From 6890b7a7abdfe59c5b3a4b095f397930c2a95417 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 18:25:40 +0100
Subject: [PATCH 001/148] wake channels: quiet on repeats, gossip cannot
 repoint a phone, channels expire

Every peer re-sends its whole wake-channel list (peer-info) on every connect, and the
receiver logged a line and rewrote wake-channels.json per entry per frame, even for
entries it already held. On the daemon, xmesh reconnects thousands of times a day, so
stdout.log reached 1 GB of "learned wake channel for unknown".

- WakeManager.learnWakeChannel(nodeId, channel, {source, lastSeen}) is the one way a
  channel is recorded, from the peer itself (direct), the relay's list (relay) or
  another peer's peer-info (gossip). A weaker source never replaces a stronger one's
  token, so unauthenticated gossip cannot repoint a phone that gave us its token.
- lastSeen is the last first-hand sighting. Gossip forwards the lastSeen it holds
  instead of the time of sending, and a channel unseen for 30 days expires, in memory
  and on disk. A channel saved before lastSeen existed gets one TTL of grace, once.
- peer-info and the relay list log one line per frame, only when something was
  learned, and write the file only when something changed. The relay list handling
  moves to RelayConnection._handleRelayPeers so it can be tested.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 lib/core/wake.js            | 102 ++++++++++++++++++++++++-
 lib/frame-handler.js        |  27 ++++---
 lib/node.js                 |   9 +--
 lib/relay.js                |  44 +++++++----
 tests/wake-channels.test.js | 145 ++++++++++++++++++++++++++++++++++++
 5 files changed, 290 insertions(+), 37 deletions(-)
 create mode 100644 tests/wake-channels.test.js

diff --git a/lib/core/wake.js b/lib/core/wake.js
index a0c6c7da..fd7875c7 100644
--- a/lib/core/wake.js
+++ b/lib/core/wake.js
@@ -25,6 +25,12 @@ function ensureDir(dir) {
   if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
 }
 
+/** A wake channel nobody has seen first-hand for this long is dropped (30 days). */
+const WAKE_CHANNEL_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+
+/** How far each source of a wake channel is trusted. Gossip is unauthenticated. */
+const SOURCE_RANK = Object.freeze({ legacy: 0, gossip: 1, relay: 2, direct: 3 });
+
 /**
  * Manages wake channel persistence and peer wake notifications.
  */
@@ -56,6 +62,8 @@ class WakeManager {
     this._getMeshNode = opts.getMeshNode;
     this._getIdentity = opts.getIdentity;
     this._nodeName = opts.nodeName;
+    this._ttlMs = opts.wakeChannelTtlMs ?? WAKE_CHANNEL_TTL_MS;
+    this._now = opts.now || Date.now;
 
     this._apnsConfig = null;
     this._apnsKey = null;
@@ -64,19 +72,26 @@ class WakeManager {
   /**
    * Load persisted peer wake channels from disk.
    *
+   * A channel saved before records carried `lastSeen` gets one TTL of grace from now: it may belong
+   * to a phone that is asleep and can only be reached through it, so it is not dropped on sight.
+   *
    * @returns {void}
    */
   loadWakeChannels() {
     try {
       if (fs.existsSync(this._wakeChannelsFile)) {
         const data = JSON.parse(fs.readFileSync(this._wakeChannelsFile, 'utf8'));
+        const now = this._now();
         for (const [id, ch] of Object.entries(data)) {
           if (ch?.platform && ch?.token) {
-            this._peerWakeChannels.set(id, ch);
+            const lastSeen = Number.isFinite(ch.lastSeen) ? Math.min(ch.lastSeen, now) : now;
+            this._peerWakeChannels.set(id, { ...ch, source: ch.source || 'legacy', lastSeen });
           }
         }
+        const expired = this.pruneWakeChannels({ save: false });
+        if (expired > 0) this.saveWakeChannels();
         if (this._peerWakeChannels.size > 0) {
-          this._log(`Loaded ${this._peerWakeChannels.size} wake channel(s) from disk`);
+          this._log(`Loaded ${this._peerWakeChannels.size} wake channel(s) from disk${expired ? `, ${expired} expired` : ''}`);
         }
       }
     } catch (err) {
@@ -84,6 +99,87 @@ class WakeManager {
     }
   }
 
+  /**
+   * Record a peer's wake channel, from one of three sources:
+   * - `direct`: the peer's own `wake-channel` frame, over its own connection;
+   * - `relay`: the relay's peer list, after relay-auth;
+   * - `gossip`: another peer's `peer-info`, which nothing authenticates.
+   *
+   * A weaker source never replaces a stronger one's token, so an unauthenticated `peer-info` cannot
+   * repoint a phone that told us its token itself. `lastSeen` is when someone last had first-hand
+   * evidence of the channel, never the time a copy of it was forwarded, so a channel nobody has seen
+   * ages out after the TTL however often it is gossiped.
+   *
+   * @param {string} nodeId
+   * @param {{platform:string, token?:string, environment?:string}} channel
+   * @param {{source:'direct'|'relay'|'gossip', lastSeen?:number}} opts
+   * @returns {'added'|'updated'|'refreshed'|'unchanged'|'ignored'} what changed; only the first
+   *   three need saving.
+   */
+  learnWakeChannel(nodeId, channel, { source, lastSeen } = {}) {
+    if (!nodeId || !channel?.platform || channel.platform === 'none') return 'ignored';
+    const now = this._now();
+    // The peer itself, or the relay that holds its registration, is first-hand evidence now; a
+    // gossiped copy is only as fresh as the sighting it carries.
+    const firstHand = source === 'direct' || (source === 'relay' && !Number.isFinite(lastSeen));
+    const seen = firstHand ? now : Math.min(Number.isFinite(lastSeen) ? lastSeen : 0, now);
+    if (now - seen > this._ttlMs) return 'ignored';
+    const next = { platform: channel.platform, token: channel.token, environment: channel.environment, source, lastSeen: seen };
+    const prev = this._peerWakeChannels.get(nodeId);
+    if (!prev) { this._peerWakeChannels.set(nodeId, next); return 'added'; }
+    const sameToken = prev.platform === next.platform && prev.token === next.token && prev.environment === next.environment;
+    if (sameToken) {
+      // The same channel again: keep the stronger source and the later sighting.
+      const keepSource = (SOURCE_RANK[source] ?? 0) > (SOURCE_RANK[prev.source] ?? 0) ? source : prev.source;
+      const keepSeen = Math.max(seen, prev.lastSeen ?? 0);
+      if (keepSource === prev.source && keepSeen === prev.lastSeen) return 'unchanged';
+      this._peerWakeChannels.set(nodeId, { ...prev, source: keepSource, lastSeen: keepSeen });
+      return 'refreshed';
+    }
+    // A different token: only a source at least as strong may replace it, and gossip must also be newer.
+    if ((SOURCE_RANK[source] ?? 0) < (SOURCE_RANK[prev.source] ?? 0)) return 'ignored';
+    if (source === 'gossip' && seen <= (prev.lastSeen ?? 0)) return 'ignored';
+    this._peerWakeChannels.set(nodeId, next);
+    return 'updated';
+  }
+
+  /**
+   * Drop channels nobody has seen for longer than the TTL.
+   * @param {{save?: boolean}} [opts]
+   * @returns {number} how many were dropped
+   */
+  pruneWakeChannels({ save = true } = {}) {
+    const now = this._now();
+    let dropped = 0;
+    for (const [id, ch] of this._peerWakeChannels) {
+      if (now - (ch.lastSeen ?? 0) > this._ttlMs) { this._peerWakeChannels.delete(id); dropped++; }
+    }
+    if (dropped > 0 && save) this.saveWakeChannels();
+    return dropped;
+  }
+
+  /**
+   * The entries a `peer-info` frame to `excludeId` should carry: live channels only, each with the
+   * lastSeen this node holds rather than the time of sending.
+   * @param {string} excludeId
+   * @param {(id:string) => string|undefined} nameOf
+   * @returns {Array<{nodeId:string, name:string, wakeChannel:object, lastSeen:number}>}
+   */
+  gossipEntries(excludeId, nameOf = () => undefined) {
+    this.pruneWakeChannels();
+    const out = [];
+    for (const [id, ch] of this._peerWakeChannels) {
+      if (id === excludeId) continue;
+      out.push({
+        nodeId: id,
+        name: nameOf(id) || 'unknown',
+        wakeChannel: { platform: ch.platform, token: ch.token, environment: ch.environment },
+        lastSeen: ch.lastSeen,
+      });
+    }
+    return out;
+  }
+
   /**
    * Persist peer wake channels to disk.
    *
@@ -295,4 +391,4 @@ class WakeManager {
   }
 }
 
-module.exports = { WakeManager };
+module.exports = { WakeManager, WAKE_CHANNEL_TTL_MS };
diff --git a/lib/frame-handler.js b/lib/frame-handler.js
index a243d13a..b9358ad1 100644
--- a/lib/frame-handler.js
+++ b/lib/frame-handler.js
@@ -1372,13 +1372,10 @@ class FrameHandler {
    */
   _handleWakeChannel(peerId, peerName, msg) {
     if (!msg.platform) return;
-    this._node._peerWakeChannels.set(peerId, {
-      platform: msg.platform,
-      token: msg.token,
-      environment: msg.environment,
-    });
-    this._node._wakeManager.saveWakeChannels();
-    this._node._log(`Wake channel from ${peerName}: ${msg.platform}`);
+    const wm = this._node._wakeManager;
+    const r = wm.learnWakeChannel(peerId, { platform: msg.platform, token: msg.token, environment: msg.environment }, { source: 'direct' });
+    if (r === 'added' || r === 'updated' || r === 'refreshed') wm.saveWakeChannels();
+    if (r === 'added' || r === 'updated') this._node._log(`Wake channel from ${peerName}: ${msg.platform}`);
   }
 
   /**
@@ -1408,13 +1405,19 @@ class FrameHandler {
    */
   _handlePeerInfo(peerId, peerName, msg) {
     if (!Array.isArray(msg.peers)) return;
+    // Every peer re-sends its whole list on every connect, so most entries are ones already held.
+    // Those change nothing and say nothing: logging and rewriting the file per entry per connect
+    // filled the daemon log at a flapping peer's reconnect rate.
+    const wm = this._node._wakeManager;
+    let learned = 0, changed = 0;
     for (const p of msg.peers) {
-      if (p.nodeId && p.wakeChannel && p.nodeId !== this._node._identity.nodeId) {
-        this._node._peerWakeChannels.set(p.nodeId, p.wakeChannel);
-        this._node._log(`Gossip from ${peerName}: learned wake channel for ${p.name}`);
-      }
+      if (!p || !p.nodeId || !p.wakeChannel || p.nodeId === this._node._identity.nodeId) continue;
+      const r = wm.learnWakeChannel(p.nodeId, p.wakeChannel, { source: 'gossip', lastSeen: p.lastSeen });
+      if (r === 'added' || r === 'updated') learned++;
+      if (r === 'added' || r === 'updated' || r === 'refreshed') changed++;
     }
-    this._node._wakeManager.saveWakeChannels();
+    if (changed > 0) wm.saveWakeChannels();
+    if (learned > 0) this._node._log(`Gossip from ${peerName}: learned ${learned} wake channel(s)`);
   }
 
   /**
diff --git a/lib/node.js b/lib/node.js
index 607a20e3..b350a986 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -526,6 +526,7 @@ class SymNode extends EventEmitter {
       nodeName: this.name,
       peerWakeChannels: this._peerWakeChannels,
       saveWakeChannels: () => this._wakeManager.saveWakeChannels(),
+      learnWakeChannel: (id, ch, o) => this._wakeManager.learnWakeChannel(id, ch, o),
     });
 
     // Frame handler — cliHostMode forwards frames without storing or SVAF.
@@ -3014,13 +3015,7 @@ class SymNode extends EventEmitter {
     }
 
     // Send peer-info gossip
-    const knownPeers = [];
-    for (const [id, wc] of this._peerWakeChannels) {
-      if (id !== peer.peerId) {
-        const peerEntry = this._peers.get(id);
-        knownPeers.push({ nodeId: id, name: peerEntry?.name || 'unknown', wakeChannel: wc, lastSeen: Date.now() });
-      }
-    }
+    const knownPeers = this._wakeManager.gossipEntries(peer.peerId, (id) => this._peers.get(id)?.name);
     if (knownPeers.length > 0) {
       peer.transport.send({ type: 'peer-info', peers: knownPeers });
     }
diff --git a/lib/relay.js b/lib/relay.js
index abf6bf8f..3b5da25a 100644
--- a/lib/relay.js
+++ b/lib/relay.js
@@ -32,6 +32,7 @@ class RelayConnection {
    * @param {string}   opts.nodeName           — this node's name
    * @param {Map}      opts.peerWakeChannels   — shared peer wake channels Map
    * @param {function} opts.saveWakeChannels   — () => void
+   * @param {function} opts.learnWakeChannel   — (nodeId, channel, {source, lastSeen}) => outcome (WakeManager)
    * @param {function} [opts.onIdentityCollision] — ({nodeId, name, code}) => void —
    *                   called when the relay reports our nodeId is already held
    *                   by another connection. If not provided, the default
@@ -66,6 +67,7 @@ class RelayConnection {
     this._nodeName = opts.nodeName;
     this._peerWakeChannels = opts.peerWakeChannels;
     this._saveWakeChannels = opts.saveWakeChannels;
+    this._learnWakeChannel = opts.learnWakeChannel;
     this._identityCollision = false;
 
     this._relayWs = null;
@@ -174,6 +176,32 @@ class RelayConnection {
    * Open WebSocket connection to the relay and authenticate.
    * Auto-reconnects on disconnect with exponential backoff.
    */
+  /**
+   * The relay's peer list, sent after a successful relay-auth (a refusal episode ends here). The
+   * relay re-sends the whole list on every (re)connect, so wake channels are learned quietly and
+   * what changed is said once.
+   * @private
+   */
+  _handleRelayPeers(msg) {
+    this._authRefused = false;
+    this._refused = null;
+    this._attempts = 0;
+    this._setPhase('connected');
+    let learned = 0, changed = 0;
+    for (const p of (msg.peers || [])) {
+      if (p.wakeChannel && p.wakeChannel.platform !== 'none') {
+        const r = this._learnWakeChannel(p.nodeId, p.wakeChannel, { source: 'relay', lastSeen: p.lastSeen });
+        if (r === 'added' || r === 'updated') learned++;
+        if (r === 'added' || r === 'updated' || r === 'refreshed') changed++;
+      }
+      if (!p.offline) {
+        this._handleRelayPeerJoined(p.nodeId, p.name);
+      }
+    }
+    if (changed > 0) this._saveWakeChannels();
+    if (learned > 0) this._log(`Relay: learned ${learned} wake channel(s)`);
+  }
+
   /**
    * The auth frame names the ENGINE VERSION beside the identity. One field, no payload, no
    * confidentiality cost — and it turns "which engines ever reached path X through the relay"
@@ -264,21 +292,7 @@ class RelayConnection {
       } else if (msg.type === 'relay-peer-left') {
         this._handleRelayPeerLeft(msg.nodeId, msg.name);
       } else if (msg.type === 'relay-peers') {
-        // The peer list is sent only after a successful relay-auth: a refusal episode ends here.
-        this._authRefused = false;
-        this._refused = null;
-        this._attempts = 0;
-        this._setPhase('connected');
-        for (const p of (msg.peers || [])) {
-          if (p.wakeChannel && p.wakeChannel.platform !== 'none') {
-            this._peerWakeChannels.set(p.nodeId, p.wakeChannel);
-            this._log(`Gossip: learned wake channel for ${p.name} (${p.wakeChannel.platform})`);
-          }
-          if (!p.offline) {
-            this._handleRelayPeerJoined(p.nodeId, p.name);
-          }
-        }
-        this._saveWakeChannels();
+        this._handleRelayPeers(msg);
       } else if (msg.type === 'relay-ping') {
         ws.send(JSON.stringify({ type: 'relay-pong' }));
       } else if (msg.type === 'relay-reauth') {
diff --git a/tests/wake-channels.test.js b/tests/wake-channels.test.js
new file mode 100644
index 00000000..7f89e091
--- /dev/null
+++ b/tests/wake-channels.test.js
@@ -0,0 +1,145 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME to a temp sandbox before lib/config loads
+
+/**
+ * Wake channels: learned from the peer itself, the relay's list, or another peer's `peer-info`
+ * gossip, which nothing authenticates. Every peer re-sends its whole list on every connect, so a
+ * repeat must change nothing and log nothing; gossip must never repoint a phone's own token; and a
+ * channel nobody has seen first-hand ages out however often it is forwarded.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const { SymNode } = require('../lib/node');
+const { NullDiscovery } = require('../lib/discovery');
+const { nodeDir } = require('../lib/config');
+const { WAKE_CHANNEL_TTL_MS } = require('../lib/core/wake');
+
+const DAY = 24 * 60 * 60 * 1000;
+const apns = (token) => ({ platform: 'apns', token, environment: 'sandbox' });
+
+function withNode(fn) {
+  const name = `wake-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+  const node = new SymNode({ name, silent: true, discovery: new NullDiscovery() });
+  const lines = [];
+  node._log = (m) => lines.push(m);
+  node._wakeManager._log = (m) => lines.push(m);
+  let writes = 0;
+  const save = node._wakeManager.saveWakeChannels.bind(node._wakeManager);
+  node._wakeManager.saveWakeChannels = () => { writes++; save(); };
+  try { return fn(node, { lines, writes: () => writes }); } finally { fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+}
+
+describe('peer-info gossip', () => {
+  it('learns new channels with one line per frame, and a repeat of the same list is silent', () => {
+    withNode((node, io) => {
+      const now = Date.now();
+      const frame = { type: 'peer-info', peers: [
+        { nodeId: 'phone-1', name: 'unknown', wakeChannel: apns('t1'), lastSeen: now - 1000 },
+        { nodeId: 'phone-2', name: 'unknown', wakeChannel: apns('t2'), lastSeen: now - 2000 },
+      ] };
+      node._frameHandler._handlePeerInfo('peer-x', 'xmesh', frame);
+      assert.deepStrictEqual(io.lines.filter((l) => /Gossip/.test(l)), ['Gossip from xmesh: learned 2 wake channel(s)']);
+      assert.strictEqual(io.writes(), 1);
+      for (let i = 0; i < 50; i++) node._frameHandler._handlePeerInfo('peer-x', 'xmesh', frame);
+      assert.strictEqual(io.lines.filter((l) => /Gossip/.test(l)).length, 1, 'a reconnect storm logs nothing more');
+      assert.strictEqual(io.writes(), 1, 'and writes nothing more');
+      assert.strictEqual(node._peerWakeChannels.get('phone-1').lastSeen, now - 1000, 'lastSeen is the sighting the frame carried');
+    });
+  });
+
+  it('never replaces a token the phone gave us itself', () => {
+    withNode((node) => {
+      node._frameHandler._handleWakeChannel('phone-1', 'melotune', apns('own-token'));
+      node._frameHandler._handlePeerInfo('peer-x', 'mallory', { peers: [{ nodeId: 'phone-1', wakeChannel: apns('attacker'), lastSeen: Date.now() }] });
+      assert.strictEqual(node._peerWakeChannels.get('phone-1').token, 'own-token');
+      assert.strictEqual(node._peerWakeChannels.get('phone-1').source, 'direct');
+    });
+  });
+
+  it('replaces an older gossiped token only with a newer sighting', () => {
+    withNode((node) => {
+      const now = Date.now();
+      const wm = node._wakeManager;
+      assert.strictEqual(wm.learnWakeChannel('phone-1', apns('old'), { source: 'gossip', lastSeen: now - 5000 }), 'added');
+      assert.strictEqual(wm.learnWakeChannel('phone-1', apns('stale'), { source: 'gossip', lastSeen: now - 9000 }), 'ignored');
+      assert.strictEqual(wm.learnWakeChannel('phone-1', apns('fresh'), { source: 'gossip', lastSeen: now - 100 }), 'updated');
+      assert.strictEqual(node._peerWakeChannels.get('phone-1').token, 'fresh');
+    });
+  });
+
+  it('ignores a sighting older than the TTL and a frame entry with no sighting', () => {
+    withNode((node) => {
+      const wm = node._wakeManager;
+      assert.strictEqual(wm.learnWakeChannel('phone-1', apns('t'), { source: 'gossip', lastSeen: Date.now() - WAKE_CHANNEL_TTL_MS - DAY }), 'ignored');
+      assert.strictEqual(wm.learnWakeChannel('phone-2', apns('t'), { source: 'gossip' }), 'ignored', 'no lastSeen means no evidence');
+      assert.strictEqual(node._peerWakeChannels.size, 0);
+    });
+  });
+});
+
+describe('gossip sent and expiry', () => {
+  it('forwards the lastSeen it holds, not the time of sending, and drops expired channels', () => {
+    withNode((node) => {
+      const wm = node._wakeManager;
+      const now = Date.now();
+      wm.learnWakeChannel('phone-1', apns('a'), { source: 'gossip', lastSeen: now - 3 * DAY });
+      wm.learnWakeChannel('phone-2', apns('b'), { source: 'gossip', lastSeen: now - 1000 });
+      let t = now;
+      wm._now = () => t;
+      const out = wm.gossipEntries('peer-x');
+      assert.deepStrictEqual(out.map((e) => [e.nodeId, e.lastSeen]).sort(), [['phone-1', now - 3 * DAY], ['phone-2', now - 1000]]);
+      t = now + WAKE_CHANNEL_TTL_MS - 2 * DAY; // phone-1 is now past the TTL, phone-2 is not
+      assert.deepStrictEqual(wm.gossipEntries('peer-x').map((e) => e.nodeId), ['phone-2']);
+      assert.strictEqual(node._peerWakeChannels.has('phone-1'), false, 'the expired channel is gone from memory too');
+    });
+  });
+
+  it('gives a channel saved before lastSeen existed one TTL of grace, once', () => {
+    withNode((node) => {
+      const wm = node._wakeManager;
+      fs.mkdirSync(require('path').dirname(wm._wakeChannelsFile), { recursive: true });
+      fs.writeFileSync(wm._wakeChannelsFile, JSON.stringify({ 'old-phone': apns('legacy') }));
+      node._peerWakeChannels.clear();
+      const loadedAt = Date.now();
+      wm._now = () => loadedAt;
+      wm.loadWakeChannels();
+      assert.strictEqual(node._peerWakeChannels.get('old-phone').lastSeen, loadedAt);
+      wm.saveWakeChannels();
+      node._peerWakeChannels.clear();
+      wm._now = () => loadedAt + WAKE_CHANNEL_TTL_MS + DAY;
+      wm.loadWakeChannels();
+      assert.strictEqual(node._peerWakeChannels.has('old-phone'), false, 'the grace is not renewed by a later load');
+      assert.deepStrictEqual(JSON.parse(fs.readFileSync(wm._wakeChannelsFile, 'utf8')), {}, 'and the file is cleaned');
+    });
+  });
+});
+
+describe('relay peer list', () => {
+  it('learns from the relay with one line per list, silent on a repeat', () => {
+    withNode((node, io) => {
+      const relayLines = [];
+      node._relay._log = (m) => relayLines.push(m);
+      node._relay._setPhase = () => {};
+      const list = { type: 'relay-peers', peers: [
+        { nodeId: 'phone-1', name: 'melotune', wakeChannel: apns('r1'), offline: true },
+        { nodeId: 'phone-2', name: 'melomove', wakeChannel: apns('r2'), offline: true },
+      ] };
+      node._relay._handleRelayPeers(list);
+      node._relay._handleRelayPeers(list);
+      assert.deepStrictEqual(relayLines.filter((l) => /wake channel/.test(l)), ['Relay: learned 2 wake channel(s)']);
+      assert.strictEqual(io.writes(), 1, 'one write for the first list, none for the repeat');
+      assert.strictEqual(node._peerWakeChannels.get('phone-1').source, 'relay');
+    });
+  });
+
+  it('a gossiped token cannot repoint a channel the relay holds', () => {
+    withNode((node) => {
+      node._relay._learnWakeChannel('phone-1', apns('relay-token'), { source: 'relay' });
+      node._frameHandler._handlePeerInfo('peer-x', 'mallory', { peers: [{ nodeId: 'phone-1', wakeChannel: apns('attacker'), lastSeen: Date.now() }] });
+      assert.strictEqual(node._peerWakeChannels.get('phone-1').token, 'relay-token');
+    });
+  });
+});

From 83cf3d587304bda0f6f154c6bacd7755856f5d15 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 18:26:50 +0100
Subject: [PATCH 002/148] directed de-dup: key on the decoded signature, so a
 relay cannot replay by re-spelling it

The directed de-duplication mark was the carried assertionId (which no signature covers) or
the raw base64url signature string. Base64url decoding ignores padding and the unused bits
of the last character, so `sig + '='`, a twin final character, or an injected assertionId
all verified as the same signed record under a new mark, and a relay could make one signed
directed record surface again and again. The mark is now sha256 of the decoded signature
bytes. Ed25519 is deterministic, so one assertion has one signature.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 lib/frame-handler.js                    | 22 ++++++++++++++++---
 tests/audit-delivery-authorship.test.js | 29 +++++++++++++++++++++++++
 2 files changed, 48 insertions(+), 3 deletions(-)

diff --git a/lib/frame-handler.js b/lib/frame-handler.js
index b9358ad1..73781aa2 100644
--- a/lib/frame-handler.js
+++ b/lib/frame-handler.js
@@ -1,5 +1,7 @@
 'use strict';
 
+const crypto = require('crypto');
+
 const { recordKey, recordLineage, recordParents, recordCreatedBy, setRecordLineage } = require('./record');
 
 /**
@@ -39,6 +41,17 @@ const { encode, DIM, processHeuristicSVAF, computeCategoryVerdicts, decryptCateg
 // disambiguates itself with a salt (mesh-channel send path). The TTL must exceed the slowest
 // sender's replay horizon, and the spool's is unbounded — seven days covers every horizon
 // observed while the size cap still bounds the cache.
+/**
+ * A stable identity for a signature: sha256 of its decoded bytes, or null when there are none.
+ * @param {string} sig base64url
+ * @returns {string|null}
+ */
+function signatureMark(sig) {
+  if (typeof sig !== 'string' || !sig) return null;
+  const bytes = Buffer.from(sig, 'base64url');
+  return bytes.length ? `sig:${crypto.createHash('sha256').update(bytes).digest('hex')}` : null;
+}
+
 const SEEN_CMB_TTL_MS = 7 * 24 * 60 * 60 * 1000; // 7 days
 const SEEN_CMB_MAX = 10000;
 
@@ -797,10 +810,13 @@ class FrameHandler {
     // new signed send of the same words, or words already seen as a broadcast, surfaces. Nothing
     // unauthenticated widens the key — a frame timestamp or an unsigned createdTimestamp is the
     // sender's choice, and would let one peer surface the same content without bound (review F2).
+    //
+    // The mark is the hash of the decoded signature bytes, never a string a relay can re-spell:
+    // base64url decoding ignores padding and the unused bits of the last character, so `sig + '='`
+    // or a twin final character verifies as the same signature, and a carried `assertionId` is
+    // covered by no signature at all. Ed25519 is deterministic, so one assertion has one signature.
     const cognitionKey = recordKey(msg.cmb) || msg.key;
-    const assertionMark = msg._cmbVerified === true
-      ? (msg.cmb?.metadata?.assertionId || msg.cmb?.metadata?.sig || null)
-      : null;
+    const assertionMark = msg._cmbVerified === true ? signatureMark(msg.cmb?.metadata?.sig) : null;
     const incomingKey = cognitionKey && msg._directedToMe && assertionMark
       ? `${cognitionKey}#${assertionMark}`
       : cognitionKey;
diff --git a/tests/audit-delivery-authorship.test.js b/tests/audit-delivery-authorship.test.js
index d50bac74..53acb4a0 100644
--- a/tests/audit-delivery-authorship.test.js
+++ b/tests/audit-delivery-authorship.test.js
@@ -194,6 +194,35 @@ describe('directed delivery (MMP §9.2.2, §8.8.2)', () => {
     });
   });
 
+  it('N1: a relay cannot replay a signed directed record by re-spelling its signature or adding an assertionId', async () => {
+    await withNode('d2-respell', async (node) => {
+      node._pinPeerKey('peerA', PEER_A.pub);
+      node._svafEvaluator.evaluate = async () => REJECTED;
+      const seen = collect(node);
+      const f = directed(node, signed(mkCmb('approve the release', { to: node.nodeId })));
+      const sig = f.cmb.metadata.sig;
+      // The same 64 signature bytes, spelled three other ways base64url decoding accepts.
+      const B64 = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_';
+      const last = B64.indexOf(sig[sig.length - 1]);
+      const twin = B64[(last & 0b110000) | ((last + 1) & 0b001111)]; // same top 2 data bits, other padding bits
+      assert.deepStrictEqual(Buffer.from(sig.slice(0, -1) + twin, 'base64url'), Buffer.from(sig, 'base64url'));
+      const variants = [
+        (c) => { c.cmb.metadata.sig = sig + '='; },
+        (c) => { c.cmb.metadata.sig = sig.slice(0, -1) + twin; },
+        (c) => { c.cmb.metadata.assertionId = 'asrt-0000000000000000000000000000000000000000000000000000000000000000'; },
+      ];
+      node._frameHandler.handle('peerA', 'peerA', JSON.parse(JSON.stringify(f)));
+      await settle();
+      for (const v of variants) {
+        const copy = JSON.parse(JSON.stringify(f));
+        v(copy);
+        node._frameHandler.handle('peerA', 'peerA', copy);
+        await settle();
+      }
+      assert.strictEqual(seen.accepted.length, 1, 'every re-spelling is the same assertion');
+    });
+  });
+
   it('F2: an unverified directed CMB cannot widen its de-duplication key with unsigned fields', async () => {
     await withNode('d2-unsigned', async (node) => {
       node._svafEvaluator.evaluate = async () => REJECTED;

From 80a7d905e54fead8c0ecaee8487f9f50e9d73463 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 18:28:09 +0100
Subject: [PATCH 003/148] remember(): a record that cannot be signed is
 refused, not sent unsigned
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

§18.3.1: every Core Secure CMB MUST be signed. A signing failure was logged and the
record was then stored and broadcast unsigned, so a node with a broken key kept
emitting records every verifying peer refuses. remember() now throws ESIGN (with a
cmb-signing-failed metric) before anything is stored or dispatched, on first signing
and on the re-sign after a collapse. The daemon's IPC handler reports a failed command
as that command's error, instead of logging every handler error as a parse error.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 bin/sym-daemon.js              |  7 +++--
 lib/node.js                    | 32 +++++++++++++++-------
 tests/sign-fail-closed.test.js | 50 ++++++++++++++++++++++++++++++++++
 3 files changed, 77 insertions(+), 12 deletions(-)
 create mode 100644 tests/sign-fail-closed.test.js

diff --git a/bin/sym-daemon.js b/bin/sym-daemon.js
index ffe01a04..7bc689b9 100755
--- a/bin/sym-daemon.js
+++ b/bin/sym-daemon.js
@@ -228,10 +228,13 @@ function startIPCServer() {
         const line = buffer.slice(0, idx);
         buffer = buffer.slice(idx + 1);
         if (line.trim()) {
+          let msg;
+          try { msg = JSON.parse(line); } catch (err) { log(`IPC parse error: ${err.message}`); continue; }
           try {
-            handleIPCMessage(socketId, socket, JSON.parse(line));
+            handleIPCMessage(socketId, socket, msg);
           } catch (err) {
-            log(`IPC parse error: ${err.message}`);
+            log(`IPC ${msg && msg.type ? `'${msg.type}'` : 'message'} failed: ${err.message}`);
+            if (msg && msg.type) sendIPC(socket, { type: 'result', action: msg.type, error: err.message, code: err.code });
           }
         }
       }
diff --git a/lib/node.js b/lib/node.js
index b350a986..21c5602b 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -1979,11 +1979,9 @@ class SymNode extends EventEmitter {
       // Authenticate the CMB with this node's Ed25519 identity key. Receivers
       // verify the signature against the public key we announce in the
       // handshake and reject any CMB that is forged or tampered (MMP §8.3).
-      try {
-        signCMB(opts.cmb, this._identity.privateKey);
-      } catch (err) {
-        this._log(`CMB signing failed: ${err.message}`);
-      }
+      // A record that cannot be signed is not sent or stored unsigned (§18.3.1): a node whose key is
+      // broken must say so, not quietly emit records every verifying peer will refuse.
+      this._signOrThrow(opts.cmb, 'CMB signing failed');
     }
     // §7.5 COLLAPSE-BEFORE-MINT [MUST] — AC-2.4, the emit-side half of the Rule A self-loop.
     //
@@ -2007,11 +2005,7 @@ class SymNode extends EventEmitter {
       if (builtHere && opts.cmb.metadata) {
         opts.cmb.metadata.lineage = null;
         if (MMP_EMIT_V2) opts.cmb.metadata.assertionId = assertionIdV2_0(opts.cmb);
-        try {
-          signCMB(opts.cmb, this._identity.privateKey);
-        } catch (err) {
-          this._log(`CMB re-signing after collapse failed: ${err.message}`);
-        }
+        this._signOrThrow(opts.cmb, 'CMB re-signing after collapse failed');
       }
       this._metrics.collapsed = (this._metrics.collapsed ?? 0) + 1;
       this.emit('metric', { type: 'cmb-collapsed', key: mintKey, reason: 'identical-to-own-head' });
@@ -2163,6 +2157,24 @@ class SymNode extends EventEmitter {
     return entry;
   }
 
+  /**
+   * Sign a record with this node's identity key, or throw ESIGN. Nothing is stored or dispatched
+   * before this runs, so a failure leaves no unsigned copy anywhere.
+   * @private
+   */
+  _signOrThrow(cmb, what) {
+    try {
+      signCMB(cmb, this._identity.privateKey);
+    } catch (err) {
+      this._log(`${what}: ${err.message} — nothing stored or sent`);
+      this.emit('metric', { type: 'cmb-signing-failed', reason: err.message });
+      const e = new Error(`${what}: ${err.message}`);
+      e.code = 'ESIGN';
+      e.cause = err;
+      throw e;
+    }
+  }
+
   /**
    * Search local mesh memory by keyword.
    * See MMP v0.2.0 Section 6 (Memory).
diff --git a/tests/sign-fail-closed.test.js b/tests/sign-fail-closed.test.js
new file mode 100644
index 00000000..d2cc3482
--- /dev/null
+++ b/tests/sign-fail-closed.test.js
@@ -0,0 +1,50 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME to a temp sandbox before lib/config loads
+
+/**
+ * §18.3.1: every Core Secure CMB MUST be signed. A node that cannot sign used to log the failure and
+ * then store and broadcast the record unsigned; now remember() throws ESIGN before anything is
+ * stored or dispatched.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const { SymNode } = require('../lib/node');
+const { NullDiscovery } = require('../lib/discovery');
+const { nodeDir } = require('../lib/config');
+
+function withNode(fn) {
+  const name = `signfail-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+  const node = new SymNode({ name, silent: true, discovery: new NullDiscovery() });
+  try { return fn(node); } finally { fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+}
+
+describe('a record that cannot be signed', () => {
+  it('throws ESIGN, and nothing is stored or sent', () => {
+    withNode((node) => {
+      const sent = [];
+      node._peers.set('peer-1', { peerId: 'peer-1', name: 'peer', transport: { send: (f) => { sent.push(f); return true; } } });
+      const metrics = [];
+      node.on('metric', (m) => metrics.push(m));
+      const before = node._store.count ? node._store.count() : node.recall('').length;
+      node._identity.privateKey = 'not-a-key';
+      assert.throws(() => node.remember({ focus: 'unsignable' }), (e) => e.code === 'ESIGN');
+      const after = node._store.count ? node._store.count() : node.recall('').length;
+      assert.strictEqual(after, before, 'nothing stored');
+      assert.strictEqual(sent.filter((f) => f.type === 'cmb').length, 0, 'nothing sent');
+      assert.ok(metrics.some((m) => m.type === 'cmb-signing-failed'));
+    });
+  });
+
+  it('a node with a working key still signs and sends', () => {
+    withNode((node) => {
+      const sent = [];
+      node._peers.set('peer-1', { peerId: 'peer-1', name: 'peer', transport: { send: (f) => { sent.push(f); return true; } } });
+      const entry = node.remember({ focus: 'signable' });
+      assert.ok(entry?.cmb?.metadata?.sig, 'signed');
+      assert.strictEqual(sent.filter((f) => f.type === 'cmb').length, 1);
+    });
+  });
+});

From 741895a188ac0da043779d611e36342e342fd616 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 18:32:39 +0100
Subject: [PATCH 004/148] handshake + AAD: NFC-normalize the room and names, as
 the reference does
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

buildTranscript bound the room and both party names, and aeadAADv2 the
room, as raw code points. The published reference (conformance lib.mjs)
NFC-normalizes all three, and so does sym's own record signature. The same
visible text arrives composed or decomposed depending on where it was typed
(macOS tends to NFD), so two honest peers in the room "café" hashed
different transcripts and rejected each other's proofs, and a correctly
sealed frame failed authentication.

Tests: a decomposed room/name gives the same transcript and AAD bytes as
the composed one, and a frame sealed under one form opens under the other.
They fail on the previous code.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 lib/core/e2e-v2.js             |  6 +++++-
 lib/core/handshake-v2.js       | 10 ++++++++--
 tests/mmp-v2-e2e.test.js       | 30 ++++++++++++++++++++++++++++++
 tests/mmp-v2-handshake.test.js | 30 ++++++++++++++++++++++++++++++
 4 files changed, 73 insertions(+), 3 deletions(-)

diff --git a/lib/core/e2e-v2.js b/lib/core/e2e-v2.js
index b6e9b0e0..2ce72ca3 100644
--- a/lib/core/e2e-v2.js
+++ b/lib/core/e2e-v2.js
@@ -23,6 +23,10 @@ const { lp } = require('./cmb-encoder');
  * The AEAD associated data (mmp-aead-aad-v2), byte-exact with the published contract. Binds the
  * ciphertext to exactly one signed record and one position in the session, so a valid ciphertext
  * cannot be moved to another record, direction, or sequence.
+ *
+ * The room is NFC-normalized, as the published reference does and as the record signature
+ * already does: the same visible room name can arrive composed or decomposed, and an AAD built
+ * from the other form fails authentication on a frame that was sealed correctly.
  */
 function aeadAADv2({ protocolVersion, sessionId, direction, sequence, key, assertionId, createdByNodeId, room, to }) {
   return Buffer.concat([
@@ -34,7 +38,7 @@ function aeadAADv2({ protocolVersion, sessionId, direction, sequence, key, asser
     lp(String(key)),
     lp(String(assertionId)),
     lp(String(createdByNodeId)),
-    lp(String(room ?? '')),
+    lp(String(room ?? '').normalize('NFC')),
     lp(String(to ?? '')),
   ]);
 }
diff --git a/lib/core/handshake-v2.js b/lib/core/handshake-v2.js
index 37da8706..4269709d 100644
--- a/lib/core/handshake-v2.js
+++ b/lib/core/handshake-v2.js
@@ -47,6 +47,12 @@ const dec = (n) => String(n >>> 0);
  * Each party carries its own `nonce` (as it does on its hello frame); both nonces are emitted,
  * client then server, before the party blocks.
  *
+ * The room and both names are NFC-normalized, as the published reference does. They are the
+ * human-typed values in the transcript, and the same visible text can arrive as different code
+ * points: macOS input and file names tend to produce decomposed (NFD) forms, most other systems
+ * composed (NFC). Without normalization two peers that agree on the room "café" would hash
+ * different transcripts, and every proof between them would fail as if one were an impostor.
+ *
  * @param {object} o
  * @param {string} o.protocolVersion
  * @param {string} o.room
@@ -64,7 +70,7 @@ function buildTranscript({ protocolVersion, room, client, server, selectedExtens
       lp(String(p.nodeId)),
       lp(String(p.identityPublicKey)),
       lp(String(p.e2ePublicKey)),
-      lp(String(p.name)),
+      lp(String(p.name).normalize('NFC')),
       lp(String(p.implementation && p.implementation.name)),
       lp(String(p.implementation && p.implementation.version)),
       lp(dec(exts.length)),
@@ -75,7 +81,7 @@ function buildTranscript({ protocolVersion, room, client, server, selectedExtens
   return Buffer.concat([
     Buffer.from(TRANSCRIPT_DOMAIN, 'utf8'),
     lp(String(protocolVersion)),
-    lp(String(room)),
+    lp(String(room).normalize('NFC')),
     lp(String(clientNonce)),
     lp(String(serverNonce)),
     ...party(client),
diff --git a/tests/mmp-v2-e2e.test.js b/tests/mmp-v2-e2e.test.js
index 869b149e..b0048c39 100644
--- a/tests/mmp-v2-e2e.test.js
+++ b/tests/mmp-v2-e2e.test.js
@@ -46,3 +46,33 @@ describe('MMP v2.0 E2E AEAD conformance (X25519-HKDF-SHA256-ChaCha20-Poly1305)',
     });
   }
 });
+
+// The AAD binds the record's room. The same visible room name can arrive composed or
+// decomposed; the reference NFC-normalizes it (as the record signature does), so a frame sealed
+// by a peer that typed the other form still authenticates.
+describe('MMP v2.0 AAD: the room is NFC-normalized', () => {
+  const m = vec.metadata;
+  const c = vec.cases[0];
+  const aadFor = (room) => aeadAADv2({
+    protocolVersion: vec.protocolVersion, sessionId: vec.sessionId,
+    direction: c.direction, sequence: c.sequence,
+    key: m.key, assertionId: m.assertionId, createdByNodeId: m.createdByNodeId, room, to: m.to,
+  });
+
+  it('a decomposed room produces the same AAD bytes as the composed one', () => {
+    const NFC = 'café-rööm';
+    const NFD = 'café-rööm';
+    assert.notStrictEqual(NFC, NFD);
+    assert.strictEqual(aadFor(NFD).toString('hex'), aadFor(NFC).toString('hex'));
+    assert.ok(aadFor(NFD).includes(Buffer.from(NFC, 'utf8')), 'the AAD carries the composed form');
+  });
+
+  it('so a frame sealed under the composed room opens under the decomposed one', () => {
+    const NFC = 'café-room';
+    const NFD = 'café-room';
+    const key = Buffer.from(c.trafficKeyHex, 'hex');
+    const nonce = Buffer.from(c.nonceHex, 'hex');
+    const sealed = sealV2(key, nonce, aadFor(NFC), Buffer.from('x'));
+    assert.strictEqual(openV2(key, nonce, aadFor(NFD), sealed).toString(), 'x');
+  });
+});
diff --git a/tests/mmp-v2-handshake.test.js b/tests/mmp-v2-handshake.test.js
index 28ddeb86..7aa6a39e 100644
--- a/tests/mmp-v2-handshake.test.js
+++ b/tests/mmp-v2-handshake.test.js
@@ -123,3 +123,33 @@ describe('MMP v2.0 transcript construction + extension binding', () => {
     assert.ok(buildTranscript(withExt).includes(Buffer.from(EXT_CMB_ENCRYPTED_V2, 'utf8')));
   });
 });
+
+// The room and the two names are the human-typed values in the transcript, and the same visible
+// text arrives as different code points depending on where it was typed (macOS tends to NFD,
+// most other systems NFC). The reference NFC-normalizes them; a transcript that did not would
+// make two honest peers hash different bytes and reject each other's proofs.
+describe('MMP v2.0 transcript: room and names are NFC-normalized', () => {
+  const NFC = 'café-rööm';                 // composed é, ö
+  const NFD = 'café-rööm';              // e + combining acute, o + combining diaeresis
+  const withText = (room, clientName, serverName) => {
+    const h = JSON.parse(JSON.stringify(vec.fixture.handshake));
+    h.room = room;
+    h.client.name = clientName;
+    h.server.name = serverName;
+    return h;
+  };
+
+  it('precondition: the two spellings are different code points for the same text', () => {
+    assert.notStrictEqual(NFC, NFD);
+    assert.strictEqual(NFD.normalize('NFC'), NFC);
+  });
+
+  it('a decomposed room or name produces the same transcript bytes as the composed one', () => {
+    const composed = buildTranscript(withText(NFC, NFC, NFC));
+    assert.strictEqual(buildTranscript(withText(NFD, NFC, NFC)).toString('hex'), composed.toString('hex'), 'room');
+    assert.strictEqual(buildTranscript(withText(NFC, NFD, NFC)).toString('hex'), composed.toString('hex'), 'client name');
+    assert.strictEqual(buildTranscript(withText(NFC, NFC, NFD)).toString('hex'), composed.toString('hex'), 'server name');
+    assert.ok(composed.includes(Buffer.from(NFC, 'utf8')), 'the transcript carries the composed form');
+    assert.ok(!buildTranscript(withText(NFD, NFD, NFD)).includes(Buffer.from(NFD, 'utf8')), 'never the decomposed one');
+  });
+});

From 628567988f444a178bbfd4394aa59aaa0595bb0c Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 18:33:45 +0100
Subject: [PATCH 005/148] wake channels: persist a repeat sighting only once it
 moves lastSeen by an hour

The relay's list is first-hand evidence, so each repeat moved lastSeen by a few
milliseconds and asked for a save: a file write per relay reconnect. Against a 30-day
TTL that precision is worthless. The record is still updated in memory; a save is
asked for only when lastSeen moves by an hour or the source gets stronger.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 lib/core/wake.js            |  6 ++++++
 tests/wake-channels.test.js | 16 ++++++++++++++++
 2 files changed, 22 insertions(+)

diff --git a/lib/core/wake.js b/lib/core/wake.js
index fd7875c7..fe3ff1c1 100644
--- a/lib/core/wake.js
+++ b/lib/core/wake.js
@@ -28,6 +28,9 @@ function ensureDir(dir) {
 /** A wake channel nobody has seen first-hand for this long is dropped (30 days). */
 const WAKE_CHANNEL_TTL_MS = 30 * 24 * 60 * 60 * 1000;
 
+/** A newer sighting of the same channel is worth persisting once it moves lastSeen by this much. */
+const REFRESH_GRANULARITY_MS = 60 * 60 * 1000;
+
 /** How far each source of a wake channel is trusted. Gossip is unauthenticated. */
 const SOURCE_RANK = Object.freeze({ legacy: 0, gossip: 1, relay: 2, direct: 3 });
 
@@ -134,6 +137,9 @@ class WakeManager {
       const keepSeen = Math.max(seen, prev.lastSeen ?? 0);
       if (keepSource === prev.source && keepSeen === prev.lastSeen) return 'unchanged';
       this._peerWakeChannels.set(nodeId, { ...prev, source: keepSource, lastSeen: keepSeen });
+      // Against a 30-day TTL a sighting a few minutes newer changes nothing worth a write: the
+      // record is updated in memory, and reported as needing a save only once it moves by an hour.
+      if (keepSource === prev.source && keepSeen - (prev.lastSeen ?? 0) < REFRESH_GRANULARITY_MS) return 'unchanged';
       return 'refreshed';
     }
     // A different token: only a source at least as strong may replace it, and gossip must also be newer.
diff --git a/tests/wake-channels.test.js b/tests/wake-channels.test.js
index 7f89e091..20ddc51f 100644
--- a/tests/wake-channels.test.js
+++ b/tests/wake-channels.test.js
@@ -80,6 +80,22 @@ describe('peer-info gossip', () => {
   });
 });
 
+describe('refreshes', () => {
+  it('a repeat sighting updates memory, and asks for a save only once it is an hour newer', () => {
+    withNode((node) => {
+      const wm = node._wakeManager;
+      let t = 1_000_000_000_000;
+      wm._now = () => t;
+      assert.strictEqual(wm.learnWakeChannel('phone-1', apns('t'), { source: 'direct' }), 'added');
+      t += 5 * 60 * 1000;
+      assert.strictEqual(wm.learnWakeChannel('phone-1', apns('t'), { source: 'direct' }), 'unchanged');
+      assert.strictEqual(node._peerWakeChannels.get('phone-1').lastSeen, t, 'memory still holds the newest sighting');
+      t += 61 * 60 * 1000;
+      assert.strictEqual(wm.learnWakeChannel('phone-1', apns('t'), { source: 'direct' }), 'refreshed');
+    });
+  });
+});
+
 describe('gossip sent and expiry', () => {
   it('forwards the lastSeen it holds, not the time of sending, and drops expired channels', () => {
     withNode((node) => {

From 8e9347f33865be844a6267ee06e217d45a591aea Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 18:33:45 +0100
Subject: [PATCH 006/148] records: an explicit room, measured moods, bounded
 sizes; unsigned receipts counted
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- B-R10 (§7): createCMB names the room 'default' when the author names none, instead of
  null, which signed the string "null" and read as "every room" on receipt. checkAudience
  now places a record without a room in 'default', so it is not admitted in every room it
  is replayed into, and the v2.0 preimage refuses a record with no room. A fixture that
  set a top-level `room` (read by nothing) passed only through that hole.
- B-R11: mood valence and arousal are kept only when measured, and must be numbers in
  [-1, 1]. They were invented as 0 when absent, and a mood given only as numbers became
  {text:'neutral'}, dropping them.
- B-R13: a category is at most 256 KiB, the seven at most 960 KiB, an agent id at most
  64 bytes (§3.1.2), so every record fits a 1 MiB frame. createCMB throws ECMBSIZE, and
  a receiver refuses an oversized record before rendering, verifying or storing it
  (metric cmb-oversize-rejected).
- B-R3 (interim): an unsigned record is still accepted as unverified, but each one is
  counted (metric cmb-unsigned-received) and the peer is named once in the log, so the
  emitters a signed-only default would cut off can be found first.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 lib/core/cmb-encoder.js                |  63 ++++++++++--
 lib/core/cmb-signing.js                |  14 ++-
 lib/frame-handler.js                   |  25 +++++
 tests/frame-handler-author-key.test.js |   5 +-
 tests/record-bounds.test.js            | 127 +++++++++++++++++++++++++
 5 files changed, 221 insertions(+), 13 deletions(-)
 create mode 100644 tests/record-bounds.test.js

diff --git a/lib/core/cmb-encoder.js b/lib/core/cmb-encoder.js
index a551f8ca..edeab1ec 100644
--- a/lib/core/cmb-encoder.js
+++ b/lib/core/cmb-encoder.js
@@ -456,6 +456,40 @@ function encodeCategory(text) {
  * @returns {{categories: object, metadata: object}} The two-section record (§7.1): `categories` is what
  *   the agent says, `metadata` is what the mesh proves. No third section exists.
  */
+/** The room a record names when its author names none (§7): the literal 'default'. */
+const DEFAULT_ROOM = 'default';
+/** §3.1.2: an agent id is 1–64 bytes. */
+const MAX_NAME_BYTES = 64;
+/**
+ * Size bounds. The spec says categories are bounded but gives no number; these keep every record
+ * sendable: one category may not take more than a quarter of a 1 MiB frame, and the seven together
+ * leave room for metadata and the signature inside it.
+ */
+const MAX_CATEGORY_BYTES = 256 * 1024;
+const MAX_RECORD_TEXT_BYTES = 960 * 1024;
+
+/**
+ * Throw ECMBSIZE when a category, or the record's text as a whole, is over its bound, or the author
+ * id is longer than §3.1.2 allows. Shared by the emitter and the receiver.
+ * @param {object} categories
+ * @param {string} [createdBy]
+ */
+function assertRecordSize(categories, createdBy) {
+  const fail = (msg) => { const e = new RangeError(msg); e.code = 'ECMBSIZE'; throw e; };
+  if (typeof createdBy === 'string' && Buffer.byteLength(createdBy, 'utf8') > MAX_NAME_BYTES) {
+    fail(`createdBy is ${Buffer.byteLength(createdBy, 'utf8')} bytes; an agent id is at most ${MAX_NAME_BYTES} (§3.1.2)`);
+  }
+  let total = 0;
+  for (const f of CAT7_CATEGORIES) {
+    const text = categories?.[f]?.text;
+    if (typeof text !== 'string') continue;
+    const n = Buffer.byteLength(text, 'utf8');
+    if (n > MAX_CATEGORY_BYTES) fail(`${f} is ${n} bytes; a category is at most ${MAX_CATEGORY_BYTES}`);
+    total += n;
+  }
+  if (total > MAX_RECORD_TEXT_BYTES) fail(`the categories total ${total} bytes; a record's text is at most ${MAX_RECORD_TEXT_BYTES}`);
+}
+
 function createCMB(opts = {}) {
   // §7.2 [MUST]: createdBy is the agent id and is REQUIRED. It used to default to the string
   // 'unknown', which minted a record whose author could never be resolved to a key — an
@@ -494,17 +528,26 @@ function createCMB(opts = {}) {
     // receiver-autonomous and kernel-local, so drift is measured against the receiver's anchors
     // in the receiver's kernel, and a sender's vector is comparable only if kernels match,
     // which nothing guarantees.
-    if (f === 'mood' && typeof value === 'object' && value.text) {
-      categories[f] = {
-        text: value.text,
-        valence: value.valence ?? 0,
-        arousal: value.arousal ?? 0,
-      };
+    if (f === 'mood' && value && typeof value === 'object') {
+      // valence and arousal are measurements in [-1, 1]. One that is absent is OMITTED, never
+      // invented as 0 (a 0 claims a measured neutral), and one out of range is refused. A mood given
+      // only as numbers keeps them: dropping to {text:'neutral'} threw the measurement away.
+      const mood = { text: (typeof value.text === 'string' && value.text) || 'neutral' };
+      for (const axis of ['valence', 'arousal']) {
+        const v = value[axis];
+        if (v === undefined || v === null) continue;
+        if (typeof v !== 'number' || !Number.isFinite(v) || v < -1 || v > 1) {
+          throw new RangeError(`createCMB: mood.${axis} must be a number in [-1, 1] (got ${JSON.stringify(v)})`);
+        }
+        mood[axis] = v;
+      }
+      categories[f] = mood;
     } else {
       const text = (typeof value === 'string' ? value : value?.text) || 'neutral';
       categories[f] = { text };
     }
   }
+  assertRecordSize(categories, createdBy);
 
   // Per-category metadata (§7.3): each category carries its own address and its own semantic
   // descent. This is the section's reason to exist — admission verdicts, anchors, membrane
@@ -536,7 +579,9 @@ function createCMB(opts = {}) {
     createdBy,
     createdTimestamp,
     lineage: opts.lineage || null,
-    room: opts.room ?? null,
+    // §7: the room is explicit, and a record with none is in the literal room 'default'. A null
+    // here signed the string "null" and read as "every room" on receipt.
+    room: (typeof opts.room === 'string' && opts.room) ? opts.room : DEFAULT_ROOM,
     to: opts.to ?? null,
   };
 
@@ -651,4 +696,8 @@ module.exports = {
   cosineSimilarity,
   l2Normalize,
   CAT7_CATEGORIES,
+  assertRecordSize,
+  DEFAULT_ROOM,
+  MAX_CATEGORY_BYTES,
+  MAX_RECORD_TEXT_BYTES,
 };
diff --git a/lib/core/cmb-signing.js b/lib/core/cmb-signing.js
index 8bb1dc89..90008e87 100644
--- a/lib/core/cmb-signing.js
+++ b/lib/core/cmb-signing.js
@@ -212,6 +212,11 @@ function signingPayloadV2_0(cmb) {
   if (m.lineage != null && m.lineage.parents != null && !Array.isArray(m.lineage.parents)) {
     throw new Error('mmp-sig-v2.0: lineage.parents must be an array when present');
   }
+  // The v2.0 schema requires a room (minLength 1): signing the string "null" made a record nobody
+  // could place, so a v2.0 record without one is refused rather than signed.
+  if (typeof m.room !== 'string' || m.room.length === 0) {
+    throw new Error('mmp-sig-v2.0 requires metadata.room, a non-empty string');
+  }
   const parents = sortedBytewise(m.lineage?.parents ?? []);
   return Buffer.concat([
     Buffer.from('mmp-sig-v2.0\n', 'utf8'),
@@ -302,10 +307,11 @@ function checkAudience(cmb, receiverRoom, receiverNodeId) {
   // invisible acceptance.
   if (receiverRoom == null) return { ok: false, reason: 'receiver-room-unknown' };
 
-  // An ABSENT room on the record still means BROADCAST, and that is semantics rather than a
-  // fallback: the author addressed everyone. It is kept, and it is the only permissive path left.
-  const room = m.room != null ? String(m.room).normalize('NFC') : '';
-  if (room && room !== String(receiverRoom).normalize('NFC')) {
+  // §7: a record names its room, and one that names none is in the literal room 'default'. It
+  // used to mean "every room", the one permissive path left, so a record minted without a room
+  // was admitted wherever it was replayed.
+  const room = (m.room != null && m.room !== '') ? String(m.room).normalize('NFC') : 'default';
+  if (room !== String(receiverRoom).normalize('NFC')) {
     return { ok: false, reason: 'wrong-audience' };
   }
   const to = m.to != null ? String(m.to).normalize('NFC') : '';
diff --git a/lib/frame-handler.js b/lib/frame-handler.js
index 73781aa2..d0407f01 100644
--- a/lib/frame-handler.js
+++ b/lib/frame-handler.js
@@ -3,6 +3,7 @@
 const crypto = require('crypto');
 
 const { recordKey, recordLineage, recordParents, recordCreatedBy, setRecordLineage } = require('./record');
+const { assertRecordSize } = require('./core/cmb-encoder');
 
 /**
  * @module @sym-bot/sym/frame-handler
@@ -75,6 +76,7 @@ class FrameHandler {
   constructor(node, opts = {}) {
     this._node = node;
     this._cliHostMode = opts.cliHostMode || false;
+    this._unsignedWarned = new Set();
     // THE ADMISSION SEAM (sym-core split). Frame routing is open; the engine that judges an
     // inbound block is injectable. Stock nodes run the open §9.2 baseline; a consumer may
     // substitute its own engine with the same call contract. The post-admission observer is a
@@ -716,6 +718,19 @@ class FrameHandler {
       }
     }
 
+    // Size first: an oversized record is refused before anything renders, verifies or stores it,
+    // under the same bounds the emitter enforces.
+    if (msg.cmb?.categories) {
+      try {
+        assertRecordSize(msg.cmb.categories, recordCreatedBy(msg.cmb));
+      } catch (err) {
+        if (err.code !== 'ECMBSIZE') throw err;
+        this._node._log(`CMB from ${peerName} refused: ${err.message}`);
+        this._node.emit('metric', { type: 'cmb-oversize-rejected', from: peerName, key: recordKey(msg.cmb), reason: err.message });
+        return;
+      }
+    }
+
     // Derive content from CMB categories if not present on the frame
     // (MMP Section 7: cmb frames carry structured categories, not necessarily a content string)
     if (!msg.content && msg.cmb?.categories) {
@@ -734,6 +749,16 @@ class FrameHandler {
     // through for interop but flagged unverified on msg._cmbVerified.
     if (this._rejectOnBadSignature(peerId, peerName, msg)) return;
 
+    // An UNSIGNED record is still accepted (as unverified) for interop, but counted and named once
+    // per peer, so the emitters that would break under a signed-only default can be found first.
+    if (msg.cmb?.metadata && !msg.cmb.metadata.sig) {
+      this._node.emit('metric', { type: 'cmb-unsigned-received', from: peerName, key: recordKey(msg.cmb) });
+      if (!this._unsignedWarned.has(peerId)) {
+        this._unsignedWarned.add(peerId);
+        this._node._log(`UNSIGNED CMB from ${peerName}: accepted as unverified. A future release will refuse unsigned records by default.`);
+      }
+    }
+
     // Who wrote it, and who handed it to us. `name` is the author's record label (MMP §8.8.4:
     // a display label, not an identity). Every surfaced and stored entry carries this, so no
     // layer has to read the store envelope's "<receiver>+<sender>".
diff --git a/tests/frame-handler-author-key.test.js b/tests/frame-handler-author-key.test.js
index b8e96b07..72bda389 100644
--- a/tests/frame-handler-author-key.test.js
+++ b/tests/frame-handler-author-key.test.js
@@ -44,8 +44,9 @@ function identity() {
 
 /** A signed CMB as it appears on the wire (emit.js: whole object, then signCMB). */
 function signedCMB({ author, signWith }) {
-  const cmb = createCMB({ categories: { focus: 'a relayed observation' }, createdBy: author });
-  cmb.room = GROUP;
+  // The room goes in metadata, where the signature binds it. (A top-level `room` is read by
+  // nothing; this fixture once passed only because a record with no room read as "every room".)
+  const cmb = createCMB({ categories: { focus: 'a relayed observation' }, createdBy: author, room: GROUP });
   signCMB(cmb, signWith);
   return cmb;
 }
diff --git a/tests/record-bounds.test.js b/tests/record-bounds.test.js
new file mode 100644
index 00000000..7e38e2de
--- /dev/null
+++ b/tests/record-bounds.test.js
@@ -0,0 +1,127 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME to a temp sandbox before lib/config loads
+
+/**
+ * What a record may carry, on the emitting side and the receiving side alike:
+ * - B-R10: a record names its room; one that names none is in the literal room 'default' (§7),
+ *   not "every room", and a v2.0 record without a room is not signed.
+ * - B-R11: mood valence and arousal are measurements in [-1, 1]: absent ones are omitted, not
+ *   invented as 0, out-of-range ones are refused, and numbers given without text are kept.
+ * - B-R13: a category is at most 256 KiB, the seven together at most 960 KiB, an agent id at most
+ *   64 bytes (§3.1.2), so every record fits a 1 MiB frame. Receivers refuse what emitters may not mint.
+ * - B-R3 (interim): an unsigned record is accepted as unverified, counted, and named once per peer.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const { createCMB, checkAudience, signCMB } = require('../lib/core');
+const { MAX_CATEGORY_BYTES, MAX_RECORD_TEXT_BYTES } = require('../lib/core/cmb-encoder');
+const { signingPayloadV2_0 } = require('../lib/core/cmb-signing');
+const { SymNode } = require('../lib/node');
+const { NullDiscovery } = require('../lib/discovery');
+const { nodeDir } = require('../lib/config');
+
+describe('room (B-R10)', () => {
+  it('a record minted without a room is in the room "default"', () => {
+    const cmb = createCMB({ categories: { focus: 'x' }, createdBy: 'a' });
+    assert.strictEqual(cmb.metadata.room, 'default');
+  });
+
+  it('a record with no room is refused outside "default", accepted inside it', () => {
+    const cmb = createCMB({ categories: { focus: 'x' }, createdBy: 'a' });
+    cmb.metadata.room = null; // as an older emitter minted it
+    assert.deepStrictEqual(checkAudience(cmb, 'xmesh-world-room', 'me'), { ok: false, reason: 'wrong-audience' });
+    assert.deepStrictEqual(checkAudience(cmb, 'default', 'me'), { ok: true });
+  });
+
+  it('the v2.0 preimage refuses a record without a room instead of signing "null"', () => {
+    const cmb = createCMB({ categories: { focus: 'x' }, createdBy: 'a', emitV2: true, createdByNodeId: 'node-a' });
+    cmb.metadata.room = null;
+    assert.throws(() => signingPayloadV2_0(cmb), /requires metadata.room/);
+  });
+});
+
+describe('mood (B-R11)', () => {
+  const mood = (m) => createCMB({ categories: { focus: 'x', mood: m }, createdBy: 'a' }).categories.mood;
+  it('keeps measured values, and omits the ones not given', () => {
+    assert.deepStrictEqual({ ...mood({ text: 'calm', valence: 0.4, arousal: -0.2 }), meta: undefined }, { text: 'calm', valence: 0.4, arousal: -0.2, meta: undefined });
+    const m = mood({ text: 'calm' });
+    assert.strictEqual('valence' in m, false, 'no invented 0');
+    assert.strictEqual('arousal' in m, false);
+  });
+  it('keeps numbers given without text', () => {
+    const m = mood({ valence: -0.8 });
+    assert.strictEqual(m.text, 'neutral');
+    assert.strictEqual(m.valence, -0.8);
+  });
+  it('refuses values outside [-1, 1] or not numbers', () => {
+    for (const bad of [7, -1.01, Number.NaN, '0.5']) {
+      assert.throws(() => mood({ text: 'x', valence: bad }), RangeError);
+      assert.throws(() => mood({ text: 'x', arousal: bad }), RangeError);
+    }
+  });
+});
+
+describe('size (B-R13)', () => {
+  const big = (n) => 'a'.repeat(n);
+  it('refuses a category over 256 KiB and a record whose text is over 960 KiB', () => {
+    assert.throws(() => createCMB({ categories: { focus: big(MAX_CATEGORY_BYTES + 1) }, createdBy: 'a' }), (e) => e.code === 'ECMBSIZE');
+    const near = big(MAX_CATEGORY_BYTES);
+    assert.throws(() => createCMB({ categories: { focus: near, issue: near, intent: near, motivation: near }, createdBy: 'a' }), (e) => e.code === 'ECMBSIZE' && /total/.test(e.message));
+    assert.ok(MAX_RECORD_TEXT_BYTES < 1024 * 1024);
+  });
+  it('counts bytes, not characters', () => {
+    const emoji = '😀'.repeat(MAX_CATEGORY_BYTES / 4 + 1); // 4 bytes each
+    assert.throws(() => createCMB({ categories: { focus: emoji }, createdBy: 'a' }), (e) => e.code === 'ECMBSIZE');
+  });
+  it('refuses an agent id over 64 bytes', () => {
+    assert.throws(() => createCMB({ categories: { focus: 'x' }, createdBy: 'n'.repeat(65) }), (e) => e.code === 'ECMBSIZE');
+    assert.ok(createCMB({ categories: { focus: 'x' }, createdBy: 'n'.repeat(64) }));
+  });
+});
+
+describe('on receipt', () => {
+  function withNode(fn) {
+    const name = `bounds-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+    const node = new SymNode({ name, silent: true, discovery: new NullDiscovery() });
+    const metrics = [];
+    const lines = [];
+    node.on('metric', (m) => metrics.push(m));
+    node._log = (m) => lines.push(m);
+    try { return fn(node, metrics, lines); } finally { fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+  }
+
+  it('refuses an oversized record before it is verified, stored or surfaced', () => {
+    withNode((node, metrics) => {
+      const cmb = createCMB({ categories: { focus: 'fine' }, createdBy: 'peer-a' });
+      cmb.categories.focus.text = 'a'.repeat(MAX_CATEGORY_BYTES + 1); // a peer that skipped the bound
+      let surfaced = 0;
+      node.on('cmb-accepted', () => surfaced++);
+      node._frameHandler.handle('peer-a', 'peer-a', { type: 'cmb', cmb, timestamp: Date.now() });
+      assert.ok(metrics.some((m) => m.type === 'cmb-oversize-rejected'));
+      assert.strictEqual(surfaced, 0);
+    });
+  });
+
+  it('counts every unsigned record and names the peer once', () => {
+    withNode((node, metrics, lines) => {
+      for (let i = 0; i < 3; i++) {
+        const cmb = createCMB({ categories: { focus: `unsigned ${i}` }, createdBy: 'old-peer' });
+        node._frameHandler.handle('peer-old', 'old-peer', { type: 'cmb', cmb, timestamp: Date.now() });
+      }
+      assert.strictEqual(metrics.filter((m) => m.type === 'cmb-unsigned-received').length, 3);
+      assert.strictEqual(lines.filter((l) => /UNSIGNED CMB from old-peer/.test(l)).length, 1);
+    });
+  });
+
+  it('a signed record is not counted as unsigned', () => {
+    withNode((node, metrics) => {
+      const cmb = createCMB({ categories: { focus: 'signed' }, createdBy: node.name });
+      signCMB(cmb, node._identity.privateKey);
+      node._frameHandler.handle('peer-x', 'peer-x', { type: 'cmb', cmb, timestamp: Date.now() });
+      assert.strictEqual(metrics.filter((m) => m.type === 'cmb-unsigned-received').length, 0);
+    });
+  });
+});

From ae2e5b8dbfe78b69443244e1381a856bb0d7fabf Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 18:34:12 +0100
Subject: [PATCH 007/148] tests: consume the published v2 conformance vectors
 verbatim, add application-v2

The SDK's record-signature and handshake vectors were not the published
files: they lacked the 2026-09-14 errata fields (`usage`,
`expectedSignatureIsOneOfMany`), and the tests asserted the opposite of
what those fields say, comparing our Ed25519 signatures and handshake proofs
byte for byte. A hedged signer (WebKit, CryptoKit) is conforming and fails
that comparison. There was also no SDK copy of application-v2 and no test
of the mmp-app-v1 commitment.

- copy all four published conformance/v2 files verbatim
  (record-signature, handshake, e2e, application)
- signing: reproduce the preimage, assertion id and category commitment
  exactly; verify expectedSignature, never reproduce it
- handshake: reproduce both proof payloads; verify the published proofs and
  two of our own signings, no byte comparison
- new application-v2 test: both commitments, payload integrity, refusal of
  a changed byte, a wrong length and padded base64url
- new digest pin: each local vector must hash to the published manifest's
  sha256, so a hand edit or a stale copy fails instead of drifting

The digest pins and the errata assertions fail on the previous copies.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 tests/mmp-v2-application.test.js          |  64 ++++++++
 tests/mmp-v2-application.vector.json      |  24 +++
 tests/mmp-v2-handshake.test.js            |  37 ++++-
 tests/mmp-v2-handshake.vector.json        |   1 +
 tests/mmp-v2-record-signature.vector.json | 188 +++++++++++++++++++++-
 tests/mmp-v2-signing.test.js              |  45 +++---
 tests/mmp-v2-vectors-published.test.js    |  33 ++++
 7 files changed, 367 insertions(+), 25 deletions(-)
 create mode 100644 tests/mmp-v2-application.test.js
 create mode 100644 tests/mmp-v2-application.vector.json
 create mode 100644 tests/mmp-v2-vectors-published.test.js

diff --git a/tests/mmp-v2-application.test.js b/tests/mmp-v2-application.test.js
new file mode 100644
index 00000000..8b0abf6f
--- /dev/null
+++ b/tests/mmp-v2-application.test.js
@@ -0,0 +1,64 @@
+'use strict';
+
+// MMP v2.0 application commitment conformance (mmp-app-v1). The application section is the
+// one place a record carries opaque, actionable bytes (a deploy instruction, a tool call), and
+// the record signature commits to it only through this commitment. So sym must reproduce the
+// published commitment exactly for both the absent and the present case, and must refuse a
+// section whose bytes no longer match what it declares — otherwise a relay could alter the
+// payload under a valid signature. Vector: the published application-v2.json, copied verbatim
+// (digest pinned in mmp-v2-vectors-published.test.js).
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const crypto = require('crypto');
+const { applicationCommitmentV1 } = require('../lib/core/cmb-signing');
+const vec = require('./mmp-v2-application.vector.json');
+const sigVec = require('./mmp-v2-record-signature.vector.json');
+
+describe('MMP v2.0 application commitment conformance (mmp-app-v1)', () => {
+  it('the vector is the mmp-app-v1 construction for protocol 2.0', () => {
+    assert.strictEqual(vec.protocolVersion, '2.0');
+    assert.strictEqual(vec.construction, 'mmp-app-v1');
+  });
+
+  for (const c of vec.cases) {
+    it(`commitment reproduces the published bytes — ${c.label}`, () => {
+      assert.strictEqual(applicationCommitmentV1(c.application), c.expectedCommitment);
+    });
+  }
+
+  const present = vec.cases.find((c) => c.application);
+  const absent = vec.cases.find((c) => c.application === null);
+
+  it('absent and present are distinct commitments (an absent section is not an empty one)', () => {
+    assert.notStrictEqual(absent.expectedCommitment, present.expectedCommitment);
+    assert.strictEqual(applicationCommitmentV1(undefined), absent.expectedCommitment, 'undefined is absent too');
+  });
+
+  it('the present case carries exactly the bytes it declares', () => {
+    const bytes = Buffer.from(present.application.data, 'base64url');
+    assert.strictEqual(bytes.toString('utf8'), present.decodedDataUtf8);
+    assert.strictEqual(bytes.length, present.application.byteLength);
+    assert.strictEqual(`sha256-${crypto.createHash('sha256').update(bytes).digest('hex')}`, present.application.digest);
+  });
+
+  it('one changed payload byte is refused, not committed to', () => {
+    const bytes = Buffer.from(present.application.data, 'base64url');
+    bytes[0] ^= 0x01;
+    const tampered = { ...present.application, data: bytes.toString('base64url') };
+    assert.throws(() => applicationCommitmentV1(tampered), /digest mismatch/);
+  });
+
+  it('a declared length that does not match the bytes is refused', () => {
+    assert.throws(() => applicationCommitmentV1({ ...present.application, byteLength: present.application.byteLength + 1 }), /byteLength mismatch/);
+  });
+
+  it('padded or non-canonical base64url is refused (one payload, one encoding)', () => {
+    assert.throws(() => applicationCommitmentV1({ ...present.application, data: `${present.application.data}=` }), /unpadded base64url/);
+  });
+
+  it('the record-signature vector signs this same section (the two vectors agree)', () => {
+    const withApp = sigVec.cases.find((k) => k.record.metadata.application);
+    assert.deepStrictEqual(withApp.record.metadata.application, present.application);
+  });
+});
diff --git a/tests/mmp-v2-application.vector.json b/tests/mmp-v2-application.vector.json
new file mode 100644
index 00000000..65d697c3
--- /dev/null
+++ b/tests/mmp-v2-application.vector.json
@@ -0,0 +1,24 @@
+{
+  "protocolVersion": "2.0",
+  "construction": "mmp-app-v1",
+  "cases": [
+    {
+      "label": "application absent",
+      "application": null,
+      "expectedCommitment": "28cd4e3d828cf5d009c50c6958a92df1abc8e4011e27c97f995f5776cd2e33ba"
+    },
+    {
+      "label": "application present",
+      "decodedDataUtf8": "{\"action\":\"deploy\",\"environment\":\"staging\"}",
+      "application": {
+        "mediaType": "application/json",
+        "schema": "https://meshcognition.org/schema/action-v1.json",
+        "encoding": "base64url",
+        "byteLength": 43,
+        "digest": "sha256-089f613acdc06074b6a9c4a3e1814b0440352c0a9a33a142d70a8964a88822ff",
+        "data": "eyJhY3Rpb24iOiJkZXBsb3kiLCJlbnZpcm9ubWVudCI6InN0YWdpbmcifQ"
+      },
+      "expectedCommitment": "dd920b2cb64ac0e45cdada75fc08b207467eae64c86b3a44ed2f7d09b62dc370"
+    }
+  ]
+}
diff --git a/tests/mmp-v2-handshake.test.js b/tests/mmp-v2-handshake.test.js
index 7aa6a39e..5e3014a1 100644
--- a/tests/mmp-v2-handshake.test.js
+++ b/tests/mmp-v2-handshake.test.js
@@ -1,8 +1,10 @@
 'use strict';
 
 // MMP v2.0 handshake proof-of-possession conformance (P0.3). sym must reproduce
-// meshcognition.org's transcript hash, session id, and proofs byte-for-byte, and must REJECT an
-// unproven/tampered handshake — the impersonation fix. Vector: website #12, digest-pinned.
+// meshcognition.org's transcript, transcript hash, session id, proof payloads and key schedule
+// byte-for-byte, must ACCEPT the published proofs, and must REJECT an unproven/tampered
+// handshake — the impersonation fix. Vector: the published handshake-v2.json, copied verbatim
+// (digest pinned in mmp-v2-vectors-published.test.js).
 
 const { describe, it } = require('node:test');
 const assert = require('node:assert');
@@ -31,13 +33,36 @@ describe('MMP v2.0 handshake proof-of-possession (P0.3)', () => {
     assert.strictEqual(sessionIdFromTranscript(tx), e.sessionId);
   });
 
-  it('client proof payload is byte-identical to the vector', () => {
+  it('client and server proof payloads are byte-identical to the vector', () => {
     assert.strictEqual(proofPayload('client', tx).toString('hex'), e.clientProofPayloadHex);
+    assert.strictEqual(proofPayload('server', tx).toString('hex'), e.serverProofPayloadHex);
   });
 
-  it('client and server proofs are byte-identical to the vector', () => {
-    assert.strictEqual(signProof('client', tx, vec.fixture.clientIdentityPrivateSeedBase64url), e.clientProofBase64url);
-    assert.strictEqual(signProof('server', tx, vec.fixture.serverIdentityPrivateSeedBase64url), e.serverProofBase64url);
+  // The vector's `usage` (2026-09-14 errata): the proofs are for VERIFICATION only — never sign
+  // the payload and compare bytes, because a hedged Ed25519 signer (WebKit, CryptoKit) returns a
+  // different valid signature on every call. Every other pinned value here is deterministic and
+  // is compared exactly. So our own proofs are checked the way the contract checks anyone's:
+  // two signings over one transcript both verify, and nothing is asserted about their bytes.
+  it('the vector marks the proofs as verification-only', () => {
+    assert.match(vec.usage, /Verification only/);
+    assert.match(vec.usage, /clientProofBase64url and serverProofBase64url/);
+  });
+
+  it('our proofs verify against the presented identity keys (signed twice, bytes not compared)', () => {
+    for (const [role, seed, pub] of [
+      ['client', vec.fixture.clientIdentityPrivateSeedBase64url, clientPub],
+      ['server', vec.fixture.serverIdentityPrivateSeedBase64url, serverPub],
+    ]) {
+      const a = signProof(role, tx, seed);
+      const b = signProof(role, tx, seed);
+      assert.ok(verifyProof(role, tx, a, pub), `${role}: first proof verifies`);
+      assert.ok(verifyProof(role, tx, b, pub), `${role}: second proof verifies`);
+    }
+  });
+
+  it('the presented identity keys are the ones the vector pins in the handshake', () => {
+    assert.strictEqual(clientPub, vec.fixture.handshake.client.identityPublicKey);
+    assert.strictEqual(serverPub, vec.fixture.handshake.server.identityPublicKey);
   });
 
   it('the published proofs verify against the presented identity keys', () => {
diff --git a/tests/mmp-v2-handshake.vector.json b/tests/mmp-v2-handshake.vector.json
index 5296f5a0..89190331 100644
--- a/tests/mmp-v2-handshake.vector.json
+++ b/tests/mmp-v2-handshake.vector.json
@@ -1,6 +1,7 @@
 {
   "protocolVersion": "2.0",
   "warning": "all private keys and nonces are fixed conformance fixtures",
+  "usage": "Verification only, for clientProofBase64url and serverProofBase64url: check that your implementation ACCEPTS each proof over its pinned payload and key; never sign the payload and compare bytes. Every other pinned value here — transcript hash, HKDF outputs, key confirmations — is deterministic and MUST reproduce exactly.",
   "fixture": {
     "handshake": {
       "protocolVersion": "2.0",
diff --git a/tests/mmp-v2-record-signature.vector.json b/tests/mmp-v2-record-signature.vector.json
index 9e73a0f3..8b748db5 100644
--- a/tests/mmp-v2-record-signature.vector.json
+++ b/tests/mmp-v2-record-signature.vector.json
@@ -1 +1,187 @@
-{"protocolVersion": "2.0", "signatureSuite": "mmp-sig-v2.0", "addressScheme": "mmp-cmb-merkle-v2", "testKey": {"warning": "fixed test key; never use as an identity", "privateSeedBase64url": "QkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkI", "publicKeyBase64url": "IVL40Zt5HSRFMkLhXy6rbLfP-ntqXtMAl5YOBpiB2xI"}, "invariant": "Both cases have one cognition key and two assertion identities.", "cases": [{"label": "same cognition without application", "record": {"categories": {"focus": {"text": "publish corrected MMP conformance artifacts", "meta": {"key": "5016f1bd82f5ec8ad064f9fb0a47c10988190c407c9d534e76b366634bf2e268", "parents": []}}, "issue": {"text": "the public vectors and runtime disagree", "meta": {"key": "8f37da919d4165770650b6508b66af65f0710157209b10724e7cc4aab717da83", "parents": ["cmb-abababababababababababababababababababababababababababababababab"]}}, "intent": {"text": "make independent implementations interoperate", "meta": {"key": "f47998bfc4aedee3ac20c485f9cd07caacccf622ceced426c02e178741718f67", "parents": []}}, "motivation": {"text": "a protocol claim must be executable", "meta": {"key": "9dfa469fab3eeb8c98f79df69c3b2f02f277a017f9cbe3bf0f32ccbf9a4f129d", "parents": []}}, "commitment": {"text": "one contract drives every implementation", "meta": {"key": "d3bbf94949feceaea72667efe8c43a4bf3aed557ecc632caf82b7c3f2447e3c8", "parents": []}}, "perspective": {"text": "protocol editor", "meta": {"key": "3e48fe2e89a1e02f5c17c08e853bd09d5355d18a491a1bd926568089626ffa35", "parents": []}}, "mood": {"text": "determined", "meta": {"key": "a515fb1d0492e7661b89c2b02d6bf81372ee07560bfca054863c76dec74880da", "parents": []}}}, "metadata": {"key": "cmb-7f7b55653aa9854999c2efeb9751ce4428f9dfe95839e34e4358ab0be5cdf98d", "addressScheme": "mmp-cmb-merkle-v2", "signatureSuite": "mmp-sig-v2.0", "createdByNodeId": "018f47a0-7b21-7abc-8def-0123456789ab", "createdBy": "vector-author", "createdTimestamp": 1786611600000, "room": "conformance-room", "to": "018f47a0-7b21-7abc-8def-fedcba987654", "lineage": {"parents": ["cmb-abababababababababababababababababababababababababababababababab"], "method": "svaf-heuristic"}, "application": null, "assertionId": "asrt-926d08932fe23abc3950001f80df80f93f9ae0942eb04329cd5d6c4748a0ff7e", "sigAlg": "ed25519", "sig": "ae5wP18m0_bGBxiqL4faj70eTjwK_nZL1FocG021xhwmHqmX1Ne3SlVZzdquOZiuh5haKtss6nGXWZdvXzVpCg"}}, "expectedCategoryParentsCommitment": "8b0ce7e861fb884dfe3b65a59c7c426ceafbdc716503505701d540dc5a950354", "expectedSigningPayloadHex": "6d6d702d7369672d76322e300a333a322e3031373a6d6d702d636d622d6d65726b6c652d763236383a636d622d3766376235353635336161393835343939396332656665623937353163653434323866396466653935383339653334653433353861623062653563646639386433363a30313866343761302d376232312d376162632d386465662d30313233343536373839616231333a766563746f722d617574686f7231333a3137383636313136303030303031363a636f6e666f726d616e63652d726f6f6d33363a30313866343761302d376232312d376162632d386465662d666564636261393837363534313a3136383a636d622d6162616261626162616261626162616261626162616261626162616261626162616261626162616261626162616261626162616261626162616261626162616236343a3862306365376538363166623838346466653362363561353963376334323663656166626463373136353033353035373031643534306463356139353033353436343a32386364346533643832386366356430303963353063363935386139326466316162633865343031316532376339376639393566353737366364326533336261", "expectedAssertionId": "asrt-926d08932fe23abc3950001f80df80f93f9ae0942eb04329cd5d6c4748a0ff7e", "expectedSignature": "ae5wP18m0_bGBxiqL4faj70eTjwK_nZL1FocG021xhwmHqmX1Ne3SlVZzdquOZiuh5haKtss6nGXWZdvXzVpCg"}, {"label": "same cognition with application", "record": {"categories": {"focus": {"text": "publish corrected MMP conformance artifacts", "meta": {"key": "5016f1bd82f5ec8ad064f9fb0a47c10988190c407c9d534e76b366634bf2e268", "parents": []}}, "issue": {"text": "the public vectors and runtime disagree", "meta": {"key": "8f37da919d4165770650b6508b66af65f0710157209b10724e7cc4aab717da83", "parents": ["cmb-abababababababababababababababababababababababababababababababab"]}}, "intent": {"text": "make independent implementations interoperate", "meta": {"key": "f47998bfc4aedee3ac20c485f9cd07caacccf622ceced426c02e178741718f67", "parents": []}}, "motivation": {"text": "a protocol claim must be executable", "meta": {"key": "9dfa469fab3eeb8c98f79df69c3b2f02f277a017f9cbe3bf0f32ccbf9a4f129d", "parents": []}}, "commitment": {"text": "one contract drives every implementation", "meta": {"key": "d3bbf94949feceaea72667efe8c43a4bf3aed557ecc632caf82b7c3f2447e3c8", "parents": []}}, "perspective": {"text": "protocol editor", "meta": {"key": "3e48fe2e89a1e02f5c17c08e853bd09d5355d18a491a1bd926568089626ffa35", "parents": []}}, "mood": {"text": "determined", "meta": {"key": "a515fb1d0492e7661b89c2b02d6bf81372ee07560bfca054863c76dec74880da", "parents": []}}}, "metadata": {"key": "cmb-7f7b55653aa9854999c2efeb9751ce4428f9dfe95839e34e4358ab0be5cdf98d", "addressScheme": "mmp-cmb-merkle-v2", "signatureSuite": "mmp-sig-v2.0", "createdByNodeId": "018f47a0-7b21-7abc-8def-0123456789ab", "createdBy": "vector-author", "createdTimestamp": 1786611600000, "room": "conformance-room", "to": "018f47a0-7b21-7abc-8def-fedcba987654", "lineage": {"parents": ["cmb-abababababababababababababababababababababababababababababababab"], "method": "svaf-heuristic"}, "application": {"mediaType": "application/json", "schema": "https://meshcognition.org/schema/action-v1.json", "encoding": "base64url", "byteLength": 43, "digest": "sha256-089f613acdc06074b6a9c4a3e1814b0440352c0a9a33a142d70a8964a88822ff", "data": "eyJhY3Rpb24iOiJkZXBsb3kiLCJlbnZpcm9ubWVudCI6InN0YWdpbmcifQ"}, "assertionId": "asrt-07ccedd2eaf5297b193c554b64f8ad4f02908adaff478618dc9ceb4eea63b011", "sigAlg": "ed25519", "sig": "LKeUxp7if-ce3zsI6OBAiukvgwHuEFfLfS0VjIP63c2usrKy6WLM66a1uFJC-ZDB6PxSik-36Wp7HglTvIp_DQ"}}, "expectedCategoryParentsCommitment": "8b0ce7e861fb884dfe3b65a59c7c426ceafbdc716503505701d540dc5a950354", "expectedSigningPayloadHex": "6d6d702d7369672d76322e300a333a322e3031373a6d6d702d636d622d6d65726b6c652d763236383a636d622d3766376235353635336161393835343939396332656665623937353163653434323866396466653935383339653334653433353861623062653563646639386433363a30313866343761302d376232312d376162632d386465662d30313233343536373839616231333a766563746f722d617574686f7231333a3137383636313136303030303031363a636f6e666f726d616e63652d726f6f6d33363a30313866343761302d376232312d376162632d386465662d666564636261393837363534313a3136383a636d622d6162616261626162616261626162616261626162616261626162616261626162616261626162616261626162616261626162616261626162616261626162616236343a3862306365376538363166623838346466653362363561353963376334323663656166626463373136353033353035373031643534306463356139353033353436343a64643932306232636236346163306534356364616461373566633038623230373436376561653634633836623361343465643266376430396236326463333730", "expectedAssertionId": "asrt-07ccedd2eaf5297b193c554b64f8ad4f02908adaff478618dc9ceb4eea63b011", "expectedSignature": "LKeUxp7if-ce3zsI6OBAiukvgwHuEFfLfS0VjIP63c2usrKy6WLM66a1uFJC-ZDB6PxSik-36Wp7HglTvIp_DQ"}]}
\ No newline at end of file
+{
+  "protocolVersion": "2.0",
+  "signatureSuite": "mmp-sig-v2.0",
+  "addressScheme": "mmp-cmb-merkle-v2",
+  "testKey": {
+    "warning": "fixed test key; never use as an identity",
+    "privateSeedBase64url": "QkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkI",
+    "publicKeyBase64url": "IVL40Zt5HSRFMkLhXy6rbLfP-ntqXtMAl5YOBpiB2xI"
+  },
+  "invariant": "Both cases have one cognition key and two assertion identities.",
+  "usage": "Verification only. Check that your implementation ACCEPTS expectedSignature for the given payload and key; never sign the payload and compare bytes. WebKit (Safari, and every browser on iOS) ships a hedged Ed25519 signer that returns a different valid signature on each call, so signature equality is not a property of a conforming implementation. To test signing, sign the same payload twice and assert that both verify — and assert nothing about whether they are equal.",
+  "cases": [
+    {
+      "label": "same cognition without application",
+      "record": {
+        "categories": {
+          "focus": {
+            "text": "publish corrected MMP conformance artifacts",
+            "meta": {
+              "key": "5016f1bd82f5ec8ad064f9fb0a47c10988190c407c9d534e76b366634bf2e268",
+              "parents": []
+            }
+          },
+          "issue": {
+            "text": "the public vectors and runtime disagree",
+            "meta": {
+              "key": "8f37da919d4165770650b6508b66af65f0710157209b10724e7cc4aab717da83",
+              "parents": [
+                "cmb-abababababababababababababababababababababababababababababababab"
+              ]
+            }
+          },
+          "intent": {
+            "text": "make independent implementations interoperate",
+            "meta": {
+              "key": "f47998bfc4aedee3ac20c485f9cd07caacccf622ceced426c02e178741718f67",
+              "parents": []
+            }
+          },
+          "motivation": {
+            "text": "a protocol claim must be executable",
+            "meta": {
+              "key": "9dfa469fab3eeb8c98f79df69c3b2f02f277a017f9cbe3bf0f32ccbf9a4f129d",
+              "parents": []
+            }
+          },
+          "commitment": {
+            "text": "one contract drives every implementation",
+            "meta": {
+              "key": "d3bbf94949feceaea72667efe8c43a4bf3aed557ecc632caf82b7c3f2447e3c8",
+              "parents": []
+            }
+          },
+          "perspective": {
+            "text": "protocol editor",
+            "meta": {
+              "key": "3e48fe2e89a1e02f5c17c08e853bd09d5355d18a491a1bd926568089626ffa35",
+              "parents": []
+            }
+          },
+          "mood": {
+            "text": "determined",
+            "meta": {
+              "key": "a515fb1d0492e7661b89c2b02d6bf81372ee07560bfca054863c76dec74880da",
+              "parents": []
+            }
+          }
+        },
+        "metadata": {
+          "key": "cmb-7f7b55653aa9854999c2efeb9751ce4428f9dfe95839e34e4358ab0be5cdf98d",
+          "addressScheme": "mmp-cmb-merkle-v2",
+          "signatureSuite": "mmp-sig-v2.0",
+          "createdByNodeId": "018f47a0-7b21-7abc-8def-0123456789ab",
+          "createdBy": "vector-author",
+          "createdTimestamp": 1786611600000,
+          "room": "conformance-room",
+          "to": "018f47a0-7b21-7abc-8def-fedcba987654",
+          "lineage": {
+            "parents": [
+              "cmb-abababababababababababababababababababababababababababababababab"
+            ],
+            "method": "svaf-heuristic"
+          },
+          "application": null,
+          "assertionId": "asrt-926d08932fe23abc3950001f80df80f93f9ae0942eb04329cd5d6c4748a0ff7e",
+          "sigAlg": "ed25519",
+          "sig": "ae5wP18m0_bGBxiqL4faj70eTjwK_nZL1FocG021xhwmHqmX1Ne3SlVZzdquOZiuh5haKtss6nGXWZdvXzVpCg"
+        }
+      },
+      "expectedCategoryParentsCommitment": "8b0ce7e861fb884dfe3b65a59c7c426ceafbdc716503505701d540dc5a950354",
+      "expectedSigningPayloadHex": "6d6d702d7369672d76322e300a333a322e3031373a6d6d702d636d622d6d65726b6c652d763236383a636d622d3766376235353635336161393835343939396332656665623937353163653434323866396466653935383339653334653433353861623062653563646639386433363a30313866343761302d376232312d376162632d386465662d30313233343536373839616231333a766563746f722d617574686f7231333a3137383636313136303030303031363a636f6e666f726d616e63652d726f6f6d33363a30313866343761302d376232312d376162632d386465662d666564636261393837363534313a3136383a636d622d6162616261626162616261626162616261626162616261626162616261626162616261626162616261626162616261626162616261626162616261626162616236343a3862306365376538363166623838346466653362363561353963376334323663656166626463373136353033353035373031643534306463356139353033353436343a32386364346533643832386366356430303963353063363935386139326466316162633865343031316532376339376639393566353737366364326533336261",
+      "expectedAssertionId": "asrt-926d08932fe23abc3950001f80df80f93f9ae0942eb04329cd5d6c4748a0ff7e",
+      "expectedSignature": "ae5wP18m0_bGBxiqL4faj70eTjwK_nZL1FocG021xhwmHqmX1Ne3SlVZzdquOZiuh5haKtss6nGXWZdvXzVpCg",
+      "expectedSignatureIsOneOfMany": "One valid signature over expectedSigningPayloadHex. Verify it; do not reproduce it. A hedged signer (WebKit) returns different valid bytes each call."
+    },
+    {
+      "label": "same cognition with application",
+      "record": {
+        "categories": {
+          "focus": {
+            "text": "publish corrected MMP conformance artifacts",
+            "meta": {
+              "key": "5016f1bd82f5ec8ad064f9fb0a47c10988190c407c9d534e76b366634bf2e268",
+              "parents": []
+            }
+          },
+          "issue": {
+            "text": "the public vectors and runtime disagree",
+            "meta": {
+              "key": "8f37da919d4165770650b6508b66af65f0710157209b10724e7cc4aab717da83",
+              "parents": [
+                "cmb-abababababababababababababababababababababababababababababababab"
+              ]
+            }
+          },
+          "intent": {
+            "text": "make independent implementations interoperate",
+            "meta": {
+              "key": "f47998bfc4aedee3ac20c485f9cd07caacccf622ceced426c02e178741718f67",
+              "parents": []
+            }
+          },
+          "motivation": {
+            "text": "a protocol claim must be executable",
+            "meta": {
+              "key": "9dfa469fab3eeb8c98f79df69c3b2f02f277a017f9cbe3bf0f32ccbf9a4f129d",
+              "parents": []
+            }
+          },
+          "commitment": {
+            "text": "one contract drives every implementation",
+            "meta": {
+              "key": "d3bbf94949feceaea72667efe8c43a4bf3aed557ecc632caf82b7c3f2447e3c8",
+              "parents": []
+            }
+          },
+          "perspective": {
+            "text": "protocol editor",
+            "meta": {
+              "key": "3e48fe2e89a1e02f5c17c08e853bd09d5355d18a491a1bd926568089626ffa35",
+              "parents": []
+            }
+          },
+          "mood": {
+            "text": "determined",
+            "meta": {
+              "key": "a515fb1d0492e7661b89c2b02d6bf81372ee07560bfca054863c76dec74880da",
+              "parents": []
+            }
+          }
+        },
+        "metadata": {
+          "key": "cmb-7f7b55653aa9854999c2efeb9751ce4428f9dfe95839e34e4358ab0be5cdf98d",
+          "addressScheme": "mmp-cmb-merkle-v2",
+          "signatureSuite": "mmp-sig-v2.0",
+          "createdByNodeId": "018f47a0-7b21-7abc-8def-0123456789ab",
+          "createdBy": "vector-author",
+          "createdTimestamp": 1786611600000,
+          "room": "conformance-room",
+          "to": "018f47a0-7b21-7abc-8def-fedcba987654",
+          "lineage": {
+            "parents": [
+              "cmb-abababababababababababababababababababababababababababababababab"
+            ],
+            "method": "svaf-heuristic"
+          },
+          "application": {
+            "mediaType": "application/json",
+            "schema": "https://meshcognition.org/schema/action-v1.json",
+            "encoding": "base64url",
+            "byteLength": 43,
+            "digest": "sha256-089f613acdc06074b6a9c4a3e1814b0440352c0a9a33a142d70a8964a88822ff",
+            "data": "eyJhY3Rpb24iOiJkZXBsb3kiLCJlbnZpcm9ubWVudCI6InN0YWdpbmcifQ"
+          },
+          "assertionId": "asrt-07ccedd2eaf5297b193c554b64f8ad4f02908adaff478618dc9ceb4eea63b011",
+          "sigAlg": "ed25519",
+          "sig": "LKeUxp7if-ce3zsI6OBAiukvgwHuEFfLfS0VjIP63c2usrKy6WLM66a1uFJC-ZDB6PxSik-36Wp7HglTvIp_DQ"
+        }
+      },
+      "expectedCategoryParentsCommitment": "8b0ce7e861fb884dfe3b65a59c7c426ceafbdc716503505701d540dc5a950354",
+      "expectedSigningPayloadHex": "6d6d702d7369672d76322e300a333a322e3031373a6d6d702d636d622d6d65726b6c652d763236383a636d622d3766376235353635336161393835343939396332656665623937353163653434323866396466653935383339653334653433353861623062653563646639386433363a30313866343761302d376232312d376162632d386465662d30313233343536373839616231333a766563746f722d617574686f7231333a3137383636313136303030303031363a636f6e666f726d616e63652d726f6f6d33363a30313866343761302d376232312d376162632d386465662d666564636261393837363534313a3136383a636d622d6162616261626162616261626162616261626162616261626162616261626162616261626162616261626162616261626162616261626162616261626162616236343a3862306365376538363166623838346466653362363561353963376334323663656166626463373136353033353035373031643534306463356139353033353436343a64643932306232636236346163306534356364616461373566633038623230373436376561653634633836623361343465643266376430396236326463333730",
+      "expectedAssertionId": "asrt-07ccedd2eaf5297b193c554b64f8ad4f02908adaff478618dc9ceb4eea63b011",
+      "expectedSignature": "LKeUxp7if-ce3zsI6OBAiukvgwHuEFfLfS0VjIP63c2usrKy6WLM66a1uFJC-ZDB6PxSik-36Wp7HglTvIp_DQ",
+      "expectedSignatureIsOneOfMany": "One valid signature over expectedSigningPayloadHex. Verify it; do not reproduce it. A hedged signer (WebKit) returns different valid bytes each call."
+    }
+  ]
+}
diff --git a/tests/mmp-v2-signing.test.js b/tests/mmp-v2-signing.test.js
index b67c516f..be2df74c 100644
--- a/tests/mmp-v2-signing.test.js
+++ b/tests/mmp-v2-signing.test.js
@@ -1,17 +1,19 @@
 'use strict';
 
 // MMP v2.0 published-contract conformance: sym must reproduce meshcognition.org's mmp-sig-v2.0
-// byte-for-byte. The vector is the normative record-signature-v2.json (website PR #12@3d66352).
-// This is the gate for the reader-first migration: if sym's preimage diverges by one byte, an
-// independent implementer's signature and sym's disagree and the mesh silently splits.
+// signing preimage byte-for-byte and accept the published signatures. The vector is the
+// normative record-signature-v2.json, copied verbatim (2026-09-14 errata included; the digest
+// is pinned in mmp-v2-vectors-published.test.js). This is the gate for the reader-first
+// migration: if sym's preimage diverges by one byte, an independent implementer's signature
+// and sym's disagree and the mesh silently splits.
 
 const { describe, it } = require('node:test');
 const assert = require('node:assert');
 const crypto = require('crypto');
-const { signingPayloadV2_0, assertionIdV2_0, signCMB, verifyCMB, privateKeyObject } = require('../lib/core/cmb-signing');
+const { signingPayloadV2_0, assertionIdV2_0, categoryParentsCommitment, verifyCMB, privateKeyObject, publicKeyObject } = require('../lib/core/cmb-signing');
 const vec = require('./mmp-v2-record-signature.vector.json');
 
-// The fixed test key (Ed25519, deterministic per RFC 8032 in Node — so a byte-exact sig match holds).
+// The fixed test key. Signatures made with it are verified, never compared: see below.
 const seed = Buffer.from(vec.testKey.privateSeedBase64url, 'base64url');
 const privB64url = seed.toString('base64url');
 const pubB64url = vec.testKey.publicKeyBase64url;
@@ -22,17 +24,24 @@ describe('MMP v2.0 signing conformance (mmp-sig-v2.0)', () => {
       assert.strictEqual(assertionIdV2_0(kase.record), kase.record.metadata.assertionId);
     });
 
-    // NODE DETERMINISM, NOT CONFORMANCE. Ed25519 is deterministic in RFC 8032 and Node honours it,
-    // so this pins that OUR signer still produces the published bytes — a regression guard on the
-    // vector and on this runtime. It is NOT a conformance requirement and MUST NOT be copied into
-    // one: Apple's implementations hedge, measured 2026-09-14 (CryptoKit: five signings of RFC 8032
-    // vector 2 under one key gave five distinct valid signatures, none matching the published one;
-    // WebKit the same, dev-team-3 on Safari 26.5). A correct implementation on those platforms
-    // fails this assertion, which is why the spec now requires verification instead
-    // (meshcognition.org §17.4, §20.3, §17.5).
-    it(`signature is byte-identical to the published vector — Node determinism, not conformance — ${kase.label}`, () => {
-      const sig = crypto.sign(null, signingPayloadV2_0(kase.record), privateKeyObject(privB64url));
-      assert.strictEqual(sig.toString('base64url'), kase.record.metadata.sig);
+    // The signing PREIMAGE is deterministic and must reproduce exactly; the signature over it
+    // must not be compared. The vector says so itself (`usage`, and `expectedSignatureIsOneOfMany`
+    // on every case, from the 2026-09-14 errata): Apple's signers hedge, so a conforming
+    // implementation there returns different valid bytes on every call (measured 2026-09-14:
+    // CryptoKit gave five distinct valid signatures for one payload under one key, none equal
+    // to the published one). Node happens to be deterministic, and asserting byte equality here
+    // would pin that accident as if it were the contract.
+    it(`signing payload and assertion id reproduce the published bytes — ${kase.label}`, () => {
+      assert.strictEqual(signingPayloadV2_0(kase.record).toString('hex'), kase.expectedSigningPayloadHex);
+      assert.strictEqual(assertionIdV2_0(kase.record), kase.expectedAssertionId);
+      assert.strictEqual(categoryParentsCommitment(kase.record.categories), kase.expectedCategoryParentsCommitment);
+    });
+
+    it(`expectedSignature is honoured as one valid signature of many: verified, never reproduced — ${kase.label}`, () => {
+      assert.ok(kase.expectedSignatureIsOneOfMany, 'the published vector marks the signature as one of many');
+      assert.ok(crypto.verify(null, Buffer.from(kase.expectedSigningPayloadHex, 'hex'),
+        publicKeyObject(pubB64url), Buffer.from(kase.expectedSignature, 'base64url')),
+      'the published expectedSignature must verify over the published payload');
     });
 
     // THE CONFORMANCE PROPERTY, which every implementation must satisfy including a hedged signer:
@@ -40,7 +49,7 @@ describe('MMP v2.0 signing conformance (mmp-sig-v2.0)', () => {
     it(`two signatures over one payload both verify — ${kase.label}`, () => {
       const payload = signingPayloadV2_0(kase.record);
       const key = privateKeyObject(privB64url);
-      const pub = require('../lib/core/cmb-signing').publicKeyObject(pubB64url);
+      const pub = publicKeyObject(pubB64url);
       const a = crypto.sign(null, payload, key);
       const b = crypto.sign(null, payload, key);
       assert.ok(crypto.verify(null, payload, pub, a), 'first signature must verify');
@@ -51,7 +60,7 @@ describe('MMP v2.0 signing conformance (mmp-sig-v2.0)', () => {
       const r = verifyCMB(kase.record, pubB64url);
       // verifyCMB currently checks the v2 preimage; assert the v2.0 preimage verifies directly.
       const ok = crypto.verify(null, signingPayloadV2_0(kase.record),
-        require('../lib/core/cmb-signing').publicKeyObject(pubB64url),
+        publicKeyObject(pubB64url),
         Buffer.from(kase.record.metadata.sig, 'base64url'));
       assert.ok(ok, 'published v2.0 signature must verify');
       void r;
diff --git a/tests/mmp-v2-vectors-published.test.js b/tests/mmp-v2-vectors-published.test.js
new file mode 100644
index 00000000..0a863093
--- /dev/null
+++ b/tests/mmp-v2-vectors-published.test.js
@@ -0,0 +1,33 @@
+'use strict';
+
+// The v2 conformance vectors in this directory are the PUBLISHED files, byte for byte — not
+// local edits of them. The SDK's copies of record-signature and handshake once drifted from
+// the published ones: they lacked the 2026-09-14 errata fields (`usage`,
+// `expectedSignatureIsOneOfMany`) that tell an implementer to verify signatures rather than
+// reproduce them, so the SDK's tests went on asserting the opposite of the contract. A digest
+// pin makes any such drift fail here instead of silently.
+//
+// Source: meshcognition.org/spec/mmp/conformance/v2/ (repository meshcognition-website,
+// public/spec/mmp/conformance/v2/; mirrored in mesh-memory-protocol/conformance/v2/), whose
+// artifact-manifest.json pins these same sha256 digests. To update: copy the published file
+// verbatim and replace its digest below from that manifest — never edit a vector by hand.
+
+const { test } = require('node:test');
+const assert = require('node:assert');
+const crypto = require('crypto');
+const fs = require('fs');
+const path = require('path');
+
+const PUBLISHED = {
+  'mmp-v2-application.vector.json': ['application-v2.json', '28ef0e7a7a7f2fb1e85a8a35b2f899962a648193e61717165540e5f4b842eb30'],
+  'mmp-v2-e2e.vector.json': ['e2e-v2.json', '3e5d4adec0137a01f85c98cacba5c8d65b5d603d02085149f950c3d5ea77dbdc'],
+  'mmp-v2-handshake.vector.json': ['handshake-v2.json', 'c93a8440c29b07b08cccd9b0ec51008f98bfd3f631e9a654f631cb391dfe3125'],
+  'mmp-v2-record-signature.vector.json': ['record-signature-v2.json', '3725744c2162e3d9f2a6fb9499253057cff018ff1148ea934861826d033018d7'],
+};
+
+for (const [local, [published, digest]] of Object.entries(PUBLISHED)) {
+  test(`${local} is the published conformance/v2/${published}, byte for byte`, () => {
+    const bytes = fs.readFileSync(path.join(__dirname, local));
+    assert.strictEqual(crypto.createHash('sha256').update(bytes).digest('hex'), digest);
+  });
+}

From d09d38af7e38bb92fc7e4532e43b8658b66bf4a7 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 18:34:46 +0100
Subject: [PATCH 008/148] tests: the lease test's foreign holder is a live
 child with a real start time

"the lease refuses a second holder" wrote lock.pid as `1` plus
{"startTime":0}. Windows has no PID 1, so the test failed there; and on
every OS the reader's metadata key is `start`, not `startTime`, so the
metadata was ignored and the test only exercised the legacy
no-start-time branch, never the v2 start-time check it was meant to cover.

The holder is now a sleeping child process, recorded exactly as a running
holder writes its lock ({"start": processStartTime(pid)}), and killed in
cleanup. The test also asserts the reader sees that start time and that
the refusal names the holder's pid.

Mutation check: making the start-time comparison always report a mismatch
fails the new test; the old one still passed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 tests/identity-halt.test.js | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/tests/identity-halt.test.js b/tests/identity-halt.test.js
index f3c86a33..c40b72c1 100644
--- a/tests/identity-halt.test.js
+++ b/tests/identity-halt.test.js
@@ -24,6 +24,7 @@ const assert = require('node:assert/strict');
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
+const { spawn } = require('node:child_process');
 
 /**
  * Point SYM_IDENTITY_DIR at a throwaway dir. No require-cache busting: identityDir() reads the
@@ -160,19 +161,29 @@ test('AC-3.2: no `-2` identity can be created by any path', () => {
   } finally { restore(); fs.rmSync(dir, { recursive: true, force: true }); }
 });
 
-test('the lease refuses a second holder and never suggests renaming', () => {
+test('the lease refuses a second holder and never suggests renaming', (t) => {
   // The old error advised "set a different SYM_NODE_NAME", which under agent-id-is-identity
   // is advice to become a different agent — the exact move the ruling forbids.
+  //
+  // The foreign holder is a real, live child process recorded with its real start time — the
+  // current lock format exactly as a running holder writes it. This used to be PID 1 with a
+  // `startTime` key: Windows has no PID 1, and the reader's key is `start`, so the metadata was
+  // ignored and the test only ever exercised the legacy no-start-time branch.
+  const holder = spawn(process.execPath, ['-e', 'setInterval(() => {}, 1000)'], { stdio: 'ignore' });
+  t.after(() => { try { holder.kill('SIGKILL'); } catch {} });
   const dir = tmp();
   const { cfg, restore } = freshConfig(dir);
   const name = `agent-lease-${process.pid}@mesh`;
   const lockPath = path.join(cfg.nodeDir(name), 'lock.pid');
   try {
+    const start = cfg.processStartTime(holder.pid);
+    assert.ok(start, 'precondition: this platform can read the holder\'s start time');
     fs.mkdirSync(cfg.nodeDir(name), { recursive: true });
-    // A live foreign holder: PID 1 always exists and is never us.
-    fs.writeFileSync(lockPath, `1\n${JSON.stringify({ startTime: 0 })}`);
+    fs.writeFileSync(lockPath, `${holder.pid}\n${JSON.stringify({ start, createdAt: Date.now() })}\n`);
+    assert.equal(cfg.readLockFile(lockPath).start, start, 'the lock carries the start time the reader checks');
     assert.throws(() => cfg.acquireIdentityLock(name), (e) => {
       assert.equal(e.code, 'EIDENTITYLOCK');
+      assert.equal(e.holderPid, holder.pid);
       assert.ok(!/different SYM_NODE_NAME/.test(e.message),
         'must not advise renaming — that is advice to become a different agent');
       assert.match(e.message, /same agent/);

From 34512090a1eb0e274943cf0d5c7b9bc8e53a2337 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 18:35:14 +0100
Subject: [PATCH 009/148] tests: skip the SIGTERM lock test on Windows; cover
 hard-kill reclaim everywhere

On win32 child.kill('SIGTERM') is TerminateProcess: no signal handler and
no exit hook run, so "releases the lock on SIGTERM when the host has no
handler" can only fail there (lock.pid stays). It is now skipped on win32,
with that reason in the skip message.

What Windows actually needs is the hard-kill path, so a new test runs on
every platform: a child acquires the lock, is killed with SIGKILL
(TerminateProcess on Windows), its lockfile is shown to be left behind
with its pid and start time, and the next acquire must reclaim it.

The new test passes on the current lib, because reclaim already works; a
mutation that stops treating a dead pid as stale makes it fail.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 tests/config.test.js | 34 +++++++++++++++++++++++++++++++++-
 1 file changed, 33 insertions(+), 1 deletion(-)

diff --git a/tests/config.test.js b/tests/config.test.js
index a245107b..70907103 100644
--- a/tests/config.test.js
+++ b/tests/config.test.js
@@ -390,7 +390,12 @@ describe('acquireIdentityLock', () => {
     assert.strictEqual(fs.existsSync(lockPathOf(name)), false);
   });
 
-  it('releases the lock on SIGTERM when the host has no handler', async () => {
+  // Windows has no POSIX signals: child.kill('SIGTERM') there is TerminateProcess, a hard kill
+  // that runs no handler and no 'exit' hook, so there is nothing for this test to observe. The
+  // Windows case is covered by the hard-kill reclaim test below, which runs on every platform.
+  it('releases the lock on SIGTERM when the host has no handler', {
+    skip: process.platform === 'win32' && 'win32: kill(\'SIGTERM\') is TerminateProcess, which runs no exit hook — see the hard-kill reclaim test',
+  }, async () => {
     const name = mkName();
     const script = `
       require(${JSON.stringify(require.resolve('../lib/config'))}).acquireIdentityLock(${JSON.stringify(name)});
@@ -409,6 +414,33 @@ describe('acquireIdentityLock', () => {
     });
     assert.strictEqual(fs.existsSync(lockPathOf(name)), false);
   });
+
+  // A holder killed so hard that no code of its own runs — SIGKILL on POSIX, TerminateProcess on
+  // Windows (which is what any child.kill() is there) — leaves its lockfile behind. Nothing can
+  // release that lock at the time; the next acquire must recognise the dead holder and reclaim
+  // it, or the agent stays locked out until someone deletes the file by hand.
+  it('reclaims the lock a hard-killed holder left behind (SIGKILL / TerminateProcess)', async () => {
+    const name = mkName();
+    const script = `
+      require(${JSON.stringify(require.resolve('../lib/config'))}).acquireIdentityLock(${JSON.stringify(name)});
+      console.log('locked');
+      setInterval(() => {}, 1000);`;
+    let holderPid;
+    await new Promise((resolve, reject) => {
+      const c = spawn(process.execPath, ['-e', script], { stdio: ['ignore', 'pipe', 'ignore'], env: process.env });
+      holderPid = c.pid;
+      c.on('error', reject);
+      c.stdout.on('data', (d) => { if (String(d).includes('locked')) c.kill('SIGKILL'); });
+      c.on('close', () => resolve());
+    });
+    const left = readLockFile(lockPathOf(name));
+    assert.ok(left, 'precondition: a hard kill runs no exit hook, so the lockfile is left behind');
+    assert.strictEqual(left.pid, holderPid);
+    assert.ok(left.start, 'precondition: the holder recorded its start time');
+    const release = acquireIdentityLock(name); // must NOT throw EIDENTITYLOCK
+    assert.strictEqual(readLockFile(lockPathOf(name)).pid, process.pid, 'the next acquire reclaimed it');
+    release();
+  });
 });
 
 describe('log', () => {

From 6955b1edc53ecad2b4184bead504c23cba95c5f0 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 18:35:55 +0100
Subject: [PATCH 010/148] lineage tether: walk only through verified records
 (B-L4)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

§15.8 anchors a remix on the oldest root reachable by recursively
VERIFYING parent records. resolveTetherAnchor stepped onto any stored
entry, including a peer block admitted without its author's signature
being verified, and followed whatever parents that block claimed. The
author of one unsigned block could pick the anchor of every remix that
cites it, and the integrator then signed a tether naming it.

A step now has to verify (storedRecordVerifies): its categories
recompute to the key it is held under, and this node either wrote it
or recorded a verified signature verdict when admitting it. An
unverifiable parent ends that branch. A remix with no verified
ancestor in reach now reports an unverifiable root (key and categories
null) instead of anchoring on itself, which measured the remix against
its own text and attested it as tethered. `complete` reports whether
the walk met an unavailable or unverifiable edge (§15.2 incomplete
proof).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 lib/core/lineage-tether.js             | 101 ++++++++++++---
 tests/lineage-tether-severance.test.js |  35 +++++
 tests/lineage-tether-traversal.test.js | 173 ++++++++++++++++++++-----
 3 files changed, 255 insertions(+), 54 deletions(-)

diff --git a/lib/core/lineage-tether.js b/lib/core/lineage-tether.js
index 84d5ff9e..c2743bfd 100644
--- a/lib/core/lineage-tether.js
+++ b/lib/core/lineage-tether.js
@@ -29,8 +29,9 @@
  * @license Apache-2.0
  */
 
-const { cosineSimilarity, CAT7_CATEGORIES } = require('./cmb-encoder');
-const { encodeForSVAF, isSemanticReady, kernelId } = require('./context-encoder');
+const { cosineSimilarity, CAT7_CATEGORIES, blockKeyV2 } = require('./cmb-encoder');
+const { encodeForSVAF, kernelId } = require('./context-encoder');
+const { keyOf, verifyAddress, VERIFY } = require('./record-shape');
 
 /**
  * Evaluate the §15.8 lineage tether of a remix against its anchor.
@@ -75,13 +76,63 @@ function computeLineageTether({ remixCategories, anchorCategories, categoryWeigh
 }
 
 /**
- * Resolve the §15.8 anchor for an incoming CMB: the EARLIEST-STORED lineage
- * ancestor the local store can resolve, falling back to the incoming block
- * itself when none resolves (a root is its own anchor).
+ * Does a STORED record verify, so a §15.8 walk may step onto it and follow its parents?
+ *
+ * §15.2: a verifier validates each parent's content address and signature, and repeats. Both
+ * halves are needed here, for different reasons.
+ *
+ *   Address. The tether compares against the anchor's TEXT, and "any holder of the root re-encodes
+ *   its text" only means something if that text is the content the key names. A stored record
+ *   whose categories no longer recompute to the key it is held under is not the root it claims to
+ *   be, whatever else is true of it.
+ *
+ *   Authorship. A record is a step only if this node knows who wrote it: either it wrote the
+ *   record itself (the store's local entries carry no peerId), or it admitted the record after
+ *   verifying the author's signature — the frame handler's verdict, `_cmbVerified`, which the
+ *   store persists with the entry. Signature verification needs the author's key, which this pure
+ *   module does not hold; the verdict reached when the key WAS at hand is the evidence that exists.
+ *   An admission with no verdict, or a false one, proves nothing about who chose its content or
+ *   its parents, and walking through it let the author of one unsigned block pick the anchor of
+ *   every remix that cites it.
+ *
+ * A pre-boundary record (no metadata section) carries no v2 attestation and never verifies
+ * (§7.8 unverified-legacy). A bare record with no store envelope has no verdict and does not either.
+ *
+ * @param {object} entry - stored entry ({ cmb, peerId, _cmbVerified, ... }).
+ * @param {string} key   - the key the walk looked the entry up under.
+ * @returns {boolean}
+ */
+function storedRecordVerifies(entry, key) {
+  if (!entry || typeof entry !== 'object') return false;
+  const cmb = entry.cmb;
+  if (!cmb || !cmb.metadata) return false;
+  if (keyOf(cmb) !== key) return false;
+  if (verifyAddress(cmb, blockKeyV2).state !== VERIFY.VERIFIED) return false;
+  // `== null`, the store's own test for a locally-written entry (hasLocalKey, compactByOrigin).
+  // receiveFromPeer always overwrites peerId, so a peer frame cannot arrive claiming to be local.
+  if (entry.peerId == null) return true;
+  return entry._cmbVerified === true;
+}
+
+/**
+ * Resolve the §15.8 anchor for an incoming CMB: the EARLIEST-STORED lineage ancestor reachable
+ * through records that verify (storedRecordVerifies).
+ *
+ * Three outcomes, never collapsed into one another:
+ *   - a verified ancestor was reached → it is the anchor (resolvedFromStore: true);
+ *   - the incoming block is a ROOT (no parents) → it is its own anchor;
+ *   - it is a remix and no verified ancestor is reachable → there is NO anchor: key and categories
+ *     are null. The tether is then unverified, which §15.8 makes a trust state, never a severance.
+ *     This used to fall back to the remix itself, so the gate measured a remix against its own
+ *     text, always found it tethered, and the integrator signed that as a tether to a root.
+ *
+ * `complete` says whether every edge the walk met resolved to a verified record within bounds.
+ * When it is false the anchor (if any) is the oldest VERIFIED record reached, not necessarily the
+ * chain's true root — §15.2's incomplete lineage proof, which MUST NOT be presented as complete.
  *
  * @param {object} incomingCMB - The incoming CMB (categories + lineage).
- * @param {(key: string) => object|undefined} getEntry - Store lookup: key → stored entry (with .cmb and .storedAt / .cmb.originTimestamp).
- * @returns {{ key: string|null, categories: object|null, resolvedFromStore: boolean }}
+ * @param {(key: string) => object|undefined} getEntry - Store lookup: key → stored entry (with .cmb, .storedAt and the store envelope).
+ * @returns {{ key: string|null, categories: object|null, resolvedFromStore: boolean, complete: boolean }}
  */
 function resolveTetherAnchor(incomingCMB, getEntry) {
   // Lineage lives in `metadata` on a §7 record and at the top level on a pre-boundary one.
@@ -94,12 +145,14 @@ function resolveTetherAnchor(incomingCMB, getEntry) {
   const lin = incomingCMB?.metadata?.lineage ?? incomingCMB?.lineage ?? null;
   // MMP v2.0: a record carries DIRECT PARENTS ONLY (§7.5 retires the transitive closure). The
   // earliest anchor is found by VERIFIED GRAPH TRAVERSAL — walk out from the direct parents
-  // through records THIS NODE has actually stored, following each stored record's own parents.
+  // through records THIS NODE has actually stored AND can verify, following each such record's
+  // own parents.
   //
   // The incoming `lineage.ancestors` is NEVER read. Seeding the walk from a sender-supplied
   // closure let a non-conformant peer inject arbitrary apparent roots into tether resolution —
-  // lineage amplification. A parent this node has not stored is incomplete LOCAL proof: the walk
-  // simply cannot pass through it, never permission to trust the sender's claim about it.
+  // lineage amplification. A parent this node has not stored, or holds but cannot verify, is
+  // incomplete LOCAL proof: the walk cannot pass through it, and it is never permission to trust
+  // the sender's claim about it.
   //
   // Bounded: MAX_HOPS depth and MAX_NODES visited cap the walk, and `seen` makes a cyclic or
   // repeated-key chain terminate. The earliest-stored reachable record wins.
@@ -113,17 +166,23 @@ function resolveTetherAnchor(incomingCMB, getEntry) {
   let best = null;
   let bestTime = Infinity;
   let visited = 0;
+  let complete = true;
   // Frontier of {key, depth} starting at the incoming record's DIRECT parents only.
-  const frontier = (Array.isArray(lin?.parents) ? lin.parents : []).map((key) => ({ key, depth: 1 }));
+  const directParents = Array.isArray(lin?.parents) ? lin.parents : [];
+  const frontier = directParents.map((key) => ({ key, depth: 1 }));
   while (frontier.length) {
     const { key, depth } = frontier.shift();
-    if (seen.has(key) || depth > MAX_HOPS || visited >= MAX_NODES) continue;
+    if (seen.has(key)) continue;
+    if (depth > MAX_HOPS || visited >= MAX_NODES) { complete = false; continue; }
     seen.add(key);
     const entry = typeof getEntry === 'function' ? getEntry(key) : undefined;
-    if (!entry) continue; // parent not stored locally → cannot walk through it; never trust the wire
+    // Not stored locally → cannot walk through it; never trust the wire.
+    if (!entry) { complete = false; continue; }
     visited++;
-    const cmb = entry.cmb || entry;
-    if (!cmb || !cmb.categories) continue;
+    // Stored but unverifiable → this branch ends here. Its content and its parents are claims by
+    // an author this node cannot name, so it is neither a candidate anchor nor a way past itself.
+    if (!storedRecordVerifies(entry, key)) { complete = false; continue; }
+    const cmb = entry.cmb;
     // Rank by RECEIVER-LOCAL storedAt — never author/transport `originTimestamp`, which is
     // unverified and backdatable: a nearer record carrying an artificially old author time must
     // not displace the locally-verified earliest-stored anchor. Tie-break deterministically by
@@ -135,11 +194,13 @@ function resolveTetherAnchor(incomingCMB, getEntry) {
     // Continue the VERIFIED walk from this stored record's own parents (never its wire ancestors).
     for (const pk of parentsOf(cmb)) if (!seen.has(pk)) frontier.push({ key: pk, depth: depth + 1 });
   }
-  if (best) return best;
-  if (incomingCMB && incomingCMB.categories) {
-    return { key: incomingCMB.metadata?.key ?? incomingCMB.key ?? null, categories: incomingCMB.categories, resolvedFromStore: false };
+  if (best) return { ...best, complete };
+  // Only a ROOT is its own anchor. A remix with no verified ancestor in reach has an unverifiable
+  // root, and saying so is the honest answer — not substituting the remix for the root it cites.
+  if (directParents.length === 0 && incomingCMB && incomingCMB.categories) {
+    return { key: incomingCMB.metadata?.key ?? incomingCMB.key ?? null, categories: incomingCMB.categories, resolvedFromStore: false, complete: true };
   }
-  return { key: null, categories: null, resolvedFromStore: false };
+  return { key: null, categories: null, resolvedFromStore: false, complete: false };
 }
 
 /**
@@ -186,4 +247,4 @@ async function evaluateLineageTetherFromText({ remixCategories, anchorCategories
   };
 }
 
-module.exports = { computeLineageTether, resolveTetherAnchor, evaluateLineageTetherFromText };
+module.exports = { computeLineageTether, resolveTetherAnchor, storedRecordVerifies, evaluateLineageTetherFromText };
diff --git a/tests/lineage-tether-severance.test.js b/tests/lineage-tether-severance.test.js
index 4d269383..47d1df76 100644
--- a/tests/lineage-tether-severance.test.js
+++ b/tests/lineage-tether-severance.test.js
@@ -139,6 +139,41 @@ describe('MMP §15.8 lineage tether — severance through the gate', () => {
     });
   });
 
+  // §15.8 anchors on a root reached by recursively VERIFYING parent records. A peer block this node
+  // admitted without verifying its author is not such a record: whoever wrote it chose its content
+  // and its claimed parents, so treating it as the anchor let an unattributable block certify the
+  // next remix. The remix is stored unchanged (unverifiable is a trust state, never a severance),
+  // but the integrator signs no tether naming that block.
+  for (const [label, verified] of [['an UNVERIFIED admission is not an anchor', false], ['a VERIFIED admission is (control)', true]]) {
+    it(`parent stored from a peer: ${label}`, async () => {
+      await withNode(`tether-verify-${verified}`, async (node) => {
+        await awaitSemantic();
+        for (const t of TOPIC_B) node.remember(cat7(t));
+        const accepted = [];
+        node.on('cmb-accepted', (e) => accepted.push(e));
+        const now = Date.now();
+        const parent = createCMB({ categories: cat7(TOPIC_B_ROOT), createdBy: 'peerA' });
+        // The frame handler sets this from the author-key signature check before admission; the
+        // gate is driven directly here, so the verdict is set the way that check would leave it.
+        const parentFrame = { type: 'cmb', timestamp: now, content: TOPIC_B_ROOT, cmb: parent, _cmbVerified: verified };
+        await node._frameHandler._processHeuristicSVAF(parentFrame, 'peerA', 'peerA', now, now, 0);
+        assert.ok(node._store.get(parent.metadata.key), 'precondition: the parent was admitted and stored');
+
+        await node._frameHandler._processHeuristicSVAF(inboundFrame(TOPIC_B_NEW, parent.metadata.key), 'peerA', 'peerA', now, now, 0);
+        const remix = accepted.find((e) => e.cmb.categories.focus.text === TOPIC_B_NEW);
+        assert.ok(remix, 'the remix admits');
+        assert.deepStrictEqual(remix.cmb.metadata.lineage.parents, [parent.metadata.key], 'lineage is kept either way');
+        if (verified) {
+          assert.strictEqual(remix.cmb.tether?.anchor, parent.metadata.key, 'a verified parent anchors the tether');
+          assert.strictEqual(remix.cmb.tether.verdict, 'tethered');
+        } else {
+          assert.strictEqual(remix.cmb.tether, undefined, 'no tether attestation names an unverified record');
+          assert.strictEqual(remix.cmb.provenance?.tether, undefined, 'the tether is unverified, not evaluated');
+        }
+      });
+    });
+  }
+
   it('tether disabled (SYM_LINEAGE_TETHER analogue: opts.lineageTether=false) → no severance', async () => {
     const name = `tether-off-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
     const node = new SymNode({ name, silent: true, discovery: new NullDiscovery(), lineageTether: false });
diff --git a/tests/lineage-tether-traversal.test.js b/tests/lineage-tether-traversal.test.js
index a80120dc..0434251f 100644
--- a/tests/lineage-tether-traversal.test.js
+++ b/tests/lineage-tether-traversal.test.js
@@ -10,67 +10,172 @@
  *   - `originTimestamp`, the author's unsigned clock. A backdated time won the earliest-anchor race.
  * Anchor resolution now walks DIRECT parents through records this node stored, following each
  * stored record's own parents, and ranks by `storedAt`.
+ *
+ * A third input was still the sender's: any STORED record counted as a step, including one this
+ * node admitted without being able to verify who wrote it. §15.8 walks recursively VERIFIED
+ * parents, so a step must be a record whose content address recomputes and whose authorship this
+ * node established — it wrote the record itself, or verified the author's signature on admission.
  */
 
 const { describe, it } = require('node:test');
 const assert = require('node:assert');
-const { resolveTetherAnchor } = require('../lib/core');
+const { resolveTetherAnchor, storedRecordVerifies, createCMB } = require('../lib/core');
 
-function store(records) {
-  const m = new Map(records.map((r) => [r.key, r]));
+function store(entries) {
+  const m = new Map(entries.map((e) => [e.key, e]));
   return (key) => m.get(key);
 }
-const cats = (t) => ({ focus: { text: t }, issue: { text: 'x' } });
-const record = (key, storedAt, parents, extra = {}) =>
-  ({ key, storedAt, cmb: { categories: cats(key), metadata: { lineage: { parents } }, ...extra } });
+const cats = (t) => ({ focus: t, issue: 'x' });
+
+/** A real record as the store holds it. `peerId: null` is a record this node wrote; a peer
+ *  admission carries the frame handler's verification verdict in `_cmbVerified`. */
+function entry(text, storedAt, parents = [], envelope = { peerId: null }) {
+  const cmb = createCMB({
+    categories: cats(text),
+    createdBy: 'author',
+    lineage: parents.length ? { parents, method: 'SVAF-v2' } : null,
+  });
+  return { key: cmb.metadata.key, storedAt, cmb, ...envelope };
+}
+const verifiedAdmission = { peerId: 'peer-1', _cmbVerified: true };
+const unverifiedAdmission = { peerId: 'peer-1', _cmbVerified: false };
+
+function remixOf(parents, extra = {}) {
+  return { metadata: { key: 'cmb-' + 'e'.repeat(64), lineage: { parents, ...extra } }, categories: createCMB({ categories: cats('remix'), createdBy: 'peer' }).categories };
+}
 
 describe('§15.8 anchor resolution — sender-supplied inputs never pick the anchor', () => {
   it('a STORED record named only in lineage.ancestors is not the anchor', () => {
     // The receiver holds `unrelated` (stored earliest) for its own reasons; the sender names it as
     // an ancestor. It is not reachable through any parent, so it must not be chosen.
-    const getEntry = store([
-      record('unrelated', 100, []),
-      record('p1', 900, []),
-    ]);
-    const incoming = { metadata: { lineage: { parents: ['p1'], ancestors: ['unrelated', 'p1'] } }, categories: cats('remix') };
-    assert.strictEqual(resolveTetherAnchor(incoming, getEntry).key, 'p1');
+    const unrelated = entry('unrelated', 100);
+    const p1 = entry('p1', 900);
+    const getEntry = store([unrelated, p1]);
+    const incoming = remixOf([p1.key], { ancestors: [unrelated.key, p1.key] });
+    assert.strictEqual(resolveTetherAnchor(incoming, getEntry).key, p1.key);
   });
 
   it('a backdated author originTimestamp does not win the earliest-anchor race', () => {
     // Both are direct parents, so this isolates the ranking from the walk.
-    const getEntry = store([
-      record('root', 500, [], { originTimestamp: 500 }),
-      record('p1', 900, [], { originTimestamp: 1 }),
-    ]);
-    const incoming = { metadata: { lineage: { parents: ['p1', 'root'] } }, categories: cats('remix') };
-    assert.strictEqual(resolveTetherAnchor(incoming, getEntry).key, 'root');
+    const root = entry('root', 500, [], { peerId: null, originTimestamp: 500 });
+    const p1 = entry('p1', 900, [], { peerId: null, originTimestamp: 1 });
+    const incoming = remixOf([p1.key, root.key]);
+    assert.strictEqual(resolveTetherAnchor(incoming, store([root, p1])).key, root.key);
   });
 
   it('a parents-only chain is walked through stored records to the earliest stored root', () => {
-    const getEntry = store([
-      record('root', 500, []),
-      record('mid', 700, ['root']),
-      record('p1', 900, ['mid']),
-    ]);
-    const incoming = { metadata: { lineage: { parents: ['p1'] } }, categories: cats('remix') };
-    assert.strictEqual(resolveTetherAnchor(incoming, getEntry).key, 'root');
+    const root = entry('root', 500);
+    const mid = entry('mid', 700, [root.key], verifiedAdmission);
+    const p1 = entry('p1', 900, [mid.key], verifiedAdmission);
+    const r = resolveTetherAnchor(remixOf([p1.key]), store([root, mid, p1]));
+    assert.strictEqual(r.key, root.key);
+    assert.strictEqual(r.resolvedFromStore, true);
+    assert.strictEqual(r.complete, true, 'every edge resolved and verified');
   });
 
   it('the walk cannot pass through a parent this node never stored', () => {
     // mid is missing locally, so root — though stored — is unreachable from p1.
-    const getEntry = store([record('root', 500, []), record('p1', 900, ['mid'])]);
-    const incoming = { metadata: { lineage: { parents: ['p1'], ancestors: ['root'] } }, categories: cats('remix') };
-    assert.strictEqual(resolveTetherAnchor(incoming, getEntry).key, 'p1');
+    const root = entry('root', 500);
+    const p1 = entry('p1', 900, ['cmb-' + '9'.repeat(64)]);
+    const incoming = remixOf([p1.key], { ancestors: [root.key] });
+    const r = resolveTetherAnchor(incoming, store([root, p1]));
+    assert.strictEqual(r.key, p1.key);
+    assert.strictEqual(r.complete, false, 'an unavailable parent is an incomplete proof, never a complete one (§15.2)');
   });
 
   it('a cyclic chain terminates', () => {
-    const getEntry = store([record('a', 800, ['b']), record('b', 700, ['a'])]);
-    const incoming = { metadata: { lineage: { parents: ['a'] } }, categories: cats('remix') };
-    assert.strictEqual(resolveTetherAnchor(incoming, getEntry).key, 'b');
+    // Content addresses cannot form a real cycle, so the lineage is set by hand to make one.
+    const a = entry('a', 800);
+    const b = entry('b', 700);
+    a.cmb.metadata.lineage = { parents: [b.key] };
+    b.cmb.metadata.lineage = { parents: [a.key] };
+    assert.strictEqual(resolveTetherAnchor(remixOf([a.key]), store([a, b])).key, b.key);
+  });
+
+  it('a root is its own anchor', () => {
+    const root = createCMB({ categories: cats('a root'), createdBy: 'peer' });
+    const r = resolveTetherAnchor(root, store([]));
+    assert.strictEqual(r.key, root.metadata.key);
+    assert.strictEqual(r.resolvedFromStore, false);
+    assert.strictEqual(r.complete, true);
+  });
+
+  it('nothing resolvable locally → the root is unverifiable, never the remix itself or a wire claim', () => {
+    // A remix is not a root. Anchoring it to itself measured its drift from itself — always
+    // "tethered" — and the integrator then signed that as a tether to a root nobody verified.
+    const incoming = remixOf(['cmb-' + '1'.repeat(64)], { ancestors: ['cmb-' + '2'.repeat(64)] });
+    const r = resolveTetherAnchor(incoming, store([]));
+    assert.deepStrictEqual(r, { key: null, categories: null, resolvedFromStore: false, complete: false });
+  });
+});
+
+describe('§15.8 anchor resolution — the walk passes only through VERIFIED records', () => {
+  it('a stored parent admitted UNVERIFIED ends that branch — the root behind it is not reached', () => {
+    // mid's parents are whatever its unverifiable author claimed. Following them let anyone who
+    // could get one unsigned block admitted choose which stored record anchors the next remix.
+    const root = entry('root', 500);
+    const mid = entry('mid', 700, [root.key], unverifiedAdmission);
+    const p1 = entry('p1', 900, [mid.key], verifiedAdmission);
+    const r = resolveTetherAnchor(remixOf([p1.key]), store([root, mid, p1]));
+    assert.strictEqual(r.key, p1.key, 'the oldest record reached through verified edges');
+    assert.strictEqual(r.complete, false, 'the walk stopped at an unverifiable parent');
+  });
+
+  it('a remix whose only parent is an unverified admission has no anchor — the root is unverifiable', () => {
+    const u = entry('unverified', 500, [], unverifiedAdmission);
+    const r = resolveTetherAnchor(remixOf([u.key]), store([u]));
+    assert.deepStrictEqual(r, { key: null, categories: null, resolvedFromStore: false, complete: false });
+  });
+
+  it('an admission with NO recorded verdict is unverified, not verified', () => {
+    // A peer record stored without the frame handler's verdict (an older store, or an admission
+    // path that never ran the signature check) proves nothing about its author.
+    const u = entry('no verdict', 500, [], { peerId: 'peer-1' });
+    assert.strictEqual(resolveTetherAnchor(remixOf([u.key]), store([u])).key, null);
+  });
+
+  it('a stored record whose categories no longer match its address is not walked', () => {
+    const root = entry('root', 500);
+    root.cmb.categories.focus.text = 'rewritten after it was addressed';
+    const r = resolveTetherAnchor(remixOf([root.key]), store([root]));
+    assert.strictEqual(r.key, null, 'content that does not answer to its key is not the content the key names');
+  });
+
+  it('two parents: the unverified branch ends, the verified branch still resolves', () => {
+    const root = entry('root', 500);
+    const u = entry('unverified older', 100, [], unverifiedAdmission);
+    const r = resolveTetherAnchor(remixOf([u.key, root.key]), store([root, u]));
+    assert.strictEqual(r.key, root.key, 'an older unverified record does not win the earliest-stored race');
+    assert.strictEqual(r.complete, false);
+  });
+});
+
+describe('storedRecordVerifies — what counts as a verified step', () => {
+  it('a record this node wrote verifies', () => {
+    const e = entry('own', 1);
+    assert.strictEqual(storedRecordVerifies(e, e.key), true);
+  });
+
+  it('a peer admission verifies only with a recorded signature verdict', () => {
+    const v = entry('peer verified', 1, [], verifiedAdmission);
+    const u = entry('peer unverified', 1, [], unverifiedAdmission);
+    assert.strictEqual(storedRecordVerifies(v, v.key), true);
+    assert.strictEqual(storedRecordVerifies(u, u.key), false);
+  });
+
+  it('a record stored under a different key does not verify', () => {
+    const e = entry('own', 1);
+    assert.strictEqual(storedRecordVerifies(e, 'cmb-' + '3'.repeat(64)), false);
+  });
+
+  it('a pre-boundary record (no metadata section) does not verify — §7.8 unverified-legacy', () => {
+    const e = entry('legacy', 1);
+    const legacy = { key: e.key, peerId: null, cmb: { key: e.key, categories: e.cmb.categories } };
+    assert.strictEqual(storedRecordVerifies(legacy, e.key), false);
   });
 
-  it('nothing resolvable locally → the block anchors itself, never a wire claim', () => {
-    const incoming = { metadata: { lineage: { parents: ['p1'], ancestors: ['root'] } }, categories: cats('remix') };
-    assert.strictEqual(resolveTetherAnchor(incoming, store([])).resolvedFromStore, false);
+  it('a bare record with no store envelope does not verify', () => {
+    const e = entry('bare', 1);
+    assert.strictEqual(storedRecordVerifies(e.cmb, e.key), false);
   });
 });

From 465b733d6333c0dca8e8b222ef9a4609159bfaa9 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 18:36:25 +0100
Subject: [PATCH 011/148] directed delivery: a signed addressee decides,
 whatever the frame says
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A verified record's signed `to` could only veto directed treatment, never grant it, so a
relay that stripped the frame's `directed` flag turned a signed directed CMB into a
broadcast that SVAF could reject and that never surfaced (§9.2.2). When the author signed
an addressee, it now alone decides whether the CMB is directed to this node (§8.8.5 step 7).
The frame flags still decide for unverified records and records that sign no addressee.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 lib/frame-handler.js                    |  8 +++++++-
 tests/audit-delivery-authorship.test.js | 14 ++++++++++++++
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/lib/frame-handler.js b/lib/frame-handler.js
index d0407f01..3c2a0c67 100644
--- a/lib/frame-handler.js
+++ b/lib/frame-handler.js
@@ -784,7 +784,13 @@ class FrameHandler {
     const meta = msg.cmb?.metadata;
     const signedTo = meta && Object.prototype.hasOwnProperty.call(meta, 'to') ? meta.to : undefined;
     const verified = msg._cmbVerified === true;
-    msg._directedToMe = frameDirected && !(verified && signedTo !== undefined && signedTo !== this._node.nodeId);
+    // When the author signed an addressee, that alone decides (§8.8.5 step 7): the frame flags are
+    // a relay's to set, so stripping `directed` must not turn a signed directed CMB into an
+    // SVAF-gated broadcast, and adding it must not make a signed broadcast directed.
+    const signedAddressee = verified && typeof signedTo === 'string' && signedTo.length > 0;
+    msg._directedToMe = signedAddressee
+      ? signedTo === this._node.nodeId
+      : frameDirected && !(verified && signedTo !== undefined && signedTo !== this._node.nodeId);
     const authenticatedDirected = msg._directedToMe && verified && signedTo === this._node.nodeId;
 
     const now = Date.now();
diff --git a/tests/audit-delivery-authorship.test.js b/tests/audit-delivery-authorship.test.js
index 53acb4a0..79470ef4 100644
--- a/tests/audit-delivery-authorship.test.js
+++ b/tests/audit-delivery-authorship.test.js
@@ -194,6 +194,20 @@ describe('directed delivery (MMP §9.2.2, §8.8.2)', () => {
     });
   });
 
+  it('B-R8: a signed addressee decides: a relay that strips the frame\'s directed flag cannot turn it into a broadcast', async () => {
+    await withNode('r8', async (node) => {
+      node._pinPeerKey('peerA', PEER_A.pub);
+      node._svafEvaluator.evaluate = async () => REJECTED; // as a broadcast it would be gated away
+      const seen = collect(node);
+      const f = frame(signed(mkCmb('for your eyes: the rollback plan', { to: node.nodeId })));
+      assert.strictEqual(f.directed, undefined, 'precondition: the frame does not say directed');
+      node._frameHandler.handle('peerA', 'peerA', f);
+      await settle();
+      assert.strictEqual(seen.accepted.length, 1, 'it surfaces as the directed CMB its author signed');
+      assert.strictEqual(seen.accepted[0].directed, true);
+    });
+  });
+
   it('N1: a relay cannot replay a signed directed record by re-spelling its signature or adding an assertionId', async () => {
     await withNode('d2-respell', async (node) => {
       node._pinPeerKey('peerA', PEER_A.pub);

From 189e0f8fc8b9e300f70248a6e0bba8092ce15cf9 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 18:37:42 +0100
Subject: [PATCH 012/148] v2.0 receipt: verify against the author's node id,
 check the assertionId
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- B-R4 (§8.8.4, §18.3.1): a published v2.0 record (mmp-sig-v2.0) signs its author's node
  id, but it was verified against the key of whichever peer delivered the frame. A peer
  could vouch for a record by signing it itself under another node's id, and a genuine
  relay failed. It is now verified against the key held for createdByNodeId. A missing
  key is unverified, not refused: that is key-distribution latency, as for v1.
- B-R6 (§8.8.5 step 5): a v2.0 record's carried assertionId must equal the one its
  preimage yields, or the record is refused. On other suites no signature covers an
  assertionId, so a carried one is dropped instead of kept beside verified fields.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 lib/frame-handler.js            | 30 ++++++++++-
 tests/v2-author-binding.test.js | 93 +++++++++++++++++++++++++++++++++
 2 files changed, 122 insertions(+), 1 deletion(-)
 create mode 100644 tests/v2-author-binding.test.js

diff --git a/lib/frame-handler.js b/lib/frame-handler.js
index 3c2a0c67..0253267e 100644
--- a/lib/frame-handler.js
+++ b/lib/frame-handler.js
@@ -446,7 +446,35 @@ class FrameHandler {
     // than no log, because it reads as a record with no address.
     const cmbKeyOf = recordKey;   // shared accessor — see lib/record.js
     if (!cmb) { msg._cmbVerified = false; return false; }
-    const { verifyCMB } = require('./core');
+    const { verifyCMB, assertionIdV2_0 } = require('./core');
+
+    // Published v2.0 records (mmp-sig-v2.0) sign the author's NODE ID, so the verifying key is the
+    // one held for createdByNodeId, never the delivering peer's (§8.8.4, §18.3.1): verified against
+    // the deliverer, a peer could vouch for a record by signing it itself under someone else's id.
+    // Their assertionId must also be the one the preimage yields (§8.8.5 step 5).
+    const md = cmb.metadata;
+    if (md && md.signatureSuite === 'mmp-sig-v2.0' && typeof md.createdByNodeId === 'string' && md.createdByNodeId) {
+      const authorKey = typeof this._node._identityKey === 'function'
+        ? this._node._identityKey(md.createdByNodeId)
+        : this._node._peerIdentityKeys?.get(md.createdByNodeId);
+      // No key for the author yet is key-distribution latency, not forgery: unverified, as for v1.
+      if (!authorKey) { msg._cmbVerified = false; return false; }
+      const v2 = verifyCMB(cmb, authorKey);
+      const idOk = md.assertionId === undefined || md.assertionId === assertionIdV2_0(cmb);
+      if (v2.valid && idOk) { msg._cmbVerified = true; return false; }
+      const reason = !v2.valid ? (v2.error || 'invalid') : 'assertion-id-mismatch';
+      const k = recordKey(cmb);
+      this._node._log(`[sym-security] v2.0 CMB ${String(k || '').slice(0, 16)} from ${peerName} rejected — ${reason} (author ${md.createdByNodeId.slice(0, 8)})`);
+      this._node.emit('metric', { type: 'cmb-signature-rejected', from: peerName, key: k, reason: 'invalid', error: reason });
+      if (typeof this._node._recordDecision === 'function') {
+        this._node._recordDecision({ method: 'signature', source: msg.source || peerName, cmbKey: k, decision: 'rejected-signature', totalDrift: null, categoryDrifts: null, gateValues: null, focusLabel: reason, remix: recordParents(cmb).length > 0 });
+      }
+      return true;
+    }
+    // On any other suite no signature covers an assertionId, so a carried one is an unsigned claim
+    // a relay could set. It is dropped rather than kept beside verified fields.
+    if (md && Object.prototype.hasOwnProperty.call(md, 'assertionId')) delete md.assertionId;
+
     // Resolve through the roster registry (anchor > handshake > grant-vouched)
     // so CMBs relayed from peers we never directly handshook still verify,
     // falling back to the direct-handshake map.
diff --git a/tests/v2-author-binding.test.js b/tests/v2-author-binding.test.js
new file mode 100644
index 00000000..f7356a38
--- /dev/null
+++ b/tests/v2-author-binding.test.js
@@ -0,0 +1,93 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME to a temp sandbox before lib/config loads
+
+/**
+ * Receipt of published v2.0 records (mmp-sig-v2.0), which sign the author's node id:
+ * - B-R4 (§8.8.4, §18.3.1): the verifying key is the one held for `createdByNodeId`, never the
+ *   key of whichever peer delivered the frame, so a peer cannot vouch for a record by signing it
+ *   itself under someone else's id, and a genuine relay verifies against the author.
+ * - B-R6 (§8.8.5 step 5): a carried `assertionId` must be the one the preimage yields; on records
+ *   of the older suite, where no signature covers it, a carried `assertionId` is dropped.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const crypto = require('crypto');
+const fs = require('fs');
+const { SymNode } = require('../lib/node');
+const { NullDiscovery } = require('../lib/discovery');
+const { nodeDir } = require('../lib/config');
+const { createCMB, signCMB, assertionIdV2_0 } = require('../lib/core');
+
+function kp() {
+  const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519', {
+    publicKeyEncoding: { type: 'spki', format: 'der' }, privateKeyEncoding: { type: 'pkcs8', format: 'der' },
+  });
+  return { pub: publicKey.slice(-32).toString('base64url'), priv: privateKey.slice(-32).toString('base64url') };
+}
+const ALICE = kp(), MALLORY = kp(), RELAY = kp();
+
+function v2Record({ nodeId, createdBy, signWith, focus = 'v2 observation' }) {
+  const cmb = createCMB({ categories: { focus }, createdBy, emitV2: true, createdByNodeId: nodeId, room: 'default' });
+  cmb.metadata.assertionId = assertionIdV2_0(cmb);
+  signCMB(cmb, signWith.priv);
+  return cmb;
+}
+
+function withNode(fn) {
+  const name = `v2bind-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+  const node = new SymNode({ name, silent: true, discovery: new NullDiscovery() });
+  node._pinPeerKey('node-alice', ALICE.pub);
+  node._pinPeerKey('node-mallory', MALLORY.pub);
+  node._pinPeerKey('node-relay', RELAY.pub);
+  try { return fn(node); } finally { fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+}
+
+describe('v2.0 author binding (B-R4)', () => {
+  it('a v2.0 record relayed by another peer verifies against its author\'s key', () => {
+    withNode((node) => {
+      const msg = { cmb: v2Record({ nodeId: 'node-alice', createdBy: 'alice', signWith: ALICE }) };
+      assert.strictEqual(node._frameHandler._rejectOnBadSignature('node-relay', 'relay', msg), false);
+      assert.strictEqual(msg._cmbVerified, true);
+    });
+  });
+
+  it('a peer that signs a record under another node\'s id is refused, even delivering it itself', () => {
+    withNode((node) => {
+      const msg = { cmb: v2Record({ nodeId: 'node-alice', createdBy: 'alice', signWith: MALLORY }) };
+      assert.strictEqual(node._frameHandler._rejectOnBadSignature('node-mallory', 'mallory', msg), true);
+    });
+  });
+
+  it('an author whose key this node does not hold yet is unverified, not refused', () => {
+    withNode((node) => {
+      const stranger = kp();
+      const msg = { cmb: v2Record({ nodeId: 'node-stranger', createdBy: 'stranger', signWith: stranger }) };
+      assert.strictEqual(node._frameHandler._rejectOnBadSignature('node-relay', 'relay', msg), false);
+      assert.strictEqual(msg._cmbVerified, false);
+    });
+  });
+});
+
+describe('assertionId (B-R6)', () => {
+  it('a v2.0 record whose carried assertionId is not the preimage\'s is refused', () => {
+    withNode((node) => {
+      const cmb = v2Record({ nodeId: 'node-alice', createdBy: 'alice', signWith: ALICE });
+      cmb.metadata.assertionId = 'asrt-' + '0'.repeat(64);
+      assert.strictEqual(node._frameHandler._rejectOnBadSignature('node-alice', 'alice', { cmb }), true);
+    });
+  });
+
+  it('on an older-suite record, a carried assertionId (which nothing signs) is dropped', () => {
+    withNode((node) => {
+      const cmb = createCMB({ categories: { focus: 'old suite' }, createdBy: 'alice', room: 'default' });
+      signCMB(cmb, ALICE.priv);
+      cmb.metadata.assertionId = 'asrt-' + '1'.repeat(64);
+      const msg = { cmb };
+      assert.strictEqual(node._frameHandler._rejectOnBadSignature('node-alice', 'alice', msg), false);
+      assert.strictEqual(msg._cmbVerified, true);
+      assert.strictEqual('assertionId' in msg.cmb.metadata, false);
+    });
+  });
+});

From ee965cc9b2e882e013f1fdb0d2a6eb8e65d5600a Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 18:39:04 +0100
Subject: [PATCH 013/148] identity lock: remember a live pid's start time; read
 many pids in one lookup

On Windows every start-time read is a synchronous PowerShell process
(~0.45 s), run per pid per lock check and remembered for only 10 s, so a
daemon start paid it once per node directory whose lock it checked.

- createStartTimeCache: a successful read is kept until the pid is seen
  dead (or a fresh read returns a different start); a failed read is kept
  10 s as before, so lookup failure still means "held", warned once
- one PowerShell call reads every pid asked for (Get-Process -Id a,b,c;
  `exit 0` so one vanished pid does not discard the others), using the
  same per-process expression as before, so strings match existing locks
- locksHeldByLiveProcess / primeProcessStartTimes: a pass over many locks
  reads all their holders in one lookup; migrateStores now checks only the
  nodes that still need the rename, all in one batch
- the one hazard of remembering: a pid that dies and is reused between two
  checks is never seen dead. A mismatch, which hands the lock to someone
  else, is therefore always confirmed by a fresh read, so a remembered
  value can only err toward "held"

POSIX keeps reading `ps` directly (cheap, nothing remembered). Tests run
the cache through an injected lookup on every platform: one read per live
pid however often it is checked, forgotten when seen dead, failures
retried after 10 s, one lookup per prime and per migrateStores pass, a
mismatch re-read before reclaiming, a failure held and warned once. They
fail on the previous code, which had no batched or injectable path. The
PowerShell batch itself runs only in the win32-only config test.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 lib/config.js                  | 189 ++++++++++++++++++++++++++------
 lib/node.js                    |  31 +++---
 tests/config.test.js           |  16 +++
 tests/start-time-cache.test.js | 192 +++++++++++++++++++++++++++++++++
 4 files changed, 379 insertions(+), 49 deletions(-)
 create mode 100644 tests/start-time-cache.test.js

diff --git a/lib/config.js b/lib/config.js
index be431d41..24447e9d 100644
--- a/lib/config.js
+++ b/lib/config.js
@@ -341,10 +341,12 @@ function bootTimeMs() {
  * lock distinguish "our previous holder is still running" from "an
  * unrelated process recycled the holder's PID".
  * @param {number} pid
+ * @param {{fresh?: boolean}} [opts] — fresh: re-read even if a start time is remembered
  * @returns {string|null}
  */
-function processStartTime(pid) {
-  if (process.platform === 'win32') return windowsProcessStartTime(pid);
+function processStartTime(pid, { fresh = false } = {}) {
+  const cache = startTimeCache();
+  if (cache) return cachedProcessStartTime(cache, pid, fresh);
   try {
     const out = execFileSync('ps', ['-p', String(pid), '-o', 'lstart='], {
       encoding: 'utf8',
@@ -358,43 +360,133 @@ function processStartTime(pid) {
 }
 
 /**
- * Windows has no `ps`. PowerShell reports a process's start time; the UTC ISO-8601 form is stable
- * across calls and locales, so the lock writer (for itself) and a later reader (for the same PID)
- * produce the same string. Without it, a Windows lock recorded no start time and a crashed
- * holder's recycled PID kept the name locked until reboot.
+ * Read the start times of several processes at once, so a later processStartTime() for any of
+ * them is answered from memory. A no-op where reads are cheap enough not to be remembered (`ps`).
+ * @param {number[]} pids
+ */
+function primeProcessStartTimes(pids) {
+  const cache = startTimeCache();
+  if (cache) cache.prime(pids.filter(validStartTimePid));
+}
+
+/**
+ * A memory of process start times in front of a slow lookup — on Windows every read is a
+ * PowerShell process (~0.45 s, synchronous), and a daemon start checks the lock of every node
+ * directory.
+ *
+ * A start time belongs to a PROCESS, and a live process's start time never changes, so a
+ * successful read is kept for as long as the pid stays alive. Once the pid is seen dead the
+ * entry is dropped, because the number is now free for an unrelated process. A failed read is
+ * kept only briefly: it may be a transient timeout, but retrying it on every check would put a
+ * multi-second call back on every lock check for a process we cannot read.
  *
+ * What memory cannot see is a holder that dies and whose pid is reused BETWEEN two of our
+ * checks: nothing observed it dead, so its remembered start outlives it. `fresh` re-reads and
+ * replaces the entry, and the lock check re-reads before it acts on a mismatch (see
+ * lockIsHeldByLiveProcess) — so a remembered value can only err toward "held", the direction a
+ * failed lookup already takes, never toward handing a live holder's lock to someone else.
+ *
+ * @param {(pids: number[]) => Map<number, string>} lookup — reads many pids in ONE call; a pid
+ *   it cannot read is absent from the result; throwing means it could read none
+ * @param {object} [o]
+ * @param {(pid: number) => boolean} [o.isAlive]
+ * @param {number} [o.failureTtlMs] — how long a failed read is remembered
+ * @param {() => number} [o.now]
+ */
+function createStartTimeCache(lookup, { isAlive = pidIsAlive, failureTtlMs = START_FAILURE_TTL_MS, now = Date.now } = {}) {
+  const entries = new Map(); // pid → { value: string|null, at: ms }
+  const remembered = (pid) => {
+    const e = entries.get(pid);
+    return Boolean(e) && (e.value !== null || now() - e.at < failureTtlMs);
+  };
+  const read = (pids) => {
+    let got;
+    try { got = lookup(pids); } catch { got = null; }
+    for (const pid of pids) {
+      const value = got instanceof Map && typeof got.get(pid) === 'string' ? got.get(pid) : null;
+      entries.set(pid, { value, at: now() });
+    }
+  };
+  return {
+    /** The start time of `pid`, or null when it is dead or cannot be read. */
+    get(pid, { fresh = false } = {}) {
+      if (!isAlive(pid)) { entries.delete(pid); return null; }
+      if (fresh || !remembered(pid)) read([pid]);
+      return entries.get(pid).value;
+    },
+    /** Read every live pid not already remembered, in one lookup. */
+    prime(pids) {
+      const need = [];
+      for (const pid of new Set(pids)) {
+        if (!isAlive(pid)) entries.delete(pid);
+        else if (!remembered(pid)) need.push(pid);
+      }
+      if (need.length) read(need);
+    },
+    clear() { entries.clear(); },
+  };
+}
+const START_FAILURE_TTL_MS = 10000;
+
+function validStartTimePid(pid) {
+  return Number.isInteger(pid) && pid > 0 && pid <= 0xffffffff;
+}
+
+let _startTimeCache = null;
+let _startTimeLookupOverride = null; // test hook: see _setProcessStartTimeLookup
+let _startTimeWarned = false;
+
+/** The remembered-start-time path, or null where start times are read directly (`ps`). */
+function startTimeCache() {
+  if (!_startTimeLookupOverride && process.platform !== 'win32') return null;
+  if (!_startTimeCache) _startTimeCache = createStartTimeCache(_startTimeLookupOverride || windowsStartTimes);
+  return _startTimeCache;
+}
+
+/**
  * Failure (no PowerShell, a timeout, access denied for another user's or a protected process)
  * returns null, which every reader treats as "held": the safe direction, and the pre-0.13.13
- * behaviour. A one-time warning says so. Results are cached briefly per PID, because a daemon
- * checks every node directory's lock at start and many of them share one holder process.
- * @param {number} pid
- * @returns {string|null}
+ * behaviour. A one-time warning says so.
  */
-function windowsProcessStartTime(pid) {
-  if (!Number.isInteger(pid) || pid <= 0 || pid > 0xffffffff) return null;
-  const cached = _winStartCache.get(pid);
-  if (cached && Date.now() - cached.at < WIN_START_CACHE_MS) return cached.value;
-  let value = null;
-  try {
-    const out = execFileSync(windowsPowerShellPath(), [
-      '-NoProfile', '-NonInteractive', '-Command',
-      `(Get-Process -Id ${pid} -ErrorAction Stop).StartTime.ToUniversalTime().ToString('o')`,
-    ], { encoding: 'utf8', timeout: 5000, windowsHide: true }).trim();
-    value = /^\d{4}-\d{2}-\d{2}T[\d:.]+Z$/.test(out) ? out : null;
-  } catch {
-    value = null;
-  }
-  if (value === null && !_winStartWarned) {
-    _winStartWarned = true;
+function cachedProcessStartTime(cache, pid, fresh) {
+  if (!validStartTimePid(pid)) return null;
+  const value = cache.get(pid, { fresh });
+  if (value === null && !_startTimeWarned && pidIsAlive(pid)) {
+    _startTimeWarned = true;
     process.emitWarning(`SYM identity lock: could not read the start time of process ${pid}; ` +
       'a lock held by that PID is treated as live (delete ~/.sym/nodes/<name>/lock.pid if its holder is gone).');
   }
-  _winStartCache.set(pid, { value, at: Date.now() });
   return value;
 }
-const WIN_START_CACHE_MS = 10000;
-const _winStartCache = new Map();
-let _winStartWarned = false;
+
+/**
+ * Windows has no `ps`. PowerShell reports a process's start time; the UTC ISO-8601 form is stable
+ * across calls and locales, so the lock writer (for itself) and a later reader (for the same PID)
+ * produce the same string. Without it, a Windows lock recorded no start time and a crashed
+ * holder's recycled PID kept the name locked until reboot.
+ *
+ * Every pid asked for is read in ONE PowerShell process: `Get-Process -Id a,b,c` skips the ones
+ * that are gone, and a process whose start time cannot be read (access denied) prints nothing,
+ * so it is simply absent from the result. `exit 0` because PowerShell exits 1 when any pid in
+ * the list was missing, which would otherwise throw away the ones it did read. The
+ * per-process expression is the one earlier versions used for a single pid, so the strings
+ * match locks those versions wrote.
+ * @param {number[]} pids
+ * @returns {Map<number, string>}
+ */
+function windowsStartTimes(pids) {
+  const out = execFileSync(windowsPowerShellPath(), [
+    '-NoProfile', '-NonInteractive', '-Command',
+    `Get-Process -Id ${pids.join(',')} -ErrorAction SilentlyContinue | ForEach-Object { ` +
+      `try { '{0} {1}' -f $_.Id, $_.StartTime.ToUniversalTime().ToString('o') } catch { } }; exit 0`,
+  ], { encoding: 'utf8', timeout: 5000 + 250 * pids.length, windowsHide: true });
+  const times = new Map();
+  for (const line of out.split(/\r?\n/)) {
+    const m = /^(\d+) (\d{4}-\d{2}-\d{2}T[\d:.]+Z)$/.exec(line.trim());
+    if (m) times.set(Number(m[1]), m[2]);
+  }
+  return times;
+}
 
 /** The system PowerShell by absolute path, never whatever `powershell.exe` the search path finds first. */
 function windowsPowerShellPath() {
@@ -483,7 +575,11 @@ function lockIsHeldByLiveProcess(lock) {
   }
   if (!pidIsAlive(lock.pid)) return false;
   if (lock.start) {
-    const current = processStartTime(lock.pid);
+    let current = processStartTime(lock.pid);
+    // A remembered start time (Windows) may predate a death and reuse of this pid that no
+    // check observed. A mismatch hands the lock to someone else, so it is never concluded
+    // from memory: re-read first. A match errs only toward "held".
+    if (current && current !== lock.start) current = processStartTime(lock.pid, { fresh: true });
     if (current && current !== lock.start) return false; // PID reused
   } else if (lock.mtimeMs < bootTimeMs() - LOCK_BOOT_SLACK_MS) {
     // Legacy lock with no start-time metadata, written before this boot:
@@ -493,6 +589,18 @@ function lockIsHeldByLiveProcess(lock) {
   return true;
 }
 
+/**
+ * lockIsHeldByLiveProcess for several locks, with every holder's start time read in one
+ * lookup rather than one per lock — on Windows that is one PowerShell process instead of one
+ * per node directory.
+ * @param {Array<{pid: number|null, start: string|null, mtimeMs: number}|null>} locks
+ * @returns {boolean[]}
+ */
+function locksHeldByLiveProcess(locks) {
+  primeProcessStartTimes(locks.filter((l) => l && l.pid !== null && l.start).map((l) => l.pid));
+  return locks.map((l) => lockIsHeldByLiveProcess(l));
+}
+
 /**
  * Read the holder PID from a node's lockfile, or null if the lockfile is
  * absent, unreadable, or has non-numeric content. Understands both the
@@ -685,10 +793,25 @@ module.exports = {
   normalizeMdnsHostname,
   pidIsAlive,
   processStartTime,
-  /** Test hook: forget cached Windows start times, so a test reaches PowerShell on every call. */
-  _clearProcessStartTimeCache: () => _winStartCache.clear(),
+  primeProcessStartTimes,
+  /** Test hook: forget remembered start times, so the next read reaches the lookup. */
+  _clearProcessStartTimeCache: () => { if (_startTimeCache) _startTimeCache.clear(); },
+  /**
+   * Test hook: read start times through `lookup` (see createStartTimeCache) on every platform,
+   * so the remembered-start-time path Windows takes can be exercised anywhere. null restores
+   * the platform default.
+   */
+  _setProcessStartTimeLookup: (lookup) => {
+    _startTimeLookupOverride = lookup || null;
+    _startTimeCache = null;
+    _startTimeWarned = false;
+  },
+  _createStartTimeCache: createStartTimeCache,
+  /** Test hook (win32 only): the raw batched PowerShell lookup. */
+  _windowsStartTimes: windowsStartTimes,
   readLockFile,
   lockIsHeldByLiveProcess,
+  locksHeldByLiveProcess,
   lockHolderPid,
   acquireIdentityLock,
   log,
diff --git a/lib/node.js b/lib/node.js
index 607a20e3..0fd7c571 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -3174,25 +3174,24 @@ class SymNode extends EventEmitter {
 // node at sym / mesh-channel install so readers use the `cmbs/` name with no
 // fallback. A LIVE node is skipped — it is running the prior code on `meshmem/`
 // and self-migrates on its next restart; renaming under it would break it.
-function _nodeIsLive(nodeDir) {
-  const { readLockFile, lockIsHeldByLiveProcess } = require('./config');
-  return lockIsHeldByLiveProcess(readLockFile(path.join(nodeDir, 'lock.pid')));
-}
-
+//
+// Only a node that still needs the rename has its lock checked, and all of those
+// checks share one start-time lookup: on Windows each lookup is a PowerShell
+// process, and the daemon runs this pass at every start over every node dir.
 function migrateStores(nodesRoot = path.join(require('./core/state-root').SYM_STATE_DIR, 'nodes')) {
-  let migrated = 0;
+  const { readLockFile, locksHeldByLiveProcess } = require('./config');
   let dirs;
   try { dirs = fs.readdirSync(nodesRoot, { withFileTypes: true }); } catch { return 0; }
-  for (const d of dirs) {
-    if (!d.isDirectory()) continue;
-    const nodeDir = path.join(nodesRoot, d.name);
-    if (_nodeIsLive(nodeDir)) continue; // live node self-migrates on restart
-    const meshmem = path.join(nodeDir, 'meshmem');
-    const cmbs = path.join(nodeDir, 'cmbs');
-    if (fs.existsSync(meshmem) && !fs.existsSync(cmbs)) {
-      try { fs.renameSync(meshmem, cmbs); migrated++; } catch { /* leave it */ }
-    }
-  }
+  const pending = dirs
+    .filter((d) => d.isDirectory())
+    .map((d) => path.join(nodesRoot, d.name))
+    .filter((nodeDir) => fs.existsSync(path.join(nodeDir, 'meshmem')) && !fs.existsSync(path.join(nodeDir, 'cmbs')));
+  const live = locksHeldByLiveProcess(pending.map((nodeDir) => readLockFile(path.join(nodeDir, 'lock.pid'))));
+  let migrated = 0;
+  pending.forEach((nodeDir, i) => {
+    if (live[i]) return; // live node self-migrates on restart
+    try { fs.renameSync(path.join(nodeDir, 'meshmem'), path.join(nodeDir, 'cmbs')); migrated++; } catch { /* leave it */ }
+  });
   return migrated;
 }
 
diff --git a/tests/config.test.js b/tests/config.test.js
index 70907103..80f0ff9d 100644
--- a/tests/config.test.js
+++ b/tests/config.test.js
@@ -13,6 +13,7 @@ const {
   uuidv7, validateName, generateSigningKeyPair, loadOrCreateIdentity,
   normalizeMdnsHostname, pidIsAlive, lockHolderPid, log,
   acquireIdentityLock, readLockFile, processStartTime, _clearProcessStartTimeCache,
+  primeProcessStartTimes, _windowsStartTimes,
 } = require('../lib/config');
 
 describe('uuidv7', () => {
@@ -348,6 +349,21 @@ describe('acquireIdentityLock', () => {
     assert.notStrictEqual(processStartTime(liveChild.pid), a, 'a different process differs');
   });
 
+  it('on Windows, one PowerShell call reads several pids and agrees with single reads', { skip: process.platform !== 'win32' }, () => {
+    // A pid that is gone must not cost the others their answer: PowerShell exits 1 when any id
+    // in the list is missing, and the lookup must still return the ones it read.
+    const both = _windowsStartTimes([process.pid, liveChild.pid, DEAD_PID]);
+    assert.strictEqual(both.has(DEAD_PID), false);
+    _clearProcessStartTimeCache();
+    primeProcessStartTimes([process.pid, liveChild.pid]);
+    const batched = [processStartTime(process.pid), processStartTime(liveChild.pid)];
+    assert.deepStrictEqual(batched, [both.get(process.pid), both.get(liveChild.pid)]);
+    assert.deepStrictEqual(batched, [
+      processStartTime(process.pid, { fresh: true }), processStartTime(liveChild.pid, { fresh: true }),
+    ], 'a single-pid read gives the same strings');
+    assert.match(String(batched[1]), /^\d{4}-\d{2}-\d{2}T[\d:.]+Z$/);
+  });
+
   it('on Windows, a lock recorded with a recycled PID\'s old start time is reclaimed', { skip: process.platform !== 'win32' }, () => {
     const name = mkName();
     writeLock(name, `${liveChild.pid}\n{"start":"2004-01-01T00:00:00.0000000Z","createdAt":1}\n`);
diff --git a/tests/start-time-cache.test.js b/tests/start-time-cache.test.js
new file mode 100644
index 00000000..0cf45a00
--- /dev/null
+++ b/tests/start-time-cache.test.js
@@ -0,0 +1,192 @@
+'use strict';
+
+require('./_isolate-home'); // sandbox HOME/USERPROFILE before anything reads os.homedir()
+
+/**
+ * Remembered process start times — the path every Windows identity-lock check takes.
+ *
+ * On Windows a start-time read is a PowerShell process (~0.45 s, synchronous). It used to run
+ * once per pid per lock check, remembered for 10 s, so a daemon start that checked every node
+ * directory's lock paid it per directory. A live process's start time cannot change, so a read
+ * is now remembered until the pid is seen dead, and a pass over many locks reads all of their
+ * holders in one lookup.
+ *
+ * Everything here runs through an injected lookup, so it is exercised on every platform; the
+ * PowerShell lookup itself only runs on Windows (config.test.js has the win32-only checks).
+ */
+
+const { describe, it, before, after, afterEach } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const { spawn } = require('node:child_process');
+const cfg = require('../lib/config');
+const { migrateStores } = require('../lib/node');
+const { tmpdir } = require('./_tmpdir');
+
+/** A lookup that answers from `table` and records every call it receives. */
+function recordingLookup(table) {
+  const calls = [];
+  const lookup = (pids) => {
+    calls.push([...pids].sort((a, b) => a - b));
+    const out = new Map();
+    for (const pid of pids) if (typeof table[pid] === 'string') out.set(pid, table[pid]);
+    return out;
+  };
+  return { lookup, calls };
+}
+
+describe('createStartTimeCache', () => {
+  it('a live pid is read once and remembered well past the old 10 s window', () => {
+    let t = 0;
+    const { lookup, calls } = recordingLookup({ 100: 'S100' });
+    const cache = cfg._createStartTimeCache(lookup, { isAlive: () => true, now: () => t });
+    assert.equal(cache.get(100), 'S100');
+    t += 60 * 60 * 1000; // an hour later
+    assert.equal(cache.get(100), 'S100');
+    assert.equal(cache.get(100), 'S100');
+    assert.equal(calls.length, 1, 'one lookup for a pid that stayed alive');
+  });
+
+  it('a pid seen dead is forgotten, and a reused pid is read afresh', () => {
+    let alive = true;
+    const table = { 200: 'old-process' };
+    const { lookup, calls } = recordingLookup(table);
+    const cache = cfg._createStartTimeCache(lookup, { isAlive: () => alive });
+    assert.equal(cache.get(200), 'old-process');
+    alive = false;
+    assert.equal(cache.get(200), null, 'a dead pid has no start time');
+    assert.equal(calls.length, 1, 'and is not looked up');
+    alive = true;
+    table[200] = 'new-process'; // the number was reused
+    assert.equal(cache.get(200), 'new-process');
+    assert.equal(calls.length, 2);
+  });
+
+  it('fresh re-reads, and a different start replaces the remembered one', () => {
+    const table = { 300: 'A' };
+    const { lookup, calls } = recordingLookup(table);
+    const cache = cfg._createStartTimeCache(lookup, { isAlive: () => true });
+    assert.equal(cache.get(300), 'A');
+    table[300] = 'B'; // died and was reused between two checks, unobserved
+    assert.equal(cache.get(300), 'A', 'memory cannot see an unobserved reuse');
+    assert.equal(cache.get(300, { fresh: true }), 'B');
+    assert.equal(cache.get(300), 'B', 'the new read replaced the old one');
+    assert.equal(calls.length, 2);
+  });
+
+  it('prime reads every live, unremembered pid in ONE lookup', () => {
+    const { lookup, calls } = recordingLookup({ 1: 'a', 2: 'b', 3: 'c', 4: 'd' });
+    const cache = cfg._createStartTimeCache(lookup, { isAlive: (pid) => pid !== 9 });
+    cache.prime([3, 1, 2, 2, 9]);
+    assert.deepEqual(calls, [[1, 2, 3]], 'one call, duplicates folded, the dead pid skipped');
+    assert.deepEqual([cache.get(1), cache.get(2), cache.get(3)], ['a', 'b', 'c']);
+    assert.equal(calls.length, 1, 'answered from memory');
+    cache.prime([1, 4]);
+    assert.deepEqual(calls[1], [4], 'only the pid not already remembered');
+  });
+
+  it('a failed read is remembered only briefly, then retried', () => {
+    let t = 0;
+    let fail = true;
+    const calls = [];
+    const lookup = (pids) => {
+      calls.push(pids);
+      if (fail) throw new Error('powershell timed out');
+      return new Map(pids.map((p) => [p, 'S']));
+    };
+    const cache = cfg._createStartTimeCache(lookup, { isAlive: () => true, now: () => t, failureTtlMs: 10000 });
+    assert.equal(cache.get(500), null);
+    t += 5000;
+    assert.equal(cache.get(500), null);
+    assert.equal(calls.length, 1, 'not retried on every check');
+    t += 6000;
+    fail = false;
+    assert.equal(cache.get(500), 'S', 'retried once the failure has aged out');
+    assert.equal(calls.length, 2);
+  });
+
+  it('a pid the lookup could not read (absent from its answer) is a failed read', () => {
+    const { lookup } = recordingLookup({ 1: 'a' });
+    const cache = cfg._createStartTimeCache(lookup, { isAlive: () => true });
+    cache.prime([1, 2]);
+    assert.equal(cache.get(1), 'a');
+    assert.equal(cache.get(2), null);
+  });
+});
+
+describe('the lock check on the remembered-start-time path', () => {
+  let holderA;
+  let holderB;
+  before(() => {
+    holderA = spawn(process.execPath, ['-e', 'setInterval(() => {}, 1000)'], { stdio: 'ignore' });
+    holderB = spawn(process.execPath, ['-e', 'setInterval(() => {}, 1000)'], { stdio: 'ignore' });
+  });
+  after(() => {
+    for (const c of [holderA, holderB]) { try { c.kill('SIGKILL'); } catch {} }
+  });
+  afterEach(() => cfg._setProcessStartTimeLookup(null));
+
+  const lock = (pid, start) => ({ pid, start, mtimeMs: Date.now() });
+
+  it('a lookup failure leaves the lock held, and warns once', async () => {
+    cfg._setProcessStartTimeLookup(() => { throw new Error('no PowerShell'); });
+    const warnings = [];
+    const onWarning = (w) => { if (/SYM identity lock/.test(w.message)) warnings.push(w); };
+    process.on('warning', onWarning);
+    try {
+      assert.equal(cfg.lockIsHeldByLiveProcess(lock(holderA.pid, 'S-A')), true);
+      assert.equal(cfg.lockIsHeldByLiveProcess(lock(holderB.pid, 'S-B')), true);
+      await new Promise((resolve) => setImmediate(resolve)); // emitWarning delivers on a later tick
+      assert.equal(warnings.length, 1, 'one warning, not one per check');
+    } finally {
+      process.off('warning', onWarning);
+    }
+  });
+
+  it('a mismatch on a remembered start is re-read before the lock is handed over', () => {
+    const table = { [holderA.pid]: 'first-occupant' };
+    const { lookup, calls } = recordingLookup(table);
+    cfg._setProcessStartTimeLookup(lookup);
+    assert.equal(cfg.processStartTime(holderA.pid), 'first-occupant');
+    // The first occupant died and the pid was reused, unobserved; the new occupant wrote the lock.
+    table[holderA.pid] = 'second-occupant';
+    assert.equal(cfg.lockIsHeldByLiveProcess(lock(holderA.pid, 'second-occupant')), true,
+      'a live holder must not lose its lock to a stale memory');
+    assert.equal(calls.length, 2, 'the mismatch was confirmed by a fresh read');
+    assert.equal(cfg.lockIsHeldByLiveProcess(lock(holderA.pid, 'recycled-away')), false, 'a real mismatch is still stale');
+  });
+
+  it('a match is answered from memory: one read per holder however often it is checked', () => {
+    const { lookup, calls } = recordingLookup({ [holderA.pid]: 'S-A' });
+    cfg._setProcessStartTimeLookup(lookup);
+    for (let i = 0; i < 5; i++) assert.equal(cfg.lockIsHeldByLiveProcess(lock(holderA.pid, 'S-A')), true);
+    assert.equal(calls.length, 1);
+  });
+
+  it('migrateStores reads every pending node\'s holder in ONE lookup, and only the pending ones', () => {
+    const root = tmpdir('sym-migrate-');
+    const DEAD = 2147483646;
+    const nodes = {
+      'held-by-a-1': { pid: holderA.pid, start: 'S-A', pending: true },
+      'held-by-a-2': { pid: holderA.pid, start: 'S-A', pending: true },
+      'held-by-b': { pid: holderB.pid, start: 'S-B', pending: true },
+      'holder-dead': { pid: DEAD, start: 'S-dead', pending: true },
+      'already-migrated': { pid: holderB.pid, start: 'S-B', pending: false },
+    };
+    for (const [name, n] of Object.entries(nodes)) {
+      const dir = path.join(root, name);
+      fs.mkdirSync(path.join(dir, n.pending ? 'meshmem' : 'cmbs'), { recursive: true });
+      fs.writeFileSync(path.join(dir, 'lock.pid'), `${n.pid}\n${JSON.stringify({ start: n.start, createdAt: Date.now() })}\n`);
+    }
+    const { lookup, calls } = recordingLookup({ [holderA.pid]: 'S-A', [holderB.pid]: 'S-B' });
+    cfg._setProcessStartTimeLookup(lookup);
+
+    assert.equal(migrateStores(root), 1, 'only the node whose holder is dead is migrated');
+    assert.deepEqual(calls, [[holderA.pid, holderB.pid].sort((x, y) => x - y)], 'one lookup for both live holders');
+    assert.ok(fs.existsSync(path.join(root, 'holder-dead', 'cmbs')));
+    for (const live of ['held-by-a-1', 'held-by-a-2', 'held-by-b']) {
+      assert.ok(fs.existsSync(path.join(root, live, 'meshmem')), `${live} is live and left alone`);
+    }
+  });
+});

From 4523e95140524e2940c55495134152ff42976b24 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 18:39:15 +0100
Subject: [PATCH 014/148] lineage tether: measure the stored record's text, in
 one kernel (B-L5)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

§15.8 makes the tether content-only so any holder of the root and the
record re-encodes the two texts and recomputes what the integrator
signed. The gate measured the remix side on its fused vectors, which
are this receiver's attention readout over its own recent anchors: two
nodes holding the same root and record signed different drifts
(0.134757 vs 0.183918 in the new test), and no holder could reproduce
either.

The gate now runs evaluateLineageTetherFromText on the record it
stores, the same computation the retroactive audit uses. That function
is made content-only throughout (a vector on a category with no text
was taken as-is) and single-kernel: the semantic encoder replaces the
lexical one at runtime, and an evaluation whose encodes straddled the
switch compared unrelated spaces, so it now re-encodes both sides when
the kernel identity changes underneath it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 lib/core/lineage-tether.js                |  55 ++++---
 lib/core/svaf-baseline.js                 |  69 ++++-----
 tests/lineage-tether-reproducible.test.js | 172 ++++++++++++++++++++++
 3 files changed, 233 insertions(+), 63 deletions(-)
 create mode 100644 tests/lineage-tether-reproducible.test.js

diff --git a/lib/core/lineage-tether.js b/lib/core/lineage-tether.js
index c2743bfd..46fc4e3e 100644
--- a/lib/core/lineage-tether.js
+++ b/lib/core/lineage-tether.js
@@ -204,16 +204,24 @@ function resolveTetherAnchor(incomingCMB, getEntry) {
 }
 
 /**
- * Text-based tether evaluation for RETROACTIVE audit (§15.8 applied to stored
- * chains). Unlike the in-gate evaluation — which compares the freshly fused
- * remix vectors against the re-encoded anchor — an audit holds two stored
- * rows whose persisted vectors may predate the current encoder, so BOTH
- * sides' category texts are re-encoded with the current kernel before the drift
- * check. Returns the §15.8 record shape including the kernelId the verdict
- * was made in.
+ * THE §15.8 tether evaluation: content-only, from the two records' TEXT, in one kernel. The gate
+ * runs it on the record it stores, and the retroactive audit on stored chains, so an integrator's
+ * verdict and an auditor's are the same computation.
+ *
+ * Content-only is what makes the number reproducible. The root is content-addressed and vectors
+ * are excluded from the address and from cmb-fetch, so any holder of the root and the record has
+ * exactly two texts and its kernel. Every input here is one of those: each category's text is
+ * re-encoded, and a vector riding on either side is ignored — including on a category with no
+ * text, where it used to be taken as-is, so a value no other holder has could reach the verdict.
+ *
+ * One kernel is what makes it a comparison at all (§15.8 MUST). The semantic encoder replaces the
+ * lexical one while a node runs, and the two produce same-length vectors in unrelated spaces, so an
+ * evaluation whose encodes straddle the switch would compare noise and could sever a faithful
+ * chain. The switch is one-way, so equal kernel identities before and after the encodes mean none
+ * happened in between; when they differ, both sides are encoded again.
  *
  * @param {object} opts
- * @param {object} opts.remixCategories  - stored remix CAT7 categories (text used).
+ * @param {object} opts.remixCategories  - the remix record's CAT7 categories (text used).
  * @param {object} opts.anchorCategories - resolved/fetched anchor CAT7 categories (text used).
  * @param {object} [opts.categoryWeights]
  * @param {number} [opts.guardedThreshold=0.5]
@@ -227,24 +235,25 @@ async function evaluateLineageTetherFromText({ remixCategories, anchorCategories
       const f = categories ? categories[category] : null;
       if (!f) continue;
       const text = typeof f === 'object' ? (f.text ?? '') : String(f ?? '');
-      out[category] = { text };
-      if (text) {
-        const { h1 } = await encodeForSVAF(text);
-        out[category].vector = h1;
-      } else if (f && typeof f === 'object' && f.vector) {
-        out[category].vector = f.vector;
-      }
+      if (!text) continue; // no text, no content — nothing a holder of the record could recompute
+      const { h1 } = await encodeForSVAF(text);
+      out[category] = { text, vector: h1 };
     }
     return out;
   }
-  // With the semantic encoder ready both sides land in one kernel; on the
-  // lexical fallback encodeForSVAF is the n-gram encoder, so the property
-  // (single kernel per comparison) holds either way.
-  const [r, a] = [await reencode(remixCategories), await reencode(anchorCategories)];
-  return {
-    kernelId: kernelId(),
-    ...computeLineageTether({ remixCategories: r, anchorCategories: a, categoryWeights, guardedThreshold }),
-  };
+  // A switch happens at most once per process, so a second pass is always in one kernel; the bound
+  // only keeps a broken encoder from looping, and what it returns then is the honest "unchecked".
+  for (let attempt = 0; attempt < 3; attempt++) {
+    const kernel = kernelId();
+    const r = await reencode(remixCategories);
+    const a = await reencode(anchorCategories);
+    if (kernelId() !== kernel) continue;
+    return {
+      kernelId: kernel,
+      ...computeLineageTether({ remixCategories: r, anchorCategories: a, categoryWeights, guardedThreshold }),
+    };
+  }
+  return { kernelId: kernelId(), checked: false, tethered: true, drift: null, evaluableCategories: [] };
 }
 
 module.exports = { computeLineageTether, resolveTetherAnchor, storedRecordVerifies, evaluateLineageTetherFromText };
diff --git a/lib/core/svaf-baseline.js b/lib/core/svaf-baseline.js
index 33e62192..7dafc8ff 100644
--- a/lib/core/svaf-baseline.js
+++ b/lib/core/svaf-baseline.js
@@ -23,7 +23,7 @@
 
 const { createCMB, renderContent: renderCMB, cosineSimilarity, l2Normalize, CAT7_CATEGORIES, categoryKeyV1, encodeCategory, blockKeyV2 } = require('./cmb-encoder');
 const { encodeForSVAF, isSemanticReady, kernelId } = require('./context-encoder');
-const { computeLineageTether } = require('./lineage-tether');
+const { evaluateLineageTetherFromText } = require('./lineage-tether');
 
 /** Per-category admission verdicts — the first-class gating output (MMP §9.2). */
 const CATEGORY_VERDICT = Object.freeze({
@@ -236,6 +236,31 @@ function strippedOfVectors(categories) {
   return out;
 }
 
+/**
+ * MMP §15.8 lineage tether of the record an admission stores, against the anchor the caller
+ * resolved. The caller applies severance and signs the attestation; this only reports.
+ *
+ * Measured on the RECORD'S TEXT, never on the fused vectors. A fused vector is this receiver's
+ * attention readout over its own recent anchors (computeCategoryDrifts), so a tether taken on it
+ * measured how the remix sat in THIS node's memory — two integrators holding the same root and the
+ * same record signed different drifts, and nobody holding them could recompute either one. §15.8
+ * makes the tether content-only so that any holder of the root re-encodes its text and gets the
+ * number the integrator signed; the text of both records is all such a holder has.
+ *
+ * @returns {Promise<object|null>} null when no anchor was resolved (the tether is unverified).
+ */
+async function tetherOfRecord(recordCategories, tetherAnchor, config) {
+  if (!tetherAnchor || !tetherAnchor.categories) return null;
+  const ev = await evaluateLineageTetherFromText({
+    remixCategories: recordCategories,
+    anchorCategories: tetherAnchor.categories,
+    categoryWeights: config.categoryWeights,
+    guardedThreshold: config.guardedThreshold,
+  });
+  // §15.8 kernel identity rides in `ev.kernelId`: verdicts are comparable iff it matches.
+  return { anchorKey: tetherAnchor.key ?? null, ...ev };
+}
+
 /**
  * The per-category drift arithmetic (§9.2/§9.2.1), as a PURE function of already-encoded vectors.
  *
@@ -568,9 +593,8 @@ async function _processHeuristicSVAF(opts) {
     // "Emitters MUST NOT include embedding vectors" — and fusion was putting one back in on the
     // receiver side, so this applies the existing rule to the remix rather than inventing one.
     //
-    // Stripped HERE and not in computeCategoryDrifts, because the in-call vectors are still load
-    // bearing: computeLineageTether reads remixCategories[f].vector and silently degrades to
-    // "not checked" without it. Computation keeps its vectors; the RECORD carries none.
+    // Stripped HERE and not in computeCategoryDrifts, whose fused readout is the measurement it
+    // returns. Computation keeps its vectors; the RECORD carries none.
     // `meta` is preserved — categoryParentsCommitment signs meta.parents.
     categories: strippedOfVectors(fusedCategories),
     createdBy: localName,
@@ -587,42 +611,7 @@ async function _processHeuristicSVAF(opts) {
   const fusedContent = renderCMB(fusedCMB);
   const fusedEntry = { ...msg, key: fusedKey, content: fusedContent, source: `${localName}+${msg.source || peerName}`, cmb: fusedCMB, storedAt: now };
 
-  // MMP §15.8 lineage tether — evaluated HERE so both sides share one kernel:
-  // the remix's fused vectors are current-encoder products, while a stored
-  // anchor's vectors may predate the encoder (n-gram vs semantic occupy the
-  // same 192 dims but different spaces, so a raw comparison is meaningless).
-  // Re-encode the anchor's category texts exactly as the gate re-encodes its
-  // anchors, then run the content-only drift check. The caller resolves the
-  // anchor and applies severance; this only reports.
-  let tether = null;
-  const tetherAnchor = opts.tetherAnchor;
-  if (tetherAnchor && tetherAnchor.categories) {
-    let anchorCategories = tetherAnchor.categories;
-    if (useSemantic) {
-      anchorCategories = {};
-      for (const category of CAT7_CATEGORIES) {
-        const f = tetherAnchor.categories[category];
-        if (!f) continue;
-        anchorCategories[category] = { ...f };
-        if (f.text) {
-          const { h1 } = await encodeForSVAF(f.text);
-          anchorCategories[category].vector = h1;
-        }
-      }
-    }
-    tether = {
-      anchorKey: tetherAnchor.key ?? null,
-      // §15.8 kernel identity — the kernel this evaluation was made in;
-      // verdicts are comparable iff kernelId matches.
-      kernelId: kernelId(),
-      ...computeLineageTether({
-        remixCategories: fusedCategories,
-        anchorCategories,
-        categoryWeights: config.categoryWeights,
-        guardedThreshold: config.guardedThreshold,
-      }),
-    };
-  }
+  const tether = await tetherOfRecord(fusedCMB.categories, opts.tetherAnchor, config);
 
   return { accepted: true, decision, totalDrift, categoryVerdicts: computeCategoryVerdicts(verdictDrifts, config, nearestDrifts), fusedEntry, fusedContent, effectiveTau: tau, changeSignal: 0, tether };
 }
diff --git a/tests/lineage-tether-reproducible.test.js b/tests/lineage-tether-reproducible.test.js
new file mode 100644
index 00000000..7f1055a9
--- /dev/null
+++ b/tests/lineage-tether-reproducible.test.js
@@ -0,0 +1,172 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME to a temp sandbox before lib/config loads
+
+/**
+ * MMP §15.8 — the tether is CONTENT-ONLY, so it is REPRODUCIBLE.
+ *
+ * "No vector crosses the wire: the root is content-addressed, so any holder of the root re-encodes
+ * its text and recomputes the tether." That sentence is the reason a tether attestation can be
+ * checked at all: a node that holds the root and the record recomputes the number the integrator
+ * signed. It holds only if the number is a function of the two texts and the kernel — nothing that
+ * belongs to the integrator alone.
+ *
+ * The gate measured the remix side on its FUSED vectors, and a fused vector is the receiver's
+ * attention readout over its own recent anchors. Two nodes holding the same root and the same
+ * record signed different drifts, and neither could reproduce the other's.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const { SymNode } = require('../lib/node');
+const { NullDiscovery } = require('../lib/discovery');
+const { nodeDir } = require('../lib/config');
+const core = require('../lib/core');
+const { createCMB, isSemanticReady, evaluateLineageTetherFromText } = core;
+
+// The reject-floor calibration assumes the semantic kernel (§9.2.1: thresholds are meaningful only
+// within a pinned encoder), and a comparison across two nodes is only meaningful in one kernel.
+async function awaitSemantic(timeoutMs = 30000) {
+  const t0 = Date.now();
+  while (!isSemanticReady()) {
+    if (Date.now() - t0 > timeoutMs) throw new Error('semantic encoder did not become ready');
+    await new Promise((r) => setTimeout(r, 200));
+  }
+}
+
+async function withNode(baseName, fn) {
+  const name = `${baseName}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+  const node = new SymNode({ name, silent: true, discovery: new NullDiscovery() });
+  await node.start();
+  try {
+    return await fn(node);
+  } finally {
+    await node.stop();
+    fs.rmSync(nodeDir(name), { recursive: true, force: true });
+  }
+}
+
+function cat7(t) {
+  return {
+    focus: t, issue: t, intent: t, motivation: t, commitment: t,
+    perspective: 'peerA', mood: { text: 'neutral', valence: 0, arousal: 0 },
+  };
+}
+
+const ROOT = 'overall report on snowy mountain hiking trail conditions this weekend';
+const INCOMING = 'fresh snowfall reported on the upper mountain trail sections';
+// Two different memories of the same domain: both admit INCOMING, through different anchors.
+const MEMORY_1 = [
+  'hiking trail conditions in the mountain snow this weekend',
+  'which boots and crampons to pack for the icy mountain ascent',
+  'trailhead parking permits and the shuttle bus timetable',
+  'weather forecast apps for alpine ridge crossings',
+  'campsite reservations near the mountain trailhead',
+];
+const MEMORY_2 = [
+  'avalanche risk bulletin for the backcountry slopes above the trail',
+  'snowshoe routes recommended for beginners on the mountain this winter',
+  'trail map showing the switchbacks up to the alpine lake',
+  'mountain hut booking for the overnight hike in the snow',
+  'icy patches reported on the lower forest section of the trail',
+];
+
+function remixFrame(text, rootKey) {
+  const cmb = createCMB({ categories: cat7(text), createdBy: 'peerA', lineage: { parents: [rootKey], method: 'SVAF-v2' } });
+  return { type: 'cmb', timestamp: Date.now(), content: text, cmb };
+}
+
+/** Deliver a frame to a node's gate and return the record it stored for it. */
+async function admit(node, frame) {
+  const accepted = [];
+  const onAccepted = (e) => accepted.push(e);
+  node.on('cmb-accepted', onAccepted);
+  const now = Date.now();
+  try {
+    await node._frameHandler._processHeuristicSVAF(frame, 'peerA', 'peerA', now, now, 0);
+  } finally {
+    node.off('cmb-accepted', onAccepted);
+  }
+  return accepted.find((e) => e.key === frame.cmb.metadata.key) || null;
+}
+
+describe('§15.8 tether is reproducible by any holder of the root and the record (B-L5)', () => {
+  it('two nodes with different local memories sign the same tether for the same record', async () => {
+    await awaitSemantic();
+    const seen = [];
+    for (const [label, memory] of [['n1', MEMORY_1], ['n2', MEMORY_2]]) {
+      await withNode(`tether-repro-${label}`, async (node) => {
+        const root = node.remember(cat7(ROOT));
+        for (const t of memory) node.remember(cat7(t));
+        const stored = await admit(node, remixFrame(INCOMING, root.key));
+        assert.ok(stored, `${label}: the remix admits`);
+        assert.ok(stored.cmb.tether, `${label}: the integrator signed a tether`);
+        assert.strictEqual(stored.cmb.tether.anchor, root.key, `${label}: anchored on the shared root`);
+        seen.push({ label, att: stored.cmb.tether, record: stored.cmb, root: root.cmb, node });
+      });
+    }
+    const [a, b] = seen;
+    assert.strictEqual(a.att.kernelId, b.att.kernelId, 'precondition: one kernel, so the drifts are comparable');
+    assert.strictEqual(a.record.metadata.key, b.record.metadata.key, 'precondition: the same record on both nodes');
+    // The attestation signs the drift at six fractional digits, so that is the value a holder reproduces.
+    assert.strictEqual(a.att.drift.toFixed(6), b.att.drift.toFixed(6), 'both integrators measured the same drift');
+
+    // And a third party holding only the root and the record recomputes it from text alone.
+    const recomputed = await evaluateLineageTetherFromText({
+      remixCategories: a.record.categories, anchorCategories: a.root.categories,
+      categoryWeights: a.node._svafCategoryWeights, guardedThreshold: a.node._svafGuardedThreshold,
+    });
+    assert.strictEqual(recomputed.kernelId, a.att.kernelId);
+    assert.strictEqual(recomputed.drift.toFixed(6), a.att.drift.toFixed(6), 'the signed drift is recomputable from the two texts');
+    assert.strictEqual(recomputed.tethered ? 'tethered' : 'severed', a.att.verdict);
+  });
+
+  it('a vector no text backs is not content, and never enters the tether', async () => {
+    // A vector is outside the content address and is not served by cmb-fetch, so a holder who
+    // fetched the root has none: a tether that used one could not be recomputed by anyone else.
+    const v = Array.from({ length: 8 }, (_, i) => (i === 0 ? 1 : 0));
+    const r = await evaluateLineageTetherFromText({
+      remixCategories: { focus: { text: '', vector: v } },
+      anchorCategories: { focus: { text: '', vector: v } },
+      guardedThreshold: 0.5,
+    });
+    assert.strictEqual(r.checked, false, 'nothing content-addressed to compare');
+    assert.deepStrictEqual(r.evaluableCategories, []);
+  });
+
+  it('both sides are encoded in ONE kernel even when the encoder switches mid-evaluation', async () => {
+    // The semantic encoder loads asynchronously and replaces the lexical one while the node is
+    // running, so the two sides of a single evaluation could otherwise straddle the switch: the
+    // remix encoded lexically, the anchor semantically, in spaces that share a dimension and
+    // nothing else. §15.8: both sides MUST be encoded within a single kernel.
+    const ctxPath = require.resolve('../lib/core/context-encoder');
+    const ltPath = require.resolve('../lib/core/lineage-tether');
+    const realCtx = require.cache[ctxPath];
+    const realLt = require.cache[ltPath];
+    let kernel = 'kernel-before';
+    let encodes = 0;
+    const fakeCtx = {
+      ...realCtx.exports,
+      kernelId: () => kernel,
+      encodeForSVAF: async () => {
+        const k = kernel;
+        if (++encodes === 1) kernel = 'kernel-after'; // the switch lands right after the first encode
+        return { h1: k === 'kernel-before' ? [1, 0] : [0, 1], h2: [] };
+      },
+    };
+    try {
+      require.cache[ctxPath] = { id: ctxPath, filename: ctxPath, loaded: true, exports: fakeCtx };
+      delete require.cache[ltPath];
+      const lt = require(ltPath);
+      const same = { focus: { text: 'the same words on both sides' } };
+      const r = await lt.evaluateLineageTetherFromText({ remixCategories: same, anchorCategories: same, guardedThreshold: 0.5 });
+      assert.strictEqual(r.kernelId, 'kernel-after', 'the verdict names the kernel both sides were encoded in');
+      assert.strictEqual(r.drift, 0, 'identical text in one kernel has no drift');
+      assert.strictEqual(r.tethered, true);
+    } finally {
+      require.cache[ctxPath] = realCtx;
+      require.cache[ltPath] = realLt;
+    }
+  });
+});

From bedc823ff17bd952de2ec9c021fc0f87a31b2ff9 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 18:39:39 +0100
Subject: [PATCH 015/148] svaf: cold-start admissions carry a lineage tether
 (B-L6)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The cold-start exit of the heuristic gate stored a remix and returned
without a tether, so the frame handler had nothing to sever on: a
remix drifted past its root's reject floor kept its lineage whenever
the receiver's anchor window was empty or uncovered. An empty window
says nothing about the chain; §15.8 compares the record with its
lineage root, not with memory. The cold-start exit now runs the same
tether computation as the warm path before returning.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 lib/core/svaf-baseline.js                 |  7 +++-
 tests/lineage-tether-reproducible.test.js | 49 ++++++++++++++++++++++-
 2 files changed, 54 insertions(+), 2 deletions(-)

diff --git a/lib/core/svaf-baseline.js b/lib/core/svaf-baseline.js
index 7dafc8ff..e16cf186 100644
--- a/lib/core/svaf-baseline.js
+++ b/lib/core/svaf-baseline.js
@@ -548,9 +548,14 @@ async function _processHeuristicSVAF(opts) {
     const csContent = renderCMB(csCMB);
     const csEntry = { ...msg, key: csKey, content: csContent, source: `${localName}+${msg.source || peerName}`, cmb: csCMB, storedAt: now };
     const csDecision = (!lensUncovered && csTotalDrift <= config.stableThreshold) ? 'aligned' : 'guarded';
+    // §15.8 applies to every remix this node integrates, and an empty anchor window says nothing
+    // about the chain: the tether compares the record with its lineage root, not with memory. This
+    // exit returned without one, so the caller had nothing to sever on and a remix drifted past its
+    // root's floor kept the lineage exactly where the receiver's memory is thinnest.
+    const csTether = await tetherOfRecord(csCMB.categories, opts.tetherAnchor, config);
     // Cold-start: no category was evaluable, so every per-category verdict is `silent`
     // (admitted on temporal grounds to bootstrap memory, gated on no category).
-    return { accepted: true, totalDrift: csTotalDrift, decision: csDecision, maxCategoryDrift: 0, categoryVerdicts: computeCategoryVerdicts(verdictDrifts, config), fusedEntry: csEntry, fusedContent: csContent, effectiveTau: tau, changeSignal: 0, coldStartCause };
+    return { accepted: true, totalDrift: csTotalDrift, decision: csDecision, maxCategoryDrift: 0, categoryVerdicts: computeCategoryVerdicts(verdictDrifts, config), fusedEntry: csEntry, fusedContent: csContent, effectiveTau: tau, changeSignal: 0, coldStartCause, tether: csTether };
   }
 
   let weightedDriftSum = 0, weightSum = 0;
diff --git a/tests/lineage-tether-reproducible.test.js b/tests/lineage-tether-reproducible.test.js
index 7f1055a9..a4d8e2c5 100644
--- a/tests/lineage-tether-reproducible.test.js
+++ b/tests/lineage-tether-reproducible.test.js
@@ -14,6 +14,10 @@ require('./_isolate-home'); // redirect $HOME to a temp sandbox before lib/confi
  * The gate measured the remix side on its FUSED vectors, and a fused vector is the receiver's
  * attention readout over its own recent anchors. Two nodes holding the same root and the same
  * record signed different drifts, and neither could reproduce the other's.
+ *
+ * The cold-start exit returned without a tether at all, so a node with nothing in its anchor window
+ * stored a remix with its lineage unexamined — a laundered chain passed exactly where memory is
+ * thinnest.
  */
 
 const { describe, it } = require('node:test');
@@ -23,7 +27,7 @@ const { SymNode } = require('../lib/node');
 const { NullDiscovery } = require('../lib/discovery');
 const { nodeDir } = require('../lib/config');
 const core = require('../lib/core');
-const { createCMB, isSemanticReady, evaluateLineageTetherFromText } = core;
+const { createCMB, isSemanticReady, evaluateLineageTetherFromText, processHeuristicSVAF } = core;
 
 // The reject-floor calibration assumes the semantic kernel (§9.2.1: thresholds are meaningful only
 // within a pinned encoder), and a comparison across two nodes is only meaningful in one kernel.
@@ -56,6 +60,7 @@ function cat7(t) {
 
 const ROOT = 'overall report on snowy mountain hiking trail conditions this weekend';
 const INCOMING = 'fresh snowfall reported on the upper mountain trail sections';
+const LAUNDERED_ROOT = 'quarterly financial audit of the accounting ledger and tax filings';
 // Two different memories of the same domain: both admit INCOMING, through different anchors.
 const MEMORY_1 = [
   'hiking trail conditions in the mountain snow this weekend',
@@ -72,6 +77,8 @@ const MEMORY_2 = [
   'icy patches reported on the lower forest section of the trail',
 ];
 
+const POLICY = { stableThreshold: 0.25, guardedThreshold: 0.5, temporalLambda: 0.3, freshnessSeconds: 1800 };
+
 function remixFrame(text, rootKey) {
   const cmb = createCMB({ categories: cat7(text), createdBy: 'peerA', lineage: { parents: [rootKey], method: 'SVAF-v2' } });
   return { type: 'cmb', timestamp: Date.now(), content: text, cmb };
@@ -170,3 +177,43 @@ describe('§15.8 tether is reproducible by any holder of the root and the record
     }
   });
 });
+
+describe('§15.8 cold-start admissions carry a tether like warm ones (B-L6)', () => {
+  it('an empty-memory admission of a remix is tether-checked against its anchor', async () => {
+    await awaitSemantic();
+    const root = createCMB({ categories: cat7(LAUNDERED_ROOT), createdBy: 'author' });
+    const frame = remixFrame(INCOMING, root.metadata.key);
+    const r = await processHeuristicSVAF({
+      msg: frame, peerName: 'peerA', localName: 'receiver', originTs: Date.now(), now: Date.now(), ageSeconds: 0,
+      recentCMBs: [], config: POLICY,
+      tetherAnchor: { key: root.metadata.key, categories: root.categories },
+    });
+    assert.strictEqual(r.accepted, true, 'cold start admits to bootstrap memory');
+    assert.strictEqual(r.coldStartCause, 'empty-memory', 'precondition: this is the cold-start exit');
+    assert.ok(r.tether, 'the cold-start admission carries a tether');
+    assert.strictEqual(r.tether.anchorKey, root.metadata.key);
+    assert.strictEqual(r.tether.checked, true);
+    assert.strictEqual(r.tether.tethered, false, 'a remix drifted past the floor is caught at cold start too');
+
+    const recomputed = await evaluateLineageTetherFromText({
+      remixCategories: r.fusedEntry.cmb.categories, anchorCategories: root.categories, guardedThreshold: POLICY.guardedThreshold,
+    });
+    assert.strictEqual(r.tether.drift.toFixed(6), recomputed.drift.toFixed(6), 'the same computation as the warm path');
+    assert.strictEqual(r.tether.kernelId, recomputed.kernelId);
+  });
+
+  it('a fresh node signs a tether on its first (cold-start) admission, as a warm node does', async () => {
+    await awaitSemantic();
+    for (const warm of [false, true]) {
+      await withNode(`tether-cold-${warm ? 'warm' : 'cold'}`, async (node) => {
+        if (warm) for (const t of MEMORY_1) node.remember(cat7(t));
+        const peerRoot = createCMB({ categories: cat7(ROOT), createdBy: 'peerA' });
+        const stored = await admit(node, { type: 'cmb', timestamp: Date.now(), content: ROOT, cmb: peerRoot });
+        assert.ok(stored, `${warm ? 'warm' : 'cold'}: the root admits`);
+        assert.strictEqual(stored.cmb.tether?.anchor, peerRoot.metadata.key, `${warm ? 'warm' : 'cold'}: a root is its own anchor`);
+        assert.strictEqual(stored.cmb.tether.verdict, 'tethered');
+        assert.strictEqual(stored.cmb.provenance?.tether?.severed, false);
+      });
+    }
+  });
+});

From 40b1b0dd1222fa38fab5de437b60ade3fb432ef3 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 18:41:13 +0100
Subject: [PATCH 016/148] tether audit: the fetch fallback never returns a
 refused local record

auditLineageTethers falls back to fetchCMB when the verified walk finds
no anchor. fetchCMB answers from the local store before asking any
peer, so for a parent held locally but unverifiable it handed back the
very record the walk had just refused, and the audit attested a tether
to it (the B-L4 defect, reached through the opt-in fetch path). Keys
the store already holds are skipped there; only records this node does
not hold are fetched, and those self-verify against their address.

