,6FAA6F;YAC7F,2FAA2F;YAC3F,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC;QAC3B,QAAQ,EACN,+FAA+F;YAC/F,4FAA4F;KAC/F,CAAC;CACH,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAa,EACb,OAAe,EACf,MAAc;AACd;;;;;;;;;;;;GAYG;AACH,MAAe;IAEf,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,MAAM,IAAI,GAAG,MAAM,GAAG,OAAO,CAAC;IAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACnC;;;;;;;;;;;;;;;;OAgBG;IACH,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC;IACpE,OAAO,CACL,YAAY,KAAK,CAAC,WAAW,EAAE,0CAA0C;QACzE,GAAG,gBAAgB,CAAC,OAAO,CAAC,WAAW,gBAAgB,CAAC,IAAI,CAAC,+BAA+B;QAC5F,qFAAqF;QACrF,CAAC,MAAM;YACL,CAAC,CAAC,uHAAuH;YACzH,CAAC,CAAC,GAAG,CAAC,CACT,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,GAAuB;IAC1C,OAAO,GAAG,CAAC,WAAW,KAAK,IAAI,IAAI,GAAG,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,sBAAsB,GAAG,CAAC,WAAW,GAAG,CAAC;AAC5G,CAAC;AAED,sGAAsG;AACtG,SAAS,gBAAgB,CAAC,EAAU;IAClC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IACnE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IACtD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IACpD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7B,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC"}