One guard line in lib/node.js, kept in its own commit.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 lib/node.js                        |  3 +++
 tests/lineage-tether-audit.test.js | 29 +++++++++++++++++++++++++++++
 2 files changed, 32 insertions(+)

diff --git a/lib/node.js b/lib/node.js
index 607a20e3..71b16627 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -712,6 +712,9 @@ class SymNode extends EventEmitter {
       if (!anchorCategories && opts.fetch === true) {
         const anc = recordLineage(cmb)?.ancestors;
         for (const k of (anc?.length ? anc : parents)) {
+          // A key this store holds was already judged by the verified walk above, and fetchCMB
+          // answers from the store first — it would hand back the record that walk refused.
+          if (this._store.get(k)) continue;
           const hit = await this.fetchCMB(k, { timeoutMs: opts.timeoutMs ?? 3000 });
           if (hit?.cmb?.categories) { anchorCategories = hit.cmb.categories; anchorKey = k; report.fetched++; break; }
         }
diff --git a/tests/lineage-tether-audit.test.js b/tests/lineage-tether-audit.test.js
index bf7cfe0c..03f58301 100644
--- a/tests/lineage-tether-audit.test.js
+++ b/tests/lineage-tether-audit.test.js
@@ -99,6 +99,35 @@ describe('MMP §15.8 retroactive tether audit', () => {
     }
   });
 
+  it('fetch: a parent held locally but unverified does not come back as the anchor', async () => {
+    // fetchCMB answers from the local store before asking any peer, so the fetch fallback handed
+    // the audit the very record the verified walk had just refused, and the audit attested a tether
+    // to it. §15.8 anchors on records reached by VERIFYING parents; a local copy is not a second
+    // opinion about its own author.
+    const name = `audit-unv-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+    const node = new SymNode({ name, silent: true, discovery: new NullDiscovery() });
+    await node.start();
+    try {
+      await awaitSemantic();
+      const parent = createCMB({ categories: cat7(TOPIC_B_ROOT), createdBy: 'unverifiable-peer' });
+      // A peer admission with no verified signature verdict, stored the way receiveFromPeer stores one.
+      node._store.receiveFromPeer('unverifiable-peer', {
+        key: parent.metadata.key, content: TOPIC_B_ROOT, source: 'unverifiable-peer', cmb: parent, storedAt: Date.now(),
+      });
+      const remix = storeLegacyRemix(node, parent.metadata.key, TOPIC_B);
+      const r = await node.auditLineageTethers({ fetch: true, timeoutMs: 50 });
+      assert.strictEqual(r.audited, 1);
+      assert.strictEqual(r.fetched, 0, 'the local unverified copy is not a fetch');
+      assert.strictEqual(r.unchecked, 1, 'the tether is unverified');
+      const e = node._store.get(remix.key);
+      assert.strictEqual(e.cmb.tether, undefined, 'no tether attestation names the unverified record');
+      assert.strictEqual(e.cmb.provenance?.tether, undefined);
+    } finally {
+      await node.stop();
+      fs.rmSync(nodeDir(name), { recursive: true, force: true });
+    }
+  });
+
   it('unresolvable roots are unchecked, never severed', async () => {
     const name = `audit-un-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
     const node = new SymNode({ name, silent: true, discovery: new NullDiscovery() });

From cb6dcbe5715b312a07ed35864e7edbeeb326f75a Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 18:43:08 +0100
Subject: [PATCH 017/148] IPC: one endpoint resolution for daemon and clients;
 a path is a named pipe on Windows

On Windows the daemon listened on SYM_SOCKET as given. A filesystem path
there cannot be a Unix socket (listen EACCES on ...\d.sock), so the daemon
exited and daemon-relay-only failed. And the clients did not resolve the
endpoint the way the daemon did:

- SymDaemonClient defaulted to /tmp/sym.sock, an address no daemon has
  listened on since the socket moved to <state root>/daemon.sock, on any OS
- bin/sym.js read SYM_SOCKET itself before getSocketPath, bypassing any
  mapping the daemon applied

lib/platform now has ipcEndpoint(address, platform): unchanged on POSIX;
on Windows a pipe name is used as given and a filesystem path becomes
\\.\pipe\sym-<basename>-<sha256 of the resolved, lower-cased path>, so two
spellings of one path reach one pipe and two paths never share one.
getSocketPath resolves SYM_SOCKET through it, and the daemon, the CLI and
SymDaemonClient all use getSocketPath / ipcEndpoint. The unrooted Windows
default stays \\.\pipe\sym-daemon; a rooted deployment (SYM_STATE_DIR) gets
a pipe of its own root, as its socket is under its root elsewhere.

Tests: the mapping and resolution for win32 and POSIX as pure functions
(fail on the previous code, which had none); SymDaemonClient's default and
an explicit path resolve to the daemon's endpoint (fails before on macOS
too: /tmp/sym.sock); daemon-relay-only now asserts relay-auth on its own,
that the relay leg starts before the IPC server, the endpoint the daemon
listens on, and that `sym status` reaches it through that endpoint.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 bin/sym.js                      |   4 +-
 lib/ipc-client.js               |  21 ++++---
 lib/platform.js                 |  63 +++++++++++++++++--
 tests/daemon-relay-only.test.js |  49 ++++++++++++---
 tests/ipc-endpoint.test.js      | 104 ++++++++++++++++++++++++++++++++
 5 files changed, 218 insertions(+), 23 deletions(-)
 create mode 100644 tests/ipc-endpoint.test.js

diff --git a/bin/sym.js b/bin/sym.js
index 6c4ceaff..fa0a2450 100755
--- a/bin/sym.js
+++ b/bin/sym.js
@@ -51,7 +51,9 @@ const PID_FILE = path.join(os.homedir(), '.sym', 'daemon.pid');
 function sleepMs(ms) {
   try { Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms); } catch {}
 }
-const SOCKET_PATH = process.env.SYM_SOCKET || getSocketPath();
+// getSocketPath already honours SYM_SOCKET — through the same mapping the daemon uses (a
+// named pipe on Windows). Reading the variable here as well would dial the raw path instead.
+const SOCKET_PATH = getSocketPath();
 const LOG_DIR = getLogDir('sym-daemon');
 const VERSION = require('../package.json').version;
 
diff --git a/lib/ipc-client.js b/lib/ipc-client.js
index a512edb9..be4ae655 100644
--- a/lib/ipc-client.js
+++ b/lib/ipc-client.js
@@ -3,7 +3,8 @@
 /**
  * IPC client for connecting to sym-daemon as a virtual node.
  *
- * Communicates via Unix socket with newline-delimited JSON.
+ * Communicates over the daemon's IPC endpoint (a Unix domain socket; a named pipe on
+ * Windows) with newline-delimited JSON.
  * Provides the same API surface as SymNode so consumers
  * (MCP server, etc.) can use either transparently.
  *
@@ -14,24 +15,28 @@
 
 const net = require('net');
 const { EventEmitter } = require('events');
-
-const DEFAULT_SOCKET = '/tmp/sym.sock';
+const { getSocketPath, ipcEndpoint } = require('./platform');
 
 /**
  * IPC client that connects to sym-daemon as a virtual node.
- * Provides a SymNode-compatible API over Unix socket IPC.
+ * Provides a SymNode-compatible API over the daemon's IPC endpoint.
  */
 class SymDaemonClient extends EventEmitter {
 
   /**
    * @param {object} [opts]
-   * @param {string} [opts.socketPath='/tmp/sym.sock'] — daemon Unix socket path
+   * @param {string} [opts.socketPath] — the daemon's socket path; defaults to the endpoint the
+   *   daemon itself listens on (getSocketPath). It is resolved the way the daemon resolves
+   *   SYM_SOCKET, so the same path reaches the same named pipe on Windows.
    * @param {string} [opts.name='virtual-node'] — virtual node name
    * @param {string} [opts.cognitiveProfile] — cognitive profile for encoding
    */
   constructor(opts = {}) {
     super();
-    this._socketPath = opts.socketPath || DEFAULT_SOCKET;
+    // The default was once a fixed /tmp/sym.sock, left behind when the daemon moved to
+    // <state root>/daemon.sock: a client built with no socketPath dialled an address no daemon
+    // listened on. Both sides now resolve the endpoint through lib/platform.
+    this._socketPath = opts.socketPath ? ipcEndpoint(opts.socketPath) : getSocketPath();
     this._name = opts.name || 'virtual-node';
     this._cognitiveProfile = opts.cognitiveProfile || null;
     this._socket = null;
@@ -267,7 +272,7 @@ class SymDaemonClient extends EventEmitter {
  * Install daemon: node bin/sym-daemon.js --install
  *
  * @param {object} [opts]
- * @param {string} [opts.socketPath] — daemon Unix socket path
+ * @param {string} [opts.socketPath] — daemon socket path (default: the daemon's own endpoint)
  * @param {string} [opts.name='claude-code'] — virtual node name
  * @param {string} [opts.cognitiveProfile] — cognitive profile
  * @returns {Promise<SymDaemonClient>} connected client
@@ -275,7 +280,7 @@ class SymDaemonClient extends EventEmitter {
  */
 async function connectToDaemon(opts = {}) {
   const client = new SymDaemonClient({
-    socketPath: opts.socketPath || DEFAULT_SOCKET,
+    socketPath: opts.socketPath,
     name: opts.name || 'claude-code',
     cognitiveProfile: opts.cognitiveProfile,
   });
diff --git a/lib/platform.js b/lib/platform.js
index 737712a2..76202dbf 100644
--- a/lib/platform.js
+++ b/lib/platform.js
@@ -14,6 +14,7 @@
 const os = require('os');
 const path = require('path');
 const fs = require('fs');
+const crypto = require('crypto');
 const { execSync, execFileSync } = require('child_process');
 
 // ── Platform Detection ──────────────────────────────────────
@@ -184,16 +185,65 @@ function getSymDir() {
   return require('./core/state-root').SYM_STATE_DIR;
 }
 
+/** The Windows named-pipe namespace: `\\.\pipe\<name>` or `\\?\pipe\<name>`, either slash. */
+function isWindowsPipe(address) {
+  return /^[\\/]{2}[.?][\\/]pipe[\\/]./i.test(String(address));
+}
+
+/**
+ * The endpoint `net.listen` / `net.createConnection` must use for a configured IPC address.
+ *
+ * On POSIX the address is a Unix domain socket path and is used as given. Windows has no domain
+ * sockets at a filesystem path: listening on `C:\...\d.sock` fails (EACCES), and IPC must go
+ * through a named pipe. So on Windows a filesystem path is mapped to a pipe name derived from
+ * it, and a name already in the pipe namespace is used as given.
+ *
+ * The daemon (server) and every client — the CLI, SymDaemonClient — resolve the address
+ * through this one function, so they agree on the pipe for the same SYM_SOCKET; a client that
+ * dialled the raw path while the daemon listened on the pipe would find nothing there. The
+ * name is a digest of the absolute path, lower-cased because Windows paths are
+ * case-insensitive, so two spellings of one path reach one pipe and two paths never share one.
+ *
+ * @param {string} address — a socket path, or (on Windows) a pipe name
+ * @param {string} [platform=process.platform]
+ * @returns {string}
+ */
+function ipcEndpoint(address, platform = process.platform) {
+  const a = String(address);
+  if (platform !== 'win32' || isWindowsPipe(a)) return a;
+  const abs = path.win32.resolve(a).toLowerCase();
+  const base = path.win32.basename(abs).replace(/[^a-z0-9._-]/g, '_').slice(0, 40);
+  const digest = crypto.createHash('sha256').update(abs, 'utf8').digest('hex').slice(0, 16);
+  return `\\\\.\\pipe\\sym-${base}-${digest}`;
+}
+
+/**
+ * Resolve the daemon's IPC endpoint from its inputs (see getSocketPath).
+ * @param {object} o
+ * @param {string} [o.configured] — SYM_SOCKET, when set
+ * @param {string} o.symDir — the state root
+ * @param {boolean} o.rooted — whether SYM_STATE_DIR re-rooted this process
+ * @param {string} [o.platform=process.platform]
+ * @returns {string}
+ */
+function resolveSocketPath({ configured, symDir, rooted, platform = process.platform }) {
+  if (configured) return ipcEndpoint(configured, platform);
+  // The long-standing Windows default, kept so an unrooted CLI and daemon of any version meet.
+  if (platform === 'win32' && !rooted) return '\\\\.\\pipe\\sym-daemon';
+  // A rooted deployment keeps its endpoint inside its root on every platform; on Windows that
+  // is a pipe named for the root, not the one host-global pipe every tenant would share.
+  return ipcEndpoint(path.join(symDir, 'daemon.sock'), platform);
+}
+
 /**
- * Get the IPC socket path.
- * Windows uses named pipes; Unix uses domain sockets.
+ * Get the IPC endpoint the daemon listens on and its clients dial: SYM_SOCKET if set, else
+ * `<state root>/daemon.sock`, mapped to a named pipe on Windows (see ipcEndpoint).
  *
  * @returns {string}
  */
 function getSocketPath() {
-  return process.env.SYM_SOCKET || (isWin
-    ? '\\\\.\\pipe\\sym-daemon'
-    : path.join(getSymDir(), 'daemon.sock'));
+  const { SYM_STATE_DIR, IS_ROOTED } = require('./core/state-root');
+  return resolveSocketPath({ configured: process.env.SYM_SOCKET, symDir: SYM_STATE_DIR, rooted: IS_ROOTED });
 }
 
 /**
@@ -332,6 +382,9 @@ module.exports = {
   // Path utilities
   getSymDir,
   getSocketPath,
+  resolveSocketPath,
+  ipcEndpoint,
+  isWindowsPipe,
   getLogDir,
   projectPath,
   safeReadFile,
diff --git a/tests/daemon-relay-only.test.js b/tests/daemon-relay-only.test.js
index b7c6ca04..54f27f3e 100644
--- a/tests/daemon-relay-only.test.js
+++ b/tests/daemon-relay-only.test.js
@@ -3,36 +3,67 @@
  * RELAY-ONLY. A host with no usable multicast (Termux on Android, a locked-down container)
  * joins over the relay alone: SYM_RELAY_ONLY=1 makes the daemon skip LAN discovery entirely and
  * still authenticate to the relay. Measured here against a fake relay, with the daemon's own
- * process, its own HOME and its own IPC socket so it never touches the real one.
+ * process, its own HOME and its own IPC endpoint so it never touches the real one.
+ *
+ * The relay leg and the IPC leg are checked separately. The relay connection is started by
+ * node.start(), before the IPC server exists, and relay-auth is asserted on its own. The IPC
+ * endpoint is asserted after it, by name and by the CLI actually reaching the daemon through
+ * it. On Windows the endpoint for SYM_SOCKET=<dir>\d.sock is a named pipe (lib/platform
+ * ipcEndpoint): listening on the file path itself failed with EACCES, the daemon exited, and
+ * the failure surfaced as a missing relay-auth. An IPC failure is now reported as an IPC failure.
  */
 const { test } = require('node:test');
 const assert = require('node:assert/strict');
-const { spawn } = require('node:child_process');
+const { spawn, execFile } = require('node:child_process');
 const { WebSocketServer } = require('ws');
 const fs = require('fs');
 const os = require('os');
 const path = require('path');
+const { ipcEndpoint } = require('../lib/platform');
 
-test('SYM_RELAY_ONLY=1: LAN discovery off, relay-auth still sent', async () => {
+const BIN = path.join(__dirname, '..', 'bin');
+
+test('SYM_RELAY_ONLY=1: LAN discovery off, relay-auth still sent, CLI reaches the daemon over its IPC endpoint', async () => {
   const home = fs.mkdtempSync(path.join(os.tmpdir(), 'sym-relay-only-'));
   const wss = new WebSocketServer({ port: 0 });
   const auths = [];
   wss.on('connection', (ws) => ws.on('message', (m) => { const f = JSON.parse(String(m)); if (f.type === 'relay-auth') auths.push(f); }));
   const relayUrl = `ws://127.0.0.1:${wss.address().port}`;
-  const daemon = spawn(process.execPath, [path.join(__dirname, '..', 'bin', 'sym-daemon.js')], {
-    env: { ...process.env, HOME: home, USERPROFILE: home, SYM_SOCKET: path.join(home, 'd.sock'), SYM_NODE_NAME: 'relay-only-test',
-      SYM_ROOM: 'relay-only-room', SYM_RELAY_ONLY: '1', SYM_RELAY_URL: relayUrl, SYM_RELAY_TOKEN: 'x'.repeat(32) },
-    stdio: ['ignore', 'pipe', 'pipe'],
-  });
+  const socket = path.join(home, 'd.sock');
+  const endpoint = ipcEndpoint(socket); // what the daemon and every client resolve SYM_SOCKET to
+  const env = { ...process.env, HOME: home, USERPROFILE: home, SYM_SOCKET: socket, SYM_NODE_NAME: 'relay-only-test',
+    SYM_ROOM: 'relay-only-room', SYM_RELAY_ONLY: '1', SYM_RELAY_URL: relayUrl, SYM_RELAY_TOKEN: 'x'.repeat(32) };
+  const daemon = spawn(process.execPath, [path.join(BIN, 'sym-daemon.js')], { env, stdio: ['ignore', 'pipe', 'pipe'] });
   let out = '';
   daemon.stdout.on('data', (b) => { out += b; });
   daemon.stderr.on('data', (b) => { out += b; });
+  const listening = () => out.includes(`IPC server listening: ${endpoint}`);
   try {
-    for (let i = 0; i < 100 && !(auths.length && /relay-only: LAN discovery off/.test(out)); i++) await new Promise((r) => setTimeout(r, 100));
+    for (let i = 0; i < 100 && daemon.exitCode === null && !(auths.length && listening()); i++) {
+      await new Promise((r) => setTimeout(r, 100));
+    }
+    assert.doesNotMatch(out, /IPC server error/, `the daemon could not open its IPC endpoint ${endpoint}:\n${out.slice(-800)}`);
+
+    // The relay leg, on its own.
     assert.match(out, /relay-only: LAN discovery off \(SYM_RELAY_ONLY\); joining ws:/, out.slice(-800));
     assert.equal(auths.length >= 1, true, `relay-auth expected; log:\n${out.slice(-800)}`);
     assert.equal(auths[0].name, 'relay-only-test');
     assert.equal(typeof auths[0].engine, 'string');
+    assert.ok(out.indexOf('SYM node started') < out.indexOf('IPC server listening'),
+      'the relay connection is started before the IPC server exists, so it is not gated on it');
+
+    // The IPC leg: the daemon listens where a client resolves the same SYM_SOCKET, and the CLI
+    // gets through. (`sym start` records the daemon pid; on Windows the CLI checks that pid
+    // rather than a socket file, so record it here the way `sym start` would.)
+    assert.ok(listening(), `IPC server listening on ${endpoint} expected; log:\n${out.slice(-800)}`);
+    fs.writeFileSync(path.join(home, '.sym', 'daemon.pid'), String(daemon.pid));
+    const status = await new Promise((resolve, reject) => {
+      execFile(process.execPath, [path.join(BIN, 'sym.js'), 'status', '--json'], { env, timeout: 15000 }, (err, stdout, stderr) => {
+        if (err) reject(new Error(`sym status failed: ${err.message}\n${stderr}\ndaemon log:\n${out.slice(-800)}`));
+        else resolve(stdout);
+      });
+    });
+    assert.equal(JSON.parse(status).status.name, 'relay-only-test', 'the CLI reached this daemon');
     assert.equal(daemon.exitCode, null, 'the daemon is still running');
   } finally {
     daemon.kill('SIGTERM');
diff --git a/tests/ipc-endpoint.test.js b/tests/ipc-endpoint.test.js
new file mode 100644
index 00000000..d39b1158
--- /dev/null
+++ b/tests/ipc-endpoint.test.js
@@ -0,0 +1,104 @@
+'use strict';
+
+require('./_isolate-home'); // sandbox HOME/USERPROFILE before anything reads os.homedir()
+
+/**
+ * The daemon's IPC endpoint, as the daemon and its clients resolve it.
+ *
+ * Windows has no Unix domain sockets at a filesystem path: a daemon told SYM_SOCKET=C:\...\d.sock
+ * failed to listen (EACCES) and exited. On Windows a path must become a named pipe, and the
+ * server and every client must turn the same path into the same pipe, or the CLI dials an
+ * address nobody listens on. The mapping is a pure function of the path, so its Windows
+ * behaviour is checked here on any platform; only the listen itself needs Windows.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert/strict');
+const path = require('node:path');
+const { execFileSync } = require('node:child_process');
+const { ipcEndpoint, isWindowsPipe, resolveSocketPath, getSocketPath } = require('../lib/platform');
+
+const PIPE = /^\\\\\.\\pipe\\sym-[a-z0-9._-]+-[0-9a-f]{16}$/;
+
+describe('ipcEndpoint', () => {
+  it('on POSIX a socket path is used as given', () => {
+    for (const platform of ['darwin', 'linux']) {
+      assert.equal(ipcEndpoint('/tmp/x/d.sock', platform), '/tmp/x/d.sock');
+    }
+  });
+
+  it('on Windows a filesystem path becomes a named pipe', () => {
+    const pipe = ipcEndpoint('C:\\Users\\agent\\AppData\\Local\\Temp\\sym-relay-only-1\\d.sock', 'win32');
+    assert.match(pipe, PIPE);
+    assert.ok(isWindowsPipe(pipe));
+  });
+
+  it('the mapping is stable, and two spellings of one path reach one pipe', () => {
+    const a = ipcEndpoint('C:\\Users\\Agent\\d.sock', 'win32');
+    assert.equal(ipcEndpoint('C:\\Users\\Agent\\d.sock', 'win32'), a, 'same input, same pipe');
+    assert.equal(ipcEndpoint('c:/users/agent/D.SOCK', 'win32'), a, 'case and slash direction do not matter on Windows');
+    assert.equal(ipcEndpoint('C:\\Users\\Agent\\sub\\..\\d.sock', 'win32'), a, 'the path is resolved first');
+  });
+
+  it('two different paths never share a pipe', () => {
+    assert.notEqual(ipcEndpoint('C:\\a\\d.sock', 'win32'), ipcEndpoint('C:\\b\\d.sock', 'win32'));
+  });
+
+  it('a name already in the pipe namespace is used as given', () => {
+    for (const p of ['\\\\.\\pipe\\sym-daemon', '\\\\?\\pipe\\custom', '//./pipe/fwd']) {
+      assert.ok(isWindowsPipe(p), p);
+      assert.equal(ipcEndpoint(p, 'win32'), p);
+    }
+    assert.ok(!isWindowsPipe('C:\\pipe\\not-a-pipe'));
+    assert.ok(!isWindowsPipe('\\\\.\\pipe\\'), 'the namespace alone names no pipe');
+  });
+});
+
+describe('resolveSocketPath', () => {
+  it('SYM_SOCKET goes through the mapping on every platform', () => {
+    assert.equal(resolveSocketPath({ configured: '/s/d.sock', symDir: '/r', rooted: false, platform: 'linux' }), '/s/d.sock');
+    assert.equal(resolveSocketPath({ configured: 'C:\\s\\d.sock', symDir: 'C:\\r', rooted: false, platform: 'win32' }),
+      ipcEndpoint('C:\\s\\d.sock', 'win32'));
+  });
+
+  it('unset, POSIX uses <state root>/daemon.sock', () => {
+    assert.equal(resolveSocketPath({ symDir: '/home/a/.sym', rooted: false, platform: 'darwin' }), '/home/a/.sym/daemon.sock');
+  });
+
+  it('unset and unrooted, Windows keeps its long-standing pipe', () => {
+    assert.equal(resolveSocketPath({ symDir: 'C:\\Users\\a\\.sym', rooted: false, platform: 'win32' }), '\\\\.\\pipe\\sym-daemon');
+  });
+
+  it('unset and rooted, Windows gets a pipe of its own root, not the host-global one', () => {
+    const a = resolveSocketPath({ symDir: 'D:\\tenant-a', rooted: true, platform: 'win32' });
+    const b = resolveSocketPath({ symDir: 'D:\\tenant-b', rooted: true, platform: 'win32' });
+    assert.match(a, PIPE);
+    assert.notEqual(a, b);
+    assert.notEqual(a, '\\\\.\\pipe\\sym-daemon');
+  });
+});
+
+describe('the daemon and its clients agree on the endpoint', () => {
+  it('SymDaemonClient dials the endpoint the daemon listens on, by default', () => {
+    const { SymDaemonClient } = require('../lib/ipc-client');
+    assert.equal(new SymDaemonClient()._socketPath, getSocketPath());
+  });
+
+  it('an explicit socketPath is resolved the way the daemon resolves SYM_SOCKET', () => {
+    const { SymDaemonClient } = require('../lib/ipc-client');
+    const p = path.join(__dirname, 'nowhere', 'd.sock');
+    assert.equal(new SymDaemonClient({ socketPath: p })._socketPath, ipcEndpoint(p));
+  });
+
+  it('with SYM_SOCKET set, the daemon\'s resolution and the client\'s are the same endpoint', () => {
+    const p = path.join(__dirname, 'nowhere', 'd.sock');
+    const out = execFileSync(process.execPath, ['-e', `
+      const { getSocketPath } = require(${JSON.stringify(require.resolve('../lib/platform'))});
+      const { SymDaemonClient } = require(${JSON.stringify(require.resolve('../lib/ipc-client'))});
+      console.log(JSON.stringify([getSocketPath(), new SymDaemonClient()._socketPath]));`],
+    { env: { ...process.env, SYM_SOCKET: p }, encoding: 'utf8' });
+    const [server, client] = JSON.parse(out);
+    assert.equal(server, ipcEndpoint(p));
+    assert.equal(client, server);
+  });
+});

From a8cacfbae3b9aaeeddeffb96cbc7abea002f9e38 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 18:43:20 +0100
Subject: [PATCH 018/148] cmb-fetch: serve a record's metadata whole, so a
 served v2.0 record still verifies

_handleCmbFetch rebuilt metadata from a fixed list of fields and dropped the v2.0 ones
(signatureSuite, addressScheme, createdByNodeId, application, assertionId), so a v2.0
record fetched from this node failed verification at the requester. The stored metadata
is now served whole, as a copy.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 lib/frame-handler.js              | 12 +++-----
 tests/cmb-fetch-serves-v2.test.js | 48 +++++++++++++++++++++++++++++++
 2 files changed, 52 insertions(+), 8 deletions(-)
 create mode 100644 tests/cmb-fetch-serves-v2.test.js

diff --git a/lib/frame-handler.js b/lib/frame-handler.js
index 0253267e..200aa0c8 100644
--- a/lib/frame-handler.js
+++ b/lib/frame-handler.js
@@ -650,16 +650,12 @@ class FrameHandler {
       // self-verifying, so the requester would recompute the address and refuse it.
       // A pre-boundary record is served in the shape it was stored in: the legacy DAG stays
       // readable and is never re-keyed (§7.8).
+      // The metadata is served WHOLE, as stored. Picking fields dropped the v2.0 ones
+      // (signatureSuite, addressScheme, createdByNodeId, application, assertionId), and a v2.0
+      // record without them no longer verifies at the requester. It is a copy, never the store's object.
       const m = cmb.metadata;
       served = m
-        ? {
-            categories,
-            metadata: {
-              key: m.key, createdBy: m.createdBy, createdTimestamp: m.createdTimestamp,
-              lineage: m.lineage ?? null, room: m.room ?? null, to: m.to ?? null,
-              sig: m.sig, sigAlg: m.sigAlg,
-            },
-          }
+        ? { categories, metadata: structuredClone(m) }
         : {
             key: cmb.key, createdBy: cmb.createdBy, createdAt: cmb.createdAt,
             categories, lineage: cmb.lineage ?? null,
diff --git a/tests/cmb-fetch-serves-v2.test.js b/tests/cmb-fetch-serves-v2.test.js
new file mode 100644
index 00000000..d22eb8b0
--- /dev/null
+++ b/tests/cmb-fetch-serves-v2.test.js
@@ -0,0 +1,48 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME to a temp sandbox before lib/config loads
+
+/**
+ * B-R9 (part): cmb-fetch serves the record as stored. A served v2.0 record (mmp-sig-v2.0) must keep
+ * signatureSuite, addressScheme, createdByNodeId, application and assertionId, or the requester
+ * cannot verify it.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const crypto = require('crypto');
+const fs = require('fs');
+const { SymNode } = require('../lib/node');
+const { NullDiscovery } = require('../lib/discovery');
+const { nodeDir } = require('../lib/config');
+const { createCMB, signCMB, verifyCMB, assertionIdV2_0 } = require('../lib/core');
+
+describe('cmb-fetch serving', () => {
+  it('a served v2.0 record still verifies against its author', () => {
+    const name = `fetchv2-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+    const node = new SymNode({ name, silent: true, discovery: new NullDiscovery() });
+    try {
+      const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519', {
+        publicKeyEncoding: { type: 'spki', format: 'der' }, privateKeyEncoding: { type: 'pkcs8', format: 'der' },
+      });
+      const pub = publicKey.slice(-32).toString('base64url');
+      const priv = privateKey.slice(-32).toString('base64url');
+      const cmb = createCMB({ categories: { focus: 'served whole' }, createdBy: 'alice', emitV2: true, createdByNodeId: 'node-alice', room: 'default' });
+      cmb.metadata.assertionId = assertionIdV2_0(cmb);
+      signCMB(cmb, priv);
+      assert.deepStrictEqual(verifyCMB(cmb, pub).valid, true, 'precondition: the stored record verifies');
+      node._store.get = (k) => (k === cmb.metadata.key ? { key: k, cmb } : null);
+      const sent = [];
+      node._peers.set('peer-r', { peerId: 'peer-r', name: 'requester', transport: { send: (f) => { sent.push(f); return true; } } });
+      node._frameHandler._handleCmbFetch('peer-r', 'requester', { type: 'cmb-fetch', key: cmb.metadata.key, reqId: 'r1' });
+      const res = sent.find((f) => f.type === 'cmb-fetch-result');
+      assert.ok(res?.found);
+      for (const k of ['signatureSuite', 'addressScheme', 'createdByNodeId', 'application', 'assertionId']) {
+        assert.ok(k in res.cmb.metadata, `${k} is served`);
+      }
+      assert.strictEqual(verifyCMB(JSON.parse(JSON.stringify(res.cmb)), pub).valid, true, 'the served record verifies');
+      res.cmb.metadata.key = 'tampered';
+      assert.notStrictEqual(cmb.metadata.key, 'tampered', 'the store keeps its own copy');
+    } finally { fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+  });
+});

From fb4582cdc99b69af5426e68248e8bbb28d30706d Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 18:45:19 +0100
Subject: [PATCH 019/148] receive de-dup: hold off a copy while the first is in
 flight; directed marks kept apart
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- K1: a key is marked seen only once its CMB has surfaced, which can be after an async
  SVAF pass, so a second copy arriving meanwhile (the same record via two peers, or a
  reconnect replay) passed the check and surfaced twice. A key is now held in flight from
  the check until its frame is finished with, and a copy arriving meanwhile is skipped.
  The SVAF chain returns its promise so the release happens exactly then.
- K3: directed assertion marks (key#sig:…) shared the broadcast map and its 10,000 cap,
  so a broadcast flood could evict them and let a replayed directed record surface again.
  They now have their own map and cap, persisted in the same file.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 lib/frame-handler.js                    | 73 +++++++++++++++++++------
 tests/audit-delivery-authorship.test.js | 34 ++++++++++++
 2 files changed, 89 insertions(+), 18 deletions(-)

diff --git a/lib/frame-handler.js b/lib/frame-handler.js
index 200aa0c8..544186ee 100644
--- a/lib/frame-handler.js
+++ b/lib/frame-handler.js
@@ -89,6 +89,11 @@ class FrameHandler {
     // raw *incoming* keys so the same CMB re-sent on reconnect/resync converges
     // instead of cycling. See _handleMemoryShare and MMP §4.2 O2.
     this._seenCmbKeys = new Map();
+    // Directed assertion marks (key#sig:…) get their own map and cap, so a broadcast flood cannot
+    // evict them and make a replayed directed record surface again, and the reverse.
+    this._seenDirectedKeys = new Map();
+    // Keys whose first copy is still being processed (an async SVAF pass): see _handleMemoryShare.
+    this._inFlightKeys = new Set();
     // Persist the dedup cache across plugin reloads / process restarts. Without this,
     // a reload wipes the cache and every already-processed CMB re-surfaces as new — a
     // primary trigger of the cross-node echo storm (MMP §14). Best-effort: any FS error
@@ -110,7 +115,7 @@ class FrameHandler {
       const raw = JSON.parse(fs.readFileSync(this._seenKeysPath, 'utf8'));
       for (const k of Object.keys(raw)) {
         const ts = raw[k];
-        if (typeof ts === 'number' && (now - ts) < SEEN_CMB_TTL_MS) this._seenCmbKeys.set(k, ts);
+        if (typeof ts === 'number' && (now - ts) < SEEN_CMB_TTL_MS) this._seenKeysFor(k).set(k, ts);
       }
     } catch { /* degrade to in-memory only */ }
   }
@@ -123,6 +128,7 @@ class FrameHandler {
     try {
       const obj = {};
       for (const [k, ts] of this._seenCmbKeys) obj[k] = ts;
+      for (const [k, ts] of this._seenDirectedKeys) obj[k] = ts;
       fs.writeFileSync(this._seenKeysPath, JSON.stringify(obj));
     } catch { /* ignore */ }
   }
@@ -134,20 +140,26 @@ class FrameHandler {
    * @private
    */
   _recordSeenCmbKey(key, now) {
-    this._seenCmbKeys.set(key, now);
-    if (this._seenCmbKeys.size > SEEN_CMB_MAX) {
-      for (const [k, ts] of this._seenCmbKeys) {
-        if (this._seenCmbKeys.size <= SEEN_CMB_MAX) break;
-        if (now - ts >= SEEN_CMB_TTL_MS) this._seenCmbKeys.delete(k);
+    const map = this._seenKeysFor(key);
+    map.set(key, now);
+    if (map.size > SEEN_CMB_MAX) {
+      for (const [k, ts] of map) {
+        if (map.size <= SEEN_CMB_MAX) break;
+        if (now - ts >= SEEN_CMB_TTL_MS) map.delete(k);
       }
-      while (this._seenCmbKeys.size > SEEN_CMB_MAX) {
-        const oldest = this._seenCmbKeys.keys().next().value;
-        this._seenCmbKeys.delete(oldest);
+      while (map.size > SEEN_CMB_MAX) {
+        const oldest = map.keys().next().value;
+        map.delete(oldest);
       }
     }
     this._persistSeenCmbKeys(now);
   }
 
+  /** The de-dup map a key belongs to: directed assertion marks are kept apart from content keys. @private */
+  _seenKeysFor(key) {
+    return typeof key === 'string' && key.includes('#sig:') ? this._seenDirectedKeys : this._seenCmbKeys;
+  }
+
   /**
    * Mark an inbound CMB's content-hash key as having actually surfaced to the
    * application layer (admitted/stored, mood delivered, or CLI-host forwarded).
@@ -716,6 +728,22 @@ class FrameHandler {
   }
 
   _handleMemoryShare(peerId, peerName, msg) {
+    let pending;
+    try {
+      pending = this._handleMemoryShareInner(peerId, peerName, msg);
+    } finally {
+      // Release the in-flight mark when this frame is finished with: now, or when its SVAF pass settles.
+      const k = msg && msg._inFlightKey;
+      if (k) {
+        if (pending && typeof pending.then === 'function') pending.finally(() => this._inFlightKeys.delete(k)).catch(() => {});
+        else this._inFlightKeys.delete(k);
+      }
+    }
+    return pending;
+  }
+
+  /** @private */
+  _handleMemoryShareInner(peerId, peerName, msg) {
     // A cmb frame is {type, timestamp, cmb}; an honest sender never sets `source`. Every name this
     // handler records for the deliverer must come from the connection (peerName), so a
     // frame-supplied one is dropped before anything reads it.
@@ -876,12 +904,21 @@ class FrameHandler {
       ? `${cognitionKey}#${assertionMark}`
       : cognitionKey;
     if (incomingKey) {
-      const lastSeen = this._seenCmbKeys.get(incomingKey);
+      const lastSeen = this._seenKeysFor(incomingKey).get(incomingKey);
       if (lastSeen !== undefined && (now - lastSeen) < SEEN_CMB_TTL_MS) {
-        this._seenCmbKeys.set(incomingKey, now); // refresh recency
+        this._seenKeysFor(incomingKey).set(incomingKey, now); // refresh recency
         this._node._log(`Duplicate CMB ${String(incomingKey).slice(0, 16)} from ${peerName} — seen within TTL, skipping (convergence)`);
         return;
       }
+      // The mark is only recorded once a CMB has surfaced, which can be after an async SVAF pass, so
+      // a copy arriving meanwhile (the same record via two peers, or a reconnect replay) would pass
+      // the check above and surface twice. It is held off while the first copy is in flight.
+      if (this._inFlightKeys.has(incomingKey)) {
+        this._node._log(`Duplicate CMB ${String(incomingKey).slice(0, 16)} from ${peerName} — the same record is still being processed, skipping`);
+        return;
+      }
+      this._inFlightKeys.add(incomingKey);
+      msg._inFlightKey = incomingKey;
     }
     // Carry the key down the processing chain so each surface point can record
     // it once the CMB has actually been delivered.
@@ -954,20 +991,20 @@ class FrameHandler {
     const recentEntries = this._node._store.allEntries().slice(0, 5);
     const anchorTexts = recentEntries.map(e => ({ text: e.content, source: e.source, tags: e.tags || [] }));
 
-    // Try neural SVAF first (Layer 4 cognition)
-    this._node._svafEvaluator.evaluate(
+    // Try neural SVAF first (Layer 4 cognition). The chain is returned so the caller knows when this
+    // frame is finished with (the in-flight de-dup mark is released then).
+    return this._node._svafEvaluator.evaluate(
       { text: msg.content, source: msg.source || peerName, tags: msg.tags || [], confidence: msg.confidence || 0.8 },
       anchorTexts,
       ageSeconds,
     ).then((neuralResult) => {
       if (neuralResult) {
-        this._processNeuralSVAF(neuralResult, msg, peerName, peerId, originTs, now);
-      } else {
-        this._runHeuristicSVAFContained(msg, peerName, peerId, originTs, now, ageSeconds);
+        return this._processNeuralSVAF(neuralResult, msg, peerName, peerId, originTs, now);
       }
+      return this._runHeuristicSVAFContained(msg, peerName, peerId, originTs, now, ageSeconds);
     }).catch((err) => {
       this._node._log(`SVAF neural error: ${err.message} — falling back to heuristic`);
-      this._runHeuristicSVAFContained(msg, peerName, peerId, originTs, now, ageSeconds);
+      return this._runHeuristicSVAFContained(msg, peerName, peerId, originTs, now, ageSeconds);
     });
   }
 
@@ -979,7 +1016,7 @@ class FrameHandler {
    * @private
    */
   _runHeuristicSVAFContained(msg, peerName, peerId, originTs, now, ageSeconds) {
-    Promise.resolve()
+    return Promise.resolve()
       .then(() => this._processHeuristicSVAF(msg, peerName, peerId, originTs, now, ageSeconds))
       .catch((err) => this._node._log(`SVAF heuristic error on frame from ${peerName}: ${err.message} — frame dropped`));
   }
diff --git a/tests/audit-delivery-authorship.test.js b/tests/audit-delivery-authorship.test.js
index 79470ef4..edb0ca30 100644
--- a/tests/audit-delivery-authorship.test.js
+++ b/tests/audit-delivery-authorship.test.js
@@ -237,6 +237,40 @@ describe('directed delivery (MMP §9.2.2, §8.8.2)', () => {
     });
   });
 
+  it('K1: two copies of one record in flight at once surface once', async () => {
+    await withNode('k1', async (node) => {
+      node._pinPeerKey('peerA', PEER_A.pub);
+      node._pinPeerKey('peerB', PEER_A.pub);
+      let release;
+      const gate = new Promise((r) => { release = r; });
+      node._svafEvaluator.evaluate = async () => { await gate; return ALIGNED; }; // the first copy is still in SVAF
+      const seen = collect(node);
+      const f = frame(signed(mkCmb('the same record, arriving twice')));
+      node._frameHandler.handle('peerA', 'peerA', JSON.parse(JSON.stringify(f)));
+      node._frameHandler.handle('peerB', 'peerB', JSON.parse(JSON.stringify(f))); // via a second peer, meanwhile
+      release();
+      await settle();
+      assert.strictEqual(seen.accepted.length, 1);
+      assert.strictEqual(node._frameHandler._inFlightKeys.size, 0, 'the in-flight mark is released');
+    });
+  });
+
+  it('K3: a broadcast flood cannot evict a directed assertion mark', async () => {
+    await withNode('k3', async (node) => {
+      node._pinPeerKey('peerA', PEER_A.pub);
+      node._svafEvaluator.evaluate = async () => REJECTED;
+      const seen = collect(node);
+      const f = directed(node, signed(mkCmb('approve the release', { to: node.nodeId })));
+      node._frameHandler.handle('peerA', 'peerA', JSON.parse(JSON.stringify(f)));
+      await settle();
+      const now = Date.now();
+      for (let i = 0; i <= 10000; i++) node._frameHandler._recordSeenCmbKey(`cmb-flood-${i}`, now);
+      node._frameHandler.handle('peerA', 'peerA', JSON.parse(JSON.stringify(f)));
+      await settle();
+      assert.strictEqual(seen.accepted.length, 1, 'the replay is still recognised');
+    });
+  });
+
   it('F2: an unverified directed CMB cannot widen its de-duplication key with unsigned fields', async () => {
     await withNode('d2-unsigned', async (node) => {
       node._svafEvaluator.evaluate = async () => REJECTED;

From 4867904fefac19b9871b05ef8def0135e5e538b5 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 18:46:30 +0100
Subject: [PATCH 020/148] under the test runner, a node refuses a home outside
 the temp dir (ETESTHOME)

Sandboxing HOME was a per-file convention (require tests/_isolate-home
first). The file that forgets it is exactly the one that leaks: it writes
identities, private keys, stores and locks into the real ~/.sym, where they
surface as phantom agents, and can read the real relay.env and its API key.
Nothing said so.

Node's test runner sets NODE_TEST_CONTEXT in every test process (children
inherit it). assertTestSandbox in lib/core/state-root.js, the module that
decides where state lives, now throws ETESTHOME when it is set and any of
these resolves outside fs.realpathSync(os.tmpdir()):

- os.homedir() (HOME; USERPROFILE on Windows), since several paths still
  derive from it directly
- the state root in effect, captured at load, so HOME sandboxed too late is
  caught
- SYM_IDENTITY_DIR when set, where the keypair goes

The message names the directories and says to sandbox HOME and USERPROFILE;
SYM_TEST_REAL_HOME=1 opts out. SymNode's constructor calls it before
anything is read or written, and the daemon before it reads relay.env,
migrates stores or builds its node.

Every existing test file passes under the guard: the files that construct a
node or start the daemon already sandbox (the 38 that do not load
_isolate-home were run under it, 393/393). New tests: in-process and child
process refusals for HOME, SYM_STATE_DIR and SYM_IDENTITY_DIR, nothing
written to the refused home, symlinked temp dirs accepted, the opt-out, no
check outside the runner, and the daemon refusing to start. 8 of 10 fail on
the previous code (the two that pass describe a sandboxed run and the
opt-out, which behave the same before and after).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 bin/sym-daemon.js             |   4 +
 lib/core/state-root.js        |  66 ++++++++++++++-
 lib/node.js                   |   4 +
 tests/_isolate-home.js        |   4 +
 tests/test-home-guard.test.js | 154 ++++++++++++++++++++++++++++++++++
 5 files changed, 231 insertions(+), 1 deletion(-)
 create mode 100644 tests/test-home-guard.test.js

diff --git a/bin/sym-daemon.js b/bin/sym-daemon.js
index ffe01a04..dec467a5 100755
--- a/bin/sym-daemon.js
+++ b/bin/sym-daemon.js
@@ -55,6 +55,10 @@ process.on('unhandledRejection', (reason) => {
   console.error(`[${new Date().toISOString()}] [ERROR] Unhandled rejection: ${reason}`);
 });
 
+// Under the test runner, a daemon whose state root is the real home is refused (ETESTHOME)
+// before it reads relay.env, migrates stores or builds its node — all of which touch ~/.sym.
+require('../lib/core/state-root').assertTestSandbox();
+
 // ── Configuration ──────────────────────────────────────────────
 
 const SYM_DIR = path.join(os.homedir(), '.sym');
diff --git a/lib/core/state-root.js b/lib/core/state-root.js
index aab49b50..54f524e8 100644
--- a/lib/core/state-root.js
+++ b/lib/core/state-root.js
@@ -23,6 +23,7 @@
  * Nothing moves for anyone who sets nothing: with SYM_STATE_DIR unset every path resolves
  * exactly where it did before, byte for byte.
  */
+const fs = require('fs');
 const os = require('os');
 const path = require('path');
 
@@ -49,4 +50,67 @@ function claudeProjectsDir() {
   return IS_ROOTED ? path.join(SYM_STATE_DIR, 'claude-projects') : path.join(os.homedir(), '.claude', 'projects');
 }
 
-module.exports = { SYM_STATE_DIR, IS_ROOTED, symPath, claudeProjectsDir };
+/**
+ * Under Node's test runner, refuse to start a node whose state would land outside a temp dir.
+ *
+ * WHY: a test that constructs a SymNode without first sandboxing HOME writes identities, private
+ * keys, stores and locks into the developer's real ~/.sym — where they surface afterwards as
+ * phantom agents in the operator's mesh, and where a test can read the real relay.env and its
+ * API key. A per-file convention (require tests/_isolate-home.js first) cannot hold that line:
+ * the file that forgets it is exactly the file that leaks, and nothing says so. Node's runner
+ * sets NODE_TEST_CONTEXT in every test process (and its children inherit it), so the engine can
+ * tell it is under test and check the one thing that matters: where it is about to write.
+ *
+ * Checked: the home directory (os.homedir() — HOME, USERPROFILE on Windows), because several
+ * paths still derive from it directly (relay.env, the daemon's room and task files, agent
+ * memory); the state root actually in effect, captured when this module loaded, so a test
+ * that sandboxed HOME too late is caught; and SYM_IDENTITY_DIR when set, since that is where
+ * the keypair goes. Each must resolve inside fs.realpathSync(os.tmpdir()) — through symlinks,
+ * because macOS's /var/folders temp dir is a link to /private/var/folders.
+ *
+ * SYM_TEST_REAL_HOME=1 opts out, for a test that means to use the real home and says so.
+ *
+ * @throws {Error} code 'ETESTHOME'
+ */
+function assertTestSandbox() {
+  if (!process.env.NODE_TEST_CONTEXT || process.env.SYM_TEST_REAL_HOME === '1') return;
+  const tmp = realpathOfPath(os.tmpdir());
+  const roots = [
+    ['home directory (HOME / USERPROFILE)', os.homedir()],
+    ['state root', SYM_STATE_DIR],
+  ];
+  if (process.env.SYM_IDENTITY_DIR) roots.push(['SYM_IDENTITY_DIR', process.env.SYM_IDENTITY_DIR]);
+  const outside = roots.filter(([, dir]) => !isWithin(realpathOfPath(dir), tmp));
+  if (!outside.length) return;
+  const err = new Error(
+    '[SYM] ETESTHOME: refusing to start a node under the Node test runner with its state outside a temp dir.\n' +
+    outside.map(([what, dir]) => `  ${what}: ${dir}\n`).join('') +
+    `  temp dir: ${tmp}\n\n` +
+    '  Sandbox HOME and USERPROFILE to a temp dir before any lib module loads ' +
+    "(require('./_isolate-home') as the first line of the test file), or this run writes " +
+    'identities, keys and stores into the real ~/.sym. Set SYM_TEST_REAL_HOME=1 to opt out deliberately.'
+  );
+  err.code = 'ETESTHOME';
+  throw err;
+}
+
+/** The real path of `p`, resolving through symlinks even when `p` itself does not exist yet. */
+function realpathOfPath(p) {
+  let head = path.resolve(p);
+  const tail = [];
+  for (;;) {
+    try { return path.join(fs.realpathSync(head), ...tail); } catch { /* not there yet */ }
+    const parent = path.dirname(head);
+    if (parent === head) return path.resolve(p);
+    tail.unshift(path.basename(head));
+    head = parent;
+  }
+}
+
+function isWithin(child, parent) {
+  const fold = (s) => (process.platform === 'win32' ? s.toLowerCase() : s);
+  const rel = path.relative(fold(parent), fold(child));
+  return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel));
+}
+
+module.exports = { SYM_STATE_DIR, IS_ROOTED, symPath, claudeProjectsDir, assertTestSandbox };
diff --git a/lib/node.js b/lib/node.js
index 0fd7c571..c4dd4efb 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -25,6 +25,7 @@ const crypto = require('crypto');
 const { EventEmitter } = require('events');
 const { MeshNode } = require('./core');
 const { nodeDir, loadOrCreateIdentity, acquireIdentityLock, log: logMsg } = require('./config');
+const { assertTestSandbox } = require('./core/state-root');
 const { MemoryStore } = require('./memory-store');
 const { AttestationStore, chainHash } = require('./attestation-store');
 const { RoleGrantStore } = require('./role-grant-store');
@@ -123,6 +124,9 @@ class SymNode extends EventEmitter {
    */
   constructor(opts = {}) {
     super();
+    // Before anything is read or written: under the test runner, a node whose state root is the
+    // real home is refused (ETESTHOME) rather than allowed to mint identities into ~/.sym.
+    assertTestSandbox();
     if (!opts.name) throw new Error('SymNode requires a name');
     this._silent = opts.silent || false;
 
diff --git a/tests/_isolate-home.js b/tests/_isolate-home.js
index 1fe53c05..ade8295e 100644
--- a/tests/_isolate-home.js
+++ b/tests/_isolate-home.js
@@ -11,6 +11,10 @@
  *
  * Without this, every `npm test` leaked `test-*`/fixture node dirs into the
  * real mesh store, which then surfaced as phantom "agents" in mesh-edge.
+ * It is no longer only a convention: under the test runner SymNode and the
+ * daemon refuse a home or state root outside the temp dir (ETESTHOME, see
+ * assertTestSandbox in lib/core/state-root.js), so a file that forgets this
+ * fails loudly instead of leaking.
  *
  * The sandbox is removed on process exit (node:test runs each file in its
  * own process, so one temp HOME per test file, cleaned when that file's
diff --git a/tests/test-home-guard.test.js b/tests/test-home-guard.test.js
new file mode 100644
index 00000000..a3ddc542
--- /dev/null
+++ b/tests/test-home-guard.test.js
@@ -0,0 +1,154 @@
+'use strict';
+
+require('./_isolate-home'); // sandbox HOME/USERPROFILE before anything reads os.homedir()
+
+/**
+ * ETESTHOME — under Node's test runner a node will not start with its state outside a temp dir.
+ *
+ * A test file that forgot to sandbox HOME used to write identities, keys and stores into the
+ * developer's real ~/.sym, silently. The runner sets NODE_TEST_CONTEXT in every test process
+ * (children inherit it), so SymNode and the daemon now refuse that state root, and say how to
+ * sandbox it; SYM_TEST_REAL_HOME=1 is the explicit way out.
+ *
+ * The "outside a temp dir" home used here is a scratch dir inside this checkout, created by no
+ * one: the guard must throw before anything is written there, and the test checks that nothing
+ * was. (If the checkout itself sits under the temp dir, there is no such place to point at and
+ * those cases are skipped.)
+ */
+
+const { describe, it, after } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { execFileSync, spawnSync } = require('node:child_process');
+const { assertTestSandbox } = require('../lib/core/state-root');
+const { sandbox } = require('./_isolate-home');
+
+const NODE = require.resolve('../lib/node');
+const DAEMON = path.join(__dirname, '..', 'bin', 'sym-daemon.js');
+const REAL_TMP = fs.realpathSync(os.tmpdir());
+const outsideTmp = path.join(__dirname, '..', `.test-home-guard-${process.pid}`);
+const checkoutInTmp = !path.relative(REAL_TMP, fs.realpathSync(path.join(__dirname, '..'))).startsWith('..');
+const needsOutside = { skip: checkoutInTmp && 'this checkout is itself under the temp dir, so there is no non-temp path to test with' };
+
+after(() => fs.rmSync(outsideTmp, { recursive: true, force: true }));
+
+/** Construct a SymNode in a fresh process under `env`; report whether it threw, and with what. */
+function constructIn(env) {
+  const r = spawnSync(process.execPath, ['-e', `
+    try {
+      const n = new (require(${JSON.stringify(NODE)}).SymNode)({ name: 'guard-probe', silent: true });
+      console.log(JSON.stringify({ ok: true, dir: n._dir }));
+    } catch (e) { console.log(JSON.stringify({ ok: false, code: e.code, message: e.message })); }
+    process.exit(0);`], { env, encoding: 'utf8', timeout: 30000 });
+  const line = String(r.stdout).trim().split('\n').pop();
+  assert.ok(line, `child produced no result: ${r.stderr}`);
+  return JSON.parse(line);
+}
+
+const underTest = (over) => {
+  const env = { ...process.env, NODE_TEST_CONTEXT: process.env.NODE_TEST_CONTEXT || 'child', ...over };
+  delete env.SYM_TEST_REAL_HOME;
+  if (!('SYM_STATE_DIR' in over)) delete env.SYM_STATE_DIR;
+  if (!('SYM_IDENTITY_DIR' in over)) delete env.SYM_IDENTITY_DIR;
+  return env;
+};
+
+describe('assertTestSandbox', () => {
+  it('this test process is under the runner, and its sandboxed home passes', () => {
+    assert.ok(process.env.NODE_TEST_CONTEXT, 'node --test sets NODE_TEST_CONTEXT');
+    assert.doesNotThrow(() => assertTestSandbox());
+  });
+
+  it('a home outside the temp dir throws ETESTHOME, naming it and the way out', needsOutside, () => {
+    const prev = { HOME: process.env.HOME, USERPROFILE: process.env.USERPROFILE };
+    process.env.HOME = outsideTmp;
+    process.env.USERPROFILE = outsideTmp;
+    try {
+      assert.throws(() => assertTestSandbox(), (e) => {
+        assert.equal(e.code, 'ETESTHOME');
+        assert.ok(e.message.includes(outsideTmp), 'names the offending directory');
+        assert.match(e.message, /HOME and USERPROFILE/);
+        assert.match(e.message, /SYM_TEST_REAL_HOME=1/);
+        return true;
+      });
+      process.env.SYM_TEST_REAL_HOME = '1';
+      assert.doesNotThrow(() => assertTestSandbox(), 'the explicit opt-out');
+    } finally {
+      delete process.env.SYM_TEST_REAL_HOME;
+      process.env.HOME = prev.HOME;
+      process.env.USERPROFILE = prev.USERPROFILE;
+    }
+  });
+
+  it('SYM_IDENTITY_DIR outside the temp dir is refused too: that is where the keypair goes', needsOutside, () => {
+    process.env.SYM_IDENTITY_DIR = outsideTmp;
+    try {
+      assert.throws(() => assertTestSandbox(), (e) => e.code === 'ETESTHOME' && e.message.includes('SYM_IDENTITY_DIR'));
+    } finally { delete process.env.SYM_IDENTITY_DIR; }
+  });
+
+  it('a temp dir reached through a symlink counts as the temp dir (macOS /var -> /private/var)', () => {
+    const prev = process.env.HOME;
+    try {
+      for (const home of [sandbox, fs.realpathSync(sandbox), path.join(sandbox, 'not', 'made', 'yet')]) {
+        process.env.HOME = home;
+        if (process.platform === 'win32') process.env.USERPROFILE = home;
+        assert.doesNotThrow(() => assertTestSandbox(), home);
+      }
+    } finally {
+      process.env.HOME = prev;
+      process.env.USERPROFILE = prev;
+    }
+  });
+
+  it('outside the test runner nothing is checked', needsOutside, () => {
+    const out = execFileSync(process.execPath, ['-e',
+      `require(${JSON.stringify(require.resolve('../lib/core/state-root'))}).assertTestSandbox(); console.log('ok')`],
+    { env: (() => { const e = { ...process.env, HOME: outsideTmp, USERPROFILE: outsideTmp }; delete e.NODE_TEST_CONTEXT; return e; })(), encoding: 'utf8' });
+    assert.equal(out.trim(), 'ok');
+  });
+});
+
+describe('SymNode construction', () => {
+  it('throws ETESTHOME when HOME is not sandboxed — and writes nothing there', needsOutside, () => {
+    const r = constructIn(underTest({ HOME: outsideTmp, USERPROFILE: outsideTmp }));
+    assert.equal(r.ok, false, 'construction must be refused');
+    assert.equal(r.code, 'ETESTHOME', r.message);
+    assert.equal(fs.existsSync(outsideTmp), false, 'nothing was written to the unsandboxed home');
+  });
+
+  it('throws ETESTHOME when SYM_STATE_DIR is outside the temp dir, even with HOME sandboxed', needsOutside, () => {
+    const r = constructIn(underTest({ SYM_STATE_DIR: path.join(outsideTmp, 'state') }));
+    assert.equal(r.code, 'ETESTHOME', r.message);
+    assert.ok(r.message.includes('state root'));
+    assert.equal(fs.existsSync(outsideTmp), false);
+  });
+
+  it('constructs normally in a sandbox', () => {
+    const r = constructIn(underTest({}));
+    assert.equal(r.ok, true, r.message);
+    assert.ok(r.dir.startsWith(sandbox), `the node lives in the sandbox: ${r.dir}`);
+  });
+
+  it('SYM_TEST_REAL_HOME=1 opts out deliberately', needsOutside, () => {
+    const r = constructIn({ ...underTest({ HOME: outsideTmp, USERPROFILE: outsideTmp }), SYM_TEST_REAL_HOME: '1' });
+    assert.equal(r.ok, true, r.message);
+    assert.ok(fs.existsSync(path.join(outsideTmp, '.sym', 'nodes', 'guard-probe', 'identity.json')), 'and then it writes where it was told');
+    fs.rmSync(outsideTmp, { recursive: true, force: true });
+  });
+});
+
+describe('daemon start', () => {
+  it('refuses to start with an unsandboxed home, and writes nothing there', needsOutside, () => {
+    const r = spawnSync(process.execPath, [DAEMON], {
+      env: underTest({ HOME: outsideTmp, USERPROFILE: outsideTmp, SYM_RELAY_ONLY: '1', SYM_NODE_NAME: 'guard-daemon',
+        SYM_SOCKET: path.join(sandbox, 'guard.sock') }),
+      encoding: 'utf8', timeout: 20000,
+    });
+    assert.notEqual(r.status, 0, `the daemon must not run; stdout:\n${r.stdout}`);
+    assert.match(String(r.stderr), /ETESTHOME/);
+    assert.equal(fs.existsSync(outsideTmp), false, 'nothing was written to the unsandboxed home');
+  });
+});

From 99c454d7feeff8ac33cec6e99d0ff408122a6a2a Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 18:46:53 +0100
Subject: [PATCH 021/148] identity lock: re-read a mismatched start time only
 when it was remembered

The confirming re-read before a mismatch reclaims a lock exists because a
remembered start time can outlive an unobserved pid reuse. `ps` reads are
never remembered, so on POSIX the second read repeated the first for
nothing; it now happens only on the remembered (Windows) path.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 lib/config.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/config.js b/lib/config.js
index 24447e9d..dbdeed31 100644
--- a/lib/config.js
+++ b/lib/config.js
@@ -578,8 +578,8 @@ function lockIsHeldByLiveProcess(lock) {
     let current = processStartTime(lock.pid);
     // A remembered start time (Windows) may predate a death and reuse of this pid that no
     // check observed. A mismatch hands the lock to someone else, so it is never concluded
-    // from memory: re-read first. A match errs only toward "held".
-    if (current && current !== lock.start) current = processStartTime(lock.pid, { fresh: true });
+    // from memory: re-read first. A match errs only toward "held". (`ps` is never remembered.)
+    if (current && current !== lock.start && startTimeCache()) current = processStartTime(lock.pid, { fresh: true });
     if (current && current !== lock.start) return false; // PID reused
   } else if (lock.mtimeMs < bootTimeMs() - LOCK_BOOT_SLACK_MS) {
     // Legacy lock with no start-time metadata, written before this boot:

From e59f71923db99eff5c0756677f417ca483679ce7 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 18:48:46 +0100
Subject: [PATCH 022/148] inbox and clock: the limit counts unread, `from`
 names a proven party, timestamps follow the clock

- K4: inbox()'s limit counted acked items, so a drain could return fewer unread deliveries
  than asked. It now counts unread; acked items still come back, marked.
- K5: the inbox `from` was the author's label whether or not anything proved it. It is now
  the author when the signature proved who that is (a v2.0 record verified against its signed
  node id, even when relayed, or a verified record its author delivered), and otherwise the
  peer that delivered it. The claim stays in author.name. A v2.0 record verified that way now
  carries author.nodeId.
- K6: the createdTimestamp ratchet restarted from zero in every process, and after a backward
  clock step it ran ahead of the clock indefinitely. It now starts from this node's newest
  stored record, and after a step of more than a minute it follows the clock again, with a
  log line and a clock-stepped-back metric.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 lib/frame-handler.js                    |  7 ++-
 lib/node.js                             | 53 ++++++++++++++++--
 tests/audit-delivery-authorship.test.js | 19 ++++++-
 tests/inbox-limit-and-clock.test.js     | 73 +++++++++++++++++++++++++
 tests/v2-author-binding.test.js         | 20 +++++++
 5 files changed, 163 insertions(+), 9 deletions(-)
 create mode 100644 tests/inbox-limit-and-clock.test.js

diff --git a/lib/frame-handler.js b/lib/frame-handler.js
index 544186ee..300a9ea6 100644
--- a/lib/frame-handler.js
+++ b/lib/frame-handler.js
@@ -473,7 +473,7 @@ class FrameHandler {
       if (!authorKey) { msg._cmbVerified = false; return false; }
       const v2 = verifyCMB(cmb, authorKey);
       const idOk = md.assertionId === undefined || md.assertionId === assertionIdV2_0(cmb);
-      if (v2.valid && idOk) { msg._cmbVerified = true; return false; }
+      if (v2.valid && idOk) { msg._cmbVerified = true; msg._verifiedAuthorNodeId = md.createdByNodeId; return false; }
       const reason = !v2.valid ? (v2.error || 'invalid') : 'assertion-id-mismatch';
       const k = recordKey(cmb);
       this._node._log(`[sym-security] v2.0 CMB ${String(k || '').slice(0, 16)} from ${peerName} rejected — ${reason} (author ${md.createdByNodeId.slice(0, 8)})`);
@@ -821,7 +821,10 @@ class FrameHandler {
     const claimedNodeId = msg.cmb?.metadata?.createdByNodeId || null;
     msg.author = {
       name: recordCreatedBy(msg.cmb) || peerName,
-      nodeId: msg._cmbVerified === true && claimedNodeId === peerId ? claimedNodeId : null,
+      // Established when the signature proved it: a v2.0 record verified against its signed node id
+      // (even when relayed), or any verified record its author delivered itself.
+      nodeId: msg._verifiedAuthorNodeId
+        || (msg._cmbVerified === true && claimedNodeId === peerId ? claimedNodeId : null),
       via: { name: peerName, nodeId: peerId },
     };
 
diff --git a/lib/node.js b/lib/node.js
index 21c5602b..cf04f941 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -1,6 +1,6 @@
 'use strict';
 
-const { recordKey, recordCreatedBy, recordLineage, recordParents, setRecordLineage } = require('./record');
+const { recordKey, recordCreatedBy, recordCreatedAt, recordLineage, recordParents, setRecordLineage } = require('./record');
 
 /**
  * SymNode — sovereign mesh node with cognitive coupling.
@@ -41,6 +41,8 @@ const {
   signGrant, roleRank, CAT7_CATEGORIES,
 } = require('./core');
 const { MMP_EMIT_V2 } = require('./emit-policy'); // the single reader-first flip switch
+/** How far this node's record timestamps may run ahead of its clock before they follow it again. */
+const MAX_CLOCK_LEAD_MS = 60 * 1000;
 const { FrameHandler } = require('./frame-handler');
 const { TcpTransport } = require('./transport');
 const { RelayConnection } = require('./relay');
@@ -1770,8 +1772,12 @@ class SymNode extends EventEmitter {
     this._inbox.push({
       seq,
       id,
-      // The author, not the store envelope's "<receiver>+<sender>" bookkeeping string.
-      from: entry.author?.name || recordCreatedBy(cmb) || entry.source || 'unknown',
+      // Who can be held to it: the author when its signature proved who that is, otherwise the peer
+      // that delivered it. The unproven claim stays in author.name, so `from` is safe to
+      // authorize on. (It used to be the author's label whether or not anything proved it.)
+      from: (entry.author?.nodeId && entry.author?.name)
+        || entry.author?.via?.name
+        || recordCreatedBy(cmb) || entry.source || 'unknown',
       author: entry.author || null,
       content: entry.content || '',
       categories: cmb.categories || null,
@@ -1868,7 +1874,14 @@ class SymNode extends EventEmitter {
     const limit = Math.max(1, Math.min(opts.limit || 50, this._inboxMax));
     const from = opts.since !== undefined ? opts.since : this._inboxCursor;
     const fresh = this._inbox.filter((m) => m.seq > from);
-    const slice = fresh.slice(0, limit);
+    // The limit counts what is still unread: an item already acked (read in full by id) comes back
+    // marked, but does not use up a place a new delivery needed.
+    const slice = [];
+    let unread = 0;
+    for (const m of fresh) {
+      if (!m.acked) { if (unread >= limit) break; unread++; }
+      slice.push(m);
+    }
     if (!opts.peek && slice.length) {
       this._inboxCursor = Math.max(this._inboxCursor, slice[slice.length - 1].seq);
       this._persistInbox(); // the drain moves the cursor — a restart must not replay it
@@ -1961,7 +1974,17 @@ class SymNode extends EventEmitter {
       // Two of this node's records never share a createdTimestamp: the timestamp is the one preimage
       // term that tells two assertions of the same words apart, so two sends in one millisecond
       // would otherwise carry identical signatures and the second would read as a replay.
-      const ts = Math.max(opts.cmb.metadata.createdTimestamp, (this._lastCreatedTimestamp ?? 0) + 1);
+      // The ratchet starts from this node's newest stored record, so it holds across restarts. It
+      // follows the clock again after a backward step of more than MAX_CLOCK_LEAD_MS instead of
+      // running ahead of it indefinitely.
+      const clock = opts.cmb.metadata.createdTimestamp;
+      let last = this._timestampRatchetBase();
+      if (last - clock > MAX_CLOCK_LEAD_MS) {
+        this._log(`The clock is ${Math.round((last - clock) / 1000)} s behind this node's newest record; timestamps follow the clock again`);
+        this.emit('metric', { type: 'clock-stepped-back', byMs: last - clock });
+        last = clock - 1;
+      }
+      const ts = Math.max(clock, last + 1);
       opts.cmb.metadata.createdTimestamp = ts;
       this._lastCreatedTimestamp = ts;
       // assertionId is a hash OF the v2.0 preimage, set after construction and before signing.
@@ -2157,6 +2180,26 @@ class SymNode extends EventEmitter {
     return entry;
   }
 
+  /**
+   * The newest createdTimestamp this node has minted, read once from its own stored records.
+   * @private
+   */
+  _timestampRatchetBase() {
+    if (this._lastCreatedTimestamp === undefined) {
+      let max = 0;
+      try {
+        for (const e of this._store.allEntries()) {
+          if (e && e.peerId == null) {
+            const t = recordCreatedAt(e.cmb);
+            if (Number.isFinite(t) && t > max) max = t;
+          }
+        }
+      } catch { /* an unreadable store starts the ratchet at zero */ }
+      this._lastCreatedTimestamp = max;
+    }
+    return this._lastCreatedTimestamp;
+  }
+
   /**
    * Sign a record with this node's identity key, or throw ESIGN. Nothing is stored or dispatched
    * before this runs, so a failure leaves no unsigned copy anywhere.
diff --git a/tests/audit-delivery-authorship.test.js b/tests/audit-delivery-authorship.test.js
index edb0ca30..2e48887b 100644
--- a/tests/audit-delivery-authorship.test.js
+++ b/tests/audit-delivery-authorship.test.js
@@ -381,7 +381,7 @@ describe('F3: an admitted broadcast the store already holds', () => {
 });
 
 describe('author and inbox id on surfaced entries', () => {
-  it('carries the author and the delivering peer, and the inbox reads the author', async () => {
+  it('carries the author and the delivering peer; the inbox `from` is the peer when nothing proves the author (K5)', async () => {
     await withNode('author', async (node) => {
       node._svafEvaluator.evaluate = async () => ALIGNED;
       const seen = collect(node);
@@ -392,11 +392,26 @@ describe('author and inbox id on surfaced entries', () => {
       assert.ok(!String(e.author.name).includes('+'));
       const item = node.inboxGet(e.inboxId);
       assert.ok(item, 'the surfaced entry names its inbox id');
-      assert.strictEqual(item.from, 'claude-sym-agent-a');
+      assert.strictEqual(item.from, 'peerA', 'an unsigned claim is not who the inbox says it is from');
+      assert.strictEqual(item.author.name, 'claude-sym-agent-a', 'the claim is kept, as a claim');
       assert.strictEqual(item.seq, e.inboxSeq);
     });
   });
 
+  it('K5: the inbox `from` is the author when its signature proved who that is', async () => {
+    await withNode('author-proven', async (node) => {
+      node._pinPeerKey('peerA', PEER_A.pub);
+      node._svafEvaluator.evaluate = async () => ALIGNED;
+      const seen = collect(node);
+      const cmb = signed(mkCmb('proven authorship', { by: 'peerA' }));
+      cmb.metadata.createdByNodeId = undefined;
+      node._frameHandler.handle('peerA', 'peerA', frame(cmb));
+      await settle();
+      const item = node.inboxGet(seen.accepted[0].inboxId);
+      assert.strictEqual(item.from, 'peerA');
+    });
+  });
+
   it('every surfaced path carries author.via: rejected-directed, CLI-host and admitted', async () => {
     const paths = {
       'rejected-directed': async (node) => { node._svafEvaluator.evaluate = async () => REJECTED; return directed(node, mkCmb('via rejected')); },
diff --git a/tests/inbox-limit-and-clock.test.js b/tests/inbox-limit-and-clock.test.js
new file mode 100644
index 00000000..4b6040d6
--- /dev/null
+++ b/tests/inbox-limit-and-clock.test.js
@@ -0,0 +1,73 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME to a temp sandbox before lib/config loads
+
+/**
+ * - K4: inbox()'s limit counts unread deliveries; an item already acked (read in full by id) comes
+ *   back marked but does not take a new delivery's place.
+ * - K6: record timestamps are strictly increasing across restarts (the ratchet starts from the newest
+ *   stored record), and after the clock steps back by more than a minute they follow the clock again
+ *   instead of running ahead of it indefinitely.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const { SymNode } = require('../lib/node');
+const { NullDiscovery } = require('../lib/discovery');
+const { nodeDir } = require('../lib/config');
+
+const mkNode = (name) => new SymNode({ name, silent: true, discovery: new NullDiscovery() });
+const uniq = (p) => `${p}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+
+describe('inbox limit (K4)', () => {
+  it('acked items do not use up the limit', () => {
+    const name = uniq('inbox');
+    const node = mkNode(name);
+    try {
+      for (let i = 0; i < 6; i++) node._pushInbox({ cmb: { categories: { focus: { text: `m${i}` } } }, content: `m${i}`, source: 'peer' });
+      const ids = node._inbox.map((m) => m.id);
+      node.inboxAck(ids[0]); node.inboxAck(ids[1]); node.inboxAck(ids[2]);
+      const r = node.inbox({ limit: 2 });
+      const unread = r.messages.filter((m) => !m.acked).map((m) => m.id);
+      assert.deepStrictEqual(unread, [ids[3], ids[4]], 'two unread deliveries, as asked');
+      assert.ok(r.messages.slice(0, 3).every((m) => m.acked), 'the acked ones come back marked');
+      assert.strictEqual(r.remaining, 1);
+    } finally { fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+  });
+});
+
+describe('record timestamps (K6)', () => {
+  it('stay strictly increasing across a restart', () => {
+    const name = uniq('clock');
+    try {
+      const a = mkNode(name);
+      const realNow = Date.now;
+      const future = realNow() + 30 * 1000; // records written 30 s "ahead", as after a small clock step
+      Date.now = () => future;
+      const first = a.remember({ focus: 'before the restart' });
+      Date.now = realNow;
+      a._identityLock?.release?.();
+      const b = mkNode(name); // a new process on the same store
+      const second = b.remember({ focus: 'after the restart' });
+      assert.ok(second.cmb.metadata.createdTimestamp > first.cmb.metadata.createdTimestamp);
+    } finally { fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+  });
+
+  it('follow the clock again after it steps back by more than a minute', () => {
+    const name = uniq('clockstep');
+    const node = mkNode(name);
+    const metrics = [];
+    node.on('metric', (m) => metrics.push(m));
+    const realNow = Date.now;
+    try {
+      const t0 = realNow();
+      Date.now = () => t0 + 60 * 60 * 1000; // an hour ahead, then the clock is corrected
+      node.remember({ focus: 'written while the clock was an hour fast' });
+      Date.now = () => t0;
+      const after = node.remember({ focus: 'written after the correction' });
+      assert.ok(Math.abs(after.cmb.metadata.createdTimestamp - t0) < 1000, 'the timestamp is the clock again');
+      assert.ok(metrics.some((m) => m.type === 'clock-stepped-back'));
+    } finally { Date.now = realNow; fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+  });
+});
diff --git a/tests/v2-author-binding.test.js b/tests/v2-author-binding.test.js
index f7356a38..2342cd30 100644
--- a/tests/v2-author-binding.test.js
+++ b/tests/v2-author-binding.test.js
@@ -91,3 +91,23 @@ describe('assertionId (B-R6)', () => {
     });
   });
 });
+
+describe('the inbox names a proven author (K5)', () => {
+  it('a relayed v2.0 record verified against its signed node id is from its author, not the relay', async () => {
+    const name = `v2inbox-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+    const node = new SymNode({ name, silent: true, discovery: new NullDiscovery() });
+    await node.start();
+    try {
+      node._pinPeerKey('node-alice', ALICE.pub);
+      node._pinPeerKey('node-relay', RELAY.pub);
+      node._svafEvaluator.evaluate = async () => ({ decision: 'aligned', total_drift: 0.1, category_drifts: { focus: 0.1 }, gate_values: { g: 1 } });
+      const got = [];
+      node.on('cmb-accepted', (e) => got.push(e));
+      node._frameHandler.handle('node-relay', 'relay', { type: 'cmb', timestamp: Date.now(), cmb: v2Record({ nodeId: 'node-alice', createdBy: 'alice', signWith: ALICE, focus: 'relayed but proven' }) });
+      await new Promise((r) => setTimeout(r, 150));
+      assert.strictEqual(got.length, 1);
+      assert.strictEqual(got[0].author.nodeId, 'node-alice');
+      assert.strictEqual(node.inboxGet(got[0].inboxId).from, 'alice');
+    } finally { await node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+  });
+});

From 4430532b2d1b7aaee0e40477a6713bf259664f23 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 18:51:12 +0100
Subject: [PATCH 023/148] daemon: keep its files in SYM_STATE_DIR, no LAN
 beacon when relay-only; no sends on dead sockets

- bin/sym-daemon.js built its own directory from os.homedir(), so a daemon rooted with
  SYM_STATE_DIR read and wrote its room, tasks and relay.env in the user's real ~/.sym. It
  now uses the same state root as every node.
- A relay-only daemon (SYM_RELAY_ONLY) has LAN discovery off, but it still published its room
  beacon on mDNS. It no longer does, and says so in the log.
- sendFrame counted a frame written to a destroyed or non-writable socket as sent, until
  'close' arrived (B-D6 residual). It returns false for those now.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 bin/sym-daemon.js                    | 11 +++++++---
 lib/frame-parser.js                  |  3 +++
 tests/daemon-relay-only.test.js      | 31 ++++++++++++++++++++++++++++
 tests/send-frame-dead-socket.test.js | 29 ++++++++++++++++++++++++++
 4 files changed, 71 insertions(+), 3 deletions(-)
 create mode 100644 tests/send-frame-dead-socket.test.js

diff --git a/bin/sym-daemon.js b/bin/sym-daemon.js
index 95274a8d..a03263d2 100755
--- a/bin/sym-daemon.js
+++ b/bin/sym-daemon.js
@@ -61,7 +61,10 @@ require('../lib/core/state-root').assertTestSandbox();
 
 // ── Configuration ──────────────────────────────────────────────
 
-const SYM_DIR = path.join(os.homedir(), '.sym');
+// The daemon's own files live in the same state root as every node's: SYM_STATE_DIR when set, else
+// ~/.sym. Building it from the home dir sent a rooted daemon's room, tasks and relay.env to the
+// user's real ~/.sym.
+const SYM_DIR = require('../lib/core/state-root').SYM_STATE_DIR;
 const { getSocketPath, getLogDir } = require('../lib/platform');
 const SOCKET_PATH = getSocketPath();
 // Stable name: use SYM_NODE_NAME env, or platform-scoped default
@@ -78,7 +81,7 @@ const LOG_DIR = getLogDir('sym-daemon');
 
 // Load relay config from ~/.sym/relay.env if env vars not set
 if (!process.env.SYM_RELAY_URL) {
-  const envFile = path.join(os.homedir(), '.sym', 'relay.env');
+  const envFile = path.join(SYM_DIR, 'relay.env');
   if (fs.existsSync(envFile)) {
     for (const line of fs.readFileSync(envFile, 'utf8').split('\n')) {
       const m = line.match(/^(\w+)=(.*)$/);
@@ -871,7 +874,9 @@ async function main() {
   await node.start();
   log(`SYM node started (${node._identity?.nodeId?.slice(0, 8)})`);
 
-  startRoomBeacon();
+  // A relay-only daemon has LAN discovery off, so it must not announce its room on the LAN either.
+  if (RELAY_ONLY) log('Room beacon: off (relay-only)');
+  else startRoomBeacon();
 
   loadTasks();
   log(`Loaded ${tasks.size} task(s)`);
diff --git a/lib/frame-parser.js b/lib/frame-parser.js
index 93f6a6eb..66429a74 100644
--- a/lib/frame-parser.js
+++ b/lib/frame-parser.js
@@ -94,6 +94,9 @@ class FrameParser extends EventEmitter {
 function sendFrame(socket, msg) {
   const payload = Buffer.from(JSON.stringify(msg), 'utf8');
   if (payload.length > MAX_FRAME_SIZE) return false;
+  // A socket that is destroyed or no longer writable has not taken the frame, even though write()
+  // on it may not throw: 'close' can arrive after the destroy, and until then this counted as sent.
+  if (!socket || socket.destroyed || socket.writable === false) return false;
   const header = Buffer.alloc(4);
   header.writeUInt32BE(payload.length, 0);
   try {
diff --git a/tests/daemon-relay-only.test.js b/tests/daemon-relay-only.test.js
index 54f27f3e..028718cb 100644
--- a/tests/daemon-relay-only.test.js
+++ b/tests/daemon-relay-only.test.js
@@ -46,6 +46,8 @@ test('SYM_RELAY_ONLY=1: LAN discovery off, relay-auth still sent, CLI reaches th
 
     // The relay leg, on its own.
     assert.match(out, /relay-only: LAN discovery off \(SYM_RELAY_ONLY\); joining ws:/, out.slice(-800));
+    assert.match(out, /Room beacon: off \(relay-only\)/, 'a relay-only daemon does not announce its room on the LAN');
+    assert.doesNotMatch(out, /Room beacon: room=/);
     assert.equal(auths.length >= 1, true, `relay-auth expected; log:\n${out.slice(-800)}`);
     assert.equal(auths[0].name, 'relay-only-test');
     assert.equal(typeof auths[0].engine, 'string');
@@ -71,3 +73,32 @@ test('SYM_RELAY_ONLY=1: LAN discovery off, relay-auth still sent, CLI reaches th
     fs.rmSync(home, { recursive: true, force: true });
   }
 });
+
+test('a daemon with SYM_STATE_DIR keeps its own files in that root, not in ~/.sym', async () => {
+  const base = fs.mkdtempSync(path.join(os.tmpdir(), 'sym-rooted-'));
+  const home = path.join(base, 'home'); fs.mkdirSync(home);
+  const root = path.join(base, 'root'); fs.mkdirSync(root);
+  const wss = new WebSocketServer({ port: 0 });
+  const auths = [];
+  wss.on('connection', (ws) => ws.on('message', (m) => { const f = JSON.parse(String(m)); if (f.type === 'relay-auth') auths.push(f); }));
+  // The relay config and the room live only in the root: a daemon reading ~/.sym finds neither.
+  fs.writeFileSync(path.join(root, 'relay.env'), `SYM_RELAY_URL=ws://127.0.0.1:${wss.address().port}\nSYM_RELAY_TOKEN=${'y'.repeat(32)}\n`);
+  fs.writeFileSync(path.join(root, 'room'), 'rooted-room');
+  const socket = path.join(base, 'r.sock');
+  const env = { ...process.env, HOME: home, USERPROFILE: home, SYM_STATE_DIR: root, SYM_SOCKET: socket, SYM_NODE_NAME: 'rooted-test', SYM_RELAY_ONLY: '1' };
+  delete env.SYM_RELAY_URL; delete env.SYM_RELAY_TOKEN; delete env.SYM_ROOM;
+  const daemon = spawn(process.execPath, [path.join(BIN, 'sym-daemon.js')], { env, stdio: ['ignore', 'pipe', 'pipe'] });
+  let out = '';
+  daemon.stdout.on('data', (b) => { out += b; });
+  daemon.stderr.on('data', (b) => { out += b; });
+  try {
+    for (let i = 0; i < 100 && daemon.exitCode === null && !auths.length; i++) await new Promise((r) => setTimeout(r, 100));
+    assert.ok(auths.length >= 1, `the relay config was read from the root; log:\n${out.slice(-800)}`);
+    assert.match(out, /rooted-room/, 'the room was read from the root');
+    assert.equal(fs.existsSync(path.join(home, '.sym')), false, 'nothing was written to ~/.sym');
+  } finally {
+    daemon.kill('SIGTERM');
+    await new Promise((r) => wss.close(() => r()));
+    fs.rmSync(base, { recursive: true, force: true });
+  }
+});
diff --git a/tests/send-frame-dead-socket.test.js b/tests/send-frame-dead-socket.test.js
new file mode 100644
index 00000000..fb91f1a5
--- /dev/null
+++ b/tests/send-frame-dead-socket.test.js
@@ -0,0 +1,29 @@
+'use strict';
+
+/**
+ * B-D6 (residual): a frame handed to a socket that is destroyed, or no longer writable, was counted
+ * as sent until 'close' fired, so a send in that window reported delivery.dispatched for nothing.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const net = require('node:net');
+const { sendFrame } = require('../lib/frame-parser');
+
+describe('sendFrame', () => {
+  it('refuses a destroyed socket, a non-writable one, and none at all', () => {
+    const destroyed = new net.Socket();
+    destroyed.destroy();
+    assert.strictEqual(sendFrame(destroyed, { type: 'cmb' }), false);
+    const ended = { destroyed: false, writable: false, write: () => true };
+    assert.strictEqual(sendFrame(ended, { type: 'cmb' }), false);
+    assert.strictEqual(sendFrame(null, { type: 'cmb' }), false);
+  });
+
+  it('still sends on a writable socket', () => {
+    const writes = [];
+    const live = { destroyed: false, writable: true, write: (b) => { writes.push(b); return true; } };
+    assert.strictEqual(sendFrame(live, { type: 'cmb', n: 1 }), true);
+    assert.strictEqual(writes.length, 1);
+  });
+});

From c56fb0f4eacc45596169383461a56d92d47bb665 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 18:51:35 +0100
Subject: [PATCH 024/148] test: pin admission-as-collapse (B-L3), the
 conformance boundary of spec PR #17
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

sym integrates an admitted CMB as the identity, so every admission is the "collapsed
integration" case PR #17 adds to §15.5: the author's record is kept exactly as signed, the
receiver mints nothing, nothing is attributed to the receiver and no K→K self-edge is
written. The test pins that, so a future integration that changes the text (which §15.5
would then require to mint a receiver remix) fails loudly here instead of silently.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 tests/audit-delivery-authorship.test.js | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/tests/audit-delivery-authorship.test.js b/tests/audit-delivery-authorship.test.js
index 2e48887b..1915bb59 100644
--- a/tests/audit-delivery-authorship.test.js
+++ b/tests/audit-delivery-authorship.test.js
@@ -380,6 +380,29 @@ describe('F3: an admitted broadcast the store already holds', () => {
   });
 });
 
+describe('B-L3: admission that leaves the text unchanged is a collapse (spec PR #17, §15.5 "Collapsed integration")', () => {
+  it('stores the author\'s record exactly as signed, mints no receiver remix, writes no self-edge', async () => {
+    await withNode('collapse', async (node) => {
+      node._pinPeerKey('peerA', PEER_A.pub);
+      node._svafEvaluator.evaluate = async () => ALIGNED;
+      const before = node.recall('').length;
+      const cmb = signed(mkCmb('an observation the receiver integrates unchanged'));
+      const key = cmb.metadata.key;
+      node._frameHandler.handle('peerA', 'peerA', frame(cmb));
+      await settle();
+      const stored = node._store.get(key);
+      assert.ok(stored, 'the record is held under the author\'s address');
+      assert.strictEqual(recordCreatedBy(stored.cmb), 'peerA', 'never attributed to the receiver');
+      assert.deepStrictEqual(core.verifyCMB(stored.cmb, PEER_A.pub).valid, true, 'kept exactly as signed');
+      const parents = stored.cmb.metadata?.lineage?.parents || [];
+      assert.ok(!parents.includes(key), 'no K→K self-edge');
+      const own = node.recall('').filter((e) => recordCreatedBy(e.cmb) === node.name);
+      assert.strictEqual(own.length, 0, 'the receiver minted no remix of its own');
+      assert.strictEqual(node.recall('').length, before + 1);
+    });
+  });
+});
+
 describe('author and inbox id on surfaced entries', () => {
   it('carries the author and the delivering peer; the inbox `from` is the peer when nothing proves the author (K5)', async () => {
     await withNode('author', async (node) => {

From 38640074211379d8f075262ae8796e98ae08dcf9 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 18:52:25 +0100
Subject: [PATCH 025/148] =?UTF-8?q?CHANGELOG:=20Unreleased=20(0.13.15)=20?=
 =?UTF-8?q?=E2=80=94=20audit=20findings,=20known=20limits,=20Windows=20tes?=
 =?UTF-8?q?t=20debt,=20the=20daemon's=20log=20flood?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 CHANGELOG.md | 100 +++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 100 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 823fb4e5..bd728c58 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,105 @@
 # Changelog
 
+## Unreleased
+
+Fixes from the MMP 2.0 conformance audit's open findings, the 0.13.12 known limits, the Windows test
+debt, and the daemon's log flood. Every item has a test that fails without its fix.
+
+### Fixed — security
+
+- **A relay could replay a signed directed record.** The directed de-duplication mark was the raw
+  base64url signature or the carried `assertionId`. Base64url decoding ignores padding and the
+  unused bits of the last character, and no signature covers `assertionId`, so a relay could
+  re-spell either and make one signed directed record surface again and again. The mark is now
+  the hash of the decoded signature bytes.
+- **A peer could vouch for a v2.0 record by signing it under another node's id (B-R4).** A
+  published v2.0 record (mmp-sig-v2.0) signs its author's node id, but it was verified against the
+  key of whichever peer delivered it. It is now verified against the key held for its
+  `createdByNodeId`, so a genuine relay also verifies. A v2.0 record whose carried `assertionId`
+  is not the one its preimage yields is refused (B-R6). On other suites a carried `assertionId`,
+  which nothing signs, is dropped.
+- **Stripping the frame's `directed` flag turned a signed directed CMB into a broadcast (B-R8).**
+  A signed addressee could only veto directed treatment. When the author signed one, it now alone
+  decides.
+- **Unauthenticated gossip could repoint a phone's wake token.** Any room peer's `peer-info` could
+  overwrite a wake channel the phone had given this node itself. A channel learned from a weaker
+  source (gossip < relay < the peer itself) now never replaces a stronger one's token.
+- **A record with no room was admitted in every room it was replayed into (B-R10).** A record that
+  names no room is now in the literal room `default` (§7). `createCMB` names `default` instead of
+  null (which signed the string `"null"`), and the v2.0 preimage refuses a record without a room.
+- **A record that could not be signed was sent unsigned (B-R12).** `remember()` now throws `ESIGN`
+  before anything is stored or dispatched (§18.3.1).
+
+### Fixed — delivery and records
+
+- **Two copies of one record arriving together could both surface (K1).** A key is held in flight
+  from the de-duplication check until its SVAF pass settles.
+- **A broadcast flood could evict directed de-duplication marks (K3).** They have their own map and
+  cap now.
+- **`inbox()`'s limit counted acked items (K4).** It counts unread deliveries; acked ones still come
+  back, marked.
+- **The inbox `from` was the author's label whether or not anything proved it (K5).** It is now the
+  author when the signature proved who that is, and otherwise the peer that delivered it. The claim
+  stays in `author.name`. A v2.0 record verified against its signed node id carries `author.nodeId`,
+  even when relayed.
+- **Record timestamps ran ahead of the clock after a backward step, and restarted every process
+  (K6).** The ratchet starts from this node's newest stored record. After a step back of more than a
+  minute, timestamps follow the clock again, with a `clock-stepped-back` metric.
+- **Mood values were invented or lost (B-R11).** `valence` and `arousal` are kept only when measured,
+  must be numbers in [-1, 1], and a mood given only as numbers keeps them.
+- **Records had no size bound below the 1 MiB frame (B-R13).** A category is at most 256 KiB, the
+  seven at most 960 KiB, and an agent id at most 64 bytes (§3.1.2). The emitter throws `ECMBSIZE`, and
+  a receiver refuses an oversized record before rendering, verifying or storing it.
+- **A served v2.0 record no longer verified (B-R9, part).** `cmb-fetch` now serves a record's
+  metadata whole, as a copy.
+- **A frame written to a destroyed socket counted as sent (B-D6, residual).**
+- **Unsigned records are now counted (B-R3, interim).** They are still accepted as unverified for
+  interop, but each is counted (`cmb-unsigned-received`) and the sending peer is named once in the
+  log, so the emitters a signed-only default would cut off can be found first.
+
+### Fixed — lineage
+
+- **The root walk trusted unverified records (B-L4).** It walks only through records whose address
+  recomputes and that this node wrote or admitted as verified. A remix with no verified ancestor in
+  reach resolves to no anchor, instead of being anchored to itself, and the result says whether the
+  walk was `complete`.
+- **A tether could not be reproduced by another node (B-L5).** It is measured on the stored record's
+  text, encoded in one kernel, instead of on vectors blended with local memory.
+- **Cold-start admissions had no tether (B-L6).**
+- The tether audit's fetch fallback no longer returns a local record the walk had refused.
+
+### Fixed — the daemon
+
+- **The log flood.** Every peer re-sends its whole wake-channel list on every connect, and the
+  receiver logged a line and rewrote `wake-channels.json` per entry per frame, so the daemon's
+  `stdout.log` reached 1 GB of `learned wake channel for unknown`. A repeat now changes nothing and
+  logs nothing; a frame that does teach something logs one line. Channels carry the time of the last
+  first-hand sighting (gossip forwards it instead of the time of sending) and expire after 30 days
+  unseen. A channel saved before this release gets one 30-day grace period, once.
+- **A daemon rooted with `SYM_STATE_DIR` kept its room, tasks and relay.env in `~/.sym`.** It uses
+  the state root now.
+- **A relay-only daemon still announced its room on the LAN.** It no longer does.
+- **IPC on Windows.** The daemon and every client now resolve the IPC endpoint one way, and on
+  Windows a file path becomes a named pipe. `SymDaemonClient` defaulted to `/tmp/sym.sock`, which no
+  daemon listens on (every OS).
+- **Windows lock checks.** A live pid's start time is cached until the pid is seen dead, and several
+  pids are read in one PowerShell call. A mismatch is re-read before a lock is reclaimed.
+- The daemon reports a failed IPC command as that command's error instead of a parse error.
+
+### Fixed — tests and conformance
+
+- **A test node can no longer reach the real `~/.sym`.** Under the Node test runner, a `SymNode` (or
+  the daemon) throws `ETESTHOME` when its home, state root or identity dir is outside the temp dir.
+  `SYM_TEST_REAL_HOME=1` opts out. **This affects other projects:** a suite that builds a `SymNode`
+  under `node --test` with the real HOME now fails until it sandboxes HOME and USERPROFILE.
+- The published v2 conformance vectors are consumed verbatim, with their errata, plus a new
+  application-v2 test. The handshake transcript and AAD normalise room and names to NFC, as the
+  reference does (B-R17).
+- Windows test debt is fixed. The SIGTERM lock test is skipped on Windows, with a hard-kill reclaim
+  test on every platform. The lease test uses a live foreign holder with a real start time; it never
+  reached the start-time check before, on any OS. The relay-only test uses the platform's IPC endpoint.
+- Admission-as-collapse (B-L3) is pinned by a test: the conformance boundary of spec PR #17.
+
 ## 0.13.14 (2026-10-01)
 
 ### Added — a peer's admission verdict is observable as it lands (`attestation-received`)

From 30f7ff616ae097bb7bd6988615ce04fdbf3bf837 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 19:02:36 +0100
Subject: [PATCH 026/148] svaf: anchors are measured through a side map, never
 written to
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The heuristic gate attached each category's receiver-local vector to the
records it read, in place. Its anchors are the store's own cached objects
(MemoryStore.anchors hands out entry.cmb), so every anchor the gate read kept
a vector on each category until the next persist of that entry, which is
routine (a peer remix citing it advances its lifecycle), and the vectors were
written to disk. A record carries no vector (§7.1). The incoming record was
mutated the same way.

localisedCategories now returns a new {text, vector} map built from text
alone, and anchors are measured through views holding only what
computeCategoryDrifts reads. A wire vector still never reaches the
measurement: a category with no text has no entry in the map.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 lib/core/svaf-baseline.js         | 40 ++++++++++++------
 tests/svaf-anchor-vectors.test.js | 68 +++++++++++++++++++++++++++++++
 2 files changed, 95 insertions(+), 13 deletions(-)
 create mode 100644 tests/svaf-anchor-vectors.test.js

diff --git a/lib/core/svaf-baseline.js b/lib/core/svaf-baseline.js
index e16cf186..a7dc9cdb 100644
--- a/lib/core/svaf-baseline.js
+++ b/lib/core/svaf-baseline.js
@@ -120,21 +120,26 @@ async function _localVector(categoryName, text, useSemantic) {
 }
 
 /**
- * Replace every category's vector with one this node computed from the category's own text.
+ * The categories as this node encodes them: a NEW map of `{ text, vector }`, one entry per category
+ * that has text, every vector computed here from that text.
  *
- * DELETES first, then recomputes — so a record that arrives carrying vectors is silently
- * ignored rather than rejected (interop), and is admitted on the re-encoded value. The delete
- * is the security-relevant line: without it a transmitted vector would survive for any category
- * whose text is empty.
+ * Built beside the record, never on it. The records the gate reads are the store's own cached
+ * objects (MemoryStore.anchors hands out entry.cmb) and the incoming record the frame handler
+ * goes on to surface or store, so a vector attached in place stayed on them and was written to
+ * disk by the next persist of that entry, though a record carries no vector (§7.1).
+ *
+ * Only text is read, so a vector that arrived on the wire never reaches the measurement: a
+ * category with no text has no entry here at all, whatever the sender attached to it.
  */
-async function localiseVectors(categories, useSemantic) {
-  if (!categories) return;
+async function localisedCategories(categories, useSemantic) {
+  const out = {};
+  if (!categories) return out;
   for (const category of CAT7_CATEGORIES) {
     const f = categories[category];
-    if (!f || typeof f !== 'object') continue;
-    delete f.vector;
-    if (f.text) f.vector = await _localVector(category, f.text, useSemantic);
+    if (!f || typeof f !== 'object' || !f.text) continue;
+    out[category] = { text: f.text, vector: await _localVector(category, f.text, useSemantic) };
   }
+  return out;
 }
 
 /**
@@ -484,10 +489,19 @@ async function _processHeuristicSVAF(opts) {
   // categoryKey either, so it is equally unsigned and equally alterable. Gating trust on an
   // attacker-supplied label tells the attacker which value to write.
   const useSemantic = isSemanticReady();
-  await localiseVectors(incomingCMB.categories, useSemantic);
-  for (const anchor of anchors) await localiseVectors(anchor.categories, useSemantic);
+  const incomingCategories = await localisedCategories(incomingCMB.categories, useSemantic);
+  // Each anchor is measured through a view holding only what computeCategoryDrifts reads, so the
+  // stored record it came from is never touched.
+  const anchorViews = [];
+  for (const anchor of anchors) {
+    anchorViews.push({
+      storedAt: anchor.storedAt,
+      confidence: anchor.confidence,
+      categories: await localisedCategories(anchor.categories, useSemantic),
+    });
+  }
 
-  const dr = computeCategoryDrifts({ incomingCategories: incomingCMB.categories, anchors, config, now, tau });
+  const dr = computeCategoryDrifts({ incomingCategories, anchors: anchorViews, config, now, tau });
   const categoryDrifts = dr.categoryDrifts;
   const nearestDrifts = dr.nearestDrifts;
   const fusedCategories = dr.fusedCategories;
diff --git a/tests/svaf-anchor-vectors.test.js b/tests/svaf-anchor-vectors.test.js
new file mode 100644
index 00000000..c3d8cc03
--- /dev/null
+++ b/tests/svaf-anchor-vectors.test.js
@@ -0,0 +1,68 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME to a temp sandbox before lib/config loads
+
+/**
+ * The SVAF gate measures with receiver-local vectors, and those vectors must never land on a record.
+ *
+ * A record carries no vector (§7.1; see the NO VECTOR note in createCMB): a vector is covered by
+ * neither the address nor the signature, so one written into a stored record is a value nobody can
+ * check, and it is served and re-read as if it were part of what the author said.
+ *
+ * The gate's anchors are the store's own cached records (MemoryStore.anchors returns entry.cmb),
+ * and the gate used to attach each category's vector to them IN PLACE. The vectors then sat on the
+ * cached record until the next write of that entry, which is routine: a peer remix citing the
+ * record advances its lifecycle and persists it. Every anchor the gate ever read was written back
+ * to disk with a vector on each category.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const path = require('path');
+const { tmpdir } = require('./_tmpdir');
+const { MemoryStore } = require('../lib/memory-store');
+const { createCMB, processHeuristicSVAF, CAT7_CATEGORIES } = require('../lib/core');
+
+const POLICY = { stableThreshold: 0.35, guardedThreshold: 0.75, temporalLambda: 0.3, freshnessSeconds: 3600 };
+
+function cat7(t) {
+  return {
+    focus: t, issue: t, intent: t, motivation: t, commitment: t,
+    perspective: 'observer', mood: { text: 'neutral', valence: 0, arousal: 0 },
+  };
+}
+
+function vectorCategories(record) {
+  return CAT7_CATEGORIES.filter((c) => record?.categories?.[c] && 'vector' in record.categories[c]);
+}
+
+describe('SVAF gate: anchors are measured, never written to', () => {
+  it('after a gate pass the store holds no vector, and the next persist writes none', async () => {
+    const dir = tmpdir('sym-svaf-anchor-vectors-');
+    const store = new MemoryStore(dir, 'receiver');
+    const anchor = store.write('anchor', { cmb: createCMB({ categories: cat7('the build pipeline caches artifacts per commit'), createdBy: 'receiver' }) });
+    const incoming = createCMB({ categories: cat7('the build pipeline caches artifacts per branch'), createdBy: 'peer' });
+
+    const now = Date.now();
+    const r = await processHeuristicSVAF({
+      msg: { type: 'cmb', cmb: incoming, content: 'incoming' },
+      peerName: 'peer', localName: 'receiver', originTs: now, now, ageSeconds: 0,
+      recentCMBs: store.recentCMBs(5), config: POLICY,
+    });
+    // Precondition: the gate really measured against the anchor rather than taking a cold-start exit.
+    assert.strictEqual(r.coldStartCause, undefined, 'the anchor was consulted');
+    assert.ok(Object.values(r.categoryVerdicts).some((v) => v !== 'silent'), 'at least one category was graded against it');
+
+    assert.deepStrictEqual(vectorCategories(store.get(anchor.key).cmb), [], 'the cached anchor record carries no vector');
+    assert.deepStrictEqual(vectorCategories(incoming), [], 'the incoming record the gate was handed carries no vector');
+
+    // The routine write that used to carry the vectors to disk: a peer remix citing the anchor
+    // advances the anchor's lifecycle, which persists the anchor's whole entry.
+    const remix = createCMB({ categories: cat7('a remix that cites the cached anchor'), createdBy: 'peer', lineage: { parents: [anchor.key], method: 'test' } });
+    assert.ok(store.receiveFromPeer('peer', { content: 'remix', cmb: remix }), 'the remix is stored');
+    const onDisk = JSON.parse(fs.readFileSync(path.join(dir, `${anchor.key}.json`), 'utf8'));
+    assert.strictEqual(onDisk.lifecycle, 'remixed', 'precondition: the anchor entry was persisted again');
+    assert.deepStrictEqual(vectorCategories(onDisk.cmb), [], 'the persisted anchor carries no vector');
+  });
+});

From 4092a8f4a70226c49390c898b83cb8719dd26471 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 19:04:56 +0100
Subject: [PATCH 027/148] svaf: cache each vector under the kernel that
 produced it
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The gate chose its encoder once, at its start (isSemanticReady), but named
each embedding-cache entry by kernelId() read at lookup time. The semantic
encoder loads asynchronously while a node runs, so a gate that started
lexical and was still encoding when it finished filed lexical vectors under
the semantic kernel's name, and every later gate was served them as semantic
vectors for as long as they stayed cached.

context-encoder gains svafKernel(): the kernel in force now, pinned, as one
value carrying its §15.8 id and an encoder bound to that same kernel.
kernelId() and encodeForSVAF() are defined through it. The gate pins one
kernel for its whole run and _localVector keys and encodes with it, so the
id in the key is the producer by construction.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 lib/core/context-encoder.js     | 42 +++++++++++----
 lib/core/svaf-baseline.js       | 29 ++++++----
 tests/svaf-kernel-cache.test.js | 95 +++++++++++++++++++++++++++++++++
 3 files changed, 145 insertions(+), 21 deletions(-)
 create mode 100644 tests/svaf-kernel-cache.test.js

diff --git a/lib/core/context-encoder.js b/lib/core/context-encoder.js
index ffc1cab4..162039c9 100644
--- a/lib/core/context-encoder.js
+++ b/lib/core/context-encoder.js
@@ -119,17 +119,20 @@ function loadSemanticEncoder() {
 }
 
 /**
- * Encode text using semantic embeddings (async).
+ * Encode text with a given semantic pipeline (async). The pipeline and its dimensionality are
+ * arguments rather than module state so a pinned kernel (svafKernel) encodes with exactly the
+ * pipeline it names.
+ * @param {Function} pipe - the feature-extraction pipeline.
+ * @param {number} dim - the dimensionality of each half.
  * @param {string} text
  * @returns {Promise<{ h1: number[], h2: number[] }>}
  */
-async function encodeSemantic(text) {
-  if (!_semanticEncoder) return encodeNgram(text);
-  const result = await _semanticEncoder(text, { pooling: 'mean', normalize: true });
+async function encodeWith(pipe, dim, text) {
+  const result = await pipe(text, { pooling: 'mean', normalize: true });
   const data = Array.from(result.data);
   return {
-    h1: data.slice(0, _semanticDim),
-    h2: data.slice(_semanticDim),
+    h1: data.slice(0, dim),
+    h2: data.slice(dim),
   };
 }
 
@@ -155,8 +158,7 @@ function encode(text) {
  * @returns {Promise<{ h1: number[], h2: number[] }>}
  */
 async function encodeForSVAF(text) {
-  if (_semanticReady) return encodeSemantic(text);
-  return encodeNgram(text);
+  return svafKernel().encode(text);
 }
 
 /**
@@ -164,6 +166,26 @@ async function encodeForSVAF(text) {
  */
 function isSemanticReady() { return _semanticReady; }
 
+/**
+ * The kernel SVAF encodes in right now, PINNED: its §15.8 identity and an encoder that keeps using
+ * that kernel for as long as the caller holds it.
+ *
+ * The semantic encoder finishes loading while a node runs, so an evaluation that reads the kernel
+ * identity and encodes in separate steps can name one kernel and encode in the other. One value
+ * carrying both makes that unrepresentable: whatever `encode` returns was produced by the kernel
+ * `id` names, even if the switch lands while the caller is still encoding.
+ *
+ * @returns {{ id: string, encode: (text: string) => Promise<{ h1: number[], h2: number[] }> }}
+ */
+function svafKernel() {
+  if (_semanticReady) {
+    const pipe = _semanticEncoder;
+    const dim = _semanticDim;
+    return { id: `minilm-l6-v2-h${dim}`, encode: (text) => encodeWith(pipe, dim, text) };
+  }
+  return { id: `ngram-h${DIM}`, encode: async (text) => encodeNgram(text) };
+}
+
 /**
  * MMP §15.8 kernel identity: a short stable token naming the encoder and the
  * comparison dimensionality this node's φ-space judgements are made in.
@@ -172,10 +194,10 @@ function isSemanticReady() { return _semanticReady; }
  * @returns {string}
  */
 function kernelId() {
-  return _semanticReady ? `minilm-l6-v2-h${_semanticDim}` : `ngram-h${DIM}`;
+  return svafKernel().id;
 }
 
 // Auto-load semantic encoder at import time
 loadSemanticEncoder();
 
-module.exports = { encode, encodeForSVAF, isSemanticReady, kernelId, DIM };
+module.exports = { encode, encodeForSVAF, isSemanticReady, kernelId, svafKernel, DIM };
diff --git a/lib/core/svaf-baseline.js b/lib/core/svaf-baseline.js
index a7dc9cdb..49959706 100644
--- a/lib/core/svaf-baseline.js
+++ b/lib/core/svaf-baseline.js
@@ -21,8 +21,8 @@
  * @license Apache-2.0
  */
 
-const { createCMB, renderContent: renderCMB, cosineSimilarity, l2Normalize, CAT7_CATEGORIES, categoryKeyV1, encodeCategory, blockKeyV2 } = require('./cmb-encoder');
-const { encodeForSVAF, isSemanticReady, kernelId } = require('./context-encoder');
+const { createCMB, renderContent: renderCMB, cosineSimilarity, l2Normalize, CAT7_CATEGORIES, categoryKeyV1, blockKeyV2 } = require('./cmb-encoder');
+const { svafKernel } = require('./context-encoder');
 const { evaluateLineageTetherFromText } = require('./lineage-tether');
 
 /** Per-category admission verdicts — the first-class gating output (MMP §9.2). */
@@ -104,16 +104,20 @@ function computeCategoryVerdicts(categoryDrifts, config, nearestDrifts) {
  * twice, not a coincidence.
  *
  * The kernel is part of the key because a semantic and an n-gram encoding of the same text are
- * different vectors and must never be served for one another.
+ * different vectors and must never be served for one another. The kernel named in the key is the
+ * one that PRODUCED the vector: `kernel` is a pinned svafKernel(), whose id and encoder are one
+ * value. The key used to be read from the kernel in force at lookup time while the encoder had been
+ * chosen at the start of the gate, so a gate still encoding when the semantic encoder finished
+ * loading filed lexical vectors under the semantic kernel's name, and later gates were served them.
  */
 const _embedCache = new Map();
 const _EMBED_CACHE_MAX = 4096;
 
-async function _localVector(categoryName, text, useSemantic) {
-  const k = `${kernelId()}|${categoryKeyV1(categoryName, text)}`;
+async function _localVector(categoryName, text, kernel) {
+  const k = `${kernel.id}|${categoryKeyV1(categoryName, text)}`;
   const hit = _embedCache.get(k);
   if (hit) return hit;
-  const v = useSemantic ? (await encodeForSVAF(text)).h1 : encodeCategory(text);
+  const v = (await kernel.encode(text)).h1;
   if (_embedCache.size >= _EMBED_CACHE_MAX) _embedCache.delete(_embedCache.keys().next().value);
   _embedCache.set(k, v);
   return v;
@@ -131,13 +135,13 @@ async function _localVector(categoryName, text, useSemantic) {
  * Only text is read, so a vector that arrived on the wire never reaches the measurement: a
  * category with no text has no entry here at all, whatever the sender attached to it.
  */
-async function localisedCategories(categories, useSemantic) {
+async function localisedCategories(categories, kernel) {
   const out = {};
   if (!categories) return out;
   for (const category of CAT7_CATEGORIES) {
     const f = categories[category];
     if (!f || typeof f !== 'object' || !f.text) continue;
-    out[category] = { text: f.text, vector: await _localVector(category, f.text, useSemantic) };
+    out[category] = { text: f.text, vector: await _localVector(category, f.text, kernel) };
   }
   return out;
 }
@@ -488,8 +492,11 @@ async function _processHeuristicSVAF(opts) {
   // kernelId gating was the tempting cheap fix and it is not a fix: kernelId is not in the
   // categoryKey either, so it is equally unsigned and equally alterable. Gating trust on an
   // attacker-supplied label tells the attacker which value to write.
-  const useSemantic = isSemanticReady();
-  const incomingCategories = await localisedCategories(incomingCMB.categories, useSemantic);
+  //
+  // ONE kernel for the whole gate (§9.2.1: drift is meaningful only within a pinned encoder), held
+  // even if the semantic encoder finishes loading while this gate is still encoding.
+  const kernel = svafKernel();
+  const incomingCategories = await localisedCategories(incomingCMB.categories, kernel);
   // Each anchor is measured through a view holding only what computeCategoryDrifts reads, so the
   // stored record it came from is never touched.
   const anchorViews = [];
@@ -497,7 +504,7 @@ async function _processHeuristicSVAF(opts) {
     anchorViews.push({
       storedAt: anchor.storedAt,
       confidence: anchor.confidence,
-      categories: await localisedCategories(anchor.categories, useSemantic),
+      categories: await localisedCategories(anchor.categories, kernel),
     });
   }
 
diff --git a/tests/svaf-kernel-cache.test.js b/tests/svaf-kernel-cache.test.js
new file mode 100644
index 00000000..38533122
--- /dev/null
+++ b/tests/svaf-kernel-cache.test.js
@@ -0,0 +1,95 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME to a temp sandbox before lib/config loads
+
+/**
+ * The gate's embedding cache must file every vector under the kernel that produced it.
+ *
+ * The semantic encoder loads asynchronously and replaces the lexical one while a node runs. The
+ * gate picked its encoder once, at its start, but named each cache entry by the kernel in force at
+ * the moment of the lookup. A gate that started lexical and was still encoding when the semantic
+ * encoder finished loading therefore cached lexical vectors under the semantic kernel's name, and
+ * every later gate was served them as semantic ones: two unrelated spaces compared as one, for as
+ * long as the entries stayed in the cache.
+ *
+ * The switch is injected by standing a fake context-encoder in for the real one, the same seam
+ * lineage-tether-reproducible uses, so the moment it lands is exact rather than a race.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const { CAT7_CATEGORIES, createCMB } = require('../lib/core');
+
+const POLICY = { stableThreshold: 0.35, guardedThreshold: 0.75, temporalLambda: 0.3, freshnessSeconds: 3600 };
+
+/** Distinct text in every category, so each category's encode can be told apart. */
+function cat7(prefix) {
+  const c = {};
+  for (const f of CAT7_CATEGORIES) c[f] = `${prefix} ${f}`;
+  c.mood = { text: `${prefix} mood`, valence: 0, arousal: 0 };
+  return c;
+}
+
+/**
+ * A context-encoder whose semantic kernel becomes ready when the test says so. Its semantic encoder
+ * maps every text to the same unit vector, so in that kernel any two records are paraphrases, and
+ * it records each text it is asked to encode.
+ */
+function fakeEncoder(real) {
+  const state = { semantic: false, semanticTexts: [] };
+  const LEX = 'ngram-h32';
+  const SEM = 'fake-semantic-h32';
+  const unit = Array.from({ length: real.DIM }, (_, i) => (i === 0 ? 1 : 0));
+  const semantic = async (text) => { state.semanticTexts.push(text); return { h1: unit.slice(), h2: [] }; };
+  const lexical = async (text) => real.encode(text);
+  const exports = {
+    ...real,
+    isSemanticReady: () => state.semantic,
+    kernelId: () => (state.semantic ? SEM : LEX),
+    encodeForSVAF: (text) => (state.semantic ? semantic(text) : lexical(text)),
+    svafKernel: () => (state.semantic ? { id: SEM, encode: semantic } : { id: LEX, encode: lexical }),
+  };
+  return { state, exports };
+}
+
+describe('SVAF embedding cache: keyed by the kernel that produced the vector', () => {
+  it('a gate that straddles the encoder switch does not poison the semantic kernel', async () => {
+    const ctxPath = require.resolve('../lib/core/context-encoder');
+    const sbPath = require.resolve('../lib/core/svaf-baseline');
+    const realCtx = require.cache[ctxPath];
+    const realSb = require.cache[sbPath];
+    const fake = fakeEncoder(realCtx.exports);
+    try {
+      require.cache[ctxPath] = { id: ctxPath, filename: ctxPath, loaded: true, exports: fake.exports };
+      delete require.cache[sbPath];
+      const { processHeuristicSVAF } = require(sbPath); // a fresh gate, with a fresh cache, on the fake encoder
+
+      const now = Date.now();
+      const gate = (cmb, recentCMBs) => processHeuristicSVAF({
+        msg: { type: 'cmb', cmb, content: 'incoming' },
+        peerName: 'peer', localName: 'receiver', originTs: now, now, ageSeconds: 0, recentCMBs, config: POLICY,
+      });
+
+      // Gate 1 starts while only the lexical kernel exists. Its synchronous prefix runs inside the
+      // call, so flipping the flag right after it returns lands the switch mid-gate.
+      const pending = gate(createCMB({ categories: cat7('incoming'), createdBy: 'peer' }), []);
+      fake.state.semantic = true;
+      await pending;
+
+      // Gate 2 runs wholly in the semantic kernel, on the same incoming text, against an anchor whose
+      // text has never been encoded.
+      fake.state.semanticTexts.length = 0;
+      const anchor = createCMB({ categories: cat7('anchor'), createdBy: 'receiver' });
+      const r = await gate(createCMB({ categories: cat7('incoming'), createdBy: 'peer' }), [anchor]);
+
+      const encoded = new Set(fake.state.semanticTexts);
+      const missed = CAT7_CATEGORIES.filter((f) => !encoded.has(f === 'mood' ? 'incoming mood' : `incoming ${f}`));
+      assert.deepStrictEqual(missed, [],
+        'every incoming category was encoded by the semantic kernel, never served a lexical vector cached under its name');
+      assert.strictEqual(r.decision, 'redundant', 'in the semantic kernel the two records are indistinguishable');
+    } finally {
+      require.cache[ctxPath] = realCtx;
+      require.cache[sbPath] = realSb;
+    }
+  });
+});

From 300ae7379c2b9377e9cdcd1660411c96700adbc9 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 19:07:22 +0100
Subject: [PATCH 028/148] store: keep the record as signed; the expanded
 lineage lives on the entry
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

write() and receiveFromPeer() stored `{ ...cmb, lineage }`, copying the
store's expanded lineage (parents plus a locally computed ancestor closure)
onto the record as a top-level member. A two-section record has exactly
`categories` and `metadata` (§8.8.1) and its lineage is metadata.lineage, so
the extra member read as the pre-boundary shape: classifyAddress took its
parents as the record's, tried only the remix derivation, and reported every
stored v2 remix as a mismatch though the record was untouched.

The store now keeps the record as given; the entry already carries the same
lineage, which is where the closure belongs. Files written by earlier
versions hold the stapled member, so every read of a store file (first-touch
index build, load(), _load) drops it from two-section records. A pre-boundary
record keeps its top-level lineage, which on that shape is its own section.
classifyAddress was right for the shape it was given and is unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 lib/memory-store.js                         | 35 +++++++--
 tests/memory-store-record-as-signed.test.js | 85 +++++++++++++++++++++
 2 files changed, 115 insertions(+), 5 deletions(-)
 create mode 100644 tests/memory-store-record-as-signed.test.js

diff --git a/lib/memory-store.js b/lib/memory-store.js
index 50dd11a3..ef349027 100644
--- a/lib/memory-store.js
+++ b/lib/memory-store.js
@@ -33,6 +33,28 @@ const { roleRank } = require('./core');
 /** A stored record file: every .json in the store except the one-off migration marker. */
 const isStoreFile = (f) => f.endsWith('.json') && f !== 'migration-v1.json';
 
+/**
+ * A stored entry as read from disk, its record restored to exactly what was signed.
+ *
+ * Stores before 0.13.15 wrote the store's expanded lineage onto every record as a top-level
+ * `lineage` member. A two-section record has no such member (§8.8.1: `categories` and `metadata`,
+ * lineage in metadata.lineage), and readers that take a top-level lineage as the record's own (the
+ * pre-boundary shape, e.g. classifyAddress) derived the wrong address from it and reported the
+ * record as a mismatch. The entry carries the same lineage on itself, which is where the store's
+ * closure belongs, so dropping the copy loses nothing. A pre-boundary record (no metadata) keeps
+ * its top-level lineage: on that shape it is the record's own section.
+ */
+function asStored(entry) {
+  const cmb = entry && entry.cmb;
+  if (cmb && typeof cmb === 'object' && cmb.metadata && typeof cmb.metadata === 'object'
+      && Object.prototype.hasOwnProperty.call(cmb, 'lineage')) {
+    const record = { ...cmb };
+    delete record.lineage;
+    entry.cmb = record;
+  }
+  return entry;
+}
+
 class MemoryIndex {
   /** Create an empty index. */
   constructor() {
@@ -184,7 +206,7 @@ class MemoryStore {
         const slice = files.slice(i, i + batch);
         const parsed = await Promise.all(slice.map(async (file) => {
           const filePath = path.join(this._dir, file);
-          try { return { filePath, entry: JSON.parse(await fs.promises.readFile(filePath, 'utf8')) }; }
+          try { return { filePath, entry: asStored(JSON.parse(await fs.promises.readFile(filePath, 'utf8'))) }; }
           catch (e) { console.error(`[SYM] cmbs: failed to index ${file}: ${e.message}`); return null; }
         }));
         for (const p of parsed) {
@@ -242,7 +264,9 @@ class MemoryStore {
       peerId: null,
       tier: 'hot',
       lifecycle: 'observed',
-      cmb: cmb ? { ...cmb, lineage } : null,
+      // The record as signed. The store's expanded lineage goes on the entry, never into the record:
+      // a two-section record has exactly two members (§8.8.1).
+      cmb: cmb ? { ...cmb } : null,
       lineage,
     };
 
@@ -299,7 +323,8 @@ class MemoryStore {
       lifecycle: 'observed',
       anchorWeight: isValidatorOrigin ? 2.0 : 1.0,
       storedAt: now,
-      cmb: cmb ? { ...cmb, lineage } : null,
+      // The record as signed; the store's expanded lineage lives on the entry (see write()).
+      cmb: cmb ? { ...cmb } : null,
       lineage,
     };
 
@@ -842,7 +867,7 @@ class MemoryStore {
 
   _load(filePath) {
     try {
-      return JSON.parse(fs.readFileSync(filePath, 'utf8'));
+      return asStored(JSON.parse(fs.readFileSync(filePath, 'utf8')));
     } catch {
       return null;
     }
@@ -855,7 +880,7 @@ class MemoryStore {
     for (const file of files) {
       const filePath = path.join(this._dir, file);
       try {
-        const entry = JSON.parse(fs.readFileSync(filePath, 'utf8'));
+        const entry = asStored(JSON.parse(fs.readFileSync(filePath, 'utf8')));
         this._cache.set(entry.key, entry);
         this._index.add(this._indexEntryFor(entry, filePath));
       } catch (e) {
diff --git a/tests/memory-store-record-as-signed.test.js b/tests/memory-store-record-as-signed.test.js
new file mode 100644
index 00000000..5a8cdfa8
--- /dev/null
+++ b/tests/memory-store-record-as-signed.test.js
@@ -0,0 +1,85 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME to a temp sandbox before lib/config loads
+
+/**
+ * The store keeps a record exactly as it was signed. What the store needs for itself lives on the
+ * entry that wraps the record, never inside it.
+ *
+ * Both write paths stored `{ ...cmb, lineage }`: the store's expanded lineage (direct parents plus a
+ * locally computed ancestor closure) copied onto the record as a top-level member. A two-section
+ * record has exactly two members, `categories` and `metadata`, and its lineage lives in
+ * metadata.lineage (§8.8.1). The third member read as the pre-boundary shape, so classifyAddress
+ * took its parents as the record's, derived a remix address, and reported every stored v2 remix as
+ * a MISMATCH, which reads as tampering, though the record was untouched.
+ *
+ * Stores written before the fix hold that member on disk, so reading must drop it as well.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const path = require('path');
+const { tmpdir } = require('./_tmpdir');
+const { MemoryStore } = require('../lib/memory-store');
+const { createCMB, classifyAddress } = require('../lib/core');
+
+function cat7(t) {
+  return {
+    focus: t, issue: t, intent: t, motivation: t, commitment: t,
+    perspective: 'observer', mood: { text: 'neutral', valence: 0, arousal: 0 },
+  };
+}
+
+function remixOf(parentKey, text) {
+  return createCMB({ categories: cat7(text), createdBy: 'peer', lineage: { parents: [parentKey], method: 'svaf-heuristic' } });
+}
+
+describe('MemoryStore keeps the record as signed', () => {
+  it('a stored v2 remix is the two-section record and classifies as verified', () => {
+    const store = new MemoryStore(tmpdir('sym-store-as-signed-'), 'receiver');
+    const root = store.write('root', { cmb: createCMB({ categories: cat7('the root block'), createdBy: 'receiver' }) });
+    const remix = remixOf(root.key, 'a remix of the root block');
+    assert.strictEqual(classifyAddress(remix).state, 'verified', 'precondition: the record verifies as signed');
+
+    const received = store.receiveFromPeer('peer', { content: 'remix', cmb: remix });
+    const written = store.write('local remix', { cmb: remixOf(root.key, 'a local remix of the root block') });
+    for (const [label, entry] of [['receiveFromPeer', received], ['write', written]]) {
+      const cmb = store.get(entry.key).cmb;
+      assert.deepStrictEqual(classifyAddress(cmb), { state: 'verified', scheme: 'block-v2', reason: null }, `${label}: the stored remix verifies`);
+      assert.deepStrictEqual(Object.keys(cmb).sort(), ['categories', 'metadata'], `${label}: exactly the two sections`);
+      assert.deepStrictEqual(cmb.metadata.lineage.parents, [root.key], `${label}: its own lineage, as signed`);
+      // The store's closure is still kept, on the entry.
+      assert.deepStrictEqual(entry.lineage.ancestors, [root.key], `${label}: the entry carries the store's closure`);
+      assert.deepStrictEqual(store.ancestors(entry.key), [root.key], `${label}: and the index walks from it`);
+    }
+  });
+
+  it('a store file written before the fix reads back as the record it was signed as', async () => {
+    const dir = tmpdir('sym-store-legacy-staple-');
+    const root = createCMB({ categories: cat7('the root block'), createdBy: 'peer' });
+    const remix = remixOf(root.metadata.key, 'a remix of the root block');
+    const lineage = { parents: [root.metadata.key], ancestors: [root.metadata.key], method: 'svaf-heuristic' };
+    // The exact shape receiveFromPeer used to persist.
+    const stale = { key: remix.metadata.key, content: 'remix', peerId: 'peer', tier: 'hot', lifecycle: 'observed', storedAt: Date.now(), cmb: { ...remix, lineage }, lineage };
+    fs.writeFileSync(path.join(dir, `${stale.key}.json`), JSON.stringify(stale, null, 2));
+    assert.strictEqual(classifyAddress(stale.cmb).state, 'mismatch', 'precondition: the stapled member is what misclassified it');
+
+    // Both ways a store builds its index: on first touch (synchronous) and through load().
+    const syncStore = new MemoryStore(dir, 'receiver');
+    const asyncStore = new MemoryStore(dir, 'receiver');
+    await asyncStore.load();
+    for (const [label, store] of [['first touch', syncStore], ['load()', asyncStore]]) {
+      const entry = store.get(stale.key);
+      assert.strictEqual(classifyAddress(entry.cmb).state, 'verified', `${label}: the stored remix verifies`);
+      assert.deepStrictEqual(Object.keys(entry.cmb).sort(), ['categories', 'metadata'], `${label}: the stapled member is gone`);
+      assert.deepStrictEqual(store.ancestors(stale.key), [root.metadata.key], `${label}: the closure still comes from the entry`);
+    }
+
+    // Compaction re-reads the file and writes it back; what it writes is the record as signed.
+    syncStore.compact(-1);
+    const rewritten = JSON.parse(fs.readFileSync(path.join(dir, `${stale.key}.json`), 'utf8'));
+    assert.strictEqual(rewritten.tier, 'cold', 'precondition: compaction rewrote the file');
+    assert.deepStrictEqual(Object.keys(rewritten.cmb).sort(), ['categories', 'metadata'], 'the rewritten file holds the record as signed');
+  });
+});

From c4d123ec8b51cb73cf4aac735f924533a13d3366 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 19:09:01 +0100
Subject: [PATCH 029/148] tether audit: read the store's lineage closure, not
 the record's
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The audit picked fetch candidates from, and unhooked severed remixes by,
recordLineage(cmb).ancestors. That held the store's closure only while the
store stapled a copy onto the record; on a two-section record it reads
metadata.lineage, which carries direct parents only, or, from a
non-conformant sender, an `ancestors` list the sender chose (§7.5: never
carried, never trusted). So a severed remix stayed in the descendant set of
every ancestor beyond its parents, keeping them hot and unpurgeable, and a
sender's list chose what the audit fetched as the anchor. With the store no
longer stapling, pre-boundary records would have gone the same way.

Fetch candidates now come from the store's index (store.ancestors), and
severance goes through a new MemoryStore.unlinkLineage(key), which leaves
the index exactly as a rebuild from the severed entry would.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 lib/memory-store.js                | 16 +++++++++
 lib/node.js                        | 11 ++++---
 tests/lineage-tether-audit.test.js | 52 ++++++++++++++++++++++++++++++
 3 files changed, 74 insertions(+), 5 deletions(-)

diff --git a/lib/memory-store.js b/lib/memory-store.js
index ef349027..d6f210dd 100644
--- a/lib/memory-store.js
+++ b/lib/memory-store.js
@@ -494,6 +494,22 @@ class MemoryStore {
     return this._index.get(key)?.parents || [];
   }
 
+  /**
+   * Make a stored entry a root in the index after its lineage was severed (§15.8): drop it from the
+   * descendant set of every ancestor it was indexed under, and clear its own parents and ancestors.
+   * This is exactly what rebuilding the index from the severed entry produces, applied now rather
+   * than at the next start; until then the severed remix kept its old ancestors hot and unpurgeable.
+   * The caller clears the record's lineage and the entry's, and persists.
+   * @param {string} key
+   */
+  unlinkLineage(key) {
+    const idx = this._index.get(key);
+    if (!idx) return;
+    for (const a of idx.ancestors || []) this._index.byAncestor.get(a)?.delete(key);
+    idx.parents = [];
+    idx.ancestors = [];
+  }
+
   // ── Search (user-facing) ─────────────────────────────────
 
   /**
diff --git a/lib/node.js b/lib/node.js
index 7b2f5c7d..5fee424c 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -1,6 +1,6 @@
 'use strict';
 
-const { recordKey, recordCreatedBy, recordCreatedAt, recordLineage, recordParents, setRecordLineage } = require('./record');
+const { recordKey, recordCreatedBy, recordCreatedAt, recordParents, setRecordLineage } = require('./record');
 
 /**
  * SymNode — sovereign mesh node with cognitive coupling.
@@ -717,8 +717,10 @@ class SymNode extends EventEmitter {
       const anchor = resolveTetherAnchor(cmb, (k) => (k === entry.key ? undefined : this._store.get(k)));
       if (anchor.resolvedFromStore) { anchorCategories = anchor.categories; anchorKey = anchor.key; }
       if (!anchorCategories && opts.fetch === true) {
-        const anc = recordLineage(cmb)?.ancestors;
-        for (const k of (anc?.length ? anc : parents)) {
+        // The store's own closure, from its index. The record carries direct parents only (§7.5);
+        // an `ancestors` list on it is the sender's claim and must not choose what is fetched.
+        const anc = this._store.ancestors(entry.key);
+        for (const k of (anc.length ? anc : parents)) {
           // A key this store holds was already judged by the verified walk above, and fetchCMB
           // answers from the store first — it would hand back the record that walk refused.
           if (this._store.get(k)) continue;
@@ -755,10 +757,9 @@ class SymNode extends EventEmitter {
       } else {
         report.failedFloor++;
         if (applySever) {
-          const oldAncestors = recordLineage(cmb)?.ancestors || parents;
           setRecordLineage(cmb, null);   // clears the section the record ACTUALLY carries
           entry.lineage = null;
-          for (const a of oldAncestors) this._store._index.byAncestor?.get(a)?.delete(entry.key);
+          this._store.unlinkLineage(entry.key);
           report.severed++;
           this._log(`[§15.8 audit] lineage severed: ${String(entry.key).slice(0, 16)}… drift ${ev.drift.toFixed(3)} from anchor ${String(anchorKey).slice(0, 16)}…`);
           this.emit('metric', { type: 'lineage-tether-severed', key: entry.key, anchor: anchorKey, drift: ev.drift, audit: true });
diff --git a/tests/lineage-tether-audit.test.js b/tests/lineage-tether-audit.test.js
index 03f58301..e6816d58 100644
--- a/tests/lineage-tether-audit.test.js
+++ b/tests/lineage-tether-audit.test.js
@@ -145,4 +145,56 @@ describe('MMP §15.8 retroactive tether audit', () => {
       fs.rmSync(nodeDir(name), { recursive: true, force: true });
     }
   });
+
+  // The audit's knowledge of a remix's ancestry is the store's own closure, held on the entry and in
+  // its index. It used to read the closure off the RECORD, which held it only because the store
+  // stapled a copy there. On a two-section record the read found metadata.lineage instead, which
+  // carries direct parents only, or, from a non-conformant sender, an `ancestors` list the sender
+  // chose (§7.5: never carried, never trusted).
+  it('sever: the remix is unhooked from every ancestor the store indexed it under', async () => {
+    const name = `audit-unhook-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+    const node = new SymNode({ name, silent: true, discovery: new NullDiscovery() });
+    await node.start();
+    try {
+      await awaitSemantic();
+      const root = node.remember(cat7(TOPIC_A));
+      // A faithful hop, admitted from a verified peer, then a laundered hop citing it.
+      const hop = createCMB({ categories: cat7(`${TOPIC_A} for the second quarter`), createdBy: 'peer', lineage: { parents: [root.key], method: 'SVAF-v2' } });
+      node._store.receiveFromPeer('peer', { key: hop.metadata.key, content: 'hop', source: 'peer', cmb: hop, _cmbVerified: true });
+      const laundered = createCMB({ categories: cat7(TOPIC_B2), createdBy: 'peer', lineage: { parents: [hop.metadata.key], method: 'SVAF-v2' } });
+      node._store.receiveFromPeer('peer', { key: laundered.metadata.key, content: 'laundered', source: 'peer', cmb: laundered, _cmbVerified: true });
+      assert.ok(node._store.descendants(root.key).includes(laundered.metadata.key), 'precondition: indexed under the root through the hop');
+
+      const r = await node.auditLineageTethers({ sever: true });
+      assert.strictEqual(r.severed, 1, 'the laundered hop is severed');
+      for (const [label, k] of [['the hop', hop.metadata.key], ['the root', root.key]]) {
+        assert.ok(!node._store.descendants(k).includes(laundered.metadata.key), `no longer a descendant of ${label}`);
+      }
+      assert.deepStrictEqual(node._store.ancestors(laundered.metadata.key), [], 'a severed remix is a root in the index');
+      assert.deepStrictEqual(node._store.parents(laundered.metadata.key), []);
+    } finally {
+      await node.stop();
+      fs.rmSync(nodeDir(name), { recursive: true, force: true });
+    }
+  });
+
+  it('fetch: the candidates are the store\'s closure, never an ancestors list the record carries', async () => {
+    const name = `audit-anc-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+    const node = new SymNode({ name, silent: true, discovery: new NullDiscovery() });
+    await node.start();
+    try {
+      const parent = 'cmb-' + 'a'.repeat(64);
+      const chosen = 'cmb-' + 'b'.repeat(64);
+      const cmb = createCMB({ categories: cat7(TOPIC_B), createdBy: 'peer' });
+      cmb.metadata.lineage = { parents: [parent], ancestors: [chosen], method: 'SVAF-v2' };
+      node._store.receiveFromPeer('peer', { key: cmb.metadata.key, content: TOPIC_B, source: 'peer', cmb });
+      const asked = [];
+      node.fetchCMB = async (k) => { asked.push(k); return null; };
+      await node.auditLineageTethers({ fetch: true, timeoutMs: 50 });
+      assert.deepStrictEqual(asked, [parent], 'only the parent the store derived its closure from is fetched');
+    } finally {
+      await node.stop();
+      fs.rmSync(nodeDir(name), { recursive: true, force: true });
+    }
+  });
 });

From c4ee1e9c766a2891db6270c2d5263aa1db2a2380 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 19:20:56 +0100
Subject: [PATCH 030/148] =?UTF-8?q?frame-handler:=20the=20neural=20admissi?=
 =?UTF-8?q?on=20path=20applies=20the=20=C2=A715.8=20tether?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The frame handler offers each inbound block to the injected Layer-4
evaluator first and runs the heuristic baseline only when it declines. The
heuristic path checked the inbound tether attestation, resolved the lineage
root, evaluated the stored record against it, severed a drifted chain and
signed a tether attestation. The neural path did none of it: a remix the
neural evaluator admitted kept a laundered lineage, carried no attestation,
and kept whatever attestation its sender attached. Dormant in a stock
install (models/svaf_v2.pt is not shipped), but any consumer injecting an
evaluator got a node that never applied §15.8.

Both paths now share the same steps: _prepareLineageTether (inbound
attestation check and anchor resolution), tetherOfRecord (moved from the
heuristic engine to lineage-tether and exported, so the engine and the
neural path run one computation), _applyLineageTether (severance,
provenance and the signed attestation) and _admissionPolicy (one policy
builder). The neural path stores the incoming record object itself, so it
drops the sender's attestation from it first, as the heuristic path's rebuilt
record never carries one. Also removes an unused read of the retired
`ancestors` field from the neural path.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 lib/core/lineage-tether.js          |  35 ++++-
 lib/core/svaf-baseline.js           |  27 +---
 lib/frame-handler.js                | 207 +++++++++++++++++-----------
 tests/lineage-tether-neural.test.js | 159 +++++++++++++++++++++
 4 files changed, 318 insertions(+), 110 deletions(-)
 create mode 100644 tests/lineage-tether-neural.test.js

diff --git a/lib/core/lineage-tether.js b/lib/core/lineage-tether.js
index 46fc4e3e..0332c7db 100644
--- a/lib/core/lineage-tether.js
+++ b/lib/core/lineage-tether.js
@@ -256,4 +256,37 @@ async function evaluateLineageTetherFromText({ remixCategories, anchorCategories
   return { kernelId: kernelId(), checked: false, tethered: true, drift: null, evaluableCategories: [] };
 }
 
-module.exports = { computeLineageTether, resolveTetherAnchor, storedRecordVerifies, evaluateLineageTetherFromText };
+/**
+ * MMP §15.8 lineage tether of the record an admission stores, against the anchor the caller
+ * resolved. The caller applies severance and signs the attestation; this only reports.
+ *
+ * ONE helper for every admission path. The heuristic engine calls it on the record it builds and
+ * the frame handler calls it on the record a neural evaluator admits, so the two gates cannot reach
+ * different tether verdicts on the same record and root; before it was shared the neural path
+ * evaluated no tether at all.
+ *
+ * Measured on the RECORD'S TEXT, never on the fused vectors. A fused vector is this receiver's
+ * attention readout over its own recent anchors (computeCategoryDrifts), so a tether taken on it
+ * measured how the remix sat in THIS node's memory — two integrators holding the same root and the
+ * same record signed different drifts, and nobody holding them could recompute either one. §15.8
+ * makes the tether content-only so that any holder of the root re-encodes its text and gets the
+ * number the integrator signed; the text of both records is all such a holder has.
+ *
+ * @param {object} recordCategories - the CAT7 categories of the record being stored.
+ * @param {object|undefined} tetherAnchor - the resolved anchor ({ key, categories }), if any.
+ * @param {object} config - the admission policy (categoryWeights, guardedThreshold).
+ * @returns {Promise<object|null>} null when no anchor was resolved (the tether is unverified).
+ */
+async function tetherOfRecord(recordCategories, tetherAnchor, config) {
+  if (!tetherAnchor || !tetherAnchor.categories) return null;
+  const ev = await evaluateLineageTetherFromText({
+    remixCategories: recordCategories,
+    anchorCategories: tetherAnchor.categories,
+    categoryWeights: config.categoryWeights,
+    guardedThreshold: config.guardedThreshold,
+  });
+  // §15.8 kernel identity rides in `ev.kernelId`: verdicts are comparable iff it matches.
+  return { anchorKey: tetherAnchor.key ?? null, ...ev };
+}
+
+module.exports = { computeLineageTether, resolveTetherAnchor, storedRecordVerifies, evaluateLineageTetherFromText, tetherOfRecord };
diff --git a/lib/core/svaf-baseline.js b/lib/core/svaf-baseline.js
index 49959706..5c0cd463 100644
--- a/lib/core/svaf-baseline.js
+++ b/lib/core/svaf-baseline.js
@@ -23,7 +23,7 @@
 
 const { createCMB, renderContent: renderCMB, cosineSimilarity, l2Normalize, CAT7_CATEGORIES, categoryKeyV1, blockKeyV2 } = require('./cmb-encoder');
 const { svafKernel } = require('./context-encoder');
-const { evaluateLineageTetherFromText } = require('./lineage-tether');
+const { tetherOfRecord } = require('./lineage-tether');
 
 /** Per-category admission verdicts — the first-class gating output (MMP §9.2). */
 const CATEGORY_VERDICT = Object.freeze({
@@ -245,31 +245,6 @@ function strippedOfVectors(categories) {
   return out;
 }
 
-/**
- * MMP §15.8 lineage tether of the record an admission stores, against the anchor the caller
- * resolved. The caller applies severance and signs the attestation; this only reports.
- *
- * Measured on the RECORD'S TEXT, never on the fused vectors. A fused vector is this receiver's
- * attention readout over its own recent anchors (computeCategoryDrifts), so a tether taken on it
- * measured how the remix sat in THIS node's memory — two integrators holding the same root and the
- * same record signed different drifts, and nobody holding them could recompute either one. §15.8
- * makes the tether content-only so that any holder of the root re-encodes its text and gets the
- * number the integrator signed; the text of both records is all such a holder has.
- *
- * @returns {Promise<object|null>} null when no anchor was resolved (the tether is unverified).
- */
-async function tetherOfRecord(recordCategories, tetherAnchor, config) {
-  if (!tetherAnchor || !tetherAnchor.categories) return null;
-  const ev = await evaluateLineageTetherFromText({
-    remixCategories: recordCategories,
-    anchorCategories: tetherAnchor.categories,
-    categoryWeights: config.categoryWeights,
-    guardedThreshold: config.guardedThreshold,
-  });
-  // §15.8 kernel identity rides in `ev.kernelId`: verdicts are comparable iff it matches.
-  return { anchorKey: tetherAnchor.key ?? null, ...ev };
-}
-
 /**
  * The per-category drift arithmetic (§9.2/§9.2.1), as a PURE function of already-encoded vectors.
  *
diff --git a/lib/frame-handler.js b/lib/frame-handler.js
index 300a9ea6..ab38ab8f 100644
--- a/lib/frame-handler.js
+++ b/lib/frame-handler.js
@@ -24,7 +24,7 @@ const { assertRecordSize } = require('./core/cmb-encoder');
 
 const fs = require('fs');
 const path = require('path');
-const { encode, DIM, processHeuristicSVAF, computeCategoryVerdicts, decryptCategories, blockKeyV2, resolveTetherAnchor, signTetherAttestation, verifyTetherAttestation, recomputeKey, classifyAddress } = require('./core');
+const { encode, DIM, processHeuristicSVAF, computeCategoryVerdicts, decryptCategories, blockKeyV2, resolveTetherAnchor, tetherOfRecord, signTetherAttestation, verifyTetherAttestation, recomputeKey, classifyAddress } = require('./core');
 
 // Receive-path dedup window (MMP §4.2 O2 — rejoin-without-replay convergence).
 // A CMB whose content-hash key we have already processed within this window is
@@ -1028,8 +1028,10 @@ class FrameHandler {
    * Process a successful neural SVAF result.
    * @private
    */
-  _processNeuralSVAF(result, msg, peerName, peerId, originTs, now) {
+  async _processNeuralSVAF(result, msg, peerName, peerId, originTs, now) {
     const { decision, total_drift, category_drifts, gate_values } = result;
+    // §15.8 runs on this path exactly as on the heuristic one: same inbound check, same anchor.
+    const tetherAnchor = this._prepareLineageTether(msg);
 
     // Record EVERY evaluation (admit AND reject). The autonomy IS the decision;
     // a rejection leaves no other trace, so this is where sovereignty is captured.
@@ -1076,7 +1078,6 @@ class FrameHandler {
 
     // Propagate lineage: fused CMB is a child of the incoming CMB
     const incomingKey = recordKey(msg.cmb) || msg.key;
-    const incomingAncestors = recordLineage(msg.cmb)?.ancestors || [];
 
     const fusedEntry = {
       ...msg,
@@ -1133,6 +1134,14 @@ class FrameHandler {
     }
     // Opaque payload rides alongside CAT7 — carry it onto the admitted remix.
     this._preserveIncomingPayload(fusedEntry, msg);
+    if (fusedEntry.cmb) {
+      // This path stores the incoming record object itself, so it still carries any attestation its
+      // sender attached. That one was an input, checked in _prepareLineageTether; the record this
+      // node stores carries its own evaluation or none, as the heuristic path's rebuilt record does.
+      delete fusedEntry.cmb.tether;
+      const tether = await tetherOfRecord(fusedEntry.cmb.categories, tetherAnchor, this._admissionPolicy());
+      this._applyLineageTether(fusedEntry, tether, now);
+    }
     // The admitted-path surface is the store's own cmb-accepted emit. The store returns null when
     // it already holds the key ('redundant') or the write failed ('not-stored'), and a directed CMB
     // then reached nobody: surface it. Everything after this runs exactly as for any admit.
@@ -1181,33 +1190,12 @@ class FrameHandler {
       && typeof this._node._store?.has === 'function'
       && recordParents(msg.cmb).some(p => this._node._store.has(p));
 
-    // Inbound §15.8 tether attestation: a re-emitted remix may carry its
-    // integrator's signed tether evaluation. Verify against the integrator's
-    // roster-resolved key. An INVALID one is stripped — a forged certificate
-    // is worse than an absent one; a valid-but-unverifiable one (no resolvable
-    // key) rides through unverified, the same posture as unsigned CMBs.
-    if (msg.cmb?.tether && typeof verifyTetherAttestation === 'function') {
-      const att = msg.cmb.tether;
-      const integKey = this._node._identityKey(att.by);
-      const v = verifyTetherAttestation(att, integKey);
-      msg._tetherAttested = v.valid === true;
-      if (v.signed && !v.valid && integKey) {
-        this._node._log(`[§15.8] inbound tether attestation INVALID from ${String(att.by).slice(0, 8)} — stripped`);
-        this._node.emit('metric', { type: 'tether-attestation-rejected', by: att.by, of: att.of });
-        delete msg.cmb.tether;
-      }
-    }
-
-    // MMP §15.8 lineage tether: resolve the earliest-stored resolvable lineage
-    // root of the incoming CMB (the incoming block itself when it is a root).
-    // The gate evaluates the remix against it in-kernel and reports; severance
-    // is applied below on the result.
-    const tetherAnchor = this._node._lineageTether && typeof resolveTetherAnchor === 'function'
-      ? resolveTetherAnchor(msg.cmb, (k) => this._node._store.get(k))
-      : null;
+    // MMP §15.8: the gate evaluates the remix against the resolved anchor in-kernel and reports;
+    // severance and the attestation are applied below on the result.
+    const tetherAnchor = this._prepareLineageTether(msg);
 
     const result = await this._admit({
-      tetherAnchor: tetherAnchor && tetherAnchor.categories ? tetherAnchor : undefined,
+      tetherAnchor,
       msg,
       peerName,
       localName: this._node.name,
@@ -1217,17 +1205,7 @@ class FrameHandler {
       groundingWaiver,
       recentCMBs: this._node._store.recentCMBs(5),
       recentDecisions: this._node._recentSvafDecisions,
-      config: {
-        stableThreshold: this._node._svafStableThreshold,
-        guardedThreshold: this._node._svafGuardedThreshold,
-        temporalLambda: this._node._svafTemporalLambda,
-        freshnessSeconds: this._node._svafFreshnessSeconds,
-        categoryWeights: this._node._svafCategoryWeights,
-        adaptiveTimescale: this._node._svafAdaptiveTimescale,
-        minFreshnessSeconds: this._node._svafMinFreshnessSeconds,
-        reactivity: this._node._svafReactivity,
-        changeWeights: this._node._svafChangeWeights ?? undefined,
-      },
+      config: this._admissionPolicy(),
     });
 
     // The observer fires on EVERY outcome, before any branch — an observation recorded only
@@ -1289,50 +1267,7 @@ class FrameHandler {
     // CMB from categories and drops it, so re-attach before storing the remix.
     this._preserveIncomingPayload(result.fusedEntry, msg);
 
-    // MMP §15.8 lineage tether — severance. The gate evaluated the remix
-    // against the resolved anchor content-only, in one kernel; a remix
-    // drifted past the reject floor MUST NOT carry the chain's lineage
-    // (keeping it would forge fidelity), so it is stored as a fresh root
-    // with the departed source recorded informally in provenance. An
-    // unverifiable tether (checked=false) is a trust state, never severed.
-    if (result.tether?.checked && !result.tether.tethered && recordLineage(result.fusedEntry?.cmb)) {
-      const departedFrom = recordParents(result.fusedEntry.cmb)[0] ?? null;
-      setRecordLineage(result.fusedEntry.cmb, null); // fresh root — must clear the section the record ACTUALLY carries
-      result.fusedEntry.cmb.provenance = {
-        ...result.fusedEntry.cmb.provenance,
-        tether: { severed: true, anchor: result.tether.anchorKey, kernelId: result.tether.kernelId, drift: result.tether.drift, departedFrom },
-      };
-      this._node._log(`[§15.8] lineage severed: remix drift ${result.tether.drift.toFixed(3)} from anchor ${String(result.tether.anchorKey).slice(0, 16)} exceeds the reject floor — stored as fresh root (departed-from in provenance)`);
-      this._node.emit('metric', { type: 'lineage-tether-severed', key: recordKey(result.fusedEntry.cmb), anchor: result.tether.anchorKey, drift: result.tether.drift });
-    } else if (result.tether?.checked && result.fusedEntry?.cmb) {
-      result.fusedEntry.cmb.provenance = {
-        ...result.fusedEntry.cmb.provenance,
-        tether: { severed: false, anchor: result.tether.anchorKey, kernelId: result.tether.kernelId, drift: result.tether.drift },
-      };
-    }
-
-    // MMP §15.8 tether attestation: sign the exact evaluation performed —
-    // remix key, anchor, kernel identity, drift, verdict — so a downstream
-    // receiver that cannot resolve the anchor holds attested-by-integrator
-    // instead of unchecked. Carried on the remix (cmb.tether); trust in the
-    // verdict is weighed through the integrator's resolved authority, and
-    // verdicts are comparable only within one kernelId.
-    if (result.tether?.checked && result.fusedEntry?.cmb
-        && typeof signTetherAttestation === 'function' && this._node._identity?.privateKey) {
-      try {
-        result.fusedEntry.cmb.tether = signTetherAttestation({
-          of: recordKey(result.fusedEntry.cmb),
-          anchor: result.tether.anchorKey,
-          kernelId: result.tether.kernelId,
-          drift: result.tether.drift,
-          verdict: result.tether.tethered ? 'tethered' : 'severed',
-          by: this._node.nodeId,
-          at: now,
-        }, this._node._identity.privateKey);
-      } catch (e) {
-        this._node._log(`[§15.8] tether attestation signing failed: ${e.message}`);
-      }
-    }
+    this._applyLineageTether(result.fusedEntry, result.tether, now);
 
     // The admitted-path surface is the store's own cmb-accepted emit. The store returns null when
     // it already holds the key ('redundant') or the write failed ('not-stored'), and a directed CMB
@@ -1361,6 +1296,112 @@ class FrameHandler {
     this._node.emit('memory-received', { from: peerName, entry: result.fusedEntry, decision: result.decision });
   }
 
+  /**
+   * The receiver's admission policy, as the gates are handed it. One builder, so the heuristic
+   * engine and the neural path's tether evaluation judge with the same thresholds and weights.
+   * @private
+   */
+  _admissionPolicy() {
+    return {
+      stableThreshold: this._node._svafStableThreshold,
+      guardedThreshold: this._node._svafGuardedThreshold,
+      temporalLambda: this._node._svafTemporalLambda,
+      freshnessSeconds: this._node._svafFreshnessSeconds,
+      categoryWeights: this._node._svafCategoryWeights,
+      adaptiveTimescale: this._node._svafAdaptiveTimescale,
+      minFreshnessSeconds: this._node._svafMinFreshnessSeconds,
+      reactivity: this._node._svafReactivity,
+      changeWeights: this._node._svafChangeWeights ?? undefined,
+    };
+  }
+
+  /**
+   * MMP §15.8 before a gate decides, on EITHER gate path: check the attestation an inbound remix
+   * carries, and resolve the anchor its tether is evaluated against.
+   *
+   * Shared because the two paths are one admission decision. The neural path skipped all of
+   * §15.8, so a remix its evaluator admitted kept a drifted lineage and was never attested, while
+   * the same record through the heuristic path was severed and signed.
+   *
+   * @returns {object|undefined} the anchor ({ key, categories, ... }), or undefined when there is
+   *   none to evaluate against (tether disabled, or no verified root in reach).
+   * @private
+   */
+  _prepareLineageTether(msg) {
+    // A re-emitted remix may carry its integrator's signed tether evaluation. Verify against the
+    // integrator's roster-resolved key. An INVALID one is stripped — a forged certificate is worse
+    // than an absent one; a valid-but-unverifiable one (no resolvable key) rides through
+    // unverified, the same posture as unsigned CMBs.
+    if (msg.cmb?.tether && typeof verifyTetherAttestation === 'function') {
+      const att = msg.cmb.tether;
+      const integKey = this._node._identityKey(att.by);
+      const v = verifyTetherAttestation(att, integKey);
+      msg._tetherAttested = v.valid === true;
+      if (v.signed && !v.valid && integKey) {
+        this._node._log(`[§15.8] inbound tether attestation INVALID from ${String(att.by).slice(0, 8)} — stripped`);
+        this._node.emit('metric', { type: 'tether-attestation-rejected', by: att.by, of: att.of });
+        delete msg.cmb.tether;
+      }
+    }
+    // The earliest-stored resolvable lineage root of the incoming CMB (the incoming block itself
+    // when it is a root).
+    const anchor = this._node._lineageTether && typeof resolveTetherAnchor === 'function'
+      ? resolveTetherAnchor(msg.cmb, (k) => this._node._store.get(k))
+      : null;
+    return anchor && anchor.categories ? anchor : undefined;
+  }
+
+  /**
+   * MMP §15.8 after a gate admits, on EITHER gate path: act on the tether evaluation of the record
+   * about to be stored. `tether` is what tetherOfRecord reported for it (null when unverified).
+   *
+   * Severance: a remix drifted past the reject floor MUST NOT carry the chain's lineage (keeping it
+   * would forge fidelity), so it is stored as a fresh root with the departed source recorded
+   * informally in provenance. An unverifiable tether (checked=false) is a trust state, never
+   * severed.
+   *
+   * Attestation: sign the exact evaluation performed — remix key, anchor, kernel identity, drift,
+   * verdict — so a downstream receiver that cannot resolve the anchor holds
+   * attested-by-integrator instead of unchecked. Carried on the remix (cmb.tether); trust in the
+   * verdict is weighed through the integrator's resolved authority, and verdicts are comparable
+   * only within one kernelId.
+   * @private
+   */
+  _applyLineageTether(entry, tether, now) {
+    const cmb = entry?.cmb;
+    if (!tether?.checked || !cmb) return;
+    if (!tether.tethered && recordLineage(cmb)) {
+      const departedFrom = recordParents(cmb)[0] ?? null;
+      setRecordLineage(cmb, null); // fresh root — must clear the section the record ACTUALLY carries
+      cmb.provenance = {
+        ...cmb.provenance,
+        tether: { severed: true, anchor: tether.anchorKey, kernelId: tether.kernelId, drift: tether.drift, departedFrom },
+      };
+      this._node._log(`[§15.8] lineage severed: remix drift ${tether.drift.toFixed(3)} from anchor ${String(tether.anchorKey).slice(0, 16)} exceeds the reject floor — stored as fresh root (departed-from in provenance)`);
+      this._node.emit('metric', { type: 'lineage-tether-severed', key: recordKey(cmb), anchor: tether.anchorKey, drift: tether.drift });
+    } else {
+      cmb.provenance = {
+        ...cmb.provenance,
+        tether: { severed: false, anchor: tether.anchorKey, kernelId: tether.kernelId, drift: tether.drift },
+      };
+    }
+    if (typeof signTetherAttestation === 'function' && this._node._identity?.privateKey) {
+      try {
+        cmb.tether = signTetherAttestation({
+          of: recordKey(cmb),
+          anchor: tether.anchorKey,
+          kernelId: tether.kernelId,
+          drift: tether.drift,
+          verdict: tether.tethered ? 'tethered' : 'severed',
+          by: this._node.nodeId,
+          at: now,
+        }, this._node._identity.privateKey);
+      } catch (e) {
+        this._node._log(`[§15.8] tether attestation signing failed: ${e.message}`);
+      }
+    }
+  }
+
   /**
    * Re-encode local state after a CMB is admitted — on EITHER gate path.
    *
diff --git a/tests/lineage-tether-neural.test.js b/tests/lineage-tether-neural.test.js
new file mode 100644
index 00000000..c20a7e74
--- /dev/null
+++ b/tests/lineage-tether-neural.test.js
@@ -0,0 +1,159 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME to a temp sandbox before lib/config loads
+
+/**
+ * MMP §15.8 applies to every remix a node integrates, whichever gate admitted it.
+ *
+ * The frame handler offers each inbound block to the injected Layer-4 evaluator first and runs the
+ * heuristic baseline only when that evaluator declines. The heuristic path resolved the lineage
+ * root, evaluated the stored record against it, severed a drifted chain and signed a tether
+ * attestation. The neural path did none of it: a remix the neural evaluator admitted kept a
+ * laundered lineage, carried no attestation, and kept whatever attestation the sender had attached.
+ *
+ * The neural evaluator is dormant in a stock install (models/svaf_v2.pt is not shipped), so it is
+ * stubbed here with the result shape it returns.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const { SymNode } = require('../lib/node');
+const { NullDiscovery } = require('../lib/discovery');
+const { nodeDir } = require('../lib/config');
+const { createCMB, isSemanticReady, verifyTetherAttestation } = require('../lib/core');
+
+const ALIGNED = { decision: 'aligned', total_drift: 0.1, category_drifts: { focus: 0.1 }, gate_values: { focus: 1 } };
+
+// The reject floor is calibrated on the semantic kernel (§9.2.1), as in the other tether tests.
+async function awaitSemantic(timeoutMs = 30000) {
+  const t0 = Date.now();
+  while (!isSemanticReady()) {
+    if (Date.now() - t0 > timeoutMs) throw new Error('semantic encoder did not become ready');
+    await new Promise((r) => setTimeout(r, 200));
+  }
+}
+
+function cat7(t) {
+  return {
+    focus: t, issue: t, intent: t, motivation: t, commitment: t,
+    perspective: 'peerA', mood: { text: 'neutral', valence: 0, arousal: 0 },
+  };
+}
+
+const TOPIC_A = 'quarterly financial audit of the accounting ledger and tax filings';
+const TOPIC_B = [
+  'hiking trail conditions in the mountain snow this weekend',
+  'which boots and crampons to pack for the icy mountain ascent',
+  'trailhead parking permits and the shuttle bus timetable',
+  'weather forecast apps for alpine ridge crossings',
+  'campsite reservations near the mountain trailhead',
+];
+const TOPIC_B_ROOT = 'overall report on snowy mountain hiking trail conditions this weekend';
+const TOPIC_B_NEW = 'fresh snowfall reported on the upper mountain trail sections';
+
+async function withNode(baseName, opts, fn) {
+  const name = `${baseName}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+  const node = new SymNode({ name, silent: true, discovery: new NullDiscovery(), ...opts });
+  await node.start();
+  try {
+    return await fn(node);
+  } finally {
+    await node.stop();
+    fs.rmSync(nodeDir(name), { recursive: true, force: true });
+  }
+}
+
+function remixFrame(text, parentKey, extra = {}) {
+  const cmb = createCMB({ categories: cat7(text), createdBy: 'peerA' });
+  cmb.metadata.lineage = { parents: [parentKey], method: 'SVAF-v2' };
+  Object.assign(cmb, extra);
+  return { type: 'cmb', timestamp: Date.now(), content: text, cmb };
+}
+
+/** Seed a node with a root and the recent topic-B window both gates admit against. */
+function seed(node, rootText) {
+  const root = node.remember(cat7(rootText));
+  for (const t of TOPIC_B) node.remember(cat7(t));
+  return root;
+}
+
+/** Admit one remix of `rootText` through the named path; return the stored entry. */
+async function admitThrough(path, rootText, frameOf) {
+  return withNode(`tether-${path}`, path === 'neural' ? { svafEvaluator: { evaluate: async () => ALIGNED } } : {}, async (node) => {
+    const root = seed(node, rootText);
+    const frame = frameOf(root.key);
+    const now = Date.now();
+    if (path === 'neural') await node._frameHandler._processNeuralSVAF(ALIGNED, frame, 'peerA', 'peerA', now, now);
+    else await node._frameHandler._processHeuristicSVAF(frame, 'peerA', 'peerA', now, now, 0);
+    const stored = node._store.get(frame.cmb.metadata.key);
+    assert.ok(stored, `${path}: the remix is stored`);
+    const att = stored.cmb.tether;
+    return {
+      root, stored, att,
+      attValid: att ? verifyTetherAttestation(att, node._identity.publicKey).valid : null,
+      nodeId: node.nodeId,
+    };
+  });
+}
+
+describe('MMP §15.8 lineage tether on the neural admission path', () => {
+  it('the stock dispatch, with a neural evaluator that admits, severs a laundered chain and attests it', async () => {
+    await awaitSemantic();
+    await withNode('tether-neural-dispatch', { svafEvaluator: { evaluate: async () => ALIGNED } }, async (node) => {
+      // The root is held as a verified peer admission: a remix citing a block this node authored
+      // would be dropped as an echo before any gate runs.
+      const root = createCMB({ categories: cat7(TOPIC_A), createdBy: 'peerR' });
+      node._store.receiveFromPeer('peerR', { key: root.metadata.key, content: TOPIC_A, source: 'peerR', cmb: root, _cmbVerified: true });
+      const frame = remixFrame(TOPIC_B_NEW, root.metadata.key);
+      await node._frameHandler._handleMemoryShare('peerA', 'peerA', frame);
+
+      const stored = node._store.get(frame.cmb.metadata.key);
+      assert.ok(stored, 'the neural evaluator admitted the remix');
+      assert.strictEqual(stored.svaf?.method, 'neural', 'precondition: the neural path stored it');
+      assert.strictEqual(stored.cmb.metadata.lineage, null, 'the laundered lineage is severed');
+      assert.strictEqual(stored.cmb.provenance?.tether?.severed, true);
+      assert.strictEqual(stored.cmb.provenance.tether.departedFrom, root.metadata.key);
+      const att = stored.cmb.tether;
+      assert.ok(att, 'a tether attestation is attached');
+      assert.strictEqual(att.verdict, 'severed');
+      assert.strictEqual(att.anchor, root.metadata.key);
+      assert.strictEqual(att.by, node.nodeId);
+      assert.strictEqual(verifyTetherAttestation(att, node._identity.publicKey).valid, true);
+    });
+  });
+
+  for (const [label, rootText] of [['a laundered chain', TOPIC_A], ['a faithful chain', TOPIC_B_ROOT]]) {
+    it(`${label}: the neural path reaches the verdict the heuristic path does`, async () => {
+      await awaitSemantic();
+      const frameOf = (rootKey) => remixFrame(TOPIC_B_NEW, rootKey);
+      const neural = await admitThrough('neural', rootText, frameOf);
+      const heuristic = await admitThrough('heuristic', rootText, frameOf);
+      for (const r of [neural, heuristic]) {
+        assert.ok(r.att, 'attested');
+        assert.strictEqual(r.attValid, true);
+        assert.strictEqual(r.att.by, r.nodeId);
+        assert.strictEqual(r.att.anchor, r.root.key);
+      }
+      assert.strictEqual(neural.att.verdict, heuristic.att.verdict, 'same verdict');
+      assert.strictEqual(neural.att.kernelId, heuristic.att.kernelId, 'one kernel, so the drifts are comparable');
+      assert.strictEqual(neural.att.drift.toFixed(6), heuristic.att.drift.toFixed(6), 'same drift: one computation');
+      const withoutDrift = ({ drift, ...rest }) => rest; // drift is compared above, to the precision it is signed at
+      assert.deepStrictEqual(withoutDrift(neural.stored.cmb.provenance.tether), withoutDrift(heuristic.stored.cmb.provenance.tether), 'same provenance');
+      assert.deepStrictEqual(neural.stored.cmb.metadata.lineage, heuristic.stored.cmb.metadata.lineage, 'same lineage outcome');
+      assert.strictEqual(neural.att.verdict, rootText === TOPIC_A ? 'severed' : 'tethered');
+    });
+  }
+
+  it('an unresolvable root: neither path attests or severs, and neither stores the sender\'s attestation', async () => {
+    await awaitSemantic();
+    const sendersOwn = { of: 'cmb-' + 'c'.repeat(64), anchor: 'cmb-' + 'd'.repeat(64), verdict: 'tethered', by: 'some-other-integrator', drift: 0 };
+    const frameOf = () => remixFrame(TOPIC_B_NEW, 'cmb-' + 'e'.repeat(64), { tether: { ...sendersOwn } });
+    for (const path of ['neural', 'heuristic']) {
+      const r = await admitThrough(path, TOPIC_B_ROOT, frameOf);
+      assert.strictEqual(r.att, undefined, `${path}: no tether attestation is stored`);
+      assert.strictEqual(r.stored.cmb.provenance?.tether, undefined, `${path}: the tether is unverified, not evaluated`);
+      assert.deepStrictEqual(r.stored.cmb.metadata.lineage.parents, ['cmb-' + 'e'.repeat(64)], `${path}: lineage is kept`);
+    }
+  });
+});

From 59bcfd8fad8a1085ca9f3e6c1239d0d4a664d4f6 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 19:22:17 +0100
Subject: [PATCH 031/148] tests: wait for in-flight frames instead of a fixed
 150 ms
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Four files handed a frame to the frame handler, slept 150 ms and asserted
on what had surfaced. That guessed how long asynchronous admission takes,
and the guess got tighter once the neural path evaluated the §15.8 tether
(encoding the stored record and its root): under heavy machine load 15 of
audit-delivery-authorship's 39 tests failed with nothing yet surfaced, and
all of them passed with a longer wait.

tests/_settle.js records every processing chain the frame handler starts;
settle(ms) waits at least ms, as before, then until every chain has
settled. With every tether evaluation slowed by 400 ms the four files pass
(64/64); with the fixed sleeps 25 of the 64 fail.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 tests/_settle.js                        | 36 +++++++++++++++++++++++++
 tests/audit-delivery-authorship.test.js |  3 ++-
 tests/cmb-signing.test.js               |  3 ++-
 tests/inbound-cmb-surfacing.test.js     |  5 ++--
 tests/v2-author-binding.test.js         |  3 ++-
 5 files changed, 44 insertions(+), 6 deletions(-)
 create mode 100644 tests/_settle.js

diff --git a/tests/_settle.js b/tests/_settle.js
new file mode 100644
index 00000000..8bec34a3
--- /dev/null
+++ b/tests/_settle.js
@@ -0,0 +1,36 @@
+'use strict';
+
+/**
+ * Wait for inbound CMB frames to finish processing instead of guessing how long that takes.
+ *
+ * node._frameHandler.handle() returns before a cmb frame is processed: admission is asynchronous
+ * (the injected evaluator, then the §15.8 tether evaluation, which encodes the stored record and
+ * its root), and the store write and every surface happen at the end of that chain. A fixed sleep
+ * is a guess at its duration, and the guess fails whenever the machine is slower than it, which is
+ * how these tests started failing under load once the neural path began evaluating the tether.
+ *
+ * Every processing chain the frame handler starts is recorded here, and settle(ms) waits at least
+ * `ms` (what the fixed sleep used to give, for anything that is not a frame) and then until every
+ * recorded chain has settled. Require it after ./_isolate-home, like any module that loads lib/.
+ */
+
+const { FrameHandler } = require('../lib/frame-handler');
+
+const inFlight = new Set();
+const handleMemoryShare = FrameHandler.prototype._handleMemoryShare;
+FrameHandler.prototype._handleMemoryShare = function tracked(...args) {
+  const chain = handleMemoryShare.apply(this, args);
+  if (chain && typeof chain.then === 'function') {
+    inFlight.add(chain);
+    const done = () => inFlight.delete(chain);
+    chain.then(done, done);
+  }
+  return chain;
+};
+
+async function settle(ms = 150) {
+  await new Promise((r) => setTimeout(r, ms));
+  while (inFlight.size) await Promise.allSettled([...inFlight]);
+}
+
+module.exports = { settle };
diff --git a/tests/audit-delivery-authorship.test.js b/tests/audit-delivery-authorship.test.js
index 2e48887b..bdb92827 100644
--- a/tests/audit-delivery-authorship.test.js
+++ b/tests/audit-delivery-authorship.test.js
@@ -73,7 +73,8 @@ function mkCmb(focus, { by = 'peerA', parents, mood = NEUTRAL, to } = {}) {
 const signed = (cmb, kp = PEER_A) => { core.signCMB(cmb, kp.priv); return cmb; };
 const frame = (cmb) => JSON.parse(JSON.stringify({ type: 'cmb', timestamp: Date.now(), cmb }));
 const directed = (node, cmb) => Object.assign(frame(cmb), { to: node.nodeId, directed: true });
-const settle = (ms = 150) => new Promise((r) => setTimeout(r, ms));
+// Waits for every in-flight frame to finish, not a fixed guess at how long that takes.
+const { settle } = require('./_settle');
 const tick = () => new Promise((r) => setTimeout(r, 5)); // distinct createdTimestamp
 
 function collect(node) {
diff --git a/tests/cmb-signing.test.js b/tests/cmb-signing.test.js
index 5976f0bd..5d26e688 100644
--- a/tests/cmb-signing.test.js
+++ b/tests/cmb-signing.test.js
@@ -62,7 +62,8 @@ function signedCmbFrame(priv, createdBy = 'peerA') {
 
 const ALIGNED = { decision: 'aligned', total_drift: 0.1, category_drifts: { focus: 0.1 }, gate_values: { g: 1 } };
 const wire = (f) => JSON.parse(JSON.stringify(f));
-const settle = (ms = 150) => new Promise((r) => setTimeout(r, ms));
+// Waits for every in-flight frame to finish, not a fixed guess at how long that takes.
+const { settle } = require('./_settle');
 
 describe('CMB authentication — Ed25519 sign + verify (MMP §8.3)', () => {
   it('a node signs the CMBs it authors; the signature verifies against its own identity key', async () => {
diff --git a/tests/inbound-cmb-surfacing.test.js b/tests/inbound-cmb-surfacing.test.js
index 10aa47b4..aeccc3f3 100644
--- a/tests/inbound-cmb-surfacing.test.js
+++ b/tests/inbound-cmb-surfacing.test.js
@@ -86,9 +86,8 @@ function directedFrame(receiverNode, focusText, mood) {
   return frame;
 }
 
-async function settle(ms = 150) {
-  await new Promise((r) => setTimeout(r, ms));
-}
+// Waits for every in-flight frame to finish, not a fixed guess at how long that takes.
+const { settle } = require('./_settle');
 
 describe('inbound CMB surfacing — public real-time mesh claim', () => {
   it('a first-seen inbound CMB surfaces (admitted) — baseline receive works', async () => {
diff --git a/tests/v2-author-binding.test.js b/tests/v2-author-binding.test.js
index 2342cd30..a469e7f0 100644
--- a/tests/v2-author-binding.test.js
+++ b/tests/v2-author-binding.test.js
@@ -19,6 +19,7 @@ const { SymNode } = require('../lib/node');
 const { NullDiscovery } = require('../lib/discovery');
 const { nodeDir } = require('../lib/config');
 const { createCMB, signCMB, assertionIdV2_0 } = require('../lib/core');
+const { settle } = require('./_settle'); // waits for every in-flight frame, not a fixed guess
 
 function kp() {
   const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519', {
@@ -104,7 +105,7 @@ describe('the inbox names a proven author (K5)', () => {
       const got = [];
       node.on('cmb-accepted', (e) => got.push(e));
       node._frameHandler.handle('node-relay', 'relay', { type: 'cmb', timestamp: Date.now(), cmb: v2Record({ nodeId: 'node-alice', createdBy: 'alice', signWith: ALICE, focus: 'relayed but proven' }) });
-      await new Promise((r) => setTimeout(r, 150));
+      await settle();
       assert.strictEqual(got.length, 1);
       assert.strictEqual(got[0].author.nodeId, 'node-alice');
       assert.strictEqual(node.inboxGet(got[0].inboxId).from, 'alice');

From abeb955a154e3692cb9c4e31542378fa03ae3ab5 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 19:31:13 +0100
Subject: [PATCH 032/148] store: SVAF anchors carry the entry's age and weight
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

§9.2.1 weighs each anchor by max(cos,0) · exp(−age/τ) · conf. The age is
the anchor's time in this store and conf the weight this store gives it
(§6.4: validated counts more, dismissed less); both live on the entry.
MemoryStore.anchors() handed the gate bare records, which carry neither, so
every anchor read as stored this instant at full weight: memory never aged
and a dismissal changed nothing.

anchors() now returns a view per record: a new object with the record's own
sections plus the entry's storedAt and its anchorWeight as confidence.
Nothing is written onto the record. A frame's `confidence` is not used: it
is the sender's unsigned claim about its own block.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 lib/memory-store.js              | 34 ++++++++---
 tests/svaf-anchor-weight.test.js | 96 ++++++++++++++++++++++++++++++++
 2 files changed, 121 insertions(+), 9 deletions(-)
 create mode 100644 tests/svaf-anchor-weight.test.js

diff --git a/lib/memory-store.js b/lib/memory-store.js
index d6f210dd..1c5443ac 100644
--- a/lib/memory-store.js
+++ b/lib/memory-store.js
@@ -377,26 +377,42 @@ class MemoryStore {
   }
 
   /**
-   * Recent CMBs with full data (for SVAF anchor retrieval).
-   * Replaces old recentCMBs().
+   * The most recent records as SVAF anchors: a VIEW of each record carrying what the gate weighs it
+   * by, which lives on the entry rather than on the record (§9.2.1: w = max(cos,0) · exp(−age/τ) ·
+   * conf).
+   *
+   *   storedAt    the entry's receiver-local storage time, from which the gate takes the age.
+   *   confidence  the entry's anchorWeight, this store's own weight for the anchor (§6.4: 2.0 once
+   *               validated, 0.5 once dismissed). Absent means no reduction was claimed. A frame's
+   *               `confidence` is never used: it is the sender's unsigned claim about its own block.
+   *
+   * These used to be the bare records, which carry neither, so every anchor read as stored this
+   * instant at full weight: memory never aged and a dismissal changed nothing. The view is a new
+   * object whose sections are the record's own; nothing is written onto the record.
    */
   anchors(limit = 5) {
     const keys = this._index.recentKeys(limit);
-    const cmbs = [];
+    const views = [];
     for (const key of keys) {
       const entry = this.get(key);
       if (!entry) continue;
-      if (entry.cmb) {
-        cmbs.push(entry.cmb);
-      } else {
+      let record = entry.cmb;
+      if (!record) {
         // Legacy entry without CMB — create on demand
         try {
           const { createCMB } = require('./core');
-          cmbs.push(createCMB({ rawText: entry.content, createdBy: entry.source || this._source }));
-        } catch { /* core not available — skip */ }
+          record = createCMB({ rawText: entry.content, createdBy: entry.source || this._source });
+        } catch { continue; /* core not available — skip */ }
       }
+      const storedAt = entry.storedAt ?? entry.timestamp;
+      const weight = entry.anchorWeight;
+      views.push({
+        ...record,
+        storedAt: typeof storedAt === 'number' && Number.isFinite(storedAt) ? storedAt : undefined,
+        confidence: typeof weight === 'number' && Number.isFinite(weight) && weight >= 0 ? weight : undefined,
+      });
     }
-    return cmbs;
+    return views;
   }
 
   /** Backward compat alias */
diff --git a/tests/svaf-anchor-weight.test.js b/tests/svaf-anchor-weight.test.js
new file mode 100644
index 00000000..449fbfdf
--- /dev/null
+++ b/tests/svaf-anchor-weight.test.js
@@ -0,0 +1,96 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME to a temp sandbox before lib/config loads
+
+/**
+ * §9.2.1: an anchor's weight in the memory readout is max(cos, 0) · exp(−age/τ) · conf. The age is
+ * the anchor's time in THIS store and conf is the weight this store gives it (§6.4: a validated
+ * anchor counts more, a dismissed one less). Both live on the store entry, not on the record.
+ *
+ * MemoryStore.anchors() handed the gate bare records, which carry neither, so the gate read
+ * `storedAt` as now and conf as 1 for every anchor: memory never aged and a dismissal changed
+ * nothing. The anchors are views carrying the entry's values; the record itself is not written to.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const { tmpdir } = require('./_tmpdir');
+const { MemoryStore } = require('../lib/memory-store');
+const { createCMB, processHeuristicSVAF, isSemanticReady } = require('../lib/core');
+
+const TAU = 3600;
+const POLICY = { stableThreshold: 0.35, guardedThreshold: 0.75, temporalLambda: 0.3, freshnessSeconds: TAU };
+
+// One kernel for every gate the test compares (§9.2.1: drifts compare only within a pinned
+// encoder), and the one a node runs once its semantic encoder has loaded.
+async function awaitSemantic(timeoutMs = 30000) {
+  const t0 = Date.now();
+  while (!isSemanticReady()) {
+    if (Date.now() - t0 > timeoutMs) throw new Error('semantic encoder did not become ready');
+    await new Promise((r) => setTimeout(r, 200));
+  }
+}
+
+function cat7(t) {
+  return {
+    focus: t, issue: t, intent: t, motivation: t, commitment: t,
+    perspective: 'observer', mood: { text: 'neutral', valence: 0, arousal: 0 },
+  };
+}
+
+const AGREES = 'the build pipeline caches artifacts per commit';
+const OTHER = 'the deploy job publishes container images every night';
+const INCOMING = 'the build pipeline caches artifacts per commit hash';
+
+/** A store holding the anchor the incoming block agrees with and one it does not; `age` the first. */
+function storeWith(adjust) {
+  const store = new MemoryStore(tmpdir('sym-anchor-weight-'), 'receiver');
+  const agrees = store.write('agrees', { cmb: createCMB({ categories: cat7(AGREES), createdBy: 'receiver' }) });
+  store.write('other', { cmb: createCMB({ categories: cat7(OTHER), createdBy: 'receiver' }) });
+  if (adjust) adjust(store, agrees.key);
+  return { store, agreesKey: agrees.key };
+}
+
+async function totalDriftAgainst(store) {
+  const now = Date.now();
+  const r = await processHeuristicSVAF({
+    msg: { type: 'cmb', cmb: createCMB({ categories: cat7(INCOMING), createdBy: 'peer' }), content: 'incoming' },
+    peerName: 'peer', localName: 'receiver', originTs: now, now, ageSeconds: 0,
+    recentCMBs: store.recentCMBs(5), config: POLICY,
+  });
+  assert.strictEqual(r.coldStartCause, undefined, 'precondition: the anchors were consulted');
+  return r.totalDrift;
+}
+
+describe('SVAF anchors carry the store\'s age and weight', () => {
+  it('an old anchor weighs less than a fresh one, and a dismissed one less than an observed one', async () => {
+    await awaitSemantic();
+    const fresh = storeWith();
+    const aged = storeWith((store, key) => { store.get(key).storedAt = Date.now() - 3 * TAU * 1000; });
+    const dismissed = storeWith((store, key) => { store.dismissCMB(key); });
+
+    const dFresh = await totalDriftAgainst(fresh.store);
+    const dAged = await totalDriftAgainst(aged.store);
+    const dDismissed = await totalDriftAgainst(dismissed.store);
+    assert.ok(dAged > dFresh, `the anchor the incoming agrees with pulls less once it is old (${dAged} vs ${dFresh})`);
+    assert.ok(dDismissed > dFresh, `and less once it is dismissed (${dDismissed} vs ${dFresh})`);
+
+    for (const { store, agreesKey } of [fresh, aged, dismissed]) {
+      const record = store.get(agreesKey).cmb;
+      assert.deepStrictEqual(Object.keys(record).sort(), ['categories', 'metadata'], 'nothing was written onto the record');
+    }
+  });
+
+  it('an anchor older than memory reaches is no anchor at all', async () => {
+    const { store } = storeWith((s, key) => { s.get(key).storedAt = Date.now() - 30 * 24 * 3600 * 1000; });
+    // Keep only the aged anchor in the window.
+    const views = store.recentCMBs(5).filter((a) => a.categories.focus.text === AGREES);
+    assert.strictEqual(views.length, 1);
+    const now = Date.now();
+    const r = await processHeuristicSVAF({
+      msg: { type: 'cmb', cmb: createCMB({ categories: cat7(INCOMING), createdBy: 'peer' }), content: 'incoming' },
+      peerName: 'peer', localName: 'receiver', originTs: now, now, ageSeconds: 0, recentCMBs: views, config: POLICY,
+    });
+    assert.strictEqual(r.coldStartCause, 'empty-memory', 'thirty days at τ = 1 h leaves no live memory of any category');
+  });
+});

From bb69b43db0fff6e4d2edee56c42b0beb36d5bd8f Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 19:33:20 +0100
Subject: [PATCH 033/148] frame-handler: the neural path stores a copy, never
 the caller's record

The neural path built its entry as `{ ...msg }`, so the record it stored
was msg.cmb itself. Everything it then wrote to its record (the admission
attestation, the tether annotations, severance, and the key and lineage it
writes when the content does not collapse onto the incoming address) landed
on the frame the caller handed in.

record-shape gains recordAsSigned(): a copy of a received record as its
author signed it, sharing nothing with the original (a two-section record
comes back as exactly categories and metadata; categories keep text, signed
meta and mood's valence/arousal, never a vector). The neural path stores
that copy, and the heuristic engine's collapsed record is now built by the
same function, so the two paths share one definition. strippedOfVectors
moves to record-shape as categoriesAsSigned, now copying nested meta too.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 lib/core/record-shape.js            | 41 ++++++++++++++++-
 lib/core/svaf-baseline.js           | 41 +++++------------
 lib/frame-handler.js                | 12 ++---
 tests/neural-admission-copy.test.js | 69 +++++++++++++++++++++++++++++
 4 files changed, 127 insertions(+), 36 deletions(-)
 create mode 100644 tests/neural-admission-copy.test.js

diff --git a/lib/core/record-shape.js b/lib/core/record-shape.js
index 024c466c..3d8da2e8 100644
--- a/lib/core/record-shape.js
+++ b/lib/core/record-shape.js
@@ -167,4 +167,43 @@ function verifyAddress(record, derive) {
     : { state: VERIFY.MISMATCH, reason: `stored ${key.slice(0, 20)}… derived ${derived.slice(0, 20)}…` };
 }
 
-module.exports = { resolveCategories, requireCategories, hasCategories, containerState, unreadableReason, keyOf, verifyAddress, VERIFY };
+/**
+ * A record-shaped projection of categories: each category's text, its signed `meta`, and mood's
+ * valence/arousal. Never a vector (§7.1), and never a member the record format does not define (a
+ * wire extra no signature or address covers). Nested values are copies, so the result shares
+ * nothing with its input.
+ */
+function categoriesAsSigned(categories) {
+  const out = {};
+  for (const [name, f] of Object.entries(categories || {})) {
+    if (!f) continue;
+    const kept = { text: f.text };
+    if (f.meta !== undefined) kept.meta = structuredClone(f.meta);
+    if (f.valence !== undefined) kept.valence = f.valence;
+    if (f.arousal !== undefined) kept.arousal = f.arousal;
+    out[name] = kept;
+  }
+  return out;
+}
+
+/**
+ * A copy of a received record as its author signed it, to be stored in place of the object that
+ * arrived. It shares nothing with that object, so nothing a receiver records against the copy
+ * reaches the caller's frame.
+ *
+ * A two-section record comes back as exactly `categories` and `metadata` (§8.8.1). A pre-boundary
+ * record (no metadata section) is copied whole, its shape being its own, with the same treatment
+ * of its categories.
+ */
+function recordAsSigned(record) {
+  if (!record || typeof record !== 'object') return record;
+  const categories = record.categories && typeof record.categories === 'object'
+    ? categoriesAsSigned(record.categories)
+    : record.categories;
+  if (record.metadata && typeof record.metadata === 'object') {
+    return { categories, metadata: structuredClone(record.metadata) };
+  }
+  return { ...structuredClone(record), categories };
+}
+
+module.exports = { resolveCategories, requireCategories, hasCategories, containerState, unreadableReason, keyOf, verifyAddress, VERIFY, categoriesAsSigned, recordAsSigned };
diff --git a/lib/core/svaf-baseline.js b/lib/core/svaf-baseline.js
index 5c0cd463..ecd19f8d 100644
--- a/lib/core/svaf-baseline.js
+++ b/lib/core/svaf-baseline.js
@@ -24,6 +24,7 @@
 const { createCMB, renderContent: renderCMB, cosineSimilarity, l2Normalize, CAT7_CATEGORIES, categoryKeyV1, blockKeyV2 } = require('./cmb-encoder');
 const { svafKernel } = require('./context-encoder');
 const { tetherOfRecord } = require('./lineage-tether');
+const { categoriesAsSigned, recordAsSigned } = require('./record-shape');
 
 /** Per-category admission verdicts — the first-class gating output (MMP §9.2). */
 const CATEGORY_VERDICT = Object.freeze({
@@ -188,7 +189,7 @@ function incomingLineageOf(cmb) {
  * audit would have nothing left to check. That is the failure this comment exists to prevent,
  * because the first cut of this function did exactly that and the store still looked healthy.
  */
-function buildFusedRecord({ categories, createdBy, parentKey, parentLineage, parentMetadata, parentCategories, parentCreatedBy, method, provenance }) {
+function buildFusedRecord({ categories, createdBy, parentKey, parentLineage, parentRecord, parentCreatedBy, method, provenance }) {
   const key = blockKeyV2(categories);
   const selfEdge = parentKey && key === parentKey;
   // Same content ⇒ same block ⇒ the AUTHOR'S record, carried through as signed (MMP §8.8.4,
@@ -196,13 +197,11 @@ function buildFusedRecord({ categories, createdBy, parentKey, parentLineage, par
   // rebuilt categories do not carry) and the author's metadata and signature. Rewriting createdBy
   // to the receiver here made every admitted block claim the receiver as author at the author's
   // address, and cmb-fetch then served that to third parties (2026-10-01 audit, B-L1).
-  if (selfEdge && parentMetadata && typeof parentMetadata === 'object') {
-    return {
-      categories: parentCategories ? strippedOfVectors(parentCategories) : categories,
-      metadata: { ...parentMetadata, key },
-      provenance,
-      collapsed: true,
-    };
+  // recordAsSigned is the one definition of that copy, shared with the neural path.
+  if (selfEdge && parentRecord?.metadata && typeof parentRecord.metadata === 'object') {
+    const record = recordAsSigned(parentRecord);
+    record.metadata.key = key;
+    return { ...record, provenance, collapsed: true };
   }
   // A pre-boundary record (§7.8, address and author at the top level) cannot be carried through
   // as signed in this shape, but its author is still its author, never the receiver.
@@ -229,22 +228,6 @@ function buildFusedRecord({ categories, createdBy, parentKey, parentLineage, par
   };
 }
 
-/** A record-shaped projection of evaluated categories: text and meta, never the vector (§7.1). */
-function strippedOfVectors(categories) {
-  const out = {};
-  for (const [name, f] of Object.entries(categories || {})) {
-    if (!f) continue;
-    // Text, the signed `meta`, and the mood's valence/arousal; never the vector, and never a field
-    // the record format does not define (a wire extra no signature or address covers).
-    const kept = { text: f.text };
-    if (f.meta !== undefined) kept.meta = f.meta;
-    if (f.valence !== undefined) kept.valence = f.valence;
-    if (f.arousal !== undefined) kept.arousal = f.arousal;
-    out[name] = kept;
-  }
-  return out;
-}
-
 /**
  * The per-category drift arithmetic (§9.2/§9.2.1), as a PURE function of already-encoded vectors.
  *
@@ -530,12 +513,11 @@ async function _processHeuristicSVAF(opts) {
       // Vectors are stripped on EVERY exit that stores a record, including this cold-start one.
       // Demonstrated rather than assumed: the first run of the store-none proof landed HERE and
       // persisted all seven vectors while the main path was already clean.
-      categories: strippedOfVectors(incomingCMB.categories),
+      categories: categoriesAsSigned(incomingCMB.categories),
       createdBy: localName,
       parentKey: csIncomingKey,
       parentLineage: incomingLineageOf(msg.cmb),
-      parentMetadata: msg.cmb?.metadata,
-      parentCategories: msg.cmb?.categories,
+      parentRecord: msg.cmb,
       parentCreatedBy: msg.cmb?.createdBy,
       method: 'svaf-heuristic-coldstart',
       provenance: { categoryDrift: {}, totalDrift: csTotalDrift, temporalDrift, effectiveTau: tau, changeSignal: 0, fusionMethod: 'svaf-heuristic-coldstart', fusedAt: now },
@@ -597,12 +579,11 @@ async function _processHeuristicSVAF(opts) {
     // Stripped HERE and not in computeCategoryDrifts, whose fused readout is the measurement it
     // returns. Computation keeps its vectors; the RECORD carries none.
     // `meta` is preserved — categoryParentsCommitment signs meta.parents.
-    categories: strippedOfVectors(fusedCategories),
+    categories: categoriesAsSigned(fusedCategories),
     createdBy: localName,
     parentKey: incomingKey,
     parentLineage: incomingLineageOf(msg.cmb),
-    parentMetadata: msg.cmb?.metadata,
-    parentCategories: msg.cmb?.categories,
+    parentRecord: msg.cmb,
     parentCreatedBy: msg.cmb?.createdBy,
     method: 'svaf-heuristic',
     provenance: { categoryDrift: categoryDrifts, totalDrift, temporalDrift, effectiveTau: tau, changeSignal: 0, fusionMethod: 'svaf-heuristic', fusedAt: now },
diff --git a/lib/frame-handler.js b/lib/frame-handler.js
index ab38ab8f..b9677fb5 100644
--- a/lib/frame-handler.js
+++ b/lib/frame-handler.js
@@ -24,7 +24,7 @@ const { assertRecordSize } = require('./core/cmb-encoder');
 
 const fs = require('fs');
 const path = require('path');
-const { encode, DIM, processHeuristicSVAF, computeCategoryVerdicts, decryptCategories, blockKeyV2, resolveTetherAnchor, tetherOfRecord, signTetherAttestation, verifyTetherAttestation, recomputeKey, classifyAddress } = require('./core');
+const { encode, DIM, processHeuristicSVAF, computeCategoryVerdicts, decryptCategories, blockKeyV2, resolveTetherAnchor, tetherOfRecord, signTetherAttestation, verifyTetherAttestation, recomputeKey, classifyAddress, recordAsSigned } = require('./core');
 
 // Receive-path dedup window (MMP §4.2 O2 — rejoin-without-replay convergence).
 // A CMB whose content-hash key we have already processed within this window is
@@ -1081,6 +1081,10 @@ class FrameHandler {
 
     const fusedEntry = {
       ...msg,
+      // A copy of the record as its author signed it, never the caller's object. Everything below
+      // writes to the record this node stores; on the incoming object it reached the caller's
+      // frame. The heuristic path stores a record built the same way (recordAsSigned).
+      cmb: msg.cmb ? recordAsSigned(msg.cmb) : msg.cmb,
       source: `${this._node.name}+${msg.source || peerName}`,
       storedAt: now,
       svaf: {
@@ -1135,10 +1139,8 @@ class FrameHandler {
     // Opaque payload rides alongside CAT7 — carry it onto the admitted remix.
     this._preserveIncomingPayload(fusedEntry, msg);
     if (fusedEntry.cmb) {
-      // This path stores the incoming record object itself, so it still carries any attestation its
-      // sender attached. That one was an input, checked in _prepareLineageTether; the record this
-      // node stores carries its own evaluation or none, as the heuristic path's rebuilt record does.
-      delete fusedEntry.cmb.tether;
+      // The copy carries no attestation the sender attached: that one was an input, checked in
+      // _prepareLineageTether. The record this node stores carries its own evaluation or none.
       const tether = await tetherOfRecord(fusedEntry.cmb.categories, tetherAnchor, this._admissionPolicy());
       this._applyLineageTether(fusedEntry, tether, now);
     }
diff --git a/tests/neural-admission-copy.test.js b/tests/neural-admission-copy.test.js
new file mode 100644
index 00000000..356dea29
--- /dev/null
+++ b/tests/neural-admission-copy.test.js
@@ -0,0 +1,69 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME to a temp sandbox before lib/config loads
+
+/**
+ * The neural admission path stores a copy of the incoming record, never the caller's object.
+ *
+ * It built its entry as `{ ...msg }`, so the entry's record WAS msg.cmb, and everything the path
+ * then did to "its" record (the admission attestation, the tether annotations, severance, and the
+ * key and lineage it writes when the content does not collapse onto the incoming address) landed on
+ * the frame the caller handed in. The heuristic path builds a new record and never had this.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const { SymNode } = require('../lib/node');
+const { NullDiscovery } = require('../lib/discovery');
+const { nodeDir } = require('../lib/config');
+const { createCMB } = require('../lib/core');
+
+const ALIGNED = { decision: 'aligned', total_drift: 0.1, category_drifts: { focus: 0.1 }, gate_values: { focus: 1 } };
+
+function cat7(t) {
+  return {
+    focus: t, issue: t, intent: t, motivation: t, commitment: t,
+    perspective: 'peerA', mood: { text: 'neutral', valence: 0, arousal: 0 },
+  };
+}
+
+async function withNode(fn) {
+  const name = `neural-copy-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+  const node = new SymNode({ name, silent: true, discovery: new NullDiscovery(), svafEvaluator: { evaluate: async () => ALIGNED } });
+  await node.start();
+  try {
+    return await fn(node);
+  } finally {
+    await node.stop();
+    fs.rmSync(nodeDir(name), { recursive: true, force: true });
+  }
+}
+
+describe('neural admission works on a copy of the incoming record', () => {
+  it('the caller\'s record is untouched, whether the content collapses onto its address or not', async () => {
+    await withNode(async (node) => {
+      const root = node.remember(cat7('quarterly financial audit of the accounting ledger and tax filings'));
+      const cases = [];
+      // Collapses: correctly addressed, cites a root this node holds (so the tether is evaluated),
+      // and carries a sender's attestation the path must not store.
+      const collapses = createCMB({ categories: cat7('fresh snowfall reported on the upper mountain trail sections'), createdBy: 'peerA', lineage: { parents: [root.key], method: 'SVAF-v2' } });
+      collapses.tether = { of: collapses.metadata.key, anchor: root.key, verdict: 'tethered', by: 'another-integrator', drift: 0 };
+      cases.push(['collapses', collapses]);
+      // Does not collapse: the address it carries is not its content's, so the path writes a new
+      // key and lineage on the record it stores.
+      const misaddressed = createCMB({ categories: cat7('a record whose carried address is not its own'), createdBy: 'peerA' });
+      misaddressed.metadata.key = 'cmb-' + '9'.repeat(64);
+      cases.push(['does not collapse', misaddressed]);
+
+      for (const [label, cmb] of cases) {
+        const frame = { type: 'cmb', timestamp: Date.now(), content: label, cmb };
+        const before = structuredClone(frame);
+        const now = Date.now();
+        await node._frameHandler._processNeuralSVAF(ALIGNED, frame, 'peerA', 'peerA', now, now);
+        assert.ok(node._store.count() > 1, `${label}: precondition: something was stored`);
+        assert.deepStrictEqual(frame.cmb, before.cmb, `${label}: the caller's record is exactly as it was handed in`);
+      }
+    });
+  });
+});

From 0b977a33327a7256f8b562a6263ca62cb0f0e9cd Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 19:38:02 +0100
Subject: [PATCH 034/148] store entry, not record: admission, tether,
 provenance and collapsed
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A two-section record has exactly `categories` and `metadata` (§8.8.1). The
receive path added four members to every stored record: `admission` (the
admission attestation), `tether` (the §15.8 attestation), `provenance`
(fusion evidence and the tether annotation) and `collapsed`. None is the
author's and none is signed; they are this node's record about the record.

They are entry members now:
- the heuristic engine returns the record as exactly two sections and puts
  provenance and collapsed on the fused entry (buildFusedRecord returns
  { record, collapsed });
- the frame handler puts the admission and tether attestations and the
  tether provenance on the entry, on both gate paths, as does the tether
  audit;
- the store's asStored() moves any of the four it finds on a two-section
  record onto the entry (the entry's own value wins), on write as well as
  on every read, so files written before keep their annotations and a
  writer that still puts them on the record cannot break the shape;
- frame intake drops frame-supplied admission/tether/provenance/collapsed
  and svaf, since the stored entry is built from the frame and these name
  this node's own work.

Readers moved with them: the tether tests, the admission attestation test,
the e2e-admission and e2e-cmb-path integration tests, and the two-stock-nodes
release-gate driver.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 lib/core/svaf-baseline.js                 |  44 ++++----
 lib/frame-handler.js                      |  36 ++++---
 lib/memory-store.js                       |  47 ++++++---
 lib/node.js                               |   7 +-
 scripts/two-stock-nodes-driver.cjs        |  15 +--
 tests/admission-attestation.test.js       |  34 +++---
 tests/integration/e2e-admission.js        |   7 +-
 tests/integration/e2e-cmb-path.js         |   4 +-
 tests/lineage-tether-audit.test.js        |  14 +--
 tests/lineage-tether-neural.test.js       |  12 +--
 tests/lineage-tether-reproducible.test.js |  12 +--
 tests/lineage-tether-severance.test.js    |  30 +++---
 tests/stored-entry-annotations.test.js    | 123 ++++++++++++++++++++++
 13 files changed, 282 insertions(+), 103 deletions(-)
 create mode 100644 tests/stored-entry-annotations.test.js

diff --git a/lib/core/svaf-baseline.js b/lib/core/svaf-baseline.js
index ecd19f8d..47e3cb41 100644
--- a/lib/core/svaf-baseline.js
+++ b/lib/core/svaf-baseline.js
@@ -171,7 +171,10 @@ function incomingLineageOf(cmb) {
 }
 
 /**
- * Build the fused remix as a §7 two-section record.
+ * Build the fused remix as a §7 two-section record: `{ record, collapsed }`, where `record` is
+ * exactly `categories` and `metadata` (§8.8.1) and `collapsed` says it is the incoming block itself.
+ * What this node records ABOUT the remix (its provenance, its collapse, the attestations the frame
+ * handler adds) belongs on the store entry beside the record, never inside it.
  *
  * Addressed by CONTENT ALONE (blockKeyV2), not by mintRemixKey. Under content-only addressing a
  * lineage-bearing block is addressed exactly like any other block with the same content, so a
@@ -189,7 +192,7 @@ function incomingLineageOf(cmb) {
  * audit would have nothing left to check. That is the failure this comment exists to prevent,
  * because the first cut of this function did exactly that and the store still looked healthy.
  */
-function buildFusedRecord({ categories, createdBy, parentKey, parentLineage, parentRecord, parentCreatedBy, method, provenance }) {
+function buildFusedRecord({ categories, createdBy, parentKey, parentLineage, parentRecord, parentCreatedBy, method }) {
   const key = blockKeyV2(categories);
   const selfEdge = parentKey && key === parentKey;
   // Same content ⇒ same block ⇒ the AUTHOR'S record, carried through as signed (MMP §8.8.4,
@@ -201,13 +204,13 @@ function buildFusedRecord({ categories, createdBy, parentKey, parentLineage, par
   if (selfEdge && parentRecord?.metadata && typeof parentRecord.metadata === 'object') {
     const record = recordAsSigned(parentRecord);
     record.metadata.key = key;
-    return { ...record, provenance, collapsed: true };
+    return { record, collapsed: true };
   }
   // A pre-boundary record (§7.8, address and author at the top level) cannot be carried through
   // as signed in this shape, but its author is still its author, never the receiver.
   if (selfEdge && typeof parentCreatedBy === 'string' && parentCreatedBy) createdBy = parentCreatedBy;
   const inherited = selfEdge ? (parentLineage ?? null) : null;
-  return {
+  const record = {
     categories,
     metadata: {
       key,
@@ -223,9 +226,8 @@ function buildFusedRecord({ categories, createdBy, parentKey, parentLineage, par
       room: null,
       to: null,
     },
-    provenance,
-    collapsed: selfEdge || undefined,
   };
+  return { record, collapsed: !!selfEdge };
 }
 
 /**
@@ -509,7 +511,7 @@ async function _processHeuristicSVAF(opts) {
       return { accepted: false, totalDrift: csTotalDrift, decision: 'rejected', categoryVerdicts: computeCategoryVerdicts(verdictDrifts, config), effectiveTau: tau, changeSignal: 0, coldStartCause };
     }
     const csIncomingKey = incomingKeyOf(msg.cmb);
-    const csCMB = buildFusedRecord({
+    const cs = buildFusedRecord({
       // Vectors are stripped on EVERY exit that stores a record, including this cold-start one.
       // Demonstrated rather than assumed: the first run of the store-none proof landed HERE and
       // persisted all seven vectors while the main path was already clean.
@@ -520,17 +522,20 @@ async function _processHeuristicSVAF(opts) {
       parentRecord: msg.cmb,
       parentCreatedBy: msg.cmb?.createdBy,
       method: 'svaf-heuristic-coldstart',
-      provenance: { categoryDrift: {}, totalDrift: csTotalDrift, temporalDrift, effectiveTau: tau, changeSignal: 0, fusionMethod: 'svaf-heuristic-coldstart', fusedAt: now },
     });
-    const csKey = csCMB.metadata.key;
-    const csContent = renderCMB(csCMB);
-    const csEntry = { ...msg, key: csKey, content: csContent, source: `${localName}+${msg.source || peerName}`, cmb: csCMB, storedAt: now };
+    const csKey = cs.record.metadata.key;
+    const csContent = renderCMB(cs.record);
+    const csEntry = {
+      ...msg, key: csKey, content: csContent, source: `${localName}+${msg.source || peerName}`, cmb: cs.record, storedAt: now,
+      provenance: { categoryDrift: {}, totalDrift: csTotalDrift, temporalDrift, effectiveTau: tau, changeSignal: 0, fusionMethod: 'svaf-heuristic-coldstart', fusedAt: now },
+      collapsed: cs.collapsed || undefined,
+    };
     const csDecision = (!lensUncovered && csTotalDrift <= config.stableThreshold) ? 'aligned' : 'guarded';
     // §15.8 applies to every remix this node integrates, and an empty anchor window says nothing
     // about the chain: the tether compares the record with its lineage root, not with memory. This
     // exit returned without one, so the caller had nothing to sever on and a remix drifted past its
     // root's floor kept the lineage exactly where the receiver's memory is thinnest.
-    const csTether = await tetherOfRecord(csCMB.categories, opts.tetherAnchor, config);
+    const csTether = await tetherOfRecord(cs.record.categories, opts.tetherAnchor, config);
     // Cold-start: no category was evaluable, so every per-category verdict is `silent`
     // (admitted on temporal grounds to bootstrap memory, gated on no category).
     return { accepted: true, totalDrift: csTotalDrift, decision: csDecision, maxCategoryDrift: 0, categoryVerdicts: computeCategoryVerdicts(verdictDrifts, config), fusedEntry: csEntry, fusedContent: csContent, effectiveTau: tau, changeSignal: 0, coldStartCause, tether: csTether };
@@ -571,7 +576,7 @@ async function _processHeuristicSVAF(opts) {
   const decision = totalDrift <= config.stableThreshold ? 'aligned' : 'guarded';
 
   const incomingKey = incomingKeyOf(msg.cmb);
-  const fusedCMB = buildFusedRecord({
+  const fused = buildFusedRecord({
     // STORE NO VECTOR (§7.1). createCMB already refuses to put a vector in an emitted record —
     // "Emitters MUST NOT include embedding vectors" — and fusion was putting one back in on the
     // receiver side, so this applies the existing rule to the remix rather than inventing one.
@@ -586,14 +591,17 @@ async function _processHeuristicSVAF(opts) {
     parentRecord: msg.cmb,
     parentCreatedBy: msg.cmb?.createdBy,
     method: 'svaf-heuristic',
-    provenance: { categoryDrift: categoryDrifts, totalDrift, temporalDrift, effectiveTau: tau, changeSignal: 0, fusionMethod: 'svaf-heuristic', fusedAt: now },
   });
-  const fusedKey = fusedCMB.metadata.key;
+  const fusedKey = fused.record.metadata.key;
 
-  const fusedContent = renderCMB(fusedCMB);
-  const fusedEntry = { ...msg, key: fusedKey, content: fusedContent, source: `${localName}+${msg.source || peerName}`, cmb: fusedCMB, storedAt: now };
+  const fusedContent = renderCMB(fused.record);
+  const fusedEntry = {
+    ...msg, key: fusedKey, content: fusedContent, source: `${localName}+${msg.source || peerName}`, cmb: fused.record, storedAt: now,
+    provenance: { categoryDrift: categoryDrifts, totalDrift, temporalDrift, effectiveTau: tau, changeSignal: 0, fusionMethod: 'svaf-heuristic', fusedAt: now },
+    collapsed: fused.collapsed || undefined,
+  };
 
-  const tether = await tetherOfRecord(fusedCMB.categories, opts.tetherAnchor, config);
+  const tether = await tetherOfRecord(fused.record.categories, opts.tetherAnchor, config);
 
   return { accepted: true, decision, totalDrift, categoryVerdicts: computeCategoryVerdicts(verdictDrifts, config, nearestDrifts), fusedEntry, fusedContent, effectiveTau: tau, changeSignal: 0, tether };
 }
diff --git a/lib/frame-handler.js b/lib/frame-handler.js
index b9677fb5..09674cbb 100644
--- a/lib/frame-handler.js
+++ b/lib/frame-handler.js
@@ -26,6 +26,9 @@ const fs = require('fs');
 const path = require('path');
 const { encode, DIM, processHeuristicSVAF, computeCategoryVerdicts, decryptCategories, blockKeyV2, resolveTetherAnchor, tetherOfRecord, signTetherAttestation, verifyTetherAttestation, recomputeKey, classifyAddress, recordAsSigned } = require('./core');
 
+/** Entry members this node writes about an admission, which a frame must never supply. */
+const ENTRY_ANNOTATIONS = Object.freeze(['admission', 'tether', 'provenance', 'collapsed', 'svaf']);
+
 // Receive-path dedup window (MMP §4.2 O2 — rejoin-without-replay convergence).
 // A CMB whose content-hash key we have already processed within this window is
 // suppressed rather than re-evaluated/re-remixed/re-emitted. Bounds the dedup
@@ -751,6 +754,13 @@ class FrameHandler {
       this._node._log(`Ignored a frame-supplied source (${JSON.stringify(String(msg.source)).slice(0, 40)}) on a CMB from ${peerName}`);
       delete msg.source;
     }
+    // The same for what this node records about an admission. The stored entry is built from the
+    // frame (`{ ...msg }`), and these entry members are this node's own: its admission and tether
+    // attestations, its fusion provenance, its collapse, its neural evidence. One a frame carried
+    // would be stored as if this node had written it.
+    for (const own of ENTRY_ANNOTATIONS) {
+      if (Object.prototype.hasOwnProperty.call(msg, own)) delete msg[own];
+    }
 
     // Decrypt E2E-encrypted CMB categories if present
     if (msg.cmb && typeof msg.cmb.categories === 'string' && msg.cmb._e2e) {
@@ -1126,7 +1136,7 @@ class FrameHandler {
       }
     }
     // Admission Attestation (MMP) — the per-category gating verdict, signed + bound to
-    // the gated CMB, persisted on the remix as the durable audit record. The neural
+    // the gated CMB, persisted on the remix's store entry as the durable audit record. The neural
     // path emits per-category drift; map it to verdicts with the same thresholds (Phase A).
     if (incomingKey && fusedEntry.cmb) {
       const categoryVerdicts = computeCategoryVerdicts(category_drifts || {}, {
@@ -1134,7 +1144,8 @@ class FrameHandler {
         guardedThreshold: this._node._svafGuardedThreshold,
       });
       const att = this._node._buildAdmissionAttestation(incomingKey, decision, categoryVerdicts, 'neural');
-      if (att) fusedEntry.cmb.admission = att;
+      // On the entry, beside the record: a two-section record has exactly two members (§8.8.1).
+      if (att) fusedEntry.admission = att;
     }
     // Opaque payload rides alongside CAT7 — carry it onto the admitted remix.
     this._preserveIncomingPayload(fusedEntry, msg);
@@ -1259,11 +1270,12 @@ class FrameHandler {
 
     // Admission Attestation (MMP) — the heuristic gate already produced the per-category
     // verdict (Phase A, result.categoryVerdicts); sign + bind it to the gated CMB and
-    // persist it on the remix as the durable audit record.
+    // persist it on the remix's store entry as the durable audit record.
     if (result.fusedEntry && result.fusedEntry.cmb) {
       const of = recordKey(msg.cmb) || msg.key;
       const att = this._node._buildAdmissionAttestation(of, result.decision, result.categoryVerdicts, 'heuristic');
-      if (att) result.fusedEntry.cmb.admission = att;
+      // On the entry, beside the record: a two-section record has exactly two members (§8.8.1).
+      if (att) result.fusedEntry.admission = att;
     }
     // Opaque payload rides alongside CAT7 — the heuristic fusion rebuilds the
     // CMB from categories and drops it, so re-attach before storing the remix.
@@ -1364,9 +1376,9 @@ class FrameHandler {
    *
    * Attestation: sign the exact evaluation performed — remix key, anchor, kernel identity, drift,
    * verdict — so a downstream receiver that cannot resolve the anchor holds
-   * attested-by-integrator instead of unchecked. Carried on the remix (cmb.tether); trust in the
-   * verdict is weighed through the integrator's resolved authority, and verdicts are comparable
-   * only within one kernelId.
+   * attested-by-integrator instead of unchecked. Kept on the store entry (entry.tether), beside the
+   * record and never inside it (§8.8.1); trust in the verdict is weighed through the integrator's
+   * resolved authority, and verdicts are comparable only within one kernelId.
    * @private
    */
   _applyLineageTether(entry, tether, now) {
@@ -1375,21 +1387,21 @@ class FrameHandler {
     if (!tether.tethered && recordLineage(cmb)) {
       const departedFrom = recordParents(cmb)[0] ?? null;
       setRecordLineage(cmb, null); // fresh root — must clear the section the record ACTUALLY carries
-      cmb.provenance = {
-        ...cmb.provenance,
+      entry.provenance = {
+        ...entry.provenance,
         tether: { severed: true, anchor: tether.anchorKey, kernelId: tether.kernelId, drift: tether.drift, departedFrom },
       };
       this._node._log(`[§15.8] lineage severed: remix drift ${tether.drift.toFixed(3)} from anchor ${String(tether.anchorKey).slice(0, 16)} exceeds the reject floor — stored as fresh root (departed-from in provenance)`);
       this._node.emit('metric', { type: 'lineage-tether-severed', key: recordKey(cmb), anchor: tether.anchorKey, drift: tether.drift });
     } else {
-      cmb.provenance = {
-        ...cmb.provenance,
+      entry.provenance = {
+        ...entry.provenance,
         tether: { severed: false, anchor: tether.anchorKey, kernelId: tether.kernelId, drift: tether.drift },
       };
     }
     if (typeof signTetherAttestation === 'function' && this._node._identity?.privateKey) {
       try {
-        cmb.tether = signTetherAttestation({
+        entry.tether = signTetherAttestation({
           of: recordKey(cmb),
           anchor: tether.anchorKey,
           kernelId: tether.kernelId,
diff --git a/lib/memory-store.js b/lib/memory-store.js
index 1c5443ac..e8f400c6 100644
--- a/lib/memory-store.js
+++ b/lib/memory-store.js
@@ -34,24 +34,43 @@ const { roleRank } = require('./core');
 const isStoreFile = (f) => f.endsWith('.json') && f !== 'migration-v1.json';
 
 /**
- * A stored entry as read from disk, its record restored to exactly what was signed.
+ * What this node records ABOUT a stored record, which lives on the entry beside the record: the
+ * admission attestation, the §15.8 tether attestation, the fusion provenance, and whether the
+ * record is the incoming block itself.
+ */
+const ENTRY_ANNOTATIONS = Object.freeze(['admission', 'tether', 'provenance', 'collapsed']);
+
+/**
+ * An entry whose record is exactly what was signed, for every entry the store writes or reads.
+ *
+ * A two-section record has exactly `categories` and `metadata` (§8.8.1). Stores before 0.13.15 put
+ * more on it, and files they wrote still hold it:
+ *
+ *   lineage     the store's expanded lineage as a top-level member. Readers that take a top-level
+ *               lineage as the record's own (the pre-boundary shape, e.g. classifyAddress) derived
+ *               the wrong address from it and reported the record as a mismatch. The entry carries
+ *               the same lineage on itself, so the copy is dropped.
+ *   admission, tether, provenance, collapsed
+ *               this node's own annotations (ENTRY_ANNOTATIONS). They move onto the entry, where
+ *               they are kept; one the entry already has wins.
  *
- * Stores before 0.13.15 wrote the store's expanded lineage onto every record as a top-level
- * `lineage` member. A two-section record has no such member (§8.8.1: `categories` and `metadata`,
- * lineage in metadata.lineage), and readers that take a top-level lineage as the record's own (the
- * pre-boundary shape, e.g. classifyAddress) derived the wrong address from it and reported the
- * record as a mismatch. The entry carries the same lineage on itself, which is where the store's
- * closure belongs, so dropping the copy loses nothing. A pre-boundary record (no metadata) keeps
- * its top-level lineage: on that shape it is the record's own section.
+ * Applied on write as well as on read, so a writer that still puts them on the record (an
+ * injected admission engine, an older caller) cannot break the shape. A pre-boundary record (no
+ * metadata) is left alone: its top-level members are its own sections.
  */
 function asStored(entry) {
   const cmb = entry && entry.cmb;
-  if (cmb && typeof cmb === 'object' && cmb.metadata && typeof cmb.metadata === 'object'
-      && Object.prototype.hasOwnProperty.call(cmb, 'lineage')) {
-    const record = { ...cmb };
-    delete record.lineage;
-    entry.cmb = record;
+  if (!cmb || typeof cmb !== 'object' || !cmb.metadata || typeof cmb.metadata !== 'object') return entry;
+  const own = (k) => Object.prototype.hasOwnProperty.call(cmb, k);
+  if (!own('lineage') && !ENTRY_ANNOTATIONS.some(own)) return entry;
+  const record = { ...cmb };
+  delete record.lineage;
+  for (const k of ENTRY_ANNOTATIONS) {
+    if (!own(k)) continue;
+    if (entry[k] === undefined) entry[k] = cmb[k];
+    delete record[k];
   }
+  entry.cmb = record;
   return entry;
 }
 
@@ -270,6 +289,7 @@ class MemoryStore {
       lineage,
     };
 
+    asStored(entry);
     if (!this._persist(entry)) return null;
 
     this._cache.set(key, entry);
@@ -328,6 +348,7 @@ class MemoryStore {
       lineage,
     };
 
+    asStored(stored);
     if (!this._persist(stored)) return null;
 
     this._cache.set(key, stored);
diff --git a/lib/node.js b/lib/node.js
index 5fee424c..95ed60db 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -737,8 +737,9 @@ class SymNode extends EventEmitter {
       if (!ev.checked) { report.unchecked++; continue; }
 
       const applySever = !ev.tethered && opts.sever === true;
-      cmb.provenance = {
-        ...cmb.provenance,
+      // On the entry, beside the record: a two-section record has exactly two members (§8.8.1).
+      entry.provenance = {
+        ...entry.provenance,
         tether: {
           severed: applySever, anchor: anchorKey, kernelId: ev.kernelId,
           drift: ev.drift, audited: true,
@@ -746,7 +747,7 @@ class SymNode extends EventEmitter {
         },
       };
       try {
-        cmb.tether = signTetherAttestation({
+        entry.tether = signTetherAttestation({
           of: recordKey(cmb), anchor: anchorKey, kernelId: ev.kernelId, drift: ev.drift,
           verdict: ev.tethered ? 'tethered' : 'severed', by: this.nodeId, at: Date.now(),
         }, this._identity.privateKey);
diff --git a/scripts/two-stock-nodes-driver.cjs b/scripts/two-stock-nodes-driver.cjs
index 1e0b6a2c..8876878c 100644
--- a/scripts/two-stock-nodes-driver.cjs
+++ b/scripts/two-stock-nodes-driver.cjs
@@ -101,16 +101,17 @@ const FOCUS = 'two stock sym nodes prove the open runtime is self-sufficient';
   const stored = evt.entry;
   assert.ok(stored, 'ADMIT: the admitted record must be handed back as a stored entry');
 
-  // The durable, signed record of the verdict is the Admission Attestation on the remix — the
-  // heuristic gate (the ratified production default) carries no `svaf` block on the entry, so
-  // asserting one here would have gated on the neural path nobody runs.
-  const admission = stored.cmb && stored.cmb.admission;
+  // The durable, signed record of the verdict is the Admission Attestation on the remix's store
+  // entry, beside the record (§8.8.1: the record is exactly its two sections) — the heuristic gate
+  // (the ratified production default) carries no `svaf` block on the entry, so asserting one here
+  // would have gated on the neural path nobody runs.
+  const admission = stored.admission;
   assert.ok(admission, 'ADMIT: an admitted remix must carry its signed Admission Attestation');
   assert.strictEqual(admission.of, sent.key,
     `ADMIT: the attestation must bind A's record ${sent.key}, got ${admission.of}`);
   assert.strictEqual(admission.verdict, evt.decision,
     'ADMIT: the persisted verdict must be the verdict that was reached');
-  assert.ok(stored.cmb.provenance && typeof stored.cmb.provenance.totalDrift === 'number',
+  assert.ok(stored.provenance && typeof stored.provenance.totalDrift === 'number',
     'ADMIT: the remix must record the drift it was admitted at');
 
   // LINEAGE, AS v2 DEFINES IT. Heuristic fusion keeps the incoming category text verbatim and v2
@@ -120,7 +121,7 @@ const FOCUS = 'two stock sym nodes prove the open runtime is self-sufficient';
   // are legitimate, so the gate asserts the property that must hold either way — the stored record
   // is reachable back to what A sent.
   const parents = (stored.cmb.metadata && stored.cmb.metadata.lineage && stored.cmb.metadata.lineage.parents) || [];
-  const collapsed = stored.key === sent.key && stored.cmb.collapsed === true;
+  const collapsed = stored.key === sent.key && stored.collapsed === true;
   assert.ok(collapsed || parents.includes(sent.key),
     `LINEAGE: stored remix must either collapse onto A's block ${sent.key} or parent it — ` +
     `got key ${stored.key}, parents [${parents.join(', ')}]`);
@@ -141,7 +142,7 @@ const FOCUS = 'two stock sym nodes prove the open runtime is self-sufficient';
   assert.ok(survivor,
     `RESTART: after restarting B, the admitted record descending from ${sent.key} was not recallable ` +
     `(recall returned ${recalled.length} entr${recalled.length === 1 ? 'y' : 'ies'})`);
-  assert.ok(survivor.cmb && survivor.cmb.admission && survivor.cmb.admission.of === sent.key,
+  assert.ok(survivor.admission && survivor.admission.of === sent.key,
     'RESTART: the survivor must still carry the signed attestation of its admission — a record that ' +
     'survives without its verdict cannot be audited later');
   console.log(`  after restart B recalled it, lineage intact`);
diff --git a/tests/admission-attestation.test.js b/tests/admission-attestation.test.js
index 5dd3362e..493cd648 100644
--- a/tests/admission-attestation.test.js
+++ b/tests/admission-attestation.test.js
@@ -4,10 +4,10 @@ require('./_isolate-home'); // redirect $HOME to a temp sandbox before lib/confi
 
 /**
  * Phase C — the node builds + signs an Admission Attestation when it gates a CMB,
- * and the store persists it on the remix.
+ * and the store persists it on the remix's entry.
  *
  * Deterministic (no encoder / no SVAF run): exercises node._buildAdmissionAttestation
- * directly and the memory-store preservation of cmb.admission. The full receive-path
+ * directly and the memory-store preservation of entry.admission. The full receive-path
  * wiring (frame-handler attaches it on admit) is covered by the integration test
  * tests/integration/e2e-admission.js.
  */
@@ -19,7 +19,7 @@ const fs = require('fs');
 const { SymNode } = require('../lib/node');
 const { NullDiscovery } = require('../lib/discovery');
 const { nodeDir } = require('../lib/config');
-const { verifyAttestation, verifyAttestationRole, signAttestation } = require('../lib/core');
+const { verifyAttestation, verifyAttestationRole, signAttestation, createCMB } = require('../lib/core');
 
 // Construct (no start) — the builder needs only identity / room / role / chain state.
 function withNode(baseName, opts, fn) {
@@ -69,19 +69,29 @@ describe('node._buildAdmissionAttestation', () => {
   });
 });
 
-describe('memory-store persists cmb.admission on the remix', () => {
+describe('memory-store persists the admission attestation on the remix\'s entry', () => {
+  // The attestation is this node's record ABOUT the remix, so it lives on the entry beside the
+  // record; a two-section record has exactly `categories` and `metadata` (§8.8.1).
+  const record = () => createCMB({ categories: { focus: 'f', issue: 'i', intent: 'n', motivation: 'm', commitment: 'c', perspective: 'p', mood: 'neutral' }, createdBy: 'peer' });
+
   it('preserves a signed admission attestation through receiveFromPeer', () => {
     withNode('att-store', { lifecycleRole: 'participant', room: 'g' }, (node) => {
       const att = node._buildAdmissionAttestation('cmb-of', 'aligned', verdicts, 'heuristic');
-      const entry = {
-        source: `${node.name}+peer`, content: 'x',
-        cmb: { key: 'remix-1', categories: { focus: { text: 'f' } }, admission: att },
-        storedAt: Date.now(),
-      };
+      const entry = { source: `${node.name}+peer`, content: 'x', cmb: record(), admission: att, storedAt: Date.now() };
       const stored = node._store.receiveFromPeer('peer-id', entry);
-      assert.ok(stored && stored.cmb && stored.cmb.admission, 'admission preserved on the stored remix');
-      assert.strictEqual(stored.cmb.admission.of, 'cmb-of');
-      assert.deepStrictEqual(verifyAttestation(stored.cmb.admission, node._identity.publicKey), { signed: true, valid: true });
+      assert.ok(stored && stored.admission, 'admission preserved on the stored remix\'s entry');
+      assert.strictEqual(stored.admission.of, 'cmb-of');
+      assert.deepStrictEqual(verifyAttestation(stored.admission, node._identity.publicKey), { signed: true, valid: true });
+      assert.deepStrictEqual(Object.keys(stored.cmb).sort(), ['categories', 'metadata']);
+    });
+  });
+
+  it('a writer that still puts it on the record has it moved onto the entry', () => {
+    withNode('att-store-lift', { lifecycleRole: 'participant', room: 'g' }, (node) => {
+      const att = node._buildAdmissionAttestation('cmb-of', 'aligned', verdicts, 'heuristic');
+      const stored = node._store.receiveFromPeer('peer-id', { content: 'x', cmb: { ...record(), admission: att }, storedAt: Date.now() });
+      assert.deepStrictEqual(Object.keys(stored.cmb).sort(), ['categories', 'metadata'], 'the record keeps exactly its two sections');
+      assert.deepStrictEqual(verifyAttestation(stored.admission, node._identity.publicKey), { signed: true, valid: true });
     });
   });
 });
diff --git a/tests/integration/e2e-admission.js b/tests/integration/e2e-admission.js
index e7153274..94d0bb48 100644
--- a/tests/integration/e2e-admission.js
+++ b/tests/integration/e2e-admission.js
@@ -7,7 +7,7 @@ require('../_isolate-home'); // sandbox HOME/USERPROFILE: node state must never
  * remix it stores (MMP admission-attestation layer, Phase C).
  *
  * Two wired in-process nodes; A sends a directed CMB to B; B gates it (heuristic
- * forced) and ADMITS it; the stored remix's cmb.admission must be a valid signed
+ * forced) and ADMITS it; the stored remix's entry.admission must be a valid signed
  * attestation bound to A's CMB, attributed to B, signed by B's identity key.
  *
  * Run with: npm run test:integration (heuristic path loads the encoder).
@@ -59,8 +59,9 @@ describe('E2E Admission Attestation — gate attaches a signed verdict to the re
       const admitted = await (async () => { for (let i = 0; i < 100 && !received; i++) await sleep(50); return !!received; })();
       assert.ok(admitted, 'B must process and admit the directed CMB');
 
-      const att = received.entry?.cmb?.admission;
-      assert.ok(att, 'stored remix carries an admission attestation');
+      // On the store entry, beside the record (§8.8.1: the record is exactly its two sections).
+      const att = received.entry?.admission;
+      assert.ok(att, 'stored remix\'s entry carries an admission attestation');
       assert.strictEqual(att.of, entry.key, 'attestation is bound to A\'s gated CMB');
       assert.strictEqual(att.by, B.nodeId, 'attested by the gating node B');
       assert.strictEqual(att.roster, 'sym-bot-team', 'scoped to B\'s roster');
diff --git a/tests/integration/e2e-cmb-path.js b/tests/integration/e2e-cmb-path.js
index d9254508..e5565172 100644
--- a/tests/integration/e2e-cmb-path.js
+++ b/tests/integration/e2e-cmb-path.js
@@ -146,8 +146,8 @@ describe('E2E CMB path — MMP §4.2 / §4.4.4 / §9.2', () => {
       {
         const storedEntry = outcomes.memoryReceived.entry;
         assert.ok(storedEntry, 'memory-received event should carry the fused entry');
-        // The gate's evidence: the neural path writes `svaf`, the heuristic path `cmb.provenance`.
-        const evidence = storedEntry.svaf || storedEntry.cmb?.provenance;
+        // The gate's evidence, on the entry: the neural path writes `svaf`, the heuristic path `provenance`.
+        const evidence = storedEntry.svaf || storedEntry.provenance;
         assert.ok(evidence, 'an admission carries the SVAF evaluation (§9.2)');
         assert.ok(typeof evidence.totalDrift === 'number', 'totalDrift is numeric');
         // B adds no new cognition (the heuristic gate keeps the text verbatim), so content
diff --git a/tests/lineage-tether-audit.test.js b/tests/lineage-tether-audit.test.js
index e6816d58..0a2a5873 100644
--- a/tests/lineage-tether-audit.test.js
+++ b/tests/lineage-tether-audit.test.js
@@ -75,9 +75,9 @@ describe('MMP §15.8 retroactive tether audit', () => {
 
       const l1 = node._store.get(laundered.key);
       assert.ok(l1.cmb.metadata.lineage && (l1.cmb.metadata.lineage.parents || []).length === 1, 'lineage kept in annotate-only mode');
-      assert.strictEqual(l1.cmb.provenance.tether.audited, true);
-      assert.ok(l1.cmb.provenance.tether.drift > 0.5);
-      const att = l1.cmb.tether;
+      assert.strictEqual(l1.provenance.tether.audited, true);
+      assert.ok(l1.provenance.tether.drift > 0.5);
+      const att = l1.tether;
       assert.strictEqual(att.verdict, 'severed', 'attestation records the evaluation outcome');
       assert.strictEqual(verifyTetherAttestation(att, node._identity.publicKey).valid, true);
 
@@ -86,13 +86,13 @@ describe('MMP §15.8 retroactive tether audit', () => {
       assert.strictEqual(r2.severed, 1);
       const l2 = node._store.get(laundered.key);
       assert.ok(!l2.cmb.metadata.lineage || (l2.cmb.metadata.lineage.parents || []).length === 0, 'laundered chain severed');
-      assert.strictEqual(l2.cmb.provenance.tether.departedFrom, rootA.key);
+      assert.strictEqual(l2.provenance.tether.departedFrom, rootA.key);
       assert.ok(![...node._store._index.byAncestor.get(rootA.key) ?? []].includes(laundered.key),
         'ancestor index no longer lists the severed remix');
 
       const f2 = node._store.get(faithful.key);
       assert.ok(f2.cmb.metadata.lineage && f2.cmb.metadata.lineage.ancestors.includes(rootB.key), 'faithful chain untouched');
-      assert.strictEqual(f2.cmb.tether.verdict, 'tethered');
+      assert.strictEqual(f2.tether.verdict, 'tethered');
     } finally {
       await node.stop();
       fs.rmSync(nodeDir(name), { recursive: true, force: true });
@@ -120,8 +120,8 @@ describe('MMP §15.8 retroactive tether audit', () => {
       assert.strictEqual(r.fetched, 0, 'the local unverified copy is not a fetch');
       assert.strictEqual(r.unchecked, 1, 'the tether is unverified');
       const e = node._store.get(remix.key);
-      assert.strictEqual(e.cmb.tether, undefined, 'no tether attestation names the unverified record');
-      assert.strictEqual(e.cmb.provenance?.tether, undefined);
+      assert.strictEqual(e.tether, undefined, 'no tether attestation names the unverified record');
+      assert.strictEqual(e.provenance?.tether, undefined);
     } finally {
       await node.stop();
       fs.rmSync(nodeDir(name), { recursive: true, force: true });
diff --git a/tests/lineage-tether-neural.test.js b/tests/lineage-tether-neural.test.js
index c20a7e74..593e6cac 100644
--- a/tests/lineage-tether-neural.test.js
+++ b/tests/lineage-tether-neural.test.js
@@ -88,7 +88,7 @@ async function admitThrough(path, rootText, frameOf) {
     else await node._frameHandler._processHeuristicSVAF(frame, 'peerA', 'peerA', now, now, 0);
     const stored = node._store.get(frame.cmb.metadata.key);
     assert.ok(stored, `${path}: the remix is stored`);
-    const att = stored.cmb.tether;
+    const att = stored.tether;
     return {
       root, stored, att,
       attValid: att ? verifyTetherAttestation(att, node._identity.publicKey).valid : null,
@@ -112,9 +112,9 @@ describe('MMP §15.8 lineage tether on the neural admission path', () => {
       assert.ok(stored, 'the neural evaluator admitted the remix');
       assert.strictEqual(stored.svaf?.method, 'neural', 'precondition: the neural path stored it');
       assert.strictEqual(stored.cmb.metadata.lineage, null, 'the laundered lineage is severed');
-      assert.strictEqual(stored.cmb.provenance?.tether?.severed, true);
-      assert.strictEqual(stored.cmb.provenance.tether.departedFrom, root.metadata.key);
-      const att = stored.cmb.tether;
+      assert.strictEqual(stored.provenance?.tether?.severed, true);
+      assert.strictEqual(stored.provenance.tether.departedFrom, root.metadata.key);
+      const att = stored.tether;
       assert.ok(att, 'a tether attestation is attached');
       assert.strictEqual(att.verdict, 'severed');
       assert.strictEqual(att.anchor, root.metadata.key);
@@ -139,7 +139,7 @@ describe('MMP §15.8 lineage tether on the neural admission path', () => {
       assert.strictEqual(neural.att.kernelId, heuristic.att.kernelId, 'one kernel, so the drifts are comparable');
       assert.strictEqual(neural.att.drift.toFixed(6), heuristic.att.drift.toFixed(6), 'same drift: one computation');
       const withoutDrift = ({ drift, ...rest }) => rest; // drift is compared above, to the precision it is signed at
-      assert.deepStrictEqual(withoutDrift(neural.stored.cmb.provenance.tether), withoutDrift(heuristic.stored.cmb.provenance.tether), 'same provenance');
+      assert.deepStrictEqual(withoutDrift(neural.stored.provenance.tether), withoutDrift(heuristic.stored.provenance.tether), 'same provenance');
       assert.deepStrictEqual(neural.stored.cmb.metadata.lineage, heuristic.stored.cmb.metadata.lineage, 'same lineage outcome');
       assert.strictEqual(neural.att.verdict, rootText === TOPIC_A ? 'severed' : 'tethered');
     });
@@ -152,7 +152,7 @@ describe('MMP §15.8 lineage tether on the neural admission path', () => {
     for (const path of ['neural', 'heuristic']) {
       const r = await admitThrough(path, TOPIC_B_ROOT, frameOf);
       assert.strictEqual(r.att, undefined, `${path}: no tether attestation is stored`);
-      assert.strictEqual(r.stored.cmb.provenance?.tether, undefined, `${path}: the tether is unverified, not evaluated`);
+      assert.strictEqual(r.stored.provenance?.tether, undefined, `${path}: the tether is unverified, not evaluated`);
       assert.deepStrictEqual(r.stored.cmb.metadata.lineage.parents, ['cmb-' + 'e'.repeat(64)], `${path}: lineage is kept`);
     }
   });
diff --git a/tests/lineage-tether-reproducible.test.js b/tests/lineage-tether-reproducible.test.js
index a4d8e2c5..bcc371c6 100644
--- a/tests/lineage-tether-reproducible.test.js
+++ b/tests/lineage-tether-reproducible.test.js
@@ -108,9 +108,9 @@ describe('§15.8 tether is reproducible by any holder of the root and the record
         for (const t of memory) node.remember(cat7(t));
         const stored = await admit(node, remixFrame(INCOMING, root.key));
         assert.ok(stored, `${label}: the remix admits`);
-        assert.ok(stored.cmb.tether, `${label}: the integrator signed a tether`);
-        assert.strictEqual(stored.cmb.tether.anchor, root.key, `${label}: anchored on the shared root`);
-        seen.push({ label, att: stored.cmb.tether, record: stored.cmb, root: root.cmb, node });
+        assert.ok(stored.tether, `${label}: the integrator signed a tether`);
+        assert.strictEqual(stored.tether.anchor, root.key, `${label}: anchored on the shared root`);
+        seen.push({ label, att: stored.tether, record: stored.cmb, root: root.cmb, node });
       });
     }
     const [a, b] = seen;
@@ -210,9 +210,9 @@ describe('§15.8 cold-start admissions carry a tether like warm ones (B-L6)', ()
         const peerRoot = createCMB({ categories: cat7(ROOT), createdBy: 'peerA' });
         const stored = await admit(node, { type: 'cmb', timestamp: Date.now(), content: ROOT, cmb: peerRoot });
         assert.ok(stored, `${warm ? 'warm' : 'cold'}: the root admits`);
-        assert.strictEqual(stored.cmb.tether?.anchor, peerRoot.metadata.key, `${warm ? 'warm' : 'cold'}: a root is its own anchor`);
-        assert.strictEqual(stored.cmb.tether.verdict, 'tethered');
-        assert.strictEqual(stored.cmb.provenance?.tether?.severed, false);
+        assert.strictEqual(stored.tether?.anchor, peerRoot.metadata.key, `${warm ? 'warm' : 'cold'}: a root is its own anchor`);
+        assert.strictEqual(stored.tether.verdict, 'tethered');
+        assert.strictEqual(stored.provenance?.tether?.severed, false);
       });
     }
   });
diff --git a/tests/lineage-tether-severance.test.js b/tests/lineage-tether-severance.test.js
index 47d1df76..d5759d4e 100644
--- a/tests/lineage-tether-severance.test.js
+++ b/tests/lineage-tether-severance.test.js
@@ -106,17 +106,18 @@ describe('MMP §15.8 lineage tether — severance through the gate', () => {
     await withNode('tether-sever', async (node) => {
       const { accepted } = await seedAndReceive(node, TOPIC_A, TOPIC_B_NEW);
       assert.strictEqual(accepted.length, 1, 'incoming admits (aligned with recent topic-B anchors)');
-      const cmb = accepted[0].cmb;
+      const entry = accepted[0];
+      const cmb = entry.cmb;
       assert.ok(isRootShaped(cmb.metadata.lineage), 'lineage severed — stored as a fresh root');
-      assert.ok(cmb.provenance.tether, 'tether recorded in provenance');
-      assert.strictEqual(cmb.provenance.tether.severed, true);
-      assert.ok(cmb.provenance.tether.drift > 0.5, `drift ${cmb.provenance.tether.drift} exceeds the reject floor`);
-      assert.ok(cmb.provenance.tether.departedFrom, 'departed source recorded informally');
+      assert.ok(entry.provenance.tether, 'tether recorded in provenance');
+      assert.strictEqual(entry.provenance.tether.severed, true);
+      assert.ok(entry.provenance.tether.drift > 0.5, `drift ${entry.provenance.tether.drift} exceeds the reject floor`);
+      assert.ok(entry.provenance.tether.departedFrom, 'departed source recorded informally');
 
       // §15.8 tether attestation: the integrator's signed record of this exact
       // evaluation rides the remix, verifiable against the node's identity key,
       // and names the kernel the verdict was made in.
-      const att = cmb.tether;
+      const att = entry.tether;
       assert.ok(att, 'tether attestation attached');
       assert.strictEqual(att.verdict, 'severed');
       assert.strictEqual(att.of, cmb.metadata.key);
@@ -130,12 +131,13 @@ describe('MMP §15.8 lineage tether — severance through the gate', () => {
     await withNode('tether-keep', async (node) => {
       const { root, accepted } = await seedAndReceive(node, TOPIC_B_ROOT, TOPIC_B_NEW);
       assert.strictEqual(accepted.length, 1, 'incoming admits');
-      const cmb = accepted[0].cmb;
+      const entry = accepted[0];
+      const cmb = entry.cmb;
       assert.ok(!isRootShaped(cmb.metadata.lineage), 'lineage intact');
       assert.ok(cmb.metadata.lineage.ancestors.includes(root.key), 'chain still reaches its root');
-      assert.strictEqual(cmb.provenance.tether.severed, false);
-      assert.ok(cmb.provenance.tether.drift <= 0.5);
-      assert.strictEqual(cmb.tether?.verdict, 'tethered', 'kept chains carry a tethered attestation');
+      assert.strictEqual(entry.provenance.tether.severed, false);
+      assert.ok(entry.provenance.tether.drift <= 0.5);
+      assert.strictEqual(entry.tether?.verdict, 'tethered', 'kept chains carry a tethered attestation');
     });
   });
 
@@ -164,11 +166,11 @@ describe('MMP §15.8 lineage tether — severance through the gate', () => {
         assert.ok(remix, 'the remix admits');
         assert.deepStrictEqual(remix.cmb.metadata.lineage.parents, [parent.metadata.key], 'lineage is kept either way');
         if (verified) {
-          assert.strictEqual(remix.cmb.tether?.anchor, parent.metadata.key, 'a verified parent anchors the tether');
-          assert.strictEqual(remix.cmb.tether.verdict, 'tethered');
+          assert.strictEqual(remix.tether?.anchor, parent.metadata.key, 'a verified parent anchors the tether');
+          assert.strictEqual(remix.tether.verdict, 'tethered');
         } else {
-          assert.strictEqual(remix.cmb.tether, undefined, 'no tether attestation names an unverified record');
-          assert.strictEqual(remix.cmb.provenance?.tether, undefined, 'the tether is unverified, not evaluated');
+          assert.strictEqual(remix.tether, undefined, 'no tether attestation names an unverified record');
+          assert.strictEqual(remix.provenance?.tether, undefined, 'the tether is unverified, not evaluated');
         }
       });
     });
diff --git a/tests/stored-entry-annotations.test.js b/tests/stored-entry-annotations.test.js
new file mode 100644
index 00000000..5f410b34
--- /dev/null
+++ b/tests/stored-entry-annotations.test.js
@@ -0,0 +1,123 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME to a temp sandbox before lib/config loads
+
+/**
+ * What a node records ABOUT an admitted record lives on the store entry, beside the record.
+ *
+ * A two-section record has exactly `categories` and `metadata` (§8.8.1). The receive path added
+ * four more members to the stored record: `admission` (the admission attestation), `tether` (the
+ * §15.8 attestation), `provenance` (fusion evidence and the tether annotation) and `collapsed`. None
+ * is the author's, none is signed, and each made the stored record a shape no reader of the record
+ * format expects. They are entry members now, and files written before keep reading.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const crypto = require('crypto');
+const fs = require('fs');
+const path = require('path');
+const { SymNode } = require('../lib/node');
+const { NullDiscovery } = require('../lib/discovery');
+const { nodeDir } = require('../lib/config');
+const { tmpdir } = require('./_tmpdir');
+const { MemoryStore } = require('../lib/memory-store');
+const { createCMB, signCMB, verifyCMB, verifyAttestation, verifyTetherAttestation } = require('../lib/core');
+
+const ALIGNED = { decision: 'aligned', total_drift: 0.1, category_drifts: { focus: 0.1 }, gate_values: { focus: 1 } };
+
+function rawKeypair() {
+  const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519', {
+    publicKeyEncoding: { type: 'spki', format: 'der' },
+    privateKeyEncoding: { type: 'pkcs8', format: 'der' },
+  });
+  return { pub: publicKey.slice(-32).toString('base64url'), priv: privateKey.slice(-32).toString('base64url') };
+}
+const AUTHOR = rawKeypair();
+
+function cat7(t) {
+  return {
+    focus: t, issue: t, intent: t, motivation: t, commitment: t,
+    perspective: 'peerA', mood: { text: 'neutral', valence: 0, arousal: 0 },
+  };
+}
+
+async function withNode(opts, fn) {
+  const name = `annotations-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+  const node = new SymNode({ name, silent: true, discovery: new NullDiscovery(), ...opts });
+  await node.start();
+  try {
+    return await fn(node);
+  } finally {
+    await node.stop();
+    fs.rmSync(nodeDir(name), { recursive: true, force: true });
+  }
+}
+
+describe('admission annotations live on the store entry', () => {
+  for (const path_ of ['heuristic', 'neural']) {
+    it(`${path_} path: the stored record is exactly {categories, metadata}; the entry carries the rest`, async () => {
+      const opts = path_ === 'neural' ? { svafEvaluator: { evaluate: async () => ALIGNED } } : {};
+      await withNode(opts, async (node) => {
+        node._pinPeerKey('peerA', AUTHOR.pub);
+        const record = createCMB({ categories: cat7(`an observation admitted through the ${path_} path`), createdBy: 'peerA' });
+        signCMB(record, AUTHOR.priv);
+        // A frame that also tries to supply the node's own annotations.
+        const frame = {
+          type: 'cmb', timestamp: Date.now(), cmb: JSON.parse(JSON.stringify(record)),
+          admission: { forged: true }, provenance: { forged: true }, tether: { forged: true }, collapsed: 'forged', svaf: { forged: true },
+        };
+        await node._frameHandler._handleMemoryShare('peerA', 'peerA', frame);
+
+        const entry = node._store.get(record.metadata.key);
+        assert.ok(entry, 'admitted and stored');
+        assert.strictEqual(entry.svaf?.method === 'neural', path_ === 'neural', 'precondition: the intended path stored it');
+        assert.deepStrictEqual(Object.keys(entry.cmb).sort(), ['categories', 'metadata'], 'the record has exactly its two sections');
+        assert.strictEqual(verifyCMB(entry.cmb, AUTHOR.pub).valid, true, 'and still verifies under its author\'s key');
+        const onDisk = JSON.parse(fs.readFileSync(path.join(node._store._dir, `${entry.key}.json`), 'utf8'));
+        assert.deepStrictEqual(Object.keys(onDisk.cmb).sort(), ['categories', 'metadata'], 'on disk too');
+
+        assert.strictEqual(entry.admission?.of, record.metadata.key, 'the admission attestation is on the entry');
+        assert.strictEqual(entry.admission.by, node.nodeId);
+        assert.deepStrictEqual(verifyAttestation(entry.admission, node._identity.publicKey), { signed: true, valid: true });
+        assert.strictEqual(entry.tether?.anchor, record.metadata.key, 'the tether attestation is on the entry (a root is its own anchor)');
+        assert.strictEqual(verifyTetherAttestation(entry.tether, node._identity.publicKey).valid, true);
+        assert.strictEqual(entry.provenance?.tether?.severed, false, 'the provenance is on the entry');
+        assert.strictEqual(entry.provenance.forged, undefined, 'nothing the frame supplied reached it');
+        assert.strictEqual(entry.collapsed, true, 'the record is the incoming block itself');
+        if (path_ === 'heuristic') {
+          assert.strictEqual(typeof entry.provenance.totalDrift, 'number', 'the gate\'s evidence');
+          assert.strictEqual(entry.svaf, undefined, 'no neural evidence a frame supplied');
+        }
+      });
+    });
+  }
+
+  it('a store file written before reads back with its annotations on the entry', async () => {
+    const dir = tmpdir('sym-annotations-legacy-');
+    const record = createCMB({ categories: cat7('a record stored by an earlier version'), createdBy: 'peerA' });
+    signCMB(record, AUTHOR.priv);
+    const admission = { of: record.metadata.key, by: 'n1', verdict: 'aligned' };
+    const tether = { of: record.metadata.key, anchor: record.metadata.key, verdict: 'tethered', by: 'n1' };
+    const provenance = { totalDrift: 0.1, tether: { severed: false } };
+    // The shape the receive path used to persist.
+    const stale = {
+      key: record.metadata.key, content: 'x', peerId: 'peer', storedAt: Date.now(), lineage: { parents: [], ancestors: [], method: null },
+      cmb: { ...record, admission, tether, provenance, collapsed: true },
+    };
+    fs.writeFileSync(path.join(dir, `${stale.key}.json`), JSON.stringify(stale, null, 2));
+
+    const syncStore = new MemoryStore(dir, 'receiver');
+    const asyncStore = new MemoryStore(dir, 'receiver');
+    await asyncStore.load();
+    for (const [label, store] of [['first touch', syncStore], ['load()', asyncStore]]) {
+      const entry = store.get(stale.key);
+      assert.deepStrictEqual(Object.keys(entry.cmb).sort(), ['categories', 'metadata'], `${label}: the record has exactly its two sections`);
+      assert.strictEqual(verifyCMB(entry.cmb, AUTHOR.pub).valid, true, `${label}: and verifies`);
+      assert.deepStrictEqual(
+        { admission: entry.admission, tether: entry.tether, provenance: entry.provenance, collapsed: entry.collapsed },
+        { admission, tether, provenance, collapsed: true },
+        `${label}: every annotation is still there, on the entry`);
+    }
+  });
+});

From cee4808fca4b73ba429b3398a931d00d6de8969d Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 19:44:21 +0100
Subject: [PATCH 035/148] =?UTF-8?q?=C2=A715.8=20severance=20lives=20on=20t?=
 =?UTF-8?q?he=20entry;=20the=20author's=20record=20stays=20as=20signed?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When the gate admits a block unchanged, the record it stores is the
author's signed block. Severance nulled that record's metadata.lineage,
which the signature covers, so a severed record failed verification under
its author's key. The retroactive audit did the same to stored records,
which are immutable once created (§8).

Severance is now kept where this node's judgements live:
- MemoryStore stores the entry's lineage as a root marked severed
  (receiveFromPeer opts.severLineage for the gate; severLineage(key) for
  the audit, replacing unlinkLineage) and the index treats it as a root,
  including when rebuilt from disk;
- isLineageSevered(entry) (lineage-tether) is honoured by every walk of
  stored lineage: the §15.8 anchor walk, the index build, the audit (which
  no longer re-audits a severed entry) and mesh-agent's remix-of-remix
  check, which now reads the store's lineage first;
- _applyLineageTether edits a record only when it is the remix this node
  is minting right now (not collapsed, unsigned), which §15.8 says to mint
  as a root; otherwise it reports the severance for the store to record.

The neural path also wrote a new key and lineage into the author's record
when the carried address was not the content's own, keeping the author's
name and a signature that no longer covered it. It now builds its record
with the heuristic gate's buildFusedRecord (exported), so a non-collapsing
block is minted as this node's own remix and the two paths cannot diverge.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 lib/core/lineage-tether.js             |  22 +++-
 lib/core/svaf-baseline.js              |   2 +-
 lib/frame-handler.js                   |  83 +++++++--------
 lib/memory-store.js                    |  42 ++++++--
 lib/mesh-agent.js                      |   4 +-
 lib/node.js                            |  13 +--
 tests/lineage-severance-signed.test.js | 139 +++++++++++++++++++++++++
 tests/lineage-tether-audit.test.js     |   5 +-
 tests/lineage-tether-neural.test.js    |   8 +-
 tests/lineage-tether-severance.test.js |   7 +-
 tests/mesh-agent.test.js               |  24 +++++
 tests/neural-admission-copy.test.js    |  19 ++++
 12 files changed, 298 insertions(+), 70 deletions(-)
 create mode 100644 tests/lineage-severance-signed.test.js

diff --git a/lib/core/lineage-tether.js b/lib/core/lineage-tether.js
index 0332c7db..1341f906 100644
--- a/lib/core/lineage-tether.js
+++ b/lib/core/lineage-tether.js
@@ -102,6 +102,22 @@ function computeLineageTether({ remixCategories, anchorCategories, categoryWeigh
  * @param {string} key   - the key the walk looked the entry up under.
  * @returns {boolean}
  */
+/**
+ * Whether this node severed a stored entry's lineage (§15.8).
+ *
+ * Severance is the receiver's judgement about a chain, so it is kept on the entry
+ * (`entry.lineage.severed`, written by MemoryStore) and never written into the record: the record
+ * is usually the author's signed block, whose signature covers its lineage. The record therefore
+ * still names its parents, and every walk of stored lineage must ask the entry before following
+ * them.
+ *
+ * @param {object} entry - a stored entry.
+ * @returns {boolean}
+ */
+function isLineageSevered(entry) {
+  return entry?.lineage?.severed === true;
+}
+
 function storedRecordVerifies(entry, key) {
   if (!entry || typeof entry !== 'object') return false;
   const cmb = entry.cmb;
@@ -191,7 +207,9 @@ function resolveTetherAnchor(incomingCMB, getEntry) {
     if (t < bestTime || (t === bestTime && best && key < best.key)) {
       bestTime = t; best = { key, categories: cmb.categories, resolvedFromStore: true };
     }
-    // Continue the VERIFIED walk from this stored record's own parents (never its wire ancestors).
+    // Continue the VERIFIED walk from this stored record's own parents (never its wire ancestors),
+    // unless this node severed them: the record still names them as signed, the entry says no.
+    if (isLineageSevered(entry)) continue;
     for (const pk of parentsOf(cmb)) if (!seen.has(pk)) frontier.push({ key: pk, depth: depth + 1 });
   }
   if (best) return { ...best, complete };
@@ -289,4 +307,4 @@ async function tetherOfRecord(recordCategories, tetherAnchor, config) {
   return { anchorKey: tetherAnchor.key ?? null, ...ev };
 }
 
-module.exports = { computeLineageTether, resolveTetherAnchor, storedRecordVerifies, evaluateLineageTetherFromText, tetherOfRecord };
+module.exports = { computeLineageTether, resolveTetherAnchor, storedRecordVerifies, isLineageSevered, evaluateLineageTetherFromText, tetherOfRecord };
diff --git a/lib/core/svaf-baseline.js b/lib/core/svaf-baseline.js
index 47e3cb41..8fd8a6dd 100644
--- a/lib/core/svaf-baseline.js
+++ b/lib/core/svaf-baseline.js
@@ -607,6 +607,6 @@ async function _processHeuristicSVAF(opts) {
 }
 
 module.exports = {
-  computeCategoryDrifts, processHeuristicSVAF, computeCategoryVerdicts,
+  computeCategoryDrifts, processHeuristicSVAF, computeCategoryVerdicts, buildFusedRecord,
   CATEGORY_VERDICT, DEFAULT_REDUNDANCY_THRESHOLD,
 };
diff --git a/lib/frame-handler.js b/lib/frame-handler.js
index 09674cbb..e8c00630 100644
--- a/lib/frame-handler.js
+++ b/lib/frame-handler.js
@@ -24,7 +24,7 @@ const { assertRecordSize } = require('./core/cmb-encoder');
 
 const fs = require('fs');
 const path = require('path');
-const { encode, DIM, processHeuristicSVAF, computeCategoryVerdicts, decryptCategories, blockKeyV2, resolveTetherAnchor, tetherOfRecord, signTetherAttestation, verifyTetherAttestation, recomputeKey, classifyAddress, recordAsSigned } = require('./core');
+const { encode, DIM, processHeuristicSVAF, buildFusedRecord, computeCategoryVerdicts, decryptCategories, resolveTetherAnchor, tetherOfRecord, signTetherAttestation, verifyTetherAttestation, recomputeKey, classifyAddress, categoriesAsSigned } = require('./core');
 
 /** Entry members this node writes about an admission, which a frame must never supply. */
 const ENTRY_ANNOTATIONS = Object.freeze(['admission', 'tether', 'provenance', 'collapsed', 'svaf']);
@@ -1086,15 +1086,30 @@ class FrameHandler {
       return;
     }
 
-    // Propagate lineage: fused CMB is a child of the incoming CMB
     const incomingKey = recordKey(msg.cmb) || msg.key;
+    // The record to store, built by the same function as the heuristic gate's (buildFusedRecord),
+    // never the caller's object and never an edit of the author's signed record. Neural evaluation
+    // keeps the incoming text, so under content-only addressing the record collapses onto the
+    // incoming block (§7.5 collapse-before-mint: cite, do not mint, claim no descent from oneself)
+    // and is a copy of the author's record as signed. Only when the carried address is not the
+    // content's own does this node mint a remix of its own citing it. This path used to write the
+    // new key and lineage into the author's record instead, keeping the author's name and a
+    // signature that no longer covered it.
+    const fused = msg.cmb?.categories && typeof msg.cmb.categories === 'object'
+      ? buildFusedRecord({
+        categories: categoriesAsSigned(msg.cmb.categories),
+        createdBy: this._node.name,
+        parentKey: incomingKey || null,
+        parentLineage: recordLineage(msg.cmb),
+        parentRecord: msg.cmb,
+        parentCreatedBy: msg.cmb.createdBy,
+        method: 'svaf-neural',
+      })
+      : null;
 
     const fusedEntry = {
       ...msg,
-      // A copy of the record as its author signed it, never the caller's object. Everything below
-      // writes to the record this node stores; on the incoming object it reached the caller's
-      // frame. The heuristic path stores a record built the same way (recordAsSigned).
-      cmb: msg.cmb ? recordAsSigned(msg.cmb) : msg.cmb,
+      ...(fused ? { key: fused.record.metadata.key, cmb: fused.record, collapsed: fused.collapsed || undefined } : {}),
       source: `${this._node.name}+${msg.source || peerName}`,
       storedAt: now,
       svaf: {
@@ -1105,36 +1120,6 @@ class FrameHandler {
         gateValues: gate_values,
       },
     };
-    // §7.5 COLLAPSE-BEFORE-MINT [MUST] — the Rule A self-loop.
-    //
-    // This used to mint a remix key over categories + parents + the RECEIVER'S NAME, which
-    // guaranteed remix key != parent key by construction. Under content-only addressing that
-    // guarantee is gone and must be replaced by a check rather than assumed: a fusion that
-    // leaves the content unchanged (first-observation forwarding, a redundant re-assertion)
-    // now addresses to exactly the parent's key, so writing lineage.parents = [incomingKey]
-    // would produce the edge K -> K. A reachability walk never leaves it.
-    //
-    // The collapse property is what prevents it: the re-assertion MINTS NOTHING and cites the
-    // address that already exists. Rule A is sound under content-only addressing IFF collapse
-    // holds, so this is the place that has to hold it.
-    if (incomingKey && fusedEntry.cmb) {
-      const fusedKey = blockKeyV2(fusedEntry.cmb.categories);
-      if (fusedKey === incomingKey) {
-        // Nothing new was said. Cite, do not mint, and do not claim descent from oneself.
-        // The record IS the author's block: its own lineage and signature stay as signed
-        // (the heuristic path inherits the same way — see buildFusedRecord).
-        fusedEntry.cmb.metadata.key = incomingKey;
-        fusedEntry.key = incomingKey;
-        fusedEntry.collapsed = true;
-      } else {
-        fusedEntry.cmb.metadata.key = fusedKey;
-        fusedEntry.key = fusedKey;
-        fusedEntry.cmb.metadata.lineage = {
-          parents: [incomingKey],
-          method: 'svaf-neural',
-        };
-      }
-    }
     // Admission Attestation (MMP) — the per-category gating verdict, signed + bound to
     // the gated CMB, persisted on the remix's store entry as the durable audit record. The neural
     // path emits per-category drift; map it to verdicts with the same thresholds (Phase A).
@@ -1149,16 +1134,17 @@ class FrameHandler {
     }
     // Opaque payload rides alongside CAT7 — carry it onto the admitted remix.
     this._preserveIncomingPayload(fusedEntry, msg);
+    let severLineage = false;
     if (fusedEntry.cmb) {
       // The copy carries no attestation the sender attached: that one was an input, checked in
       // _prepareLineageTether. The record this node stores carries its own evaluation or none.
       const tether = await tetherOfRecord(fusedEntry.cmb.categories, tetherAnchor, this._admissionPolicy());
-      this._applyLineageTether(fusedEntry, tether, now);
+      severLineage = this._applyLineageTether(fusedEntry, tether, now);
     }
     // The admitted-path surface is the store's own cmb-accepted emit. The store returns null when
     // it already holds the key ('redundant') or the write failed ('not-stored'), and a directed CMB
     // then reached nobody: surface it. Everything after this runs exactly as for any admit.
-    const storedNeural = this._node._store.receiveFromPeer(peerId, fusedEntry, { creatorRole: this._getCreatorRole(peerId, msg) });
+    const storedNeural = this._node._store.receiveFromPeer(peerId, fusedEntry, { creatorRole: this._getCreatorRole(peerId, msg), severLineage });
     if (!storedNeural && msg._directedToMe) {
       this._surfaceDirectedReject(msg, peerName, peerId, now, this._node._store.get(fusedEntry.key) ? 'redundant' : 'not-stored');
     }
@@ -1281,12 +1267,12 @@ class FrameHandler {
     // CMB from categories and drops it, so re-attach before storing the remix.
     this._preserveIncomingPayload(result.fusedEntry, msg);
 
-    this._applyLineageTether(result.fusedEntry, result.tether, now);
+    const severLineage = this._applyLineageTether(result.fusedEntry, result.tether, now);
 
     // The admitted-path surface is the store's own cmb-accepted emit. The store returns null when
     // it already holds the key ('redundant') or the write failed ('not-stored'), and a directed CMB
     // then reached nobody: surface it. Everything after this runs exactly as for any admit.
-    const storedHeuristic = this._node._store.receiveFromPeer(peerId, result.fusedEntry, { creatorRole: this._getCreatorRole(peerId, msg) });
+    const storedHeuristic = this._node._store.receiveFromPeer(peerId, result.fusedEntry, { creatorRole: this._getCreatorRole(peerId, msg), severLineage });
     if (!storedHeuristic && msg._directedToMe) {
       this._surfaceDirectedReject(msg, peerName, peerId, now, this._node._store.get(result.fusedEntry.key) ? 'redundant' : 'not-stored');
     }
@@ -1372,7 +1358,7 @@ class FrameHandler {
    * Severance: a remix drifted past the reject floor MUST NOT carry the chain's lineage (keeping it
    * would forge fidelity), so it is stored as a fresh root with the departed source recorded
    * informally in provenance. An unverifiable tether (checked=false) is a trust state, never
-   * severed.
+   * severed. Returns whether it severed, so the caller stores the entry as a root.
    *
    * Attestation: sign the exact evaluation performed — remix key, anchor, kernel identity, drift,
    * verdict — so a downstream receiver that cannot resolve the anchor holds
@@ -1383,10 +1369,18 @@ class FrameHandler {
    */
   _applyLineageTether(entry, tether, now) {
     const cmb = entry?.cmb;
-    if (!tether?.checked || !cmb) return;
-    if (!tether.tethered && recordLineage(cmb)) {
+    if (!tether?.checked || !cmb) return false;
+    let severed = false;
+    if (!tether.tethered && recordParents(cmb).length > 0) {
       const departedFrom = recordParents(cmb)[0] ?? null;
-      setRecordLineage(cmb, null); // fresh root — must clear the section the record ACTUALLY carries
+      // Severance never edits a record someone signed. When the gate stored the incoming block
+      // itself (collapsed) the record is its author's, and its signature covers its lineage:
+      // nulling it there made the stored record fail verification under the author's key. The
+      // caller stores that one as a root on the entry instead (receiveFromPeer severLineage) and
+      // the record keeps its parents as signed. A remix this node is minting right now is its own
+      // and not yet created, so it is simply minted as a root, as §15.8 says.
+      if (entry.collapsed !== true && !cmb.metadata?.sig) setRecordLineage(cmb, null);
+      severed = true;
       entry.provenance = {
         ...entry.provenance,
         tether: { severed: true, anchor: tether.anchorKey, kernelId: tether.kernelId, drift: tether.drift, departedFrom },
@@ -1414,6 +1408,7 @@ class FrameHandler {
         this._node._log(`[§15.8] tether attestation signing failed: ${e.message}`);
       }
     }
+    return severed;
   }
 
   /**
diff --git a/lib/memory-store.js b/lib/memory-store.js
index e8f400c6..8f720407 100644
--- a/lib/memory-store.js
+++ b/lib/memory-store.js
@@ -22,7 +22,7 @@ const fs = require('fs');
 const path = require('path');
 const crypto = require('crypto');
 const { ensureDir } = require('./config');
-const { roleRank } = require('./core');
+const { roleRank, isLineageSevered } = require('./core');
 
 // ── In-Memory Index ──────────────────────────────────────────
 
@@ -33,6 +33,14 @@ const { roleRank } = require('./core');
 /** A stored record file: every .json in the store except the one-off migration marker. */
 const isStoreFile = (f) => f.endsWith('.json') && f !== 'migration-v1.json';
 
+/**
+ * The store's lineage for an entry whose lineage this node severed (§15.8): a root, marked as
+ * severed so every walk of stored lineage knows not to follow the parents the record still names.
+ */
+function severedLineage() {
+  return { parents: [], ancestors: [], method: null, severed: true };
+}
+
 /**
  * What this node records ABOUT a stored record, which lives on the entry beside the record: the
  * admission attestation, the §15.8 tether attestation, the fusion provenance, and whether the
@@ -244,13 +252,15 @@ class MemoryStore {
 
   /** One index entry from one stored record — shared by both build paths so they cannot drift. */
   _indexEntryFor(entry, filePath) {
+    // A severed entry is a root to this store although its record still names parents as signed.
+    const severed = isLineageSevered(entry);
     return {
       key: entry.key,
       storedAt: entry.storedAt || entry.timestamp || 0,
       createdBy: recordCreatedBy(entry.cmb) || entry.source || this._source,
       peerId: entry.peerId || null,
-      parents: entry.lineage?.parents || recordParents(entry.cmb),
-      ancestors: entry.lineage?.ancestors || recordLineage(entry.cmb)?.ancestors || [],
+      parents: severed ? [] : (entry.lineage?.parents || recordParents(entry.cmb)),
+      ancestors: severed ? [] : (entry.lineage?.ancestors || recordLineage(entry.cmb)?.ancestors || []),
       tier: entry.tier || 'hot',
       filePath,
     };
@@ -318,6 +328,8 @@ class MemoryStore {
    * @param {object} entry
    * @param {object} opts
    * @param {string} opts.creatorRole — lifecycle role of the creating node (participant/validator/anchor)
+   * @param {boolean} [opts.severLineage] — the gate severed this record's lineage (§15.8): store it as a
+   *   root although its record, kept as signed, still names parents
    * @returns {object|null} stored entry or null if duplicate
    */
   receiveFromPeer(peerId, entry, opts = {}) {
@@ -327,7 +339,7 @@ class MemoryStore {
     // Dedup — same CMB from multiple peers stored once
     if (this._index.has(key)) return null;
 
-    const lineage = this._expandLineage(recordLineage(cmb));
+    const lineage = opts.severLineage === true ? severedLineage() : this._expandLineage(recordLineage(cmb));
     const now = Date.now();
 
     // Section 6.4 + 11.1: validator/anchor-origin CMBs enter at weight 2.0.
@@ -532,19 +544,27 @@ class MemoryStore {
   }
 
   /**
-   * Make a stored entry a root in the index after its lineage was severed (§15.8): drop it from the
-   * descendant set of every ancestor it was indexed under, and clear its own parents and ancestors.
-   * This is exactly what rebuilding the index from the severed entry produces, applied now rather
-   * than at the next start; until then the severed remix kept its old ancestors hot and unpurgeable.
-   * The caller clears the record's lineage and the entry's, and persists.
+   * Sever a stored entry's lineage after the fact (§15.8 retroactive audit), on the entry and in the
+   * index, never in the record. The record is immutable once stored (§8) and usually the author's
+   * signed block, whose signature covers its lineage, so it keeps naming its parents; the entry
+   * records that this store no longer walks them (isLineageSevered).
+   *
+   * The index is left exactly as a rebuild from the severed entry would leave it: the entry drops
+   * out of every ancestor's descendant set and has no parents or ancestors of its own. Until then
+   * a severed remix kept its old ancestors hot and unpurgeable.
    * @param {string} key
+   * @returns {boolean} true when the entry exists and was persisted
    */
-  unlinkLineage(key) {
+  severLineage(key) {
+    const entry = this.get(key);
     const idx = this._index.get(key);
-    if (!idx) return;
+    if (!entry || !idx) return false;
     for (const a of idx.ancestors || []) this._index.byAncestor.get(a)?.delete(key);
     idx.parents = [];
     idx.ancestors = [];
+    entry.lineage = severedLineage();
+    this._cache.set(key, entry);
+    return this._persist(entry);
   }
 
   // ── Search (user-facing) ─────────────────────────────────
diff --git a/lib/mesh-agent.js b/lib/mesh-agent.js
index 42ff5a9f..99b1a4a7 100644
--- a/lib/mesh-agent.js
+++ b/lib/mesh-agent.js
@@ -263,7 +263,9 @@ class MeshAgent {
     // A CMB with lineage parents is itself a remix — re-remixing it creates
     // cascade storms across agents. Store it (SVAF accepted it) but don't
     // spend an LLM call to remix it.
-    const lineage = recordLineage(entry.cmb) || entry.lineage;
+    // The store's lineage first: it is the record's own unless this node severed it (§15.8), and a
+    // severed record still names its parents as signed, though it is a root to this node.
+    const lineage = entry.lineage || recordLineage(entry.cmb);
     if (lineage?.parents?.length > 0) {
       console.log(`[${this._name}] accepted remix from ${source} — no re-remix`);
       return;
diff --git a/lib/node.js b/lib/node.js
index 95ed60db..43695179 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -1,6 +1,6 @@
 'use strict';
 
-const { recordKey, recordCreatedBy, recordCreatedAt, recordParents, setRecordLineage } = require('./record');
+const { recordKey, recordCreatedBy, recordCreatedAt, recordParents } = require('./record');
 
 /**
  * SymNode — sovereign mesh node with cognitive coupling.
@@ -700,7 +700,7 @@ class SymNode extends EventEmitter {
    *   failedFloor:number, unchecked:number, fetched:number}>}
    */
   async auditLineageTethers(opts = {}) {
-    const { resolveTetherAnchor, evaluateLineageTetherFromText, signTetherAttestation } = require('./core');
+    const { resolveTetherAnchor, evaluateLineageTetherFromText, signTetherAttestation, isLineageSevered } = require('./core');
     const report = { audited: 0, tethered: 0, severed: 0, failedFloor: 0, unchecked: 0, fetched: 0 };
     if (typeof evaluateLineageTetherFromText !== 'function') return report;
     const keys = [...this._store._index.byKey.keys()];
@@ -708,7 +708,8 @@ class SymNode extends EventEmitter {
       const entry = this._store.get(key);
       if (!entry) continue;
       const cmb = entry.cmb;
-      const parents = recordParents(cmb);
+      // An entry this node already severed is a root to it, though its record still names parents.
+      const parents = isLineageSevered(entry) ? [] : recordParents(cmb);
       if (!cmb || !cmb.categories || parents.length === 0) continue;
       report.audited++;
 
@@ -758,9 +759,9 @@ class SymNode extends EventEmitter {
       } else {
         report.failedFloor++;
         if (applySever) {
-          setRecordLineage(cmb, null);   // clears the section the record ACTUALLY carries
-          entry.lineage = null;
-          this._store.unlinkLineage(entry.key);
+          // On the entry and in the index, never in the record: a stored record is immutable (§8),
+          // and this one is usually its author's signed block, whose signature covers its lineage.
+          this._store.severLineage(entry.key);
           report.severed++;
           this._log(`[§15.8 audit] lineage severed: ${String(entry.key).slice(0, 16)}… drift ${ev.drift.toFixed(3)} from anchor ${String(anchorKey).slice(0, 16)}…`);
           this.emit('metric', { type: 'lineage-tether-severed', key: entry.key, anchor: anchorKey, drift: ev.drift, audit: true });
diff --git a/tests/lineage-severance-signed.test.js b/tests/lineage-severance-signed.test.js
new file mode 100644
index 00000000..851375b6
--- /dev/null
+++ b/tests/lineage-severance-signed.test.js
@@ -0,0 +1,139 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME to a temp sandbox before lib/config loads
+
+/**
+ * §15.8 severance never edits a signed record.
+ *
+ * When the gate admits a block unchanged, the record it stores IS the author's signed block (the
+ * collapse). Severance used to null that record's metadata.lineage, which the signature covers, so
+ * a severed record no longer verified under its author's key: the receiver's judgement about a
+ * chain was written into someone else's signed statement and broke it. The retroactive audit did
+ * the same to records already stored.
+ *
+ * Severance is this node's judgement, so it is kept where this node's judgements live: on the
+ * entry (entry.lineage.severed) and in the store's lineage index. The record stays exactly as
+ * signed, and every walk of stored lineage honours the entry: the index, the §15.8 anchor walk,
+ * and a rebuild of the index from disk.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const crypto = require('crypto');
+const fs = require('fs');
+const { SymNode } = require('../lib/node');
+const { NullDiscovery } = require('../lib/discovery');
+const { nodeDir } = require('../lib/config');
+const { MemoryStore } = require('../lib/memory-store');
+const { createCMB, signCMB, verifyCMB, isSemanticReady, resolveTetherAnchor } = require('../lib/core');
+
+const ALIGNED = { decision: 'aligned', total_drift: 0.1, category_drifts: { focus: 0.1 }, gate_values: { focus: 1 } };
+
+function rawKeypair() {
+  const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519', {
+    publicKeyEncoding: { type: 'spki', format: 'der' },
+    privateKeyEncoding: { type: 'pkcs8', format: 'der' },
+  });
+  return { pub: publicKey.slice(-32).toString('base64url'), priv: privateKey.slice(-32).toString('base64url') };
+}
+const AUTHOR = rawKeypair();
+
+// The reject floor is calibrated on the semantic kernel (§9.2.1), as in the other tether tests.
+async function awaitSemantic(timeoutMs = 30000) {
+  const t0 = Date.now();
+  while (!isSemanticReady()) {
+    if (Date.now() - t0 > timeoutMs) throw new Error('semantic encoder did not become ready');
+    await new Promise((r) => setTimeout(r, 200));
+  }
+}
+
+function cat7(t) {
+  return {
+    focus: t, issue: t, intent: t, motivation: t, commitment: t,
+    perspective: 'peerA', mood: { text: 'neutral', valence: 0, arousal: 0 },
+  };
+}
+
+const TOPIC_A = 'quarterly financial audit of the accounting ledger and tax filings';
+const TOPIC_B = [
+  'hiking trail conditions in the mountain snow this weekend',
+  'which boots and crampons to pack for the icy mountain ascent',
+  'trailhead parking permits and the shuttle bus timetable',
+  'weather forecast apps for alpine ridge crossings',
+  'campsite reservations near the mountain trailhead',
+];
+const LAUNDERED = 'fresh snowfall reported on the upper mountain trail sections';
+const CITES_SEVERED = 'deep snow drifts covering the mountain hiking path near the summit ridge';
+
+async function withNode(opts, fn) {
+  const name = `sever-signed-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+  const node = new SymNode({ name, silent: true, discovery: new NullDiscovery(), ...opts });
+  await node.start();
+  try {
+    return await fn(node, name);
+  } finally {
+    await node.stop();
+    fs.rmSync(nodeDir(name), { recursive: true, force: true });
+  }
+}
+
+/** A remix of `parentKey`, signed by AUTHOR. */
+function signedRemix(text, parentKey) {
+  const cmb = createCMB({ categories: cat7(text), createdBy: 'peerA', lineage: { parents: [parentKey], method: 'SVAF-v2' } });
+  signCMB(cmb, AUTHOR.priv);
+  return cmb;
+}
+
+/** The severance as every reader of stored lineage must see it, live and after a rebuild from disk. */
+function assertSevered(node, label, record, rootKey) {
+  const entry = node._store.get(record.metadata.key);
+  assert.ok(entry, `${label}: stored`);
+  assert.strictEqual(verifyCMB(entry.cmb, AUTHOR.pub).valid, true, `${label}: the stored record still verifies under its author's key`);
+  assert.deepStrictEqual(entry.cmb.metadata.lineage, record.metadata.lineage, `${label}: its lineage is exactly as signed`);
+  assert.strictEqual(entry.lineage?.severed, true, `${label}: the severance is on the entry`);
+  assert.strictEqual(entry.provenance?.tether?.severed, true, `${label}: and in its provenance`);
+  for (const [where, store] of [['live', node._store], ['rebuilt from disk', new MemoryStore(node._store._dir, 'reader')]]) {
+    assert.deepStrictEqual(store.parents(record.metadata.key), [], `${label} (${where}): no parents in the lineage index`);
+    assert.deepStrictEqual(store.ancestors(record.metadata.key), [], `${label} (${where}): no ancestors`);
+    assert.ok(!store.descendants(rootKey).includes(record.metadata.key), `${label} (${where}): no longer walked as the root's descendant`);
+  }
+  // The §15.8 walk from a block citing the severed one stops there: it does not reach the root
+  // through a lineage this node severed.
+  const next = signedRemix(CITES_SEVERED, record.metadata.key);
+  const anchor = resolveTetherAnchor(next, (k) => node._store.get(k));
+  assert.strictEqual(anchor.key, record.metadata.key, `${label}: the anchor walk does not pass through the severance`);
+}
+
+describe('§15.8 severance keeps the author\'s record as signed', () => {
+  for (const path of ['heuristic', 'neural']) {
+    it(`${path} gate: a severed collapsed record still verifies and is no longer a descendant`, async () => {
+      await awaitSemantic();
+      const opts = path === 'neural' ? { svafEvaluator: { evaluate: async () => ALIGNED } } : {};
+      await withNode(opts, async (node) => {
+        const root = node.remember(cat7(TOPIC_A));
+        for (const t of TOPIC_B) node.remember(cat7(t)); // the recent window the heuristic gate admits against
+        const record = signedRemix(LAUNDERED, root.key);
+        const frame = { type: 'cmb', timestamp: Date.now(), content: LAUNDERED, cmb: JSON.parse(JSON.stringify(record)), _cmbVerified: true };
+        const now = Date.now();
+        if (path === 'neural') await node._frameHandler._processNeuralSVAF(ALIGNED, frame, 'peerA', 'peerA', now, now);
+        else await node._frameHandler._processHeuristicSVAF(frame, 'peerA', 'peerA', now, now, 0);
+        assert.strictEqual(node._store.get(record.metadata.key)?.collapsed, true, 'precondition: the stored record is the author\'s block');
+        assertSevered(node, path, record, root.key);
+      });
+    });
+  }
+
+  it('the retroactive audit severs on the entry too', async () => {
+    await awaitSemantic();
+    await withNode({}, async (node) => {
+      const root = node.remember(cat7(TOPIC_A));
+      const record = signedRemix(LAUNDERED, root.key);
+      node._store.receiveFromPeer('peerA', { key: record.metadata.key, content: LAUNDERED, source: 'peerA', cmb: JSON.parse(JSON.stringify(record)), _cmbVerified: true });
+      const r1 = await node.auditLineageTethers({ sever: true });
+      assert.strictEqual(r1.severed, 1, 'precondition: the audit severed it');
+      assertSevered(node, 'audit', record, root.key);
+      const r2 = await node.auditLineageTethers({ sever: true });
+      assert.strictEqual(r2.audited, 0, 'a severed record is a root to the audit: there is no chain left to check');
+    });
+  });
+});
diff --git a/tests/lineage-tether-audit.test.js b/tests/lineage-tether-audit.test.js
index 0a2a5873..e5db3bbe 100644
--- a/tests/lineage-tether-audit.test.js
+++ b/tests/lineage-tether-audit.test.js
@@ -85,7 +85,10 @@ describe('MMP §15.8 retroactive tether audit', () => {
       const r2 = await node.auditLineageTethers({ sever: true });
       assert.strictEqual(r2.severed, 1);
       const l2 = node._store.get(laundered.key);
-      assert.ok(!l2.cmb.metadata.lineage || (l2.cmb.metadata.lineage.parents || []).length === 0, 'laundered chain severed');
+      // Severed on the entry and in the index; the stored record is never edited.
+      assert.strictEqual(l2.lineage.severed, true, 'laundered chain severed');
+      assert.deepStrictEqual(node._store.parents(laundered.key), [], 'the store walks no parents from it');
+      assert.deepStrictEqual(l2.cmb.metadata.lineage.parents, [rootA.key], 'the record\'s own lineage is untouched');
       assert.strictEqual(l2.provenance.tether.departedFrom, rootA.key);
       assert.ok(![...node._store._index.byAncestor.get(rootA.key) ?? []].includes(laundered.key),
         'ancestor index no longer lists the severed remix');
diff --git a/tests/lineage-tether-neural.test.js b/tests/lineage-tether-neural.test.js
index 593e6cac..e1aeb5f4 100644
--- a/tests/lineage-tether-neural.test.js
+++ b/tests/lineage-tether-neural.test.js
@@ -111,7 +111,10 @@ describe('MMP §15.8 lineage tether on the neural admission path', () => {
       const stored = node._store.get(frame.cmb.metadata.key);
       assert.ok(stored, 'the neural evaluator admitted the remix');
       assert.strictEqual(stored.svaf?.method, 'neural', 'precondition: the neural path stored it');
-      assert.strictEqual(stored.cmb.metadata.lineage, null, 'the laundered lineage is severed');
+      // Severed on the entry and in the index; the record is the author's and keeps its lineage.
+      assert.strictEqual(stored.lineage.severed, true, 'the laundered lineage is severed');
+      assert.deepStrictEqual(node._store.parents(stored.key), [], 'the store walks no parents from it');
+      assert.deepStrictEqual(stored.cmb.metadata.lineage, frame.cmb.metadata.lineage, 'the record\'s own lineage is untouched');
       assert.strictEqual(stored.provenance?.tether?.severed, true);
       assert.strictEqual(stored.provenance.tether.departedFrom, root.metadata.key);
       const att = stored.tether;
@@ -140,7 +143,8 @@ describe('MMP §15.8 lineage tether on the neural admission path', () => {
       assert.strictEqual(neural.att.drift.toFixed(6), heuristic.att.drift.toFixed(6), 'same drift: one computation');
       const withoutDrift = ({ drift, ...rest }) => rest; // drift is compared above, to the precision it is signed at
       assert.deepStrictEqual(withoutDrift(neural.stored.provenance.tether), withoutDrift(heuristic.stored.provenance.tether), 'same provenance');
-      assert.deepStrictEqual(neural.stored.cmb.metadata.lineage, heuristic.stored.cmb.metadata.lineage, 'same lineage outcome');
+      assert.deepStrictEqual(neural.stored.cmb.metadata.lineage, heuristic.stored.cmb.metadata.lineage, 'same record lineage, as signed');
+      assert.deepStrictEqual(neural.stored.lineage, heuristic.stored.lineage, 'same lineage in the store: severed or kept alike');
       assert.strictEqual(neural.att.verdict, rootText === TOPIC_A ? 'severed' : 'tethered');
     });
   }
diff --git a/tests/lineage-tether-severance.test.js b/tests/lineage-tether-severance.test.js
index d5759d4e..9cf190fb 100644
--- a/tests/lineage-tether-severance.test.js
+++ b/tests/lineage-tether-severance.test.js
@@ -76,7 +76,7 @@ const TOPIC_B_NEW = 'fresh snowfall reported on the upper mountain trail section
 // admit against the recents — near-duplicating one would be redundant-banned).
 const TOPIC_B_ROOT = 'overall report on snowy mountain hiking trail conditions this weekend';
 
-// The store normalizes a severed (null) lineage to root shape.
+// A record's lineage with no parents: a root.
 function isRootShaped(lineage) {
   return lineage == null
     || ((lineage.parents ?? []).length === 0 && (lineage.ancestors ?? []).length === 0);
@@ -108,7 +108,10 @@ describe('MMP §15.8 lineage tether — severance through the gate', () => {
       assert.strictEqual(accepted.length, 1, 'incoming admits (aligned with recent topic-B anchors)');
       const entry = accepted[0];
       const cmb = entry.cmb;
-      assert.ok(isRootShaped(cmb.metadata.lineage), 'lineage severed — stored as a fresh root');
+      // Severed on the entry and in the index; the record is the author's and keeps its lineage.
+      assert.strictEqual(entry.lineage.severed, true, 'lineage severed — stored as a fresh root');
+      assert.deepStrictEqual(node._store.parents(entry.key), [], 'the store walks no parents from it');
+      assert.ok(!isRootShaped(cmb.metadata.lineage), 'the record\'s own lineage is untouched');
       assert.ok(entry.provenance.tether, 'tether recorded in provenance');
       assert.strictEqual(entry.provenance.tether.severed, true);
       assert.ok(entry.provenance.tether.drift > 0.5, `drift ${entry.provenance.tether.drift} exceeds the reject floor`);
diff --git a/tests/mesh-agent.test.js b/tests/mesh-agent.test.js
index 8ad02f03..67991673 100644
--- a/tests/mesh-agent.test.js
+++ b/tests/mesh-agent.test.js
@@ -124,4 +124,28 @@ describe('MeshAgent', () => {
     assert.strictEqual(agent._shouldRemix({ source: 'special' }), true);
     assert.strictEqual(agent._shouldRemix({ source: 'other' }), false);
   });
+
+  // §15.8 severance lives on the store entry: the record keeps the parents its author signed, but
+  // this node stored it as a root. Remix-of-remix suppression must read the entry, or a severed
+  // block is never remixed, though to this node it is an original observation.
+  it('remixes a block whose lineage this node severed, as it does any root', async () => {
+    const remixed = [];
+    const agent = new MeshAgent({
+      name: 'sever-aware',
+      fetchDomain: async () => null,
+      reason: async () => null,
+      remix: async (incoming) => { remixed.push(incoming.key); return null; },
+    });
+    agent._node._hasNewDomainData = true;
+    const { createCMB } = require('../lib/core');
+    const cmb = createCMB({
+      categories: { focus: 'a block whose chain was severed', issue: 'i', intent: 'n', motivation: 'm', commitment: 'c', perspective: 'p', mood: 'neutral' },
+      createdBy: 'other-agent', lineage: { parents: ['cmb-' + 'a'.repeat(64)], method: 'SVAF-v2' },
+    });
+    const severed = { key: cmb.metadata.key, source: 'other-agent', cmb, lineage: { parents: [], ancestors: [], method: null, severed: true } };
+    const kept = { ...severed, key: 'kept', lineage: { parents: ['cmb-' + 'a'.repeat(64)], ancestors: [], method: 'SVAF-v2' } };
+    await agent._onCMBAccepted(kept);
+    await agent._onCMBAccepted(severed);
+    assert.deepStrictEqual(remixed, [cmb.metadata.key], 'the kept remix is not re-remixed; the severed one is a root');
+  });
 });
diff --git a/tests/neural-admission-copy.test.js b/tests/neural-admission-copy.test.js
index 356dea29..4b995deb 100644
--- a/tests/neural-admission-copy.test.js
+++ b/tests/neural-admission-copy.test.js
@@ -66,4 +66,23 @@ describe('neural admission works on a copy of the incoming record', () => {
       }
     });
   });
+
+  it('a record that does not collapse is minted as this node\'s own remix, never rewritten under its author\'s name', async () => {
+    // The path used to write the new key and lineage into the author's record and store that: a
+    // record naming the author, carrying the author's signature, over content and descent the author
+    // never signed. It is minted the way the heuristic gate mints one (buildFusedRecord).
+    await withNode(async (node) => {
+      const record = createCMB({ categories: cat7('a record whose carried address is not its own content'), createdBy: 'peerA' });
+      record.metadata.key = 'cmb-' + '8'.repeat(64);
+      record.metadata.sig = 'not-a-signature-over-anything-this-node-will-store';
+      const now = Date.now();
+      await node._frameHandler._processNeuralSVAF(ALIGNED, { type: 'cmb', timestamp: now, content: 'x', cmb: record }, 'peerA', 'peerA', now, now);
+      const minted = node._store.recall('').find((e) => e.cmb?.categories?.focus?.text === record.categories.focus.text);
+      assert.ok(minted, 'stored');
+      assert.strictEqual(minted.cmb.metadata.createdBy, node.name, 'this node authors the remix it mints');
+      assert.strictEqual(minted.cmb.metadata.sig, undefined, 'and carries no signature it did not make');
+      assert.deepStrictEqual(minted.cmb.metadata.lineage.parents, [record.metadata.key], 'citing the block it came from');
+      assert.notStrictEqual(minted.collapsed, true);
+    });
+  });
 });

From 2651cf3bcc2b87e94aa3914932f0cc7a3d63ecf9 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 19:48:14 +0100
Subject: [PATCH 036/148] frame-handler: drop two imports nothing uses (DIM,
 recomputeKey)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 lib/frame-handler.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/frame-handler.js b/lib/frame-handler.js
index e8c00630..98e98f33 100644
--- a/lib/frame-handler.js
+++ b/lib/frame-handler.js
@@ -24,7 +24,7 @@ const { assertRecordSize } = require('./core/cmb-encoder');
 
 const fs = require('fs');
 const path = require('path');
-const { encode, DIM, processHeuristicSVAF, buildFusedRecord, computeCategoryVerdicts, decryptCategories, resolveTetherAnchor, tetherOfRecord, signTetherAttestation, verifyTetherAttestation, recomputeKey, classifyAddress, categoriesAsSigned } = require('./core');
+const { encode, processHeuristicSVAF, buildFusedRecord, computeCategoryVerdicts, decryptCategories, resolveTetherAnchor, tetherOfRecord, signTetherAttestation, verifyTetherAttestation, classifyAddress, categoriesAsSigned } = require('./core');
 
 /** Entry members this node writes about an admission, which a frame must never supply. */
 const ENTRY_ANNOTATIONS = Object.freeze(['admission', 'tether', 'provenance', 'collapsed', 'svaf']);

From d806b1b0b4ced097129a31872540fa8f22b9182f Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 19:51:35 +0100
Subject: [PATCH 037/148] deps: floors past the vulnerable versions; tests
 await the encoder instead of a guessed timeout

- npm audit is clean. ws ^8.20.2 (two high advisories below it), @huggingface/transformers
  ^4.3.0, and the overrides for sharp (^0.35.4) and adm-zip (^0.6.1). The overrides only apply
  when sym is the root project, so the floors are what protect a consumer's install.
- context-encoder: semanticSettled() resolves when the semantic encoder is ready (true) or has
  failed (false), and a second loadSemanticEncoder() call no longer starts a second pipeline
  while the first loads. The six tests that need the semantic kernel await it through one
  helper (tests/_semantic.js) instead of polling for 30 s, which the full suite outlasted when
  several test processes loaded the model at once.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 lib/core/context-encoder.js               |  23 +-
 package-lock.json                         | 430 ++++++++++------------
 package.json                              |   8 +-
 tests/_semantic.js                        |  15 +
 tests/lineage-severance-signed.test.js    |  11 +-
 tests/lineage-tether-audit.test.js        |  12 +-
 tests/lineage-tether-neural.test.js       |  11 +-
 tests/lineage-tether-reproducible.test.js |  11 +-
 tests/lineage-tether-severance.test.js    |  11 +-
 tests/svaf-anchor-weight.test.js          |  11 +-
 10 files changed, 237 insertions(+), 306 deletions(-)
 create mode 100644 tests/_semantic.js

diff --git a/lib/core/context-encoder.js b/lib/core/context-encoder.js
index 162039c9..46bbb659 100644
--- a/lib/core/context-encoder.js
+++ b/lib/core/context-encoder.js
@@ -95,29 +95,46 @@ let _semanticEncoder = null;
 let _semanticDim = null;
 let _semanticReady = false;
 let _semanticFailed = false;
+/** The one load in flight, so a second call cannot start a second pipeline while the first loads. */
+let _semanticLoading = null;
 
 /**
  * Load the semantic encoder. Non-blocking — returns immediately.
  * Call once at startup. encode() uses semantic once loaded.
  */
 function loadSemanticEncoder() {
-  if (_semanticReady || _semanticFailed) return;
+  if (_semanticReady || _semanticFailed || _semanticLoading) return;
   try {
     const { pipeline } = require('@huggingface/transformers');
-    pipeline('feature-extraction', 'Xenova/all-MiniLM-L6-v2').then(pipe => {
+    _semanticLoading = pipeline('feature-extraction', 'Xenova/all-MiniLM-L6-v2').then(pipe => {
       _semanticEncoder = pipe;
       _semanticDim = 192; // 384 / 2
       _semanticReady = true;
       console.log('[encoder] Semantic encoder ready (all-MiniLM-L6-v2)');
+      return true;
     }).catch(err => {
       _semanticFailed = true;
       console.warn(`[encoder] Semantic encoder failed: ${err.message?.slice(0, 60)}`);
+      return false;
     });
   } catch {
     _semanticFailed = true;
   }
 }
 
+/**
+ * Resolves once the semantic encoder has settled: true when it is ready, false when it failed or
+ * cannot be loaded here (the lexical encoder then stays in use). For callers that need the
+ * semantic kernel, instead of polling isSemanticReady() against a guessed timeout.
+ * @returns {Promise<boolean>}
+ */
+function semanticSettled() {
+  if (_semanticReady) return Promise.resolve(true);
+  if (_semanticFailed) return Promise.resolve(false);
+  loadSemanticEncoder();
+  return _semanticLoading || Promise.resolve(_semanticReady);
+}
+
 /**
  * Encode text with a given semantic pipeline (async). The pipeline and its dimensionality are
  * arguments rather than module state so a pinned kernel (svafKernel) encodes with exactly the
@@ -200,4 +217,4 @@ function kernelId() {
 // Auto-load semantic encoder at import time
 loadSemanticEncoder();
 
-module.exports = { encode, encodeForSVAF, isSemanticReady, kernelId, svafKernel, DIM };
+module.exports = { encode, encodeForSVAF, isSemanticReady, semanticSettled, kernelId, svafKernel, DIM };
diff --git a/package-lock.json b/package-lock.json
index 290f3a74..395ae9a2 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -10,17 +10,17 @@
       "license": "Apache-2.0",
       "dependencies": {
         "bonjour-service": "^1.3.0",
-        "ws": "^8.20.0"
+        "ws": "^8.20.2"
       },
       "bin": {
         "sym": "bin/sym.js",
         "sym-daemon": "bin/sym-daemon.js"
       },
       "engines": {
-        "node": ">=18"
+        "node": ">=20"
       },
       "optionalDependencies": {
-        "@huggingface/transformers": "^4.0.1"
+        "@huggingface/transformers": "^4.3.0"
       }
     },
     "node_modules/@emnapi/runtime": {
@@ -34,9 +34,9 @@
       }
     },
     "node_modules/@huggingface/jinja": {
-      "version": "0.5.9",
-      "resolved": "https://registry.npmjs.org/@huggingface/jinja/-/jinja-0.5.9.tgz",
-      "integrity": "sha512-uWTG+l3VJRsl7EXxYizuL3P+cCPoc3cRqbWWRcQN0FhejRfbdq0RNhCmbY/YDtnTcz9icdLYuLDjsnz4d8JMuw==",
+      "version": "0.5.10",
+      "resolved": "https://registry.npmjs.org/@huggingface/jinja/-/jinja-0.5.10.tgz",
+      "integrity": "sha512-SgS1D1bglQ94ceD4ZCL6eayUDy9uV1xuyk61OjgSxU5GJh7upqZCKII0JoTYMc6wWsg3JUgaPRX0ElQzXPk3Cw==",
       "license": "MIT",
       "optional": true,
       "engines": {
@@ -44,24 +44,24 @@
       }
     },
     "node_modules/@huggingface/tokenizers": {
-      "version": "0.1.3",
-      "resolved": "https://registry.npmjs.org/@huggingface/tokenizers/-/tokenizers-0.1.3.tgz",
-      "integrity": "sha512-8rF/RRT10u+kn7YuUbUg0OF30K8rjTc78aHpxT+qJ1uWSqxT1MHi8+9ltwYfkFYJzT/oS+qw3JVfHtNMGAdqyA==",
+      "version": "0.2.0",
+      "resolved": "https://registry.npmjs.org/@huggingface/tokenizers/-/tokenizers-0.2.0.tgz",
+      "integrity": "sha512-LidMHe1FpcSYH4vcSjXooda34pC0M8m1gmDOv7SQi6Iv+ib1zX7J3sHBCC9/3FPCkn2k1b55FneVqMRxrr99pg==",
       "license": "Apache-2.0",
       "optional": true
     },
     "node_modules/@huggingface/transformers": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@huggingface/transformers/-/transformers-4.2.0.tgz",
-      "integrity": "sha512-8BRCoBMH0XsWaEIamuR0LrJGAfftgHAfb2Vrffy0VKlSAE/MnUJ5/h/zTfEP3fDIft+nk7TqB8xXEyABGitBjQ==",
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/@huggingface/transformers/-/transformers-4.3.0.tgz",
+      "integrity": "sha512-fL1A/WUZwouPrOlYxU5dzIwD2T5J781JiB2jDR8bFe5DwCj0Gfudq+NEXCMno49kQgajHA7xQkrRLJlqG1veEA==",
       "license": "Apache-2.0",
       "optional": true,
       "dependencies": {
-        "@huggingface/jinja": "^0.5.6",
-        "@huggingface/tokenizers": "^0.1.3",
-        "onnxruntime-node": "1.24.3",
-        "onnxruntime-web": "1.26.0-dev.20260416-b7804b056c",
-        "sharp": "^0.34.5"
+        "@huggingface/jinja": "^0.5.10",
+        "@huggingface/tokenizers": "^0.2.0",
+        "onnxruntime-node": "1.30.0",
+        "onnxruntime-web": "1.31.0-dev.20260914-8d85527a0",
+        "sharp": "^0.35.4"
       }
     },
     "node_modules/@img/colour": {
@@ -75,9 +75,9 @@
       }
     },
     "node_modules/@img/sharp-darwin-arm64": {
-      "version": "0.35.3",
-      "resolved": "https://registry.npmjs.org/@img/sharp-darwin-arm64/-/sharp-darwin-arm64-0.35.3.tgz",
-      "integrity": "sha512-RMnFX7YQsMoh7lWfcM4NEHHymBX/rLuKNPVM84XE9ONPcaSCDgE7CHIHpSgPcO2xcRthgBy1HfNO319mwhIAkg==",
+      "version": "0.35.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-darwin-arm64/-/sharp-darwin-arm64-0.35.5.tgz",
+      "integrity": "sha512-QRUlFQ0WxvdWyqqG/WtI3iupfD5rBzmCHXSdPsY91sAtVtTo7Q4cb6zOccZ3gqEqkr0f1As1ehLqmEpDsRf+lg==",
       "cpu": [
         "arm64"
       ],
@@ -93,13 +93,13 @@
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-darwin-arm64": "1.3.2"
+        "@img/sharp-libvips-darwin-arm64": "1.3.4"
       }
     },
     "node_modules/@img/sharp-darwin-x64": {
-      "version": "0.35.3",
-      "resolved": "https://registry.npmjs.org/@img/sharp-darwin-x64/-/sharp-darwin-x64-0.35.3.tgz",
-      "integrity": "sha512-Xo+5uFBtLN0BKqieTxiFzFPQAUlBbbH5iBKyRX/z1JrbnYsHTfKJnUfL8+p2TPXr1pXqao4eeL4Rl144uDpK9w==",
+      "version": "0.35.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-darwin-x64/-/sharp-darwin-x64-0.35.5.tgz",
+      "integrity": "sha512-+BR255RhDlpygUpOc/Jdt1nT6DQ3XG/ERo5wbcdOf5Q320dKtPCKPLR1LJs9VGXRaMa8l1uUa0tkCNOXiAxZUw==",
       "cpu": [
         "x64"
       ],
@@ -115,20 +115,20 @@
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-darwin-x64": "1.3.2"
+        "@img/sharp-libvips-darwin-x64": "1.3.4"
       }
     },
     "node_modules/@img/sharp-freebsd-wasm32": {
-      "version": "0.35.3",
-      "resolved": "https://registry.npmjs.org/@img/sharp-freebsd-wasm32/-/sharp-freebsd-wasm32-0.35.3.tgz",
-      "integrity": "sha512-lUxcqWIj2wMQ9BrwNjngcr1gWUr5xgaGThBRqPPalIC2n67Cqj1uPh8NnA/ZhAg8hUbKl+kVHKwgUIwe6ZYPrg==",
+      "version": "0.35.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-freebsd-wasm32/-/sharp-freebsd-wasm32-0.35.5.tgz",
+      "integrity": "sha512-Y/z91nEZ4uIBX5X3nfTovjU9lHNKFYbL2lpHCLVNmXQK03VIZvXBBt0KxbPGp2SdGSF+2mQU4e+hQaWOt86iAw==",
       "license": "Apache-2.0",
       "optional": true,
       "os": [
         "freebsd"
       ],
       "dependencies": {
-        "@img/sharp-wasm32": "0.35.3"
+        "@img/sharp-wasm32": "0.35.5"
       },
       "engines": {
         "node": ">=20.9.0"
@@ -138,9 +138,9 @@
       }
     },
     "node_modules/@img/sharp-libvips-darwin-arm64": {
-      "version": "1.3.2",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-darwin-arm64/-/sharp-libvips-darwin-arm64-1.3.2.tgz",
-      "integrity": "sha512-9J6ypZFpQBj4YnePGoq/S38w6nz+vqg5WZLrLGY4YuSemdMq47GMLBPO42MzwdGwpg/agZ7xzZcFHa48xlywfg==",
+      "version": "1.3.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-darwin-arm64/-/sharp-libvips-darwin-arm64-1.3.4.tgz",
+      "integrity": "sha512-5R89nBYiRdUlSWJxPhO+GVtaXzXSxKnRu/xqMn3KTA3L9EB9Oy/P+Nn2f2vlhPuUdy/Zusb2DarbyTpGCfEDuw==",
       "cpu": [
         "arm64"
       ],
@@ -154,9 +154,9 @@
       }
     },
     "node_modules/@img/sharp-libvips-darwin-x64": {
-      "version": "1.3.2",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-darwin-x64/-/sharp-libvips-darwin-x64-1.3.2.tgz",
-      "integrity": "sha512-m2pW1n6cns9VaubNwsZ+c3CRYjxNQWgJ5gPlnL1nbBcpkBvFm6SCFN5o0psFHI8w9n11NKhFkeEDns98tiqbEw==",
+      "version": "1.3.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-darwin-x64/-/sharp-libvips-darwin-x64-1.3.4.tgz",
+      "integrity": "sha512-iR2OKH80yi0U+dUplyh3/xdpFvps6YkCwsXenIJxqxR1v9o+xtKTGbS9H7cps+2Vxjc8B1j96p75NmTGjIhtpQ==",
       "cpu": [
         "x64"
       ],
@@ -170,9 +170,9 @@
       }
     },
     "node_modules/@img/sharp-libvips-linux-arm": {
-      "version": "1.3.2",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-arm/-/sharp-libvips-linux-arm-1.3.2.tgz",
-      "integrity": "sha512-1eMLzy92I4J6rmi4mAT8yC3HxOtniyGELlzGbNMLLeqe052ahFQ0h6LFq+lh5DsDIdYViIDst08abvSbcEdLXQ==",
+      "version": "1.3.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-arm/-/sharp-libvips-linux-arm-1.3.4.tgz",
+      "integrity": "sha512-LmRtTsOHuvM2+wlO2Db37dx5MiZhB0FvSunciw48YjdOkZz9KAiRbm8ujeMOA1INqmei5NapFxYEK1D1ZSidmw==",
       "cpu": [
         "arm"
       ],
@@ -186,9 +186,9 @@
       }
     },
     "node_modules/@img/sharp-libvips-linux-arm64": {
-      "version": "1.3.2",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-arm64/-/sharp-libvips-linux-arm64-1.3.2.tgz",
-      "integrity": "sha512-dqVSFynCox4C/J8kT16V7SIFAns0IjgLwkvYT7p8LQVmJ5OS5b6tI9IGflxTeuBS//zXeFIUbwt5dwxyZ17cnA==",
+      "version": "1.3.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-arm64/-/sharp-libvips-linux-arm64-1.3.4.tgz",
+      "integrity": "sha512-Y3dgX/6lE2QhQb+Gxy0WZxfg9MEm/JBjamZpS2IklP7xIQoKN4hzAm7KcMVGtaVDt3neE9OKBC7vAfonA/Lr1A==",
       "cpu": [
         "arm64"
       ],
@@ -202,9 +202,9 @@
       }
     },
     "node_modules/@img/sharp-libvips-linux-ppc64": {
-      "version": "1.3.2",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-ppc64/-/sharp-libvips-linux-ppc64-1.3.2.tgz",
-      "integrity": "sha512-3z0NHDxD6n5I9gc05U1eW1AyRm+Gznzq3naMrthPNqE6oYykcogW0l/jfpJdjYnuNl8R7yI9pNbE1XiUeyq0Aw==",
+      "version": "1.3.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-ppc64/-/sharp-libvips-linux-ppc64-1.3.4.tgz",
+      "integrity": "sha512-Le6boB8Tai0Nis+gIxIpKx68UDVVIqdR8Tin5Yf1z2LJJQLDJvCDRqRu+jC2qCoD+eIomonmOwB4smBRxfVpYQ==",
       "cpu": [
         "ppc64"
       ],
@@ -218,9 +218,9 @@
       }
     },
     "node_modules/@img/sharp-libvips-linux-riscv64": {
-      "version": "1.3.2",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-riscv64/-/sharp-libvips-linux-riscv64-1.3.2.tgz",
-      "integrity": "sha512-bsb4rI+NldGOsXuej2r8OdSS8+zXDVaCWxyWrcv6kneTOlgAHtZABRzBBCwdsPiD90J4myNJuHpg6kA20ImW/w==",
+      "version": "1.3.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-riscv64/-/sharp-libvips-linux-riscv64-1.3.4.tgz",
+      "integrity": "sha512-aHkkIEHPRdQEegJN20MLmGtxYD9R2wQr3Cwpddnu5+YKMt6Uzax7S9h5gpZTo8wyrGuZSlfQ63OevL5mTyOC7Q==",
       "cpu": [
         "riscv64"
       ],
@@ -234,9 +234,9 @@
       }
     },
     "node_modules/@img/sharp-libvips-linux-s390x": {
-      "version": "1.3.2",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-s390x/-/sharp-libvips-linux-s390x-1.3.2.tgz",
-      "integrity": "sha512-/ABshyj8gCpyIrNXnHn4LorDJ0HHm1VhXPBlxZ8zAtfVPAaSafXPGn+sUSIRiwaSBy0mmFjSjiXI5mkcwdChKQ==",
+      "version": "1.3.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-s390x/-/sharp-libvips-linux-s390x-1.3.4.tgz",
+      "integrity": "sha512-ra/mB6MikESDUO7Yg+Mi95bFBb9GsObURuhnOv3OqknjGe9sZrG8tCe9q0xSIGrtLgvgw0gKnFWcK4blSgQOuQ==",
       "cpu": [
         "s390x"
       ],
@@ -250,9 +250,9 @@
       }
     },
     "node_modules/@img/sharp-libvips-linux-x64": {
-      "version": "1.3.2",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-x64/-/sharp-libvips-linux-x64-1.3.2.tgz",
-      "integrity": "sha512-ITPEtgffGJ0S6G9dRyw/366tJQqFRcHWPHhC+Stpg3Z8AEMrDrTr2lhdz4f/Y/HMbRh//7Z5mBzEpVdi62Oc3w==",
+      "version": "1.3.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-x64/-/sharp-libvips-linux-x64-1.3.4.tgz",
+      "integrity": "sha512-GJ//SSXbnwSDes02umB3nDJLFcQzw8a18V8fyhqr6tV515tOEMdImjjxj1AoafMRz56F3PHgftnj1QEKSU1zkw==",
       "cpu": [
         "x64"
       ],
@@ -266,9 +266,9 @@
       }
     },
     "node_modules/@img/sharp-libvips-linuxmusl-arm64": {
-      "version": "1.3.2",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linuxmusl-arm64/-/sharp-libvips-linuxmusl-arm64-1.3.2.tgz",
-      "integrity": "sha512-zE9EdiUzUmg5mDT5a1rk5fYJ6GWPloTwWBYDS14naqHsL+EaMpDj1AWnpLgh3u0YCORv2Tt50wrcrpYqkP97Kw==",
+      "version": "1.3.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linuxmusl-arm64/-/sharp-libvips-linuxmusl-arm64-1.3.4.tgz",
+      "integrity": "sha512-hvulFwtjUcagsis6BBxHwGFwWoNZjgYmULGVrZcyfNbjA8hKILbRxGg15/7w5HDyXHXUos/j6baAWqnCyQ2DWA==",
       "cpu": [
         "arm64"
       ],
@@ -282,9 +282,9 @@
       }
     },
     "node_modules/@img/sharp-libvips-linuxmusl-x64": {
-      "version": "1.3.2",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linuxmusl-x64/-/sharp-libvips-linuxmusl-x64-1.3.2.tgz",
-      "integrity": "sha512-m0lrLiUt+lBYnCFr8qV/65yMR4E/c7/wf78I5eKTdkEakFAlZ9QlzEM3QIhhAwVeUhLAHLcCq7a7Vszq/oFNZQ==",
+      "version": "1.3.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linuxmusl-x64/-/sharp-libvips-linuxmusl-x64-1.3.4.tgz",
+      "integrity": "sha512-6zXKeE/p39I1AmA3cJG35eyBGNqNddLnUXjhwBnsGjFPWqf5VKkDBEqaEkPDoTEtkxwi2vv8Tcr2mDyP4So7Fg==",
       "cpu": [
         "x64"
       ],
@@ -298,9 +298,9 @@
       }
     },
     "node_modules/@img/sharp-linux-arm": {
-      "version": "0.35.3",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linux-arm/-/sharp-linux-arm-0.35.3.tgz",
-      "integrity": "sha512-affVWCTLooy8TSxbDx2qkzuDeaWLNVBA+P//FNBirHsXpP2fuBhk5AuboYUnrDnzoXes8GFjpTx0SBFOCRg+FA==",
+      "version": "0.35.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-arm/-/sharp-linux-arm-0.35.5.tgz",
+      "integrity": "sha512-LEaXK2WdXVK5ykcw0buWyPMsmLLL2vpHLD6yrNSW+JGEL3BZPA4tpKN6iaMc4AxTTAoaX/sU1rOL51lcIz48ZQ==",
       "cpu": [
         "arm"
       ],
@@ -316,13 +316,13 @@
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-linux-arm": "1.3.2"
+        "@img/sharp-libvips-linux-arm": "1.3.4"
       }
     },
     "node_modules/@img/sharp-linux-arm64": {
-      "version": "0.35.3",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linux-arm64/-/sharp-linux-arm64-0.35.3.tgz",
-      "integrity": "sha512-QgKDspHPnrU+GQ55XPhGwyhC8acLVOOSyAvo1oVfFmrIXLkDNmGWzAfDZ4xK8oSA1qBQrALcHX0G5UZni/SuFQ==",
+      "version": "0.35.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-arm64/-/sharp-linux-arm64-0.35.5.tgz",
+      "integrity": "sha512-LYVx5JTsOM2CBzmxreh+nl64/3H6Xb09iSLknqH47z2T2DFFxDeFLP5y4dJwe6H7uGQlHPyEEtIqyo3DYsRwdQ==",
       "cpu": [
         "arm64"
       ],
@@ -338,13 +338,13 @@
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-linux-arm64": "1.3.2"
+        "@img/sharp-libvips-linux-arm64": "1.3.4"
       }
     },
     "node_modules/@img/sharp-linux-ppc64": {
-      "version": "0.35.3",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linux-ppc64/-/sharp-linux-ppc64-0.35.3.tgz",
-      "integrity": "sha512-sMd8rDxmpLOwv/7N44klFjOD5DUO7FLdjiXDI0hoxYaf7Ar262dQIEkosE98bps+5HPLtp/EvNqeqQtOycP/IA==",
+      "version": "0.35.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-ppc64/-/sharp-linux-ppc64-0.35.5.tgz",
+      "integrity": "sha512-QVxAAq8evVRI9ia2vqgwrmWucn5Dfv+JdWzj75pD8omHLPSP7f8p20O8jxzjCcuCEQEOtYOZUmX1hkiZ0kdevA==",
       "cpu": [
         "ppc64"
       ],
@@ -360,13 +360,13 @@
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-linux-ppc64": "1.3.2"
+        "@img/sharp-libvips-linux-ppc64": "1.3.4"
       }
     },
     "node_modules/@img/sharp-linux-riscv64": {
-      "version": "0.35.3",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linux-riscv64/-/sharp-linux-riscv64-0.35.3.tgz",
-      "integrity": "sha512-0Eob78yjlYPfL5vMNWAW55l3R9Y6BQS/gOfe0ZcP9mEz9ohhKSt4im1hayiknXgf8AWrFqMvJcKIdmLmEe7yeQ==",
+      "version": "0.35.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-riscv64/-/sharp-linux-riscv64-0.35.5.tgz",
+      "integrity": "sha512-LtdreXguaavKODPIfzJ4kffx7UNt1omwtK0rch4EBbbSTXPnxWmYSayXdLJw0fJzQ97kHt1gL/yh4tvU+nCyRQ==",
       "cpu": [
         "riscv64"
       ],
@@ -382,13 +382,13 @@
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-linux-riscv64": "1.3.2"
+        "@img/sharp-libvips-linux-riscv64": "1.3.4"
       }
     },
     "node_modules/@img/sharp-linux-s390x": {
-      "version": "0.35.3",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linux-s390x/-/sharp-linux-s390x-0.35.3.tgz",
-      "integrity": "sha512-KgAxQ0DxpNOq1rG2t5cgTgShJFGSuU7XO45cqC+1NVOuZnP6tlgZRuSYOfNupGkHID0o3cJOsw4DVeJpMovcGw==",
+      "version": "0.35.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-s390x/-/sharp-linux-s390x-0.35.5.tgz",
+      "integrity": "sha512-UZasTOFiYzotTsGOCu42BfUzP6Tu6Do/947iRm1RsLKvlllxwGcn4RN27LibGWceix4Y+Pmw3jsnTcCQIgWjqA==",
       "cpu": [
         "s390x"
       ],
@@ -404,13 +404,13 @@
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-linux-s390x": "1.3.2"
+        "@img/sharp-libvips-linux-s390x": "1.3.4"
       }
     },
     "node_modules/@img/sharp-linux-x64": {
-      "version": "0.35.3",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linux-x64/-/sharp-linux-x64-0.35.3.tgz",
-      "integrity": "sha512-8pqvxubL2PGdhlPy6GLqzDYMUjyRmKAwKHYKixpdJYBUK7PJ0C029XdsnpFIdgRZG68fZiGdHVWcKPvtiPB4cA==",
+      "version": "0.35.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-x64/-/sharp-linux-x64-0.35.5.tgz",
+      "integrity": "sha512-SxFtLTeJInhAA9Q836kux2vZNeOBQEx658qvbboZScr0wIARym3IcGmW7KpVD5sbVg0Ojy+udFQdayYIZyoNog==",
       "cpu": [
         "x64"
       ],
@@ -426,13 +426,13 @@
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-linux-x64": "1.3.2"
+        "@img/sharp-libvips-linux-x64": "1.3.4"
       }
     },
     "node_modules/@img/sharp-linuxmusl-arm64": {
-      "version": "0.35.3",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linuxmusl-arm64/-/sharp-linuxmusl-arm64-0.35.3.tgz",
-      "integrity": "sha512-Vz0iQjzzcSX3HCbfwFfCSG/9SCIqyO0mH2sXyiHaAYfBk0cRsCWXRyQYX0ovCK/PAQBbTzQ0dsPQHh5MAFL59w==",
+      "version": "0.35.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linuxmusl-arm64/-/sharp-linuxmusl-arm64-0.35.5.tgz",
+      "integrity": "sha512-9HbMclmI1zlNkFRs3z9/eBtDjfD0sGlrX1z6b1qwmiFY5ElDLh4BC0LPBdVp7z1DXFiKlIcznf+ZlsuZzLxQqg==",
       "cpu": [
         "arm64"
       ],
@@ -448,13 +448,13 @@
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-linuxmusl-arm64": "1.3.2"
+        "@img/sharp-libvips-linuxmusl-arm64": "1.3.4"
       }
     },
     "node_modules/@img/sharp-linuxmusl-x64": {
-      "version": "0.35.3",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linuxmusl-x64/-/sharp-linuxmusl-x64-0.35.3.tgz",
-      "integrity": "sha512-6O1NPKcDVj9QEdg7Hx549EX8U0rp6yXQERqru6yRN7fGBn32UvIRJUlWnk+8xDCiG76hXVBbX82NZ/ZKr0euIg==",
+      "version": "0.35.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linuxmusl-x64/-/sharp-linuxmusl-x64-0.35.5.tgz",
+      "integrity": "sha512-4KOphqB035HrVdqLZfCgMzzERrQkkzOwRhl4OAkRO1YCldbaFjySXMaK534Mo0V+LndnlJk+sbUyLeU0ULyD1A==",
       "cpu": [
         "x64"
       ],
@@ -470,17 +470,17 @@
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-linuxmusl-x64": "1.3.2"
+        "@img/sharp-libvips-linuxmusl-x64": "1.3.4"
       }
     },
     "node_modules/@img/sharp-wasm32": {
-      "version": "0.35.3",
-      "resolved": "https://registry.npmjs.org/@img/sharp-wasm32/-/sharp-wasm32-0.35.3.tgz",
-      "integrity": "sha512-cZ0XkcYGpHZkqW6iCkqTcmUC0CD9DhD5d/qeZlZkfRBn6GnHniZXLUo5+9xw8Iv76YE6LQFN9YNBlKREcCG76w==",
+      "version": "0.35.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-wasm32/-/sharp-wasm32-0.35.5.tgz",
+      "integrity": "sha512-Ptsga1su4tQx+LLF1ECS9U6nz5kmrXKo6XVbtR48Ke3ZRxxgaWBu7IDtEe1quo8hiupwm6WFqxVlXaSf7IINGQ==",
       "license": "Apache-2.0 AND LGPL-3.0-or-later AND MIT",
       "optional": true,
       "dependencies": {
-        "@emnapi/runtime": "^1.11.1"
+        "@emnapi/runtime": "^1.11.3"
       },
       "engines": {
         "node": ">=20.9.0"
@@ -490,16 +490,16 @@
       }
     },
     "node_modules/@img/sharp-webcontainers-wasm32": {
-      "version": "0.35.3",
-      "resolved": "https://registry.npmjs.org/@img/sharp-webcontainers-wasm32/-/sharp-webcontainers-wasm32-0.35.3.tgz",
-      "integrity": "sha512-2rnq7bX3NzeR2T4YWgz8qiG4h3TSdMe+vN1iQXpJleSJ3SM5zQ8Fy2SyyXAWlbxpEZ2Y+Z4u1BePgJEYbSy80Q==",
+      "version": "0.35.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-webcontainers-wasm32/-/sharp-webcontainers-wasm32-0.35.5.tgz",
+      "integrity": "sha512-hfhF/FmoQyTUkA0bIKFOtw536BQSeBMe6BF6QyWlrPxT754+TFLaZ7sKKTfvvM0yJgKgaYTwnFCIZ/GuDw5SUA==",
       "cpu": [
         "wasm32"
       ],
       "license": "Apache-2.0",
       "optional": true,
       "dependencies": {
-        "@img/sharp-wasm32": "0.35.3"
+        "@img/sharp-wasm32": "0.35.5"
       },
       "engines": {
         "node": ">=20.9.0"
@@ -509,9 +509,9 @@
       }
     },
     "node_modules/@img/sharp-win32-arm64": {
-      "version": "0.35.3",
-      "resolved": "https://registry.npmjs.org/@img/sharp-win32-arm64/-/sharp-win32-arm64-0.35.3.tgz",
-      "integrity": "sha512-4bPwFdMbeC4JQ8L8LOyWp6nsHcboP5fxkp6iPOXz2Vg49R42TuMs2whkJ5OAP4/Ul035qOzy0AecOF9VOscn4w==",
+      "version": "0.35.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-win32-arm64/-/sharp-win32-arm64-0.35.5.tgz",
+      "integrity": "sha512-X4t7g+7ZA5DKblCBEXGjUqqemj4vczING/5viFwAL8h4N3qYeyjwdCvRLHi4EdOUI+2Z7UFlp1VM+p/AuEtm6Q==",
       "cpu": [
         "arm64"
       ],
@@ -528,9 +528,9 @@
       }
     },
     "node_modules/@img/sharp-win32-ia32": {
-      "version": "0.35.3",
-      "resolved": "https://registry.npmjs.org/@img/sharp-win32-ia32/-/sharp-win32-ia32-0.35.3.tgz",
-      "integrity": "sha512-r53mXsBN6lFUDiST764SvgwUdHAqM4rPAiDzAmf4fLoB6X/rkfyTrLCg6+g17wJJiCmB3JYgHuUldCWUIRFSXw==",
+      "version": "0.35.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-win32-ia32/-/sharp-win32-ia32-0.35.5.tgz",
+      "integrity": "sha512-5Zm82LoBc43nhwNybZlG7Y1KO//Zhsn306fQl29ZOuStHLGTo3BWL83q3cznX0poxSAMuYL1On/BHBxkBeKr6A==",
       "cpu": [
         "ia32"
       ],
@@ -547,9 +547,9 @@
       }
     },
     "node_modules/@img/sharp-win32-x64": {
-      "version": "0.35.3",
-      "resolved": "https://registry.npmjs.org/@img/sharp-win32-x64/-/sharp-win32-x64-0.35.3.tgz",
-      "integrity": "sha512-D4y1vNeZrIIJCN+uHaWVtH86B+aCrdMYYjicy9pXHvbGZeGYLLSd3wdVuC37FxVXlU1ARsk84eKWfWMXGYEqvA==",
+      "version": "0.35.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-win32-x64/-/sharp-win32-x64-0.35.5.tgz",
+      "integrity": "sha512-x76eH0vEiHlcMQu8Y8IenntaACtddpT6W0wmXtWrnKcnKI7ME5DdgqhAD6SEWOEl1v2zDvkZDhFA9KnURwpfqg==",
       "cpu": [
         "x64"
       ],
@@ -638,19 +638,19 @@
       "optional": true
     },
     "node_modules/@types/node": {
-      "version": "26.1.2",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.1.2.tgz",
-      "integrity": "sha512-Vu4a5UFA9rIIFJ7rB/Vaafh9lrCQszopTCx6KjFboXTGQbPNasehVR5TEiithSDGyd1DEiUByggTZsg8jukeIg==",
+      "version": "26.6.3",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.3.tgz",
+      "integrity": "sha512-dsqMQQoeTLqu9wynDD00q573mNzso3IdQOAfHRJqLCcmCFPoGo9A1bDpUcv/9tnKpErQWv9uKeGfl37EIS02Yg==",
       "license": "MIT",
       "optional": true,
       "dependencies": {
-        "undici-types": "~8.3.0"
+        "undici-types": "~8.9.0"
       }
     },
     "node_modules/adm-zip": {
-      "version": "0.6.0",
-      "resolved": "https://registry.npmjs.org/adm-zip/-/adm-zip-0.6.0.tgz",
-      "integrity": "sha512-XleryMhbuksdKtofnWZ9Sk+4CUTbms4Mb/EU32SZwToAyZ5RgVos/ki8n+yr0LWHOGKuakbXTuuYNHLQjhddgg==",
+      "version": "0.6.1",
+      "resolved": "https://registry.npmjs.org/adm-zip/-/adm-zip-0.6.1.tgz",
+      "integrity": "sha512-Xwrja8nx9e5o2N1my4DsKCeKpdrnACyr1wtbPxBDgGzKzKyE9kRtBFA8mWldI+RVlD7CBZNWY/wQ2+ydwOR6kQ==",
       "license": "MIT",
       "optional": true,
       "engines": {
@@ -667,14 +667,6 @@
         "multicast-dns": "^7.2.5"
       }
     },
-    "node_modules/boolean": {
-      "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/boolean/-/boolean-3.2.0.tgz",
-      "integrity": "sha512-d0II/GO9uf9lfUHH2BQsjxzRJZBdsjgsBiW4BvhWk/3qoKwQFjIDVN19PfX8F2D/r9PCMTtLWjYVCFrpeYUzsw==",
-      "deprecated": "Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.",
-      "license": "MIT",
-      "optional": true
-    },
     "node_modules/define-data-property": {
       "version": "1.1.4",
       "resolved": "https://registry.npmjs.org/define-data-property/-/define-data-property-1.1.4.tgz",
@@ -721,13 +713,6 @@
         "node": ">=8"
       }
     },
-    "node_modules/detect-node": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/detect-node/-/detect-node-2.1.0.tgz",
-      "integrity": "sha512-T0NIuQpnTvFDATNuHN5roPwSBG83rFsuO+MXXH9/3N1eFbn4wcPjttvjMLEPWJ0RGUYgQE7cGgS3tNxbqCGM7g==",
-      "license": "MIT",
-      "optional": true
-    },
     "node_modules/dns-packet": {
       "version": "5.6.1",
       "resolved": "https://registry.npmjs.org/dns-packet/-/dns-packet-5.6.1.tgz",
@@ -760,13 +745,6 @@
         "node": ">= 0.4"
       }
     },
-    "node_modules/es6-error": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/es6-error/-/es6-error-4.1.1.tgz",
-      "integrity": "sha512-Um/+FxMr9CISWh0bi5Zv0iOD+4cFh5qLeks1qhAopKVAJw3drgKbKySikp7wGhDL0HPeaja0P5ULZrxLkniUVg==",
-      "license": "MIT",
-      "optional": true
-    },
     "node_modules/escape-string-regexp": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-4.0.0.tgz",
@@ -794,18 +772,16 @@
       "optional": true
     },
     "node_modules/global-agent": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/global-agent/-/global-agent-3.0.0.tgz",
-      "integrity": "sha512-PT6XReJ+D07JvGoxQMkT6qji/jVNfX/h364XHZOWeRzy64sSFr+xJ5OX7LI3b4MPQzdL4H8Y8M0xzPpsVMwA8Q==",
+      "version": "4.1.3",
+      "resolved": "https://registry.npmjs.org/global-agent/-/global-agent-4.1.3.tgz",
+      "integrity": "sha512-KUJEViiuFT3I97t+GYMikLPJS2Lfo/S2F+DQuBWzuzaMPnvt5yyZePzArx36fBzpGTxZjIpDbXLeySLgh+k76g==",
       "license": "BSD-3-Clause",
       "optional": true,
       "dependencies": {
-        "boolean": "^3.0.1",
-        "es6-error": "^4.1.1",
-        "matcher": "^3.0.0",
-        "roarr": "^2.15.3",
-        "semver": "^7.3.2",
-        "serialize-error": "^7.0.1"
+        "globalthis": "^1.0.2",
+        "matcher": "^4.0.0",
+        "semver": "^7.3.5",
+        "serialize-error": "^8.1.0"
       },
       "engines": {
         "node": ">=10.0"
@@ -861,13 +837,6 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/json-stringify-safe": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/json-stringify-safe/-/json-stringify-safe-5.0.1.tgz",
-      "integrity": "sha512-ZClg6AaYvamvYEE82d3Iyd3vSSIjQ+odgjaTzRuO3s7toCdFKczob2i0zCh7JE8kWn17yvAWhUVxvqGwUalsRA==",
-      "license": "ISC",
-      "optional": true
-    },
     "node_modules/long": {
       "version": "5.3.2",
       "resolved": "https://registry.npmjs.org/long/-/long-5.3.2.tgz",
@@ -876,9 +845,9 @@
       "optional": true
     },
     "node_modules/matcher": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/matcher/-/matcher-3.0.0.tgz",
-      "integrity": "sha512-OkeDaAZ/bQCxeFAozM55PKcKU0yJMPGifLwV4Qgjitu+5MoAfSQN4lsLJeXZ1b8w0x+/Emda6MZgXS1jvsapng==",
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/matcher/-/matcher-4.0.0.tgz",
+      "integrity": "sha512-S6x5wmcDmsDRRU/c2dkccDwQPXoFczc5+HpQ2lON8pnvHlnvHAHj5WlLVvw6n6vNyHuVugYrFohYxbS+pvFpKQ==",
       "license": "MIT",
       "optional": true,
       "dependencies": {
@@ -886,6 +855,9 @@
       },
       "engines": {
         "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
       }
     },
     "node_modules/multicast-dns": {
@@ -912,16 +884,16 @@
       }
     },
     "node_modules/onnxruntime-common": {
-      "version": "1.24.3",
-      "resolved": "https://registry.npmjs.org/onnxruntime-common/-/onnxruntime-common-1.24.3.tgz",
-      "integrity": "sha512-GeuPZO6U/LBJXvwdaqHbuUmoXiEdeCjWi/EG7Y1HNnDwJYuk6WUbNXpF6luSUY8yASul3cmUlLGrCCL1ZgVXqA==",
+      "version": "1.30.0",
+      "resolved": "https://registry.npmjs.org/onnxruntime-common/-/onnxruntime-common-1.30.0.tgz",
+      "integrity": "sha512-7fdVWjAID1dVhH/G8qK3APARunV4VkBFoCQAP7qp4Wkab0mrorvmc+sqiT+mKXOzDqdjN5j+/Z9nb4gzNPWcyA==",
       "license": "MIT",
       "optional": true
     },
     "node_modules/onnxruntime-node": {
-      "version": "1.24.3",
-      "resolved": "https://registry.npmjs.org/onnxruntime-node/-/onnxruntime-node-1.24.3.tgz",
-      "integrity": "sha512-JH7+czbc8ALA819vlTgcV+Q214/+VjGeBHDjX81+ZCD0PCVCIFGFNtT0V4sXG/1JXypKPgScQcB3ij/hk3YnTg==",
+      "version": "1.30.0",
+      "resolved": "https://registry.npmjs.org/onnxruntime-node/-/onnxruntime-node-1.30.0.tgz",
+      "integrity": "sha512-twhs1C2C/BFkz1yc5OY0KIU2GUq6DURO7hD4bx5Q2Qy3nAMJwRXW8xU3NVczE29VA9lolLOYepoD8fjTGOfIqw==",
       "hasInstallScript": true,
       "license": "MIT",
       "optional": true,
@@ -931,30 +903,30 @@
         "linux"
       ],
       "dependencies": {
-        "adm-zip": "^0.5.16",
-        "global-agent": "^3.0.0",
-        "onnxruntime-common": "1.24.3"
+        "adm-zip": "^0.6.0",
+        "global-agent": "^4.1.3",
+        "onnxruntime-common": "1.30.0"
       }
     },
     "node_modules/onnxruntime-web": {
-      "version": "1.26.0-dev.20260416-b7804b056c",
-      "resolved": "https://registry.npmjs.org/onnxruntime-web/-/onnxruntime-web-1.26.0-dev.20260416-b7804b056c.tgz",
-      "integrity": "sha512-MD6Ss4GSpQBo6zqoJzyT9LRbKYs7x/JVN23FT24EcEvlqF4VuzPOeH6X38orZPKHQDbprn7K+SBpu0/mj2CQiw==",
+      "version": "1.31.0-dev.20260914-8d85527a0",
+      "resolved": "https://registry.npmjs.org/onnxruntime-web/-/onnxruntime-web-1.31.0-dev.20260914-8d85527a0.tgz",
+      "integrity": "sha512-Iy7rtadoBgxS/LLvDr3QW38DB1PNXRnr0GJMcL0TAt7c9qjgVQl83UlGCVyeAnK2InpmW8Uc3PL8XIuqtDeF6g==",
       "license": "MIT",
       "optional": true,
       "dependencies": {
         "flatbuffers": "^25.1.24",
         "guid-typescript": "^1.0.9",
         "long": "^5.2.3",
-        "onnxruntime-common": "1.24.0-dev.20251116-b39e144322",
+        "onnxruntime-common": "1.31.0-dev.20260911-2a43ec07e",
         "platform": "^1.3.6",
         "protobufjs": "^7.2.4"
       }
     },
     "node_modules/onnxruntime-web/node_modules/onnxruntime-common": {
-      "version": "1.24.0-dev.20251116-b39e144322",
-      "resolved": "https://registry.npmjs.org/onnxruntime-common/-/onnxruntime-common-1.24.0-dev.20251116-b39e144322.tgz",
-      "integrity": "sha512-BOoomdHYmNRL5r4iQ4bMvsl2t0/hzVQ3OM3PHD0gxeXu1PmggqBv3puZicEUVOA3AtHHYmqZtjMj9FOfGrATTw==",
+      "version": "1.31.0-dev.20260911-2a43ec07e",
+      "resolved": "https://registry.npmjs.org/onnxruntime-common/-/onnxruntime-common-1.31.0-dev.20260911-2a43ec07e.tgz",
+      "integrity": "sha512-gBuF6U32YErKIAt+yD7DeGBpjRxhJ1uJwako6ygjokSZULDU6Pd+KWComX8Tumk1hYVHRxjPj7mdMnD0ryAPOw==",
       "license": "MIT",
       "optional": true
     },
@@ -966,9 +938,9 @@
       "optional": true
     },
     "node_modules/protobufjs": {
-      "version": "7.6.5",
-      "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-7.6.5.tgz",
-      "integrity": "sha512-/FPD0nUc9jH6rfFjji9IBqOz4pcSE3CsT1m7Ep6Mdb0LxSUMj8hgl6GomOvZzpNpAqqGaXA0P3VSrZLFzIhQrw==",
+      "version": "7.6.6",
+      "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-7.6.6.tgz",
+      "integrity": "sha512-dYDWdjSl5RNb7SgPxGQcRU+GtvP7s2fpkrY0r432PcOIaZ0/rBcxEZnQN67iJhFuQiVw754JDoPruPCNdGsbjg==",
       "hasInstallScript": true,
       "license": "BSD-3-Clause",
       "optional": true,
@@ -989,24 +961,6 @@
         "node": ">=12.0.0"
       }
     },
-    "node_modules/roarr": {
-      "version": "2.15.4",
-      "resolved": "https://registry.npmjs.org/roarr/-/roarr-2.15.4.tgz",
-      "integrity": "sha512-CHhPh+UNHD2GTXNYhPWLnU8ONHdI+5DI+4EYIAOaiD63rHeYlZvyh8P+in5999TTSFgUYuKUAjzRI4mdh/p+2A==",
-      "license": "BSD-3-Clause",
-      "optional": true,
-      "dependencies": {
-        "boolean": "^3.0.1",
-        "detect-node": "^2.0.4",
-        "globalthis": "^1.0.1",
-        "json-stringify-safe": "^5.0.1",
-        "semver-compare": "^1.0.0",
-        "sprintf-js": "^1.1.2"
-      },
-      "engines": {
-        "node": ">=8.0"
-      }
-    },
     "node_modules/semver": {
       "version": "7.8.5",
       "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz",
@@ -1020,21 +974,14 @@
         "node": ">=10"
       }
     },
-    "node_modules/semver-compare": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/semver-compare/-/semver-compare-1.0.0.tgz",
-      "integrity": "sha512-YM3/ITh2MJ5MtzaM429anh+x2jiLVjqILF4m4oyQB18W7Ggea7BfqdH/wGMK7dDiMghv/6WG7znWMwUDzJiXow==",
-      "license": "MIT",
-      "optional": true
-    },
     "node_modules/serialize-error": {
-      "version": "7.0.1",
-      "resolved": "https://registry.npmjs.org/serialize-error/-/serialize-error-7.0.1.tgz",
-      "integrity": "sha512-8I8TjW5KMOKsZQTvoxjuSIa7foAwPWGOts+6o7sgjz41/qMD9VQHEDxi6PBvK2l0MXUmqZyNpUK+T2tQaaElvw==",
+      "version": "8.1.0",
+      "resolved": "https://registry.npmjs.org/serialize-error/-/serialize-error-8.1.0.tgz",
+      "integrity": "sha512-3NnuWfM6vBYoy5gZFvHiYsVbafvI9vZv/+jlIigFn4oP4zjNPK3LhcY0xSCgeb1a5L8jO71Mit9LlNoi2UfDDQ==",
       "license": "MIT",
       "optional": true,
       "dependencies": {
-        "type-fest": "^0.13.1"
+        "type-fest": "^0.20.2"
       },
       "engines": {
         "node": ">=10"
@@ -1044,9 +991,9 @@
       }
     },
     "node_modules/sharp": {
-      "version": "0.35.3",
-      "resolved": "https://registry.npmjs.org/sharp/-/sharp-0.35.3.tgz",
-      "integrity": "sha512-ej0zVHuZGHCiABXcNxeYhpRnPNPAcvbG8RMdBAhDAxLKkCRVSpK3Iyu7qbqw3JMzoj0REeM6f3tJLtVwl0023Q==",
+      "version": "0.35.5",
+      "resolved": "https://registry.npmjs.org/sharp/-/sharp-0.35.5.tgz",
+      "integrity": "sha512-Ywn4OnzGukp7CDMrp08RQ50YKmuwG47brZgIVPTvBaaAfQlRlygrRqSrxdCiL9M+LlzLBiJ68IR1QqvzHyjC7g==",
       "license": "Apache-2.0",
       "optional": true,
       "dependencies": {
@@ -1061,31 +1008,31 @@
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-darwin-arm64": "0.35.3",
-        "@img/sharp-darwin-x64": "0.35.3",
-        "@img/sharp-freebsd-wasm32": "0.35.3",
-        "@img/sharp-libvips-darwin-arm64": "1.3.2",
-        "@img/sharp-libvips-darwin-x64": "1.3.2",
-        "@img/sharp-libvips-linux-arm": "1.3.2",
-        "@img/sharp-libvips-linux-arm64": "1.3.2",
-        "@img/sharp-libvips-linux-ppc64": "1.3.2",
-        "@img/sharp-libvips-linux-riscv64": "1.3.2",
-        "@img/sharp-libvips-linux-s390x": "1.3.2",
-        "@img/sharp-libvips-linux-x64": "1.3.2",
-        "@img/sharp-libvips-linuxmusl-arm64": "1.3.2",
-        "@img/sharp-libvips-linuxmusl-x64": "1.3.2",
-        "@img/sharp-linux-arm": "0.35.3",
-        "@img/sharp-linux-arm64": "0.35.3",
-        "@img/sharp-linux-ppc64": "0.35.3",
-        "@img/sharp-linux-riscv64": "0.35.3",
-        "@img/sharp-linux-s390x": "0.35.3",
-        "@img/sharp-linux-x64": "0.35.3",
-        "@img/sharp-linuxmusl-arm64": "0.35.3",
-        "@img/sharp-linuxmusl-x64": "0.35.3",
-        "@img/sharp-webcontainers-wasm32": "0.35.3",
-        "@img/sharp-win32-arm64": "0.35.3",
-        "@img/sharp-win32-ia32": "0.35.3",
-        "@img/sharp-win32-x64": "0.35.3"
+        "@img/sharp-darwin-arm64": "0.35.5",
+        "@img/sharp-darwin-x64": "0.35.5",
+        "@img/sharp-freebsd-wasm32": "0.35.5",
+        "@img/sharp-libvips-darwin-arm64": "1.3.4",
+        "@img/sharp-libvips-darwin-x64": "1.3.4",
+        "@img/sharp-libvips-linux-arm": "1.3.4",
+        "@img/sharp-libvips-linux-arm64": "1.3.4",
+        "@img/sharp-libvips-linux-ppc64": "1.3.4",
+        "@img/sharp-libvips-linux-riscv64": "1.3.4",
+        "@img/sharp-libvips-linux-s390x": "1.3.4",
+        "@img/sharp-libvips-linux-x64": "1.3.4",
+        "@img/sharp-libvips-linuxmusl-arm64": "1.3.4",
+        "@img/sharp-libvips-linuxmusl-x64": "1.3.4",
+        "@img/sharp-linux-arm": "0.35.5",
+        "@img/sharp-linux-arm64": "0.35.5",
+        "@img/sharp-linux-ppc64": "0.35.5",
+        "@img/sharp-linux-riscv64": "0.35.5",
+        "@img/sharp-linux-s390x": "0.35.5",
+        "@img/sharp-linux-x64": "0.35.5",
+        "@img/sharp-linuxmusl-arm64": "0.35.5",
+        "@img/sharp-linuxmusl-x64": "0.35.5",
+        "@img/sharp-webcontainers-wasm32": "0.35.5",
+        "@img/sharp-win32-arm64": "0.35.5",
+        "@img/sharp-win32-ia32": "0.35.5",
+        "@img/sharp-win32-x64": "0.35.5"
       },
       "peerDependenciesMeta": {
         "@types/node": {
@@ -1093,13 +1040,6 @@
         }
       }
     },
-    "node_modules/sprintf-js": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/sprintf-js/-/sprintf-js-1.1.3.tgz",
-      "integrity": "sha512-Oo+0REFV59/rz3gfJNKQiBlwfHaSESl1pcGyABQsnnIfWOFt6JNj5gCog2U6MLZ//IGYD+nA8nI+mTShREReaA==",
-      "license": "BSD-3-Clause",
-      "optional": true
-    },
     "node_modules/thunky": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/thunky/-/thunky-1.1.0.tgz",
@@ -1114,9 +1054,9 @@
       "optional": true
     },
     "node_modules/type-fest": {
-      "version": "0.13.1",
-      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.13.1.tgz",
-      "integrity": "sha512-34R7HTnG0XIJcBSn5XhDd7nNFPRcXYRZrBB2O2jdKqYODldSzBAqzsWoZYYvduky73toYS/ESqxPvkDf/F0XMg==",
+      "version": "0.20.2",
+      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.20.2.tgz",
+      "integrity": "sha512-Ne+eE4r0/iWnpAxD852z3A+N0Bt5RN//NjJwRd2VFHEmrywxf5vsZlh4R6lixl6B+wz/8d+maTSAkN1FIkI3LQ==",
       "license": "(MIT OR CC0-1.0)",
       "optional": true,
       "engines": {
@@ -1127,9 +1067,9 @@
       }
     },
     "node_modules/undici-types": {
-      "version": "8.3.0",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-8.3.0.tgz",
-      "integrity": "sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ==",
+      "version": "8.9.0",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-8.9.0.tgz",
+      "integrity": "sha512-KTDyRTYX8sWmKXAikPHHSyc63CRPETMctyjKFupcC6OBLXT3xsN0e9aF7m+mIXutFWpUXuedtowG7iLOzp0kQg==",
       "license": "MIT",
       "optional": true
     },
diff --git a/package.json b/package.json
index b3107237..13b6f3cf 100644
--- a/package.json
+++ b/package.json
@@ -34,11 +34,11 @@
   },
   "dependencies": {
     "bonjour-service": "^1.3.0",
-    "ws": "^8.20.0"
+    "ws": "^8.20.2"
   },
   "overrides": {
-    "sharp": "^0.35.0",
-    "adm-zip": "^0.6.0"
+    "sharp": "^0.35.4",
+    "adm-zip": "^0.6.1"
   },
   "files": [
     "bin/",
@@ -49,6 +49,6 @@
     "README.md"
   ],
   "optionalDependencies": {
-    "@huggingface/transformers": "^4.0.1"
+    "@huggingface/transformers": "^4.3.0"
   }
 }
diff --git a/tests/_semantic.js b/tests/_semantic.js
new file mode 100644
index 00000000..72432954
--- /dev/null
+++ b/tests/_semantic.js
@@ -0,0 +1,15 @@
+'use strict';
+
+/**
+ * Wait for the semantic encoder (the kernel the §9.2.1 reject floor is calibrated on). It awaits the
+ * encoder's own load instead of polling against a fixed timeout: the full suite loads the model in
+ * several test processes at once, and a guessed 30 s ran out under that contention. The test's own
+ * timeout is the only bound.
+ */
+const { semanticSettled } = require('../lib/core/context-encoder');
+
+async function awaitSemantic() {
+  if (!(await semanticSettled())) throw new Error('the semantic encoder failed to load (see the [encoder] line above)');
+}
+
+module.exports = { awaitSemantic };
diff --git a/tests/lineage-severance-signed.test.js b/tests/lineage-severance-signed.test.js
index 851375b6..e868cc11 100644
--- a/tests/lineage-severance-signed.test.js
+++ b/tests/lineage-severance-signed.test.js
@@ -25,7 +25,7 @@ const { SymNode } = require('../lib/node');
 const { NullDiscovery } = require('../lib/discovery');
 const { nodeDir } = require('../lib/config');
 const { MemoryStore } = require('../lib/memory-store');
-const { createCMB, signCMB, verifyCMB, isSemanticReady, resolveTetherAnchor } = require('../lib/core');
+const { createCMB, signCMB, verifyCMB, resolveTetherAnchor } = require('../lib/core');
 
 const ALIGNED = { decision: 'aligned', total_drift: 0.1, category_drifts: { focus: 0.1 }, gate_values: { focus: 1 } };
 
@@ -38,14 +38,7 @@ function rawKeypair() {
 }
 const AUTHOR = rawKeypair();
 
-// The reject floor is calibrated on the semantic kernel (§9.2.1), as in the other tether tests.
-async function awaitSemantic(timeoutMs = 30000) {
-  const t0 = Date.now();
-  while (!isSemanticReady()) {
-    if (Date.now() - t0 > timeoutMs) throw new Error('semantic encoder did not become ready');
-    await new Promise((r) => setTimeout(r, 200));
-  }
-}
+const { awaitSemantic } = require('./_semantic');
 
 function cat7(t) {
   return {
diff --git a/tests/lineage-tether-audit.test.js b/tests/lineage-tether-audit.test.js
index e5db3bbe..d9ecca85 100644
--- a/tests/lineage-tether-audit.test.js
+++ b/tests/lineage-tether-audit.test.js
@@ -15,15 +15,9 @@ const fs = require('fs');
 const { SymNode } = require('../lib/node');
 const { NullDiscovery } = require('../lib/discovery');
 const { nodeDir } = require('../lib/config');
-const { createCMB, isSemanticReady, verifyTetherAttestation } = require('../lib/core');
-
-async function awaitSemantic(timeoutMs = 30000) {
-  const t0 = Date.now();
-  while (!isSemanticReady()) {
-    if (Date.now() - t0 > timeoutMs) throw new Error('semantic encoder did not become ready');
-    await new Promise((r) => setTimeout(r, 200));
-  }
-}
+const { createCMB, verifyTetherAttestation } = require('../lib/core');
+
+const { awaitSemantic } = require('./_semantic');
 
 function cat7(t) {
   return {
diff --git a/tests/lineage-tether-neural.test.js b/tests/lineage-tether-neural.test.js
index e1aeb5f4..0885521e 100644
--- a/tests/lineage-tether-neural.test.js
+++ b/tests/lineage-tether-neural.test.js
@@ -21,18 +21,11 @@ const fs = require('fs');
 const { SymNode } = require('../lib/node');
 const { NullDiscovery } = require('../lib/discovery');
 const { nodeDir } = require('../lib/config');
-const { createCMB, isSemanticReady, verifyTetherAttestation } = require('../lib/core');
+const { createCMB, verifyTetherAttestation } = require('../lib/core');
 
 const ALIGNED = { decision: 'aligned', total_drift: 0.1, category_drifts: { focus: 0.1 }, gate_values: { focus: 1 } };
 
-// The reject floor is calibrated on the semantic kernel (§9.2.1), as in the other tether tests.
-async function awaitSemantic(timeoutMs = 30000) {
-  const t0 = Date.now();
-  while (!isSemanticReady()) {
-    if (Date.now() - t0 > timeoutMs) throw new Error('semantic encoder did not become ready');
-    await new Promise((r) => setTimeout(r, 200));
-  }
-}
+const { awaitSemantic } = require('./_semantic');
 
 function cat7(t) {
   return {
diff --git a/tests/lineage-tether-reproducible.test.js b/tests/lineage-tether-reproducible.test.js
index bcc371c6..b22410a2 100644
--- a/tests/lineage-tether-reproducible.test.js
+++ b/tests/lineage-tether-reproducible.test.js
@@ -27,17 +27,10 @@ const { SymNode } = require('../lib/node');
 const { NullDiscovery } = require('../lib/discovery');
 const { nodeDir } = require('../lib/config');
 const core = require('../lib/core');
-const { createCMB, isSemanticReady, evaluateLineageTetherFromText, processHeuristicSVAF } = core;
+const { createCMB, evaluateLineageTetherFromText, processHeuristicSVAF } = core;
 
 // The reject-floor calibration assumes the semantic kernel (§9.2.1: thresholds are meaningful only
-// within a pinned encoder), and a comparison across two nodes is only meaningful in one kernel.
-async function awaitSemantic(timeoutMs = 30000) {
-  const t0 = Date.now();
-  while (!isSemanticReady()) {
-    if (Date.now() - t0 > timeoutMs) throw new Error('semantic encoder did not become ready');
-    await new Promise((r) => setTimeout(r, 200));
-  }
-}
+const { awaitSemantic } = require('./_semantic');
 
 async function withNode(baseName, fn) {
   const name = `${baseName}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
diff --git a/tests/lineage-tether-severance.test.js b/tests/lineage-tether-severance.test.js
index 9cf190fb..655e7f98 100644
--- a/tests/lineage-tether-severance.test.js
+++ b/tests/lineage-tether-severance.test.js
@@ -25,19 +25,12 @@ const fs = require('fs');
 const { SymNode } = require('../lib/node');
 const { NullDiscovery } = require('../lib/discovery');
 const { nodeDir } = require('../lib/config');
-const { createCMB, isSemanticReady, verifyTetherAttestation, kernelId } = require('../lib/core');
+const { createCMB, verifyTetherAttestation, kernelId } = require('../lib/core');
 
 // The tether's reject-floor calibration assumes the semantic kernel (the
 // production default — §9.2.1: thresholds are meaningful only within a pinned
 // encoder). The encoder loads async at module require; wait for it so the
-// test exercises the deployed configuration, not the n-gram warmup fallback.
-async function awaitSemantic(timeoutMs = 30000) {
-  const t0 = Date.now();
-  while (!isSemanticReady()) {
-    if (Date.now() - t0 > timeoutMs) throw new Error('semantic encoder did not become ready');
-    await new Promise((r) => setTimeout(r, 200));
-  }
-}
+const { awaitSemantic } = require('./_semantic');
 
 async function withNode(baseName, fn) {
   const name = `${baseName}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
diff --git a/tests/svaf-anchor-weight.test.js b/tests/svaf-anchor-weight.test.js
index 449fbfdf..af262595 100644
--- a/tests/svaf-anchor-weight.test.js
+++ b/tests/svaf-anchor-weight.test.js
@@ -16,20 +16,13 @@ const { describe, it } = require('node:test');
 const assert = require('node:assert');
 const { tmpdir } = require('./_tmpdir');
 const { MemoryStore } = require('../lib/memory-store');
-const { createCMB, processHeuristicSVAF, isSemanticReady } = require('../lib/core');
+const { createCMB, processHeuristicSVAF } = require('../lib/core');
 
 const TAU = 3600;
 const POLICY = { stableThreshold: 0.35, guardedThreshold: 0.75, temporalLambda: 0.3, freshnessSeconds: TAU };
 
 // One kernel for every gate the test compares (§9.2.1: drifts compare only within a pinned
-// encoder), and the one a node runs once its semantic encoder has loaded.
-async function awaitSemantic(timeoutMs = 30000) {
-  const t0 = Date.now();
-  while (!isSemanticReady()) {
-    if (Date.now() - t0 > timeoutMs) throw new Error('semantic encoder did not become ready');
-    await new Promise((r) => setTimeout(r, 200));
-  }
-}
+const { awaitSemantic } = require('./_semantic');
 
 function cat7(t) {
   return {

From c5cdcbd6a5d66eb5e2c6be27900d64a0cd23ab41 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 19:51:56 +0100
Subject: [PATCH 038/148] CHANGELOG: the store, SVAF anchor decay and
 dependency changes for 0.13.15

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 CHANGELOG.md | 43 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 43 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index bd728c58..bad03abd 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -68,6 +68,48 @@ debt, and the daemon's log flood. Every item has a test that fails without its f
 - **Cold-start admissions had no tether (B-L6).**
 - The tether audit's fetch fallback no longer returns a local record the walk had refused.
 
+### Changed — read these before upgrading
+
+- **A stored record is exactly what its author signed.** The store used to add members to a
+  two-section record: `admission`, `tether`, `provenance` and `collapsed`, plus an expanded
+  top-level `lineage`. The record now stays `{categories, metadata}` as signed (§8.8.1), and those
+  annotations live on the store **entry**. Stored files from earlier releases are read as before and
+  moved on first touch. **Code outside sym that reads `entry.cmb.admission`, `.tether`,
+  `.provenance` or `.collapsed`, from stored entries or from `cmb-accepted` / `memory-received`
+  events, must read them from the entry.** xmesh 0.10.11 reads both places.
+- **SVAF anchors decay with age (§9.2.1).** The gate treated every stored anchor as fresh at full
+  weight, because the anchor view carried neither the entry's age nor its weight. Anchors now carry
+  both: `storedAt`, and the store's §6.4 `anchorWeight` (2.0 once validated, 0.5 once dismissed, never
+  the sender's unsigned confidence). At the default freshness of 1800 s, an anchor older than about
+  nine hours carries no weight. **A node whose recent memory is all older than that admits the next
+  block under the empty-memory rule**, as §9.2.1 specifies.
+
+### Fixed — SVAF and the store
+
+- Anchor vectors are measured through a side map and are never written onto stored records, where a
+  later save persisted them.
+- A vector is cached under the kernel that produced it. When the semantic encoder finished loading
+  during a gate, lexical vectors were cached under the semantic key.
+- The neural admission path applies the §15.8 tether exactly as the heuristic path does, through the
+  same helpers. It stores a copy, never the caller's record. When a carried address did not match
+  the content, it now mints this node's own remix, as the heuristic path does; before, it rewrote the
+  author's record under the author's name with a signature that no longer covered it.
+- §15.8 severance no longer edits a signed record (that broke the author's signature). Severance is
+  recorded on the entry and in the lineage index, and every reader of stored lineage honours it:
+  the anchor walk, an index rebuild from disk, the tether audit, and mesh-agent's remix check.
+- The tether audit reads the store's lineage, not an `ancestors` list a sender chose, and never
+  fetches a local record the walk had refused.
+- A frame cannot supply `admission`, `tether`, `provenance`, `collapsed` or `svaf` that this node
+  would then store as its own.
+- The semantic encoder no longer starts a second model load while the first is loading.
+  `semanticSettled()` resolves when it is ready or has failed.
+
+### Fixed — dependencies
+
+- `npm audit` is clean. Floors are raised past the vulnerable versions, because `overrides` do not
+  reach a consumer's install: `ws` `^8.20.2`, `@huggingface/transformers` `^4.3.0`, and `sharp` and
+  `adm-zip` as overrides.
+
 ### Fixed — the daemon
 
 - **The log flood.** Every peer re-sends its whole wake-channel list on every connect, and the
@@ -99,6 +141,7 @@ debt, and the daemon's log flood. Every item has a test that fails without its f
   test on every platform. The lease test uses a live foreign holder with a real start time; it never
   reached the start-time check before, on any OS. The relay-only test uses the platform's IPC endpoint.
 - Admission-as-collapse (B-L3) is pinned by a test: the conformance boundary of spec PR #17.
+- Tests wait on what they test instead of fixed sleeps: in-flight frames, and the encoder's own load.
 
 ## 0.13.14 (2026-10-01)
 

From 212ea2b2e693b528a4e3d2f8a8f294e21f0eb9cc Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 20:22:01 +0100
Subject: [PATCH 039/148] =?UTF-8?q?comments:=20the=20anti-echo=20rule=20is?=
 =?UTF-8?q?=20MMP=20v2.0=20=C2=A715.7,=20not=20=C2=A714?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 lib/frame-handler.js | 6 +++---
 lib/memory-store.js  | 2 +-
 lib/node.js          | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/lib/frame-handler.js b/lib/frame-handler.js
index 98e98f33..954257d1 100644
--- a/lib/frame-handler.js
+++ b/lib/frame-handler.js
@@ -17,7 +17,7 @@ const { assertRecordSize } = require('./core/cmb-encoder');
  *
  * See MMP v0.2.0 Section 9: Coupling & SVAF.
  * See MMP v0.2.0 Section 12: xMesh (Layer 6).
- * See MMP v0.2.0 Section 14: Echo loop prevention.
+ * Echo loop prevention: the anti-echo rule of MMP v2.0 §15.7 (it was Section 14 in v0.2.0).
  *
  * Copyright (c) 2026 SYM.BOT. Apache 2.0 License.
  */
@@ -99,7 +99,7 @@ class FrameHandler {
     this._inFlightKeys = new Set();
     // Persist the dedup cache across plugin reloads / process restarts. Without this,
     // a reload wipes the cache and every already-processed CMB re-surfaces as new — a
-    // primary trigger of the cross-node echo storm (MMP §14). Best-effort: any FS error
+    // primary trigger of the cross-node echo storm (MMP §15.7, anti-echo). Best-effort: any FS error
     // degrades silently to in-memory-only. Stored as a dotfile WITHOUT a .json extension
     // so the store's own *.json scan never mistakes it for a CMB entry.
     this._seenKeysPath = null;
@@ -937,7 +937,7 @@ class FrameHandler {
     // it once the CMB has actually been delivered.
     msg._incomingKey = incomingKey || null;
 
-    // Echo loop prevention (MMP Section 14): if the incoming CMB's
+    // Echo loop prevention (MMP §15.7, anti-echo): if the incoming CMB's
     // lineage parents include a key that exists in our local cmbs,
     // this CMB is a derivative of our own broadcast. Skip all
     // processing — including mood delivery — to prevent ping-pong
diff --git a/lib/memory-store.js b/lib/memory-store.js
index 8f720407..79dd2a2a 100644
--- a/lib/memory-store.js
+++ b/lib/memory-store.js
@@ -609,7 +609,7 @@ class MemoryStore {
 
   /**
    * Check if a CMB key exists in local entries (authored by this node).
-   * Used for echo loop prevention (MMP Section 14): incoming CMBs whose
+   * Used for echo loop prevention (MMP §15.7, anti-echo): incoming CMBs whose
    * lineage parents exist in our local store are derivatives of our own
    * broadcasts and should be silently dropped.
    *
diff --git a/lib/node.js b/lib/node.js
index 43695179..4ce0bb20 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -3049,7 +3049,7 @@ class SymNode extends EventEmitter {
       const sharedSecret = this._peerSharedSecrets.get(peer.peerId);
       // Anchors must be this node's OWN recent emissions (peerId == null). Forwarding
       // CMBs we merely received from other peers re-gossips them across the mesh
-      // (A->B->C->A) and is the amplifier behind cross-node echo storms (MMP §14): a
+      // (A->B->C->A) and is the amplifier behind cross-node echo storms (MMP §15.7, anti-echo): a
       // peer learns each node's state from that node directly, so own-origin anchors
       // are sufficient context. Pull a wider window, then keep the 5 most-recent own.
       const recentAnchors = this._store.recent(50).filter(a => a.cmb && a.peerId == null).slice(0, 5);

From 1b2779f40a3c97ba2289fe4b4d034692b74f1acd Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 20:28:27 +0100
Subject: [PATCH 040/148] docs: a handshake-learned key binding is trusted on
 first use, not authenticated

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 docs/DESIGN-room-join-authorization.md | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/docs/DESIGN-room-join-authorization.md b/docs/DESIGN-room-join-authorization.md
index 3afa4a98..5af2317b 100644
--- a/docs/DESIGN-room-join-authorization.md
+++ b/docs/DESIGN-room-join-authorization.md
@@ -68,8 +68,9 @@ B cannot mint an invite for any room xmesh actually creates.
 
 ## What already exists to build on (read, not imagined)
 
-- **Ed25519 node identity** and **roster-keys** (`lib/roster-keys.js`): authenticated
-  nodeId→publicKey bindings with source precedence — anchor (2) > handshake (1) > grant (0);
+- **Ed25519 node identity** and **roster-keys** (`lib/roster-keys.js`): nodeId→publicKey
+  bindings (a handshake-learned key is trusted on first use until Core Secure proves possession)
+  with source precedence — anchor (2) > handshake (1) > grant (0);
   a gossiped grant can never overwrite a handshake-learned key; the relayer never vouches.
 - **Signed grants** along the rooted authority chain (`lib/role-grant-store.js`): a grant
   binds the grantee's key into the grantor's signed payload — tamper-evident vouching that

From fd76924f988161c9112364ab05c5340b2f2184fa Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 20:55:06 +0100
Subject: [PATCH 041/148] F1: a malformed v2.0 frame is refused, never thrown;
 a frame that throws is dropped, not fatal

assertionIdV2_0 throws on a record that declares the v2.0 suite but has no preimage (no room, no
key, ...). It ran outside any try, and on the relay path nothing above it caught the throw, so one
unsigned frame from an admitted peer ended the daemon. The derived id is now null for such a record
(a mismatch, rejected with its metric), and FrameHandler.handle contains any throw from frame
handling: the frame is dropped with a log line and a frame-handler-error metric.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 lib/frame-handler.js            | 19 +++++++++++++++++-
 tests/v2-author-binding.test.js | 35 +++++++++++++++++++++++++++++++++
 2 files changed, 53 insertions(+), 1 deletion(-)

diff --git a/lib/frame-handler.js b/lib/frame-handler.js
index 954257d1..8dec25fa 100644
--- a/lib/frame-handler.js
+++ b/lib/frame-handler.js
@@ -205,6 +205,18 @@ class FrameHandler {
         return;
       }
     }
+    // One frame must never end the node. The TCP parser catches a throw from here, but the relay
+    // path calls this from a WebSocket handler with nothing above it, so a throw there was an
+    // uncaught exception and the daemon exited. A frame that throws is dropped and said so.
+    try {
+      this._dispatch(peerId, peerName, msg);
+    } catch (err) {
+      this._node._log(`Frame '${msg && msg.type}' from ${peerName} dropped: ${err && err.message ? err.message : err}`);
+      this._node.emit('metric', { type: 'frame-handler-error', from: peerName, frameType: msg && msg.type, error: String(err && err.message ? err.message : err) });
+    }
+  }
+
+  _dispatch(peerId, peerName, msg) {
     switch (msg.type) {
       case 'handshake':
         this._handleHandshake(peerId, peerName, msg);
@@ -475,7 +487,12 @@ class FrameHandler {
       // No key for the author yet is key-distribution latency, not forgery: unverified, as for v1.
       if (!authorKey) { msg._cmbVerified = false; return false; }
       const v2 = verifyCMB(cmb, authorKey);
-      const idOk = md.assertionId === undefined || md.assertionId === assertionIdV2_0(cmb);
+      // A record that declares the v2.0 suite but is malformed for it (no room, no key, …) has no
+      // preimage: assertionIdV2_0 throws. That is a mismatch to reject, never an exception: on the
+      // relay path nothing above this catches it, and one such frame ended the daemon.
+      let derivedId = null;
+      try { derivedId = assertionIdV2_0(cmb); } catch { /* not a well-formed v2.0 record */ }
+      const idOk = md.assertionId === undefined || md.assertionId === derivedId;
       if (v2.valid && idOk) { msg._cmbVerified = true; msg._verifiedAuthorNodeId = md.createdByNodeId; return false; }
       const reason = !v2.valid ? (v2.error || 'invalid') : 'assertion-id-mismatch';
       const k = recordKey(cmb);
diff --git a/tests/v2-author-binding.test.js b/tests/v2-author-binding.test.js
index a469e7f0..c6e77780 100644
--- a/tests/v2-author-binding.test.js
+++ b/tests/v2-author-binding.test.js
@@ -112,3 +112,38 @@ describe('the inbox names a proven author (K5)', () => {
     } finally { await node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
   });
 });
+
+describe('a malformed v2.0 frame is refused, never thrown (0.13.15 review F1)', () => {
+  // Declares the v2.0 suite but carries no room and no signature: it has no preimage, and building
+  // one throws. On the relay path that throw reached the process and ended the daemon.
+  function malformed() {
+    const cmb = createCMB({ categories: { focus: 'x' }, createdBy: 'alice', emitV2: true, createdByNodeId: 'node-alice', room: 'default' });
+    cmb.metadata.assertionId = 'asrt-0';
+    delete cmb.metadata.room;
+    return cmb;
+  }
+
+  it('the signature check rejects it as a mismatch', () => {
+    withNode((node) => {
+      const metrics = [];
+      node.on('metric', (m) => metrics.push(m));
+      const msg = { cmb: malformed() };
+      assert.doesNotThrow(() => assert.strictEqual(node._frameHandler._rejectOnBadSignature('node-alice', 'alice', msg), true));
+      assert.ok(metrics.some((m) => m.type === 'cmb-signature-rejected'), 'rejected through the ordinary path, with its metric');
+    });
+  });
+
+  it('a frame that throws anywhere in handling is dropped and counted, and the node goes on', () => {
+    withNode((node) => {
+      node._roomDoor = () => ({ pass: true });
+      const metrics = [];
+      node.on('metric', (m) => metrics.push(m));
+      assert.doesNotThrow(() => node._frameHandler.handle('node-alice', 'alice', { type: 'cmb', cmb: malformed() }));
+      const original = node._frameHandler._handleMemoryShare;
+      node._frameHandler._handleMemoryShare = () => { throw new Error('boom'); };
+      assert.doesNotThrow(() => node._frameHandler.handle('node-alice', 'alice', { type: 'cmb', cmb: malformed() }));
+      node._frameHandler._handleMemoryShare = original;
+      assert.ok(metrics.some((m) => m.type === 'frame-handler-error' && /boom/.test(m.error)));
+    });
+  });
+});

From a3eebdeea574a193559f04118ba24d2b109edaa1 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 20:56:24 +0100
Subject: [PATCH 042/148] F2, F3: a pre-0.13.15 wake channel is not repointed
 by gossip; the wake-channel map and each peer-info are bounded

A channel loaded from a 0.13.14 file has no source and ranked below gossip, so any room peer could
repoint a phone's token, the case this release says is closed. It now ranks with the relay: gossip
cannot replace it, the relay and the phone can. The map holds at most 1024 channels, making room by
dropping the weakest-sourced, oldest sighting and never a stronger source for a weaker one, and one
peer-info frame is read for at most 256 entries.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 lib/core/wake.js            | 39 ++++++++++++++++++++++++++++----
 lib/frame-handler.js        |  7 +++++-
 tests/wake-channels.test.js | 45 +++++++++++++++++++++++++++++++++++++
 3 files changed, 86 insertions(+), 5 deletions(-)

diff --git a/lib/core/wake.js b/lib/core/wake.js
index fe3ff1c1..a6796a42 100644
--- a/lib/core/wake.js
+++ b/lib/core/wake.js
@@ -31,8 +31,14 @@ const WAKE_CHANNEL_TTL_MS = 30 * 24 * 60 * 60 * 1000;
 /** A newer sighting of the same channel is worth persisting once it moves lastSeen by this much. */
 const REFRESH_GRANULARITY_MS = 60 * 60 * 1000;
 
-/** How far each source of a wake channel is trusted. Gossip is unauthenticated. */
-const SOURCE_RANK = Object.freeze({ legacy: 0, gossip: 1, relay: 2, direct: 3 });
+/** How far each source of a wake channel is trusted. Gossip is unauthenticated. A channel kept by
+ *  a release before 0.13.15 carries no source: it may have come from the phone itself, so gossip
+ *  must not repoint it, while the relay and the phone still can. */
+const SOURCE_RANK = Object.freeze({ gossip: 1, legacy: 2, relay: 2, direct: 3 });
+
+/** At most this many wake channels are kept. Gossip names nodeIds nothing vouches for, so without a
+ *  bound a peer could grow the map, its file and every peer-info this node sends. */
+const WAKE_CHANNELS_MAX = 1024;
 
 /**
  * Manages wake channel persistence and peer wake notifications.
@@ -66,6 +72,7 @@ class WakeManager {
     this._getIdentity = opts.getIdentity;
     this._nodeName = opts.nodeName;
     this._ttlMs = opts.wakeChannelTtlMs ?? WAKE_CHANNEL_TTL_MS;
+    this._maxChannels = opts.maxWakeChannels ?? WAKE_CHANNELS_MAX;
     this._now = opts.now || Date.now;
 
     this._apnsConfig = null;
@@ -129,7 +136,11 @@ class WakeManager {
     if (now - seen > this._ttlMs) return 'ignored';
     const next = { platform: channel.platform, token: channel.token, environment: channel.environment, source, lastSeen: seen };
     const prev = this._peerWakeChannels.get(nodeId);
-    if (!prev) { this._peerWakeChannels.set(nodeId, next); return 'added'; }
+    if (!prev) {
+      if (this._peerWakeChannels.size >= this._maxChannels && !this._evictFor(source)) return 'ignored';
+      this._peerWakeChannels.set(nodeId, next);
+      return 'added';
+    }
     const sameToken = prev.platform === next.platform && prev.token === next.token && prev.environment === next.environment;
     if (sameToken) {
       // The same channel again: keep the stronger source and the later sighting.
@@ -149,6 +160,26 @@ class WakeManager {
     return 'updated';
   }
 
+  /**
+   * Make room for one channel from `source`: drop the weakest-sourced channel, the oldest sighting
+   * among those, but never one from a stronger source than the newcomer's. So fabricated gossip
+   * only ever displaces other gossip.
+   * @private
+   * @returns {boolean} whether there is room now
+   */
+  _evictFor(source) {
+    const rank = SOURCE_RANK[source] ?? 0;
+    let victim = null;
+    for (const [id, ch] of this._peerWakeChannels) {
+      const r = SOURCE_RANK[ch.source] ?? 0;
+      const seen = ch.lastSeen ?? 0;
+      if (!victim || r < victim.r || (r === victim.r && seen < victim.seen)) victim = { id, r, seen };
+    }
+    if (!victim || victim.r > rank) return false;
+    this._peerWakeChannels.delete(victim.id);
+    return true;
+  }
+
   /**
    * Drop channels nobody has seen for longer than the TTL.
    * @param {{save?: boolean}} [opts]
@@ -397,4 +428,4 @@ class WakeManager {
   }
 }
 
-module.exports = { WakeManager, WAKE_CHANNEL_TTL_MS };
+module.exports = { WakeManager, WAKE_CHANNEL_TTL_MS, WAKE_CHANNELS_MAX };
diff --git a/lib/frame-handler.js b/lib/frame-handler.js
index 8dec25fa..1c60318b 100644
--- a/lib/frame-handler.js
+++ b/lib/frame-handler.js
@@ -58,6 +58,8 @@ function signatureMark(sig) {
 
 const SEEN_CMB_TTL_MS = 7 * 24 * 60 * 60 * 1000; // 7 days
 const SEEN_CMB_MAX = 10000;
+/** The most `peer-info` entries read from one frame. */
+const PEER_INFO_MAX = 256;
 
 /**
  * Processes inbound peer frames for a SymNode.
@@ -1588,7 +1590,10 @@ class FrameHandler {
     // filled the daemon log at a flapping peer's reconnect rate.
     const wm = this._node._wakeManager;
     let learned = 0, changed = 0;
-    for (const p of msg.peers) {
+    // A room's peer list is short; a frame naming thousands of nodeIds is not one. Only the first
+    // PEER_INFO_MAX are read.
+    if (msg.peers.length > PEER_INFO_MAX) this._node._log(`Gossip from ${peerName}: ${msg.peers.length} entries, reading the first ${PEER_INFO_MAX}`);
+    for (const p of msg.peers.slice(0, PEER_INFO_MAX)) {
       if (!p || !p.nodeId || !p.wakeChannel || p.nodeId === this._node._identity.nodeId) continue;
       const r = wm.learnWakeChannel(p.nodeId, p.wakeChannel, { source: 'gossip', lastSeen: p.lastSeen });
       if (r === 'added' || r === 'updated') learned++;
diff --git a/tests/wake-channels.test.js b/tests/wake-channels.test.js
index 20ddc51f..21cd7711 100644
--- a/tests/wake-channels.test.js
+++ b/tests/wake-channels.test.js
@@ -159,3 +159,48 @@ describe('relay peer list', () => {
     });
   });
 });
+
+describe('0.13.15 review F2/F3', () => {
+  it('a channel kept by 0.13.14 (no source) is not repointed by gossip, and the relay or the phone still can', () => {
+    withNode((node) => {
+      const wm = node._wakeManager;
+      fs.mkdirSync(require('path').dirname(wm._wakeChannelsFile), { recursive: true });
+      fs.writeFileSync(wm._wakeChannelsFile, JSON.stringify({ 'phone-1': apns('phones-own') }));
+      wm.loadWakeChannels();
+      node._frameHandler.handle('peer-x', 'peer-x', { type: 'peer-info', peers: [{ nodeId: 'phone-1', wakeChannel: apns('ATTACKER'), lastSeen: Date.now() }] });
+      assert.strictEqual(wm._peerWakeChannels.get('phone-1').token, 'phones-own', 'gossip cannot repoint it');
+      assert.strictEqual(wm.learnWakeChannel('phone-1', apns('re-registered'), { source: 'relay' }), 'updated', 'the relay can');
+      assert.strictEqual(wm.learnWakeChannel('phone-1', apns('again'), { source: 'direct' }), 'updated', 'the phone can');
+    });
+  });
+
+  it('fabricated gossip is bounded: one frame reads at most 256 entries, and the map holds at most its cap', () => {
+    withNode((node, io) => {
+      const wm = node._wakeManager;
+      wm._maxChannels = 300;
+      wm.learnWakeChannel('real-phone', apns('own'), { source: 'direct' });
+      const now = Date.now();
+      const flood = (from) => ({ type: 'peer-info', peers: Array.from({ length: 2000 }, (_, i) => ({ nodeId: `fake-${from}-${i}`, wakeChannel: apns(`f${i}`), lastSeen: now })) });
+      node._frameHandler.handle('peer-x', 'peer-x', flood('a'));
+      assert.strictEqual(wm._peerWakeChannels.size, 1 + 256, 'the first 256 entries of one frame');
+      assert.ok(io.lines.some((l) => /2000 entries, reading the first 256/.test(l)));
+      node._frameHandler.handle('peer-x', 'peer-x', flood('b'));
+      assert.strictEqual(wm._peerWakeChannels.size, 300, 'never past the cap');
+      assert.strictEqual(wm._peerWakeChannels.get('real-phone').token, 'own', 'gossip only displaces gossip');
+    });
+  });
+
+  it('a full map of first-hand channels is not displaced by gossip, and a new first-hand one displaces the oldest weakest', () => {
+    withNode(() => {
+      const { WakeManager } = require('../lib/core/wake');
+      let t = 1_000_000;
+      const wm = new WakeManager({ wakeChannelsFile: require('path').join(require('os').tmpdir(), `wc-${process.pid}-${Date.now()}.json`), peerWakeChannels: new Map(), peerLastWake: new Map(), pendingFrames: new Map(), maxWakeChannels: 3, now: () => t, log: () => {} });
+      wm.learnWakeChannel('p1', apns('1'), { source: 'direct' }); t += 1000;
+      wm.learnWakeChannel('p2', apns('2'), { source: 'relay' }); t += 1000;
+      wm.learnWakeChannel('p3', apns('3'), { source: 'direct' }); t += 1000;
+      assert.strictEqual(wm.learnWakeChannel('g1', apns('g'), { source: 'gossip', lastSeen: t }), 'ignored');
+      assert.strictEqual(wm.learnWakeChannel('p4', apns('4'), { source: 'direct' }), 'added');
+      assert.deepStrictEqual([...wm._peerWakeChannels.keys()].sort(), ['p1', 'p3', 'p4'], 'the relay-sourced one went: the weakest');
+    });
+  });
+});

From 80388722ed8fb2c994fa9262371e676a0d2f08ac Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 20:56:40 +0100
Subject: [PATCH 043/148] test: the legacy-channel case pins a later clock, so
 it fails on the old ranking

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 tests/wake-channels.test.js | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/tests/wake-channels.test.js b/tests/wake-channels.test.js
index 21cd7711..5dd4e059 100644
--- a/tests/wake-channels.test.js
+++ b/tests/wake-channels.test.js
@@ -167,7 +167,10 @@ describe('0.13.15 review F2/F3', () => {
       fs.mkdirSync(require('path').dirname(wm._wakeChannelsFile), { recursive: true });
       fs.writeFileSync(wm._wakeChannelsFile, JSON.stringify({ 'phone-1': apns('phones-own') }));
       wm.loadWakeChannels();
-      node._frameHandler.handle('peer-x', 'peer-x', { type: 'peer-info', peers: [{ nodeId: 'phone-1', wakeChannel: apns('ATTACKER'), lastSeen: Date.now() }] });
+      // A minute later, so the gossip is strictly newer than the load (the old ranking let it through).
+      const later = Date.now() + 60_000;
+      wm._now = () => later;
+      node._frameHandler.handle('peer-x', 'peer-x', { type: 'peer-info', peers: [{ nodeId: 'phone-1', wakeChannel: apns('ATTACKER'), lastSeen: later }] });
       assert.strictEqual(wm._peerWakeChannels.get('phone-1').token, 'phones-own', 'gossip cannot repoint it');
       assert.strictEqual(wm.learnWakeChannel('phone-1', apns('re-registered'), { source: 'relay' }), 'updated', 'the relay can');
       assert.strictEqual(wm.learnWakeChannel('phone-1', apns('again'), { source: 'direct' }), 'updated', 'the phone can');

From 045a00cc644e08adf3c3e9eeae779562bff2a699 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 20:57:01 +0100
Subject: [PATCH 044/148] F4: inbox().from is a display label; authorize on
 author.nodeId

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 lib/node.js | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/lib/node.js b/lib/node.js
index 4ce0bb20..366a8121 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -1782,9 +1782,10 @@ class SymNode extends EventEmitter {
     this._inbox.push({
       seq,
       id,
-      // Who can be held to it: the author when its signature proved who that is, otherwise the peer
-      // that delivered it. The unproven claim stays in author.name, so `from` is safe to
-      // authorize on. (It used to be the author's label whether or not anything proved it.)
+      // A display label: the author's when its signature proved who wrote it, otherwise the peer that
+      // delivered it. (It used to be the author's label whether or not anything proved it.) A label
+      // is not unique — two node ids can each sign createdBy "alice" — so authorize on
+      // author.nodeId, the proven identity, never on `from`.
       from: (entry.author?.nodeId && entry.author?.name)
         || entry.author?.via?.name
         || recordCreatedBy(cmb) || entry.source || 'unknown',

From a3b96fbbf8bcde9ba169c18e3c25245853e9c63f Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 20:59:02 +0100
Subject: [PATCH 045/148] F5: the CLI's pid file, room, relay.env and nodes
 path follow SYM_STATE_DIR

The daemon was re-rooted in this release but the CLI was not: two SYM_STATE_DIR deployments sharing
a home shared ~/.sym/daemon.pid, so `sym stop` for one SIGTERMed the other, and a room or relay set
for a rooted daemon was written to ~/.sym, where it never reads.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 bin/sym.js                       | 25 +++++++++++++++----------
 tests/state-root-tenancy.test.js | 19 +++++++++++++++++++
 2 files changed, 34 insertions(+), 10 deletions(-)

diff --git a/bin/sym.js b/bin/sym.js
index fa0a2450..0743025c 100755
--- a/bin/sym.js
+++ b/bin/sym.js
@@ -38,13 +38,18 @@ const { recordCreatedBy } = require('../lib/record');
 const net = require('net');
 const fs = require('fs');
 const path = require('path');
-const os = require('os');
 const { execSync, spawn } = require('child_process');
 
 const { getSocketPath, getLogDir } = require('../lib/platform');
 const { isValidRoom, roomServiceType } = require('../lib/rooms');
-const ROOM_FILE = path.join(os.homedir(), '.sym', 'room');
-const PID_FILE = path.join(os.homedir(), '.sym', 'daemon.pid');
+// The CLI's state lives where its daemon's does (SYM_STATE_DIR, default ~/.sym): rooted in the
+// home, two SYM_STATE_DIR deployments shared one pid file (`sym stop` for one stopped the other),
+// and a room or relay set for a rooted daemon went to a file it never reads.
+const { symPath } = require('../lib/core/state-root');
+const { NODES_DIR } = require('../lib/config');
+const ROOM_FILE = symPath('room');
+const PID_FILE = symPath('daemon.pid');
+const RELAY_ENV = symPath('relay.env');
 
 // Portable synchronous sleep — no shell dependency (`sleep` is POSIX-only and
 // absent on Windows). Used between daemon stop/start on a room switch.
@@ -139,9 +144,9 @@ function readRoom() {
 }
 
 function persistRelay(url, token, relayOnly) {
-  const dir = path.join(os.homedir(), '.sym');
+  const dir = path.dirname(RELAY_ENV);
   if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
-  const f = path.join(dir, 'relay.env');
+  const f = RELAY_ENV;
   const kv = {};
   try {
     for (const line of fs.readFileSync(f, 'utf8').split('\n')) {
@@ -192,7 +197,7 @@ function applyStartFlags() {
 function readRelayEnv() {
   const kv = {};
   try {
-    for (const line of fs.readFileSync(path.join(os.homedir(), '.sym', 'relay.env'), 'utf8').split('\n')) {
+    for (const line of fs.readFileSync(RELAY_ENV, 'utf8').split('\n')) {
       const m = line.match(/^([A-Z_]+)=(.*)$/);
       if (m) kv[m[1]] = m[2];
     }
@@ -504,10 +509,10 @@ function cmdPublish() {
 async function standaloneObserve(categories, opts) {
   const { SymNode } = require('..');
 
-  // Load relay credentials from ~/.sym/relay.env if the env vars are
+  // Load relay credentials from the state root's relay.env if the env vars are
   // not already present. Same pattern as MeshAgent (sym/lib/mesh-agent.js:160).
   if (!process.env.SYM_RELAY_URL || !process.env.SYM_RELAY_TOKEN) {
-    const envFile = path.join(os.homedir(), '.sym', 'relay.env');
+    const envFile = RELAY_ENV;
     if (fs.existsSync(envFile)) {
       for (const line of fs.readFileSync(envFile, 'utf8').split('\n')) {
         const m = line.match(/^(\w+)=(.*)$/);
@@ -636,7 +641,7 @@ function cmdRecall() {
   }
   const query = recallArgs.join(' ').toLowerCase();
 
-  const nodesDir = path.join(os.homedir(), '.sym', 'nodes');
+  const nodesDir = NODES_DIR;
   if (!fs.existsSync(nodesDir)) {
     console.log('No memories found.');
     return;
@@ -820,7 +825,7 @@ function broadcastQuestion(question) {
  * most recent memories when nothing matches, so `ask` always has context.
  */
 function gatherMeshMemory(question, limit) {
-  const nodesDir = path.join(os.homedir(), '.sym', 'nodes');
+  const nodesDir = NODES_DIR;
   if (!fs.existsSync(nodesDir)) return [];
   const words = question.toLowerCase().split(/[^a-z0-9]+/).filter((w) => w.length > 2);
 
diff --git a/tests/state-root-tenancy.test.js b/tests/state-root-tenancy.test.js
index 5bb7b7c9..b9551a01 100644
--- a/tests/state-root-tenancy.test.js
+++ b/tests/state-root-tenancy.test.js
@@ -84,3 +84,22 @@ test('and the SAME root still refuses a second holder — the single-writer rule
     assert.equal(out, 'REFUSED EIDENTITYLOCK', 'rooting the tree must not weaken the lock within a root');
   } finally { holder.kill(); }
 });
+
+// The CLI's own state follows SYM_STATE_DIR, as its daemon's does (0.13.15 review F5): rooted in
+// the home, two rooted deployments shared one pid file, so `sym stop` for one stopped the other,
+// and a room or relay set for a rooted daemon was written where that daemon never reads.
+test('the CLI reads its room from SYM_STATE_DIR, not the home (pid and relay.env resolve the same way)', () => {
+  const home = tmpdir('cli-home-');
+  const root = tmpdir('cli-root-');
+  try {
+    fs.writeFileSync(path.join(root, 'room'), 'rooted-room\n');
+    fs.mkdirSync(path.join(home, '.sym'), { recursive: true });
+    fs.writeFileSync(path.join(home, '.sym', 'room'), 'home-room\n');
+    const env = { ...process.env, HOME: home, USERPROFILE: home, SYM_STATE_DIR: root };
+    const out = execFileSync(process.execPath, [path.resolve(__dirname, '..', 'bin', 'sym.js'), 'room'], { env, encoding: 'utf8' });
+    assert.match(out, /current room: rooted-room/, out);
+  } finally {
+    fs.rmSync(home, { recursive: true, force: true });
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});

From 21a0d96ba0bd65323335c61afa0f13b3608b1b9f Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 20:59:52 +0100
Subject: [PATCH 046/148] F6: inbox()'s limit bounds the reply again; acked
 items are listed up to the same limit

K4 made the limit count only unread items, so a ring of acked items came back whole on every call.
Acked items are now listed up to the limit and passed over beyond it (they were read), and the
cursor moves past them, so unread deliveries are still never starved.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 lib/node.js                         | 14 +++++++++-----
 tests/inbox-limit-and-clock.test.js | 17 ++++++++++++++++-
 2 files changed, 25 insertions(+), 6 deletions(-)

diff --git a/lib/node.js b/lib/node.js
index 366a8121..8205d5a3 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -1886,21 +1886,25 @@ class SymNode extends EventEmitter {
     const from = opts.since !== undefined ? opts.since : this._inboxCursor;
     const fresh = this._inbox.filter((m) => m.seq > from);
     // The limit counts what is still unread: an item already acked (read in full by id) comes back
-    // marked, but does not use up a place a new delivery needed.
+    // marked, but does not use up a place a new delivery needed. Acked items are listed up to the
+    // same limit; past it they are passed over (they were read), so `limit` still bounds the reply.
     const slice = [];
-    let unread = 0;
+    let unread = 0, ackedListed = 0, passed = 0, lastSeq = null;
     for (const m of fresh) {
       if (!m.acked) { if (unread >= limit) break; unread++; }
+      else if (ackedListed >= limit) { passed++; lastSeq = m.seq; continue; }
+      else ackedListed++;
       slice.push(m);
+      lastSeq = m.seq;
     }
-    if (!opts.peek && slice.length) {
-      this._inboxCursor = Math.max(this._inboxCursor, slice[slice.length - 1].seq);
+    if (!opts.peek && lastSeq !== null) {
+      this._inboxCursor = Math.max(this._inboxCursor, lastSeq);
       this._persistInbox(); // the drain moves the cursor — a restart must not replay it
     }
     return {
       messages: slice,
       drained: slice.length,
-      remaining: fresh.length - slice.length,
+      remaining: fresh.length - slice.length - passed,
       cursor: this._inboxCursor,
     };
   }
diff --git a/tests/inbox-limit-and-clock.test.js b/tests/inbox-limit-and-clock.test.js
index 4b6040d6..4724de54 100644
--- a/tests/inbox-limit-and-clock.test.js
+++ b/tests/inbox-limit-and-clock.test.js
@@ -31,10 +31,25 @@ describe('inbox limit (K4)', () => {
       const r = node.inbox({ limit: 2 });
       const unread = r.messages.filter((m) => !m.acked).map((m) => m.id);
       assert.deepStrictEqual(unread, [ids[3], ids[4]], 'two unread deliveries, as asked');
-      assert.ok(r.messages.slice(0, 3).every((m) => m.acked), 'the acked ones come back marked');
+      assert.deepStrictEqual(r.messages.filter((m) => m.acked).map((m) => m.id), [ids[0], ids[1]], 'acked ones come back marked, up to the same limit');
       assert.strictEqual(r.remaining, 1);
     } finally { fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
   });
+
+  // 0.13.15 review F6: counting only unread items let the reply grow to the whole ring.
+  it('the limit still bounds the reply when most of the ring is acked', () => {
+    const name = uniq('inbox-bound');
+    const node = mkNode(name);
+    try {
+      for (let i = 0; i < 300; i++) node._pushInbox({ cmb: { categories: { focus: { text: `m${i}` } } }, content: `m${i}`, source: 'peer' });
+      for (const m of node._inbox.slice(0, 299)) node.inboxAck(m.id);
+      const r = node.inbox({ limit: 1 });
+      assert.ok(r.messages.length <= 2, `one unread and at most one acked, not ${r.messages.length}`);
+      assert.deepStrictEqual(r.messages.filter((m) => !m.acked).map((m) => m.id), [node._inbox[299].id], 'the unread delivery is not starved by acked ones');
+      assert.strictEqual(r.remaining, 0, 'acked items passed over are behind the cursor');
+      assert.strictEqual(node.inbox({ limit: 1 }).messages.length, 0, 'and are not handed back next time');
+    } finally { fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+  });
 });
 
 describe('record timestamps (K6)', () => {

From 3f6c9befb034e119dacead405bcc77cd50a9ebb6 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 21:01:52 +0100
Subject: [PATCH 047/148] F7: directed de-duplication marks the assertion by
 its preimage digest, not its signature bytes

A hedged Ed25519 signer (WebKit) signs one assertion differently each time, so the signature hash
named one directed assertion twice and it surfaced twice. The mark is now the digest of the preimage
the signature covers, recomputed locally (assertionIdV2_0 for v2.0, sigDigestV2 otherwise), with the
signature hash as the fallback; marks persisted by 0.13.14 still route to the directed map.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 lib/frame-handler.js                    | 40 +++++++++++++++++++------
 tests/audit-delivery-authorship.test.js | 26 ++++++++++++++++
 2 files changed, 57 insertions(+), 9 deletions(-)

diff --git a/lib/frame-handler.js b/lib/frame-handler.js
index 1c60318b..c36ab825 100644
--- a/lib/frame-handler.js
+++ b/lib/frame-handler.js
@@ -56,8 +56,28 @@ function signatureMark(sig) {
   return bytes.length ? `sig:${crypto.createHash('sha256').update(bytes).digest('hex')}` : null;
 }
 
+/**
+ * The identity of a verified record's ASSERTION (§8.8.2), for directed de-duplication: the digest
+ * of the preimage its signature covers, recomputed here, never a value the frame carries. A hedged
+ * Ed25519 signer (WebKit) signs one assertion differently each time, so the signature bytes would
+ * name one assertion twice; for a deterministic signer the two marks are equivalent. The signature
+ * hash is the fallback for a record whose preimage cannot be rebuilt.
+ * @param {object} cmb a record whose signature verified
+ * @returns {string|null}
+ */
+function assertionMark(cmb) {
+  const { assertionIdV2_0, sigDigestV2 } = require('./core');
+  try {
+    return cmb?.metadata?.signatureSuite === 'mmp-sig-v2.0' ? assertionIdV2_0(cmb) : `sd:${sigDigestV2(cmb)}`;
+  } catch {
+    return signatureMark(cmb?.metadata?.sig);
+  }
+}
+
 const SEEN_CMB_TTL_MS = 7 * 24 * 60 * 60 * 1000; // 7 days
 const SEEN_CMB_MAX = 10000;
+/** A directed de-duplication key: the record key, `#`, and its assertion mark. */
+const DIRECTED_MARK = /#(asrt-|sd:|sig:)/;
 /** The most `peer-info` entries read from one frame. */
 const PEER_INFO_MAX = 256;
 
@@ -162,7 +182,9 @@ class FrameHandler {
 
   /** The de-dup map a key belongs to: directed assertion marks are kept apart from content keys. @private */
   _seenKeysFor(key) {
-    return typeof key === 'string' && key.includes('#sig:') ? this._seenDirectedKeys : this._seenCmbKeys;
+    // A directed mark is `<key>#<assertion mark>` (assertionMark): `asrt-…`, `sd:…`, or `sig:…`
+    // (the signature hash, and every mark 0.13.14 persisted).
+    return typeof key === 'string' && DIRECTED_MARK.test(key) ? this._seenDirectedKeys : this._seenCmbKeys;
   }
 
   /**
@@ -926,14 +948,14 @@ class FrameHandler {
     // unauthenticated widens the key — a frame timestamp or an unsigned createdTimestamp is the
     // sender's choice, and would let one peer surface the same content without bound (review F2).
     //
-    // The mark is the hash of the decoded signature bytes, never a string a relay can re-spell:
-    // base64url decoding ignores padding and the unused bits of the last character, so `sig + '='`
-    // or a twin final character verifies as the same signature, and a carried `assertionId` is
-    // covered by no signature at all. Ed25519 is deterministic, so one assertion has one signature.
+    // The mark is the digest of the preimage the signature covers, recomputed here (assertionMark):
+    // never a string a relay can re-spell (base64url ignores padding and the unused bits of the
+    // last character, so `sig + '='` verifies as the same signature), never a carried assertionId,
+    // which no signature covers, and not the signature bytes, which a hedged signer varies.
     const cognitionKey = recordKey(msg.cmb) || msg.key;
-    const assertionMark = msg._cmbVerified === true ? signatureMark(msg.cmb?.metadata?.sig) : null;
-    const incomingKey = cognitionKey && msg._directedToMe && assertionMark
-      ? `${cognitionKey}#${assertionMark}`
+    const mark = msg._cmbVerified === true ? assertionMark(msg.cmb) : null;
+    const incomingKey = cognitionKey && msg._directedToMe && mark
+      ? `${cognitionKey}#${mark}`
       : cognitionKey;
     if (incomingKey) {
       const lastSeen = this._seenKeysFor(incomingKey).get(incomingKey);
@@ -1648,4 +1670,4 @@ class FrameHandler {
   }
 }
 
-module.exports = { FrameHandler };
+module.exports = { FrameHandler, assertionMark };
diff --git a/tests/audit-delivery-authorship.test.js b/tests/audit-delivery-authorship.test.js
index 715e0901..179dbc3f 100644
--- a/tests/audit-delivery-authorship.test.js
+++ b/tests/audit-delivery-authorship.test.js
@@ -728,3 +728,29 @@ describe('B-D5: directed sends that mint nothing still deliver (MMP §4.4.4)', (
     });
   });
 });
+
+// 0.13.15 review F7: a hedged Ed25519 signer (WebKit) signs one assertion differently each time, so
+// a mark taken from the signature bytes named one directed assertion twice.
+describe('directed de-duplication marks the assertion, not its signature bytes', () => {
+  const { assertionMark } = require('../lib/frame-handler');
+  const crypto = require('crypto');
+  const otherSig = () => crypto.randomBytes(64).toString('base64url');
+
+  it('two signatures over one v2.0 assertion give one mark; different words give another', () => {
+    const cmb = core.createCMB({ categories: { focus: 'directed once' }, createdBy: 'alice', emitV2: true, createdByNodeId: 'node-alice', room: 'default' });
+    const a = structuredClone(cmb); a.metadata.sig = otherSig();
+    const b = structuredClone(cmb); b.metadata.sig = otherSig();
+    assert.strictEqual(assertionMark(a), assertionMark(b));
+    assert.match(assertionMark(a), /^asrt-/);
+    const other = core.createCMB({ categories: { focus: 'directed twice' }, createdBy: 'alice', emitV2: true, createdByNodeId: 'node-alice', room: 'default' });
+    other.metadata.sig = a.metadata.sig;
+    assert.notStrictEqual(assertionMark(other), assertionMark(a), 'the same signature bytes do not make two assertions one');
+  });
+
+  it('records of the older suite are marked by their preimage digest the same way', () => {
+    const cmb = core.createCMB({ categories: { focus: 'older suite' }, createdBy: 'alice', room: 'default' });
+    const a = structuredClone(cmb); a.metadata.sig = otherSig();
+    const b = structuredClone(cmb); b.metadata.sig = otherSig();
+    assert.strictEqual(assertionMark(a), assertionMark(b));
+  });
+});

From cf3cba41ba6304739f97e29d5b73c7ec020cd273 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 21:03:06 +0100
Subject: [PATCH 048/148] F8: a mesh agent whose node cannot sign halts once,
 instead of an error per admitted record
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

remember() throws ESIGN since this release (fail closed, §18.3.1). MeshAgent's remix and observation
paths did not catch it, so every admitted record logged an error and still spent a model call. It
now says once that it is halted and stops remixing and observing. Its remix comment cites §15.7.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 lib/mesh-agent.js        | 30 +++++++++++++++++++++++++-----
 tests/mesh-agent.test.js | 31 +++++++++++++++++++++++++++++++
 2 files changed, 56 insertions(+), 5 deletions(-)

diff --git a/lib/mesh-agent.js b/lib/mesh-agent.js
index 99b1a4a7..f3003223 100644
--- a/lib/mesh-agent.js
+++ b/lib/mesh-agent.js
@@ -254,7 +254,7 @@ class MeshAgent {
   // ── Event-driven remix (Section 14) ────────────────────
 
   async _onCMBAccepted(entry) {
-    if (!this._shouldRemix(entry)) return;
+    if (this._signingHalted || !this._shouldRemix(entry)) return;
 
     const source = entry.source || recordCreatedBy(entry.cmb) || 'unknown';
     const focusText = entry.cmb?.categories?.focus?.text || entry.content || '';
@@ -280,9 +280,9 @@ class MeshAgent {
 
     console.log(`[${this._name}] accepted from ${source}: ${focusText.slice(0, 80)}`);
 
-    // Section 14.7: remix requires new domain data
+    // MMP §15.7: remix requires new domain data
     if (!this._node.canRemix()) {
-      console.log(`[${this._name}] no new domain data — silent (14.7)`);
+      console.log(`[${this._name}] no new domain data — silent (§15.7)`);
       return;
     }
 
@@ -316,7 +316,8 @@ class MeshAgent {
       lineage: entry.lineage || recordLineage(entry.cmb) || null,
     };
 
-    const stored = this._node.remember(remixCategories, { parents: [parent], ...(meta ? { meta } : {}) });
+    const stored = this._remember(remixCategories, { parents: [parent], ...(meta ? { meta } : {}) });
+    if (this._signingHalted) return;
     if (!stored) {
       console.log(`[${this._name}] remix rejected by SDK`);
       return;
@@ -327,7 +328,25 @@ class MeshAgent {
 
   // ── Domain observation (Section 13) ────────────────────
 
+  /**
+   * remember(), for an agent: the SDK throws ESIGN when this node cannot sign (§18.3.1, fail
+   * closed). An agent that cannot sign cannot emit anything, so it says so once and stops remixing
+   * and observing, instead of an error per admitted record and a model call it can never use.
+   * @private
+   */
+  _remember(categories, opts) {
+    try {
+      return this._node.remember(categories, opts);
+    } catch (err) {
+      if (!err || err.code !== 'ESIGN') throw err;
+      this._signingHalted = true;
+      console.error(`[${this._name}] HALTED: this node cannot sign (${err.message}). It emits nothing until its identity key is readable again; fix that and restart it.`);
+      return null;
+    }
+  }
+
   async _checkDomain() {
+    if (this._signingHalted) return;
     console.log(`[${this._name}] checking domain...`);
 
     const result = await this._fetchDomain();
@@ -371,7 +390,8 @@ class MeshAgent {
     }
 
     // Original observation — no parents
-    const stored = this._node.remember(categories, meta ? { meta } : undefined);
+    const stored = this._remember(categories, meta ? { meta } : undefined);
+    if (this._signingHalted) return;
     if (!stored) {
       console.log(`[${this._name}] observation rejected (duplicate)`);
       return;
diff --git a/tests/mesh-agent.test.js b/tests/mesh-agent.test.js
index 67991673..6516c572 100644
--- a/tests/mesh-agent.test.js
+++ b/tests/mesh-agent.test.js
@@ -149,3 +149,34 @@ describe('MeshAgent', () => {
     assert.deepStrictEqual(remixed, [cmb.metadata.key], 'the kept remix is not re-remixed; the severed one is a root');
   });
 });
+
+// 0.13.15 review F8: remember() throws ESIGN when the node cannot sign. The agent says so once and
+// stops, instead of an error for every admitted record and a model call it could never use.
+describe('MeshAgent when its node cannot sign', () => {
+  const { MeshAgent } = require('../lib/mesh-agent');
+  it('halts once on ESIGN and stops remixing and observing', async () => {
+    let remixCalls = 0;
+    const agent = new MeshAgent({
+      name: `esign-${Date.now()}`,
+      fetchDomain: async () => ({ data: 'd', fingerprint: String(Math.random()) }),
+      reason: async () => ({ focus: 'an observation' }),
+      remix: async () => { remixCalls++; return { focus: 'a remix' }; },
+      shouldRemix: () => true,
+    });
+    agent.node.canRemix = () => true;
+    agent.node.remember = () => { const e = new Error('CMB signing failed: key unreadable'); e.code = 'ESIGN'; throw e; };
+    const errors = [];
+    const origError = console.error, origLog = console.log;
+    console.error = (...a) => errors.push(a.join(' '));
+    console.log = () => {};
+    try {
+      const entry = () => ({ key: 'k-' + Math.random(), source: 'peer', cmb: { categories: { focus: { text: 'x' } } } });
+      await agent._onCMBAccepted(entry());
+      await agent._onCMBAccepted(entry());
+      await agent._checkDomain();
+    } finally { console.error = origError; console.log = origLog; }
+    assert.strictEqual(errors.filter((l) => /HALTED: this node cannot sign/.test(l)).length, 1, 'said once');
+    assert.strictEqual(remixCalls, 1, 'no model call after the halt');
+    assert.strictEqual(agent._signingHalted, true);
+  });
+});

From ce9d26128c9d2d18f8a272da4db7852e21749aef Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 21:04:57 +0100
Subject: [PATCH 049/148] tests: the encoder's single load, a rooted daemon's
 task board, and the daemon's IPC error replies

The release review found three claims with no test: one model load however many callers ask, the
task board read from SYM_STATE_DIR, and an IPC request whose handler throws answered with the error.
The daemon's remember reply now also carries the SDK's error code (ECMBSIZE, ESIGN).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 bin/sym-daemon.js                  |  2 +-
 tests/daemon-relay-only.test.js    | 28 ++++++++++++++++++++++++
 tests/semantic-single-load.test.js | 34 ++++++++++++++++++++++++++++++
 3 files changed, 63 insertions(+), 1 deletion(-)
 create mode 100644 tests/semantic-single-load.test.js

diff --git a/bin/sym-daemon.js b/bin/sym-daemon.js
index a03263d2..885bb4ad 100755
--- a/bin/sym-daemon.js
+++ b/bin/sym-daemon.js
@@ -450,7 +450,7 @@ function handleIPCMessage(socketId, socket, msg) {
           }
         } catch (err) {
           log(`remember failed: ${err.message}`);
-          sendIPC(socket, { type: 'result', action: 'remember', error: err.message });
+          sendIPC(socket, { type: 'result', action: 'remember', error: err.message, code: err.code });
         }
       }
       break;
diff --git a/tests/daemon-relay-only.test.js b/tests/daemon-relay-only.test.js
index 028718cb..3dbb4ec6 100644
--- a/tests/daemon-relay-only.test.js
+++ b/tests/daemon-relay-only.test.js
@@ -19,6 +19,7 @@ const { WebSocketServer } = require('ws');
 const fs = require('fs');
 const os = require('os');
 const path = require('path');
+const net = require('net');
 const { ipcEndpoint } = require('../lib/platform');
 
 const BIN = path.join(__dirname, '..', 'bin');
@@ -84,6 +85,7 @@ test('a daemon with SYM_STATE_DIR keeps its own files in that root, not in ~/.sy
   // The relay config and the room live only in the root: a daemon reading ~/.sym finds neither.
   fs.writeFileSync(path.join(root, 'relay.env'), `SYM_RELAY_URL=ws://127.0.0.1:${wss.address().port}\nSYM_RELAY_TOKEN=${'y'.repeat(32)}\n`);
   fs.writeFileSync(path.join(root, 'room'), 'rooted-room');
+  fs.writeFileSync(path.join(root, 'tasks.json'), JSON.stringify({ tasks: [{ id: 'task-1', title: 'kept in the root', status: 'backlog' }], nextId: 2 }));
   const socket = path.join(base, 'r.sock');
   const env = { ...process.env, HOME: home, USERPROFILE: home, SYM_STATE_DIR: root, SYM_SOCKET: socket, SYM_NODE_NAME: 'rooted-test', SYM_RELAY_ONLY: '1' };
   delete env.SYM_RELAY_URL; delete env.SYM_RELAY_TOKEN; delete env.SYM_ROOM;
@@ -95,6 +97,32 @@ test('a daemon with SYM_STATE_DIR keeps its own files in that root, not in ~/.sy
     for (let i = 0; i < 100 && daemon.exitCode === null && !auths.length; i++) await new Promise((r) => setTimeout(r, 100));
     assert.ok(auths.length >= 1, `the relay config was read from the root; log:\n${out.slice(-800)}`);
     assert.match(out, /rooted-room/, 'the room was read from the root');
+    const endpoint = ipcEndpoint(socket);
+    for (let i = 0; i < 100 && !out.includes(`IPC server listening: ${endpoint}`); i++) await new Promise((r) => setTimeout(r, 100));
+    const ipc = (msg) => new Promise((resolve, reject) => {
+      const c = net.createConnection(endpoint);
+      let buf = '';
+      c.on('data', (d) => {
+        buf += d;
+        for (const line of buf.split('\n').slice(0, -1)) {
+          const m = JSON.parse(line);
+          if (m.type === 'result' && m.action === msg.type) { c.end(); resolve(m); return; }
+        }
+      });
+      c.on('error', reject);
+      c.on('connect', () => c.write(JSON.stringify(msg) + '\n'));
+    });
+    const listed = await ipc({ type: 'task-list' });
+    assert.deepEqual(listed.tasks.map((t) => t.title), ['kept in the root'], 'the task board was read from the root');
+    // A refused record answers with the SDK's reason and its code, so a client can say why.
+    const big = await ipc({ type: 'remember', categories: { focus: 'x'.repeat(300 * 1024) } });
+    assert.match(String(big.error), /at most/);
+    assert.equal(big.code, 'ECMBSIZE');
+    // A handler that throws answers the request with the error instead of leaving it unanswered.
+    assert.ok((await ipc({ type: 'remember', categories: { focus: 'one stored record' } })).key);
+    const bad = await ipc({ type: 'recall', query: 123 });
+    assert.ok(bad.error, `the throw is reported to the caller: ${JSON.stringify(bad)}`);
+    assert.equal(daemon.exitCode, null, 'and the daemon is still running');
     assert.equal(fs.existsSync(path.join(home, '.sym')), false, 'nothing was written to ~/.sym');
   } finally {
     daemon.kill('SIGTERM');
diff --git a/tests/semantic-single-load.test.js b/tests/semantic-single-load.test.js
new file mode 100644
index 00000000..bba456de
--- /dev/null
+++ b/tests/semantic-single-load.test.js
@@ -0,0 +1,34 @@
+'use strict';
+
+/**
+ * The semantic encoder is loaded once per process (0.13.15). Under load, a second caller asking
+ * for it while the first load was still running started a second model load, and parallel loads
+ * were what made the full suite report "semantic encoder did not become ready".
+ *
+ * Run in a child process with the model library replaced by a counting stand-in, so no model is
+ * downloaded and the module's load-time call is part of what is counted.
+ */
+
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const path = require('node:path');
+const { execFileSync } = require('node:child_process');
+
+const ENCODER = path.resolve(__dirname, '..', 'lib', 'core', 'context-encoder.js');
+
+test('one model load however many callers ask while it is loading', () => {
+  const out = execFileSync(process.execPath, ['-e', `
+    const Module = require('module');
+    let loads = 0;
+    const stand = { pipeline: () => { loads++; return new Promise((r) => setTimeout(() => r(async () => ({ data: new Float32Array(384) })), 100)); } };
+    const real = Module._load;
+    Module._load = function (req, ...rest) { return req === '@huggingface/transformers' ? stand : real.call(this, req, ...rest); };
+    const enc = require(${JSON.stringify(ENCODER)});
+    Promise.all([enc.semanticSettled(), enc.semanticSettled(), enc.semanticSettled()]).then((r) => {
+      process.stdout.write(JSON.stringify({ loads, settled: r, ready: enc.isSemanticReady() }));
+    });`], { encoding: 'utf8' });
+  const r = JSON.parse(out.trim().split('\n').pop());
+  assert.equal(r.loads, 1, 'the module load and three callers share one model load');
+  assert.deepEqual(r.settled, [true, true, true]);
+  assert.equal(r.ready, true);
+});

From cbe301621a24fee4fb5e40e1612acccbbe7a56cb Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 21:05:25 +0100
Subject: [PATCH 050/148] =?UTF-8?q?CHANGELOG:=20the=20release=20review's?=
 =?UTF-8?q?=20fixes,=20and=20the=20=C2=A716=20consequence=20of=20anchor=20?=
 =?UTF-8?q?decay?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 CHANGELOG.md | 34 ++++++++++++++++++++++++++--------
 1 file changed, 26 insertions(+), 8 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index bad03abd..c645a4d2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -23,25 +23,37 @@ debt, and the daemon's log flood. Every item has a test that fails without its f
   decides.
 - **Unauthenticated gossip could repoint a phone's wake token.** Any room peer's `peer-info` could
   overwrite a wake channel the phone had given this node itself. A channel learned from a weaker
-  source (gossip < relay < the peer itself) now never replaces a stronger one's token.
+  source (gossip < relay < the peer itself) now never replaces a stronger one's token. A channel kept
+  by an earlier release, which recorded no source, ranks with the relay: gossip cannot repoint it.
+  At most 1024 channels are kept (gossip only ever displaces gossip), and one `peer-info` frame is
+  read for at most 256 entries, so fabricated node ids cannot grow the map, its file or the gossip
+  this node sends.
+- **A frame whose handling threw ended a relay-connected daemon.** The LAN path caught a throw from
+  frame handling, but the relay path had nothing above it, so the exception reached the process. A
+  frame that throws is now dropped with a log line and a `frame-handler-error` metric. A record that
+  declares the v2.0 suite but has no buildable preimage is rejected as a signature mismatch.
 - **A record with no room was admitted in every room it was replayed into (B-R10).** A record that
   names no room is now in the literal room `default` (§7). `createCMB` names `default` instead of
   null (which signed the string `"null"`), and the v2.0 preimage refuses a record without a room.
 - **A record that could not be signed was sent unsigned (B-R12).** `remember()` now throws `ESIGN`
-  before anything is stored or dispatched (§18.3.1).
+  before anything is stored or dispatched (§18.3.1). A `MeshAgent` whose node cannot sign says so
+  once and stops remixing and observing.
 