package/dist/quarantine-framing.d.ts

@@ -0,0 +1,92 @@
+/**
+ * DOD-M15-REFUSEDEVIDENCE-1 — how a refused message is handed back.
+ *
+ * ─── Why the payload is handed over at all, rather than hidden ─────────────────────────────────
+ *
+ * Andre, 2026-09-03, and it reverses the obvious approach: *"Most prompt injections rely on the
+ * naivete of an LM. If you send in a warning — the following is a prompt injection, the following
+ * is a malicious message — the chance it would be fooled is very, very low, because the very thing
+ * it understands is that this is a super dangerous message trying to subvert it."*
+ *
+ * The alternative — base64, a human-only channel, a file the operator has to hunt for — does not
+ * remove the LM from the path. **It removes the FRAMING from the path.** The operator asks their
+ * coding agent to find the file, the agent finds it, reads the raw bytes, and reports *"I found it,
+ * the message says…"*. That is strictly worse than handing it over wrapped in a warning.
+ *
+ * ⚠️ BASE64 ENCODING, CLI-ONLY ACCESS AND A SEPARATE UNSEALED STORE WERE EACH PROPOSED AND REJECTED
+ * IN WRITING. Do not re-derive them; each produces the unframed read it was meant to prevent.
+ *
+ * ─── Why there is NO CLOSING DELIMITER ─────────────────────────────────────────────────────────
+ *
+ * Andre, 2026-09-03: *"I would not include anything around 'end payload' or messages after the
+ * payload. It opens it up to gaming. My malicious payload can include the end-payload tag to fool
+ * you into thinking that text below that is okay."*
+ *
+ * A closing marker is FORGEABLE BY THE PAYLOAD. It writes its own `END PAYLOAD` line and everything
+ * after it reads as trusted framing again — the reader is back inside the attack believing it has
+ * left it. So the structure is one-way: **all metadata above, payload last, nothing after it, to
+ * the end of the string.** The header says so explicitly, because a reader who knows there is no
+ * end marker cannot be convinced by a forged one.
+ *
+ * That invariant binds every caller: whatever carries this string must not append to it, and in a
+ * JSON response the field holding it must be the LAST key in the object.
+ */
+/** Everything known ABOUT the refused message. None of it comes from the message itself. */
+export interface QuarantineFrameMeta {
+    /** The refusal reason code — why this was never delivered. */
+    reason: string;
+    /** Sender's key, when this side could resolve one. `null` is itself evidence (`sender_unresolved`). */
+    senderPubkeyHex: string | null;
+    /** The operator's own pet name for that key, when they have set one. Never sender-supplied. */
+    senderLabel: string | null;
+    /** Whether a signature over the sender's own bytes was verified before the message was refused. */
+    signature: "VERIFIED" | "NOT SIGNED";
+    sessionId: string;
+    /** Transcript position. Negative for a refusal with no chain position (no session, no sender). */
+    position: number;
+    arrivedAtMs: number;
+    /** sha256 of the RETAINED bytes — what a third party checks the payload they were handed against.
+     *  Deliberately not the hash the sender committed to: on a tamper those differ, which is the point. */
+    contentHashHex: string;
+}
+/**
+ * Wrap a refused message so that reading it is safe.
+ *
+ * The return value ENDS with the payload, byte for byte. Callers must treat that as a contract:
+ * appending anything — a footer, a signature block, a "hope that helps" — hands the payload a way
+ * to impersonate it.
+ */
+export declare function frameQuarantinedPayload(meta: QuarantineFrameMeta, payload: string): string;
+/**
+ * What `cello_transcript` says in place of the text.
+ *
+ * The entry stays in the transcript at its position — a hole where a message was is the evidence
+ * gap this unit exists to close, one level up. What is redacted is the READ, never the storage.
+ *
+ * ⚠️ **TWO FIELDS, AND THE SPLIT IS NOT COSMETIC — review F8.** The command lives in a key ending
+ * `guidance`, because that suffix is what `vocabulary.ts` rewrites for the surface that asked. When
+ * the whole sentence sat in `text`, `cello transcript` printed *"read it with `cello_quarantined`"*
+ * — an MCP tool name a terminal operator cannot type — while the sibling guidance on the same
+ * response was correctly rewritten to `cello quarantined`. One response, two spellings, one of them
+ * unrunnable. So `text` states the fact and names no verb, and the verb lives where the rewrite can
+ * reach it.
+ */
+export declare function quarantineRedaction(reason: string, sessionId: string, sequence: number): {
+    text: string;
+    guidance: string;
+};
+/**
+ * Whether the evidence is actually there, and where — `DOD-M15-REFUSEDEVIDENCE-1`.
+ *
+ * ⚠️ **A CLAIM ABOUT DURABILITY IS MADE AFTER THE WRITE, NEVER BEFORE IT.** Retention has two real
+ * ways to keep nothing — the conversation's byte budget is spent, or the write threw — so a notice
+ * saying "the message was kept" unconditionally sends an operator to a remedy that answers
+ * `no_refused_message_at_sequence`. The caller passes what the retention attempt returned.
+ *
+ * ⚠️ **IT LIVES HERE, IN THIS UNIT'S MODULE, NOT IN `orphan-triage.ts`.** Whether a refused message
+ * exists is 023's fact. It was briefly defined inside 024's module and duplicated against a private
+ * copy on the manager — two functions answering one question, which is how they drift into
+ * disagreeing. 024's triage RECEIVES this string; it does not own it.
+ */
+export declare function retentionSentence(sessionId: string, storedSeq: number | null): string;
+//# sourceMappingURL=quarantine-framing.d.ts.map

package/dist/quarantine-framing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quarantine-framing.d.ts","sourceRoot":"","sources":["../src/quarantine-framing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,4FAA4F;AAC5F,MAAM,WAAW,mBAAmB;IAClC,8DAA8D;IAC9D,MAAM,EAAE,MAAM,CAAC;IACf,uGAAuG;IACvG,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,+FAA+F;IAC/F,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,mGAAmG;IACnG,SAAS,EAAE,UAAU,GAAG,YAAY,CAAC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,kGAAkG;IAClG,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB;2GACuG;IACvG,cAAc,EAAE,MAAM,CAAC;CACxB;AAID;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CA6B1F;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAU3H;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAIrF"}