 ### Fixed — delivery and records
 
 - **Two copies of one record arriving together could both surface (K1).** A key is held in flight
   from the de-duplication check until its SVAF pass settles.
 - **A broadcast flood could evict directed de-duplication marks (K3).** They have their own map and
-  cap now.
-- **`inbox()`'s limit counted acked items (K4).** It counts unread deliveries; acked ones still come
-  back, marked.
+  cap now. A directed assertion is marked by the digest of the preimage its signature covers,
+  recomputed on receipt, not by the signature bytes: a hedged Ed25519 signer (WebKit) signs one
+  assertion differently each time, and its re-signed copy surfaced twice.
+- **`inbox()`'s limit counted acked items (K4).** It counts unread deliveries. Acked ones still come
+  back, marked, up to the same limit, and are passed over beyond it, so the limit bounds the reply.
 - **The inbox `from` was the author's label whether or not anything proved it (K5).** It is now the
   author when the signature proved who that is, and otherwise the peer that delivered it. The claim
   stays in `author.name`. A v2.0 record verified against its signed node id carries `author.nodeId`,
-  even when relayed.
+  even when relayed. `from` is a display label (two node ids can sign the same `createdBy`):
+  authorize on `author.nodeId`.
 - **Record timestamps ran ahead of the clock after a backward step, and restarted every process
   (K6).** The ratchet starts from this node's newest stored record. After a step back of more than a
   minute, timestamps follow the clock again, with a `clock-stepped-back` metric.
@@ -82,7 +94,10 @@ debt, and the daemon's log flood. Every item has a test that fails without its f
   both: `storedAt`, and the store's §6.4 `anchorWeight` (2.0 once validated, 0.5 once dismissed, never
   the sender's unsigned confidence). At the default freshness of 1800 s, an anchor older than about
   nine hours carries no weight. **A node whose recent memory is all older than that admits the next
-  block under the empty-memory rule**, as §9.2.1 specifies.
+  block under the empty-memory rule**, as §9.2.1 specifies. The spec discloses what that rule costs:
+  while it applies, the §16 influence bound does not cover the node. With decay that window recurs
+  after every quiet period of about 18.4 × `freshnessSeconds` (about nine hours at the default), not
+  only on a fresh node. `freshnessSeconds` is the dial: a larger value keeps older memory gating.
 
 ### Fixed — SVAF and the store
 
@@ -119,7 +134,10 @@ debt, and the daemon's log flood. Every item has a test that fails without its f
   first-hand sighting (gossip forwards it instead of the time of sending) and expire after 30 days
   unseen. A channel saved before this release gets one 30-day grace period, once.
 - **A daemon rooted with `SYM_STATE_DIR` kept its room, tasks and relay.env in `~/.sym`.** It uses
-  the state root now.
+  the state root now, and so does the `sym` CLI: its pid file, room, relay.env and node directory.
+  Two rooted deployments sharing a home shared one pid file, so `sym stop` for one stopped the other.
+- **A daemon IPC request whose handler threw went unanswered.** It is answered with the error, and a
+  refused `remember` carries the SDK's code (`ECMBSIZE`, `ESIGN`).
 - **A relay-only daemon still announced its room on the LAN.** It no longer does.
 - **IPC on Windows.** The daemon and every client now resolve the IPC endpoint one way, and on
   Windows a file path becomes a named pipe. `SymDaemonClient` defaulted to `/tmp/sym.sock`, which no

From f112207a2fe3f8f5dac0de038b1cbd4970681f9d Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 21:48:19 +0100
Subject: [PATCH 051/148] the witness storm: one checkpoint and one witness per
 statement, bounded logs, archived not reread

Two signed copies of one witness (a node re-witnessing after a restart) were relayed by every node
without end: the store kept only the latest copy per witness, so each copy was new whenever the
other arrived. Checkpoints and witnesses are now deduplicated by what they assert, a node witnesses
a checkpoint once, the logs are bounded (32 checkpoints per attester, 20,000 witnesses), a log past
8 MiB is archived unchanged and restarted from what is held, and an oversized legacy log is read
from its tail only. Attestation eviction no longer shifts an array.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 CHANGELOG.md                        |  16 ++++
 lib/attestation-store.js            | 140 ++++++++++++++++++++++++----
 lib/node.js                         |   3 +
 tests/admission-attestation.test.js |  31 ++++++
 tests/attestation-store.test.js     |  75 +++++++++++++++
 5 files changed, 249 insertions(+), 16 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c645a4d2..961eedab 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -39,6 +39,22 @@ debt, and the daemon's log flood. Every item has a test that fails without its f
   before anything is stored or dispatched (§18.3.1). A `MeshAgent` whose node cannot sign says so
   once and stops remixing and observing.
 
+### Fixed — the witness storm
+
+- **Two signed copies of one witness were relayed by every node without end.** A node that
+  witnessed a checkpoint again after a restart signed a second copy of the same statement. The store
+  kept only the latest copy per witness, so each copy was new whenever the other arrived, and every
+  node stored and relayed it again. On one host this grew one node's `witnesses.jsonl` to 625,079
+  lines (257 MB) of two witnesses, and kept every node in the room busy relaying them. A checkpoint
+  is now held once per (attester, position) and a witness once per (attester, position, witness):
+  a later copy is a duplicate and is not relayed, and one asserting a different root is a conflict,
+  kept out. A node witnesses a checkpoint once, across restarts.
+- **The attestation logs are bounded.** At most 32 checkpoints per attester (with their witnesses)
+  and 20,000 witnesses are kept, the oldest dropped first. A log past 8 MiB is moved, unchanged, into
+  `attestations/archive/` and restarted from the records held, so nothing appended is lost. A node
+  reads only the live logs at start, and of an oversized log from an earlier release only its last
+  8 MiB; reading the whole of one held a node's thread for minutes.
+
 ### Fixed — delivery and records
 
 - **Two copies of one record arriving together could both surface (K1).** A key is held in flight
diff --git a/lib/attestation-store.js b/lib/attestation-store.js
index f074275d..cfc53d79 100644
--- a/lib/attestation-store.js
+++ b/lib/attestation-store.js
@@ -13,6 +13,17 @@
  *     anchored checkpoints add the cross-node half in a later step).
  * Deduplicated by signature (idempotent record / relay-once). Bounded by count.
  *
+ * Checkpoints and witnesses are deduplicated by WHAT they assert, not by signature: one checkpoint
+ * per (attester, upto_seq) and one witness per (attester, upto_seq, witness). A node that witnesses
+ * a checkpoint again after a restart signs a second, different-looking copy of the same statement;
+ * keeping only the latest copy made the two copies new to each other forever, so every node stored
+ * and relayed each one again whenever the other arrived. A later copy of a held statement is a
+ * duplicate; one asserting a different root for the same position is a conflict, kept out.
+ *
+ * Persistence is append-only, and bounded: a log that outgrows its limit is moved, whole and
+ * unchanged, into `archive/`, and a new log starts from the records still held. A node reads only
+ * the live logs at start, and of an oversized one only its tail.
+ *
  * This store does NOT verify signatures or roster membership — the caller verifies
  * before recording (a recorded attestation is assumed already verified). It only
  * indexes, dedups, reports chain integrity, and bounds memory.
@@ -47,8 +58,13 @@ class AttestationStore {
     this._byCmb = new Map();       // of  -> Map(sig -> att)
     this._byAttester = new Map();  // by  -> Map(seq -> att)
     this._seen = new Set();        // sig -> dedup / relay-once
-    this._order = [];              // [{ sig, of, by, seq }] insertion order, for eviction
+    this._order = new Map();       // sig -> { of, by, seq }, insertion order, for O(1) eviction
     this._max = opts.max || 50000;
+    this._maxCheckpointsPerAttester = opts.maxCheckpointsPerAttester || 32;
+    this._maxWitnesses = opts.maxWitnesses || 20000;
+    this._maxLiveBytes = opts.maxLiveBytes || 8 * 1024 * 1024;
+    this._witnessOrder = new Map(); // `${attester}|${upto_seq}|${by}` -> true, insertion order
+    this._bytes = new Map();        // live file -> bytes written to it
     // Per-(of,by) ingest rate-limit — bounds a Sybil/flood of attestations about a
     // single CMB on the immutable log (research's DoS-at-ingest finding). Applies
     // only to GOSSIPED-IN attestations, never to this node's own gating output.
@@ -86,7 +102,7 @@ class AttestationStore {
     }
 
     this._seen.add(att.sig);
-    this._order.push({ sig: att.sig, of: att.of, by: att.by, seq: att.seq });
+    this._order.set(att.sig, { of: att.of, by: att.by, seq: att.seq });
 
     let cmbIdx = this._byCmb.get(att.of);
     if (!cmbIdx) { cmbIdx = new Map(); this._byCmb.set(att.of, cmbIdx); }
@@ -144,30 +160,64 @@ class AttestationStore {
 
   // ── Checkpoints + witnesses (omission-evidence) ──────────────────────────────
 
-  /** Record an (already-verified) checkpoint, keyed by attester + upto_seq. Idempotent. */
+  /** Record an (already-verified) checkpoint, keyed by attester + upto_seq. Idempotent: a later
+   *  copy of a held checkpoint is a duplicate, one with a different root is a conflict (both kept
+   *  out, so neither is relayed again). At most `maxCheckpointsPerAttester` are kept per attester. */
   recordCheckpoint(cp) {
     if (!cp || !cp.by || cp.upto_seq === undefined || !cp.root || !cp.sig) return { stored: false, reason: 'malformed' };
     let m = this._checkpoints.get(cp.by);
     if (!m) { m = new Map(); this._checkpoints.set(cp.by, m); }
     const existing = m.get(cp.upto_seq);
-    if (existing && existing.sig === cp.sig) return { stored: false, reason: 'duplicate' };
+    if (existing) return { stored: false, reason: existing.root === cp.root ? 'duplicate' : 'conflict' };
+    if (m.size >= this._maxCheckpointsPerAttester) {
+      const oldest = Math.min(...m.keys());
+      if (cp.upto_seq < oldest) return { stored: false, reason: 'stale' };
+      m.delete(oldest);
+      this._dropWitnessesOf(cp.by, oldest);
+    }
     m.set(cp.upto_seq, cp);
     this._append(CP_FILE, cp);
     return { stored: true };
   }
 
-  /** Record an (already-verified) witness countersignature, keyed by (attester, upto_seq, witness). */
+  /** Record an (already-verified) witness countersignature, keyed by (attester, upto_seq, witness).
+   *  Idempotent on what it asserts (see the module note); at most `maxWitnesses` are kept. */
   recordWitness(w) {
     if (!w || !w.attester || w.upto_seq === undefined || !w.root || !w.by || !w.sig) return { stored: false, reason: 'malformed' };
     const key = `${w.attester}|${w.upto_seq}`;
     let m = this._witnesses.get(key);
+    const existing = m && m.get(w.by);
+    if (existing) return { stored: false, reason: existing.root === w.root ? 'duplicate' : 'conflict' };
     if (!m) { m = new Map(); this._witnesses.set(key, m); }
-    if (m.has(w.by) && m.get(w.by).sig === w.sig) return { stored: false, reason: 'duplicate' };
     m.set(w.by, w);
+    this._witnessOrder.set(`${key}|${w.by}`, true);
+    while (this._witnessOrder.size > this._maxWitnesses) {
+      const first = this._witnessOrder.keys().next().value;
+      this._witnessOrder.delete(first);
+      const cut = first.lastIndexOf('|');
+      const k = first.slice(0, cut), by = first.slice(cut + 1);
+      const wm = this._witnesses.get(k);
+      if (wm) { wm.delete(by); if (wm.size === 0) this._witnesses.delete(k); }
+    }
     this._append(WIT_FILE, w);
     return { stored: true };
   }
 
+  /** Whether `by` has witnessed (attester, upto_seq) already, in any copy. */
+  hasWitnessed(attester, upto_seq, by) {
+    const m = this._witnesses.get(`${attester}|${upto_seq}`);
+    return !!(m && m.has(by));
+  }
+
+  /** @private Drop the witnesses of a checkpoint no longer held. */
+  _dropWitnessesOf(attester, upto_seq) {
+    const key = `${attester}|${upto_seq}`;
+    const m = this._witnesses.get(key);
+    if (!m) return;
+    for (const by of m.keys()) this._witnessOrder.delete(`${key}|${by}`);
+    this._witnesses.delete(key);
+  }
+
   /** An attester's checkpoints, ordered by upto_seq. */
   checkpointsOf(by) {
     const m = this._checkpoints.get(by);
@@ -190,11 +240,47 @@ class AttestationStore {
 
   // ── Durable persistence (append-only JSONL) ──────────────────────────────────
 
-  /** Append one record to its JSONL file. No-op without a dir or while replaying. */
+  /** Append one record to its JSONL file. No-op without a dir or while replaying. A log past
+   *  `maxLiveBytes` is archived and restarted from what is held (_rotate). */
   _append(file, obj) {
     if (!this._dir || this._loading) return;
-    try { fs.appendFileSync(path.join(this._dir, file), JSON.stringify(obj) + '\n'); }
-    catch { /* best effort — never let persistence break gating */ }
+    try {
+      const line = JSON.stringify(obj) + '\n';
+      fs.appendFileSync(path.join(this._dir, file), line);
+      const bytes = (this._bytes.get(file) || 0) + Buffer.byteLength(line);
+      this._bytes.set(file, bytes);
+      if (bytes > this._maxLiveBytes) this._rotate(file);
+    } catch { /* best effort — never let persistence break gating */ }
+  }
+
+  /** The records of one log this store still holds, in the order they were recorded. @private */
+  _held(file) {
+    if (file === ATT_FILE) {
+      const out = [];
+      for (const [sig, { of }] of this._order) { const a = this._byCmb.get(of)?.get(sig); if (a) out.push(a); }
+      return out;
+    }
+    if (file === CP_FILE) return [...this._checkpoints.values()].flatMap((m) => [...m.values()]);
+    const out = [];
+    for (const k of this._witnessOrder.keys()) {
+      const cut = k.lastIndexOf('|');
+      const w = this._witnesses.get(k.slice(0, cut))?.get(k.slice(cut + 1));
+      if (w) out.push(w);
+    }
+    return out;
+  }
+
+  /** Move a log, whole and unchanged, into archive/ and start a new one from the records held.
+   *  Nothing is rewritten: the archived file keeps every line ever appended. @private */
+  _rotate(file) {
+    const live = path.join(this._dir, file);
+    const archiveDir = path.join(this._dir, 'archive');
+    fs.mkdirSync(archiveDir, { recursive: true });
+    const stamp = new Date().toISOString().replace(/[:.]/g, '-');
+    fs.renameSync(live, path.join(archiveDir, `${file.replace(/\.jsonl$/, '')}.${stamp}.jsonl`));
+    const text = this._held(file).map((o) => JSON.stringify(o) + '\n').join('');
+    fs.writeFileSync(live, text);
+    this._bytes.set(file, Buffer.byteLength(text));
   }
 
   /** Replay persisted records into the in-memory index on construction. Reuses the
@@ -202,20 +288,41 @@ class AttestationStore {
    *  malformed line is skipped, never fatal. */
   _load() {
     this._loading = true;
-    this._replay(ATT_FILE, (o) => this.record(o));
-    this._replay(CP_FILE, (o) => this.recordCheckpoint(o));
-    this._replay(WIT_FILE, (o) => this.recordWitness(o));
+    const oversized = [];
+    if (this._replay(ATT_FILE, (o) => this.record(o))) oversized.push(ATT_FILE);
+    if (this._replay(CP_FILE, (o) => this.recordCheckpoint(o))) oversized.push(CP_FILE);
+    if (this._replay(WIT_FILE, (o) => this.recordWitness(o))) oversized.push(WIT_FILE);
     this._loading = false;
+    for (const file of oversized) { try { this._rotate(file); } catch { /* best effort */ } }
   }
 
+  /** Replay one log. Of a log larger than `maxLiveBytes` only the last `maxLiveBytes` are read:
+   *  the newest records, which are all a bounded store keeps anyway. Reading a whole oversized log
+   *  at start held a node's thread for minutes. @returns {boolean} whether the log was oversized */
   _replay(file, fn) {
+    const p = path.join(this._dir, file);
+    let size;
+    try { size = fs.statSync(p).size; } catch { return false; } // no file yet
     let text;
-    try { text = fs.readFileSync(path.join(this._dir, file), 'utf8'); }
-    catch { return; } // no file yet
+    const oversized = size > this._maxLiveBytes;
+    try {
+      if (!oversized) text = fs.readFileSync(p, 'utf8');
+      else {
+        const fd = fs.openSync(p, 'r');
+        try {
+          const buf = Buffer.alloc(this._maxLiveBytes);
+          const n = fs.readSync(fd, buf, 0, buf.length, size - buf.length);
+          text = buf.subarray(0, n).toString('utf8');
+          text = text.slice(text.indexOf('\n') + 1); // the first line is cut
+        } finally { fs.closeSync(fd); }
+      }
+    } catch { return false; }
     for (const line of text.split('\n')) {
       if (!line.trim()) continue;
       try { fn(JSON.parse(line)); } catch { /* skip a corrupt line */ }
     }
+    if (!oversized) this._bytes.set(file, size);
+    return oversized;
   }
 
   /** Sliding-window rate gate for ingested attestations, per (of, by). */
@@ -231,8 +338,9 @@ class AttestationStore {
   }
 
   _evict() {
-    while (this._seen.size > this._max && this._order.length) {
-      const { sig, of, by, seq } = this._order.shift();
+    while (this._seen.size > this._max && this._order.size) {
+      const [sig, { of, by, seq }] = this._order.entries().next().value;
+      this._order.delete(sig);
       if (!this._seen.delete(sig)) continue;
       const cmbIdx = this._byCmb.get(of);
       if (cmbIdx) { cmbIdx.delete(sig); if (cmbIdx.size === 0) this._byCmb.delete(of); }
diff --git a/lib/node.js b/lib/node.js
index 8205d5a3..2720c997 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -1125,6 +1125,9 @@ class SymNode extends EventEmitter {
   /** Countersign a checkpoint (witness) and gossip the witness. @private */
   _witnessCheckpoint(cp) {
     if (cp.by === this.nodeId) return; // don't witness your own
+    // Once per checkpoint, across restarts: a second signing is a second copy of the same
+    // statement, and two copies in circulation were relayed back and forth without end.
+    if (this._attestations.hasWitnessed(cp.by, cp.upto_seq, this.nodeId)) return;
     const w = {
       type: 'witness',
       attester: cp.by,
diff --git a/tests/admission-attestation.test.js b/tests/admission-attestation.test.js
index 493cd648..a519c761 100644
--- a/tests/admission-attestation.test.js
+++ b/tests/admission-attestation.test.js
@@ -455,3 +455,34 @@ describe("'attestation-received' — a peer's verified verdict is observable as
     }
   });
 });
+
+// The witness storm (2026-10-01): two signed copies of one witness were relayed back and forth by
+// every node without end. A node relays a witness once, whatever copy arrives, and witnesses a
+// checkpoint once, across restarts.
+describe('a witness is relayed and signed once per statement', () => {
+  const { signCheckpoint, signWitness } = require('../lib/core');
+  const kp = () => {
+    const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519', { publicKeyEncoding: { type: 'spki', format: 'der' }, privateKeyEncoding: { type: 'pkcs8', format: 'der' } });
+    return { pub: publicKey.slice(-32).toString('base64url'), priv: privateKey.slice(-32).toString('base64url') };
+  };
+  it('a second copy of a witness is not relayed, and a held checkpoint is not witnessed again', () => {
+    const ATT = kp(), WIT = kp();
+    withNode('att-storm', { lifecycleRole: 'participant', room: 'g' }, (node) => {
+      node._pinPeerKey('node-att', ATT.pub);
+      node._pinPeerKey('node-wit', WIT.pub);
+      const relayed = [];
+      node._gossipToRoster = (frame) => relayed.push(frame.type);
+      const cp = { type: 'checkpoint', by: 'node-att', roster: 'g', upto_seq: 8, root: 'r8', at: 1 };
+      signCheckpoint(cp, ATT.priv);
+      assert.strictEqual(node._ingestCheckpoint(cp, 'node-att').ok, true);
+      assert.deepStrictEqual(relayed, ['checkpoint', 'witness'], 'relayed once and witnessed once');
+      const copy = (at) => { const w = { type: 'witness', attester: 'node-att', roster: 'g', upto_seq: 8, root: 'r8', by: 'node-wit', role: 'participant', at }; signWitness(w, WIT.priv); return w; };
+      assert.strictEqual(node._ingestWitness(copy(1), 'node-wit').ok, true);
+      assert.strictEqual(node._ingestWitness(copy(2), 'node-wit').ok, false, 'a second signing of the same witness is not new');
+      assert.strictEqual(node._ingestWitness(copy(1), 'node-wit').ok, false, 'nor is the first one, again');
+      assert.deepStrictEqual(relayed, ['checkpoint', 'witness', 'witness'], 'one relay per witness statement');
+      node._witnessCheckpoint(cp);
+      assert.strictEqual(relayed.length, 3, 'this node does not sign a second copy of its own witness');
+    });
+  });
+});
diff --git a/tests/attestation-store.test.js b/tests/attestation-store.test.js
index 003329dc..9096c440 100644
--- a/tests/attestation-store.test.js
+++ b/tests/attestation-store.test.js
@@ -177,3 +177,78 @@ describe('AttestationStore — durable persistence (append-only, reload on const
     assert.strictEqual(st.size(), 1);
   });
 });
+
+// The witness storm (2026-10-01): a node that witnessed a checkpoint again after a restart signed a
+// second copy of the same statement. The store kept only the latest copy per witness, so the two
+// copies were new to each other forever, and every node stored and relayed each one again whenever
+// the other arrived: 625,079 witness lines, 257 MB, re-read on every start.
+describe('AttestationStore — one record per statement, bounded, archived', () => {
+  const w = (sig, extra = {}) => ({ attester: 'A', upto_seq: 8, root: 'r8', by: 'W1', sig, ...extra });
+
+  it('a second copy of a held witness is a duplicate, never stored or relayed again', () => {
+    const st = new AttestationStore();
+    assert.strictEqual(st.recordWitness(w('copy-1')).stored, true);
+    assert.deepStrictEqual(st.recordWitness(w('copy-2', { at: 2 })), { stored: false, reason: 'duplicate' });
+    assert.deepStrictEqual(st.recordWitness(w('copy-1')), { stored: false, reason: 'duplicate' }, 'and the first copy is not new again');
+    assert.deepStrictEqual(st.recordWitness(w('other-root', { root: 'r-other' })), { stored: false, reason: 'conflict' });
+    assert.strictEqual(st.witnessesFor('A', 8).length, 1);
+    assert.strictEqual(st.hasWitnessed('A', 8, 'W1'), true);
+  });
+
+  it('a second copy of a held checkpoint is a duplicate; another root for the same position is a conflict', () => {
+    const st = new AttestationStore();
+    assert.strictEqual(st.recordCheckpoint({ by: 'A', upto_seq: 8, root: 'r8', sig: 'c8' }).stored, true);
+    assert.deepStrictEqual(st.recordCheckpoint({ by: 'A', upto_seq: 8, root: 'r8', sig: 'c8-resigned' }), { stored: false, reason: 'duplicate' });
+    assert.deepStrictEqual(st.recordCheckpoint({ by: 'A', upto_seq: 8, root: 'r-forked', sig: 'c8x' }), { stored: false, reason: 'conflict' });
+  });
+
+  it('checkpoints are bounded per attester, and a dropped checkpoint takes its witnesses with it', () => {
+    const st = new AttestationStore({ maxCheckpointsPerAttester: 3 });
+    for (const n of [1, 2, 3]) { st.recordCheckpoint({ by: 'A', upto_seq: n, root: `r${n}`, sig: `c${n}` }); st.recordWitness({ attester: 'A', upto_seq: n, root: `r${n}`, by: 'W', sig: `w${n}` }); }
+    st.recordCheckpoint({ by: 'A', upto_seq: 4, root: 'r4', sig: 'c4' });
+    assert.deepStrictEqual(st.checkpointsOf('A').map((c) => c.upto_seq), [2, 3, 4]);
+    assert.strictEqual(st.witnessesFor('A', 1).length, 0);
+    assert.deepStrictEqual(st.recordCheckpoint({ by: 'A', upto_seq: 1, root: 'r1', sig: 'c1' }), { stored: false, reason: 'stale' });
+  });
+
+  it('witnesses are bounded in total, oldest first', () => {
+    const st = new AttestationStore({ maxWitnesses: 100 });
+    for (let i = 0; i < 250; i++) st.recordWitness({ attester: 'A', upto_seq: i, root: `r${i}`, by: 'W', sig: `w${i}` });
+    assert.strictEqual(st.witnessesFor('A', 249).length, 1);
+    assert.strictEqual(st.witnessesFor('A', 0).length, 0);
+    let held = 0; for (let i = 0; i < 250; i++) held += st.witnessesFor('A', i).length;
+    assert.strictEqual(held, 100);
+  });
+
+  it('a log past its limit is archived whole and restarted from what is held; a reload sees the same', () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'att-rotate-'));
+    try {
+      const st = new AttestationStore({ dir, maxWitnesses: 10, maxLiveBytes: 4096 });
+      for (let i = 0; i < 200; i++) st.recordWitness({ attester: 'A', upto_seq: i, root: `r${i}`, by: 'W', sig: `w${i}`.padEnd(64, 'x') });
+      const archived = fs.readdirSync(path.join(dir, 'archive'));
+      assert.ok(archived.length >= 1 && archived.every((f) => /^witnesses\..+\.jsonl$/.test(f)), archived.join(','));
+      const archivedLines = archived.map((f) => fs.readFileSync(path.join(dir, 'archive', f), 'utf8').trim().split('\n').length).reduce((a, b) => a + b, 0);
+      const liveLines = fs.readFileSync(path.join(dir, 'witnesses.jsonl'), 'utf8').trim().split('\n').length;
+      assert.ok(fs.statSync(path.join(dir, 'witnesses.jsonl')).size <= 4096 * 2, 'the live log stays bounded');
+      assert.ok(archivedLines + liveLines >= 200, 'every line appended is still on disk');
+      const again = new AttestationStore({ dir, maxWitnesses: 10, maxLiveBytes: 4096 });
+      assert.strictEqual(again.witnessesFor('A', 199).length, 1, 'the newest is reloaded');
+      assert.strictEqual(again.witnessesFor('A', 0).length, 0);
+    } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+  });
+
+  it('an oversized log from an earlier release is read from its tail only, then archived', () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'att-legacy-'));
+    try {
+      const lines = [];
+      for (let i = 0; i < 2000; i++) lines.push(JSON.stringify({ attester: 'A', upto_seq: i, root: `r${i}`, by: 'W', sig: `w${i}` }));
+      fs.writeFileSync(path.join(dir, 'witnesses.jsonl'), lines.join('\n') + '\n');
+      const size = fs.statSync(path.join(dir, 'witnesses.jsonl')).size;
+      const st = new AttestationStore({ dir, maxLiveBytes: 8192 });
+      assert.strictEqual(st.witnessesFor('A', 1999).length, 1, 'the newest records are read');
+      assert.strictEqual(st.witnessesFor('A', 0).length, 0, 'the head of the oversized log is not');
+      const archived = fs.readdirSync(path.join(dir, 'archive'));
+      assert.strictEqual(fs.statSync(path.join(dir, 'archive', archived[0])).size, size, 'the original is archived unchanged');
+    } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+  });
+});

From 78f25b59b261bd0a3367bdc65eefa74d409f057c Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 21:55:13 +0100
Subject: [PATCH 052/148] gossip repeats are dropped before verification; one
 peer's gossip frames are capped

Under the witness storm a node spent most of its thread checking the signatures of copies it already
held. A held attestation, checkpoint or witness is now a duplicate before verification, and each
peer gets a gossip budget (burst 500, 100/s) with a gossip-rate-limited metric.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 CHANGELOG.md                        |  4 +++
 lib/attestation-store.js            |  6 ++++
 lib/frame-handler.js                | 24 +++++++++++++++
 lib/node.js                         |  6 ++++
 tests/admission-attestation.test.js | 45 +++++++++++++++++++++++++++++
 5 files changed, 85 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 961eedab..54958eb8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -54,6 +54,10 @@ debt, and the daemon's log flood. Every item has a test that fails without its f
   `attestations/archive/` and restarted from the records held, so nothing appended is lost. A node
   reads only the live logs at start, and of an oversized log from an earlier release only its last
   8 MiB; reading the whole of one held a node's thread for minutes.
+- **A repeat cost a signature check, and one peer could flood a node.** An attestation, checkpoint or
+  witness already held is dropped before its signature is verified. One peer's gossip frames
+  (attestation, checkpoint, witness) are capped at a burst of 500 and 100 a second; the excess is
+  dropped and counted (`gossip-rate-limited`).
 
 ### Fixed — delivery and records
 
diff --git a/lib/attestation-store.js b/lib/attestation-store.js
index cfc53d79..21b20aba 100644
--- a/lib/attestation-store.js
+++ b/lib/attestation-store.js
@@ -203,6 +203,12 @@ class AttestationStore {
     return { stored: true };
   }
 
+  /** Whether a checkpoint for (by, upto_seq) is held, in any copy. */
+  hasCheckpoint(by, upto_seq) {
+    const m = this._checkpoints.get(by);
+    return !!(m && m.has(upto_seq));
+  }
+
   /** Whether `by` has witnessed (attester, upto_seq) already, in any copy. */
   hasWitnessed(attester, upto_seq, by) {
     const m = this._witnesses.get(`${attester}|${upto_seq}`);
diff --git a/lib/frame-handler.js b/lib/frame-handler.js
index c36ab825..13e3fda4 100644
--- a/lib/frame-handler.js
+++ b/lib/frame-handler.js
@@ -80,6 +80,12 @@ const SEEN_CMB_MAX = 10000;
 const DIRECTED_MARK = /#(asrt-|sd:|sig:)/;
 /** The most `peer-info` entries read from one frame. */
 const PEER_INFO_MAX = 256;
+/** Gossip frames (attestation, checkpoint, witness) one peer may send: a burst, then a rate per
+ *  second. A node's own traffic is a few per gating event; a peer far past this is relaying a storm,
+ *  and every frame of it would cost a parse and a signature check. */
+const GOSSIP_BURST = 500;
+const GOSSIP_PER_SECOND = 100;
+const GOSSIP_TYPES = new Set(['attestation', 'checkpoint', 'witness']);
 
 /**
  * Processes inbound peer frames for a SymNode.
@@ -240,7 +246,25 @@ class FrameHandler {
     }
   }
 
+  /** Spend one of `peerId`'s gossip tokens; false when the peer is past its budget. @private */
+  _gossipAllowed(peerId, peerName, now = Date.now()) {
+    if (!this._gossipBuckets) this._gossipBuckets = new Map();
+    let b = this._gossipBuckets.get(peerId);
+    if (!b) { b = { tokens: GOSSIP_BURST, at: now, dropped: 0, saidAt: 0 }; this._gossipBuckets.set(peerId, b); }
+    b.tokens = Math.min(GOSSIP_BURST, b.tokens + ((now - b.at) / 1000) * GOSSIP_PER_SECOND);
+    b.at = now;
+    if (b.tokens >= 1) { b.tokens -= 1; return true; }
+    b.dropped++;
+    if (now - b.saidAt > 60_000) {
+      b.saidAt = now;
+      this._node._log(`Gossip from ${peerName} past ${GOSSIP_PER_SECOND}/s: ${b.dropped} frame(s) dropped`);
+      this._node.emit('metric', { type: 'gossip-rate-limited', from: peerName, dropped: b.dropped });
+    }
+    return false;
+  }
+
   _dispatch(peerId, peerName, msg) {
+    if (GOSSIP_TYPES.has(msg.type) && !this._gossipAllowed(peerId, peerName)) return;
     switch (msg.type) {
       case 'handshake':
         this._handleHandshake(peerId, peerName, msg);
diff --git a/lib/node.js b/lib/node.js
index 2720c997..39d81e4c 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -1111,6 +1111,8 @@ class SymNode extends EventEmitter {
   _ingestCheckpoint(cp, fromPeerId) {
     if (!cp || !cp.by || cp.upto_seq === undefined || !cp.root) return { ok: false, reason: 'malformed' };
     if (cp.roster && this._room && cp.roster !== this._room) return { ok: false, reason: 'roster-mismatch' };
+    // A position already held is a duplicate, whatever copy this is: dropped before the signature check.
+    if (this._attestations.hasCheckpoint(cp.by, cp.upto_seq)) return { ok: false, reason: 'duplicate' };
     const key = this._identityKey(cp.by);
     if (!key) return { ok: false, reason: 'unknown-attester-key' };
     if (!verifyCheckpoint(cp, key).valid) return { ok: false, reason: 'bad-signature' };
@@ -1155,6 +1157,7 @@ class SymNode extends EventEmitter {
   _ingestWitness(w, fromPeerId) {
     if (!w || !w.attester || w.upto_seq === undefined || !w.root || !w.by) return { ok: false, reason: 'malformed' };
     if (w.roster && this._room && w.roster !== this._room) return { ok: false, reason: 'roster-mismatch' };
+    if (this._attestations.hasWitnessed(w.attester, w.upto_seq, w.by)) return { ok: false, reason: 'duplicate' };
     const key = this._identityKey(w.by);
     if (!key) return { ok: false, reason: 'unknown-witness-key' };
     if (!verifyWitness(w, key).valid) return { ok: false, reason: 'bad-signature' };
@@ -1214,6 +1217,9 @@ class SymNode extends EventEmitter {
     }
     // Verify against the attester's authenticated identity key. Known for a direct
     // peer (handshake key map); a relayed attester awaits the roster key registry.
+    // A signature already held was verified when it was stored: a repeat is dropped before the
+    // signature check, which is most of what a flood of repeats costs.
+    if (this._attestations.has(att.sig)) return { ok: false, reason: 'duplicate' };
     const attesterKey = this._identityKey(att.by);
     if (!attesterKey) return { ok: false, reason: 'unknown-attester-key' };
     const v = verifyAttestation(att, attesterKey);
diff --git a/tests/admission-attestation.test.js b/tests/admission-attestation.test.js
index a519c761..0233f95f 100644
--- a/tests/admission-attestation.test.js
+++ b/tests/admission-attestation.test.js
@@ -486,3 +486,48 @@ describe('a witness is relayed and signed once per statement', () => {
     });
   });
 });
+
+// Under the storm every repeat still cost a signature check, and a node spent most of its thread
+// verifying copies it already held. Repeats are dropped before verification, and one peer's gossip
+// frames are capped.
+describe('gossip repeats are cheap, and one peer cannot flood a node', () => {
+  const { signCheckpoint, signWitness } = require('../lib/core');
+  const kp = () => {
+    const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519', { publicKeyEncoding: { type: 'spki', format: 'der' }, privateKeyEncoding: { type: 'pkcs8', format: 'der' } });
+    return { pub: publicKey.slice(-32).toString('base64url'), priv: privateKey.slice(-32).toString('base64url') };
+  };
+  it('a repeat is dropped before its signature is checked', () => {
+    const ATT = kp(), WIT = kp();
+    withNode('att-early', { lifecycleRole: 'participant', room: 'g' }, (node) => {
+      node._pinPeerKey('node-att', ATT.pub);
+      node._pinPeerKey('node-wit', WIT.pub);
+      node._gossipToRoster = () => {};
+      const cp = { type: 'checkpoint', by: 'node-att', roster: 'g', upto_seq: 8, root: 'r8', at: 1 };
+      signCheckpoint(cp, ATT.priv);
+      assert.strictEqual(node._ingestCheckpoint(cp, 'node-att').ok, true);
+      const forgedCp = { ...cp, sig: 'not-a-signature' };
+      assert.strictEqual(node._ingestCheckpoint(forgedCp, 'node-att').reason, 'duplicate', 'not even verified');
+      const w = { type: 'witness', attester: 'node-att', roster: 'g', upto_seq: 8, root: 'r8', by: 'node-wit', role: 'participant', at: 1 };
+      signWitness(w, WIT.priv);
+      assert.strictEqual(node._ingestWitness(w, 'node-wit').ok, true);
+      assert.strictEqual(node._ingestWitness({ ...w, sig: 'garbage' }, 'node-wit').reason, 'duplicate');
+    });
+  });
+
+  it('one peer past its gossip budget is dropped and counted; another peer is unaffected', () => {
+    withNode('att-rate', { lifecycleRole: 'participant', room: 'g' }, (node) => {
+      node._roomDoor = () => ({ pass: true });
+      let ingested = 0;
+      node._ingestWitness = () => { ingested++; return { ok: false }; };
+      const metrics = [];
+      node.on('metric', (m) => metrics.push(m));
+      const frame = { type: 'witness', witness: { attester: 'a', upto_seq: 1, root: 'r', by: 'b', sig: 's' } };
+      for (let i = 0; i < 2000; i++) node._frameHandler.handle('flooder', 'flooder', frame);
+      assert.ok(ingested <= 520, `at most the burst (and what refilled meanwhile) was handled: ${ingested}`);
+      assert.ok(metrics.some((m) => m.type === 'gossip-rate-limited' && m.from === 'flooder'));
+      const before = ingested;
+      node._frameHandler.handle('quiet-peer', 'quiet-peer', frame);
+      assert.strictEqual(ingested, before + 1, 'another peer has its own budget');
+    });
+  });
+});

From 3807ad42cd39d68de394544a92b612de81b91288 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 22:04:13 +0100
Subject: [PATCH 053/148] daemon: never remove a served socket; listen again
 when ours is removed

startIPCServer removed any socket file as stale, so a second daemon start unlinked the live daemon's
socket and that daemon became unreachable while it kept running. The path is probed first (a second
daemon exits), shutdown removes only this daemon's own socket (by inode), and a removed socket is
re-bound within 30 s (SYM_SOCKET_CHECK_MS for tests).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 CHANGELOG.md                    |  6 ++++
 bin/sym-daemon.js               | 55 +++++++++++++++++++++++++++++----
 tests/daemon-relay-only.test.js | 44 ++++++++++++++++++++++++++
 3 files changed, 99 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 54958eb8..1d0c1970 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -156,6 +156,12 @@ debt, and the daemon's log flood. Every item has a test that fails without its f
 - **A daemon rooted with `SYM_STATE_DIR` kept its room, tasks and relay.env in `~/.sym`.** It uses
   the state root now, and so does the `sym` CLI: its pid file, room, relay.env and node directory.
   Two rooted deployments sharing a home shared one pid file, so `sym stop` for one stopped the other.
+- **A second daemon start took the socket from the one serving it.** The daemon removed any socket
+  file at start, assuming it stale, so a second start unlinked a live daemon's socket; that daemon
+  ran on, reachable by no client, and every client reported "sym-daemon not running". A socket file
+  is now removed only when nothing answers on it (otherwise the second start exits), a daemon
+  removes only its own socket at shutdown, and a daemon whose socket file is removed listens on it
+  again within 30 s.
 - **A daemon IPC request whose handler threw went unanswered.** It is answered with the error, and a
   refused `remember` carries the SDK's code (`ECMBSIZE`, `ESIGN`).
 - **A relay-only daemon still announced its room on the LAN.** It no longer does.
diff --git a/bin/sym-daemon.js b/bin/sym-daemon.js
index 885bb4ad..b87ea5dd 100755
--- a/bin/sym-daemon.js
+++ b/bin/sym-daemon.js
@@ -214,12 +214,41 @@ const listeners = new Map(); // socketId → socket — real-time event subscrib
  * See MMP v0.2.0 Section 13 (Application).
  * @returns {net.Server}
  */
-function startIPCServer() {
+/**
+ * Whether a daemon is serving the socket path: a connect that succeeds means yes; a refused or
+ * missing socket is stale. Named pipes (Windows) have no file to remove, so they are not probed.
+ * @returns {Promise<boolean>}
+ */
+function socketServed() {
+  if (process.platform === 'win32' || !fs.existsSync(SOCKET_PATH)) return Promise.resolve(false);
+  return new Promise((resolve) => {
+    const c = net.createConnection(SOCKET_PATH);
+    const done = (v) => { c.destroy(); resolve(v); };
+    c.once('connect', () => done(true));
+    c.once('error', () => done(false));
+    setTimeout(() => done(false), 2000).unref();
+  });
+}
+
+/** The socket file this daemon created (its inode), so it never removes another daemon's. */
+let ownSocketIno = null;
+function socketIsOurs() {
+  if (process.platform === 'win32' || ownSocketIno === null) return false;
+  try { return fs.statSync(SOCKET_PATH).ino === ownSocketIno; } catch { return false; }
+}
+
+async function startIPCServer() {
   // Ensure ~/.sym/ exists
   if (!fs.existsSync(SYM_DIR)) {
     fs.mkdirSync(SYM_DIR, { recursive: true });
   }
-  // Clean up stale socket
+  // A socket file is removed only when nothing answers on it. Removing it unconditionally let a
+  // second daemon start take the path from the one already serving: that daemon kept running,
+  // reachable by no client, and every client reported "sym-daemon not running".
+  if (await socketServed()) {
+    log(`Another sym-daemon is serving ${SOCKET_PATH}; not starting a second one.`);
+    process.exit(1);
+  }
   if (fs.existsSync(SOCKET_PATH)) {
     try { fs.unlinkSync(SOCKET_PATH); } catch {}
   }
@@ -264,13 +293,26 @@ function startIPCServer() {
     });
   });
 
-  server.listen(SOCKET_PATH, () => {
+  const onListening = () => {
     // chmod not applicable on Windows named pipes
     if (process.platform !== 'win32') {
       try { fs.chmodSync(SOCKET_PATH, 0o700); } catch {}
+      try { ownSocketIno = fs.statSync(SOCKET_PATH).ino; } catch { ownSocketIno = null; }
     }
     log(`IPC server listening: ${SOCKET_PATH}`);
-  });
+  };
+  server.listen(SOCKET_PATH, onListening);
+
+  // If the socket file is removed or replaced while this daemon runs, clients can no longer reach
+  // it. It is checked every 30 s and, when gone, listened on again.
+  if (process.platform !== 'win32') {
+    setInterval(() => {
+      if (ownSocketIno === null || socketIsOurs()) return;
+      if (fs.existsSync(SOCKET_PATH)) return; // another process's socket now: leave it alone
+      log(`IPC socket ${SOCKET_PATH} was removed while this daemon was serving; listening again`);
+      server.close(() => server.listen(SOCKET_PATH, onListening));
+    }, Number(process.env.SYM_SOCKET_CHECK_MS) || 30_000).unref();
+  }
 
   server.on('error', (err) => {
     log(`IPC server error: ${err.message}`);
@@ -929,7 +971,7 @@ async function main() {
     broadcastToListeners({ type: 'event', event: 'peer-left', data: { name: data.name || 'unknown', peerId: data.peerId } });
   });
 
-  const ipcServer = startIPCServer();
+  const ipcServer = await startIPCServer();
 
   log('sym-daemon ready');
 
@@ -939,7 +981,8 @@ async function main() {
     stopRoomBeacon();
     node.stop();
     ipcServer.close();
-    if (fs.existsSync(SOCKET_PATH)) {
+    // Only our own socket file: a path another daemon now serves is left to it.
+    if (socketIsOurs()) {
       try { fs.unlinkSync(SOCKET_PATH); } catch {}
     }
     process.exit(0);
diff --git a/tests/daemon-relay-only.test.js b/tests/daemon-relay-only.test.js
index 3dbb4ec6..a3789e01 100644
--- a/tests/daemon-relay-only.test.js
+++ b/tests/daemon-relay-only.test.js
@@ -130,3 +130,47 @@ test('a daemon with SYM_STATE_DIR keeps its own files in that root, not in ~/.sy
     fs.rmSync(base, { recursive: true, force: true });
   }
 });
+
+// A second daemon start removed the socket of the daemon already serving it, which then ran on,
+// reachable by no client (every client: "sym-daemon not running"). A served socket is never
+// removed, and a daemon whose socket file is removed listens on it again.
+test('a second daemon never takes a served socket, and a removed socket is listened on again', { skip: process.platform === 'win32' && 'a socket file' }, async () => {
+  const base = fs.mkdtempSync(path.join(os.tmpdir(), 'sym-sock-'));
+  const socket = path.join(base, 'd.sock');
+  const start = (name) => {
+    const home = path.join(base, name); fs.mkdirSync(home);
+    const env = { ...process.env, HOME: home, USERPROFILE: home, SYM_STATE_DIR: path.join(home, '.sym'), SYM_SOCKET: socket, SYM_NODE_NAME: name, SYM_RELAY_ONLY: '1', SYM_SOCKET_CHECK_MS: '300' };
+    delete env.SYM_RELAY_URL; delete env.SYM_RELAY_TOKEN; delete env.SYM_ROOM;
+    const d = spawn(process.execPath, [path.join(BIN, 'sym-daemon.js')], { env, stdio: ['ignore', 'pipe', 'pipe'] });
+    d.out = '';
+    d.stdout.on('data', (b) => { d.out += b; });
+    d.stderr.on('data', (b) => { d.out += b; });
+    return d;
+  };
+  const until = async (cond, ms = 15000) => { for (let t = 0; t < ms && !cond(); t += 100) await new Promise((r) => setTimeout(r, 100)); return cond(); };
+  const status = () => new Promise((resolve) => {
+    const c = net.createConnection(socket);
+    let buf = '';
+    c.on('data', (d) => { buf += d; if (buf.includes('\n')) { c.end(); resolve(true); } });
+    c.on('error', () => resolve(false));
+    c.on('connect', () => c.write(JSON.stringify({ type: 'status' }) + '\n'));
+    setTimeout(() => resolve(false), 3000);
+  });
+  const a = start('first');
+  let b = null;
+  try {
+    assert.ok(await until(() => a.out.includes('IPC server listening')), a.out.slice(-600));
+    b = start('second');
+    assert.ok(await until(() => b.exitCode !== null), `the second daemon exits: ${b.out.slice(-400)}`);
+    assert.match(b.out, /Another sym-daemon is serving/);
+    assert.equal(await status(), true, 'the first is still reachable on the socket');
+    fs.unlinkSync(socket);
+    assert.ok(await until(() => fs.existsSync(socket), 5000), 'the first listens again on its removed socket');
+    assert.equal(await status(), true);
+  } finally {
+    a.kill('SIGTERM');
+    if (b && b.exitCode === null) b.kill('SIGTERM');
+    await new Promise((r) => setTimeout(r, 300));
+    fs.rmSync(base, { recursive: true, force: true });
+  }
+});

From b405fead9475fbb00460fd174d013966fbed534d Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 1 Oct 2026 22:17:14 +0100
Subject: [PATCH 054/148] 0.14.0: the large release is a minor version (the
 store's annotations moved to the entry)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 CHANGELOG.md                            | 5 ++++-
 lib/core/wake.js                        | 2 +-
 lib/memory-store.js                     | 2 +-
 tests/audit-delivery-authorship.test.js | 2 +-
 tests/inbox-limit-and-clock.test.js     | 2 +-
 tests/mesh-agent.test.js                | 2 +-
 tests/semantic-single-load.test.js      | 2 +-
 tests/state-root-tenancy.test.js        | 2 +-
 tests/v2-author-binding.test.js         | 2 +-
 tests/wake-channels.test.js             | 2 +-
 10 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1d0c1970..032ad2f2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,9 @@
 # Changelog
 
-## Unreleased
+## 0.14.0 (unreleased)
+
+A minor version because one change breaks readers outside sym: the store's annotations moved from
+the stored record to the entry (see Changed). Also carries the 0.13.15 witness-storm fix.
 
 Fixes from the MMP 2.0 conformance audit's open findings, the 0.13.12 known limits, the Windows test
 debt, and the daemon's log flood. Every item has a test that fails without its fix.
diff --git a/lib/core/wake.js b/lib/core/wake.js
index a6796a42..9f42fb61 100644
--- a/lib/core/wake.js
+++ b/lib/core/wake.js
@@ -32,7 +32,7 @@ const WAKE_CHANNEL_TTL_MS = 30 * 24 * 60 * 60 * 1000;
 const REFRESH_GRANULARITY_MS = 60 * 60 * 1000;
 
 /** How far each source of a wake channel is trusted. Gossip is unauthenticated. A channel kept by
- *  a release before 0.13.15 carries no source: it may have come from the phone itself, so gossip
+ *  a release before 0.14.0 carries no source: it may have come from the phone itself, so gossip
  *  must not repoint it, while the relay and the phone still can. */
 const SOURCE_RANK = Object.freeze({ gossip: 1, legacy: 2, relay: 2, direct: 3 });
 
diff --git a/lib/memory-store.js b/lib/memory-store.js
index 79dd2a2a..915dc866 100644
--- a/lib/memory-store.js
+++ b/lib/memory-store.js
@@ -51,7 +51,7 @@ const ENTRY_ANNOTATIONS = Object.freeze(['admission', 'tether', 'provenance', 'c
 /**
  * An entry whose record is exactly what was signed, for every entry the store writes or reads.
  *
- * A two-section record has exactly `categories` and `metadata` (§8.8.1). Stores before 0.13.15 put
+ * A two-section record has exactly `categories` and `metadata` (§8.8.1). Stores before 0.14.0 put
  * more on it, and files they wrote still hold it:
  *
  *   lineage     the store's expanded lineage as a top-level member. Readers that take a top-level
diff --git a/tests/audit-delivery-authorship.test.js b/tests/audit-delivery-authorship.test.js
index 179dbc3f..e5ce064b 100644
--- a/tests/audit-delivery-authorship.test.js
+++ b/tests/audit-delivery-authorship.test.js
@@ -729,7 +729,7 @@ describe('B-D5: directed sends that mint nothing still deliver (MMP §4.4.4)', (
   });
 });
 
-// 0.13.15 review F7: a hedged Ed25519 signer (WebKit) signs one assertion differently each time, so
+// 0.14.0 review F7: a hedged Ed25519 signer (WebKit) signs one assertion differently each time, so
 // a mark taken from the signature bytes named one directed assertion twice.
 describe('directed de-duplication marks the assertion, not its signature bytes', () => {
   const { assertionMark } = require('../lib/frame-handler');
diff --git a/tests/inbox-limit-and-clock.test.js b/tests/inbox-limit-and-clock.test.js
index 4724de54..4b19cd3c 100644
--- a/tests/inbox-limit-and-clock.test.js
+++ b/tests/inbox-limit-and-clock.test.js
@@ -36,7 +36,7 @@ describe('inbox limit (K4)', () => {
     } finally { fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
   });
 
-  // 0.13.15 review F6: counting only unread items let the reply grow to the whole ring.
+  // 0.14.0 review F6: counting only unread items let the reply grow to the whole ring.
   it('the limit still bounds the reply when most of the ring is acked', () => {
     const name = uniq('inbox-bound');
     const node = mkNode(name);
diff --git a/tests/mesh-agent.test.js b/tests/mesh-agent.test.js
index 6516c572..5d2aa05e 100644
--- a/tests/mesh-agent.test.js
+++ b/tests/mesh-agent.test.js
@@ -150,7 +150,7 @@ describe('MeshAgent', () => {
   });
 });
 
-// 0.13.15 review F8: remember() throws ESIGN when the node cannot sign. The agent says so once and
+// 0.14.0 review F8: remember() throws ESIGN when the node cannot sign. The agent says so once and
 // stops, instead of an error for every admitted record and a model call it could never use.
 describe('MeshAgent when its node cannot sign', () => {
   const { MeshAgent } = require('../lib/mesh-agent');
diff --git a/tests/semantic-single-load.test.js b/tests/semantic-single-load.test.js
index bba456de..879dda2b 100644
--- a/tests/semantic-single-load.test.js
+++ b/tests/semantic-single-load.test.js
@@ -1,7 +1,7 @@
 'use strict';
 
 /**
- * The semantic encoder is loaded once per process (0.13.15). Under load, a second caller asking
+ * The semantic encoder is loaded once per process (0.14.0). Under load, a second caller asking
  * for it while the first load was still running started a second model load, and parallel loads
  * were what made the full suite report "semantic encoder did not become ready".
  *
diff --git a/tests/state-root-tenancy.test.js b/tests/state-root-tenancy.test.js
index b9551a01..3ba48ea3 100644
--- a/tests/state-root-tenancy.test.js
+++ b/tests/state-root-tenancy.test.js
@@ -85,7 +85,7 @@ test('and the SAME root still refuses a second holder — the single-writer rule
   } finally { holder.kill(); }
 });
 
-// The CLI's own state follows SYM_STATE_DIR, as its daemon's does (0.13.15 review F5): rooted in
+// The CLI's own state follows SYM_STATE_DIR, as its daemon's does (0.14.0 review F5): rooted in
 // the home, two rooted deployments shared one pid file, so `sym stop` for one stopped the other,
 // and a room or relay set for a rooted daemon was written where that daemon never reads.
 test('the CLI reads its room from SYM_STATE_DIR, not the home (pid and relay.env resolve the same way)', () => {
diff --git a/tests/v2-author-binding.test.js b/tests/v2-author-binding.test.js
index c6e77780..48205ef8 100644
--- a/tests/v2-author-binding.test.js
+++ b/tests/v2-author-binding.test.js
@@ -113,7 +113,7 @@ describe('the inbox names a proven author (K5)', () => {
   });
 });
 
-describe('a malformed v2.0 frame is refused, never thrown (0.13.15 review F1)', () => {
+describe('a malformed v2.0 frame is refused, never thrown (0.14.0 review F1)', () => {
   // Declares the v2.0 suite but carries no room and no signature: it has no preimage, and building
   // one throws. On the relay path that throw reached the process and ended the daemon.
   function malformed() {
diff --git a/tests/wake-channels.test.js b/tests/wake-channels.test.js
index 5dd4e059..69b8dd24 100644
--- a/tests/wake-channels.test.js
+++ b/tests/wake-channels.test.js
@@ -160,7 +160,7 @@ describe('relay peer list', () => {
   });
 });
 
-describe('0.13.15 review F2/F3', () => {
+describe('0.14.0 review F2/F3', () => {
   it('a channel kept by 0.13.14 (no source) is not repointed by gossip, and the relay or the phone still can', () => {
     withNode((node) => {
       const wm = node._wakeManager;

From 00ced01f1ee6dc48ea399ac446554c12a92ded6d Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Fri, 2 Oct 2026 02:15:54 +0100
Subject: [PATCH 055/148] 0.14.0: the attestation logs are rotated, and
 archive/ is bounded

A log is rotated once the bytes in it beyond the records held exceed
max(8 MiB, bytes held): a rotation always reclaims more than it writes, is
never followed by another until that much more has been appended and dropped,
and a start applies the same rule, so it rotates only a log over budget.

A rotation writes the held set to a temp file (every byte, fsynced), links
the old log into archive/ under <log>.<seq>.<time>.<pid>.jsonl without ever
replacing a name (copied where there are no hard links), then renames the
temp file over the live log. A failure at any step undoes what it made,
leaves the live log as it was, is said once per distinct error and is
retried after another budget; a start tidies what a crash left. archive/
keeps at most 128 MiB per log, the newest included, pruned by sequence.

A rotation keeps conflicting copies for held positions and this node's
own-witness memory. Checkpoint and witness logs are read whole at start
(twice their caps); attestations, held newest-last, to what their cap
holds: 110 MiB in all, under 0.13.16's 112. A conflict is now dropped only
with its position.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 CHANGELOG.md                       |  42 +++
 lib/attestation-store.js           | 439 ++++++++++++++++++++++++++---
 lib/node.js                        |   7 +-
 tests/attestation-rotation.test.js | 364 ++++++++++++++++++++++++
 4 files changed, 804 insertions(+), 48 deletions(-)
 create mode 100644 tests/attestation-rotation.test.js

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2f87033d..18a931eb 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -102,6 +102,16 @@ debt, and the daemon's log flood. Every item has a test that fails without its f
   while it applies, the §16 influence bound does not cover the node. With decay that window recurs
   after every quiet period of about 18.4 × `freshnessSeconds` (about nine hours at the default), not
   only on a fresh node. `freshnessSeconds` is the dial: a larger value keeps older memory gating.
+- **The attestation logs are rotated, and older lines are deleted.** `attestations.jsonl`,
+  `checkpoints.jsonl` and `witnesses.jsonl` (in the node's `attestations/` directory) only ever grew.
+  Now a rotation replaces each live log with the records the store holds and moves the old log, whole,
+  into `attestations/archive/`. `archive/` keeps at most 128 MiB per log, **its newest archive
+  included**: the oldest go first, and an archive larger than 128 MiB on its own is deleted. **What
+  stays on disk is the records the store holds (50,000 attestations, 32 checkpoints for each of 1,024
+  attesters, 50,000 witnesses), the lines appended since the last rotation, and as many of the most
+  recent archived logs as fit in 128 MiB per log. Anything older is deleted.** On the first start, a
+  log already over its budget is rotated at once: the storm's 257 MB `witnesses.jsonl` is archived and,
+  being over 128 MiB, deleted.
 
 ### Fixed — SVAF and the store
 
@@ -123,6 +133,38 @@ debt, and the daemon's log flood. Every item has a test that fails without its f
 - The semantic encoder no longer starts a second model load while the first is loading.
   `semanticSettled()` resolves when it is ready or has failed.
 
+### Fixed — the attestation logs
+
+- **The logs are rotated (0.13.15's known limit).** A log is rotated once the bytes in it beyond the
+  records the store holds (appended since its last rotation, then evicted or superseded) exceed the
+  larger of 8 MiB and the bytes of the records it holds. So a rotation always reclaims more than it
+  writes. It is never followed by another until that much more has been appended and dropped: a held
+  set larger than 8 MiB does not make every append rotate. A start applies the same rule to the log as
+  it finds it, so a node does not rotate on every start. Rotating a full attestation log (50,000,
+  ~27 MB) took about 100 ms here.
+- **A rotation cannot lose the live log.** It writes the records held to a temp file, checks every
+  byte reached the file (a write may be short) and fsyncs it. It then hard-links the old log into
+  `archive/` as `<log>.<sequence>.<time>.<pid>.jsonl`, never over an existing name, or copies it where
+  the filesystem has no hard links. Only then does it rename the temp file over the live log, so the
+  live path holds a complete log at every instant. A failure at any step removes what the rotation
+  made (no archive name is left on the live log), leaves the live log as it was, is logged once per
+  distinct error, and is retried after another budget. A start removes what a crashed rotation left
+  behind. Archives are pruned in sequence order, not by file time.
+- **A rotation keeps everything held:** every attestation, checkpoint and witness the store holds;
+  each conflicting checkpoint copy for a held position, so a restart still reports the conflict; and
+  this node's memory of the checkpoints it witnessed itself (one line per attester), so it still signs
+  a witness once across restarts. A witness waiting for its checkpoint stays in memory only, as before.
+- **A start reads all of a checkpoint or witness log.** A held checkpoint or witness can sit at the
+  head of its log while newer ones churn past, so these two logs are read whole: twice what their caps
+  hold, 28 MiB for checkpoints and 47.7 MiB for witnesses. 0.13.16 read only the newest 16 and 32 MiB,
+  which could miss a quiet attester's checkpoints. Attestations are evicted oldest first, so the ones
+  held are always the newest in their log, and 34.3 MiB (50,000 at 720 bytes; measured ~520) reads them
+  all. That is 110 MiB at most in all, against 0.13.16's 112 MiB. On logs over every budget, a start
+  took 0.5–0.6 s here, against 1.0–1.1 s for 0.13.16.
+- **A conflict on a held position is remembered as long as the position is held.** 0.13.16's
+  32,768-entry list also counted positions already dropped, so another attester's conflicts could push
+  out the mark of a position still held.
+
 ### Fixed — dependencies
 
 - `npm audit` is clean. Floors are raised past the vulnerable versions, because `overrides` do not
diff --git a/lib/attestation-store.js b/lib/attestation-store.js
index 5af3b6cb..f4e44284 100644
--- a/lib/attestation-store.js
+++ b/lib/attestation-store.js
@@ -27,6 +27,16 @@
  * after its witness index has dropped it. Checkpoints and witnesses are bounded, and each log is read
  * at start up to a budget that covers what its cap holds.
  *
+ * Each log is rotated once the bytes in it beyond the records the store holds (appended since the
+ * last rotation and since dropped: evicted, superseded) exceed the larger of `rotateBytes` and the
+ * bytes of the records it holds. The rule is the same at start as at run time, so a start rotates a
+ * log only when it is over budget, and a rotation is never followed by another until that much more
+ * has been appended and dropped. A rotation writes the records held to a temp file (fully, then
+ * fsynced), links the old log into `archive/` under a name no other rotation can take, and renames
+ * the temp file over the live log: the live path holds a complete log at every instant, and a failure
+ * at any step leaves it as it was. `archive/` keeps at most `maxArchiveBytes` per log, the newest
+ * archive included, dropping the oldest first. A log is never edited in place.
+ *
  * This store does NOT verify signatures or roster membership — the caller verifies
  * before recording (a recorded attestation is assumed already verified). It only
  * indexes, dedups, reports chain integrity, and bounds memory.
@@ -41,10 +51,40 @@ const path = require('path');
 const ATT_FILE = 'attestations.jsonl';
 const CP_FILE = 'checkpoints.jsonl';
 const WIT_FILE = 'witnesses.jsonl';
+const LOGS = [ATT_FILE, CP_FILE, WIT_FILE];
+const ARCHIVE_DIR = 'archive';
+/** An archived log: `<log>.<sequence, 12 digits>.<UTC time to the ms>.<pid>.jsonl`. The sequence orders them. */
+const ARCHIVE_NAME = /^(attestations|checkpoints|witnesses)\.(\d{12})\.(\d{8}T\d{9}Z)\.(\d+)\.jsonl$/;
+/** A rotation's temp file: left behind only by a crash part way through one. */
+const ROTATING_NAME = /^(attestations|checkpoints|witnesses)\.jsonl\.\d+\.\d+\.rotating$/;
+/** The line a rotated witness log keeps this node's own-witness memory in, one per attester. */
+const OWN_WITNESSED = 'own-witnessed';
+/** A link error that means the filesystem has no hard links: the old log is copied instead. */
+const NO_LINK = new Set(['EPERM', 'ENOTSUP', 'EOPNOTSUPP', 'ENOSYS', 'EXDEV', 'EMLINK']);
+/** Bytes a read budget allows for one record's line. Measured (36-character node ids, a 16-character
+ *  room): an attestation ~520, a checkpoint ~315, a witness ~380; and per attester, this node's
+ *  own-witness line (up to 256 positions). */
+const ATT_LINE = 720;
+const CP_LINE = 448;
+const WIT_LINE = 448;
+const OWN_LINE = 2560;
+/** A rotation writes the held records in chunks of about this many characters. */
+const WRITE_CHUNK = 1 << 20;
 
 /** A checkpoint position: a non-negative integer, never its text spelling. */
 const isPosition = (n) => Number.isSafeInteger(n) && n >= 0;
 
+/** Write a whole buffer to a file descriptor: a write may be short. @returns {number} bytes written */
+function writeAll(fd, buf) {
+  let off = 0;
+  while (off < buf.length) {
+    const n = fs.writeSync(fd, buf, off, buf.length - off);
+    if (!(n > 0)) throw Object.assign(new Error(`write returned ${n}`), { code: 'ESHORTWRITE' });
+    off += n;
+  }
+  return off;
+}
+
 /** sha256 hex of a signature — the per-attester chain link (`prev`). */
 function chainHash(sig) {
   return crypto.createHash('sha256').update(String(sig)).digest('hex');
@@ -59,6 +99,11 @@ class AttestationStore {
    * @param {string} [opts.selfId] this node's id: the witnesses it signs are remembered apart.
    * @param {number} [opts.maxReadBytes] one budget for every log at start (tests); otherwise each log
    *   has its own, sized to what its cap holds.
+   * @param {number} [opts.rotateBytes=8 MiB] a log is rotated once the bytes in it beyond the records
+   *   held exceed the larger of this and the bytes of the records held.
+   * @param {number} [opts.maxArchiveBytes=128 MiB] `archive/` keeps at most this much per log,
+   *   the newest archive included; the oldest go first.
+   * @param {function(string):void} [opts.log] where a rotation failure is said (once per distinct error).
    * @param {string} [opts.dir] when set, the store persists records as append-only
    *   JSONL under this dir and reloads them on construction — so the audit trail
    *   (attestations + checkpoints + witnesses) survives a node restart.
@@ -79,8 +124,9 @@ class AttestationStore {
     this._checkpoints = new Map(); // by -> Map(upto_seq -> checkpoint); least recently updated attester first
     this._maxCheckpointsPerAttester = opts.maxCheckpointsPerAttester || 32;
     this._maxAttesters = opts.maxAttesters || 1024;
-    this._conflicted = new Map();  // by -> Set(upto_seq) where a second root was refused
-    this._conflictOrder = [];      // [by, upto_seq] in the order seen, bounded
+    // by -> Map(upto_seq -> the copy with the other root), for held positions only: a position that
+    // is dropped takes its conflict with it, so this is bounded by the checkpoint caps.
+    this._conflicted = new Map();
     this._witnesses = new Map();   // attester -> Map(upto_seq -> Map(witnessBy -> witness))
     this._positions = [];          // [attester, upto_seq] in the order a position got its first witness
     this._witnessCount = 0;
@@ -90,19 +136,42 @@ class AttestationStore {
     this._maxPending = opts.maxPending || 2048;
     this._ownWitnessed = new Map(); // attester -> Set(upto_seq) this node has witnessed itself
     this._witnessConflicts = new Set(); // JSON [attester, upto_seq, by] already reported, bounded
-    this._fromLog = new WeakSet();  // waiting witnesses read from the log (already appended)
-    // At start, each log is read up to a budget that covers what its cap holds (an attestation is
-    // ~400-700 bytes and 50,000 are kept), and of a larger log only its newest part.
-    const readAll = opts.maxReadBytes;
-    this._readBudget = {
-      [ATT_FILE]: readAll || 64 * 1024 * 1024,
-      [CP_FILE]: readAll || (this._maxCheckpointsPerAttester * this._maxAttesters * 512),
-      [WIT_FILE]: readAll || 32 * 1024 * 1024,
-    };
+    this._fromLog = new WeakSet();  // waiting witnesses read from the live log (already in it)
     this._rateCalls = 0;
-    // Durable, append-only persistence (compliance: never rewrite, only append).
+    // Durable, append-only persistence (compliance: a log is never edited, only appended to; a
+    // rotation archives it whole and starts a new one from the records held).
     this._dir = opts.dir || null;
     this._loading = false;
+    this._rotateBytes = opts.rotateBytes || 8 * 1024 * 1024;
+    this._maxArchiveBytes = opts.maxArchiveBytes ?? 128 * 1024 * 1024;
+    this._logFn = typeof opts.log === 'function' ? opts.log : (m) => console.error(`[SYM] attestations: ${m}`);
+    const perLog = (v) => ({ [ATT_FILE]: v, [CP_FILE]: v, [WIT_FILE]: v });
+    this._held = perLog(0);        // bytes of the records held, as the lines a rotation writes
+    this._logBytes = perLog(0);    // bytes in each live log
+    this._retryAt = perLog(0);     // after a failed rotation, the log size it waits for
+    this._rotations = perLog(0);
+    this._recBytes = new WeakMap(); // record -> bytes of its log line
+    this._replayBytes = 0;         // bytes of the line being replayed
+    this._archiveSeq = 0;
+    this._tmpSeq = 0;
+    this._said = new Set();        // rotation errors already said
+    // At start, each log is read up to a budget that covers what its caps hold, and of a larger log
+    // only its newest part. Attestations are evicted oldest first, so the ones held are the newest in
+    // their log: reading what the cap holds reloads them all. A checkpoint or witness can stay held
+    // while newer ones churn past it, so those two logs are read whole: what the caps hold, plus what
+    // a log may hold beyond that before it is rotated.
+    const readAll = opts.maxReadBytes;
+    const capBytes = {
+      [ATT_FILE]: this._max * ATT_LINE,
+      [CP_FILE]: this._maxCheckpointsPerAttester * this._maxAttesters * CP_LINE,
+      [WIT_FILE]: this._maxWitnesses * WIT_LINE + this._maxAttesters * OWN_LINE,
+    };
+    const wholeLog = (f) => capBytes[f] + Math.max(this._rotateBytes, capBytes[f]);
+    this._readBudget = {
+      [ATT_FILE]: readAll || capBytes[ATT_FILE],
+      [CP_FILE]: readAll || wholeLog(CP_FILE),
+      [WIT_FILE]: readAll || wholeLog(WIT_FILE),
+    };
     if (this._dir) {
       try { fs.mkdirSync(this._dir, { recursive: true }); } catch { /* best effort */ }
       this._load();
@@ -139,8 +208,9 @@ class AttestationStore {
     if (!chain) { chain = new Map(); this._byAttester.set(att.by, chain); }
     chain.set(att.seq, att);
 
-    this._append(ATT_FILE, att);
+    this._keep(ATT_FILE, att);
     this._evict();
+    this._maybeRotate(ATT_FILE);
     return { stored: true };
   }
 
@@ -200,35 +270,41 @@ class AttestationStore {
     const existing = m && m.get(cp.upto_seq);
     if (existing) {
       if (existing.root === cp.root) return { stored: false, reason: 'duplicate' };
-      const first = this._markConflict(cp.by, cp.upto_seq);
-      if (first) this._append(CP_FILE, cp);
+      const first = this._markConflict(cp.by, cp.upto_seq, cp);
+      if (first) { this._keep(CP_FILE, cp); this._maybeRotate(CP_FILE); }
       return { stored: false, reason: 'conflict', keptRoot: existing.root, first };
     }
+    let dropped = false;
     if (m && m.size >= this._maxCheckpointsPerAttester) {
       let oldest = Infinity;
       for (const k of m.keys()) if (k < oldest) oldest = k;
       if (cp.upto_seq < oldest) return { stored: false, reason: 'stale' };
+      this._unkeep(CP_FILE, m.get(oldest));
       m.delete(oldest);
       this._dropWitnessesOf(cp.by, oldest);
-      this._conflicted.get(cp.by)?.delete(oldest);   // a conflict is kept while its position is
+      this._dropConflict(cp.by, oldest);   // a conflict is kept while its position is
+      dropped = true;
     }
     if (!m) {
       m = new Map();
       if (this._checkpoints.size >= this._maxAttesters) {
-        const [victim] = this._checkpoints.keys();   // the attester updated least recently
-        for (const seq of [...this._checkpoints.get(victim).keys()]) this._dropWitnessesOf(victim, seq);
+        const [victim, held] = this._checkpoints.entries().next().value;   // the attester updated least recently
+        for (const [seq, old] of held) { this._unkeep(CP_FILE, old); this._dropWitnessesOf(victim, seq); }
         this._checkpoints.delete(victim);
-        this._conflicted.delete(victim);
+        for (const seq of [...(this._conflicted.get(victim)?.keys() || [])]) this._dropConflict(victim, seq);
         this._ownWitnessed.delete(victim);
+        dropped = true;
       }
     }
     m.set(cp.upto_seq, cp);
     this._checkpoints.delete(cp.by);
     this._checkpoints.set(cp.by, m);
-    this._append(CP_FILE, cp);
+    this._keep(CP_FILE, cp);
     for (const w of [...this._pending]) {
       if (w.attester === cp.by && w.upto_seq === cp.upto_seq) { this._pending.delete(w); this.recordWitness(w); }
     }
+    this._maybeRotate(CP_FILE);
+    if (dropped) this._maybeRotate(WIT_FILE);   // witnesses went with the dropped positions
     return { stored: true };
   }
 
@@ -255,7 +331,7 @@ class AttestationStore {
         if (p.root === w.root) return { stored: false, reason: 'duplicate' };
         return { stored: false, reason: 'conflict', keptRoot: p.root, first: this._noteWitnessConflict(w) };
       }
-      if (this._loading) this._fromLog.add(w);
+      if (this._loading) { this._fromLog.add(w); this._recBytes.set(w, this._replayBytes); }
       this._pending.add(w);
       if (this._pending.size > this._maxPending) this._pending.delete(this._pending.values().next().value);
       return { stored: false, reason: 'pending' };
@@ -267,17 +343,19 @@ class AttestationStore {
     if (m.size >= this._maxWitnessesPerPosition) {
       // This node's own witness is written even when the position cannot hold it, so a restart still
       // knows it was signed; it is read back as remembered, not stored.
-      if (this._selfId && w.by === this._selfId) this._append(WIT_FILE, w);
+      // (A rotation keeps it in this node's own-witness line.)
+      if (this._selfId && w.by === this._selfId && !this._fromLog.has(w)) this._appendLine(WIT_FILE, JSON.stringify(w) + '\n');
       return { stored: false, reason: 'position-full' };
     }
     m.set(w.by, w);
     this._witnessCount++;
+    // One read from the live log and kept waiting is already in it: promoting it must not append it again.
+    this._keep(WIT_FILE, w, !this._fromLog.has(w));
     while (this._witnessCount > this._maxWitnesses && this._positions.length) {
       const [a, seq] = this._positions.shift();
       this._dropWitnessesOf(a, seq, false);
     }
-    // One read from the log and kept waiting is already in it: promoting it must not append it again.
-    if (!this._fromLog.has(w)) this._append(WIT_FILE, w);
+    this._maybeRotate(WIT_FILE);
     return { stored: true };
   }
 
@@ -296,6 +374,7 @@ class AttestationStore {
     const m = byPos && byPos.get(upto_seq);
     if (!m) return;
     this._witnessCount -= m.size;
+    for (const w of m.values()) this._unkeep(WIT_FILE, w);
     byPos.delete(upto_seq);
     if (byPos.size === 0) this._witnesses.delete(attester);
     if (unlist) {
@@ -321,22 +400,28 @@ class AttestationStore {
     }
   }
 
-  /** @private Remember that a second root was refused for (by, upto_seq); bounded.
+  /** @private Remember that a second root was refused for a held position (by, upto_seq), with the
+   *  copy that asserted it (a rotation writes it after the kept one, so a restart re-derives the
+   *  conflict). Bounded by the held positions: a dropped position drops its conflict.
    *  @returns {boolean} whether this position is newly conflicted */
-  _markConflict(by, upto_seq) {
-    let set = this._conflicted.get(by);
-    if (!set) { set = new Set(); this._conflicted.set(by, set); }
-    if (set.has(upto_seq)) return false;
-    set.add(upto_seq);
-    this._conflictOrder.push([by, upto_seq]);
-    if (this._conflictOrder.length > this._maxCheckpointsPerAttester * this._maxAttesters) {
-      const [oby, oseq] = this._conflictOrder.shift();
-      const os = this._conflicted.get(oby);
-      if (os) { os.delete(oseq); if (os.size === 0) this._conflicted.delete(oby); }
-    }
+  _markConflict(by, upto_seq, copy) {
+    let m = this._conflicted.get(by);
+    if (m && m.has(upto_seq)) return false;
+    if (!m) { m = new Map(); this._conflicted.set(by, m); }
+    m.set(upto_seq, copy);
     return true;
   }
 
+  /** @private Forget the conflict of a dropped position. */
+  _dropConflict(by, upto_seq) {
+    const m = this._conflicted.get(by);
+    const copy = m && m.get(upto_seq);
+    if (!copy) return;
+    this._unkeep(CP_FILE, copy);
+    m.delete(upto_seq);
+    if (m.size === 0) this._conflicted.delete(by);
+  }
+
   /** Whether a second, different root was refused for (by, upto_seq). */
   hasConflict(by, upto_seq) { return !!this._conflicted.get(by)?.has(upto_seq); }
 
@@ -375,24 +460,59 @@ class AttestationStore {
     return root ? all.filter(w => w.root === root) : all;
   }
 
-  // ── Durable persistence (append-only JSONL) ──────────────────────────────────
+  // ── Durable persistence (append-only JSONL, rotated) ─────────────────────────
+
+  /** @private A record is now held: its line's bytes count as held, and it is appended to its log
+   *  (unless it is being replayed from it, or `append` is false because it is already in it). */
+  _keep(file, rec, append = true) {
+    if (!this._dir) return;
+    let bytes = this._recBytes.get(rec);
+    let line = null;
+    if (bytes === undefined) {
+      if (this._loading) bytes = this._replayBytes;
+      else { line = JSON.stringify(rec) + '\n'; bytes = Buffer.byteLength(line); }
+      this._recBytes.set(rec, bytes);
+    }
+    this._held[file] += bytes;
+    if (append && !this._loading) this._appendLine(file, line || JSON.stringify(rec) + '\n');
+  }
+
+  /** @private A record is no longer held: its line is now waste in the log until the next rotation. */
+  _unkeep(file, rec) {
+    if (!this._dir || !rec) return;
+    this._held[file] -= this._recBytes.get(rec) || 0;
+  }
 
-  /** Append one record to its JSONL file. No-op without a dir or while replaying. */
-  _append(file, obj) {
+  /** @private Append one line to a live log. Best effort: a failed append is never fatal (the record
+   *  is held, and the next rotation writes it). No-op without a dir or while replaying. */
+  _appendLine(file, line) {
     if (!this._dir || this._loading) return;
-    try { fs.appendFileSync(path.join(this._dir, file), JSON.stringify(obj) + '\n'); }
-    catch { /* best effort — never let persistence break gating */ }
+    try {
+      fs.appendFileSync(path.join(this._dir, file), line);
+      this._logBytes[file] += Buffer.byteLength(line);
+    } catch { /* best effort — never let persistence break gating */ }
   }
 
   /** Replay persisted records into the in-memory index on construction. Reuses the
    *  normal record paths (which dedup), with `_loading` suppressing re-writes. A
-   *  malformed line is skipped, never fatal. */
+   *  malformed line is skipped, never fatal. Then a crashed rotation is tidied up, and a log that is
+   *  over budget (by the same rule as at run time) is rotated. */
   _load() {
     this._loading = true;
     this._replay(ATT_FILE, (o) => this.record(o));
     this._replay(CP_FILE, (o) => this.recordCheckpoint(o));
-    this._replay(WIT_FILE, (o) => this.recordWitness(o));
+    this._replay(WIT_FILE, (o) => (o && o.type === OWN_WITNESSED ? this._restoreOwn(o) : this.recordWitness(o)));
     this._loading = false;
+    this._tidy();
+    for (const file of LOGS) this._maybeRotate(file);
+  }
+
+  /** @private This node's own-witness line, as a rotation writes it: the positions it signed for one
+   *  attester. Read for this node's id only; the line counts as held. */
+  _restoreOwn(o) {
+    if (!this._selfId || o.by !== this._selfId || !o.attester || !Array.isArray(o.positions)) return;
+    for (const p of o.positions.slice(-256)) if (isPosition(p)) this._markOwnWitness(o.attester, p);
+    this._held[WIT_FILE] += this._replayBytes;
   }
 
   _replay(file, fn) {
@@ -401,11 +521,12 @@ class AttestationStore {
     let text;
     try {
       const size = fs.statSync(p).size;
+      this._logBytes[file] = size;
       if (size <= budget) text = fs.readFileSync(p, 'utf8');
       else {
         // The newest part only: what a bounded store keeps. Reading a whole oversized log (one was
-        // 257 MB of storm) held a node's thread for minutes at every start. The log itself is never
-        // rewritten.
+        // 257 MB of storm) held a node's thread for minutes at every start. What is not read counts
+        // as waste, so such a log is rotated once it is loaded.
         const fd = fs.openSync(p, 'r');
         try {
           const buf = Buffer.alloc(budget);
@@ -416,10 +537,234 @@ class AttestationStore {
     } catch { return; } // no file yet
     for (const line of text.split('\n')) {
       if (!line.trim()) continue;
-      try { fn(JSON.parse(line)); } catch { /* skip a corrupt line */ }
+      let o;
+      try { o = JSON.parse(line); } catch { continue; } // skip a corrupt line
+      this._replayBytes = Buffer.byteLength(line) + 1;
+      try { fn(o); } catch { /* skip a record that does not fit */ }
+    }
+    this._replayBytes = 0;
+  }
+
+  // ── Rotation ─────────────────────────────────────────────────────────────────
+
+  /**
+   * @private Rotate a log once the bytes in it beyond the records held exceed the larger of
+   * `rotateBytes` and the bytes of the records held. Every rotation therefore reclaims more than it
+   * writes, a rotation is never followed by another until that much more has been appended and
+   * dropped, and a start (which applies the same rule to the log as it finds it) rotates only a log
+   * that is over budget. After a failed rotation it is retried only after another such budget.
+   * O(1): two comparisons per record stored.
+   */
+  _maybeRotate(file) {
+    if (!this._dir || this._loading) return;
+    const held = this._held[file];
+    if (this._logBytes[file] - held <= Math.max(this._rotateBytes, held)) return;
+    if (this._logBytes[file] < this._retryAt[file]) return;
+    this._rotate(file);
+  }
+
+  /** @private The records a rotation writes, in the order that replays to the same store. */
+  * _heldRecords(file) {
+    if (file === ATT_FILE) {
+      for (const [sig, { of }] of this._order) { const a = this._byCmb.get(of)?.get(sig); if (a) yield a; }
+    } else if (file === CP_FILE) {
+      // Attesters least recently updated first; each conflicting copy after every kept one, so a
+      // replay keeps the first and re-derives the conflict.
+      for (const m of this._checkpoints.values()) yield* m.values();
+      for (const m of this._conflicted.values()) yield* m.values();
+    } else {
+      // Positions in the order they got their first witness (the global cap drops the oldest first).
+      for (const [a, seq] of this._positions) { const m = this._witnesses.get(a)?.get(seq); if (m) yield* m.values(); }
+    }
+  }
+
+  /**
+   * @private Rotate one log: write the records held to a temp file (every byte, then fsync), link the
+   * old log into archive/ under a name no other rotation can take (copied where the filesystem has no
+   * hard links), then rename the temp file over the live log. Until the rename the live log is
+   * untouched, and the rename replaces it whole, so the live path holds a complete log at every
+   * instant. A failure at any step removes what the rotation made, leaves the live log as it was, is
+   * said once per distinct error, and is retried after another budget. @returns {boolean}
+   */
+  _rotate(file) {
+    const live = path.join(this._dir, file);
+    const base = file.slice(0, -'.jsonl'.length);
+    const tmp = `${live}.${process.pid}.${++this._tmpSeq}.rotating`;
+    const sizes = [];
+    let step = 'write';
+    let fd = null;
+    let archived = null;
+    let written = 0;
+    try {
+      fd = fs.openSync(tmp, 'wx');
+      let chunk = '';
+      const add = (line) => {
+        chunk += line;
+        if (chunk.length >= WRITE_CHUNK) { written += writeAll(fd, Buffer.from(chunk)); chunk = ''; }
+      };
+      for (const rec of this._heldRecords(file)) {
+        const line = JSON.stringify(rec) + '\n';
+        sizes.push([rec, Buffer.byteLength(line)]);
+        add(line);
+      }
+      if (file === WIT_FILE && this._selfId) {
+        // This node's own-witness memory, one line per attester, so a restart knows what it signed
+        // even when the witness itself is no longer held.
+        for (const [attester, set] of this._ownWitnessed) {
+          add(JSON.stringify({ type: OWN_WITNESSED, by: this._selfId, attester, positions: [...set].sort((x, y) => x - y) }) + '\n');
+        }
+      }
+      if (chunk) written += writeAll(fd, Buffer.from(chunk));
+      step = 'fsync';
+      fs.fsyncSync(fd);
+      const onDisk = fs.fstatSync(fd).size;
+      if (onDisk !== written) throw Object.assign(new Error(`${onDisk} of ${written} bytes on disk`), { code: 'ESHORTWRITE' });
+      fs.closeSync(fd);
+      fd = null;
+      step = 'archive';
+      archived = this._archive(live, base);
+      step = 'rename';
+      fs.renameSync(tmp, live);
+    } catch (err) {
+      if (fd !== null) { try { fs.closeSync(fd); } catch { /* closing */ } }
+      try { fs.unlinkSync(tmp); } catch { /* not made */ }
+      // An archive name left on the live log would grow with it: it is removed with the rest.
+      if (archived) { try { fs.unlinkSync(archived); } catch { /* best effort; a start removes it too */ } }
+      const wait = Math.max(this._rotateBytes, this._held[file]);
+      this._retryAt[file] = this._logBytes[file] + wait;
+      const code = (err && (err.code || err.message)) || String(err);
+      this._say(`rotate|${file}|${step}|${code}`, `${file} not rotated (${step}: ${code}); the live log is unchanged, retried after another ${wait} bytes`);
+      return false;
+    }
+    this._syncDir(this._dir);
+    for (const [rec, bytes] of sizes) this._recBytes.set(rec, bytes);
+    this._logBytes[file] = written;
+    this._held[file] = written;
+    this._retryAt[file] = 0;
+    this._rotations[file]++;
+    if (file === WIT_FILE) this._fromLog = new WeakSet();   // what waits is no longer in the live log
+    this._pruneArchive(base);
+    return true;
+  }
+
+  /** @private Put the live log into archive/ under a fresh name, never over an existing one.
+   *  @returns {string|null} the archive path, or null when there is no live log */
+  _archive(live, base) {
+    try { fs.statSync(live); } catch (e) { if (e.code === 'ENOENT') return null; throw e; }
+    const dir = path.join(this._dir, ARCHIVE_DIR);
+    fs.mkdirSync(dir, { recursive: true });
+    for (let tries = 0; tries < 8; tries++) {
+      const dest = path.join(dir, this._archiveName(dir, base));
+      try {
+        fs.linkSync(live, dest);   // EEXIST rather than replace
+      } catch (e) {
+        if (e.code === 'EEXIST') continue;
+        if (!NO_LINK.has(e.code)) throw e;
+        // No hard links here: copy it, never over an existing name, and make the copy durable before
+        // the live log is replaced.
+        try {
+          fs.copyFileSync(live, dest, fs.constants.COPYFILE_EXCL);
+          const cfd = fs.openSync(dest, 'r+');
+          try { fs.fsyncSync(cfd); } finally { fs.closeSync(cfd); }
+        } catch (c) {
+          if (c.code === 'EEXIST') continue;
+          try { fs.unlinkSync(dest); } catch { /* not made */ }
+          throw c;
+        }
+      }
+      this._syncDir(dir);
+      return dest;
+    }
+    throw Object.assign(new Error('no free archive name'), { code: 'EEXIST' });
+  }
+
+  /** @private A name no other rotation takes: the next sequence after every archive of this log on
+   *  disk (and every one this store made), then the time and this process's pid. */
+  _archiveName(dir, base) {
+    let seq = this._archiveSeq;
+    for (const f of this._archives(dir, base)) if (f.seq > seq) seq = f.seq;
+    this._archiveSeq = seq + 1;
+    const stamp = new Date().toISOString().replace(/[-:.]/g, '');
+    return `${base}.${String(this._archiveSeq).padStart(12, '0')}.${stamp}.${process.pid}.jsonl`;
+  }
+
+  /** @private One log's archives, oldest first: by sequence, then time, then pid, then name — a
+   *  total order that does not depend on file times. */
+  _archives(dir, base) {
+    let names;
+    try { names = fs.readdirSync(dir); } catch (e) { if (e.code === 'ENOENT') return []; throw e; }
+    const out = [];
+    for (const name of names) {
+      const m = ARCHIVE_NAME.exec(name);
+      if (m && m[1] === base) out.push({ name, file: path.join(dir, name), seq: Number(m[2]), stamp: m[3], pid: Number(m[4]) });
+    }
+    const cmp = (a, b) => (a < b ? -1 : a > b ? 1 : 0);
+    return out.sort((a, b) => a.seq - b.seq || cmp(a.stamp, b.stamp) || a.pid - b.pid || cmp(a.name, b.name));
+  }
+
+  /** @private Keep at most `maxArchiveBytes` of one log's archives, the newest included: the oldest
+   *  go first, and one that alone exceeds the bound goes too. A failed unlink stops the prune (a newer
+   *  archive is never deleted before an older one); it is said once and retried at the next rotation. */
+  _pruneArchive(base) {
+    try {
+      const files = [];
+      for (const f of this._archives(path.join(this._dir, ARCHIVE_DIR), base)) {
+        try { f.size = fs.statSync(f.file).size; files.push(f); } catch { /* gone */ }
+      }
+      let total = files.reduce((sum, f) => sum + f.size, 0);
+      for (const f of files) {
+        if (total <= this._maxArchiveBytes) break;
+        fs.unlinkSync(f.file);
+        total -= f.size;
+      }
+    } catch (err) {
+      const code = (err && (err.code || err.message)) || String(err);
+      this._say(`prune|${base}|${code}`, `archive of ${base} not pruned (${code}); retried at the next rotation`);
     }
   }
 
+  /** @private At start, undo what a rotation that crashed part way left: its temp file, and an archive
+   *  name still on the live log's inode (linked, but never renamed away from). Then each archive is
+   *  held to its bound. */
+  _tidy() {
+    let names = [];
+    try { names = fs.readdirSync(this._dir); } catch { return; }
+    for (const n of names) if (ROTATING_NAME.test(n)) { try { fs.unlinkSync(path.join(this._dir, n)); } catch { /* best effort */ } }
+    const dir = path.join(this._dir, ARCHIVE_DIR);
+    for (const file of LOGS) {
+      const base = file.slice(0, -'.jsonl'.length);
+      let archives = [];
+      try { archives = this._archives(dir, base); } catch { continue; }
+      if (archives.length === 0) continue;
+      let live = null;
+      try { live = fs.statSync(path.join(this._dir, file), { bigint: true }); } catch { /* none */ }
+      if (live && live.ino !== 0n) {
+        for (const f of archives) {
+          try {
+            const st = fs.statSync(f.file, { bigint: true });
+            if (st.ino === live.ino && st.dev === live.dev) fs.unlinkSync(f.file);
+          } catch { /* best effort */ }
+        }
+      }
+      this._pruneArchive(base);
+    }
+  }
+
+  /** @private fsync a directory, so a link or rename in it is durable. Best effort (not on Windows). */
+  _syncDir(dir) {
+    let fd = null;
+    try { fd = fs.openSync(dir, 'r'); fs.fsyncSync(fd); } catch { /* not supported here */ }
+    finally { if (fd !== null) { try { fs.closeSync(fd); } catch { /* closing */ } } }
+  }
+
+  /** @private Say a rotation problem once per distinct error. */
+  _say(key, msg) {
+    if (this._said.has(key)) return;
+    if (this._said.size >= 256) this._said.clear();
+    this._said.add(key);
+    try { this._logFn(msg); } catch { /* a log sink must not break gating */ }
+  }
+
   /** Sliding-window rate gate for ingested attestations, per (of, by). */
   _allowIngest(of, by, now) {
     const key = `${of}|${by}`;
@@ -442,7 +787,7 @@ class AttestationStore {
       this._order.delete(sig);
       if (!this._seen.delete(sig)) continue;
       const cmbIdx = this._byCmb.get(of);
-      if (cmbIdx) { cmbIdx.delete(sig); if (cmbIdx.size === 0) this._byCmb.delete(of); }
+      if (cmbIdx) { this._unkeep(ATT_FILE, cmbIdx.get(sig)); cmbIdx.delete(sig); if (cmbIdx.size === 0) this._byCmb.delete(of); }
       const chain = this._byAttester.get(by);
       if (chain) { chain.delete(seq); if (chain.size === 0) this._byAttester.delete(by); }
     }
diff --git a/lib/node.js b/lib/node.js
index f27f01d1..3fa5c7ca 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -243,7 +243,12 @@ class SymNode extends EventEmitter {
     // gated-CMB-key (the audit trail) and by attester chain (omission-evidence).
     // Persisted append-only under the node dir, so the cross-mesh audit trail
     // survives a restart instead of evaporating from memory.
-    this._attestations = new AttestationStore({ dir: path.join(this._dir, 'attestations'), selfId: this._identity.nodeId });
+    // The logs are rotated (archive/ bounded per log); a rotation that fails is said here once.
+    this._attestations = new AttestationStore({
+      dir: path.join(this._dir, 'attestations'),
+      selfId: this._identity.nodeId,
+      log: (m) => this._log(`[attestations] ${m}`),
+    });
     // Restore the per-attester chain cursor from the reloaded own-chain so `seq`
     // stays monotonic and `prev` keeps linking across restarts — otherwise a restart
     // would reset the chain to genesis and read as a gap (false omission). Genesis
diff --git a/tests/attestation-rotation.test.js b/tests/attestation-rotation.test.js
new file mode 100644
index 00000000..aaa9f070
--- /dev/null
+++ b/tests/attestation-rotation.test.js
@@ -0,0 +1,364 @@
+'use strict';
+
+/**
+ * 0.14.0: the attestation logs are rotated. A log is rotated once the bytes in it beyond the records
+ * the store holds exceed the larger of the rotation budget and the bytes held; the live log is
+ * complete at every instant; archive names never collide; archive/ is bounded per log, the newest
+ * archive included. The earlier, rejected attempts thrashed (a rotation on every append once the held
+ * set outgrew the budget), rotated on every start, renamed before writing, ignored short writes, left
+ * an archive name on the live log after a failure, clobbered archives made in one millisecond, and
+ * exempted the newest archive from the bound. Each case below fails on one of those.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const path = require('path');
+const { tmpdir } = require('./_tmpdir');
+const { AttestationStore } = require('../lib/attestation-store');
+
+const ATT = 'attestations.jsonl';
+const CP = 'checkpoints.jsonl';
+const WIT = 'witnesses.jsonl';
+
+/** An attestation of about 120 bytes. */
+const att = (i, by = 'A') => ({ of: `cmb-${i}`, by, seq: i, prev: 'p', sig: `sig-${by}-${i}`, pad: 'x'.repeat(60) });
+const lineOf = (o) => JSON.stringify(o) + '\n';
+const read = (dir, file) => { try { return fs.readFileSync(path.join(dir, file), 'utf8'); } catch { return ''; } };
+const archives = (dir) => { try { return fs.readdirSync(path.join(dir, 'archive')).sort(); } catch { return []; } };
+const archiveBytes = (dir) => archives(dir).reduce((s, n) => s + fs.statSync(path.join(dir, 'archive', n)).size, 0);
+const leftovers = (dir) => fs.readdirSync(dir).filter((n) => n.endsWith('.rotating'));
+
+/** Spy on a store's rotations: the bytes it had appended (in all) at each one. */
+function spyRotations(st, appended) {
+  const at = [];
+  const real = st._rotate;
+  st._rotate = function (file) { at.push({ file, appended: appended(), held: this._held[file] }); return real.call(this, file); };
+  return at;
+}
+
+describe('attestation log rotation — when', () => {
+  it('does not cascade when the records held exceed the budget', () => {
+    const dir = tmpdir('att-rot-cascade-');
+    // 200 held attestations are ~24 KB, twelve times the 2 KB budget.
+    const st = new AttestationStore({ dir, max: 200, rotateBytes: 2048, maxArchiveBytes: 1e9, log: () => {} });
+    let appended = 0;
+    const at = spyRotations(st, () => appended);
+    for (let i = 1; i <= 3000; i++) { const a = att(i); st.record(a); appended += Buffer.byteLength(lineOf(a)); }
+    const held = st._held[ATT];
+    assert.ok(held > 10 * 2048, `held ${held}`);
+    assert.ok(at.length >= 1, 'it does rotate');
+    // Each rotation needs more than max(budget, held) bytes appended and dropped since the last.
+    assert.ok(at.length <= Math.ceil(appended / held), `${at.length} rotations for ${appended} bytes appended, ${held} held`);
+    for (let i = 1; i < at.length; i++) {
+      assert.ok(at[i].appended - at[i - 1].appended > at[i - 1].held, `rotation ${i} came ${at[i].appended - at[i - 1].appended} bytes after the last`);
+    }
+    assert.strictEqual(st._rotations[ATT], at.length, 'every rotation succeeded');
+    assert.strictEqual(archives(dir).length, at.length, 'one archive per rotation');
+    const size = fs.statSync(path.join(dir, ATT)).size;
+    assert.ok(size <= 2 * held + 200, `the live log stays within held + max(budget, held): ${size}`);
+  });
+
+  it('does not rotate a log that holds little beyond its records, and does reclaim one that holds a lot', () => {
+    const dir = tmpdir('att-rot-small-');
+    const st = new AttestationStore({ dir, max: 50, rotateBytes: 4096, log: () => {} });
+    for (let i = 1; i <= 50; i++) st.record(att(i));        // 6 KB, all held: nothing to reclaim
+    assert.strictEqual(st._rotations[ATT], 0, 'a log of only held records is not rotated');
+    for (let i = 51; i <= 120; i++) st.record(att(i));      // 70 dropped: ~8.4 KB beyond the 6 KB held
+    assert.strictEqual(st._rotations[ATT], 1);
+    assert.strictEqual(read(dir, ATT).trim().split('\n').length <= 50 + 20, true);
+  });
+});
+
+describe('attestation log rotation — at start', () => {
+  it('a start of a log under budget does not rotate, even when the records held exceed the budget', () => {
+    const dir = tmpdir('att-rot-start-');
+    const opts = { dir, max: 200, rotateBytes: 2048, log: () => {} };
+    const st = new AttestationStore(opts);
+    for (let i = 1; i <= 700; i++) st.record(att(i));       // rotated at least once
+    assert.ok(st._rotations[ATT] >= 1);
+    const before = read(dir, ATT);
+    const arch = archives(dir);
+    for (let n = 0; n < 3; n++) {
+      const again = new AttestationStore(opts);
+      assert.strictEqual(again._rotations[ATT], 0, `restart ${n} did not rotate`);
+      assert.strictEqual(again.size(), 200);
+    }
+    assert.strictEqual(read(dir, ATT), before, 'the live log is untouched');
+    assert.deepStrictEqual(archives(dir), arch, 'and nothing was archived');
+  });
+
+  it('a start of a log over budget rotates it once (the storm log), keeping what is held', () => {
+    const dir = tmpdir('att-rot-storm-');
+    fs.writeFileSync(path.join(dir, CP), lineOf({ type: 'checkpoint', by: 'A', upto_seq: 8, root: 'r8', sig: 'c8' }));
+    const copies = [];
+    for (let i = 0; i < 5000; i++) copies.push(lineOf({ type: 'witness', attester: 'A', upto_seq: 8, root: 'r8', by: 'W', sig: `copy-${i % 2}`, at: i % 2 }));
+    fs.writeFileSync(path.join(dir, WIT), copies.join(''));
+    const st = new AttestationStore({ dir, rotateBytes: 8192, maxArchiveBytes: 1e9, log: () => {} });
+    assert.strictEqual(st._rotations[WIT], 1);
+    assert.strictEqual(read(dir, WIT), copies[0], 'the live log holds the one witness held');
+    assert.strictEqual(fs.readFileSync(path.join(dir, 'archive', archives(dir)[0]), 'utf8'), copies.join(''), 'the old log is archived whole');
+    const again = new AttestationStore({ dir, rotateBytes: 8192, maxArchiveBytes: 1e9, log: () => {} });
+    assert.strictEqual(again._rotations[WIT], 0, 'and the next start leaves it alone');
+    assert.strictEqual(again.witnessesFor('A', 8).length, 1);
+  });
+
+  it('the checkpoint and witness logs are read whole, so a quiet attester at the head of a rotated log survives a restart', () => {
+    const dir = tmpdir('att-rot-quiet-');
+    const opts = { dir, maxCheckpointsPerAttester: 2, maxAttesters: 4, rotateBytes: 4096, log: () => {} };
+    const st = new AttestationStore(opts);
+    st.recordCheckpoint({ by: 'Q', upto_seq: 1, root: 'rq', sig: 'cq' });   // a quiet attester
+    let n = 0;
+    while (st._rotations[CP] === 0) { n++; st.recordCheckpoint({ by: 'A', upto_seq: n, root: `r${n}`, sig: `c${n}` }); }
+    // Q is now at the head of the live log; A churns until just before the next rotation.
+    while (fs.statSync(path.join(dir, CP)).size - st._held[CP] < 4096 - 200) { n++; st.recordCheckpoint({ by: 'A', upto_seq: n, root: `r${n}`, sig: `c${n}` }); }
+    assert.strictEqual(st._rotations[CP], 1);
+    assert.ok(fs.statSync(path.join(dir, CP)).size > st._held[CP] * 4, 'the live log is mostly churn');
+    const again = new AttestationStore(opts);
+    assert.ok(again.checkpointAt('Q', 1), 'the quiet attester is still held');
+    assert.deepStrictEqual(again.checkpointsOf('A').map((c) => c.upto_seq), [n - 1, n]);
+  });
+
+  it('read budgets: the checkpoint and witness logs whole at their caps, attestations what their cap holds, no more than 0.13.16 read in all', () => {
+    const st = new AttestationStore();
+    const b = st._readBudget;
+    // Measured lines: an attestation ~520 bytes, a checkpoint ~315, a witness ~380.
+    assert.ok(b[ATT] >= 50000 * 520 * 1.3, `attestations ${b[ATT]}`);
+    assert.ok(b[CP] >= 2 * 32 * 1024 * 315 * 1.3, `checkpoints ${b[CP]}`);
+    assert.ok(b[WIT] >= 2 * (50000 * 380 + 1024 * 2048), `witnesses ${b[WIT]}`);
+    assert.ok(b[ATT] + b[CP] + b[WIT] <= (64 + 16 + 32) * 1024 * 1024, `in all ${b[ATT] + b[CP] + b[WIT]}`);
+  });
+
+  it('a rotation that crashed after linking is tidied at the next start', () => {
+    const dir = tmpdir('att-rot-crash-');
+    const st = new AttestationStore({ dir, log: () => {} });
+    for (let i = 1; i <= 5; i++) st.record(att(i));
+    const before = read(dir, ATT);
+    // What a crash between the link and the rename leaves: an archive name on the live inode, and the temp file.
+    fs.mkdirSync(path.join(dir, 'archive'));
+    fs.linkSync(path.join(dir, ATT), path.join(dir, 'archive', 'attestations.000000000001.20261002T000000000Z.1.jsonl'));
+    fs.writeFileSync(path.join(dir, `${ATT}.1.1.rotating`), 'partial');
+    const again = new AttestationStore({ dir, log: () => {} });
+    assert.deepStrictEqual(archives(dir), [], 'the archive name on the live log is removed');
+    assert.deepStrictEqual(leftovers(dir), [], 'and so is the temp file');
+    assert.strictEqual(read(dir, ATT), before, 'the live log is untouched');
+    assert.strictEqual(again.size(), 5);
+  });
+});
+
+describe('attestation log rotation — how', () => {
+  /** A store about to rotate its attestation log on the next record. */
+  function nearRotation(extra = {}) {
+    const dir = tmpdir('att-rot-fail-');
+    const said = [];
+    const st = new AttestationStore({ dir, max: 20, rotateBytes: 2048, maxArchiveBytes: 1e9, log: (m) => said.push(m), ...extra });
+    let i = 0;
+    st.record(att(++i));
+    while (fs.statSync(path.join(dir, ATT)).size - st._held[ATT] + 130 <= Math.max(2048, st._held[ATT])) st.record(att(++i));
+    assert.strictEqual(st._rotations[ATT], 0);
+    return { dir, st, said, next: () => att(++i) };
+  }
+
+  /** Make one fs call fail, for the rotation's temp file only (appends to the live log go on). */
+  function onTemp(name, fail) {
+    const realOpen = fs.openSync;
+    const real = fs[name];
+    const temps = new Set();
+    fs.openSync = (p, ...a) => { const fd = realOpen(p, ...a); if (String(p).endsWith('.rotating')) temps.add(fd); return fd; };
+    fs[name] = (fd, ...a) => (temps.has(fd) ? fail(fd, ...a) : real(fd, ...a));
+    return () => { fs.openSync = realOpen; fs[name] = real; };
+  }
+  const failures = {
+    'opening the temp file': () => { const real = fs.openSync; fs.openSync = (p, ...a) => { if (String(p).endsWith('.rotating')) throw Object.assign(new Error('no'), { code: 'EMFILE' }); return real(p, ...a); }; return () => { fs.openSync = real; }; },
+    'writing it': () => onTemp('writeSync', () => { throw Object.assign(new Error('full'), { code: 'ENOSPC' }); }),
+    'a write that makes no progress': () => onTemp('writeSync', () => 0),
+    'fsyncing it': () => onTemp('fsyncSync', () => { throw Object.assign(new Error('io'), { code: 'EIO' }); }),
+    'linking the old log into the archive': () => { const real = fs.linkSync; fs.linkSync = () => { throw Object.assign(new Error('io'), { code: 'EIO' }); }; return () => { fs.linkSync = real; }; },
+    'renaming it over the live log': () => { const real = fs.renameSync; fs.renameSync = () => { throw Object.assign(new Error('busy'), { code: 'EBUSY' }); }; return () => { fs.renameSync = real; }; },
+  };
+
+  for (const [step, inject] of Object.entries(failures)) {
+    it(`a failure ${step} leaves the live log complete, is said once, and is retried after another budget`, () => {
+      const { dir, st, said, next } = nearRotation();
+      const before = read(dir, ATT);
+      const arch = archives(dir);
+      const calls = spyRotations(st, () => 0);
+      const restore = inject();
+      let a;
+      try { a = next(); st.record(a); } finally { restore(); }
+      assert.strictEqual(calls.length, 1, 'a rotation was attempted');
+      assert.strictEqual(st._rotations[ATT], 0, 'and failed');
+      assert.strictEqual(read(dir, ATT), before + lineOf(a), 'the live log is every line appended, whole');
+      assert.deepStrictEqual(archives(dir), arch, 'no archive name is left (none on the live log)');
+      assert.deepStrictEqual(leftovers(dir), [], 'no temp file is left');
+      assert.strictEqual(said.length, 1, said.join('\n'));
+      // Not retried on the next append, only after another budget.
+      const restore2 = inject();
+      try {
+        for (let k = 0; k < 5; k++) st.record(next());
+        assert.strictEqual(calls.length, 1, 'not retried at once');
+        while (calls.length === 1) st.record(next());
+      } finally { restore2(); }
+      assert.strictEqual(calls.length, 2, 'retried after another budget');
+      assert.strictEqual(said.length, 1, 'the same error is said once');
+      while (st._rotations[ATT] === 0) st.record(next());   // and once it can, it does
+      const again = new AttestationStore({ dir, max: 20, rotateBytes: 2048, log: () => {} });
+      assert.deepStrictEqual(again.chainOf('A').map((x) => x.seq), st.chainOf('A').map((x) => x.seq), 'nothing held was lost');
+    });
+  }
+
+  it('a short write is completed, never installed short', () => {
+    const { dir, st, next } = nearRotation();
+    const real = fs.writeSync;
+    const restore = onTemp('writeSync', (fd, buf, off, len, ...rest) => real(fd, buf, off, Math.min(len, 100), ...rest));
+    try { st.record(next()); } finally { restore(); }
+    assert.strictEqual(st._rotations[ATT], 1);
+    const expected = [...st._heldRecords(ATT)].map(lineOf).join('');
+    assert.strictEqual(read(dir, ATT), expected, 'the live log is every record held');
+  });
+
+  it('archive names never collide: rotations in one millisecond, two stores on one directory, a name already taken', () => {
+    const realIso = Date.prototype.toISOString;
+    Date.prototype.toISOString = () => '2026-10-02T00:00:00.000Z';   // every rotation in the same millisecond
+    try {
+      const { dir, st, next } = nearRotation();
+      for (let k = 0; k < 400; k++) st.record(next());
+      const made = st._rotations[ATT];
+      assert.ok(made >= 3, `${made} rotations`);
+      assert.strictEqual(archives(dir).length, made, 'one archive per rotation');
+      // A second store on the same directory rotating in turn with the first.
+      const other = new AttestationStore({ dir, max: 20, rotateBytes: 2048, maxArchiveBytes: 1e9, log: () => {} });
+      let j = 100000;
+      while (other._rotations[ATT] < 2) other.record(att(++j, 'B'));
+      while (st._rotations[ATT] < made + 2) st.record(next());
+      assert.strictEqual(archives(dir).length, made + 4, 'every rotation kept its own archive');
+      // A name taken by someone else between its choice and the link is refused, not overwritten.
+      const realName = st._archiveName;
+      let taken = null;
+      st._archiveName = function (...a) {
+        const name = realName.apply(this, a);
+        if (!taken) { taken = path.join(dir, 'archive', name); fs.writeFileSync(taken, 'not yours\n'); }
+        return name;
+      };
+      while (st._rotations[ATT] < made + 3) st.record(next());
+      assert.strictEqual(fs.readFileSync(taken, 'utf8'), 'not yours\n', 'an existing name is never overwritten');
+      assert.strictEqual(archives(dir).length, made + 4 + 2, 'and the rotation took another');
+    } finally { Date.prototype.toISOString = realIso; }
+  });
+
+  it('where the filesystem has no hard links, the old log is copied', () => {
+    const { dir, st, next } = nearRotation();
+    const before = read(dir, ATT);
+    const real = fs.linkSync;
+    fs.linkSync = () => { throw Object.assign(new Error('no links'), { code: 'EPERM' }); };
+    let a;
+    try { a = next(); st.record(a); } finally { fs.linkSync = real; }
+    assert.strictEqual(st._rotations[ATT], 1);
+    assert.strictEqual(fs.readFileSync(path.join(dir, 'archive', archives(dir)[0]), 'utf8'), before + lineOf(a), 'the archive is the old log, whole');
+  });
+});
+
+describe('attestation log rotation — the archive bound', () => {
+  it('holds including the newest archive', () => {
+    const dir = tmpdir('att-rot-bound-');
+    const bound = 12 * 1024;
+    const st = new AttestationStore({ dir, max: 20, rotateBytes: 2048, maxArchiveBytes: bound, log: () => {} });
+    const at = spyRotations(st, () => 0);
+    for (let i = 1; i <= 3000; i++) {
+      st.record(att(i));
+      if (at.length && i % 50 === 0) assert.ok(archiveBytes(dir) <= bound, `archive ${archiveBytes(dir)} > ${bound}`);
+    }
+    assert.ok(st._rotations[ATT] > 20, `${st._rotations[ATT]} rotations`);
+    assert.ok(archiveBytes(dir) <= bound && archives(dir).length >= 1);
+  });
+
+  it('an archive that alone exceeds the bound is dropped too', () => {
+    const dir = tmpdir('att-rot-bound1-');
+    const st = new AttestationStore({ dir, max: 20, rotateBytes: 2048, maxArchiveBytes: 1024, log: () => {} });
+    for (let i = 1; i <= 200; i++) st.record(att(i));
+    assert.ok(st._rotations[ATT] >= 1);
+    assert.deepStrictEqual(archives(dir), [], 'nothing over the bound is kept, the newest included');
+  });
+
+  it('prunes oldest first by sequence, whatever the file times', () => {
+    const dir = tmpdir('att-rot-order-');
+    fs.mkdirSync(path.join(dir, 'archive'));
+    const name = (seq) => `attestations.${String(seq).padStart(12, '0')}.20261002T000000000Z.1.jsonl`;
+    const t = new Date('2026-10-01T00:00:00Z');
+    for (const seq of [2, 9, 10, 11]) {
+      const p = path.join(dir, 'archive', name(seq));
+      fs.writeFileSync(p, 'x'.repeat(1000) + '\n');
+      // Equal times for 9, 10 and 11; the newest made to look the oldest.
+      fs.utimesSync(p, t, seq === 11 ? new Date('2026-09-01T00:00:00Z') : t);
+    }
+    new AttestationStore({ dir, maxArchiveBytes: 2100, log: () => {} });   // a start holds the bound
+    assert.deepStrictEqual(archives(dir), [name(10), name(11)], 'the two newest by sequence are kept');
+  });
+});
+
+describe('attestation log rotation — nothing held is lost', () => {
+  it('a restart after rotating every log rebuilds the same store: chains, checkpoints and their order, conflicts, witnesses, and what this node witnessed', () => {
+    const dir = tmpdir('att-rot-same-');
+    const opts = { dir, selfId: 'me', max: 40, maxCheckpointsPerAttester: 3, maxAttesters: 4, maxWitnesses: 12, maxWitnessesPerPosition: 2, rotateBytes: 1024, log: () => {} };
+    const st = new AttestationStore(opts);
+    for (let i = 1; i <= 100; i++) st.record(att(i, i % 2 ? 'A' : 'B'));
+    st.recordCheckpoint({ by: 'Q', upto_seq: 5, root: 'rq', sig: 'cq' });
+    st.recordCheckpoint({ by: 'Q', upto_seq: 5, root: 'forked', sig: 'xq' });      // a conflict on a held position
+    st.recordWitness({ attester: 'Q', upto_seq: 5, root: 'rq', by: 'W1', sig: 'wq1' });
+    st.recordWitness({ attester: 'Q', upto_seq: 5, root: 'rq', by: 'W2', sig: 'wq2' });
+    st.recordWitness({ attester: 'Q', upto_seq: 5, root: 'rq', by: 'me', sig: 'mine-full' });   // its position is full
+    for (let n = 1; n <= 60; n++) {
+      st.recordCheckpoint({ by: 'A', upto_seq: n, root: `ra${n}`, sig: `ca${n}` });
+      st.recordWitness({ attester: 'A', upto_seq: n, root: `ra${n}`, by: 'me', sig: `ma${n}` });
+      st.recordWitness({ attester: 'A', upto_seq: n, root: `ra${n}`, by: 'W1', sig: `wa${n}` });
+    }
+    for (const f of [ATT, CP, WIT]) assert.ok(st._rotations[f] >= 1, `${f} rotated`);
+    const snap = (s) => ({
+      chains: [s.chainOf('A').map((a) => a.sig), s.chainOf('B').map((a) => a.sig)],
+      attesters: [...s._checkpoints.keys()],
+      checkpoints: ['Q', 'A'].map((by) => s.checkpointsOf(by).map((c) => [c.upto_seq, c.root])),
+      conflicted: s.hasConflict('Q', 5),
+      positions: s._positions.map((p) => p.join(':')),
+      witnesses: s._positions.map(([a, seq]) => s.witnessesFor(a, seq).map((w) => w.sig)),
+      own: [s.hasWitnessed('Q', 5, 'me'), s.hasWitnessed('A', 1, 'me'), s.hasWitnessed('A', 60, 'me')],
+    });
+    const before = snap(st);
+    assert.deepStrictEqual(before.own, [true, true, true]);
+    assert.strictEqual(before.conflicted, true);
+    const again = new AttestationStore(opts);
+    assert.deepStrictEqual(snap(again), before);
+    for (const f of [ATT, CP, WIT]) assert.strictEqual(again._rotations[f], 0, `${f} not rotated again at start`);
+  });
+
+  it('a waiting witness read from the log is appended when promoted after its log was rotated', () => {
+    const dir = tmpdir('att-rot-wait-');
+    const opts = { dir, maxCheckpointsPerAttester: 2, rotateBytes: 1024, log: () => {} };
+    fs.writeFileSync(path.join(dir, WIT), lineOf({ attester: 'Z', upto_seq: 3, root: 'rz', by: 'W', sig: 'wz' }));
+    const st = new AttestationStore(opts);   // the witness waits for Z's checkpoint
+    st.recordCheckpoint({ by: 'A', upto_seq: 1, root: 'r1', sig: 'c1' });
+    for (let n = 1; st._rotations[WIT] === 0; n++) {
+      st.recordCheckpoint({ by: 'A', upto_seq: n, root: `r${n}`, sig: `c${n}` });
+      st.recordWitness({ attester: 'A', upto_seq: n, root: `r${n}`, by: 'W', sig: `w${n}` });
+    }
+    assert.ok(!read(dir, WIT).includes('"wz"'), 'the waiting witness is not in the rotated log');
+    st.recordCheckpoint({ by: 'Z', upto_seq: 3, root: 'rz', sig: 'cz' });
+    assert.ok(read(dir, WIT).includes('"wz"'), 'promoted, it is appended');
+    assert.strictEqual(new AttestationStore(opts).witnessesFor('Z', 3).length, 1);
+  });
+});
+
+describe('conflicts are held with their positions', () => {
+  it("a held position's conflict is not pushed out by another attester's conflicts on positions since dropped", () => {
+    const st = new AttestationStore({ maxCheckpointsPerAttester: 2, maxAttesters: 4 });
+    st.recordCheckpoint({ by: 'A', upto_seq: 1, root: 'r', sig: 'a1' });
+    st.recordCheckpoint({ by: 'A', upto_seq: 1, root: 'fork', sig: 'a1x' });
+    for (let q = 1; q <= 100; q++) {   // B commits and forks position after position; each is dropped two later
+      st.recordCheckpoint({ by: 'B', upto_seq: q, root: 'r', sig: `b${q}` });
+      st.recordCheckpoint({ by: 'B', upto_seq: q, root: 'fork', sig: `b${q}x` });
+    }
+    assert.strictEqual(st.hasConflict('A', 1), true, "A's position is still held, and so is its conflict");
+    assert.strictEqual(st.recordCheckpoint({ by: 'A', upto_seq: 1, root: 'fork', sig: 'again' }).first, false, 'not reported again');
+    assert.strictEqual(st.hasConflict('B', 1), false, 'a dropped position took its conflict with it');
+    assert.strictEqual([...st._conflicted.values()].reduce((n, m) => n + m.size, 0), 3, 'only held positions are counted');
+  });
+});

From 2ac2f9b75896a19fe7f6262cc0bed0d17053264a Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Fri, 2 Oct 2026 02:23:25 +0100
Subject: [PATCH 056/148] 0.14.0: one peer's attestation gossip has a budget of
 new statements

Attestations, checkpoints and witnesses one peer delivers may make this node
check at most 2,000 new statements a second after a burst of 10,000; past
that a frame is dropped before its signature is checked. A busy room (32
nodes gating 4 CMBs a second) makes 640 new statements a second in all, which
is what a peer delivers first only when it is this node's sole path to the
room (about 20 otherwise).

Only a new statement spends it: repeats (an attestation's signature compared
by its bytes, so a re-spelling is a repeat; a checkpoint or witness held,
waiting, or already refused as a conflict), stale checkpoints, unsigned
frames and unknown signers are dropped first, for nothing. The bucket is the
delivering peer's, so a forgery spends only its sender's budget, and a dropped
frame marks nothing, so another peer's copy is taken; the bucket refills.

Drops are said with the peer named at most once per 10 s, the rest of the
window when it closes (gossip-over-budget). Buckets: at most 4,096 peers,
least recently active evicted in O(1). The waiting-witness set is keyed, so
its lookups are O(1). The frame handler says a dropped attestation once a
minute per peer and reason.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 CHANGELOG.md                |  32 ++++
 lib/attestation-store.js    |  90 +++++++----
 lib/frame-handler.js        |  22 ++-
 lib/node.js                 | 123 +++++++++++++--
 tests/gossip-budget.test.js | 297 ++++++++++++++++++++++++++++++++++++
 5 files changed, 524 insertions(+), 40 deletions(-)
 create mode 100644 tests/gossip-budget.test.js

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 18a931eb..7d8f095d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -165,6 +165,38 @@ debt, and the daemon's log flood. Every item has a test that fails without its f
   32,768-entry list also counted positions already dropped, so another attester's conflicts could push
   out the mark of a position still held.
 
+### Fixed — one peer's attestation gossip has a budget
+
+- **A peer's new statements are budgeted (0.13.15's other known limit).** The attestations,
+  checkpoints and witnesses one peer delivers may make this node check at most 2,000 new statements a
+  second, after a burst of 10,000. Past that a frame is dropped before its signature is checked, so no
+  peer buys more signature checks than that (~40 µs each: under a tenth of a core). Attestations are
+  covered as well as checkpoints and witnesses.
+- **Only a new statement spends it.** These are dropped first, for nothing: a repeat (an attestation
+  whose signature is held, however it is spelled; a checkpoint or witness held, waiting for its
+  checkpoint, or already refused as a conflict), a checkpoint older than every position held, an
+  unsigned frame, and a frame whose signer's key this node does not hold.
+- **Sized above a busy room.** A room of R nodes, each gating G CMBs a second, makes R·G
+  attestations, R·G/8 checkpoints and R·G/8·(R−1) witnesses a second: 640 at R = 32, G = 4. Only the
+  first copy of a statement is new, so a peer spends the budget only for what it delivers first:
+  about what it signs itself (~20 a second there), and at most all 640 when it is this node's only
+  path to the room. 2,000 is three times that. `gossipBudget: { perSecond, burst }` changes it.
+- **Forged frames cannot starve genuine ones.** The budget is the delivering peer's, never the claimed
+  signer's, so a forged frame spends only its sender's budget. An honest peer relays only what it has
+  verified, so its budget is never spent on forgeries. A dropped frame is not marked seen, so the same
+  statement from another peer is taken. The budget refills, so a peer that stops flooding is heard
+  again.
+- **A drop is attributable.** A `gossip-over-budget` metric (`fromPeerId`, `from`, `dropped`,
+  `frames` by type, and up to 16 `authors` whose statements were dropped) and one log line name the
+  peer, at most once per 10 s per peer: the first drop at once, the rest when the 10 s close, so every
+  drop is counted. A gap it leaves is told apart from an omission by the attester. Budgets are kept for
+  at most 4,096 peers, the least recently active evicted in O(1), without scanning.
+- **An attestation is de-duplicated by its signature's bytes.** Base64url decoding ignores padding,
+  whitespace and stray characters. One signature could be spelled any number of ways that all verify,
+  and each spelling was stored and relayed as a new attestation.
+- **A dropped attestation is logged once a minute per peer and reason, with a count.** It was logged
+  once per frame, and one naming a signer whose key is not held is dropped before any budget.
+
 ### Fixed — dependencies
 
 - `npm audit` is clean. Floors are raised past the vulnerable versions, because `overrides` do not
diff --git a/lib/attestation-store.js b/lib/attestation-store.js
index f4e44284..51a6d41f 100644
--- a/lib/attestation-store.js
+++ b/lib/attestation-store.js
@@ -74,6 +74,23 @@ const WRITE_CHUNK = 1 << 20;
 /** A checkpoint position: a non-negative integer, never its text spelling. */
 const isPosition = (n) => Number.isSafeInteger(n) && n >= 0;
 
+/** The key a witness is held or waits under: (attester, position, witness), unambiguous for any ids. */
+const witnessKey = (attester, upto_seq, by) => JSON.stringify([attester, upto_seq, by]);
+
+/** An Ed25519 signature as its signer writes it: 64 bytes in unpadded base64url (86 characters, the
+ *  last one carrying two bits). */
+const CANONICAL_SIG = /^[A-Za-z0-9_-]{85}[AQgw]$/;
+
+/** The key an attestation is de-duplicated by: its signature's bytes, not its spelling. Base64url
+ *  decoding ignores padding, whitespace and stray characters, so one signature can be spelled any
+ *  number of ways that all verify; each spelling was a new attestation, stored and relayed. A string
+ *  that is not a 64-byte signature is its own key. */
+function sigKey(sig) {
+  if (typeof sig !== 'string' || sig.length < 86 || CANONICAL_SIG.test(sig)) return sig;
+  const bytes = Buffer.from(sig, 'base64url');
+  return bytes.length === 64 ? bytes.toString('base64url') : sig;
+}
+
 /** Write a whole buffer to a file descriptor: a write may be short. @returns {number} bytes written */
 function writeAll(fd, buf) {
   let off = 0;
@@ -109,10 +126,10 @@ class AttestationStore {
    *   (attestations + checkpoints + witnesses) survives a node restart.
    */
   constructor(opts = {}) {
-    this._byCmb = new Map();       // of  -> Map(sig -> att)
+    this._byCmb = new Map();       // of  -> Map(sigKey -> att)
     this._byAttester = new Map();  // by  -> Map(seq -> att)
-    this._seen = new Set();        // sig -> dedup / relay-once
-    this._order = new Map();       // sig -> { of, by, seq }, insertion order, for O(1) eviction
+    this._seen = new Set();        // sigKey -> dedup / relay-once
+    this._order = new Map();       // sigKey -> { of, by, seq }, insertion order, for O(1) eviction
     this._max = opts.max || 50000;
     // Per-(of,by) ingest rate-limit — bounds a Sybil/flood of attestations about a
     // single CMB on the immutable log (research's DoS-at-ingest finding). Applies
@@ -132,10 +149,10 @@ class AttestationStore {
     this._witnessCount = 0;
     this._maxWitnesses = opts.maxWitnesses || 50000;
     this._maxWitnessesPerPosition = opts.maxWitnessesPerPosition || 256;
-    this._pending = new Set();     // witnesses whose checkpoint has not arrived yet (memory only)
+    this._pending = new Map();     // witnessKey -> witness whose checkpoint has not arrived yet (memory only)
     this._maxPending = opts.maxPending || 2048;
     this._ownWitnessed = new Map(); // attester -> Set(upto_seq) this node has witnessed itself
-    this._witnessConflicts = new Set(); // JSON [attester, upto_seq, by] already reported, bounded
+    this._witnessConflicts = new Map(); // witnessKey -> the other root, already reported; bounded
     this._fromLog = new WeakSet();  // waiting witnesses read from the live log (already in it)
     this._rateCalls = 0;
     // Durable, append-only persistence (compliance: a log is never edited, only appended to; a
@@ -179,8 +196,8 @@ class AttestationStore {
   }
 
   /**
-   * Record an (already signature-verified) attestation. Idempotent — a sig already
-   * seen is a no-op, so relay/replay converge rather than duplicate.
+   * Record an (already signature-verified) attestation. Idempotent — a signature already
+   * seen, however it is spelled, is a no-op, so relay/replay converge rather than duplicate.
    * @param {object} att
    * @param {object} [opts]
    * @param {boolean} [opts.ingested=false] true when received from a peer (gossip) —
@@ -192,17 +209,18 @@ class AttestationStore {
     if (!att || !att.sig || !att.of || !att.by || att.seq === undefined) {
       return { stored: false, reason: 'malformed' };
     }
-    if (this._seen.has(att.sig)) return { stored: false, reason: 'duplicate' };
+    const key = sigKey(att.sig);
+    if (this._seen.has(key)) return { stored: false, reason: 'duplicate' };
     if (opts.ingested && !this._allowIngest(att.of, att.by, opts.now ?? Date.now())) {
       return { stored: false, reason: 'rate-limited' };
     }
 
-    this._seen.add(att.sig);
-    this._order.set(att.sig, { of: att.of, by: att.by, seq: att.seq });
+    this._seen.add(key);
+    this._order.set(key, { of: att.of, by: att.by, seq: att.seq });
 
     let cmbIdx = this._byCmb.get(att.of);
     if (!cmbIdx) { cmbIdx = new Map(); this._byCmb.set(att.of, cmbIdx); }
-    cmbIdx.set(att.sig, att);
+    cmbIdx.set(key, att);
 
     let chain = this._byAttester.get(att.by);
     if (!chain) { chain = new Map(); this._byAttester.set(att.by, chain); }
@@ -226,7 +244,8 @@ class AttestationStore {
     return chain ? [...chain.values()].sort((a, b) => a.seq - b.seq) : [];
   }
 
-  has(sig) { return this._seen.has(sig); }
+  /** Whether an attestation with this signature is held, however the signature is spelled. */
+  has(sig) { return this._seen.has(sigKey(sig)); }
   size() { return this._seen.size; }
 
   /**
@@ -300,8 +319,8 @@ class AttestationStore {
     this._checkpoints.delete(cp.by);
     this._checkpoints.set(cp.by, m);
     this._keep(CP_FILE, cp);
-    for (const w of [...this._pending]) {
-      if (w.attester === cp.by && w.upto_seq === cp.upto_seq) { this._pending.delete(w); this.recordWitness(w); }
+    for (const [k, w] of [...this._pending]) {
+      if (w.attester === cp.by && w.upto_seq === cp.upto_seq) { this._pending.delete(k); this.recordWitness(w); }
     }
     this._maybeRotate(CP_FILE);
     if (dropped) this._maybeRotate(WIT_FILE);   // witnesses went with the dropped positions
@@ -326,14 +345,15 @@ class AttestationStore {
       return { stored: false, reason: 'conflict', keptRoot: existing.root, first: this._noteWitnessConflict(w) };
     }
     if (!this.checkpointAt(w.attester, w.upto_seq)) {
-      for (const p of this._pending) {
-        if (p.attester !== w.attester || p.upto_seq !== w.upto_seq || p.by !== w.by) continue;
+      const k = witnessKey(w.attester, w.upto_seq, w.by);
+      const p = this._pending.get(k);
+      if (p) {
         if (p.root === w.root) return { stored: false, reason: 'duplicate' };
         return { stored: false, reason: 'conflict', keptRoot: p.root, first: this._noteWitnessConflict(w) };
       }
       if (this._loading) { this._fromLog.add(w); this._recBytes.set(w, this._replayBytes); }
-      this._pending.add(w);
-      if (this._pending.size > this._maxPending) this._pending.delete(this._pending.values().next().value);
+      this._pending.set(k, w);
+      if (this._pending.size > this._maxPending) this._pending.delete(this._pending.keys().next().value);
       return { stored: false, reason: 'pending' };
     }
     let byPos = this._witnesses.get(w.attester);
@@ -359,12 +379,13 @@ class AttestationStore {
     return { stored: true };
   }
 
-  /** @private Remember a witness conflict once; bounded. @returns {boolean} whether it is newly seen */
+  /** @private Remember a witness conflict, and the root it asserted, once; bounded.
+   *  @returns {boolean} whether it is newly seen */
   _noteWitnessConflict(w) {
-    const k = JSON.stringify([w.attester, w.upto_seq, w.by]);
+    const k = witnessKey(w.attester, w.upto_seq, w.by);
     if (this._witnessConflicts.has(k)) return false;
-    this._witnessConflicts.add(k);
-    if (this._witnessConflicts.size > 1024) this._witnessConflicts.delete(this._witnessConflicts.values().next().value);
+    this._witnessConflicts.set(k, w.root);
+    if (this._witnessConflicts.size > 1024) this._witnessConflicts.delete(this._witnessConflicts.keys().next().value);
     return true;
   }
 
@@ -425,19 +446,36 @@ class AttestationStore {
   /** Whether a second, different root was refused for (by, upto_seq). */
   hasConflict(by, upto_seq) { return !!this._conflicted.get(by)?.has(upto_seq); }
 
+  /** The refused copy with the other root for a held (by, upto_seq), or null. */
+  conflictAt(by, upto_seq) { return this._conflicted.get(by)?.get(upto_seq) || null; }
+
   /** The checkpoint held for (by, upto_seq), or null. */
   checkpointAt(by, upto_seq) { return this._checkpoints.get(by)?.get(upto_seq) || null; }
 
+  /** Whether a checkpoint for (by, upto_seq) would be refused as older than every position held. O(32). */
+  isStale(by, upto_seq) {
+    const m = this._checkpoints.get(by);
+    if (!m || m.size < this._maxCheckpointsPerAttester || m.has(upto_seq)) return false;
+    for (const k of m.keys()) if (k < upto_seq) return false;
+    return true;
+  }
+
   /** The witness `by` holds for (attester, upto_seq), or null. */
   witnessAt(attester, upto_seq, by) { return this._witnesses.get(attester)?.get(upto_seq)?.get(by) || null; }
 
+  /** The witness `by` holds or has waiting for (attester, upto_seq), or null. O(1). */
+  witnessSeen(attester, upto_seq, by) {
+    return this.witnessAt(attester, upto_seq, by) || this._pending.get(witnessKey(attester, upto_seq, by)) || null;
+  }
+
+  /** The other root `by` was refused for, for (attester, upto_seq), while that is remembered; or null. */
+  witnessConflictRoot(attester, upto_seq, by) { return this._witnessConflicts.get(witnessKey(attester, upto_seq, by)) ?? null; }
+
   /** Whether `by` has witnessed (attester, upto_seq) already, in any copy. For this node itself it
    *  also counts a witness its index has since dropped. */
   hasWitnessed(attester, upto_seq, by) {
     if (this._selfId && by === this._selfId && this._ownWitnessed.get(attester)?.has(upto_seq)) return true;
-    if (this.witnessAt(attester, upto_seq, by) !== null) return true;
-    for (const p of this._pending) if (p.attester === attester && p.upto_seq === upto_seq && p.by === by) return true;
-    return false;
+    return this.witnessSeen(attester, upto_seq, by) !== null;
   }
 
   /** An attester's checkpoints, ordered by upto_seq. */
@@ -794,4 +832,4 @@ class AttestationStore {
   }
 }
 
-module.exports = { AttestationStore, chainHash, isPosition };
+module.exports = { AttestationStore, chainHash, isPosition, sigKey };
diff --git a/lib/frame-handler.js b/lib/frame-handler.js
index c36ab825..64343c77 100644
--- a/lib/frame-handler.js
+++ b/lib/frame-handler.js
@@ -102,6 +102,7 @@ class FrameHandler {
     this._node = node;
     this._cliHostMode = opts.cliHostMode || false;
     this._unsignedWarned = new Set();
+    this._attDropSaid = new Map(); // `${peerId}|${reason}` -> { at, more }: a dropped attestation is said once a minute
     // THE ADMISSION SEAM (sym-core split). Frame routing is open; the engine that judges an
     // inbound block is injectable. Stock nodes run the open §9.2 baseline; a consumer may
     // substitute its own engine with the same call contract. The post-admission observer is a
@@ -1593,12 +1594,23 @@ class FrameHandler {
     const att = msg && msg.attestation;
     if (!att) return;
     const r = this._node._ingestAttestation(att, peerId, peerName);
-    if (!r.ok && r.reason && r.reason !== 'duplicate' && r.reason !== 'rate-limited') {
-      this._node._log(`Attestation from ${peerName} dropped (${r.reason}) — of:${String(att.of).slice(0, 12)} by:${String(att.by).slice(0, 8)}`);
-      if (r.reason === 'bad-signature') {
-        this._node.emit('metric', { type: 'attestation-rejected', from: peerName, of: att.of, by: att.by, reason: 'invalid' });
-      }
+    // A repeat, a copy past the per-CMB limit, and one past the peer's budget (which says its own
+    // drops) are quiet.
+    if (r.ok || !r.reason || r.reason === 'duplicate' || r.reason === 'rate-limited' || r.reason === 'over-budget') return;
+    if (r.reason === 'bad-signature') {
+      this._node.emit('metric', { type: 'attestation-rejected', from: peerName, of: att.of, by: att.by, reason: 'invalid' });
     }
+    // A peer naming signers this node holds no key for is dropped before any budget, so the line is
+    // said once a minute per peer and reason, with how many more there were, not once per frame.
+    const k = `${peerId}|${r.reason}`;
+    const now = Date.now();
+    const said = this._attDropSaid.get(k);
+    if (said && now - said.at < 60_000) { said.more++; return; }
+    this._attDropSaid.delete(k);
+    if (this._attDropSaid.size >= 1024) this._attDropSaid.delete(this._attDropSaid.keys().next().value);
+    this._attDropSaid.set(k, { at: now, more: 0 });
+    const more = said && said.more ? ` (and ${said.more} more since it was last said)` : '';
+    this._node._log(`Attestation from ${peerName} dropped (${r.reason}) — of:${String(att.of).slice(0, 12)} by:${String(att.by).slice(0, 8)}${more}`);
   }
 
   /**
diff --git a/lib/node.js b/lib/node.js
index 3fa5c7ca..5a06aac2 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -88,6 +88,28 @@ function summarizeTally(tally, totalWeight) {
 function peerReachedOnlyOverRelay(peer) {
   return !!(peer && peer.transports) && peer.transport === peer.transports.get('relay');
 }
+
+/**
+ * One peer's budget of NEW gossiped statements (attestations, checkpoints, witnesses): a burst, then a
+ * rate a second, spent before the signature is checked, so no peer can buy more signature checks than
+ * this. A repeat, a malformed frame, one for a signer whose key is not held, or a stale checkpoint is
+ * dropped before it, for nothing.
+ *
+ * Sizing. A room of R nodes, each gating G CMBs a second, makes R·G attestations, R·G/8 checkpoints
+ * (one per 8 attestations) and R·G/8·(R−1) witnesses a second. A busy room, R = 32 and G = 4, makes
+ * 128 + 16 + 496 = 640 new statements a second in all. Relaying repeats every one to every node, but
+ * only the first copy of a statement is new, so a peer spends this node's budget only for what it
+ * delivers first: about what it signs itself, G·(1 + R/8) = 20 a second, and at most all 640 when it
+ * is this node's only path to the room. 2,000 a second is 3× that worst case and 100× the usual; a
+ * flood buys at most 2,000 checks a second per peer (one costs ~40 µs: under a tenth of a core).
+ */
+const GOSSIP_PER_SECOND = 2000;
+const GOSSIP_BURST = 10000;
+/** A peer's dropped statements are said at most once per this many ms (one log line, one metric). */
+const GOSSIP_REPORT_MS = 10000;
+/** Peers with a budget held at once; the least recently active goes first, in O(1). */
+const GOSSIP_MAX_PEERS = 4096;
+
 function refuseClearThroughRelay(node, peerId, peer) {
   if (!node._clearRefused) node._clearRefused = new Set();
   if (node._clearRefused.has(peerId)) return;
@@ -249,6 +271,12 @@ class SymNode extends EventEmitter {
       selfId: this._identity.nodeId,
       log: (m) => this._log(`[attestations] ${m}`),
     });
+    // Each peer's budget of new gossiped statements (see GOSSIP_PER_SECOND); `opts.gossipBudget`
+    // ({ perSecond, burst }) changes it.
+    this._gossipRate = (opts.gossipBudget && opts.gossipBudget.perSecond) || GOSSIP_PER_SECOND;
+    this._gossipBurst = (opts.gossipBudget && opts.gossipBudget.burst) || GOSSIP_BURST;
+    this._gossipBuckets = new Map(); // peerId -> bucket, least recently active first
+    this._gossipClock = Date.now;
     // Restore the per-attester chain cursor from the reloaded own-chain so `seq`
     // stays monotonic and `prev` keeps linking across restarts — otherwise a restart
     // would reset the chain to genesis and read as a gap (false omission). Genesis
@@ -1114,17 +1142,22 @@ class SymNode extends EventEmitter {
    * @private
    */
   _ingestCheckpoint(cp, fromPeerId) {
-    if (!cp || !cp.by || cp.upto_seq === undefined || !cp.root) return { ok: false, reason: 'malformed' };
+    if (!cp || !cp.by || cp.upto_seq === undefined || !cp.root || !cp.sig) return { ok: false, reason: 'malformed' };
     if (cp.roster && this._room && cp.roster !== this._room) return { ok: false, reason: 'roster-mismatch' };
     // A position is an integer; the signature covers its text, so a re-spelled one is refused here,
-    // before any signature check. A copy of a held checkpoint (same position, same root) is a
-    // duplicate, also dropped unverified: under the witness storm most of a node's thread went to
-    // verifying copies it already held. Nothing unverified changes any state.
+    // before any signature check. A copy of a held checkpoint (same position, same root), of a
+    // conflicting one already refused, or one older than every position held, is dropped unverified:
+    // under the witness storm most of a node's thread went to verifying copies it already held.
+    // Only a new statement spends the peer's budget, and it does so before its signature is checked.
+    // Nothing unverified changes any state.
     if (!isPosition(cp.upto_seq)) return { ok: false, reason: 'malformed' };
     const held = this._attestations.checkpointAt(cp.by, cp.upto_seq);
     if (held && held.root === cp.root) return { ok: false, reason: 'duplicate' };
+    if (this._attestations.conflictAt(cp.by, cp.upto_seq)?.root === cp.root) return { ok: false, reason: 'duplicate' };
+    if (this._attestations.isStale(cp.by, cp.upto_seq)) return { ok: false, reason: 'stale' };
     const key = this._identityKey(cp.by);
     if (!key) return { ok: false, reason: 'unknown-attester-key' };
+    if (!this._gossipBudget(fromPeerId, 'checkpoint', cp.by)) return { ok: false, reason: 'over-budget' };
     if (!verifyCheckpoint(cp, key).valid) return { ok: false, reason: 'bad-signature' };
     const r = this._attestations.recordCheckpoint(cp);
     if (r.reason === 'conflict' && r.first) {
@@ -1139,6 +1172,70 @@ class SymNode extends EventEmitter {
     return { ok: r.stored, reason: r.reason };
   }
 
+  /**
+   * Spend one of a peer's tokens for a NEW gossiped statement, before its signature is checked (see
+   * GOSSIP_PER_SECOND). The bucket is the delivering peer's, never a claimed signer's, so a forged
+   * frame spends only the budget of the peer that sent it; an honest peer relays only what it has
+   * verified and stored, so its lane carries no forgeries, and the bucket refills, so a peer that
+   * stops flooding is heard again within burst/rate seconds. A dropped frame changes nothing: it is not
+   * marked seen, so another peer's copy is taken. Drops are said with the peer named, at most once per
+   * 10 s (see _reportGossipDrops), so a gap they leave is attributable to this node, not the attester.
+   * O(1): the bucket map is ordered least recently active first and bounded by evicting its head.
+   * @returns {boolean} whether the frame may be verified
+   * @private
+   */
+  _gossipBudget(peerId, type, author) {
+    const now = this._gossipClock();
+    const buckets = this._gossipBuckets;
+    let b = buckets.get(peerId);
+    if (b) buckets.delete(peerId);
+    else {
+      b = { tokens: this._gossipBurst, at: now, dropped: 0, frames: {}, authors: new Set(), reportedAt: -Infinity, timer: null };
+      if (buckets.size >= GOSSIP_MAX_PEERS) {
+        const [oldId, old] = buckets.entries().next().value;
+        buckets.delete(oldId);
+        this._reportGossipDrops(oldId, old, now);
+      }
+    }
+    buckets.set(peerId, b); // most recently active last
+    const elapsed = now - b.at;
+    if (elapsed > 0) b.tokens = Math.min(this._gossipBurst, b.tokens + (elapsed * this._gossipRate) / 1000);
+    b.at = now; // a clock stepped back refills nothing, and stalls nothing
+    if (b.tokens >= 1) { b.tokens -= 1; return true; }
+    b.dropped++;
+    b.frames[type] = (b.frames[type] || 0) + 1;
+    if (author && b.authors.size < 16) b.authors.add(String(author));
+    if (now - b.reportedAt >= GOSSIP_REPORT_MS) this._reportGossipDrops(peerId, b, now);
+    else if (!b.timer) {
+      // The rest of this window is said when it closes, so a flood that stops is still counted.
+      b.timer = setTimeout(() => {
+        b.timer = null;
+        try { this._reportGossipDrops(peerId, b); } catch (err) { this._log(`Gossip drop report failed: ${err && err.message}`); }
+      }, Math.max(0, GOSSIP_REPORT_MS - (now - b.reportedAt)));
+      if (typeof b.timer.unref === 'function') b.timer.unref();
+    }
+    return false;
+  }
+
+  /**
+   * Say what a peer's budget dropped since it was last said: one log line and one
+   * `gossip-over-budget` metric `{ fromPeerId, from, dropped, frames: {attestation, checkpoint,
+   * witness}, authors (up to 16 signers whose statements were dropped), perSecond }`. @private
+   */
+  _reportGossipDrops(peerId, b, now = this._gossipClock()) {
+    if (b.timer) { clearTimeout(b.timer); b.timer = null; }
+    if (!b.dropped) return;
+    const name = this._peers?.get(peerId)?.name || null;
+    const ev = { type: 'gossip-over-budget', fromPeerId: peerId, from: name || peerId, dropped: b.dropped, frames: { ...b.frames }, authors: [...b.authors], perSecond: this._gossipRate };
+    b.dropped = 0;
+    b.frames = {};
+    b.authors = new Set();
+    b.reportedAt = now;
+    const what = Object.entries(ev.frames).map(([t, n]) => `${n} ${t}`).join(', ');
+    this._log(`Gossip from ${ev.from} over its budget (${this._gossipRate}/s): ${ev.dropped} new statement(s) dropped unverified (${what})`);
+    this.emit('metric', ev);
+  }
+
   /** Countersign a checkpoint (witness) and gossip the witness. @private */
   _witnessCheckpoint(cp) {
     if (cp.by === this.nodeId) return; // don't witness your own
@@ -1170,13 +1267,16 @@ class SymNode extends EventEmitter {
    * @private
    */
   _ingestWitness(w, fromPeerId) {
-    if (!w || !w.attester || w.upto_seq === undefined || !w.root || !w.by) return { ok: false, reason: 'malformed' };
+    if (!w || !w.attester || w.upto_seq === undefined || !w.root || !w.by || !w.sig) return { ok: false, reason: 'malformed' };
     if (w.roster && this._room && w.roster !== this._room) return { ok: false, reason: 'roster-mismatch' };
     if (!isPosition(w.upto_seq)) return { ok: false, reason: 'malformed' };
-    const held = this._attestations.witnessAt(w.attester, w.upto_seq, w.by);
+    // A copy of a witness held or waiting, or of a conflicting one already refused: dropped unverified.
+    const held = this._attestations.witnessSeen(w.attester, w.upto_seq, w.by);
     if (held && held.root === w.root) return { ok: false, reason: 'duplicate' };
+    if (this._attestations.witnessConflictRoot(w.attester, w.upto_seq, w.by) === w.root) return { ok: false, reason: 'duplicate' };
     const key = this._identityKey(w.by);
     if (!key) return { ok: false, reason: 'unknown-witness-key' };
+    if (!this._gossipBudget(fromPeerId, 'witness', w.by)) return { ok: false, reason: 'over-budget' };
     if (!verifyWitness(w, key).valid) return { ok: false, reason: 'bad-signature' };
     const r = this._attestations.recordWitness(w);
     if (r.stored) this._gossipToRoster({ type: 'witness', witness: w }, fromPeerId);
@@ -1220,9 +1320,10 @@ class SymNode extends EventEmitter {
   }
 
   /**
-   * Ingest an attestation received from a roster peer: roster-scope check, verify the
-   * attester's Ed25519 signature against its authenticated identity key, rate-limit
-   * per (of,by), record, and relay-once on first sight (epidemic spread). Returns the
+   * Ingest an attestation received from a roster peer: roster-scope check, drop a repeat, spend the
+   * delivering peer's gossip budget, verify the attester's Ed25519 signature against its
+   * authenticated identity key, rate-limit per (of,by), record, and relay-once on first sight
+   * (epidemic spread). Returns the
    * outcome so the frame-handler can log. Verification of a RELAYED attester (one that
    * is not a direct peer) needs the permissioned-roster key registry — pending; in the
    * current fully-connected roster every attester is a direct peer.
@@ -1243,9 +1344,12 @@ class SymNode extends EventEmitter {
     // peer (handshake key map); a relayed attester awaits the roster key registry.
     // A signature already held was verified when it was stored: a repeat is dropped before the
     // signature check, which is most of what a flood of repeats costs.
+    // `has` compares the signature's bytes, so a re-spelling of one held is a repeat too. Only a new
+    // statement spends the peer's budget, before its signature is checked.
     if (this._attestations.has(att.sig)) return { ok: false, reason: 'duplicate' };
     const attesterKey = this._identityKey(att.by);
     if (!attesterKey) return { ok: false, reason: 'unknown-attester-key' };
+    if (!this._gossipBudget(fromPeerId, 'attestation', att.by)) return { ok: false, reason: 'over-budget' };
     const v = verifyAttestation(att, attesterKey);
     if (!v.valid) return { ok: false, reason: v.error || 'bad-signature' };
     // Record (rate-limited as ingested). Relay-once only on first sight.
@@ -1690,6 +1794,7 @@ class SymNode extends EventEmitter {
     if (this._encodeTimer) clearInterval(this._encodeTimer);
     if (this._statsTimer) clearInterval(this._statsTimer);
     if (this._purgeTimer) clearInterval(this._purgeTimer);
+    for (const [peerId, b] of this._gossipBuckets) this._reportGossipDrops(peerId, b);
     // A throttled inbox write still pending (a drain or an ack in the last second) is flushed,
     // or it is lost: the timer is unref'd and would not hold the process open.
     if (this._inboxPersistTimer) {
diff --git a/tests/gossip-budget.test.js b/tests/gossip-budget.test.js
new file mode 100644
index 00000000..a0bec10d
--- /dev/null
+++ b/tests/gossip-budget.test.js
@@ -0,0 +1,297 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME to a temp sandbox before lib/config loads
+
+/**
+ * 0.14.0: one peer's gossiped attestations, checkpoints and witnesses have a budget of new statements
+ * (2,000 a second, a burst of 10,000), spent before the signature is checked. The earlier, rejected
+ * attempts spent it on repeats and unsigned frames, left attestations unbudgeted, budgeted 100 a
+ * second (below a busy room's legitimate rate, so a drop read as an omission), emitted a metric per
+ * dropped frame, and scanned the bucket map on every call. Each case below fails on one of those.
+ *
+ * Deterministic: the budget's clock is injected (node._gossipClock), and frames are ingested the way
+ * the frame handler hands them over (_ingestAttestation / _ingestCheckpoint / _ingestWitness), with
+ * real Ed25519 signatures.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const crypto = require('crypto');
+const fs = require('fs');
+const { SymNode } = require('../lib/node');
+const { NullDiscovery } = require('../lib/discovery');
+const { nodeDir } = require('../lib/config');
+const { signAttestation, signCheckpoint, signWitness } = require('../lib/core');
+
+const ROOM = 'g';
+const kp = () => {
+  const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519', { publicKeyEncoding: { type: 'spki', format: 'der' }, privateKeyEncoding: { type: 'pkcs8', format: 'der' } });
+  return { pub: publicKey.slice(-32).toString('base64url'), priv: privateKey.slice(-32).toString('base64url') };
+};
+const signed = (fields, priv, sign) => { const o = { ...fields }; sign(o, priv); return o; };
+const forgedSig = () => crypto.randomBytes(64).toString('base64url');
+
+/** A node (not started) that holds the keys of `n` attesters, on an injected clock. */
+function withNode(n, fn) {
+  const name = `gossip-budget-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+  const node = new SymNode({ name, silent: true, discovery: new NullDiscovery(), room: ROOM });
+  try {
+    const keys = Array.from({ length: n }, (_, i) => ({ id: `att-${i}`, ...kp() }));
+    for (const k of keys) node._pinPeerKey(k.id, k.pub);
+    node._gossipToRoster = () => {};
+    const clock = { t: 1_800_000_000_000 };
+    node._gossipClock = () => clock.t;
+    const metrics = [];
+    node.on('metric', (m) => { if (m.type === 'gossip-over-budget') metrics.push(m); });
+    return fn({ node, keys, clock, metrics });
+  } finally { fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+}
+
+const ingest = (node, peer, f) => (f.type === 'attestation' ? node._ingestAttestation(f.attestation, peer, peer)
+  : f.type === 'checkpoint' ? node._ingestCheckpoint(f.checkpoint, peer) : node._ingestWitness(f.witness, peer));
+
+let ofSeq = 0;
+const attestation = (k, seq) => ({ type: 'attestation', attestation: signed({ of: `cmb-${++ofSeq}`, by: k.id, at: 1, roster: ROOM, method: 'heuristic', verdict: 'aligned', categories: {}, role: 'participant', seq, prev: 'p' }, k.priv, signAttestation) });
+const forgedAttestation = (k) => ({ type: 'attestation', attestation: { of: `cmb-forged-${++ofSeq}`, by: k.id, at: 1, roster: ROOM, verdict: 'aligned', categories: {}, seq: ofSeq, prev: 'p', sig: forgedSig(), sigAlg: 'ed25519' } });
+
+/**
+ * A busy room through one peer, second by second: R attesters each gating G CMBs a second, a
+ * checkpoint every 8 attestations, and every other attester witnessing each checkpoint —
+ * R·G + R·G/8 + R·G/8·(R−1) new statements a second (640 at R = 32, G = 4). This is what a peer
+ * delivers when it is this node's only path to the room; in a full mesh it delivers ~20 of them.
+ */
+function* busyRoom(keys, G, seconds) {
+  const seq = new Map(keys.map((k) => [k.id, 0]));
+  for (let s = 0; s < seconds; s++) {
+    const frames = [];
+    for (let g = 0; g < G; g++) {
+      for (const k of keys) {
+        const n = seq.get(k.id) + 1;
+        seq.set(k.id, n);
+        frames.push(attestation(k, n));
+        if (n % 8 === 0) {
+          const cp = signed({ type: 'checkpoint', by: k.id, roster: ROOM, upto_seq: n, root: `root-${k.id}-${n}`, at: n }, k.priv, signCheckpoint);
+          frames.push({ type: 'checkpoint', checkpoint: cp });
+          for (const w of keys) {
+            if (w === k) continue;
+            frames.push({ type: 'witness', witness: signed({ type: 'witness', attester: k.id, roster: ROOM, upto_seq: n, root: cp.root, by: w.id, role: 'participant', at: n }, w.priv, signWitness) });
+          }
+        }
+      }
+    }
+    yield frames;
+  }
+}
+
+describe('gossip budget — sized for a busy room', () => {
+  it("drops a flood, but none of an honest peer's traffic at a busy room's rate (640 new statements a second through one peer)", () => {
+    withNode(32, ({ node, keys, clock, metrics }) => {
+      const counts = { attestation: 0, checkpoint: 0, witness: 0 };
+      let refused = 0;
+      const start = clock.t;
+      const room = busyRoom(keys, 4, 22);
+      for (let sec = 0; sec < 20; sec++) {
+        const frames = room.next().value;
+        const second = clock.t;
+        frames.forEach((f, i) => {
+          clock.t = second + Math.floor((i * 1000) / frames.length);
+          const r = ingest(node, 'hub', f);
+          counts[f.type]++;
+          if (!r.ok && r.reason !== 'pending') refused++;
+        });
+        clock.t = second + 1000;
+      }
+      assert.deepStrictEqual(counts, { attestation: 2560, checkpoint: 320, witness: 9920 }, '640 a second for 20 s');
+      assert.strictEqual(refused, 0, 'every statement from the honest peer was taken');
+      assert.strictEqual(metrics.length, 0, 'and nothing was reported dropped');
+      assert.ok(clock.t - start === 20000);
+
+      // A flood from another peer: forged attestations at 20,000 a second for 2 s, the honest peer
+      // carrying on at its rate alongside.
+      const flood = { verified: 0, dropped: 0 };
+      const t0 = clock.t;
+      for (let ms = 0; ms < 2000; ms++) {
+        clock.t = t0 + ms;
+        for (let j = 0; j < 20; j++) {
+          const r = ingest(node, 'flooder', forgedAttestation(keys[j % keys.length]));
+          if (r.reason === 'over-budget') flood.dropped++; else flood.verified++;
+        }
+        if (ms % 1000 === 0) {
+          for (const f of room.next().value) { const r = ingest(node, 'hub', f); if (!r.ok && r.reason !== 'pending') refused++; }
+        }
+      }
+      // A burst of 10,000, then 2,000 a second: ~14,000 signature checks bought, of 40,000 sent.
+      assert.ok(Math.abs(flood.verified - 14000) <= 2, `verified ${flood.verified}`);
+      assert.strictEqual(flood.verified + flood.dropped, 40000);
+      assert.strictEqual(refused, 0, 'the honest peer lost nothing during the flood');
+      assert.ok(metrics.length >= 1 && metrics.every((m) => m.fromPeerId === 'flooder'));
+    });
+  });
+});
+
+describe('gossip budget — only new statements spend it', () => {
+  it('repeats, re-spelled signatures, unsigned frames and unknown signers are dropped before it and spend nothing', () => {
+    withNode(3, ({ node, keys: [A, W, X] }) => {
+      const tokens = () => node._gossipBuckets.get('p')?.tokens ?? node._gossipBurst;
+      const spent = () => node._gossipBurst - tokens();
+      // One of each held: an attestation, a checkpoint and its witness, a conflict, a waiting witness.
+      const att = attestation(A, 1);
+      const cp = signed({ type: 'checkpoint', by: A.id, roster: ROOM, upto_seq: 8, root: 'r8', at: 1 }, A.priv, signCheckpoint);
+      const fork = signed({ type: 'checkpoint', by: A.id, roster: ROOM, upto_seq: 8, root: 'forked', at: 2 }, A.priv, signCheckpoint);
+      const wit = signed({ type: 'witness', attester: A.id, roster: ROOM, upto_seq: 8, root: 'r8', by: W.id, role: 'participant', at: 1 }, W.priv, signWitness);
+      const witFork = signed({ type: 'witness', attester: A.id, roster: ROOM, upto_seq: 8, root: 'forked', by: W.id, role: 'participant', at: 2 }, W.priv, signWitness);
+      const waiting = signed({ type: 'witness', attester: X.id, roster: ROOM, upto_seq: 16, root: 'r16', by: W.id, role: 'participant', at: 1 }, W.priv, signWitness);
+      for (const f of [att, { type: 'checkpoint', checkpoint: cp }, { type: 'checkpoint', checkpoint: fork }, { type: 'witness', witness: wit }, { type: 'witness', witness: witFork }, { type: 'witness', witness: waiting }]) ingest(node, 'p', f);
+      assert.strictEqual(node._attestations.hasConflict(A.id, 8), true);
+      assert.strictEqual(node._attestations.witnessSeen(X.id, 16, W.id).root, 'r16', 'one waits for its checkpoint');
+      const before = spent();
+      assert.strictEqual(before, 6, 'each new statement spent one');
+
+      const s = att.attestation.sig;
+      const respelled = [s + '=', s + '==', ` ${s}`, `${s.slice(0, 40)}\n${s.slice(40)}`, s.replace(/-/g, '+').replace(/_/g, '/'), `${s}!`];
+      const repeats = [];
+      for (let i = 0; i < 5000; i++) {
+        repeats.push(att);
+        repeats.push({ type: 'attestation', attestation: { ...att.attestation, sig: respelled[i % respelled.length] } });
+        repeats.push({ type: 'checkpoint', checkpoint: { ...cp, sig: forgedSig() } });      // held: same position, same root
+        repeats.push({ type: 'checkpoint', checkpoint: { ...fork, sig: forgedSig() } });    // the conflict already refused
+        repeats.push({ type: 'witness', witness: { ...wit, sig: forgedSig() } });            // held
+        repeats.push({ type: 'witness', witness: { ...witFork, sig: forgedSig() } });        // the conflict already refused
+        repeats.push({ type: 'witness', witness: { ...waiting, sig: forgedSig() } });        // waiting
+        repeats.push({ type: 'checkpoint', checkpoint: { ...cp, upto_seq: 9, sig: undefined } });   // unsigned
+        repeats.push({ type: 'witness', witness: { ...wit, upto_seq: 9, sig: '' } });               // unsigned
+        repeats.push({ type: 'attestation', attestation: { ...att.attestation, by: 'nobody', sig: forgedSig() } }); // no key held
+      }
+      const reasons = new Set();
+      for (const f of repeats) { const r = ingest(node, 'p', f); assert.strictEqual(r.ok, false); reasons.add(r.reason); }
+      assert.deepStrictEqual([...reasons].sort(), ['duplicate', 'malformed', 'unknown-attester-key']);
+      assert.strictEqual(spent(), before, `50,000 repeats spent nothing (${spent() - before})`);
+      assert.strictEqual(node._attestations.size(), 1, 'and a re-spelled signature is not a second attestation');
+      assert.strictEqual(ingest(node, 'p', attestation(A, 2)).ok, true, 'a new statement is still taken');
+    });
+  });
+
+  it('a checkpoint older than every position held is dropped before it', () => {
+    withNode(1, ({ node, keys: [A] }) => {
+      for (let n = 1; n <= 32; n++) ingest(node, 'p', { type: 'checkpoint', checkpoint: signed({ type: 'checkpoint', by: A.id, roster: ROOM, upto_seq: 100 + n, root: `r${n}`, at: n }, A.priv, signCheckpoint) });
+      const spent = node._gossipBurst - node._gossipBuckets.get('p').tokens;
+      for (let i = 0; i < 1000; i++) {
+        const r = ingest(node, 'p', { type: 'checkpoint', checkpoint: { type: 'checkpoint', by: A.id, roster: ROOM, upto_seq: i % 100, root: 'old', at: 1, sig: forgedSig() } });
+        assert.strictEqual(r.reason, 'stale');
+      }
+      assert.strictEqual(node._gossipBurst - node._gossipBuckets.get('p').tokens, spent);
+    });
+  });
+});
+
+describe('gossip budget — forged frames cannot starve genuine ones', () => {
+  it("a flood spends only its sender's budget; the same statement from an honest peer is taken; the flooder is heard again once it stops", () => {
+    withNode(32, ({ node, keys, clock }) => {
+      let seq = 0;
+      const genuine = () => attestation(keys[0], ++seq);
+      const t0 = clock.t;
+      let honestRefused = 0;
+      let floodVerified = 0;
+      // 10 s of forgeries at 4,000 a second, all naming attester 0, while an honest peer relays
+      // attester 0's genuine attestations at 640 a second.
+      for (let ms = 0; ms < 10000; ms++) {
+        clock.t = t0 + ms;
+        for (let j = 0; j < 4; j++) if (ingest(node, 'flooder', forgedAttestation(keys[0])).reason !== 'over-budget') floodVerified++;
+        if (ms % 25 < 16) { const r = ingest(node, 'honest', genuine()); if (!r.ok) honestRefused++; }
+      }
+      assert.strictEqual(honestRefused, 0, 'every genuine statement from the honest peer was taken');
+      assert.ok(floodVerified <= 10000 + 10 * 2000 + 1, `what the flooder could send is bounded: ${floodVerified}`);
+      // During the flood the flooder's own genuine relay is dropped, unverified, and marks nothing...
+      const g = genuine();
+      assert.strictEqual(ingest(node, 'flooder', g).reason, 'over-budget');
+      assert.strictEqual(node._attestations.has(g.attestation.sig), false);
+      // ...so the same statement from the honest peer is taken.
+      assert.strictEqual(ingest(node, 'honest', g).ok, true);
+      // Not for ever: once the flood stops, the bucket refills and the flooder's genuine frames pass.
+      clock.t += 1000;
+      for (let i = 0; i < 100; i++) assert.strictEqual(ingest(node, 'flooder', genuine()).ok, true, `genuine ${i} after the flood`);
+    });
+  });
+});
+
+describe('gossip budget — what it reports, and what it keeps', () => {
+  it('a drop is said with the peer named, at most once per 10 s, and every drop is counted', () => {
+    withNode(2, ({ node, keys, clock, metrics }) => {
+      node._peers.set('flooder', { peerId: 'flooder', name: 'the-flooder', transport: { send() {} } });
+      const logs = [];
+      node._log = (m) => logs.push(m);
+      let dropped = 0;
+      const t0 = clock.t;
+      for (let i = 0; i < 40000; i++) {
+        clock.t = t0 + Math.floor(i / 8);   // 8,000 a second for 5 s
+        const f = i % 2 ? forgedAttestation(keys[i % 2]) : { type: 'witness', witness: { type: 'witness', attester: 'x', roster: ROOM, upto_seq: i, root: 'r', by: keys[0].id, role: 'participant', at: 1, sig: forgedSig() } };
+        if (ingest(node, 'flooder', f).reason === 'over-budget') dropped++;
+      }
+      assert.ok(dropped > 10000, `${dropped} dropped`);
+      assert.strictEqual(metrics.length, 1, 'said once in the window, at the first drop');
+      const b = node._gossipBuckets.get('flooder');
+      assert.ok(b.timer, 'the rest of the window is said when it closes');
+      node._reportGossipDrops('flooder', b);   // what the timer does
+      assert.strictEqual(metrics.length, 2);
+      assert.strictEqual(metrics.reduce((s, m) => s + m.dropped, 0), dropped, 'every drop is counted');
+      for (const m of metrics) {
+        assert.strictEqual(m.fromPeerId, 'flooder');
+        assert.strictEqual(m.from, 'the-flooder');
+      }
+      assert.deepStrictEqual(Object.keys(metrics[1].frames).sort(), ['attestation', 'witness']);
+      assert.deepStrictEqual(metrics[1].authors.sort(), [keys[0].id, keys[1].id].sort(), 'whose statements were dropped');
+      assert.strictEqual(logs.filter((l) => l.includes('over its budget')).length, 2);
+    });
+  });
+
+  it('keeps at most 4,096 buckets, evicting the least recently active, without scanning the map', () => {
+    withNode(1, ({ node, keys: [A] }) => {
+      let iterations = 0;
+      class Counted extends Map {
+        entries() { iterations++; return super.entries(); }
+        keys() { iterations++; return super.keys(); }
+        values() { iterations++; return super.values(); }
+        forEach(...a) { iterations++; return super.forEach(...a); }
+        [Symbol.iterator]() { iterations++; return super.entries(); }
+      }
+      node._gossipBuckets = new Counted();
+      const frame = () => forgedAttestation(A);
+      for (let i = 0; i < 50; i++) ingest(node, 'busy', frame());
+      for (let p = 0; p < 6000; p++) {
+        ingest(node, `peer-${p}`, frame());
+        if (p % 1000 === 0) ingest(node, 'busy', frame());   // still active
+      }
+      assert.strictEqual(node._gossipBuckets.size, 4096);
+      assert.ok(node._gossipBuckets.has('busy'), 'an active peer keeps its bucket');
+      assert.strictEqual(node._gossipBurst - node._gossipBuckets.get('busy').tokens, 50 + 6, 'and what it spent');
+      assert.ok(!node._gossipBuckets.has('peer-0'), 'the least recently active went');
+      assert.strictEqual(iterations, 6001 - 4096, 'one O(1) look at the head per eviction, nothing else');
+    });
+  });
+});
+
+describe('gossip budget — the frame handler', () => {
+  it('says a dropped attestation once a minute per peer and reason, with a count, not once per frame', () => {
+    withNode(1, ({ node, keys: [A], clock }) => {
+      const logs = [];
+      node._log = (m) => logs.push(m);
+      const realNow = Date.now;
+      let now = realNow();
+      Date.now = () => now;
+      try {
+        // Naming a signer this node holds no key for: dropped before any budget, so free to send.
+        for (let i = 0; i < 5000; i++) node._frameHandler._handleAttestation('p', 'peer-p', { attestation: { ...forgedAttestation(A).attestation, by: `nobody-${i}` } });
+        assert.strictEqual(logs.length, 1, logs.slice(0, 3).join('\n'));
+        now += 61_000;
+        node._frameHandler._handleAttestation('p', 'peer-p', { attestation: { ...forgedAttestation(A).attestation, by: 'nobody' } });
+        assert.strictEqual(logs.length, 2);
+        assert.match(logs[1], /and 4999 more since it was last said/);
+        // A drop past the budget is said by the budget, not here.
+        node._gossipBuckets.set('q', { tokens: 0, at: clock.t, dropped: 0, frames: {}, authors: new Set(), reportedAt: clock.t, timer: null });
+        node._frameHandler._handleAttestation('q', 'peer-q', forgedAttestation(A));
+        assert.strictEqual(logs.length, 2);
+        clearTimeout(node._gossipBuckets.get('q').timer);
+      } finally { Date.now = realNow; }
+    });
+  });
+});

From 65ed70772bc1fb3d75b895e36859f47db4618094 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Fri, 2 Oct 2026 02:25:47 +0100
Subject: [PATCH 057/148] 0.14.0 CHANGELOG: the start-up times as measured, and
 what a flood costs whom

A first start on logs over every budget reads them in 0.5-0.6 s and, rotating
all three, takes 0.7-0.8 s (0.13.16: 1.0-1.1 s); the next start 0.2 s. A peer
flooding forgeries loses its own frames while it floods, and no one else's.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 CHANGELOG.md             | 15 ++++++++-------
 lib/attestation-store.js |  3 ++-
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7d8f095d..5563a400 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -159,8 +159,9 @@ debt, and the daemon's log flood. Every item has a test that fails without its f
   hold, 28 MiB for checkpoints and 47.7 MiB for witnesses. 0.13.16 read only the newest 16 and 32 MiB,
   which could miss a quiet attester's checkpoints. Attestations are evicted oldest first, so the ones
   held are always the newest in their log, and 34.3 MiB (50,000 at 720 bytes; measured ~520) reads them
-  all. That is 110 MiB at most in all, against 0.13.16's 112 MiB. On logs over every budget, a start
-  took 0.5–0.6 s here, against 1.0–1.1 s for 0.13.16.
+  all. That is 110 MiB at most in all, against 0.13.16's 112 MiB. On logs over every budget, reading
+  them took 0.5–0.6 s here and a first start that also rotates all three 0.7–0.8 s, against
+  1.0–1.1 s for 0.13.16 reading them; the next start took 0.2 s.
 - **A conflict on a held position is remembered as long as the position is held.** 0.13.16's
   32,768-entry list also counted positions already dropped, so another attester's conflicts could push
   out the mark of a position still held.
@@ -181,11 +182,11 @@ debt, and the daemon's log flood. Every item has a test that fails without its f
   first copy of a statement is new, so a peer spends the budget only for what it delivers first:
   about what it signs itself (~20 a second there), and at most all 640 when it is this node's only
   path to the room. 2,000 is three times that. `gossipBudget: { perSecond, burst }` changes it.
-- **Forged frames cannot starve genuine ones.** The budget is the delivering peer's, never the claimed
-  signer's, so a forged frame spends only its sender's budget. An honest peer relays only what it has
-  verified, so its budget is never spent on forgeries. A dropped frame is not marked seen, so the same
-  statement from another peer is taken. The budget refills, so a peer that stops flooding is heard
-  again.
+- **A forged frame spends only its sender's budget.** The budget is the delivering peer's, never the
+  claimed signer's. A peer that floods forgeries loses its own frames while it floods, and no one
+  else's. An honest peer relays only what it has verified, so its budget is never spent on forgeries.
+  A dropped frame is not marked seen, so the same statement from another peer is taken. The budget
+  refills, so a peer that stops flooding is heard again.
 - **A drop is attributable.** A `gossip-over-budget` metric (`fromPeerId`, `from`, `dropped`,
   `frames` by type, and up to 16 `authors` whose statements were dropped) and one log line name the
   peer, at most once per 10 s per peer: the first drop at once, the rest when the 10 s close, so every
diff --git a/lib/attestation-store.js b/lib/attestation-store.js
index 51a6d41f..e886e2ec 100644
--- a/lib/attestation-store.js
+++ b/lib/attestation-store.js
@@ -546,7 +546,8 @@ class AttestationStore {
   }
 
   /** @private This node's own-witness line, as a rotation writes it: the positions it signed for one
-   *  attester. Read for this node's id only; the line counts as held. */
+   *  attester. Read for this node's id only; the line counts as held. Like every line replayed it is
+   *  not verified, and a forged one can only stop this node from signing a witness. */
   _restoreOwn(o) {
     if (!this._selfId || o.by !== this._selfId || !o.attester || !Array.isArray(o.positions)) return;
     for (const p of o.positions.slice(-256)) if (isPosition(p)) this._markOwnWitness(o.attester, p);

From c23001bc36413e398d9597f9fb8e930d2f353295 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Fri, 2 Oct 2026 02:34:54 +0100
Subject: [PATCH 058/148] 0.14.0 review: a dropped position is unlisted in O(1)

The witnessed positions were an array searched with findIndex (up to 32,768
entries) each time a checkpoint was dropped. They are now a Map keyed by
(attester, position) in first-witness order: a dropped checkpoint deletes its
own key, and the global witness cap takes the oldest from the head. Unlisting
happens before the drop, so the cap's loop always makes progress.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 CHANGELOG.md                       |  3 ++
 lib/attestation-store.js           | 26 +++++++++--------
 tests/attestation-rotation.test.js |  4 +--
 tests/attestation-store.test.js    | 45 ++++++++++++++++++++++++++++++
 4 files changed, 64 insertions(+), 14 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5563a400..6c9a86db 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -165,6 +165,9 @@ debt, and the daemon's log flood. Every item has a test that fails without its f
 - **A conflict on a held position is remembered as long as the position is held.** 0.13.16's
   32,768-entry list also counted positions already dropped, so another attester's conflicts could push
   out the mark of a position still held.
+- **A dropped position is unlisted in O(1).** Each checkpoint dropped searched every witnessed
+  position (up to 32,768) for its own; the positions are now indexed by key, and the witness cap takes
+  the oldest from the head.
 
 ### Fixed — one peer's attestation gossip has a budget
 
diff --git a/lib/attestation-store.js b/lib/attestation-store.js
index e886e2ec..a73d6dec 100644
--- a/lib/attestation-store.js
+++ b/lib/attestation-store.js
@@ -76,6 +76,8 @@ const isPosition = (n) => Number.isSafeInteger(n) && n >= 0;
 
 /** The key a witness is held or waits under: (attester, position, witness), unambiguous for any ids. */
 const witnessKey = (attester, upto_seq, by) => JSON.stringify([attester, upto_seq, by]);
+/** The key of a witnessed position: (attester, position). */
+const positionKey = (attester, upto_seq) => JSON.stringify([attester, upto_seq]);
 
 /** An Ed25519 signature as its signer writes it: 64 bytes in unpadded base64url (86 characters, the
  *  last one carrying two bits). */
@@ -145,7 +147,9 @@ class AttestationStore {
     // is dropped takes its conflict with it, so this is bounded by the checkpoint caps.
     this._conflicted = new Map();
     this._witnesses = new Map();   // attester -> Map(upto_seq -> Map(witnessBy -> witness))
-    this._positions = [];          // [attester, upto_seq] in the order a position got its first witness
+    // positionKey -> [attester, upto_seq], in the order a position got its first witness: the global
+    // cap drops the oldest (its head) and a dropped checkpoint unlists its own, both in O(1).
+    this._positions = new Map();
     this._witnessCount = 0;
     this._maxWitnesses = opts.maxWitnesses || 50000;
     this._maxWitnessesPerPosition = opts.maxWitnessesPerPosition || 256;
@@ -359,7 +363,7 @@ class AttestationStore {
     let byPos = this._witnesses.get(w.attester);
     if (!byPos) { byPos = new Map(); this._witnesses.set(w.attester, byPos); }
     let m = byPos.get(w.upto_seq);
-    if (!m) { m = new Map(); byPos.set(w.upto_seq, m); this._positions.push([w.attester, w.upto_seq]); }
+    if (!m) { m = new Map(); byPos.set(w.upto_seq, m); this._positions.set(positionKey(w.attester, w.upto_seq), [w.attester, w.upto_seq]); }
     if (m.size >= this._maxWitnessesPerPosition) {
       // This node's own witness is written even when the position cannot hold it, so a restart still
       // knows it was signed; it is read back as remembered, not stored.
@@ -371,9 +375,9 @@ class AttestationStore {
     this._witnessCount++;
     // One read from the live log and kept waiting is already in it: promoting it must not append it again.
     this._keep(WIT_FILE, w, !this._fromLog.has(w));
-    while (this._witnessCount > this._maxWitnesses && this._positions.length) {
-      const [a, seq] = this._positions.shift();
-      this._dropWitnessesOf(a, seq, false);
+    while (this._witnessCount > this._maxWitnesses && this._positions.size) {
+      const [a, seq] = this._positions.values().next().value;   // the oldest position, unlisted as it goes
+      this._dropWitnessesOf(a, seq);
     }
     this._maybeRotate(WIT_FILE);
     return { stored: true };
@@ -389,8 +393,10 @@ class AttestationStore {
     return true;
   }
 
-  /** @private Drop the witnesses of a position (its checkpoint dropped, or the oldest under the cap). */
-  _dropWitnessesOf(attester, upto_seq, unlist = true) {
+  /** @private Drop the witnesses of a position (its checkpoint dropped, or the oldest under the cap).
+   *  O(witnesses at the position): the position is unlisted by key, never searched for. */
+  _dropWitnessesOf(attester, upto_seq) {
+    this._positions.delete(positionKey(attester, upto_seq));
     const byPos = this._witnesses.get(attester);
     const m = byPos && byPos.get(upto_seq);
     if (!m) return;
@@ -398,10 +404,6 @@ class AttestationStore {
     for (const w of m.values()) this._unkeep(WIT_FILE, w);
     byPos.delete(upto_seq);
     if (byPos.size === 0) this._witnesses.delete(attester);
-    if (unlist) {
-      const i = this._positions.findIndex(([a, s]) => a === attester && s === upto_seq);
-      if (i >= 0) this._positions.splice(i, 1);
-    }
   }
 
   /** @private Remember a checkpoint this node witnessed itself; kept per attester, newest 256. */
@@ -613,7 +615,7 @@ class AttestationStore {
       for (const m of this._conflicted.values()) yield* m.values();
     } else {
       // Positions in the order they got their first witness (the global cap drops the oldest first).
-      for (const [a, seq] of this._positions) { const m = this._witnesses.get(a)?.get(seq); if (m) yield* m.values(); }
+      for (const [a, seq] of this._positions.values()) { const m = this._witnesses.get(a)?.get(seq); if (m) yield* m.values(); }
     }
   }
 
diff --git a/tests/attestation-rotation.test.js b/tests/attestation-rotation.test.js
index aaa9f070..5707fa93 100644
--- a/tests/attestation-rotation.test.js
+++ b/tests/attestation-rotation.test.js
@@ -318,8 +318,8 @@ describe('attestation log rotation — nothing held is lost', () => {
       attesters: [...s._checkpoints.keys()],
       checkpoints: ['Q', 'A'].map((by) => s.checkpointsOf(by).map((c) => [c.upto_seq, c.root])),
       conflicted: s.hasConflict('Q', 5),
-      positions: s._positions.map((p) => p.join(':')),
-      witnesses: s._positions.map(([a, seq]) => s.witnessesFor(a, seq).map((w) => w.sig)),
+      positions: [...s._positions.values()].map((p) => p.join(':')),
+      witnesses: [...s._positions.values()].map(([a, seq]) => s.witnessesFor(a, seq).map((w) => w.sig)),
       own: [s.hasWitnessed('Q', 5, 'me'), s.hasWitnessed('A', 1, 'me'), s.hasWitnessed('A', 60, 'me')],
     });
     const before = snap(st);
diff --git a/tests/attestation-store.test.js b/tests/attestation-store.test.js
index 28daa6c7..c1bdd25b 100644
--- a/tests/attestation-store.test.js
+++ b/tests/attestation-store.test.js
@@ -369,3 +369,48 @@ describe('AttestationStore — 0.13.15 review follow-ups', () => {
     } finally { fs.rmSync(dir, { recursive: true, force: true }); }
   });
 });
+
+// 0.14.0 review follow-up: a position was unlisted with findIndex over every witnessed position (up
+// to 32,768), once per position dropped.
+describe('AttestationStore — position eviction is O(1)', () => {
+  it('a dropped checkpoint unlists its position by key, and the global cap takes the oldest from the head, never scanning', () => {
+    const st = new AttestationStore({ maxCheckpointsPerAttester: 2, maxAttesters: 2000, maxWitnessesPerPosition: 1, maxWitnesses: 100000 });
+    for (let a = 0; a < 1000; a++) {
+      for (const n of [1, 2]) {
+        st.recordCheckpoint({ by: `A${a}`, upto_seq: n, root: 'r', sig: `c${a}-${n}` });
+        st.recordWitness({ attester: `A${a}`, upto_seq: n, root: 'r', by: 'W', sig: `w${a}-${n}` });
+      }
+    }
+    let iterations = 0;   // iterator steps taken over the position index
+    const counted = (it) => ({ next() { iterations++; return it.next(); }, [Symbol.iterator]() { return this; } });
+    class Counted extends Map {
+      entries() { return counted(super.entries()); }
+      keys() { return counted(super.keys()); }
+      values() { return counted(super.values()); }
+      forEach(fn, self) { for (const [k, v] of this) fn.call(self, v, k, this); }
+      [Symbol.iterator]() { return counted(super.entries()); }
+    }
+    st._positions = new Counted(st._positions);
+    iterations = 0;
+    // 500 attesters commit a third checkpoint: each drops its oldest position, with its witness.
+    for (let a = 0; a < 500; a++) st.recordCheckpoint({ by: `A${a}`, upto_seq: 3, root: 'r', sig: `c${a}-3` });
+    assert.strictEqual(iterations, 0, 'unlisting a dropped position looks at nothing else');
+    assert.strictEqual(st._positions.size, 1500);
+    assert.strictEqual(st.witnessesFor('A0', 1).length, 0);
+    // The global cap: 100 more positions than it allows, each drop one look at the head.
+    st._maxWitnesses = st._witnessCount;
+    for (let a = 500; a < 600; a++) {
+      st.recordCheckpoint({ by: `A${a}`, upto_seq: 3, root: 'r', sig: `c${a}-3x` });   // drops A${a}'s position 1
+      st.recordWitness({ attester: `A${a}`, upto_seq: 3, root: 'r', by: 'W', sig: `w${a}-3` });
+    }
+    st._maxWitnesses -= 100;
+    iterations = 0;
+    st.recordCheckpoint({ by: 'B', upto_seq: 1, root: 'r', sig: 'b1' });
+    st.recordWitness({ attester: 'B', upto_seq: 1, root: 'r', by: 'W', sig: 'wb1' });
+    assert.strictEqual(iterations, 101, 'one step at the head per position the cap drops');
+    assert.strictEqual(st._witnessCount, st._maxWitnesses);
+    assert.strictEqual(st.witnessesFor('A0', 2).length + st.witnessesFor('A100', 2).length, 0, 'the oldest positions went first');
+    assert.strictEqual(st.witnessesFor('A101', 2).length, 1, 'and no more');
+    assert.strictEqual(st.witnessesFor('B', 1).length, 1, 'the newest stayed');
+  });
+});

From 2e63dab9d168c05ee0b2fffd08ec78773d154b3e Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Fri, 2 Oct 2026 02:38:22 +0100
Subject: [PATCH 059/148] 0.14.0 review: one attester cannot flush another's
 attestation chain

The 50,000-attestation cap was one FIFO across attesters. It is now shared
out by attester: when the store is full, the attester holding the most loses
its oldest (count buckets keep that O(1)), so each keeps its newest up to
max / attesters held. At most maxAttesters (1,024) chains are held, which
floors the share at 48; a new attester replaces the one updated least
recently, never this node's own. Dropping the older of two attestations at
one position no longer clears the newer from the chain.

Held attestations are no longer the newest lines of their log (a quiet
attester's sit at its head), so the attestation log is read whole at start
like the other two: twice what its cap holds, 68.7 MiB; 144 MiB in all.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 CHANGELOG.md                       | 21 ++++---
 lib/attestation-store.js           | 94 +++++++++++++++++++++++++-----
 tests/attestation-rotation.test.js | 21 ++++++-
 tests/attestation-store.test.js    | 51 ++++++++++++++++
 4 files changed, 161 insertions(+), 26 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6c9a86db..1020c843 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -154,14 +154,19 @@ debt, and the daemon's log flood. Every item has a test that fails without its f
   each conflicting checkpoint copy for a held position, so a restart still reports the conflict; and
   this node's memory of the checkpoints it witnessed itself (one line per attester), so it still signs
   a witness once across restarts. A witness waiting for its checkpoint stays in memory only, as before.
-- **A start reads all of a checkpoint or witness log.** A held checkpoint or witness can sit at the
-  head of its log while newer ones churn past, so these two logs are read whole: twice what their caps
-  hold, 28 MiB for checkpoints and 47.7 MiB for witnesses. 0.13.16 read only the newest 16 and 32 MiB,
-  which could miss a quiet attester's checkpoints. Attestations are evicted oldest first, so the ones
-  held are always the newest in their log, and 34.3 MiB (50,000 at 720 bytes; measured ~520) reads them
-  all. That is 110 MiB at most in all, against 0.13.16's 112 MiB. On logs over every budget, reading
-  them took 0.5–0.6 s here and a first start that also rotates all three 0.7–0.8 s, against
-  1.0–1.1 s for 0.13.16 reading them; the next start took 0.2 s.
+- **A start reads all of each log.** A record can stay held at the head of its log while newer ones
+  churn past it: a quiet attester's attestations or checkpoints, a quiet position's witnesses. So each
+  log is read whole, up to twice what its caps hold: 68.7 MiB for attestations (50,000 at 720 bytes;
+  measured ~520), 28 MiB for checkpoints and 47.7 MiB for witnesses, 144 MiB in all. 0.13.16 read at
+  most 112 MiB but only the newest part of each log, which could miss a quiet attester. On logs over
+  every budget, reading them took 0.8–0.9 s here against 1.0–1.4 s for 0.13.16. A first start that
+  also rotates all three took 1.0–1.3 s, once; the next start took 0.25 s.
+- **One attester cannot flush another's chain.** The 50,000-attestation cap was one queue across all
+  attesters, so one attester signing many attestations pushed every other attester's chain out, and
+  the omission evidence with it. Now, when the store is full, the attester holding the most loses its
+  oldest. Each attester keeps its newest up to its share (50,000 / attesters held), and never fewer
+  than 48: at most 1,024 chains are held, and a new attester takes the place of the one updated least
+  recently, never this node's own.
 - **A conflict on a held position is remembered as long as the position is held.** 0.13.16's
   32,768-entry list also counted positions already dropped, so another attester's conflicts could push
   out the mark of a position still held.
diff --git a/lib/attestation-store.js b/lib/attestation-store.js
index a73d6dec..603b5d51 100644
--- a/lib/attestation-store.js
+++ b/lib/attestation-store.js
@@ -11,7 +11,8 @@
  *   - by `by` (attester nodeId) → that attester's hash-chain, keyed by `seq`, so a
  *     dropped attestation is a detectable gap (omission-evidence, LOCAL half;
  *     anchored checkpoints add the cross-node half in a later step).
- * Deduplicated by signature (idempotent record / relay-once). Bounded by count.
+ * Deduplicated by signature (idempotent record / relay-once). Bounded by count, shared out by
+ * attester: when full, the attester holding the most loses its oldest.
  *
  * Checkpoints and witnesses are deduplicated by WHAT they assert, not by signature: one checkpoint
  * per (attester, position) and one witness per (attester, position, witness). A node that witnessed
@@ -131,8 +132,14 @@ class AttestationStore {
     this._byCmb = new Map();       // of  -> Map(sigKey -> att)
     this._byAttester = new Map();  // by  -> Map(seq -> att)
     this._seen = new Set();        // sigKey -> dedup / relay-once
-    this._order = new Map();       // sigKey -> { of, by, seq }, insertion order, for O(1) eviction
+    this._order = new Map();       // sigKey -> { of, by, seq }, insertion order (the order a rotation writes)
     this._max = opts.max || 50000;
+    // The cap is shared out by attester, so one attester cannot flush another's chain: when the store
+    // is full, the attester holding the most loses its oldest. Each attester therefore keeps its newest
+    // up to its share, max / attesters held, and at least max / maxAttesters (48 at the defaults).
+    this._heldBy = new Map();      // by -> Set(sigKey) oldest first; attesters least recently updated first
+    this._byCount = new Map();     // n -> Set(by) of the attesters holding n attestations
+    this._maxCount = 0;            // the most any attester holds
     // Per-(of,by) ingest rate-limit — bounds a Sybil/flood of attestations about a
     // single CMB on the immutable log (research's DoS-at-ingest finding). Applies
     // only to GOSSIPED-IN attestations, never to this node's own gating output.
@@ -177,10 +184,9 @@ class AttestationStore {
     this._tmpSeq = 0;
     this._said = new Set();        // rotation errors already said
     // At start, each log is read up to a budget that covers what its caps hold, and of a larger log
-    // only its newest part. Attestations are evicted oldest first, so the ones held are the newest in
-    // their log: reading what the cap holds reloads them all. A checkpoint or witness can stay held
-    // while newer ones churn past it, so those two logs are read whole: what the caps hold, plus what
-    // a log may hold beyond that before it is rotated.
+    // only its newest part. A record can stay held while newer ones churn past it (a quiet attester's
+    // attestations or checkpoints, a quiet position's witnesses), so each log is read whole: what the
+    // caps hold, plus what a log may hold beyond that before it is rotated.
     const readAll = opts.maxReadBytes;
     const capBytes = {
       [ATT_FILE]: this._max * ATT_LINE,
@@ -189,7 +195,7 @@ class AttestationStore {
     };
     const wholeLog = (f) => capBytes[f] + Math.max(this._rotateBytes, capBytes[f]);
     this._readBudget = {
-      [ATT_FILE]: readAll || capBytes[ATT_FILE],
+      [ATT_FILE]: readAll || wholeLog(ATT_FILE),
       [CP_FILE]: readAll || wholeLog(CP_FILE),
       [WIT_FILE]: readAll || wholeLog(WIT_FILE),
     };
@@ -219,6 +225,17 @@ class AttestationStore {
       return { stored: false, reason: 'rate-limited' };
     }
 
+    let mine = this._heldBy.get(att.by);
+    if (mine) this._heldBy.delete(att.by);
+    else {
+      mine = new Set();
+      // At most maxAttesters chains: a new attester takes the place of the one updated least recently
+      // (never this node's own, which restores its chain cursor at start).
+      if (this._heldBy.size >= this._maxAttesters) this._dropAttester(this._leastRecentAttester());
+    }
+    this._heldBy.set(att.by, mine);   // most recently updated last
+    mine.add(key);
+    this._recount(att.by, mine.size - 1, mine.size);
     this._seen.add(key);
     this._order.set(key, { of: att.of, by: att.by, seq: att.seq });
 
@@ -822,16 +839,63 @@ class AttestationStore {
     return true;
   }
 
+  /** @private While over the cap, the attester holding the most loses its oldest attestation. When the
+   *  store is over the cap some attester holds more than its share (max / attesters held), and the one
+   *  holding the most is such an attester, so no attester at or under its share loses anything. O(1). */
   _evict() {
-    while (this._seen.size > this._max && this._order.size) {
-      const [sig, { of, by, seq }] = this._order.entries().next().value;
-      this._order.delete(sig);
-      if (!this._seen.delete(sig)) continue;
-      const cmbIdx = this._byCmb.get(of);
-      if (cmbIdx) { this._unkeep(ATT_FILE, cmbIdx.get(sig)); cmbIdx.delete(sig); if (cmbIdx.size === 0) this._byCmb.delete(of); }
-      const chain = this._byAttester.get(by);
-      if (chain) { chain.delete(seq); if (chain.size === 0) this._byAttester.delete(by); }
+    while (this._seen.size > this._max && this._maxCount > 0) {
+      const [by] = this._byCount.get(this._maxCount);
+      this._dropAttestation(this._heldBy.get(by).values().next().value);
+    }
+  }
+
+  /** @private The attester updated least recently, other than this node itself. */
+  _leastRecentAttester() {
+    const it = this._heldBy.keys();
+    const first = it.next().value;
+    return first === this._selfId && this._heldBy.size > 1 ? it.next().value : first;
+  }
+
+  /** @private Drop every attestation one attester has here. O(its chain). */
+  _dropAttester(by) {
+    const mine = this._heldBy.get(by);
+    if (mine) for (const key of [...mine]) this._dropAttestation(key);
+  }
+
+  /** @private Drop one attestation from every index. */
+  _dropAttestation(key) {
+    const e = this._order.get(key);
+    if (!e) return;
+    this._order.delete(key);
+    this._seen.delete(key);
+    const cmbIdx = this._byCmb.get(e.of);
+    const att = cmbIdx && cmbIdx.get(key);
+    if (att) this._unkeep(ATT_FILE, att);
+    if (cmbIdx) { cmbIdx.delete(key); if (cmbIdx.size === 0) this._byCmb.delete(e.of); }
+    // Two attestations can share a position (a chain restarted): only this one's slot is cleared.
+    const chain = this._byAttester.get(e.by);
+    if (chain && chain.get(e.seq) === att) { chain.delete(e.seq); if (chain.size === 0) this._byAttester.delete(e.by); }
+    const mine = this._heldBy.get(e.by);
+    if (mine && mine.delete(key)) {
+      this._recount(e.by, mine.size + 1, mine.size);
+      if (mine.size === 0) this._heldBy.delete(e.by);
+    }
+  }
+
+  /** @private An attester's count went from `from` to `to` (by one, or to 0 when its chain is
+   *  dropped one by one): move it between the count sets and keep the most held. Amortised O(1). */
+  _recount(by, from, to) {
+    if (from > 0) {
+      const s = this._byCount.get(from);
+      if (s) { s.delete(by); if (s.size === 0) this._byCount.delete(from); }
+    }
+    if (to > 0) {
+      let s = this._byCount.get(to);
+      if (!s) { s = new Set(); this._byCount.set(to, s); }
+      s.add(by);
+      if (to > this._maxCount) this._maxCount = to;
     }
+    while (this._maxCount > 0 && !this._byCount.has(this._maxCount)) this._maxCount--;
   }
 }
 
diff --git a/tests/attestation-rotation.test.js b/tests/attestation-rotation.test.js
index 5707fa93..f20ef166 100644
--- a/tests/attestation-rotation.test.js
+++ b/tests/attestation-rotation.test.js
@@ -119,14 +119,29 @@ describe('attestation log rotation — at start', () => {
     assert.deepStrictEqual(again.checkpointsOf('A').map((c) => c.upto_seq), [n - 1, n]);
   });
 
-  it('read budgets: the checkpoint and witness logs whole at their caps, attestations what their cap holds, no more than 0.13.16 read in all', () => {
+  it('read budgets: every log whole at its caps (what the caps hold, and as much again before a rotation)', () => {
     const st = new AttestationStore();
     const b = st._readBudget;
     // Measured lines: an attestation ~520 bytes, a checkpoint ~315, a witness ~380.
-    assert.ok(b[ATT] >= 50000 * 520 * 1.3, `attestations ${b[ATT]}`);
+    assert.ok(b[ATT] >= 2 * 50000 * 520 * 1.3, `attestations ${b[ATT]}`);
     assert.ok(b[CP] >= 2 * 32 * 1024 * 315 * 1.3, `checkpoints ${b[CP]}`);
     assert.ok(b[WIT] >= 2 * (50000 * 380 + 1024 * 2048), `witnesses ${b[WIT]}`);
-    assert.ok(b[ATT] + b[CP] + b[WIT] <= (64 + 16 + 32) * 1024 * 1024, `in all ${b[ATT] + b[CP] + b[WIT]}`);
+  });
+
+  it("a quiet attester's attestations at the head of a rotated log survive a restart", () => {
+    const dir = tmpdir('att-rot-quiet-att-');
+    // What the caps hold (6 attestations) is far less than may sit beyond it before a rotation (8 KiB).
+    const opts = { dir, max: 6, rotateBytes: 8192, log: () => {} };
+    const st = new AttestationStore(opts);
+    for (let i = 1; i <= 2; i++) st.record(att(i, 'Q'));   // a quiet attester
+    let i = 0;
+    while (st._rotations[ATT] === 0) st.record(att(++i, 'F'));
+    // Q is now at the head of the live log; F churns until just before the next rotation.
+    while (fs.statSync(path.join(dir, ATT)).size - st._held[ATT] < 8192 - 200) st.record(att(++i, 'F'));
+    assert.strictEqual(st._rotations[ATT], 1);
+    assert.ok(fs.statSync(path.join(dir, ATT)).size > 6 * 720, 'the live log is longer than what the caps hold');
+    const again = new AttestationStore(opts);
+    assert.deepStrictEqual(again.chainOf('Q').map((a) => a.seq), [1, 2], "the quiet attester's chain is reloaded");
   });
 
   it('a rotation that crashed after linking is tidied at the next start', () => {
diff --git a/tests/attestation-store.test.js b/tests/attestation-store.test.js
index c1bdd25b..1d5dee5f 100644
--- a/tests/attestation-store.test.js
+++ b/tests/attestation-store.test.js
@@ -414,3 +414,54 @@ describe('AttestationStore — position eviction is O(1)', () => {
     assert.strictEqual(st.witnessesFor('B', 1).length, 1, 'the newest stayed');
   });
 });
+
+// 0.14.0 review follow-up: the 50,000 cap was one FIFO across attesters, so one attester signing many
+// attestations flushed every other attester's chain (and with it the omission evidence).
+describe('AttestationStore — the cap is shared out by attester', () => {
+  it("one attester signing far beyond its share leaves every other attester's chain intact", () => {
+    const st = new AttestationStore({ max: 1000, maxAttesters: 16 });
+    const honest = Array.from({ length: 10 }, (_, k) => `H${k}`);
+    for (let s = 0; s < 50; s++) for (const by of honest) st.record(makeChain(by, 50)[s]);
+    for (const a of makeChain('F', 100000)) st.record(a);
+    for (const by of honest) {
+      assert.strictEqual(st.chainOf(by).length, 50, `${by} keeps its whole chain`);
+      assert.deepStrictEqual(st.verifyChain(by), { ok: true, gaps: [], breaks: [] });
+    }
+    assert.strictEqual(st.size(), 1000, 'the global bound holds');
+    assert.strictEqual(st.chainOf('F').length, 500, 'the flooder keeps what is left, its newest');
+    assert.strictEqual(st.chainOf('F')[0].seq, 99501);
+    assert.deepStrictEqual(st.verifyChain('F'), { ok: true, gaps: [], breaks: [] });
+  });
+
+  it('when full, attesters over their share lose their oldest until each holds its share', () => {
+    const st = new AttestationStore({ max: 1000, maxAttesters: 16 });
+    const chains = ['A', 'B', 'C', 'D'].map((by) => makeChain(by, 1000));
+    for (let s = 0; s < 1000; s++) for (const c of chains) st.record(c[s]);
+    for (const by of ['A', 'B', 'C', 'D']) {
+      assert.strictEqual(st.chainOf(by).length, 250, `${by} holds max / 4`);
+      assert.strictEqual(st.chainOf(by)[0].seq, 751, 'its newest');
+    }
+    // A fifth attester takes its share from the others, not from itself.
+    for (const a of makeChain('E', 300)) st.record(a);
+    for (const by of ['A', 'B', 'C', 'D', 'E']) assert.strictEqual(st.chainOf(by).length, 200, `${by} holds max / 5`);
+  });
+
+  it("holds at most maxAttesters chains, dropping the one updated least recently, never this node's own", () => {
+    const st = new AttestationStore({ max: 1000, maxAttesters: 4, selfId: 'me' });
+    st.record(makeChain('me', 1)[0]);
+    for (const by of ['A', 'B', 'C']) st.record(makeChain(by, 1)[0]);
+    st.record(makeChain('D', 1)[0]);   // 'me' is least recently updated, so A goes
+    assert.deepStrictEqual(['me', 'A', 'B', 'C', 'D'].map((by) => st.chainOf(by).length), [1, 0, 1, 1, 1]);
+    st.record(makeChain('E', 1)[0]);   // then B
+    assert.deepStrictEqual(['me', 'B', 'E'].map((by) => st.chainOf(by).length), [1, 0, 1]);
+    assert.strictEqual(st.size(), 4);
+  });
+
+  it('two attestations at one position: dropping the older leaves the newer in the chain', () => {
+    const st = new AttestationStore({ max: 2 });
+    st.record({ of: 'c1', by: 'A', seq: 1, prev: 'genesis', sig: 'old' });
+    st.record({ of: 'c2', by: 'A', seq: 1, prev: 'genesis', sig: 'restarted' });
+    st.record({ of: 'c3', by: 'A', seq: 2, prev: chainHash('restarted'), sig: 's2' });   // drops 'old'
+    assert.deepStrictEqual(st.chainOf('A').map((a) => a.sig), ['restarted', 's2']);
+  });
+});

From 0a2d254fa4c0bb7003b2c2bd0877d45045d51a43 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Fri, 2 Oct 2026 02:41:26 +0100
Subject: [PATCH 060/148] 0.14.0 review: only the spelling a signer writes is
 stored

Base64url decoding ignores padding, whitespace and stray characters, and the
chain hash and Merkle root are computed over the signature as written, so a
re-spelling of an attestation's signature that arrived first made its
attester's chain look broken. A gossiped attestation, checkpoint or witness
whose signature is not 64 bytes in unpadded base64url is now refused after
the repeat check and before the key lookup, budget and verification. It is
counted (metrics().signaturesNotCanonical) and said once per 10 s per peer
(signature-not-canonical). This node checks its own signatures before it
records or gossips one.

The once-per-10 s reporting is now one mechanism (_noteDrop/_sayDrops) for
budget drops and refusals, and the token bucket a shared helper (takeToken);
metrics().gossipOverBudget keeps the total of budget drops.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 CHANGELOG.md                        |  17 +++-
 lib/attestation-store.js            |   5 +-
 lib/frame-handler.js                |   6 +-
 lib/node.js                         | 153 +++++++++++++++++++---------
 tests/admission-attestation.test.js |   4 +-
 tests/gossip-budget.test.js         | 108 +++++++++++++++++---
 6 files changed, 223 insertions(+), 70 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1020c843..77b81b7e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -198,11 +198,18 @@ debt, and the daemon's log flood. Every item has a test that fails without its f
 - **A drop is attributable.** A `gossip-over-budget` metric (`fromPeerId`, `from`, `dropped`,
   `frames` by type, and up to 16 `authors` whose statements were dropped) and one log line name the
   peer, at most once per 10 s per peer: the first drop at once, the rest when the 10 s close, so every
-  drop is counted. A gap it leaves is told apart from an omission by the attester. Budgets are kept for
-  at most 4,096 peers, the least recently active evicted in O(1), without scanning.
-- **An attestation is de-duplicated by its signature's bytes.** Base64url decoding ignores padding,
-  whitespace and stray characters. One signature could be spelled any number of ways that all verify,
-  and each spelling was stored and relayed as a new attestation.
+  drop is counted (`gossipOverBudget` in `metrics()` keeps the total). A gap it leaves is told apart
+  from an omission by the attester. Budgets are kept for at most 4,096 peers, the least recently active
+  evicted in O(1), without scanning.
+- **Only the spelling a signer writes is stored.** Base64url decoding ignores padding, whitespace and
+  stray characters, so one signature could be spelled any number of ways that all verify. Each spelling
+  was stored and relayed as a new attestation. The chain hash and the Merkle root are computed over the
+  signature as written, so a re-spelling that arrived first made its attester's chain look broken. A
+  gossiped attestation, checkpoint or witness whose signature is not 64 bytes in unpadded base64url is
+  now refused before anything is spent on it. It is counted (`signaturesNotCanonical` in `metrics()`)
+  and said like a budget drop (`signature-not-canonical`). A re-spelling of an attestation already
+  held is a repeat. Every signer sym knows writes the canonical spelling, and this node checks its own
+  before recording one.
 - **A dropped attestation is logged once a minute per peer and reason, with a count.** It was logged
   once per frame, and one naming a signer whose key is not held is dropped before any budget.
 
diff --git a/lib/attestation-store.js b/lib/attestation-store.js
index 603b5d51..2bf1d75a 100644
--- a/lib/attestation-store.js
+++ b/lib/attestation-store.js
@@ -94,6 +94,9 @@ function sigKey(sig) {
   return bytes.length === 64 ? bytes.toString('base64url') : sig;
 }
 
+/** Whether a signature is spelled as an Ed25519 signer writes it: 64 bytes, unpadded base64url. */
+const isCanonicalSig = (sig) => typeof sig === 'string' && CANONICAL_SIG.test(sig);
+
 /** Write a whole buffer to a file descriptor: a write may be short. @returns {number} bytes written */
 function writeAll(fd, buf) {
   let off = 0;
@@ -899,4 +902,4 @@ class AttestationStore {
   }
 }
 
-module.exports = { AttestationStore, chainHash, isPosition, sigKey };
+module.exports = { AttestationStore, chainHash, isPosition, sigKey, isCanonicalSig };
diff --git a/lib/frame-handler.js b/lib/frame-handler.js
index 64343c77..c02772e5 100644
--- a/lib/frame-handler.js
+++ b/lib/frame-handler.js
@@ -1594,9 +1594,9 @@ class FrameHandler {
     const att = msg && msg.attestation;
     if (!att) return;
     const r = this._node._ingestAttestation(att, peerId, peerName);
-    // A repeat, a copy past the per-CMB limit, and one past the peer's budget (which says its own
-    // drops) are quiet.
-    if (r.ok || !r.reason || r.reason === 'duplicate' || r.reason === 'rate-limited' || r.reason === 'over-budget') return;
+    // A repeat, a copy past the per-CMB limit, and one past the peer's budget or with a signature not
+    // spelled canonically (both said by the node, once per 10 s) are quiet here.
+    if (r.ok || !r.reason || r.reason === 'duplicate' || r.reason === 'rate-limited' || r.reason === 'over-budget' || r.reason === 'non-canonical-signature') return;
     if (r.reason === 'bad-signature') {
       this._node.emit('metric', { type: 'attestation-rejected', from: peerName, of: att.of, by: att.by, reason: 'invalid' });
     }
diff --git a/lib/node.js b/lib/node.js
index 5a06aac2..143f9476 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -27,7 +27,7 @@ const { MeshNode } = require('./core');
 const { nodeDir, loadOrCreateIdentity, acquireIdentityLock, log: logMsg } = require('./config');
 const { assertTestSandbox } = require('./core/state-root');
 const { MemoryStore } = require('./memory-store');
-const { AttestationStore, chainHash, isPosition } = require('./attestation-store');
+const { AttestationStore, chainHash, isPosition, isCanonicalSig } = require('./attestation-store');
 const { RoleGrantStore } = require('./role-grant-store');
 const { RosterKeyRegistry } = require('./roster-keys');
 const { RoomOwnershipRegistry } = require('./room-ownership');
@@ -110,6 +110,26 @@ const GOSSIP_REPORT_MS = 10000;
 /** Peers with a budget held at once; the least recently active goes first, in O(1). */
 const GOSSIP_MAX_PEERS = 4096;
 
+/**
+ * Take a token from `key`'s bucket in `buckets`: a Map ordered least recently used first and held to
+ * `max` by evicting its head (O(1), no scan), each bucket refilled at `rate` a second up to `burst`.
+ * A clock stepped back refills nothing and stalls nothing. @returns {boolean} whether a token was taken
+ */
+function takeToken(buckets, key, rate, burst, now, max) {
+  let b = buckets.get(key);
+  if (b) buckets.delete(key);
+  else {
+    b = { tokens: burst, at: now };
+    if (buckets.size >= max) buckets.delete(buckets.keys().next().value);
+  }
+  buckets.set(key, b); // most recently used last
+  const elapsed = now - b.at;
+  if (elapsed > 0) b.tokens = Math.min(burst, b.tokens + (elapsed * rate) / 1000);
+  b.at = now;
+  if (b.tokens >= 1) { b.tokens -= 1; return true; }
+  return false;
+}
+
 function refuseClearThroughRelay(node, peerId, peer) {
   if (!node._clearRefused) node._clearRefused = new Set();
   if (node._clearRefused.has(peerId)) return;
@@ -275,8 +295,10 @@ class SymNode extends EventEmitter {
     // ({ perSecond, burst }) changes it.
     this._gossipRate = (opts.gossipBudget && opts.gossipBudget.perSecond) || GOSSIP_PER_SECOND;
     this._gossipBurst = (opts.gossipBudget && opts.gossipBudget.burst) || GOSSIP_BURST;
-    this._gossipBuckets = new Map(); // peerId -> bucket, least recently active first
+    this._gossipBuckets = new Map(); // peerId -> { tokens, at }, least recently active first
     this._gossipClock = Date.now;
+    // What gossip this node dropped unverified, said at most once per 10 s per metric and key.
+    this._dropReports = new Map();   // `${metric}|${key}` -> report, least recently dropped first
     // Restore the per-attester chain cursor from the reloaded own-chain so `seq`
     // stays monotonic and `prev` keeps linking across restarts — otherwise a restart
     // would reset the chain to genesis and read as a gap (false omission). Genesis
@@ -440,6 +462,8 @@ class SymNode extends EventEmitter {
       llmTokensOut: 0,       // Total output tokens
       llmModel: null,        // Last model used
       startedAt: null,       // When the node started
+      gossipOverBudget: 0,   // gossiped statements dropped unverified, past their peer's budget
+      signaturesNotCanonical: 0, // gossiped statements refused for a signature not spelled canonically
     };
 
     // LLM cost pricing (USD per token). Updated by reportLLMUsage().
@@ -987,6 +1011,8 @@ class SymNode extends EventEmitter {
     };
     try {
       signAttestation(att, this._identity.privateKey);
+      // Peers refuse a signature not spelled canonically; one of ours never is, and is never recorded.
+      if (!isCanonicalSig(att.sig)) throw new Error('signature not in canonical form');
       // Advance the per-attester chain: the next attestation's `prev` is this one's
       // signature hash, so any dropped attestation breaks the link (omission-evidence).
       this._attestHead = crypto.createHash('sha256').update(att.sig).digest('hex');
@@ -1126,6 +1152,7 @@ class SymNode extends EventEmitter {
     };
     try {
       signCheckpoint(cp, this._identity.privateKey);
+      if (!isCanonicalSig(cp.sig)) throw new Error('signature not in canonical form');
       this._attestations.recordCheckpoint(cp);
       this._gossipToRoster({ type: 'checkpoint', checkpoint: cp });
       return cp;
@@ -1155,6 +1182,7 @@ class SymNode extends EventEmitter {
     if (held && held.root === cp.root) return { ok: false, reason: 'duplicate' };
     if (this._attestations.conflictAt(cp.by, cp.upto_seq)?.root === cp.root) return { ok: false, reason: 'duplicate' };
     if (this._attestations.isStale(cp.by, cp.upto_seq)) return { ok: false, reason: 'stale' };
+    if (!isCanonicalSig(cp.sig)) return this._refuseSpelling(fromPeerId, 'checkpoint', cp.by);
     const key = this._identityKey(cp.by);
     if (!key) return { ok: false, reason: 'unknown-attester-key' };
     if (!this._gossipBudget(fromPeerId, 'checkpoint', cp.by)) return { ok: false, reason: 'over-budget' };
@@ -1178,61 +1206,90 @@ class SymNode extends EventEmitter {
    * frame spends only the budget of the peer that sent it; an honest peer relays only what it has
    * verified and stored, so its lane carries no forgeries, and the bucket refills, so a peer that
    * stops flooding is heard again within burst/rate seconds. A dropped frame changes nothing: it is not
-   * marked seen, so another peer's copy is taken. Drops are said with the peer named, at most once per
-   * 10 s (see _reportGossipDrops), so a gap they leave is attributable to this node, not the attester.
-   * O(1): the bucket map is ordered least recently active first and bounded by evicting its head.
+   * marked seen, so another peer's copy is taken. Drops are said with the peer named (see _noteDrop),
+   * so a gap they leave is attributable to this node, not the attester. O(1).
    * @returns {boolean} whether the frame may be verified
    * @private
    */
   _gossipBudget(peerId, type, author) {
+    if (takeToken(this._gossipBuckets, peerId, this._gossipRate, this._gossipBurst, this._gossipClock(), GOSSIP_MAX_PEERS)) return true;
+    this._noteDrop('gossip-over-budget', peerId, { frame: type, author });
+    return false;
+  }
+
+  /**
+   * Refuse a gossiped statement whose signature is not spelled canonically (64 bytes, unpadded
+   * base64url), before anything else is spent on it. Base64url decoding ignores padding, whitespace and
+   * stray characters, so one signature can be spelled many ways that all verify; but the chain hash and
+   * the Merkle root are computed over the signature as written, so only the spelling its signer wrote
+   * may be stored. Every signer sym knows writes that one. Counted and said like a budget drop.
+   * @private
+   */
+  _refuseSpelling(peerId, type, author) {
+    this._noteDrop('signature-not-canonical', peerId, { frame: type, author });
+    return { ok: false, reason: 'non-canonical-signature' };
+  }
+
+  /**
+   * Count gossip dropped unverified, for `metric` under `key` (the delivering peer), and say it at most
+   * once per GOSSIP_REPORT_MS per key: the first drop at once, the rest when that window closes, so
+   * every drop is counted even when the flood stops. O(1); at most GOSSIP_MAX_PEERS reports are held,
+   * the least recently dropped said and let go first.
+   * @private
+   */
+  _noteDrop(metric, key, { frame, author } = {}) {
     const now = this._gossipClock();
-    const buckets = this._gossipBuckets;
-    let b = buckets.get(peerId);
-    if (b) buckets.delete(peerId);
+    const id = `${metric}|${key}`;
+    const reports = this._dropReports;
+    let r = reports.get(id);
+    if (r) reports.delete(id);
     else {
-      b = { tokens: this._gossipBurst, at: now, dropped: 0, frames: {}, authors: new Set(), reportedAt: -Infinity, timer: null };
-      if (buckets.size >= GOSSIP_MAX_PEERS) {
-        const [oldId, old] = buckets.entries().next().value;
-        buckets.delete(oldId);
-        this._reportGossipDrops(oldId, old, now);
+      r = { metric, key, dropped: 0, frames: {}, authors: new Set(), reportedAt: -Infinity, timer: null };
+      if (reports.size >= GOSSIP_MAX_PEERS) {
+        const [oldId, old] = reports.entries().next().value;
+        reports.delete(oldId);
+        this._sayDrops(old, now);
       }
     }
-    buckets.set(peerId, b); // most recently active last
-    const elapsed = now - b.at;
-    if (elapsed > 0) b.tokens = Math.min(this._gossipBurst, b.tokens + (elapsed * this._gossipRate) / 1000);
-    b.at = now; // a clock stepped back refills nothing, and stalls nothing
-    if (b.tokens >= 1) { b.tokens -= 1; return true; }
-    b.dropped++;
-    b.frames[type] = (b.frames[type] || 0) + 1;
-    if (author && b.authors.size < 16) b.authors.add(String(author));
-    if (now - b.reportedAt >= GOSSIP_REPORT_MS) this._reportGossipDrops(peerId, b, now);
-    else if (!b.timer) {
-      // The rest of this window is said when it closes, so a flood that stops is still counted.
-      b.timer = setTimeout(() => {
-        b.timer = null;
-        try { this._reportGossipDrops(peerId, b); } catch (err) { this._log(`Gossip drop report failed: ${err && err.message}`); }
-      }, Math.max(0, GOSSIP_REPORT_MS - (now - b.reportedAt)));
-      if (typeof b.timer.unref === 'function') b.timer.unref();
+    reports.set(id, r); // most recently dropped last
+    if (metric === 'gossip-over-budget') this._metrics.gossipOverBudget++;
+    else if (metric === 'signature-not-canonical') this._metrics.signaturesNotCanonical++;
+    r.dropped++;
+    if (frame) r.frames[frame] = (r.frames[frame] || 0) + 1;
+    if (author && r.authors.size < 16) r.authors.add(String(author));
+    if (now - r.reportedAt >= GOSSIP_REPORT_MS) this._sayDrops(r, now);
+    else if (!r.timer) {
+      r.timer = setTimeout(() => {
+        r.timer = null;
+        try { this._sayDrops(r); } catch (err) { this._log(`Gossip drop report failed: ${err && err.message}`); }
+      }, Math.max(0, GOSSIP_REPORT_MS - (now - r.reportedAt)));
+      if (typeof r.timer.unref === 'function') r.timer.unref();
     }
-    return false;
   }
 
   /**
-   * Say what a peer's budget dropped since it was last said: one log line and one
-   * `gossip-over-budget` metric `{ fromPeerId, from, dropped, frames: {attestation, checkpoint,
-   * witness}, authors (up to 16 signers whose statements were dropped), perSecond }`. @private
+   * Say what was dropped under one report since it was last said: one log line and one metric,
+   * `{ type, fromPeerId, from, dropped, frames: {attestation, checkpoint, witness}, authors (up to 16
+   * signers named by what was dropped) }`, plus `perSecond` for `gossip-over-budget`. @private
    */
-  _reportGossipDrops(peerId, b, now = this._gossipClock()) {
-    if (b.timer) { clearTimeout(b.timer); b.timer = null; }
-    if (!b.dropped) return;
-    const name = this._peers?.get(peerId)?.name || null;
-    const ev = { type: 'gossip-over-budget', fromPeerId: peerId, from: name || peerId, dropped: b.dropped, frames: { ...b.frames }, authors: [...b.authors], perSecond: this._gossipRate };
-    b.dropped = 0;
-    b.frames = {};
-    b.authors = new Set();
-    b.reportedAt = now;
+  _sayDrops(r, now = this._gossipClock()) {
+    if (r.timer) { clearTimeout(r.timer); r.timer = null; }
+    if (!r.dropped) return;
+    const name = this._peers?.get(r.key)?.name || null;
+    const ev = { type: r.metric, fromPeerId: r.key, from: name || r.key, dropped: r.dropped, frames: { ...r.frames }, authors: [...r.authors] };
     const what = Object.entries(ev.frames).map(([t, n]) => `${n} ${t}`).join(', ');
-    this._log(`Gossip from ${ev.from} over its budget (${this._gossipRate}/s): ${ev.dropped} new statement(s) dropped unverified (${what})`);
+    let line;
+    if (r.metric === 'gossip-over-budget') {
+      ev.perSecond = this._gossipRate;
+      line = `Gossip from ${ev.from} over its budget (${this._gossipRate}/s): ${ev.dropped} new statement(s) dropped unverified (${what})`;
+    } else {
+      line = `Gossip from ${ev.from}: ${ev.dropped} statement(s) refused unverified, signature not in canonical form (${what})`;
+    }
+    r.dropped = 0;
+    r.frames = {};
+    r.authors = new Set();
+    r.reportedAt = now;
+    this._log(line);
     this.emit('metric', ev);
   }
 
@@ -1254,6 +1311,7 @@ class SymNode extends EventEmitter {
     };
     try {
       signWitness(w, this._identity.privateKey);
+      if (!isCanonicalSig(w.sig)) throw new Error('signature not in canonical form');
       this._attestations.recordWitness(w);
       this._gossipToRoster({ type: 'witness', witness: w });
     } catch (err) {
@@ -1274,6 +1332,7 @@ class SymNode extends EventEmitter {
     const held = this._attestations.witnessSeen(w.attester, w.upto_seq, w.by);
     if (held && held.root === w.root) return { ok: false, reason: 'duplicate' };
     if (this._attestations.witnessConflictRoot(w.attester, w.upto_seq, w.by) === w.root) return { ok: false, reason: 'duplicate' };
+    if (!isCanonicalSig(w.sig)) return this._refuseSpelling(fromPeerId, 'witness', w.by);
     const key = this._identityKey(w.by);
     if (!key) return { ok: false, reason: 'unknown-witness-key' };
     if (!this._gossipBudget(fromPeerId, 'witness', w.by)) return { ok: false, reason: 'over-budget' };
@@ -1344,9 +1403,11 @@ class SymNode extends EventEmitter {
     // peer (handshake key map); a relayed attester awaits the roster key registry.
     // A signature already held was verified when it was stored: a repeat is dropped before the
     // signature check, which is most of what a flood of repeats costs.
-    // `has` compares the signature's bytes, so a re-spelling of one held is a repeat too. Only a new
-    // statement spends the peer's budget, before its signature is checked.
+    // `has` compares the signature's bytes, so a re-spelling of one held is a repeat too; a new one
+    // is refused unless spelled as its signer wrote it (the chain hashes the signature as written).
+    // Only a new statement spends the peer's budget, before its signature is checked.
     if (this._attestations.has(att.sig)) return { ok: false, reason: 'duplicate' };
+    if (!isCanonicalSig(att.sig)) return this._refuseSpelling(fromPeerId, 'attestation', att.by);
     const attesterKey = this._identityKey(att.by);
     if (!attesterKey) return { ok: false, reason: 'unknown-attester-key' };
     if (!this._gossipBudget(fromPeerId, 'attestation', att.by)) return { ok: false, reason: 'over-budget' };
@@ -1794,7 +1855,7 @@ class SymNode extends EventEmitter {
     if (this._encodeTimer) clearInterval(this._encodeTimer);
     if (this._statsTimer) clearInterval(this._statsTimer);
     if (this._purgeTimer) clearInterval(this._purgeTimer);
-    for (const [peerId, b] of this._gossipBuckets) this._reportGossipDrops(peerId, b);
+    for (const r of [...this._dropReports.values()]) this._sayDrops(r);
     // A throttled inbox write still pending (a drain or an ack in the last second) is flushed,
     // or it is lost: the timer is unref'd and would not hold the process open.
     if (this._inboxPersistTimer) {
diff --git a/tests/admission-attestation.test.js b/tests/admission-attestation.test.js
index f9f45677..0ba4b4db 100644
--- a/tests/admission-attestation.test.js
+++ b/tests/admission-attestation.test.js
@@ -486,7 +486,9 @@ describe('the witness storm', () => {
       const cp = signed({ type: 'checkpoint', by: 'node-att', roster: 'g', upto_seq: 8, root: 'r8', at: 1 }, ATT.priv, signCheckpoint);
       node._ingestCheckpoint(cp, 'node-att');
       assert.strictEqual(node._ingestCheckpoint({ ...cp, sig: 'not-a-signature' }, 'node-att').reason, 'duplicate', 'not even verified');
-      assert.strictEqual(node._ingestCheckpoint({ ...cp, root: 'forged', sig: 'garbage' }, 'node-att').reason, 'bad-signature', 'a different root is verified first');
+      const forgedSig = crypto.randomBytes(64).toString('base64url');
+      assert.strictEqual(node._ingestCheckpoint({ ...cp, root: 'forged', sig: forgedSig }, 'node-att').reason, 'bad-signature', 'a different root is verified first');
+      assert.strictEqual(node._ingestCheckpoint({ ...cp, root: 'forged', sig: 'garbage' }, 'node-att').reason, 'non-canonical-signature', 'one not spelled as a signature is not even verified');
       assert.strictEqual(node._attestations.hasConflict('node-att', 8), false, 'and an unverified one marks nothing');
       const w = signed({ type: 'witness', attester: 'node-att', roster: 'g', upto_seq: 8, root: 'r8', by: 'node-wit', role: 'participant', at: 1 }, WIT.priv, signWitness);
       node._ingestWitness(w, 'node-wit');
diff --git a/tests/gossip-budget.test.js b/tests/gossip-budget.test.js
index a0bec10d..368bb30c 100644
--- a/tests/gossip-budget.test.js
+++ b/tests/gossip-budget.test.js
@@ -22,6 +22,7 @@ const { SymNode } = require('../lib/node');
 const { NullDiscovery } = require('../lib/discovery');
 const { nodeDir } = require('../lib/config');
 const { signAttestation, signCheckpoint, signWitness } = require('../lib/core');
+const { chainHash, isCanonicalSig } = require('../lib/attestation-store');
 
 const ROOM = 'g';
 const kp = () => {
@@ -229,11 +230,12 @@ describe('gossip budget — what it reports, and what it keeps', () => {
       }
       assert.ok(dropped > 10000, `${dropped} dropped`);
       assert.strictEqual(metrics.length, 1, 'said once in the window, at the first drop');
-      const b = node._gossipBuckets.get('flooder');
-      assert.ok(b.timer, 'the rest of the window is said when it closes');
-      node._reportGossipDrops('flooder', b);   // what the timer does
+      const report = node._dropReports.get('gossip-over-budget|flooder');
+      assert.ok(report.timer, 'the rest of the window is said when it closes');
+      node._sayDrops(report);   // what the timer does
       assert.strictEqual(metrics.length, 2);
       assert.strictEqual(metrics.reduce((s, m) => s + m.dropped, 0), dropped, 'every drop is counted');
+      assert.strictEqual(node.metrics().gossipOverBudget, dropped, 'and kept in the node metrics');
       for (const m of metrics) {
         assert.strictEqual(m.fromPeerId, 'flooder');
         assert.strictEqual(m.from, 'the-flooder');
@@ -246,13 +248,14 @@ describe('gossip budget — what it reports, and what it keeps', () => {
 
   it('keeps at most 4,096 buckets, evicting the least recently active, without scanning the map', () => {
     withNode(1, ({ node, keys: [A] }) => {
-      let iterations = 0;
+      let iterations = 0;   // iterator steps taken over the bucket map
+      const counted = (it) => ({ next() { iterations++; return it.next(); }, [Symbol.iterator]() { return this; } });
       class Counted extends Map {
-        entries() { iterations++; return super.entries(); }
-        keys() { iterations++; return super.keys(); }
-        values() { iterations++; return super.values(); }
-        forEach(...a) { iterations++; return super.forEach(...a); }
-        [Symbol.iterator]() { iterations++; return super.entries(); }
+        entries() { return counted(super.entries()); }
+        keys() { return counted(super.keys()); }
+        values() { return counted(super.values()); }
+        forEach(fn, self) { for (const [k, v] of this) fn.call(self, v, k, this); }
+        [Symbol.iterator]() { return counted(super.entries()); }
       }
       node._gossipBuckets = new Counted();
       const frame = () => forgedAttestation(A);
@@ -265,7 +268,7 @@ describe('gossip budget — what it reports, and what it keeps', () => {
       assert.ok(node._gossipBuckets.has('busy'), 'an active peer keeps its bucket');
       assert.strictEqual(node._gossipBurst - node._gossipBuckets.get('busy').tokens, 50 + 6, 'and what it spent');
       assert.ok(!node._gossipBuckets.has('peer-0'), 'the least recently active went');
-      assert.strictEqual(iterations, 6001 - 4096, 'one O(1) look at the head per eviction, nothing else');
+      assert.strictEqual(iterations, 6001 - 4096, 'one step at the head per eviction, nothing else');
     });
   });
 });
@@ -286,12 +289,89 @@ describe('gossip budget — the frame handler', () => {
         node._frameHandler._handleAttestation('p', 'peer-p', { attestation: { ...forgedAttestation(A).attestation, by: 'nobody' } });
         assert.strictEqual(logs.length, 2);
         assert.match(logs[1], /and 4999 more since it was last said/);
-        // A drop past the budget is said by the budget, not here.
-        node._gossipBuckets.set('q', { tokens: 0, at: clock.t, dropped: 0, frames: {}, authors: new Set(), reportedAt: clock.t, timer: null });
+        // A drop past the budget, or for a signature not spelled canonically, is said by the node, not here.
+        node._gossipBuckets.set('q', { tokens: 0, at: clock.t });
         node._frameHandler._handleAttestation('q', 'peer-q', forgedAttestation(A));
-        assert.strictEqual(logs.length, 2);
-        clearTimeout(node._gossipBuckets.get('q').timer);
+        node._frameHandler._handleAttestation('q', 'peer-q', { attestation: { ...forgedAttestation(A).attestation, sig: `${forgedSig()}=` } });
+        assert.strictEqual(logs.filter((l) => l.startsWith('Attestation from peer-q')).length, 0, logs.join('\n'));
+        for (const r of node._dropReports.values()) clearTimeout(r.timer);
       } finally { Date.now = realNow; }
     });
   });
 });
+
+// 0.14.0 review follow-up: base64url decoding ignores padding, whitespace and stray characters, so one
+// signature can be spelled many ways that all verify. The chain hash and the Merkle root are computed
+// over the signature as written, so a re-spelling stored first made the attester's chain look broken.
+describe('signature spelling', () => {
+  it('a re-spelled signature arriving first is refused, unverified and free; the canonical one is then stored and the chain verifies', () => {
+    withNode(1, ({ node, keys: [A] }) => {
+      const reported = [];
+      node.on('metric', (m) => { if (m.type === 'signature-not-canonical') reported.push(m); });
+      const a1 = signed({ of: 'cmb-s1', by: A.id, at: 1, roster: ROOM, method: 'heuristic', verdict: 'aligned', categories: {}, role: 'participant', seq: 1, prev: 'genesis' }, A.priv, signAttestation);
+      const a2 = signed({ of: 'cmb-s2', by: A.id, at: 2, roster: ROOM, method: 'heuristic', verdict: 'aligned', categories: {}, role: 'participant', seq: 2, prev: chainHash(a1.sig) }, A.priv, signAttestation);
+      const s = a1.sig;
+      const respelled = [`${s}=`, `${s}==`, ` ${s}`, `${s.slice(0, 40)}\n${s.slice(40)}`, s.replace(/-/g, '+').replace(/_/g, '/'), `${s}!`];
+      assert.ok(respelled.every((x) => x !== s && Buffer.from(x, 'base64url').equals(Buffer.from(s, 'base64url'))), 'every one is the same signature');
+      for (const sig of respelled) {
+        assert.strictEqual(node._ingestAttestation({ ...a1, sig }, 'm', 'm').reason, 'non-canonical-signature');
+      }
+      assert.strictEqual(node._gossipBuckets.has('m'), false, 'nothing was spent: no signature was checked');
+      assert.strictEqual(node._attestations.has(s), false, 'nothing was stored');
+      assert.strictEqual(node._ingestAttestation(a1, 'p', 'p').ok, true, 'the canonical spelling is stored');
+      assert.strictEqual(node._ingestAttestation(a2, 'p', 'p').ok, true);
+      assert.deepStrictEqual(node._attestations.verifyChain(A.id), { ok: true, gaps: [], breaks: [] }, 'and the chain verifies');
+      assert.strictEqual(node._attestations.chainOf(A.id)[0].sig, s);
+      // Counted, and said once per 10 s with the peer named.
+      assert.strictEqual(node.metrics().signaturesNotCanonical, respelled.length);
+      assert.strictEqual(reported.length, 1);
+      node._sayDrops(node._dropReports.get('signature-not-canonical|m'));
+      assert.deepStrictEqual([reported.length, reported[0].fromPeerId, reported[0].dropped + reported[1].dropped], [2, 'm', respelled.length]);
+    });
+  });
+
+  it('a checkpoint or witness not spelled canonically is refused too, before any signature check', () => {
+    withNode(2, ({ node, keys: [A, W] }) => {
+      const cp = signed({ type: 'checkpoint', by: A.id, roster: ROOM, upto_seq: 8, root: 'r8', at: 1 }, A.priv, signCheckpoint);
+      const w = signed({ type: 'witness', attester: A.id, roster: ROOM, upto_seq: 8, root: 'r8', by: W.id, role: 'participant', at: 1 }, W.priv, signWitness);
+      assert.strictEqual(node._ingestCheckpoint({ ...cp, sig: `${cp.sig}=` }, 'm').reason, 'non-canonical-signature');
+      assert.strictEqual(node._ingestWitness({ ...w, sig: ` ${w.sig}` }, 'm').reason, 'non-canonical-signature');
+      assert.strictEqual(node._gossipBuckets.has('m'), false);
+      assert.strictEqual(node._ingestCheckpoint(cp, 'p').ok, true);
+      assert.strictEqual(node._ingestWitness(w, 'p').ok, true);
+      assert.strictEqual(node._attestations.checkpointAt(A.id, 8).sig, cp.sig);
+      assert.strictEqual(node._attestations.witnessAt(A.id, 8, W.id).sig, w.sig);
+    });
+  });
+
+  it("this node's own signatures are canonical, and one that were not would be neither recorded nor gossiped", () => {
+    withNode(1, ({ node, keys: [A] }) => {
+      const sent = [];
+      node._gossipToRoster = (f) => sent.push(f);
+      const verdicts = { focus: 'admit', issue: 'admit', intent: 'admit', motivation: 'admit', commitment: 'admit', perspective: 'admit', mood: 'admit' };
+      for (let i = 0; i < 200; i++) assert.ok(node._buildAdmissionAttestation(`cmb-own-${i}`, 'aligned', verdicts, 'heuristic'));
+      node._ingestCheckpoint(signed({ type: 'checkpoint', by: A.id, roster: ROOM, upto_seq: 8, root: 'r8', at: 1 }, A.priv, signCheckpoint), 'p');
+      const own = sent.map((f) => f.attestation || f.checkpoint || f.witness).filter((x) => (x.by === node.nodeId));
+      assert.deepStrictEqual([...new Set(own.map((x) => x.type || 'attestation'))].sort(), ['attestation', 'checkpoint', 'witness']);
+      assert.ok(own.every((x) => isCanonicalSig(x.sig)), 'every signature this node made is canonical');
+      // A signer that wrote a short signature: refused at home, not only by peers.
+      const realSign = crypto.sign;
+      const seq = node._attestSeq;
+      const before = sent.length;
+      const cps = node._attestations.checkpointsOf(node.nodeId).length;
+      const cp16 = signed({ type: 'checkpoint', by: A.id, roster: ROOM, upto_seq: 16, root: 'r16', at: 2 }, A.priv, signCheckpoint);
+      crypto.sign = (...a) => realSign(...a).subarray(0, 63);
+      try {
+        assert.strictEqual(node._buildAdmissionAttestation('cmb-short', 'aligned', verdicts, 'heuristic'), null);
+        assert.strictEqual(node._emitCheckpoint(), null);
+        node._attestations.recordCheckpoint(cp16);   // held, so this node would witness it
+        node._witnessCheckpoint(cp16);
+      } finally { crypto.sign = realSign; }
+      assert.strictEqual(node._attestSeq, seq, 'the chain did not advance');
+      assert.strictEqual(sent.length, before, 'nothing was gossiped');
+      assert.strictEqual(node._attestations.byCmb('cmb-short').length, 0, 'nothing was recorded');
+      assert.strictEqual(node._attestations.checkpointsOf(node.nodeId).length, cps, 'no checkpoint of its own was recorded');
+      assert.strictEqual(node._attestations.witnessAt(A.id, 16, node.nodeId), null, 'nor a witness');
+    });
+  });
+});

From 50862836645db162ba0ee3e27f66218eab2b677c Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Fri, 2 Oct 2026 02:44:14 +0100
Subject: [PATCH 061/148] 0.14.0 review: one attester's checkpoints are taken
 at a bounded rate

Each checkpoint a node takes costs every node a witness signed, gossiped and
verified; the per-peer budget bounded what one peer delivers, not what one
attester signs. A node now takes one attester's new checkpoints at most at
4 a second after a burst of 128 (an honest attester commits one every 8
attestations: 0.5 a second in a busy room), keyed by the attester whose
signature was just checked, whichever peer brings them. Past that the
checkpoint is not stored, witnessed or relayed; it is counted
(metrics().checkpointsOverRate) and said once per 10 s
(checkpoint-over-rate, with the peers that brought it). A conflicting copy
for a held position does not spend it. opts.checkpointRate changes it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 CHANGELOG.md                  |  13 +++-
 lib/node.js                   |  79 ++++++++++++++++----
 tests/checkpoint-rate.test.js | 133 ++++++++++++++++++++++++++++++++++
 3 files changed, 210 insertions(+), 15 deletions(-)
 create mode 100644 tests/checkpoint-rate.test.js

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 77b81b7e..8d29ed2d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -174,7 +174,7 @@ debt, and the daemon's log flood. Every item has a test that fails without its f
   position (up to 32,768) for its own; the positions are now indexed by key, and the witness cap takes
   the oldest from the head.
 
-### Fixed — one peer's attestation gossip has a budget
+### Fixed — attestation gossip is budgeted, per peer and per attester
 
 - **A peer's new statements are budgeted (0.13.15's other known limit).** The attestations,
   checkpoints and witnesses one peer delivers may make this node check at most 2,000 new statements a
@@ -201,6 +201,17 @@ debt, and the daemon's log flood. Every item has a test that fails without its f
   drop is counted (`gossipOverBudget` in `metrics()` keeps the total). A gap it leaves is told apart
   from an omission by the attester. Budgets are kept for at most 4,096 peers, the least recently active
   evicted in O(1), without scanning.
+- **One attester's checkpoints cannot make the room sign witnesses without end.** Each checkpoint a
+  node takes costs every node in the room a witness signed, gossiped and verified. The per-peer budget
+  bounds what one peer delivers, not what one attester signs: an attester sending new checkpoints
+  through every peer at once had every node witness each one. A node now takes one attester's new
+  checkpoints at most at 4 a second, after a burst of 128, whichever peer brings them. The rate is
+  spent after the signature is checked, so only that attester spends it. Past it a checkpoint is not
+  stored, witnessed or relayed; it is counted (`checkpointsOverRate` in `metrics()`) and said once per
+  10 s (`checkpoint-over-rate`, naming the attester and the peers that brought it). An attester commits
+  a checkpoint every 8 attestations: 0.5 a second in the busy room above. 4 a second is 8× that, and
+  the burst holds 1,024 attestations gated back to back. A second root for a position already held is
+  still recorded as a conflict. `checkpointRate: { perSecond, burst }` changes it.
 - **Only the spelling a signer writes is stored.** Base64url decoding ignores padding, whitespace and
   stray characters, so one signature could be spelled any number of ways that all verify. Each spelling
   was stored and relayed as a new attestation. The chain hash and the Merkle root are computed over the
diff --git a/lib/node.js b/lib/node.js
index 143f9476..7e9a134d 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -105,6 +105,20 @@ function peerReachedOnlyOverRelay(peer) {
  */
 const GOSSIP_PER_SECOND = 2000;
 const GOSSIP_BURST = 10000;
+/**
+ * One attester's new checkpoints this node takes (stores, witnesses and relays): a burst, then a rate a
+ * second, spent after the signature is checked (so only the attester itself spends it) and whichever
+ * peer brings them. Each checkpoint taken costs every node in the room a witness signed, gossiped and
+ * verified (R−1 of them), so this bounds what one attester's checkpoint flood makes the room sign: at
+ * most 4 witnesses a second per node, where the per-peer budget alone allowed 2,000.
+ *
+ * Sizing. An attester commits a checkpoint every 8 attestations, so one gating G CMBs a second makes
+ * G/8 a second: 0.5 in the busy room above. 4 a second is 8× that (an attester gating 32 CMBs a second
+ * without pause), and the burst of 128 holds 1,024 attestations gated back to back. A conflicting copy
+ * for a position already held does not spend it: it is recorded once and never witnessed or relayed.
+ */
+const CHECKPOINTS_PER_SECOND = 4;
+const CHECKPOINT_BURST = 128;
 /** A peer's dropped statements are said at most once per this many ms (one log line, one metric). */
 const GOSSIP_REPORT_MS = 10000;
 /** Peers with a budget held at once; the least recently active goes first, in O(1). */
@@ -296,6 +310,11 @@ class SymNode extends EventEmitter {
     this._gossipRate = (opts.gossipBudget && opts.gossipBudget.perSecond) || GOSSIP_PER_SECOND;
     this._gossipBurst = (opts.gossipBudget && opts.gossipBudget.burst) || GOSSIP_BURST;
     this._gossipBuckets = new Map(); // peerId -> { tokens, at }, least recently active first
+    // Each attester's rate of new checkpoints taken (see CHECKPOINTS_PER_SECOND); `opts.checkpointRate`
+    // ({ perSecond, burst }) changes it.
+    this._checkpointRate = (opts.checkpointRate && opts.checkpointRate.perSecond) || CHECKPOINTS_PER_SECOND;
+    this._checkpointBurst = (opts.checkpointRate && opts.checkpointRate.burst) || CHECKPOINT_BURST;
+    this._checkpointBuckets = new Map(); // attester -> { tokens, at }, least recently active first
     this._gossipClock = Date.now;
     // What gossip this node dropped unverified, said at most once per 10 s per metric and key.
     this._dropReports = new Map();   // `${metric}|${key}` -> report, least recently dropped first
@@ -464,6 +483,7 @@ class SymNode extends EventEmitter {
       startedAt: null,       // When the node started
       gossipOverBudget: 0,   // gossiped statements dropped unverified, past their peer's budget
       signaturesNotCanonical: 0, // gossiped statements refused for a signature not spelled canonically
+      checkpointsOverRate: 0, // verified checkpoints not taken, past their attester's rate
     };
 
     // LLM cost pricing (USD per token). Updated by reportLLMUsage().
@@ -1187,6 +1207,9 @@ class SymNode extends EventEmitter {
     if (!key) return { ok: false, reason: 'unknown-attester-key' };
     if (!this._gossipBudget(fromPeerId, 'checkpoint', cp.by)) return { ok: false, reason: 'over-budget' };
     if (!verifyCheckpoint(cp, key).valid) return { ok: false, reason: 'bad-signature' };
+    // A new position is taken at most at its attester's rate, whichever peer brings it: past that it is
+    // not stored, witnessed or relayed. Checked after the signature, so no one else can spend it.
+    if (!held && !this._checkpointRateOk(cp.by, fromPeerId)) return { ok: false, reason: 'over-rate' };
     const r = this._attestations.recordCheckpoint(cp);
     if (r.reason === 'conflict' && r.first) {
       // Two signed roots for one position: equivocation, or a chain restarted after a lost log.
@@ -1217,6 +1240,19 @@ class SymNode extends EventEmitter {
     return false;
   }
 
+  /**
+   * Take one of an attester's checkpoint tokens (see CHECKPOINTS_PER_SECOND), keyed by the attester
+   * whose signature was just checked, never by the peer that delivered it. Past the rate the checkpoint
+   * is counted and said like a budget drop (`checkpoint-over-rate`, naming the attester and the peers
+   * that brought it). O(1). @returns {boolean} whether the checkpoint may be taken
+   * @private
+   */
+  _checkpointRateOk(attester, fromPeerId) {
+    if (takeToken(this._checkpointBuckets, attester, this._checkpointRate, this._checkpointBurst, this._gossipClock(), GOSSIP_MAX_PEERS)) return true;
+    this._noteDrop('checkpoint-over-rate', attester, { frame: 'checkpoint', peer: fromPeerId });
+    return false;
+  }
+
   /**
    * Refuse a gossiped statement whose signature is not spelled canonically (64 bytes, unpadded
    * base64url), before anything else is spent on it. Base64url decoding ignores padding, whitespace and
@@ -1237,14 +1273,14 @@ class SymNode extends EventEmitter {
    * the least recently dropped said and let go first.
    * @private
    */
-  _noteDrop(metric, key, { frame, author } = {}) {
+  _noteDrop(metric, key, { frame, author, peer } = {}) {
     const now = this._gossipClock();
     const id = `${metric}|${key}`;
     const reports = this._dropReports;
     let r = reports.get(id);
     if (r) reports.delete(id);
     else {
-      r = { metric, key, dropped: 0, frames: {}, authors: new Set(), reportedAt: -Infinity, timer: null };
+      r = { metric, key, dropped: 0, frames: {}, authors: new Set(), peers: new Set(), reportedAt: -Infinity, timer: null };
       if (reports.size >= GOSSIP_MAX_PEERS) {
         const [oldId, old] = reports.entries().next().value;
         reports.delete(oldId);
@@ -1254,9 +1290,11 @@ class SymNode extends EventEmitter {
     reports.set(id, r); // most recently dropped last
     if (metric === 'gossip-over-budget') this._metrics.gossipOverBudget++;
     else if (metric === 'signature-not-canonical') this._metrics.signaturesNotCanonical++;
+    else if (metric === 'checkpoint-over-rate') this._metrics.checkpointsOverRate++;
     r.dropped++;
     if (frame) r.frames[frame] = (r.frames[frame] || 0) + 1;
     if (author && r.authors.size < 16) r.authors.add(String(author));
+    if (peer && r.peers.size < 16) r.peers.add(String(peer));
     if (now - r.reportedAt >= GOSSIP_REPORT_MS) this._sayDrops(r, now);
     else if (!r.timer) {
       r.timer = setTimeout(() => {
@@ -1268,29 +1306,42 @@ class SymNode extends EventEmitter {
   }
 
   /**
-   * Say what was dropped under one report since it was last said: one log line and one metric,
-   * `{ type, fromPeerId, from, dropped, frames: {attestation, checkpoint, witness}, authors (up to 16
-   * signers named by what was dropped) }`, plus `perSecond` for `gossip-over-budget`. @private
+   * Say what was dropped under one report since it was last said: one log line and one metric. For a
+   * peer: `{ type, fromPeerId, from, dropped, frames: {attestation, checkpoint, witness}, authors (up
+   * to 16 signers named by what was dropped) }`, plus `perSecond` for `gossip-over-budget`. For
+   * `checkpoint-over-rate`: `{ type, attester, dropped, fromPeerIds (up to 16), perSecond }`. @private
    */
   _sayDrops(r, now = this._gossipClock()) {
     if (r.timer) { clearTimeout(r.timer); r.timer = null; }
     if (!r.dropped) return;
-    const name = this._peers?.get(r.key)?.name || null;
-    const ev = { type: r.metric, fromPeerId: r.key, from: name || r.key, dropped: r.dropped, frames: { ...r.frames }, authors: [...r.authors] };
-    const what = Object.entries(ev.frames).map(([t, n]) => `${n} ${t}`).join(', ');
+    let ev;
     let line;
-    if (r.metric === 'gossip-over-budget') {
-      ev.perSecond = this._gossipRate;
-      line = `Gossip from ${ev.from} over its budget (${this._gossipRate}/s): ${ev.dropped} new statement(s) dropped unverified (${what})`;
+    if (r.metric === 'checkpoint-over-rate') {
+      ev = { type: r.metric, attester: r.key, dropped: r.dropped, fromPeerIds: [...r.peers], perSecond: this._checkpointRate };
+      line = `Checkpoints from ${String(r.key).slice(0, 8)} over their rate (${this._checkpointRate}/s): ${ev.dropped} not stored, witnessed or relayed`;
     } else {
-      line = `Gossip from ${ev.from}: ${ev.dropped} statement(s) refused unverified, signature not in canonical form (${what})`;
+      const name = this._peers?.get(r.key)?.name || null;
+      ev = { type: r.metric, fromPeerId: r.key, from: name || r.key, dropped: r.dropped, frames: { ...r.frames }, authors: [...r.authors] };
+      const what = Object.entries(ev.frames).map(([t, n]) => `${n} ${t}`).join(', ');
+      if (r.metric === 'gossip-over-budget') {
+        ev.perSecond = this._gossipRate;
+        line = `Gossip from ${ev.from} over its budget (${this._gossipRate}/s): ${ev.dropped} new statement(s) dropped unverified (${what})`;
+      } else {
+        line = `Gossip from ${ev.from}: ${ev.dropped} statement(s) refused unverified, signature not in canonical form (${what})`;
+      }
     }
+    this._resetDrops(r, now);
+    this._log(line);
+    this.emit('metric', ev);
+  }
+
+  /** @private A report was said: start counting again. */
+  _resetDrops(r, now) {
     r.dropped = 0;
     r.frames = {};
     r.authors = new Set();
+    r.peers = new Set();
     r.reportedAt = now;
-    this._log(line);
-    this.emit('metric', ev);
   }
 
   /** Countersign a checkpoint (witness) and gossip the witness. @private */
diff --git a/tests/checkpoint-rate.test.js b/tests/checkpoint-rate.test.js
new file mode 100644
index 00000000..4378c19a
--- /dev/null
+++ b/tests/checkpoint-rate.test.js
@@ -0,0 +1,133 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME to a temp sandbox before lib/config loads
+
+/**
+ * 0.14.0 review follow-up: each checkpoint a node takes costs every node in the room a witness signed,
+ * gossiped and verified. The per-peer budget bounded what one peer delivers, but an attester could
+ * flood new checkpoints through every peer at once, and every node would witness each one. A node now
+ * takes one attester's new checkpoints at most at 4 a second after a burst of 128 (an honest attester
+ * commits one every 8 attestations: 0.5 a second in a busy room), whichever peer brings them, and past
+ * that does not store, witness or relay them.
+ *
+ * Deterministic: the clock is injected (node._gossipClock), with real Ed25519 signatures.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const crypto = require('crypto');
+const fs = require('fs');
+const { SymNode } = require('../lib/node');
+const { NullDiscovery } = require('../lib/discovery');
+const { nodeDir } = require('../lib/config');
+const { signCheckpoint } = require('../lib/core');
+
+const ROOM = 'g';
+const kp = () => {
+  const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519', { publicKeyEncoding: { type: 'spki', format: 'der' }, privateKeyEncoding: { type: 'pkcs8', format: 'der' } });
+  return { pub: publicKey.slice(-32).toString('base64url'), priv: privateKey.slice(-32).toString('base64url') };
+};
+
+function withNode(n, fn) {
+  const name = `checkpoint-rate-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+  const node = new SymNode({ name, silent: true, discovery: new NullDiscovery(), room: ROOM });
+  try {
+    const keys = Array.from({ length: n }, (_, i) => ({ id: `att-${i}`, ...kp() }));
+    for (const k of keys) node._pinPeerKey(k.id, k.pub);
+    const sent = [];
+    node._gossipToRoster = (frame) => sent.push(frame);
+    const clock = { t: 1_800_000_000_000 };
+    node._gossipClock = () => clock.t;
+    const reports = [];
+    node.on('metric', (m) => { if (m.type === 'checkpoint-over-rate') reports.push(m); });
+    return fn({ node, keys, clock, sent, reports });
+  } finally { fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+}
+
+const checkpoint = (k, upto_seq, at = upto_seq) => signed({ type: 'checkpoint', by: k.id, roster: ROOM, upto_seq, root: `root-${k.id}-${upto_seq}`, at }, k.priv);
+function signed(fields, priv) { const o = { ...fields }; signCheckpoint(o, priv); return o; }
+const witnessesBy = (sent, node, attester) => sent.filter((f) => f.type === 'witness' && f.witness.by === node.nodeId && f.witness.attester === attester);
+const relayed = (sent, attester) => sent.filter((f) => f.type === 'checkpoint' && f.checkpoint.by === attester);
+
+describe('checkpoint rate — one attester', () => {
+  it("a flooding attester's checkpoints past the bound are not stored, witnessed or relayed, whichever peers bring them", () => {
+    withNode(1, ({ node, keys: [A], clock, sent, reports }) => {
+      const t0 = clock.t;
+      const outcome = { taken: 0, overRate: 0, other: 0 };
+      const dropped = [];
+      // 1,000 new checkpoints a second for 5 s, spread over five peers (each well within its budget).
+      for (let i = 0; i < 5000; i++) {
+        clock.t = t0 + i;
+        const cp = checkpoint(A, 8 * (i + 1));
+        const r = node._ingestCheckpoint(cp, `peer-${i % 5}`);
+        if (r.ok) outcome.taken++;
+        else if (r.reason === 'over-rate') { outcome.overRate++; dropped.push(cp); }
+        else outcome.other++;
+      }
+      // A burst of 128, then 4 a second for 5 s.
+      assert.ok(Math.abs(outcome.taken - (128 + 20)) <= 1, `taken ${outcome.taken}`);
+      assert.strictEqual(outcome.other, 0);
+      assert.strictEqual(witnessesBy(sent, node, A.id).length, outcome.taken, 'this node witnessed only what it took');
+      assert.strictEqual(relayed(sent, A.id).length, outcome.taken, 'and relayed only that');
+      for (const cp of dropped.slice(-50)) assert.strictEqual(node._attestations.checkpointAt(A.id, cp.upto_seq), null, 'a dropped one is not stored');
+      // Said once in the window, every drop counted, the attester and the peers named.
+      assert.strictEqual(reports.length, 1);
+      node._sayDrops(node._dropReports.get(`checkpoint-over-rate|${A.id}`));
+      assert.strictEqual(reports.reduce((s, m) => s + m.dropped, 0), outcome.overRate);
+      assert.strictEqual(node.metrics().checkpointsOverRate, outcome.overRate);
+      assert.strictEqual(reports[0].attester, A.id);
+      assert.deepStrictEqual([...new Set(reports.flatMap((m) => m.fromPeerIds))].sort(), ['peer-0', 'peer-1', 'peer-2', 'peer-3', 'peer-4']);
+      // The same checkpoints again, from yet more peers, while the rate is spent: still not taken.
+      for (const cp of dropped.slice(0, 100)) assert.strictEqual(node._ingestCheckpoint(cp, 'peer-9').reason, 'over-rate');
+      assert.strictEqual(witnessesBy(sent, node, A.id).length, outcome.taken);
+      // A second root for a position it holds is still recorded as a conflict: that spends nothing.
+      const heldPos = node._attestations.latestCheckpoint(A.id).upto_seq;
+      const fork = signed({ type: 'checkpoint', by: A.id, roster: ROOM, upto_seq: heldPos, root: 'forked', at: 1 }, A.priv);
+      assert.strictEqual(node._ingestCheckpoint(fork, 'peer-0').reason, 'conflict');
+      assert.strictEqual(node._attestations.hasConflict(A.id, heldPos), true);
+    });
+  });
+
+  it('an honest attester at its normal rate is never limited, including over a burst', () => {
+    withNode(4, ({ node, keys, clock, sent }) => {
+      const t0 = clock.t;
+      const seq = new Map(keys.map((k) => [k.id, 0]));
+      let refused = 0;
+      const next = (k) => { const n = seq.get(k.id) + 8; seq.set(k.id, n); return checkpoint(k, n); };
+      // Four attesters, each committing a checkpoint every 2 s (gating 4 CMBs a second) for 10 minutes.
+      for (let ms = 0; ms < 600_000; ms += 500) {
+        clock.t = t0 + ms;
+        const k = keys[(ms / 500) % 4];
+        if (!node._ingestCheckpoint(next(k), 'hub').ok) refused++;
+      }
+      // Then one gates 1,024 CMBs back to back: 128 checkpoints in one second, and carries on as before.
+      const t1 = clock.t;
+      for (let i = 0; i < 128; i++) {
+        clock.t = t1 + Math.floor(i * 1000 / 128);
+        if (!node._ingestCheckpoint(next(keys[0]), 'hub').ok) refused++;
+      }
+      for (let ms = 2000; ms <= 60_000; ms += 2000) {
+        clock.t = t1 + ms;
+        if (!node._ingestCheckpoint(next(keys[0]), 'hub').ok) refused++;
+      }
+      assert.strictEqual(refused, 0, 'every checkpoint was taken');
+      const own = sent.filter((f) => f.type === 'witness' && f.witness.by === node.nodeId).length;
+      assert.strictEqual(own, 1200 + 128 + 30, 'and witnessed');
+    });
+  });
+
+  it('forged checkpoints naming an honest attester do not spend its rate', () => {
+    withNode(1, ({ node, keys: [H], clock }) => {
+      const t0 = clock.t;
+      let pos = 0;
+      for (let i = 0; i < 2000; i++) {
+        clock.t = t0 + Math.floor(i / 2);
+        pos += 8;
+        const forged = { type: 'checkpoint', by: H.id, roster: ROOM, upto_seq: pos, root: 'x', at: 1, sig: crypto.randomBytes(64).toString('base64url') };
+        assert.strictEqual(node._ingestCheckpoint(forged, 'mallory').reason, 'bad-signature');
+      }
+      // Its own checkpoints, a burst of them, are all still taken.
+      for (let i = 0; i < 100; i++) assert.strictEqual(node._ingestCheckpoint(checkpoint(H, (pos += 8)), 'hub').ok, true, `checkpoint ${i}`);
+    });
+  });
+});

From 4d9ea052d458b5bac3aa025f7ac1f529e22dac23 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Fri, 2 Oct 2026 03:45:34 +0100
Subject: [PATCH 062/148] 0.14.0 review: the anchor walk is bounded in work

MAX_NODES capped the stored records the walk visited, not the keys it
queued, and past the cap the loop kept draining the queue. A record can
name about 14,700 parents in one frame, so long parent lists on the
records the walk stepped onto grew the queue, `seen` and the lookups
without bound, and shift() moved the whole array on every step. The walk
now queues at most 16,384 parent keys in all (4 x MAX_NODES), reads the
queue through a cursor, and stops at MAX_HOPS or MAX_NODES instead of
draining. Past any bound the result is incomplete, as before.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 CHANGELOG.md                           |  5 +++-
 lib/core/lineage-tether.js             | 31 +++++++++++++++------
 tests/lineage-tether-traversal.test.js | 38 ++++++++++++++++++++++++++
 3 files changed, 65 insertions(+), 9 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8d29ed2d..f40fccdf 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -78,7 +78,10 @@ debt, and the daemon's log flood. Every item has a test that fails without its f
 - **The root walk trusted unverified records (B-L4).** It walks only through records whose address
   recomputes and that this node wrote or admitted as verified. A remix with no verified ancestor in
   reach resolves to no anchor, instead of being anchored to itself, and the result says whether the
-  walk was `complete`.
+  walk was `complete`. The walk is bounded in work as well as in records: at most 64 hops, 4,096
+  stored records and 16,384 parent keys queued, and it stops at a bound instead of draining its
+  queue. A record can name about 14,700 parents within one frame, and before this the queue grew
+  with every long parent list the walk stepped onto.
 - **A tether could not be reproduced by another node (B-L5).** It is measured on the stored record's
   text, encoded in one kernel, instead of on vectors blended with local memory.
 - **Cold-start admissions had no tether (B-L6).**
diff --git a/lib/core/lineage-tether.js b/lib/core/lineage-tether.js
index 1341f906..ea0d4d80 100644
--- a/lib/core/lineage-tether.js
+++ b/lib/core/lineage-tether.js
@@ -170,10 +170,15 @@ function resolveTetherAnchor(incomingCMB, getEntry) {
   // incomplete LOCAL proof: the walk cannot pass through it, and it is never permission to trust
   // the sender's claim about it.
   //
-  // Bounded: MAX_HOPS depth and MAX_NODES visited cap the walk, and `seen` makes a cyclic or
-  // repeated-key chain terminate. The earliest-stored reachable record wins.
+  // Bounded: MAX_HOPS depth, MAX_NODES stored records visited and MAX_EDGES parent keys queued in
+  // all, and `seen` makes a cyclic or repeated-key chain terminate. The earliest-stored reachable
+  // record wins. A record may name as many parents as fit in a frame (about 14,700), so a bound on
+  // visited records alone let the queue, `seen` and the lookups grow with every long parent list
+  // the walk stepped onto. Past MAX_EDGES nothing more is queued; past MAX_HOPS or MAX_NODES the
+  // walk stops. Either way the result is incomplete.
   const MAX_HOPS = 64;
   const MAX_NODES = 4096;
+  const MAX_EDGES = 4 * MAX_NODES;
   const parentsOf = (cmb) => {
     const l = cmb?.metadata?.lineage ?? cmb?.lineage ?? null;
     return Array.isArray(l?.parents) ? l.parents : [];
@@ -183,13 +188,23 @@ function resolveTetherAnchor(incomingCMB, getEntry) {
   let bestTime = Infinity;
   let visited = 0;
   let complete = true;
-  // Frontier of {key, depth} starting at the incoming record's DIRECT parents only.
+  // Frontier of {key, depth} starting at the incoming record's DIRECT parents only. Read through a
+  // cursor, never shift(), which moves the whole array on every step.
   const directParents = Array.isArray(lin?.parents) ? lin.parents : [];
-  const frontier = directParents.map((key) => ({ key, depth: 1 }));
-  while (frontier.length) {
-    const { key, depth } = frontier.shift();
+  const frontier = [];
+  let next = 0;
+  const enqueue = (key, depth) => {
+    if (frontier.length >= MAX_EDGES) { complete = false; return false; }
+    frontier.push({ key, depth });
+    return true;
+  };
+  for (const key of directParents) if (!enqueue(key, 1)) break;
+  while (next < frontier.length) {
+    const { key, depth } = frontier[next++];
     if (seen.has(key)) continue;
-    if (depth > MAX_HOPS || visited >= MAX_NODES) { complete = false; continue; }
+    // Breadth-first, so depth never falls along the queue and `visited` never falls: once either
+    // bound is reached, every key still queued is past it too.
+    if (depth > MAX_HOPS || visited >= MAX_NODES) { complete = false; break; }
     seen.add(key);
     const entry = typeof getEntry === 'function' ? getEntry(key) : undefined;
     // Not stored locally → cannot walk through it; never trust the wire.
@@ -210,7 +225,7 @@ function resolveTetherAnchor(incomingCMB, getEntry) {
     // Continue the VERIFIED walk from this stored record's own parents (never its wire ancestors),
     // unless this node severed them: the record still names them as signed, the entry says no.
     if (isLineageSevered(entry)) continue;
-    for (const pk of parentsOf(cmb)) if (!seen.has(pk)) frontier.push({ key: pk, depth: depth + 1 });
+    for (const pk of parentsOf(cmb)) if (!seen.has(pk) && !enqueue(pk, depth + 1)) break;
   }
   if (best) return { ...best, complete };
   // Only a ROOT is its own anchor. A remix with no verified ancestor in reach has an unverifiable
diff --git a/tests/lineage-tether-traversal.test.js b/tests/lineage-tether-traversal.test.js
index 0434251f..46b3c2eb 100644
--- a/tests/lineage-tether-traversal.test.js
+++ b/tests/lineage-tether-traversal.test.js
@@ -179,3 +179,41 @@ describe('storedRecordVerifies — what counts as a verified step', () => {
     assert.strictEqual(storedRecordVerifies(e.cmb, e.key), false);
   });
 });
+
+describe('§15.8 anchor resolution — the walk is bounded in work, not only in records visited', () => {
+  // A record may name as many parents as fit in a frame. The walk counted only the stored records
+  // it visited, so long parent lists grew the queue and the lookups without bound, and past its
+  // budget the walk went on draining the queue instead of stopping (0.14.0 review C-F5).
+  const unstored = (tag, n) => Array.from({ length: n }, (_, i) => `cmb-${tag}${String(i).padStart(63 - tag.length, '0')}`);
+  function counting(entries) {
+    const get = store(entries);
+    const counter = { lookups: 0 };
+    counter.getEntry = (key) => { counter.lookups++; return get(key); };
+    return counter;
+  }
+
+  it('a record naming 30,000 parents costs at most 16,384 lookups, and is incomplete', () => {
+    const c = counting([]);
+    const r = resolveTetherAnchor(remixOf(unstored('a', 30000)), c.getEntry);
+    assert.ok(c.lookups <= 4 * 4096, `${c.lookups} lookups`);
+    assert.strictEqual(r.complete, false);
+    assert.strictEqual(r.key, null);
+  });
+
+  it('long parent lists on the verified records it steps onto do not grow the walk', () => {
+    // A verified chain of 40 records, each also naming 2,000 parents this node never stored.
+    const chain = [];
+    let parent = null;
+    for (let i = 0; i < 40; i++) {
+      const e = entry(`chain ${i}`, 1000 + i, parent ? [parent] : [], verifiedAdmission);
+      e.cmb.metadata.lineage = { parents: [...(parent ? [parent] : []), ...unstored(`b${i}x`, 2000)], method: 'SVAF-v2' };
+      chain.push(e);
+      parent = e.key;
+    }
+    const c = counting(chain);
+    const r = resolveTetherAnchor(remixOf([parent]), c.getEntry);
+    assert.ok(c.lookups <= 4 * 4096, `${c.lookups} lookups`);
+    assert.strictEqual(r.complete, false, 'what it could not queue is not proven');
+    assert.strictEqual(r.resolvedFromStore, true, 'the verified records it did reach still anchor it');
+  });
+});

From f4fe30921f3d2d71f03b5b03571d5c572c05f37e Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Fri, 2 Oct 2026 03:53:11 +0100
Subject: [PATCH 063/148] 0.14.0 review: a send that is not made says why

sendFrame and the transports returned one `false` for a frame over
MAX_FRAME_SIZE, a closed socket and a failed write, so remember() told a
caller a connected peer was "not connected" when its frame was too large.
writeFrame and TcpTransport/RelayPeerTransport.trySend now return
{ ok, reason, bytes } with reason too-large, not-connected or
write-failed; sendFrame and send() still return a boolean, so existing
callers are unchanged. _dispatchCmb reports the reason (also
clear-over-relay, and send-failed for a transport that says only
whether); a directed remember() that was not sent carries
delivery.reason and logs it, and a frame over the bound is logged and
counted (cmb-frame-too-large). shareWithPeers counts only the peers a
frame reached; it counted every peer.

Review B-F6 (the reporting half; the bound half is the next commit).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 CHANGELOG.md                         |  6 +++
 lib/frame-parser.js                  | 43 +++++++++++----
 lib/node.js                          | 78 ++++++++++++++++++++-------
 lib/transport.js                     | 37 ++++++++++---
 tests/send-frame-dead-socket.test.js | 80 +++++++++++++++++++++++++++-
 5 files changed, 206 insertions(+), 38 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f40fccdf..efdc923b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -69,6 +69,12 @@ debt, and the daemon's log flood. Every item has a test that fails without its f
 - **A served v2.0 record no longer verified (B-R9, part).** `cmb-fetch` now serves a record's
   metadata whole, as a copy.
 - **A frame written to a destroyed socket counted as sent (B-D6, residual).**
+- **A send that failed for any reason was reported as "not connected".** `sendFrame` and the
+  transports returned one `false` for a frame over the bound, a closed socket and a failed write.
+  `writeFrame` and the transports' `trySend` now say which (`too-large`, `not-connected`,
+  `write-failed`); `sendFrame` and `send` still return a boolean. A directed `remember()` that was not
+  sent carries `delivery.reason`, its log line names the reason, and a frame over the bound is counted
+  (`cmb-frame-too-large`). `shareWithPeers` counts only the peers a frame reached.
 - **Unsigned records are now counted (B-R3, interim).** They are still accepted as unverified for
   interop, but each is counted (`cmb-unsigned-received`) and the sending peer is named once in the
   log, so the emitters a signed-only default would cut off can be found first.
diff --git a/lib/frame-parser.js b/lib/frame-parser.js
index 66429a74..2a2d4986 100644
--- a/lib/frame-parser.js
+++ b/lib/frame-parser.js
@@ -85,24 +85,49 @@ class FrameParser extends EventEmitter {
 }
 
 /**
- * Send a length-prefixed JSON frame over a TCP socket.
+ * Why a frame was not sent. Callers that only need whether keep using sendFrame()/send(); the ones
+ * that tell a person what happened read the reason, so "too large" is never reported as "not
+ * connected".
+ */
+const SEND_FAILURE = Object.freeze({
+  TOO_LARGE: 'too-large',         // the serialized frame is over MAX_FRAME_SIZE: no transport carries it
+  NOT_CONNECTED: 'not-connected', // no socket, or it is destroyed, closed or no longer writable
+  WRITE_FAILED: 'write-failed',   // the socket refused the write
+});
+
+/**
+ * Send a length-prefixed JSON frame over a TCP socket, and say why when it is not sent.
  *
  * @param {net.Socket} socket — TCP socket to write to
  * @param {object} msg — JSON-serializable message
- * @returns {boolean} true if sent, false if too large or write failed
+ * @returns {{ ok: boolean, reason?: string, bytes: number }} `bytes` is the serialized frame's
+ *   length; `reason` is one of SEND_FAILURE when `ok` is false.
  */
-function sendFrame(socket, msg) {
+function writeFrame(socket, msg) {
   const payload = Buffer.from(JSON.stringify(msg), 'utf8');
-  if (payload.length > MAX_FRAME_SIZE) return false;
+  const bytes = payload.length;
+  if (bytes > MAX_FRAME_SIZE) return { ok: false, reason: SEND_FAILURE.TOO_LARGE, bytes };
   // A socket that is destroyed or no longer writable has not taken the frame, even though write()
   // on it may not throw: 'close' can arrive after the destroy, and until then this counted as sent.
-  if (!socket || socket.destroyed || socket.writable === false) return false;
+  if (!socket || socket.destroyed || socket.writable === false) return { ok: false, reason: SEND_FAILURE.NOT_CONNECTED, bytes };
   const header = Buffer.alloc(4);
-  header.writeUInt32BE(payload.length, 0);
+  header.writeUInt32BE(bytes, 0);
   try {
     socket.write(Buffer.concat([header, payload]));
-    return true;
-  } catch { return false; }
+    return { ok: true, bytes };
+  } catch { return { ok: false, reason: SEND_FAILURE.WRITE_FAILED, bytes }; }
+}
+
+/**
+ * Send a length-prefixed JSON frame over a TCP socket.
+ *
+ * @param {net.Socket} socket — TCP socket to write to
+ * @param {object} msg — JSON-serializable message
+ * @returns {boolean} true if sent, false if too large, not connected or the write failed
+ *   (writeFrame says which)
+ */
+function sendFrame(socket, msg) {
+  return writeFrame(socket, msg).ok;
 }
 
-module.exports = { FrameParser, sendFrame, MAX_FRAME_SIZE };
+module.exports = { FrameParser, sendFrame, writeFrame, SEND_FAILURE, MAX_FRAME_SIZE };
diff --git a/lib/node.js b/lib/node.js
index 7e9a134d..274f3492 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -46,6 +46,7 @@ const { MMP_EMIT_V2 } = require('./emit-policy'); // the single reader-first fli
 const MAX_CLOCK_LEAD_MS = 60 * 1000;
 const { FrameHandler } = require('./frame-handler');
 const { TcpTransport } = require('./transport');
+const { SEND_FAILURE, MAX_FRAME_SIZE } = require('./frame-parser');
 const { RelayConnection } = require('./relay');
 const { BonjourDiscovery, NullDiscovery } = require('./discovery');
 
@@ -153,6 +154,30 @@ function refuseClearThroughRelay(node, peerId, peer) {
   }
 }
 
+/** Why a CMB was not handed to a peer, beyond the transport's own SEND_FAILURE reasons. */
+const NOT_SENT = Object.freeze({
+  CLEAR_OVER_RELAY: 'clear-over-relay', // reachable only through the relay, and no shared secret to seal with
+  SEND_FAILED: 'send-failed',           // a transport that says only whether, not why
+});
+
+/** How each reason reads in the log. */
+const NOT_SENT_SAID = Object.freeze({
+  [SEND_FAILURE.TOO_LARGE]: 'frame too large',
+  [SEND_FAILURE.NOT_CONNECTED]: 'not connected',
+  [SEND_FAILURE.WRITE_FAILED]: 'write failed',
+  [NOT_SENT.CLEAR_OVER_RELAY]: 'reachable only through the relay, with no key to encrypt for it',
+  [NOT_SENT.SEND_FAILED]: 'send failed',
+});
+
+/**
+ * Hand `frame` to a peer's transport and say why it was not taken: { ok, reason, bytes }. A transport
+ * without trySend (an embedder's, or a test's) reports only whether, as NOT_SENT.SEND_FAILED.
+ */
+function trySend(transport, frame) {
+  if (transport && typeof transport.trySend === 'function') return transport.trySend(frame);
+  return transport && transport.send(frame) !== false ? { ok: true } : { ok: false, reason: NOT_SENT.SEND_FAILED };
+}
+
 class SymNode extends EventEmitter {
 
   /**
@@ -1714,12 +1739,11 @@ class SymNode extends EventEmitter {
         refuseClearThroughRelay(this, peerId, peer);
         continue;
       }
-      peer.transport.send({
-        type: 'cmb',
-        timestamp: ts,
-        cmb: peerCmb,
-      });
-      shared++;
+      // Only a frame a transport took counts: this counted every peer, so a block no peer could take
+      // (too large, a closed socket) was logged as shared with all of them.
+      const sent = trySend(peer.transport, { type: 'cmb', timestamp: ts, cmb: peerCmb });
+      if (sent.ok) shared++;
+      else this._log(`Not shared with ${peer.name || peerId.slice(0, 8)}: ${NOT_SENT_SAID[sent.reason] || sent.reason}${sent.bytes ? ` (${sent.bytes} bytes)` : ''}`);
     }
 
     this._log(`Shared: "${content.slice(0, 50)}${content.length > 50 ? '...' : ''}" → ${shared}/${this._peers.size} peers`);
@@ -2378,7 +2402,7 @@ class SymNode extends EventEmitter {
     // Encrypt categories per-peer if shared secret is available (E2E encryption)
     const baseCmb = entry.cmb || null;
 
-    const shared = this._dispatchCmb(baseCmb, entry.storedAt, opts.to);
+    const { dispatched: shared, reason: notSent } = this._dispatchCmb(baseCmb, entry.storedAt, opts.to);
 
     // Feed signal to the Layer-6 insight engine, when one is injected
     if (this._xmesh) this._xmesh.ingestSignal({
@@ -2391,7 +2415,7 @@ class SymNode extends EventEmitter {
     });
 
     const fanoutDesc = opts.to
-      ? `target=${opts.to.slice(0, 8)} (${shared ? 'sent' : 'not connected'})`
+      ? `target=${opts.to.slice(0, 8)} (${shared ? 'sent' : NOT_SENT_SAID[notSent] || notSent})`
       : `${shared}/${this._peers.size} peers`;
     this._log(`Remembered: "${content.slice(0, 50)}${content.length > 50 ? '...' : ''}" → ${fanoutDesc}`);
 
@@ -2430,6 +2454,9 @@ class SymNode extends EventEmitter {
         targets: opts.to ? (this._peers.has(opts.to) ? 1 : 0) : this._peers.size,
         dispatched: shared,
         undelivered: !!opts.to && shared === 0,
+        // Why a directed send was not dispatched (NOT_SENT_SAID's keys): not connected is one
+        // reason of several, and the one this used to report for all of them.
+        ...(opts.to && shared === 0 ? { reason: notSent } : {}),
       }),
       enumerable: false,
       configurable: true,
@@ -2438,8 +2465,8 @@ class SymNode extends EventEmitter {
     if (entry.delivery.undelivered) {
       // Loud, and distinct from the fan-out line above: a broken addressed promise
       // is not routine telemetry. This is the signal a caller acts on.
-      this._log(`UNDELIVERED (directed): ${opts.to.slice(0, 8)} not connected — stored locally, NOT sent`);
-      this.emit('metric', { type: 'cmb-undelivered', to: opts.to, key: entry.key });
+      this._log(`UNDELIVERED (directed): ${opts.to.slice(0, 8)} ${NOT_SENT_SAID[notSent] || notSent} — stored locally, NOT sent`);
+      this.emit('metric', { type: 'cmb-undelivered', to: opts.to, key: entry.key, reason: notSent });
     }
 
     return entry;
@@ -3358,19 +3385,23 @@ class SymNode extends EventEmitter {
 
   /**
    * Fan a CMB out to every peer, or to one peer when `to` is set (MMP §4.4.4).
-   * @returns {number} frames a transport accepted (not frames a peer received)
+   * @returns {{ dispatched: number, reason: string|null }} `dispatched` counts frames a transport
+   *   accepted (not frames a peer received); `reason` is why the last peer that did not get one did
+   *   not (NOT_SENT_SAID's keys), or null when every target got one.
    * @private
    */
   _dispatchCmb(baseCmb, timestamp, to) {
     // The caller has already stored the CMB, so it persists regardless of how
     // many peers receive this frame.
     let targets;
+    let reason = null;
     if (to) {
       const targeted = this._peers.get(to);
       if (targeted) {
         targets = [[to, targeted]];
       } else {
         targets = [];
+        reason = SEND_FAILURE.NOT_CONNECTED;
         this._log(`Targeted send: peer ${to.slice(0, 8)} not connected; CMB stored locally only`);
       }
     } else {
@@ -3386,9 +3417,10 @@ class SymNode extends EventEmitter {
         this._log(`E2E encrypted categories for peer ${peerId.slice(0, 8)}`);
       } else if (baseCmb && peerReachedOnlyOverRelay(peer)) {
         refuseClearThroughRelay(this, peerId, peer);
+        reason = NOT_SENT.CLEAR_OVER_RELAY;
         continue;
       }
-      const accepted = peer.transport.send({
+      const sent = trySend(peer.transport, {
         type: 'cmb',
         timestamp,
         cmb,
@@ -3398,12 +3430,18 @@ class SymNode extends EventEmitter {
         // governs memory admission only. Broadcasts stay fully SVAF-gated.
         ...(to ? { to, directed: true } : {}),
       });
-      // A transport returns false when the socket is closed, the relay is not open or the frame
-      // is over MAX_FRAME_SIZE. Counting those as dispatched made a stale peer read as reached.
-      if (accepted !== false) shared++;
+      // A transport refuses a frame when the socket is closed, the relay is not open, the write
+      // failed or the frame is over MAX_FRAME_SIZE. Counting those as dispatched made a stale peer
+      // read as reached, and reporting them all as "not connected" hid a frame no peer could take.
+      if (sent.ok) { shared++; continue; }
+      reason = sent.reason;
+      if (sent.reason === SEND_FAILURE.TOO_LARGE) {
+        this._log(`CMB ${String(recordKey(baseCmb) || '').slice(0, 16)} not sent to ${peer.name || peerId.slice(0, 8)}: its frame is ${sent.bytes} bytes, over the ${MAX_FRAME_SIZE}-byte bound`);
+        this.emit('metric', { type: 'cmb-frame-too-large', to: peerId, key: recordKey(baseCmb), bytes: sent.bytes, limit: MAX_FRAME_SIZE });
+      }
     }
 
-    return shared;
+    return { dispatched: shared, reason };
   }
 
   /**
@@ -3415,15 +3453,15 @@ class SymNode extends EventEmitter {
    */
   _dispatchExisting(result, key, to) {
     const cmb = result.cmb || null;
-    const shared = cmb ? this._dispatchCmb(cmb, Date.now(), to) : 0;
+    const { dispatched: shared, reason } = cmb ? this._dispatchCmb(cmb, Date.now(), to) : { dispatched: 0, reason: NOT_SENT.SEND_FAILED };
     Object.defineProperty(result, 'delivery', {
-      value: Object.freeze({ directed: true, to, targets: this._peers.has(to) ? 1 : 0, dispatched: shared, undelivered: shared === 0 }),
+      value: Object.freeze({ directed: true, to, targets: this._peers.has(to) ? 1 : 0, dispatched: shared, undelivered: shared === 0, ...(shared === 0 ? { reason } : {}) }),
       enumerable: false,
       configurable: true,
     });
     if (shared === 0) {
-      this._log(`UNDELIVERED (directed): ${to.slice(0, 8)} not reachable — record ${String(key).slice(0, 16)} NOT sent`);
-      this.emit('metric', { type: 'cmb-undelivered', to, key });
+      this._log(`UNDELIVERED (directed): ${to.slice(0, 8)} ${NOT_SENT_SAID[reason] || reason} — record ${String(key).slice(0, 16)} NOT sent`);
+      this.emit('metric', { type: 'cmb-undelivered', to, key, reason });
     }
   }
 
diff --git a/lib/transport.js b/lib/transport.js
index 516cfa6b..e6f79059 100644
--- a/lib/transport.js
+++ b/lib/transport.js
@@ -16,7 +16,7 @@
  */
 
 const { EventEmitter } = require('events');
-const { FrameParser, sendFrame, MAX_FRAME_SIZE } = require('./frame-parser');
+const { FrameParser, writeFrame, SEND_FAILURE, MAX_FRAME_SIZE } = require('./frame-parser');
 /**
  * TcpTransport — wraps a raw TCP socket with length-prefixed framing.
  * See MMP v0.2.0 Section 4 (Transport).
@@ -56,10 +56,20 @@ class TcpTransport extends EventEmitter {
    * Send a JSON frame to the peer.
    * @param {object} frame — JSON-serializable frame
    * @returns {boolean} false if the transport is closed, the frame is too large or the write failed
+   *   (trySend says which)
    */
   send(frame) {
-    if (this._closed) return false;
-    return sendFrame(this._socket, frame);
+    return this.trySend(frame).ok;
+  }
+
+  /**
+   * Send a JSON frame to the peer, and say why when it is not sent.
+   * @param {object} frame — JSON-serializable frame
+   * @returns {{ ok: boolean, reason?: string, bytes?: number }} `reason` is one of SEND_FAILURE
+   */
+  trySend(frame) {
+    if (this._closed) return { ok: false, reason: SEND_FAILURE.NOT_CONNECTED };
+    return writeFrame(this._socket, frame);
   }
 
   /**
@@ -100,18 +110,29 @@ class RelayPeerTransport extends EventEmitter {
   /**
    * Send a JSON frame to the target peer via the relay.
    * @param {object} frame — JSON-serializable frame
-   * @returns {boolean} false if the relay is not open or the frame is too large
+   * @returns {boolean} false if the relay is not open, the frame is too large or the send failed
+   *   (trySend says which)
    */
   send(frame) {
-    if (this._closed || !this._ws || this._ws.readyState !== 1) return false;
+    return this.trySend(frame).ok;
+  }
+
+  /**
+   * Send a JSON frame to the target peer via the relay, and say why when it is not sent.
+   * @param {object} frame — JSON-serializable frame
+   * @returns {{ ok: boolean, reason?: string, bytes?: number }} `reason` is one of SEND_FAILURE
+   */
+  trySend(frame) {
+    if (this._closed || !this._ws || this._ws.readyState !== 1) return { ok: false, reason: SEND_FAILURE.NOT_CONNECTED };
     const data = JSON.stringify({ to: this._targetNodeId, payload: frame });
+    const bytes = Buffer.byteLength(data, 'utf8');
     // MMP §4.1: senders MUST NOT produce frames over MAX_FRAME_SIZE; the relay
     // would close the whole shared connection (1009) rather than drop one frame.
-    if (Buffer.byteLength(data, 'utf8') > MAX_FRAME_SIZE) return false;
+    if (bytes > MAX_FRAME_SIZE) return { ok: false, reason: SEND_FAILURE.TOO_LARGE, bytes };
     try {
       this._ws.send(data);
-      return true;
-    } catch { return false; }
+      return { ok: true, bytes };
+    } catch { return { ok: false, reason: SEND_FAILURE.WRITE_FAILED, bytes }; }
   }
 
   /**
diff --git a/tests/send-frame-dead-socket.test.js b/tests/send-frame-dead-socket.test.js
index fb91f1a5..9c3b523b 100644
--- a/tests/send-frame-dead-socket.test.js
+++ b/tests/send-frame-dead-socket.test.js
@@ -3,12 +3,23 @@
 /**
  * B-D6 (residual): a frame handed to a socket that is destroyed, or no longer writable, was counted
  * as sent until 'close' fired, so a send in that window reported delivery.dispatched for nothing.
+ *
+ * 0.14.0 review B-F6: a frame over MAX_FRAME_SIZE, a closed socket and a failed write were all one
+ * `false`, and a directed send that was too large was reported as "not connected". The transports
+ * say which, and remember()'s delivery result and log carry it.
  */
 
+require('./_isolate-home');
+
 const { describe, it } = require('node:test');
 const assert = require('node:assert');
 const net = require('node:net');
-const { sendFrame } = require('../lib/frame-parser');
+const fs = require('node:fs');
+const { sendFrame, writeFrame, SEND_FAILURE, MAX_FRAME_SIZE } = require('../lib/frame-parser');
+const { TcpTransport, RelayPeerTransport } = require('../lib/transport');
+const { SymNode } = require('../lib/node');
+const { NullDiscovery } = require('../lib/discovery');
+const { nodeDir } = require('../lib/config');
 
 describe('sendFrame', () => {
   it('refuses a destroyed socket, a non-writable one, and none at all', () => {
@@ -27,3 +38,70 @@ describe('sendFrame', () => {
     assert.strictEqual(writes.length, 1);
   });
 });
+
+describe('a send that is not made says why (0.14.0 review B-F6)', () => {
+  const live = () => ({ destroyed: false, writable: true, write: () => true, on: () => {}, setKeepAlive: () => {} });
+  const huge = { type: 'cmb', blob: 'x'.repeat(MAX_FRAME_SIZE) };
+
+  it('writeFrame names the reason: too large, not connected, write failed', () => {
+    assert.deepStrictEqual(writeFrame(live(), huge).reason, SEND_FAILURE.TOO_LARGE);
+    assert.ok(writeFrame(live(), huge).bytes > MAX_FRAME_SIZE);
+    assert.strictEqual(writeFrame(null, { type: 'cmb' }).reason, SEND_FAILURE.NOT_CONNECTED);
+    assert.strictEqual(writeFrame({ destroyed: true }, { type: 'cmb' }).reason, SEND_FAILURE.NOT_CONNECTED);
+    assert.strictEqual(writeFrame({ ...live(), write: () => { throw new Error('EPIPE'); } }, { type: 'cmb' }).reason, SEND_FAILURE.WRITE_FAILED);
+    assert.strictEqual(writeFrame(live(), { type: 'cmb' }).ok, true);
+  });
+
+  it('both transports say it, and send() still answers only whether', () => {
+    const tcp = new TcpTransport(Object.assign(new net.Socket(), { write: () => true }));
+    assert.strictEqual(tcp.trySend(huge).reason, SEND_FAILURE.TOO_LARGE);
+    assert.strictEqual(tcp.send(huge), false);
+    tcp.close();
+    assert.strictEqual(tcp.trySend({ type: 'cmb' }).reason, SEND_FAILURE.NOT_CONNECTED);
+
+    const sent = [];
+    const ws = { readyState: 1, send: (d) => sent.push(d) };
+    const relay = new RelayPeerTransport(ws, 'peer-r');
+    assert.strictEqual(relay.trySend(huge).reason, SEND_FAILURE.TOO_LARGE);
+    assert.strictEqual(relay.trySend({ type: 'cmb' }).ok, true);
+    assert.strictEqual(relay.send({ type: 'cmb' }), true);
+    ws.send = () => { throw new Error('closed under it'); };
+    assert.strictEqual(relay.trySend({ type: 'cmb' }).reason, SEND_FAILURE.WRITE_FAILED);
+    ws.readyState = 3;
+    assert.strictEqual(relay.trySend({ type: 'cmb' }).reason, SEND_FAILURE.NOT_CONNECTED);
+    assert.strictEqual(relay.send({ type: 'cmb' }), false);
+  });
+
+  it('a directed send whose frame no transport takes reports why, not "not connected"', async () => {
+    const name = `send-reason-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+    const node = new SymNode({ name, silent: true, discovery: new NullDiscovery() });
+    await node.start();
+    try {
+      const lines = [];
+      const metrics = [];
+      node._log = (m) => lines.push(m);
+      node.on('metric', (m) => metrics.push(m));
+      // A connected peer whose transport refuses the frame as too large (a frame from a record the
+      // bounds did not see, or a long relay envelope), and one whose transport only says whether.
+      const tooLarge = { on: () => {}, close: () => {}, send: () => false, trySend: () => ({ ok: false, reason: SEND_FAILURE.TOO_LARGE, bytes: MAX_FRAME_SIZE + 1 }) };
+      const opaque = { on: () => {}, close: () => {}, send: () => false };
+      node._addPeer(node._createPeer(tooLarge, 'peer-LARGE000', 'peer-large', false, 'bonjour'));
+      node._addPeer(node._createPeer(opaque, 'peer-OPAQUE00', 'peer-opaque', false, 'bonjour'));
+
+      const a = node.remember({ focus: 'a directed send the transport refuses as too large' }, { to: 'peer-LARGE000' });
+      assert.strictEqual(a.delivery.undelivered, true);
+      assert.strictEqual(a.delivery.reason, SEND_FAILURE.TOO_LARGE);
+      assert.ok(lines.some((l) => /UNDELIVERED \(directed\): peer-LAR frame too large/.test(l)), lines.join('\n'));
+      assert.ok(!lines.some((l) => /UNDELIVERED.*not connected/.test(l)), 'not reported as not connected');
+      assert.ok(metrics.some((m) => m.type === 'cmb-frame-too-large' && m.to === 'peer-LARGE000'));
+      assert.ok(metrics.some((m) => m.type === 'cmb-undelivered' && m.reason === SEND_FAILURE.TOO_LARGE));
+
+      const b = node.remember({ focus: 'a directed send to a transport that says only whether' }, { to: 'peer-OPAQUE00' });
+      assert.strictEqual(b.delivery.reason, 'send-failed');
+
+      const c = node.remember({ focus: 'a directed send to nobody connected' }, { to: 'peer-ABSENT00' });
+      assert.strictEqual(c.delivery.reason, SEND_FAILURE.NOT_CONNECTED);
+      assert.ok(lines.some((l) => /UNDELIVERED \(directed\): peer-ABS not connected/.test(l)));
+    } finally { await node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+  });
+});

From 302048a9e4867038aba56b7adfa687f05b071d5f Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Fri, 2 Oct 2026 03:53:32 +0100
Subject: [PATCH 064/148] 0.14.0 review: a record is minted only if its frame
 can be sent
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The record bound summed category text bytes against 960 KiB, while the
transport bounds the serialized frame at 1 MiB: JSON writes a `"` as two
bytes and a control character as six, and a record sent to a peer with a
shared secret travels with its categories sealed and base64-encoded. So
500 KiB of quotes, or 900 KiB of plain text sent sealed, minted and then
could not be sent. createCMB now also requires the frame the record
travels in (its JSON with the categories sealed, plus an allowance for
the frame, the relay envelope and the signature) to fit MAX_FRAME_SIZE,
imported from the transport; about 766 KiB of plain text. remember()
applies the same bound after it attaches a payload, and to a caller's own
record, before anything is stored or sent. The text bounds still hold on
both sides.

The 64-byte agent-id bound (§3.1.2) is a minting rule: the receiver no
longer applies it. Earlier releases minted records with longer agent ids,
and refusing them stopped a node hearing such a peer at all. A categories-
only frame's evaluation subject is built under the receiver's bounds only
(createCMB `received`).

Review C-F3 (and the bound half of B-F6), C-F4.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 CHANGELOG.md                |  13 ++++-
 lib/core/cmb-encoder.js     | 105 +++++++++++++++++++++++++++++------
 lib/core/svaf-baseline.js   |   2 +-
 lib/frame-handler.js        |   6 +-
 lib/node.js                 |   5 +-
 tests/record-bounds.test.js | 108 ++++++++++++++++++++++++++++++++++--
 6 files changed, 211 insertions(+), 28 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index efdc923b..d928fe03 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -63,9 +63,16 @@ debt, and the daemon's log flood. Every item has a test that fails without its f
   minute, timestamps follow the clock again, with a `clock-stepped-back` metric.
 - **Mood values were invented or lost (B-R11).** `valence` and `arousal` are kept only when measured,
   must be numbers in [-1, 1], and a mood given only as numbers keeps them.
-- **Records had no size bound below the 1 MiB frame (B-R13).** A category is at most 256 KiB, the
-  seven at most 960 KiB, and an agent id at most 64 bytes (§3.1.2). The emitter throws `ECMBSIZE`, and
-  a receiver refuses an oversized record before rendering, verifying or storing it.
+- **Records had no size bound below the 1 MiB frame (B-R13).** A category is at most 256 KiB of text
+  and the seven at most 960 KiB, and a record is minted only if the frame it travels in fits the
+  1 MiB frame bound with its categories sealed for a peer. Text bytes are not frame bytes: JSON
+  writes a `"` as two bytes and a control character as six, and the end-to-end seal is base64, a 4/3
+  expansion, so a record within the text bounds could be one no transport would carry. In plain text
+  the frame bound allows about 766 KiB. An agent id is at most 64 bytes (§3.1.2). `createCMB` throws
+  `ECMBSIZE`, and so does `remember()`, before anything is stored or sent, for a record or payload
+  that would not fit. A receiver refuses a record over the text bounds before rendering, verifying or
+  storing it. It does not refuse a longer agent id: earlier releases minted those, and refusing them
+  would stop a node hearing such a peer at all.
 - **A served v2.0 record no longer verified (B-R9, part).** `cmb-fetch` now serves a record's
   metadata whole, as a copy.
 - **A frame written to a destroyed socket counted as sent (B-D6, residual).**
diff --git a/lib/core/cmb-encoder.js b/lib/core/cmb-encoder.js
index edeab1ec..2ed95053 100644
--- a/lib/core/cmb-encoder.js
+++ b/lib/core/cmb-encoder.js
@@ -21,6 +21,9 @@ const { CAT7_CATEGORIES } = require('./cmb');
 // record-shape requires nothing, so this cannot cycle. It is the ONE answer to "where is the
 // container" — the encoder must not re-derive it, or the answer and the check drift apart again.
 const { resolveCategories, unreadableReason } = require('./record-shape');
+// The transport's frame bound, from the module that enforces it, so the record bound cannot drift
+// from it. frame-parser requires nothing but 'events', so this cannot cycle.
+const { MAX_FRAME_SIZE } = require('../frame-parser');
 
 // ── Content-Addressable Key ───────────────────────────────────
 
@@ -453,41 +456,100 @@ function encodeCategory(text) {
  * @param {object} [opts.categoryParents] - per-category descent refs, keyed by CAT7 category name (§7.3).
  * @param {string} [opts.room] - audience.
  * @param {string|null} [opts.to] - directed recipient's agent id, or null for a broadcast.
+ * @param {boolean} [opts.received] - the categories came in a peer's frame and the record is built
+ *   only to evaluate them: the receiver's bounds apply (assertRecordSize), not the agent-id and
+ *   frame bounds of a record minted to be sent.
+ * @throws {RangeError} code ECMBSIZE when a bound is exceeded.
  * @returns {{categories: object, metadata: object}} The two-section record (§7.1): `categories` is what
  *   the agent says, `metadata` is what the mesh proves. No third section exists.
  */
 /** The room a record names when its author names none (§7): the literal 'default'. */
 const DEFAULT_ROOM = 'default';
-/** §3.1.2: an agent id is 1–64 bytes. */
+/** §3.1.2: an agent id is 1–64 bytes. Enforced when a record is minted, never on receipt (below). */
 const MAX_NAME_BYTES = 64;
 /**
- * Size bounds. The spec says categories are bounded but gives no number; these keep every record
- * sendable: one category may not take more than a quarter of a 1 MiB frame, and the seven together
- * leave room for metadata and the signature inside it.
+ * Text bounds. The spec says categories are bounded but gives no number. One category is at most a
+ * quarter of a 1 MiB frame and the seven at most 960 KiB of text. These hold on mint and on receipt.
+ *
+ * They do not by themselves keep a record sendable, because a frame is not text: JSON escapes a `"`
+ * as two bytes and a control character as six, and a record sent to a peer with a shared secret
+ * travels with its categories sealed and base64-encoded, a 4/3 expansion. So a record is minted only
+ * when the frame it would travel in fits MAX_FRAME_SIZE as well (assertRecordSendable).
  */
 const MAX_CATEGORY_BYTES = 256 * 1024;
 const MAX_RECORD_TEXT_BYTES = 960 * 1024;
+/**
+ * What a `cmb` frame adds around its record at most, in bytes: the frame's own members (type,
+ * timestamp, to, directed, _anchor), the E2E nonce and the relay envelope ({to, payload}). About 270
+ * with 64-byte node ids.
+ */
+const FRAME_ALLOWANCE_BYTES = 1024;
+/** What signing adds to the metadata (sig, sigAlg, assertionId: about 200 bytes), held in reserve
+ *  until the record is signed, so a record measures the same before and after. */
+const SIGNATURE_RESERVE_BYTES = 256;
+
+function sizeError(msg) {
+  const e = new RangeError(msg);
+  e.code = 'ECMBSIZE';
+  return e;
+}
 
 /**
- * Throw ECMBSIZE when a category, or the record's text as a whole, is over its bound, or the author
- * id is longer than §3.1.2 allows. Shared by the emitter and the receiver.
+ * Throw ECMBSIZE when a category, or the record's text as a whole, is over its bound. Shared by the
+ * emitter and the receiver.
+ *
+ * The agent id is not checked here. Records minted before 0.14.0 have no bound on it but the frame,
+ * so a receiver refusing a longer one would stop hearing a peer whose records are otherwise sound;
+ * it is bounded where a record is minted (assertAgentId).
  * @param {object} categories
- * @param {string} [createdBy]
  */
-function assertRecordSize(categories, createdBy) {
-  const fail = (msg) => { const e = new RangeError(msg); e.code = 'ECMBSIZE'; throw e; };
-  if (typeof createdBy === 'string' && Buffer.byteLength(createdBy, 'utf8') > MAX_NAME_BYTES) {
-    fail(`createdBy is ${Buffer.byteLength(createdBy, 'utf8')} bytes; an agent id is at most ${MAX_NAME_BYTES} (§3.1.2)`);
-  }
+function assertRecordSize(categories) {
   let total = 0;
   for (const f of CAT7_CATEGORIES) {
     const text = categories?.[f]?.text;
     if (typeof text !== 'string') continue;
     const n = Buffer.byteLength(text, 'utf8');
-    if (n > MAX_CATEGORY_BYTES) fail(`${f} is ${n} bytes; a category is at most ${MAX_CATEGORY_BYTES}`);
+    if (n > MAX_CATEGORY_BYTES) throw sizeError(`${f} is ${n} bytes; a category is at most ${MAX_CATEGORY_BYTES}`);
     total += n;
   }
-  if (total > MAX_RECORD_TEXT_BYTES) fail(`the categories total ${total} bytes; a record's text is at most ${MAX_RECORD_TEXT_BYTES}`);
+  if (total > MAX_RECORD_TEXT_BYTES) throw sizeError(`the categories total ${total} bytes; a record's text is at most ${MAX_RECORD_TEXT_BYTES}`);
+}
+
+/** Throw ECMBSIZE when an agent id minted into a record is longer than §3.1.2 allows. */
+function assertAgentId(createdBy) {
+  const n = typeof createdBy === 'string' ? Buffer.byteLength(createdBy, 'utf8') : 0;
+  if (n > MAX_NAME_BYTES) throw sizeError(`createdBy is ${n} bytes; an agent id is at most ${MAX_NAME_BYTES} (§3.1.2)`);
+}
+
+/**
+ * The largest frame `record` can travel in: its JSON with the categories sealed for a peer (AES-GCM
+ * tag, base64, quotes) where that is the larger, plus FRAME_ALLOWANCE_BYTES, plus
+ * SIGNATURE_RESERVE_BYTES until it is signed. Sealing is what every peer with a shared secret gets,
+ * and the only form the relay carries, so this is the size to bound.
+ * @param {object} record
+ * @returns {number}
+ */
+function recordFrameBytes(record) {
+  const whole = Buffer.byteLength(JSON.stringify(record), 'utf8');
+  const cats = record && record.categories && typeof record.categories === 'object'
+    ? Buffer.byteLength(JSON.stringify(record.categories), 'utf8')
+    : 0;
+  const sealed = 4 * Math.ceil((cats + 16) / 3) + 2;
+  const signed = !!(record && record.metadata && record.metadata.sig);
+  return whole - cats + Math.max(cats, sealed) + FRAME_ALLOWANCE_BYTES + (signed ? 0 : SIGNATURE_RESERVE_BYTES);
+}
+
+/**
+ * Throw ECMBSIZE when `record` would not fit a frame (recordFrameBytes > MAX_FRAME_SIZE), so a node
+ * never stores, as sent, a record no transport can carry. createCMB runs it; so does anything that
+ * adds to a record after createCMB (remember()'s payload).
+ * @param {object} record
+ */
+function assertRecordSendable(record) {
+  const n = recordFrameBytes(record);
+  if (n > MAX_FRAME_SIZE) {
+    throw sizeError(`the record would travel in a frame of up to ${n} bytes (its categories sealed for a peer); a frame is at most ${MAX_FRAME_SIZE}`);
+  }
 }
 
 function createCMB(opts = {}) {
@@ -547,7 +609,11 @@ function createCMB(opts = {}) {
       categories[f] = { text };
     }
   }
-  assertRecordSize(categories, createdBy);
+  assertRecordSize(categories);
+  // A record built from a peer's categories-only frame, only to be evaluated, is held to the bounds
+  // a receiver applies and nothing else: it is never sent, and its agent id is the peer's.
+  const minting = opts.received !== true;
+  if (minting) assertAgentId(createdBy);
 
   // Per-category metadata (§7.3): each category carries its own address and its own semantic
   // descent. This is the section's reason to exist — admission verdicts, anchors, membrane
@@ -605,7 +671,9 @@ function createCMB(opts = {}) {
     metadata.application = opts.application ?? null;
   }
 
-  return { categories, metadata };
+  const record = { categories, metadata };
+  if (minting) assertRecordSendable(record);
+  return record;
 }
 
 // ── Rendering ─────────────────────────────────────────────────
@@ -697,7 +765,12 @@ module.exports = {
   l2Normalize,
   CAT7_CATEGORIES,
   assertRecordSize,
+  assertAgentId,
+  assertRecordSendable,
+  recordFrameBytes,
   DEFAULT_ROOM,
   MAX_CATEGORY_BYTES,
   MAX_RECORD_TEXT_BYTES,
+  FRAME_ALLOWANCE_BYTES,
+  SIGNATURE_RESERVE_BYTES,
 };
diff --git a/lib/core/svaf-baseline.js b/lib/core/svaf-baseline.js
index 8fd8a6dd..fa3fa713 100644
--- a/lib/core/svaf-baseline.js
+++ b/lib/core/svaf-baseline.js
@@ -427,7 +427,7 @@ async function _processHeuristicSVAF(opts) {
   // categories-only message carries, so it is used ONLY to synthesise a local evaluation subject
   // and never travels.
   const incomingCMB = msg.cmb
-    || createCMB({ categories: msg.categories, createdBy: String(msg.source || peerName || 'peer') });
+    || createCMB({ categories: msg.categories, createdBy: String(msg.source || peerName || 'peer'), received: true });
   const anchors = recentCMBs || [];
 
   // Vectors are RECEIVER-LOCAL and are recomputed here, unconditionally, from text.
diff --git a/lib/frame-handler.js b/lib/frame-handler.js
index c02772e5..c45124ae 100644
--- a/lib/frame-handler.js
+++ b/lib/frame-handler.js
@@ -822,11 +822,11 @@ class FrameHandler {
       }
     }
 
-    // Size first: an oversized record is refused before anything renders, verifies or stores it,
-    // under the same bounds the emitter enforces.
+    // Size first: a record over the text bounds is refused before anything renders, verifies or
+    // stores it. Not its agent id: earlier releases minted ids of any length (cmb-encoder).
     if (msg.cmb?.categories) {
       try {
-        assertRecordSize(msg.cmb.categories, recordCreatedBy(msg.cmb));
+        assertRecordSize(msg.cmb.categories);
       } catch (err) {
         if (err.code !== 'ECMBSIZE') throw err;
         this._node._log(`CMB from ${peerName} refused: ${err.message}`);
diff --git a/lib/node.js b/lib/node.js
index 274f3492..a1707709 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -39,7 +39,7 @@ const {
   e2eGenerateKeyPair, e2eDeriveSharedSecret, encryptCategories,
   signCMB, assertionIdV2_0, mintRemixKey, signAttestation, verifyAttestation, verifyAttestationRole,
   merkleRoot, signCheckpoint, verifyCheckpoint, signWitness, verifyWitness,
-  signGrant, roleRank, CAT7_CATEGORIES,
+  signGrant, roleRank, CAT7_CATEGORIES, assertRecordSendable,
 } = require('./core');
 const { MMP_EMIT_V2 } = require('./emit-policy'); // the single reader-first flip switch
 /** How far this node's record timestamps may run ahead of its clock before they follow it again. */
@@ -2295,6 +2295,9 @@ class SymNode extends EventEmitter {
       // broken must say so, not quietly emit records every verifying peer will refuse.
       this._signOrThrow(opts.cmb, 'CMB signing failed');
     }
+    // A record no transport can carry is refused here, before it is stored as sent (ECMBSIZE).
+    // createCMB bounds what it builds; a payload, or a caller's own record, is bounded only here.
+    assertRecordSendable(opts.cmb);
     // §7.5 COLLAPSE-BEFORE-MINT [MUST] — AC-2.4, the emit-side half of the Rule A self-loop.
     //
     // Under content-only addressing, re-asserting content identical to your own HEAD produces
diff --git a/tests/record-bounds.test.js b/tests/record-bounds.test.js
index 7e38e2de..d8e86d27 100644
--- a/tests/record-bounds.test.js
+++ b/tests/record-bounds.test.js
@@ -9,19 +9,26 @@ require('./_isolate-home'); // redirect $HOME to a temp sandbox before lib/confi
  * - B-R11: mood valence and arousal are measurements in [-1, 1]: absent ones are omitted, not
  *   invented as 0, out-of-range ones are refused, and numbers given without text are kept.
  * - B-R13: a category is at most 256 KiB, the seven together at most 960 KiB, an agent id at most
- *   64 bytes (§3.1.2), so every record fits a 1 MiB frame. Receivers refuse what emitters may not mint.
+ *   64 bytes (§3.1.2). Receivers refuse a record over the text bounds.
+ * - 0.14.0 review C-F3: text bytes are not frame bytes (JSON escaping, and the E2E seal's base64), so
+ *   a record is minted only when the frame it travels in, sealed, fits MAX_FRAME_SIZE.
+ * - 0.14.0 review C-F4: the agent-id bound is a minting rule. A record an earlier release minted
+ *   with a longer agent id is not refused on receipt.
  * - B-R3 (interim): an unsigned record is accepted as unverified, counted, and named once per peer.
  */
 
 const { describe, it } = require('node:test');
 const assert = require('node:assert');
 const fs = require('fs');
-const { createCMB, checkAudience, signCMB } = require('../lib/core');
-const { MAX_CATEGORY_BYTES, MAX_RECORD_TEXT_BYTES } = require('../lib/core/cmb-encoder');
+const crypto = require('crypto');
+const { createCMB, checkAudience, signCMB, encryptCategories, assertionIdV2_0 } = require('../lib/core');
+const { MAX_CATEGORY_BYTES, MAX_RECORD_TEXT_BYTES, recordFrameBytes } = require('../lib/core/cmb-encoder');
+const { MAX_FRAME_SIZE, writeFrame } = require('../lib/frame-parser');
 const { signingPayloadV2_0 } = require('../lib/core/cmb-signing');
 const { SymNode } = require('../lib/node');
 const { NullDiscovery } = require('../lib/discovery');
 const { nodeDir } = require('../lib/config');
+const { settle } = require('./_settle'); // waits for every in-flight frame, not a fixed guess
 
 describe('room (B-R10)', () => {
   it('a record minted without a room is in the room "default"', () => {
@@ -70,7 +77,7 @@ describe('size (B-R13)', () => {
     assert.throws(() => createCMB({ categories: { focus: big(MAX_CATEGORY_BYTES + 1) }, createdBy: 'a' }), (e) => e.code === 'ECMBSIZE');
     const near = big(MAX_CATEGORY_BYTES);
     assert.throws(() => createCMB({ categories: { focus: near, issue: near, intent: near, motivation: near }, createdBy: 'a' }), (e) => e.code === 'ECMBSIZE' && /total/.test(e.message));
-    assert.ok(MAX_RECORD_TEXT_BYTES < 1024 * 1024);
+    assert.ok(MAX_RECORD_TEXT_BYTES < MAX_FRAME_SIZE);
   });
   it('counts bytes, not characters', () => {
     const emoji = '😀'.repeat(MAX_CATEGORY_BYTES / 4 + 1); // 4 bytes each
@@ -82,6 +89,70 @@ describe('size (B-R13)', () => {
   });
 });
 
+describe('a record is minted only if its frame can be sent (0.14.0 review C-F3)', () => {
+  const ID = 'n'.repeat(64); // a 64-byte node id, the longest `to` a frame names
+  const cats4 = (t) => ({ focus: t, issue: t, intent: t, motivation: t });
+  /** The frames a record travels in: plain over TCP, and sealed for a peer inside the relay envelope. */
+  function frames(record) {
+    const plain = { type: 'cmb', timestamp: Date.now(), cmb: record, to: ID, directed: true, _anchor: true };
+    const { ciphertext, nonce } = encryptCategories(record.categories, crypto.randomBytes(32));
+    const sealed = { type: 'cmb', timestamp: Date.now(), cmb: { ...record, categories: ciphertext, _e2e: { nonce } }, to: ID, directed: true, _anchor: true };
+    return { plain, relayed: { to: ID, payload: sealed } };
+  }
+  const live = { destroyed: false, writable: true, write: () => true };
+  // The longest metadata a record of this node's carries: a 64-byte author, node id, addressee and
+  // room, under the v2.0 suite (its extra fields, and an assertionId once signed).
+  const mint = (t) => createCMB({ categories: cats4(t), createdBy: 'a'.repeat(64), to: ID, room: 'r'.repeat(64), emitV2: true, createdByNodeId: ID });
+  /** The longest run of `ch` per category (four categories) that still mints, by bisection. */
+  function largestMintable(ch) {
+    let lo = 0, hi = MAX_CATEGORY_BYTES;
+    while (lo < hi) {
+      const mid = Math.ceil((lo + hi) / 2);
+      try { mint(ch.repeat(mid)); lo = mid; } catch (e) {
+        if (e.code !== 'ECMBSIZE') throw e;
+        hi = mid - 1;
+      }
+    }
+    return lo;
+  }
+
+  it('text that JSON escapes is bounded by the frame, not by its text bytes', () => {
+    // 500 KiB of `"`, well inside the text bounds, is a 1 MB frame once each one is written `\"`.
+    const quotes = '"'.repeat(250 * 1024);
+    assert.throws(() => createCMB({ categories: { focus: quotes, issue: quotes }, createdBy: 'a' }), (e) => e.code === 'ECMBSIZE' && /frame/.test(e.message));
+  });
+
+  it('a record sealed for a peer is bounded with the seal\'s base64 counted', () => {
+    // 900 KiB of plain text is inside the 960 KiB text bound, and about 1.2 MB once sealed.
+    assert.throws(() => createCMB({ categories: cats4('a'.repeat(225 * 1024)), createdBy: 'a' }), (e) => e.code === 'ECMBSIZE' && /frame/.test(e.message));
+  });
+
+  for (const [label, ch] of [['plain text', 'a'], ['text JSON escapes', '"'], ['control characters', '\u0001']]) {
+    it(`the largest record that mints is sendable on every transport (${label})`, () => {
+      const n = largestMintable(ch);
+      assert.ok(n > 0 && n < MAX_CATEGORY_BYTES, `bisection found ${n}`);
+      const record = mint(ch.repeat(n));
+      record.metadata.assertionId = assertionIdV2_0(record);
+      signCMB(record, crypto.randomBytes(32).toString('base64url'));
+      const { plain, relayed } = frames(record);
+      assert.strictEqual(writeFrame(live, plain).ok, true, 'over TCP in the clear');
+      assert.ok(Buffer.byteLength(JSON.stringify(relayed), 'utf8') <= MAX_FRAME_SIZE, 'sealed, inside the relay envelope');
+      assert.ok(recordFrameBytes(record) <= MAX_FRAME_SIZE);
+    });
+  }
+
+  it('remember() refuses a payload that would make the frame too large, before storing it', async () => {
+    const name = `bounds-payload-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+    const node = new SymNode({ name, silent: true, discovery: new NullDiscovery() });
+    await node.start();
+    try {
+      assert.throws(() => node.remember({ focus: 'a small record with a large payload' }, { payload: 'x'.repeat(MAX_FRAME_SIZE) }), (e) => e.code === 'ECMBSIZE');
+      assert.strictEqual(node._store.allEntries().length, 0, 'nothing stored');
+      assert.ok(node.remember({ focus: 'the same record with a payload that fits' }, { payload: 'x'.repeat(1024) }));
+    } finally { await node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+  });
+});
+
 describe('on receipt', () => {
   function withNode(fn) {
     const name = `bounds-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
@@ -105,6 +176,35 @@ describe('on receipt', () => {
     });
   });
 
+  it('accepts a record an earlier release minted with an agent id over 64 bytes (0.14.0 review C-F4)', async () => {
+    // Shaped as 0.13.16 mints it: the two-section record, signed under mmp-sig-v2, with no bound on
+    // createdBy. Its address does not cover the author, so only the signature is redone here.
+    const name = `bounds-longid-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+    const node = new SymNode({ name, silent: true, discovery: new NullDiscovery() });
+    await node.start();
+    try {
+      const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519', { publicKeyEncoding: { type: 'spki', format: 'der' }, privateKeyEncoding: { type: 'pkcs8', format: 'der' } });
+      const peer = { pub: publicKey.slice(-32).toString('base64url'), priv: privateKey.slice(-32).toString('base64url') };
+      node._pinPeerKey('peer-long', peer.pub);
+      const longId = 'claude-' + 'host-qualified-session-label-'.repeat(4); // 123 bytes
+      const cmb = createCMB({ categories: { focus: 'a record from a peer with a long agent id' }, createdBy: 'short', room: node._room });
+      cmb.metadata.createdBy = longId;
+      signCMB(cmb, peer.priv);
+      assert.throws(() => createCMB({ categories: { focus: 'x' }, createdBy: longId }), (e) => e.code === 'ECMBSIZE', 'this release does not mint one');
+
+      const metrics = [];
+      node.on('metric', (m) => metrics.push(m));
+      const accepted = [];
+      node.on('cmb-accepted', (e) => accepted.push(e));
+      await node._frameHandler.handle('peer-long', 'peer-long', { type: 'cmb', timestamp: Date.now(), cmb });
+      await settle();
+      assert.strictEqual(metrics.filter((m) => m.type === 'cmb-oversize-rejected').length, 0, 'not refused as oversized');
+      assert.strictEqual(accepted.length, 1, 'admitted');
+      assert.strictEqual(accepted[0].author.name, longId);
+      assert.strictEqual(accepted[0]._cmbVerified, true, 'and verified');
+    } finally { await node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+  });
+
   it('counts every unsigned record and names the peer once', () => {
     withNode((node, metrics, lines) => {
       for (let i = 0; i < 3; i++) {

From 44957f1977b9a0200888360d8ef656dcf811c1d4 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Fri, 2 Oct 2026 03:54:34 +0100
Subject: [PATCH 065/148] 0.14.0 review B: the daemon re-listens without
 waiting on its clients, binds before it probes

F1: a removed socket was listened on again inside server.close()'s callback,
which waits for every connection to end; with a client attached the daemon
accepted nothing, each check queued another callback, and when the clients
left the second listen() threw and exited the daemon. A fresh server now
binds the path at once (the old listener is closed first, since closing a
Unix-socket server removes its path), one attempt at a time; a failure is
logged and retried, never fatal.

F9: the daemon probed and then removed whatever file was at the path, so two
daemons starting together could each take it from the other. It binds first
(lib/platform listenExclusive), probes only a taken path, and removes a stale
file only while it is still the file probed. A start exits before its node
joins anything when a daemon answers on the path.

At shutdown the server is closed only while the path is its own: closing it
removed a socket another daemon had bound since.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 CHANGELOG.md                       |  16 ++-
 bin/sym-daemon.js                  | 193 ++++++++++++++++-------------
 lib/platform.js                    |  54 ++++++++
 tests/daemon-relisten.test.js      | 104 ++++++++++++++++
 tests/ipc-listen-exclusive.test.js |  74 +++++++++++
 5 files changed, 354 insertions(+), 87 deletions(-)
 create mode 100644 tests/daemon-relisten.test.js
 create mode 100644 tests/ipc-listen-exclusive.test.js

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8d29ed2d..ccb62766 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -243,10 +243,18 @@ debt, and the daemon's log flood. Every item has a test that fails without its f
   Two rooted deployments sharing a home shared one pid file, so `sym stop` for one stopped the other.
 - **A second daemon start took the socket from the one serving it.** The daemon removed any socket
   file at start, assuming it stale, so a second start unlinked a live daemon's socket; that daemon
-  ran on, reachable by no client, and every client reported "sym-daemon not running". A socket file
-  is now removed only when nothing answers on it (otherwise the second start exits), a daemon
-  removes only its own socket at shutdown, and a daemon whose socket file is removed listens on it
-  again within 30 s.
+  ran on, reachable by no client, and every client reported "sym-daemon not running".
+  - A start now exits before its node joins anything when a daemon answers on the path.
+  - It binds first and probes only a path that is taken. A stale file is removed only while it is
+    still the file it probed, so two daemons starting together cannot each take the path from the
+    other.
+  - At shutdown, a daemon closes its server only while the path is its own. Closing a Unix-socket
+    server removes its path, whoever has bound it since.
+  - A daemon whose socket file is removed listens on it again within 30 s, on a fresh server. It no
+    longer waits for its connected clients to leave (closing a server waits for every connection),
+    so a client attached for hours no longer left it unreachable and then exited it with
+    `ERR_SERVER_ALREADY_LISTEN` once the clients left. A failure to listen again is logged and
+    retried, and never ends the daemon.
 - **A daemon IPC request whose handler threw went unanswered.** It is answered with the error, and a
   refused `remember` carries the SDK's code (`ECMBSIZE`, `ESIGN`).
 - **A relay-only daemon still announced its room on the LAN.** It no longer does.
diff --git a/bin/sym-daemon.js b/bin/sym-daemon.js
index b87ea5dd..77d4722b 100755
--- a/bin/sym-daemon.js
+++ b/bin/sym-daemon.js
@@ -65,7 +65,7 @@ require('../lib/core/state-root').assertTestSandbox();
 // ~/.sym. Building it from the home dir sent a rooted daemon's room, tasks and relay.env to the
 // user's real ~/.sym.
 const SYM_DIR = require('../lib/core/state-root').SYM_STATE_DIR;
-const { getSocketPath, getLogDir } = require('../lib/platform');
+const { getSocketPath, getLogDir, listenExclusive, socketAnswers } = require('../lib/platform');
 const SOCKET_PATH = getSocketPath();
 // Stable name: use SYM_NODE_NAME env, or platform-scoped default
 // (not hostname — macOS appends random suffixes to hostname on WiFi,
@@ -221,13 +221,7 @@ const listeners = new Map(); // socketId → socket — real-time event subscrib
  */
 function socketServed() {
   if (process.platform === 'win32' || !fs.existsSync(SOCKET_PATH)) return Promise.resolve(false);
-  return new Promise((resolve) => {
-    const c = net.createConnection(SOCKET_PATH);
-    const done = (v) => { c.destroy(); resolve(v); };
-    c.once('connect', () => done(true));
-    c.once('error', () => done(false));
-    setTimeout(() => done(false), 2000).unref();
-  });
+  return socketAnswers(SOCKET_PATH);
 }
 
 /** The socket file this daemon created (its inode), so it never removes another daemon's. */
@@ -237,88 +231,113 @@ function socketIsOurs() {
   try { return fs.statSync(SOCKET_PATH).ino === ownSocketIno; } catch { return false; }
 }
 
-async function startIPCServer() {
-  // Ensure ~/.sym/ exists
-  if (!fs.existsSync(SYM_DIR)) {
-    fs.mkdirSync(SYM_DIR, { recursive: true });
-  }
-  // A socket file is removed only when nothing answers on it. Removing it unconditionally let a
-  // second daemon start take the path from the one already serving: that daemon kept running,
-  // reachable by no client, and every client reported "sym-daemon not running".
-  if (await socketServed()) {
-    log(`Another sym-daemon is serving ${SOCKET_PATH}; not starting a second one.`);
-    process.exit(1);
-  }
-  if (fs.existsSync(SOCKET_PATH)) {
-    try { fs.unlinkSync(SOCKET_PATH); } catch {}
-  }
-
-  const server = net.createServer((socket) => {
-    const socketId = nextSocketId++;
-    let buffer = '';
-
-    socket.on('data', (data) => {
-      buffer += data.toString();
-      let idx;
-      while ((idx = buffer.indexOf('\n')) !== -1) {
-        const line = buffer.slice(0, idx);
-        buffer = buffer.slice(idx + 1);
-        if (line.trim()) {
-          let msg;
-          try { msg = JSON.parse(line); } catch (err) { log(`IPC parse error: ${err.message}`); continue; }
-          try {
-            handleIPCMessage(socketId, socket, msg);
-          } catch (err) {
-            log(`IPC ${msg && msg.type ? `'${msg.type}'` : 'message'} failed: ${err.message}`);
-            if (msg && msg.type) sendIPC(socket, { type: 'result', action: msg.type, error: err.message, code: err.code });
-          }
+/** The server listening on SOCKET_PATH now. Closing a Unix-socket server removes its path, whoever
+ *  has bound it since, so it is closed only while the path is still its own. */
+let listeningServer = null;
+
+/** One IPC connection: newline-delimited JSON in, results and events out. */
+function onIPCConnection(socket) {
+  const socketId = nextSocketId++;
+  let buffer = '';
+
+  socket.on('data', (data) => {
+    buffer += data.toString();
+    let idx;
+    while ((idx = buffer.indexOf('\n')) !== -1) {
+      const line = buffer.slice(0, idx);
+      buffer = buffer.slice(idx + 1);
+      if (line.trim()) {
+        let msg;
+        try { msg = JSON.parse(line); } catch (err) { log(`IPC parse error: ${err.message}`); continue; }
+        try {
+          handleIPCMessage(socketId, socket, msg);
+        } catch (err) {
+          log(`IPC ${msg && msg.type ? `'${msg.type}'` : 'message'} failed: ${err.message}`);
+          if (msg && msg.type) sendIPC(socket, { type: 'result', action: msg.type, error: err.message, code: err.code });
         }
       }
-    });
-
-    socket.on('close', () => {
-      const vn = virtualNodes.get(socketId);
-      if (vn) { log(`Virtual node disconnected: ${vn.name}`); virtualNodes.delete(socketId); }
-      const ha = hostedAgents.get(socketId);
-      if (ha) { log(`Hosted agent disconnected: ${ha.name}`); hostedAgents.delete(socketId); }
-      listeners.delete(socketId);
-    });
+    }
+  });
 
-    socket.on('error', (err) => {
-      if (err.code !== 'EPIPE' && err.code !== 'ECONNRESET') {
-        log(`IPC socket error: ${err.message}`);
-      }
-      virtualNodes.delete(socketId);
-      hostedAgents.delete(socketId);
-    });
+  socket.on('close', () => {
+    const vn = virtualNodes.get(socketId);
+    if (vn) { log(`Virtual node disconnected: ${vn.name}`); virtualNodes.delete(socketId); }
+    const ha = hostedAgents.get(socketId);
+    if (ha) { log(`Hosted agent disconnected: ${ha.name}`); hostedAgents.delete(socketId); }
+    listeners.delete(socketId);
   });
 
-  const onListening = () => {
-    // chmod not applicable on Windows named pipes
-    if (process.platform !== 'win32') {
-      try { fs.chmodSync(SOCKET_PATH, 0o700); } catch {}
-      try { ownSocketIno = fs.statSync(SOCKET_PATH).ino; } catch { ownSocketIno = null; }
+  socket.on('error', (err) => {
+    if (err.code !== 'EPIPE' && err.code !== 'ECONNRESET') {
+      log(`IPC socket error: ${err.message}`);
     }
-    log(`IPC server listening: ${SOCKET_PATH}`);
-  };
-  server.listen(SOCKET_PATH, onListening);
+    virtualNodes.delete(socketId);
+    hostedAgents.delete(socketId);
+  });
+}
+
+function onListening() {
+  // chmod not applicable on Windows named pipes
+  if (process.platform !== 'win32') {
+    try { fs.chmodSync(SOCKET_PATH, 0o700); } catch {}
+    try { ownSocketIno = fs.statSync(SOCKET_PATH).ino; } catch { ownSocketIno = null; }
+  }
+  log(`IPC server listening: ${SOCKET_PATH}`);
+}
+
+/** A server that only logs its errors once it is listening: an accept error never ends the daemon. */
+function newIPCServer() {
+  const server = net.createServer(onIPCConnection);
+  return server;
+}
+
+/** @returns {Promise<net.Server|null>} the listening server, or null when another daemon serves the path */
+async function startIPCServer() {
+  // Ensure ~/.sym/ exists
+  if (!fs.existsSync(SYM_DIR)) {
+    fs.mkdirSync(SYM_DIR, { recursive: true });
+  }
+  // Bind first, and probe only a path that is taken: a socket file is removed only when nothing
+  // answers on it and it is still the file probed. Probing first and then removing whatever was
+  // there let two daemons starting together each take the path from the other.
+  const server = newIPCServer();
+  if (await listenExclusive(server, SOCKET_PATH) === 'served') return null;
+  server.on('error', (err) => log(`IPC server error: ${err.message}`));
+  listeningServer = server;
+  onListening();
 
   // If the socket file is removed or replaced while this daemon runs, clients can no longer reach
-  // it. It is checked every 30 s and, when gone, listened on again.
+  // it. It is checked every 30 s and, when gone, a fresh server listens on it. That never waits for
+  // the clients already connected: they stay on the connections they have (closing a server stops it
+  // accepting and leaves its connections open). One attempt at a time, and a failure is logged and
+  // retried at the next check, never fatal.
   if (process.platform !== 'win32') {
-    setInterval(() => {
-      if (ownSocketIno === null || socketIsOurs()) return;
+    let relistening = false;
+    setInterval(async () => {
+      if (relistening || ownSocketIno === null || socketIsOurs()) return;
       if (fs.existsSync(SOCKET_PATH)) return; // another process's socket now: leave it alone
-      log(`IPC socket ${SOCKET_PATH} was removed while this daemon was serving; listening again`);
-      server.close(() => server.listen(SOCKET_PATH, onListening));
+      relistening = true;
+      try {
+        log(`IPC socket ${SOCKET_PATH} was removed while this daemon was serving; listening again`);
+        // The old listener goes first: closing it removes the path, which is still empty now.
+        if (listeningServer) { listeningServer.close(); listeningServer = null; }
+        ownSocketIno = null;
+        const fresh = newIPCServer();
+        if (await listenExclusive(fresh, SOCKET_PATH) === 'served') {
+          log(`Another sym-daemon now serves ${SOCKET_PATH}; this one keeps the clients it has`);
+          return;
+        }
+        fresh.on('error', (err) => log(`IPC server error: ${err.message}`));
+        listeningServer = fresh;
+        onListening();
+      } catch (err) {
+        log(`IPC listen again on ${SOCKET_PATH} failed: ${err.message}; retried at the next check`);
+      } finally {
+        relistening = false;
+      }
     }, Number(process.env.SYM_SOCKET_CHECK_MS) || 30_000).unref();
   }
 
-  server.on('error', (err) => {
-    log(`IPC server error: ${err.message}`);
-    process.exit(1);
-  });
-
   return server;
 }
 
@@ -913,6 +932,12 @@ async function main() {
   log(`  relay: ${relayUrl || 'none'}`);
   log(`  socket: ${SOCKET_PATH}`);
 
+  // A socket another daemon answers on is its: this start stops before its node joins anything.
+  if (await socketServed()) {
+    log(`Another sym-daemon is serving ${SOCKET_PATH}; not starting a second one.`);
+    process.exit(1);
+  }
+
   await node.start();
   log(`SYM node started (${node._identity?.nodeId?.slice(0, 8)})`);
 
@@ -971,7 +996,11 @@ async function main() {
     broadcastToListeners({ type: 'event', event: 'peer-left', data: { name: data.name || 'unknown', peerId: data.peerId } });
   });
 
-  const ipcServer = await startIPCServer();
+  if (!(await startIPCServer())) {
+    log(`Another sym-daemon is serving ${SOCKET_PATH}; not starting a second one.`);
+    await node.stop();
+    process.exit(1);
+  }
 
   log('sym-daemon ready');
 
@@ -980,11 +1009,9 @@ async function main() {
     log('Shutting down...');
     stopRoomBeacon();
     node.stop();
-    ipcServer.close();
-    // Only our own socket file: a path another daemon now serves is left to it.
-    if (socketIsOurs()) {
-      try { fs.unlinkSync(SOCKET_PATH); } catch {}
-    }
+    // Only our own socket file: closing a server removes its path, so a path another daemon now
+    // serves is not closed over; exiting releases this one's handle without touching it.
+    if (listeningServer && socketIsOurs()) listeningServer.close();
     process.exit(0);
   };
 
diff --git a/lib/platform.js b/lib/platform.js
index 76202dbf..223553ec 100644
--- a/lib/platform.js
+++ b/lib/platform.js
@@ -217,6 +217,58 @@ function ipcEndpoint(address, platform = process.platform) {
   return `\\\\.\\pipe\\sym-${base}-${digest}`;
 }
 
+/**
+ * Whether something answers on an IPC endpoint: a connect that succeeds means yes; a refused,
+ * missing or silent one means no.
+ * @returns {Promise<boolean>}
+ */
+function socketAnswers(address, timeoutMs = 2000) {
+  const net = require('net');
+  return new Promise((resolve) => {
+    const c = net.createConnection(address);
+    let settled = false;
+    const done = (v) => { if (settled) return; settled = true; c.destroy(); resolve(v); };
+    c.once('connect', () => done(true));
+    c.once('error', () => done(false));
+    setTimeout(() => done(false), timeoutMs).unref();
+  });
+}
+
+/**
+ * Listen on an IPC endpoint without taking it from a server that answers there. It binds first, and
+ * only a path already taken (EADDRINUSE) is probed: probing first and then removing whatever file
+ * was there let two daemons starting together each remove the other's socket. A Unix path nobody
+ * answers on is stale and is removed, but only while it is still the file that was probed (the same
+ * inode), so a socket another server bound in the meantime is never removed; then the bind is tried
+ * again. A named pipe (Windows) leaves no stale file, so a taken one is served.
+ * @param {import('net').Server} server - not yet listening
+ * @param {string} address
+ * @param {{ probe?: (address: string) => Promise<boolean>, tries?: number, platform?: string }} [opts]
+ * @returns {Promise<'listening'|'served'>} 'served' when another server answers on the address
+ */
+async function listenExclusive(server, address, { probe = socketAnswers, tries = 3, platform = process.platform } = {}) {
+  for (let attempt = 0; attempt < tries; attempt++) {
+    const err = await new Promise((resolve) => {
+      const onError = (e) => { server.removeListener('listening', onListening); resolve(e); };
+      const onListening = () => { server.removeListener('error', onError); resolve(null); };
+      server.once('error', onError);
+      server.once('listening', onListening);
+      server.listen(address);
+    });
+    if (!err) return 'listening';
+    if (err.code !== 'EADDRINUSE') throw err;
+    if (platform === 'win32' || isWindowsPipe(address)) return 'served';
+    let probed;
+    try { probed = fs.statSync(address); } catch { continue; } // gone already: bind again
+    if (await probe(address)) return 'served';
+    try {
+      const now = fs.statSync(address);
+      if (now.ino === probed.ino && now.dev === probed.dev) fs.unlinkSync(address);
+    } catch { /* gone, or not ours to remove: bind again */ }
+  }
+  return (await probe(address)) ? 'served' : Promise.reject(Object.assign(new Error(`could not listen on ${address}`), { code: 'EADDRINUSE' }));
+}
+
 /**
  * Resolve the daemon's IPC endpoint from its inputs (see getSocketPath).
  * @param {object} o
@@ -385,6 +437,8 @@ module.exports = {
   resolveSocketPath,
   ipcEndpoint,
   isWindowsPipe,
+  socketAnswers,
+  listenExclusive,
   getLogDir,
   projectPath,
   safeReadFile,
diff --git a/tests/daemon-relisten.test.js b/tests/daemon-relisten.test.js
new file mode 100644
index 00000000..4cb341e3
--- /dev/null
+++ b/tests/daemon-relisten.test.js
@@ -0,0 +1,104 @@
+'use strict';
+
+/**
+ * 0.14.0 release review B-F1: a daemon whose socket file was removed listened again by closing its
+ * server and listening in the close callback. close() waits for every connection to end, and IPC
+ * clients stay connected for hours, so the daemon accepted nothing while one was attached; each check
+ * queued another callback, and when the clients left the second listen() threw and the daemon exited.
+ * It now binds a fresh server, without waiting on anyone, and a failure never ends it.
+ *
+ * Closing a Unix-socket server removes its path, whoever has bound it since; so a daemon shutting
+ * down closes its server only while the path is its own, and leaves one another daemon serves.
+ */
+
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const { spawn } = require('node:child_process');
+const net = require('net');
+const fs = require('fs');
+const path = require('path');
+const { tmpdir } = require('./_tmpdir');
+
+const BIN = path.join(__dirname, '..', 'bin');
+const posix = process.platform !== 'win32';
+
+function startDaemon(base, name, socket, checkMs) {
+  const home = path.join(base, name);
+  fs.mkdirSync(home, { recursive: true });
+  const env = { ...process.env, HOME: home, USERPROFILE: home, SYM_SOCKET: socket, SYM_NODE_NAME: name, SYM_RELAY_ONLY: '1', SYM_SOCKET_CHECK_MS: String(checkMs) };
+  delete env.SYM_RELAY_URL; delete env.SYM_RELAY_TOKEN; delete env.SYM_ROOM; delete env.SYM_STATE_DIR;
+  const d = spawn(process.execPath, [path.join(BIN, 'sym-daemon.js')], { env, stdio: ['ignore', 'pipe', 'pipe'] });
+  d.out = '';
+  d.stdout.on('data', (b) => { d.out += b; });
+  d.stderr.on('data', (b) => { d.out += b; });
+  return d;
+}
+const until = async (cond, ms = 15000) => { for (let t = 0; t < ms && !cond(); t += 50) await new Promise((r) => setTimeout(r, 50)); return cond(); };
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+/** A client that stays connected and can ask for status over and over. */
+function client(socket) {
+  return new Promise((resolve, reject) => {
+    const c = net.createConnection(socket);
+    let buf = '';
+    const waiting = [];
+    c.on('data', (d) => {
+      buf += d;
+      let i;
+      while ((i = buf.indexOf('\n')) !== -1) { const line = buf.slice(0, i); buf = buf.slice(i + 1); const w = waiting.shift(); if (w) w(JSON.parse(line)); }
+    });
+    c.once('error', reject);
+    c.once('connect', () => resolve({
+      status: () => new Promise((r) => { waiting.push(r); c.write(JSON.stringify({ type: 'status' }) + '\n'); setTimeout(() => r(null), 3000); }),
+      end: () => c.end(),
+    }));
+  });
+}
+const statusOnce = async (socket) => { try { const c = await client(socket); const s = await c.status(); c.end(); return !!s; } catch { return false; } };
+
+test('a removed socket is listened on again while a client stays connected, and the daemon lives on when it leaves', { skip: !posix && 'Unix socket files only' }, async () => {
+  const base = tmpdir('sym-relisten-');
+  const socket = path.join(base, 'd.sock');
+  const d = startDaemon(base, 'relisten', socket, 200);
+  try {
+    assert.ok(await until(() => d.out.includes('IPC server listening')), d.out.slice(-600));
+    const held = await client(socket);
+    assert.ok(await held.status(), 'a client is connected and served');
+    for (let round = 1; round <= 2; round++) {
+      fs.unlinkSync(socket);
+      assert.ok(await until(() => fs.existsSync(socket), 3000), `round ${round}: the socket is back while the client is still connected\n${d.out.slice(-600)}`);
+      assert.equal(await statusOnce(socket), true, `round ${round}: a new client reaches the daemon`);
+      assert.ok(await held.status(), `round ${round}: and the connected client is still served`);
+      await sleep(700);   // several checks pass with the path served: none re-listens
+    }
+    held.end();
+    await sleep(1000);
+    assert.equal(d.exitCode, null, `the daemon is still running after its clients left\n${d.out.slice(-600)}`);
+    assert.doesNotMatch(d.out, /FATAL|ERR_SERVER_ALREADY_LISTEN/);
+    assert.equal(await statusOnce(socket), true);
+  } finally {
+    d.kill('SIGTERM');
+    await until(() => d.exitCode !== null, 5000);
+  }
+});
+
+test('a daemon shutting down leaves the socket another daemon now serves', { skip: !posix && 'Unix socket files only' }, async () => {
+  const base = tmpdir('sym-shutdown-');
+  const socket = path.join(base, 'd.sock');
+  const a = startDaemon(base, 'first', socket, 600_000);   // never re-listens within the test
+  let b = null;
+  try {
+    assert.ok(await until(() => a.out.includes('IPC server listening')), a.out.slice(-600));
+    fs.unlinkSync(socket);
+    b = startDaemon(base, 'second', socket, 600_000);
+    assert.ok(await until(() => b.out.includes('IPC server listening')), `the second daemon takes the free path\n${b.out.slice(-600)}`);
+    a.kill('SIGTERM');
+    assert.ok(await until(() => a.exitCode !== null, 10000), 'the first shuts down');
+    assert.ok(fs.existsSync(socket), "the second daemon's socket is still there");
+    assert.equal(await statusOnce(socket), true, 'and it still answers');
+  } finally {
+    if (a.exitCode === null) a.kill('SIGTERM');
+    if (b && b.exitCode === null) b.kill('SIGTERM');
+    await sleep(300);
+  }
+});
diff --git a/tests/ipc-listen-exclusive.test.js b/tests/ipc-listen-exclusive.test.js
new file mode 100644
index 00000000..db956274
--- /dev/null
+++ b/tests/ipc-listen-exclusive.test.js
@@ -0,0 +1,74 @@
+'use strict';
+
+/**
+ * 0.14.0 release review B-F9: the daemon probed the socket path and then removed whatever file was
+ * there, so two daemons starting together could each take the path from the other. It now binds
+ * first, probes only a path that is taken, and removes a stale file only while it is still the file
+ * it probed (lib/platform listenExclusive).
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert/strict');
+const net = require('net');
+const fs = require('fs');
+const path = require('path');
+const { tmpdir } = require('./_tmpdir');
+const { listenExclusive, socketAnswers } = require('../lib/platform');
+
+const posix = process.platform !== 'win32';
+const listen = (server, p) => new Promise((resolve, reject) => { server.once('error', reject); server.listen(p, resolve); });
+const closeAll = (...servers) => Promise.all(servers.map((s) => new Promise((r) => (s.listening ? s.close(() => r()) : r()))));
+
+describe('listening on an IPC path without taking it from another server', { skip: !posix && 'Unix socket paths only' }, () => {
+  it('a free path is listened on', async () => {
+    const p = path.join(tmpdir('ipc-ex-'), 's.sock');
+    const s = net.createServer();
+    assert.equal(await listenExclusive(s, p), 'listening');
+    assert.equal(await socketAnswers(p), true);
+    await closeAll(s);
+  });
+
+  it('a stale file nobody answers on is replaced', async () => {
+    const p = path.join(tmpdir('ipc-ex-'), 's.sock');
+    fs.writeFileSync(p, '');   // what a crashed daemon leaves
+    const s = net.createServer();
+    assert.equal(await listenExclusive(s, p), 'listening');
+    assert.equal(await socketAnswers(p), true);
+    await closeAll(s);
+  });
+
+  it('a path another server answers on is left to it', async () => {
+    const p = path.join(tmpdir('ipc-ex-'), 's.sock');
+    const other = net.createServer();
+    await listen(other, p);
+    const ino = fs.statSync(p).ino;
+    const s = net.createServer();
+    assert.equal(await listenExclusive(s, p), 'served');
+    assert.equal(s.listening, false);
+    assert.equal(fs.statSync(p).ino, ino, 'its socket file is untouched');
+    assert.equal(await socketAnswers(p), true);
+    await closeAll(other);
+  });
+
+  it('a socket another server binds between the probe and the removal is never removed', async () => {
+    const p = path.join(tmpdir('ipc-ex-'), 's.sock');
+    fs.writeFileSync(p, '');   // stale when probed...
+    const other = net.createServer();
+    let probes = 0;
+    const probe = async (addr) => {
+      probes++;
+      if (probes === 1) {
+        // ...and in the window after the probe, another daemon removes it and binds the path.
+        fs.unlinkSync(addr);
+        await listen(other, addr);
+        return false;
+      }
+      return socketAnswers(addr);
+    };
+    const s = net.createServer();
+    assert.equal(await listenExclusive(s, p, { probe }), 'served', 'the other server keeps the path');
+    assert.equal(s.listening, false);
+    assert.equal(await socketAnswers(p), true, 'and still answers on it');
+    await closeAll(other);
+  });
+});

From 2e60869cfd40fe2921f4cce3420e30471217b845 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Fri, 2 Oct 2026 03:55:06 +0100
Subject: [PATCH 066/148] 0.14.0 review B: a wake channel ranks by how its node
 id was proven; the store is bounded

F2: a peer's wake-channel frame was recorded at the top rank on a node id it
only claimed at handshake (this runtime proves no key there), so whoever
claimed a phone's id could repoint its wake token. A frame from a session that
proved nothing now ranks with gossip ('unproven'); only a session that proved
the key (node._peerKeyProven, false until the proving handshake is wired)
ranks above the relay. Nothing unproven repoints what the relay or a proven
session gave.

Also: provenPublicKey, which only this node's own proving handshake may set,
was read from the peer's handshake frame, so a copy of a room grant plus the
key printed in it admitted an impostor to a gated room. It is dropped on
arrival (frame handler and the LAN inbound path).

F3: platform 'none' removes the channel when the peer's own frame or the
relay's registration ranks at least as high; gossip cannot.
F4/F10: the cap and validation hold for what is loaded; a pre-0.14.0 entry's
one grace stamp is written back at once. F7/F12: peer-info is sent and read
for 256 entries (the most recently seen), the relay's list read for 256, and
room is made in O(1) from a per-rank index. Frames waiting for a sleeping
peer are capped at 64 and go with its channel. Ids and tokens are short, and
a token is one path segment. F8: RelayConnection defaults learnWakeChannel.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 CHANGELOG.md                |  39 +++++--
 lib/core/wake.js            | 202 +++++++++++++++++++++++++-----------
 lib/frame-handler.js        |  30 ++++--
 lib/node.js                 |  13 +++
 lib/relay.js                |  17 ++-
 tests/wake-channels.test.js | 184 +++++++++++++++++++++++++++++++-
 6 files changed, 404 insertions(+), 81 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ccb62766..bdfbc1d0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -26,16 +26,38 @@ debt, and the daemon's log flood. Every item has a test that fails without its f
   A signed addressee could only veto directed treatment. When the author signed one, it now alone
   decides.
 - **Unauthenticated gossip could repoint a phone's wake token.** Any room peer's `peer-info` could
-  overwrite a wake channel the phone had given this node itself. A channel learned from a weaker
-  source (gossip < relay < the peer itself) now never replaces a stronger one's token. A channel kept
-  by an earlier release, which recorded no source, ranks with the relay: gossip cannot repoint it.
-  At most 1024 channels are kept (gossip only ever displaces gossip), and one `peer-info` frame is
-  read for at most 256 entries, so fabricated node ids cannot grow the map, its file or the gossip
-  this node sends.
+  overwrite a wake channel the phone had given this node itself. A channel now ranks by how the node
+  id it names was proven, and a weaker source never replaces a stronger one's token. At the top is the
+  peer's own `wake-channel` frame over a session that proved it holds that node id's key. Next comes
+  the relay's peer list, which is the peer's own registration over its relay-auth session, ranked with
+  a channel kept by an earlier release (which recorded no source). At the bottom are a `wake-channel`
+  frame over a session that proved nothing, which is just whoever claimed that node id at handshake,
+  and gossip. **No handshake in this runtime proves a key yet**, so a peer's own frame ranks with
+  gossip, and nothing unproven can repoint a channel the relay or a proven session gave.
+- **A peer can turn its wake channel off.** `platform: 'none'` removes the channel when it comes from
+  the peer's own frame, or from the relay's registration, ranked at least as high as the channel
+  held. Gossip cannot remove anyone's.
+- **The wake-channel store and everything it feeds are bounded, at load as at run time.**
+  - At most 1,024 channels are kept, including what is loaded from a file an earlier release wrote.
+    Gossip only ever displaces gossip, and room is made in O(1), dropping the channel of the weakest
+    rank set least recently, never by scanning the map.
+  - A `peer-info` frame carries and is read for at most 256 entries, the most recently seen. The
+    relay's peer list is read for 256 too. An over-long frame from an older sender is said once a
+    minute per peer.
+  - At most 64 frames wait for one sleeping peer, and they go with its channel.
+  - A node id, platform, token and environment are short strings, and a token is one path segment
+    (it is put in the push provider's request path).
+- **A peer could claim to have proven its key.** `provenPublicKey`, which only this node's own
+  proving handshake may set, was read from the peer's own handshake frame. A gated room's admission
+  compares it with the key printed in the room grant presented, so anyone holding a copy of a grant
+  could enter as its grantee by writing that key into the frame. A handshake's `provenPublicKey` is
+  now dropped on arrival, on both the LAN and the relay path.
 - **A frame whose handling threw ended a relay-connected daemon.** The LAN path caught a throw from
   frame handling, but the relay path had nothing above it, so the exception reached the process. A
   frame that throws is now dropped with a log line and a `frame-handler-error` metric. A record that
-  declares the v2.0 suite but has no buildable preimage is rejected as a signature mismatch.
+  declares the v2.0 suite but has no buildable preimage is rejected as a signature mismatch. A relay
+  connection built without a wake manager no longer throws in its WebSocket handler on a peer list
+  that carries a wake channel.
 - **A record with no room was admitted in every room it was replayed into (B-R10).** A record that
   names no room is now in the literal room `default` (§7). `createCMB` names `default` instead of
   null (which signed the string `"null"`), and the v2.0 preimage refuses a record without a room.
@@ -237,7 +259,8 @@ debt, and the daemon's log flood. Every item has a test that fails without its f
   `stdout.log` reached 1 GB of `learned wake channel for unknown`. A repeat now changes nothing and
   logs nothing; a frame that does teach something logs one line. Channels carry the time of the last
   first-hand sighting (gossip forwards it instead of the time of sending) and expire after 30 days
-  unseen. A channel saved before this release gets one 30-day grace period, once.
+  unseen. A channel saved before this release gets one 30-day grace period, once: the stamp is
+  written back the first time it is loaded, so a restart does not renew it.
 - **A daemon rooted with `SYM_STATE_DIR` kept its room, tasks and relay.env in `~/.sym`.** It uses
   the state root now, and so does the `sym` CLI: its pid file, room, relay.env and node directory.
   Two rooted deployments sharing a home shared one pid file, so `sym stop` for one stopped the other.
diff --git a/lib/core/wake.js b/lib/core/wake.js
index 9f42fb61..4b60c1c2 100644
--- a/lib/core/wake.js
+++ b/lib/core/wake.js
@@ -31,15 +31,48 @@ const WAKE_CHANNEL_TTL_MS = 30 * 24 * 60 * 60 * 1000;
 /** A newer sighting of the same channel is worth persisting once it moves lastSeen by this much. */
 const REFRESH_GRANULARITY_MS = 60 * 60 * 1000;
 
-/** How far each source of a wake channel is trusted. Gossip is unauthenticated. A channel kept by
- *  a release before 0.14.0 carries no source: it may have come from the phone itself, so gossip
- *  must not repoint it, while the relay and the phone still can. */
-const SOURCE_RANK = Object.freeze({ gossip: 1, legacy: 2, relay: 2, direct: 3 });
+/** How far each source of a wake channel is trusted, by how the nodeId it names was proven:
+ *  - `direct` (3): the peer's own `wake-channel` frame over a session that proved it holds the key
+ *    bound to that nodeId;
+ *  - `relay` (2): the relay's peer list, the peer's own registration over its relay-auth session;
+ *  - `legacy` (2): kept by a release before 0.14.0, which recorded no source;
+ *  - `unproven` (1): a `wake-channel` frame over a session that proved nothing, so from whoever
+ *    claimed that nodeId at handshake;
+ *  - `gossip` (1): another peer's `peer-info`, which nothing authenticates.
+ *  A source never replaces a stronger one's token, so nothing unproven can repoint a channel the peer
+ *  announced over its own authenticated session. */
+const SOURCE_RANK = Object.freeze({ gossip: 1, unproven: 1, legacy: 2, relay: 2, direct: 3 });
+const RANKS = [1, 2, 3];
+const rankOf = (source) => SOURCE_RANK[source] ?? 0;
 
 /** At most this many wake channels are kept. Gossip names nodeIds nothing vouches for, so without a
  *  bound a peer could grow the map, its file and every peer-info this node sends. */
 const WAKE_CHANNELS_MAX = 1024;
 
+/** A `peer-info` frame carries, and is read for, at most this many entries: sender and receiver agree. */
+const PEER_INFO_MAX = 256;
+
+/** At most this many frames wait for one sleeping peer; the oldest go first. */
+const PENDING_FRAMES_MAX = 64;
+
+/** What a channel may hold: a nodeId, platform, token and environment are short strings, and the
+ *  token goes into the push provider's request path, so it is one path segment. */
+const NODE_ID_MAX = 128;
+const TOKEN_RE = /^[A-Za-z0-9_:.-]{1,512}$/;
+const PLATFORM_RE = /^[a-z0-9-]{1,32}$/;
+const ENVIRONMENT_RE = /^[A-Za-z0-9_-]{1,32}$/;
+
+/** A channel as stored, or null if it is not one: `platform: 'none'` (no channel) needs no token. */
+function cleanChannel(nodeId, channel) {
+  if (typeof nodeId !== 'string' || !nodeId || nodeId.length > NODE_ID_MAX) return null;
+  if (!channel || typeof channel.platform !== 'string' || !PLATFORM_RE.test(channel.platform)) return null;
+  if (channel.platform === 'none') return { platform: 'none' };
+  if (typeof channel.token !== 'string' || !TOKEN_RE.test(channel.token)) return null;
+  if (channel.environment !== undefined && channel.environment !== null
+    && (typeof channel.environment !== 'string' || !ENVIRONMENT_RE.test(channel.environment))) return null;
+  return { platform: channel.platform, token: channel.token, environment: channel.environment ?? undefined };
+}
+
 /**
  * Manages wake channel persistence and peer wake notifications.
  */
@@ -73,7 +106,12 @@ class WakeManager {
     this._nodeName = opts.nodeName;
     this._ttlMs = opts.wakeChannelTtlMs ?? WAKE_CHANNEL_TTL_MS;
     this._maxChannels = opts.maxWakeChannels ?? WAKE_CHANNELS_MAX;
+    this._maxPendingFrames = opts.maxPendingFrames ?? PENDING_FRAMES_MAX;
     this._now = opts.now || Date.now;
+    // rank -> Map(nodeId -> true) in the order channels were last set: room is made by dropping the
+    // head of the weakest rank, O(1), never by scanning the map. The map is written only through
+    // _set and _delete, which keep this index.
+    this._byRank = new Map(RANKS.map((r) => [r, new Map()]));
 
     this._apnsConfig = null;
     this._apnsKey = null;
@@ -92,16 +130,25 @@ class WakeManager {
       if (fs.existsSync(this._wakeChannelsFile)) {
         const data = JSON.parse(fs.readFileSync(this._wakeChannelsFile, 'utf8'));
         const now = this._now();
-        for (const [id, ch] of Object.entries(data)) {
-          if (ch?.platform && ch?.token) {
-            const lastSeen = Number.isFinite(ch.lastSeen) ? Math.min(ch.lastSeen, now) : now;
-            this._peerWakeChannels.set(id, { ...ch, source: ch.source || 'legacy', lastSeen });
-          }
+        // What is loaded is held to the same rules as what is learned: valid entries only, and at
+        // most the cap. A file written before 0.14.0 could hold any number of gossiped ids.
+        let dirty = false;
+        for (const [id, ch] of Object.entries(data && typeof data === 'object' ? data : {})) {
+          const clean = cleanChannel(id, ch);
+          if (!clean || clean.platform === 'none') { dirty = true; continue; }
+          // Stamped now, the first time only: written back below, so the grace is given once.
+          if (!Number.isFinite(ch.lastSeen) || !ch.source) dirty = true;
+          const lastSeen = Number.isFinite(ch.lastSeen) ? Math.min(ch.lastSeen, now) : now;
+          const source = SOURCE_RANK[ch.source] ? ch.source : 'legacy';
+          this._set(id, { ...clean, source, lastSeen });
         }
         const expired = this.pruneWakeChannels({ save: false });
-        if (expired > 0) this.saveWakeChannels();
+        let over = 0;
+        while (this._peerWakeChannels.size > this._maxChannels && this._evictFor('direct')) over++;
+        if (dirty || expired > 0 || over > 0) this.saveWakeChannels();
         if (this._peerWakeChannels.size > 0) {
-          this._log(`Loaded ${this._peerWakeChannels.size} wake channel(s) from disk${expired ? `, ${expired} expired` : ''}`);
+          const notes = [expired ? `${expired} expired` : '', over ? `${over} over the cap of ${this._maxChannels} dropped` : ''].filter(Boolean);
+          this._log(`Loaded ${this._peerWakeChannels.size} wake channel(s) from disk${notes.length ? `, ${notes.join(', ')}` : ''}`);
         }
       }
     } catch (err) {
@@ -109,75 +156,104 @@ class WakeManager {
     }
   }
 
+  /** @private Set a channel, keeping the rank index: it moves to the end of its rank. */
+  _set(nodeId, ch) {
+    const prev = this._peerWakeChannels.get(nodeId);
+    if (prev) this._byRank.get(rankOf(prev.source))?.delete(nodeId);
+    this._peerWakeChannels.set(nodeId, ch);
+    this._byRank.get(rankOf(ch.source))?.set(nodeId, true);
+  }
+
+  /** @private Drop a channel, and the frames waiting to reach that peer through it. */
+  _delete(nodeId) {
+    const prev = this._peerWakeChannels.get(nodeId);
+    if (!prev) return;
+    this._byRank.get(rankOf(prev.source))?.delete(nodeId);
+    this._peerWakeChannels.delete(nodeId);
+    this._pendingFrames?.delete(nodeId);
+  }
+
   /**
-   * Record a peer's wake channel, from one of three sources:
-   * - `direct`: the peer's own `wake-channel` frame, over its own connection;
-   * - `relay`: the relay's peer list, after relay-auth;
-   * - `gossip`: another peer's `peer-info`, which nothing authenticates.
+   * Record a peer's wake channel, from one of the sources in SOURCE_RANK: `direct` or `unproven`
+   * (the peer's own `wake-channel` frame, over a session that did or did not prove its key), `relay`
+   * (the relay's peer list, after relay-auth) or `gossip` (another peer's `peer-info`).
+   *
+   * A weaker source never replaces a stronger one's token, so nothing unproven can repoint a channel
+   * the peer announced over its own authenticated session. `lastSeen` is when someone last had
+   * first-hand evidence of the channel, never the time a copy of it was forwarded, so a channel
+   * nobody has seen ages out after the TTL however often it is gossiped.
    *
-   * A weaker source never replaces a stronger one's token, so an unauthenticated `peer-info` cannot
-   * repoint a phone that told us its token itself. `lastSeen` is when someone last had first-hand
-   * evidence of the channel, never the time a copy of it was forwarded, so a channel nobody has seen
-   * ages out after the TTL however often it is gossiped.
+   * `platform: 'none'` is the peer turning its channel off: it removes the channel when it comes
+   * from the peer's own frame or registration (not from gossip about it) at least as strong as the
+   * channel held.
    *
    * @param {string} nodeId
    * @param {{platform:string, token?:string, environment?:string}} channel
-   * @param {{source:'direct'|'relay'|'gossip', lastSeen?:number}} opts
-   * @returns {'added'|'updated'|'refreshed'|'unchanged'|'ignored'} what changed; only the first
-   *   three need saving.
+   * @param {{source:'direct'|'unproven'|'relay'|'gossip', lastSeen?:number}} opts
+   * @returns {'added'|'updated'|'refreshed'|'removed'|'unchanged'|'ignored'} what changed; only
+   *   the first four need saving.
    */
   learnWakeChannel(nodeId, channel, { source, lastSeen } = {}) {
-    if (!nodeId || !channel?.platform || channel.platform === 'none') return 'ignored';
+    const clean = cleanChannel(nodeId, channel);
+    if (!clean || !rankOf(source)) return 'ignored';
+    const prev = this._peerWakeChannels.get(nodeId);
+    if (clean.platform === 'none') {
+      if (source === 'gossip') return 'ignored';   // a peer turns off its own channel, nobody else's
+      if (!prev) return 'unchanged';
+      if (rankOf(source) < rankOf(prev.source)) return 'ignored';
+      this._delete(nodeId);
+      return 'removed';
+    }
     const now = this._now();
     // The peer itself, or the relay that holds its registration, is first-hand evidence now; a
     // gossiped copy is only as fresh as the sighting it carries.
-    const firstHand = source === 'direct' || (source === 'relay' && !Number.isFinite(lastSeen));
+    const firstHand = source === 'direct' || source === 'unproven' || (source === 'relay' && !Number.isFinite(lastSeen));
     const seen = firstHand ? now : Math.min(Number.isFinite(lastSeen) ? lastSeen : 0, now);
     if (now - seen > this._ttlMs) return 'ignored';
-    const next = { platform: channel.platform, token: channel.token, environment: channel.environment, source, lastSeen: seen };
-    const prev = this._peerWakeChannels.get(nodeId);
+    const next = { ...clean, source, lastSeen: seen };
     if (!prev) {
       if (this._peerWakeChannels.size >= this._maxChannels && !this._evictFor(source)) return 'ignored';
-      this._peerWakeChannels.set(nodeId, next);
+      this._set(nodeId, next);
       return 'added';
     }
     const sameToken = prev.platform === next.platform && prev.token === next.token && prev.environment === next.environment;
     if (sameToken) {
       // The same channel again: keep the stronger source and the later sighting.
-      const keepSource = (SOURCE_RANK[source] ?? 0) > (SOURCE_RANK[prev.source] ?? 0) ? source : prev.source;
+      const keepSource = rankOf(source) > rankOf(prev.source) ? source : prev.source;
       const keepSeen = Math.max(seen, prev.lastSeen ?? 0);
       if (keepSource === prev.source && keepSeen === prev.lastSeen) return 'unchanged';
-      this._peerWakeChannels.set(nodeId, { ...prev, source: keepSource, lastSeen: keepSeen });
+      this._set(nodeId, { ...prev, source: keepSource, lastSeen: keepSeen });
       // Against a 30-day TTL a sighting a few minutes newer changes nothing worth a write: the
       // record is updated in memory, and reported as needing a save only once it moves by an hour.
       if (keepSource === prev.source && keepSeen - (prev.lastSeen ?? 0) < REFRESH_GRANULARITY_MS) return 'unchanged';
       return 'refreshed';
     }
     // A different token: only a source at least as strong may replace it, and gossip must also be newer.
-    if ((SOURCE_RANK[source] ?? 0) < (SOURCE_RANK[prev.source] ?? 0)) return 'ignored';
+    if (rankOf(source) < rankOf(prev.source)) return 'ignored';
     if (source === 'gossip' && seen <= (prev.lastSeen ?? 0)) return 'ignored';
-    this._peerWakeChannels.set(nodeId, next);
+    this._set(nodeId, next);
     return 'updated';
   }
 
   /**
-   * Make room for one channel from `source`: drop the weakest-sourced channel, the oldest sighting
-   * among those, but never one from a stronger source than the newcomer's. So fabricated gossip
-   * only ever displaces other gossip.
+   * Make room for one channel from `source`: drop a channel of the weakest rank held, the one set
+   * least recently among those, but never one from a stronger source than the newcomer's. So
+   * fabricated gossip only ever displaces other gossip. O(1): the head of a rank's index.
    * @private
    * @returns {boolean} whether there is room now
    */
   _evictFor(source) {
-    const rank = SOURCE_RANK[source] ?? 0;
-    let victim = null;
-    for (const [id, ch] of this._peerWakeChannels) {
-      const r = SOURCE_RANK[ch.source] ?? 0;
-      const seen = ch.lastSeen ?? 0;
-      if (!victim || r < victim.r || (r === victim.r && seen < victim.seen)) victim = { id, r, seen };
+    const rank = rankOf(source);
+    for (const r of RANKS) {
+      if (r > rank) return false;
+      const ids = this._byRank.get(r);
+      for (const id of ids.keys()) {
+        // The head, unless the index has outlived the channel (it never should): then it goes too.
+        if (rankOf(this._peerWakeChannels.get(id)?.source) === r) { this._delete(id); return true; }
+        ids.delete(id);
+      }
     }
-    if (!victim || victim.r > rank) return false;
-    this._peerWakeChannels.delete(victim.id);
-    return true;
+    return false;
   }
 
   /**
@@ -189,7 +265,7 @@ class WakeManager {
     const now = this._now();
     let dropped = 0;
     for (const [id, ch] of this._peerWakeChannels) {
-      if (now - (ch.lastSeen ?? 0) > this._ttlMs) { this._peerWakeChannels.delete(id); dropped++; }
+      if (now - (ch.lastSeen ?? 0) > this._ttlMs) { this._delete(id); dropped++; }
     }
     if (dropped > 0 && save) this.saveWakeChannels();
     return dropped;
@@ -197,24 +273,24 @@ class WakeManager {
 
   /**
    * The entries a `peer-info` frame to `excludeId` should carry: live channels only, each with the
-   * lastSeen this node holds rather than the time of sending.
+   * lastSeen this node holds rather than the time of sending, and at most `limit` of them, the most
+   * recently seen, which is as many as a receiver reads.
    * @param {string} excludeId
    * @param {(id:string) => string|undefined} nameOf
+   * @param {number} [limit=PEER_INFO_MAX]
    * @returns {Array<{nodeId:string, name:string, wakeChannel:object, lastSeen:number}>}
    */
-  gossipEntries(excludeId, nameOf = () => undefined) {
+  gossipEntries(excludeId, nameOf = () => undefined, limit = PEER_INFO_MAX) {
     this.pruneWakeChannels();
-    const out = [];
-    for (const [id, ch] of this._peerWakeChannels) {
-      if (id === excludeId) continue;
-      out.push({
-        nodeId: id,
-        name: nameOf(id) || 'unknown',
-        wakeChannel: { platform: ch.platform, token: ch.token, environment: ch.environment },
-        lastSeen: ch.lastSeen,
-      });
-    }
-    return out;
+    let held = [];
+    for (const [id, ch] of this._peerWakeChannels) if (id !== excludeId) held.push([id, ch]);
+    if (held.length > limit) held = held.sort((a, b) => (b[1].lastSeen ?? 0) - (a[1].lastSeen ?? 0)).slice(0, limit);
+    return held.map(([id, ch]) => ({
+      nodeId: id,
+      name: nameOf(id) || 'unknown',
+      wakeChannel: { platform: ch.platform, token: ch.token, environment: ch.environment },
+      lastSeen: ch.lastSeen,
+    }));
   }
 
   /**
@@ -295,10 +371,12 @@ class WakeManager {
     for (const [peerId] of this._peerWakeChannels) {
       if (!peers.has(peerId)) {
         if (pendingFrame) {
-          if (!this._pendingFrames.has(peerId)) {
-            this._pendingFrames.set(peerId, []);
-          }
-          this._pendingFrames.get(peerId).push(pendingFrame);
+          // At most PENDING_FRAMES_MAX wait per peer (the oldest go), and only for a peer with a
+          // channel: dropping the channel drops its queue (_delete).
+          let queue = this._pendingFrames.get(peerId);
+          if (!queue) { queue = []; this._pendingFrames.set(peerId, queue); }
+          queue.push(pendingFrame);
+          if (queue.length > this._maxPendingFrames) queue.splice(0, queue.length - this._maxPendingFrames);
         }
 
         this.wakeIfNeeded(peerId, reason).catch(err => {
@@ -428,4 +506,4 @@ class WakeManager {
   }
 }
 
-module.exports = { WakeManager, WAKE_CHANNEL_TTL_MS, WAKE_CHANNELS_MAX };
+module.exports = { WakeManager, WAKE_CHANNEL_TTL_MS, WAKE_CHANNELS_MAX, PEER_INFO_MAX, PENDING_FRAMES_MAX, SOURCE_RANK };
diff --git a/lib/frame-handler.js b/lib/frame-handler.js
index c02772e5..d43b2e97 100644
--- a/lib/frame-handler.js
+++ b/lib/frame-handler.js
@@ -78,8 +78,8 @@ const SEEN_CMB_TTL_MS = 7 * 24 * 60 * 60 * 1000; // 7 days
 const SEEN_CMB_MAX = 10000;
 /** A directed de-duplication key: the record key, `#`, and its assertion mark. */
 const DIRECTED_MARK = /#(asrt-|sd:|sig:)/;
-/** The most `peer-info` entries read from one frame. */
-const PEER_INFO_MAX = 256;
+/** The most `peer-info` entries read from one frame, and the most a frame this node sends carries. */
+const { PEER_INFO_MAX } = require('./core/wake');
 
 /**
  * Processes inbound peer frames for a SymNode.
@@ -103,6 +103,7 @@ class FrameHandler {
     this._cliHostMode = opts.cliHostMode || false;
     this._unsignedWarned = new Set();
     this._attDropSaid = new Map(); // `${peerId}|${reason}` -> { at, more }: a dropped attestation is said once a minute
+    this._longPeerInfoSaid = new Map(); // peerId -> when an over-long peer-info from it was last said
     // THE ADMISSION SEAM (sym-core split). Frame routing is open; the engine that judges an
     // inbound block is injectable. Stock nodes run the open §9.2 baseline; a consumer may
     // substitute its own engine with the same call contract. The post-admission observer is a
@@ -212,6 +213,10 @@ class FrameHandler {
    * @returns {void}
    */
   handle(peerId, peerName, msg) {
+    // `provenPublicKey` is what this node's own proving handshake sets once it has verified a peer's
+    // proof of its key. A peer's handshake frame cannot carry it: a peer that wrote one into its frame
+    // would be taken as having proved the key printed in the room grant it presents.
+    if (msg && msg.type === 'handshake' && 'provenPublicKey' in msg) delete msg.provenPublicKey;
     // THE DOOR (MMP §5.8.1). Admission is decided from the handshake; this consults that decision
     // on every frame that carries meaning, so a peer that speaks without ever having been judged
     // does not reach SVAF. Exempt: `handshake`, which is how a peer ASKS to be admitted — gating
@@ -1576,9 +1581,14 @@ class FrameHandler {
   _handleWakeChannel(peerId, peerName, msg) {
     if (!msg.platform) return;
     const wm = this._node._wakeManager;
-    const r = wm.learnWakeChannel(peerId, { platform: msg.platform, token: msg.token, environment: msg.environment }, { source: 'direct' });
-    if (r === 'added' || r === 'updated' || r === 'refreshed') wm.saveWakeChannels();
+    // The channel is the peer's own only if this session proved the peer holds the key bound to
+    // peerId; otherwise it is whoever claimed that nodeId at handshake, trusted no further than
+    // gossip, and never over a channel the peer gave through its own authenticated session.
+    const source = typeof this._node._peerKeyProven === 'function' && this._node._peerKeyProven(peerId) ? 'direct' : 'unproven';
+    const r = wm.learnWakeChannel(peerId, { platform: msg.platform, token: msg.token, environment: msg.environment }, { source });
+    if (r === 'added' || r === 'updated' || r === 'refreshed' || r === 'removed') wm.saveWakeChannels();
     if (r === 'added' || r === 'updated') this._node._log(`Wake channel from ${peerName}: ${msg.platform}`);
+    if (r === 'removed') this._node._log(`Wake channel from ${peerName}: turned off`);
   }
 
   /**
@@ -1625,8 +1635,16 @@ class FrameHandler {
     const wm = this._node._wakeManager;
     let learned = 0, changed = 0;
     // A room's peer list is short; a frame naming thousands of nodeIds is not one. Only the first
-    // PEER_INFO_MAX are read.
-    if (msg.peers.length > PEER_INFO_MAX) this._node._log(`Gossip from ${peerName}: ${msg.peers.length} entries, reading the first ${PEER_INFO_MAX}`);
+    // PEER_INFO_MAX are read (what this release sends at most), said once a minute per peer.
+    if (msg.peers.length > PEER_INFO_MAX) {
+      const now = Date.now();
+      if (now - (this._longPeerInfoSaid.get(peerId) ?? -Infinity) >= 60_000) {
+        this._longPeerInfoSaid.delete(peerId);
+        if (this._longPeerInfoSaid.size >= 1024) this._longPeerInfoSaid.delete(this._longPeerInfoSaid.keys().next().value);
+        this._longPeerInfoSaid.set(peerId, now);
+        this._node._log(`Gossip from ${peerName}: ${msg.peers.length} entries, reading the first ${PEER_INFO_MAX}`);
+      }
+    }
     for (const p of msg.peers.slice(0, PEER_INFO_MAX)) {
       if (!p || !p.nodeId || !p.wakeChannel || p.nodeId === this._node._identity.nodeId) continue;
       const r = wm.learnWakeChannel(p.nodeId, p.wakeChannel, { source: 'gossip', lastSeen: p.lastSeen });
diff --git a/lib/node.js b/lib/node.js
index 7e9a134d..9c2f4093 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -1767,6 +1767,8 @@ class SymNode extends EventEmitter {
       this._connectToPeer(address, port, peerId, peerName);
     });
     this._discovery.on('inbound-connection', (transport, peerId, peerName, handshakeMsg) => {
+      // Only this node's own proving handshake may set `provenPublicKey`; a peer cannot claim it.
+      if (handshakeMsg && 'provenPublicKey' in handshakeMsg) delete handshakeMsg.provenPublicKey;
       // Section 5.2 + 4.6 + dual-dial dedup. Three cases when an existing
       // bonjour transport is registered for this peerId:
       //
@@ -3163,6 +3165,17 @@ class SymNode extends EventEmitter {
     };
   }
 
+  /**
+   * Whether the session speaking for `peerId` proved it holds the key bound to that id. No handshake
+   * in this runtime proves a key (the proving flow, lib/core/handshake-v2.js, is not wired; see
+   * _roomAdmissionDecide), so this is false for every peer until it is, and a peer's own frames are
+   * trusted no further than an unproven claim. The one place to change when proving lands.
+   * @returns {boolean}
+   */
+  _peerKeyProven(peerId) { // eslint-disable-line no-unused-vars
+    return false;
+  }
+
   _roomAdmission(peerId, handshakeMsg) {
     // Called through the prototype, not through `this`: both this suite and the stage-2 suite
     // exercise the decision against a minimal receiver object rather than a live SymNode, and
diff --git a/lib/relay.js b/lib/relay.js
index 3b5da25a..7c37529d 100644
--- a/lib/relay.js
+++ b/lib/relay.js
@@ -11,6 +11,7 @@
 
 const { RelayPeerTransport } = require('./transport');
 const { MAX_FRAME_SIZE } = require('./frame-parser');
+const { PEER_INFO_MAX } = require('./core/wake');
 const RELAY_ENVELOPE_ALLOWANCE = 4096;
 const ENGINE_VERSION = require('../package.json').version;
 class RelayConnection {
@@ -67,7 +68,9 @@ class RelayConnection {
     this._nodeName = opts.nodeName;
     this._peerWakeChannels = opts.peerWakeChannels;
     this._saveWakeChannels = opts.saveWakeChannels;
-    this._learnWakeChannel = opts.learnWakeChannel;
+    // Optional: a relay leg built without a wake manager learns no channels (and does not throw in
+    // the WebSocket handler for a peer list that carries some).
+    this._learnWakeChannel = typeof opts.learnWakeChannel === 'function' ? opts.learnWakeChannel : () => 'ignored';
     this._identityCollision = false;
 
     this._relayWs = null;
@@ -188,11 +191,17 @@ class RelayConnection {
     this._attempts = 0;
     this._setPhase('connected');
     let learned = 0, changed = 0;
-    for (const p of (msg.peers || [])) {
-      if (p.wakeChannel && p.wakeChannel.platform !== 'none') {
+    // A room's peer list is short. Like a peer's peer-info, the relay's is read for its first
+    // PEER_INFO_MAX entries: a longer one (a faulty or compromised relay) cannot keep the event loop.
+    const peers = Array.isArray(msg.peers) ? msg.peers : [];
+    if (peers.length > PEER_INFO_MAX) this._log(`Relay peer list of ${peers.length} entries: reading the first ${PEER_INFO_MAX}`);
+    for (const p of peers.slice(0, PEER_INFO_MAX)) {
+      if (!p || !p.nodeId) continue;
+      if (p.wakeChannel) {
+        // 'none' is the peer's own registration turning its channel off.
         const r = this._learnWakeChannel(p.nodeId, p.wakeChannel, { source: 'relay', lastSeen: p.lastSeen });
         if (r === 'added' || r === 'updated') learned++;
-        if (r === 'added' || r === 'updated' || r === 'refreshed') changed++;
+        if (r === 'added' || r === 'updated' || r === 'refreshed' || r === 'removed') changed++;
       }
       if (!p.offline) {
         this._handleRelayPeerJoined(p.nodeId, p.name);
diff --git a/tests/wake-channels.test.js b/tests/wake-channels.test.js
index 69b8dd24..fbbba08c 100644
--- a/tests/wake-channels.test.js
+++ b/tests/wake-channels.test.js
@@ -50,8 +50,9 @@ describe('peer-info gossip', () => {
     });
   });
 
-  it('never replaces a token the phone gave us itself', () => {
+  it('never replaces a token the phone gave us itself over a session that proved its key', () => {
     withNode((node) => {
+      node._peerKeyProven = (id) => id === 'phone-1';
       node._frameHandler._handleWakeChannel('phone-1', 'melotune', apns('own-token'));
       node._frameHandler._handlePeerInfo('peer-x', 'mallory', { peers: [{ nodeId: 'phone-1', wakeChannel: apns('attacker'), lastSeen: Date.now() }] });
       assert.strictEqual(node._peerWakeChannels.get('phone-1').token, 'own-token');
@@ -207,3 +208,184 @@ describe('0.14.0 review F2/F3', () => {
     });
   });
 });
+
+// 0.14.0 release review, part B (F2-F4, F7, F8, F10, F12).
+describe('0.14.0 release review B: who may set a wake channel', () => {
+  it("a wake-channel frame from a session that proved nothing is trusted as gossip, never over the phone's own (F2)", () => {
+    withNode((node) => {
+      const wm = node._wakeManager;
+      // The phone registered its channel through the relay (its own authenticated session).
+      wm.learnWakeChannel('phone-1', apns('phones-own'), { source: 'relay' });
+      // Mallory handshakes claiming the phone's nodeId and sends its own token.
+      node._frameHandler.handle('phone-1', 'mallory', { type: 'wake-channel', platform: 'apns', token: 'MALLORY', environment: 'sandbox' });
+      assert.strictEqual(node._peerWakeChannels.get('phone-1').token, 'phones-own', 'an unproven claim cannot repoint it');
+      // A channel only an unproven frame gave is held at the lowest rank: it repoints nothing above it.
+      node._frameHandler.handle('phone-2', 'phone-2', { type: 'wake-channel', platform: 'apns', token: 'p2', environment: 'sandbox' });
+      assert.strictEqual(node._peerWakeChannels.get('phone-2').source, 'unproven');
+      // A session that proved the key is the peer itself: top rank.
+      node._peerKeyProven = (id) => id === 'phone-1';
+      node._frameHandler.handle('phone-1', 'phone-1', { type: 'wake-channel', platform: 'apns', token: 'rotated', environment: 'sandbox' });
+      assert.deepStrictEqual([node._peerWakeChannels.get('phone-1').token, node._peerWakeChannels.get('phone-1').source], ['rotated', 'direct']);
+    });
+  });
+
+  it('this runtime proves no peer key at handshake, and a handshake cannot claim it did', () => {
+    withNode((node) => {
+      assert.strictEqual(node._peerKeyProven('anyone'), false);
+      const msg = { type: 'handshake', nodeId: 'x', name: 'x', publicKey: 'k', provenPublicKey: 'k' };
+      let seen = null;
+      node._roomAdmission = (peerId, m) => { seen = { ...m }; return { admit: true }; };
+      node._frameHandler.handle('x', 'x', msg);
+      assert.ok(seen, 'the admission check ran');
+      assert.strictEqual('provenPublicKey' in seen, false, 'a peer-supplied proof claim never reaches it');
+    });
+  });
+
+  it("a peer turns its own channel off with platform 'none'; gossip cannot turn off anyone's (F3)", () => {
+    withNode((node, io) => {
+      const wm = node._wakeManager;
+      node._frameHandler.handle('phone-1', 'phone-1', { type: 'wake-channel', platform: 'apns', token: 't1', environment: 'sandbox' });
+      wm.learnWakeChannel('phone-2', apns('t2'), { source: 'relay' });
+      const before = io.writes();
+      node._frameHandler.handle('peer-x', 'mallory', { type: 'peer-info', peers: [{ nodeId: 'phone-1', wakeChannel: { platform: 'none' }, lastSeen: Date.now() }] });
+      assert.ok(node._peerWakeChannels.has('phone-1'), 'gossip cannot turn it off');
+      node._frameHandler.handle('phone-1', 'phone-1', { type: 'wake-channel', platform: 'none' });
+      assert.strictEqual(node._peerWakeChannels.has('phone-1'), false, 'the peer turned its own channel off');
+      assert.strictEqual(io.writes(), before + 1, 'and it was saved');
+      // Not one held at a stronger rank than the frame: that takes the relay or a proven session.
+      node._frameHandler.handle('phone-2', 'phone-2', { type: 'wake-channel', platform: 'none' });
+      assert.ok(node._peerWakeChannels.has('phone-2'));
+      node._relay._setPhase = () => {};
+      node._relay._handleRelayPeers({ peers: [{ nodeId: 'phone-2', wakeChannel: { platform: 'none' }, offline: true }] });
+      assert.strictEqual(node._peerWakeChannels.has('phone-2'), false, "the relay's registration turned it off");
+      wm.loadWakeChannels();
+      assert.strictEqual(node._peerWakeChannels.size, 0, 'and neither comes back from the file');
+    });
+  });
+});
+
+describe('0.14.0 release review B: every store and list is bounded', () => {
+  const file = (wm, data) => { fs.mkdirSync(require('path').dirname(wm._wakeChannelsFile), { recursive: true }); fs.writeFileSync(wm._wakeChannelsFile, JSON.stringify(data)); };
+
+  it('the cap holds for what is loaded from disk, and invalid entries are not loaded (F4)', () => {
+    withNode((node) => {
+      const wm = node._wakeManager;
+      const data = {};
+      for (let i = 0; i < 3000; i++) data[`gossiped-${i}`] = apns(`t${i}`);   // a 0.13.x file: no source, no lastSeen
+      data['x'.repeat(5000)] = apns('long-id');
+      data['bad-token'] = apns('a/../b?c');
+      data['huge-token'] = apns('t'.repeat(5000));
+      file(wm, data);
+      node._peerWakeChannels.clear();
+      wm.loadWakeChannels();
+      assert.strictEqual(node._peerWakeChannels.size, 1024, 'at most the cap');
+      for (const k of ['x'.repeat(5000), 'bad-token', 'huge-token']) assert.strictEqual(node._peerWakeChannels.has(k), false, `${k.slice(0, 12)} is not a channel`);
+      assert.strictEqual(Object.keys(JSON.parse(fs.readFileSync(wm._wakeChannelsFile, 'utf8'))).length, 1024, 'and the file is held to it');
+    });
+  });
+
+  it('a learned channel is a short, single-segment token too', () => {
+    withNode((node) => {
+      const wm = node._wakeManager;
+      for (const token of ['a/b', 'a?b', '', 't'.repeat(600), 42]) {
+        assert.strictEqual(wm.learnWakeChannel('p', { platform: 'apns', token }, { source: 'relay' }), 'ignored', String(token).slice(0, 10));
+      }
+      assert.strictEqual(wm.learnWakeChannel('n'.repeat(200), apns('t'), { source: 'relay' }), 'ignored');
+      assert.strictEqual(node._peerWakeChannels.size, 0);
+    });
+  });
+
+  it("the one grace given a channel saved before 0.14.0 is written down at once, so a restart does not renew it (F10)", () => {
+    withNode((node) => {
+      const wm = node._wakeManager;
+      file(wm, { 'old-phone': apns('legacy') });
+      node._peerWakeChannels.clear();
+      const loadedAt = Date.now();
+      wm._now = () => loadedAt;
+      wm.loadWakeChannels();   // nothing expires: before, nothing was written
+      node._peerWakeChannels.clear();
+      wm._now = () => loadedAt + WAKE_CHANNEL_TTL_MS + DAY;
+      wm.loadWakeChannels();
+      assert.strictEqual(node._peerWakeChannels.has('old-phone'), false, 'the grace ended');
+    });
+  });
+
+  it('a peer-info frame this node sends carries at most what a receiver reads, the most recently seen (F7)', () => {
+    withNode((node, io) => {
+      const wm = node._wakeManager;
+      const now = Date.now();
+      for (let i = 0; i < 300; i++) wm.learnWakeChannel(`p${i}`, apns(`t${i}`), { source: 'gossip', lastSeen: now - (300 - i) * 1000 });
+      const out = wm.gossipEntries('peer-x');
+      assert.strictEqual(out.length, 256);
+      assert.ok(out.every((e) => Number(e.nodeId.slice(1)) >= 44), 'the 256 most recently seen');
+      // A receiver reading a longer frame (from an older sender) says so once a minute, not per frame.
+      const long = { type: 'peer-info', peers: Array.from({ length: 300 }, (_, i) => ({ nodeId: `q${i}`, wakeChannel: apns('t'), lastSeen: now })) };
+      for (let i = 0; i < 20; i++) node._frameHandler.handle('peer-y', 'old-sender', long);
+      assert.strictEqual(io.lines.filter((l) => /entries, reading the first/.test(l)).length, 1);
+    });
+  });
+
+  it("the relay's peer list is read for its first 256 entries, and room is made without scanning the map (F12)", () => {
+    withNode((node) => {
+      const wm = node._wakeManager;
+      node._relay._setPhase = () => {};
+      node._relay._log = () => {};
+      let joined = 0;
+      node._relay._handleRelayPeerJoined = () => { joined++; };
+      const peers = Array.from({ length: 200000 }, (_, i) => ({ nodeId: `r${i}`, wakeChannel: apns(`t${i}`) }));
+      // Count steps over the channel map: making room must not walk it.
+      let steps = 0;
+      const map = node._peerWakeChannels;
+      for (const m of ['entries', 'keys', 'values', Symbol.iterator]) {
+        const real = map[m].bind(map);
+        map[m] = (...a) => { const it = real(...a); return { next: () => { steps++; return it.next(); }, [Symbol.iterator]() { return this; } }; };
+      }
+      wm._maxChannels = 100;
+      let saves = 0;
+      node._relay._saveWakeChannels = () => { saves++; };   // the one save per list serialises the map; counted apart
+      node._relay._handleRelayPeers({ peers });
+      assert.strictEqual(joined, 256, 'the first 256 entries');
+      assert.strictEqual(node._peerWakeChannels.size, 100, 'at the cap');
+      assert.strictEqual(steps, 0, 'and making room for 156 of them walked nothing');
+      assert.strictEqual(saves, 1);
+      assert.ok(node._peerWakeChannels.has('r255') && !node._peerWakeChannels.has('r0'), 'the least recently set went first');
+    });
+  });
+
+  it('the eviction index holds exactly the channels held, through removals and expiry', () => {
+    withNode((node) => {
+      const wm = node._wakeManager;
+      const indexed = () => [...wm._byRank.values()].reduce((n, m) => n + m.size, 0);
+      let t = Date.now();
+      wm._now = () => t;
+      for (let i = 0; i < 100; i++) wm.learnWakeChannel(`p${i}`, apns(`t${i}`), { source: i % 2 ? 'relay' : 'gossip', lastSeen: t });
+      for (let i = 0; i < 10; i++) wm.learnWakeChannel(`p${i}`, { platform: 'none' }, { source: 'relay' });
+      assert.strictEqual(indexed(), node._peerWakeChannels.size);
+      t += WAKE_CHANNEL_TTL_MS + DAY;
+      wm.pruneWakeChannels();
+      assert.deepStrictEqual([node._peerWakeChannels.size, indexed()], [0, 0]);
+    });
+  });
+
+  it('frames waiting for a sleeping peer are bounded, and go with its channel', () => {
+    withNode((node) => {
+      const wm = node._wakeManager;
+      wm.wakeIfNeeded = async () => false;
+      wm.learnWakeChannel('sleeper', apns('t'), { source: 'relay' });
+      for (let i = 0; i < 500; i++) wm.wakeSleepingPeers('message', { type: 'message', n: i });
+      const q = node._pendingFrames.get('sleeper');
+      assert.strictEqual(q.length, 64);
+      assert.strictEqual(q[0].n, 436, 'the newest are kept');
+      wm.learnWakeChannel('sleeper', { platform: 'none' }, { source: 'relay' });
+      assert.strictEqual(node._pendingFrames.has('sleeper'), false);
+    });
+  });
+
+  it('a relay leg built without a wake manager does not throw on a peer list with channels (F8)', () => {
+    const { RelayConnection } = require('../lib/relay');
+    const relay = new RelayConnection({ relayUrl: 'ws://127.0.0.1:1', token: 'x'.repeat(32), getIdentity: () => ({ nodeId: 'me' }), getPeers: () => new Map(), createPeer: () => ({}), addPeer: () => {}, log: () => {}, nodeName: 'n', peerWakeChannels: new Map(), saveWakeChannels: () => {} });
+    relay._setPhase = () => {};
+    relay._handleRelayPeerJoined = () => {};
+    assert.doesNotThrow(() => relay._handleRelayPeers({ peers: [{ nodeId: 'p', wakeChannel: apns('t'), offline: true }] }));
+  });
+});

From 889368d17c795fdd97f380e3ee945dc6e7ac976e Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Fri, 2 Oct 2026 03:55:17 +0100
Subject: [PATCH 067/148] 0.14.0 review B: a failure after the neural gate
 decided no longer re-gates the frame

F5: the neural path awaits the tether, which encodes with the model and can
fail, and the gate's one .catch took any failure for the evaluator's and ran
the heuristic gate on the same frame, after the neural path had recorded its
decision and signed and gossiped an attestation. Only the evaluator's own
failure falls back now; a later failure is contained and logged, and a
tether the encoder cannot evaluate leaves the record stored unverified.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 CHANGELOG.md                        |  5 ++
 lib/frame-handler.js                | 53 ++++++++++++------
 tests/neural-after-decision.test.js | 83 +++++++++++++++++++++++++++++
 3 files changed, 126 insertions(+), 15 deletions(-)
 create mode 100644 tests/neural-after-decision.test.js

diff --git a/CHANGELOG.md b/CHANGELOG.md
index bdfbc1d0..f56b8419 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -154,6 +154,11 @@ debt, and the daemon's log flood. Every item has a test that fails without its f
   would then store as its own.
 - The semantic encoder no longer starts a second model load while the first is loading.
   `semanticSettled()` resolves when it is ready or has failed.
+- **A failure after the neural gate decided re-ran the frame through the heuristic gate.** A failure
+  in the tether encode or the store write landed in the evaluator's fallback. One frame was then
+  decided twice, and two attestations were signed and gossiped for it. Now only the evaluator's own
+  failure falls back. A later failure is logged and the frame is not gated again, and a tether the
+  encoder cannot evaluate leaves the record stored unverified.
 
 ### Fixed — the attestation logs
 
diff --git a/lib/frame-handler.js b/lib/frame-handler.js
index d43b2e97..17d68e4e 100644
--- a/lib/frame-handler.js
+++ b/lib/frame-handler.js
@@ -1052,20 +1052,36 @@ class FrameHandler {
     const anchorTexts = recentEntries.map(e => ({ text: e.content, source: e.source, tags: e.tags || [] }));
 
     // Try neural SVAF first (Layer 4 cognition). The chain is returned so the caller knows when this
-    // frame is finished with (the in-flight de-dup mark is released then).
-    return this._node._svafEvaluator.evaluate(
-      { text: msg.content, source: msg.source || peerName, tags: msg.tags || [], confidence: msg.confidence || 0.8 },
-      anchorTexts,
-      ageSeconds,
-    ).then((neuralResult) => {
-      if (neuralResult) {
-        return this._processNeuralSVAF(neuralResult, msg, peerName, peerId, originTs, now);
-      }
-      return this._runHeuristicSVAFContained(msg, peerName, peerId, originTs, now, ageSeconds);
-    }).catch((err) => {
-      this._node._log(`SVAF neural error: ${err.message} — falling back to heuristic`);
-      return this._runHeuristicSVAFContained(msg, peerName, peerId, originTs, now, ageSeconds);
-    });
+    // frame is finished with (the in-flight de-dup mark is released then). Only the evaluator's own
+    // failure falls back to the heuristic gate. Once the neural gate has decided, recorded and attested,
+    // a later failure is contained in that path: running the heuristic gate as well signed and gossiped
+    // a second attestation for one frame.
+    return Promise.resolve()
+      .then(() => this._node._svafEvaluator.evaluate(
+        { text: msg.content, source: msg.source || peerName, tags: msg.tags || [], confidence: msg.confidence || 0.8 },
+        anchorTexts,
+        ageSeconds,
+      ))
+      .then(
+        (neuralResult) => (neuralResult
+          ? this._runNeuralSVAFContained(neuralResult, msg, peerName, peerId, originTs, now)
+          : this._runHeuristicSVAFContained(msg, peerName, peerId, originTs, now, ageSeconds)),
+        (err) => {
+          this._node._log(`SVAF neural error: ${err.message} — falling back to heuristic`);
+          return this._runHeuristicSVAFContained(msg, peerName, peerId, originTs, now, ageSeconds);
+        },
+      );
+  }
+
+  /**
+   * Run the neural path with its own failure contained: by then the frame has been decided (and
+   * attested), so a failure is logged and the frame is not gated again.
+   * @private
+   */
+  _runNeuralSVAFContained(result, msg, peerName, peerId, originTs, now) {
+    return Promise.resolve()
+      .then(() => this._processNeuralSVAF(result, msg, peerName, peerId, originTs, now))
+      .catch((err) => this._node._log(`SVAF neural: the frame from ${peerName} failed after its decision: ${err.message} — not gated again`));
   }
 
   /**
@@ -1185,7 +1201,14 @@ class FrameHandler {
     if (fusedEntry.cmb) {
       // The copy carries no attestation the sender attached: that one was an input, checked in
       // _prepareLineageTether. The record this node stores carries its own evaluation or none.
-      const tether = await tetherOfRecord(fusedEntry.cmb.categories, tetherAnchor, this._admissionPolicy());
+      // A tether that cannot be evaluated (the encoder failed) leaves the record unverified: stored,
+      // as it was admitted, with no tether verdict.
+      let tether = null;
+      try {
+        tether = await tetherOfRecord(fusedEntry.cmb.categories, tetherAnchor, this._admissionPolicy());
+      } catch (err) {
+        this._node._log(`§15.8 tether of a record from ${peerName} not evaluated: ${err.message} — stored unverified`);
+      }
       severLineage = this._applyLineageTether(fusedEntry, tether, now);
     }
     // The admitted-path surface is the store's own cmb-accepted emit. The store returns null when
diff --git a/tests/neural-after-decision.test.js b/tests/neural-after-decision.test.js
new file mode 100644
index 00000000..84c3c2cb
--- /dev/null
+++ b/tests/neural-after-decision.test.js
@@ -0,0 +1,83 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME to a temp sandbox before lib/config loads
+
+/**
+ * 0.14.0 release review B-F5: the neural admission path awaits the §15.8 tether, which encodes with
+ * the model and can fail. The gate's one `.catch` took any failure for an evaluator failure and ran
+ * the heuristic gate on the same frame, after the neural path had already recorded its decision and
+ * signed and gossiped an attestation: one frame, decided and attested twice. Now only the evaluator's
+ * own failure falls back; a later one is contained, and a tether that cannot be evaluated leaves the
+ * record stored unverified.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const { SymNode } = require('../lib/node');
+const { NullDiscovery } = require('../lib/discovery');
+const { nodeDir } = require('../lib/config');
+const { createCMB } = require('../lib/core');
+
+const ALIGNED = { decision: 'aligned', total_drift: 0.1, category_drifts: { focus: 0.1 }, gate_values: { focus: 1 } };
+const cat7 = (t) => ({ focus: t, issue: t, intent: t, motivation: t, commitment: t, perspective: 'peerA', mood: { text: 'neutral', valence: 0, arousal: 0 } });
+
+async function withNode(fn) {
+  const name = `neural-after-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+  const node = new SymNode({ name, silent: true, discovery: new NullDiscovery(), svafEvaluator: { evaluate: async () => ALIGNED } });
+  await node.start();
+  const fh = node._frameHandler;
+  const seen = { heuristic: 0, decisions: 0, logs: [] };
+  const heuristic = fh._processHeuristicSVAF.bind(fh);
+  fh._processHeuristicSVAF = (...a) => { seen.heuristic++; return heuristic(...a); };
+  const record = node._recordDecision.bind(node);
+  node._recordDecision = (d) => { seen.decisions++; return record(d); };
+  node._log = (m) => seen.logs.push(m);
+  try { return await fn(node, seen); } finally {
+    await node.stop();
+    fs.rmSync(nodeDir(name), { recursive: true, force: true });
+  }
+}
+
+const frame = (text) => { const cmb = createCMB({ categories: cat7(text), createdBy: 'peerA' }); return { type: 'cmb', timestamp: Date.now(), content: text, cmb }; };
+
+describe('the neural path after its decision', () => {
+  it('a tether that cannot be evaluated leaves the record stored unverified, decided and attested once', async () => {
+    await withNode(async (node, seen) => {
+      // A lineage anchor whose categories cannot be read: what a model fault during the encode does.
+      const broken = new Proxy({}, { get() { throw new Error('encoder fault'); }, ownKeys() { throw new Error('encoder fault'); } });
+      node._frameHandler._prepareLineageTether = () => ({ key: 'anchor-key', categories: broken });
+      const f = frame('a remix whose tether the model cannot encode');
+      await node._frameHandler._handleMemoryShare('peerA', 'peerA', f);
+      const key = f.cmb.metadata.key;
+      assert.strictEqual(seen.heuristic, 0, 'the heuristic gate did not run on the frame as well');
+      assert.strictEqual(seen.decisions, 1, 'one decision');
+      assert.strictEqual(node._attestations.byCmb(key).length, 1, 'one attestation for the frame');
+      const stored = node._store.get(key);
+      assert.ok(stored, 'the admitted record is stored');
+      assert.strictEqual(stored.tether ?? null, null, 'with no tether verdict: unverified');
+      assert.ok(seen.logs.some((l) => /tether of a record from peerA not evaluated: encoder fault/.test(l)));
+    });
+  });
+
+  it('any other failure after the decision is contained: logged, and the frame is not gated again', async () => {
+    await withNode(async (node, seen) => {
+      node._store.receiveFromPeer = () => { throw new Error('disk full'); };
+      const f = frame('an admitted record the store cannot write');
+      await node._frameHandler._handleMemoryShare('peerA', 'peerA', f);
+      assert.strictEqual(seen.heuristic, 0, 'not gated again');
+      assert.strictEqual(seen.decisions, 1);
+      assert.strictEqual(node._attestations.byCmb(f.cmb.metadata.key).length, 1, 'attested once');
+      assert.ok(seen.logs.some((l) => /failed after its decision: disk full — not gated again/.test(l)), seen.logs.join('\n'));
+    });
+  });
+
+  it("the evaluator's own failure still falls back to the heuristic gate", async () => {
+    await withNode(async (node, seen) => {
+      node._svafEvaluator = { evaluate: async () => { throw new Error('model not loaded'); } };
+      await node._frameHandler._handleMemoryShare('peerA', 'peerA', frame('a record the neural evaluator cannot judge'));
+      assert.strictEqual(seen.heuristic, 1);
+      assert.ok(seen.logs.some((l) => /SVAF neural error: model not loaded — falling back to heuristic/.test(l)));
+    });
+  });
+});

From 0be2a1814c87cd2341f4d606e8372a5012cdd72d Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Fri, 2 Oct 2026 03:55:17 +0100
Subject: [PATCH 068/148] 0.14.0 review B: MeshAgent, llm-reason and the
 loopback registry use the state root

F11: MeshAgent (at load and when an agent is built) and llm-reason read
~/.sym/relay.env, and LAN discovery kept its loopback registry in
~/.sym/loopback, so a deployment rooted with SYM_STATE_DIR read another
root's relay credentials and met other roots' nodes over 127.0.0.1. All four
go through symPath now.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 CHANGELOG.md                     |  2 ++
 lib/discovery.js                 |  5 +--
 lib/llm-reason.js                |  3 +-
 lib/mesh-agent.js                |  5 ++-
 tests/state-root-readers.test.js | 55 ++++++++++++++++++++++++++++++++
 5 files changed, 63 insertions(+), 7 deletions(-)
 create mode 100644 tests/state-root-readers.test.js

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f56b8419..57485c16 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -269,6 +269,8 @@ debt, and the daemon's log flood. Every item has a test that fails without its f
 - **A daemon rooted with `SYM_STATE_DIR` kept its room, tasks and relay.env in `~/.sym`.** It uses
   the state root now, and so does the `sym` CLI: its pid file, room, relay.env and node directory.
   Two rooted deployments sharing a home shared one pid file, so `sym stop` for one stopped the other.
+  `MeshAgent` and `llm-reason` read `relay.env` from the state root too, and LAN discovery keeps its
+  loopback registry there, so a rooted deployment meets only its own root's nodes over 127.0.0.1.
 - **A second daemon start took the socket from the one serving it.** The daemon removed any socket
   file at start, assuming it stale, so a second start unlinked a live daemon's socket; that daemon
   ran on, reachable by no client, and every client reported "sym-daemon not running".
diff --git a/lib/discovery.js b/lib/discovery.js
index 36ab5bae..5e67e785 100644
--- a/lib/discovery.js
+++ b/lib/discovery.js
@@ -17,7 +17,6 @@
 
 const net = require('net');
 const fs = require('fs');
-const os = require('os');
 const path = require('path');
 const { EventEmitter } = require('events');
 const { TcpTransport } = require('./transport');
@@ -443,7 +442,9 @@ class BonjourDiscovery extends Discovery {
   // also fills in when mDNS is flaky. See MMP §5 (Connection, Layer 2).
 
   _loopbackDir() {
-    return path.join(os.homedir(), '.sym', 'loopback');
+    // Under the state root, like every other file the engine keeps: a rooted deployment meets only
+    // the nodes of its own root over 127.0.0.1.
+    return require('./core/state-root').symPath('loopback');
   }
 
   _startLoopbackRegistry() {
diff --git a/lib/llm-reason.js b/lib/llm-reason.js
index 759239f8..b5fdb7ee 100644
--- a/lib/llm-reason.js
+++ b/lib/llm-reason.js
@@ -148,8 +148,7 @@ function ensureEnv() {
   if (_envLoaded) return;
   _envLoaded = true;
   if (process.env.SYM_LLM_API_KEY) return;
-  const os = require('os');
-  const envFile = path.join(os.homedir(), '.sym', 'relay.env');
+  const envFile = require('./core/state-root').symPath('relay.env');
   if (!fs.existsSync(envFile)) return;
   for (const line of fs.readFileSync(envFile, 'utf8').split('\n')) {
     const m = line.match(/^(\w+)=(.*)$/);
diff --git a/lib/mesh-agent.js b/lib/mesh-agent.js
index f3003223..148cf20d 100644
--- a/lib/mesh-agent.js
+++ b/lib/mesh-agent.js
@@ -32,7 +32,6 @@ const { recordCreatedBy, recordLineage } = require('./record');
  */
 
 const fs = require('fs');
-const os = require('os');
 const path = require('path');
 const { SymNode } = require('./node');
 
@@ -43,7 +42,7 @@ const { SymNode } = require('./node');
 // agents read them at the top of agent.js — before MeshAgent ctor.
 (function loadRelayEnv() {
   if (process.env.SYM_RELAY_URL) return;
-  const envFile = path.join(os.homedir(), '.sym', 'relay.env');
+  const envFile = require('./core/state-root').symPath('relay.env');
   if (!fs.existsSync(envFile)) return;
   for (const line of fs.readFileSync(envFile, 'utf8').split('\n')) {
     const m = line.match(/^(\w+)=(.*)$/);
@@ -160,7 +159,7 @@ class MeshAgent {
     // Load relay config from ~/.sym/relay.env if env vars not set
     // Same pattern as sym-daemon — agents are full peers and need relay
     if (!process.env.SYM_RELAY_URL) {
-      const envFile = path.join(os.homedir(), '.sym', 'relay.env');
+      const envFile = require('./core/state-root').symPath('relay.env');
       if (fs.existsSync(envFile)) {
         for (const line of fs.readFileSync(envFile, 'utf8').split('\n')) {
           const m = line.match(/^(\w+)=(.*)$/);
diff --git a/tests/state-root-readers.test.js b/tests/state-root-readers.test.js
new file mode 100644
index 00000000..82644cb0
--- /dev/null
+++ b/tests/state-root-readers.test.js
@@ -0,0 +1,55 @@
+'use strict';
+
+/**
+ * 0.14.0 release review B-F11: the daemon and the CLI keep their room, pid file, relay.env and node
+ * directory under the state root (SYM_STATE_DIR), but MeshAgent and llm-reason still read
+ * ~/.sym/relay.env and LAN discovery still kept its loopback registry in ~/.sym/loopback. A rooted
+ * deployment read another tenant's relay credentials and met other roots' nodes over 127.0.0.1.
+ *
+ * Run in a child process with HOME and SYM_STATE_DIR pointing at two different places, each holding
+ * its own relay.env, so a reader that still derives its path from the home is caught by what it reads.
+ */
+
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const { execFileSync } = require('node:child_process');
+const fs = require('fs');
+const path = require('path');
+const { tmpdir } = require('./_tmpdir');
+
+const LIB = path.join(__dirname, '..', 'lib');
+
+test('relay.env and the loopback registry are read under the state root, not the home', () => {
+  const base = tmpdir('sym-state-readers-');
+  fs.mkdirSync(path.join(base, 'agent'));
+  const home = path.join(base, 'home');
+  const root = path.join(base, 'root');
+  fs.mkdirSync(path.join(home, '.sym'), { recursive: true });
+  fs.mkdirSync(root, { recursive: true });
+  fs.writeFileSync(path.join(home, '.sym', 'relay.env'), 'SYM_RELAY_URL=ws://the-home\nSYM_LLM_API_KEY=from-the-home\n');
+  fs.writeFileSync(path.join(root, 'relay.env'), 'SYM_RELAY_URL=ws://the-root\nSYM_LLM_API_KEY=from-the-root\n');
+  const env = { ...process.env, HOME: home, USERPROFILE: home, SYM_STATE_DIR: root };
+  for (const k of ['SYM_RELAY_URL', 'SYM_RELAY_TOKEN', 'SYM_LLM_API_KEY', 'NODE_TEST_CONTEXT']) delete env[k];
+  const probe = `
+    const lib = ${JSON.stringify(LIB)};
+    const { MeshAgent } = require(lib + '/mesh-agent');
+    const relay = process.env.SYM_RELAY_URL;           // read when the module loads
+    delete process.env.SYM_RELAY_URL;
+    const agent = new MeshAgent({ name: 'probe', agentDir: ${JSON.stringify(path.join(base, 'agent'))}, fetchDomain: async () => [], reason: async () => null, remix: async () => null });
+    const relayAtStart = process.env.SYM_RELAY_URL;    // and again when an agent is built
+    try { agent.node._releaseIdentityLock?.(); } catch {}
+    delete process.env.SYM_LLM_API_KEY;
+    try { require(lib + '/llm-reason').getProviderConfig({}); } catch {}
+    const llm = process.env.SYM_LLM_API_KEY;
+    const { BonjourDiscovery } = require(lib + '/discovery');
+    const loopback = BonjourDiscovery.prototype._loopbackDir.call({});
+    process.stdout.write('RESULT ' + JSON.stringify({ relay, relayAtStart, llm, loopback }) + String.fromCharCode(10));
+    process.exit(0);
+  `;
+  const stdout = execFileSync(process.execPath, ['-e', probe], { env, encoding: 'utf8' });
+  const out = JSON.parse(stdout.split('\n').find((l) => l.startsWith('RESULT ')).slice(7));
+  assert.equal(out.relay, 'ws://the-root', "MeshAgent reads the root's relay.env when it loads");
+  assert.equal(out.relayAtStart, 'ws://the-root', 'and when an agent is built');
+  assert.equal(out.llm, 'from-the-root', "llm-reason reads the root's relay.env");
+  assert.equal(out.loopback, path.join(root, 'loopback'), 'the loopback registry is under the root');
+});

From de5af921dc1fd6c5b471c8e318eb482438aba1c4 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Fri, 2 Oct 2026 03:55:44 +0100
Subject: [PATCH 069/148] 0.14.0 review: the audience a record signs is checked
 on every suite

_rejectOnBadSignature returned from the mmp-sig-v2.0 arm as soon as the
signature verified, before the audience check, and the older suite's
relayed arm (verified against the author's key) returned the same way.
So a record its author signed `to` another node, or for another room,
was stored, remixed and gossiped by any node that held the author's key;
the B-R10 room rule never ran for the suite this release hardens. Every
path through the signature check now ends in _audienceRefused: verified
v2.0 and relayed records, and signed two-section records whose key is
not held (their carried audience excludes this node either way, and
refusing can only drop what a relay could drop). A refusal returns
before anything is stored or surfaced, is counted on every record
(cmb-audience-rejected, with `verified`) and logged once a minute per
peer and reason with how many more there were.

Review C-F1. lib/frame-handler.js is part B's file; the hunks are the
return sites in _rejectOnBadSignature and the one new helper.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 CHANGELOG.md                    |  8 +++
 lib/frame-handler.js            | 64 +++++++++++++++++++-----
 tests/v2-author-binding.test.js | 88 ++++++++++++++++++++++++++++++++-
 3 files changed, 145 insertions(+), 15 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d928fe03..56425688 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -22,6 +22,14 @@ debt, and the daemon's log flood. Every item has a test that fails without its f
   `createdByNodeId`, so a genuine relay also verifies. A v2.0 record whose carried `assertionId`
   is not the one its preimage yields is refused (B-R6). On other suites a carried `assertionId`,
   which nothing signs, is dropped.
+- **A record signed for another room or another node was stored.** The audience check (§18.3.1)
+  ran only on the older suite's direct path: a verified v2.0 record returned before it, and so did an
+  older-suite record verified against its author on relay, so a record its author addressed to
+  another node, or signed for another room, was stored, remixed and gossiped by every node it
+  reached. Every signed record's `room` and `to` are now checked, on every path, whether or not its
+  signature could be verified here, and a record addressed elsewhere is refused before it is stored
+  or surfaced. Each refusal is counted (`cmb-audience-rejected`, with `verified`) and said once a
+  minute per peer and reason.
 - **Stripping the frame's `directed` flag turned a signed directed CMB into a broadcast (B-R8).**
   A signed addressee could only veto directed treatment. When the author signed one, it now alone
   decides.
diff --git a/lib/frame-handler.js b/lib/frame-handler.js
index c45124ae..e5ff350f 100644
--- a/lib/frame-handler.js
+++ b/lib/frame-handler.js
@@ -80,6 +80,8 @@ const SEEN_CMB_MAX = 10000;
 const DIRECTED_MARK = /#(asrt-|sd:|sig:)/;
 /** The most `peer-info` entries read from one frame. */
 const PEER_INFO_MAX = 256;
+/** A record refused for its audience is said at most once per this many ms per peer and reason. */
+const AUDIENCE_REPORT_MS = 60_000;
 
 /**
  * Processes inbound peer frames for a SymNode.
@@ -103,6 +105,7 @@ class FrameHandler {
     this._cliHostMode = opts.cliHostMode || false;
     this._unsignedWarned = new Set();
     this._attDropSaid = new Map(); // `${peerId}|${reason}` -> { at, more }: a dropped attestation is said once a minute
+    this._audienceSaid = new Map(); // `${peerId}|${reason}` -> { at, more }: a refused audience, the same way
     // THE ADMISSION SEAM (sym-core split). Frame routing is open; the engine that judges an
     // inbound block is injectable. Stock nodes run the open §9.2 baseline; a consumer may
     // substitute its own engine with the same call contract. The post-admission observer is a
@@ -510,7 +513,8 @@ class FrameHandler {
         ? this._node._identityKey(md.createdByNodeId)
         : this._node._peerIdentityKeys?.get(md.createdByNodeId);
       // No key for the author yet is key-distribution latency, not forgery: unverified, as for v1.
-      if (!authorKey) { msg._cmbVerified = false; return false; }
+      // Its audience is still the one it carries (see _audienceRefused).
+      if (!authorKey) { msg._cmbVerified = false; return this._audienceRefused(peerId, peerName, cmb, false); }
       const v2 = verifyCMB(cmb, authorKey);
       // A record that declares the v2.0 suite but is malformed for it (no room, no key, …) has no
       // preimage: assertionIdV2_0 throws. That is a mismatch to reject, never an exception: on the
@@ -518,7 +522,13 @@ class FrameHandler {
       let derivedId = null;
       try { derivedId = assertionIdV2_0(cmb); } catch { /* not a well-formed v2.0 record */ }
       const idOk = md.assertionId === undefined || md.assertionId === derivedId;
-      if (v2.valid && idOk) { msg._cmbVerified = true; msg._verifiedAuthorNodeId = md.createdByNodeId; return false; }
+      // Verified is not addressed here: the audience the author signed is checked next, as on every
+      // suite. Returning here skipped it, so a v2.0 record signed for another room or node was stored.
+      if (v2.valid && idOk) {
+        msg._cmbVerified = true;
+        msg._verifiedAuthorNodeId = md.createdByNodeId;
+        return this._audienceRefused(peerId, peerName, cmb, true);
+      }
       const reason = !v2.valid ? (v2.error || 'invalid') : 'assertion-id-mismatch';
       const k = recordKey(cmb);
       this._node._log(`[sym-security] v2.0 CMB ${String(k || '').slice(0, 16)} from ${peerName} rejected — ${reason} (author ${md.createdByNodeId.slice(0, 8)})`);
@@ -552,9 +562,10 @@ class FrameHandler {
 
     if (!senderKey) {
       // Signed, but this peer's identity key isn't known on this transport yet
-      // (handshake not processed). Cannot verify — do not reject; treat unverified.
+      // (handshake not processed). Cannot verify — do not reject; treat unverified. A two-section
+      // record's audience is still checked (see _audienceRefused).
       msg._cmbVerified = false;
-      return false;
+      return cmb.metadata ? this._audienceRefused(peerId, peerName, cmb, false) : false;
     }
 
     // §7.8 GRANDFATHERING — a pre-boundary block is UNATTESTED, not FORGED (P-6).
@@ -602,13 +613,13 @@ class FrameHandler {
           : this._node._peerIdentityKeys?.get(author);
         if (authorKey) {
           const va = verifyCMB(cmb, authorKey);
-          if (va.valid) { msg._cmbVerified = true; return false; }
+          if (va.valid) { msg._cmbVerified = true; return this._audienceRefused(peerId, peerName, cmb, true); }
           // fall through: verified against the author's own key and it is wrong — forged.
         } else {
           msg._cmbVerified = false;
           this._node._log(`[sym-security] UNVERIFIABLE CMB ${keyShort} authored by ${author}, relayed via ${peerName} — this node holds no key for the author; passing unverified${v.error ? ' (' + v.error + ')' : ''}`);
           this._node.emit('metric', { type: 'cmb-signature-unverifiable', from: peerName, author, key: cmbKeyOf(cmb), reason: v.error || 'author-key-unavailable' });
-          return false;
+          return cmb.metadata ? this._audienceRefused(peerId, peerName, cmb, false) : false;
         }
       }
       // verifyCMB distinguishes WHY it refused — 'legacy-key-rejected', 'bad-signature',
@@ -655,13 +666,7 @@ class FrameHandler {
     // Audience (§18.3.1): a genuinely-signed v1 CMB whose bound room is not this
     // node's room, or which is directed at another node, is a cross-room / mis-
     // directed replay. Reject it — reported distinctly from a bad signature.
-    const { checkAudience } = require('./core');
-    const aud = checkAudience(cmb, this._node._room, this._node.nodeId);
-    if (!aud.ok) {
-      this._node._log(`[sym-security] ${aud.reason} on CMB ${String(cmbKeyOf(cmb) || '').slice(0, 16)} from ${peerName} — rejected`);
-      this._node.emit('metric', { type: 'cmb-audience-rejected', from: peerName, key: cmbKeyOf(cmb), reason: aud.reason });
-      return true;
-    }
+    if (this._audienceRefused(peerId, peerName, cmb, !grandfathered)) return true;
 
     // Unattested is not verified. A grandfathered block is admitted and readable, but it MUST
     // NOT be marked verified — anything downstream weighing this flag is entitled to know the
@@ -670,6 +675,39 @@ class FrameHandler {
     return false;
   }
 
+  /**
+   * Whether a signed record is addressed away from this node, and so is refused before it is stored
+   * or surfaced (§18.3.1): its signed `room` is not this node's room, or its signed `to` names
+   * another node.
+   *
+   * Both suites this node verifies, mmp-sig-v2 and mmp-sig-v2.0, sign `room` and `to`, so every
+   * signed record is checked, on every path through the signature check and whether or not its
+   * signature could be checked here. A verified record's author addressed it elsewhere. An
+   * unverified one says the same or was altered, and is not for this node either way; refusing it
+   * drops only what a relay could already drop. Every refusal is counted (`cmb-audience-rejected`);
+   * the log names a peer and reason once a minute, with how many more there were.
+   * @param {boolean} verified - whether the signature was verified (said in the log and metric).
+   * @returns {boolean} true when the record must be refused.
+   * @private
+   */
+  _audienceRefused(peerId, peerName, cmb, verified) {
+    const { checkAudience } = require('./core');
+    const aud = checkAudience(cmb, this._node._room, this._node.nodeId);
+    if (aud.ok) return false;
+    const key = recordKey(cmb);
+    this._node.emit('metric', { type: 'cmb-audience-rejected', from: peerName, key, reason: aud.reason, verified: verified === true });
+    const k = `${peerId}|${aud.reason}`;
+    const now = Date.now();
+    const said = this._audienceSaid.get(k);
+    if (said && now - said.at < AUDIENCE_REPORT_MS) { said.more++; return true; }
+    this._audienceSaid.delete(k);
+    if (this._audienceSaid.size >= 1024) this._audienceSaid.delete(this._audienceSaid.keys().next().value);
+    this._audienceSaid.set(k, { at: now, more: 0 });
+    const more = said && said.more ? ` (and ${said.more} more since it was last said)` : '';
+    this._node._log(`[sym-security] ${aud.reason} on CMB ${String(key || '').slice(0, 16)} from ${peerName}${verified ? '' : ' (unverified)'} — rejected${more}`);
+    return true;
+  }
+
   /**
    * MMP §7 cmb-fetch: content-addressed retrieval. A peer asks for the CMB this
    * store holds under an exact content-address key — the §15.8 re-verification
diff --git a/tests/v2-author-binding.test.js b/tests/v2-author-binding.test.js
index 48205ef8..37b659a1 100644
--- a/tests/v2-author-binding.test.js
+++ b/tests/v2-author-binding.test.js
@@ -9,6 +9,9 @@ require('./_isolate-home'); // redirect $HOME to a temp sandbox before lib/confi
  *   itself under someone else's id, and a genuine relay verifies against the author.
  * - B-R6 (§8.8.5 step 5): a carried `assertionId` must be the one the preimage yields; on records
  *   of the older suite, where no signature covers it, a carried `assertionId` is dropped.
+ * - 0.14.0 review C-F1 (§18.3.1): the audience a record signs (`room`, `to`) is checked on every
+ *   suite. A verified v2.0 record returned before the check, so one signed for another room or node
+ *   was stored; so did an older-suite record verified against its author on relay.
  */
 
 const { describe, it } = require('node:test');
@@ -29,8 +32,8 @@ function kp() {
 }
 const ALICE = kp(), MALLORY = kp(), RELAY = kp();
 
-function v2Record({ nodeId, createdBy, signWith, focus = 'v2 observation' }) {
-  const cmb = createCMB({ categories: { focus }, createdBy, emitV2: true, createdByNodeId: nodeId, room: 'default' });
+function v2Record({ nodeId, createdBy, signWith, focus = 'v2 observation', room = 'default', to = null }) {
+  const cmb = createCMB({ categories: { focus }, createdBy, emitV2: true, createdByNodeId: nodeId, room, to });
   cmb.metadata.assertionId = assertionIdV2_0(cmb);
   signCMB(cmb, signWith.priv);
   return cmb;
@@ -147,3 +150,84 @@ describe('a malformed v2.0 frame is refused, never thrown (0.14.0 review F1)', (
     });
   });
 });
+
+describe('the audience a record signs is checked on every suite (0.14.0 review C-F1)', () => {
+  function capture(node) {
+    const metrics = [];
+    const lines = [];
+    node.on('metric', (m) => metrics.push(m));
+    node._log = (l) => lines.push(l);
+    return { metrics, lines, refused: () => metrics.filter((m) => m.type === 'cmb-audience-rejected') };
+  }
+
+  it('a verified v2.0 record addressed to another node is refused, never stored', async () => {
+    const name = `v2aud-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+    const node = new SymNode({ name, silent: true, discovery: new NullDiscovery() });
+    await node.start();
+    try {
+      node._pinPeerKey('node-alice', ALICE.pub);
+      node._pinPeerKey('node-relay', RELAY.pub);
+      node._svafEvaluator.evaluate = async () => ({ decision: 'aligned', total_drift: 0.1, category_drifts: { focus: 0.1 }, gate_values: { g: 1 } });
+      const c = capture(node);
+      const got = [];
+      node.on('cmb-accepted', (e) => got.push(e));
+      // Alice signs a record for Bob; a relay hands it to this node, which holds Alice's key.
+      const forBob = v2Record({ nodeId: 'node-alice', createdBy: 'alice', signWith: ALICE, focus: 'meant for bob only', to: 'node-bob' });
+      node._frameHandler.handle('node-relay', 'relay', { type: 'cmb', timestamp: Date.now(), cmb: forBob });
+      await settle();
+      assert.strictEqual(got.length, 0, 'not surfaced');
+      assert.strictEqual(node._store.get(forBob.metadata.key), null, 'not stored');
+      assert.deepStrictEqual(c.refused().map((m) => [m.reason, m.verified]), [['wrong-recipient', true]]);
+
+      // The same author's record for THIS node is admitted, so the refusal is the audience's.
+      const forMe = v2Record({ nodeId: 'node-alice', createdBy: 'alice', signWith: ALICE, focus: 'meant for this node', to: node.nodeId });
+      node._frameHandler.handle('node-relay', 'relay', { type: 'cmb', timestamp: Date.now(), cmb: forMe });
+      await settle();
+      assert.strictEqual(got.length, 1, 'a record addressed here is surfaced');
+    } finally { await node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+  });
+
+  it('a verified v2.0 record signed for another room is refused', () => {
+    withNode((node) => {
+      const c = capture(node);
+      const msg = { cmb: v2Record({ nodeId: 'node-alice', createdBy: 'alice', signWith: ALICE, room: 'another-room' }) };
+      assert.strictEqual(node._frameHandler._rejectOnBadSignature('node-alice', 'alice', msg), true);
+      assert.deepStrictEqual(c.refused().map((m) => m.reason), ['wrong-audience']);
+    });
+  });
+
+  it('an older-suite record verified against its author on relay is checked too', () => {
+    withNode((node) => {
+      node._pinPeerKey('alice', ALICE.pub); // the relayed arm resolves the author by its label
+      const c = capture(node);
+      const cmb = createCMB({ categories: { focus: 'older suite, for bob' }, createdBy: 'alice', room: 'default', to: 'node-bob' });
+      signCMB(cmb, ALICE.priv);
+      const msg = { cmb };
+      assert.strictEqual(node._frameHandler._rejectOnBadSignature('node-relay', 'relay', msg), true);
+      assert.strictEqual(msg._cmbVerified, true, 'precondition: it verified against its author');
+      assert.deepStrictEqual(c.refused().map((m) => m.reason), ['wrong-recipient']);
+    });
+  });
+
+  it('a record whose author key is not held is refused for its audience all the same', () => {
+    withNode((node) => {
+      const c = capture(node);
+      const stranger = kp();
+      const msg = { cmb: v2Record({ nodeId: 'node-stranger', createdBy: 'stranger', signWith: stranger, to: 'node-bob' }) };
+      assert.strictEqual(node._frameHandler._rejectOnBadSignature('node-relay', 'relay', msg), true);
+      assert.deepStrictEqual(c.refused().map((m) => [m.reason, m.verified]), [['wrong-recipient', false]]);
+    });
+  });
+
+  it('every refusal is counted, and said once a minute per peer and reason', () => {
+    withNode((node) => {
+      const c = capture(node);
+      for (let i = 0; i < 3; i++) {
+        const msg = { cmb: v2Record({ nodeId: 'node-alice', createdBy: 'alice', signWith: ALICE, focus: `for bob ${i}`, to: 'node-bob' }) };
+        assert.strictEqual(node._frameHandler._rejectOnBadSignature('node-relay', 'relay', msg), true);
+      }
+      assert.strictEqual(c.refused().length, 3);
+      assert.strictEqual(c.lines.filter((l) => /wrong-recipient/.test(l)).length, 1);
+    });
+  });
+});

From e54a4b043ab3f85f49a8d6a4faad3052e411761d Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Fri, 2 Oct 2026 03:56:48 +0100
Subject: [PATCH 070/148] 0.14.0 review: a room-less emitter is heard by the
 room that admits it

connect() and `sym emit` without --room make no room claim, and a node in
a named room admits them, but Emitter.emit minted `room: null`, which
createCMB now turns into 'default' (B-R10), so the node that had just
admitted the emitter refused every block it sent. An emitter that names
no room now authors for the room the node's handshake reply states.

The receiver relaxes nothing: a record that names no room is still in
'default' wherever it arrives, because nothing in it shows it was not
replayed from another room, and the handshake proves no key, so "sent by
its own author" cannot be shown either. A 0.13.x room-less emitter into a
0.14.0 node in another room is therefore still refused; the CHANGELOG
says so under "read these before upgrading", with the remedy.

Review C-F2.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 CHANGELOG.md                  | 10 +++++++++
 lib/emit.js                   | 18 +++++++++++++--
 tests/emit-room-claim.test.js | 41 +++++++++++++++++++++++++++++++++++
 3 files changed, 67 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 56425688..95816600 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -53,6 +53,10 @@ debt, and the daemon's log flood. Every item has a test that fails without its f
 
 ### Fixed — delivery and records
 
+- **An emitter that named no room was admitted and then not heard.** `connect()` and `sym emit`
+  without `--room` make no room claim, and a node in a named room admits them, but their records
+  named no room, which is the room `default` (B-R10), so that node refused every block. An emitter
+  that names no room now authors for the room the node's handshake reply states.
 - **Two copies of one record arriving together could both surface (K1).** A key is held in flight
   from the de-duplication check until its SVAF pass settles.
 - **A broadcast flood could evict directed de-duplication marks (K3).** They have their own map and
@@ -117,6 +121,12 @@ debt, and the daemon's log flood. Every item has a test that fails without its f
   moved on first touch. **Code outside sym that reads `entry.cmb.admission`, `.tether`,
   `.provenance` or `.collapsed`, from stored entries or from `cmb-accepted` / `memory-received`
   events, must read them from the entry.** xmesh 0.10.11 reads both places.
+- **A record that names no room is in the room `default`, from any sender.** Earlier releases read
+  it as addressed to every room. A 0.13.x `connect()` or `sym emit` without `--room` mints exactly
+  such records, so a 0.14.0 node in any other room refuses what it sends (`cmb-audience-rejected`,
+  `wrong-audience`): a receiver cannot tell a room-less record its author just sent from one
+  replayed out of another room. Upgrade the emitter, or pass `--room` (`connect({ room })`) naming
+  the node's room.
 - **SVAF anchors decay with age (§9.2.1).** The gate treated every stored anchor as fresh at full
   weight, because the anchor view carried neither the entry's age nor its weight. Anchors now carry
   both: `storedAt`, and the store's §6.4 `anchorWeight` (2.0 once validated, 0.5 once dismissed, never
diff --git a/lib/emit.js b/lib/emit.js
index 0b4d1391..db701cee 100644
--- a/lib/emit.js
+++ b/lib/emit.js
@@ -44,6 +44,11 @@ function parseServer(server) {
   return { host, port };
 }
 
+/** The room a node's handshake reply says it is in, or null when it names none. */
+function admittedRoom(peer) {
+  return peer && typeof peer.room === 'string' && peer.room ? peer.room : null;
+}
+
 /** A connected emitter session. Create via connect(); reuse for many emits. */
 class Emitter {
   constructor({ identity, transport, socket, room, name, peer }) {
@@ -75,11 +80,19 @@ class Emitter {
 
     // Audience is part of the record now, so it is passed at construction rather than stapled
     // on afterwards — `room` became `room` in the same signing-scheme change.
+    //
+    // THE ROOM A RECORD NAMES. A caller that named a room authors for it. One that named none
+    // authors for the room its handshake was admitted into, which the receiving node's reply states:
+    // the connection made no claim, the node admitted it to its own room, and that is the room this
+    // emitter is speaking in. Minting `null` there named 'default' (§7), and the node that had just
+    // admitted the emitter, in any other room, refused every block it sent. The receiver relaxes
+    // nothing for this: a record that names no room is in 'default' wherever it arrives (B-R10),
+    // because nothing in a room-less record shows it was not replayed from another room.
     const cmb = createCMB({
       categories,
       createdBy: this.name,
       lineage,
-      room: this.room ?? null,
+      room: (typeof this.room === 'string' && this.room) ? this.room : admittedRoom(this.peer),
       to: opts.to ?? null,
       // Reader-first gated: only populates the v2.0 preimage fields (and thus signs under
       // mmp-sig-v2.0) once MMP_EMIT_V2 is flipped on after reader deployment.
@@ -122,7 +135,8 @@ class Emitter {
  * Connect to a mesh endpoint and complete the §5.2 handshake.
  * @param {object} opts
  * @param {string} opts.server - "host:port" of a listening mesh node.
- * @param {string} [opts.room='default'] - the room this emitter authors for.
+ * @param {string} [opts.room] - the room this emitter claims and authors for. Omitted, it claims
+ *   none, and authors for the room the node it connects to admits it into.
  * @param {string} [opts.name='emitter'] - stable emitter identity name.
  * @param {number} [opts.timeoutMs=8000] - connect + handshake deadline.
  * @returns {Promise<Emitter>}
diff --git a/tests/emit-room-claim.test.js b/tests/emit-room-claim.test.js
index 00029d4d..e17af118 100644
--- a/tests/emit-room-claim.test.js
+++ b/tests/emit-room-claim.test.js
@@ -9,6 +9,11 @@
  * default of a first-class API was therefore refused by every named room, and the
  * caller saw only "closed before handshake" with no mention of rooms: the node
  * logged the reason, the client did not.
+ *
+ * Admitted is not heard (0.14.0 review C-F2): the emitter then minted its records
+ * with no room, a record with no room is in 'default' (B-R10), and the node that
+ * had admitted it refused every block. It now authors for the room it was
+ * admitted into.
  */
 
 require('./_isolate-home');
@@ -31,6 +36,42 @@ describe('emit room claims', () => {
     }
   });
 
+  it('and the node that admitted it hears what it sends', async () => {
+    const node = new SymNode({ name: 'acme-node4', room: 'acme', silent: true });
+    await node.start();
+    const refused = [];
+    node.on('metric', (m) => { if (m.type === 'cmb-audience-rejected') refused.push(m); });
+    try {
+      const accepted = new Promise((resolve) => node.once('cmb-accepted', resolve));
+      const e = await connect({ server: `127.0.0.1:${node._port}`, timeoutMs: 4000 });
+      const { cmb } = e.emit({ focus: 'a block from an emitter that named no room' });
+      assert.strictEqual(cmb.metadata.room, 'acme', 'it authors for the room it was admitted into');
+      const entry = await Promise.race([accepted, new Promise((_, reject) => setTimeout(() => reject(new Error(`not heard; refused: ${JSON.stringify(refused)}`)), 8000))]);
+      assert.strictEqual(entry.cmb.metadata.key, cmb.metadata.key);
+      assert.strictEqual(refused.length, 0);
+      await e.close();
+    } finally {
+      await node.stop();
+    }
+  });
+
+  it('a record that names no room is still refused outside "default", even from its own author', () => {
+    // As a 0.13.x emitter mints it. The emitter fix is on the minting side: a receiver cannot tell a
+    // room-less record its author just sent from one replayed out of another room (B-R10).
+    const crypto = require('crypto');
+    const { createCMB, signCMB } = require('../lib/core');
+    const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519', { publicKeyEncoding: { type: 'spki', format: 'der' }, privateKeyEncoding: { type: 'pkcs8', format: 'der' } });
+    const node = new SymNode({ name: 'acme-node5', room: 'acme', silent: true });
+    node._pinPeerKey('emitter-0133', publicKey.slice(-32).toString('base64url'));
+    const cmb = createCMB({ categories: { focus: 'room-less, from an older emitter' }, createdBy: 'emitter' });
+    cmb.metadata.room = null;
+    signCMB(cmb, privateKey.slice(-32).toString('base64url'));
+    const metrics = [];
+    node.on('metric', (m) => metrics.push(m));
+    assert.strictEqual(node._frameHandler._rejectOnBadSignature('emitter-0133', 'emitter', { cmb }), true);
+    assert.ok(metrics.some((m) => m.type === 'cmb-audience-rejected' && m.reason === 'wrong-audience'));
+  });
+
   it('still CLAIMS default when the caller asks for it, and a named room refuses that', async () => {
     const node = new SymNode({ name: 'acme-node2', room: 'acme', silent: true });
     await node.start();

From 7d60b8b15745e96eac42e93ddbf189faa837b7c1 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Fri, 2 Oct 2026 03:58:02 +0100
Subject: [PATCH 071/148] 0.14.0 review: what a stored record is, said as it is

The CHANGELOG and recordAsSigned said a stored record is exactly its
two signed sections, but the receive path puts back the `payload` the
frame carried beside them (_preserveIncomingPayload), on both admission
paths. That is the author's member, not this node's: remember() puts it
on the author's own record, signed, stored and sent with it, so the
receiver's stored record matches what the author holds. What was false
was the claim. A re-verifier is unaffected: no signature or address
covers the payload, the signed sections are stored exactly as signed and
re-verify, and cmb-fetch serves those two sections alone. The claim now
says so, and a test pins it on both paths: the stored record is the two
sections plus the payload as sent, the sections equal recordAsSigned of
the author's record and verify, the inbox delivers the payload, and the
fetched copy is two sections and re-verifies.

Moving the payload to the entry was not done: it would break readers of
entry.cmb.payload (mesh-channel's push path and recall policy) for a
member whose spec home is the signed metadata.application section, the
deferred v2-record work.

Review C-F6.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 CHANGELOG.md                           | 11 +++++---
 lib/core/record-shape.js               |  6 ++++
 tests/stored-entry-annotations.test.js | 39 +++++++++++++++++++++++++-
 3 files changed, 51 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 95816600..610d1247 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -114,10 +114,13 @@ debt, and the daemon's log flood. Every item has a test that fails without its f
 
 ### Changed — read these before upgrading
 
-- **A stored record is exactly what its author signed.** The store used to add members to a
-  two-section record: `admission`, `tether`, `provenance` and `collapsed`, plus an expanded
-  top-level `lineage`. The record now stays `{categories, metadata}` as signed (§8.8.1), and those
-  annotations live on the store **entry**. Stored files from earlier releases are read as before and
+- **A stored record is what its author sent, and nothing this node computed.** The store used to add
+  members to a two-section record: `admission`, `tether`, `provenance` and `collapsed`, plus an
+  expanded top-level `lineage`. The record now stays `{categories, metadata}` as signed (§8.8.1), and
+  those annotations live on the store **entry**. The one other member it can carry is the `payload`
+  its author sent beside the two sections (as the author's own stored record does): no signature or
+  address covers it, so a record that verifies says nothing about its payload, and `cmb-fetch`
+  serves the two sections without it. Stored files from earlier releases are read as before and
   moved on first touch. **Code outside sym that reads `entry.cmb.admission`, `.tether`,
   `.provenance` or `.collapsed`, from stored entries or from `cmb-accepted` / `memory-received`
   events, must read them from the entry.** xmesh 0.10.11 reads both places.
diff --git a/lib/core/record-shape.js b/lib/core/record-shape.js
index 3d8da2e8..38981337 100644
--- a/lib/core/record-shape.js
+++ b/lib/core/record-shape.js
@@ -194,6 +194,12 @@ function categoriesAsSigned(categories) {
  * A two-section record comes back as exactly `categories` and `metadata` (§8.8.1). A pre-boundary
  * record (no metadata section) is copied whole, its shape being its own, with the same treatment
  * of its categories.
+ *
+ * What is stored can carry one member more: the receive path puts back the `payload` the author
+ * sent beside the two sections (lib/frame-handler.js _preserveIncomingPayload), as the author's own
+ * stored record carries it. No signature or address covers it, so verifying the record says
+ * nothing about it. The signed sections are stored exactly as returned here, and what cmb-fetch
+ * serves is those two sections alone.
  */
 function recordAsSigned(record) {
   if (!record || typeof record !== 'object') return record;
diff --git a/tests/stored-entry-annotations.test.js b/tests/stored-entry-annotations.test.js
index 5f410b34..c60e7a7c 100644
--- a/tests/stored-entry-annotations.test.js
+++ b/tests/stored-entry-annotations.test.js
@@ -10,6 +10,11 @@ require('./_isolate-home'); // redirect $HOME to a temp sandbox before lib/confi
  * §15.8 attestation), `provenance` (fusion evidence and the tether annotation) and `collapsed`. None
  * is the author's, none is signed, and each made the stored record a shape no reader of the record
  * format expects. They are entry members now, and files written before keep reading.
+ *
+ * The one member a stored record may carry beyond its two sections is the `payload` its author sent
+ * beside them (0.14.0 review C-F6). It is the author's, not this node's, and no signature or address
+ * covers it: the signed sections are stored exactly as signed, and what cmb-fetch serves, the two
+ * sections, re-verifies.
  */
 
 const { describe, it } = require('node:test');
@@ -22,7 +27,7 @@ const { NullDiscovery } = require('../lib/discovery');
 const { nodeDir } = require('../lib/config');
 const { tmpdir } = require('./_tmpdir');
 const { MemoryStore } = require('../lib/memory-store');
-const { createCMB, signCMB, verifyCMB, verifyAttestation, verifyTetherAttestation } = require('../lib/core');
+const { createCMB, signCMB, verifyCMB, verifyAttestation, verifyTetherAttestation, recordAsSigned } = require('../lib/core');
 
 const ALIGNED = { decision: 'aligned', total_drift: 0.1, category_drifts: { focus: 0.1 }, gate_values: { focus: 1 } };
 
@@ -120,4 +125,36 @@ describe('admission annotations live on the store entry', () => {
         `${label}: every annotation is still there, on the entry`);
     }
   });
+
+  for (const path_ of ['heuristic', 'neural']) {
+    it(`${path_} path: a payload the author sent is stored beside the signed sections, which stay as signed`, async () => {
+      const opts = path_ === 'neural' ? { svafEvaluator: { evaluate: async () => ALIGNED } } : {};
+      await withNode(opts, async (node) => {
+        node._pinPeerKey('peerA', AUTHOR.pub);
+        const record = createCMB({ categories: cat7(`an llm-request admitted through the ${path_} path`), createdBy: 'peerA' });
+        signCMB(record, AUTHOR.priv);
+        const payload = { kind: 'llm-request', request_id: `r-${path_}`, prompt: 'say hello' };
+        const sent = JSON.parse(JSON.stringify({ ...record, payload }));
+        await node._frameHandler._handleMemoryShare('peerA', 'peerA', { type: 'cmb', timestamp: Date.now(), cmb: sent });
+
+        const entry = node._store.get(record.metadata.key);
+        assert.ok(entry, 'admitted and stored');
+        assert.deepStrictEqual(Object.keys(entry.cmb).sort(), ['categories', 'metadata', 'payload'], 'the two sections and the author\'s payload, nothing this node computed');
+        assert.deepStrictEqual(entry.cmb.payload, payload, 'the payload as sent');
+        const { payload: _p, ...sections } = entry.cmb;
+        assert.deepStrictEqual(sections, recordAsSigned(record), 'the signed sections exactly as signed');
+        assert.strictEqual(verifyCMB(entry.cmb, AUTHOR.pub).valid, true, 'and they verify');
+        assert.deepStrictEqual(node.inboxGet(entry.inboxId)?.payload, payload, 'the inbox delivers it');
+
+        // What another node fetching this key gets, and re-verifies: the two sections.
+        const served = [];
+        const transport = { send: (f) => served.push(f), close: () => {} };
+        node._peers.set('peer-fetch', { peerId: 'peer-fetch', name: 'fetcher', transport, transports: new Map([['bonjour', transport]]), source: 'bonjour', lastSeen: Date.now() });
+        node._frameHandler._handleCmbFetch('peer-fetch', 'fetcher', { type: 'cmb-fetch', key: record.metadata.key, reqId: 'q1' });
+        const got = served.find((f) => f.type === 'cmb-fetch-result')?.cmb;
+        assert.deepStrictEqual(Object.keys(got).sort(), ['categories', 'metadata']);
+        assert.strictEqual(verifyCMB(got, AUTHOR.pub).valid, true, 'the served copy re-verifies');
+      });
+    });
+  }
 });

From 623c56c934c9f42c432640a14792390666c18eec Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Fri, 2 Oct 2026 04:08:41 +0100
Subject: [PATCH 072/148] 0.14.0 review A1: the attestation store never
 truncates what it could not read

F1: _replay recorded a log's size before reading it, so a read that threw
(too large for memory, an I/O error) left the log counted as all waste and
the start-up rotation replaced it with an empty one, then pruned the
archive of it. A log that could not be read is now only appended to and
never rotated by that process; that is said once.
F8: a short fs.readSync is completed; a read that ends early is a log not
read (F1), not waste.
F2: dedup keyed on a signature's bytes while the chain link and Merkle root
hash its spelling. A signature is now stored as its signer wrote it, so a
re-spelling in a log written before 0.14.0 is read as the canonical one
(counted, said once) and cannot make an honest chain look broken.
F3: the checkpoint read budget covers a conflicting copy beside each held
position (56 MiB; 172 MiB in all).
F4: a rotation writes back the witnesses read from the log that still wait
for their checkpoint, counted as held; one heard only on the network stays
in memory only.
F5: this node's own witness at a full position is written once, and its
line counts toward a rotation.
F6: the start-up tidy leaves the temp file and archive of a rotation that
another live process has in flight. F7: a copy-fallback rotation names its
copy in a marker until the live log is replaced, so a start after a crash
removes a copy of the live log and keeps a real archive.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 CHANGELOG.md                       |  35 +++--
 lib/attestation-store.js           | 169 +++++++++++++++++++---
 tests/attestation-rotation.test.js | 216 +++++++++++++++++++++++++++--
 3 files changed, 381 insertions(+), 39 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 57485c16..077725bc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -175,19 +175,34 @@ debt, and the daemon's log flood. Every item has a test that fails without its f
   the filesystem has no hard links. Only then does it rename the temp file over the live log, so the
   live path holds a complete log at every instant. A failure at any step removes what the rotation
   made (no archive name is left on the live log), leaves the live log as it was, is logged once per
-  distinct error, and is retried after another budget. A start removes what a crashed rotation left
-  behind. Archives are pruned in sequence order, not by file time.
+  distinct error, and is retried after another budget. A start removes what a rotation that crashed
+  left behind: its temp file, an archive name still on the live log, and a copy of the live log made
+  where there are no hard links (a marker names that copy until the live log is replaced). It leaves
+  alone a rotation another running process has in flight on the same directory. Archives are pruned
+  in sequence order, not by file time.
+- **A log that cannot be read at start is left as it is.** A start that could not read a log (too
+  large for memory, an I/O error, a read that ended early) counted none of it as held. The rotation
+  that followed then replaced the log with an empty one, and pruned the archive of it. Such a log is
+  now only appended to, and not rotated until a start reads it; that is said once. A read that
+  returns short is completed.
 - **A rotation keeps everything held:** every attestation, checkpoint and witness the store holds;
   each conflicting checkpoint copy for a held position, so a restart still reports the conflict; and
   this node's memory of the checkpoints it witnessed itself (one line per attester), so it still signs
-  a witness once across restarts. A witness waiting for its checkpoint stays in memory only, as before.
+  a witness once across restarts. A witness read from the log that still waits for its checkpoint is
+  written back, so a restart finds it again, as when the log was never rewritten. One heard only on
+  the network waits in memory only, as before. This node's own witness for a position too full to
+  hold it is written once, not once per copy received.
 - **A start reads all of each log.** A record can stay held at the head of its log while newer ones
   churn past it: a quiet attester's attestations or checkpoints, a quiet position's witnesses. So each
-  log is read whole, up to twice what its caps hold: 68.7 MiB for attestations (50,000 at 720 bytes;
-  measured ~520), 28 MiB for checkpoints and 47.7 MiB for witnesses, 144 MiB in all. 0.13.16 read at
-  most 112 MiB but only the newest part of each log, which could miss a quiet attester. On logs over
-  every budget, reading them took 0.8–0.9 s here against 1.0–1.4 s for 0.13.16. A first start that
-  also rotates all three took 1.0–1.3 s, once; the next start took 0.25 s.
+  log is read whole, up to twice what its caps hold:
+  - 68.7 MiB for attestations (50,000 at 720 bytes; measured ~520);
+  - 56 MiB for checkpoints (32,768 at 448 bytes, and a conflicting copy beside each);
+  - 47.7 MiB for witnesses;
+  - 172 MiB in all.
+
+  0.13.16 read at most 112 MiB, but only the newest part of each log, which could miss a quiet
+  attester. On logs over every budget, reading them took 0.80–0.85 s here against 0.96 s for 0.13.16.
+  A first start that also rotates all three took about 1.0 s, once; the next start took 0.23 s.
 - **One attester cannot flush another's chain.** The 50,000-attestation cap was one queue across all
   attesters, so one attester signing many attestations pushed every other attester's chain out, and
   the omission evidence with it. Now, when the store is full, the attester holding the most loses its
@@ -247,7 +262,9 @@ debt, and the daemon's log flood. Every item has a test that fails without its f
   now refused before anything is spent on it. It is counted (`signaturesNotCanonical` in `metrics()`)
   and said like a budget drop (`signature-not-canonical`). A re-spelling of an attestation already
   held is a repeat. Every signer sym knows writes the canonical spelling, and this node checks its own
-  before recording one.
+  before recording one. A log written before 0.14.0 can hold another spelling. Such a line is read as
+  the canonical spelling, which is counted and said once, so it can no longer make an honest chain
+  look broken; a rotation then writes the canonical one.
 - **A dropped attestation is logged once a minute per peer and reason, with a count.** It was logged
   once per frame, and one naming a signer whose key is not held is dropped before any budget.
 
diff --git a/lib/attestation-store.js b/lib/attestation-store.js
index 2bf1d75a..b517b05d 100644
--- a/lib/attestation-store.js
+++ b/lib/attestation-store.js
@@ -36,7 +36,9 @@
  * fsynced), links the old log into `archive/` under a name no other rotation can take, and renames
  * the temp file over the live log: the live path holds a complete log at every instant, and a failure
  * at any step leaves it as it was. `archive/` keeps at most `maxArchiveBytes` per log, the newest
- * archive included, dropping the oldest first. A log is never edited in place.
+ * archive included, dropping the oldest first. A log is never edited in place, and a log that could
+ * not be read at start is never rotated. A rotation writes back the witnesses read from the log that
+ * still wait for their checkpoint.
  *
  * This store does NOT verify signatures or roster membership — the caller verifies
  * before recording (a recorded attestation is assumed already verified). It only
@@ -56,8 +58,12 @@ const LOGS = [ATT_FILE, CP_FILE, WIT_FILE];
 const ARCHIVE_DIR = 'archive';
 /** An archived log: `<log>.<sequence, 12 digits>.<UTC time to the ms>.<pid>.jsonl`. The sequence orders them. */
 const ARCHIVE_NAME = /^(attestations|checkpoints|witnesses)\.(\d{12})\.(\d{8}T\d{9}Z)\.(\d+)\.jsonl$/;
-/** A rotation's temp file: left behind only by a crash part way through one. */
-const ROTATING_NAME = /^(attestations|checkpoints|witnesses)\.jsonl\.\d+\.\d+\.rotating$/;
+/** A rotation's temp file: left behind only by a crash part way through one. The fields are the
+ *  writing process's pid and a counter. */
+const ROTATING_NAME = /^(attestations|checkpoints|witnesses)\.jsonl\.(\d+)\.\d+\.rotating$/;
+/** Names the archive a rotation is copying the old log into (where there are no hard links), until the
+ *  rotation has replaced the live log: a crash in between leaves a copy of the live log in archive/. */
+const ARCHIVING_NAME = /^(attestations|checkpoints|witnesses)\.jsonl\.(\d+)\.\d+\.archiving$/;
 /** The line a rotated witness log keeps this node's own-witness memory in, one per attester. */
 const OWN_WITNESSED = 'own-witnessed';
 /** A link error that means the filesystem has no hard links: the old log is copied instead. */
@@ -108,6 +114,34 @@ function writeAll(fd, buf) {
   return off;
 }
 
+/** Whether `pid` is a running process other than this one (one that may be mid-rotation on the same
+ *  directory). A pid that has been reused errs toward leaving a leftover for a later start. */
+function otherLiveProcess(pid) {
+  if (!Number.isSafeInteger(pid) || pid <= 0 || pid === process.pid) return false;
+  try { process.kill(pid, 0); return true; } catch (e) { return e.code === 'EPERM'; }
+}
+
+/** Whether two files hold the same bytes, read in chunks. */
+function sameBytes(a, b) {
+  const fa = fs.openSync(a, 'r');
+  try {
+    const fb = fs.openSync(b, 'r');
+    try {
+      if (fs.fstatSync(fa).size !== fs.fstatSync(fb).size) return false;
+      const ba = Buffer.alloc(1 << 20);
+      const bb = Buffer.alloc(1 << 20);
+      for (let pos = 0; ;) {
+        const na = fs.readSync(fa, ba, 0, ba.length, pos);
+        const nb = fs.readSync(fb, bb, 0, bb.length, pos);
+        if (na !== nb) return false;
+        if (na === 0) return true;
+        if (!ba.subarray(0, na).equals(bb.subarray(0, nb))) return false;
+        pos += na;
+      }
+    } finally { fs.closeSync(fb); }
+  } finally { fs.closeSync(fa); }
+}
+
 /** sha256 hex of a signature — the per-attester chain link (`prev`). */
 function chainHash(sig) {
   return crypto.createHash('sha256').update(String(sig)).digest('hex');
@@ -186,6 +220,8 @@ class AttestationStore {
     this._archiveSeq = 0;
     this._tmpSeq = 0;
     this._said = new Set();        // rotation errors already said
+    this._unread = new Set();      // logs that could not be read at start: never rotated or rewritten
+    this._respelled = 0;           // attestations read from a log with a signature not spelled canonically
     // At start, each log is read up to a budget that covers what its caps hold, and of a larger log
     // only its newest part. A record can stay held while newer ones churn past it (a quiet attester's
     // attestations or checkpoints, a quiet position's witnesses), so each log is read whole: what the
@@ -193,7 +229,8 @@ class AttestationStore {
     const readAll = opts.maxReadBytes;
     const capBytes = {
       [ATT_FILE]: this._max * ATT_LINE,
-      [CP_FILE]: this._maxCheckpointsPerAttester * this._maxAttesters * CP_LINE,
+      // Each held position may also hold the copy that conflicted with it.
+      [CP_FILE]: this._maxCheckpointsPerAttester * this._maxAttesters * CP_LINE * 2,
       [WIT_FILE]: this._maxWitnesses * WIT_LINE + this._maxAttesters * OWN_LINE,
     };
     const wholeLog = (f) => capBytes[f] + Math.max(this._rotateBytes, capBytes[f]);
@@ -224,6 +261,14 @@ class AttestationStore {
     }
     const key = sigKey(att.sig);
     if (this._seen.has(key)) return { stored: false, reason: 'duplicate' };
+    // One form for everything: the signature is stored as its signer wrote it, so the chain link
+    // (`prev` is the hash of the previous signature as written) and the checkpoint's Merkle root
+    // are computed over that, as dedup is. Gossip refuses another spelling; a log written before
+    // 0.14.0 may hold one, which is read as the canonical spelling, and counted.
+    if (key !== att.sig) {
+      att = { ...att, sig: key };
+      if (this._loading) this._respelled++;
+    }
     if (opts.ingested && !this._allowIngest(att.of, att.by, opts.now ?? Date.now())) {
       return { stored: false, reason: 'rate-limited' };
     }
@@ -344,7 +389,7 @@ class AttestationStore {
     this._checkpoints.set(cp.by, m);
     this._keep(CP_FILE, cp);
     for (const [k, w] of [...this._pending]) {
-      if (w.attester === cp.by && w.upto_seq === cp.upto_seq) { this._pending.delete(k); this.recordWitness(w); }
+      if (w.attester === cp.by && w.upto_seq === cp.upto_seq) { this._unpend(k); this.recordWitness(w); }
     }
     this._maybeRotate(CP_FILE);
     if (dropped) this._maybeRotate(WIT_FILE);   // witnesses went with the dropped positions
@@ -362,7 +407,9 @@ class AttestationStore {
     if (!w || !w.attester || !isPosition(w.upto_seq) || !w.root || !w.by || !w.sig) return { stored: false, reason: 'malformed' };
     // This node's own witness is remembered before anything else is decided, so one that waits or
     // is refused still counts as signed (witness once, across restarts).
-    if (this._selfId && w.by === this._selfId) this._markOwnWitness(w.attester, w.upto_seq);
+    const own = !!this._selfId && w.by === this._selfId;
+    const ownKnown = own && !!this._ownWitnessed.get(w.attester)?.has(w.upto_seq);
+    if (own) this._markOwnWitness(w.attester, w.upto_seq);
     const existing = this.witnessAt(w.attester, w.upto_seq, w.by);
     if (existing) {
       if (existing.root === w.root) return { stored: false, reason: 'duplicate' };
@@ -375,9 +422,15 @@ class AttestationStore {
         if (p.root === w.root) return { stored: false, reason: 'duplicate' };
         return { stored: false, reason: 'conflict', keptRoot: p.root, first: this._noteWitnessConflict(w) };
       }
-      if (this._loading) { this._fromLog.add(w); this._recBytes.set(w, this._replayBytes); }
+      if (this._loading) {
+        // Read from the live log: it stays there (a rotation writes it again) until it is promoted
+        // or the waiting set lets it go. One heard on the network waits in memory only.
+        this._fromLog.add(w);
+        this._recBytes.set(w, this._replayBytes);
+        if (this._dir) this._held[WIT_FILE] += this._replayBytes;
+      }
       this._pending.set(k, w);
-      if (this._pending.size > this._maxPending) this._pending.delete(this._pending.keys().next().value);
+      if (this._pending.size > this._maxPending) this._unpend(this._pending.keys().next().value);
       return { stored: false, reason: 'pending' };
     }
     let byPos = this._witnesses.get(w.attester);
@@ -386,9 +439,13 @@ class AttestationStore {
     if (!m) { m = new Map(); byPos.set(w.upto_seq, m); this._positions.set(positionKey(w.attester, w.upto_seq), [w.attester, w.upto_seq]); }
     if (m.size >= this._maxWitnessesPerPosition) {
       // This node's own witness is written even when the position cannot hold it, so a restart still
-      // knows it was signed; it is read back as remembered, not stored.
-      // (A rotation keeps it in this node's own-witness line.)
-      if (this._selfId && w.by === this._selfId && !this._fromLog.has(w)) this._appendLine(WIT_FILE, JSON.stringify(w) + '\n');
+      // knows it was signed; it is read back as remembered, not stored (and a rotation keeps it in
+      // this node's own-witness line). Once: a later copy of a statement already remembered adds
+      // nothing to the log, and what was written counts toward the next rotation like any waste.
+      if (own && !ownKnown && !this._fromLog.has(w)) {
+        this._appendLine(WIT_FILE, JSON.stringify(w) + '\n');
+        this._maybeRotate(WIT_FILE);
+      }
       return { stored: false, reason: 'position-full' };
     }
     m.set(w.by, w);
@@ -403,6 +460,15 @@ class AttestationStore {
     return { stored: true };
   }
 
+  /** @private Let a waiting witness go (promoted, or out of the bounded set). One read from the live
+   *  log stops counting as held there. */
+  _unpend(k) {
+    const w = this._pending.get(k);
+    if (!w) return;
+    this._pending.delete(k);
+    if (this._dir && this._fromLog.has(w)) this._held[WIT_FILE] -= this._recBytes.get(w) || 0;
+  }
+
   /** @private Remember a witness conflict, and the root it asserted, once; bounded.
    *  @returns {boolean} whether it is newly seen */
   _noteWitnessConflict(w) {
@@ -563,6 +629,9 @@ class AttestationStore {
     this._replay(CP_FILE, (o) => this.recordCheckpoint(o));
     this._replay(WIT_FILE, (o) => (o && o.type === OWN_WITNESSED ? this._restoreOwn(o) : this.recordWitness(o)));
     this._loading = false;
+    if (this._respelled > 0) {
+      this._say('respelled', `${this._respelled} attestation(s) in ${ATT_FILE} carried a signature not spelled as its signer wrote it (stored before 0.14.0); each was read as the canonical spelling`);
+    }
     this._tidy();
     for (const file of LOGS) this._maybeRotate(file);
   }
@@ -579,10 +648,13 @@ class AttestationStore {
   _replay(file, fn) {
     const p = path.join(this._dir, file);
     const budget = this._readBudget[file];
+    let size;
+    try { size = fs.statSync(p).size; } catch (e) {
+      if (e.code === 'ENOENT') return; // no log yet
+      return this._cannotRead(file, e);
+    }
     let text;
     try {
-      const size = fs.statSync(p).size;
-      this._logBytes[file] = size;
       if (size <= budget) text = fs.readFileSync(p, 'utf8');
       else {
         // The newest part only: what a bounded store keeps. Reading a whole oversized log (one was
@@ -591,11 +663,24 @@ class AttestationStore {
         const fd = fs.openSync(p, 'r');
         try {
           const buf = Buffer.alloc(budget);
-          const n = fs.readSync(fd, buf, 0, buf.length, size - buf.length);
+          // A read may return short (a network or FUSE filesystem): it is completed, and a log that
+          // cannot be read in full is not taken as read.
+          let n = 0;
+          while (n < buf.length) {
+            const r = fs.readSync(fd, buf, n, buf.length - n, size - buf.length + n);
+            if (!(r > 0)) break;
+            n += r;
+          }
+          if (n < buf.length) throw Object.assign(new Error(`read ${n} of ${buf.length} bytes`), { code: 'ESHORTREAD' });
           text = buf.subarray(buf.indexOf(0x0a) + 1, n).toString('utf8'); // the cut first line is skipped
         } finally { fs.closeSync(fd); }
       }
-    } catch { return; } // no file yet
+    } catch (e) {
+      return this._cannotRead(file, e);
+    }
+    // Only a log that was read counts its bytes: what was read and not held is waste a rotation may
+    // reclaim, and an unread log has nothing known to be waste.
+    this._logBytes[file] = size;
     for (const line of text.split('\n')) {
       if (!line.trim()) continue;
       let o;
@@ -606,6 +691,15 @@ class AttestationStore {
     this._replayBytes = 0;
   }
 
+  /** @private A log that exists but could not be read at start (too large for memory, an I/O
+   *  error): nothing in it is known, so it is never rotated or rewritten by this process, only
+   *  appended to. Said once. */
+  _cannotRead(file, err) {
+    this._unread.add(file);
+    const code = (err && (err.code || err.message)) || String(err);
+    this._say(`unread|${file}|${code}`, `${file} could not be read at start (${code}); it is kept as it is, appended to, and not rotated until a start reads it`);
+  }
+
   // ── Rotation ─────────────────────────────────────────────────────────────────
 
   /**
@@ -617,7 +711,7 @@ class AttestationStore {
    * O(1): two comparisons per record stored.
    */
   _maybeRotate(file) {
-    if (!this._dir || this._loading) return;
+    if (!this._dir || this._loading || this._unread.has(file)) return;
     const held = this._held[file];
     if (this._logBytes[file] - held <= Math.max(this._rotateBytes, held)) return;
     if (this._logBytes[file] < this._retryAt[file]) return;
@@ -634,8 +728,11 @@ class AttestationStore {
       for (const m of this._checkpoints.values()) yield* m.values();
       for (const m of this._conflicted.values()) yield* m.values();
     } else {
-      // Positions in the order they got their first witness (the global cap drops the oldest first).
+      // Positions in the order they got their first witness (the global cap drops the oldest first),
+      // then the witnesses read from the log that still wait for their checkpoint: a rotation keeps
+      // them in the log, where a restart finds them again.
       for (const [a, seq] of this._positions.values()) { const m = this._witnesses.get(a)?.get(seq); if (m) yield* m.values(); }
+      for (const w of this._pending.values()) if (this._fromLog.has(w)) yield w;
     }
   }
 
@@ -655,6 +752,7 @@ class AttestationStore {
     let step = 'write';
     let fd = null;
     let archived = null;
+    let marker = null;
     let written = 0;
     try {
       fd = fs.openSync(tmp, 'wx');
@@ -683,7 +781,9 @@ class AttestationStore {
       fs.closeSync(fd);
       fd = null;
       step = 'archive';
-      archived = this._archive(live, base);
+      const made = this._archive(live, base);
+      archived = made && made.dest;
+      marker = made && made.marker;
       step = 'rename';
       fs.renameSync(tmp, live);
     } catch (err) {
@@ -691,19 +791,20 @@ class AttestationStore {
       try { fs.unlinkSync(tmp); } catch { /* not made */ }
       // An archive name left on the live log would grow with it: it is removed with the rest.
       if (archived) { try { fs.unlinkSync(archived); } catch { /* best effort; a start removes it too */ } }
+      if (marker) { try { fs.unlinkSync(marker); } catch { /* best effort */ } }
       const wait = Math.max(this._rotateBytes, this._held[file]);
       this._retryAt[file] = this._logBytes[file] + wait;
       const code = (err && (err.code || err.message)) || String(err);
       this._say(`rotate|${file}|${step}|${code}`, `${file} not rotated (${step}: ${code}); the live log is unchanged, retried after another ${wait} bytes`);
       return false;
     }
+    if (marker) { try { fs.unlinkSync(marker); } catch { /* a start removes it */ } }
     this._syncDir(this._dir);
     for (const [rec, bytes] of sizes) this._recBytes.set(rec, bytes);
     this._logBytes[file] = written;
     this._held[file] = written;
     this._retryAt[file] = 0;
     this._rotations[file]++;
-    if (file === WIT_FILE) this._fromLog = new WeakSet();   // what waits is no longer in the live log
     this._pruneArchive(base);
     return true;
   }
@@ -712,6 +813,7 @@ class AttestationStore {
    *  @returns {string|null} the archive path, or null when there is no live log */
   _archive(live, base) {
     try { fs.statSync(live); } catch (e) { if (e.code === 'ENOENT') return null; throw e; }
+    let marker = null;
     const dir = path.join(this._dir, ARCHIVE_DIR);
     fs.mkdirSync(dir, { recursive: true });
     for (let tries = 0; tries < 8; tries++) {
@@ -722,20 +824,25 @@ class AttestationStore {
         if (e.code === 'EEXIST') continue;
         if (!NO_LINK.has(e.code)) throw e;
         // No hard links here: copy it, never over an existing name, and make the copy durable before
-        // the live log is replaced.
+        // the live log is replaced. A marker names the copy until the live log is replaced, so a
+        // start after a crash in between can tell a copy of the live log from a real archive.
         try {
+          if (!marker) marker = `${live}.${process.pid}.${++this._tmpSeq}.archiving`;
+          fs.writeFileSync(marker, path.basename(dest));
           fs.copyFileSync(live, dest, fs.constants.COPYFILE_EXCL);
           const cfd = fs.openSync(dest, 'r+');
           try { fs.fsyncSync(cfd); } finally { fs.closeSync(cfd); }
         } catch (c) {
           if (c.code === 'EEXIST') continue;
           try { fs.unlinkSync(dest); } catch { /* not made */ }
+          if (marker) { try { fs.unlinkSync(marker); } catch { /* not made */ } }
           throw c;
         }
       }
       this._syncDir(dir);
-      return dest;
+      return { dest, marker };
     }
+    if (marker) { try { fs.unlinkSync(marker); } catch { /* not made */ } }
     throw Object.assign(new Error('no free archive name'), { code: 'EEXIST' });
   }
 
@@ -790,8 +897,25 @@ class AttestationStore {
   _tidy() {
     let names = [];
     try { names = fs.readdirSync(this._dir); } catch { return; }
-    for (const n of names) if (ROTATING_NAME.test(n)) { try { fs.unlinkSync(path.join(this._dir, n)); } catch { /* best effort */ } }
     const dir = path.join(this._dir, ARCHIVE_DIR);
+    // Only what a crashed rotation left: a file a live process other than this one is still using
+    // (its pid is in the name) is part of a rotation in progress, and is left to it.
+    for (const n of names) {
+      const m = ROTATING_NAME.exec(n);
+      if (m && !otherLiveProcess(Number(m[2]))) { try { fs.unlinkSync(path.join(this._dir, n)); } catch { /* best effort */ } }
+    }
+    for (const n of names) {
+      const m = ARCHIVING_NAME.exec(n);
+      if (!m || otherLiveProcess(Number(m[2]))) continue;
+      // A copy made where there are no hard links, and a crash before the live log was replaced: if
+      // the copy is the live log, byte for byte, it is not an archive of anything. (If the live log was
+      // replaced, the copy is the old log, a real archive, and is kept.)
+      try {
+        const copy = path.join(dir, path.basename(fs.readFileSync(path.join(this._dir, n), 'utf8').trim()));
+        if (ARCHIVE_NAME.test(path.basename(copy)) && sameBytes(copy, path.join(this._dir, `${m[1]}.jsonl`))) fs.unlinkSync(copy);
+      } catch { /* best effort */ }
+      try { fs.unlinkSync(path.join(this._dir, n)); } catch { /* best effort */ }
+    }
     for (const file of LOGS) {
       const base = file.slice(0, -'.jsonl'.length);
       let archives = [];
@@ -801,6 +925,7 @@ class AttestationStore {
       try { live = fs.statSync(path.join(this._dir, file), { bigint: true }); } catch { /* none */ }
       if (live && live.ino !== 0n) {
         for (const f of archives) {
+          if (otherLiveProcess(f.pid)) continue;
           try {
             const st = fs.statSync(f.file, { bigint: true });
             if (st.ino === live.ino && st.dev === live.dev) fs.unlinkSync(f.file);
diff --git a/tests/attestation-rotation.test.js b/tests/attestation-rotation.test.js
index f20ef166..da400a40 100644
--- a/tests/attestation-rotation.test.js
+++ b/tests/attestation-rotation.test.js
@@ -27,7 +27,9 @@ const lineOf = (o) => JSON.stringify(o) + '\n';
 const read = (dir, file) => { try { return fs.readFileSync(path.join(dir, file), 'utf8'); } catch { return ''; } };
 const archives = (dir) => { try { return fs.readdirSync(path.join(dir, 'archive')).sort(); } catch { return []; } };
 const archiveBytes = (dir) => archives(dir).reduce((s, n) => s + fs.statSync(path.join(dir, 'archive', n)).size, 0);
-const leftovers = (dir) => fs.readdirSync(dir).filter((n) => n.endsWith('.rotating'));
+const leftovers = (dir) => fs.readdirSync(dir).filter((n) => n.endsWith('.rotating') || n.endsWith('.archiving'));
+/** The pid of a process that has exited: what a crashed rotation's leftovers are named with. */
+const deadPid = () => require('node:child_process').spawnSync(process.execPath, ['-e', '0']).pid;
 
 /** Spy on a store's rotations: the bytes it had appended (in all) at each one. */
 function spyRotations(st, appended) {
@@ -150,9 +152,10 @@ describe('attestation log rotation — at start', () => {
     for (let i = 1; i <= 5; i++) st.record(att(i));
     const before = read(dir, ATT);
     // What a crash between the link and the rename leaves: an archive name on the live inode, and the temp file.
+    const pid = deadPid();
     fs.mkdirSync(path.join(dir, 'archive'));
-    fs.linkSync(path.join(dir, ATT), path.join(dir, 'archive', 'attestations.000000000001.20261002T000000000Z.1.jsonl'));
-    fs.writeFileSync(path.join(dir, `${ATT}.1.1.rotating`), 'partial');
+    fs.linkSync(path.join(dir, ATT), path.join(dir, 'archive', `attestations.000000000001.20261002T000000000Z.${pid}.jsonl`));
+    fs.writeFileSync(path.join(dir, `${ATT}.${pid}.1.rotating`), 'partial');
     const again = new AttestationStore({ dir, log: () => {} });
     assert.deepStrictEqual(archives(dir), [], 'the archive name on the live log is removed');
     assert.deepStrictEqual(leftovers(dir), [], 'and so is the temp file');
@@ -345,19 +348,28 @@ describe('attestation log rotation — nothing held is lost', () => {
     for (const f of [ATT, CP, WIT]) assert.strictEqual(again._rotations[f], 0, `${f} not rotated again at start`);
   });
 
-  it('a waiting witness read from the log is appended when promoted after its log was rotated', () => {
+  it('a waiting witness read from the log is kept through a rotation and a restart, then promoted once (0.14.0 review A1-F4)', () => {
     const dir = tmpdir('att-rot-wait-');
     const opts = { dir, maxCheckpointsPerAttester: 2, rotateBytes: 1024, log: () => {} };
-    fs.writeFileSync(path.join(dir, WIT), lineOf({ attester: 'Z', upto_seq: 3, root: 'rz', by: 'W', sig: 'wz' }));
+    const waiting = lineOf({ attester: 'Z', upto_seq: 3, root: 'rz', by: 'W', sig: 'wz' });
+    fs.writeFileSync(path.join(dir, WIT), waiting);
     const st = new AttestationStore(opts);   // the witness waits for Z's checkpoint
+    st.recordWitness({ attester: 'Y', upto_seq: 1, root: 'ry', by: 'W', sig: 'wy' });   // heard on the network: memory only
     st.recordCheckpoint({ by: 'A', upto_seq: 1, root: 'r1', sig: 'c1' });
     for (let n = 1; st._rotations[WIT] === 0; n++) {
       st.recordCheckpoint({ by: 'A', upto_seq: n, root: `r${n}`, sig: `c${n}` });
       st.recordWitness({ attester: 'A', upto_seq: n, root: `r${n}`, by: 'W', sig: `w${n}` });
     }
-    assert.ok(!read(dir, WIT).includes('"wz"'), 'the waiting witness is not in the rotated log');
-    st.recordCheckpoint({ by: 'Z', upto_seq: 3, root: 'rz', sig: 'cz' });
-    assert.ok(read(dir, WIT).includes('"wz"'), 'promoted, it is appended');
+    assert.ok(read(dir, WIT).includes('"wz"'), 'the waiting witness read from the log is in the rotated log');
+    assert.ok(!read(dir, WIT).includes('"wy"'), 'one heard on the network still never reaches it');
+    const again = new AttestationStore(opts);   // a restart before Z's checkpoint arrives
+    assert.strictEqual(again._rotations[WIT], 0, 'and the next start does not rotate');
+    const size = () => fs.statSync(path.join(dir, WIT)).size;
+    assert.strictEqual(again._held[WIT], size(), 'the rotated log is all held, the waiting witness included: no waste');
+    again.recordCheckpoint({ by: 'Z', upto_seq: 3, root: 'rz', sig: 'cz' });
+    assert.strictEqual(again._held[WIT], size(), 'and promoting it counts it once');
+    assert.strictEqual(again.witnessesFor('Z', 3).length, 1, 'it was still waiting, and is promoted');
+    assert.strictEqual(read(dir, WIT).split('"wz"').length - 1, 1, 'without being written twice');
     assert.strictEqual(new AttestationStore(opts).witnessesFor('Z', 3).length, 1);
   });
 });
@@ -377,3 +389,191 @@ describe('conflicts are held with their positions', () => {
     assert.strictEqual([...st._conflicted.values()].reduce((n, m) => n + m.size, 0), 3, 'only held positions are counted');
   });
 });
+
+// 0.14.0 release review, part A1 (lib/attestation-store.js).
+describe('0.14.0 release review A1', () => {
+  const sig64 = () => require('crypto').randomBytes(64).toString('base64url');
+  const { chainHash } = require('../lib/attestation-store');
+
+  it('a log that cannot be read at start is never rotated or rewritten, only appended to, and that is said once (F1)', () => {
+    const dir = tmpdir('att-a1-unread-');
+    const opts = { dir, max: 100, rotateBytes: 2048 };
+    const seed = new AttestationStore({ ...opts, log: () => {} });
+    for (let i = 1; i <= 100; i++) seed.record(att(i));   // ~12 KB, well over the budget
+    const before = read(dir, ATT);
+    const said = [];
+    const real = fs.readFileSync;
+    fs.readFileSync = (p, ...a) => (String(p).endsWith(ATT) ? (() => { throw Object.assign(new Error('out of memory'), { code: 'ENOMEM' }); })() : real(p, ...a));
+    let st;
+    try { st = new AttestationStore({ ...opts, log: (m) => said.push(m) }); } finally { fs.readFileSync = real; }
+    assert.strictEqual(st._rotations[ATT], 0, 'not rotated');
+    assert.strictEqual(read(dir, ATT), before, 'the log is as it was');
+    assert.deepStrictEqual(archives(dir), [], 'and nothing was archived (or pruned)');
+    assert.strictEqual(said.filter((m) => /could not be read at start \(ENOMEM\)/.test(m)).length, 1, said.join('\n'));
+    // Far more than it holds is appended (and dropped) after the start: a log it read would rotate.
+    const added = [];
+    for (let i = 101; i <= 500; i++) { const a = att(i); st.record(a); added.push(lineOf(a)); }
+    assert.strictEqual(st._rotations[ATT], 0, 'and not later either, however much is appended');
+    assert.strictEqual(read(dir, ATT), before + added.join(''), 'it is only appended to');
+    const again = new AttestationStore({ ...opts, log: () => {} });
+    assert.deepStrictEqual([again.size(), again.chainOf('A').at(-1).seq], [100, 500], 'a start that reads it has the newest records');
+  });
+
+  it('a read that returns short is completed, and one that cannot be completed leaves the log alone (F8)', () => {
+    const dir = tmpdir('att-a1-short-');
+    const seed = new AttestationStore({ dir, max: 100, rotateBytes: 2048, log: () => {} });
+    for (let i = 1; i <= 300; i++) seed.record(att(i));
+    const before = read(dir, ATT);
+    const opts = { dir, max: 100, rotateBytes: 2048, maxReadBytes: 16384, log: () => {} };   // the tail branch
+    const real = fs.readSync;
+    fs.readSync = (fd, buf, off, len, pos) => real(fd, buf, off, Math.min(len, 1000), pos);   // short reads
+    let st;
+    try { st = new AttestationStore(opts); } finally { fs.readSync = real; }
+    assert.deepStrictEqual(st.chainOf('A').map((a) => a.seq).slice(-3), [298, 299, 300], 'the newest records are read');
+    assert.strictEqual(st.size(), 100);
+    // A read that stops early (the file changed under it) is not taken as read.
+    fs.readSync = (fd, buf, off, len, pos) => (off > 0 ? 0 : real(fd, buf, off, Math.min(len, 1000), pos));
+    let partial;
+    try { partial = new AttestationStore({ ...opts, dir: (() => { const d = tmpdir('att-a1-short2-'); fs.writeFileSync(path.join(d, ATT), before); return d; })() }); } finally { fs.readSync = real; }
+    assert.strictEqual(partial._rotations[ATT], 0);
+    assert.strictEqual(partial._unread.has(ATT), true);
+  });
+
+  it('a re-spelled signature in a log written before 0.14.0 is read as the canonical one: no false break, counted once (F2)', () => {
+    const dir = tmpdir('att-a1-spell-');
+    const sigs = Array.from({ length: 8 }, sig64);
+    const lines = [];
+    let prev = 'genesis';
+    sigs.forEach((sig, i) => {
+      const a = { of: `cmb-${i + 1}`, by: 'A', seq: i + 1, prev, sig };
+      // 0.13.16 kept a relay's re-spelling of seq 5, which arrived before the canonical copy.
+      if (i === 4) lines.push(lineOf({ ...a, sig: `${sig}=` }));
+      lines.push(lineOf(a));
+      prev = chainHash(sig);
+    });
+    fs.writeFileSync(path.join(dir, ATT), lines.join(''));
+    const said = [];
+    const st = new AttestationStore({ dir, log: (m) => said.push(m) });
+    assert.deepStrictEqual(st.verifyChain('A'), { ok: true, gaps: [], breaks: [] }, 'no false break');
+    assert.deepStrictEqual(st.chainOf('A').map((a) => a.sig), sigs, 'every signature as its signer wrote it');
+    assert.strictEqual(st.size(), 8, 'the canonical copy is the same attestation');
+    assert.strictEqual(said.filter((m) => /1 attestation\(s\) in attestations.jsonl carried a signature not spelled/.test(m)).length, 1, said.join('\n'));
+    assert.strictEqual(st.has(`${sigs[4]}==`), true, 'any spelling of it is known as held');
+  });
+
+  it('a log of witnesses waiting for their checkpoints is held, so a start does not rotate it (F4)', () => {
+    const dir = tmpdir('att-a1-waiting-');
+    fs.writeFileSync(path.join(dir, WIT), Array.from({ length: 50 }, (_, i) => lineOf({ attester: `Z${i}`, upto_seq: 1, root: 'r', by: 'W', sig: `w${i}` })).join(''));
+    const before = read(dir, WIT);
+    const st = new AttestationStore({ dir, rotateBytes: 1024, log: () => {} });
+    assert.strictEqual(st._rotations[WIT], 0);
+    assert.strictEqual(read(dir, WIT), before);
+  });
+
+  it('the checkpoint log is read whole even when every held position also holds a conflicting copy (F3)', () => {
+    const st = new AttestationStore();
+    assert.ok(st._readBudget[CP] >= 4 * 32 * 1024 * 315, `checkpoints ${st._readBudget[CP]}`);
+    // Functionally, with checkpoint lines near the budget's allowance (448 bytes).
+    const dir = tmpdir('att-a1-conflicts-');
+    const opts = { dir, maxCheckpointsPerAttester: 2, maxAttesters: 4, rotateBytes: 512, log: () => {} };
+    const pad = 'p'.repeat(360);
+    const cp = (by, n, root) => ({ by, upto_seq: n, root, sig: `${by}${n}${root}`, pad });
+    const s1 = new AttestationStore(opts);
+    for (const by of ['B', 'C', 'D', 'A']) for (const n of [1, 2]) { s1.recordCheckpoint(cp(by, n, 'r')); s1.recordCheckpoint(cp(by, n, 'fork')); }
+    // A churns: its positions (and their conflicts) are dropped, B-D's stay held at the head of the log.
+    // Each step adds two lines of waste (~900 bytes); stop while one more would reach a rotation.
+    const waste = () => fs.statSync(path.join(dir, CP)).size - s1._held[CP];
+    for (let n = 3; waste() + 2000 < Math.max(512, s1._held[CP]); n++) {
+      s1.recordCheckpoint(cp('A', n, 'r'));
+      s1.recordCheckpoint(cp('A', n, 'fork'));
+    }
+    assert.strictEqual(s1._rotations[CP], 0);
+    assert.ok(fs.statSync(path.join(dir, CP)).size > 14336 * 0.7, `the live log is near its most: ${fs.statSync(path.join(dir, CP)).size}`);
+    const again = new AttestationStore(opts);
+    for (const by of ['B', 'C', 'D']) for (const n of [1, 2]) assert.strictEqual(again.hasConflict(by, n), true, `${by}@${n} is still known as conflicted`);
+  });
+
+  it("this node's own witness at a full position is written once, and what is written is reclaimed by a rotation (F5)", () => {
+    const dir = tmpdir('att-a1-own-');
+    const st = new AttestationStore({ dir, selfId: 'me', maxWitnessesPerPosition: 2, maxCheckpointsPerAttester: 1000, rotateBytes: 4096, log: () => {} });
+    const fill = (n) => {
+      st.recordCheckpoint({ by: 'A', upto_seq: n, root: 'r', sig: `c${n}` });
+      st.recordWitness({ attester: 'A', upto_seq: n, root: 'r', by: 'W1', sig: `w1-${n}` });
+      st.recordWitness({ attester: 'A', upto_seq: n, root: 'r', by: 'W2', sig: `w2-${n}` });
+    };
+    fill(1);
+    for (let i = 0; i < 100; i++) assert.strictEqual(st.recordWitness({ attester: 'A', upto_seq: 1, root: 'r', by: 'me', sig: `mine-1-${i}` }).reason, 'position-full');
+    assert.strictEqual(read(dir, WIT).split('"by":"me"').length - 1, 1, 'one line, however many copies arrive');
+    assert.strictEqual(st.hasWitnessed('A', 1, 'me'), true);
+    // Then nothing but this node's own witnesses for full positions: their lines alone reach a rotation.
+    for (let n = 2; n <= 20; n++) fill(n);
+    const rotations = st._rotations[WIT];
+    const pad = 'x'.repeat(2000);
+    for (let n = 2; n <= 20; n++) st.recordWitness({ attester: 'A', upto_seq: n, root: 'r', by: 'me', sig: `mine-${n}`, pad });
+    assert.ok(st._rotations[WIT] > rotations, 'the own-witness lines count toward a rotation like any waste');
+  });
+
+  it("the start-up tidy leaves a rotation another live process has in flight (F6)", () => {
+    const dir = tmpdir('att-a1-tidy-');
+    const st = new AttestationStore({ dir, log: () => {} });
+    for (let i = 1; i <= 5; i++) st.record(att(i));
+    const child = require('node:child_process').spawn(process.execPath, ['-e', 'setTimeout(() => {}, 30000)'], { stdio: 'ignore' });
+    try {
+      // Mid-rotation in that process: its temp file written, the old log just linked into archive/.
+      fs.mkdirSync(path.join(dir, 'archive'));
+      const name = `attestations.000000000001.20261002T000000000Z.${child.pid}.jsonl`;
+      fs.linkSync(path.join(dir, ATT), path.join(dir, 'archive', name));
+      fs.writeFileSync(path.join(dir, `${ATT}.${child.pid}.1.rotating`), 'in flight');
+      new AttestationStore({ dir, log: () => {} });
+      assert.deepStrictEqual(archives(dir), [name], 'its archive is left to it');
+      assert.deepStrictEqual(leftovers(dir), [`${ATT}.${child.pid}.1.rotating`], 'and so is its temp file');
+    } finally { child.kill(); }
+  });
+
+  it('a copy-fallback rotation that crashed before the rename leaves no duplicate of the live log in archive/ (F7)', () => {
+    const dir = tmpdir('att-a1-copy-');
+    const st = new AttestationStore({ dir, log: () => {} });
+    for (let i = 1; i <= 5; i++) st.record(att(i));
+    const pid = deadPid();
+    fs.mkdirSync(path.join(dir, 'archive'));
+    // A crash after copying the live log (no hard links) and before replacing it.
+    const dup = `attestations.000000000002.20261002T000000000Z.${pid}.jsonl`;
+    fs.copyFileSync(path.join(dir, ATT), path.join(dir, 'archive', dup));
+    fs.writeFileSync(path.join(dir, `${ATT}.${pid}.7.archiving`), dup);
+    // And an older one whose rotation did replace the live log before the crash: a real archive.
+    const real = `attestations.000000000001.20261002T000000000Z.${pid}.jsonl`;
+    fs.writeFileSync(path.join(dir, 'archive', real), 'the old log\n');
+    fs.writeFileSync(path.join(dir, `${ATT}.${pid}.6.archiving`), real);
+    new AttestationStore({ dir, log: () => {} });
+    assert.deepStrictEqual(archives(dir), [real], 'the copy of the live log is gone, the real archive kept');
+    assert.deepStrictEqual(leftovers(dir), [], 'and the markers are cleared');
+  });
+
+  it('while a copied archive waits for the live log to be replaced, a marker names it (F7)', () => {
+    const dir = tmpdir('att-a1-copy-mark-');
+    const st = new AttestationStore({ dir, max: 20, rotateBytes: 2048, log: () => {} });
+    const realLink = fs.linkSync;
+    const realRename = fs.renameSync;
+    let seen = null;
+    fs.linkSync = () => { throw Object.assign(new Error('no links'), { code: 'EPERM' }); };
+    fs.renameSync = (from, to) => {
+      // The moment a crash would leave a copy of the live log in archive/.
+      const marker = fs.readdirSync(dir).find((n) => n.endsWith('.archiving'));
+      seen = marker && { names: fs.readFileSync(path.join(dir, marker), 'utf8'), archives: archives(dir) };
+      return realRename(from, to);
+    };
+    try { for (let i = 1; st._rotations[ATT] === 0; i++) st.record(att(i)); } finally { fs.linkSync = realLink; fs.renameSync = realRename; }
+    assert.ok(seen, 'a marker existed before the rename');
+    assert.deepStrictEqual(seen.archives, [seen.names], 'naming the copy');
+  });
+
+  it('a copy-fallback rotation that succeeds leaves no marker', () => {
+    const dir = tmpdir('att-a1-copy-ok-');
+    const st = new AttestationStore({ dir, max: 20, rotateBytes: 2048, log: () => {} });
+    const realLink = fs.linkSync;
+    fs.linkSync = () => { throw Object.assign(new Error('no links'), { code: 'EPERM' }); };
+    try { for (let i = 1; st._rotations[ATT] === 0; i++) st.record(att(i)); } finally { fs.linkSync = realLink; }
+    assert.strictEqual(archives(dir).length, 1);
+    assert.deepStrictEqual(leftovers(dir), []);
+  });
+});

From a7e7458f9dc69d30765ca32e75eeb99d29a14951 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Fri, 2 Oct 2026 04:08:41 +0100
Subject: [PATCH 073/148] 0.14.0 CHANGELOG: a Security section for the copied
 room-join grant

0.13.16 and the releases before it that gate rooms admitted anyone who wrote
a copied grant and the key printed in it into its own handshake; 0.14.0 drops
a handshake's provenPublicKey (2e60869). No room is gated by default.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 CHANGELOG.md | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 077725bc..3dc9bc17 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,15 @@ its follow-ups).
 Fixes from the MMP 2.0 conformance audit's open findings, the 0.13.12 known limits, the Windows test
 debt, and the daemon's log flood. Every item has a test that fails without its fix.
 
+### Security
+
+- **A copied room-join grant admitted its holder to a gated room** (0.13.16, and the releases before
+  it that gate rooms). A grant is shown in its grantee's every handshake, so any node that saw one
+  could keep a copy. Writing the grant and the key printed in it into its own handshake (as
+  `provenPublicKey`) admitted that node to the gated room as the grantee, with no proof it held the
+  grantee's key. 0.14.0 drops a `provenPublicKey` that arrives in a handshake (see Fixed — security).
+  A room with no owner, the default, was never gated and is not affected.
+
 ### Fixed — security
 
 - **A relay could replay a signed directed record.** The directed de-duplication mark was the raw

From 560d1dce8546bf09dafe43d3f70d01c242d90ad9 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Fri, 2 Oct 2026 04:08:48 +0100
Subject: [PATCH 074/148] 0.14.0 review: a receiver accepts what earlier
 releases minted

The receive path refused a record with a category over 256 KiB of text,
or over 960 KiB in all, before rendering or verifying it. Those bounds
are new in 0.14.0, and 0.13.16 minted records bounded only by the frame,
so an older peer's sound record became unreceivable, as the agent-id
bound did before (C-F4). The text bounds are now minting rules like the
agent-id bound: createCMB applies them, the receiver applies none beyond
the frame the record arrived in, and a categories-only frame's
evaluation subject is built under none of them. The receive-side
cmb-oversize-rejected metric is gone with the check.

Test: a record exactly as 0.13.16's createCMB mints it (checked against
v0.13.16) with a 296 KiB category, signed under mmp-sig-v2, is admitted,
verified and stored whole; minting the same categories throws ECMBSIZE.

Review C-F4, follow-up.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 CHANGELOG.md                |  6 ++---
 lib/core/cmb-encoder.js     | 26 +++++++++----------
 lib/frame-handler.js        | 16 +++---------
 tests/record-bounds.test.js | 50 ++++++++++++++++++++++++-------------
 4 files changed, 51 insertions(+), 47 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 610d1247..1cda09c7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -82,9 +82,9 @@ debt, and the daemon's log flood. Every item has a test that fails without its f
   expansion, so a record within the text bounds could be one no transport would carry. In plain text
   the frame bound allows about 766 KiB. An agent id is at most 64 bytes (§3.1.2). `createCMB` throws
   `ECMBSIZE`, and so does `remember()`, before anything is stored or sent, for a record or payload
-  that would not fit. A receiver refuses a record over the text bounds before rendering, verifying or
-  storing it. It does not refuse a longer agent id: earlier releases minted those, and refusing them
-  would stop a node hearing such a peer at all.
+  that would not fit. These are minting rules. A receiver applies no record bound beyond the frame a
+  record arrives in: earlier releases minted larger categories and longer agent ids, and refusing
+  them would stop a node hearing such a peer at all.
 - **A served v2.0 record no longer verified (B-R9, part).** `cmb-fetch` now serves a record's
   metadata whole, as a copy.
 - **A frame written to a destroyed socket counted as sent (B-D6, residual).**
diff --git a/lib/core/cmb-encoder.js b/lib/core/cmb-encoder.js
index 2ed95053..8733480e 100644
--- a/lib/core/cmb-encoder.js
+++ b/lib/core/cmb-encoder.js
@@ -457,8 +457,8 @@ function encodeCategory(text) {
  * @param {string} [opts.room] - audience.
  * @param {string|null} [opts.to] - directed recipient's agent id, or null for a broadcast.
  * @param {boolean} [opts.received] - the categories came in a peer's frame and the record is built
- *   only to evaluate them: the receiver's bounds apply (assertRecordSize), not the agent-id and
- *   frame bounds of a record minted to be sent.
+ *   only to evaluate them: none of the bounds of a record minted to be sent apply (text, agent id,
+ *   frame), as none apply to a received record.
  * @throws {RangeError} code ECMBSIZE when a bound is exceeded.
  * @returns {{categories: object, metadata: object}} The two-section record (§7.1): `categories` is what
  *   the agent says, `metadata` is what the mesh proves. No third section exists.
@@ -469,7 +469,9 @@ const DEFAULT_ROOM = 'default';
 const MAX_NAME_BYTES = 64;
 /**
  * Text bounds. The spec says categories are bounded but gives no number. One category is at most a
- * quarter of a 1 MiB frame and the seven at most 960 KiB of text. These hold on mint and on receipt.
+ * quarter of a 1 MiB frame and the seven at most 960 KiB of text. Like the agent-id bound, these are
+ * minting rules. A receiver applies no record bound beyond the frame a record arrives in: releases
+ * before 0.14.0 minted records up to that, and refusing them would stop a node hearing such a peer.
  *
  * They do not by themselves keep a record sendable, because a frame is not text: JSON escapes a `"`
  * as two bytes and a control character as six, and a record sent to a peer with a shared secret
@@ -495,12 +497,8 @@ function sizeError(msg) {
 }
 
 /**
- * Throw ECMBSIZE when a category, or the record's text as a whole, is over its bound. Shared by the
- * emitter and the receiver.
- *
- * The agent id is not checked here. Records minted before 0.14.0 have no bound on it but the frame,
- * so a receiver refusing a longer one would stop hearing a peer whose records are otherwise sound;
- * it is bounded where a record is minted (assertAgentId).
+ * Throw ECMBSIZE when a category, or the record's text as a whole, is over its bound. Run when a
+ * record is minted, never on receipt (see the text bounds above).
  * @param {object} categories
  */
 function assertRecordSize(categories) {
@@ -609,11 +607,13 @@ function createCMB(opts = {}) {
       categories[f] = { text };
     }
   }
-  assertRecordSize(categories);
-  // A record built from a peer's categories-only frame, only to be evaluated, is held to the bounds
-  // a receiver applies and nothing else: it is never sent, and its agent id is the peer's.
+  // A record built from a peer's categories-only frame, only to be evaluated, is held to no minting
+  // bound, as no received record is: it is never sent, and its text and agent id are the peer's.
   const minting = opts.received !== true;
-  if (minting) assertAgentId(createdBy);
+  if (minting) {
+    assertRecordSize(categories);
+    assertAgentId(createdBy);
+  }
 
   // Per-category metadata (§7.3): each category carries its own address and its own semantic
   // descent. This is the section's reason to exist — admission verdicts, anchors, membrane
diff --git a/lib/frame-handler.js b/lib/frame-handler.js
index e5ff350f..1d63e1bf 100644
--- a/lib/frame-handler.js
+++ b/lib/frame-handler.js
@@ -3,7 +3,6 @@
 const crypto = require('crypto');
 
 const { recordKey, recordLineage, recordParents, recordCreatedBy, setRecordLineage } = require('./record');
-const { assertRecordSize } = require('./core/cmb-encoder');
 
 /**
  * @module @sym-bot/sym/frame-handler
@@ -860,18 +859,9 @@ class FrameHandler {
       }
     }
 
-    // Size first: a record over the text bounds is refused before anything renders, verifies or
-    // stores it. Not its agent id: earlier releases minted ids of any length (cmb-encoder).
-    if (msg.cmb?.categories) {
-      try {
-        assertRecordSize(msg.cmb.categories);
-      } catch (err) {
-        if (err.code !== 'ECMBSIZE') throw err;
-        this._node._log(`CMB from ${peerName} refused: ${err.message}`);
-        this._node.emit('metric', { type: 'cmb-oversize-rejected', from: peerName, key: recordKey(msg.cmb), reason: err.message });
-        return;
-      }
-    }
+    // No size bound here beyond the frame the record arrived in. The record bounds are minting
+    // rules (cmb-encoder): earlier releases minted larger categories and longer agent ids, and
+    // refusing those would stop this node hearing such a peer at all.
 
     // Derive content from CMB categories if not present on the frame
     // (MMP Section 7: cmb frames carry structured categories, not necessarily a content string)
diff --git a/tests/record-bounds.test.js b/tests/record-bounds.test.js
index d8e86d27..433a2cd0 100644
--- a/tests/record-bounds.test.js
+++ b/tests/record-bounds.test.js
@@ -3,17 +3,17 @@
 require('./_isolate-home'); // redirect $HOME to a temp sandbox before lib/config loads
 
 /**
- * What a record may carry, on the emitting side and the receiving side alike:
+ * What a record may carry when it is minted, and what a receiver accepts:
  * - B-R10: a record names its room; one that names none is in the literal room 'default' (§7),
  *   not "every room", and a v2.0 record without a room is not signed.
  * - B-R11: mood valence and arousal are measurements in [-1, 1]: absent ones are omitted, not
  *   invented as 0, out-of-range ones are refused, and numbers given without text are kept.
  * - B-R13: a category is at most 256 KiB, the seven together at most 960 KiB, an agent id at most
- *   64 bytes (§3.1.2). Receivers refuse a record over the text bounds.
+ *   64 bytes (§3.1.2), when a record is minted.
  * - 0.14.0 review C-F3: text bytes are not frame bytes (JSON escaping, and the E2E seal's base64), so
  *   a record is minted only when the frame it travels in, sealed, fits MAX_FRAME_SIZE.
- * - 0.14.0 review C-F4: the agent-id bound is a minting rule. A record an earlier release minted
- *   with a longer agent id is not refused on receipt.
+ * - 0.14.0 review C-F4: the record bounds are minting rules. A record an earlier release minted
+ *   with a longer agent id or a larger category is not refused on receipt: the frame bounds it.
  * - B-R3 (interim): an unsigned record is accepted as unverified, counted, and named once per peer.
  */
 
@@ -22,7 +22,7 @@ const assert = require('node:assert');
 const fs = require('fs');
 const crypto = require('crypto');
 const { createCMB, checkAudience, signCMB, encryptCategories, assertionIdV2_0 } = require('../lib/core');
-const { MAX_CATEGORY_BYTES, MAX_RECORD_TEXT_BYTES, recordFrameBytes } = require('../lib/core/cmb-encoder');
+const { MAX_CATEGORY_BYTES, MAX_RECORD_TEXT_BYTES, recordFrameBytes, categoryKeyV1, blockKeyV2, CAT7_CATEGORIES } = require('../lib/core/cmb-encoder');
 const { MAX_FRAME_SIZE, writeFrame } = require('../lib/frame-parser');
 const { signingPayloadV2_0 } = require('../lib/core/cmb-signing');
 const { SymNode } = require('../lib/node');
@@ -164,16 +164,33 @@ describe('on receipt', () => {
     try { return fn(node, metrics, lines); } finally { fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
   }
 
-  it('refuses an oversized record before it is verified, stored or surfaced', () => {
-    withNode((node, metrics) => {
-      const cmb = createCMB({ categories: { focus: 'fine' }, createdBy: 'peer-a' });
-      cmb.categories.focus.text = 'a'.repeat(MAX_CATEGORY_BYTES + 1); // a peer that skipped the bound
-      let surfaced = 0;
-      node.on('cmb-accepted', () => surfaced++);
-      node._frameHandler.handle('peer-a', 'peer-a', { type: 'cmb', cmb, timestamp: Date.now() });
-      assert.ok(metrics.some((m) => m.type === 'cmb-oversize-rejected'));
-      assert.strictEqual(surfaced, 0);
-    });
+  it('accepts a record an earlier release minted with a category over 256 KiB (0.14.0 review C-F4)', async () => {
+    // Exactly the record 0.13.16's createCMB mints for these categories (checked against it): no
+    // text bound but the frame, signed under mmp-sig-v2. This release would not mint it.
+    const name = `bounds-bigcat-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+    const node = new SymNode({ name, silent: true, discovery: new NullDiscovery() });
+    await node.start();
+    try {
+      const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519', { publicKeyEncoding: { type: 'spki', format: 'der' }, privateKeyEncoding: { type: 'pkcs8', format: 'der' } });
+      node._pinPeerKey('peer-old', publicKey.slice(-32).toString('base64url'));
+      const texts = { focus: 'b'.repeat(MAX_CATEGORY_BYTES + 40 * 1024), issue: 'a large category from an older peer' };
+      const categories = {};
+      for (const f of CAT7_CATEGORIES) {
+        const text = texts[f] || 'neutral';
+        categories[f] = { text, meta: { key: categoryKeyV1(f, text), parents: [] } };
+      }
+      const cmb = { categories, metadata: { key: blockKeyV2(categories), createdBy: 'peer-old', createdTimestamp: Date.now(), lineage: null, room: node._room, to: null } };
+      signCMB(cmb, privateKey.slice(-32).toString('base64url'));
+      assert.throws(() => createCMB({ categories: texts, createdBy: 'peer-old' }), (e) => e.code === 'ECMBSIZE', 'this release does not mint it');
+
+      const accepted = [];
+      node.on('cmb-accepted', (e) => accepted.push(e));
+      await node._frameHandler.handle('peer-old', 'peer-old', { type: 'cmb', timestamp: Date.now(), cmb });
+      await settle();
+      assert.strictEqual(accepted.length, 1, 'admitted');
+      assert.strictEqual(accepted[0]._cmbVerified, true, 'and verified');
+      assert.strictEqual(node._store.get(cmb.metadata.key)?.cmb.categories.focus.text.length, texts.focus.length, 'stored whole');
+    } finally { await node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
   });
 
   it('accepts a record an earlier release minted with an agent id over 64 bytes (0.14.0 review C-F4)', async () => {
@@ -192,13 +209,10 @@ describe('on receipt', () => {
       signCMB(cmb, peer.priv);
       assert.throws(() => createCMB({ categories: { focus: 'x' }, createdBy: longId }), (e) => e.code === 'ECMBSIZE', 'this release does not mint one');
 
-      const metrics = [];
-      node.on('metric', (m) => metrics.push(m));
       const accepted = [];
       node.on('cmb-accepted', (e) => accepted.push(e));
       await node._frameHandler.handle('peer-long', 'peer-long', { type: 'cmb', timestamp: Date.now(), cmb });
       await settle();
-      assert.strictEqual(metrics.filter((m) => m.type === 'cmb-oversize-rejected').length, 0, 'not refused as oversized');
       assert.strictEqual(accepted.length, 1, 'admitted');
       assert.strictEqual(accepted[0].author.name, longId);
       assert.strictEqual(accepted[0]._cmbVerified, true, 'and verified');

From 31654332cee79378e418aa288e258705e1e4ed7c Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Fri, 2 Oct 2026 04:09:40 +0100
Subject: [PATCH 075/148] 0.14.0 review: cmb-fetch serves a record exactly as
 signed

_handleCmbFetch served a two-section record's categories as text (and
mood's values) only, dropping each category's `meta`. The signature
commits to every category's parents (categoryParentsCommitment), so a
record minted with per-category parents failed verification at the
requester that fetched it. A two-section record is now served as
recordAsSigned returns it: the metadata whole and each category's text,
signed `meta` and mood values, as a copy, never a vector. A pre-boundary
record is served as before.

Test: a record minted with categoryParents and stored with a vector
beside its text is fetched; the served copy carries each category's meta,
no vector, exactly two sections, and verifies at the requester.

lib/frame-handler.js is part B's file; the hunk is the served value, its
comments and the import.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 CHANGELOG.md                      |  6 ++++--
 lib/frame-handler.js              | 19 ++++++++++-------
 tests/cmb-fetch-serves-v2.test.js | 35 +++++++++++++++++++++++++++++++
 3 files changed, 50 insertions(+), 10 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1cda09c7..aac662fe 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -85,8 +85,10 @@ debt, and the daemon's log flood. Every item has a test that fails without its f
   that would not fit. These are minting rules. A receiver applies no record bound beyond the frame a
   record arrives in: earlier releases minted larger categories and longer agent ids, and refusing
   them would stop a node hearing such a peer at all.
-- **A served v2.0 record no longer verified (B-R9, part).** `cmb-fetch` now serves a record's
-  metadata whole, as a copy.
+- **A served v2.0 record no longer verified (B-R9, part).** `cmb-fetch` now serves a record's two
+  sections exactly as signed, as a copy: the metadata whole, and each category with its `meta`. Text
+  alone dropped the per-category parents the signature commits to, so a record that declared them
+  failed verification at the requester.
 - **A frame written to a destroyed socket counted as sent (B-D6, residual).**
 - **A send that failed for any reason was reported as "not connected".** `sendFrame` and the
   transports returned one `false` for a frame over the bound, a closed socket and a failed write.
diff --git a/lib/frame-handler.js b/lib/frame-handler.js
index 1d63e1bf..89a7ddfc 100644
--- a/lib/frame-handler.js
+++ b/lib/frame-handler.js
@@ -23,7 +23,7 @@ const { recordKey, recordLineage, recordParents, recordCreatedBy, setRecordLinea
 
 const fs = require('fs');
 const path = require('path');
-const { encode, processHeuristicSVAF, buildFusedRecord, computeCategoryVerdicts, decryptCategories, resolveTetherAnchor, tetherOfRecord, signTetherAttestation, verifyTetherAttestation, classifyAddress, categoriesAsSigned } = require('./core');
+const { encode, processHeuristicSVAF, buildFusedRecord, computeCategoryVerdicts, decryptCategories, resolveTetherAnchor, tetherOfRecord, signTetherAttestation, verifyTetherAttestation, classifyAddress, categoriesAsSigned, recordAsSigned } = require('./core');
 
 /** Entry members this node writes about an admission, which a frame must never supply. */
 const ENTRY_ANNOTATIONS = Object.freeze(['admission', 'tether', 'provenance', 'collapsed', 'svaf']);
@@ -714,9 +714,10 @@ class FrameHandler {
    * recompute the tether). Serving is discretionary and same-room by
    * construction (only connected peers can ask); the response is self-verifying
    * (the requester recomputes the content address), so no trust is extended by
-   * serving and none is required of the server. Categories are served TEXT-ONLY:
-   * the content address binds text, and re-verifiers re-encode in their own
-   * kernel — vectors are dead weight.
+   * serving and none is required of the server. A record is served as signed
+   * (recordAsSigned): each category's text, its signed `meta` and mood's values, never
+   * a vector — the content address binds text, and re-verifiers re-encode in their
+   * own kernel, so vectors are dead weight.
    * @private
    */
   _handleCmbFetch(peerId, peerName, msg) {
@@ -727,6 +728,7 @@ class FrameHandler {
     const cmb = entry?.cmb;
     let served = null;
     if (cmb && cmb.categories && typeof cmb.categories === 'object') {
+      // A pre-boundary record's categories, served text-only (below).
       const categories = {};
       for (const [f, v] of Object.entries(cmb.categories)) {
         if (v && typeof v === 'object') {
@@ -744,12 +746,13 @@ class FrameHandler {
       // self-verifying, so the requester would recompute the address and refuse it.
       // A pre-boundary record is served in the shape it was stored in: the legacy DAG stays
       // readable and is never re-keyed (§7.8).
-      // The metadata is served WHOLE, as stored. Picking fields dropped the v2.0 ones
-      // (signatureSuite, addressScheme, createdByNodeId, application, assertionId), and a v2.0
-      // record without them no longer verifies at the requester. It is a copy, never the store's object.
+      // The two sections are served exactly as signed, as a copy. Picking metadata fields dropped
+      // the v2.0 ones (signatureSuite, addressScheme, createdByNodeId, application, assertionId), and
+      // serving categories as text alone dropped each category's `meta`, whose parents the signature
+      // commits to: either way the requester could not verify what it fetched.
       const m = cmb.metadata;
       served = m
-        ? { categories, metadata: structuredClone(m) }
+        ? recordAsSigned(cmb)
         : {
             key: cmb.key, createdBy: cmb.createdBy, createdAt: cmb.createdAt,
             categories, lineage: cmb.lineage ?? null,
diff --git a/tests/cmb-fetch-serves-v2.test.js b/tests/cmb-fetch-serves-v2.test.js
index d22eb8b0..40aa9eb9 100644
--- a/tests/cmb-fetch-serves-v2.test.js
+++ b/tests/cmb-fetch-serves-v2.test.js
@@ -6,6 +6,10 @@ require('./_isolate-home'); // redirect $HOME to a temp sandbox before lib/confi
  * B-R9 (part): cmb-fetch serves the record as stored. A served v2.0 record (mmp-sig-v2.0) must keep
  * signatureSuite, addressScheme, createdByNodeId, application and assertionId, or the requester
  * cannot verify it.
+ *
+ * The categories are served as signed too, each with its `meta` (0.14.0 review): the signature
+ * commits to every category's parents, and serving text alone made a record with per-category
+ * parents fail verification at the requester.
  */
 
 const { describe, it } = require('node:test');
@@ -45,4 +49,35 @@ describe('cmb-fetch serving', () => {
       assert.notStrictEqual(cmb.metadata.key, 'tampered', 'the store keeps its own copy');
     } finally { fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
   });
+
+  it('a served record with per-category parents still verifies, and carries no vector', () => {
+    const name = `fetchcp-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+    const node = new SymNode({ name, silent: true, discovery: new NullDiscovery() });
+    try {
+      const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519', {
+        publicKeyEncoding: { type: 'spki', format: 'der' }, privateKeyEncoding: { type: 'pkcs8', format: 'der' },
+      });
+      const pub = publicKey.slice(-32).toString('base64url');
+      const parent = createCMB({ categories: { focus: 'the issue it descends from', issue: 'an earlier issue' }, createdBy: 'alice' });
+      const cmb = createCMB({
+        categories: { focus: 'continues its own line', issue: 'descends from the peer\'s issue' },
+        createdBy: 'alice',
+        categoryParents: { issue: [parent.categories.issue.meta.key], focus: [parent.categories.focus.meta.key] },
+      });
+      signCMB(cmb, privateKey.slice(-32).toString('base64url'));
+      assert.strictEqual(verifyCMB(cmb, pub).valid, true, 'precondition: the stored record verifies');
+      // As a store may hold it after a gate measured it: a vector beside the text.
+      const stored = JSON.parse(JSON.stringify(cmb));
+      stored.categories.focus.vector = [0.1, 0.2];
+      node._store.get = (k) => (k === cmb.metadata.key ? { key: k, cmb: stored } : null);
+      const sent = [];
+      node._peers.set('peer-r', { peerId: 'peer-r', name: 'requester', transport: { send: (f) => { sent.push(f); return true; } } });
+      node._frameHandler._handleCmbFetch('peer-r', 'requester', { type: 'cmb-fetch', key: cmb.metadata.key, reqId: 'r2' });
+      const served = JSON.parse(JSON.stringify(sent.find((f) => f.type === 'cmb-fetch-result').cmb));
+      assert.deepStrictEqual(served.categories.issue.meta.parents, [parent.categories.issue.meta.key], 'each category\'s signed meta is served');
+      assert.strictEqual(verifyCMB(served, pub).valid, true, 'the served record verifies at the requester');
+      assert.strictEqual('vector' in served.categories.focus, false, 'vectors stay local');
+      assert.deepStrictEqual(Object.keys(served).sort(), ['categories', 'metadata']);
+    } finally { fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+  });
 });

From 6e71b2a57593b26c9167b3b0d5d4c22359a7e077 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Fri, 2 Oct 2026 04:12:29 +0100
Subject: [PATCH 076/148] 0.14.0: attestation archive retention is
 configurable; one writer per directory stated

archive/ keeps 128 MiB per log by default, now set by the store's
archiveMaxBytes (SymNode: attestationArchiveMaxBytes) or, when that is not
given, SYM_ATTESTATION_ARCHIVE_MAX_BYTES; 0 keeps every archive. A value that
is not a whole number of bytes >= 0 falls back to the default, said once.
The store's header, docs/reference.md and the CHANGELOG state the trade-off:
rotation keeps the live log bounded, archives hold older history and are
pruned oldest first past the bound unless it is 0, and whoever needs the
whole audit trail sets 0 and owns the disk. (The unreleased maxArchiveBytes
option is renamed archiveMaxBytes.)

The header also states the single-writer contract: the store lives in its
node's directory, and the identity lock admits one process per node; the
start-up tidy tolerates a second live process only defensively.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 CHANGELOG.md                        |  7 +++
 docs/reference.md                   | 17 +++++
 lib/attestation-store.js            | 43 ++++++++++---
 lib/node.js                         |  3 +
 tests/attestation-retention.test.js | 97 +++++++++++++++++++++++++++++
 tests/attestation-rotation.test.js  | 16 ++---
 6 files changed, 167 insertions(+), 16 deletions(-)
 create mode 100644 tests/attestation-retention.test.js

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3dc9bc17..b0245d46 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -144,6 +144,13 @@ debt, and the daemon's log flood. Every item has a test that fails without its f
   log already over its budget is rotated at once: the storm's 257 MB `witnesses.jsonl` is archived and,
   being over 128 MiB, deleted.
 
+  **The bound is configurable**, and the trade-off is yours. Rotation keeps the live log bounded
+  either way. The archives hold the older history and are pruned oldest first past the bound, unless
+  it is 0, which keeps every archive. Anyone who needs the whole audit trail sets 0 and owns the disk
+  it takes. Set it with `SYM_ATTESTATION_ARCHIVE_MAX_BYTES` (bytes per log), or with
+  `attestationArchiveMaxBytes` on `SymNode` (`archiveMaxBytes` on the store). A value that is not a
+  number of bytes ≥ 0 falls back to 128 MiB, and that is said once.
+
 ### Fixed — SVAF and the store
 
 - Anchor vectors are measured through a side map and are never written onto stored records, where a
diff --git a/docs/reference.md b/docs/reference.md
index 337c0fb7..e326163c 100644
--- a/docs/reference.md
+++ b/docs/reference.md
@@ -296,6 +296,23 @@ const node = new SymNode({
 });
 ```
 
+### The attestation audit trail: how much history is kept
+
+Every node keeps the admission attestations, checkpoints and witnesses it holds in `attestations/` in
+its node directory. Rotation keeps each live log bounded. When a log is rotated, the old one moves
+whole into `attestations/archive/`, and the archives hold the older history. They are pruned oldest
+first once a log's archives pass a bound: **128 MiB per log** by default, the newest archive included.
+**0 keeps every archive.** If you need the whole audit trail, set 0 and own the disk it takes.
+
+| Setting | Where | Meaning |
+|---------|-------|---------|
+| `SYM_ATTESTATION_ARCHIVE_MAX_BYTES` | environment (the daemon, any node) | bytes of archive kept per log; `0` keeps every archive |
+| `attestationArchiveMaxBytes` | `new SymNode({ ... })` | the same, for one node; wins over the environment |
+
+A value that is not a whole number of bytes ≥ 0 falls back to 128 MiB, and the node says so once in
+its log. One process writes a node's `attestations/` directory: the node's identity lock admits one
+process per node.
+
 ### CAT7 — the 7 universal fields
 
 Every memory block on the mesh is decomposed into 7 immutable fields. Per-agent weights decide which matter most to *your* agent:
diff --git a/lib/attestation-store.js b/lib/attestation-store.js
index b517b05d..699381b4 100644
--- a/lib/attestation-store.js
+++ b/lib/attestation-store.js
@@ -35,10 +35,19 @@
  * has been appended and dropped. A rotation writes the records held to a temp file (fully, then
  * fsynced), links the old log into `archive/` under a name no other rotation can take, and renames
  * the temp file over the live log: the live path holds a complete log at every instant, and a failure
- * at any step leaves it as it was. `archive/` keeps at most `maxArchiveBytes` per log, the newest
- * archive included, dropping the oldest first. A log is never edited in place, and a log that could
- * not be read at start is never rotated. A rotation writes back the witnesses read from the log that
- * still wait for their checkpoint.
+ * at any step leaves it as it was. A log is never edited in place, and a log that could not be read
+ * at start is never rotated. A rotation writes back the witnesses read from the log that still wait
+ * for their checkpoint.
+ *
+ * Retention, plainly: rotation keeps each live log bounded; the archives hold the older history. They
+ * are pruned oldest first once a log's archives exceed `archiveMaxBytes` (128 MiB by default, the
+ * newest archive included, so an archive larger than the bound on its own is deleted too), and never
+ * when it is 0. Whoever needs the whole audit trail sets 0 (or SYM_ATTESTATION_ARCHIVE_MAX_BYTES=0)
+ * and owns the disk it takes.
+ *
+ * One writer per directory is the contract, by construction: the store lives in its node's directory
+ * (`<node>/attestations`), and the node's identity lock admits one process per node. The start-up
+ * tidy tolerates a second live process on the same directory only defensively; nothing else does.
  *
  * This store does NOT verify signatures or roster membership — the caller verifies
  * before recording (a recorded attestation is assumed already verified). It only
@@ -75,6 +84,8 @@ const ATT_LINE = 720;
 const CP_LINE = 448;
 const WIT_LINE = 448;
 const OWN_LINE = 2560;
+/** archive/ keeps at most this many bytes per log unless configured (0 keeps every archive). */
+const ARCHIVE_MAX_DEFAULT = 128 * 1024 * 1024;
 /** A rotation writes the held records in chunks of about this many characters. */
 const WRITE_CHUNK = 1 << 20;
 
@@ -158,8 +169,10 @@ class AttestationStore {
    *   has its own, sized to what its cap holds.
    * @param {number} [opts.rotateBytes=8 MiB] a log is rotated once the bytes in it beyond the records
    *   held exceed the larger of this and the bytes of the records held.
-   * @param {number} [opts.maxArchiveBytes=128 MiB] `archive/` keeps at most this much per log,
-   *   the newest archive included; the oldest go first.
+   * @param {number} [opts.archiveMaxBytes=128 MiB] `archive/` keeps at most this much per log, the
+   *   newest archive included, the oldest pruned first; 0 keeps every archive. When not given,
+   *   SYM_ATTESTATION_ARCHIVE_MAX_BYTES is read; a value that is not a number of bytes ≥ 0 falls back
+   *   to the default, which is said once.
    * @param {function(string):void} [opts.log] where a rotation failure is said (once per distinct error).
    * @param {string} [opts.dir] when set, the store persists records as append-only
    *   JSONL under this dir and reloads them on construction — so the audit trail
@@ -208,7 +221,6 @@ class AttestationStore {
     this._dir = opts.dir || null;
     this._loading = false;
     this._rotateBytes = opts.rotateBytes || 8 * 1024 * 1024;
-    this._maxArchiveBytes = opts.maxArchiveBytes ?? 128 * 1024 * 1024;
     this._logFn = typeof opts.log === 'function' ? opts.log : (m) => console.error(`[SYM] attestations: ${m}`);
     const perLog = (v) => ({ [ATT_FILE]: v, [CP_FILE]: v, [WIT_FILE]: v });
     this._held = perLog(0);        // bytes of the records held, as the lines a rotation writes
@@ -222,6 +234,7 @@ class AttestationStore {
     this._said = new Set();        // rotation errors already said
     this._unread = new Set();      // logs that could not be read at start: never rotated or rewritten
     this._respelled = 0;           // attestations read from a log with a signature not spelled canonically
+    this._maxArchiveBytes = this._archiveBound(opts.archiveMaxBytes, process.env.SYM_ATTESTATION_ARCHIVE_MAX_BYTES);
     // At start, each log is read up to a budget that covers what its caps hold, and of a larger log
     // only its newest part. A record can stay held while newer ones churn past it (a quiet attester's
     // attestations or checkpoints, a quiet position's witnesses), so each log is read whole: what the
@@ -870,10 +883,24 @@ class AttestationStore {
     return out.sort((a, b) => a.seq - b.seq || cmp(a.stamp, b.stamp) || a.pid - b.pid || cmp(a.name, b.name));
   }
 
-  /** @private Keep at most `maxArchiveBytes` of one log's archives, the newest included: the oldest
+  /** @private The archive bound: the option, else the environment, else 128 MiB; 0 keeps every
+   *  archive. A value that is not a number of bytes ≥ 0 is not used, and that is said once. */
+  _archiveBound(option, env) {
+    const configured = option !== undefined ? option : env;
+    if (configured === undefined || configured === null || configured === '') return ARCHIVE_MAX_DEFAULT;
+    const n = typeof configured === 'number' ? configured
+      : (typeof configured === 'string' && /^\s*\d+\s*$/.test(configured) ? Number(configured) : NaN);
+    if (Number.isFinite(n) && n >= 0) return Math.floor(n);
+    const from = option !== undefined ? 'archiveMaxBytes' : 'SYM_ATTESTATION_ARCHIVE_MAX_BYTES';
+    this._say(`archive-bound|${from}`, `${from}=${JSON.stringify(configured)} is not a number of bytes ≥ 0; archive/ keeps ${ARCHIVE_MAX_DEFAULT} bytes per log`);
+    return ARCHIVE_MAX_DEFAULT;
+  }
+
+  /** @private Keep at most `archiveMaxBytes` of one log's archives, the newest included: the oldest
    *  go first, and one that alone exceeds the bound goes too. A failed unlink stops the prune (a newer
    *  archive is never deleted before an older one); it is said once and retried at the next rotation. */
   _pruneArchive(base) {
+    if (this._maxArchiveBytes === 0) return;   // 0: every archive is kept
     try {
       const files = [];
       for (const f of this._archives(path.join(this._dir, ARCHIVE_DIR), base)) {
diff --git a/lib/node.js b/lib/node.js
index 9c2f4093..ee0c7c36 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -304,6 +304,9 @@ class SymNode extends EventEmitter {
       dir: path.join(this._dir, 'attestations'),
       selfId: this._identity.nodeId,
       log: (m) => this._log(`[attestations] ${m}`),
+      // archive/ retention per log (bytes; 0 keeps every archive). Unset: SYM_ATTESTATION_ARCHIVE_MAX_BYTES,
+      // else 128 MiB.
+      archiveMaxBytes: opts.attestationArchiveMaxBytes,
     });
     // Each peer's budget of new gossiped statements (see GOSSIP_PER_SECOND); `opts.gossipBudget`
     // ({ perSecond, burst }) changes it.
diff --git a/tests/attestation-retention.test.js b/tests/attestation-retention.test.js
new file mode 100644
index 00000000..e972ec71
--- /dev/null
+++ b/tests/attestation-retention.test.js
@@ -0,0 +1,97 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME to a temp sandbox before lib/config loads
+
+/**
+ * Retention of the attestation audit trail. Rotation keeps each live log bounded; archive/ holds the
+ * older history and is pruned oldest first past `archiveMaxBytes` (128 MiB per log by default), and
+ * never when it is 0. The bound is the store's option (SymNode's `attestationArchiveMaxBytes`), else
+ * SYM_ATTESTATION_ARCHIVE_MAX_BYTES; a value that is not a number of bytes ≥ 0 falls back to the
+ * default, which is said once.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('fs');
+const path = require('path');
+const { tmpdir } = require('./_tmpdir');
+const { AttestationStore } = require('../lib/attestation-store');
+
+const ATT = 'attestations.jsonl';
+const DEFAULT = 128 * 1024 * 1024;
+const att = (i) => ({ of: `cmb-${i}`, by: 'A', seq: i, prev: 'p', sig: `sig-${i}`, pad: 'x'.repeat(60) });
+const archives = (dir) => { try { return fs.readdirSync(path.join(dir, 'archive')).sort(); } catch { return []; } };
+const archiveBytes = (dir) => archives(dir).reduce((n, f) => n + fs.statSync(path.join(dir, 'archive', f)).size, 0);
+
+function withEnv(value, fn) {
+  const had = Object.prototype.hasOwnProperty.call(process.env, 'SYM_ATTESTATION_ARCHIVE_MAX_BYTES');
+  const prev = process.env.SYM_ATTESTATION_ARCHIVE_MAX_BYTES;
+  if (value === undefined) delete process.env.SYM_ATTESTATION_ARCHIVE_MAX_BYTES; else process.env.SYM_ATTESTATION_ARCHIVE_MAX_BYTES = value;
+  try { return fn(); } finally { if (had) process.env.SYM_ATTESTATION_ARCHIVE_MAX_BYTES = prev; else delete process.env.SYM_ATTESTATION_ARCHIVE_MAX_BYTES; }
+}
+
+/** Rotate the attestation log `n` times; returns the store. */
+function rotate(dir, n, extra = {}) {
+  const st = new AttestationStore({ dir, max: 20, rotateBytes: 2048, log: () => {}, ...extra });
+  for (let i = 1; st._rotations[ATT] < n; i++) st.record(att(i));
+  return st;
+}
+
+describe('attestation archive retention', () => {
+  it('0 keeps every archive, however many rotations', () => {
+    const dir = tmpdir('att-keep-all-');
+    const st = rotate(dir, 40, { archiveMaxBytes: 0 });
+    assert.equal(archives(dir).length, 40, 'one archive per rotation, none pruned');
+    assert.ok(archiveBytes(dir) > 40 * 2048);
+    assert.equal(st._maxArchiveBytes, 0);
+    // And a later start does not prune them either.
+    new AttestationStore({ dir, max: 20, rotateBytes: 2048, archiveMaxBytes: 0, log: () => {} });
+    assert.equal(archives(dir).length, 40);
+  });
+
+  it('a small bound prunes oldest first, from the option or from the environment', () => {
+    for (const [label, extra, env] of [['option', { archiveMaxBytes: 12 * 1024 }, undefined], ['environment', {}, String(12 * 1024)]]) {
+      withEnv(env, () => {
+        const dir = tmpdir('att-small-bound-');
+        const st = rotate(dir, 40, extra);
+        assert.equal(st._maxArchiveBytes, 12 * 1024, label);
+        assert.ok(archiveBytes(dir) <= 12 * 1024, `${label}: ${archiveBytes(dir)}`);
+        const seqs = archives(dir).map((n) => Number(n.split('.')[1]));
+        assert.deepEqual(seqs, seqs.slice().sort((a, b) => a - b));
+        assert.equal(seqs.at(-1), 40, `${label}: the newest archives are the ones kept`);
+        assert.ok(seqs[0] > 1, `${label}: the oldest went`);
+      });
+    }
+  });
+
+  it('the option wins over the environment, and 0 in the environment keeps everything', () => {
+    withEnv('0', () => {
+      const dir = tmpdir('att-env-zero-');
+      rotate(dir, 30);
+      assert.equal(archives(dir).length, 30);
+      assert.equal(new AttestationStore({ archiveMaxBytes: 5000, log: () => {} })._maxArchiveBytes, 5000);
+    });
+  });
+
+  it('a value that is not a number of bytes ≥ 0 uses the default, and says so once', () => {
+    for (const [option, env] of [[-5, undefined], ['lots', undefined], [Number.NaN, undefined], [undefined, 'abc'], [undefined, '-1'], [undefined, '1.5e3']]) {
+      withEnv(env, () => {
+        const said = [];
+        const dir = tmpdir('att-bad-bound-');
+        const st = new AttestationStore({ dir, archiveMaxBytes: option, log: (m) => said.push(m) });
+        assert.equal(st._maxArchiveBytes, DEFAULT, `${String(option)} / ${env}`);
+        assert.equal(said.filter((m) => /is not a number of bytes/.test(m)).length, 1, said.join('\n'));
+      });
+    }
+    withEnv(undefined, () => assert.equal(new AttestationStore({ log: () => {} })._maxArchiveBytes, DEFAULT, 'unset: the default'));
+  });
+
+  it("a SymNode passes `attestationArchiveMaxBytes` to its store", () => {
+    const { SymNode } = require('../lib/node');
+    const { NullDiscovery } = require('../lib/discovery');
+    const { nodeDir } = require('../lib/config');
+    const name = `retention-${Date.now()}`;
+    const node = new SymNode({ name, silent: true, discovery: new NullDiscovery(), attestationArchiveMaxBytes: 0 });
+    try { assert.equal(node._attestations._maxArchiveBytes, 0); } finally { fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+  });
+});
diff --git a/tests/attestation-rotation.test.js b/tests/attestation-rotation.test.js
index da400a40..8ada78e9 100644
--- a/tests/attestation-rotation.test.js
+++ b/tests/attestation-rotation.test.js
@@ -43,7 +43,7 @@ describe('attestation log rotation — when', () => {
   it('does not cascade when the records held exceed the budget', () => {
     const dir = tmpdir('att-rot-cascade-');
     // 200 held attestations are ~24 KB, twelve times the 2 KB budget.
-    const st = new AttestationStore({ dir, max: 200, rotateBytes: 2048, maxArchiveBytes: 1e9, log: () => {} });
+    const st = new AttestationStore({ dir, max: 200, rotateBytes: 2048, archiveMaxBytes: 1e9, log: () => {} });
     let appended = 0;
     const at = spyRotations(st, () => appended);
     for (let i = 1; i <= 3000; i++) { const a = att(i); st.record(a); appended += Buffer.byteLength(lineOf(a)); }
@@ -96,11 +96,11 @@ describe('attestation log rotation — at start', () => {
     const copies = [];
     for (let i = 0; i < 5000; i++) copies.push(lineOf({ type: 'witness', attester: 'A', upto_seq: 8, root: 'r8', by: 'W', sig: `copy-${i % 2}`, at: i % 2 }));
     fs.writeFileSync(path.join(dir, WIT), copies.join(''));
-    const st = new AttestationStore({ dir, rotateBytes: 8192, maxArchiveBytes: 1e9, log: () => {} });
+    const st = new AttestationStore({ dir, rotateBytes: 8192, archiveMaxBytes: 1e9, log: () => {} });
     assert.strictEqual(st._rotations[WIT], 1);
     assert.strictEqual(read(dir, WIT), copies[0], 'the live log holds the one witness held');
     assert.strictEqual(fs.readFileSync(path.join(dir, 'archive', archives(dir)[0]), 'utf8'), copies.join(''), 'the old log is archived whole');
-    const again = new AttestationStore({ dir, rotateBytes: 8192, maxArchiveBytes: 1e9, log: () => {} });
+    const again = new AttestationStore({ dir, rotateBytes: 8192, archiveMaxBytes: 1e9, log: () => {} });
     assert.strictEqual(again._rotations[WIT], 0, 'and the next start leaves it alone');
     assert.strictEqual(again.witnessesFor('A', 8).length, 1);
   });
@@ -169,7 +169,7 @@ describe('attestation log rotation — how', () => {
   function nearRotation(extra = {}) {
     const dir = tmpdir('att-rot-fail-');
     const said = [];
-    const st = new AttestationStore({ dir, max: 20, rotateBytes: 2048, maxArchiveBytes: 1e9, log: (m) => said.push(m), ...extra });
+    const st = new AttestationStore({ dir, max: 20, rotateBytes: 2048, archiveMaxBytes: 1e9, log: (m) => said.push(m), ...extra });
     let i = 0;
     st.record(att(++i));
     while (fs.statSync(path.join(dir, ATT)).size - st._held[ATT] + 130 <= Math.max(2048, st._held[ATT])) st.record(att(++i));
@@ -245,7 +245,7 @@ describe('attestation log rotation — how', () => {
       assert.ok(made >= 3, `${made} rotations`);
       assert.strictEqual(archives(dir).length, made, 'one archive per rotation');
       // A second store on the same directory rotating in turn with the first.
-      const other = new AttestationStore({ dir, max: 20, rotateBytes: 2048, maxArchiveBytes: 1e9, log: () => {} });
+      const other = new AttestationStore({ dir, max: 20, rotateBytes: 2048, archiveMaxBytes: 1e9, log: () => {} });
       let j = 100000;
       while (other._rotations[ATT] < 2) other.record(att(++j, 'B'));
       while (st._rotations[ATT] < made + 2) st.record(next());
@@ -280,7 +280,7 @@ describe('attestation log rotation — the archive bound', () => {
   it('holds including the newest archive', () => {
     const dir = tmpdir('att-rot-bound-');
     const bound = 12 * 1024;
-    const st = new AttestationStore({ dir, max: 20, rotateBytes: 2048, maxArchiveBytes: bound, log: () => {} });
+    const st = new AttestationStore({ dir, max: 20, rotateBytes: 2048, archiveMaxBytes: bound, log: () => {} });
     const at = spyRotations(st, () => 0);
     for (let i = 1; i <= 3000; i++) {
       st.record(att(i));
@@ -292,7 +292,7 @@ describe('attestation log rotation — the archive bound', () => {
 
   it('an archive that alone exceeds the bound is dropped too', () => {
     const dir = tmpdir('att-rot-bound1-');
-    const st = new AttestationStore({ dir, max: 20, rotateBytes: 2048, maxArchiveBytes: 1024, log: () => {} });
+    const st = new AttestationStore({ dir, max: 20, rotateBytes: 2048, archiveMaxBytes: 1024, log: () => {} });
     for (let i = 1; i <= 200; i++) st.record(att(i));
     assert.ok(st._rotations[ATT] >= 1);
     assert.deepStrictEqual(archives(dir), [], 'nothing over the bound is kept, the newest included');
@@ -309,7 +309,7 @@ describe('attestation log rotation — the archive bound', () => {
       // Equal times for 9, 10 and 11; the newest made to look the oldest.
       fs.utimesSync(p, t, seq === 11 ? new Date('2026-09-01T00:00:00Z') : t);
     }
-    new AttestationStore({ dir, maxArchiveBytes: 2100, log: () => {} });   // a start holds the bound
+    new AttestationStore({ dir, archiveMaxBytes: 2100, log: () => {} });   // a start holds the bound
     assert.deepStrictEqual(archives(dir), [name(10), name(11)], 'the two newest by sequence are kept');
   });
 });

From e421ce8d4b5da3bcb05a0317911833b4ab80d94d Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Fri, 2 Oct 2026 07:22:50 +0100
Subject: [PATCH 077/148] 0.14.0 review A2: signed gossip is budgeted per
 connection, role grants included

F1: role grants were outside the gossip budget and de-duplicated by the
signature as written, so one captured grant re-spelled (padding, whitespace,
a +/ swap; each verifies) was stored, appended and relayed again for every
spelling, by every node. _ingestRoleGrant now refuses in the same order as
the other statements (malformed, non-canonical spelling, a repeat by the
signature's bytes, a grantor whose key is not held) before it spends the
budget. RoleGrantStore dedups on sigKey, keeps the canonical spelling, and
bounds what it keeps (1,024 per grantor, 64 per grantor and grantee, 65,536
in all; the anchor exempt), refusing before verification and never evicting.

F2: the budget was keyed by the peer id a sender declares, and a new id
started with the whole burst. It is now kept per lane: one per TCP
connection, and the relay connection plus the sender id it names over the
relay. A new lane starts with 100 tokens and earns the rest at 2,000/s up to
10,000, and every lane draws on one ceiling of 4,000/s after 20,000. Drops by
the ceiling are said in one report (gossip-over-ceiling), and the frame
handler's attestation drop line is keyed per connection, not per id.

F4: _sayDrops contains its log and metric sink (the counts reset first), and
stop() cannot be cut short by a report.

F5: a signature over 128 characters is malformed on every ingest path,
before it is decoded or looked up; an attestation's spelling is refused
before the repeat check.

F6: a further root for a position already in conflict is dropped before the
budget and the signature check; the first conflict stays free of the rate.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 CHANGELOG.md                |  88 +++++---
 lib/frame-handler.js        |  32 +--
 lib/node.js                 | 179 +++++++++++-----
 lib/relay.js                |   6 +-
 lib/role-grant-store.js     |  54 ++++-
 tests/gossip-budget.test.js |  25 ++-
 tests/gossip-lanes.test.js  | 415 ++++++++++++++++++++++++++++++++++++
 7 files changed, 690 insertions(+), 109 deletions(-)
 create mode 100644 tests/gossip-lanes.test.js

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 44eff890..04bb0619 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,11 @@ debt, and the daemon's log flood. Every item has a test that fails without its f
   `provenPublicKey`) admitted that node to the gated room as the grantee, with no proof it held the
   grantee's key. 0.14.0 drops a `provenPublicKey` that arrives in a handshake (see Fixed — security).
   A room with no owner, the default, was never gated and is not affected.
+- **One captured role grant could be stored and relayed without end** (0.13.16, and the releases
+  before it that gossip role grants). A grant re-spelled (padding, whitespace, a `+`/`/` swap: each
+  spelling verifies) was taken as a new grant, so any admitted peer holding one, with no key of its
+  own, could make every node store, append and relay it again for every spelling. 0.14.0 refuses the
+  re-spelling, budgets grants and bounds what is kept (see Fixed — signed gossip is budgeted).
 
 ### Fixed — security
 
@@ -271,33 +276,59 @@ debt, and the daemon's log flood. Every item has a test that fails without its f
   position (up to 32,768) for its own; the positions are now indexed by key, and the witness cap takes
   the oldest from the head.
 
-### Fixed — attestation gossip is budgeted, per peer and per attester
+### Fixed — signed gossip is budgeted, per connection and per attester
 
-- **A peer's new statements are budgeted (0.13.15's other known limit).** The attestations,
-  checkpoints and witnesses one peer delivers may make this node check at most 2,000 new statements a
-  second, after a burst of 10,000. Past that a frame is dropped before its signature is checked, so no
-  peer buys more signature checks than that (~40 µs each: under a tenth of a core). Attestations are
-  covered as well as checkpoints and witnesses.
+- **New signed statements are budgeted (0.13.15's other known limit).** The attestations,
+  checkpoints, witnesses and role grants that arrive on one connection may make this node check at most
+  2,000 new statements a second, up to a burst of 10,000. A connection seen for the first time starts
+  with 100 and earns the rest at that rate. All connections together draw on one ceiling, 4,000 a
+  second after a burst of 20,000. Past either, a frame is dropped before its signature is checked, so
+  no sender, and no number of senders, buys more signature checks than the ceiling (~40 µs each: under
+  a fifth of a core). Attestations are covered as well as checkpoints and witnesses.
 - **Only a new statement spends it.** These are dropped first, for nothing: a repeat (an attestation
-  whose signature is held, however it is spelled; a checkpoint or witness held, waiting for its
-  checkpoint, or already refused as a conflict), a checkpoint older than every position held, an
-  unsigned frame, and a frame whose signer's key this node does not hold.
+  or role grant whose signature is held, however it is spelled; a checkpoint or witness held, waiting
+  for its checkpoint, or already refused as a conflict), a checkpoint older than every position held,
+  a further root for a position already in conflict, an unsigned or malformed frame, and a frame whose
+  signer's key this node does not hold.
 - **Sized above a busy room.** A room of R nodes, each gating G CMBs a second, makes R·G
   attestations, R·G/8 checkpoints and R·G/8·(R−1) witnesses a second: 640 at R = 32, G = 4. Only the
   first copy of a statement is new, so a peer spends the budget only for what it delivers first:
   about what it signs itself (~20 a second there), and at most all 640 when it is this node's only
-  path to the room. 2,000 is three times that. `gossipBudget: { perSecond, burst }` changes it.
-- **A forged frame spends only its sender's budget.** The budget is the delivering peer's, never the
-  claimed signer's. A peer that floods forgeries loses its own frames while it floods, and no one
-  else's. An honest peer relays only what it has verified, so its budget is never spent on forgeries.
-  A dropped frame is not marked seen, so the same statement from another peer is taken. The budget
-  refills, so a peer that stops flooding is heard again.
+  path to the room. 2,000 is three times that, and the ceiling six times the room's 640 in all.
+  `gossipBudget: { perSecond, burst, newLane, globalPerSecond, globalBurst }` changes it.
+- **The budget is the connection's, not a declared id's.** A connection is one TCP connection, or the
+  relay connection together with the sender id the relay names. A first reading kept the budget by the
+  peer id a sender declares, and gave an id seen for the first time the whole burst, so a sender that
+  minted ids bought 10,000 signature checks per id. Fresh ids on one TCP connection now share its
+  budget; over the relay each starts with 100, and together they stay under the ceiling. The budget is
+  never the claimed signer's, so a forged frame spends only its own connection's budget and the
+  ceiling. An honest peer relays only what it has verified, so its budget is never spent on
+  forgeries. A dropped frame is not marked seen, so the same statement from another peer is taken.
+  The budget refills, so a sender that stops flooding is heard again.
+- **Limits of the budget.** Under a flood from many ids or connections at once, the ceiling drops
+  honest peers' new statements too, for as long as the flood lasts (a copy that comes again later is
+  taken); what a flood cannot do is buy more checks than the ceiling. Over the relay this node cannot
+  tell whether the relay checked the sender id it names, so a sender that names an honest peer's id
+  spends that peer's relay budget.
 - **A drop is attributable.** A `gossip-over-budget` metric (`fromPeerId`, `from`, `dropped`,
   `frames` by type, and up to 16 `authors` whose statements were dropped) and one log line name the
   peer, at most once per 10 s per peer: the first drop at once, the rest when the 10 s close, so every
-  drop is counted (`gossipOverBudget` in `metrics()` keeps the total). A gap it leaves is told apart
-  from an omission by the attester. Budgets are kept for at most 4,096 peers, the least recently active
-  evicted in O(1), without scanning.
+  drop is counted (`gossipOverBudget` in `metrics()` keeps the total). Drops by the ceiling are said
+  in one report for all peers, `gossip-over-ceiling` (with up to 16 `fromPeerIds`), not one per id. A
+  gap a drop leaves is told apart from an omission by the attester. Budgets are kept for at most
+  4,096 connections, the least recently active evicted in O(1), without scanning. A log or metric
+  listener that throws cannot break the handling of a frame or `stop()`: a report's counts are reset
+  before it is said, so none is said twice, and the totals stay in `metrics()`.
+- **Role grants are gossip like the rest.** They were outside the budget and de-duplicated by the
+  signature as written, so one grant re-spelled (see Security) was stored, appended to
+  `role-grants.jsonl` and relayed again for every spelling. A grant is now refused in the same order
+  as the other statements (malformed, not spelled canonically, a repeat by its signature's bytes, a
+  grantor whose key is not held) before it spends the budget, and is kept in its canonical spelling.
+  The store bounds what it keeps, and so what it relays: 1,024 records per grantor, 64 per grantor and
+  grantee, 65,536 in all. A full bound refuses the newcomer and never evicts, since a record's
+  authority can depend on its place in a chain; the anchor's own records are never refused. Limit: a
+  node whose key this node holds can fill its own bounds with grants that confer nothing, and enough
+  such nodes can fill the store, after which only the anchor's grants are taken.
 - **One attester's checkpoints cannot make the room sign witnesses without end.** Each checkpoint a
   node takes costs every node in the room a witness signed, gossiped and verified. The per-peer budget
   bounds what one peer delivers, not what one attester signs: an attester sending new checkpoints
@@ -308,20 +339,27 @@ debt, and the daemon's log flood. Every item has a test that fails without its f
   10 s (`checkpoint-over-rate`, naming the attester and the peers that brought it). An attester commits
   a checkpoint every 8 attestations: 0.5 a second in the busy room above. 4 a second is 8× that, and
   the burst holds 1,024 attestations gated back to back. A second root for a position already held is
-  still recorded as a conflict. `checkpointRate: { perSecond, burst }` changes it.
+  still recorded as a conflict, whatever the rate. A further root for a position already in conflict
+  adds nothing and is dropped before the budget and the signature check; it was verified, up to the
+  peer's 2,000 a second, where the attester's rate was meant to bound it. `checkpointRate: {
+  perSecond, burst }` changes it.
 - **Only the spelling a signer writes is stored.** Base64url decoding ignores padding, whitespace and
   stray characters, so one signature could be spelled any number of ways that all verify. Each spelling
   was stored and relayed as a new attestation. The chain hash and the Merkle root are computed over the
   signature as written, so a re-spelling that arrived first made its attester's chain look broken. A
-  gossiped attestation, checkpoint or witness whose signature is not 64 bytes in unpadded base64url is
-  now refused before anything is spent on it. It is counted (`signaturesNotCanonical` in `metrics()`)
-  and said like a budget drop (`signature-not-canonical`). A re-spelling of an attestation already
-  held is a repeat. Every signer sym knows writes the canonical spelling, and this node checks its own
+  gossiped attestation, checkpoint, witness or role grant whose signature is not 64 bytes in unpadded
+  base64url is now refused before anything is spent on it, before the repeat check (which decoded a
+  re-spelling to look it up). It is counted (`signaturesNotCanonical` in `metrics()`) and said like a
+  budget drop (`signature-not-canonical`). A signature longer than 128 characters is malformed,
+  refused before it is decoded or looked up: one of ~900 KB cost a decode and a hash, for nothing.
+  Every signer sym knows writes the canonical spelling, and this node checks its own
   before recording one. A log written before 0.14.0 can hold another spelling. Such a line is read as
   the canonical spelling, which is counted and said once, so it can no longer make an honest chain
   look broken; a rotation then writes the canonical one.
-- **A dropped attestation is logged once a minute per peer and reason, with a count.** It was logged
-  once per frame, and one naming a signer whose key is not held is dropped before any budget.
+- **A dropped attestation is logged once a minute per connection and reason, with a count.** It was
+  logged once per frame, and one naming a signer whose key is not held is dropped before any budget.
+  Per connection, not per peer: over the relay the id is the sender's to choose, and a fresh one per
+  frame bought a line per frame.
 
 ### Fixed — dependencies
 
diff --git a/lib/frame-handler.js b/lib/frame-handler.js
index d2057257..5bbc6a43 100644
--- a/lib/frame-handler.js
+++ b/lib/frame-handler.js
@@ -79,6 +79,10 @@ const SEEN_CMB_MAX = 10000;
 const DIRECTED_MARK = /#(asrt-|sd:|sig:)/;
 /** The most `peer-info` entries read from one frame, and the most a frame this node sends carries. */
 const { PEER_INFO_MAX } = require('./core/wake');
+
+/** The connection a gossip lane names (see GOSSIP_NEW_LANE in node.js): a relay lane is the relay
+ *  connection plus the sender id it carries, and this is the connection alone. Null without a lane. */
+const connectionOf = (lane) => (typeof lane === 'string' ? lane.replace(/^(relay:\d+):[\s\S]*$/, '$1') : null);
 /** A record refused for its audience is said at most once per this many ms per peer and reason. */
 const AUDIENCE_REPORT_MS = 60_000;
 
@@ -103,7 +107,7 @@ class FrameHandler {
     this._node = node;
     this._cliHostMode = opts.cliHostMode || false;
     this._unsignedWarned = new Set();
-    this._attDropSaid = new Map(); // `${peerId}|${reason}` -> { at, more }: a dropped attestation is said once a minute
+    this._attDropSaid = new Map(); // `${connection}|${reason}` -> { at, more }: a dropped attestation is said once a minute
     this._longPeerInfoSaid = new Map(); // peerId -> when an over-long peer-info from it was last said
     this._audienceSaid = new Map(); // `${peerId}|${reason}` -> { at, more }: a refused audience, the same way
     // THE ADMISSION SEAM (sym-core split). Frame routing is open; the engine that judges an
@@ -212,9 +216,11 @@ class FrameHandler {
    * @param {string} peerId - Unique identifier of the sending peer.
    * @param {string} peerName - Display name of the sending peer.
    * @param {object} msg - The frame payload with a .type category.
+   * @param {string} [lane] - The connection the frame arrived on (see GOSSIP_NEW_LANE in node.js):
+   *   the gossip budget is kept per lane. Defaults to the peer id.
    * @returns {void}
    */
-  handle(peerId, peerName, msg) {
+  handle(peerId, peerName, msg, lane) {
     // `provenPublicKey` is what this node's own proving handshake sets once it has verified a peer's
     // proof of its key. A peer's handshake frame cannot carry it: a peer that wrote one into its frame
     // would be taken as having proved the key printed in the room grant it presents.
@@ -241,14 +247,14 @@ class FrameHandler {
     // path calls this from a WebSocket handler with nothing above it, so a throw there was an
     // uncaught exception and the daemon exited. A frame that throws is dropped and said so.
     try {
-      this._dispatch(peerId, peerName, msg);
+      this._dispatch(peerId, peerName, msg, lane);
     } catch (err) {
       this._node._log(`Frame '${msg && msg.type}' from ${peerName} dropped: ${err && err.message ? err.message : err}`);
       this._node.emit('metric', { type: 'frame-handler-error', from: peerName, frameType: msg && msg.type, error: String(err && err.message ? err.message : err) });
     }
   }
 
-  _dispatch(peerId, peerName, msg) {
+  _dispatch(peerId, peerName, msg, lane) {
     switch (msg.type) {
       case 'handshake':
         this._handleHandshake(peerId, peerName, msg);
@@ -280,7 +286,7 @@ class FrameHandler {
         break;
 
       case 'attestation':
-        this._handleAttestation(peerId, peerName, msg);
+        this._handleAttestation(peerId, peerName, msg, lane);
         break;
 
       case 'cmb-fetch':
@@ -292,16 +298,16 @@ class FrameHandler {
         break;
 
       case 'checkpoint':
-        if (msg.checkpoint) this._node._ingestCheckpoint(msg.checkpoint, peerId);
+        if (msg.checkpoint) this._node._ingestCheckpoint(msg.checkpoint, peerId, lane);
         break;
 
       case 'witness':
-        if (msg.witness) this._node._ingestWitness(msg.witness, peerId);
+        if (msg.witness) this._node._ingestWitness(msg.witness, peerId, lane);
         break;
 
       case 'role-grant':
       case 'role-revoke':
-        if (msg.grant) this._node._ingestRoleGrant(msg.grant, peerId);
+        if (msg.grant) this._node._ingestRoleGrant(msg.grant, peerId, lane);
         break;
 
       case 'node-stats':
@@ -1654,10 +1660,10 @@ class FrameHandler {
    * through SVAF. Invalid/forged → dropped + audit-logged.
    * @private
    */
-  _handleAttestation(peerId, peerName, msg) {
+  _handleAttestation(peerId, peerName, msg, lane) {
     const att = msg && msg.attestation;
     if (!att) return;
-    const r = this._node._ingestAttestation(att, peerId, peerName);
+    const r = this._node._ingestAttestation(att, peerId, peerName, lane);
     // A repeat, a copy past the per-CMB limit, and one past the peer's budget or with a signature not
     // spelled canonically (both said by the node, once per 10 s) are quiet here.
     if (r.ok || !r.reason || r.reason === 'duplicate' || r.reason === 'rate-limited' || r.reason === 'over-budget' || r.reason === 'non-canonical-signature') return;
@@ -1665,8 +1671,10 @@ class FrameHandler {
       this._node.emit('metric', { type: 'attestation-rejected', from: peerName, of: att.of, by: att.by, reason: 'invalid' });
     }
     // A peer naming signers this node holds no key for is dropped before any budget, so the line is
-    // said once a minute per peer and reason, with how many more there were, not once per frame.
-    const k = `${peerId}|${r.reason}`;
+    // said once a minute per connection and reason, with how many more there were, not once per frame.
+    // Per connection, not per peer id: over the relay the id is the sender's to choose, and a fresh one
+    // per frame bought a line per frame.
+    const k = `${connectionOf(lane) ?? peerId}|${r.reason}`;
     const now = Date.now();
     const said = this._attDropSaid.get(k);
     if (said && now - said.at < 60_000) { said.more++; return; }
diff --git a/lib/node.js b/lib/node.js
index d93182ba..f239e1d7 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -91,10 +91,11 @@ function peerReachedOnlyOverRelay(peer) {
 }
 
 /**
- * One peer's budget of NEW gossiped statements (attestations, checkpoints, witnesses): a burst, then a
- * rate a second, spent before the signature is checked, so no peer can buy more signature checks than
- * this. A repeat, a malformed frame, one for a signer whose key is not held, or a stale checkpoint is
- * dropped before it, for nothing.
+ * One lane's budget of NEW gossiped statements (attestations, checkpoints, witnesses, role grants): a
+ * burst, then a rate a second, spent before the signature is checked, so no lane can buy more
+ * signature checks than this (lanes and the ceiling over all of them: see GOSSIP_NEW_LANE). A repeat,
+ * a malformed frame, one for a signer whose key is not held, a stale checkpoint or a further root for a
+ * position already in conflict is dropped before it, for nothing.
  *
  * Sizing. A room of R nodes, each gating G CMBs a second, makes R·G attestations, R·G/8 checkpoints
  * (one per 8 attestations) and R·G/8·(R−1) witnesses a second. A busy room, R = 32 and G = 4, makes
@@ -102,16 +103,33 @@ function peerReachedOnlyOverRelay(peer) {
  * only the first copy of a statement is new, so a peer spends this node's budget only for what it
  * delivers first: about what it signs itself, G·(1 + R/8) = 20 a second, and at most all 640 when it
  * is this node's only path to the room. 2,000 a second is 3× that worst case and 100× the usual; a
- * flood buys at most 2,000 checks a second per peer (one costs ~40 µs: under a tenth of a core).
+ * flood buys at most 2,000 checks a second per lane (one costs ~40 µs: under a tenth of a core).
  */
 const GOSSIP_PER_SECOND = 2000;
 const GOSSIP_BURST = 10000;
+/**
+ * The budget is kept per lane: the connection a frame arrives on (one TCP connection, or the relay
+ * connection together with the id the relay names as the sender), never only the peer id the sender
+ * declares. A lane seen for the first time starts with GOSSIP_NEW_LANE tokens and earns the rest at
+ * the rate, so minting ids buys a hundred checks each, not a burst each. And every lane draws on one
+ * ceiling as well, GOSSIP_GLOBAL_PER_SECOND after a burst of GOSSIP_GLOBAL_BURST, so many ids together
+ * buy no more than that: 4,000 a second is six times the busy room's 640 new statements a second in
+ * all. Under a flood from many ids at once the ceiling can drop honest frames too (a copy of one may
+ * still come by another lane later); what it cannot do is spend more than the ceiling's checks.
+ */
+const GOSSIP_NEW_LANE = 100;
+/** A signature longer than this is not one (an Ed25519 signature is 86 characters of base64url): it is
+ *  refused as malformed before anything decodes or hashes it. */
+const SIG_MAX_CHARS = 128;
+const sigOk = (sig) => typeof sig === 'string' && sig.length > 0 && sig.length <= SIG_MAX_CHARS;
+const GOSSIP_GLOBAL_PER_SECOND = 4000;
+const GOSSIP_GLOBAL_BURST = 20000;
 /**
  * One attester's new checkpoints this node takes (stores, witnesses and relays): a burst, then a rate a
  * second, spent after the signature is checked (so only the attester itself spends it) and whichever
  * peer brings them. Each checkpoint taken costs every node in the room a witness signed, gossiped and
  * verified (R−1 of them), so this bounds what one attester's checkpoint flood makes the room sign: at
- * most 4 witnesses a second per node, where the per-peer budget alone allowed 2,000.
+ * most 4 witnesses a second per node, where the per-lane budget alone allowed 2,000.
  *
  * Sizing. An attester commits a checkpoint every 8 attestations, so one gating G CMBs a second makes
  * G/8 a second: 0.5 in the busy room above. 4 a second is 8× that (an attester gating 32 CMBs a second
@@ -131,18 +149,29 @@ const GOSSIP_MAX_PEERS = 4096;
  * A clock stepped back refills nothing and stalls nothing. @returns {boolean} whether a token was taken
  */
 function takeToken(buckets, key, rate, burst, now, max) {
+  const b = bucketOf(buckets, key, rate, burst, burst, now, max);
+  if (b.tokens >= 1) { b.tokens -= 1; return true; }
+  return false;
+}
+
+/** `key`'s bucket, refilled to `now`; a new one starts with `initial` tokens. Most recently used last. */
+function bucketOf(buckets, key, rate, burst, initial, now, max) {
   let b = buckets.get(key);
   if (b) buckets.delete(key);
   else {
-    b = { tokens: burst, at: now };
+    b = { tokens: Math.min(initial, burst), at: now };
     if (buckets.size >= max) buckets.delete(buckets.keys().next().value);
   }
-  buckets.set(key, b); // most recently used last
+  buckets.set(key, b);
+  return refill(b, rate, burst, now);
+}
+
+/** Refill a bucket to `now`. A clock stepped back refills nothing and stalls nothing. */
+function refill(b, rate, burst, now) {
   const elapsed = now - b.at;
   if (elapsed > 0) b.tokens = Math.min(burst, b.tokens + (elapsed * rate) / 1000);
   b.at = now;
-  if (b.tokens >= 1) { b.tokens -= 1; return true; }
-  return false;
+  return b;
 }
 
 function refuseClearThroughRelay(node, peerId, peer) {
@@ -333,11 +362,18 @@ class SymNode extends EventEmitter {
       // else 128 MiB.
       archiveMaxBytes: opts.attestationArchiveMaxBytes,
     });
-    // Each peer's budget of new gossiped statements (see GOSSIP_PER_SECOND); `opts.gossipBudget`
-    // ({ perSecond, burst }) changes it.
-    this._gossipRate = (opts.gossipBudget && opts.gossipBudget.perSecond) || GOSSIP_PER_SECOND;
-    this._gossipBurst = (opts.gossipBudget && opts.gossipBudget.burst) || GOSSIP_BURST;
-    this._gossipBuckets = new Map(); // peerId -> { tokens, at }, least recently active first
+    // The budget of new gossiped statements, per lane and in all (see GOSSIP_PER_SECOND and
+    // GOSSIP_NEW_LANE); `opts.gossipBudget` ({ perSecond, burst, newLane, globalPerSecond,
+    // globalBurst }) changes it.
+    const gb = opts.gossipBudget || {};
+    this._gossipRate = gb.perSecond || GOSSIP_PER_SECOND;
+    this._gossipBurst = gb.burst || GOSSIP_BURST;
+    this._gossipNewLane = gb.newLane || GOSSIP_NEW_LANE;
+    this._gossipGlobalRate = gb.globalPerSecond || GOSSIP_GLOBAL_PER_SECOND;
+    this._gossipGlobalBurst = gb.globalBurst || GOSSIP_GLOBAL_BURST;
+    this._gossipBuckets = new Map(); // lane -> { tokens, at }, least recently active first
+    this._gossipGlobal = { tokens: this._gossipGlobalBurst, at: Date.now() };
+    this._laneSeq = 0;
     // Each attester's rate of new checkpoints taken (see CHECKPOINTS_PER_SECOND); `opts.checkpointRate`
     // ({ perSecond, burst }) changes it.
     this._checkpointRate = (opts.checkpointRate && opts.checkpointRate.perSecond) || CHECKPOINTS_PER_SECOND;
@@ -613,10 +649,10 @@ class SymNode extends EventEmitter {
       getMeshNode: () => this._meshNode,
       createPeer: (transport, peerId, peerName, isOutbound, source) => this._createPeer(transport, peerId, peerName, isOutbound, source),
       addPeer: (peer) => this._addPeer(peer),
-      handlePeerMessage: (peerId, peerName, msg) => {
+      handlePeerMessage: (peerId, peerName, msg, lane) => {
         // Emit raw frame for hosted agents (Section 4.3.2: forward before evaluation)
         this.emit('frame-received', { peerId, peerName, frame: msg });
-        this._frameHandler.handle(peerId, peerName, msg);
+        this._frameHandler.handle(peerId, peerName, msg, lane);
       },
       onPeerLeft: (peerId, peerName) => { this._metrics.peersLeft++; this.emit('peer-left', { id: peerId, name: peerName }); this.emit('metric', { type: 'peer-left', name: peerName }); },
       onIdentityCollision: (info) => {
@@ -986,8 +1022,17 @@ class SymNode extends EventEmitter {
    * lazily, so an unentitled grant is stored but confers nothing.
    * @private
    */
-  _ingestRoleGrant(g, fromPeerId) {
-    if (!g) return { ok: false, reason: 'malformed' };
+  _ingestRoleGrant(g, fromPeerId, lane) {
+    // A role grant is gossip like any other signed statement: a repeat (its signature's bytes, however
+    // it is spelled) or a frame that is malformed, spelled otherwise than its signer wrote it, or from a
+    // grantor whose key this node does not hold is dropped before anything is spent; a new one spends
+    // the delivering lane's budget before its signature is checked. The store bounds what it keeps,
+    // and only what it keeps is relayed.
+    if (!g || !g.grantee || !g.grantedBy || !g.type || !sigOk(g.sig)) return { ok: false, reason: 'malformed' };
+    if (!isCanonicalSig(g.sig)) return this._refuseSpelling(fromPeerId, 'role-grant', g.grantedBy);
+    if (this._roleGrants.has(g.sig)) return { ok: false, reason: 'duplicate' };
+    if (!this._roleGrants.grantorKey(g.grantedBy)) return { ok: false, reason: 'unknown-grantor-key' };
+    if (!this._gossipBudget(fromPeerId, 'role-grant', g.grantedBy, lane)) return { ok: false, reason: 'over-budget' };
     const r = this._roleGrants.record(g);
     if (r.stored) this._gossipToRoster({ type: g.type, grant: g }, fromPeerId);
     return { ok: r.stored, reason: r.reason };
@@ -1216,8 +1261,8 @@ class SymNode extends EventEmitter {
    * node countersigns "I saw attester's chain to N with root R"), and relay-once.
    * @private
    */
-  _ingestCheckpoint(cp, fromPeerId) {
-    if (!cp || !cp.by || cp.upto_seq === undefined || !cp.root || !cp.sig) return { ok: false, reason: 'malformed' };
+  _ingestCheckpoint(cp, fromPeerId, lane) {
+    if (!cp || !cp.by || cp.upto_seq === undefined || !cp.root || !sigOk(cp.sig)) return { ok: false, reason: 'malformed' };
     if (cp.roster && this._room && cp.roster !== this._room) return { ok: false, reason: 'roster-mismatch' };
     // A position is an integer; the signature covers its text, so a re-spelled one is refused here,
     // before any signature check. A copy of a held checkpoint (same position, same root), of a
@@ -1229,14 +1274,21 @@ class SymNode extends EventEmitter {
     const held = this._attestations.checkpointAt(cp.by, cp.upto_seq);
     if (held && held.root === cp.root) return { ok: false, reason: 'duplicate' };
     if (this._attestations.conflictAt(cp.by, cp.upto_seq)?.root === cp.root) return { ok: false, reason: 'duplicate' };
+    // A further root for a position already proven conflicted adds nothing: the evidence is held, and
+    // a conflict is neither stored nor relayed. So it is dropped here, before the budget and the
+    // signature, and one attester's equivocation costs at most one signature check per position it
+    // holds (positions come at its rate, below), not one per root it signs.
+    if (this._attestations.hasConflict(cp.by, cp.upto_seq)) return { ok: false, reason: 'conflict' };
     if (this._attestations.isStale(cp.by, cp.upto_seq)) return { ok: false, reason: 'stale' };
     if (!isCanonicalSig(cp.sig)) return this._refuseSpelling(fromPeerId, 'checkpoint', cp.by);
     const key = this._identityKey(cp.by);
     if (!key) return { ok: false, reason: 'unknown-attester-key' };
-    if (!this._gossipBudget(fromPeerId, 'checkpoint', cp.by)) return { ok: false, reason: 'over-budget' };
+    if (!this._gossipBudget(fromPeerId, 'checkpoint', cp.by, lane)) return { ok: false, reason: 'over-budget' };
     if (!verifyCheckpoint(cp, key).valid) return { ok: false, reason: 'bad-signature' };
     // A new position is taken at most at its attester's rate, whichever peer brings it: past that it is
-    // not stored, witnessed or relayed. Checked after the signature, so no one else can spend it.
+    // not stored, witnessed or relayed. Checked after the signature, so no one else can spend it. A
+    // second root for a held position is the evidence of equivocation, kept once and free (a third is
+    // dropped above).
     if (!held && !this._checkpointRateOk(cp.by, fromPeerId)) return { ok: false, reason: 'over-rate' };
     const r = this._attestations.recordCheckpoint(cp);
     if (r.reason === 'conflict' && r.first) {
@@ -1252,22 +1304,34 @@ class SymNode extends EventEmitter {
   }
 
   /**
-   * Spend one of a peer's tokens for a NEW gossiped statement, before its signature is checked (see
-   * GOSSIP_PER_SECOND). The bucket is the delivering peer's, never a claimed signer's, so a forged
-   * frame spends only the budget of the peer that sent it; an honest peer relays only what it has
-   * verified and stored, so its lane carries no forgeries, and the bucket refills, so a peer that
-   * stops flooding is heard again within burst/rate seconds. A dropped frame changes nothing: it is not
-   * marked seen, so another peer's copy is taken. Drops are said with the peer named (see _noteDrop),
-   * so a gap they leave is attributable to this node, not the attester. O(1).
+   * Spend one token of the lane a NEW gossiped statement arrived on, and one of the shared ceiling,
+   * before its signature is checked (see GOSSIP_PER_SECOND and GOSSIP_NEW_LANE). The lane is the
+   * connection that delivered the frame, never a claimed signer and never only the id the sender
+   * declares, so a forged frame spends only its own connection's budget, and minting fresh ids on one
+   * connection buys nothing; an honest peer relays only what it has verified and stored, so its lane
+   * carries no forgeries. Both refill, so a lane that stops flooding is heard again within burst/rate
+   * seconds. A dropped frame changes nothing: it is not marked seen, so another peer's copy is taken.
+   * Drops are said with the peer named (see _noteDrop), those the shared ceiling refused in one report
+   * of their own, so a gap they leave is attributable to this node, not the attester. O(1).
+   * @param {string} [lane] the connection's lane id; a caller without one is keyed by peerId
    * @returns {boolean} whether the frame may be verified
    * @private
    */
-  _gossipBudget(peerId, type, author) {
-    if (takeToken(this._gossipBuckets, peerId, this._gossipRate, this._gossipBurst, this._gossipClock(), GOSSIP_MAX_PEERS)) return true;
-    this._noteDrop('gossip-over-budget', peerId, { frame: type, author });
+  _gossipBudget(peerId, type, author, lane) {
+    const now = this._gossipClock();
+    const b = bucketOf(this._gossipBuckets, lane ?? peerId, this._gossipRate, this._gossipBurst, this._gossipNewLane, now, GOSSIP_MAX_PEERS);
+    const all = refill(this._gossipGlobal, this._gossipGlobalRate, this._gossipGlobalBurst, now);
+    if (b.tokens >= 1 && all.tokens >= 1) { b.tokens -= 1; all.tokens -= 1; return true; }
+    // A drop by the ceiling is said in one report for all peers, not one per id: ids are free to mint,
+    // so one report each would let a flood of them buy a log line a frame.
+    if (b.tokens >= 1) this._noteDrop('gossip-over-ceiling', '*', { frame: type, author, peer: peerId });
+    else this._noteDrop('gossip-over-budget', peerId, { frame: type, author });
     return false;
   }
 
+  /** A lane id for one connection's frames (see GOSSIP_NEW_LANE). @private */
+  _newLane(kind) { return `${kind}:${++this._laneSeq}`; }
+
   /**
    * Take one of an attester's checkpoint tokens (see CHECKPOINTS_PER_SECOND), keyed by the attester
    * whose signature was just checked, never by the peer that delivered it. Past the rate the checkpoint
@@ -1316,7 +1380,7 @@ class SymNode extends EventEmitter {
       }
     }
     reports.set(id, r); // most recently dropped last
-    if (metric === 'gossip-over-budget') this._metrics.gossipOverBudget++;
+    if (metric === 'gossip-over-budget' || metric === 'gossip-over-ceiling') this._metrics.gossipOverBudget++;
     else if (metric === 'signature-not-canonical') this._metrics.signaturesNotCanonical++;
     else if (metric === 'checkpoint-over-rate') this._metrics.checkpointsOverRate++;
     r.dropped++;
@@ -1337,7 +1401,9 @@ class SymNode extends EventEmitter {
    * Say what was dropped under one report since it was last said: one log line and one metric. For a
    * peer: `{ type, fromPeerId, from, dropped, frames: {attestation, checkpoint, witness}, authors (up
    * to 16 signers named by what was dropped) }`, plus `perSecond` for `gossip-over-budget`. For
-   * `checkpoint-over-rate`: `{ type, attester, dropped, fromPeerIds (up to 16), perSecond }`. @private
+   * `gossip-over-ceiling`, the drops of every peer by the shared ceiling: `{ type, dropped, frames,
+   * authors, fromPeerIds (up to 16), perSecond }`. For `checkpoint-over-rate`: `{ type, attester,
+   * dropped, fromPeerIds (up to 16), perSecond }`. @private
    */
   _sayDrops(r, now = this._gossipClock()) {
     if (r.timer) { clearTimeout(r.timer); r.timer = null; }
@@ -1347,6 +1413,10 @@ class SymNode extends EventEmitter {
     if (r.metric === 'checkpoint-over-rate') {
       ev = { type: r.metric, attester: r.key, dropped: r.dropped, fromPeerIds: [...r.peers], perSecond: this._checkpointRate };
       line = `Checkpoints from ${String(r.key).slice(0, 8)} over their rate (${this._checkpointRate}/s): ${ev.dropped} not stored, witnessed or relayed`;
+    } else if (r.metric === 'gossip-over-ceiling') {
+      ev = { type: r.metric, dropped: r.dropped, frames: { ...r.frames }, authors: [...r.authors], fromPeerIds: [...r.peers], perSecond: this._gossipGlobalRate };
+      const what = Object.entries(ev.frames).map(([t, n]) => `${n} ${t}`).join(', ');
+      line = `Gossip over the ceiling all peers share (${this._gossipGlobalRate}/s): ${ev.dropped} new statement(s) dropped unverified (${what}), from ${ev.fromPeerIds.map((id) => String(id).slice(0, 8)).join(', ')}`;
     } else {
       const name = this._peers?.get(r.key)?.name || null;
       ev = { type: r.metric, fromPeerId: r.key, from: name || r.key, dropped: r.dropped, frames: { ...r.frames }, authors: [...r.authors] };
@@ -1358,9 +1428,14 @@ class SymNode extends EventEmitter {
         line = `Gossip from ${ev.from}: ${ev.dropped} statement(s) refused unverified, signature not in canonical form (${what})`;
       }
     }
+    // Reset first, so a throwing sink cannot make the same drops be said twice; and the sink is
+    // contained, so it cannot take a frame's handling or the node's shutdown with it. The totals
+    // are kept in metrics() either way.
     this._resetDrops(r, now);
-    this._log(line);
-    this.emit('metric', ev);
+    try {
+      this._log(line);
+      this.emit('metric', ev);
+    } catch { /* a log or metric sink must not break gossip or shutdown */ }
   }
 
   /** @private A report was said: start counting again. */
@@ -1403,8 +1478,8 @@ class SymNode extends EventEmitter {
    * signature against its authenticated key, record, relay-once.
    * @private
    */
-  _ingestWitness(w, fromPeerId) {
-    if (!w || !w.attester || w.upto_seq === undefined || !w.root || !w.by || !w.sig) return { ok: false, reason: 'malformed' };
+  _ingestWitness(w, fromPeerId, lane) {
+    if (!w || !w.attester || w.upto_seq === undefined || !w.root || !w.by || !sigOk(w.sig)) return { ok: false, reason: 'malformed' };
     if (w.roster && this._room && w.roster !== this._room) return { ok: false, reason: 'roster-mismatch' };
     if (!isPosition(w.upto_seq)) return { ok: false, reason: 'malformed' };
     // A copy of a witness held or waiting, or of a conflicting one already refused: dropped unverified.
@@ -1414,7 +1489,7 @@ class SymNode extends EventEmitter {
     if (!isCanonicalSig(w.sig)) return this._refuseSpelling(fromPeerId, 'witness', w.by);
     const key = this._identityKey(w.by);
     if (!key) return { ok: false, reason: 'unknown-witness-key' };
-    if (!this._gossipBudget(fromPeerId, 'witness', w.by)) return { ok: false, reason: 'over-budget' };
+    if (!this._gossipBudget(fromPeerId, 'witness', w.by, lane)) return { ok: false, reason: 'over-budget' };
     if (!verifyWitness(w, key).valid) return { ok: false, reason: 'bad-signature' };
     const r = this._attestations.recordWitness(w);
     if (r.stored) this._gossipToRoster({ type: 'witness', witness: w }, fromPeerId);
@@ -1472,8 +1547,8 @@ class SymNode extends EventEmitter {
    * copy, a roster mismatch, an unknown attester or a bad signature emits nothing.
    * @private
    */
-  _ingestAttestation(att, fromPeerId, fromPeerName) {
-    if (!att || !att.sig || !att.of || !att.by) return { ok: false, reason: 'malformed' };
+  _ingestAttestation(att, fromPeerId, fromPeerName, lane) {
+    if (!att || !sigOk(att.sig) || !att.of || !att.by) return { ok: false, reason: 'malformed' };
     // Roster scope (defense in depth — gossip already stays in-room).
     if (att.roster && this._room && att.roster !== this._room) {
       return { ok: false, reason: 'roster-mismatch' };
@@ -1482,14 +1557,15 @@ class SymNode extends EventEmitter {
     // peer (handshake key map); a relayed attester awaits the roster key registry.
     // A signature already held was verified when it was stored: a repeat is dropped before the
     // signature check, which is most of what a flood of repeats costs.
-    // `has` compares the signature's bytes, so a re-spelling of one held is a repeat too; a new one
-    // is refused unless spelled as its signer wrote it (the chain hashes the signature as written).
-    // Only a new statement spends the peer's budget, before its signature is checked.
-    if (this._attestations.has(att.sig)) return { ok: false, reason: 'duplicate' };
+    // A signature not spelled as its signer wrote it is refused first (the chain hashes the signature
+    // as written), before the repeat check, which then only ever looks up a canonical spelling: no
+    // re-spelling is decoded. Only a new statement spends the peer's budget, before its signature is
+    // checked.
     if (!isCanonicalSig(att.sig)) return this._refuseSpelling(fromPeerId, 'attestation', att.by);
+    if (this._attestations.has(att.sig)) return { ok: false, reason: 'duplicate' };
     const attesterKey = this._identityKey(att.by);
     if (!attesterKey) return { ok: false, reason: 'unknown-attester-key' };
-    if (!this._gossipBudget(fromPeerId, 'attestation', att.by)) return { ok: false, reason: 'over-budget' };
+    if (!this._gossipBudget(fromPeerId, 'attestation', att.by, lane)) return { ok: false, reason: 'over-budget' };
     const v = verifyAttestation(att, attesterKey);
     if (!v.valid) return { ok: false, reason: v.error || 'bad-signature' };
     // Record (rate-limited as ingested). Relay-once only on first sight.
@@ -1885,10 +1961,12 @@ class SymNode extends EventEmitter {
       if (handshakeMsg.publicKey) {
         this._pinPeerKey(peerId, handshakeMsg.publicKey);
       }
+      // One gossip-budget lane per connection: the peer id is the one this connection claimed.
+      const lane = this._newLane('tcp');
       transport.on('message', (m) => {
         const peer = this._peers.get(peerId);
         if (peer) peer.lastSeen = Date.now();
-        this._frameHandler.handle(peerId, peerName, m);
+        this._frameHandler.handle(peerId, peerName, m, lane);
       });
       const admission = this._roomAdmission(peerId, handshakeMsg);
       if (!admission.admit) {
@@ -1935,7 +2013,7 @@ class SymNode extends EventEmitter {
     if (this._encodeTimer) clearInterval(this._encodeTimer);
     if (this._statsTimer) clearInterval(this._statsTimer);
     if (this._purgeTimer) clearInterval(this._purgeTimer);
-    for (const r of [...this._dropReports.values()]) this._sayDrops(r);
+    for (const r of [...this._dropReports.values()]) { try { this._sayDrops(r); } catch { /* shutting down */ } }
     // A throttled inbox write still pending (a drain or an ack in the last second) is flushed,
     // or it is lost: the timer is unref'd and would not hold the process open.
     if (this._inboxPersistTimer) {
@@ -2939,10 +3017,11 @@ class SymNode extends EventEmitter {
       socket.setTimeout(0); // clear connect timeout — connection is alive
       this._pendingBonjour.delete(peerId);
       const transport = new TcpTransport(socket);
+      const lane = this._newLane('tcp');   // one gossip-budget lane per connection
       transport.on('message', (msg) => {
         const peer = this._peers.get(peerId);
         if (peer) peer.lastSeen = Date.now();
-        this._frameHandler.handle(peerId, peerName, msg);
+        this._frameHandler.handle(peerId, peerName, msg, lane);
       });
       transport.on('error', () => {});
       const peer = this._createPeer(transport, peerId, peerName, true, 'bonjour');
diff --git a/lib/relay.js b/lib/relay.js
index 7c37529d..7c436ead 100644
--- a/lib/relay.js
+++ b/lib/relay.js
@@ -28,7 +28,8 @@ class RelayConnection {
    * @param {function} opts.getMeshNode        — () => meshNode
    * @param {function} opts.createPeer         — (transport, peerId, peerName, isOutbound, source) => peer
    * @param {function} opts.addPeer            — (peer) => void
-   * @param {function} opts.handlePeerMessage  — (peerId, peerName, msg) => void
+   * @param {function} opts.handlePeerMessage  — (peerId, peerName, msg, lane) => void; `lane` is this
+   *   relay connection and the sender id it names, the key the node's gossip budget is kept by
    * @param {function} opts.onPeerLeft         — (peerId, peerName) => void — emit peer-left event
    * @param {string}   opts.nodeName           — this node's name
    * @param {Map}      opts.peerWakeChannels   — shared peer wake channels Map
@@ -251,6 +252,7 @@ class RelayConnection {
     // §4.1's frame bound, applied by ws before it buffers a message (it closes with 1009 instead).
     const ws = new WebSocket(this._relayUrl, { maxPayload: MAX_FRAME_SIZE + RELAY_ENVELOPE_ALLOWANCE });
     this._relayWs = ws;
+    const connection = this._connections = (this._connections || 0) + 1;   // this connection, for lanes
     this._attempts++;
     this._nextRetryAt = null;
     // A retry inside a refusal episode is part of the episode (see _scheduleReconnect): the phase
@@ -320,7 +322,7 @@ class RelayConnection {
         const peers = this._getPeers();
         const peer = peers.get(msg.from);
         if (peer) peer.lastSeen = Date.now();
-        this._handlePeerMessage(msg.from, msg.fromName || 'unknown', msg.payload);
+        this._handlePeerMessage(msg.from, msg.fromName || 'unknown', msg.payload, `relay:${connection}:${msg.from}`);
       }
     });
 
diff --git a/lib/role-grant-store.js b/lib/role-grant-store.js
index dd5674ef..0a2f445c 100644
--- a/lib/role-grant-store.js
+++ b/lib/role-grant-store.js
@@ -25,8 +25,20 @@
 const fs = require('fs');
 const path = require('path');
 const { verifyGrant, roleRank } = require('./core');
+const { sigKey } = require('./attestation-store');
 
 const GRANTS_FILE = 'role-grants.jsonl';
+/**
+ * Bounds on what is kept, and so on what is relayed, since only a record kept is relayed: records
+ * signed by one grantor, records one grantor signed for one grantee, and records in all. A full bound
+ * refuses the newcomer and never evicts a record already kept, since a record's authority can depend
+ * on its place in a chain. The anchor's own records are never refused. The pair bound is per grantor,
+ * so one grantor filling it cannot keep another's grants to that grantee out; and it bounds what one
+ * grantor adds to the grantee's role resolution, which every gating decision runs.
+ */
+const MAX_PER_GRANTOR = 1024;
+const MAX_PER_PAIR = 64;
+const MAX_GRANTS = 65536;
 
 class RoleGrantStore {
   /**
@@ -41,7 +53,12 @@ class RoleGrantStore {
     this._anchor = opts.anchor || null;
     this._keys = opts.keys || new Map();
     this._byGrantee = new Map(); // grantee nodeId -> [grant/revoke records]
-    this._seen = new Set();      // sig dedup
+    this._seen = new Set();      // sigKey dedup: the signature's bytes, however it is spelled
+    this._perGrantor = new Map(); // grantor nodeId -> records kept
+    this._perPair = new Map();    // grantor nodeId + NUL + grantee nodeId -> records kept
+    this._maxPerGrantor = opts.maxPerGrantor || MAX_PER_GRANTOR;
+    this._maxPerPair = opts.maxPerPair || MAX_PER_PAIR;
+    this._maxGrants = opts.maxGrants || MAX_GRANTS;
     this._dir = opts.dir || null;
     this._loading = false;
     if (this._dir) {
@@ -60,25 +77,43 @@ class RoleGrantStore {
     return this._keys.get(grantedBy);
   }
 
+  /** The key a grant from `grantedBy` is verified against, or undefined: no verification is possible. */
+  grantorKey(grantedBy) { return this._grantorKey(grantedBy); }
+
   /**
    * Record a signed role-grant / role-revoke. The signature must verify against the
    * grantor's key (anchor key pinned). Whether the grantor had the RANK to confer is
    * NOT checked here — that is a resolve-time property, so an over-reaching/unrooted
-   * grant is stored but confers nothing. Idempotent (dedup by sig). On reload from
-   * disk the record is trusted (already verified when first ingested).
+   * grant is stored but confers nothing. Idempotent (dedup by the signature's bytes, so a
+   * re-spelling of a held signature is a duplicate). Refused, before verification, once
+   * its grantor, its grantor-grantee pair or the store is full (see MAX_PER_GRANTOR). On
+   * reload from disk the record is trusted (already verified when first ingested).
    * @returns {{ stored: boolean, reason?: string }}
    */
   record(grant) {
     if (!grant || !grant.grantee || !grant.grantedBy || !grant.sig || !grant.type) {
       return { stored: false, reason: 'malformed' };
     }
-    if (this._seen.has(grant.sig)) return { stored: false, reason: 'duplicate' };
+    const key = sigKey(grant.sig);
+    if (this._seen.has(key)) return { stored: false, reason: 'duplicate' };
+    const fromAnchor = !!this._anchor && grant.grantedBy === this._anchor.nodeId;
+    const pair = `${grant.grantedBy}\u0000${grant.grantee}`;
+    if (!fromAnchor) {
+      if ((this._perGrantor.get(grant.grantedBy) || 0) >= this._maxPerGrantor) return { stored: false, reason: 'grantor-full' };
+      if ((this._perPair.get(pair) || 0) >= this._maxPerPair) return { stored: false, reason: 'pair-full' };
+      if (this._seen.size >= this._maxGrants) return { stored: false, reason: 'store-full' };
+    }
     if (!this._loading) {
-      const key = this._grantorKey(grant.grantedBy);
-      if (!key) return { stored: false, reason: 'unknown-grantor-key' };
-      if (!verifyGrant(grant, key).valid) return { stored: false, reason: 'bad-signature' };
+      const grantorKey = this._grantorKey(grant.grantedBy);
+      if (!grantorKey) return { stored: false, reason: 'unknown-grantor-key' };
+      if (!verifyGrant(grant, grantorKey).valid) return { stored: false, reason: 'bad-signature' };
     }
-    this._seen.add(grant.sig);
+    // Kept in its canonical spelling, the one its signer wrote: a re-spelling verifies too, but the
+    // spelling is what relay-once and every other node's dedup see.
+    if (key !== grant.sig) grant = { ...grant, sig: key };
+    this._seen.add(key);
+    this._perGrantor.set(grant.grantedBy, (this._perGrantor.get(grant.grantedBy) || 0) + 1);
+    this._perPair.set(pair, (this._perPair.get(pair) || 0) + 1);
     let arr = this._byGrantee.get(grant.grantee);
     if (!arr) { arr = []; this._byGrantee.set(grant.grantee, arr); }
     arr.push(grant);
@@ -156,7 +191,8 @@ class RoleGrantStore {
     return (this._byGrantee.get(grantee) || []).slice().sort((a, b) => (a.grantedAt ?? 0) - (b.grantedAt ?? 0));
   }
 
-  has(sig) { return this._seen.has(sig); }
+  /** Whether a grant with this signature is held, however the signature is spelled. */
+  has(sig) { return this._seen.has(sigKey(sig)); }
   size() { return this._seen.size; }
 
   // ── Durable persistence (append-only) ────────────────────────────────────────
diff --git a/tests/gossip-budget.test.js b/tests/gossip-budget.test.js
index 368bb30c..30a121d7 100644
--- a/tests/gossip-budget.test.js
+++ b/tests/gossip-budget.test.js
@@ -3,8 +3,10 @@
 require('./_isolate-home'); // redirect $HOME to a temp sandbox before lib/config loads
 
 /**
- * 0.14.0: one peer's gossiped attestations, checkpoints and witnesses have a budget of new statements
- * (2,000 a second, a burst of 10,000), spent before the signature is checked. The earlier, rejected
+ * 0.14.0: gossiped attestations, checkpoints, witnesses and role grants have a budget of new
+ * statements, spent before the signature is checked: per lane (the connection a frame came by), 2,000
+ * a second up to a burst of 10,000, a new lane starting at 100; and a ceiling all lanes share, 4,000 a
+ * second after a burst of 20,000. The earlier, rejected
  * attempts spent it on repeats and unsigned frames, left attestations unbudgeted, budgeted 100 a
  * second (below a busy room's legitimate rate, so a drop read as an omission), emitted a metric per
  * dropped frame, and scanned the bucket map on every call. Each case below fails on one of those.
@@ -121,8 +123,8 @@ describe('gossip budget — sized for a busy room', () => {
           for (const f of room.next().value) { const r = ingest(node, 'hub', f); if (!r.ok && r.reason !== 'pending') refused++; }
         }
       }
-      // A burst of 10,000, then 2,000 a second: ~14,000 signature checks bought, of 40,000 sent.
-      assert.ok(Math.abs(flood.verified - 14000) <= 2, `verified ${flood.verified}`);
+      // A new lane's 100, then 2,000 a second: ~4,100 signature checks bought, of 40,000 sent.
+      assert.ok(Math.abs(flood.verified - 4100) <= 2, `verified ${flood.verified}`);
       assert.strictEqual(flood.verified + flood.dropped, 40000);
       assert.strictEqual(refused, 0, 'the honest peer lost nothing during the flood');
       assert.ok(metrics.length >= 1 && metrics.every((m) => m.fromPeerId === 'flooder'));
@@ -133,8 +135,8 @@ describe('gossip budget — sized for a busy room', () => {
 describe('gossip budget — only new statements spend it', () => {
   it('repeats, re-spelled signatures, unsigned frames and unknown signers are dropped before it and spend nothing', () => {
     withNode(3, ({ node, keys: [A, W, X] }) => {
-      const tokens = () => node._gossipBuckets.get('p')?.tokens ?? node._gossipBurst;
-      const spent = () => node._gossipBurst - tokens();
+      const tokens = () => node._gossipBuckets.get('p')?.tokens ?? node._gossipNewLane;
+      const spent = () => node._gossipNewLane - tokens();
       // One of each held: an attestation, a checkpoint and its witness, a conflict, a waiting witness.
       const att = attestation(A, 1);
       const cp = signed({ type: 'checkpoint', by: A.id, roster: ROOM, upto_seq: 8, root: 'r8', at: 1 }, A.priv, signCheckpoint);
@@ -165,7 +167,7 @@ describe('gossip budget — only new statements spend it', () => {
       }
       const reasons = new Set();
       for (const f of repeats) { const r = ingest(node, 'p', f); assert.strictEqual(r.ok, false); reasons.add(r.reason); }
-      assert.deepStrictEqual([...reasons].sort(), ['duplicate', 'malformed', 'unknown-attester-key']);
+      assert.deepStrictEqual([...reasons].sort(), ['duplicate', 'malformed', 'non-canonical-signature', 'unknown-attester-key']);
       assert.strictEqual(spent(), before, `50,000 repeats spent nothing (${spent() - before})`);
       assert.strictEqual(node._attestations.size(), 1, 'and a re-spelled signature is not a second attestation');
       assert.strictEqual(ingest(node, 'p', attestation(A, 2)).ok, true, 'a new statement is still taken');
@@ -175,12 +177,12 @@ describe('gossip budget — only new statements spend it', () => {
   it('a checkpoint older than every position held is dropped before it', () => {
     withNode(1, ({ node, keys: [A] }) => {
       for (let n = 1; n <= 32; n++) ingest(node, 'p', { type: 'checkpoint', checkpoint: signed({ type: 'checkpoint', by: A.id, roster: ROOM, upto_seq: 100 + n, root: `r${n}`, at: n }, A.priv, signCheckpoint) });
-      const spent = node._gossipBurst - node._gossipBuckets.get('p').tokens;
+      const spent = node._gossipNewLane - node._gossipBuckets.get('p').tokens;
       for (let i = 0; i < 1000; i++) {
         const r = ingest(node, 'p', { type: 'checkpoint', checkpoint: { type: 'checkpoint', by: A.id, roster: ROOM, upto_seq: i % 100, root: 'old', at: 1, sig: forgedSig() } });
         assert.strictEqual(r.reason, 'stale');
       }
-      assert.strictEqual(node._gossipBurst - node._gossipBuckets.get('p').tokens, spent);
+      assert.strictEqual(node._gossipNewLane - node._gossipBuckets.get('p').tokens, spent);
     });
   });
 });
@@ -201,7 +203,8 @@ describe('gossip budget — forged frames cannot starve genuine ones', () => {
         if (ms % 25 < 16) { const r = ingest(node, 'honest', genuine()); if (!r.ok) honestRefused++; }
       }
       assert.strictEqual(honestRefused, 0, 'every genuine statement from the honest peer was taken');
-      assert.ok(floodVerified <= 10000 + 10 * 2000 + 1, `what the flooder could send is bounded: ${floodVerified}`);
+      // A new lane's 100, then 2,000 a second for 10 s.
+      assert.ok(Math.abs(floodVerified - (100 + 10 * 2000)) <= 4, `what the flooder could send is bounded: ${floodVerified}`);
       // During the flood the flooder's own genuine relay is dropped, unverified, and marks nothing...
       const g = genuine();
       assert.strictEqual(ingest(node, 'flooder', g).reason, 'over-budget');
@@ -266,7 +269,7 @@ describe('gossip budget — what it reports, and what it keeps', () => {
       }
       assert.strictEqual(node._gossipBuckets.size, 4096);
       assert.ok(node._gossipBuckets.has('busy'), 'an active peer keeps its bucket');
-      assert.strictEqual(node._gossipBurst - node._gossipBuckets.get('busy').tokens, 50 + 6, 'and what it spent');
+      assert.strictEqual(node._gossipNewLane - node._gossipBuckets.get('busy').tokens, 50 + 6, 'and what it spent');
       assert.ok(!node._gossipBuckets.has('peer-0'), 'the least recently active went');
       assert.strictEqual(iterations, 6001 - 4096, 'one step at the head per eviction, nothing else');
     });
diff --git a/tests/gossip-lanes.test.js b/tests/gossip-lanes.test.js
new file mode 100644
index 00000000..a8ebdad9
--- /dev/null
+++ b/tests/gossip-lanes.test.js
@@ -0,0 +1,415 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME to a temp sandbox before lib/config loads
+
+/**
+ * 0.14.0, part A2 review of the gossip budget:
+ *
+ * - F1: role grants were outside the budget and were deduplicated by the signature as written, so one
+ *   captured grant re-spelled (padding, whitespace, a +/ swap) was stored, appended and relayed again
+ *   for every spelling, by every node. They now take the same order as every other signed statement
+ *   (malformed, spelling, repeat by the signature's bytes, unknown signer, then the budget), and the
+ *   store bounds what it keeps, and so what it relays.
+ * - F2: the budget was keyed by the peer id a sender declares and a new id started with the whole
+ *   burst, so minting ids bought 10,000 signature checks each. It is now kept per lane (the
+ *   connection a frame came by; over the relay, the relay connection and the sender id it names), a
+ *   new lane starts with 100, and every lane draws on one ceiling.
+ * - F4: a throwing log or metric sink took a frame's handling, or the node's shutdown, with it.
+ * - F5: an over-long signature was decoded and hashed by the repeat check before it was refused.
+ * - F6: a further conflicting root for a position already conflicted was verified at the peer's
+ *   budget, where the attester's rate was meant to bound it.
+ *
+ * Deterministic: the budget's clock is injected (node._gossipClock).
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const crypto = require('crypto');
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const { WebSocketServer } = require('ws');
+const { SymNode } = require('../lib/node');
+const { NullDiscovery } = require('../lib/discovery');
+const { nodeDir } = require('../lib/config');
+const { RelayConnection } = require('../lib/relay');
+const { RoleGrantStore } = require('../lib/role-grant-store');
+const { signAttestation, signCheckpoint, signWitness, signGrant, verifyGrant } = require('../lib/core');
+
+const ROOM = 'g';
+const kp = (id) => {
+  const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519', { publicKeyEncoding: { type: 'spki', format: 'der' }, privateKeyEncoding: { type: 'pkcs8', format: 'der' } });
+  return { id, pub: publicKey.slice(-32).toString('base64url'), priv: privateKey.slice(-32).toString('base64url') };
+};
+const signed = (fields, priv, sign) => { const o = { ...fields }; sign(o, priv); return o; };
+const forgedSig = () => crypto.randomBytes(64).toString('base64url');
+let n = 0;
+const forged = (k) => ({ of: `cmb-${++n}`, by: k.id, at: 1, roster: ROOM, verdict: 'aligned', categories: {}, seq: n, prev: 'p', sig: forgedSig(), sigAlg: 'ed25519' });
+const forgedGrant = (by, grantee) => ({ type: 'role-grant', grantee, role: 'validator', grantedBy: by, grantedAt: ++n, sig: forgedSig(), sigAlg: 'ed25519' });
+const respell = (s) => [`${s}=`, `${s}==`, ` ${s}`, `${s.slice(0, 40)}\n${s.slice(40)}`, s.replace(/-/g, '+').replace(/_/g, '/'), `${s}!`].filter((x) => x !== s);
+
+/** A node (not started) on an injected clock, with what it gossips captured. */
+function withNode(opts, fn) {
+  const name = `lanes-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+  const node = new SymNode({ name, silent: true, discovery: new NullDiscovery(), room: ROOM, ...opts });
+  try {
+    const sent = [];
+    node._gossipToRoster = (f) => sent.push(f);
+    const clock = { t: Date.now() + 1000 };
+    node._gossipClock = () => clock.t;
+    const metrics = [];
+    node.on('metric', (m) => metrics.push(m));
+    return fn({ node, sent, clock, metrics });
+  } finally {
+    for (const r of node._dropReports.values()) clearTimeout(r.timer);
+    node._releaseIdentityLock?.();
+    fs.rmSync(nodeDir(name), { recursive: true, force: true });
+  }
+}
+
+describe('role grants are gossip under the budget (F1)', () => {
+  it('a captured grant re-spelled is refused or a repeat: never stored, written or relayed again, and nothing is spent', () => {
+    const A = kp('anchor-A');
+    withNode({ anchor: { nodeId: A.id, publicKey: A.pub } }, ({ node, sent }) => {
+      const g = signGrant({ type: 'role-grant', grantee: 'node-V', role: 'validator', grantedBy: A.id, grantedAt: 1 }, A.priv);
+      assert.strictEqual(node._ingestRoleGrant(g, 'p', 'tcp:1').ok, true);
+      assert.strictEqual(sent.length, 1, 'relayed once');
+      const tokens = node._gossipBuckets.get('tcp:1').tokens;
+      assert.strictEqual(node._gossipNewLane - tokens, 1, 'a new grant spent one');
+      const spellings = respell(g.sig);
+      assert.ok(spellings.length >= 5 && spellings.every((sig) => verifyGrant({ ...g, sig }, A.pub).valid), 'every spelling verifies: that was the amplification');
+      const reasons = new Set();
+      for (let i = 0; i < 6000; i++) {
+        const r = node._ingestRoleGrant({ ...g, sig: spellings[i % spellings.length] }, 'p', 'tcp:1');
+        assert.strictEqual(r.ok, false);
+        reasons.add(r.reason);
+      }
+      for (let i = 0; i < 1000; i++) reasons.add(node._ingestRoleGrant({ ...g }, 'q', 'tcp:2').reason);
+      assert.deepStrictEqual([...reasons].sort(), ['duplicate', 'non-canonical-signature']);
+      assert.strictEqual(node._roleGrants.size(), 1, 'one grant held');
+      assert.strictEqual(node._roleGrants.grantsFor('node-V').length, 1);
+      const file = path.join(node._dir, 'role-grants', 'role-grants.jsonl');
+      assert.strictEqual(fs.readFileSync(file, 'utf8').trim().split('\n').length, 1, 'one line written');
+      assert.strictEqual(sent.length, 1, 'and nothing relayed again');
+      assert.strictEqual(node._gossipBuckets.get('tcp:1').tokens, tokens, 'nothing spent');
+      assert.strictEqual(node._gossipBuckets.has('tcp:2'), false);
+      assert.strictEqual(node.metrics().signaturesNotCanonical, 6000, 'the refusals are counted');
+    });
+  });
+
+  it("new grants spend the lane's budget before their signatures are checked, and only a grant kept is relayed", () => {
+    withNode({}, ({ node, sent }) => {
+      const P = kp('grantor-P');
+      const Q = kp('grantor-Q');
+      node._pinPeerKey(P.id, P.pub);
+      node._pinPeerKey(Q.id, Q.pub);
+      const reasons = {};
+      for (let i = 0; i < 300; i++) {
+        const r = node._ingestRoleGrant(forgedGrant(P.id, `x-${i}`), 'p', 'tcp:1');
+        reasons[r.reason] = (reasons[r.reason] || 0) + 1;
+      }
+      assert.deepStrictEqual(reasons, { 'bad-signature': 100, 'over-budget': 200 }, 'a new lane checks 100, then refuses unverified');
+      // A grantor whose key is not held costs nothing.
+      for (let i = 0; i < 100; i++) assert.strictEqual(node._ingestRoleGrant(forgedGrant('nobody', 'x'), 'p', 'tcp:5').reason, 'unknown-grantor-key');
+      assert.strictEqual(node._gossipBuckets.has('tcp:5'), false);
+      assert.strictEqual(sent.length, 0, 'nothing refused was relayed');
+      // Genuine grants from one grantor to one grantee: kept up to the pair's bound, and only those relayed.
+      let kept = 0;
+      for (let i = 0; i < 70; i++) {
+        const r = node._ingestRoleGrant(signGrant({ type: 'role-grant', grantee: 'node-X', role: 'validator', grantedBy: P.id, grantedAt: i }, P.priv), 'p', 'tcp:2');
+        if (r.ok) kept++; else assert.strictEqual(r.reason, 'pair-full');
+      }
+      assert.strictEqual(kept, 64);
+      assert.strictEqual(sent.length, 64);
+      // Another grantor's grant to the same grantee is not kept out by the first one's.
+      assert.strictEqual(node._ingestRoleGrant(signGrant({ type: 'role-grant', grantee: 'node-X', role: 'validator', grantedBy: Q.id, grantedAt: 1 }, Q.priv), 'p', 'tcp:3').ok, true);
+    });
+  });
+
+  it("the store dedups by the signature's bytes, keeps the canonical spelling, and bounds what it keeps without evicting", () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'grants-'));
+    try {
+      const A = kp('A');
+      const P = kp('P');
+      const Q = kp('Q');
+      const keys = new Map([[P.id, P.pub], [Q.id, Q.pub]]);
+      const opts = { anchor: { nodeId: A.id, publicKey: A.pub }, keys, dir, maxPerGrantor: 3, maxPerPair: 2, maxGrants: 5 };
+      const st = new RoleGrantStore(opts);
+      const grant = (by, grantee, at) => signGrant({ type: 'role-grant', grantee, role: 'validator', grantedBy: by.id, grantedAt: at }, by.priv);
+      const g = grant(A, 'V', 1);
+      assert.strictEqual(st.record({ ...g, sig: `${g.sig}=` }).stored, true, 'a direct caller may hand over another spelling');
+      assert.strictEqual(st.grantsFor('V')[0].sig, g.sig, 'it is kept as its signer wrote it');
+      for (const sig of [g.sig, ...respell(g.sig)]) assert.strictEqual(st.record({ ...g, sig }).reason, 'duplicate');
+      assert.strictEqual(st.has(` ${g.sig}`), true);
+      assert.strictEqual(st.size(), 1);
+
+      const r = (by, grantee, at) => st.record(grant(by, grantee, at)).reason ?? 'stored';
+      assert.deepStrictEqual([r(P, 'X', 1), r(P, 'X', 2), r(P, 'X', 3)], ['stored', 'stored', 'pair-full']);
+      assert.deepStrictEqual([r(P, 'Y', 4), r(P, 'Z', 5)], ['stored', 'grantor-full']);
+      assert.strictEqual(st.record(forgedGrant(P.id, 'W')).reason, 'grantor-full', 'refused before its signature is checked');
+      assert.deepStrictEqual([r(Q, 'X', 6), r(Q, 'Y', 7)], ['stored', 'store-full']);
+      assert.strictEqual(st.size(), 5);
+      assert.deepStrictEqual([r(A, 'X', 8), r(A, 'Z', 9)], ['stored', 'stored'], "the anchor's own are never refused");
+      assert.deepStrictEqual(st.grantsFor('X').map((x) => x.grantedAt), [1, 2, 6, 8], 'nothing kept was evicted');
+      const again = new RoleGrantStore(opts);
+      assert.strictEqual(again.size(), 7, 'and a restart reads back what was kept');
+      assert.strictEqual(again.resolveRole('X', 100), 'validator');
+    } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+  });
+});
+
+describe('the budget is kept per connection, not per declared id (F2)', () => {
+  it('a lane seen for the first time has 100 checks and earns the rest at the rate, up to the burst', () => {
+    withNode({}, ({ node, clock }) => {
+      const A = kp('att-A');
+      node._pinPeerKey(A.id, A.pub);
+      const send = (count, lane) => {
+        let checked = 0;
+        for (let i = 0; i < count; i++) if (node._ingestAttestation(forged(A), 'p', 'p', lane).reason !== 'over-budget') checked++;
+        return checked;
+      };
+      assert.strictEqual(send(300, 'tcp:1'), 100, 'a new lane: 100');
+      clock.t += 50;
+      assert.strictEqual(send(300, 'tcp:1'), 100, '2,000 a second: 100 in 50 ms');
+      clock.t += 60_000;
+      assert.strictEqual(send(12_000, 'tcp:1'), 10_000, 'and at most the burst once it has earned it');
+    });
+  });
+
+  it('fresh ids on one connection share its lane', () => {
+    withNode({}, ({ node }) => {
+      const A = kp('att-A');
+      node._pinPeerKey(A.id, A.pub);
+      const lane = node._newLane('tcp');
+      let rejected = 0;
+      node.on('metric', (m) => { if (m.type === 'attestation-rejected') rejected++; });
+      for (let i = 0; i < 1000; i++) node._frameHandler.handle(`id-${i}`, `id-${i}`, { type: 'attestation', attestation: forged(A) }, lane);
+      assert.strictEqual(rejected, 100, 'checked: one new lane, not 1,000');
+      assert.strictEqual(node.metrics().gossipOverBudget, 900);
+      assert.deepStrictEqual([...node._gossipBuckets.keys()], [lane]);
+      // Checkpoints, witnesses and role grants go by the lane as well.
+      const other = node._newLane('tcp');
+      for (let i = 0; i < 30; i++) {
+        node._frameHandler.handle(`c-${i}`, `c-${i}`, { type: 'checkpoint', checkpoint: { type: 'checkpoint', by: A.id, roster: ROOM, upto_seq: i + 1, root: `r${i}`, at: 1, sig: forgedSig() } }, other);
+        node._frameHandler.handle(`w-${i}`, `w-${i}`, { type: 'witness', witness: { type: 'witness', attester: A.id, roster: ROOM, upto_seq: i + 1, root: 'r', by: A.id, role: 'participant', at: 1, sig: forgedSig() } }, other);
+        node._frameHandler.handle(`g-${i}`, `g-${i}`, { type: 'role-grant', grant: forgedGrant(A.id, `x-${i}`) }, other);
+      }
+      assert.deepStrictEqual([...node._gossipBuckets.keys()], [lane, other]);
+      assert.strictEqual(node._gossipNewLane - node._gossipBuckets.get(other).tokens, 90, 'each spent one of its lane');
+    });
+  });
+
+  it('fresh sender ids over the relay are a lane each, of 100, and all of them together stay under the ceiling', () => {
+    withNode({}, ({ node, clock, metrics }) => {
+      const A = kp('att-A');
+      node._pinPeerKey(A.id, A.pub);
+      const logs = [];
+      node._log = (m) => logs.push(m);
+      const relay = (id, frame) => node._relay._handlePeerMessage(id, id, frame, `relay:1:${id}`);
+      const checked = () => metrics.filter((m) => m.type === 'attestation-rejected').length;
+      // 300 ids, 101 forgeries each.
+      for (let i = 0; i < 300; i++) for (let j = 0; j < 101; j++) relay(`id-${i}`, { type: 'attestation', attestation: forged(A) });
+      assert.strictEqual(checked(), 20_000, 'the ceiling: a burst of 20,000, however many ids');
+      assert.ok(node._gossipBuckets.has('relay:1:id-0'), 'the relay frame came with its lane');
+      assert.strictEqual(node._gossipBuckets.get('relay:1:id-0').tokens, 0, 'each id has 100');
+      assert.strictEqual(node._gossipBuckets.get('relay:1:id-299').tokens, 100, 'those past the ceiling checked nothing');
+      // What the ceiling dropped is said in one report, not one per id.
+      const ceiling = () => metrics.filter((m) => m.type === 'gossip-over-ceiling');
+      assert.strictEqual(ceiling().length, 1, 'said once, at the first drop');
+      node._sayDrops(node._dropReports.get('gossip-over-ceiling|*'));
+      assert.strictEqual(ceiling().length, 2);
+      assert.strictEqual(ceiling().reduce((s, m) => s + m.dropped, 0), 100 * 101, 'every drop counted');
+      assert.strictEqual(ceiling()[0].perSecond, 4000);
+      assert.strictEqual(ceiling()[1].fromPeerIds.length, 16, 'naming up to 16 peers');
+      assert.strictEqual(node.metrics().gossipOverBudget, 300 * 101 - 20_000);
+      // The frame handler's own drop line is said once per connection and reason, not once per id:
+      // checked forgeries, and frames naming a signer whose key is not held (dropped for free).
+      for (let i = 0; i < 1000; i++) relay(`free-${i}`, { type: 'attestation', attestation: { ...forged(A), by: `nobody-${i}` } });
+      assert.strictEqual(logs.filter((l) => /Attestation from .* dropped \(bad-signature\)/.test(l)).length, 1);
+      assert.strictEqual(logs.filter((l) => /dropped \(unknown-attester-key\)/.test(l)).length, 1);
+      // The ceiling refills at 4,000 a second.
+      clock.t += 1000;
+      const before = checked();
+      for (let i = 0; i < 50; i++) for (let j = 0; j < 100; j++) relay(`next-${i}`, { type: 'attestation', attestation: forged(A) });
+      assert.strictEqual(checked() - before, 4000);
+    });
+  });
+
+  it('each TCP connection, accepted or dialled, is a lane of its own, whatever id it claims', async () => {
+    const net = require('net');
+    const { EventEmitter } = require('events');
+    const { writeFrame } = require('../lib/frame-parser');
+    const name = `lanes-tcp-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+    const node = new SymNode({ name, silent: true, discovery: new NullDiscovery(), room: ROOM });
+    const A = kp('att-A');
+    const sockets = [];
+    const server = net.createServer((sock) => { sockets.push(sock); writeFrame(sock, { type: 'attestation', attestation: forged(A) }); });
+    await new Promise((r) => server.listen(0, '127.0.0.1', r));
+    try {
+      await node.start();
+      node._pinPeerKey(A.id, A.pub);
+      const accepted = () => {
+        const t = new EventEmitter();
+        t._closed = false;
+        t.send = () => true;
+        t.trySend = () => ({ ok: true });
+        t.close = () => { t._closed = true; };
+        return t;
+      };
+      // Accepted: two connections, one after the other, claiming one id.
+      for (let i = 0; i < 2; i++) {
+        const t = accepted();
+        node._discovery.emit('inbound-connection', t, 'p-in', 'p-in', { type: 'handshake', nodeId: 'p-in', name: 'p-in' });
+        t.emit('message', { type: 'attestation', attestation: forged(A) });
+        t.close();
+      }
+      // Dialled.
+      node._connectToPeer('127.0.0.1', server.address().port, 'p-out', 'p-out');
+      for (let i = 0; i < 250 && node._gossipBuckets.size < 3; i++) await new Promise((r) => setTimeout(r, 20));
+      assert.deepStrictEqual([...node._gossipBuckets.keys()].sort(), ['tcp:1', 'tcp:2', 'tcp:3']);
+    } finally {
+      await node.stop();
+      for (const sock of sockets) sock.destroy();
+      await new Promise((r) => server.close(() => r()));
+      fs.rmSync(nodeDir(name), { recursive: true, force: true });
+    }
+  });
+
+  it('the relay hands each frame over with its lane: this connection and the sender id it names', async () => {
+    const wss = new WebSocketServer({ port: 0 });
+    let connections = 0;
+    wss.on('connection', (ws) => {
+      const c = ++connections;
+      ws.once('message', () => {
+        for (const from of c === 1 ? ['a', 'b', 'a'] : ['a']) ws.send(JSON.stringify({ from, fromName: from, payload: { type: 'ping' } }));
+        if (c === 1) setTimeout(() => ws.close(), 50);
+      });
+    });
+    const got = [];
+    let running = true;
+    const rc = new RelayConnection({
+      relayUrl: `ws://127.0.0.1:${wss.address().port}`, relayToken: 'x'.repeat(40), log: () => {},
+      getIdentity: () => ({ nodeId: 'c'.repeat(64) }), isRunning: () => running, getPeers: () => new Map(), getMeshNode: () => null,
+      createPeer: () => { throw new Error('no peers expected'); }, addPeer: () => {}, onPeerLeft: () => {}, onAuthRefused: () => {},
+      handlePeerMessage: (id, name, msg, lane) => got.push([id, lane]),
+      nodeName: 'lanes', peerWakeChannels: new Map(), saveWakeChannels: () => {},
+    });
+    try {
+      rc.connect();
+      for (let i = 0; i < 250 && got.length < 4; i++) await new Promise((r) => setTimeout(r, 20));
+      assert.deepStrictEqual(got, [['a', 'relay:1:a'], ['b', 'relay:1:b'], ['a', 'relay:1:a'], ['a', 'relay:2:a']], 'a reconnection is a new lane');
+    } finally { running = false; rc.destroy(); await new Promise((r) => wss.close(() => r())); }
+  });
+});
+
+describe('drop reporting cannot break gossip or shutdown (F4)', () => {
+  it('a throwing metric listener neither breaks ingest nor loses or repeats a count', () => {
+    withNode({}, ({ node }) => {
+      const A = kp('att-A');
+      node._pinPeerKey(A.id, A.pub);
+      const said = [];
+      node.on('metric', (m) => { if (m.type === 'gossip-over-budget') said.push(m); });
+      node.on('metric', () => { throw new Error('a bad sink'); });
+      const reasons = {};
+      for (let i = 0; i < 300; i++) {
+        const r = node._ingestAttestation(forged(A), 'p', 'p', 'tcp:1');
+        reasons[r.reason] = (reasons[r.reason] || 0) + 1;
+      }
+      assert.deepStrictEqual(reasons, { 'bad-signature': 100, 'over-budget': 200 });
+      assert.strictEqual(said.length, 1, 'the first drop was said, and the sink threw');
+      const report = node._dropReports.get('gossip-over-budget|p');
+      node._sayDrops(report);
+      node._sayDrops(report);
+      assert.strictEqual(said.length, 2, 'the rest once, not again');
+      assert.strictEqual(said.reduce((s, m) => s + m.dropped, 0), 200, 'every drop said once');
+      assert.strictEqual(node.metrics().gossipOverBudget, 200);
+    });
+  });
+
+  for (const how of ['a throwing metric listener', 'a report that throws']) {
+    it(`stop() finishes with ${how}: the relay is closed and the identity lock released`, async () => {
+      const name = `lanes-stop-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+      const node = new SymNode({ name, silent: true, discovery: new NullDiscovery(), room: ROOM });
+      try {
+        node._pinPeerKey('att', kp('att').pub);
+        const t = Date.now();
+        node._gossipClock = () => t;
+        node._gossipBuckets.set('q', { tokens: 0, at: t });
+        node._ingestAttestation(forged({ id: 'att' }), 'q', 'q');   // said at once
+        node._ingestAttestation(forged({ id: 'att' }), 'q', 'q');   // waits for the window to close
+        assert.ok(node._dropReports.get('gossip-over-budget|q').dropped > 0, 'a drop waits to be said');
+        if (how === 'a report that throws') node._sayDrops = () => { throw new Error('a bad report'); };
+        else node.on('metric', () => { throw new Error('a bad sink'); });
+        let destroyed = false;
+        let released = false;
+        const destroy = node._relay.destroy.bind(node._relay);
+        node._relay.destroy = () => { destroyed = true; destroy(); };
+        const release = node._releaseIdentityLock;
+        node._releaseIdentityLock = () => { released = true; release?.(); };
+        node._running = true;
+        await node.stop();
+        assert.deepStrictEqual([destroyed, released], [true, true]);
+      } finally {
+        for (const r of node._dropReports.values()) clearTimeout(r.timer);
+        fs.rmSync(nodeDir(name), { recursive: true, force: true });
+      }
+    });
+  }
+});
+
+describe('an over-long signature (F5)', () => {
+  it('is malformed, refused before anything decodes or looks it up; a re-spelling is refused before the lookup too', () => {
+    withNode({}, ({ node }) => {
+      const A = kp('att-A');
+      const W = kp('wit-W');
+      node._pinPeerKey(A.id, A.pub);
+      node._pinPeerKey(W.id, W.pub);
+      let lookups = 0;
+      const has = node._attestations.has.bind(node._attestations);
+      node._attestations.has = (sig) => { lookups++; return has(sig); };
+      let grantLookups = 0;
+      const grantHas = node._roleGrants.has.bind(node._roleGrants);
+      node._roleGrants.has = (sig) => { grantLookups++; return grantHas(sig); };
+      const att = signed({ of: 'cmb-1', by: A.id, at: 1, roster: ROOM, method: 'heuristic', verdict: 'aligned', categories: {}, role: 'participant', seq: 1, prev: 'p' }, A.priv, signAttestation);
+      const cp = signed({ type: 'checkpoint', by: A.id, roster: ROOM, upto_seq: 8, root: 'r8', at: 1 }, A.priv, signCheckpoint);
+      const w = signed({ type: 'witness', attester: A.id, roster: ROOM, upto_seq: 8, root: 'r8', by: W.id, role: 'participant', at: 1 }, W.priv, signWitness);
+      const g = signGrant({ type: 'role-grant', grantee: 'V', role: 'validator', grantedBy: A.id, grantedAt: 1 }, A.priv);
+      const ingest = (sig) => [
+        node._ingestAttestation({ ...att, sig }, 'p', 'p').reason,
+        node._ingestCheckpoint({ ...cp, sig }, 'p').reason,
+        node._ingestWitness({ ...w, sig }, 'p').reason,
+        node._ingestRoleGrant({ ...g, sig }, 'p').reason,
+      ];
+      for (const sig of [`${att.sig}${'A'.repeat(900_000)}`, 'A'.repeat(129), '', undefined, 42]) assert.deepStrictEqual(ingest(sig), ['malformed', 'malformed', 'malformed', 'malformed']);
+      assert.deepStrictEqual(ingest('A'.repeat(128)), Array(4).fill('non-canonical-signature'), '128 characters is not too long');
+      assert.deepStrictEqual(ingest(`${att.sig}=`), Array(4).fill('non-canonical-signature'));
+      assert.deepStrictEqual([lookups, grantLookups], [0, 0], 'none was looked up');
+      assert.strictEqual(node._ingestAttestation(att, 'p', 'p').ok, true);
+      assert.strictEqual(lookups, 1, 'a canonical one is');
+    });
+  });
+});
+
+describe('equivocation at one position (F6)', () => {
+  it('a further root for a conflicted position is dropped before the budget and the signature; the first conflict is kept although the rate is spent', () => {
+    withNode({ checkpointRate: { perSecond: 4, burst: 2 } }, ({ node, sent, metrics }) => {
+      const A = kp('att-A');
+      node._pinPeerKey(A.id, A.pub);
+      const cp = (seq, root) => signed({ type: 'checkpoint', by: A.id, roster: ROOM, upto_seq: seq, root, at: seq }, A.priv, signCheckpoint);
+      const ingest = (c) => node._ingestCheckpoint(c, 'p', 'tcp:1');
+      assert.deepStrictEqual([ingest(cp(8, 'r8')).ok, ingest(cp(16, 'r16')).ok, ingest(cp(24, 'r24')).reason], [true, true, 'over-rate'], "the attester's rate is spent");
+      const relayed = sent.length;
+      assert.strictEqual(ingest(cp(8, 'forked')).reason, 'conflict', 'a second root at a held position: the evidence');
+      assert.strictEqual(node._attestations.conflictAt(A.id, 8).root, 'forked', 'kept although the rate is spent');
+      assert.strictEqual(metrics.filter((m) => m.type === 'attestation-conflict').length, 1);
+      const tokens = node._gossipBuckets.get('tcp:1').tokens;
+      for (let i = 0; i < 2000; i++) {
+        const third = i % 2 ? { ...cp(8, 'r8'), root: `fork-${i}`, sig: forgedSig() } : cp(8, `fork-${i}`);
+        assert.strictEqual(ingest(third).reason, 'conflict');
+      }
+      assert.strictEqual(node._gossipBuckets.get('tcp:1').tokens, tokens, 'a third root spends nothing: no signature is checked');
+      assert.strictEqual(node._attestations.conflictAt(A.id, 8).root, 'forked', 'and changes nothing');
+      assert.strictEqual(sent.length, relayed, 'nor is relayed');
+    });
+  });
+});

From f2f985c1571449840dd3caf7305b980f1c41a56a Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Fri, 2 Oct 2026 07:23:27 +0100
Subject: [PATCH 078/148] 0.14.0 review A2: the timestamp ratchet starts from
 every own record stored

F3: _timestampRatchetBase read "this node's newest stored record" from
allEntries(), which is recent(20), so on a node that had admitted 20 peer
records since its own last one the ratchet started from zero and a backward
clock step across a restart could mint a timestamp already used. It now reads
MemoryStore.newestOwnCreatedAt(), which walks the whole index once per
process (without filling the cache). The CHANGELOG line says so.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 CHANGELOG.md                        |  6 +++--
 lib/memory-store.js                 | 16 +++++++++++
 lib/node.js                         | 14 ++++------
 tests/inbox-limit-and-clock.test.js | 41 +++++++++++++++++++++++++++--
 4 files changed, 64 insertions(+), 13 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 04bb0619..9132719d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -107,8 +107,10 @@ debt, and the daemon's log flood. Every item has a test that fails without its f
   even when relayed. `from` is a display label (two node ids can sign the same `createdBy`):
   authorize on `author.nodeId`.
 - **Record timestamps ran ahead of the clock after a backward step, and restarted every process
-  (K6).** The ratchet starts from this node's newest stored record. After a step back of more than a
-  minute, timestamps follow the clock again, with a `clock-stepped-back` metric.
+  (K6).** The ratchet starts from the newest of this node's own stored records, read from the whole
+  store index once per process (a first reading took only the 20 most recently stored, so after 20
+  peer records it started from zero). After a step back of more than a minute, timestamps follow the
+  clock again, with a `clock-stepped-back` metric.
 - **Mood values were invented or lost (B-R11).** `valence` and `arousal` are kept only when measured,
   must be numbers in [-1, 1], and a mood given only as numbers keeps them.
 - **Records had no size bound below the 1 MiB frame (B-R13).** A category is at most 256 KiB of text
diff --git a/lib/memory-store.js b/lib/memory-store.js
index 915dc866..c956041b 100644
--- a/lib/memory-store.js
+++ b/lib/memory-store.js
@@ -462,6 +462,22 @@ class MemoryStore {
   /** Backward compat alias */
   allEntries() { return this.recent(20); }
 
+  /**
+   * The newest `createdTimestamp` among this node's own stored records (those no peer delivered), over
+   * the whole index, not a recent window: the timestamp ratchet starts from it. O(records), once; it
+   * reads without filling the cache.
+   * @returns {number} 0 when there is none
+   */
+  newestOwnCreatedAt() {
+    let max = 0;
+    for (const [key, idx] of this._index.byKey) {
+      if (idx.peerId != null) continue;
+      const t = recordCreatedAt((this._cache.get(key) || this._load(idx.filePath))?.cmb);
+      if (Number.isFinite(t) && t > max) max = t;
+    }
+    return max;
+  }
+
   // ── Context Curation ─────────────────────────────────────
 
   /**
diff --git a/lib/node.js b/lib/node.js
index f239e1d7..40574f0c 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -1,6 +1,6 @@
 'use strict';
 
-const { recordKey, recordCreatedBy, recordCreatedAt, recordParents } = require('./record');
+const { recordKey, recordCreatedBy, recordParents } = require('./record');
 
 /**
  * SymNode — sovereign mesh node with cognitive coupling.
@@ -2564,15 +2564,11 @@ class SymNode extends EventEmitter {
    */
   _timestampRatchetBase() {
     if (this._lastCreatedTimestamp === undefined) {
+      // Every stored record of this node's own, not a recent window: on a node that has admitted 20
+      // peer records since its last own one, the 20 newest held none of its own and the ratchet
+      // restarted from zero.
       let max = 0;
-      try {
-        for (const e of this._store.allEntries()) {
-          if (e && e.peerId == null) {
-            const t = recordCreatedAt(e.cmb);
-            if (Number.isFinite(t) && t > max) max = t;
-          }
-        }
-      } catch { /* an unreadable store starts the ratchet at zero */ }
+      try { max = this._store.newestOwnCreatedAt(); } catch { /* an unreadable store starts the ratchet at zero */ }
       this._lastCreatedTimestamp = max;
     }
     return this._lastCreatedTimestamp;
diff --git a/tests/inbox-limit-and-clock.test.js b/tests/inbox-limit-and-clock.test.js
index 4b19cd3c..b05e29fb 100644
--- a/tests/inbox-limit-and-clock.test.js
+++ b/tests/inbox-limit-and-clock.test.js
@@ -6,8 +6,10 @@ require('./_isolate-home'); // redirect $HOME to a temp sandbox before lib/confi
  * - K4: inbox()'s limit counts unread deliveries; an item already acked (read in full by id) comes
  *   back marked but does not take a new delivery's place.
  * - K6: record timestamps are strictly increasing across restarts (the ratchet starts from the newest
- *   stored record), and after the clock steps back by more than a minute they follow the clock again
- *   instead of running ahead of it indefinitely.
+ *   of this node's own stored records), and after the clock steps back by more than a minute they
+ *   follow the clock again instead of running ahead of it indefinitely.
+ * - 0.14.0 part A2 F3: "the newest stored record" was read from the 20 most recently stored, so on a
+ *   node that had admitted 20 peer records since its own last one the ratchet started from zero.
  */
 
 const { describe, it } = require('node:test');
@@ -69,6 +71,41 @@ describe('record timestamps (K6)', () => {
     } finally { fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
   });
 
+  it('stay strictly increasing across a restart after 20 or more peer records were stored since', () => {
+    const name = uniq('clock-busy');
+    const peerName = uniq('clock-peer');
+    const realNow = Date.now;
+    try {
+      const a = mkNode(name);
+      const peer = mkNode(peerName);
+      const t0 = realNow();
+      Date.now = () => t0 + 30 * 1000;   // written 30 s "ahead", as after a small clock step
+      const own = a.remember({ focus: 'before the restart' });
+      // 25 peer records, minted further ahead still and stored after this node's own.
+      for (let i = 0; i < 25; i++) {
+        Date.now = () => t0 + 50 * 1000 + i;
+        const r = peer.remember({ focus: `peer record ${i}` });
+        Date.now = () => t0 + 31 * 1000 + i;
+        assert.ok(a._store.receiveFromPeer(peer.nodeId, { cmb: r.cmb, content: r.content, source: peerName }), `peer record ${i} stored`);
+      }
+      assert.ok(a._store.allEntries().every((e) => e.peerId != null), 'none of the 20 most recent is its own');
+      Date.now = realNow;
+      a._identityLock?.release?.();
+      a._releaseIdentityLock?.();
+      const b = mkNode(name); // a new process on the same store, the clock 30 s behind the last record
+      const after = b.remember({ focus: 'after the restart' });
+      const ts = after.cmb.metadata.createdTimestamp;
+      assert.ok(ts > own.cmb.metadata.createdTimestamp, `${ts} after ${own.cmb.metadata.createdTimestamp}`);
+      assert.ok(ts < t0 + 50 * 1000, "and it starts from this node's own, not a peer's");
+      b._releaseIdentityLock?.();
+      peer._releaseIdentityLock?.();
+    } finally {
+      Date.now = realNow;
+      fs.rmSync(nodeDir(name), { recursive: true, force: true });
+      fs.rmSync(nodeDir(peerName), { recursive: true, force: true });
+    }
+  });
+
   it('follow the clock again after it steps back by more than a minute', () => {
     const name = uniq('clockstep');
     const node = mkNode(name);

From f775581c60558ac8d6d5e44ea0cc338ea3ade4a6 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Fri, 2 Oct 2026 07:23:35 +0100
Subject: [PATCH 079/148] 0.14.0 review A2: the review's suggestions on logging
 and the inbox prose

- The door's refusal is said once a minute per connection and reason, with a
  count; it was a line per frame, and fresh ids over the relay bought one
  each. The attestation drop line shares the helper (_sayOnceAMinute).
- An ESIGN from the xMesh synthesis loop is said as the node failing to sign,
  not as an error of its delegate.
- gossipEntries drops expired wake channels without a synchronous file write
  on the connection path.
- The checkpoint-over-rate line names the peers that brought the checkpoints.
- inbox(): the comment, JSDoc and CHANGELOG say a reply holds up to limit
  unread and limit acked items.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 CHANGELOG.md                | 11 +++++--
 lib/core/wake.js            |  4 ++-
 lib/frame-handler.js        | 38 +++++++++++++++++-------
 lib/node.js                 |  8 +++--
 tests/gossip-lanes.test.js  | 58 +++++++++++++++++++++++++++++++++++++
 tests/wake-channels.test.js |  3 ++
 6 files changed, 105 insertions(+), 17 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9132719d..e6cbaf83 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -67,6 +67,8 @@ debt, and the daemon's log flood. Every item has a test that fails without its f
     relay's peer list is read for 256 too. An over-long frame from an older sender is said once a
     minute per peer.
   - At most 64 frames wait for one sleeping peer, and they go with its channel.
+  - Building a `peer-info` frame on a connection drops expired channels without writing the file
+    there (a synchronous write); the next save writes it, and a load drops them again.
   - A node id, platform, token and environment are short strings, and a token is one path segment
     (it is put in the push provider's request path).
 - **A peer could claim to have proven its key.** `provenPublicKey`, which only this node's own
@@ -85,7 +87,8 @@ debt, and the daemon's log flood. Every item has a test that fails without its f
   null (which signed the string `"null"`), and the v2.0 preimage refuses a record without a room.
 - **A record that could not be signed was sent unsigned (B-R12).** `remember()` now throws `ESIGN`
   before anything is stored or dispatched (§18.3.1). A `MeshAgent` whose node cannot sign says so
-  once and stops remixing and observing.
+  once and stops remixing and observing. The xMesh synthesis loop says a record it could not sign as
+  the node failing to sign, not as an error of its delegate.
 
 ### Fixed — delivery and records
 
@@ -100,7 +103,8 @@ debt, and the daemon's log flood. Every item has a test that fails without its f
   recomputed on receipt, not by the signature bytes: a hedged Ed25519 signer (WebKit) signs one
   assertion differently each time, and its re-signed copy surfaced twice.
 - **`inbox()`'s limit counted acked items (K4).** It counts unread deliveries. Acked ones still come
-  back, marked, up to the same limit, and are passed over beyond it, so the limit bounds the reply.
+  back, marked, up to the same limit, and are passed over beyond it, so a reply holds at most `limit`
+  unread and `limit` acked items: 2 × `limit` in all.
 - **The inbox `from` was the author's label whether or not anything proved it (K5).** It is now the
   author when the signature proved who that is, and otherwise the peer that delivered it. The claim
   stays in `author.name`. A v2.0 record verified against its signed node id carries `author.nodeId`,
@@ -361,7 +365,8 @@ debt, and the daemon's log flood. Every item has a test that fails without its f
 - **A dropped attestation is logged once a minute per connection and reason, with a count.** It was
   logged once per frame, and one naming a signer whose key is not held is dropped before any budget.
   Per connection, not per peer: over the relay the id is the sender's to choose, and a fresh one per
-  frame bought a line per frame.
+  frame bought a line per frame. A frame the room's door refuses is said the same way; it was said
+  once per frame.
 
 ### Fixed — dependencies
 
diff --git a/lib/core/wake.js b/lib/core/wake.js
index 4b60c1c2..0c96a48b 100644
--- a/lib/core/wake.js
+++ b/lib/core/wake.js
@@ -281,7 +281,9 @@ class WakeManager {
    * @returns {Array<{nodeId:string, name:string, wakeChannel:object, lastSeen:number}>}
    */
   gossipEntries(excludeId, nameOf = () => undefined, limit = PEER_INFO_MAX) {
-    this.pruneWakeChannels();
+    // Not saved here: this runs on a connection, and a synchronous write there held the event loop.
+    // What expired is dropped again when the file is loaded, and the next save writes it out.
+    this.pruneWakeChannels({ save: false });
     let held = [];
     for (const [id, ch] of this._peerWakeChannels) if (id !== excludeId) held.push([id, ch]);
     if (held.length > limit) held = held.sort((a, b) => (b[1].lastSeen ?? 0) - (a[1].lastSeen ?? 0)).slice(0, limit);
diff --git a/lib/frame-handler.js b/lib/frame-handler.js
index 5bbc6a43..5a96ced8 100644
--- a/lib/frame-handler.js
+++ b/lib/frame-handler.js
@@ -108,6 +108,7 @@ class FrameHandler {
     this._cliHostMode = opts.cliHostMode || false;
     this._unsignedWarned = new Set();
     this._attDropSaid = new Map(); // `${connection}|${reason}` -> { at, more }: a dropped attestation is said once a minute
+    this._doorSaid = new Map();    // `${connection}|${reason}` -> { at, more }: a frame the door refused, the same way
     this._longPeerInfoSaid = new Map(); // peerId -> when an over-long peer-info from it was last said
     this._audienceSaid = new Map(); // `${peerId}|${reason}` -> { at, more }: a refused audience, the same way
     // THE ADMISSION SEAM (sym-core split). Frame routing is open; the engine that judges an
@@ -239,7 +240,10 @@ class FrameHandler {
         && typeof this._node._roomDoor === 'function') {
       const door = this._node._roomDoor(peerId);
       if (!door.pass) {
-        this._node._log(`Door refused '${msg.type}' from ${peerName}: ${door.reason}`);
+        // Once a minute per connection and reason, with a count: a refused peer sending frames, or
+        // fresh ids over the relay, bought a line per frame.
+        this._sayOnceAMinute(this._doorSaid, `${connectionOf(lane) ?? peerId}|${door.reason}`,
+          (more) => `Door refused '${msg.type}' from ${peerName}: ${door.reason}${more}`);
         return;
       }
     }
@@ -1674,15 +1678,26 @@ class FrameHandler {
     // said once a minute per connection and reason, with how many more there were, not once per frame.
     // Per connection, not per peer id: over the relay the id is the sender's to choose, and a fresh one
     // per frame bought a line per frame.
-    const k = `${connectionOf(lane) ?? peerId}|${r.reason}`;
+    this._sayOnceAMinute(this._attDropSaid, `${connectionOf(lane) ?? peerId}|${r.reason}`,
+      (more) => `Attestation from ${peerName} dropped (${r.reason}) — of:${String(att.of).slice(0, 12)} by:${String(att.by).slice(0, 8)}${more}`);
+  }
+
+  /**
+   * Say a line at most once a minute per key, with how many more there were since it was last said.
+   * `said` holds at most 1,024 keys, the least recently said let go first. O(1).
+   * @param {Map} said
+   * @param {string} key
+   * @param {(more: string) => string} line
+   * @private
+   */
+  _sayOnceAMinute(said, key, line) {
     const now = Date.now();
-    const said = this._attDropSaid.get(k);
-    if (said && now - said.at < 60_000) { said.more++; return; }
-    this._attDropSaid.delete(k);
-    if (this._attDropSaid.size >= 1024) this._attDropSaid.delete(this._attDropSaid.keys().next().value);
-    this._attDropSaid.set(k, { at: now, more: 0 });
-    const more = said && said.more ? ` (and ${said.more} more since it was last said)` : '';
-    this._node._log(`Attestation from ${peerName} dropped (${r.reason}) — of:${String(att.of).slice(0, 12)} by:${String(att.by).slice(0, 8)}${more}`);
+    const last = said.get(key);
+    if (last && now - last.at < 60_000) { last.more++; return; }
+    said.delete(key);
+    if (said.size >= 1024) said.delete(said.keys().next().value);
+    said.set(key, { at: now, more: 0 });
+    this._node._log(line(last && last.more ? ` (and ${last.more} more since it was last said)` : ''));
   }
 
   /**
@@ -1756,7 +1771,10 @@ class FrameHandler {
           this._node._log(`Synthesis loop: shared domain insight back to mesh`);
         }
       } catch (err) {
-        this._node._log(`Synthesis delegate error: ${err.message}`);
+        // A record this node cannot sign is its key's failure, said by remember() already; naming the
+        // delegate would send the operator to the wrong place.
+        if (err && err.code === 'ESIGN') this._node._log('Synthesis not shared: this node cannot sign its records');
+        else this._node._log(`Synthesis delegate error: ${err && err.message}`);
       }
     }
   }
diff --git a/lib/node.js b/lib/node.js
index 40574f0c..d90789ec 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -1412,7 +1412,7 @@ class SymNode extends EventEmitter {
     let line;
     if (r.metric === 'checkpoint-over-rate') {
       ev = { type: r.metric, attester: r.key, dropped: r.dropped, fromPeerIds: [...r.peers], perSecond: this._checkpointRate };
-      line = `Checkpoints from ${String(r.key).slice(0, 8)} over their rate (${this._checkpointRate}/s): ${ev.dropped} not stored, witnessed or relayed`;
+      line = `Checkpoints from ${String(r.key).slice(0, 8)} over their rate (${this._checkpointRate}/s): ${ev.dropped} not stored, witnessed or relayed, brought by ${ev.fromPeerIds.map((id) => String(id).slice(0, 8)).join(', ')}`;
     } else if (r.metric === 'gossip-over-ceiling') {
       ev = { type: r.metric, dropped: r.dropped, frames: { ...r.frames }, authors: [...r.authors], fromPeerIds: [...r.peers], perSecond: this._gossipGlobalRate };
       const what = Object.entries(ev.frames).map(([t, n]) => `${n} ${t}`).join(', ');
@@ -2234,7 +2234,8 @@ class SymNode extends EventEmitter {
    *
    * @param {object} [opts]
    * @param {boolean} [opts.peek=false] — return without advancing the cursor.
-   * @param {number}  [opts.limit=50]   — max messages (oldest-first).
+   * @param {number}  [opts.limit=50]   — max unread messages (oldest-first); acked ones are listed
+   *   up to as many again, so a reply holds at most 2 × limit.
    * @param {number}  [opts.since]      — explicit cursor override (seq).
    * @returns {{ messages: object[], drained: number, remaining: number, cursor: number }}
    */
@@ -2244,7 +2245,8 @@ class SymNode extends EventEmitter {
     const fresh = this._inbox.filter((m) => m.seq > from);
     // The limit counts what is still unread: an item already acked (read in full by id) comes back
     // marked, but does not use up a place a new delivery needed. Acked items are listed up to the
-    // same limit; past it they are passed over (they were read), so `limit` still bounds the reply.
+    // same limit; past it they are passed over (they were read), so a reply holds at most `limit`
+    // unread and `limit` acked items: 2 × `limit` in all.
     const slice = [];
     let unread = 0, ackedListed = 0, passed = 0, lastSeq = null;
     for (const m of fresh) {
diff --git a/tests/gossip-lanes.test.js b/tests/gossip-lanes.test.js
index a8ebdad9..5bd82b3a 100644
--- a/tests/gossip-lanes.test.js
+++ b/tests/gossip-lanes.test.js
@@ -18,6 +18,8 @@ require('./_isolate-home'); // redirect $HOME to a temp sandbox before lib/confi
  * - F5: an over-long signature was decoded and hashed by the repeat check before it was refused.
  * - F6: a further conflicting root for a position already conflicted was verified at the peer's
  *   budget, where the attester's rate was meant to bound it.
+ * - Its suggestions: the door's refusal was logged once per frame; an ESIGN from the synthesis loop
+ *   was blamed on the delegate; the checkpoint-over-rate line named the attester only.
  *
  * Deterministic: the budget's clock is injected (node._gossipClock).
  */
@@ -413,3 +415,59 @@ describe('equivocation at one position (F6)', () => {
     });
   });
 });
+
+describe('part A2 review suggestions', () => {
+  it("the door's refusal is said once a minute per connection and reason, with a count, not once per frame", () => {
+    const { RoomOwnershipRegistry } = require('../lib/room-ownership');
+    const { FrameHandler } = require('../lib/frame-handler');
+    const GATED = 'x-review--team-02779b950c3d8d7378fd11d6';
+    const owners = new RoomOwnershipRegistry();
+    owners.pin(GATED, 'owner-node', 'ownerkey', 'config');
+    const logged = [];
+    const node = { _room: GATED, _roomOwners: owners, _log: (m) => logged.push(m), _peers: new Map(), emit() {} };
+    node._roomDoor = (peerId) => SymNode.prototype._roomDoor.call(node, peerId);
+    const fh = new FrameHandler(node);
+    const realNow = Date.now;
+    let now = realNow();
+    Date.now = () => now;
+    try {
+      const refused = () => logged.filter((l) => l.startsWith('Door refused'));
+      for (let i = 0; i < 1000; i++) fh.handle(`m-${i}`, `m-${i}`, { type: 'cmb', cmb: {} }, `relay:1:m-${i}`);
+      assert.strictEqual(refused().length, 1, 'fresh ids over one relay connection: one line');
+      for (let i = 0; i < 500; i++) fh.handle('mallory', 'mallory', { type: 'cmb', cmb: {} }, 'tcp:9');
+      assert.strictEqual(refused().length, 2, 'another connection: one more');
+      now += 61_000;
+      fh.handle('m-0', 'm-0', { type: 'mood', mood: {} }, 'relay:1:m-0');
+      assert.strictEqual(refused().length, 3);
+      assert.match(refused()[2], /and 999 more since it was last said/);
+    } finally { Date.now = realNow; }
+  });
+
+  it('an ESIGN from the synthesis loop is said as the node failing to sign, not as a delegate error', () => {
+    withNode({}, ({ node }) => {
+      const logs = [];
+      node._log = (m) => logs.push(m);
+      node._synthesisDelegate = () => ({ focus: 'a synthesis' });
+      node.remember = () => { const e = new Error('CMB signing failed: no key'); e.code = 'ESIGN'; throw e; };
+      node._frameHandler._handleXMeshInsight('p', 'p', { anomaly: 0.1 });
+      assert.ok(logs.includes('Synthesis not shared: this node cannot sign its records'), logs.join('\n'));
+      assert.ok(!logs.some((l) => l.startsWith('Synthesis delegate error')));
+      node._synthesisDelegate = () => { throw new Error('the delegate broke'); };
+      node._frameHandler._handleXMeshInsight('p', 'p', { anomaly: 0.1 });
+      assert.ok(logs.includes('Synthesis delegate error: the delegate broke'), 'a delegate error is still said as one');
+    });
+  });
+
+  it('the checkpoint-over-rate line names the peers that brought the checkpoints', () => {
+    withNode({ checkpointRate: { perSecond: 4, burst: 1 } }, ({ node }) => {
+      const logs = [];
+      node._log = (m) => logs.push(m);
+      const A = kp('att-A');
+      node._pinPeerKey(A.id, A.pub);
+      const cp = (seq) => signed({ type: 'checkpoint', by: A.id, roster: ROOM, upto_seq: seq, root: `r${seq}`, at: seq }, A.priv, signCheckpoint);
+      assert.strictEqual(node._ingestCheckpoint(cp(8), 'peer-one-xyz').ok, true);
+      assert.strictEqual(node._ingestCheckpoint(cp(16), 'peer-two-xyz').reason, 'over-rate');
+      assert.ok(logs.some((l) => /over their rate .* brought by peer-two/.test(l)), logs.join('\n'));
+    });
+  });
+});
diff --git a/tests/wake-channels.test.js b/tests/wake-channels.test.js
index fbbba08c..c305c8af 100644
--- a/tests/wake-channels.test.js
+++ b/tests/wake-channels.test.js
@@ -109,8 +109,11 @@ describe('gossip sent and expiry', () => {
       const out = wm.gossipEntries('peer-x');
       assert.deepStrictEqual(out.map((e) => [e.nodeId, e.lastSeen]).sort(), [['phone-1', now - 3 * DAY], ['phone-2', now - 1000]]);
       t = now + WAKE_CHANNEL_TTL_MS - 2 * DAY; // phone-1 is now past the TTL, phone-2 is not
+      let saves = 0;
+      wm.saveWakeChannels = () => { saves++; };
       assert.deepStrictEqual(wm.gossipEntries('peer-x').map((e) => e.nodeId), ['phone-2']);
       assert.strictEqual(node._peerWakeChannels.has('phone-1'), false, 'the expired channel is gone from memory too');
+      assert.strictEqual(saves, 0, 'and nothing is written on the connection path (0.14.0 part A2 review)');
     });
   });
 

From ee107c6b973e0e1822f94e0148917eed15a94f65 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Fri, 2 Oct 2026 08:24:39 +0100
Subject: [PATCH 080/148] 0.13.17 security: a role-grant is kept only when
 rooted at the anchor; reading the grant store never stops a node

In 0.13.16 any connected peer could stop a node from ever starting again with one frame:
_ingestRoleGrant stored a role-grant whose signature verified against the sender's own
first-use key, appended it to role-grants.jsonl and relayed it to the roster, and the
store's reload did `new Map(this._keys)` over the node's RosterKeyRegistry (not iterable),
so any non-empty (even empty) role-grants.jsonl made `new SymNode` throw. The anchor's own
legitimate grantRole() hit the same wall on its next start.

- A record is kept only when it is rooted at the anchor: its grantor's role at the time it
  signed, by the chain already held, carries the rank the record needs. An unrooted record
  has no effect on any resolution, so it is not stored, not written, not relayed. Rootedness
  is checked before the signature, so refusing one costs no verification.
- Grantor keys are resolved through the registry's own lookup, on ingest and on reload; the
  store never copies or iterates it.
- Reload runs the same checks as a frame. A record that cannot be verified (not JSON,
  malformed, unknown key, bad signature, unrooted) is skipped and counted; records rooted by
  a later line are retried until a pass adds nothing; a file that cannot be read leaves the
  node starting with no grants. The node says what it skipped, once.
- grantRole/revokeRole by a node without the rooted authority make nothing and send nothing
  (they return null) instead of gossiping a record every receiver drops.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 lib/node.js                     |  39 +++++--
 lib/role-grant-store.js         | 180 +++++++++++++++++++-----------
 tests/role-grant-rooted.test.js | 187 ++++++++++++++++++++++++++++++++
 tests/role-grant-store.test.js  |   6 +-
 4 files changed, 333 insertions(+), 79 deletions(-)
 create mode 100644 tests/role-grant-rooted.test.js

diff --git a/lib/node.js b/lib/node.js
index 96f9df88..8cf96605 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -294,14 +294,25 @@ class SymNode extends EventEmitter {
     // (carried by an invite). Absent for the room's owner, which needs none.
     this._roomGrant = opts.roomGrant || null;
     // Role-grant chain — signed grants/revokes; resolves the role a node held at a
-    // given time, with authority flowing only along anchor-rooted chains. Verifies
-    // grant sigs against the roster registry (which a rooted grant can populate with the
-    // grantee's vouched key); persisted under the node dir.
+    // given time, with authority flowing only along anchor-rooted chains. Keeps only
+    // records rooted at the anchor, verifies their sigs through the roster registry's own
+    // lookup (which a rooted grant can populate with the grantee's vouched key); persisted
+    // under the node dir. Reading it never stops the node from starting: what it could not
+    // verify is skipped and said here, once.
     this._roleGrants = new RoleGrantStore({
       anchor: this._anchor,
       keys: this._roster,
       dir: path.join(this._dir, 'role-grants'),
     });
+    {
+      const r = this._roleGrants.loadReport();
+      const skipped = Object.entries(r.skipped);
+      if (r.unreadable) this._log(`Role grants: ${r.unreadable}; starting with no grants`);
+      else if (skipped.length) {
+        const n = skipped.reduce((sum, [, c]) => sum + c, 0);
+        this._log(`Role grants: loaded ${r.loaded}, skipped ${n} that could not be verified (${skipped.map(([k, c]) => `${k} ${c}`).join(', ')})`);
+      }
+    }
     // Strict mode: when set, reject UNSIGNED CMBs from peers whose identity key
     // is known (default off — unsigned peers are allowed for interop).
     this._requireSignedCmb = process.env.SYM_REQUIRE_SIGNED_CMB === '1'
@@ -801,10 +812,10 @@ class SymNode extends EventEmitter {
 
   /**
    * Grant a lifecycle role to a peer (MMP §6.5). Signs a role-grant with this node's
-   * identity key, records it, and gossips it to the roster. The grant only confers
-   * authority on the grantee if THIS node's own resolved role outranks-or-equals the
-   * conferred role and roots at the anchor — enforced at resolve time, so a grant
-   * this node isn't entitled to make is stored but inert.
+   * identity key, records it, and gossips it to the roster. A grant is made only if THIS
+   * node's own resolved role outranks-or-equals the conferred role along a chain rooted at
+   * the anchor; a grant it is not entitled to make would have no effect anywhere, so it is
+   * neither kept nor sent, and this returns null.
    * @param {string} granteeNodeId
    * @param {'validator'|'anchor'} role
    * @returns {object|null} the signed grant, or null
@@ -852,7 +863,11 @@ class SymNode extends EventEmitter {
     }
     try {
       signGrant(g, this._identity.privateKey);
-      this._roleGrants.record(g);
+      const r = this._roleGrants.record(g);
+      if (!r.stored) {
+        this._log(`Role ${g.type === 'role-revoke' ? 'revoke' : 'grant'} for ${String(g.grantee).slice(0, 8)} not made: ${r.reason}`);
+        return null;
+      }
       this._gossipToRoster({ type: g.type, grant: g });
       return g;
     } catch (err) {
@@ -862,10 +877,10 @@ class SymNode extends EventEmitter {
   }
 
   /**
-   * Ingest a role-grant/revoke gossiped by a roster peer: the store verifies the
-   * grantor's signature against its authenticated key (anchor pinned), records it,
-   * and we relay-once. Authority (whether the grantor was entitled) is resolved
-   * lazily, so an unentitled grant is stored but confers nothing.
+   * Ingest a role-grant/revoke gossiped by a roster peer: the store keeps it only if it is
+   * rooted at the anchor and its signature verifies against the grantor's authenticated
+   * key (anchor pinned), and only a record kept is relayed (once). An unrooted record — a
+   * peer's self-signed grant, say — has no effect, so it is dropped here and goes no further.
    * @private
    */
   _ingestRoleGrant(g, fromPeerId) {
diff --git a/lib/role-grant-store.js b/lib/role-grant-store.js
index dd5674ef..1461af07 100644
--- a/lib/role-grant-store.js
+++ b/lib/role-grant-store.js
@@ -14,10 +14,18 @@
  * the attestation `role` un-spoofable: `verifyAttestationRole` resolves against this
  * chain, never the stamped category.
  *
- * Signatures are verified on ingest against the grantor's announced identity key
- * (the anchor's key is pinned). Whether the grantor actually HELD the rank to confer
- * a role is checked at resolve time (role-at-time), so an over-reaching or unrooted
- * grant is stored but inert. Persisted append-only and reloaded on construction.
+ * A record is KEPT only when it is rooted at the anchor: its grantor held, at the time it
+ * signed, the rank the record needs (a grant: the rank it confers; a revoke: validator or
+ * above), by the chain this store already holds. An unrooted record has no effect on any
+ * resolution, so it is not stored, not relayed, and costs nothing — before 0.13.17 it was
+ * stored and relayed, so any connected peer could write records here by signing them
+ * itself. Resolution still re-checks every chain (role-at-time, revocation cascades).
+ *
+ * Grantor keys are resolved through ONE interface, the key registry's own lookup (the
+ * node's roster), on ingest and on reload alike. Persisted append-only; reloaded on
+ * construction through the same checks as a frame, so a record on disk that cannot be
+ * verified is skipped and counted, and a file that cannot be read leaves the store empty
+ * (`loadReport()` says which) — reading the store never throws.
  *
  * @copyright 2026 SYM.BOT. Apache 2.0 License.
  */
@@ -33,8 +41,10 @@ class RoleGrantStore {
    * @param {object} [opts]
    * @param {{nodeId: string, publicKey: string}} [opts.anchor] the non-earnable root
    *   of trust (founder). resolveRole confers authority only along chains rooting here.
-   * @param {Map<string,string>} [opts.keys] live nodeId→pubkey map (e.g. the node's
-   *   handshake key map) used to verify grant signatures on ingest.
+   * @param {{get: function(string): (string|undefined)}} [opts.keys] the key registry grant
+   *   signatures are verified against — the node's RosterKeyRegistry, or any Map-like with
+   *   `get`. Only ever LOOKED UP through `get` (never copied or iterated); a rooted grant's
+   *   vouched grantee key is pinned back into it (`pin`, or `set` when absent on a Map).
    * @param {string} [opts.dir] when set, grants persist append-only and reload here.
    */
   constructor(opts = {}) {
@@ -44,12 +54,24 @@ class RoleGrantStore {
     this._seen = new Set();      // sig dedup
     this._dir = opts.dir || null;
     this._loading = false;
+    this._loadReport = { loaded: 0, skipped: {}, unreadable: null };
     if (this._dir) {
       try { fs.mkdirSync(this._dir, { recursive: true }); } catch { /* best effort */ }
       this._load();
     }
   }
 
+  /**
+   * What the last reload found: records `loaded`, records `skipped` by reason (each a record
+   * that could not be verified — not JSON, malformed, unknown grantor key, bad signature,
+   * unrooted, duplicate), and `unreadable` (why the file could not be read; null when it
+   * could, or when there was none).
+   * @returns {{ loaded: number, skipped: Object<string, number>, unreadable: string|null }}
+   */
+  loadReport() {
+    return { loaded: this._loadReport.loaded, skipped: { ...this._loadReport.skipped }, unreadable: this._loadReport.unreadable };
+  }
+
   /** Learn/pin an identity key for verifying a node's grants. */
   setKey(nodeId, pubKeyB64url) {
     if (nodeId && pubKeyB64url) this._keys.set(nodeId, pubKeyB64url);
@@ -61,48 +83,58 @@ class RoleGrantStore {
   }
 
   /**
-   * Record a signed role-grant / role-revoke. The signature must verify against the
-   * grantor's key (anchor key pinned). Whether the grantor had the RANK to confer is
-   * NOT checked here — that is a resolve-time property, so an over-reaching/unrooted
-   * grant is stored but confers nothing. Idempotent (dedup by sig). On reload from
-   * disk the record is trusted (already verified when first ingested).
+   * Record a signed role-grant / role-revoke, if it is rooted at the anchor. In order: the
+   * record must be well-formed, new (dedup by sig), from a grantor whose key the registry
+   * resolves, ROOTED (see `_rooted`), and its signature must verify against that key. A
+   * record that fails any of these is refused with the reason and leaves no trace: it is
+   * not held, not written, and the caller does not relay it. Reloading from disk runs the
+   * same checks — the file has no integrity of its own, so nothing is trusted for being on it.
    * @returns {{ stored: boolean, reason?: string }}
    */
   record(grant) {
-    if (!grant || !grant.grantee || !grant.grantedBy || !grant.sig || !grant.type) {
-      return { stored: false, reason: 'malformed' };
-    }
+    if (malformed(grant)) return { stored: false, reason: 'malformed' };
     if (this._seen.has(grant.sig)) return { stored: false, reason: 'duplicate' };
-    if (!this._loading) {
-      const key = this._grantorKey(grant.grantedBy);
-      if (!key) return { stored: false, reason: 'unknown-grantor-key' };
-      if (!verifyGrant(grant, key).valid) return { stored: false, reason: 'bad-signature' };
-    }
+    const key = this._grantorKey(grant.grantedBy);
+    if (!key) return { stored: false, reason: 'unknown-grantor-key' };
+    if (!this._rooted(grant)) return { stored: false, reason: 'unrooted' };
+    if (!verifyGrant(grant, key).valid) return { stored: false, reason: 'bad-signature' };
     this._seen.add(grant.sig);
     let arr = this._byGrantee.get(grant.grantee);
     if (!arr) { arr = []; this._byGrantee.set(grant.grantee, arr); }
     arr.push(grant);
     this._append(grant);
-    this._maybePinGranteeKey(grant);
+    this._pinGranteeKey(grant);
     return { stored: true };
   }
 
   /**
-   * A grant may VOUCH for the grantee's nodeId↔key binding (granteeKey, bound into the
-   * signed payload). We pin it into the key registry only when the grant is actually
-   * role-effective — i.e. the grantor's resolved role at grant time outranks-or-equals
-   * the conferred role, so the chain roots at the anchor. An unrooted or over-reaching
-   * grant confers no role AND vouches for no key: a node whose authority we don't trust
-   * cannot poison the registry. The registry itself refuses to overwrite a stronger
-   * (handshake/anchor) binding with this grant-sourced one.
+   * Whether a record is rooted at the anchor: its grantor's role AT THE TIME IT SIGNED,
+   * resolved from the chain this store holds, carries the authority the record needs. A
+   * grant needs the rank it confers (validators grant validator; only anchors grant
+   * anchor); a revoke needs validator or above. Anything else could never change a
+   * resolution, which is why it is not kept. (A grant from a grantor revoked SINCE it
+   * signed is rooted and kept; resolution still gives it no effect while the grantor is
+   * revoked — see resolveRole.)
    * @private
    */
-  _maybePinGranteeKey(grant) {
-    if (!grant.granteeKey || grant.type !== 'role-grant' || typeof this._keys.pin !== 'function') return;
-    const grantorRole = this.resolveRole(grant.grantedBy, grant.grantedAt ?? 0);
-    if (roleRank(grantorRole) >= roleRank(grant.role)) {
-      this._keys.pin(grant.grantee, grant.granteeKey, 'grant');
-    }
+  _rooted(grant) {
+    const rank = roleRank(this.resolveRole(grant.grantedBy, grant.grantedAt));
+    return grant.type === 'role-revoke' ? rank >= 1 : rank >= roleRank(grant.role);
+  }
+
+  /**
+   * A rooted grant may VOUCH for the grantee's nodeId↔key binding (granteeKey, bound into the
+   * signed payload): pin it into the key registry, so a node that never met the grantee can
+   * verify what it signs. Only rooted grants are kept, so a node whose authority we do not
+   * trust cannot poison the registry. The roster refuses to overwrite a stronger
+   * (handshake/anchor) binding with this grant-sourced one; a plain Map is only filled where
+   * it holds nothing.
+   * @private
+   */
+  _pinGranteeKey(grant) {
+    if (grant.type !== 'role-grant' || typeof grant.granteeKey !== 'string' || !grant.granteeKey) return;
+    if (typeof this._keys.pin === 'function') this._keys.pin(grant.grantee, grant.granteeKey, 'grant');
+    else if (typeof this._keys.set === 'function' && !this._keys.get(grant.grantee)) this._keys.set(grant.grantee, grant.granteeKey);
   }
 
   /**
@@ -167,46 +199,66 @@ class RoleGrantStore {
     catch { /* best effort — never let persistence break authority */ }
   }
 
+  /**
+   * Reload the grant file through `record` — the same checks a frame gets. A rooted record
+   * can only be rooted by records before it in time, not necessarily before it in the file
+   * (0.13.16 kept unrooted records, some of which an anchor grant later rooted), so records
+   * refused for a reason a later record can cure (`unknown-grantor-key`: the key arrives
+   * vouched in a grant; `unrooted`: the grantor's own grant arrives) are retried until a
+   * pass adds nothing. What is left is skipped and counted, as is a record whose check
+   * fails in a way no reason names ('unverifiable'). Never throws: a file that cannot be
+   * read leaves the store with no grants and `loadReport().unreadable` saying why.
+   * @private
+   */
   _load() {
+    const report = { loaded: 0, skipped: {}, unreadable: null };
+    this._loadReport = report;
+    const skip = (reason) => { report.skipped[reason] = (report.skipped[reason] || 0) + 1; };
     let text;
     try { text = fs.readFileSync(path.join(this._dir, GRANTS_FILE), 'utf8'); }
-    catch { return; }
-    const raw = [];
-    for (const line of text.split('\n')) {
-      if (!line.trim()) continue;
-      try { raw.push(JSON.parse(line)); } catch { /* skip corrupt line */ }
+    catch (err) {
+      if (err && err.code !== 'ENOENT') report.unreadable = `${GRANTS_FILE} could not be read (${err.code || err.message})`;
+      return;
     }
-    // The grant file has no integrity of its own, so a record is NOT trusted just
-    // because it is on disk (a file-write attacker could otherwise forge an
-    // anchor-rooted grant). Verify signatures top-down: start from the pinned
-    // anchor key, and learn each grantee's key from the `granteeKey` vouched in an
-    // already-verified grant (bound into its signed payload). A record whose grantor
-    // key can never be reached from the anchor is dropped. Authority is still gated
-    // independently by resolveRole, so verifying an unrooted grant's signature only
-    // lets it be stored-but-inert — no authority leaks from key-learning.
-    const known = new Map(this._keys);
-    if (this._anchor) known.set(this._anchor.nodeId, this._anchor.publicKey);
     this._loading = true;
-    let progress = true;
-    while (progress) {
-      progress = false;
-      for (let i = 0; i < raw.length; i++) {
-        const g = raw[i];
-        if (!g) continue;
-        const grantorKey = known.get(g.grantedBy);
-        if (!grantorKey) continue;               // grantor key not yet reachable
-        raw[i] = null;
-        progress = true;
-        if (!g.grantee || !g.grantedBy || !g.sig || !g.type) continue; // malformed → drop
-        if (!verifyGrant(g, grantorKey).valid) continue;               // forged/corrupt → drop
-        this.record(g);                          // verified: dedup + store (skips re-verify while loading)
-        if (g.type === 'role-grant' && g.granteeKey && !known.has(g.grantee)) {
-          known.set(g.grantee, g.granteeKey);    // learn the vouched key for the next hop
+    try {
+      let pending = [];
+      for (const line of text.split('\n')) {
+        if (!line.trim()) continue;
+        try { pending.push(JSON.parse(line)); } catch { skip('not-json'); }
+      }
+      const curable = new Set(['unknown-grantor-key', 'unrooted']);
+      let reasons = [];
+      let progress = true;
+      while (progress && pending.length) {
+        progress = false;
+        const retry = [];
+        reasons = [];
+        for (const g of pending) {
+          let r;
+          try { r = this.record(g); } catch { r = { stored: false, reason: 'unverifiable' }; }
+          if (r.stored) { report.loaded++; progress = true; }
+          else if (curable.has(r.reason)) { retry.push(g); reasons.push(r.reason); }
+          else skip(r.reason);
         }
+        pending = retry;
       }
+      for (const reason of reasons) skip(reason);
+    } finally {
+      this._loading = false;
     }
-    this._loading = false;
   }
 }
 
+/** The fields a record must have, of the types it must have them, or it is not a record. */
+function malformed(g) {
+  if (!g || typeof g !== 'object' || Array.isArray(g)) return true;
+  if (g.type !== 'role-grant' && g.type !== 'role-revoke') return true;
+  for (const f of ['grantee', 'grantedBy', 'sig']) if (typeof g[f] !== 'string' || !g[f]) return true;
+  if (!Number.isFinite(g.grantedAt)) return true;
+  if (g.granteeKey !== undefined && typeof g.granteeKey !== 'string') return true;
+  // A grant confers a rank above participant, or it confers nothing.
+  return g.type === 'role-grant' && roleRank(g.role) < 1;
+}
+
 module.exports = { RoleGrantStore };
diff --git a/tests/role-grant-rooted.test.js b/tests/role-grant-rooted.test.js
new file mode 100644
index 00000000..5815d422
--- /dev/null
+++ b/tests/role-grant-rooted.test.js
@@ -0,0 +1,187 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME before lib/config loads
+
+/**
+ * 0.13.17 security hotfix (F3). In 0.13.16 one self-signed role-grant from any connected peer was
+ * verified against that peer's own first-use key, written to role-grants.jsonl and relayed to the
+ * roster; and reading any non-empty role-grants.jsonl threw ("object is not iterable"), so every
+ * node that had received it could never start again.
+ *
+ * Authority flows only along chains rooted at the pinned anchor, so a grant that is not rooted there
+ * has no effect: it is not stored, not relayed, and costs nothing. A record on disk that cannot be
+ * verified is skipped and counted, and a store that cannot be read leaves the node starting with no
+ * grants.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const crypto = require('crypto');
+const fs = require('fs');
+const path = require('path');
+const { SymNode } = require('../lib/node');
+const { NullDiscovery } = require('../lib/discovery');
+const { nodeDir, loadOrCreateIdentity } = require('../lib/config');
+const { signGrant } = require('../lib/core');
+
+function kp(nodeId) {
+  const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519');
+  return {
+    nodeId,
+    priv: privateKey.export({ format: 'der', type: 'pkcs8' }).subarray(16).toString('base64url'),
+    pub: publicKey.export({ format: 'der', type: 'spki' }).subarray(12).toString('base64url'),
+  };
+}
+const grant = (type, grantee, role, grantor, at, extra = {}) =>
+  signGrant({ type, grantee: grantee.nodeId, role, grantedBy: grantor.nodeId, grantedAt: at, ...extra }, grantor.priv);
+
+const uniq = (base) => `${base}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+const grantsFile = (name) => path.join(nodeDir(name), 'role-grants', 'role-grants.jsonl');
+
+function boot(name, founder, extra = {}) {
+  return new SymNode({
+    name, silent: true, discovery: new NullDiscovery(), room: 'g',
+    ...(founder ? { anchor: { nodeId: founder.nodeId, publicKey: founder.pub } } : {}),
+    ...extra,
+  });
+}
+// A peer connects: its handshake pins its key at first use, which is what a self-signed grant verifies against.
+function handshake(node, peer) {
+  node._frameHandler.handle(peer.nodeId, peer.nodeId, { type: 'handshake', nodeId: peer.nodeId, name: peer.nodeId, publicKey: peer.pub });
+}
+
+describe('a role-grant that is not rooted at the anchor is not stored (F3)', () => {
+  for (const anchored of [true, false]) {
+    it(`a connected peer's self-signed grant is not persisted, not relayed, and the node restarts (${anchored ? 'anchored' : 'no anchor, as the daemon runs'})`, () => {
+      const name = uniq('rg-self');
+      const founder = kp('founder');
+      const evil = kp('evil-peer');
+      let node = boot(name, anchored ? founder : null);
+      try {
+        const relayed = [];
+        node._gossipToRoster = (frame) => relayed.push(frame);
+        handshake(node, evil);
+        const self = grant('role-grant', evil, 'anchor', evil, Date.now());
+        node._frameHandler.handle(evil.nodeId, 'evil', { type: 'role-grant', grant: self });
+        assert.strictEqual(node._roleGrants.has(self.sig), false, 'the unrooted grant is not held');
+        assert.strictEqual(fs.existsSync(grantsFile(name)), false, 'and nothing was written');
+        assert.deepStrictEqual(relayed, [], 'and nothing was relayed');
+        assert.strictEqual(node.resolveRole(evil.nodeId), 'participant');
+        node.stop();
+        node = boot(name, anchored ? founder : null);
+        assert.strictEqual(node.resolveRole(evil.nodeId), 'participant');
+      } finally { node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+    });
+  }
+
+  it('an anchor-rooted grant relayed by a peer still persists, is relayed once, and resolves after a restart', () => {
+    const name = uniq('rg-rooted');
+    const founder = kp('founder'), relayer = kp('relayer'), V = kp('validator-v');
+    let node = boot(name, founder);
+    try {
+      const relayed = [];
+      node._gossipToRoster = (frame, except) => relayed.push({ frame, except });
+      handshake(node, relayer);
+      const g = grant('role-grant', V, 'validator', founder, Date.now() - 1000, { granteeKey: V.pub });
+      node._frameHandler.handle(relayer.nodeId, 'relayer', { type: 'role-grant', grant: g });
+      assert.strictEqual(node._roleGrants.has(g.sig), true);
+      assert.strictEqual(relayed.length, 1, 'relayed once');
+      assert.strictEqual(relayed[0].except, relayer.nodeId, 'not back to the peer it came from');
+      assert.strictEqual(node.resolveRole(V.nodeId), 'validator');
+      node.stop();
+      node = boot(name, founder);
+      assert.strictEqual(node.resolveRole(V.nodeId), 'validator', 'the rooted grant survives the restart');
+      assert.strictEqual(node._roster.get(V.nodeId), V.pub, 'and the key it vouched for is resolvable');
+    } finally { node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+  });
+
+  it('the anchor node\'s own grant persists and the node restarts (it could not in 0.13.16)', () => {
+    const name = uniq('rg-own');
+    const id = loadOrCreateIdentity(name);
+    const self = { nodeId: id.nodeId, pub: id.publicKey };
+    let node = boot(name, self);
+    try {
+      const peer = 'node-peer-xyz';
+      assert.ok(node.grantRole(peer, 'validator'));
+      node.stop();
+      node = boot(name, self);
+      assert.strictEqual(node.resolveRole(peer), 'validator');
+    } finally { node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+  });
+
+  it('a node with no rooted authority makes no grant and sends nothing', () => {
+    const name = uniq('rg-noauth');
+    const founder = kp('founder');
+    const node = boot(name, founder);
+    try {
+      const sent = [];
+      node._gossipToRoster = (frame) => sent.push(frame);
+      assert.strictEqual(node.grantRole('someone', 'validator'), null);
+      assert.deepStrictEqual(sent, []);
+      assert.strictEqual(fs.existsSync(grantsFile(name)), false);
+    } finally { node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+  });
+});
+
+describe('reading role-grants.jsonl never stops a node from starting (F3)', () => {
+  it('junk, non-JSON, malformed, forged and unrooted records are skipped and counted; rooted ones load in any order', () => {
+    const name = uniq('rg-junk');
+    const founder = kp('founder'), evil = kp('evil-peer'), V = kp('v'), W = kp('w');
+    let node = boot(name, founder);
+    handshake(node, evil); // pins evil's key, as a 0.13.16 node had
+    node.stop();
+    const now = Date.now();
+    const forged = { ...grant('role-grant', evil, 'anchor', founder, now), sig: Buffer.alloc(64, 7).toString('base64url') };
+    const lines = [
+      'not json at all {',
+      'null',
+      '42',
+      '[]',
+      JSON.stringify({ type: 'role-grant' }),
+      JSON.stringify({ type: 'role-grant', grantee: { x: 1 }, grantedBy: founder.nodeId, grantedAt: now, role: 'validator', sig: 'abc' }),
+      JSON.stringify(grant('role-grant', evil, 'anchor', evil, now)),                          // what 0.13.16 stored from one frame
+      JSON.stringify(forged),
+      JSON.stringify(grant('role-grant', W, 'validator', V, now - 500)),                       // V→W, before V's own grant in the file
+      JSON.stringify(grant('role-grant', V, 'validator', founder, now - 1000, { granteeKey: V.pub })),
+    ];
+    fs.mkdirSync(path.dirname(grantsFile(name)), { recursive: true });
+    fs.writeFileSync(grantsFile(name), lines.join('\n') + '\n');
+    const said = [];
+    const log = console.log;
+    console.log = (line) => said.push(String(line));
+    try { node = boot(name, founder, { silent: false }); } finally { console.log = log; }
+    try {
+      const about = said.filter((l) => /Role grants/.test(l));
+      assert.strictEqual(about.length, 1, 'said once');
+      assert.match(about[0], /loaded 2, skipped 8 that could not be verified \(not-json 1, malformed 5, bad-signature 1, unrooted 1\)/);
+      assert.strictEqual(node.resolveRole(V.nodeId), 'validator');
+      assert.strictEqual(node.resolveRole(W.nodeId), 'validator', 'a two-hop chain loads whatever the line order');
+      assert.strictEqual(node.resolveRole(evil.nodeId), 'participant');
+      const rep = node._roleGrants.loadReport();
+      assert.strictEqual(rep.loaded, 2);
+      assert.strictEqual(rep.unreadable, null);
+      assert.deepStrictEqual(rep.skipped, { 'not-json': 1, malformed: 5, unrooted: 1, 'bad-signature': 1 });
+    } finally { node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+  });
+
+  it('a store that cannot be read leaves the node starting with no grants, and says why', () => {
+    const name = uniq('rg-unreadable');
+    const founder = kp('founder');
+    fs.mkdirSync(grantsFile(name), { recursive: true }); // a directory where the file should be: EISDIR
+    const node = boot(name, founder);
+    try {
+      assert.strictEqual(node._roleGrants.size(), 0);
+      assert.match(String(node._roleGrants.loadReport().unreadable), /EISDIR/);
+      assert.strictEqual(node._resolvedRole(), 'participant');
+    } finally { node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+  });
+
+  it('an empty grants file starts', () => {
+    const name = uniq('rg-empty');
+    fs.mkdirSync(path.dirname(grantsFile(name)), { recursive: true });
+    fs.writeFileSync(grantsFile(name), '');
+    const node = boot(name, kp('founder'));
+    try { assert.strictEqual(node._roleGrants.size(), 0); }
+    finally { node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+  });
+});
diff --git a/tests/role-grant-store.test.js b/tests/role-grant-store.test.js
index 25422a06..e842ff9d 100644
--- a/tests/role-grant-store.test.js
+++ b/tests/role-grant-store.test.js
@@ -206,10 +206,10 @@ describe('RoleGrantStore — relayed key learning (grant vouches for grantee key
     assert.strictEqual(reg.source(V.nodeId), 'grant');
 
     // X (a participant) grants Y, vouching Y's key — X's key is in the registry (say via
-    // some handshake) so the grant verifies, but X is unrooted so it confers nothing AND
-    // vouches for no key.
+    // some handshake) so the grant verifies, but X is unrooted so it confers nothing, is
+    // not kept (0.13.17: an unrooted record is not stored or relayed) AND vouches for no key.
     reg.pin(X.nodeId, X.pub, 'handshake');
-    assert.strictEqual(store.record(grantWithKey(Y, 'validator', X, T)).stored, true);
+    assert.deepStrictEqual(store.record(grantWithKey(Y, 'validator', X, T)), { stored: false, reason: 'unrooted' });
     assert.strictEqual(reg.has(Y.nodeId), false, 'unrooted grantor vouches for no key');
   });
 

From 3c961df4eca7cb538e69ff3e1dbb76aef45a8afa Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Fri, 2 Oct 2026 08:30:56 +0100
Subject: [PATCH 081/148] 0.13.17 security: every inbound frame goes through
 one guarded dispatch; a mood is measured, not coupled
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In 0.13.16 a peer could crash any node over the relay with one legacy `mood` frame. The relay
called the frame handler bare (the LAN transports caught a handler's throw inside the frame
parser and dropped it silently, so the same frame was quietly lost on LAN), and _handleMood
always threw on a stock node: it registered the mood as a temporary PEER in the coupling set
and ran a coupling step, whose metrics logger read `d.agentId` from decisions the stock
DefaultCoupler does not give one. The throw reached uncaughtException. On LAN the phantom peer
was never removed, so for its two-minute lifetime every coupling step threw too and the node's
own remember() failed: one mood frame every two minutes kept a node from publishing.

- SymNode._receiveFrame is the one inbound dispatch for every transport (LAN and loopback TCP,
  inbound and outbound, and the relay). A frame whose handling throws — its handler or a host's
  listener on the event it raises — is refused and counted (metrics().framesRefused, and
  framesRefusedByType), said at most once a minute per peer, and never thrown out of the
  transport. The relay's raw 'frame-received' offer to hosted agents is inside the guard.
- _handleMood measures the drift directly, ((1 - cos h1) + (1 - cos h2)) / 2 against this
  node's state, the measure the drift-bounded couplers use, and touches no shared state. A
  mood that is not text is not a mood.
- The metrics logger reads the agent id from the decisions map's key (the coupler contract),
  and peers() no longer assumes a decision carries a drift.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 lib/core/metrics.js               |   7 +-
 lib/frame-handler.js              |  25 +++---
 lib/node.js                       |  68 +++++++++++++--
 tests/inbound-frame-guard.test.js | 139 ++++++++++++++++++++++++++++++
 4 files changed, 219 insertions(+), 20 deletions(-)
 create mode 100644 tests/inbound-frame-guard.test.js

diff --git a/lib/core/metrics.js b/lib/core/metrics.js
index 8ba053a1..ecf64fab 100644
--- a/lib/core/metrics.js
+++ b/lib/core/metrics.js
@@ -45,8 +45,11 @@ class KuramotoMetricsLogger {
             h2L2Distance: l2Distances?.[1] ?? 0,
             orderParameter: orderParameter ?? 0,
             effectiveAlpha,
-            decisions: [...decisions.values()].map(d => ({
-                agentId: d.agentId.slice(0, 8),
+            // The decisions map is KEYED by agent id; that is the coupler contract. The id is
+            // read from the key: a decision need not repeat it (the stock DefaultCoupler's do
+            // not, and reading d.agentId threw on every coupling step it had a peer in).
+            decisions: [...decisions].map(([id, d]) => ({
+                agentId: String(id).slice(0, 8),
                 drift: d.drift,
                 decision: d.decision,
                 alpha: d.alpha,
diff --git a/lib/frame-handler.js b/lib/frame-handler.js
index 23a9c364..4768328f 100644
--- a/lib/frame-handler.js
+++ b/lib/frame-handler.js
@@ -21,7 +21,7 @@ const { recordKey, recordLineage, recordParents, recordCreatedBy, setRecordLinea
 
 const fs = require('fs');
 const path = require('path');
-const { encode, DIM, processHeuristicSVAF, computeCategoryVerdicts, decryptCategories, blockKeyV2, resolveTetherAnchor, signTetherAttestation, verifyTetherAttestation, recomputeKey, classifyAddress } = require('./core');
+const { encode, cosineSimilarity, DIM, processHeuristicSVAF, computeCategoryVerdicts, decryptCategories, blockKeyV2, resolveTetherAnchor, signTetherAttestation, verifyTetherAttestation, recomputeKey, classifyAddress } = require('./core');
 
 // Receive-path dedup window (MMP §4.2 O2 — rejoin-without-replay convergence).
 // A CMB whose content-hash key we have already processed within this window is
@@ -1340,22 +1340,27 @@ class FrameHandler {
   }
 
   /**
-   * Handle mood frame: evaluate coupling drift and accept/reject.
+   * Handle mood frame: evaluate the mood's drift from this node's state and accept/reject.
+   *
+   * The drift is MEASURED here, directly: ((1 − cos h1) + (1 − cos h2)) / 2 between this
+   * node's local state and the mood's encoding — the measure the drift-bounded couplers
+   * use. Until 0.13.17 it was read off the coupling engine by registering the mood as a
+   * temporary PEER in the coupling set and running a coupling step. That assumed the engine's
+   * decisions carry a `drift` (the stock coupler's do not) and that the step cannot throw (it
+   * did, in the metrics logger, on every mood frame); and when it threw, the phantom peer was
+   * never removed, so for its two-minute lifetime every coupling step threw with it —
+   * remember() included. A measurement does not belong in shared state: nothing here touches
+   * the coupling set. A mood that is not text is not a mood.
    * @private
    */
   _handleMood(peerId, peerName, msg) {
-    if (!msg.mood) return;
+    if (typeof msg.mood !== 'string' || !msg.mood) return;
 
     const { h1: moodH1, h2: moodH2 } = encode(msg.mood);
-    const moodPeerId = `mood-${peerId}`;
-
-    this._node._meshNode.addPeer(moodPeerId, moodH1, moodH2, 0.8);
-    this._node._meshNode.coupledState();
-    const d = this._node._meshNode.couplingDecisions.get(moodPeerId);
-    this._node._meshNode.removePeer(moodPeerId);
+    const mesh = this._node._meshNode;
+    const drift = ((1 - cosineSimilarity(mesh.localH1, moodH1)) + (1 - cosineSimilarity(mesh.localH2, moodH2))) / 2;
 
     const from = msg.fromName || peerName;
-    const drift = d ? d.drift : 1;
 
     if (drift <= this._node._moodThreshold) {
       this._node._log(`Mood from ${from}: "${msg.mood.slice(0, 50)}" → ACCEPTED (drift: ${drift.toFixed(3)}, threshold: ${this._node._moodThreshold})`);
diff --git a/lib/node.js b/lib/node.js
index 8cf96605..41c38d82 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -412,7 +412,10 @@ class SymNode extends EventEmitter {
       llmTokensOut: 0,       // Total output tokens
       llmModel: null,        // Last model used
       startedAt: null,       // When the node started
+      framesRefused: 0,      // Inbound frames whose handling failed — refused, never thrown (see _receiveFrame)
+      framesRefusedByType: {}, // ...by frame type
     };
+    this._refusalLines = new Map(); // peerId -> { at, quiet }: at most one log line per peer a minute
 
     // LLM cost pricing (USD per token). Updated by reportLLMUsage().
     // Default: gpt-4o-mini pricing as of 2026-03.
@@ -513,11 +516,7 @@ class SymNode extends EventEmitter {
       getMeshNode: () => this._meshNode,
       createPeer: (transport, peerId, peerName, isOutbound, source) => this._createPeer(transport, peerId, peerName, isOutbound, source),
       addPeer: (peer) => this._addPeer(peer),
-      handlePeerMessage: (peerId, peerName, msg) => {
-        // Emit raw frame for hosted agents (Section 4.3.2: forward before evaluation)
-        this.emit('frame-received', { peerId, peerName, frame: msg });
-        this._frameHandler.handle(peerId, peerName, msg);
-      },
+      handlePeerMessage: (peerId, peerName, msg) => this._receiveFrame(peerId, peerName, msg, 'relay'),
       onPeerLeft: (peerId, peerName) => { this._metrics.peersLeft++; this.emit('peer-left', { id: peerId, name: peerName }); this.emit('metric', { type: 'peer-left', name: peerName }); },
       onIdentityCollision: (info) => {
         // Surface the collision as an event so hosts can take action.
@@ -1640,7 +1639,7 @@ class SymNode extends EventEmitter {
       transport.on('message', (m) => {
         const peer = this._peers.get(peerId);
         if (peer) peer.lastSeen = Date.now();
-        this._frameHandler.handle(peerId, peerName, m);
+        this._receiveFrame(peerId, peerName, m, 'lan');
       });
       const admission = this._roomAdmission(peerId, handshakeMsg);
       if (!admission.admit) {
@@ -2362,6 +2361,7 @@ class SymNode extends EventEmitter {
 
     return {
       ...m,
+      framesRefusedByType: { ...m.framesRefusedByType },
       uptimeMs,
       llmCostUSD: Math.round(llmCostUSD * 1_000_000) / 1_000_000,
     };
@@ -2557,7 +2557,7 @@ class SymNode extends EventEmitter {
         connected: true,
         lastSeen: peer.lastSeen,
         coupling: d ? d.decision : 'pending',
-        drift: d ? parseFloat(d.drift.toFixed(3)) : null,
+        drift: d && typeof d.drift === 'number' ? parseFloat(d.drift.toFixed(3)) : null,
         source: peer.source || 'bonjour',
         e2e: this._peerSharedSecrets.has(id),
         clearRefused: !!(this._clearRefused && this._clearRefused.has(id)),
@@ -2616,6 +2616,58 @@ class SymNode extends EventEmitter {
     return this._relay.awaitOutcome(timeoutMs);
   }
 
+  /**
+   * THE ONE INBOUND DISPATCH. Every frame a peer sends reaches the frame handler through here,
+   * whatever carried it: a LAN or loopback TCP transport (inbound or outbound) or the relay.
+   * A frame this node cannot handle — its handler, or a host's listener on the event it raises,
+   * throws — is REFUSED and COUNTED (metrics().framesRefused, by type), and said in the log at
+   * most once a minute per peer. It is never thrown out of the transport.
+   *
+   * Why one place. In 0.13.16 the LAN transports caught a handler's throw inside the frame
+   * parser and dropped it silently, while the relay called the handler bare, so the same frame
+   * that was quietly lost on LAN reached uncaughtException over the relay and the daemon
+   * exited: a peer's legacy `mood` frame did it on every node, a `message` frame on the daemon.
+   * Guarding each path separately is how one path was missed; there is now one path.
+   *
+   * A relay frame is also offered raw to hosted agents before evaluation ('frame-received',
+   * MMP §4.3.2), as before — inside the guard, since a host's listener can throw too.
+   * @returns {boolean} true if the frame was handled, false if it was refused
+   * @private
+   */
+  _receiveFrame(peerId, peerName, msg, via) {
+    try {
+      if (via === 'relay') this.emit('frame-received', { peerId, peerName, frame: msg });
+      this._frameHandler.handle(peerId, peerName, msg);
+      return true;
+    } catch (err) {
+      this._refuseFrame(peerId, peerName, msg, via, err);
+      return false;
+    }
+  }
+
+  /**
+   * Count and (rate-limited) say a refused inbound frame. Must not throw itself: it runs where
+   * a throw would leave the transport.
+   * @private
+   */
+  _refuseFrame(peerId, peerName, msg, via, err) {
+    try {
+      const type = msg && typeof msg.type === 'string' ? msg.type.slice(0, 40) : '?';
+      this._metrics.framesRefused++;
+      const byType = this._metrics.framesRefusedByType;
+      byType[type] = (byType[type] || 0) + 1;
+      const key = String(peerId);
+      const now = Date.now();
+      const last = this._refusalLines.get(key);
+      if (last && now - last.at < 60_000) { last.quiet++; return; }
+      if (this._refusalLines.size >= 1024) this._refusalLines.clear();
+      this._refusalLines.set(key, { at: now, quiet: 0 });
+      const why = err && typeof err.message === 'string' ? err.message : String(err);
+      const more = last && last.quiet ? ` (${last.quiet} more from this peer since the last line)` : '';
+      this._log(`Refused a '${type}' frame from ${String(peerName).slice(0, 64)} (${via}): ${why.slice(0, 200)}${more}`);
+    } catch { /* counting a refusal must never become the failure */ }
+  }
+
   _connectToPeer(address, port, peerId, peerName) {
     // Connect timeout: 10s to establish the TCP connection. Cleared once
     // connected so the socket doesn't die from idle — LAN connections
@@ -2629,7 +2681,7 @@ class SymNode extends EventEmitter {
       transport.on('message', (msg) => {
         const peer = this._peers.get(peerId);
         if (peer) peer.lastSeen = Date.now();
-        this._frameHandler.handle(peerId, peerName, msg);
+        this._receiveFrame(peerId, peerName, msg, 'lan');
       });
       transport.on('error', () => {});
       const peer = this._createPeer(transport, peerId, peerName, true, 'bonjour');
diff --git a/tests/inbound-frame-guard.test.js b/tests/inbound-frame-guard.test.js
new file mode 100644
index 00000000..56807b0b
--- /dev/null
+++ b/tests/inbound-frame-guard.test.js
@@ -0,0 +1,139 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME before lib/config loads
+
+/**
+ * 0.13.17 security hotfix (G2, C3). In 0.13.16 a frame whose handling threw took the process down
+ * when it came over the relay: the relay's dispatch had no guard, so the throw reached
+ * uncaughtException, and the daemon exits on that. Two frames any peer could send did it:
+ *   - a legacy `mood` frame: _handleMood registered the mood as a peer in the coupling set and the
+ *     stock coupler's decisions do not carry the fields the metrics logger read, so it always threw
+ *     (and, on LAN where the throw was swallowed, left the phantom peer behind, so the node's own
+ *     remember() threw for the next two minutes);
+ *   - a `message` frame, on the daemon: its listener called node._xmesh.ingestSignal, and a stock
+ *     node has no insight engine.
+ * Every inbound frame now goes through one guarded dispatch, whatever carried it: a frame the node
+ * cannot handle is refused and counted, never thrown out of the transport.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const net = require('net');
+const { WebSocketServer } = require('ws');
+const { SymNode } = require('../lib/node');
+const { NullDiscovery } = require('../lib/discovery');
+const { nodeDir } = require('../lib/config');
+const { sendFrame } = require('../lib/frame-parser');
+
+const uniq = (base) => `${base}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+const until = async (cond, ms = 5000) => { for (let t = 0; t < ms && !cond(); t += 20) await new Promise((r) => setTimeout(r, 20)); };
+
+/** Throws on its first call only: a host listener (like the daemon's) that fails on one frame. */
+function throwOnce(seen) {
+  let thrown = false;
+  return (from, content) => {
+    seen.push(content);
+    if (!thrown) { thrown = true; throw new Error('host listener failed'); }
+  };
+}
+
+describe('every inbound frame goes through one guarded dispatch (G2, C3)', () => {
+  it('relay: a frame whose handling throws is refused and counted; the process and the relay link survive', async () => {
+    const uncaught = [];
+    const onUncaught = (err) => uncaught.push(err);
+    process.on('uncaughtException', onUncaught);
+    const evil = 'e'.repeat(64);
+    const wss = new WebSocketServer({ port: 0 });
+    wss.on('connection', (ws) => ws.on('message', (m) => {
+      if (JSON.parse(String(m)).type !== 'relay-auth') return;
+      const send = (payload) => ws.send(JSON.stringify({ from: evil, fromName: 'evil', payload }));
+      send({ type: 'message', content: 'first' });
+      send({ type: 'mood', mood: 'exhausted after a long debugging session', fromName: 'evil' });
+      send({ type: 'message', content: 'second' });
+    }));
+    const name = uniq('guard-relay');
+    const node = new SymNode({ name, silent: true, relayOnly: true, relay: `ws://127.0.0.1:${wss.address().port}`, relayToken: 'x'.repeat(40), room: 'g' });
+    const seen = [];
+    const moods = [];
+    node.on('message', throwOnce(seen));
+    node.on('mood-delivered', (d) => moods.push(d));
+    node.on('mood-rejected', (d) => moods.push(d));
+    try {
+      await node.start();
+      await until(() => seen.length >= 2);
+      assert.deepStrictEqual(uncaught, [], 'nothing reached uncaughtException');
+      assert.deepStrictEqual(seen, ['first', 'second'], 'the frame after the refused one is still dispatched');
+      assert.strictEqual(moods.length, 1, 'the mood frame is evaluated, not thrown');
+      const m = node.metrics();
+      assert.strictEqual(m.framesRefused, 1);
+      assert.deepStrictEqual(m.framesRefusedByType, { message: 1 });
+      assert.strictEqual(node.status().relayConnected, true, 'the relay link is still up');
+    } finally {
+      process.removeListener('uncaughtException', onUncaught);
+      await node.stop();
+      await new Promise((r) => wss.close(() => r()));
+      fs.rmSync(nodeDir(name), { recursive: true, force: true });
+    }
+  });
+
+  it('LAN and loopback: the same dispatch refuses and counts (0.13.16 swallowed it in the transport, uncounted)', async () => {
+    const socks = [];
+    const server = net.createServer((sock) => {
+      socks.push(sock);
+      sock.on('error', () => {});
+      sendFrame(sock, { type: 'handshake', nodeId: 'lan-peer', name: 'lan-peer' });
+      sendFrame(sock, { type: 'message', content: 'first' });
+      sendFrame(sock, { type: 'message', content: 'second' });
+    });
+    await new Promise((r) => server.listen(0, '127.0.0.1', r));
+    const name = uniq('guard-lan');
+    const node = new SymNode({ name, silent: true, discovery: new NullDiscovery(), room: 'g' });
+    const seen = [];
+    node.on('message', throwOnce(seen));
+    try {
+      await node.start();
+      node._connectToPeer('127.0.0.1', server.address().port, 'lan-peer', 'lan-peer');
+      await until(() => seen.length >= 2);
+      assert.deepStrictEqual(seen, ['first', 'second']);
+      assert.strictEqual(node.metrics().framesRefused, 1);
+      assert.deepStrictEqual(node.metrics().framesRefusedByType, { message: 1 });
+    } finally {
+      await node.stop();
+      for (const sock of socks) sock.destroy();
+      server.close();
+      fs.rmSync(nodeDir(name), { recursive: true, force: true });
+    }
+  });
+});
+
+describe('a mood frame on a stock node (G2)', () => {
+  it('is evaluated against this node\'s state without touching the coupling set, and the node keeps working', () => {
+    const name = uniq('guard-mood');
+    const node = new SymNode({ name, silent: true, discovery: new NullDiscovery() });
+    const out = [];
+    node.on('mood-delivered', (d) => out.push(['delivered', d]));
+    node.on('mood-rejected', (d) => out.push(['rejected', d]));
+    try {
+      node._frameHandler.handle('p', 'p', { type: 'mood', mood: 'tired', fromName: 'p' });
+      assert.strictEqual(out.length, 1);
+      assert.strictEqual(typeof out[0][1].drift, 'number');
+      assert.ok(out[0][1].drift >= 0 && out[0][1].drift <= 2, `drift ${out[0][1].drift} is a cosine drift`);
+      assert.strictEqual(node._meshNode.activePeerCount, 0, 'no phantom peer is left in the coupling set');
+      const entry = node.remember({ focus: 'own work after a mood frame', issue: 'none', intent: 'x', motivation: 'y', commitment: 'z', perspective: 'me', mood: { text: 'calm', valence: 0, arousal: 0 } });
+      assert.ok(entry, 'remember() still works (in 0.13.16 it threw for two minutes after one mood frame)');
+      assert.ok(Array.isArray(node.peers()));
+      for (const mood of [42, { text: 'x' }, null, '']) node._frameHandler.handle('p', 'p', { type: 'mood', mood });
+      assert.strictEqual(out.length, 1, 'a mood that is not text is not a mood');
+    } finally { node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+  });
+
+  it('the stock coupler, with a peer in it, does not break coupledState (the metrics logger reads the contract, not extra fields)', () => {
+    const { MeshNode } = require('../lib/core');
+    const mesh = new MeshNode({ hiddenDim: 4 });
+    mesh.updateLocalState([1, 0, 0, 0], [0, 1, 0, 0]);
+    mesh.addPeer('some-peer-id', [1, 0, 0, 0], [0, 1, 0, 0], 0.8);
+    assert.doesNotThrow(() => mesh.coupledState());
+    assert.strictEqual(mesh.metricsCount, 1);
+  });
+});

From ccbb340b3bc9d5862f2e7b63a40dfe212817f544 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Fri, 2 Oct 2026 08:31:05 +0100
Subject: [PATCH 082/148] 0.13.17 security: the daemon checks for an insight
 engine instead of assuming one

In 0.13.16 any peer could crash the daemon with one `message` frame over the relay: its
'message' listener called node._xmesh.ingestSignal, and the daemon's node is a stock node with
no insight engine (_xmesh is null), so the listener threw inside the frame dispatch and the
throw reached uncaughtException, which exits.

- The listener feeds the insight engine only if the node has one. The engine is injected, so
  it is a capability to check, never to assume.
- The IPC requests that read the engine (xmesh-context, xmesh-search) answer with an error when
  there is none, instead of throwing and leaving the client to its timeout.
- An IPC request that fails is said as a failed request (not "IPC parse error") and answered
  with the error, as in the 0.14.0 line.

The frame that carried this is also refused, not thrown, by the guarded dispatch; this removes
the cause.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 bin/sym-daemon.js                 | 34 +++++++++++++---------
 tests/inbound-frame-guard.test.js | 48 +++++++++++++++++++++++++++++++
 2 files changed, 68 insertions(+), 14 deletions(-)

diff --git a/bin/sym-daemon.js b/bin/sym-daemon.js
index ffe01a04..1d43e591 100755
--- a/bin/sym-daemon.js
+++ b/bin/sym-daemon.js
@@ -228,10 +228,13 @@ function startIPCServer() {
         const line = buffer.slice(0, idx);
         buffer = buffer.slice(idx + 1);
         if (line.trim()) {
+          let msg;
+          try { msg = JSON.parse(line); } catch (err) { log(`IPC parse error: ${err.message}`); continue; }
           try {
-            handleIPCMessage(socketId, socket, JSON.parse(line));
+            handleIPCMessage(socketId, socket, msg);
           } catch (err) {
-            log(`IPC parse error: ${err.message}`);
+            log(`IPC ${msg && msg.type ? `'${msg.type}'` : 'message'} failed: ${err.message}`);
+            if (msg && msg.type) sendIPC(socket, { type: 'result', action: msg.type, error: err.message, code: err.code });
           }
         }
       }
@@ -270,6 +273,8 @@ function startIPCServer() {
   return server;
 }
 
+const NO_INSIGHT_ENGINE = 'this node runs no insight engine';
+
 /**
  * Handle a single IPC message from a virtual node.
  * Routes to the appropriate SymNode method and sends result back.
@@ -517,20 +522,18 @@ function handleIPCMessage(socketId, socket, msg) {
       });
       break;
 
+    // The insight engine is a capability a node may not have (a stock daemon has none): checked,
+    // answered either way, never assumed — unchecked, this threw and the client waited out its timeout.
     case 'xmesh-context':
-      sendIPC(socket, {
-        type: 'result',
-        action: 'xmesh-context',
-        context: node._xmesh.getContext({ timeWindow: msg.timeWindow }),
-      });
+      sendIPC(socket, node._xmesh
+        ? { type: 'result', action: 'xmesh-context', context: node._xmesh.getContext({ timeWindow: msg.timeWindow }) }
+        : { type: 'result', action: 'xmesh-context', error: NO_INSIGHT_ENGINE });
       break;
 
     case 'xmesh-search':
-      sendIPC(socket, {
-        type: 'result',
-        action: 'xmesh-search',
-        insights: node._xmesh.getInsights(msg.query),
-      });
+      sendIPC(socket, node._xmesh
+        ? { type: 'result', action: 'xmesh-search', insights: node._xmesh.getInsights(msg.query) }
+        : { type: 'result', action: 'xmesh-search', error: NO_INSIGHT_ENGINE });
       break;
 
     case 'catchup':
@@ -616,8 +619,11 @@ function forwardEventsToVirtualNodes() {
     broadcastToVirtualNodes({ type: 'event', event: 'message', data: { from, content } });
     broadcastToListeners({ type: 'event', event: 'message', data: { from, content, timestamp: Date.now() } });
 
-    // Feed messages (including Telegram) into xMesh
-    node._xmesh.ingestSignal({ type: 'message', from, content });
+    // Feed messages (including Telegram) into the insight engine, if this node has one. A stock
+    // daemon has none (`node._xmesh` is null: the engine is injected, never assumed); calling it
+    // unchecked threw inside the frame dispatch, so any peer's `message` frame over the relay
+    // took the daemon down in 0.13.16.
+    if (node._xmesh) node._xmesh.ingestSignal({ type: 'message', from, content });
 
     // Wake sleeping peers that might need this message.
     // The daemon acts as wake proxy — it has APNs keys and gossiped wake channels.
diff --git a/tests/inbound-frame-guard.test.js b/tests/inbound-frame-guard.test.js
index 56807b0b..56dec62f 100644
--- a/tests/inbound-frame-guard.test.js
+++ b/tests/inbound-frame-guard.test.js
@@ -20,6 +20,9 @@ const { describe, it } = require('node:test');
 const assert = require('node:assert');
 const fs = require('fs');
 const net = require('net');
+const os = require('os');
+const path = require('path');
+const { spawn } = require('child_process');
 const { WebSocketServer } = require('ws');
 const { SymNode } = require('../lib/node');
 const { NullDiscovery } = require('../lib/discovery');
@@ -137,3 +140,48 @@ describe('a mood frame on a stock node (G2)', () => {
     assert.strictEqual(mesh.metricsCount, 1);
   });
 });
+
+describe('the daemon survives a peer\'s mood and message frames over the relay (G2, C3)', () => {
+  it('stays up, handles both, and answers an insight-engine request it cannot serve instead of throwing', async () => {
+    const home = fs.mkdtempSync(path.join(os.tmpdir(), 'sym-daemon-guard-'));
+    const sock = path.join(home, 'd.sock');
+    const wss = new WebSocketServer({ port: 0 });
+    wss.on('connection', (ws) => ws.on('message', (m) => {
+      if (JSON.parse(String(m)).type !== 'relay-auth') return;
+      const send = (payload) => ws.send(JSON.stringify({ from: 'e'.repeat(64), fromName: 'evil', payload }));
+      send({ type: 'mood', mood: 'exhausted after a long debugging session', fromName: 'evil' });
+      send({ type: 'message', content: 'hello daemon', fromName: 'evil' });
+    }));
+    const daemon = spawn(process.execPath, [path.join(__dirname, '..', 'bin', 'sym-daemon.js')], {
+      env: { ...process.env, HOME: home, USERPROFILE: home, SYM_STATE_DIR: path.join(home, '.sym'), SYM_SOCKET: sock,
+        SYM_NODE_NAME: 'daemon-guard-test', SYM_ROOM: 'daemon-guard-room', SYM_RELAY_ONLY: '1',
+        SYM_RELAY_URL: `ws://127.0.0.1:${wss.address().port}`, SYM_RELAY_TOKEN: 'x'.repeat(32) },
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    let out = '';
+    daemon.stdout.on('data', (b) => { out += b; });
+    daemon.stderr.on('data', (b) => { out += b; });
+    try {
+      await until(() => /Message from evil: hello daemon/.test(out) && /sym-daemon ready/.test(out) || daemon.exitCode !== null, 15000);
+      await new Promise((r) => setTimeout(r, 500));
+      assert.strictEqual(daemon.exitCode, null, `the daemon is still running; log:\n${out.slice(-1500)}`);
+      assert.doesNotMatch(out, /FATAL/);
+      assert.match(out, /Mood from evil: .*(ACCEPTED|IGNORED)/);
+      const reply = await new Promise((resolve, reject) => {
+        const c = net.createConnection(sock, () => c.write(JSON.stringify({ type: 'xmesh-context' }) + '\n'));
+        let buf = '';
+        c.on('data', (d) => { buf += d; const i = buf.indexOf('\n'); if (i >= 0) { c.end(); resolve(JSON.parse(buf.slice(0, i))); } });
+        c.on('error', reject);
+        setTimeout(() => { c.destroy(); reject(new Error('no IPC reply')); }, 5000);
+      });
+      assert.strictEqual(reply.action, 'xmesh-context');
+      assert.match(String(reply.error), /insight engine/);
+      assert.strictEqual(daemon.exitCode, null);
+    } finally {
+      daemon.kill('SIGTERM');
+      await new Promise((r) => (daemon.exitCode !== null ? r() : daemon.once('exit', r)));
+      await new Promise((r) => wss.close(() => r()));
+      fs.rmSync(home, { recursive: true, force: true });
+    }
+  });
+});

From 3cd1ff8b57f2b5555915b0674dd191a33717d972 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Fri, 2 Oct 2026 08:38:17 +0100
Subject: [PATCH 083/148] 0.13.17 security: a peer's nodeId and name are taken
 at the door; the LAN handshake goes through the guard

A peer's nodeId and name arrive as JSON: in a LAN handshake, in a relay's join notice and peer
list (the relay forwards what the joiner put in its relay-auth), in a relay envelope. JSON can
carry an object whose toString is not callable, which throws when anything prints it. 0.13.16
kept those values as given and printed them later, in transport callbacks and timers, so any
peer could crash a node by choosing its own name: over the relay with a join notice (every node
in the channel, and again on every reconnect, since the peer list carries it too), and over the
LAN with a handshake. A relay peer list that was not an array, or held null, crashed it as well.
And a LAN handshake the node could not take (an e2e key that is not text, say) threw after
discovery had cleared the identification deadline, so the connection stayed open with no owner
and no deadline: a peer could hold sockets without limit.

- lib/wire-identity.js: a nodeId off the wire is a bounded non-empty string or it is not one
  (the announcement or connection is refused); a name is a bounded string or 'unknown'; a key is
  text or it is not pinned. Applied where they enter: the relay's join/leave notices, peer list
  and envelopes, discovery's advertisements, the inbound handshake, key pinning and e2e secret
  derivation.
- The handshake that opens an inbound LAN/loopback connection is taken through the same guard as
  every other frame (_guardInbound, shared with _receiveFrame); one it cannot take is refused,
  counted, and its connection closed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 lib/node.js                         | 247 ++++++++++++++++------------
 lib/relay.js                        |  28 ++--
 lib/wire-identity.js                |  38 +++++
 tests/wire-identity-ingress.test.js | 134 +++++++++++++++
 4 files changed, 333 insertions(+), 114 deletions(-)
 create mode 100644 lib/wire-identity.js
 create mode 100644 tests/wire-identity-ingress.test.js

diff --git a/lib/node.js b/lib/node.js
index 41c38d82..045eebd6 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -29,6 +29,7 @@ const { MemoryStore } = require('./memory-store');
 const { AttestationStore, chainHash, isPosition } = require('./attestation-store');
 const { RoleGrantStore } = require('./role-grant-store');
 const { RosterKeyRegistry } = require('./roster-keys');
+const { wireNodeId, wireName, wireKey } = require('./wire-identity');
 const { RoomOwnershipRegistry } = require('./room-ownership');
 const { verifyRoomGrant } = require('./core/room-grant');
 const { DecisionLog } = require('./decision-log');
@@ -599,6 +600,7 @@ class SymNode extends EventEmitter {
    * @private
    */
   _deriveAndStoreSecret(peerId, peerPublicKeyB64) {
+    if (!wireNodeId(peerId) || !wireKey(peerPublicKeyB64)) return;
     // Skip if we already have a shared secret for this peer+key combo
     const cacheKey = `${peerId}:${peerPublicKeyB64}`;
     if (this._e2eDerivedKeys && this._e2eDerivedKeys.has(cacheKey)) return;
@@ -656,7 +658,9 @@ class SymNode extends EventEmitter {
    * @private
    */
   _pinPeerKey(nodeId, keyB64url) {
-    if (!nodeId || !keyB64url) return;
+    // A key is text or it is not a key: pinned as given, a JSON object here sat in the roster (and
+    // its file) and failed every verification against it.
+    if (!wireNodeId(nodeId) || !wireKey(keyB64url)) return;
     this._peerIdentityKeys.set(nodeId, keyB64url);
     this._roster.pin(nodeId, keyB64url, 'handshake');
   }
@@ -1530,7 +1534,11 @@ class SymNode extends EventEmitter {
     this._pendingBonjour = new Set();
 
     // Wire discovery events to peer management
-    this._discovery.on('peer-found', (address, port, peerId, peerName) => {
+    this._discovery.on('peer-found', (address, port, foundId, foundName) => {
+      // An advertisement's node-id/node-name are what the advertiser chose (wire-identity.js).
+      const peerId = wireNodeId(foundId);
+      if (!peerId) return;
+      const peerName = wireName(foundName);
       // Skip if already connecting (dns-sd resolves the same peer multiple times).
       if (this._pendingBonjour.has(peerId)) return;
       // If we already have a LIVE bonjour transport, no need to dial again.
@@ -1547,108 +1555,16 @@ class SymNode extends EventEmitter {
       this._connectToPeer(address, port, peerId, peerName);
     });
     this._discovery.on('inbound-connection', (transport, peerId, peerName, handshakeMsg) => {
-      // Section 5.2 + 4.6 + dual-dial dedup. Three cases when an existing
-      // bonjour transport is registered for this peerId:
-      //
-      //   (a) Stale: the prior transport's _closed flag is set, but its
-      //       close handler hasn't run yet. Treat as no prior — accept the
-      //       new inbound (it will replace via _createPeer).
-      //
-      //   (b) Same-direction duplicate: prior is also inbound. Happens when
-      //       the OS fires newConnectionHandler twice for the same advertised
-      //       service (multipath / TCP retry). Keep the established prior,
-      //       reject duplicate — silently replacing it would tear down the
-      //       wire pair on the remote side and trigger peer-left storms.
-      //
-      //   (c) Dual-dial collision: prior is OUR outbound, new is the peer's
-      //       outbound arriving as our inbound. Both peers Bonjour-discovered
-      //       each other within ~50ms and dialed. Tie-break deterministically
-      //       by nodeId — the lower nodeId acts as client and keeps its
-      //       outbound; the higher its inbound. Both peers compute the same
-      //       physical-socket winner without exchanging coordination frames.
-      const existingPeer = this._peers.get(peerId);
-      if (existingPeer && existingPeer.transports.has('bonjour')) {
-        const prev = existingPeer.transports.get('bonjour');
-        // Stale-prior detection. Two stale signals — either is sufficient
-        // to treat the prior as dead and let the new connection replace it:
-        //   * `_closed` set: socket has explicitly been closed.
-        //   * `lastSeen` older than one heartbeat interval: socket may be
-        //     ESTABLISHED-but-half-open (peer process killed without FIN
-        //     reaching us). Loopback in particular can keep dead sockets in
-        //     ESTABLISHED state for ~2h before macOS keepalive reaps them,
-        //     blocking every redial against the zombie entry. The remote
-        //     re-dialling is itself strong evidence the prior is dead — it
-        //     wouldn't dial again if it had a healthy connection. Bound by
-        //     `_heartbeatInterval` (default 10s) — short enough that a
-        //     restarting peer reconnects within seconds, long enough that
-        //     a momentary lull during initial handshake doesn't trip it.
-        const staleByFlag = !prev || prev._closed;
-        // 1-second threshold (NOT _heartbeatInterval=10s). When a peer
-        // process is killed and quickly relaunches, its old run sent a
-        // CMB seconds before death, so lastSeen is still recent. A 10s
-        // threshold misses this and the dedup-reject path kills the
-        // legitimate redial. 1s tolerates sub-second TCP-retry races
-        // during initial handshake while letting normal peer-restart
-        // (≥1s gap between kill and re-dial) recover within the
-        // application layer.
-        const staleByLastSeen = existingPeer.lastSeen
-          && (Date.now() - existingPeer.lastSeen) > 1000;
-        const stalePrior = staleByFlag || staleByLastSeen;
-        if (!stalePrior) {
-          // Determine prior direction. The peer's `isOutbound` category reflects
-          // the direction at first transport creation; for a single-transport
-          // bonjour peer (the common case) this matches the live transport.
-          const prevIsOutbound = !!existingPeer.isOutbound;
-          const newIsOutbound = false; // by definition — this is inbound
-          const isDualDial = prevIsOutbound !== newIsOutbound;
-          if (!isDualDial) {
-            // (b) same-direction duplicate — keep prior
-            transport.close();
-            return;
-          }
-          // (c) dual-dial: lower nodeId is client, keeps outbound
-          const localIsClient = String(this._identity.nodeId) < String(peerId);
-          const keepOutbound = localIsClient;
-          const preferNew = (keepOutbound === newIsOutbound);
-          if (!preferNew) {
-            // we keep prior outbound, reject new inbound
-            transport.close();
-            return;
-          }
-          // preferNew = true: replace prior outbound with new inbound.
-          // Close prior so its close handler removes the bonjour entry from
-          // existingPeer.transports; _createPeer below will then add the new
-          // transport without the "same source already open" guard rejecting it.
-          prev.close();
-        } else if (prev && !prev._closed) {
-          // Stale by lastSeen but flag not yet set — close it explicitly so
-          // its close handler runs and removes the dict entry before we add
-          // the new transport.
-          prev.close();
-        }
-        // else: stale-by-flag prior — fall through to accept
-      }
-      if (handshakeMsg.e2ePublicKey) {
-        this._deriveAndStoreSecret(peerId, handshakeMsg.e2ePublicKey);
-      }
-      // Store the connector's Ed25519 identity key (this first handshake arrives
-      // via discovery, not the frame-handler) so we can verify its signed CMBs.
-      if (handshakeMsg.publicKey) {
-        this._pinPeerKey(peerId, handshakeMsg.publicKey);
-      }
-      transport.on('message', (m) => {
-        const peer = this._peers.get(peerId);
-        if (peer) peer.lastSeen = Date.now();
-        this._receiveFrame(peerId, peerName, m, 'lan');
-      });
-      const admission = this._roomAdmission(peerId, handshakeMsg);
-      if (!admission.admit) {
-        this._log(`Refused ${peerName} into '${this._room}': ${admission.reason}`);
+      // The handshake that opens a LAN or loopback connection is an inbound frame like any other:
+      // it goes through the same guard. Discovery has already cleared the identification deadline
+      // and handed the transport over, so a handshake this node cannot take must CLOSE the
+      // connection — in 0.13.16 a throw here was swallowed by the frame parser and left the socket
+      // open with no deadline and no owner. A nodeId that is not one is not taken at all.
+      const id = wireNodeId(peerId);
+      const name = wireName(peerName);
+      if (!id || !this._guardInbound(id, name, handshakeMsg, 'lan', () => this._acceptInbound(transport, id, name, handshakeMsg))) {
         try { transport.close(); } catch { /* already gone */ }
-        return;
       }
-      const peer = this._createPeer(transport, peerId, peerName, false, 'bonjour');
-      this._addPeer(peer);
     });
 
     this._port = await this._discovery.start(this._identity, (msg) => this._log(msg));
@@ -1674,6 +1590,116 @@ class SymNode extends EventEmitter {
     this._log(`Started (port: ${this._port}, id: ${this._identity.nodeId.slice(0, 8)}${this._relayUrl ? ', relay: ' + this._relayUrl : ''})`);
   }
 
+  /**
+   * Take the handshake that opened an inbound LAN/loopback connection (see 'inbound-connection'
+   * in start(); always called through _guardInbound).
+   * @private
+   */
+  _acceptInbound(transport, peerId, peerName, handshakeMsg) {
+    // Section 5.2 + 4.6 + dual-dial dedup. Three cases when an existing
+    // bonjour transport is registered for this peerId:
+    //
+    //   (a) Stale: the prior transport's _closed flag is set, but its
+    //       close handler hasn't run yet. Treat as no prior — accept the
+    //       new inbound (it will replace via _createPeer).
+    //
+    //   (b) Same-direction duplicate: prior is also inbound. Happens when
+    //       the OS fires newConnectionHandler twice for the same advertised
+    //       service (multipath / TCP retry). Keep the established prior,
+    //       reject duplicate — silently replacing it would tear down the
+    //       wire pair on the remote side and trigger peer-left storms.
+    //
+    //   (c) Dual-dial collision: prior is OUR outbound, new is the peer's
+    //       outbound arriving as our inbound. Both peers Bonjour-discovered
+    //       each other within ~50ms and dialed. Tie-break deterministically
+    //       by nodeId — the lower nodeId acts as client and keeps its
+    //       outbound; the higher its inbound. Both peers compute the same
+    //       physical-socket winner without exchanging coordination frames.
+    const existingPeer = this._peers.get(peerId);
+    if (existingPeer && existingPeer.transports.has('bonjour')) {
+      const prev = existingPeer.transports.get('bonjour');
+      // Stale-prior detection. Two stale signals — either is sufficient
+      // to treat the prior as dead and let the new connection replace it:
+      //   * `_closed` set: socket has explicitly been closed.
+      //   * `lastSeen` older than one heartbeat interval: socket may be
+      //     ESTABLISHED-but-half-open (peer process killed without FIN
+      //     reaching us). Loopback in particular can keep dead sockets in
+      //     ESTABLISHED state for ~2h before macOS keepalive reaps them,
+      //     blocking every redial against the zombie entry. The remote
+      //     re-dialling is itself strong evidence the prior is dead — it
+      //     wouldn't dial again if it had a healthy connection. Bound by
+      //     `_heartbeatInterval` (default 10s) — short enough that a
+      //     restarting peer reconnects within seconds, long enough that
+      //     a momentary lull during initial handshake doesn't trip it.
+      const staleByFlag = !prev || prev._closed;
+      // 1-second threshold (NOT _heartbeatInterval=10s). When a peer
+      // process is killed and quickly relaunches, its old run sent a
+      // CMB seconds before death, so lastSeen is still recent. A 10s
+      // threshold misses this and the dedup-reject path kills the
+      // legitimate redial. 1s tolerates sub-second TCP-retry races
+      // during initial handshake while letting normal peer-restart
+      // (≥1s gap between kill and re-dial) recover within the
+      // application layer.
+      const staleByLastSeen = existingPeer.lastSeen
+        && (Date.now() - existingPeer.lastSeen) > 1000;
+      const stalePrior = staleByFlag || staleByLastSeen;
+      if (!stalePrior) {
+        // Determine prior direction. The peer's `isOutbound` category reflects
+        // the direction at first transport creation; for a single-transport
+        // bonjour peer (the common case) this matches the live transport.
+        const prevIsOutbound = !!existingPeer.isOutbound;
+        const newIsOutbound = false; // by definition — this is inbound
+        const isDualDial = prevIsOutbound !== newIsOutbound;
+        if (!isDualDial) {
+          // (b) same-direction duplicate — keep prior
+          transport.close();
+          return;
+        }
+        // (c) dual-dial: lower nodeId is client, keeps outbound
+        const localIsClient = String(this._identity.nodeId) < String(peerId);
+        const keepOutbound = localIsClient;
+        const preferNew = (keepOutbound === newIsOutbound);
+        if (!preferNew) {
+          // we keep prior outbound, reject new inbound
+          transport.close();
+          return;
+        }
+        // preferNew = true: replace prior outbound with new inbound.
+        // Close prior so its close handler removes the bonjour entry from
+        // existingPeer.transports; _createPeer below will then add the new
+        // transport without the "same source already open" guard rejecting it.
+        prev.close();
+      } else if (prev && !prev._closed) {
+        // Stale by lastSeen but flag not yet set — close it explicitly so
+        // its close handler runs and removes the dict entry before we add
+        // the new transport.
+        prev.close();
+      }
+      // else: stale-by-flag prior — fall through to accept
+    }
+    if (handshakeMsg.e2ePublicKey) {
+      this._deriveAndStoreSecret(peerId, handshakeMsg.e2ePublicKey);
+    }
+    // Store the connector's Ed25519 identity key (this first handshake arrives
+    // via discovery, not the frame-handler) so we can verify its signed CMBs.
+    if (handshakeMsg.publicKey) {
+      this._pinPeerKey(peerId, handshakeMsg.publicKey);
+    }
+    transport.on('message', (m) => {
+      const peer = this._peers.get(peerId);
+      if (peer) peer.lastSeen = Date.now();
+      this._receiveFrame(peerId, peerName, m, 'lan');
+    });
+    const admission = this._roomAdmission(peerId, handshakeMsg);
+    if (!admission.admit) {
+      this._log(`Refused ${peerName} into '${this._room}': ${admission.reason}`);
+      try { transport.close(); } catch { /* already gone */ }
+      return;
+    }
+    const peer = this._createPeer(transport, peerId, peerName, false, 'bonjour');
+    this._addPeer(peer);
+  }
+
   /**
    * Stop the node: close all peers, timers, relay, and discovery.
    * @returns {Promise<void>}
@@ -2630,14 +2656,27 @@ class SymNode extends EventEmitter {
    * Guarding each path separately is how one path was missed; there is now one path.
    *
    * A relay frame is also offered raw to hosted agents before evaluation ('frame-received',
-   * MMP §4.3.2), as before — inside the guard, since a host's listener can throw too.
+   * MMP §4.3.2), as before — inside the guard, since a host's listener can throw too. The
+   * handshake that opens an inbound LAN connection is taken through the same guard (see
+   * 'inbound-connection' in start()).
    * @returns {boolean} true if the frame was handled, false if it was refused
    * @private
    */
   _receiveFrame(peerId, peerName, msg, via) {
-    try {
+    return this._guardInbound(peerId, peerName, msg, via, () => {
       if (via === 'relay') this.emit('frame-received', { peerId, peerName, frame: msg });
       this._frameHandler.handle(peerId, peerName, msg);
+    });
+  }
+
+  /**
+   * The guard itself: run `take` for one inbound frame; if it throws, the frame is refused and
+   * counted (_refuseFrame) and false is returned. Nothing it runs escapes into the transport.
+   * @private
+   */
+  _guardInbound(peerId, peerName, msg, via, take) {
+    try {
+      take();
       return true;
     } catch (err) {
       this._refuseFrame(peerId, peerName, msg, via, err);
diff --git a/lib/relay.js b/lib/relay.js
index 5c3a2b08..dde61c92 100644
--- a/lib/relay.js
+++ b/lib/relay.js
@@ -11,6 +11,7 @@
 
 const { RelayPeerTransport } = require('./transport');
 const { MAX_FRAME_SIZE } = require('./frame-parser');
+const { wireNodeId, wireName } = require('./wire-identity');
 const RELAY_ENVELOPE_ALLOWANCE = 4096;
 const ENGINE_VERSION = require('../package.json').version;
 class RelayConnection {
@@ -259,10 +260,15 @@ class RelayConnection {
       if (!msg || typeof msg !== 'object') return;
       this._lastRelayMessage = Date.now();
 
+      // A peer's nodeId and name reach us here as the JOINER put them in its relay-auth (the relay
+      // forwards them as given), so they are taken as what they must be before anything keeps or
+      // prints them (see wire-identity.js): a peer that cannot be named by a string is not added.
       if (msg.type === 'relay-peer-joined') {
-        this._handleRelayPeerJoined(msg.nodeId, msg.name);
+        const id = wireNodeId(msg.nodeId);
+        if (id) this._handleRelayPeerJoined(id, wireName(msg.name));
       } else if (msg.type === 'relay-peer-left') {
-        this._handleRelayPeerLeft(msg.nodeId, msg.name);
+        const id = wireNodeId(msg.nodeId);
+        if (id) this._handleRelayPeerLeft(id, wireName(msg.name));
       } else if (msg.type === 'relay-peers') {
         // The peer list is sent only after a successful relay-auth: a refusal episode ends here.
         this._authRefused = false;
@@ -272,17 +278,19 @@ class RelayConnection {
         // The relay re-sends its whole list on every connect: only a channel that changed is set
         // and saved, with one line for the list (it logged a line per peer on every connect).
         let learned = 0;
-        for (const p of (msg.peers || [])) {
+        for (const p of (Array.isArray(msg.peers) ? msg.peers : [])) {
+          const id = p && typeof p === 'object' ? wireNodeId(p.nodeId) : null;
+          if (!id) continue;
           const ch = p.wakeChannel;
-          if (ch && ch.platform !== 'none') {
-            const prev = this._peerWakeChannels.get(p.nodeId);
+          if (ch && typeof ch === 'object' && ch.platform !== 'none') {
+            const prev = this._peerWakeChannels.get(id);
             if (!(prev && prev.platform === ch.platform && prev.token === ch.token && prev.environment === ch.environment)) {
-              this._peerWakeChannels.set(p.nodeId, ch);
+              this._peerWakeChannels.set(id, ch);
               learned++;
             }
           }
           if (!p.offline) {
-            this._handleRelayPeerJoined(p.nodeId, p.name);
+            this._handleRelayPeerJoined(id, wireName(p.name));
           }
         }
         if (learned > 0) {
@@ -297,8 +305,8 @@ class RelayConnection {
         this._log('Relay requested re-auth — re-sending identity');
         ws.send(JSON.stringify(this._authFrame()));
       } else if (msg.type === 'relay-error') {
-        this._log(`Relay error: ${msg.message}`);
-      } else if (typeof msg.from === 'string' && msg.payload && typeof msg.payload === 'object'
+        this._log(`Relay error: ${String(typeof msg.message === 'string' ? msg.message : JSON.stringify(msg.message)).slice(0, 500)}`);
+      } else if (wireNodeId(msg.from) && msg.payload && typeof msg.payload === 'object'
                  && typeof msg.payload.type === 'string') {
         if (Buffer.byteLength(JSON.stringify(msg.payload), 'utf8') > MAX_FRAME_SIZE) {
           this._log(`Relay frame from ${String(msg.from).slice(0, 8)} dropped: payload exceeds MAX_FRAME_SIZE`);
@@ -307,7 +315,7 @@ class RelayConnection {
         const peers = this._getPeers();
         const peer = peers.get(msg.from);
         if (peer) peer.lastSeen = Date.now();
-        this._handlePeerMessage(msg.from, msg.fromName || 'unknown', msg.payload);
+        this._handlePeerMessage(msg.from, wireName(msg.fromName), msg.payload);
       }
     });
 
diff --git a/lib/wire-identity.js b/lib/wire-identity.js
new file mode 100644
index 00000000..3822237b
--- /dev/null
+++ b/lib/wire-identity.js
@@ -0,0 +1,38 @@
+'use strict';
+
+/**
+ * @module @sym-bot/sym/wire-identity
+ * @description The identity a peer declares on the wire, taken at the door as what it must be.
+ *
+ * A peer's nodeId and name arrive as JSON: in a handshake, a relay envelope (`from`, `fromName`),
+ * a relay's peer list or join notice (which carries what the joiner put in its relay-auth). JSON
+ * can carry any type there, including an object whose `toString` is not callable, which throws
+ * the moment anything turns it into text — a log line, a template string, `.slice`. Until 0.13.17
+ * these values were stored as given (in the peer table, the relay transports) and turned into
+ * text later, much of it in timers and transport callbacks where a throw is uncaught: a peer could
+ * crash a node by choosing its own name. Taken here instead: a nodeId that is not a non-empty
+ * string is no nodeId (the announcement or connection is refused), and a name that is not a
+ * string is no name ('unknown'). Both are bounded, since both are kept and repeated.
+ *
+ * @copyright 2026 SYM.BOT. Apache 2.0 License.
+ */
+
+const MAX_NODE_ID = 256;
+const MAX_NAME = 256;
+
+/** A nodeId off the wire, or null when it is not one. */
+function wireNodeId(x) {
+  return typeof x === 'string' && x.length > 0 && x.length <= MAX_NODE_ID ? x : null;
+}
+
+/** A display name off the wire: the sender's own label, a bounded string, or 'unknown'. */
+function wireName(x) {
+  return typeof x === 'string' && x.length > 0 ? x.slice(0, MAX_NAME) : 'unknown';
+}
+
+/** A public key off the wire (base64url text), or null when it is not one. */
+function wireKey(x) {
+  return typeof x === 'string' && x.length > 0 && x.length <= 512 ? x : null;
+}
+
+module.exports = { wireNodeId, wireName, wireKey, MAX_NODE_ID, MAX_NAME };
diff --git a/tests/wire-identity-ingress.test.js b/tests/wire-identity-ingress.test.js
new file mode 100644
index 00000000..d925fc2f
--- /dev/null
+++ b/tests/wire-identity-ingress.test.js
@@ -0,0 +1,134 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME before lib/config loads
+
+/**
+ * 0.13.17 security hotfix. A peer's nodeId and name arrive as JSON (a LAN handshake; a relay's
+ * join notice and peer list, which carry what the joiner put in its relay-auth; a relay envelope),
+ * and JSON can carry an object whose toString is not callable, which throws when anything prints
+ * it. 0.13.16 kept such values in the peer table and printed them later, in timers and transport
+ * callbacks: a peer could crash a node over the relay (a join notice) or the LAN (a handshake) by
+ * choosing its own name. They are now taken at the door as what they must be (lib/wire-identity.js).
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const net = require('net');
+const { WebSocketServer } = require('ws');
+const { SymNode } = require('../lib/node');
+const { BonjourDiscovery } = require('../lib/discovery');
+const { nodeDir } = require('../lib/config');
+const { sendFrame } = require('../lib/frame-parser');
+const { wireNodeId, wireName } = require('../lib/wire-identity');
+
+const BAD = { toString: 1 }; // JSON-expressible; String(BAD) throws
+const uniq = (base) => `${base}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+const until = async (cond, ms = 5000) => { for (let t = 0; t < ms && !cond(); t += 20) await new Promise((r) => setTimeout(r, 20)); };
+
+function catchUncaught() {
+  const seen = [];
+  const on = (err) => seen.push(err);
+  process.on('uncaughtException', on);
+  return { seen, done: () => process.removeListener('uncaughtException', on) };
+}
+
+describe('wire identity', () => {
+  it('a nodeId is a bounded non-empty string or nothing; a name is a bounded string or "unknown"', () => {
+    assert.strictEqual(wireNodeId('abc'), 'abc');
+    for (const x of [BAD, 42, null, undefined, '', 'x'.repeat(257), ['a']]) assert.strictEqual(wireNodeId(x), null);
+    assert.strictEqual(wireName('alice'), 'alice');
+    for (const x of [BAD, 42, null, undefined, '']) assert.strictEqual(wireName(x), 'unknown');
+    assert.strictEqual(wireName('n'.repeat(1000)).length, 256);
+  });
+});
+
+describe('relay: what the relay forwards from a joiner cannot crash the node', () => {
+  it('a join notice and a peer list naming a peer with an unprintable name, or malformed entries, are taken safely', async () => {
+    const u = catchUncaught();
+    const wss = new WebSocketServer({ port: 0 });
+    wss.on('connection', (ws) => ws.on('message', (m) => {
+      if (JSON.parse(String(m)).type !== 'relay-auth') return;
+      ws.send(JSON.stringify({ type: 'relay-peers', peers: [null, 7, { nodeId: BAD }, { nodeId: 'p'.repeat(64), name: BAD }] }));
+      ws.send(JSON.stringify({ type: 'relay-peers', peers: { length: 1 } }));
+      ws.send(JSON.stringify({ type: 'relay-peer-joined', nodeId: 'q'.repeat(64), name: BAD }));
+      ws.send(JSON.stringify({ type: 'relay-peer-joined', nodeId: 12345, name: 'numeric' }));
+      ws.send(JSON.stringify({ type: 'relay-peer-left', nodeId: BAD, name: BAD }));
+      ws.send(JSON.stringify({ type: 'relay-error', message: BAD }));
+      ws.send(JSON.stringify({ from: 'q'.repeat(64), fromName: BAD, payload: { type: 'message', content: 'hello' } }));
+    }));
+    const name = uniq('wire-relay');
+    const node = new SymNode({ name, silent: true, relayOnly: true, relay: `ws://127.0.0.1:${wss.address().port}`, relayToken: 'x'.repeat(40), room: 'g' });
+    const messages = [];
+    node.on('message', (from, content) => messages.push([from, content]));
+    try {
+      await node.start();
+      await until(() => messages.length >= 1);
+      await new Promise((r) => setTimeout(r, 100));
+      assert.deepStrictEqual(u.seen, [], 'nothing reached uncaughtException');
+      const peers = node.status().peers;
+      assert.deepStrictEqual(peers.map((p) => p.name).sort(), ['unknown', 'unknown'], 'both named peers are in, as "unknown"; the numeric id is not');
+      assert.deepStrictEqual(messages, [['unknown', 'hello']]);
+      assert.strictEqual(node.status().relayConnected, true);
+    } finally {
+      u.done();
+      await node.stop();
+      await new Promise((r) => wss.close(() => r()));
+      fs.rmSync(nodeDir(name), { recursive: true, force: true });
+    }
+  });
+});
+
+describe('LAN: the handshake that opens a connection', () => {
+  async function lanNode(base, opts = {}) {
+    const name = uniq(base);
+    const node = new SymNode({ name, silent: true, discovery: new BonjourDiscovery({ mdns: false }), room: 'g', ...opts });
+    await node.start();
+    return { node, name };
+  }
+  function dial(port, frame) {
+    const s = net.createConnection({ port, host: '127.0.0.1' }, () => sendFrame(s, frame));
+    s.gone = false;
+    s.on('data', () => {});
+    s.on('error', () => {});
+    s.on('close', () => { s.gone = true; });
+    return s;
+  }
+
+  it('a handshake naming the peer with an unprintable name does not crash the node; the peer is "unknown"', async () => {
+    const u = catchUncaught();
+    const { node, name } = await lanNode('wire-lan-name');
+    const s = dial(node._port, { type: 'handshake', nodeId: 'z'.repeat(64), name: BAD });
+    try {
+      await until(() => node._peers.size === 1);
+      await new Promise((r) => setTimeout(r, 200));
+      assert.deepStrictEqual(u.seen, []);
+      assert.strictEqual(node._peers.get('z'.repeat(64)).name, 'unknown');
+      assert.ok(Array.isArray(node.status().peers));
+    } finally { u.done(); s.destroy(); await node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+  });
+
+  it('a handshake the node cannot take closes the connection and is counted; it is never left open without an owner', async () => {
+    const { node, name } = await lanNode('wire-lan-refused');
+    node._roomAdmission = () => { throw new Error('admission failed'); };
+    const s = dial(node._port, { type: 'handshake', nodeId: 'w'.repeat(64), name: 'w' });
+    const t = dial(node._port, { type: 'handshake', nodeId: 42, name: 'n' });
+    try {
+      await until(() => s.gone && t.gone, 3000);
+      assert.strictEqual(s.gone, true, 'the refused connection is closed (0.13.16 left it open, its deadline cleared)');
+      assert.strictEqual(t.gone, true, 'a handshake whose nodeId is not one is closed');
+      assert.strictEqual(node._peers.size, 0);
+      assert.strictEqual(node.metrics().framesRefusedByType.handshake, 1);
+    } finally { s.destroy(); t.destroy(); await node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+  });
+
+  it('a handshake whose keys are not text pins nothing', async () => {
+    const { node, name } = await lanNode('wire-lan-keys');
+    const s = dial(node._port, { type: 'handshake', nodeId: 'k'.repeat(64), name: 'k', publicKey: BAD, e2ePublicKey: BAD });
+    try {
+      await until(() => node._peers.size === 1);
+      assert.strictEqual(node._roster.has('k'.repeat(64)), false);
+      assert.strictEqual(node._peerSharedSecrets.has('k'.repeat(64)), false);
+    } finally { s.destroy(); await node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+  });
+});

From cf0854caca6c5c0e96f7ec87a21eca2c877c9519 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Fri, 2 Oct 2026 08:46:55 +0100
Subject: [PATCH 084/148] 0.13.17 security: wake channels are taken as text
 before they are kept; a frame's async half is refused by the same guard

- A wake channel off the wire (a `wake-channel` frame, a `peer-info` entry, the relay's peer
  list) is kept only as { platform, token, environment } of text. In 0.13.16 a `wake-channel`
  frame was stored and written to wake-channels.json before it was printed, so one whose
  platform could not be printed was persisted and then threw; and whatever a peer put in a
  channel was kept and gossiped on to every peer this node met.
- The asynchronous half of a cmb frame's dispatch (heuristic SVAF) is refused and counted by the
  node's guard (_refuseFrame, which cannot throw). In 0.13.16 its containment built a log line
  from the peer's name, and a name that could not be printed made the catch itself throw: an
  unhandled rejection, which ends a host without a handler.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 lib/frame-handler.js                | 35 +++++++++++++++++-----------
 lib/relay.js                        |  6 ++---
 lib/wire-identity.js                | 21 +++++++++++++++--
 tests/inbound-frame-guard.test.js   | 21 +++++++++++++++++
 tests/wire-identity-ingress.test.js | 36 ++++++++++++++++++++++++++++-
 5 files changed, 99 insertions(+), 20 deletions(-)

diff --git a/lib/frame-handler.js b/lib/frame-handler.js
index 4768328f..66e9df84 100644
--- a/lib/frame-handler.js
+++ b/lib/frame-handler.js
@@ -1,6 +1,7 @@
 'use strict';
 
 const { recordKey, recordLineage, recordParents, recordCreatedBy, setRecordLineage } = require('./record');
+const { wireNodeId, wireWakeChannel } = require('./wire-identity');
 
 /**
  * @module @sym-bot/sym/frame-handler
@@ -895,7 +896,7 @@ class FrameHandler {
         this._runHeuristicSVAFContained(msg, peerName, peerId, originTs, now, ageSeconds);
       }
     }).catch((err) => {
-      this._node._log(`SVAF neural error: ${err.message} — falling back to heuristic`);
+      this._node._log(`SVAF neural error: ${err && err.message} — falling back to heuristic`);
       this._runHeuristicSVAFContained(msg, peerName, peerId, originTs, now, ageSeconds);
     });
   }
@@ -903,14 +904,20 @@ class FrameHandler {
   /**
    * Run heuristic SVAF with its rejection contained. A malformed or
    * unexpected frame must never be able to kill the host process — the
-   * async path's failure is logged and the frame dropped, not left to the
-   * global unhandled-rejection handler.
+   * async path's failure is the asynchronous half of the frame's dispatch, so
+   * it is refused and counted by the same guard as a synchronous one
+   * (node._refuseFrame, which cannot itself throw), not left to the global
+   * unhandled-rejection handler. (In 0.13.16 this catch built a log line from
+   * the peer's name, and a name that could not be printed made the catch throw.)
    * @private
    */
   _runHeuristicSVAFContained(msg, peerName, peerId, originTs, now, ageSeconds) {
     Promise.resolve()
       .then(() => this._processHeuristicSVAF(msg, peerName, peerId, originTs, now, ageSeconds))
-      .catch((err) => this._node._log(`SVAF heuristic error on frame from ${peerName}: ${err.message} — frame dropped`));
+      .catch((err) => {
+        if (typeof this._node._refuseFrame === 'function') this._node._refuseFrame(peerId, peerName, msg, 'svaf', err);
+        else try { this._node._log(`SVAF heuristic error: ${err && err.message} — frame dropped`); } catch { /* never rethrow */ }
+      });
   }
 
   /**
@@ -1376,12 +1383,11 @@ class FrameHandler {
    * @private
    */
   _handleWakeChannel(peerId, peerName, msg) {
-    if (!msg.platform) return;
-    this._node._peerWakeChannels.set(peerId, {
-      platform: msg.platform,
-      token: msg.token,
-      environment: msg.environment,
-    });
+    // Taken as text before it is kept: in 0.13.16 a channel was stored and written to disk first and
+    // printed after, so one whose platform could not be printed was persisted and then threw.
+    const ch = wireWakeChannel(msg);
+    if (!ch) return;
+    this._node._peerWakeChannels.set(peerId, ch);
     this._node._wakeManager.saveWakeChannels();
     this._node._log(`Wake channel from ${peerName}: ${msg.platform}`);
   }
@@ -1420,11 +1426,12 @@ class FrameHandler {
     let learned = 0;
     if (msg.peers.length > 256) this._node._log(`Gossip from ${peerName}: ${msg.peers.length} entries, reading the first 256`);
     for (const p of msg.peers.slice(0, 256)) {
-      if (!p || !p.nodeId || !p.wakeChannel || p.nodeId === this._node._identity.nodeId) continue;
-      const prev = this._node._peerWakeChannels.get(p.nodeId);
-      const ch = p.wakeChannel;
+      const id = p && typeof p === 'object' ? wireNodeId(p.nodeId) : null;
+      const ch = id ? wireWakeChannel(p.wakeChannel) : null;
+      if (!ch || id === this._node._identity.nodeId) continue;
+      const prev = this._node._peerWakeChannels.get(id);
       if (prev && prev.platform === ch.platform && prev.token === ch.token && prev.environment === ch.environment) continue;
-      this._node._peerWakeChannels.set(p.nodeId, ch);
+      this._node._peerWakeChannels.set(id, ch);
       learned++;
     }
     if (learned === 0) return;
diff --git a/lib/relay.js b/lib/relay.js
index dde61c92..8410895b 100644
--- a/lib/relay.js
+++ b/lib/relay.js
@@ -11,7 +11,7 @@
 
 const { RelayPeerTransport } = require('./transport');
 const { MAX_FRAME_SIZE } = require('./frame-parser');
-const { wireNodeId, wireName } = require('./wire-identity');
+const { wireNodeId, wireName, wireWakeChannel } = require('./wire-identity');
 const RELAY_ENVELOPE_ALLOWANCE = 4096;
 const ENGINE_VERSION = require('../package.json').version;
 class RelayConnection {
@@ -281,8 +281,8 @@ class RelayConnection {
         for (const p of (Array.isArray(msg.peers) ? msg.peers : [])) {
           const id = p && typeof p === 'object' ? wireNodeId(p.nodeId) : null;
           if (!id) continue;
-          const ch = p.wakeChannel;
-          if (ch && typeof ch === 'object' && ch.platform !== 'none') {
+          const ch = wireWakeChannel(p.wakeChannel);
+          if (ch && ch.platform !== 'none') {
             const prev = this._peerWakeChannels.get(id);
             if (!(prev && prev.platform === ch.platform && prev.token === ch.token && prev.environment === ch.environment)) {
               this._peerWakeChannels.set(id, ch);
diff --git a/lib/wire-identity.js b/lib/wire-identity.js
index 3822237b..2dafbeeb 100644
--- a/lib/wire-identity.js
+++ b/lib/wire-identity.js
@@ -12,7 +12,8 @@
  * text later, much of it in timers and transport callbacks where a throw is uncaught: a peer could
  * crash a node by choosing its own name. Taken here instead: a nodeId that is not a non-empty
  * string is no nodeId (the announcement or connection is refused), and a name that is not a
- * string is no name ('unknown'). Both are bounded, since both are kept and repeated.
+ * string is no name ('unknown'). Both are bounded, since both are kept and repeated. The same
+ * holds for the other peer-supplied values a node keeps and passes on: keys and wake channels.
  *
  * @copyright 2026 SYM.BOT. Apache 2.0 License.
  */
@@ -35,4 +36,20 @@ function wireKey(x) {
   return typeof x === 'string' && x.length > 0 && x.length <= 512 ? x : null;
 }
 
-module.exports = { wireNodeId, wireName, wireKey, MAX_NODE_ID, MAX_NAME };
+/**
+ * A wake channel off the wire (a `wake-channel` frame, a `peer-info` entry, the relay's peer list):
+ * `{ platform, token, environment }`, each text (token and environment may be absent), or null.
+ * Only those three are kept — they are all a wake uses — since a channel is stored, written to
+ * wake-channels.json and gossiped on to every peer this node meets.
+ */
+function wireWakeChannel(ch) {
+  if (!ch || typeof ch !== 'object') return null;
+  const { platform, token, environment } = ch;
+  if (typeof platform !== 'string' || !platform || platform.length > 32) return null;
+  // null is how some encoders (sym-swift's optionals) spell absent.
+  if (token != null && (typeof token !== 'string' || token.length > 4096)) return null;
+  if (environment != null && (typeof environment !== 'string' || environment.length > 64)) return null;
+  return { platform, token: token ?? undefined, environment: environment ?? undefined };
+}
+
+module.exports = { wireNodeId, wireName, wireKey, wireWakeChannel, MAX_NODE_ID, MAX_NAME };
diff --git a/tests/inbound-frame-guard.test.js b/tests/inbound-frame-guard.test.js
index 56dec62f..13348e40 100644
--- a/tests/inbound-frame-guard.test.js
+++ b/tests/inbound-frame-guard.test.js
@@ -141,6 +141,27 @@ describe('a mood frame on a stock node (G2)', () => {
   });
 });
 
+describe('the asynchronous half of a frame (SVAF) is refused by the same guard', () => {
+  it('a rejection is counted, and a peer name that cannot be printed cannot make the containment throw', async () => {
+    const name = uniq('guard-async');
+    const node = new SymNode({ name, silent: true, discovery: new NullDiscovery() });
+    const rejections = [];
+    const onRejection = (r) => rejections.push(r);
+    process.on('unhandledRejection', onRejection);
+    try {
+      node._frameHandler._processHeuristicSVAF = async () => { throw new Error('engine failed'); };
+      node._frameHandler._runHeuristicSVAFContained({ type: 'cmb', cmb: {} }, { toString: 1 }, 'id-a', 0, Date.now(), 1);
+      await new Promise((r) => setTimeout(r, 50));
+      assert.deepStrictEqual(rejections, [], 'nothing reached unhandledRejection (0.13.16: the catch threw printing the name)');
+      assert.strictEqual(node.metrics().framesRefusedByType.cmb, 1);
+    } finally {
+      process.removeListener('unhandledRejection', onRejection);
+      node.stop();
+      fs.rmSync(nodeDir(name), { recursive: true, force: true });
+    }
+  });
+});
+
 describe('the daemon survives a peer\'s mood and message frames over the relay (G2, C3)', () => {
   it('stays up, handles both, and answers an insight-engine request it cannot serve instead of throwing', async () => {
     const home = fs.mkdtempSync(path.join(os.tmpdir(), 'sym-daemon-guard-'));
diff --git a/tests/wire-identity-ingress.test.js b/tests/wire-identity-ingress.test.js
index d925fc2f..97744b75 100644
--- a/tests/wire-identity-ingress.test.js
+++ b/tests/wire-identity-ingress.test.js
@@ -17,7 +17,7 @@ const fs = require('fs');
 const net = require('net');
 const { WebSocketServer } = require('ws');
 const { SymNode } = require('../lib/node');
-const { BonjourDiscovery } = require('../lib/discovery');
+const { BonjourDiscovery, NullDiscovery } = require('../lib/discovery');
 const { nodeDir } = require('../lib/config');
 const { sendFrame } = require('../lib/frame-parser');
 const { wireNodeId, wireName } = require('../lib/wire-identity');
@@ -122,6 +122,17 @@ describe('LAN: the handshake that opens a connection', () => {
     } finally { s.destroy(); t.destroy(); await node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
   });
 
+  it('a handshake whose room claim cannot be printed is refused and its connection closed', async () => {
+    const { node, name } = await lanNode('wire-lan-room');
+    const s = dial(node._port, { type: 'handshake', nodeId: 'r'.repeat(64), name: 'r', room: BAD });
+    try {
+      await until(() => s.gone, 3000);
+      assert.strictEqual(s.gone, true);
+      assert.strictEqual(node._peers.size, 0);
+      assert.strictEqual(node.metrics().framesRefusedByType.handshake, 1);
+    } finally { s.destroy(); await node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+  });
+
   it('a handshake whose keys are not text pins nothing', async () => {
     const { node, name } = await lanNode('wire-lan-keys');
     const s = dial(node._port, { type: 'handshake', nodeId: 'k'.repeat(64), name: 'k', publicKey: BAD, e2ePublicKey: BAD });
@@ -132,3 +143,26 @@ describe('LAN: the handshake that opens a connection', () => {
     } finally { s.destroy(); await node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
   });
 });
+
+describe('wake channels are taken as text before they are kept', () => {
+  it('a wake-channel frame or peer-info entry that is not text is not stored, written or passed on', () => {
+    const name = uniq('wire-wake');
+    const node = new SymNode({ name, silent: true, discovery: new NullDiscovery() });
+    let writes = 0;
+    node._wakeManager.saveWakeChannels = () => { writes++; };
+    try {
+      assert.doesNotThrow(() => node._frameHandler.handle('p1', 'p1', { type: 'wake-channel', platform: BAD, token: 't' }));
+      assert.doesNotThrow(() => node._frameHandler.handle('p1', 'p1', { type: 'wake-channel', platform: 'apns', token: { t: 1 } }));
+      assert.strictEqual(node._peerWakeChannels.has('p1'), false, 'not kept');
+      assert.strictEqual(writes, 0, 'and not written (0.13.16 wrote it, then threw printing it)');
+      node._frameHandler.handle('p2', 'p2', { type: 'peer-info', peers: [
+        null, 7, { nodeId: BAD, wakeChannel: { platform: 'apns', token: 't' } },
+        { nodeId: 'a', wakeChannel: { platform: 'apns', token: BAD } },
+        { nodeId: 'b', wakeChannel: { platform: 'apns', token: 't', environment: 'sandbox', extra: 'x'.repeat(10000) } },
+      ] });
+      assert.deepStrictEqual([...node._peerWakeChannels.keys()], ['b']);
+      assert.deepStrictEqual(node._peerWakeChannels.get('b'), { platform: 'apns', token: 't', environment: 'sandbox' }, 'only what a wake uses is kept');
+      assert.strictEqual(writes, 1);
+    } finally { node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+  });
+});

From 73c1d1e76fb29c84d276650e91a92a7708940919 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Fri, 2 Oct 2026 08:46:55 +0100
Subject: [PATCH 085/148] 0.13.17 tests: the daemon handles a peer's mood and
 message frames, it does not merely survive them

The daemon test now also requires that neither frame is refused, so it fails if the cause (the
unchecked insight engine) comes back even though the guarded dispatch would keep the daemon up.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 tests/inbound-frame-guard.test.js | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/inbound-frame-guard.test.js b/tests/inbound-frame-guard.test.js
index 13348e40..53d84e53 100644
--- a/tests/inbound-frame-guard.test.js
+++ b/tests/inbound-frame-guard.test.js
@@ -187,6 +187,7 @@ describe('the daemon survives a peer\'s mood and message frames over the relay (
       await new Promise((r) => setTimeout(r, 500));
       assert.strictEqual(daemon.exitCode, null, `the daemon is still running; log:\n${out.slice(-1500)}`);
       assert.doesNotMatch(out, /FATAL/);
+      assert.doesNotMatch(out, /Refused a/, 'both frames are handled, not refused: the cause is gone, not just caught');
       assert.match(out, /Mood from evil: .*(ACCEPTED|IGNORED)/);
       const reply = await new Promise((resolve, reject) => {
         const c = net.createConnection(sock, () => c.write(JSON.stringify({ type: 'xmesh-context' }) + '\n'));

From f112f06d520e21e03e1da97c99936b93d3232b7a Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Fri, 2 Oct 2026 08:49:52 +0100
Subject: [PATCH 086/148] 0.13.17 tests: a LAN peer whose keys are not text is
 taken without them, not refused

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 tests/wire-identity-ingress.test.js | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tests/wire-identity-ingress.test.js b/tests/wire-identity-ingress.test.js
index 97744b75..ebb4fddd 100644
--- a/tests/wire-identity-ingress.test.js
+++ b/tests/wire-identity-ingress.test.js
@@ -138,6 +138,8 @@ describe('LAN: the handshake that opens a connection', () => {
     const s = dial(node._port, { type: 'handshake', nodeId: 'k'.repeat(64), name: 'k', publicKey: BAD, e2ePublicKey: BAD });
     try {
       await until(() => node._peers.size === 1);
+      assert.strictEqual(node._peers.size, 1, 'the peer is taken, as one that sent no keys');
+      assert.strictEqual(node.metrics().framesRefused, 0);
       assert.strictEqual(node._roster.has('k'.repeat(64)), false);
       assert.strictEqual(node._peerSharedSecrets.has('k'.repeat(64)), false);
     } finally { s.destroy(); await node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }

From 3a6fd68883ab2563ef5052452295daa170a926d9 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Fri, 2 Oct 2026 08:48:03 +0100
Subject: [PATCH 087/148] 0.13.17

Security hotfix: a peer could stop a node from ever starting again with one role-grant, and
crash a node or the daemon with a mood or message frame, or its own name. See CHANGELOG.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 CHANGELOG.md      | 54 +++++++++++++++++++++++++++++++++++++++++++++++
 package-lock.json |  4 ++--
 package.json      |  2 +-
 3 files changed, 57 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a102029a..f902e63a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,59 @@
 # Changelog
 
+## 0.13.17 (2026-10-02)
+
+A security hotfix. In 0.13.16 a peer could stop a node from ever starting again, and crash a
+running node or the daemon, with one frame. Every node and every daemon should take it.
+
+### Security
+
+- **One role-grant from any peer stopped a node from starting, for good.** A connected peer could
+  sign a role-grant itself (naming itself as grantor) and send it; the node checked the signature
+  against that peer's own key, which it had just learned from the peer's handshake, wrote the grant
+  to `role-grants.jsonl` and relayed it to every peer it had, which did the same. Reading any
+  `role-grants.jsonl` then threw (`object is not iterable`), so every node that had received the
+  frame failed in `new SymNode` on its next start, and kept failing. The anchor's own `grantRole()`
+  had the same effect on its own node. Now:
+  - a grant or revoke is kept only when it is rooted at the pinned anchor: its grantor held, when it
+    signed, the rank the record needs, by the chain the node already holds. A record that is not
+    rooted has no effect on any role, so it is not stored, not written and not relayed (and costs no
+    signature check). A node without an anchor (the daemon, by default) keeps none;
+  - the store looks grantor keys up through the roster's own lookup, on receipt and on reload alike;
+  - reading the file never stops a node from starting. A record that cannot be verified (not JSON,
+    malformed, unknown grantor key, bad signature, unrooted) is skipped and counted, and the node says
+    what it skipped, once; a file that cannot be read leaves the node starting with no grants. **A
+    node that 0.13.16 left unable to start starts on 0.13.17 with nothing to clean up**: the bad
+    records stay in the file (it is append-only and is not rewritten) and are skipped at each start;
+  - `grantRole`/`revokeRole` on a node without that rooted authority make nothing, send nothing, and
+    return `null`.
+- **A peer's `mood` frame crashed any node over the relay.** The relay path called the frame
+  handler with no guard (the LAN path caught a handler's throw inside the frame parser and dropped it
+  silently), and the mood handler always threw on a stock node: it registered the mood as a peer in
+  the coupling set and ran a coupling step that the stock coupler cannot run. The throw reached
+  `uncaughtException`; the daemon exits on that, and so does a host without a handler. On LAN, where
+  it was swallowed, the phantom peer stayed for two minutes and the node's own `remember()` threw for
+  as long: one mood frame every two minutes kept a node from publishing. Now:
+  - every inbound frame, over every transport (LAN and loopback, inbound and outbound, the relay),
+    goes through one guarded dispatch. A frame the node cannot handle is refused and counted
+    (`metrics().framesRefused`, `framesRefusedByType`), said at most once a minute per peer, and
+    never thrown out of the transport. The handshake that opens a LAN connection and the asynchronous
+    half of a CMB's evaluation go through the same guard;
+  - a mood's drift is measured directly against the node's own state; nothing is added to the
+    coupling set. The metrics logger and `peers()` read only what the coupler contract gives.
+- **A peer's `message` frame crashed the daemon over the relay.** The daemon fed every message to an
+  insight engine that a stock daemon does not have. It now checks for one, and the IPC requests that
+  read it (`xmesh-context`, `xmesh-search`) answer with an error when there is none.
+- **A peer could crash a node with its own name.** A peer's nodeId and name arrive as JSON, which can
+  carry an object that throws when printed, and 0.13.16 kept them as given and printed them later, in
+  timers and transport callbacks. Over the relay, a joiner's name reaches every node in the channel in
+  the relay's join notice and peer list, so one token holder could crash them all, again on every
+  reconnect; over the LAN, a handshake did it. A LAN handshake without a nodeId put a phantom peer in
+  the table that made `peers()` and `status()` throw until restart, and a handshake the node could
+  not take left its connection open with no deadline, so a peer could hold sockets without limit. A
+  nodeId is now a non-empty string or the announcement or connection is refused, a name is a string
+  or `'unknown'`, a key is text or it is not pinned, and a wake channel is kept only as text
+  (`{ platform, token, environment }`), before anything stores, prints or passes them on.
+
 ## 0.13.16 (2026-10-02)
 
 Follow-ups to the 0.13.15 witness-storm fix, from its last review.
diff --git a/package-lock.json b/package-lock.json
index 4345a406..2a74386b 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@sym-bot/sym",
-  "version": "0.13.16",
+  "version": "0.13.17",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@sym-bot/sym",
-      "version": "0.13.16",
+      "version": "0.13.17",
       "license": "Apache-2.0",
       "dependencies": {
         "bonjour-service": "^1.3.0",
diff --git a/package.json b/package.json
index db9f7bb9..7273adf8 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@sym-bot/sym",
-  "version": "0.13.16",
+  "version": "0.13.17",
   "description": "Infrastructure and protocol for multi-agent collective intelligence",
   "main": "lib/node.js",
   "bin": {

From fb09b979a6b392adad8fafea590ed0fb1fea3177 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Fri, 2 Oct 2026 11:36:05 +0100
Subject: [PATCH 088/148] 0.13.17 security: a grant or revoke that arrives
 before its root waits for it instead of being lost

The hotfix refused an unrooted record at receipt, never relayed it, and there is no grant
sync, so a grant (or a revoke) that gossip delivered before the grant rooting its grantor was
lost for good: the node resolved different roles from 0.13.16, and an early revoke never took
effect.

A record refused for a curable reason (unknown-grantor-key, unrooted) now waits in a bounded
in-memory pending set (1024, oldest dropped first), keyed by its signed fields and signature so
a forgery sent ahead cannot displace the genuine record. It is never written, never relayed and
changes no role while it waits. Whenever a record is stored, the pending set is retried by the
same fixpoint the reload uses (_settle); what is now rooted is stored, persisted and returned as
`released`, and the node relays it like any record kept on receipt. Records a 0.13.16 file left
unrooted wait the same way, and are not appended again when rooted.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 lib/node.js                      |  22 +++-
 lib/role-grant-store.js          | 189 ++++++++++++++++++++++++-------
 tests/role-grant-pending.test.js | 161 ++++++++++++++++++++++++++
 3 files changed, 328 insertions(+), 44 deletions(-)
 create mode 100644 tests/role-grant-pending.test.js

diff --git a/lib/node.js b/lib/node.js
index 045eebd6..4172e18c 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -872,6 +872,7 @@ class SymNode extends EventEmitter {
         return null;
       }
       this._gossipToRoster({ type: g.type, grant: g });
+      this._relayReleasedGrants(r.released);
       return g;
     } catch (err) {
       this._log(`Role grant signing failed: ${err.message}`);
@@ -883,16 +884,33 @@ class SymNode extends EventEmitter {
    * Ingest a role-grant/revoke gossiped by a roster peer: the store keeps it only if it is
    * rooted at the anchor and its signature verifies against the grantor's authenticated
    * key (anchor pinned), and only a record kept is relayed (once). An unrooted record — a
-   * peer's self-signed grant, say — has no effect, so it is dropped here and goes no further.
+   * peer's self-signed grant, say — has no effect, so it goes no further: the store holds it
+   * in memory only (never written, never relayed) in case the grant rooting its grantor is
+   * still on its way. A record that roots held ones releases them, and they are relayed here
+   * as it is (see _relayReleasedGrants).
    * @private
    */
   _ingestRoleGrant(g, fromPeerId) {
     if (!g) return { ok: false, reason: 'malformed' };
     const r = this._roleGrants.record(g);
-    if (r.stored) this._gossipToRoster({ type: g.type, grant: g }, fromPeerId);
+    if (r.stored) {
+      this._gossipToRoster({ type: g.type, grant: g }, fromPeerId);
+      this._relayReleasedGrants(r.released);
+    }
     return { ok: r.stored, reason: r.reason };
   }
 
+  /**
+   * Relay the records a store released from the pending set — each now rooted, stored and
+   * persisted, so relayed once like any record kept on receipt. Who sent each one is not
+   * kept, so none is excepted: a peer that already holds one drops it as a duplicate.
+   * @private
+   */
+  _relayReleasedGrants(released) {
+    if (!Array.isArray(released)) return;
+    for (const g of released) this._gossipToRoster({ type: g.type, grant: g });
+  }
+
   /**
    * This node's own store tally: emitted = CMBs it authored (no peerId), admitted = CMBs
    * it accepted from peers (remixed in, has peerId), memory = total. The node is the only
diff --git a/lib/role-grant-store.js b/lib/role-grant-store.js
index 1461af07..d620c3e5 100644
--- a/lib/role-grant-store.js
+++ b/lib/role-grant-store.js
@@ -17,9 +17,22 @@
  * A record is KEPT only when it is rooted at the anchor: its grantor held, at the time it
  * signed, the rank the record needs (a grant: the rank it confers; a revoke: validator or
  * above), by the chain this store already holds. An unrooted record has no effect on any
- * resolution, so it is not stored, not relayed, and costs nothing — before 0.13.17 it was
- * stored and relayed, so any connected peer could write records here by signing them
- * itself. Resolution still re-checks every chain (role-at-time, revocation cascades).
+ * resolution, so it is not stored, not relayed, and costs no signature check — before
+ * 0.13.17 it was stored and relayed, so any connected peer could write records here by
+ * signing them itself. Resolution still re-checks every chain (role-at-time, revocation
+ * cascades).
+ *
+ * Rooted is a property of the chain, not of arrival order: gossip can bring a grant (or a
+ * revoke) before the grant that roots its grantor, and there is no grant sync to ask for it
+ * again. So a record refused for a reason a later record can cure — `unknown-grantor-key`
+ * (the grantor's key arrives vouched in its own grant) or `unrooted` (the grantor's grant
+ * arrives) — is HELD in memory, in a bounded pending set (`maxPending`, 1024 by default, the
+ * oldest dropped first). It is never written and never relayed while it waits, and has no
+ * effect on any resolution. Whenever a record is stored, the pending set is retried by the
+ * same fixpoint the reload uses (offer each until a pass stores none); one that is now
+ * rooted is stored, persisted and returned to the caller to relay like any other. The
+ * pending set is not persisted: what waits when the node stops is gone, as a refused record
+ * was before.
  *
  * Grantor keys are resolved through ONE interface, the key registry's own lookup (the
  * node's roster), on ingest and on reload alike. Persisted append-only; reloaded on
@@ -35,6 +48,9 @@ const path = require('path');
 const { verifyGrant, roleRank } = require('./core');
 
 const GRANTS_FILE = 'role-grants.jsonl';
+/** Refusals a later record can cure: the grantor's key, or the grant rooting the grantor, has not arrived. */
+const CURABLE = new Set(['unknown-grantor-key', 'unrooted']);
+const MAX_PENDING = 1024;
 
 class RoleGrantStore {
   /**
@@ -46,12 +62,16 @@ class RoleGrantStore {
    *   `get`. Only ever LOOKED UP through `get` (never copied or iterated); a rooted grant's
    *   vouched grantee key is pinned back into it (`pin`, or `set` when absent on a Map).
    * @param {string} [opts.dir] when set, grants persist append-only and reload here.
+   * @param {number} [opts.maxPending=1024] how many refused-but-curable records are held in
+   *   memory waiting for their root (the oldest is dropped first).
    */
   constructor(opts = {}) {
     this._anchor = opts.anchor || null;
     this._keys = opts.keys || new Map();
     this._byGrantee = new Map(); // grantee nodeId -> [grant/revoke records]
     this._seen = new Set();      // sig dedup
+    this._pending = new Map();   // pendingKey -> { grant, persisted, reason }: curable refusals, in arrival order
+    this._maxPending = Number.isInteger(opts.maxPending) && opts.maxPending >= 0 ? opts.maxPending : MAX_PENDING;
     this._dir = opts.dir || null;
     this._loading = false;
     this._loadReport = { loaded: 0, skipped: {}, unreadable: null };
@@ -86,25 +106,115 @@ class RoleGrantStore {
    * Record a signed role-grant / role-revoke, if it is rooted at the anchor. In order: the
    * record must be well-formed, new (dedup by sig), from a grantor whose key the registry
    * resolves, ROOTED (see `_rooted`), and its signature must verify against that key. A
-   * record that fails any of these is refused with the reason and leaves no trace: it is
-   * not held, not written, and the caller does not relay it. Reloading from disk runs the
-   * same checks — the file has no integrity of its own, so nothing is trusted for being on it.
-   * @returns {{ stored: boolean, reason?: string }}
+   * record that fails any of these is refused with the reason: it is not stored, not written,
+   * and the caller does not relay it. One refused for a curable reason (`unknown-grantor-key`,
+   * `unrooted`) is held in the pending set until a later record roots it (see the module doc).
+   *
+   * A record that is stored is followed by a retry of the pending set: the records it rooted
+   * (directly, or through one another) are stored and persisted too, and returned as
+   * `released`, in the order they were stored, for the caller to relay as it relays this one.
+   * Reloading from disk runs the same checks — the file has no integrity of its own, so
+   * nothing is trusted for being on it.
+   * @returns {{ stored: boolean, reason?: string, released?: object[] }}
    */
   record(grant) {
-    if (malformed(grant)) return { stored: false, reason: 'malformed' };
-    if (this._seen.has(grant.sig)) return { stored: false, reason: 'duplicate' };
-    const key = this._grantorKey(grant.grantedBy);
-    if (!key) return { stored: false, reason: 'unknown-grantor-key' };
-    if (!this._rooted(grant)) return { stored: false, reason: 'unrooted' };
-    if (!verifyGrant(grant, key).valid) return { stored: false, reason: 'bad-signature' };
+    const reason = this._refusal(grant);
+    if (reason) {
+      if (CURABLE.has(reason)) this._hold(grant, false, reason);
+      return { stored: false, reason };
+    }
+    this._keep(grant, false);
+    const released = this._retryPending();
+    return released.length ? { stored: true, released } : { stored: true };
+  }
+
+  /** How many refused-but-curable records are waiting for their root (in memory only). */
+  pendingSize() { return this._pending.size; }
+
+  /**
+   * Why a record cannot be stored now, or null when it can. Never throws: a record whose
+   * checks fail in a way no reason names is 'unverifiable'.
+   * @private
+   */
+  _refusal(grant) {
+    try {
+      if (malformed(grant)) return 'malformed';
+      if (this._seen.has(grant.sig)) return 'duplicate';
+      const key = this._grantorKey(grant.grantedBy);
+      if (!key) return 'unknown-grantor-key';
+      if (!this._rooted(grant)) return 'unrooted';
+      if (!verifyGrant(grant, key).valid) return 'bad-signature';
+      return null;
+    } catch {
+      return 'unverifiable';
+    }
+  }
+
+  /** Store a record that passed `_refusal`: index it, persist it (unless it came from the file), pin its vouched key. @private */
+  _keep(grant, persisted) {
     this._seen.add(grant.sig);
     let arr = this._byGrantee.get(grant.grantee);
     if (!arr) { arr = []; this._byGrantee.set(grant.grantee, arr); }
     arr.push(grant);
-    this._append(grant);
+    if (!persisted) this._append(grant);
     this._pinGranteeKey(grant);
-    return { stored: true };
+  }
+
+  /**
+   * Hold a curable refusal until its root arrives. Keyed by everything the signature covers
+   * plus the signature, so a copy that differs from a held record in any signed field is a
+   * different record (a forgery sent ahead of the genuine one cannot displace it), and an
+   * identical copy is held once. Bounded: the oldest is dropped first.
+   * @private
+   */
+  _hold(grant, persisted, reason) {
+    if (this._maxPending === 0) return;
+    const key = pendingKey(grant);
+    const held = this._pending.get(key);
+    if (held) { held.reason = reason; return; }
+    while (this._pending.size >= this._maxPending) this._pending.delete(this._pending.keys().next().value);
+    this._pending.set(key, { grant, persisted, reason });
+  }
+
+  /**
+   * The fixpoint the reload and every store share: offer each entry in turn; one that can be
+   * stored is stored, one refused for a curable reason is offered again on the next pass, any
+   * other refusal is final; stop when a pass stores nothing.
+   * @param {{grant: object, persisted: boolean}[]} entries
+   * @returns {{ kept: object[], refused: {entry: object, reason: string}[], left: {entry: object, reason: string}[] }}
+   * @private
+   */
+  _settle(entries) {
+    const kept = [];
+    const refused = [];
+    let left = entries.map((entry) => ({ entry, reason: null }));
+    let progress = true;
+    while (progress && left.length) {
+      progress = false;
+      const retry = [];
+      for (const { entry } of left) {
+        const reason = this._refusal(entry.grant);
+        if (!reason) { this._keep(entry.grant, entry.persisted); kept.push(entry.grant); progress = true; }
+        else if (CURABLE.has(reason)) retry.push({ entry, reason });
+        else refused.push({ entry, reason });
+      }
+      left = retry;
+    }
+    return { kept, refused, left };
+  }
+
+  /**
+   * Retry the pending set after a store: what is now rooted is stored (and released to the
+   * caller to relay), what can never be stored (a duplicate by now, a bad signature) is
+   * dropped, the rest keeps waiting in its arrival order.
+   * @private
+   */
+  _retryPending() {
+    if (this._pending.size === 0) return [];
+    const { kept, left } = this._settle([...this._pending.values()]);
+    this._pending.clear();
+    for (const { entry, reason } of left) { entry.reason = reason; this._pending.set(pendingKey(entry.grant), entry); }
+    return kept;
   }
 
   /**
@@ -200,14 +310,16 @@ class RoleGrantStore {
   }
 
   /**
-   * Reload the grant file through `record` — the same checks a frame gets. A rooted record
-   * can only be rooted by records before it in time, not necessarily before it in the file
-   * (0.13.16 kept unrooted records, some of which an anchor grant later rooted), so records
-   * refused for a reason a later record can cure (`unknown-grantor-key`: the key arrives
-   * vouched in a grant; `unrooted`: the grantor's own grant arrives) are retried until a
-   * pass adds nothing. What is left is skipped and counted, as is a record whose check
-   * fails in a way no reason names ('unverifiable'). Never throws: a file that cannot be
-   * read leaves the store with no grants and `loadReport().unreadable` saying why.
+   * Reload the grant file through the checks a frame gets. A rooted record can only be rooted
+   * by records before it in time, not necessarily before it in the file (0.13.16 kept unrooted
+   * records, some of which an anchor grant later rooted), so the file goes through the same
+   * fixpoint a store triggers (`_settle`): records refused for a curable reason are retried
+   * until a pass adds nothing. What is left is skipped and counted, as is a record whose check
+   * fails in a way no reason names ('unverifiable'); the curable ones left also wait in the
+   * pending set, as a record refused on receipt does, since their root may yet arrive (they
+   * are on disk already, so one that is rooted later is not written again). Never throws: a
+   * file that cannot be read leaves the store with no grants and `loadReport().unreadable`
+   * saying why.
    * @private
    */
   _load() {
@@ -222,34 +334,26 @@ class RoleGrantStore {
     }
     this._loading = true;
     try {
-      let pending = [];
+      const entries = [];
       for (const line of text.split('\n')) {
         if (!line.trim()) continue;
-        try { pending.push(JSON.parse(line)); } catch { skip('not-json'); }
-      }
-      const curable = new Set(['unknown-grantor-key', 'unrooted']);
-      let reasons = [];
-      let progress = true;
-      while (progress && pending.length) {
-        progress = false;
-        const retry = [];
-        reasons = [];
-        for (const g of pending) {
-          let r;
-          try { r = this.record(g); } catch { r = { stored: false, reason: 'unverifiable' }; }
-          if (r.stored) { report.loaded++; progress = true; }
-          else if (curable.has(r.reason)) { retry.push(g); reasons.push(r.reason); }
-          else skip(r.reason);
-        }
-        pending = retry;
+        try { entries.push({ grant: JSON.parse(line), persisted: true }); } catch { skip('not-json'); }
       }
-      for (const reason of reasons) skip(reason);
+      const { kept, refused, left } = this._settle(entries);
+      report.loaded = kept.length;
+      for (const { reason } of refused) skip(reason);
+      for (const { entry, reason } of left) { skip(reason); this._hold(entry.grant, true, reason); }
     } finally {
       this._loading = false;
     }
   }
 }
 
+/** The pending set's key: every field the signature covers, then the signature. */
+function pendingKey(g) {
+  return `${g.type}|${g.grantee}|${g.role || ''}|${g.grantedBy}|${g.grantedAt}|${g.granteeKey || ''}|${g.sig}`;
+}
+
 /** The fields a record must have, of the types it must have them, or it is not a record. */
 function malformed(g) {
   if (!g || typeof g !== 'object' || Array.isArray(g)) return true;
@@ -257,6 +361,7 @@ function malformed(g) {
   for (const f of ['grantee', 'grantedBy', 'sig']) if (typeof g[f] !== 'string' || !g[f]) return true;
   if (!Number.isFinite(g.grantedAt)) return true;
   if (g.granteeKey !== undefined && typeof g.granteeKey !== 'string') return true;
+  if (g.role !== undefined && typeof g.role !== 'string') return true;
   // A grant confers a rank above participant, or it confers nothing.
   return g.type === 'role-grant' && roleRank(g.role) < 1;
 }
diff --git a/tests/role-grant-pending.test.js b/tests/role-grant-pending.test.js
new file mode 100644
index 00000000..d30e421b
--- /dev/null
+++ b/tests/role-grant-pending.test.js
@@ -0,0 +1,161 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME before lib/config loads
+
+/**
+ * 0.13.17 review (R1). The hotfix keeps a role-grant only when it is rooted at the anchor, and
+ * refused the rest at receipt. Rooted is a property of the chain, not of arrival order: gossip can
+ * bring a grant, or a revoke, before the grant that roots its grantor, refused records were not
+ * relayed and there is no grant sync, so such a record was lost for good, and the node resolved
+ * different roles from 0.13.16 (which kept everything). A record refused for a curable reason
+ * (`unknown-grantor-key`, `unrooted`) now waits in a bounded in-memory pending set, never written
+ * and never relayed, and is stored, persisted and relayed once a stored record roots it.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const crypto = require('crypto');
+const fs = require('fs');
+const path = require('path');
+const { RoleGrantStore } = require('../lib/role-grant-store');
+const { SymNode } = require('../lib/node');
+const { NullDiscovery } = require('../lib/discovery');
+const { nodeDir } = require('../lib/config');
+const { signGrant } = require('../lib/core');
+
+function kp(nodeId) {
+  const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519');
+  return {
+    nodeId,
+    priv: privateKey.export({ format: 'der', type: 'pkcs8' }).subarray(16).toString('base64url'),
+    pub: publicKey.export({ format: 'der', type: 'spki' }).subarray(12).toString('base64url'),
+  };
+}
+const grant = (type, grantee, role, grantor, at, extra = {}) =>
+  signGrant({ type, grantee: grantee.nodeId, role, grantedBy: grantor.nodeId, grantedAt: at, ...extra }, grantor.priv);
+const uniq = (base) => `${base}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+const grantsFile = (name) => path.join(nodeDir(name), 'role-grants', 'role-grants.jsonl');
+const lines = (file) => (fs.existsSync(file) ? fs.readFileSync(file, 'utf8').split('\n').filter(Boolean) : []);
+
+describe('a grant or revoke that arrives before its root is not lost (R1)', () => {
+  const A = kp('anchor'), V = kp('val'), X = kp('x');
+  const t = Date.now();
+  const gAV = grant('role-grant', V, 'validator', A, t - 3000, { granteeKey: V.pub });
+  const gVX = grant('role-grant', X, 'validator', V, t - 2000, { granteeKey: X.pub });
+  const rVX = grant('role-revoke', X, undefined, V, t - 1000);
+  const store = (keys = new Map()) => new RoleGrantStore({ anchor: { nodeId: A.nodeId, publicKey: A.pub }, keys });
+
+  // The roles 0.13.16 resolved for each order (it kept every record, rooted or not).
+  for (const [order, role] of [
+    [['AV', 'VX'], 'validator'],
+    [['VX', 'AV'], 'validator'],          // the grant arrives first (grantor key unknown)
+    [['AV', 'VX', 'rVX'], 'participant'],
+    [['AV', 'rVX', 'VX'], 'participant'],
+    [['rVX', 'VX', 'AV'], 'participant'], // both before their root
+    [['VX', 'rVX', 'AV'], 'participant'],
+  ]) {
+    it(`grant case ${order.join(' → ')}: X ends ${role}, as in 0.13.16`, () => {
+      const s = store();
+      const recs = { AV: gAV, VX: gVX, rVX };
+      for (const k of order) s.record(recs[k]);
+      assert.strictEqual(s.resolveRole(X.nodeId, Date.now()), role);
+      assert.strictEqual(s.pendingSize(), 0, 'nothing is left waiting once the root is in');
+    });
+  }
+
+  it('revoke case: a revoke that arrives before the grant rooting its revoker still revokes', () => {
+    const gAX = grant('role-grant', X, 'validator', A, t - 5000);
+    const gAV2 = grant('role-grant', V, 'validator', A, t - 4000);
+    const s = store(new Map([[V.nodeId, V.pub]]));
+    assert.strictEqual(s.record(gAX).stored, true);
+    assert.deepStrictEqual(s.record(rVX), { stored: false, reason: 'unrooted' }, 'refused at receipt, as before');
+    assert.strictEqual(s.resolveRole(X.nodeId, Date.now()), 'validator', 'and no effect while it waits');
+    const r = s.record(gAV2);
+    assert.strictEqual(r.stored, true);
+    assert.deepStrictEqual(r.released, [rVX], 'the stored grant releases the revoke it roots');
+    assert.strictEqual(s.resolveRole(X.nodeId, Date.now()), 'participant', 'as 0.13.16 resolved it');
+  });
+
+  it('the pending set is bounded: the oldest is dropped first', () => {
+    const s = new RoleGrantStore({ anchor: { nodeId: A.nodeId, publicKey: A.pub }, keys: new Map(), maxPending: 3 });
+    const Ys = [0, 1, 2, 3, 4].map((i) => kp(`y${i}`));
+    const waiting = Ys.map((Y, i) => grant('role-grant', Y, 'validator', V, t - 2000 + i));
+    for (const g of waiting) assert.strictEqual(s.record(g).stored, false);
+    for (const g of waiting) s.record(g); // re-sending them changes nothing
+    const r = s.record(gAV);
+    assert.deepStrictEqual(Ys.map((Y) => s.resolveRole(Y.nodeId, Date.now())),
+      ['participant', 'participant', 'validator', 'validator', 'validator'], 'the newest three waited; the oldest two were dropped');
+    assert.deepStrictEqual(r.released.map((g) => g.grantee), ['y2', 'y3', 'y4']);
+    assert.strictEqual(s.pendingSize(), 0);
+  });
+
+  it('the default bound is 1024', () => {
+    const s = store();
+    for (let i = 0; i < 1100; i++) s.record({ type: 'role-grant', grantee: `g${i}`, role: 'validator', grantedBy: 'nobody', grantedAt: t, sig: `s${i}`, sigAlg: 'ed25519' });
+    assert.strictEqual(s.pendingSize(), 1024);
+  });
+
+  it('a forged copy sent ahead of the genuine record cannot displace it, and is dropped when its grantor is rooted', () => {
+    const s = store();
+    const forged = { ...gVX, granteeKey: kp('other').pub }; // same sig, a different signed field
+    s.record(forged);
+    s.record(gVX);
+    const r = s.record(gAV);
+    assert.strictEqual(s.resolveRole(X.nodeId, Date.now()), 'validator');
+    assert.deepStrictEqual(r.released, [gVX]);
+    assert.strictEqual(s.pendingSize(), 0, 'the forgery failed its signature check and is gone');
+  });
+});
+
+describe('nothing pending is written or relayed; a released record is persisted and relayed once (R1)', () => {
+  it('a node holds an early grant in memory, then writes and relays it when its root arrives', () => {
+    const name = uniq('rg-pending');
+    const A = kp('anchor'), V = kp('val'), X = kp('x'), relayer = kp('relayer');
+    const t = Date.now();
+    const gAV = grant('role-grant', V, 'validator', A, t - 3000, { granteeKey: V.pub });
+    const gVX = grant('role-grant', X, 'validator', V, t - 2000, { granteeKey: X.pub });
+    const boot = () => new SymNode({ name, silent: true, discovery: new NullDiscovery(), room: 'g', anchor: { nodeId: A.nodeId, publicKey: A.pub } });
+    let node = boot();
+    try {
+      const relayed = [];
+      node._gossipToRoster = (frame, except) => relayed.push({ sig: frame.grant.sig, except });
+      node._frameHandler.handle(relayer.nodeId, 'relayer', { type: 'handshake', nodeId: relayer.nodeId, name: 'relayer', publicKey: relayer.pub });
+      node._frameHandler.handle(relayer.nodeId, 'relayer', { type: 'role-grant', grant: gVX });
+      assert.deepStrictEqual(lines(grantsFile(name)), [], 'not written while it waits');
+      assert.deepStrictEqual(relayed, [], 'not relayed while it waits');
+      assert.strictEqual(node.resolveRole(X.nodeId), 'participant', 'and no effect');
+
+      node._frameHandler.handle(relayer.nodeId, 'relayer', { type: 'role-grant', grant: gAV });
+      assert.deepStrictEqual(relayed, [
+        { sig: gAV.sig, except: relayer.nodeId },
+        { sig: gVX.sig, except: undefined },
+      ], 'the root is relayed, then the record it released');
+      assert.deepStrictEqual(lines(grantsFile(name)).map((l) => JSON.parse(l).sig), [gAV.sig, gVX.sig], 'both persisted, root first');
+      assert.strictEqual(node.resolveRole(X.nodeId), 'validator');
+      assert.strictEqual(node._roleGrants.pendingSize(), 0);
+      node.stop();
+      node = boot();
+      assert.strictEqual(node.resolveRole(X.nodeId), 'validator', 'and both survive a restart');
+    } finally { node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+  });
+
+  it('a record a 0.13.16 file left unrooted waits too, and is not written again when it is rooted', () => {
+    const name = uniq('rg-pending-file');
+    const A = kp('anchor'), V = kp('val'), X = kp('x');
+    const t = Date.now();
+    const gAV = grant('role-grant', V, 'validator', A, t - 3000, { granteeKey: V.pub });
+    const gVX = grant('role-grant', X, 'validator', V, t - 2000, { granteeKey: X.pub });
+    fs.mkdirSync(path.dirname(grantsFile(name)), { recursive: true });
+    fs.writeFileSync(grantsFile(name), JSON.stringify(gVX) + '\n');
+    const node = new SymNode({ name, silent: true, discovery: new NullDiscovery(), room: 'g', anchor: { nodeId: A.nodeId, publicKey: A.pub } });
+    try {
+      assert.deepStrictEqual(node._roleGrants.loadReport().skipped, { 'unknown-grantor-key': 1 });
+      const relayed = [];
+      node._gossipToRoster = (frame) => relayed.push(frame.grant.sig);
+      node._frameHandler.handle('relayer', 'relayer', { type: 'role-grant', grant: gAV });
+      assert.strictEqual(node.resolveRole(X.nodeId), 'validator');
+      assert.deepStrictEqual(relayed, [gAV.sig, gVX.sig]);
+      assert.deepStrictEqual(lines(grantsFile(name)).map((l) => JSON.parse(l).sig), [gVX.sig, gAV.sig], 'the file already held it: only the root is appended');
+    } finally { node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+  });
+});

From 22ee82e3d690510b378f2ed965674eaae7e48531 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Fri, 2 Oct 2026 11:36:26 +0100
Subject: [PATCH 089/148] 0.13.17 security: peer JSON nests at most 128 levels;
 every message off the relay socket goes through the guard
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The relay measured a peer's payload with JSON.stringify before the frame reached the inbound
guard. Serialising recurses once per level, so a payload about 10,000 levels deep (24 KB, under
every size bound) threw a RangeError out of the socket callback: uncaughtException, and the
daemon exits on that. A relay-error's message was serialised the same way.

The design assumption that failed: a frame that parsed can be serialised again. It is now true
by construction: JSON a peer wrote is checked for nesting on its text, before parsing, wherever
it is parsed (a LAN frame, a relay message, the plaintext of an encrypted CMB), and anything
deeper than 128 levels is dropped unparsed, as malformed JSON is (core/json-depth.js). Whatever
parses can then be measured, relayed and persisted without overflowing the stack.

The relay's own frames (join notices, the peer list) carry what other parties wrote, so every
message off the relay socket is now taken inside the node's inbound guard (refused and counted,
never thrown); a relay-error is printed field by field, each only when it has the right type.
The payload's own size check stays (a §4.1 bound on the frame itself, which the raw envelope
bound does not give), now safe and inside the guard.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 lib/core/cmb-encrypted-frame.js |   6 +-
 lib/core/e2e-crypto.js          |   6 +-
 lib/core/json-depth.js          |  43 +++++++++
 lib/frame-parser.js             |  10 +-
 lib/node.js                     |   7 +-
 lib/relay.js                    | 157 ++++++++++++++++++++------------
 tests/relay-deep-frame.test.js  | 144 +++++++++++++++++++++++++++++
 7 files changed, 309 insertions(+), 64 deletions(-)
 create mode 100644 lib/core/json-depth.js
 create mode 100644 tests/relay-deep-frame.test.js

diff --git a/lib/core/cmb-encrypted-frame.js b/lib/core/cmb-encrypted-frame.js
index 520a145c..79fa9bf9 100644
--- a/lib/core/cmb-encrypted-frame.js
+++ b/lib/core/cmb-encrypted-frame.js
@@ -22,6 +22,7 @@
  */
 
 const { aeadAADv2, sealV2, openV2 } = require('./e2e-v2');
+const { MAX_FRAME_DEPTH, nestedTooDeep } = require('./json-depth');
 
 const FRAME_TYPE = 'cmb-encrypted';
 const PROTOCOL_VERSION = '2.0';
@@ -122,7 +123,10 @@ function openEncryptedFrame({ frame, trafficKey }) {
   });
   const nonce = nonceForSequence(frame.sequence);
   const plaintext = openV2(trafficKey, nonce, aad, Buffer.from(frame.sealed, 'base64url'));
-  const parsed = JSON.parse(plaintext.toString('utf8'));
+  const text = plaintext.toString('utf8');
+  // The peer wrote this JSON as surely as a cleartext frame, so it meets the same nesting bound.
+  if (nestedTooDeep(text)) throw new Error(`cmb-encrypted: plaintext nests deeper than ${MAX_FRAME_DEPTH} levels`);
+  const parsed = JSON.parse(text);
   const applicationBytes = (typeof parsed.applicationData === 'string')
     ? Buffer.from(parsed.applicationData, 'base64url') : null;
 
diff --git a/lib/core/e2e-crypto.js b/lib/core/e2e-crypto.js
index 2002657b..e1caba3b 100644
--- a/lib/core/e2e-crypto.js
+++ b/lib/core/e2e-crypto.js
@@ -17,6 +17,7 @@
  */
 
 const crypto = require('crypto');
+const { MAX_FRAME_DEPTH, nestedTooDeep } = require('./json-depth');
 
 /**
  * Generate an X25519 key pair for Diffie-Hellman key agreement.
@@ -101,7 +102,10 @@ function decryptCategories(ciphertext, nonce, sharedSecret) {
   decipher.setAuthTag(authTag);
 
   const decrypted = Buffer.concat([decipher.update(encryptedData), decipher.final()]);
-  return JSON.parse(decrypted.toString('utf8'));
+  const text = decrypted.toString('utf8');
+  // The peer wrote this JSON as surely as a cleartext frame, so it meets the same nesting bound.
+  if (nestedTooDeep(text)) throw new Error(`decrypted categories nest deeper than ${MAX_FRAME_DEPTH} levels`);
+  return JSON.parse(text);
 }
 
 module.exports = {
diff --git a/lib/core/json-depth.js b/lib/core/json-depth.js
new file mode 100644
index 00000000..a67ae4b9
--- /dev/null
+++ b/lib/core/json-depth.js
@@ -0,0 +1,43 @@
+'use strict';
+
+/**
+ * @module sym/core/json-depth
+ * @description The nesting bound on JSON a peer wrote, checked before it is parsed.
+ *
+ * @copyright 2026 SYM.BOT Ltd.
+ * @license Apache-2.0
+ */
+
+/**
+ * Maximum nesting of objects and arrays in JSON a peer wrote: a frame, or the plaintext of an
+ * encrypted one. A frame is parsed once at the door and then kept, relayed, persisted and handed
+ * to hosts, each of which serialises it again, and serialising recurses once per level: a frame
+ * some 10,000 levels deep (24 KB on the wire) parses but cannot be serialised, and threw a
+ * RangeError wherever that happened, outside any guard. No MMP frame nests anywhere near this
+ * deep, so a deeper one is not a frame and is dropped unparsed, as malformed JSON is.
+ */
+const MAX_FRAME_DEPTH = 128;
+
+/**
+ * Whether JSON text nests objects/arrays deeper than `max`. Scans the text (brackets inside
+ * strings do not count) without parsing it, so a frame too deep is never built.
+ * @param {string} text
+ * @param {number} [max=MAX_FRAME_DEPTH]
+ * @returns {boolean}
+ */
+function nestedTooDeep(text, max = MAX_FRAME_DEPTH) {
+  let depth = 0;
+  let inString = false;
+  for (let i = 0; i < text.length; i++) {
+    const c = text.charCodeAt(i);
+    if (inString) {
+      if (c === 0x5c) i++;                 // backslash: skip the escaped character
+      else if (c === 0x22) inString = false;
+    } else if (c === 0x22) inString = true;
+    else if (c === 0x7b || c === 0x5b) { if (++depth > max) return true; }
+    else if (c === 0x7d || c === 0x5d) depth--;
+  }
+  return false;
+}
+
+module.exports = { MAX_FRAME_DEPTH, nestedTooDeep };
diff --git a/lib/frame-parser.js b/lib/frame-parser.js
index 93f6a6eb..9b6bc0ca 100644
--- a/lib/frame-parser.js
+++ b/lib/frame-parser.js
@@ -12,6 +12,7 @@
  */
 
 const { EventEmitter } = require('events');
+const { MAX_FRAME_DEPTH, nestedTooDeep } = require('./core/json-depth');
 
 /** Maximum frame payload size (1 MiB). */
 const MAX_FRAME_SIZE = 1024 * 1024;
@@ -67,7 +68,12 @@ class FrameParser extends EventEmitter {
         this.frameLength = 0;
         let msg;
         try {
-          msg = JSON.parse(utf8.decode(payload));
+          const text = utf8.decode(payload);
+          if (nestedTooDeep(text)) {
+            this.emit('error', new Error(`Frame dropped: nested deeper than ${MAX_FRAME_DEPTH} levels`));
+            continue;
+          }
+          msg = JSON.parse(text);
         } catch (e) {
           this.emit('error', new Error(`Invalid JSON: ${e.message}`));
           continue;
@@ -102,4 +108,4 @@ function sendFrame(socket, msg) {
   } catch { return false; }
 }
 
-module.exports = { FrameParser, sendFrame, MAX_FRAME_SIZE };
+module.exports = { FrameParser, sendFrame, MAX_FRAME_SIZE, MAX_FRAME_DEPTH, nestedTooDeep };
diff --git a/lib/node.js b/lib/node.js
index 4172e18c..b356ebc5 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -518,6 +518,9 @@ class SymNode extends EventEmitter {
       createPeer: (transport, peerId, peerName, isOutbound, source) => this._createPeer(transport, peerId, peerName, isOutbound, source),
       addPeer: (peer) => this._addPeer(peer),
       handlePeerMessage: (peerId, peerName, msg) => this._receiveFrame(peerId, peerName, msg, 'relay'),
+      // The relay's own frames (join notices, the peer list) carry what other parties wrote too:
+      // they are taken under the same guard as a peer's frame, refused and counted, never thrown.
+      guard: (frame, take) => this._guardInbound('relay', 'relay', frame, 'relay', take),
       onPeerLeft: (peerId, peerName) => { this._metrics.peersLeft++; this.emit('peer-left', { id: peerId, name: peerName }); this.emit('metric', { type: 'peer-left', name: peerName }); },
       onIdentityCollision: (info) => {
         // Surface the collision as an event so hosts can take action.
@@ -2676,7 +2679,9 @@ class SymNode extends EventEmitter {
    * A relay frame is also offered raw to hosted agents before evaluation ('frame-received',
    * MMP §4.3.2), as before — inside the guard, since a host's listener can throw too. The
    * handshake that opens an inbound LAN connection is taken through the same guard (see
-   * 'inbound-connection' in start()).
+   * 'inbound-connection' in start()), and so is every message off the relay socket, the
+   * relay's own frames included (see the relay's `guard` in the constructor): nothing a peer
+   * wrote is read outside it.
    * @returns {boolean} true if the frame was handled, false if it was refused
    * @private
    */
diff --git a/lib/relay.js b/lib/relay.js
index 8410895b..a2a34524 100644
--- a/lib/relay.js
+++ b/lib/relay.js
@@ -11,6 +11,7 @@
 
 const { RelayPeerTransport } = require('./transport');
 const { MAX_FRAME_SIZE } = require('./frame-parser');
+const { nestedTooDeep } = require('./core/json-depth');
 const { wireNodeId, wireName, wireWakeChannel } = require('./wire-identity');
 const RELAY_ENVELOPE_ALLOWANCE = 4096;
 const ENGINE_VERSION = require('../package.json').version;
@@ -29,6 +30,10 @@ class RelayConnection {
    * @param {function} opts.createPeer         — (transport, peerId, peerName, isOutbound, source) => peer
    * @param {function} opts.addPeer            — (peer) => void
    * @param {function} opts.handlePeerMessage  — (peerId, peerName, msg) => void
+   * @param {function} [opts.guard]            — (frame, take) => boolean: runs `take` for one
+   *                   message off the relay socket so that nothing it does can throw out of the
+   *                   socket's callback (the node passes its inbound guard, which refuses and
+   *                   counts); without it, a throw is caught and logged here.
    * @param {function} opts.onPeerLeft         — (peerId, peerName) => void — emit peer-left event
    * @param {string}   opts.nodeName           — this node's name
    * @param {Map}      opts.peerWakeChannels   — shared peer wake channels Map
@@ -59,6 +64,12 @@ class RelayConnection {
     this._createPeer = opts.createPeer;
     this._addPeer = opts.addPeer;
     this._handlePeerMessage = opts.handlePeerMessage;
+    this._guard = typeof opts.guard === 'function' ? opts.guard : (frame, take) => {
+      try { take(); return true; } catch (err) {
+        try { this._log(`Relay message refused: ${err && typeof err.message === 'string' ? err.message.slice(0, 200) : 'unknown error'}`); } catch { /* never the failure */ }
+        return false;
+      }
+    };
     this._onPeerLeft = opts.onPeerLeft;
     this._onIdentityCollision = opts.onIdentityCollision || null;
     this._onAuthRefused = opts.onAuthRefused || null;
@@ -253,70 +264,24 @@ class RelayConnection {
         this._log(`Relay message dropped: ${data.length} bytes exceeds the frame bound`);
         return;
       }
+      // Nesting is bounded before parsing (core/json-depth.js): a message nested deeper is not a
+      // frame and is dropped unparsed, as malformed JSON is. Until 0.13.17 a payload some 10,000
+      // levels deep (24 KB on the wire) parsed, and serialising it to measure it, below, recursed
+      // once per level and threw a RangeError out of this callback, which is uncaught.
       let msg;
-      try { msg = JSON.parse(data.toString()); } catch { return; }
+      try {
+        const text = data.toString();
+        if (nestedTooDeep(text)) return;
+        msg = JSON.parse(text);
+      } catch { return; }
       // MMP §4.1: a frame without a string `type` is silently discarded. Relay
       // envelopes carry `from` + `payload` instead, so accept those as well.
       if (!msg || typeof msg !== 'object') return;
       this._lastRelayMessage = Date.now();
-
-      // A peer's nodeId and name reach us here as the JOINER put them in its relay-auth (the relay
-      // forwards them as given), so they are taken as what they must be before anything keeps or
-      // prints them (see wire-identity.js): a peer that cannot be named by a string is not added.
-      if (msg.type === 'relay-peer-joined') {
-        const id = wireNodeId(msg.nodeId);
-        if (id) this._handleRelayPeerJoined(id, wireName(msg.name));
-      } else if (msg.type === 'relay-peer-left') {
-        const id = wireNodeId(msg.nodeId);
-        if (id) this._handleRelayPeerLeft(id, wireName(msg.name));
-      } else if (msg.type === 'relay-peers') {
-        // The peer list is sent only after a successful relay-auth: a refusal episode ends here.
-        this._authRefused = false;
-        this._refused = null;
-        this._attempts = 0;
-        this._setPhase('connected');
-        // The relay re-sends its whole list on every connect: only a channel that changed is set
-        // and saved, with one line for the list (it logged a line per peer on every connect).
-        let learned = 0;
-        for (const p of (Array.isArray(msg.peers) ? msg.peers : [])) {
-          const id = p && typeof p === 'object' ? wireNodeId(p.nodeId) : null;
-          if (!id) continue;
-          const ch = wireWakeChannel(p.wakeChannel);
-          if (ch && ch.platform !== 'none') {
-            const prev = this._peerWakeChannels.get(id);
-            if (!(prev && prev.platform === ch.platform && prev.token === ch.token && prev.environment === ch.environment)) {
-              this._peerWakeChannels.set(id, ch);
-              learned++;
-            }
-          }
-          if (!p.offline) {
-            this._handleRelayPeerJoined(id, wireName(p.name));
-          }
-        }
-        if (learned > 0) {
-          this._log(`Relay: learned ${learned} wake channel(s)`);
-          this._saveWakeChannels();
-        }
-      } else if (msg.type === 'relay-ping') {
-        ws.send(JSON.stringify({ type: 'relay-pong' }));
-      } else if (msg.type === 'relay-reauth') {
-        // Server lost our registration (e.g. relay restarted while TCP survived).
-        // Re-send auth to re-register without dropping the connection.
-        this._log('Relay requested re-auth — re-sending identity');
-        ws.send(JSON.stringify(this._authFrame()));
-      } else if (msg.type === 'relay-error') {
-        this._log(`Relay error: ${String(typeof msg.message === 'string' ? msg.message : JSON.stringify(msg.message)).slice(0, 500)}`);
-      } else if (wireNodeId(msg.from) && msg.payload && typeof msg.payload === 'object'
-                 && typeof msg.payload.type === 'string') {
-        if (Buffer.byteLength(JSON.stringify(msg.payload), 'utf8') > MAX_FRAME_SIZE) {
-          this._log(`Relay frame from ${String(msg.from).slice(0, 8)} dropped: payload exceeds MAX_FRAME_SIZE`);
-          return;
-        }
-        const peers = this._getPeers();
-        const peer = peers.get(msg.from);
-        if (peer) peer.lastSeen = Date.now();
-        this._handlePeerMessage(msg.from, wireName(msg.fromName), msg.payload);
-      }
+      // Everything past this point reads what other parties wrote — a peer's frame, or a join
+      // notice and peer list carrying what each joiner put in its relay-auth — so all of it runs
+      // inside the inbound guard: a message this node cannot take is refused, never thrown.
+      this._guard(msg, () => this._takeRelayMessage(ws, msg));
     });
 
     ws.on('close', (code, reason) => {
@@ -392,6 +357,80 @@ class RelayConnection {
     });
   }
 
+  /**
+   * One parsed message off the relay socket (always called through the guard). The relay's own
+   * frames are taken field by field as what they must be; a peer's envelope hands its payload to
+   * the node's inbound dispatch as it is.
+   * @private
+   */
+  _takeRelayMessage(ws, msg) {
+    // A peer's nodeId and name reach us here as the JOINER put them in its relay-auth (the relay
+    // forwards them as given), so they are taken as what they must be before anything keeps or
+    // prints them (see wire-identity.js): a peer that cannot be named by a string is not added.
+    if (msg.type === 'relay-peer-joined') {
+      const id = wireNodeId(msg.nodeId);
+      if (id) this._handleRelayPeerJoined(id, wireName(msg.name));
+    } else if (msg.type === 'relay-peer-left') {
+      const id = wireNodeId(msg.nodeId);
+      if (id) this._handleRelayPeerLeft(id, wireName(msg.name));
+    } else if (msg.type === 'relay-peers') {
+      // The peer list is sent only after a successful relay-auth: a refusal episode ends here.
+      this._authRefused = false;
+      this._refused = null;
+      this._attempts = 0;
+      this._setPhase('connected');
+      // The relay re-sends its whole list on every connect: only a channel that changed is set
+      // and saved, with one line for the list (it logged a line per peer on every connect).
+      let learned = 0;
+      for (const p of (Array.isArray(msg.peers) ? msg.peers : [])) {
+        const id = p && typeof p === 'object' ? wireNodeId(p.nodeId) : null;
+        if (!id) continue;
+        const ch = wireWakeChannel(p.wakeChannel);
+        if (ch && ch.platform !== 'none') {
+          const prev = this._peerWakeChannels.get(id);
+          if (!(prev && prev.platform === ch.platform && prev.token === ch.token && prev.environment === ch.environment)) {
+            this._peerWakeChannels.set(id, ch);
+            learned++;
+          }
+        }
+        if (!p.offline) {
+          this._handleRelayPeerJoined(id, wireName(p.name));
+        }
+      }
+      if (learned > 0) {
+        this._log(`Relay: learned ${learned} wake channel(s)`);
+        this._saveWakeChannels();
+      }
+    } else if (msg.type === 'relay-ping') {
+      ws.send(JSON.stringify({ type: 'relay-pong' }));
+    } else if (msg.type === 'relay-reauth') {
+      // Server lost our registration (e.g. relay restarted while TCP survived).
+      // Re-send auth to re-register without dropping the connection.
+      this._log('Relay requested re-auth — re-sending identity');
+      ws.send(JSON.stringify(this._authFrame()));
+    } else if (msg.type === 'relay-error') {
+      // { kind, code, message } as sym-relay sends them; each is printed only when it is what it
+      // should be, and nothing else in the frame is turned into text.
+      const kind = typeof msg.kind === 'string' ? ` ${msg.kind.slice(0, 40)}` : '';
+      const code = Number.isInteger(msg.code) ? ` ${msg.code}` : '';
+      const text = typeof msg.message === 'string' ? msg.message.slice(0, 500) : '(no message)';
+      this._log(`Relay error${kind}${code}: ${text}`);
+    } else if (wireNodeId(msg.from) && msg.payload && typeof msg.payload === 'object'
+               && typeof msg.payload.type === 'string') {
+      // §4.1's bound is on the frame itself, the payload (the raw bound above also allows for the
+      // envelope). Measuring it serialises the payload, which cannot throw here: nesting was
+      // bounded before parsing, and this runs inside the guard.
+      if (Buffer.byteLength(JSON.stringify(msg.payload), 'utf8') > MAX_FRAME_SIZE) {
+        this._log(`Relay frame from ${msg.from.slice(0, 8)} dropped: payload exceeds MAX_FRAME_SIZE`);
+        return;
+      }
+      const peers = this._getPeers();
+      const peer = peers.get(msg.from);
+      if (peer) peer.lastSeen = Date.now();
+      this._handlePeerMessage(msg.from, wireName(msg.fromName), msg.payload);
+    }
+  }
+
   _handleRelayPeerJoined(peerId, peerName) {
     const identity = this._getIdentity();
     if (!peerId || peerId === identity.nodeId) return;
diff --git a/tests/relay-deep-frame.test.js b/tests/relay-deep-frame.test.js
new file mode 100644
index 00000000..41a9648d
--- /dev/null
+++ b/tests/relay-deep-frame.test.js
@@ -0,0 +1,144 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME before lib/config loads
+
+/**
+ * 0.13.17 review (R2). The relay measured a peer's payload by serialising it again,
+ * JSON.stringify(msg.payload), before the frame reached the inbound guard; serialising recurses once
+ * per level, so a payload some 10,000 levels deep (24 KB, under every size bound) threw a RangeError
+ * out of the socket callback: uncaughtException, and the daemon exits on that. A relay-error's
+ * `message` was serialised the same way. Now nesting has its own bound, checked on the text before
+ * parsing wherever peer JSON is parsed, so whatever parses can be serialised again (measured,
+ * relayed, persisted); a relay-error is printed field by field; and every message off the relay
+ * socket, the relay's own frames included, is taken inside the guard.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const crypto = require('crypto');
+const fs = require('fs');
+const { WebSocketServer } = require('ws');
+const { SymNode } = require('../lib/node');
+const { nodeDir } = require('../lib/config');
+const { FrameParser } = require('../lib/frame-parser');
+const { nestedTooDeep, MAX_FRAME_DEPTH } = require('../lib/core/json-depth');
+const { encryptCategories, decryptCategories } = require('../lib/core/e2e-crypto');
+
+const uniq = (base) => `${base}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+const until = async (cond, ms = 5000) => { for (let t = 0; t < ms && !cond(); t += 20) await new Promise((r) => setTimeout(r, 20)); };
+const deep = (d) => '['.repeat(d) + ']'.repeat(d);
+
+/** A relay that answers relay-auth with `messages` (raw strings), then a plain message frame. */
+async function withRelay(messages, fn) {
+  const uncaught = [];
+  const onUncaught = (err) => uncaught.push(String(err && err.message));
+  process.on('uncaughtException', onUncaught);
+  const wss = new WebSocketServer({ port: 0 });
+  wss.on('connection', (ws) => ws.on('message', (m) => {
+    if (JSON.parse(String(m)).type !== 'relay-auth') return;
+    for (const raw of messages) ws.send(raw);
+    ws.send(JSON.stringify({ from: 'e'.repeat(64), fromName: 'evil', payload: { type: 'message', content: 'after' } }));
+  }));
+  const name = uniq('deep-relay');
+  const lines = [];
+  const node = new SymNode({ name, silent: true, relayOnly: true, relay: `ws://127.0.0.1:${wss.address().port}`, relayToken: 'x'.repeat(40), room: 'g' });
+  const origLog = node._log.bind(node);
+  node._log = (l) => { lines.push(l); origLog(l); };
+  const seen = [];
+  node.on('message', (from, content) => seen.push(content));
+  try {
+    await node.start();
+    await until(() => seen.length >= 1);
+    await fn({ node, uncaught, seen, lines });
+  } finally {
+    process.removeListener('uncaughtException', onUncaught);
+    await node.stop();
+    await new Promise((r) => wss.close(() => r()));
+    fs.rmSync(nodeDir(name), { recursive: true, force: true });
+  }
+}
+
+describe('a deeply nested message off the relay cannot throw out of the socket (R2)', () => {
+  it('a peer payload 12,000 levels deep (24 KB) is dropped; nothing is uncaught and the next frame is delivered', async () => {
+    const raw = `{"from":"${'e'.repeat(64)}","fromName":"evil","payload":{"type":"message","content":"deep","a":${deep(12000)}}}`;
+    assert.ok(raw.length < 32 * 1024, 'well under every size bound');
+    await withRelay([raw], async ({ uncaught, seen, node }) => {
+      assert.deepStrictEqual(uncaught, [], 'nothing reached uncaughtException (0.13.16/17: RangeError from JSON.stringify)');
+      assert.deepStrictEqual(seen, ['after']);
+      assert.strictEqual(node.status().relayConnected, true);
+    });
+  });
+
+  it('a relay-error whose message is deep, an object or unprintable is said without it', async () => {
+    const msgs = [
+      `{"type":"relay-error","message":${deep(12000)}}`,
+      JSON.stringify({ type: 'relay-error', message: { toString: 1 } }),
+      JSON.stringify({ type: 'relay-error', kind: 'auth', code: 4003, message: 'Invalid token' }),
+    ];
+    await withRelay(msgs, async ({ uncaught, lines }) => {
+      assert.deepStrictEqual(uncaught, []);
+      const said = lines.filter((l) => /^Relay error/.test(l));
+      assert.deepStrictEqual(said, ['Relay error: (no message)', 'Relay error auth 4003: Invalid token']);
+    });
+  });
+});
+
+describe('the relay\'s own frames go through the guard (R2)', () => {
+  it('a host listener that throws on a relay join notice is refused and counted, not thrown out of the socket', async () => {
+    const uncaught = [];
+    const onUncaught = (err) => uncaught.push(String(err && err.message));
+    process.on('uncaughtException', onUncaught);
+    const wss = new WebSocketServer({ port: 0 });
+    wss.on('connection', (ws) => ws.on('message', (m) => {
+      if (JSON.parse(String(m)).type !== 'relay-auth') return;
+      ws.send(JSON.stringify({ type: 'relay-peer-joined', nodeId: 'j'.repeat(64), name: 'joiner' }));
+      ws.send(JSON.stringify({ from: 'e'.repeat(64), fromName: 'evil', payload: { type: 'message', content: 'after' } }));
+    }));
+    const name = uniq('deep-relay-join');
+    const node = new SymNode({ name, silent: true, relayOnly: true, relay: `ws://127.0.0.1:${wss.address().port}`, relayToken: 'x'.repeat(40), room: 'g' });
+    const seen = [];
+    node.on('peer-joined', () => { throw new Error('host listener failed'); });
+    node.on('message', (from, content) => seen.push(content));
+    try {
+      await node.start();
+      await until(() => seen.length >= 1);
+      assert.deepStrictEqual(uncaught, [], 'nothing reached uncaughtException');
+      assert.deepStrictEqual(seen, ['after'], 'the relay link keeps working');
+      assert.strictEqual(node.metrics().framesRefusedByType['relay-peer-joined'], 1);
+    } finally {
+      process.removeListener('uncaughtException', onUncaught);
+      await node.stop();
+      await new Promise((r) => wss.close(() => r()));
+      fs.rmSync(nodeDir(name), { recursive: true, force: true });
+    }
+  });
+});
+
+describe('nesting is bounded wherever peer JSON is parsed (R2)', () => {
+  it('the text scan counts brackets outside strings only', () => {
+    assert.strictEqual(nestedTooDeep(deep(MAX_FRAME_DEPTH)), false);
+    assert.strictEqual(nestedTooDeep(deep(MAX_FRAME_DEPTH + 1)), true);
+    assert.strictEqual(nestedTooDeep(JSON.stringify({ a: '['.repeat(1000), b: '\\"{{{{' + '{'.repeat(500) })), false);
+  });
+
+  it('LAN: the frame parser drops a frame nested too deep, unparsed, and reads the next one', () => {
+    const p = new FrameParser();
+    const got = [];
+    const errors = [];
+    p.on('message', (m) => got.push(m.type));
+    p.on('error', (e) => errors.push(e.message));
+    const frame = (text) => { const b = Buffer.from(text); const h = Buffer.alloc(4); h.writeUInt32BE(b.length); return Buffer.concat([h, b]); };
+    p.feed(Buffer.concat([frame(`{"type":"message","a":${deep(12000)}}`), frame('{"type":"ping"}')]));
+    assert.deepStrictEqual(got, ['ping']);
+    assert.match(errors[0], /nested deeper than 128/);
+  });
+
+  it('an encrypted CMB whose plaintext nests too deep is refused by decryption, as a bad one is', () => {
+    const secret = crypto.randomBytes(32);
+    let v = []; for (let i = 0; i < 200; i++) v = [v];
+    const { ciphertext, nonce } = encryptCategories({ focus: { text: 'x', v } }, secret);
+    assert.throws(() => decryptCategories(ciphertext, nonce, secret), /deeper than 128/);
+    const ok = encryptCategories({ focus: { text: 'x' } }, secret);
+    assert.deepStrictEqual(decryptCategories(ok.ciphertext, ok.nonce, secret), { focus: { text: 'x' } });
+  });
+});

From c8fb97468b5c38bf8151b0190adc333fec65250f Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Fri, 2 Oct 2026 11:36:40 +0100
Subject: [PATCH 090/148] 0.13.17 security: an IPC message is typed at the
 door; one line can no longer stop the daemon

A regression in this release's first build: the daemon's IPC catch named the failing request by
printing msg.type in a template, unchecked, so the line {"type":{"toString":1}} made the catch
itself throw, and the daemon exited (FATAL).

An IPC message is now taken like a wire frame: a JSON object with a non-empty string `type`, or
it is refused with an error reply and handled no further (a line that is not JSON gets one too).
Only then is anything in it printed, and a thrown value is printed only through its message.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 bin/sym-daemon.js             | 44 ++++++++++++++++-----
 tests/daemon-ipc-door.test.js | 73 +++++++++++++++++++++++++++++++++++
 2 files changed, 107 insertions(+), 10 deletions(-)
 create mode 100644 tests/daemon-ipc-door.test.js

diff --git a/bin/sym-daemon.js b/bin/sym-daemon.js
index 1d43e591..4ab27ce5 100755
--- a/bin/sym-daemon.js
+++ b/bin/sym-daemon.js
@@ -227,16 +227,7 @@ function startIPCServer() {
       while ((idx = buffer.indexOf('\n')) !== -1) {
         const line = buffer.slice(0, idx);
         buffer = buffer.slice(idx + 1);
-        if (line.trim()) {
-          let msg;
-          try { msg = JSON.parse(line); } catch (err) { log(`IPC parse error: ${err.message}`); continue; }
-          try {
-            handleIPCMessage(socketId, socket, msg);
-          } catch (err) {
-            log(`IPC ${msg && msg.type ? `'${msg.type}'` : 'message'} failed: ${err.message}`);
-            if (msg && msg.type) sendIPC(socket, { type: 'result', action: msg.type, error: err.message, code: err.code });
-          }
-        }
+        if (line.trim()) takeIPCLine(socketId, socket, line);
       }
     });
 
@@ -275,6 +266,39 @@ function startIPCServer() {
 
 const NO_INSIGHT_ENGINE = 'this node runs no insight engine';
 
+/** The text of a thrown value, without trusting it to print. */
+function errorText(err) {
+  return err && typeof err.message === 'string' ? err.message.slice(0, 500) : 'unknown error';
+}
+
+/**
+ * Take one IPC line. An IPC message is typed at the door, as a wire frame is: it is a JSON object
+ * whose `type` is a non-empty string, or it is refused with an error reply and handled no
+ * further. Only then is anything in it printed: the catch below names the message by its type,
+ * and in 0.13.17 as first built it printed `type` unchecked, so one line whose type was an object
+ * that cannot be turned into text made the catch itself throw, and the daemon exited (FATAL).
+ */
+function takeIPCLine(socketId, socket, line) {
+  let msg;
+  try { msg = JSON.parse(line); } catch (err) {
+    log(`IPC parse error: ${errorText(err)}`);
+    sendIPC(socket, { type: 'result', action: null, error: 'not JSON' });
+    return;
+  }
+  if (!msg || typeof msg !== 'object' || Array.isArray(msg) || typeof msg.type !== 'string' || !msg.type) {
+    log('IPC message refused: not an object with a string type');
+    sendIPC(socket, { type: 'result', action: null, error: 'an IPC message is a JSON object with a string type' });
+    return;
+  }
+  const type = msg.type.slice(0, 64);
+  try {
+    handleIPCMessage(socketId, socket, msg);
+  } catch (err) {
+    log(`IPC '${type}' failed: ${errorText(err)}`);
+    sendIPC(socket, { type: 'result', action: type, error: errorText(err), code: err && typeof err.code === 'string' ? err.code : undefined });
+  }
+}
+
 /**
  * Handle a single IPC message from a virtual node.
  * Routes to the appropriate SymNode method and sends result back.
diff --git a/tests/daemon-ipc-door.test.js b/tests/daemon-ipc-door.test.js
new file mode 100644
index 00000000..0c8eb89b
--- /dev/null
+++ b/tests/daemon-ipc-door.test.js
@@ -0,0 +1,73 @@
+'use strict';
+
+/**
+ * 0.13.17 review (R3), a regression in the hotfix itself. The hotfix made the daemon's IPC catch
+ * name the failing message by printing `msg.type` in a template, unchecked; an IPC line whose type
+ * is an object that cannot be turned into text ({"type":{"toString":1}}) made the catch throw,
+ * which is uncaught, and the daemon exited (FATAL). An IPC message is now typed at the door as a
+ * wire frame is: a JSON object with a string `type`, or it is refused with an error reply.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const net = require('net');
+const os = require('os');
+const path = require('path');
+const { spawn } = require('child_process');
+
+const until = async (cond, ms = 5000) => { for (let t = 0; t < ms && !cond(); t += 20) await new Promise((r) => setTimeout(r, 20)); };
+
+/** Send IPC lines on one connection and collect the reply lines until `want` have arrived. */
+function ipc(sock, lines, want) {
+  return new Promise((resolve, reject) => {
+    const replies = [];
+    let buf = '';
+    const c = net.createConnection(sock, () => { for (const l of lines) c.write(l + '\n'); });
+    c.on('data', (d) => {
+      buf += d;
+      let i;
+      while ((i = buf.indexOf('\n')) >= 0) { replies.push(JSON.parse(buf.slice(0, i))); buf = buf.slice(i + 1); }
+      if (replies.length >= want) { c.end(); resolve(replies); }
+    });
+    c.on('error', reject);
+    setTimeout(() => { c.destroy(); resolve(replies); }, 5000);
+  });
+}
+
+describe('an IPC message is typed at the door (R3)', () => {
+  it('a line whose type is not a string is refused with an error reply; the daemon stays up and answers the next one', async () => {
+    const home = fs.mkdtempSync(path.join(os.tmpdir(), 'sym-daemon-ipc-'));
+    const sock = path.join(home, 'd.sock');
+    const daemon = spawn(process.execPath, [path.join(__dirname, '..', 'bin', 'sym-daemon.js')], {
+      env: { ...process.env, HOME: home, USERPROFILE: home, SYM_STATE_DIR: path.join(home, '.sym'), SYM_SOCKET: sock,
+        SYM_NODE_NAME: 'daemon-ipc-test', SYM_ROOM: 'daemon-ipc-room', SYM_RELAY_ONLY: '1', SYM_RELAY_URL: '', SYM_RELAY_TOKEN: '' },
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    let out = '';
+    daemon.stdout.on('data', (b) => { out += b; });
+    daemon.stderr.on('data', (b) => { out += b; });
+    try {
+      await until(() => /sym-daemon ready/.test(out) || daemon.exitCode !== null, 15000);
+      assert.strictEqual(daemon.exitCode, null, `the daemon started; log:\n${out.slice(-1500)}`);
+      const replies = await ipc(sock, [
+        JSON.stringify({ type: { toString: 1 } }),
+        JSON.stringify({ type: 5 }),
+        JSON.stringify(['type']),
+        'not json',
+        JSON.stringify({ type: 'xmesh-context' }),
+      ], 5);
+      await new Promise((r) => setTimeout(r, 300));
+      assert.strictEqual(daemon.exitCode, null, `the daemon is still running; log:\n${out.slice(-1500)}`);
+      assert.doesNotMatch(out, /FATAL/);
+      assert.strictEqual(replies.length, 5, 'every line is answered');
+      for (const r of replies.slice(0, 3)) assert.match(String(r.error), /JSON object with a string type/);
+      assert.strictEqual(replies[3].error, 'not JSON');
+      assert.strictEqual(replies[4].action, 'xmesh-context', 'and a well-typed request after them is served');
+    } finally {
+      daemon.kill('SIGTERM');
+      await new Promise((r) => (daemon.exitCode !== null ? r() : daemon.once('exit', r)));
+      fs.rmSync(home, { recursive: true, force: true });
+    }
+  });
+});

From cd24996219dea53e25558016a6536928adc39abe Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Fri, 2 Oct 2026 11:36:56 +0100
Subject: [PATCH 091/148] 0.13.17 security: every store a peer feeds has one
 bound; per-peer state goes when the peer does

A room peer could make a node keep more and more:
- wake channels: peer-info had no total bound (20 frames kept 5,120 channels) and rewrote
  wake-channels.json on every frame. The table (WakeChannelTable) now holds at most 1,024
  channels, at most 512 taught by one peer for nodes other than itself, and a node's own channel
  always has room (it displaces the oldest gossiped one). The file is written at most once a
  second and on stop, and read back typed and within the same bound. A dropped channel takes its
  queued frames and cooldown with it.
- wakes: the daemon wakes every sleeping channel on every message and mood it relays, and a
  failed wake (every one, on a node without APNs keys) had no cooldown, so each message logged a
  line per channel. The cooldown now runs from the last attempt; at most 16 frames wait for one
  sleeping peer, oldest dropped first.
- per-peer maps (room verdicts, anchor debounce, E2E secrets and derived-key cache, identity
  keys, lifecycle roles) were never pruned. What each connection's handshake teaches again
  (lifecycle role, derived-key cache, an admit verdict) is forgotten when the peer leaves the
  table (_forgetPeer); a refusal verdict stays, since over the relay a refused peer keeps
  speaking. Every such map keeps at most 4,096 entries for peers not connected, oldest first
  (peer-state.js); a connected peer's entry is never dropped for room. The derived-key cache is
  one entry per peer (it grew by one per re-sent handshake), and a lifecycle role is one of the
  named roles or it is not kept (it was kept as any JSON value).
- the roster's conflict list: at most 256, each conflict kept once.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 lib/core/wake.js              | 152 ++++++++++++++++++++++--
 lib/frame-handler.js          |  29 +++--
 lib/node.js                   |  53 +++++++--
 lib/peer-state.js             |  46 ++++++++
 lib/relay.js                  |   5 +-
 lib/roster-keys.js            |  19 ++-
 tests/peer-fed-bounds.test.js | 214 ++++++++++++++++++++++++++++++++++
 7 files changed, 482 insertions(+), 36 deletions(-)
 create mode 100644 lib/peer-state.js
 create mode 100644 tests/peer-fed-bounds.test.js

diff --git a/lib/core/wake.js b/lib/core/wake.js
index a0c6c7da..7e8b0787 100644
--- a/lib/core/wake.js
+++ b/lib/core/wake.js
@@ -25,6 +25,108 @@ function ensureDir(dir) {
   if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
 }
 
+/** At most this many wake channels are held (and written to wake-channels.json). */
+const MAX_WAKE_CHANNELS = 1024;
+/** No one peer may teach more than this many channels for nodes other than itself: half the table. */
+const MAX_GOSSIPED_PER_ANNOUNCER = 512;
+/** Frames queued for one sleeping peer; the oldest is dropped first. */
+const MAX_PENDING_FRAMES_PER_PEER = 16;
+/** A save asked for is written at most this long after (the writes of a burst coalesce into one). */
+const WAKE_SAVE_DELAY_MS = 1000;
+/** The source of a channel read back from wake-channels.json (who taught it is not written). */
+const FROM_DISK = Symbol('wake-channel-from-disk');
+
+/**
+ * The wake channels a node holds — a Map (nodeId -> { platform, token, environment }) with a bound.
+ * Every channel is fed by peers: a peer's own (`wake-channel`, or the relay's list of its peers'
+ * registrations) or one a peer gossips for some other node (`peer-info`). Until 0.13.17 the table
+ * had no bound, so twenty `peer-info` frames from one peer kept 5,120 channels, every one written
+ * to disk and woken on every message. Now:
+ *   - at most `max` channels are held (1024);
+ *   - a peer may teach at most `maxPerAnnouncer` channels for nodes other than itself (512), so no
+ *     one peer can fill the table with gossip;
+ *   - a node's OWN channel always has room: when the table is full it displaces the oldest channel
+ *     that was gossiped (or read back from disk), so gossip cannot lock a node out of being woken.
+ *     A gossiped channel that finds the table full is not kept.
+ * `set(nodeId, ch, announcer)` takes the announcing peer as a third argument (absent, or the
+ * nodeId itself: the node's own channel); callers that need to know whether a channel was kept
+ * check `get(nodeId) === ch` after. Replacing a held channel is not limited here (which source may
+ * replace a phone's token is a separate question, open for 0.14.0). A channel dropped by `delete`,
+ * displacement or `clear` is reported to `onDrop(nodeId)`.
+ */
+class WakeChannelTable extends Map {
+  /**
+   * @param {object} [opts]
+   * @param {number} [opts.max=1024]
+   * @param {number} [opts.maxPerAnnouncer=512]
+   * @param {function(string): void} [opts.onDrop]
+   */
+  constructor(opts = {}) {
+    super();
+    this._max = opts.max || MAX_WAKE_CHANNELS;
+    this._maxPerAnnouncer = opts.maxPerAnnouncer || MAX_GOSSIPED_PER_ANNOUNCER;
+    this._onDrop = typeof opts.onDrop === 'function' ? opts.onDrop : null;
+    this._from = new Map();        // nodeId -> announcer (a peer id or FROM_DISK); absent: the node's own
+    this._perAnnouncer = new Map(); // announcer -> channels it taught that are held
+  }
+
+  set(nodeId, ch, announcer) {
+    const own = announcer === undefined || announcer === nodeId;
+    if (super.has(nodeId)) {
+      super.set(nodeId, ch);
+      if (own) this._unattribute(nodeId);
+      return this;
+    }
+    if (!own && announcer !== FROM_DISK && (this._perAnnouncer.get(announcer) || 0) >= this._maxPerAnnouncer) return this;
+    if (this.size >= this._max) {
+      if (!own) return this;
+      let displaced = null;
+      for (const id of this._from.keys()) { displaced = id; break; } // oldest gossiped or read from disk
+      if (displaced === null) return this;
+      this.delete(displaced);
+    }
+    super.set(nodeId, ch);
+    if (!own) {
+      this._from.set(nodeId, announcer);
+      if (announcer !== FROM_DISK) this._perAnnouncer.set(announcer, (this._perAnnouncer.get(announcer) || 0) + 1);
+    }
+    return this;
+  }
+
+  delete(nodeId) {
+    const had = super.delete(nodeId);
+    if (had) {
+      this._unattribute(nodeId);
+      if (this._onDrop) { try { this._onDrop(nodeId); } catch { /* never the failure */ } }
+    }
+    return had;
+  }
+
+  clear() {
+    for (const id of [...this.keys()]) this.delete(id);
+  }
+
+  /** @private */
+  _unattribute(nodeId) {
+    if (!this._from.has(nodeId)) return;
+    const a = this._from.get(nodeId);
+    this._from.delete(nodeId);
+    if (a === FROM_DISK) return;
+    const n = (this._perAnnouncer.get(a) || 0) - 1;
+    if (n > 0) this._perAnnouncer.set(a, n); else this._perAnnouncer.delete(a);
+  }
+}
+
+/** A channel read back from disk, taken as text (the file has no integrity of its own), or null. */
+function storedChannel(ch) {
+  if (!ch || typeof ch !== 'object') return null;
+  const { platform, token, environment } = ch;
+  if (typeof platform !== 'string' || !platform || platform.length > 32) return null;
+  if (typeof token !== 'string' || !token || token.length > 4096) return null;
+  if (environment != null && (typeof environment !== 'string' || environment.length > 64)) return null;
+  return { platform, token, environment: environment ?? undefined };
+}
+
 /**
  * Manages wake channel persistence and peer wake notifications.
  */
@@ -59,6 +161,7 @@ class WakeManager {
 
     this._apnsConfig = null;
     this._apnsKey = null;
+    this._saveTimer = null;
   }
 
   /**
@@ -70,10 +173,11 @@ class WakeManager {
     try {
       if (fs.existsSync(this._wakeChannelsFile)) {
         const data = JSON.parse(fs.readFileSync(this._wakeChannelsFile, 'utf8'));
-        for (const [id, ch] of Object.entries(data)) {
-          if (ch?.platform && ch?.token) {
-            this._peerWakeChannels.set(id, ch);
-          }
+        // Taken as a frame's channel is (0.13.16 wrote what peers sent, as sent), and held as
+        // gossip: who taught a channel is not written, so one read back gives way to a node's own.
+        for (const [id, raw] of Object.entries(data && typeof data === 'object' ? data : {})) {
+          const ch = storedChannel(raw);
+          if (id && id.length <= 256 && ch) this._peerWakeChannels.set(id, ch, FROM_DISK);
         }
         if (this._peerWakeChannels.size > 0) {
           this._log(`Loaded ${this._peerWakeChannels.size} wake channel(s) from disk`);
@@ -85,11 +189,27 @@ class WakeManager {
   }
 
   /**
-   * Persist peer wake channels to disk.
+   * Ask for the peer wake channels to be persisted. Coalesced: the file is written once, at most
+   * WAKE_SAVE_DELAY_MS later, however many saves a burst of frames asks for (each `peer-info` frame
+   * rewrote the whole file before 0.13.17). `flushWakeChannels()` writes a pending save now.
    *
    * @returns {void}
    */
   saveWakeChannels() {
+    if (this._saveTimer) return;
+    this._saveTimer = setTimeout(() => this.flushWakeChannels(), WAKE_SAVE_DELAY_MS);
+    if (this._saveTimer.unref) this._saveTimer.unref();
+  }
+
+  /**
+   * Write the peer wake channels to disk now, if a save is pending (the node calls this on stop).
+   *
+   * @returns {void}
+   */
+  flushWakeChannels() {
+    if (!this._saveTimer) return;
+    clearTimeout(this._saveTimer);
+    this._saveTimer = null;
     try {
       ensureDir(path.dirname(this._wakeChannelsFile));
       const data = Object.fromEntries(this._peerWakeChannels);
@@ -120,12 +240,15 @@ class WakeManager {
     const d = this._getMeshNode().couplingDecisions.get(peerId);
     if (d && d.decision === 'rejected') return false;
 
+    // The cooldown runs from the last ATTEMPT, not the last success: until 0.13.17 a wake that
+    // failed (a node without APNs keys fails every one) was tried again on the very next message,
+    // for every channel held, with a log line each time.
     const lastWake = this._peerLastWake.get(peerId) || 0;
     if (Date.now() - lastWake < this._wakeCooldownMs) return false;
+    this._peerLastWake.set(peerId, Date.now());
 
     try {
       await this._sendWake(wakeChannel, reason);
-      this._peerLastWake.set(peerId, Date.now());
       this._log(`Wake sent to ${peerId}: ${reason} via ${wakeChannel.platform}`);
       return true;
     } catch (err) {
@@ -151,7 +274,9 @@ class WakeManager {
 
   /**
    * Wake all sleeping peers with wake channels but no active transport.
-   * Queues the frame for delivery on reconnect.
+   * Queues the frame for delivery on reconnect: at most MAX_PENDING_FRAMES_PER_PEER per peer, the
+   * oldest dropped first (one frame object is shared by every queue it is in, so what is held is
+   * bounded by that many frames, for at most as many peers as the wake-channel table holds).
    *
    * @param {string} reason - Wake reason.
    * @param {object} [pendingFrame] - Frame to queue for delivery on reconnect.
@@ -162,10 +287,10 @@ class WakeManager {
     for (const [peerId] of this._peerWakeChannels) {
       if (!peers.has(peerId)) {
         if (pendingFrame) {
-          if (!this._pendingFrames.has(peerId)) {
-            this._pendingFrames.set(peerId, []);
-          }
-          this._pendingFrames.get(peerId).push(pendingFrame);
+          let queue = this._pendingFrames.get(peerId);
+          if (!queue) { queue = []; this._pendingFrames.set(peerId, queue); }
+          queue.push(pendingFrame);
+          if (queue.length > MAX_PENDING_FRAMES_PER_PEER) queue.splice(0, queue.length - MAX_PENDING_FRAMES_PER_PEER);
         }
 
         this.wakeIfNeeded(peerId, reason).catch(err => {
@@ -295,4 +420,7 @@ class WakeManager {
   }
 }
 
-module.exports = { WakeManager };
+module.exports = {
+  WakeManager, WakeChannelTable, FROM_DISK,
+  MAX_WAKE_CHANNELS, MAX_GOSSIPED_PER_ANNOUNCER, MAX_PENDING_FRAMES_PER_PEER, WAKE_SAVE_DELAY_MS,
+};
diff --git a/lib/frame-handler.js b/lib/frame-handler.js
index 66e9df84..e8665cd8 100644
--- a/lib/frame-handler.js
+++ b/lib/frame-handler.js
@@ -2,6 +2,10 @@
 
 const { recordKey, recordLineage, recordParents, recordCreatedBy, setRecordLineage } = require('./record');
 const { wireNodeId, wireWakeChannel } = require('./wire-identity');
+const { keepPeerState } = require('./peer-state');
+
+/** The lifecycle roles a handshake may declare (MMP §3.5); anything else is not kept. */
+const LIFECYCLE_ROLES = new Set(['participant', 'observer', 'validator', 'anchor']);
 
 /**
  * @module @sym-bot/sym/frame-handler
@@ -286,9 +290,11 @@ class FrameHandler {
     if (msg.publicKey && this._node._peerIdentityKeys) {
       this._node._pinPeerKey(peerId, msg.publicKey);
     }
-    // Section 3.5 + 6.4: store peer lifecycle role for validator-origin weight.
-    if (msg.lifecycleRole && this._node._peerLifecycleRoles) {
-      this._node._peerLifecycleRoles.set(peerId, msg.lifecycleRole);
+    // Section 3.5 + 6.4: store peer lifecycle role for validator-origin weight. A role is one of the
+    // named roles or it is not kept (it was kept as given, any JSON value, and returned as a role);
+    // bounded and forgotten when the peer leaves, like every per-peer map fed from the wire.
+    if (typeof msg.lifecycleRole === 'string' && LIFECYCLE_ROLES.has(msg.lifecycleRole) && this._node._peerLifecycleRoles) {
+      keepPeerState(this._node._peerLifecycleRoles, peerId, msg.lifecycleRole, this._node._peers);
     }
   }
 
@@ -1385,11 +1391,16 @@ class FrameHandler {
   _handleWakeChannel(peerId, peerName, msg) {
     // Taken as text before it is kept: in 0.13.16 a channel was stored and written to disk first and
     // printed after, so one whose platform could not be printed was persisted and then threw.
+    // The peer's OWN channel (announcer = itself), which always has room in the table; a repeat of
+    // the channel already held is not saved or logged again.
     const ch = wireWakeChannel(msg);
     if (!ch) return;
-    this._node._peerWakeChannels.set(peerId, ch);
+    const prev = this._node._peerWakeChannels.get(peerId);
+    if (prev && prev.platform === ch.platform && prev.token === ch.token && prev.environment === ch.environment) return;
+    this._node._peerWakeChannels.set(peerId, ch, peerId);
+    if (this._node._peerWakeChannels.get(peerId) !== ch) return;
     this._node._wakeManager.saveWakeChannels();
-    this._node._log(`Wake channel from ${peerName}: ${msg.platform}`);
+    this._node._log(`Wake channel from ${peerName}: ${ch.platform}`);
   }
 
   /**
@@ -1422,7 +1433,9 @@ class FrameHandler {
     // Every peer re-sends its whole list on every connect, so most entries are ones already held.
     // Logging every entry and rewriting the file on every frame filled the daemon's log (1 GB): only
     // a channel that changed is set, the file is written only then, and one line says how many.
-    // A room's list is short; a frame naming more than 256 is read for its first 256.
+    // A room's list is short; a frame naming more than 256 is read for its first 256. Each entry is
+    // learned as gossip from this peer (its own entry, as its own channel), so the table's bounds
+    // apply: no one peer fills it, and a full table keeps room for a node's own channel.
     let learned = 0;
     if (msg.peers.length > 256) this._node._log(`Gossip from ${peerName}: ${msg.peers.length} entries, reading the first 256`);
     for (const p of msg.peers.slice(0, 256)) {
@@ -1431,8 +1444,8 @@ class FrameHandler {
       if (!ch || id === this._node._identity.nodeId) continue;
       const prev = this._node._peerWakeChannels.get(id);
       if (prev && prev.platform === ch.platform && prev.token === ch.token && prev.environment === ch.environment) continue;
-      this._node._peerWakeChannels.set(id, ch);
-      learned++;
+      this._node._peerWakeChannels.set(id, ch, peerId);
+      if (this._node._peerWakeChannels.get(id) === ch) learned++;
     }
     if (learned === 0) return;
     this._node._log(`Gossip from ${peerName}: learned ${learned} wake channel(s)`);
diff --git a/lib/node.js b/lib/node.js
index b356ebc5..c135085e 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -30,12 +30,13 @@ const { AttestationStore, chainHash, isPosition } = require('./attestation-store
 const { RoleGrantStore } = require('./role-grant-store');
 const { RosterKeyRegistry } = require('./roster-keys');
 const { wireNodeId, wireName, wireKey } = require('./wire-identity');
+const { keepPeerState } = require('./peer-state');
 const { RoomOwnershipRegistry } = require('./room-ownership');
 const { verifyRoomGrant } = require('./core/room-grant');
 const { DecisionLog } = require('./decision-log');
 const {
   encode, DIM, createCMB, renderContent, FIELD_WEIGHT_PROFILES,
-  WakeManager,
+  WakeManager, WakeChannelTable,
   e2eGenerateKeyPair, e2eDeriveSharedSecret, encryptCategories,
   signCMB, assertionIdV2_0, mintRemixKey, signAttestation, verifyAttestation, verifyAttestationRole,
   merkleRoot, signCheckpoint, verifyCheckpoint, signWitness, verifyWitness,
@@ -160,7 +161,8 @@ class SymNode extends EventEmitter {
     // The attestation index is created after the node dir is known (below), so it can
     // persist + reload the durable audit trail.
 
-    // Track peer lifecycle roles from handshake (Section 6.4: validator-origin weight 2.0)
+    // Track peer lifecycle roles from handshake (Section 6.4: validator-origin weight 2.0).
+    // Like every per-peer map fed from the wire, bounded and pruned (see peer-state.js).
     this._peerLifecycleRoles = new Map();
 
     // SVAF parameters (paper Section 3.2-3.3)
@@ -267,6 +269,7 @@ class SymNode extends EventEmitter {
     // E2E encryption — X25519 keypair for CMB category encryption
     this._e2eKeyPair = this._loadOrCreateE2EKeyPair();
     this._peerSharedSecrets = new Map();
+    this._e2eDerivedKeys = new Map(); // peerId -> the peer key its shared secret was derived from
 
     // CMB authentication — peers' Ed25519 identity public keys (from handshake,
     // base64url). Used to verify the signature on every inbound signed CMB.
@@ -481,7 +484,10 @@ class SymNode extends EventEmitter {
 
     // Wake
     this._wakeChannel = opts.wakeChannel || null;
-    this._peerWakeChannels = new Map();
+    // Bounded (see WakeChannelTable): a channel dropped takes its queued frames and cooldown with it.
+    this._peerWakeChannels = new WakeChannelTable({
+      onDrop: (id) => { this._pendingFrames.delete(id); this._peerLastWake.delete(id); },
+    });
     this._peerLastWake = new Map();
     this._pendingFrames = new Map();
 
@@ -604,15 +610,16 @@ class SymNode extends EventEmitter {
    */
   _deriveAndStoreSecret(peerId, peerPublicKeyB64) {
     if (!wireNodeId(peerId) || !wireKey(peerPublicKeyB64)) return;
-    // Skip if we already have a shared secret for this peer+key combo
-    const cacheKey = `${peerId}:${peerPublicKeyB64}`;
-    if (this._e2eDerivedKeys && this._e2eDerivedKeys.has(cacheKey)) return;
+    // Skip if the secret held for this peer was derived from this key. One entry per peer (the key
+    // it was derived from): keyed by peer+key, as until 0.13.17, a link re-sending its handshake
+    // with a fresh key each time grew the cache by one entry per handshake.
+    if (!this._e2eDerivedKeys) this._e2eDerivedKeys = new Map();
+    if (this._e2eDerivedKeys.get(peerId) === peerPublicKeyB64) return;
     try {
       const peerPubKey = Buffer.from(peerPublicKeyB64, 'base64');
       const secret = e2eDeriveSharedSecret(this._e2eKeyPair.privateKey, peerPubKey);
-      this._peerSharedSecrets.set(peerId, secret);
-      if (!this._e2eDerivedKeys) this._e2eDerivedKeys = new Set();
-      this._e2eDerivedKeys.add(cacheKey);
+      keepPeerState(this._peerSharedSecrets, peerId, secret, this._peers);
+      keepPeerState(this._e2eDerivedKeys, peerId, peerPublicKeyB64, this._peers);
       this._log(`E2E shared secret derived for peer ${peerId.slice(0, 8)}`);
     } catch (err) {
       this._log(`E2E key derivation failed for peer ${peerId.slice(0, 8)}: ${err.message}`);
@@ -664,7 +671,7 @@ class SymNode extends EventEmitter {
     // A key is text or it is not a key: pinned as given, a JSON object here sat in the roster (and
     // its file) and failed every verification against it.
     if (!wireNodeId(nodeId) || !wireKey(keyB64url)) return;
-    this._peerIdentityKeys.set(nodeId, keyB64url);
+    keepPeerState(this._peerIdentityKeys, nodeId, keyB64url, this._peers);
     this._roster.pin(nodeId, keyB64url, 'handshake');
   }
 
@@ -1726,6 +1733,9 @@ class SymNode extends EventEmitter {
    * @returns {Promise<void>}
    */
   async stop() {
+    // A coalesced wake-channel save still pending is written now (its timer is unref'd and would
+    // not hold the process open), whether or not the node was started.
+    this._wakeManager.flushWakeChannels();
     if (!this._running) return;
     this._running = false;
 
@@ -2856,6 +2866,7 @@ class SymNode extends EventEmitter {
         if (existingPeer.transports.size === 0) {
           this._peers.delete(peerId);
           this._meshNode.removePeer(peerId);
+          this._forgetPeer(peerId);
           this._metrics.peersLeft++;
           this._log(`Peer disconnected: ${peerName} (all transports closed)`);
           this.emit('peer-left', { id: peerId, name: peerName });
@@ -2886,6 +2897,7 @@ class SymNode extends EventEmitter {
       if (transports.size === 0) {
         this._peers.delete(peerId);
         this._meshNode.removePeer(peerId);
+        this._forgetPeer(peerId);
         this._metrics.peersLeft++;
         this._log(`Peer disconnected: ${peerName} (all transports closed)`);
         this.emit('peer-left', { id: peerId, name: peerName });
@@ -2896,6 +2908,21 @@ class SymNode extends EventEmitter {
     return peer;
   }
 
+  /**
+   * A peer has left the peer table (its last transport closed): forget what was learned from its
+   * connection and is learned again on the next one — its declared lifecycle role, the key its
+   * shared secret was derived from (the next handshake re-derives it), an ADMIT verdict. A refusal
+   * verdict is kept (see peer-state.js), as are its shared secret and identity key, which bridge a
+   * reconnect, within their bound.
+   * @private
+   */
+  _forgetPeer(peerId) {
+    this._peerLifecycleRoles.delete(peerId);
+    if (this._e2eDerivedKeys) this._e2eDerivedKeys.delete(peerId);
+    const v = this._roomVerdicts && this._roomVerdicts.get(peerId);
+    if (v && v.admit) this._roomVerdicts.delete(peerId);
+  }
+
   /**
    * Select the highest-priority healthy transport for a peer.
    * Priority: bonjour (LAN) > relay (WAN).
@@ -3007,8 +3034,10 @@ class SymNode extends EventEmitter {
     // REMEMBER THE VERDICT. The decision was reachable only at handshake time, so every frame
     // that arrived without one was dispatched on trust. Recording it here gives `_roomDoor`
     // something to consult per frame, which is what makes the door more than a greeting.
+    // Bounded like every per-peer map fed from the wire (see peer-state.js); an admit verdict is
+    // forgotten when the peer leaves (_forgetPeer), a refusal is kept while there is room.
     if (!this._roomVerdicts) this._roomVerdicts = new Map();
-    this._roomVerdicts.set(peerId, { admit: verdict.admit, reason: verdict.reason || null, at: Date.now() });
+    keepPeerState(this._roomVerdicts, peerId, { admit: verdict.admit, reason: verdict.reason || null, at: Date.now() }, this._peers);
     return verdict;
   }
 
@@ -3131,7 +3160,7 @@ class SymNode extends EventEmitter {
     if (now - lastSent < 60000) {
       this._log(`Skipping anchor CMBs for ${peer.name} (reconnected within 60s)`);
     } else {
-      this._lastAnchorSent.set(peer.peerId, now);
+      keepPeerState(this._lastAnchorSent, peer.peerId, now, this._peers);
 
       // Send recent CMB anchors — enables the "Ask the Mesh" pattern.
       // New peers need context to respond relevantly. Without this,
diff --git a/lib/peer-state.js b/lib/peer-state.js
new file mode 100644
index 00000000..3cb74730
--- /dev/null
+++ b/lib/peer-state.js
@@ -0,0 +1,46 @@
+'use strict';
+
+/**
+ * @module @sym-bot/sym/peer-state
+ * @description The bound on what a node keeps per peer from the wire.
+ *
+ * A node keeps small facts per peer, learned from what the peer sent: its room-admission verdict,
+ * its E2E shared secret and the key it was derived from, its identity key, its declared lifecycle
+ * role, when anchors were last sent to it. Each is keyed by the peerId the frame came with, and
+ * until 0.13.17 none was ever pruned or bounded, so a peer (or a relay) presenting new peerIds, or
+ * one link re-sending its handshake with new keys, grew them without limit. Two rules now:
+ *   - what is learned from a connection's handshake and is learned again on the next one (the
+ *     lifecycle role, the derived-key cache, an ADMIT verdict) is forgotten when the peer leaves
+ *     the peer table (SymNode#_forgetPeer). A REFUSAL verdict is kept: it is what shuts a refused
+ *     peer that keeps speaking (over the relay, a peer is not disconnected by being refused);
+ *   - every such map is bounded (`keepPeerState`): past MAX_PEER_STATE entries, the oldest entries
+ *     for peers NOT in the peer table are dropped first. A connected peer's entry is never dropped
+ *     for room (dropping its shared secret would downgrade its CMBs to cleartext on LAN), so a map
+ *     holds at most MAX_PEER_STATE entries plus one per connected peer.
+ *
+ * @copyright 2026 SYM.BOT. Apache 2.0 License.
+ */
+
+const MAX_PEER_STATE = 4096;
+
+/**
+ * Set `map[peerId] = value` as the newest entry, then trim the map to `max`, dropping the oldest
+ * entries whose peer is not live (never `peerId` itself).
+ * @param {Map} map
+ * @param {string} peerId
+ * @param {*} value
+ * @param {{has: function(string): boolean}} [livePeers] the peer table; absent: none is live
+ * @param {number} [max=MAX_PEER_STATE]
+ */
+function keepPeerState(map, peerId, value, livePeers, max = MAX_PEER_STATE) {
+  map.delete(peerId);
+  map.set(peerId, value);
+  if (map.size <= max) return;
+  for (const id of map.keys()) {
+    if (map.size <= max) break;
+    if (id === peerId || (livePeers && livePeers.has(id))) continue;
+    map.delete(id);
+  }
+}
+
+module.exports = { keepPeerState, MAX_PEER_STATE };
diff --git a/lib/relay.js b/lib/relay.js
index a2a34524..3489995c 100644
--- a/lib/relay.js
+++ b/lib/relay.js
@@ -381,6 +381,7 @@ class RelayConnection {
       this._setPhase('connected');
       // The relay re-sends its whole list on every connect: only a channel that changed is set
       // and saved, with one line for the list (it logged a line per peer on every connect).
+      // Each entry is that peer's own registration, so it is learned as the peer's own channel.
       let learned = 0;
       for (const p of (Array.isArray(msg.peers) ? msg.peers : [])) {
         const id = p && typeof p === 'object' ? wireNodeId(p.nodeId) : null;
@@ -389,8 +390,8 @@ class RelayConnection {
         if (ch && ch.platform !== 'none') {
           const prev = this._peerWakeChannels.get(id);
           if (!(prev && prev.platform === ch.platform && prev.token === ch.token && prev.environment === ch.environment)) {
-            this._peerWakeChannels.set(id, ch);
-            learned++;
+            this._peerWakeChannels.set(id, ch, id);
+            if (this._peerWakeChannels.get(id) === ch) learned++;
           }
         }
         if (!p.offline) {
diff --git a/lib/roster-keys.js b/lib/roster-keys.js
index 147c3a18..130acaa0 100644
--- a/lib/roster-keys.js
+++ b/lib/roster-keys.js
@@ -32,6 +32,8 @@ const fs = require('fs');
 const path = require('path');
 
 const KEYS_FILE = 'roster-keys.jsonl';
+/** Conflicts kept as evidence; a repeat of one already kept is not added again, and the oldest goes first. */
+const MAX_CONFLICTS = 256;
 const SOURCE_RANK = Object.freeze({ grant: 0, handshake: 1, anchor: 2 });
 function sourceRank(s) { return SOURCE_RANK[s] ?? 0; }
 
@@ -78,7 +80,7 @@ class RosterKeyRegistry {
         return { pinned: true };
       }
       if (sourceRank(source) <= sourceRank(existing.source)) {
-        this._conflicts.push({ nodeId, had: existing.key, got: keyB64url, source, at: existing.at });
+        this._noteConflict({ nodeId, had: existing.key, got: keyB64url, source, at: existing.at });
         return { pinned: false, reason: 'conflict' };
       }
       // strictly stronger source overrides a weaker binding (e.g. a direct handshake
@@ -90,6 +92,19 @@ class RosterKeyRegistry {
     return { pinned: true };
   }
 
+  /**
+   * Keep a refused rebinding as evidence. Peer-fed (every handshake that names a held nodeId with
+   * another key is one), so bounded: an identical conflict already kept is not kept twice, and past
+   * MAX_CONFLICTS the oldest is dropped — until 0.13.17 one link re-sending its handshake with a
+   * new key each time added one entry per handshake, without limit.
+   * @private
+   */
+  _noteConflict(c) {
+    if (this._conflicts.some((x) => x.nodeId === c.nodeId && x.got === c.got && x.source === c.source)) return;
+    if (this._conflicts.length >= MAX_CONFLICTS) this._conflicts.shift();
+    this._conflicts.push(c);
+  }
+
   /** Map-compatible read: the pinned public key for a nodeId, or undefined. */
   get(nodeId) { return this._byNode.get(nodeId)?.key; }
 
@@ -123,4 +138,4 @@ class RosterKeyRegistry {
   }
 }
 
-module.exports = { RosterKeyRegistry, SOURCE_RANK };
+module.exports = { RosterKeyRegistry, SOURCE_RANK, MAX_CONFLICTS };
diff --git a/tests/peer-fed-bounds.test.js b/tests/peer-fed-bounds.test.js
new file mode 100644
index 00000000..fe99fc8f
--- /dev/null
+++ b/tests/peer-fed-bounds.test.js
@@ -0,0 +1,214 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME before lib/config loads
+
+/**
+ * 0.13.17 review (R4). A room peer could grow what a node keeps without limit:
+ *   - wake channels: `peer-info` had no total bound, so 20 frames of 256 fresh nodeIds kept 5,120
+ *     channels, and wake-channels.json was rewritten whole on every frame;
+ *   - wakes: every message and mood the daemon relays wakes every stored channel; a failed wake
+ *     (every one, on a node without APNs keys) had no cooldown, so each message queued a frame and
+ *     logged a line per channel, and the queues were unbounded;
+ *   - per-peer maps never pruned: room verdicts, anchor debounce, the E2E derived-key cache (one
+ *     entry per handshake on one link), declared lifecycle roles (kept as any JSON value), and the
+ *     roster's conflict list (one entry per re-sent handshake with a new key).
+ * Each peer-fed store now has one bound, and per-peer state goes when the peer does.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const crypto = require('crypto');
+const fs = require('fs');
+const path = require('path');
+const { EventEmitter } = require('events');
+const { SymNode } = require('../lib/node');
+const { NullDiscovery } = require('../lib/discovery');
+const { nodeDir } = require('../lib/config');
+const { WakeChannelTable, MAX_WAKE_CHANNELS, MAX_GOSSIPED_PER_ANNOUNCER, MAX_PENDING_FRAMES_PER_PEER } = require('../lib/core/wake');
+const { keepPeerState, MAX_PEER_STATE } = require('../lib/peer-state');
+const { RosterKeyRegistry, MAX_CONFLICTS } = require('../lib/roster-keys');
+
+const uniq = (base) => `${base}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+const ch = (token) => ({ platform: 'apns', token });
+const gossip = (f, n = 256) => ({ type: 'peer-info', peers: Array.from({ length: n }, (_, i) => ({ nodeId: `fake-${f}-${i}`, wakeChannel: ch('t'.repeat(64)) })) });
+
+function boot(name, extra = {}) {
+  return new SymNode({ name, silent: true, discovery: new NullDiscovery(), room: 'g', ...extra });
+}
+
+describe('wake channels have one bound (R4)', () => {
+  it('twenty peer-info frames from one peer keep at most half the table, not 5,120', () => {
+    const name = uniq('bound-wake');
+    const node = boot(name);
+    try {
+      for (let f = 0; f < 20; f++) node._receiveFrame('evil', 'evil', gossip(f), 'relay');
+      assert.strictEqual(node._peerWakeChannels.size, MAX_GOSSIPED_PER_ANNOUNCER);
+      for (const a of ['e2', 'e3', 'e4']) for (let f = 0; f < 4; f++) node._receiveFrame(a, a, gossip(`${a}-${f}`), 'relay');
+      assert.strictEqual(node._peerWakeChannels.size, MAX_WAKE_CHANNELS, 'and never more than the table in all');
+    } finally { node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+  });
+
+  it('a full table still takes a node\'s own channel, displacing the oldest gossiped one', () => {
+    const t = new WakeChannelTable({ max: 3, maxPerAnnouncer: 2 });
+    t.set('a', ch('1'), 'p');
+    t.set('b', ch('2'), 'p');
+    t.set('c', ch('3'), 'p');
+    assert.deepStrictEqual([...t.keys()], ['a', 'b'], 'one announcer teaches at most its share');
+    t.set('c', ch('3'), 'q');
+    t.set('d', ch('4'), 'q');
+    assert.deepStrictEqual([...t.keys()], ['a', 'b', 'c'], 'gossip finding the table full is not kept');
+    t.set('me', ch('5'), 'me');
+    assert.deepStrictEqual([...t.keys()], ['b', 'c', 'me'], 'a node\'s own channel displaces the oldest gossiped');
+    t.set('me2', ch('6'));
+    t.set('me3', ch('7'));
+    t.set('me4', ch('8'));
+    assert.deepStrictEqual([...t.keys()], ['me', 'me2', 'me3'], 'and when only own channels are left, a new one is not kept');
+    t.set('d', ch('4'), 'p');
+    assert.strictEqual(t.has('d'), false);
+  });
+
+  it('a dropped channel takes its queued frames and its cooldown with it', () => {
+    const name = uniq('bound-wake-drop');
+    const node = boot(name);
+    try {
+      node._peerWakeChannels.set('phone', ch('t'), 'gossiper');
+      node._pendingFrames.set('phone', [{ type: 'message' }]);
+      node._peerLastWake.set('phone', Date.now());
+      node._peerWakeChannels.delete('phone');
+      assert.strictEqual(node._pendingFrames.has('phone'), false);
+      assert.strictEqual(node._peerLastWake.has('phone'), false);
+    } finally { node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+  });
+
+  it('wake-channels.json is written once for a burst of frames, not once per frame', () => {
+    const name = uniq('bound-wake-file');
+    const node = boot(name);
+    const file = path.join(nodeDir(name), 'wake-channels.json');
+    const write = fs.writeFileSync;
+    let writes = 0;
+    fs.writeFileSync = function (p, ...rest) { if (p === file) writes++; return write.call(this, p, ...rest); };
+    try {
+      for (let f = 0; f < 20; f++) node._receiveFrame(`p${f}`, `p${f}`, gossip(f, 10), 'relay');
+      assert.strictEqual(writes, 0, 'nothing yet: the saves coalesce');
+      node.stop();
+      assert.strictEqual(writes, 1, 'one write, made when the node stops (or a second after the burst)');
+      assert.strictEqual(Object.keys(JSON.parse(fs.readFileSync(file, 'utf8'))).length, 200);
+    } finally { fs.writeFileSync = write; node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+  });
+
+  it('channels read back from disk are typed and bounded, and give way to a node\'s own', () => {
+    const name = uniq('bound-wake-load');
+    fs.mkdirSync(nodeDir(name), { recursive: true });
+    const data = { bad1: { platform: { toString: 1 }, token: 't' }, bad2: { platform: 'apns', token: 7 } };
+    for (let i = 0; i < MAX_WAKE_CHANNELS + 100; i++) data[`n${i}`] = ch(`t${i}`);
+    fs.writeFileSync(path.join(nodeDir(name), 'wake-channels.json'), JSON.stringify(data));
+    const node = boot(name);
+    try {
+      assert.strictEqual(node._peerWakeChannels.size, MAX_WAKE_CHANNELS);
+      assert.strictEqual(node._peerWakeChannels.has('bad1') || node._peerWakeChannels.has('bad2'), false);
+      node._receiveFrame('own-phone', 'own-phone', { type: 'wake-channel', platform: 'apns', token: 'mine' }, 'relay');
+      assert.deepStrictEqual(node._peerWakeChannels.get('own-phone'), { platform: 'apns', token: 'mine', environment: undefined });
+      assert.strictEqual(node._peerWakeChannels.has('n0'), false, 'the oldest read back made room');
+    } finally { node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+  });
+});
+
+describe('wakes have a cooldown on failure and a bounded queue (R4)', () => {
+  it('fifty messages to 300 sleeping channels: one failed wake per channel, at most 16 frames queued for each', async () => {
+    const name = uniq('bound-wakes');
+    const node = boot(name);
+    const lines = [];
+    node._log = (l) => lines.push(l);
+    try {
+      for (let i = 0; i < 300; i++) node._peerWakeChannels.set(`phone-${i}`, ch(`t${i}`));
+      for (let m = 0; m < 50; m++) node._wakeManager.wakeSleepingPeers('message', { type: 'message', content: `m${m}` });
+      await new Promise((r) => setTimeout(r, 300));
+      const failed = lines.filter((l) => /^Wake failed/.test(l));
+      assert.strictEqual(failed.length, 300, 'one attempt per channel per cooldown, not one per message (no APNs keys here, so each fails)');
+      let most = 0;
+      for (const [, q] of node._pendingFrames) most = Math.max(most, q.length);
+      assert.strictEqual(most, MAX_PENDING_FRAMES_PER_PEER);
+      assert.deepStrictEqual(node._pendingFrames.get('phone-0').map((f) => f.content), Array.from({ length: 16 }, (_, i) => `m${34 + i}`), 'the newest are kept');
+    } finally { node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+  });
+});
+
+describe('per-peer maps are pruned when the peer leaves and bounded otherwise (R4)', () => {
+  const x25519 = () => crypto.generateKeyPairSync('x25519').publicKey.export({ format: 'der', type: 'spki' }).toString('base64'); // as a handshake carries it
+
+  it('one link re-sending its handshake with new keys holds one derived-key entry and a bounded conflict list', () => {
+    const name = uniq('bound-handshake');
+    const node = boot(name);
+    try {
+      const P = 'p'.repeat(64);
+      for (let i = 0; i < 300; i++) node._receiveFrame(P, 'evil', { type: 'handshake', nodeId: P, name: 'evil', room: 'g', e2ePublicKey: x25519(), publicKey: `k${i}` }, 'relay');
+      assert.strictEqual(node._e2eDerivedKeys.size, 1, 'until 0.13.17: 300');
+      assert.strictEqual(node._roster.conflicts().length, MAX_CONFLICTS, 'until 0.13.17: 299');
+      assert.strictEqual(node.metrics().framesRefused, 0);
+    } finally { node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+  });
+
+  it('a repeated conflict is kept once', () => {
+    const r = new RosterKeyRegistry();
+    r.pin('n', 'k1', 'handshake');
+    for (let i = 0; i < 10; i++) r.pin('n', 'k2', 'handshake');
+    assert.strictEqual(r.conflicts().length, 1);
+  });
+
+  it('a peer that leaves takes its lifecycle role, derived-key cache and admit verdict with it; a refusal stays', () => {
+    const name = uniq('bound-forget');
+    const node = boot(name);
+    try {
+      const transport = Object.assign(new EventEmitter(), { send() { return true; }, close() { this.emit('close'); } });
+      const peer = node._createPeer(transport, 'friend', 'friend', true, 'relay');
+      node._addPeer(peer);
+      node._receiveFrame('friend', 'friend', { type: 'handshake', nodeId: 'friend', name: 'friend', room: 'g', lifecycleRole: 'validator', e2ePublicKey: x25519() }, 'relay');
+      assert.strictEqual(node._peerLifecycleRoles.get('friend'), 'validator');
+      assert.strictEqual(node._e2eDerivedKeys.has('friend'), true);
+      assert.strictEqual(node._roomVerdicts.get('friend').admit, true);
+      node._receiveFrame('liar', 'liar', { type: 'handshake', nodeId: 'liar', name: 'liar', room: 'elsewhere' }, 'relay');
+      transport.close();
+      assert.strictEqual(node._peers.has('friend'), false);
+      assert.strictEqual(node._peerLifecycleRoles.has('friend'), false);
+      assert.strictEqual(node._e2eDerivedKeys.has('friend'), false);
+      assert.strictEqual(node._roomVerdicts.has('friend'), false);
+      assert.strictEqual(node._roomVerdicts.get('liar').admit, false, 'a refused peer stays refused (it can keep speaking over the relay)');
+      assert.strictEqual(node._roomDoor('liar').pass, false);
+    } finally { node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+  });
+
+  it('a declared lifecycle role is one of the named roles or it is not kept', () => {
+    const name = uniq('bound-role');
+    const node = boot(name);
+    try {
+      for (const [i, role] of [{ toString: 1 }, 7, ['validator'], 'emperor'].entries()) {
+        node._receiveFrame(`r${i}`, `r${i}`, { type: 'handshake', nodeId: `r${i}`, name: 'r', room: 'g', lifecycleRole: role }, 'relay');
+      }
+      assert.strictEqual(node._peerLifecycleRoles.size, 0);
+      node._receiveFrame('ok', 'ok', { type: 'handshake', nodeId: 'ok', name: 'ok', room: 'g', lifecycleRole: 'anchor' }, 'relay');
+      assert.strictEqual(node._peerLifecycleRoles.get('ok'), 'anchor');
+    } finally { node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+  });
+
+  it('room verdicts from peers that never joined are bounded; a connected peer\'s entry is never dropped for room', () => {
+    const name = uniq('bound-verdicts');
+    const node = boot(name);
+    try {
+      node._peers.set('connected', { peerId: 'connected', transports: new Map() });
+      node._receiveFrame('connected', 'c', { type: 'handshake', nodeId: 'connected', name: 'c', room: 'g' }, 'relay');
+      for (let i = 0; i < MAX_PEER_STATE + 50; i++) node._receiveFrame(`ghost-${i}`, 'g', { type: 'handshake', nodeId: `ghost-${i}`, name: 'g', room: 'g' }, 'relay');
+      assert.strictEqual(node._roomVerdicts.size, MAX_PEER_STATE);
+      assert.strictEqual(node._roomVerdicts.has('connected'), true);
+      assert.strictEqual(node._roomVerdicts.has('ghost-0'), false, 'the oldest went first');
+    } finally { node._peers.clear(); node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+  });
+
+  it('keepPeerState: newest last, oldest non-live dropped first, never the one just set', () => {
+    const m = new Map();
+    const live = new Set(['a']);
+    for (const k of ['a', 'b', 'c', 'd']) keepPeerState(m, k, k, live, 2);
+    assert.deepStrictEqual([...m.keys()], ['a', 'd']);
+    keepPeerState(m, 'a', 'a2', live, 2);
+    assert.deepStrictEqual([...m.entries()], [['d', 'd'], ['a', 'a2']]);
+  });
+});

From 89413189839415368651f81b813b376745c9fc99 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Fri, 2 Oct 2026 11:37:02 +0100
Subject: [PATCH 092/148] 0.13.17 security: a frame's own fromName is taken as
 text in message, mood and xmesh-insight

The hotfix took a peer's name as text where the transport carries it, but these three handlers
still preferred the frame's own fromName as given: printed in their log line (one that cannot be
turned into text got the frame refused) and passed on to listeners as the sender's name (the
daemon forwards it to every client). It now goes through wireName, falling back to the name the
transport took (wireName takes the fallback as a second argument).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 lib/frame-handler.js        | 12 +++++-----
 lib/wire-identity.js        | 10 ++++++---
 tests/wire-fromname.test.js | 45 +++++++++++++++++++++++++++++++++++++
 3 files changed, 59 insertions(+), 8 deletions(-)
 create mode 100644 tests/wire-fromname.test.js

diff --git a/lib/frame-handler.js b/lib/frame-handler.js
index e8665cd8..e06a80eb 100644
--- a/lib/frame-handler.js
+++ b/lib/frame-handler.js
@@ -1,7 +1,7 @@
 'use strict';
 
 const { recordKey, recordLineage, recordParents, recordCreatedBy, setRecordLineage } = require('./record');
-const { wireNodeId, wireWakeChannel } = require('./wire-identity');
+const { wireNodeId, wireName, wireWakeChannel } = require('./wire-identity');
 const { keepPeerState } = require('./peer-state');
 
 /** The lifecycle roles a handshake may declare (MMP §3.5); anything else is not kept. */
@@ -1373,7 +1373,7 @@ class FrameHandler {
     const mesh = this._node._meshNode;
     const drift = ((1 - cosineSimilarity(mesh.localH1, moodH1)) + (1 - cosineSimilarity(mesh.localH2, moodH2))) / 2;
 
-    const from = msg.fromName || peerName;
+    const from = wireName(msg.fromName, peerName);
 
     if (drift <= this._node._moodThreshold) {
       this._node._log(`Mood from ${from}: "${msg.mood.slice(0, 50)}" → ACCEPTED (drift: ${drift.toFixed(3)}, threshold: ${this._node._moodThreshold})`);
@@ -1457,8 +1457,10 @@ class FrameHandler {
    * @private
    */
   _handleMessage(peerId, peerName, msg) {
-    this._node._log(`Message from ${msg.fromName || peerName}: ${(msg.content || '').slice(0, 60)}`);
-    this._node.emit('message', msg.fromName || peerName, msg.content, msg);
+    // The frame's own name for its sender is taken as text, as the transport's was (wire-identity.js).
+    const from = wireName(msg.fromName, peerName);
+    this._node._log(`Message from ${from}: ${(msg.content || '').slice(0, 60)}`);
+    this._node.emit('message', from, msg.content, msg);
   }
 
   /**
@@ -1469,7 +1471,7 @@ class FrameHandler {
    */
   _handleXMeshInsight(peerId, peerName, msg) {
     const insight = {
-      from: msg.fromName || peerName,
+      from: wireName(msg.fromName, peerName),
       trajectory: msg.trajectory,
       patterns: msg.patterns,
       anomaly: msg.anomaly,
diff --git a/lib/wire-identity.js b/lib/wire-identity.js
index 2dafbeeb..104c7cdc 100644
--- a/lib/wire-identity.js
+++ b/lib/wire-identity.js
@@ -26,9 +26,13 @@ function wireNodeId(x) {
   return typeof x === 'string' && x.length > 0 && x.length <= MAX_NODE_ID ? x : null;
 }
 
-/** A display name off the wire: the sender's own label, a bounded string, or 'unknown'. */
-function wireName(x) {
-  return typeof x === 'string' && x.length > 0 ? x.slice(0, MAX_NAME) : 'unknown';
+/**
+ * A display name off the wire: the sender's own label, a bounded string, or `fallback` ('unknown').
+ * A frame's own `fromName` falls back to the name its transport already took (`wireName(msg.fromName,
+ * peerName)`), so it is never kept, printed or passed on as given.
+ */
+function wireName(x, fallback = 'unknown') {
+  return typeof x === 'string' && x.length > 0 ? x.slice(0, MAX_NAME) : fallback;
 }
 
 /** A public key off the wire (base64url text), or null when it is not one. */
diff --git a/tests/wire-fromname.test.js b/tests/wire-fromname.test.js
new file mode 100644
index 00000000..5f6427d1
--- /dev/null
+++ b/tests/wire-fromname.test.js
@@ -0,0 +1,45 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME before lib/config loads
+
+/**
+ * 0.13.17 review (R5). The hotfix took a peer's name as text where the transport carries it, but
+ * the `message`, `mood` and `xmesh-insight` handlers still preferred the frame's own `fromName`,
+ * as given: printed in their log line and passed on to listeners (the daemon forwards it to every
+ * client). One whose `fromName` cannot be turned into text was refused (the log line threw), and
+ * any other JSON value reached the listeners as the sender's name. Now `fromName` is taken through
+ * wireName, falling back to the name the transport took.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const { SymNode } = require('../lib/node');
+const { NullDiscovery } = require('../lib/discovery');
+const { nodeDir } = require('../lib/config');
+
+const uniq = (base) => `${base}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+const BAD = { toString: 1 };
+
+describe('a frame\'s fromName is taken as text (R5)', () => {
+  for (const [type, frame, event, fromOf] of [
+    ['message', { type: 'message', content: 'hello' }, 'message', (args) => args[0]],
+    ['mood', { type: 'mood', mood: 'calm and focused' }, ['mood-delivered', 'mood-rejected'], (args) => args[0].from],
+    ['xmesh-insight', { type: 'xmesh-insight', anomaly: 0.1, remixScore: 0.2, coherence: 0.3 }, 'xmesh-insight', (args) => args[0].from],
+  ]) {
+    it(`${type}: a fromName that is not text is not printed or passed on; the transport's name is used`, () => {
+      const name = uniq(`fromname-${type}`);
+      const node = new SymNode({ name, silent: true, discovery: new NullDiscovery(), room: 'g' });
+      const froms = [];
+      for (const e of [].concat(event)) node.on(e, (...args) => froms.push(fromOf(args)));
+      try {
+        for (const fromName of [BAD, 42, ['x'], { a: 1 }, null]) {
+          assert.strictEqual(node._receiveFrame('p', 'peer-p', { ...frame, fromName }, 'relay'), true, 'handled, not refused');
+        }
+        node._receiveFrame('p', 'peer-p', { ...frame, fromName: 'its own label' }, 'relay');
+        assert.deepStrictEqual(froms, ['peer-p', 'peer-p', 'peer-p', 'peer-p', 'peer-p', 'its own label']);
+        assert.strictEqual(node.metrics().framesRefused, 0);
+      } finally { node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+    });
+  }
+});

From ea137df3e486cb835466257022d025bd7629e6b8 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Fri, 2 Oct 2026 11:37:09 +0100
Subject: [PATCH 093/148] 0.13.17 security: loopback registrations are typed
 when read; an inbound connection is admitted before it can replace one

- The loopback scan runs in a timer and did arithmetic and comparisons on registry file fields as
  read (now - ts, nodeId < other), passing the name on to be printed; any process of the same user
  can write that directory, and a file holding an object there threw in the timer. A registration
  is now taken as what it must be (loopbackRecord), or skipped.
- _acceptInbound ran its dedup before deciding admission, so it could close the existing
  connection for the same nodeId (as stale, or by the dual-dial tie-break) and only then refuse
  the new one. Admission is decided first; a refused handshake derives no secret, pins no key and
  gets no frame listener.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 lib/discovery.js                       | 26 ++++++++--
 lib/node.js                            | 18 ++++---
 tests/loopback-admission-order.test.js | 72 ++++++++++++++++++++++++++
 3 files changed, 107 insertions(+), 9 deletions(-)
 create mode 100644 tests/loopback-admission-order.test.js

diff --git a/lib/discovery.js b/lib/discovery.js
index 36ab5bae..0e8f7703 100644
--- a/lib/discovery.js
+++ b/lib/discovery.js
@@ -21,6 +21,7 @@ const os = require('os');
 const path = require('path');
 const { EventEmitter } = require('events');
 const { TcpTransport } = require('./transport');
+const { wireNodeId, wireName } = require('./wire-identity');
 
 // ONE EXIT HOOK FOR EVERY LIVE LOOPBACK REGISTRATION IN THE PROCESS. Each discovery added its own 'exit' listener, so a
 // process hosting many nodes carried one listener per live node: the xmesh runtime logged Node's
@@ -513,8 +514,8 @@ class BonjourDiscovery extends Discovery {
       if (!f.endsWith('.json') || f.endsWith('.tmp')) continue;
       const full = path.join(this._regDir, f);
       let rec;
-      try { rec = JSON.parse(fs.readFileSync(full, 'utf8')); } catch { continue; }
-      if (!rec || !rec.nodeId || rec.nodeId === identity.nodeId) continue;
+      try { rec = loopbackRecord(JSON.parse(fs.readFileSync(full, 'utf8'))); } catch { continue; }
+      if (!rec || rec.nodeId === identity.nodeId) continue;
       // Liveness FIRST, for every registration whatever its room: a dead process's registration is garbage to every
       // scanner. Same-host pid check: signal 0 tests existence; EPERM means the process exists but is not ours (alive);
       // ESRCH means dead. This used to run after the room filter below, so a registration whose room had no live node
@@ -533,12 +534,31 @@ class BonjourDiscovery extends Discovery {
       // Tie-break: the lower nodeId dials; the higher one accepts the inbound.
       // Mirrors the Bonjour _resolvePeer path so we connect exactly once.
       if (identity.nodeId < rec.nodeId) {
-        this.emit('peer-found', '127.0.0.1', rec.port, rec.nodeId, rec.name || 'unknown');
+        this.emit('peer-found', '127.0.0.1', rec.port, rec.nodeId, rec.name);
       }
     }
   }
 }
 
+/**
+ * A loopback registration read from the registry directory, taken as what it must be, or null. The
+ * scan runs in a timer, where a throw is uncaught, and does arithmetic and comparisons on these
+ * fields (`now - ts`, `nodeId < other`) and passes `name` on to be printed: a file holding an
+ * object there (one that cannot be turned into a number or text) threw in that timer. Any process
+ * of this user can write the directory, so its files are read like a frame.
+ * @returns {{nodeId: string, name: string, port: number, pid: (number|null), serviceType: (string|null), ts: number}|null}
+ */
+function loopbackRecord(r) {
+  if (!r || typeof r !== 'object' || Array.isArray(r)) return null;
+  const nodeId = wireNodeId(r.nodeId);
+  if (!nodeId) return null;
+  const port = Number.isInteger(r.port) && r.port > 0 && r.port < 65536 ? r.port : null;
+  const pid = Number.isSafeInteger(r.pid) && r.pid > 0 ? r.pid : null;
+  const ts = Number.isFinite(r.ts) ? r.ts : null;
+  const serviceType = typeof r.serviceType === 'string' ? r.serviceType : null;
+  return { nodeId, name: wireName(r.name), port, pid, serviceType, ts };
+}
+
 // ── Null Discovery ───────────────────────────────────────────
 
 /**
diff --git a/lib/node.js b/lib/node.js
index c135085e..c1489dd5 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -1624,6 +1624,18 @@ class SymNode extends EventEmitter {
    * @private
    */
   _acceptInbound(transport, peerId, peerName, handshakeMsg) {
+    // ADMISSION FIRST. Whether this connection may join the room is decided before anything else
+    // is done with it: until 0.13.17 the dedup below ran first and could close this peerId's
+    // existing, admitted connection (replaced as stale or by the dual-dial tie-break), and only then
+    // was the new one refused, so a refused handshake naming a connected peer's nodeId cost that
+    // peer its connection. Nothing is learned from a refused handshake either (no secret derived,
+    // no key pinned), and no frame listener is attached to its connection.
+    const admission = this._roomAdmission(peerId, handshakeMsg);
+    if (!admission.admit) {
+      this._log(`Refused ${peerName} into '${this._room}': ${admission.reason}`);
+      try { transport.close(); } catch { /* already gone */ }
+      return;
+    }
     // Section 5.2 + 4.6 + dual-dial dedup. Three cases when an existing
     // bonjour transport is registered for this peerId:
     //
@@ -1718,12 +1730,6 @@ class SymNode extends EventEmitter {
       if (peer) peer.lastSeen = Date.now();
       this._receiveFrame(peerId, peerName, m, 'lan');
     });
-    const admission = this._roomAdmission(peerId, handshakeMsg);
-    if (!admission.admit) {
-      this._log(`Refused ${peerName} into '${this._room}': ${admission.reason}`);
-      try { transport.close(); } catch { /* already gone */ }
-      return;
-    }
     const peer = this._createPeer(transport, peerId, peerName, false, 'bonjour');
     this._addPeer(peer);
   }
diff --git a/tests/loopback-admission-order.test.js b/tests/loopback-admission-order.test.js
new file mode 100644
index 00000000..57eac7f8
--- /dev/null
+++ b/tests/loopback-admission-order.test.js
@@ -0,0 +1,72 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME before lib/config loads
+
+/**
+ * 0.13.17 review (R6), two lower findings.
+ *   - The loopback scan, which runs in a timer, did arithmetic and comparisons on the fields of
+ *     registry files (`now - ts`, `nodeId < other`) and passed `name` on to be printed, as read: a
+ *     file holding an object there threw in the timer, which is uncaught. A registration is now
+ *     taken as what it must be, or skipped.
+ *   - `_acceptInbound` ran its dedup first, which can close the existing connection for the same
+ *     nodeId (as stale, or by the dual-dial tie-break), and decided admission after: a refused
+ *     handshake naming a connected peer's nodeId cost that peer its connection. Admission is now
+ *     decided first, and a refused handshake leaves nothing behind.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { EventEmitter } = require('events');
+const { BonjourDiscovery, NullDiscovery } = require('../lib/discovery');
+const { SymNode } = require('../lib/node');
+const { nodeDir } = require('../lib/config');
+
+const uniq = (base) => `${base}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+const BAD = { toString: 1, valueOf: 1 };
+
+describe('the loopback scan types what it reads (R6)', () => {
+  it('a registration whose fields are not what they must be is skipped, not thrown on; a good one is still found', () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'sym-loopback-'));
+    try {
+      const now = Date.now();
+      const write = (f, rec) => fs.writeFileSync(path.join(dir, f), JSON.stringify(rec));
+      write('a.json', { nodeId: 'zz-bad-ts', port: 4000, pid: process.pid, ts: BAD });
+      write('b.json', { nodeId: BAD, port: 4001, pid: process.pid, ts: now });
+      write('c.json', { nodeId: 'zz-bad-name', name: BAD, port: 4002, pid: process.pid, ts: now });
+      write('d.json', { nodeId: 'zz-bad-port', port: '4003', pid: process.pid, ts: now });
+      write('e.json', [1, 2]);
+      write('f.json', { nodeId: 'zz-good', name: 'good', port: 4005, pid: process.pid, ts: now });
+      const scanner = Object.assign(new EventEmitter(), {
+        _regFile: path.join(dir, 'self.json'), _regDir: dir, _identity: { nodeId: 'aa-self' }, _serviceType: '_sym._tcp',
+      });
+      const found = [];
+      scanner.on('peer-found', (addr, port, id, name) => found.push([port, id, name]));
+      assert.doesNotThrow(() => BonjourDiscovery.prototype._scanLoopback.call(scanner));
+      assert.deepStrictEqual(found.sort(), [[4002, 'zz-bad-name', 'unknown'], [4005, 'zz-good', 'good']]);
+    } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+  });
+});
+
+describe('an inbound connection is admitted before it can replace one (R6)', () => {
+  it('a refused handshake naming a connected peer leaves that peer\'s connection open and learns nothing', () => {
+    const name = uniq('accept-order');
+    const node = new SymNode({ name, silent: true, discovery: new NullDiscovery(), room: 'g' });
+    const fake = () => Object.assign(new EventEmitter(), { closed: false, send() { return true; }, close() { this.closed = true; this._closed = true; this.emit('close'); } });
+    try {
+      const existing = fake();
+      node._acceptInbound(existing, 'friend', 'friend', { type: 'handshake', nodeId: 'friend', name: 'friend', room: 'g' });
+      assert.strictEqual(node._peers.get('friend').transport, existing);
+      node._peers.get('friend').lastSeen = Date.now() - 60_000; // idle: the dedup would take it for stale
+      const impostor = fake();
+      node._acceptInbound(impostor, 'friend', 'friend', { type: 'handshake', nodeId: 'friend', name: 'friend', room: 'elsewhere', publicKey: 'impostor-key' });
+      assert.strictEqual(impostor.closed, true, 'the refused connection is closed');
+      assert.strictEqual(existing.closed, false, 'the connected peer keeps its connection (until 0.13.17 it was closed first)');
+      assert.strictEqual(node._peers.get('friend').transport, existing);
+      assert.strictEqual(node._roster.has('friend'), false, 'and nothing was learned from the refused handshake');
+      assert.strictEqual(impostor.listenerCount('message'), 0, 'nor is anything read from its connection');
+    } finally { node._peers.clear(); node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+  });
+});

From 946db221ba28954da0f10307c492c42eca2d4d3b Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Fri, 2 Oct 2026 11:37:44 +0100
Subject: [PATCH 094/148] 0.13.17 CHANGELOG: what each review fix closes

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 CHANGELOG.md | 56 +++++++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 55 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f902e63a..d94f6c7f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -18,6 +18,13 @@ running node or the daemon, with one frame. Every node and every daemon should t
     signed, the rank the record needs, by the chain the node already holds. A record that is not
     rooted has no effect on any role, so it is not stored, not written and not relayed (and costs no
     signature check). A node without an anchor (the daemon, by default) keeps none;
+  - gossip has no order, so a grant or a revoke can arrive before the grant that roots its grantor,
+    and there is no grant sync to ask for it again. Such a record (refused only because its
+    grantor's key or grant has not arrived yet) waits in memory, at most 1,024 of them, the oldest
+    dropped first. It is never written or relayed while it waits and changes no role; when a record
+    that roots it is stored, it is stored, written and relayed too. So a node resolves the roles
+    0.13.16 did, whatever order the records arrive in (an early revoke still takes effect). What
+    waits is not kept across a restart;
   - the store looks grantor keys up through the roster's own lookup, on receipt and on reload alike;
   - reading the file never stops a node from starting. A record that cannot be verified (not JSON,
     malformed, unknown grantor key, bad signature, unrooted) is skipped and counted, and the node says
@@ -52,7 +59,54 @@ running node or the daemon, with one frame. Every node and every daemon should t
   not take left its connection open with no deadline, so a peer could hold sockets without limit. A
   nodeId is now a non-empty string or the announcement or connection is refused, a name is a string
   or `'unknown'`, a key is text or it is not pinned, and a wake channel is kept only as text
-  (`{ platform, token, environment }`), before anything stores, prints or passes them on.
+  (`{ platform, token, environment }`), before anything stores, prints or passes them on. A
+  `message`, `mood` or `xmesh-insight` frame's own `fromName` is taken the same way (it falls back to
+  the name the transport took); it was printed and passed on to listeners as given.
+- **A deeply nested frame crashed a node over the relay.** The relay measured a peer's payload by
+  serialising it again before the frame reached the guard. Serialising recurses once per level, so
+  a payload about 10,000 levels deep (24 KB, under every size bound) threw a RangeError out of the
+  socket callback, and the daemon exits on that. A `relay-error`'s message was printed as given, so
+  one that could not be turned into text threw the same way. Now:
+  - JSON a peer wrote that nests deeper than 128 levels is dropped before it is parsed, as malformed
+    JSON is: a LAN frame, a relay message, and the plaintext of an encrypted CMB. A frame that
+    parses can then always be serialised again, wherever the node keeps, relays, persists or
+    measures it;
+  - a `relay-error` is printed field by field (`kind`, `code`, `message`), each only when it has the
+    right type;
+  - every message off the relay socket goes through the inbound guard, the relay's own join notices
+    and peer list included (they carry what each joiner put in its relay-auth).
+- **The daemon checks each IPC message at the door, like a wire frame.** It must be a JSON object
+  with a string `type`, or it gets an error reply and goes no further, and nothing in it is printed
+  before that. A request that fails is answered with the error instead of only logged. (Naming a
+  failed request by a `type` that cannot be turned into text would make the error path itself throw
+  and stop the daemon.)
+- **A room peer could make a node keep more and more.** Each store a peer feeds now has one bound:
+  - wake channels: at most 1,024 in all, and at most 512 that one peer taught for nodes other than
+    itself. A node's own channel always has room, displacing the oldest gossiped one. Twenty
+    `peer-info` frames kept 5,120 channels before. `wake-channels.json` is written at most once a
+    second (and when the node stops), not once per frame. It is read back as a frame is: typed, and
+    within the same bound;
+  - wakes: the cooldown runs from the last attempt, so a failed wake is not tried again on the next
+    message. Every message and mood the daemon relays wakes every sleeping channel, and a node
+    without APNs keys fails every one, so each message logged a line per channel. At most 16 frames
+    wait for one sleeping peer, the oldest dropped first;
+  - per-peer state (room verdicts, the anchor debounce, E2E secrets and the key each was derived
+    from, identity keys, declared lifecycle roles): what is learned again from each connection's
+    handshake goes when the peer leaves. That is the lifecycle role, the derived-key cache, and an
+    admit verdict; a refusal verdict stays, since over the relay a refused peer can keep speaking.
+    Every such map holds at most 4,096 entries for peers that are not connected, the oldest dropped
+    first. A connected peer's entry is never dropped for room. The derived-key cache is one entry per
+    peer: one link re-sending its handshake with a new key each time had added one per handshake. A
+    lifecycle role is one of the named roles or it is not kept (it was kept as any JSON value);
+  - the roster's list of refused key rebindings: at most 256, each one kept once.
+- **The loopback scan threw on a registry file it could not use.** It runs in a timer and did
+  arithmetic and comparisons on registry file fields as read. Any process of the same user can write
+  that directory. A registration is now typed when it is read, or skipped.
+- **A refused LAN handshake could cost a connected peer its connection.** An inbound connection's
+  dedup ran before its admission was decided, so it could close the existing connection for the same
+  nodeId (as stale, or by the dual-dial tie-break), and only then refuse the new one. Admission is
+  now decided first. Nothing is learned from a refused handshake: no secret is derived, no key is
+  pinned, and nothing is read from its connection.
 
 ## 0.13.16 (2026-10-02)
 

From 548f69091fdbb2c9b14aeb28f6cdac5dd28e6185 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Fri, 2 Oct 2026 12:23:08 +0100
Subject: [PATCH 095/148] 0.13.17 security: key bindings held at most 16,384,
 never evicted; relay-announced peers at most 4,096

Two more stores peers feed had no bound. The root fix for both is 0.14.0's session-first design
(a peer exists only after a proven handshake); 0.13.x bounds them.

- The roster key registry added a binding, and a line to its file, for every new nodeId a
  handshake named. It holds at most 16,384. When full a NEW binding is refused and none is ever
  evicted: forgetting one would let its nodeId be pinned again with another key. The anchor is
  configuration and always pinned; a stronger source for a held nodeId still applies. The refusal
  is said once and counted (status().roster.refusedFull). The direct-handshake key map now holds
  only keys the roster pinned, so a refused key is not resolvable through _identityKey's fallback
  either, and what it signs fails verification.
- The relay's join notices and peer list added a peer for every nodeId they named. At most 4,096
  peers that only an announcement introduced are held; an announcement for another unknown nodeId
  is ignored, said once and counted (relay state().announcementsIgnored). Peers the node already
  knows (announced before, or with a live transport) are unaffected; relay-peer-left and a relay
  disconnect free a place as before. A replaced relay transport's close no longer removes its
  successor.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 lib/node.js                                |  12 +-
 lib/relay.js                               |  31 ++++
 lib/roster-keys.js                         |  29 +++-
 tests/roster-and-peer-table-bounds.test.js | 178 +++++++++++++++++++++
 4 files changed, 247 insertions(+), 3 deletions(-)
 create mode 100644 tests/roster-and-peer-table-bounds.test.js

diff --git a/lib/node.js b/lib/node.js
index c1489dd5..66040307 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -283,9 +283,11 @@ class SymNode extends EventEmitter {
     // Roster key registry — authenticated nodeId→key bindings, so signatures from peers
     // we never directly handshook still verify. Pins by source precedence (anchor >
     // handshake > grant-vouched); the relayer never vouches. Persisted under the node dir.
+    // Bounded (16,384), never evicting: see roster-keys.js.
     this._roster = new RosterKeyRegistry({
       anchor: this._anchor,
       dir: path.join(this._dir, 'roster-keys'),
+      log: (m) => this._log(m),
     });
     // Room ownership — which key owns which room, for THIS receiver. Config pins are
     // supplied per boot and outrank the persisted cache; there is no wire source (see
@@ -671,8 +673,12 @@ class SymNode extends EventEmitter {
     // A key is text or it is not a key: pinned as given, a JSON object here sat in the roster (and
     // its file) and failed every verification against it.
     if (!wireNodeId(nodeId) || !wireKey(keyB64url)) return;
-    keepPeerState(this._peerIdentityKeys, nodeId, keyB64url, this._peers);
-    this._roster.pin(nodeId, keyB64url, 'handshake');
+    // The direct-handshake map holds only what the roster pinned, so a key the roster refused (a
+    // conflicting one, or any once the roster is full) is not resolvable through the fallback in
+    // _identityKey either: what it signs fails verification, as an unknown key's does.
+    if (this._roster.pin(nodeId, keyB64url, 'handshake').pinned) {
+      keepPeerState(this._peerIdentityKeys, nodeId, keyB64url, this._peers);
+    }
   }
 
   /**
@@ -2667,6 +2673,8 @@ class SymNode extends EventEmitter {
       peerCount: this._peers.size,
       memoryCount: this.memories(),
       coherence: this.coherence(),
+      // The key registry's size, and how many new bindings it refused for being full.
+      roster: { size: this._roster.size(), refusedFull: this._roster.refusedFull() },
     };
   }
 
diff --git a/lib/relay.js b/lib/relay.js
index 3489995c..aaded663 100644
--- a/lib/relay.js
+++ b/lib/relay.js
@@ -14,6 +14,14 @@ const { MAX_FRAME_SIZE } = require('./frame-parser');
 const { nestedTooDeep } = require('./core/json-depth');
 const { wireNodeId, wireName, wireWakeChannel } = require('./wire-identity');
 const RELAY_ENVELOPE_ALLOWANCE = 4096;
+/**
+ * Peers the relay's announcements (join notices, peer-list entries) may add to the peer table:
+ * peers this node did not know when they were announced. Past this many, an announcement for a
+ * nodeId this node does not know is ignored (said once, counted in state().announcementsIgnored).
+ * A peer this node already knows (announced before, or with a live transport of its own) is
+ * unaffected, and one that leaves (relay-peer-left, or the relay link closing) frees its place.
+ */
+const MAX_ANNOUNCED_PEERS = 4096;
 const ENGINE_VERSION = require('../package.json').version;
 class RelayConnection {
 
@@ -84,6 +92,9 @@ class RelayConnection {
     this._relayReconnectTimer = null;
     this._relayReconnectDelay = 1000;
     this._relayPeerTransports = new Map();
+    this._announcedPeers = new Set(); // peers the relay's announcements added to the table (bounded)
+    this._maxAnnouncedPeers = Number.isInteger(opts.maxAnnouncedPeers) && opts.maxAnnouncedPeers > 0 ? opts.maxAnnouncedPeers : MAX_ANNOUNCED_PEERS;
+    this._announcementsIgnored = 0; // announcements for unknown nodeIds ignored at the cap
     this._lastRelayMessage = 0;  // timestamp of last message from relay
 
     // Observable state. A host used to see one bit — `ws.readyState === 1` — so a refused
@@ -119,6 +130,7 @@ class RelayConnection {
       lastError: this._lastError,
       refused: this._refused,
       peers: this._relayPeerTransports.size,
+      announcementsIgnored: this._announcementsIgnored,
     };
   }
 
@@ -298,6 +310,7 @@ class RelayConnection {
         transport.destroy();
       }
       this._relayPeerTransports.clear();
+      this._announcedPeers.clear();
 
       // MMP identity invariant: nodeId is bound to a keypair. If the relay
       // closes us with code 4004 ("Replaced by new connection"), another
@@ -436,11 +449,27 @@ class RelayConnection {
     const identity = this._getIdentity();
     if (!peerId || peerId === identity.nodeId) return;
     const peers = this._getPeers();
+    // The relay's announcements are the one way a peer enters the table without a transport of
+    // its own (a relay or a token holder can announce any number of nodeIds), so they are bounded:
+    // at MAX_ANNOUNCED_PEERS announced peers, one for a nodeId this node does not know is ignored.
+    const unknown = !peers.has(peerId) && !this._announcedPeers.has(peerId);
+    if (unknown && this._announcedPeers.size >= this._maxAnnouncedPeers) {
+      this._announcementsIgnored++;
+      if (this._announcementsIgnored === 1) {
+        this._log(`Relay: ${this._maxAnnouncedPeers} announced peers held; announcements for more are ignored (counted in relay state)`);
+      }
+      return;
+    }
+    if (unknown) this._announcedPeers.add(peerId);
     const transport = new RelayPeerTransport(this._relayWs, peerId);
     this._relayPeerTransports.set(peerId, transport);
 
+    // Identity-aware: a re-announcement replaces the transport, and the replaced one's close must
+    // not remove its successor (or the peer's place among the announced).
     transport.on('close', () => {
+      if (this._relayPeerTransports.get(peerId) !== transport) return;
       this._relayPeerTransports.delete(peerId);
+      this._announcedPeers.delete(peerId);
     });
 
     // Section 4.6: if peer already connected (e.g. via Bonjour),
@@ -459,6 +488,7 @@ class RelayConnection {
       const transport = this._relayPeerTransports.get(peerId);
       if (transport) transport.destroy();
       this._relayPeerTransports.delete(peerId);
+      this._announcedPeers.delete(peerId);
       this._log(`Relay transport closed for ${peerName || peerId}`);
     } catch (err) {
       this._log(`Relay peer-left error for ${peerName || peerId}: ${err.message}`);
@@ -494,6 +524,7 @@ class RelayConnection {
       transport.destroy();
     }
     this._relayPeerTransports.clear();
+    this._announcedPeers.clear();
 
     if (this._relayWs) {
       try { this._relayWs.close(); } catch {}
diff --git a/lib/roster-keys.js b/lib/roster-keys.js
index 130acaa0..eb2524b6 100644
--- a/lib/roster-keys.js
+++ b/lib/roster-keys.js
@@ -22,6 +22,15 @@
  * key learnt from a direct handshake or the pinned anchor. Conflicts at equal strength
  * are refused (first binding holds) and surfaced as evidence, not silently merged.
  *
+ * BOUNDED, AND NEVER FORGETS. Every handshake that names a new nodeId adds a binding (and a
+ * line to the file), and until MMP 2.0's proven sessions (sym 0.14.0) a handshake proves
+ * nothing, so the registry holds at most `maxBindings` (16,384). When it is full a NEW binding
+ * is refused; a binding already held is never evicted, since forgetting one would let its
+ * nodeId be pinned again with a different key. A refusal is said once and counted
+ * (`refusedFull()`, `status().roster.refusedFull`); a record signed by a key that could not be
+ * pinned then fails verification, as one from an unknown key does. The anchor is configuration,
+ * not peer input, and is always pinned.
+ *
  * Duck-types Map's `get`/`set` so it can drop in wherever a plain key map was used.
  * Persisted append-only and reloaded on construction.
  *
@@ -34,6 +43,8 @@ const path = require('path');
 const KEYS_FILE = 'roster-keys.jsonl';
 /** Conflicts kept as evidence; a repeat of one already kept is not added again, and the oldest goes first. */
 const MAX_CONFLICTS = 256;
+/** Bindings held at most; past this a new one is refused and none is evicted. */
+const MAX_BINDINGS = 16384;
 const SOURCE_RANK = Object.freeze({ grant: 0, handshake: 1, anchor: 2 });
 function sourceRank(s) { return SOURCE_RANK[s] ?? 0; }
 
@@ -42,10 +53,15 @@ class RosterKeyRegistry {
    * @param {object} [opts]
    * @param {{nodeId: string, publicKey: string}} [opts.anchor] pinned at 'anchor' strength.
    * @param {string} [opts.dir] when set, bindings persist append-only and reload here.
+   * @param {number} [opts.maxBindings=16384] bindings held at most (new ones refused past it).
+   * @param {function(string): void} [opts.log] where the one "registry is full" line goes.
    */
   constructor(opts = {}) {
     this._byNode = new Map();   // nodeId -> { key, source, at }
     this._conflicts = [];       // refused equal/weaker rebindings (omission/impersonation evidence)
+    this._maxBindings = Number.isInteger(opts.maxBindings) && opts.maxBindings > 0 ? opts.maxBindings : MAX_BINDINGS;
+    this._refusedFull = 0;      // new bindings refused because the registry was full
+    this._log = typeof opts.log === 'function' ? opts.log : null;
     this._dir = opts.dir || null;
     this._loading = false;
     if (this._dir) {
@@ -85,6 +101,15 @@ class RosterKeyRegistry {
       }
       // strictly stronger source overrides a weaker binding (e.g. a direct handshake
       // corrects a previously grant-vouched key)
+    } else if (source !== 'anchor' && this._byNode.size >= this._maxBindings) {
+      // Full: a new binding is refused, and nothing held is evicted to make room for it.
+      this._refusedFull++;
+      if (this._refusedFull === 1 && this._log) {
+        try {
+          this._log(`Roster key registry is full (${this._maxBindings} bindings): new bindings are refused and none is evicted; a record signed by a key that could not be pinned fails verification`);
+        } catch { /* never the failure */ }
+      }
+      return { pinned: false, reason: 'full' };
     }
     const rec = { key: keyB64url, source, at: existing?.at ?? null };
     this._byNode.set(nodeId, rec);
@@ -114,6 +139,8 @@ class RosterKeyRegistry {
   has(nodeId) { return this._byNode.has(nodeId); }
   source(nodeId) { return this._byNode.get(nodeId)?.source; }
   size() { return this._byNode.size; }
+  /** New bindings refused because the registry was full (see the module doc). */
+  refusedFull() { return this._refusedFull; }
   conflicts() { return this._conflicts.slice(); }
 
   // ── Durable persistence (append-only; last write per nodeId wins on reload) ──────
@@ -138,4 +165,4 @@ class RosterKeyRegistry {
   }
 }
 
-module.exports = { RosterKeyRegistry, SOURCE_RANK, MAX_CONFLICTS };
+module.exports = { RosterKeyRegistry, SOURCE_RANK, MAX_CONFLICTS, MAX_BINDINGS };
diff --git a/tests/roster-and-peer-table-bounds.test.js b/tests/roster-and-peer-table-bounds.test.js
new file mode 100644
index 00000000..8f2bba2e
--- /dev/null
+++ b/tests/roster-and-peer-table-bounds.test.js
@@ -0,0 +1,178 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME before lib/config loads
+
+/**
+ * 0.13.17, two more peer-fed stores with no bound, bounded here; sym 0.14.0's proven sessions
+ * remove the cause (a peer exists only after a handshake that proves its key).
+ *   - The roster key registry added a binding, and a line to its file, for every handshake that
+ *     named a new nodeId. It now holds at most 16,384; when full a NEW binding is refused and none
+ *     is ever evicted (forgetting one would let its nodeId be pinned again with another key). The
+ *     refusal is said once and counted in status().roster.refusedFull, and a record signed by a key
+ *     that could not be pinned fails verification.
+ *   - The relay's announcements (join notices, peer-list entries) added a peer for every nodeId
+ *     they named. At most 4,096 announced peers are held; an announcement for an unknown nodeId
+ *     past that is ignored, said once and counted. Known peers are unaffected, and relay-peer-left
+ *     still prunes.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const crypto = require('crypto');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { WebSocketServer } = require('ws');
+const { SymNode } = require('../lib/node');
+const { NullDiscovery } = require('../lib/discovery');
+const { nodeDir } = require('../lib/config');
+const { RosterKeyRegistry, MAX_BINDINGS } = require('../lib/roster-keys');
+const { RelayConnection } = require('../lib/relay');
+const { createCMB, signCMB } = require('../lib/core');
+
+const uniq = (base) => `${base}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+const until = async (cond, ms = 5000) => { for (let t = 0; t < ms && !cond(); t += 20) await new Promise((r) => setTimeout(r, 20)); };
+
+describe('the roster key registry is bounded and never evicts', () => {
+  it(`holds at most ${MAX_BINDINGS}; a new binding past that is refused, said once and counted`, () => {
+    const lines = [];
+    const r = new RosterKeyRegistry({ log: (l) => lines.push(l) });
+    for (let i = 0; i < MAX_BINDINGS; i++) assert.strictEqual(r.pin(`n${i}`, `k${i}`, 'handshake').pinned, true);
+    assert.deepStrictEqual(r.pin('late', 'kl', 'handshake'), { pinned: false, reason: 'full' });
+    assert.deepStrictEqual(r.pin('late2', 'kl2', 'grant'), { pinned: false, reason: 'full' });
+    assert.strictEqual(r.size(), MAX_BINDINGS);
+    assert.strictEqual(r.refusedFull(), 2);
+    assert.strictEqual(lines.filter((l) => /registry is full/.test(l)).length, 1, 'said once');
+  });
+
+  it('never evicts: a full registry keeps every binding, refuses a rebinding as before, and still takes a stronger source for a held nodeId and the anchor', () => {
+    const r = new RosterKeyRegistry({ maxBindings: 3 });
+    r.pin('a', 'ka', 'grant');
+    r.pin('b', 'kb', 'handshake');
+    r.pin('c', 'kc', 'handshake');
+    assert.strictEqual(r.pin('d', 'kd', 'handshake').reason, 'full');
+    assert.deepStrictEqual(['a', 'b', 'c'].map((n) => r.get(n)), ['ka', 'kb', 'kc'], 'nothing evicted');
+    assert.strictEqual(r.pin('b', 'other', 'handshake').reason, 'conflict', 'a held nodeId is not re-pinned with another key');
+    assert.strictEqual(r.pin('a', 'ka2', 'handshake').pinned, true, 'a stronger source for a held nodeId does not grow it');
+    assert.strictEqual(r.pin('founder', 'kf', 'anchor').pinned, true, 'the anchor is configuration, always pinned');
+    assert.strictEqual(r.refusedFull(), 1);
+  });
+
+  it('a full registry reloaded from its file keeps what it held and refuses the rest', () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'roster-full-'));
+    try {
+      const r = new RosterKeyRegistry({ dir, maxBindings: 2 });
+      r.pin('a', 'ka', 'handshake');
+      r.pin('b', 'kb', 'handshake');
+      r.pin('c', 'kc', 'handshake');
+      fs.appendFileSync(path.join(dir, 'roster-keys.jsonl'), JSON.stringify({ nodeId: 'z', key: 'kz', source: 'handshake' }) + '\n');
+      const again = new RosterKeyRegistry({ dir, maxBindings: 2 });
+      assert.deepStrictEqual([again.get('a'), again.get('b'), again.get('c'), again.get('z')], ['ka', 'kb', undefined, undefined]);
+      assert.strictEqual(again.refusedFull(), 1);
+    } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+  });
+
+  it('on a node: a key the full roster refused is not resolvable at all, so what it signs is not verified; status() shows the count', () => {
+    const name = uniq('roster-full-node');
+    const node = new SymNode({ name, silent: true, discovery: new NullDiscovery(), room: 'g' });
+    const keypair = () => {
+      const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519');
+      return { pub: publicKey.export({ format: 'der', type: 'spki' }).subarray(12).toString('base64url'),
+        priv: privateKey.export({ format: 'der', type: 'pkcs8' }).subarray(16).toString('base64url') };
+    };
+    const signedBy = (k, author) => {
+      const cmb = createCMB({ categories: { focus: `work from ${author}`, issue: 'x', intent: 'x', motivation: 'x', commitment: 'x', perspective: author, mood: { text: 'neutral', valence: 0, arousal: 0 } }, createdBy: author });
+      signCMB(cmb, k.priv);
+      return { type: 'cmb', timestamp: Date.now(), cmb: JSON.parse(JSON.stringify(cmb)) };
+    };
+    try {
+      node._roster._maxBindings = node._roster.size() + 1; // room for exactly one more (keeps this fast)
+      const known = keypair(), late = keypair();
+      node._receiveFrame('known-peer', 'known', { type: 'handshake', nodeId: 'known-peer', name: 'known', room: 'g', publicKey: known.pub }, 'relay');
+      node._receiveFrame('late-peer', 'late', { type: 'handshake', nodeId: 'late-peer', name: 'late', room: 'g', publicKey: late.pub }, 'relay');
+      assert.strictEqual(node._roster.get('known-peer'), known.pub);
+      assert.strictEqual(node._roster.has('late-peer'), false, 'the full roster refused it');
+      assert.strictEqual(node._identityKey('late-peer'), undefined, 'and it is not resolvable through the direct-handshake fallback either');
+      assert.deepStrictEqual(node.status().roster, { size: node._roster.size(), refusedFull: 1 });
+      const a = signedBy(known, 'known');
+      const b = signedBy(late, 'late');
+      node._frameHandler._rejectOnBadSignature('known-peer', 'known', a);
+      node._frameHandler._rejectOnBadSignature('late-peer', 'late', b);
+      assert.strictEqual(a._cmbVerified, true, 'a pinned key verifies');
+      assert.strictEqual(b._cmbVerified, false, 'an unpinned key does not: no verified authorship, no elevation');
+    } finally { node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+  });
+});
+
+describe('peers the relay announces are bounded', () => {
+  /** A RelayConnection against a fake relay that sends `messages` after relay-auth. */
+  async function withRelay(messages, opts, fn) {
+    const wss = new WebSocketServer({ port: 0 });
+    const sockets = [];
+    wss.on('connection', (ws) => {
+      sockets.push(ws);
+      ws.once('message', () => { for (const m of messages) ws.send(JSON.stringify(m)); });
+    });
+    const peers = opts.peers || new Map();
+    const logs = [];
+    let running = true;
+    const rc = new RelayConnection({
+      relayUrl: `ws://127.0.0.1:${wss.address().port}`, relayToken: 'x'.repeat(40), log: (l) => logs.push(l),
+      getIdentity: () => ({ nodeId: 'b'.repeat(64) }), isRunning: () => running, getPeers: () => peers, getMeshNode: () => null,
+      createPeer: (transport, peerId) => {
+        const p = peers.get(peerId) || { peerId, transports: new Map() };
+        p.transports.set('relay', transport);
+        transport.on('close', () => { p.transports.delete('relay'); if (p.transports.size === 0) peers.delete(peerId); });
+        return p;
+      },
+      addPeer: (p) => peers.set(p.peerId, p),
+      handlePeerMessage: () => {}, onPeerLeft: () => {}, onAuthRefused: () => {},
+      nodeName: 'announce-cap', peerWakeChannels: new Map(), saveWakeChannels: () => {},
+      ...(opts.max ? { maxAnnouncedPeers: opts.max } : {}),
+    });
+    try {
+      rc.connect();
+      await fn({ rc, peers, logs, send: (m) => sockets[0].send(JSON.stringify(m)) });
+    } finally {
+      running = false;
+      rc.destroy();
+      await new Promise((r) => wss.close(() => r()));
+    }
+  }
+
+  it('a peer list naming 4,100 unknown nodeIds adds 4,096; the rest are ignored, said once and counted', async () => {
+    const list = { type: 'relay-peers', peers: Array.from({ length: 4100 }, (_, i) => ({ nodeId: `ann-${i}`, name: `a${i}` })) };
+    await withRelay([list], {}, async ({ rc, peers, logs }) => {
+      await until(() => rc.state().phase === 'connected' && peers.size >= 4096);
+      await new Promise((r) => setTimeout(r, 100));
+      assert.strictEqual(peers.size, 4096);
+      assert.strictEqual(rc.state().announcementsIgnored, 4);
+      assert.strictEqual(logs.filter((l) => /announced peers held/.test(l)).length, 1, 'said once');
+    });
+  });
+
+  it('known peers are unaffected at the cap, and relay-peer-left still prunes', async () => {
+    const lan = { peerId: 'lan-peer', transports: new Map([['bonjour', { send() { return true; } }]]) };
+    const peers = new Map([['lan-peer', lan]]);
+    const msgs = [
+      { type: 'relay-peers', peers: [{ nodeId: 'a1' }, { nodeId: 'a2' }] },
+      { type: 'relay-peer-joined', nodeId: 'a3' },                 // unknown, at the cap: ignored
+      { type: 'relay-peer-joined', nodeId: 'lan-peer' },           // known (live LAN transport): taken
+      { type: 'relay-peer-joined', nodeId: 'a1' },                 // already announced: taken again
+    ];
+    await withRelay(msgs, { max: 2, peers }, async ({ rc, logs, send }) => {
+      await until(() => lan.transports.has('relay'));
+      await new Promise((r) => setTimeout(r, 100));
+      assert.deepStrictEqual([...peers.keys()].sort(), ['a1', 'a2', 'lan-peer']);
+      assert.strictEqual(lan.transports.has('relay'), true, 'a known peer gets its relay transport at the cap');
+      assert.strictEqual(rc.state().announcementsIgnored, 1);
+      send({ type: 'relay-peer-left', nodeId: 'a2' });
+      await until(() => !peers.has('a2'));
+      assert.strictEqual(peers.has('a2'), false, 'pruned as before');
+      send({ type: 'relay-peer-joined', nodeId: 'a4' });
+      await until(() => peers.has('a4'));
+      assert.strictEqual(peers.has('a4'), true, 'room again once one left');
+      assert.ok(logs.some((l) => /announced peers held/.test(l)));
+    });
+  });
+});

From c1742ca33558b1a9d0e3a5e041a48e7d621f2c6f Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Fri, 2 Oct 2026 12:23:16 +0100
Subject: [PATCH 096/148] 0.13.17 docs: SECURITY.md states the 0.13.x known
 limit and the two new bounds; CHANGELOG adds them

SECURITY.md (new on the 0.13 line): peer identity is trust on first use; a handshake claiming a
connected peer's nodeId can reset that peer's room verdict until it handshakes again, because
identity is unproven (0.14.0 proves it before any per-peer state); key bindings are bounded at
16,384 with no eviction and relay-announced peers at 4,096. The README's security section links
it, and the CHANGELOG 0.13.17 entry lists both bounds and the known limit.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 CHANGELOG.md | 19 ++++++++++++++++++-
 README.md    |  4 +++-
 SECURITY.md  | 45 +++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 66 insertions(+), 2 deletions(-)
 create mode 100644 SECURITY.md

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d94f6c7f..85970484 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -98,7 +98,17 @@ running node or the daemon, with one frame. Every node and every daemon should t
     first. A connected peer's entry is never dropped for room. The derived-key cache is one entry per
     peer: one link re-sending its handshake with a new key each time had added one per handshake. A
     lifecycle role is one of the named roles or it is not kept (it was kept as any JSON value);
-  - the roster's list of refused key rebindings: at most 256, each one kept once.
+  - the roster's list of refused key rebindings: at most 256, each one kept once;
+  - key bindings: the roster key registry added a binding, and a line to its file, for every new
+    nodeId a handshake named. It now holds at most 16,384. Past that a new binding is refused and
+    none is ever evicted, since forgetting one would let its nodeId be pinned again with another
+    key. The refusal is said once and counted (`status().roster.refusedFull`), and a record signed
+    by a key that could not be pinned fails verification;
+  - peers added by relay announcements: the relay's join notices and peer list added a peer for
+    every nodeId they named. At most 4,096 peers that only an announcement introduced are now held;
+    an announcement for another unknown nodeId is ignored, said once and counted
+    (`status().relayState.announcementsIgnored`). Peers the node already knows, including any with
+    a live LAN connection, are not affected, and a peer that leaves the relay frees its place.
 - **The loopback scan threw on a registry file it could not use.** It runs in a timer and did
   arithmetic and comparisons on registry file fields as read. Any process of the same user can write
   that directory. A registration is now typed when it is read, or skipped.
@@ -108,6 +118,13 @@ running node or the daemon, with one frame. Every node and every daemon should t
   now decided first. Nothing is learned from a refused handshake: no secret is derived, no key is
   pinned, and nothing is read from its connection.
 
+### Known limit
+
+- **A handshake that claims a connected peer's nodeId can reset that peer's room verdict** until
+  the peer handshakes again. The cause is unproven identity: in 0.13 a peer's identity is trust on
+  first use, and the handshake proves nothing. 0.14.0 removes the cause by proving identity before
+  it keeps any per-peer state. This and the bounds above are described in the new `SECURITY.md`.
+
 ## 0.13.16 (2026-10-02)
 
 Follow-ups to the 0.13.15 witness-storm fix, from its last review.
diff --git a/README.md b/README.md
index 23df92cd..12b7e723 100644
--- a/README.md
+++ b/README.md
@@ -137,7 +137,9 @@ limits rather than as a promise.
 What this does not cover: a room name or relay token is not an enterprise trust boundary —
 anyone holding the token is in the channel; the envelope (names, room, timing, sizes) is
 visible to the relay operator; and a peer's own machine is trusted with everything that peer
-admitted.
+admitted. Peer identity in 0.13 is trust on first use: the handshake does not prove a peer's key.
+[SECURITY.md](SECURITY.md) lists what follows from that and the bounds on what peers can make a
+node keep.
 
 ## Current boundaries
 
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 00000000..2edd731a
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,45 @@
+# Security
+
+This file says what `@sym-bot/sym` 0.13.x does not protect, so nobody has to find out the hard
+way. It covers the 0.13 line. sym 0.14.0 (MMP 2.0 Core Secure) proves each peer's identity at
+the handshake, and that removes the cause of the first limit below.
+
+## Reporting
+
+Report a vulnerability privately to info@sym.bot (the address in package.json). Please do not
+open a public issue for it.
+
+## Peer identity in 0.13.x is trust on first use
+
+A 0.13 handshake does not prove anything. A peer names its nodeId and its keys, and the node
+believes the first key it sees for a nodeId (the roster key registry). Signatures are checked
+against that key from then on, but the first contact is taken on trust. What follows from that:
+
+- **A handshake that claims a connected peer's nodeId can reset that peer's room verdict.** A
+  node records one room-admission verdict per nodeId, from the latest handshake that named it.
+  A handshake from anyone, naming a connected peer's nodeId and a different room, is refused,
+  and the refusal replaces the peer's own verdict, so the node refuses that peer's frames until
+  the peer handshakes again (on its next connection). The peer's connection is not closed and
+  nothing is learned from the refused handshake: no key is pinned and no secret is derived. The
+  cause is unproven identity. 0.14.0 fixes it by proving identity before it keeps any per-peer
+  state.
+
+## Bounds on what peers can make a node keep
+
+These stores are fed by what peers send, so each has a fixed bound. Reaching one never stops the
+node; it is said once in the log and counted.
+
+- **Key bindings: at most 16,384.** The roster key registry adds a binding for each nodeId a
+  handshake (or an anchor-rooted grant) names. When it holds 16,384, a new binding is refused and
+  no binding is ever evicted: forgetting one would let its nodeId be pinned again with another
+  key. A record signed by a key that could not be pinned fails verification, as one signed by
+  an unknown key does. `status().roster.refusedFull` counts the refusals.
+- **Peers added by relay announcements: at most 4,096.** The relay's join notices and peer list
+  can name any number of nodeIds, and each one becomes a peer in the table. At most 4,096 peers
+  that only an announcement introduced are held; an announcement for another unknown nodeId is
+  ignored and counted (`status().relayState.announcementsIgnored`). Peers this node already knows,
+  including any with a live LAN connection, are not affected, and a peer that leaves the relay
+  frees its place.
+
+The other bounds 0.13.17 sets (wake channels, per-peer state, pending role grants, the nesting
+of a frame) are listed in its CHANGELOG entry.

From 591696f8c6f0447095a79151864ffc81f8fce125 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Fri, 2 Oct 2026 15:15:18 +0100
Subject: [PATCH 097/148] 0.14.0 Core Secure: a peer is a proven session
 (design D1-D9)

Implements the reviewed design "Core Secure identity" v2 (docs/DESIGN-core-secure-identity.md,
ee6405a) on top of the 0.13.17 merge (D10). One commit: the steps share the session manager in
lib/node.js, so no earlier tree of them loads on its own.

D3  Key registry: one key per nodeId for life; anchor | proven | pinned | grant | legacy-claim;
    no source overrides a different key (a conflict is refused, recorded, resolved by an
    operator: sym keys resolve); 0.13 handshake pins become legacy-claim (expected, never
    verifying); the anchor is configuration, never persisted; a version marker line, idempotent
    migration. Authority follows the key: resolveRole(nodeId, key, at), granteeKey required,
    chains verified top-down with vouched keys.
D1  Session-first peers: every per-peer structure keyed by the proven nodeId; the frame
    classification table; sealed control frames (control-encrypted) for every post-handshake
    frame but ping/pong/error; the public verified-record hook (record, session facts,
    verification); messages are directed CMBs; cmb-fetch answers each record as its own
    cmb-encrypted frame, then a result with the key lists only.
D2  The v2 handshake on LAN, loopback and relay; TXT mmp=2.0 and room; the listener takes
    client-hello only; the smaller nodeId dials / sends client-hello over the relay; relay
    sessions bound to the relay from, superseded by a newer confirmed session, torn down on
    relay-peer-left; AEAD before sequence; a gap or replay closes and re-handshakes.
D4  cmb-encrypted only, MMP_EMIT_V2 on, author key by createdByNodeId, binding from the signed
    metadata.to; a legacy-suite record refused on its own metric (not as a forgery); relay
    pacing under 25 frames/s, fan-out behind relay-peers.features ['fanout'] (spec draft #25);
    4006 and 4007 hard stops like 4004.
D5  Invites carry node and key; accepting pins the issuer only where its nodeId is unbound.
D6  Gated rooms admit on proven keys (owner by its pinned key, grantee by the key its session
    proved; the grant is presented in a sealed mesh-room-join frame).
D7  Legacy Import: outbound-only routes with a mandatory fingerprint, legacy E2E on legacy
    sessions, quarantine (verified:false, profile legacy-import), the persisted sticky floor.
D8  The daemon's register / register-agent / agent-cmb paths are removed (EREMOVED); hello.
D9  Identities by id (nodes/by-id/<nodeId>, a name index, nodes/<name> symlink for one release);
    loadIdentity({create:false}) never mints; a 0.13 identity that cannot be established halts
    instead of being replaced; relocation (sym node export/import/host-key) with an encrypted
    bundle, a tombstone first and an independently pinned key; the interior submission socket
    with per-mission capabilities and its checks; one mind per node.

Docs: CHANGELOG 0.14.0, README security section, SECURITY.md.
Tests: the design's section 7, public vectors, negative cases, every conflict-matrix row, relay
sessions on a fake relay, Legacy Import against a real 0.13.17 node, migration on copies.
Suite at this commit: 1,020 unit tests pass (3 Windows-only skipped); integration 8/8.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 CHANGELOG.md                                |  155 +-
 README.md                                   |   69 +-
 SECURITY.md                                 |   73 +
 bin/sym-daemon.js                           |  179 +-
 bin/sym.js                                  |   92 +-
 lib/config.js                               |  376 ++++-
 lib/core/mmp-extensions.js                  |   18 +-
 lib/core/mmp-session.js                     |   43 +-
 lib/core/sealed-control.js                  |   90 +
 lib/discovery.js                            |   44 +-
 lib/emit-policy.js                          |   11 +-
 lib/emit.js                                 |   92 +-
 lib/frame-handler.js                        |  858 ++++------
 lib/interior.js                             |  260 +++
 lib/invite.js                               |   90 +
 lib/ipc-client.js                           |   18 +-
 lib/legacy-import.js                        |  402 +++++
 lib/node.js                                 | 1668 +++++++++----------
 lib/relay.js                                |  320 +++-
 lib/relocation.js                           |  244 +++
 lib/role-grant-store.js                     |  225 +--
 lib/roster-keys.js                          |  379 ++++-
 lib/session.js                              |  414 +++++
 package.json                                |    3 +-
 scripts/migration-rehearsal.js              |  107 ++
 scripts/two-stock-nodes-driver.cjs          |   14 +-
 tests/_core-secure.js                       |  160 ++
 tests/_fake-relay.js                        |   93 ++
 tests/admission-attestation.test.js         |   16 +-
 tests/audit-delivery-authorship.test.js     |  200 ++-
 tests/checkpoint-rate.test.js               |    2 +-
 tests/cmb-fetch-serves-v2.test.js           |   45 +-
 tests/cmb-fetch.test.js                     |  112 +-
 tests/cmb-signing.test.js                   |   63 +-
 tests/core-secure-authority.test.js         |  132 ++
 tests/core-secure-identity.test.js          |  225 +++
 tests/core-secure-legacy.test.js            |  206 +++
 tests/core-secure-node.test.js              |  307 ++++
 tests/core-secure-relay.test.js             |  253 +++
 tests/core-secure-session.test.js           |  284 ++++
 tests/discovery.test.js                     |   36 +-
 tests/earned-authority-node.test.js         |    6 +-
 tests/emit-room-claim.test.js               |   97 +-
 tests/frame-handler-author-key.test.js      |  180 +-
 tests/gossip-budget.test.js                 |    2 +-
 tests/gossip-lanes.test.js                  |  228 +--
 tests/inbound-cmb-surfacing.test.js         |   62 +-
 tests/inbound-frame-guard.test.js           |  136 +-
 tests/integration/e2e-admission.js          |    6 +-
 tests/integration/e2e-attestation-gossip.js |   13 +-
 tests/integration/e2e-checkpoint-witness.js |    6 +-
 tests/integration/e2e-cmb-path.js           |   35 +-
 tests/integration/e2e-payload-receive.js    |    6 +-
 tests/integration/legacy-import-013.js      |  148 ++
 tests/lineage-tether-neural.test.js         |    8 +-
 tests/mmp-v2-handshake-flow.test.js         |   15 +-
 tests/mmp-v2-session.test.js                |   41 +-
 tests/mmp-v2-two-node.test.js               |   19 +-
 tests/neural-after-decision.test.js         |   13 +-
 tests/node.test.js                          |  117 +-
 tests/p6-legacy-grandfather.test.js         |   11 +-
 tests/peer-info-quiet.test.js               |   53 +-
 tests/record-bounds.test.js                 |   76 +-
 tests/relay-clear-refusal.test.js           |   83 +-
 tests/relay-state.test.js                   |   43 +
 tests/remember-payload.test.js              |   20 +-
 tests/remember-targeted.test.js             |   17 +-
 tests/role-grant-rooted.test.js             |   34 +-
 tests/role-grant-store.test.js              |   31 +-
 tests/room-admission.test.js                |  180 +-
 tests/room-door-per-frame.test.js           |  166 +-
 tests/roster-keys.test.js                   |  211 ++-
 tests/send-frame-dead-socket.test.js        |   11 +-
 tests/stored-entry-annotations.test.js      |   41 +-
 tests/v2-author-binding.test.js             |   61 +-
 tests/wake-channels.test.js                 |  159 +-
 tests/wire-identity-ingress.test.js         |   89 +-
 77 files changed, 7415 insertions(+), 3387 deletions(-)
 create mode 100644 SECURITY.md
 create mode 100644 lib/core/sealed-control.js
 create mode 100644 lib/interior.js
 create mode 100644 lib/invite.js
 create mode 100644 lib/legacy-import.js
 create mode 100644 lib/relocation.js
 create mode 100644 lib/session.js
 create mode 100644 scripts/migration-rehearsal.js
 create mode 100644 tests/_core-secure.js
 create mode 100644 tests/_fake-relay.js
 create mode 100644 tests/core-secure-authority.test.js
 create mode 100644 tests/core-secure-identity.test.js
 create mode 100644 tests/core-secure-legacy.test.js
 create mode 100644 tests/core-secure-node.test.js
 create mode 100644 tests/core-secure-relay.test.js
 create mode 100644 tests/core-secure-session.test.js
 create mode 100644 tests/integration/legacy-import-013.js

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 812c3a90..c36ba418 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,9 +2,158 @@
 
 ## 0.14.0 (unreleased)
 
-A minor version because one change breaks readers outside sym: the store's annotations moved from
-the stored record to the entry (see Changed). It includes 0.13.15 and 0.13.16 (the witness-storm fix and
-its follow-ups) and 0.13.17 (the inbound-frame security hotfix).
+**Core Secure.** 0.14.0 makes every sym node an MMP v2.0 Core Secure participant (design
+"Core Secure identity: a peer is a proven session, never a hint", v2, 2026-10-02). It breaks the
+wire with 0.13 and older: a 0.13 node is reached only through an explicit Legacy Import route
+(below). It also breaks readers outside sym: the store's annotations moved from the stored record
+to the entry (see Changed). It includes 0.13.15 and 0.13.16 (the witness-storm fix and its
+follow-ups) and 0.13.17 (the inbound-frame security hotfix).
+
+### Core Secure — breaking
+
+- **A peer is a proven session.** A sym peer used to exist before anything was proven about it: on
+  TCP connect, on any first `handshake` frame (whose keys were pinned), on a relay's
+  `relay-peer-joined`. Now every transport — LAN TCP, loopback, relay — runs the MMP §5.2
+  handshake (client-hello → server-hello → client-finish, both proofs, key confirmation), and a
+  peer is the set of confirmed sessions that proved one nodeId with one identity key. Every
+  per-peer structure is keyed by the proven nodeId; a name is a label. The listener takes
+  `client-hello` first and nothing else; a legacy `handshake` is refused at once (counted,
+  said once a minute per address). Over the relay the node with the smaller nodeId sends
+  `client-hello` in an envelope; a relay session is bound to the relay `from` it was made on (a
+  hello naming another nodeId is refused),
+  torn down on `relay-peer-left`, superseded by a newer confirmed session for the same (nodeId,
+  key) (a restart under 4004), and never torn down by an unconfirmed hello. 10 s timeout.
+- **Discovery advertises the profile.** TXT `mmp=2.0` and `room=<room>` (and the same in the
+  loopback registry). A record without `mmp=2.0` is a legacy node: never dialled as Core Secure.
+  The lexicographically smaller nodeId dials (§5.1).
+- **Ephemeral E2E, sealed frames.** The persistent X25519 key (`e2e-keypair.json`) and the
+  per-peer shared-secret map are gone: each handshake uses a fresh X25519 key pair and derives
+  directional keys (§5.2.1). Records travel only as `cmb-encrypted` (§18.2.1), one sealed frame
+  per peer session. Every other post-handshake frame except ping/pong/error travels sealed as
+  `control-encrypted` (`mood` included: it is cognitive content). The receive counter advances
+  only after the AEAD opens (it advanced first, so one forged frame with the right sequence
+  desynchronised a session); a gap or replay closes the session and re-handshakes.
+- **Records are v2.0** (`MMP_EMIT_V2` on). Every record is signed `mmp-sig-v2.0` with the signed
+  author `createdByNodeId`; the receiver resolves the author key by `createdByNodeId` through
+  the key registry. An unsigned, legacy-suite or unresolvable record is refused (a legacy-suite
+  one on its own metric, `cmb-legacy-suite-refused`: old history is not counted as a forgery).
+  **Release
+  note (M12):** "X via Y" deliveries from authors this node has never proven, and no grant
+  vouches, no longer surface. That is §18.3.1's rule, not a regression.
+- **Binding from the signed `metadata.to`.** Directed versus room-bound (§9.2.2) is the record's
+  signed, AAD-bound `metadata.to`; the frame flags `to`/`directed` are no longer read. A
+  `remember({ payload })` payload now rides as the record's signed application section (§8.8.3)
+  and is given back to the receiver as `cmb.payload`.
+- **The frame table.** `cmb` (plaintext) is refused (Legacy Import sessions only);
+  `cmb-fetch` may name one `key` or up to 32 `keys`; each record found goes out as its own
+  sealed `cmb-encrypted` frame, then one sealed `cmb-fetch-result` that carries only the
+  correlation id and the key lists, `{ reqId, found: [...], notFound: [...] }` (it carried the
+  record in the clear); `role-grant`/`role-revoke` are verified against
+  the grant chain, never the delivering session; `peer-info` and `wake-channel` are learned only
+  for the session's own nodeId (gossip about other nodes and the relay's peer list are hints,
+  never stored); `message` is retired: `send()` sends a directed CMB whose signed application
+  section marks it a message, and the receiver raises its `message` event from it;
+  `attestation`, `checkpoint`, `witness`, `node-stats` go only to sessions that selected
+  `sym-attest-v1`, `xmesh-insight` only with `xmesh-insight-v1`; `state-sync` is refused. Records
+  replayed as context on connect are announced in a sealed `cmb-anchors` frame (the `_anchor`
+  frame flag could not ride a sealed record).
+- **One key registry, an explicit conflict matrix.** No source ever overrides a different key
+  (the 0.13 "strictly stronger source overrides" rule is gone). A different key for a bound
+  nodeId, from any source, is a conflict: refused, recorded (`roster-conflicts.jsonl`), shown in
+  `status().coreSecure.keyConflicts` and `sym status`; the operator resolves it
+  (`sym keys <name> resolve <nodeId> <key>`). The configured anchor is read from configuration at
+  every start and never persisted, so re-pinning it out of band takes effect. Every 0.13
+  `handshake` entry becomes `legacy-claim` on first load: the expected key, never one that
+  verifies; a proven session presenting it binds `proven`, one presenting another key is a
+  conflict. `roster-keys.jsonl` gets a version marker line (a 0.13 rollback skips it).
+- **Authority follows the key.** `resolveRole(nodeId, key, at)`: a grant confers its role only on
+  the key its `granteeKey` names. Grant chains are verified top-down with the key each verified
+  grant vouches, never the registry's key for the grantor. Every role-grant carries `granteeKey`
+  (one without it is malformed), and `grantRole` refuses a grantee with no proven or pinned key
+  (or pass `{ granteeKey }`).
+- **Room admission on proven keys.** A gated room admits its owner by its pinned key and a grantee
+  whose room-join grant binds the key its session proved (the grant is presented in a sealed
+  `mesh-room-join` frame); `roomGate().admits` is now `grant-holders`. The `provenPublicKey`
+  strip and the "refuses everyone" fallback are gone.
+- **The Class 1 emitter speaks Core Secure.** `sym emit` / `lib/emit.js` run the v2 handshake
+  and send sealed records. The room is explicit: an emitter that names none is in `default`, and
+  a node in another room refuses it at the handshake.
+
+### Core Secure — new API (for hosts: xmesh, mesh-channel)
+
+- `node.on('verified-record', ({ record, session, verification }) => …)`: every record that
+  passed §8.8.5, with the proven session facts (`nodeId`, `name`, `identityKey`, `sessionId`,
+  `transport`, `role`, `room`, `extensions`, `confirmedAt`, `implementation`, `profile`) and
+  `verification` (`suite`, `assertionId`, `authorNodeId`, `authorName`, `authorKey`,
+  `authorKeySource`, `audience`, `room`, `to`, `relayed`, `anchor`). Hosts no longer reach into
+  `_frameHandler`, `_peerSharedSecrets` or `_identityKey`; `frame-received` (raw, unverified
+  frames) is removed.
+- `loadIdentity({ nodeId | name, create })` and `new SymNode({ name, nodeId, create })`:
+  identities live at `nodes/by-id/<nodeId>/` with the name as an index; `create: false` throws
+  `EIDENTITYABSENT` instead of minting; a tombstoned identity throws `EIDENTITYTOMBSTONED`.
+  `renameIdentity(old, new)` moves the index, never the identity. A 0.13 `nodes/<name>/`
+  directory moves once, idempotently, and `nodes/<name>` stays as a symlink for one release so a
+  0.13 rollback reads the old path.
+- `sym node export <name> --out <file> (--passphrase-env VAR | --to-host <key>)` tombstones the
+  node, then writes its encrypted bundle; `sym node import <file> --expect-node <id>
+  [--expect-key <k> | --expect-fingerprint sha256:…]` verifies it against an independently
+  pinned key (or this host's key registry) and refuses a re-keyed bundle; `sym node host-key`.
+- `node.interior()`: the interior submission path for the node's mind — `startMind({ kinds,
+  allowTo, ratePerMinute })` issues a per-mission capability (`queueMind` waits its turn; one
+  mind per node), `submit(capability, { kind, categories, to, parents, payload })` and the
+  interior socket (`listen()`, newline JSON) check audience, size (64 KiB text, 512 KiB
+  application), rate, declared kinds and lineage before the node signs; `endMind` revokes.
+- `node.connectTransport(transport, { role, expectNodeId })` runs the handshake over a transport
+  the host provides; `node.inviteURL()` and `node.acceptInvite(url)` (invites carry the issuer's
+  `node` and `key`; accepting pins the issuer only where that nodeId is unbound); `lib/invite.js`.
+- `sym keys <name> [conflicts | resolve | reset-floor]`.
+
+### Legacy Import (temporary: network Legacy Import is removed in 0.15.0)
+
+- Off by default. A route (`legacyRoutes: [{ nodeId, endpoint: 'host:port' | 'relay', key |
+  fingerprint }]`, or `legacy-routes.json` in the node dir) names a 0.13 peer; the identity key
+  fingerprint is mandatory and is pinned. This node always dials a route itself and never accepts
+  a legacy hello. Over the relay it sends its legacy hello to the routed nodeId, and takes only
+  records whose signature verifies against the pinned key.
+- What it sends on a legacy session: its records as legacy `cmb` under the legacy E2E
+  construction (never plaintext). `sym status` says the session uses legacy encryption, with no
+  forward secrecy and no transcript proof. Everything received is stored `verified: false`,
+  `profile: 'legacy-import'`, never given authority. Connection-level frames are hints.
+- The sticky floor is the registry's persisted proven binding: once a nodeId has proven itself
+  over Core Secure its route is refused until an operator reset (`sym keys <name> reset-floor`).
+
+### Removed
+
+- The daemon's `register` virtual nodes, `register-agent` hosted agents and `agent-cmb` path
+  (which broadcast a plain `cmb` with a client-supplied `from`): one agent, one node; a node's
+  mind uses its interior. Local clients send `hello` and subscribe with `listen`.
+- `_peerSharedSecrets`, `_pinPeerKey`, `_peerIdentityKeys`, `_deriveAndStoreSecret`,
+  `_buildHandshake` (outside Legacy Import), `_createPeer`/`_addPeer`, per-connection gossip
+  lanes (the gossip budget is kept per proven peer), the `frame-received` event, `state-sync`.
+
+### Relay
+
+- **4006 and 4007 are hard stops, like 4004.** The client did not handle 4006 (§4.4.7: the
+  existing holder is the legitimate one) and retried it at the normal backoff. Now 4006, and 4007
+  (draft MMP spec PR meshcognition-website#20: the relay binds this nodeId to a different key) are
+  said once, loudly, kept in `state().stopped` / `status().relayState.stopped` with phases
+  `duplicate-rejected` and `key-conflict`, reported to the host (`identity-collision` with `code`
+  and `kind`, and a `relay-hard-stop` metric), and never reconnected. relay-auth v2 (the
+  challenge in that PR) is not implemented until it merges.
+- A relay socket that `destroy()` let go no longer schedules a reconnect when its close arrives
+  (a stopped node object kept redialling when its host reported it still running).
+- The client paces everything it sends under sym-relay's limit (25 frames/s, burst 300, then
+  4008) at 20 frames/s, burst 200, and uses the fan-out envelope `{ fanout: [{ to, payload }] }`
+  (one message for many recipients, at most 64 entries, never a recipient twice) when the relay
+  lists `fanout` in `relay-peers.features` (MMP spec draft PR meshcognition-website#25) —
+  sym-relay 0.6.0.
+
+### Known limits (design §5, said in README and SECURITY.md)
+
+- First contact with no anchor, invite or grant is trust on first proven use.
+- Relay eviction: `relay-auth` is unproven and 4004 lets a token holder evict a node; an evicted
+  node re-handshakes and a squatter gets no session.
+- No key rotation (§3.4). A same-user process can read identity files.
 
 Fixes from the MMP 2.0 conformance audit's open findings, the 0.13.12 known limits, the Windows test
 debt, and the daemon's log flood. Every item has a test that fails without its fix.
diff --git a/README.md b/README.md
index 23df92cd..8c7c7a25 100644
--- a/README.md
+++ b/README.md
@@ -113,31 +113,52 @@ mesh-channel are open source.
 ## Security, and what the relay can and cannot see
 
 We treat this as the product's first property, and we state it as mechanisms with their
-limits rather than as a promise.
-
-- **Every node signs.** A node's identity is an Ed25519 keypair on its own disk; every CMB it
-  emits is signed, and a receiver verifies the signature against the key it pinned at the
-  handshake.
-- **Content is encrypted for each peer.** At the handshake two nodes exchange X25519 public
-  keys and derive a secret only they hold. A CMB's seven categories — the content — are
-  encrypted for each recipient separately before they leave the sender. This is the same on
-  the local network and through a relay.
-- **Never in the clear through a relay** (engine 0.13.7 and later). If a peer reached only
-  over a relay presented no encryption key, the sender sends it nothing, says so once in its
-  log, and `sym status` shows the peer with `e2e: false, clearRefused: true`. On the local
-  network a keyless peer still receives, because the frame never leaves that network.
-- **The relay is a forwarder that cannot read what it carries.** `@sym-bot/sym-relay` reads
-  only the routing envelope (who, to whom, which room), forwards the sealed payload, and drops
-  it: no message store, no keys, no addresses. A channel is the set of nodes connected with
-  the same token; a self-serve token must be 32 characters or more, and a refused connection
-  is logged with the token's length, never the token.
+limits rather than as a promise. Since 0.14 every sym node is an MMP 2.0 **Core Secure**
+participant.
+
+- **A peer is a proven session, never a hint.** Two nodes run the MMP §5.2 handshake on every
+  transport — LAN, loopback and relay. Each proves possession of its Ed25519 identity key over
+  a transcript that binds both nonces, both nodeIds, both keys, the room and the extensions,
+  and confirms the X25519 key schedule. Nothing about a peer — its key, its room membership, its
+  roles — exists until both proofs validate. A discovery record or a relay roster entry only
+  decides whom to dial.
+- **One key per nodeId, for life.** The first proven key for a nodeId is bound; a session that
+  later proves the same nodeId with a different key is a *conflict*: refused, recorded, and
+  shown in `sym status` for you to resolve (`sym keys <name> resolve`). No source overrides a
+  different key.
+- **Every record is signed, and verified by its author's node id.** A record is accepted only
+  if it is a signed `mmp-sig-v2.0` record whose author key this node resolves by
+  `createdByNodeId` — a key it proved, pinned from an invite, or holds from an anchor-rooted
+  grant. An unsigned, legacy or unresolvable record is refused.
+- **Content is sealed per session.** Records travel only as `cmb-encrypted` frames, and every
+  other frame (mood, gossip, grants) as a sealed control frame, under directional keys derived
+  fresh for each handshake (X25519, HKDF-SHA256, ChaCha20-Poly1305). A relay sees routing
+  envelopes and ciphertext. There is no long-lived encryption key to steal later.
+- **Authority follows the key.** A role grant names the key it confers authority on, and a
+  grant chain is checked with the keys each grant vouches, from the anchor down.
 - **Each node decides what it keeps.** Admission is receiver-local: a node runs its own
-  evaluation on every block it hears and stores only what it admits.
-
-What this does not cover: a room name or relay token is not an enterprise trust boundary —
-anyone holding the token is in the channel; the envelope (names, room, timing, sizes) is
-visible to the relay operator; and a peer's own machine is trusted with everything that peer
-admitted.
+  evaluation on every record it hears and stores only what it admits.
+
+What this does not solve, said plainly:
+
+- **First contact** with a node you hold no anchor, invite or grant for is *trust on first
+  proven use*: the handshake proves the peer holds the key it presents, not that the key is
+  the one you meant. Pin it out of band (an invite carries the issuer's key) when that matters.
+- **Relay eviction.** `relay-auth` is not proven, and a relay token holder can make the relay
+  replace another node's connection (close 4004). A squatter gets no session — it cannot
+  prove the key — and an evicted node re-handshakes, but the relay path can be interrupted.
+- **Key compromise.** There is no key rotation: a node whose private key leaks must be
+  replaced, under a new nodeId.
+- **Your own machine.** Another process running as the same user can read the identity file.
+  Operating-system isolation is out of scope.
+- **Legacy peers (0.13 and older)** are reached only through explicit Legacy Import routes,
+  which use the old encryption (no forward secrecy, no transcript proof); what they send is
+  quarantined as unverified. Network Legacy Import is removed in 0.15.0.
+
+A room name or relay token is still not an enterprise trust boundary — anyone holding the
+token is in the channel; the envelope (who, to whom, room, timing, sizes) is visible to the
+relay operator; and a peer's own machine is trusted with everything that peer admitted. See
+[SECURITY.md](SECURITY.md).
 
 ## Current boundaries
 
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 00000000..2f618e08
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,73 @@
+# Security
+
+This file says what `@sym-bot/sym` protects, how, and what it does not. It is kept honest on
+purpose: a property stated here is one the code enforces and a test exercises.
+
+## Reporting
+
+Report a vulnerability privately to info@sym.bot (the address in package.json). Please do not open a public issue for it.
+
+## What sym 0.14 (Core Secure) enforces
+
+- **Proven sessions.** Every peer connection — LAN TCP, loopback, relay — runs the MMP v2.0
+  §5.2 handshake: client-hello, server-hello, client-finish. Each side proves its Ed25519
+  identity key over the transcript (both nonces, nodeIds, identity and X25519 keys, names,
+  implementations, room, protocol version, offered and selected extensions) and confirms the
+  HKDF key schedule. A failed proof, a wrong confirmation, an unechoed nonce, a stripped
+  extension, a room mismatch, an all-zero shared secret or any frame before client-finish
+  closes the connection with no peer state kept. The listener takes `client-hello` first and
+  nothing else; a legacy one-frame `handshake` is refused at once.
+- **Fresh keys per handshake.** Each handshake uses a fresh X25519 key pair; there is no
+  persistent encryption key and no per-peer secret map.
+- **Sealed, ordered channel.** Records travel only as `cmb-encrypted` (ChaCha20-Poly1305 under
+  the session's directional traffic key, AEAD-bound to session, direction, sequence and the
+  record's identity). Every other post-handshake frame except ping, pong and error travels as a
+  sealed `control-encrypted` frame on the same ordered sequence. The receive counter advances
+  only after a frame authenticates, so a forged frame moves nothing; an authentic frame out of
+  order (replay, rollback, gap) closes the session, which re-handshakes.
+- **One key per nodeId.** The key registry binds a nodeId to the first key a proven session, an
+  out-of-band pin (invite, Legacy Import route) or an anchor-rooted grant gives it, and never
+  replaces it: a different key from any source is a recorded conflict an operator resolves.
+  Keys pinned before 0.14 from unproven hellos become `legacy-claim`: expected, never trusted
+  to verify, so a squatter racing the upgrade cannot take an honest node's id.
+- **Records verified by author node id.** A record is admitted, delivered or exposed to a host
+  (`verified-record`) only after §8.8.5: application bytes, category keys and cognition key,
+  assertion identity, the Ed25519 signature against the key resolved by `createdByNodeId`, and
+  the signed audience (room, recipient). Directed versus room-bound delivery is decided by the
+  signed `metadata.to`, never by a relay envelope.
+- **Authority follows the key.** A role grant must name `granteeKey`; it confers its role only
+  on that key, and a chain is verified top-down with each grant's vouched key. A grantor whose
+  nodeId an impostor holds keeps exactly its vouched authority; the impostor gets none.
+- **Gated rooms on proven keys.** A gated room admits its owner by the owner's pinned key and a
+  grantee when its room-join grant binds the key its session proved. A copied grant admits
+  nobody.
+- **Moved, not copied.** `sym node export` tombstones a node before its encrypted bundle exists,
+  so the source refuses to start it; `sym node import` verifies the bundle against an
+  independently pinned key and refuses a re-keyed bundle.
+- **The interior.** A node's mind submits through the node's local interior socket with a
+  per-mission capability; the node checks audience, size, rate, declared kinds and lineage
+  before it signs. One mind per node.
+
+## What it does not solve
+
+- **First contact is trust on first proven use.** Without an anchor, an invite carrying the
+  issuer's key, or a grant, the first key a session proves for a nodeId is the one bound. The
+  handshake proves possession, not intent.
+- **Relay eviction.** `relay-auth` identity is not proven (MMP §4.4.1), and the relay replaces a
+  connection that re-authenticates under the same nodeId (close 4004, §4.4.7). A token holder
+  can therefore interrupt another node's relay path. It cannot impersonate it: it gets no
+  session without the key. The client stops for good on 4004, 4006 (the existing holder is the
+  legitimate one) and 4007 (a relay that binds this nodeId to another key), and says so in
+  status, so an eviction is visible rather than a reconnect loop. The fix (relay-auth proving key
+  possession, MMP spec PR meshcognition-website#20) is drafted, not implemented.
+- **No key rotation** (MMP §3.4). A compromised key means a new identity.
+- **The local machine.** Identity files are readable by any process running as the same user.
+  Operating-system isolation is out of scope.
+- **Legacy Import is weaker, and temporary.** A route to a 0.13 node uses the legacy encryption
+  (X25519 + AES-256-GCM per connection: no forward secrecy, no transcript proof). Everything
+  received over it is stored `verified: false`, `profile: legacy-import`, and given no
+  authority. A nodeId that has proven itself over Core Secure has its legacy route refused (a
+  persisted floor) until an operator resets it. Network Legacy Import is removed in 0.15.0.
+- **Metadata.** The relay operator sees routing envelopes: who, to whom, room, timing, sizes.
+- **A room name or relay token is not an enterprise trust boundary.** Anyone holding the token
+  is in the channel, and an invite that carries a token is a secret.
diff --git a/bin/sym-daemon.js b/bin/sym-daemon.js
index 827bde32..ea1aded0 100755
--- a/bin/sym-daemon.js
+++ b/bin/sym-daemon.js
@@ -177,10 +177,11 @@ const node = new SymNode({
 
 // ── IPC Server (Unix Socket) ───────────────────────────────────
 
-/** Connected virtual nodes. socketId → { socket, name, cognitiveProfile } */
-const virtualNodes = new Map();
-/** Hosted agents (Section 3.2 + 4.3). socketId → { socket, nodeId, name, publicKey, activity } */
-const hostedAgents = new Map();
+// sym 0.14 (design D8): ONE AGENT, ONE NODE. The daemon's virtual nodes (`register`), hosted agents
+// (`register-agent`) and their outbound path (`agent-cmb`, which broadcast a plain `cmb` with a
+// client-supplied `from`) are gone: an autonomous agent is its own node, with its own identity, and a
+// node's reasoning process is its interior (lib/interior.js), which has no mesh identity. Local
+// clients query the daemon's node and subscribe to its events with `listen` (MMP §14.9).
 /** Agent activity state. name → { status, timestamp } */
 const agentActivity = new Map();
 /** Task board — persisted to ~/.sym/tasks.json */
@@ -260,10 +261,6 @@ function onIPCConnection(socket) {
   });
 
   socket.on('close', () => {
-    const vn = virtualNodes.get(socketId);
-    if (vn) { log(`Virtual node disconnected: ${vn.name}`); virtualNodes.delete(socketId); }
-    const ha = hostedAgents.get(socketId);
-    if (ha) { log(`Hosted agent disconnected: ${ha.name}`); hostedAgents.delete(socketId); }
     listeners.delete(socketId);
   });
 
@@ -271,8 +268,7 @@ function onIPCConnection(socket) {
     if (err.code !== 'EPIPE' && err.code !== 'ECONNRESET') {
       log(`IPC socket error: ${err.message}`);
     }
-    virtualNodes.delete(socketId);
-    hostedAgents.delete(socketId);
+    listeners.delete(socketId);
   });
 }
 
@@ -353,64 +349,20 @@ const NO_INSIGHT_ENGINE = 'this node runs no insight engine';
  */
 function handleIPCMessage(socketId, socket, msg) {
   switch (msg.type) {
-    case 'register': {
-      virtualNodes.set(socketId, {
-        socket,
-        name: msg.name || `virtual-${socketId}`,
-        cognitiveProfile: msg.cognitiveProfile || null,
-      });
-      sendIPC(socket, {
-        type: 'registered',
-        nodeId: node._identity?.nodeId,
-        name: node.name,
-        relay: relayUrl,
-      });
-      log(`Virtual node registered: ${msg.name}`);
+    // A client's opener: who this daemon's node is. (The `register` virtual-node path is gone in
+    // 0.14, design D8: a client is not a node.)
+    case 'hello':
+      sendIPC(socket, { type: 'result', action: 'hello', nodeId: node._identity?.nodeId, name: node.name, relay: relayUrl });
       break;
-    }
 
-    // ── Hosted Agent Registration (Section 4.3.1) ──────────
-    case 'register-agent': {
-      if (!msg.nodeId || !msg.name) {
-        sendIPC(socket, { type: 'error', message: 'register-agent requires nodeId and name' });
-        break;
-      }
-      hostedAgents.set(socketId, {
-        socket,
-        nodeId: msg.nodeId,
-        name: msg.name,
-        publicKey: msg.publicKey || null,
-        svafFieldWeights: msg.svafFieldWeights || null,
-        svafFreshnessSeconds: msg.svafFreshnessSeconds || null,
-      });
+    case 'register':
+    case 'register-agent':
+    case 'agent-cmb':
       sendIPC(socket, {
-        type: 'registered-agent',
-        nodeId: msg.nodeId,
-        daemonNodeId: node._identity?.nodeId,
-        relay: relayUrl,
-        peers: node.peers(),
+        type: 'result', action: msg.type, code: 'EREMOVED',
+        error: `'${msg.type}' was removed in sym 0.14 (one agent, one node): an agent runs its own node; a node's mind submits through its interior socket. Use 'hello' and 'listen' for local clients.`,
       });
-      log(`Hosted agent registered: ${msg.name} (${msg.nodeId.slice(0, 8)})`);
       break;
-    }
-
-    // ── Hosted Agent Outbound CMB (Section 4.3.2) ─────────
-    case 'agent-cmb': {
-      // Hosted agent produced a CMB — broadcast to remote peers with agent's nodeId
-      if (!msg.cmb || !msg.from) break;
-      const frame = { type: 'cmb', timestamp: msg.timestamp || Date.now(), cmb: msg.cmb, from: msg.from, fromName: msg.fromName };
-      // Broadcast via all peer transports
-      for (const [, peer] of node._peers) {
-        peer.transport.send(frame);
-      }
-      // Also forward to other hosted agents (local mesh)
-      for (const [id, agent] of hostedAgents) {
-        if (id !== socketId) {
-          sendIPC(agent.socket, { type: 'event', event: 'frame-received', data: { peerId: msg.from, peerName: msg.fromName, frame } });
-        }
-      }
-      break;
-    }
 
     case 'agent-activity':
       if (msg.name && msg.status) {
@@ -462,7 +414,7 @@ function handleIPCMessage(socketId, socket, msg) {
       tasks.set(id, task);
       saveTasks();
       sendIPC(socket, { type: 'result', action: 'task-create', task });
-      broadcastToHostedAgents({ type: 'event', event: 'task-created', data: task });
+      broadcastToListeners({ type: 'event', event: 'task-created', data: task });
       break;
     }
 
@@ -487,7 +439,7 @@ function handleIPCMessage(socketId, socket, msg) {
       task.updatedAt = now;
       saveTasks();
       sendIPC(socket, { type: 'result', action: 'task-update', task });
-      broadcastToHostedAgents({ type: 'event', event: 'task-updated', data: task });
+      broadcastToListeners({ type: 'event', event: 'task-updated', data: task });
       break;
     }
 
@@ -553,26 +505,9 @@ function handleIPCMessage(socketId, socket, msg) {
       log(`Listener registered (socket ${socketId}${msg.categoryWeights ? ', with category weights' : ''})`);
       break;
 
-    case 'peers': {
-      const hostedNames = new Set(Array.from(hostedAgents.values()).map(a => a.name));
-      const meshPeers = node.peers().filter(p => !hostedNames.has(p.name));
-      const hosted = Array.from(hostedAgents.values()).map(a => {
-        const act = agentActivity.get(a.name);
-        return {
-          id: a.nodeId?.slice(0, 8) || '',
-          name: a.name,
-          connected: true,
-          lastSeen: Date.now(),
-          coupling: 'hosted',
-          drift: 0,
-          source: 'ipc',
-          activity: act?.status || 'idle',
-          svafFieldWeights: a.svafFieldWeights || null,
-        };
-      });
-      sendIPC(socket, { type: 'result', action: 'peers', peers: [...meshPeers, ...hosted] });
+    case 'peers':
+      sendIPC(socket, { type: 'result', action: 'peers', peers: node.peers() });
       break;
-    }
 
     case 'metrics':
       sendIPC(socket, { type: 'result', action: 'metrics', metrics: node.metrics() });
@@ -583,10 +518,6 @@ function handleIPCMessage(socketId, socket, msg) {
         type: 'result',
         action: 'status',
         status: node.status(),
-        virtualNodes: Array.from(virtualNodes.values()).map(v => v.name),
-        hostedAgents: Array.from(hostedAgents.values()).map(a => ({
-          nodeId: a.nodeId, name: a.name,
-        })),
       });
       break;
 
@@ -625,17 +556,6 @@ function sendIPC(socket, msg) {
   try { socket.write(JSON.stringify(msg) + '\n'); } catch {}
 }
 
-/**
- * Broadcast to all hosted agents (Section 4.3.2).
- * Hosted agents receive raw frames — they run their own SVAF.
- */
-function broadcastToHostedAgents(msg) {
-  const data = JSON.stringify(msg) + '\n';
-  for (const [id, agent] of hostedAgents) {
-    try { agent.socket.write(data); } catch { hostedAgents.delete(id); }
-  }
-}
-
 // MMP Section 13.9.2: Subscriber Category Weights.
 // If subscriber declared category weights, evaluate CMB relevance before delivery.
 function shouldDeliverToListener(listener, msg) {
@@ -669,8 +589,8 @@ function broadcastToListeners(msg) {
   }
 }
 
-/** Forward mesh events to all registered virtual nodes. */
-function forwardEventsToVirtualNodes() {
+/** Forward mesh events to the local subscribers (`listen`, MMP §14.9). */
+function forwardEventsToListeners() {
   const events = [
     ['mood-delivered', (d) => ({ type: 'event', event: 'mood-delivered', data: d })],
     ['mood-rejected', (d) => ({ type: 'event', event: 'mood-rejected', data: d })],
@@ -680,11 +600,10 @@ function forwardEventsToVirtualNodes() {
   ];
 
   for (const [event, formatter] of events) {
-    node.on(event, (data) => broadcastToVirtualNodes(formatter(data)));
+    node.on(event, (data) => broadcastToListeners(formatter(data)));
   }
 
   node.on('message', (from, content) => {
-    broadcastToVirtualNodes({ type: 'event', event: 'message', data: { from, content } });
     broadcastToListeners({ type: 'event', event: 'message', data: { from, content, timestamp: Date.now() } });
 
     // Feed messages (including Telegram) into the insight engine, if this node has one. A stock
@@ -713,26 +632,15 @@ function forwardEventsToVirtualNodes() {
   });
 
   node.on('xmesh-insight', (data) => {
-    broadcastToVirtualNodes({ type: 'event', event: 'xmesh-insight', data });
+    broadcastToListeners({ type: 'event', event: 'xmesh-insight', data });
   });
 
   node.on('memory-received', ({ from, entry, decision }) => {
     // xMesh ingestion already happens in frame-handler after SVAF evaluation.
-    broadcastToVirtualNodes({ type: 'event', event: 'memory-received', data: { from, content: entry.content, decision } });
+    broadcastToListeners({ type: 'event', event: 'memory-received', data: { from, content: entry.content, decision } });
   });
 }
 
-/**
- * Broadcast a message to all connected virtual nodes.
- * @param {object} msg — message to broadcast
- */
-function broadcastToVirtualNodes(msg) {
-  const data = JSON.stringify(msg) + '\n';
-  for (const [id, vn] of virtualNodes) {
-    try { vn.socket.write(data); } catch { virtualNodes.delete(id); }
-  }
-}
-
 // ── launchd Install/Uninstall ──────────────────────────────────
 
 /**
@@ -867,7 +775,8 @@ function showStatus() {
           console.log(`  relay:    ${s.relayConnected ? 'connected' : 'disconnected'} (${s.relay || 'none'})`);
           console.log(`  peers:    ${s.peerCount}`);
           console.log(`  memories: ${s.memoryCount}`);
-          console.log(`  virtual:  ${(msg.virtualNodes || []).join(', ') || 'none'}`);
+          if (s.coreSecure) console.log(`  sessions: ${s.coreSecure.sessions.confirmed} confirmed (Core Secure)${s.coreSecure.keyConflicts.length ? `, ${s.coreSecure.keyConflicts.length} KEY CONFLICT(S) to resolve: sym keys` : ''}`);
+          if (s.legacyImport && s.legacyImport.sessions.length) console.log(`  legacy:   ${s.legacyImport.sessions.length} Legacy Import session(s) — legacy encryption, no forward secrecy, no transcript proof`);
           console.log(`  socket:   ${SOCKET_PATH}`);
         }
       } catch {}
@@ -951,17 +860,9 @@ async function main() {
   loadTasks();
   log(`Loaded ${tasks.size} task(s)`);
 
-  forwardEventsToVirtualNodes();
-
-  // Section 4.3.2: forward raw frames to hosted agents (before SVAF evaluation)
-  node.on('frame-received', ({ peerId, peerName, frame }) => {
-    if (hostedAgents.size > 0) {
-      broadcastToHostedAgents({ type: 'event', event: 'frame-received', data: { peerId, peerName, frame } });
-    }
-  });
+  forwardEventsToListeners();
 
-  // When daemon accepts a CMB (from peer or local observe), forward to hosted agents
-  // so they can ingest it into their local memory via their own SVAF
+  // A CMB the daemon's node accepted (from a peer or a local observe) goes to the subscribers.
   node.on('cmb-accepted', (entry) => {
     broadcastToListeners({
       type: 'event', event: 'cmb-accepted',
@@ -973,31 +874,9 @@ async function main() {
         timestamp: entry.timestamp || Date.now(),
       },
     });
-    if (hostedAgents.size > 0) {
-      // Wrap as a cmb frame so hosted agent's SVAF can evaluate it
-      const frame = {
-        type: 'cmb',
-        timestamp: entry.timestamp || entry.storedAt || Date.now(),
-        cmb: entry.cmb,
-        source: entry.source,
-      };
-      broadcastToHostedAgents({ type: 'event', event: 'frame-received', data: {
-        peerId: entry.peerId || entry.source || 'daemon',
-        peerName: entry.source || 'daemon',
-        frame,
-      }});
-    }
   });
 
-  // Forward peer events to hosted agents
-  node.on('peer-joined', (data) => {
-    broadcastToHostedAgents({ type: 'event', event: 'peer-joined', data });
-    broadcastToListeners({ type: 'event', event: 'peer-joined', data: { name: data.name || 'unknown', peerId: data.peerId } });
-  });
-  node.on('peer-left', (data) => {
-    broadcastToHostedAgents({ type: 'event', event: 'peer-left', data });
-    broadcastToListeners({ type: 'event', event: 'peer-left', data: { name: data.name || 'unknown', peerId: data.peerId } });
-  });
+  // peer-joined/left reach the subscribers through forwardEventsToListeners.
 
   if (!(await startIPCServer())) {
     log(`Another sym-daemon is serving ${SOCKET_PATH}; not starting a second one.`);
diff --git a/bin/sym.js b/bin/sym.js
index 0743025c..a0b49e95 100755
--- a/bin/sym.js
+++ b/bin/sym.js
@@ -29,6 +29,12 @@ const { recordCreatedBy } = require('../lib/record');
  *   sym rooms                        # Discover rooms live on the LAN
  *   sym join <name>                   # Switch into a room ("room chat")
  *   sym leave                         # Return to the default global mesh
+ *   sym keys <name> [conflicts]       # Key registry: bindings and conflicts (Core Secure, 0.14)
+ *   sym keys <name> resolve <nodeId> <key>    # Operator: bind nodeId to key (pinned), clearing its conflicts
+ *   sym keys <name> reset-floor <nodeId>      # Operator: let a Legacy Import route be used again
+ *   sym node export <name> --out <file> (--passphrase-env VAR | --to-host <x25519 pub>)
+ *   sym node import <file> --expect-node <id> [--expect-key <k> | --expect-fingerprint sha256:…] [--passphrase-env VAR]
+ *   sym node host-key                 # This host's X25519 key for receiving node bundles
  *   sym logs                          # Tail daemon logs
  *   sym version                       # Show version
  *
@@ -102,6 +108,8 @@ switch (command) {
   case 'catchup': cmdIPC({ type: 'catchup' }, (msg) => { console.log(`Catchup triggered for ${msg.agents || 0} hosted agent(s).`); }); break;
   case 'task':    cmdTask(); break;
   case 'logs':    cmdLogs(); break;
+  case 'keys':    cmdKeys(); break;
+  case 'node':    cmdNode(); break;
   default:
     console.error(`Unknown command: ${command}`);
     console.error('Run sym --help for usage.');
@@ -110,6 +118,77 @@ switch (command) {
 
 // ── Command Implementations ───────────────────────────────────
 
+/**
+ * The key registry of a stopped node (design D3), offline: a running node holds its registry in
+ * memory, so the operator stops it first (or uses the node's own API).
+ */
+function cmdKeys() {
+  const config = require('../lib/config');
+  const { RosterKeyRegistry, keyFingerprint } = require('../lib/roster-keys');
+  const name = args[1];
+  if (!name) { console.error('usage: sym keys <name> [conflicts | resolve <nodeId> <key> | reset-floor <nodeId>]'); process.exit(1); }
+  const nodeId = config.nodeIdForName(name);
+  if (!nodeId) { console.error(`no node named "${name}" on this host`); process.exit(1); }
+  const dir = config.nodeDirById(nodeId);
+  const lock = config.readLockFile(path.join(dir, 'lock.pid'));
+  const sub = args[2] || 'list';
+  if ((sub === 'resolve' || sub === 'reset-floor') && lock && config.lockIsHeldByLiveProcess(lock)) {
+    console.error(`${name} is running (PID ${lock.pid}): stop it before changing its key registry`);
+    process.exit(1);
+  }
+  const reg = new RosterKeyRegistry({ dir: path.join(dir, 'roster-keys') });
+  if (sub === 'resolve') {
+    const r = reg.resolveConflict(args[3], args[4]);
+    if (!r.resolved) { console.error(`not resolved: ${r.reason}`); process.exit(1); }
+    console.log(`${args[3]} is now bound to ${keyFingerprint(args[4])} (pinned, by the operator)`);
+    return;
+  }
+  if (sub === 'reset-floor') {
+    reg.resetFloor(args[3]);
+    console.log(`the sticky floor of ${args[3]} is reset: its Legacy Import route may be used again`);
+    return;
+  }
+  const conflicts = reg.conflicts();
+  if (jsonFlag) { console.log(JSON.stringify({ bindings: reg.entries(), conflicts }, null, 2)); return; }
+  if (sub !== 'conflicts') {
+    for (const e of reg.entries()) console.log(`${e.nodeId}  ${e.source.padEnd(12)}  ${keyFingerprint(e.key).slice(0, 23)}…`);
+  }
+  if (conflicts.length === 0) console.log('no key conflicts');
+  for (const c of conflicts) {
+    console.log(`CONFLICT ${c.nodeId}: bound ${keyFingerprint(c.had).slice(0, 23)}… (${c.hadSource}); refused ${keyFingerprint(c.got).slice(0, 23)}… (${c.gotSource}) — resolve: sym keys ${name} resolve ${c.nodeId} <key>`);
+  }
+}
+
+/** Move a node between hosts (design D9.2): export (tombstone first), import (independently pinned). */
+function cmdNode() {
+  const relocation = require('../lib/relocation');
+  const sub = args[1];
+  const passphrase = () => { const v = flagValue('--passphrase-env'); return v ? process.env[v] : undefined; };
+  try {
+    if (sub === 'host-key') {
+      const k = relocation.hostKey();
+      console.log(k.publicKey);
+      return;
+    }
+    if (sub === 'export') {
+      const r = relocation.exportNode({ name: args[2], out: flagValue('--out'), passphrase: passphrase(), toHostKey: flagValue('--to-host') || undefined });
+      console.log(`exported ${r.name} (${r.nodeId}, ${r.fingerprint}) to ${r.out}: ${r.files} file(s). It is tombstoned here and will not start on this host again.`);
+      return;
+    }
+    if (sub === 'import') {
+      const expect = { nodeId: flagValue('--expect-node') || undefined, key: flagValue('--expect-key') || undefined, fingerprint: flagValue('--expect-fingerprint') || undefined };
+      const r = relocation.importNode({ from: args[2], passphrase: passphrase(), expect, name: flagValue('--name') || undefined });
+      console.log(`imported ${r.name} (${r.nodeId}), verified against ${r.pinnedBy}: ${r.files} file(s)`);
+      return;
+    }
+  } catch (err) {
+    console.error(err.message);
+    process.exit(1);
+  }
+  console.error('usage: sym node (export <name> --out <file> (--passphrase-env VAR | --to-host <pub>) | import <file> --expect-node <id> [--expect-key <k> | --expect-fingerprint sha256:…] [--passphrase-env VAR] | host-key)');
+  process.exit(1);
+}
+
 function cmdStart() {
   applyStartFlags();                       // parse + persist --room / --relay-* first
   if (isDaemonRunning()) {
@@ -795,7 +874,7 @@ function broadcastQuestion(question) {
       resolve(v);
     };
     const socket = net.createConnection(SOCKET_PATH, () => {
-      socket.write(JSON.stringify({ type: 'register', name: 'sym-cli' }) + '\n');
+      socket.write(JSON.stringify({ type: 'hello' }) + '\n');
     });
     let buffer = '';
     socket.on('data', (data) => {
@@ -806,7 +885,7 @@ function broadcastQuestion(question) {
         if (!line.trim()) continue;
         try {
           const res = JSON.parse(line);
-          if (res.type === 'registered') {
+          if (res.type === 'result' && res.action === 'hello') {
             socket.write(JSON.stringify({ type: 'send', message: question }) + '\n');
           } else if (res.type === 'result') {
             finish(true); return;
@@ -1076,8 +1155,9 @@ function cmdIPC(msg, formatter) {
       return;
     }
 
-    // Register first, then send command
-    socket.write(JSON.stringify({ type: 'register', name: 'sym-cli' }) + '\n');
+    // Say hello first, then send the command (0.14: a CLI is a client of the daemon's node, not a
+    // virtual node — design D8).
+    socket.write(JSON.stringify({ type: 'hello' }) + '\n');
   });
 
   let buffer = '';
@@ -1106,8 +1186,8 @@ function cmdIPC(msg, formatter) {
           return;
         }
 
-        // Handle registration
-        if (res.type === 'registered' && !registered) {
+        // The daemon answered hello: send the command
+        if (res.type === 'result' && res.action === 'hello' && !registered) {
           registered = true;
           socket.write(JSON.stringify(msg) + '\n');
           return;
diff --git a/lib/config.js b/lib/config.js
index dbdeed31..f20c841c 100644
--- a/lib/config.js
+++ b/lib/config.js
@@ -133,12 +133,15 @@ function normalizeMdnsHostname(h) {
 }
 
 /**
- * Get the data directory for a named node.
+ * Get the data directory for a named node. A name is an index (design D9): when the name index holds
+ * it, this is the node's by-id directory (`nodes/by-id/<nodeId>`); otherwise the 0.13 path
+ * `nodes/<name>`, which `loadIdentity` moves to the by-id layout when it first loads it.
  * @param {string} name — node name
- * @returns {string} path to ~/.sym/nodes/<name>
+ * @returns {string} path to the node's directory
  */
 function nodeDir(name) {
-  return path.join(NODES_DIR, name);
+  const id = nodeIdForName(name);
+  return id ? nodeDirById(id) : path.join(NODES_DIR, name);
 }
 
 /**
@@ -208,80 +211,258 @@ function generateSigningKeyPair() {
 }
 
 /**
- * Load or create a persistent identity for a node.
- * Identity is stored as ~/.sym/nodes/<name>/identity.json.
- * See MMP v0.2.0 Section 3 (Identity).
+ * Raised when an identity that must already exist does not (`loadIdentity({ create: false })`): a
+ * host restoring a known agent can never mint a replacement silently (design D9).
+ */
+class IdentityAbsentError extends Error {
+  constructor(what) {
+    super(`[SYM] No identity for ${what} on this host, and none was minted (create: false). ` +
+      `Restore it (sym node import) or start it where it lives; minting a new one would be a different agent.`);
+    this.name = 'IdentityAbsentError';
+    this.code = 'EIDENTITYABSENT';
+  }
+}
+
+/**
+ * Raised for an identity that was moved away (`sym node export` wrote a tombstone, design D9): the
+ * source refuses to start it, so no second live copy can exist.
+ */
+class IdentityTombstonedError extends Error {
+  constructor(nodeId, tomb) {
+    super(`[SYM] REFUSING TO START ${nodeId}: this identity was exported to another host` +
+      `${tomb && tomb.movedAt ? ` on ${new Date(tomb.movedAt).toISOString()}` : ''} and is tombstoned here. ` +
+      `It runs where it was imported; two live copies would be two agents claiming one key.`);
+    this.name = 'IdentityTombstonedError';
+    this.code = 'EIDENTITYTOMBSTONED';
+    this.tombstone = tomb || null;
+  }
+}
+
+/** Where a node lives, by its nodeId (design D9): <state root>/nodes/by-id/<nodeId>. */
+function nodeDirById(nodeId) {
+  if (!isNodeIdText(nodeId)) throw new Error(`not a nodeId: ${String(nodeId).slice(0, 40)}`);
+  return path.join(NODES_DIR, 'by-id', nodeId);
+}
+
+/** Where a node's identity.json lives by nodeId: SYM_IDENTITY_DIR/by-id/<nodeId> when set, else the node dir. */
+function identityDirById(nodeId) {
+  const root = process.env.SYM_IDENTITY_DIR;
+  return root ? path.join(root, 'by-id', nodeId) : nodeDirById(nodeId);
+}
+
+const isNodeIdText = (id) => typeof id === 'string' && /^[0-9A-Za-z][0-9A-Za-z_.-]{0,127}$/.test(id) && id !== '.' && id !== '..';
+const TOMBSTONE = 'TOMBSTONE.json';
+const nameIndexPath = (name) => path.join(NODES_DIR, 'by-name', `${encodeURIComponent(name)}.json`);
+
+/** The nodeId the name index holds for `name`, or null. */
+function nodeIdForName(name) {
+  try {
+    const r = JSON.parse(fs.readFileSync(nameIndexPath(name), 'utf8'));
+    return r && isNodeIdText(r.nodeId) ? r.nodeId : null;
+  } catch { return null; }
+}
+
+/** Write the name index entry (atomic) and the 0.13-compatible `nodes/<name>` symlink (one release). */
+function indexName(name, nodeId) {
+  ensureDir(path.join(NODES_DIR, 'by-name'));
+  const file = nameIndexPath(name);
+  const tmp = `${file}.${process.pid}.tmp`;
+  fs.writeFileSync(tmp, JSON.stringify({ name, nodeId, at: Date.now() }));
+  fs.renameSync(tmp, file);
+  linkCompat(path.join(NODES_DIR, name), path.join('by-id', nodeId));
+  const idRoot = process.env.SYM_IDENTITY_DIR;
+  if (idRoot && fs.existsSync(path.join(idRoot, 'by-id', nodeId))) linkCompat(path.join(idRoot, name), path.join('by-id', nodeId));
+}
+
+/** `link` → `target` (relative), unless a real directory is there (a legacy layout not yet moved). */
+function linkCompat(link, target) {
+  try {
+    const st = fs.lstatSync(link);
+    if (st.isSymbolicLink()) {
+      if (fs.readlinkSync(link) === target) return;
+      fs.unlinkSync(link);
+    } else {
+      return; // a real dir: migration moves it first
+    }
+  } catch { /* absent */ }
+  try { fs.symlinkSync(target, link, process.platform === 'win32' ? 'junction' : 'dir'); } catch { /* best effort: the index is authoritative */ }
+}
+
+/** The tombstone a moved identity left, or null. */
+function readTombstone(nodeId) {
+  try { return JSON.parse(fs.readFileSync(path.join(nodeDirById(nodeId), TOMBSTONE), 'utf8')); } catch { return null; }
+}
+
+/**
+ * Read and validate an identity.json. Never regenerates a key: a file that exists and cannot be read
+ * halts (IdentityHaltError). A pre-v0.3.7 identity with no keypair gets its first key; a private key
+ * with no public key gets the public key derived from it.
+ * @private
+ */
+function readIdentityFile(idPath, name) {
+  let raw;
+  try {
+    raw = fs.readFileSync(idPath, 'utf8');
+  } catch (e) {
+    // The file EXISTS and we cannot read it. Never regenerate here — a transient read failure
+    // (permissions, a full disk, a partial write) would otherwise overwrite a live keypair.
+    throw new IdentityHaltError(name, idPath, `identity.json exists but could not be read: ${e.message}`);
+  }
+  let identity;
+  try {
+    identity = JSON.parse(raw);
+  } catch (e) {
+    throw new IdentityHaltError(name, idPath, `identity.json is not valid JSON: ${e.message}`);
+  }
+  if (!identity || typeof identity !== 'object' || !identity.nodeId) {
+    throw new IdentityHaltError(name, idPath, 'identity.json has no nodeId — the file is not an identity');
+  }
+  let mutated = false;
+  // NO KEYPAIR AT ALL (pre-v0.3.7 nodes): nothing to replace, so minting one gives an agent its first
+  // key; the nodeId is preserved. A PRIVATE KEY BUT NO PUBLIC KEY: derive it, never generate one.
+  if (!identity.publicKey && !identity.privateKey) {
+    const kp = generateSigningKeyPair();
+    identity.publicKey = kp.publicKey.toString('base64url');
+    identity.privateKey = kp.privateKey.toString('base64url');
+    mutated = true;
+  } else if (!identity.publicKey) {
+    const priv = crypto.createPrivateKey({
+      key: Buffer.concat([ED25519_PKCS8_PREFIX, Buffer.from(identity.privateKey, 'base64url')]),
+      format: 'der',
+      type: 'pkcs8',
+    });
+    const spki = crypto.createPublicKey(priv).export({ type: 'spki', format: 'der' });
+    identity.publicKey = spki.subarray(spki.length - 32).toString('base64url');
+    mutated = true;
+  }
+  // Migrate: normalize bare hostnames (pre-v0.5.1 Windows nodes)
+  const normalized = normalizeMdnsHostname(identity.hostname);
+  if (normalized !== identity.hostname) {
+    identity.hostname = normalized;
+    mutated = true;
+  }
+  if (mutated) fs.writeFileSync(idPath, JSON.stringify(identity, null, 2));
+  return identity;
+}
+
+/**
+ * Move one 0.13 node (`nodes/<name>/`, and its identity at `SYM_IDENTITY_DIR/<name>/` when that is
+ * set) to `nodes/by-id/<nodeId>/`, and leave `nodes/<name>` as a symlink to it for one release (a 0.13
+ * rollback reads the old path). Idempotent: a name that is already a symlink, or indexed, is left as
+ * it is. A directory whose lock a live process holds is skipped: that node moves itself when it
+ * restarts.
+ *
+ * A 0.13 identity file is read with the same reader a load uses, so one that exists and cannot be
+ * established (unreadable, not JSON, no nodeId) HALTS (IdentityHaltError) instead of reading as
+ * "no node here" — which would let the caller mint a replacement under the agent's name.
+ * @returns {'moved'|'indexed'|'skipped-live'|'skipped-duplicate'|'not-a-node'|'already'}
+ */
+function migrateNodeDir(name) {
+  const legacy = path.join(NODES_DIR, name);
+  const idRoot = process.env.SYM_IDENTITY_DIR;
+  const legacyIdDir = idRoot ? path.join(idRoot, name) : legacy;
+  const lst = (p) => { try { return fs.lstatSync(p); } catch { return null; } };
+  const indexFromLink = (link) => {
+    const m = /by-id[\\/]([^\\/]+)$/.exec(fs.readlinkSync(link));
+    if (m && isNodeIdText(m[1])) { indexName(name, m[1]); return 'indexed'; }
+    return 'already';
+  };
+  const st = lst(legacy);
+  if (st && st.isSymbolicLink()) return nodeIdForName(name) ? 'already' : indexFromLink(legacy);
+  if (st && !st.isDirectory()) return 'not-a-node';
+  const idSt = idRoot ? lst(legacyIdDir) : st;
+  if (idRoot && idSt && idSt.isSymbolicLink()) return nodeIdForName(name) ? 'already' : indexFromLink(legacyIdDir);
+  const idFile = path.join(legacyIdDir, 'identity.json');
+  if (!fs.existsSync(idFile)) return 'not-a-node';
+  const identity = readIdentityFile(idFile, name); // halts on an identity it cannot establish
+  const nodeId = identity.nodeId;
+  if (!isNodeIdText(nodeId)) throw new IdentityHaltError(name, idFile, `the nodeId ${JSON.stringify(String(nodeId).slice(0, 40))} cannot name a directory under nodes/by-id`);
+  if (st) {
+    const lock = readLockFile(path.join(legacy, 'lock.pid'));
+    if (lock && lock.pid !== process.pid && lockIsHeldByLiveProcess(lock)) return 'skipped-live';
+  }
+  const dest = nodeDirById(nodeId);
+  const idDest = idRoot && idSt && idSt.isDirectory() ? path.join(idRoot, 'by-id', nodeId) : null;
+  // Two dirs claim one nodeId: the first one moved stays, and nothing of this one is moved.
+  if ((st && fs.existsSync(dest)) || (idDest && fs.existsSync(idDest))) return 'skipped-duplicate';
+  ensureDir(path.dirname(dest));
+  if (st) fs.renameSync(legacy, dest);
+  else ensureDir(dest);
+  if (idDest) {
+    ensureDir(path.dirname(idDest));
+    fs.renameSync(legacyIdDir, idDest);
+  }
+  indexName(name, nodeId);
+  return 'moved';
+}
+
+/**
+ * Move every 0.13 node directory under the state root to the by-id layout (design D9, §6 of the
+ * design: a one-time, idempotent move). Safe to run at every start and from several processes.
+ * @returns {{ moved: number, already: number, skippedLive: number, duplicates: number }}
+ */
+function migrateIdentities() {
+  const out = { moved: 0, already: 0, skippedLive: 0, duplicates: 0 };
+  let entries;
+  try { entries = fs.readdirSync(NODES_DIR, { withFileTypes: true }); } catch { return out; }
+  for (const d of entries) {
+    if (d.name === 'by-id' || d.name === 'by-name' || d.name.startsWith('.')) continue;
+    let r;
+    try { r = migrateNodeDir(d.name); } catch { continue; }
+    if (r === 'moved') out.moved++;
+    else if (r === 'already' || r === 'indexed') out.already++;
+    else if (r === 'skipped-live') out.skippedLive++;
+    else if (r === 'skipped-duplicate') out.duplicates++;
+  }
+  return out;
+}
+
+/**
+ * Load a node's identity by nodeId or by name (design D9).
  *
- * New nodes get UUID v7 + Ed25519 keypair. Existing nodes with UUID v4
- * are accepted (backward compatible per spec Section 3.1.1).
+ *   - `{ nodeId }` loads `nodes/by-id/<nodeId>/identity.json`;
+ *   - `{ name }` resolves the name index to a nodeId (moving a 0.13 `nodes/<name>/` dir first);
+ *   - `create: false` throws IdentityAbsentError when the identity is absent: a host restoring a
+ *     known agent can never mint a replacement silently;
+ *   - `create: true` (the default, for a brand-new agent) is the ONLY path that mints, and it mints
+ *     only when the name is unknown (a name is an index; renaming changes the index, never the
+ *     identity);
+ *   - a tombstoned identity (exported to another host) refuses to load: IdentityTombstonedError.
  *
- * @param {string} name — node name
+ * @param {{ nodeId?: string, name?: string, create?: boolean }} o
  * @returns {{ nodeId: string, name: string, hostname: string, createdAt: number, publicKey: string, privateKey: string }}
  */
-function loadOrCreateIdentity(name) {
-  validateName(name);
-  const dir = identityDir(name);
-  ensureDir(dir);
-  const idPath = path.join(dir, 'identity.json');
-  if (fs.existsSync(idPath)) {
-    let raw;
-    try {
-      raw = fs.readFileSync(idPath, 'utf8');
-    } catch (e) {
-      // The file EXISTS and we cannot read it. Never regenerate here — a transient read
-      // failure (permissions, a full disk, a partial write) would otherwise overwrite a
-      // live keypair, and the old private key is gone the moment we do.
-      throw new IdentityHaltError(name, idPath, `identity.json exists but could not be read: ${e.message}`);
-    }
-    let identity;
-    try {
-      identity = JSON.parse(raw);
-    } catch (e) {
-      throw new IdentityHaltError(name, idPath, `identity.json is not valid JSON: ${e.message}`);
-    }
-    if (!identity || typeof identity !== 'object' || !identity.nodeId) {
-      throw new IdentityHaltError(name, idPath, 'identity.json has no nodeId — the file is not an identity');
-    }
-    {
-      let mutated = false;
-      // Two different situations wear the same shape here, and only one of them is the
-      // forbidden one.
-      //
-      //   NO KEYPAIR AT ALL (pre-v0.3.7 nodes): there is nothing to replace, so minting one
-      //   is not "creating a replacement identity" — it is giving an agent its first key.
-      //   Allowed, and the nodeId is preserved so the agent stays itself.
-      //
-      //   A PRIVATE KEY PRESENT BUT NO PUBLIC KEY: the public key must be DERIVED from the
-      //   private one, never generated. Minting a fresh pair would discard a live private
-      //   key, and every peer holding the old public key would read this agent's blocks as
-      //   forged. Ed25519 public keys are a function of the private key, so derivation is
-      //   exact and lossless.
-      if (!identity.publicKey && !identity.privateKey) {
-        const kp = generateSigningKeyPair();
-        identity.publicKey = kp.publicKey.toString('base64url');
-        identity.privateKey = kp.privateKey.toString('base64url');
-        mutated = true;
-      } else if (!identity.publicKey) {
-        const priv = crypto.createPrivateKey({
-          key: Buffer.concat([ED25519_PKCS8_PREFIX, Buffer.from(identity.privateKey, 'base64url')]),
-          format: 'der',
-          type: 'pkcs8',
-        });
-        const spki = crypto.createPublicKey(priv).export({ type: 'spki', format: 'der' });
-        identity.publicKey = spki.subarray(spki.length - 32).toString('base64url');
-        mutated = true;
+function loadIdentity({ nodeId, name, create = true } = {}) {
+  if (name !== undefined) validateName(name);
+  if (!nodeId && !name) throw new Error('loadIdentity needs a nodeId or a name');
+  if (nodeId && !isNodeIdText(nodeId)) throw new Error(`not a nodeId: ${String(nodeId).slice(0, 40)}`);
+  if (!nodeId && name) {
+    nodeId = nodeIdForName(name);
+    if (!nodeId) {
+      const r = migrateNodeDir(name);
+      if (r === 'moved' || r === 'already' || r === 'indexed') nodeId = nodeIdForName(name);
+      if (r === 'skipped-live') {
+        // A 0.13 process of this name holds its old directory: load it in place, unmoved.
+        const idRoot = process.env.SYM_IDENTITY_DIR;
+        const idPath = idRoot ? path.join(idRoot, name, 'identity.json') : path.join(NODES_DIR, name, 'identity.json');
+        return readIdentityFile(idPath, name);
       }
-      // Migrate: normalize bare hostnames (pre-v0.5.1 Windows nodes)
-      const normalized = normalizeMdnsHostname(identity.hostname);
-      if (normalized !== identity.hostname) {
-        identity.hostname = normalized;
-        mutated = true;
-      }
-      if (mutated) fs.writeFileSync(idPath, JSON.stringify(identity, null, 2));
+    }
+  }
+  if (nodeId) {
+    const tomb = readTombstone(nodeId);
+    if (tomb) throw new IdentityTombstonedError(nodeId, tomb);
+    const idPath = path.join(identityDirById(nodeId), 'identity.json');
+    if (fs.existsSync(idPath)) {
+      const identity = readIdentityFile(idPath, name || nodeId);
+      if (identity.nodeId !== nodeId) throw new IdentityHaltError(name || nodeId, idPath, `identity.json names ${identity.nodeId}, not ${nodeId}`);
+      if (name && nodeIdForName(name) !== nodeId) indexName(name, nodeId);
       return identity;
     }
+    if (!create || !name) throw new IdentityAbsentError(name ? `"${name}" (${nodeId})` : nodeId);
   }
-  // No identity file: a genuinely new agent. This is the ONLY path that mints one.
+  if (!create) throw new IdentityAbsentError(`"${name}"`);
+  // No identity under this name: a genuinely new agent. This is the ONLY path that mints one.
   const kp = generateSigningKeyPair();
   const identity = {
     nodeId: uuidv7(),
@@ -291,10 +472,46 @@ function loadOrCreateIdentity(name) {
     publicKey: kp.publicKey.toString('base64url'),
     privateKey: kp.privateKey.toString('base64url'),
   };
-  fs.writeFileSync(idPath, JSON.stringify(identity, null, 2));
+  // A 0.13-style `nodes/<name>/` dir with no identity (made by hand, or by a test) is the new node's
+  // dir: it moves with the identity rather than being left behind.
+  const legacy = path.join(NODES_DIR, name);
+  let legacyDir = false;
+  try { legacyDir = fs.lstatSync(legacy).isDirectory(); } catch { /* absent */ }
+  const dir = nodeDirById(identity.nodeId);
+  ensureDir(path.dirname(dir));
+  if (legacyDir) fs.renameSync(legacy, dir);
+  ensureDir(dir);
+  const idDir = identityDirById(identity.nodeId);
+  ensureDir(idDir);
+  fs.writeFileSync(path.join(idDir, 'identity.json'), JSON.stringify(identity, null, 2), { mode: 0o600 });
+  indexName(name, identity.nodeId);
   return identity;
 }
 
+/**
+ * Load or create a persistent identity for a node (0.13 API, kept): `loadIdentity({ name, create: true })`.
+ * See MMP §3 (Identity).
+ * @param {string} name — node name
+ */
+function loadOrCreateIdentity(name) {
+  return loadIdentity({ name, create: true });
+}
+
+/**
+ * Rename a node: the name index moves; the identity (nodeId, key) does not (design D9).
+ * @returns {string} the nodeId
+ */
+function renameIdentity(oldName, newName) {
+  validateName(oldName); validateName(newName);
+  const nodeId = nodeIdForName(oldName);
+  if (!nodeId) throw new IdentityAbsentError(`"${oldName}"`);
+  if (nodeIdForName(newName)) throw new Error(`the name "${newName}" already indexes a node`);
+  indexName(newName, nodeId);
+  try { fs.unlinkSync(nameIndexPath(oldName)); } catch { /* */ }
+  try { if (fs.lstatSync(path.join(NODES_DIR, oldName)).isSymbolicLink()) fs.unlinkSync(path.join(NODES_DIR, oldName)); } catch { /* */ }
+  return nodeId;
+}
+
 /**
  * True if `pid` refers to a live process. `process.kill(pid, 0)` sends no
  * signal but throws ESRCH when the process is gone; EPERM means the
@@ -703,9 +920,11 @@ function _installExitHooks() {
  * @returns {() => void} release function — call to delete the lockfile
  * @throws {Error} if another process already holds the lock
  */
-function acquireIdentityLock(name, _attempt = 0) {
+function acquireIdentityLock(name, opts = {}, _attempt = 0) {
   validateName(name);
-  const dir = nodeDir(name);
+  // The lock lives in the node's own directory: by nodeId since 0.14 (opts.dir); `nodes/<name>` is a
+  // link to it for one release, so a 0.13 process of the same agent contends for the same file.
+  const dir = (opts && opts.dir) || nodeDir(name);
   ensureDir(dir);
   const lockPath = path.join(dir, 'lock.pid');
 
@@ -756,7 +975,7 @@ function acquireIdentityLock(name, _attempt = 0) {
   } catch (e) {
     if (e.code === 'EEXIST' && _attempt < 5) {
       // Lost the race — re-acquire (retry handles the new state)
-      return acquireIdentityLock(name, _attempt + 1);
+      return acquireIdentityLock(name, opts, _attempt + 1);
     }
     throw e;
   }
@@ -785,7 +1004,18 @@ module.exports = {
   ensureDir,
   nodeDir,
   identityDir,
+  identityDirById,
+  nodeDirById,
+  nodeIdForName,
+  loadIdentity,
+  migrateIdentities,
+  migrateNodeDir,
+  renameIdentity,
+  readTombstone,
+  TOMBSTONE,
   IdentityHaltError,
+  IdentityAbsentError,
+  IdentityTombstonedError,
   uuidv7,
   validateName,
   generateSigningKeyPair,
diff --git a/lib/core/mmp-extensions.js b/lib/core/mmp-extensions.js
index 15d1b738..614f11de 100644
--- a/lib/core/mmp-extensions.js
+++ b/lib/core/mmp-extensions.js
@@ -29,17 +29,19 @@
 const EXT_CMB_ENCRYPTED_V2 = 'cmb-encrypted-v2';
 
 /**
- * Decide the selected extensions from both authenticated offers. If both offer cmb-encrypted-v2 it
- * is selected (mandatory). This is what the SERVER computes; the client verifies it with
- * assertNoDowngrade below.
+ * Decide the selected extensions from both authenticated offers: their intersection (§16.1 "the
+ * server selects their intersection", as the published handshake vector selects), in bytewise
+ * order. cmb-encrypted-v2 is therefore selected whenever both offer it (mandatory). This is what the
+ * SERVER computes; the client verifies it with assertNoDowngrade below. (Until sym 0.14 this
+ * selected cmb-encrypted-v2 alone, so no other extension could ever be active on a session.)
  * @returns {{ selected: string[], v2: boolean }}
  */
 function selectExtensions(clientOffers, serverOffers) {
-  const c = new Set(Array.isArray(clientOffers) ? clientOffers : []);
-  const s = new Set(Array.isArray(serverOffers) ? serverOffers : []);
-  const v2 = c.has(EXT_CMB_ENCRYPTED_V2) && s.has(EXT_CMB_ENCRYPTED_V2);
-  const selected = v2 ? [EXT_CMB_ENCRYPTED_V2] : [];
-  return { selected, v2 };
+  const c = new Set(Array.isArray(clientOffers) ? clientOffers.map(String) : []);
+  const s = Array.isArray(serverOffers) ? [...new Set(serverOffers.map(String))] : [];
+  const selected = s.filter((e) => c.has(e))
+    .sort((a, b) => Buffer.compare(Buffer.from(a, 'utf8'), Buffer.from(b, 'utf8')));
+  return { selected, v2: selected.includes(EXT_CMB_ENCRYPTED_V2) };
 }
 
 /**
diff --git a/lib/core/mmp-session.js b/lib/core/mmp-session.js
index 1faf3301..a6dfc6a0 100644
--- a/lib/core/mmp-session.js
+++ b/lib/core/mmp-session.js
@@ -98,26 +98,51 @@ class MmpSession {
   }
 
   /**
-   * Admit an inbound frame's position. The sequence MUST be exactly the next expected for the
-   * receive direction — a replay (already consumed), a rollback (below the expected), or a gap
-   * (above the expected) is refused. On success returns the recv direction and directional key and
-   * advances the receive counter; the caller then opens the frame with that key.
+   * Give back the send position just taken, when the frame it was for was never written (it was too
+   * large, or could not be sealed). Only the latest position can be given back, so no gap is made.
+   */
+  cancelSend(sequence) {
+    if (BigInt(sequence) === this._nextSend - 1n) this._nextSend -= 1n;
+  }
+
+  /**
+   * Receive one inbound sealed frame at its position, AUTHENTICATED BEFORE ANY STATE MOVES (design
+   * D2). `open(trafficKey, sequence)` decrypts the frame under this direction's key at the frame's
+   * own sequence and throws on any AEAD failure. Only then is the position judged:
+   *
+   *   - the AEAD fails          → the frame is forged or damaged: it throws, and the counter does NOT
+   *                               move (0.14.0's candidate advanced first, in `acceptRecv`, so one
+   *                               forged frame carrying the right sequence desynchronised the session);
+   *   - authentic, exact-next   → the counter advances and open's result is returned;
+   *   - authentic, but a replay, rollback or gap → `SessionDesyncError`: the caller closes the session
+   *                               and re-handshakes (it never stalls waiting for a lost frame).
    *
    * @param {string} sequence  - the frame's canonical decimal sequence.
    * @param {string} direction - the frame's declared direction; MUST equal this session's recv direction.
+   * @param {(trafficKey: Buffer, sequence: string) => any} open
+   * @returns {any} what `open` returned
    */
-  acceptRecv(sequence, direction) {
+  receive(sequence, direction, open) {
     if (!this._confirmed) throw new Error('mmp-session: cannot receive on an unconfirmed session');
     if (direction !== this._recvDirection) {
       throw new Error(`mmp-session: frame direction ${direction} is not this session's receive direction ${this._recvDirection}`);
     }
     if (!/^(0|[1-9][0-9]*)$/.test(String(sequence))) throw new Error('mmp-session: sequence must be a canonical decimal string');
+    const result = open(this._recvKey, String(sequence));   // throws on AEAD failure: nothing moved
     const seq = BigInt(sequence);
-    if (seq < this._nextRecv) throw new Error(`mmp-session: replay/rollback — sequence ${sequence} already past ${this._nextRecv}`);
-    if (seq > this._nextRecv) throw new Error(`mmp-session: gap — expected ${this._nextRecv}, got ${sequence}`);
+    if (seq < this._nextRecv) throw new SessionDesyncError(`mmp-session: replay/rollback — sequence ${sequence} already past ${this._nextRecv}`, 'replay');
+    if (seq > this._nextRecv) throw new SessionDesyncError(`mmp-session: gap — expected ${this._nextRecv}, got ${sequence}`, 'gap');
     this._nextRecv += 1n;
-    return { direction: this._recvDirection, trafficKey: this._recvKey };
+    return result;
   }
+
+  /** The next receive sequence expected (decimal string), for status and tests. */
+  get nextRecv() { return this._nextRecv.toString(10); }
+}
+
+/** An authentic frame out of order (replay, rollback, gap): the session must close and re-handshake. */
+class SessionDesyncError extends Error {
+  constructor(message, kind) { super(message); this.name = 'SessionDesyncError'; this.kind = kind; this.code = 'ESESSIONDESYNC'; }
 }
 
-module.exports = { MmpSession, C2S, S2C };
+module.exports = { MmpSession, SessionDesyncError, C2S, S2C };
diff --git a/lib/core/sealed-control.js b/lib/core/sealed-control.js
new file mode 100644
index 00000000..1472e2b2
--- /dev/null
+++ b/lib/core/sealed-control.js
@@ -0,0 +1,90 @@
+'use strict';
+
+/**
+ * @module sym/core/sealed-control
+ * @description The sealed control frame, `control-encrypted` (sym 0.14, design D1; drafted for the
+ * MMP spec as §7.1/§18.2.1 "sealed control frames", design §10 PR 7).
+ *
+ * MMP v2.0 binds only CMBs to the session: `cmb-encrypted` seals a record under the session's
+ * directional key, and every other frame travels in the clear. Over a relay that leaves control
+ * frames injectable by anyone who can address the relay envelope (design §9: "Only CMBs are bound
+ * to the session"). A Core Secure session in sym therefore carries EVERY post-handshake frame except
+ * `ping`, `pong` and `error` inside this envelope: `mood` (cognitive content, §9.3), `peer-info` and
+ * `wake-channel` (so what is learned from a session is learned from the node that proved itself on
+ * it), the signed gossip frames, `cmb-fetch` and `cmb-fetch-result` (its correlation id and key
+ * lists; the fetched records themselves travel as `cmb-encrypted`), and the room-join grant.
+ *
+ * Wire shape (the `cmb-encrypted` envelope without the record metadata):
+ *
+ *   { type: 'control-encrypted', protocolVersion: '2.0', suite, sessionId, sequence, direction, sealed }
+ *
+ * The plaintext is the inner frame's JSON. It shares the session's ONE per-direction sequence with
+ * `cmb-encrypted`, so a nonce never repeats under a traffic key, and ordering covers both kinds. The
+ * AAD binds the domain, version, session, direction and sequence:
+ *
+ *   AAD = UTF8("mmp-aead-control-v2\n") || lp("2.0") || lp(sessionId) || lp(direction) || lp(sequence)
+ *
+ * The distinct domain means a sealed control frame can never be opened as a record and vice versa.
+ *
+ * @copyright 2026 SYM.BOT Ltd.
+ * @license Apache-2.0
+ */
+
+const { lp } = require('./cmb-encoder');
+const { sealV2, openV2 } = require('./e2e-v2');
+const { nonceForSequence, SUITE, PROTOCOL_VERSION } = require('./cmb-encrypted-frame');
+
+const FRAME_TYPE = 'control-encrypted';
+const AAD_DOMAIN = 'mmp-aead-control-v2\n';
+const DIRECTIONS = new Set(['client-to-server', 'server-to-client']);
+
+/** The frame types a sealed control frame may carry. Records, handshakes and envelopes never. */
+const NEVER_INNER = new Set(['cmb', 'cmb-encrypted', 'control-encrypted', 'client-hello', 'server-hello', 'client-finish', 'handshake', 'state-sync']);
+
+function controlAAD({ sessionId, direction, sequence }) {
+  return Buffer.concat([
+    Buffer.from(AAD_DOMAIN, 'utf8'),
+    lp(PROTOCOL_VERSION),
+    lp(String(sessionId)),
+    lp(String(direction)),
+    lp(String(sequence)),
+  ]);
+}
+
+const b64urlUnpadded = (buf) => Buffer.from(buf).toString('base64url').replace(/=+$/, '');
+
+/**
+ * Seal one control frame at a session position.
+ * @returns {object} the wire frame
+ */
+function buildControlFrame({ frame, sessionId, direction, sequence, trafficKey }) {
+  if (!frame || typeof frame.type !== 'string' || NEVER_INNER.has(frame.type)) throw new Error(`control-encrypted: refusing to seal a '${frame && frame.type}' frame`);
+  if (!/^[0-9a-f]{32}$/.test(sessionId || '')) throw new Error('control-encrypted: sessionId must be 32 lowercase hex');
+  if (!DIRECTIONS.has(direction)) throw new Error('control-encrypted: bad direction');
+  if (!/^(0|[1-9][0-9]*)$/.test(String(sequence))) throw new Error('control-encrypted: bad sequence');
+  const sealed = sealV2(trafficKey, nonceForSequence(sequence), controlAAD({ sessionId, direction, sequence }), Buffer.from(JSON.stringify(frame), 'utf8'));
+  return { type: FRAME_TYPE, protocolVersion: PROTOCOL_VERSION, suite: SUITE, sessionId, sequence: String(sequence), direction, sealed: b64urlUnpadded(sealed) };
+}
+
+/** Whether a wire frame is shaped as a sealed control frame (nothing about its authenticity). */
+function isControlFrame(f) {
+  return !!f && f.type === FRAME_TYPE && f.protocolVersion === PROTOCOL_VERSION && f.suite === SUITE
+    && typeof f.sessionId === 'string' && DIRECTIONS.has(f.direction)
+    && /^(0|[1-9][0-9]*)$/.test(String(f.sequence)) && typeof f.sealed === 'string' && /^[A-Za-z0-9_-]+$/.test(f.sealed);
+}
+
+/**
+ * Open a sealed control frame. Throws on any AEAD failure or a malformed inner frame.
+ * @returns {object} the inner frame
+ */
+function openControlFrame({ frame, trafficKey }) {
+  if (!isControlFrame(frame)) throw new Error('control-encrypted: malformed frame');
+  const plain = openV2(trafficKey, nonceForSequence(frame.sequence), controlAAD(frame), Buffer.from(frame.sealed, 'base64url'));
+  const inner = JSON.parse(plain.toString('utf8'));
+  if (!inner || typeof inner !== 'object' || Array.isArray(inner) || typeof inner.type !== 'string' || NEVER_INNER.has(inner.type)) {
+    throw new Error('control-encrypted: the sealed frame is not a control frame');
+  }
+  return inner;
+}
+
+module.exports = { FRAME_TYPE, AAD_DOMAIN, controlAAD, buildControlFrame, openControlFrame, isControlFrame, NEVER_INNER };
diff --git a/lib/discovery.js b/lib/discovery.js
index 5e67e785..78557a3c 100644
--- a/lib/discovery.js
+++ b/lib/discovery.js
@@ -135,6 +135,8 @@ class BonjourDiscovery extends Discovery {
     this._port = 0;
     this._identity = null;
     this._log = () => {};
+    // The room advertised in TXT and the loopback registry (§5.1 `room`; the default room is 'default').
+    this._room = opts.room || 'default';
   }
 
   async start(identity, log) {
@@ -235,19 +237,30 @@ class BonjourDiscovery extends Discovery {
     });
   }
 
+  /**
+   * THE CORE SECURE LISTENER (design D2, §5.2): the first frame must be `client-hello`, and nothing
+   * else is taken. A legacy `handshake` is refused at once — the connection closes and the refusal is
+   * reported ('legacy-hello-refused', rate-limited by the node) — because a first-frame type chosen
+   * by the peer must never choose the security policy (mmp-ingress). A 0.13 peer is reached only by a
+   * Legacy Import route this node dials itself (design D7).
+   */
   _handleInboundConnection(socket) {
     const transport = new TcpTransport(socket);
+    const remote = `${socket.remoteAddress || '?'}:${socket.remotePort || '?'}`;
     let identified = false;
     const timeout = setTimeout(() => { if (!identified) transport.close(); }, this._handshakeTimeoutMs);
 
     transport.on('message', (msg) => {
       if (identified) return;
-      if (msg.type !== 'handshake') { transport.close(); return; }
       identified = true;
       clearTimeout(timeout);
-
       transport.removeAllListeners('message');
-      this.emit('inbound-connection', transport, msg.nodeId, msg.name, msg);
+      if (!msg || msg.type !== 'client-hello') {
+        transport.close();
+        if (msg && msg.type === 'handshake') this.emit('legacy-hello-refused', remote);
+        return;
+      }
+      this.emit('inbound-connection', transport, msg, remote);
     });
 
     // A parse error must not cancel the identification deadline (MMP §4.1, §19.1):
@@ -265,6 +278,8 @@ class BonjourDiscovery extends Discovery {
       `node-name=${identity.name}`,
       `public-key=${identity.publicKey}`,
       `hostname=${identity.hostname}`,
+      'mmp=2.0',
+      `room=${this._room}`,
     ];
     this._dnssdRegister = spawn('dns-sd', [
       '-R', identity.nodeId, this._serviceType, 'local.',
@@ -320,15 +335,15 @@ class BonjourDiscovery extends Discovery {
 
       const nodeIdMatch = resolveBuffer.match(/node-id=(\S+)/);
       const nodeNameMatch = resolveBuffer.match(/node-name=(\S+)/);
+      const mmpMatch = resolveBuffer.match(/mmp=(\S+)/);
+      const roomMatch = resolveBuffer.match(/room=(\S+)/);
       const peerId = nodeIdMatch ? nodeIdMatch[1] : instanceName;
       const peerName = nodeNameMatch ? nodeNameMatch[1] : 'unknown';
 
       resolve.kill();
 
       if (peerId === identity.nodeId) return;
-      if (identity.nodeId < peerId) {
-        this.emit('peer-found', host, port, peerId, peerName);
-      }
+      this.emit('peer-found', host, port, peerId, peerName, { mmp: mmpMatch ? mmpMatch[1] : null, room: roomMatch ? roomMatch[1] : null, source: 'bonjour' });
     });
   }
 
@@ -356,7 +371,9 @@ class BonjourDiscovery extends Discovery {
       type: this._bonjourType,
       port: this._port,
       host: identity.hostname,
-      txt: { 'node-id': identity.nodeId, 'node-name': identity.name, 'public-key': identity.publicKey, 'hostname': identity.hostname },
+      // mmp=2.0 marks a Core Secure advertisement (design D2; drafted for §5.1): a 0.14 node dials a
+      // record as Core Secure only when it carries it. room=<room> is §5.1's optional field.
+      txt: { 'node-id': identity.nodeId, 'node-name': identity.name, 'public-key': identity.publicKey, 'hostname': identity.hostname, mmp: '2.0', room: this._room },
     });
 
     this._browser = this._bonjour.find({ type: this._bonjourType });
@@ -376,10 +393,11 @@ class BonjourDiscovery extends Discovery {
       const port = service.port;
       if (!address || !port) return;
 
+      const info = { mmp: typeof service.txt?.mmp === 'string' ? service.txt.mmp : null, room: typeof service.txt?.room === 'string' ? service.txt.room : null, source: 'bonjour' };
       // Update cache with current address:port, and when this peer was last announced
-      this._bonjourPeerCache.set(peerId, { address, port, peerName, seenAt: Date.now() });
+      this._bonjourPeerCache.set(peerId, { address, port, peerName, info, seenAt: Date.now() });
 
-      this.emit('peer-found', address, port, peerId, peerName);
+      this.emit('peer-found', address, port, peerId, peerName, info);
     };
 
     this._onServiceDown = (service) => {
@@ -403,7 +421,7 @@ class BonjourDiscovery extends Discovery {
       // (2026-09-28). Each browser restart below re-announces every live peer, so one not
       // announced for BONJOUR_PEER_TTL_MS (about 20 restarts) is gone, and is dropped.
       for (const [peerId, info] of this._cachedPeersToReoffer()) {
-        this.emit('peer-found', info.address, info.port, peerId, info.peerName);
+        this.emit('peer-found', info.address, info.port, peerId, info.peerName, info.info || {});
       }
       // Restart the browser to discover updated ports
       if (this._browser) {
@@ -493,6 +511,9 @@ class BonjourDiscovery extends Discovery {
         port: this._port,
         pid: process.pid,
         serviceType: this._serviceType,
+        // A Core Secure endpoint (design D2): a 0.13 registration has no mmp field.
+        mmp: '2.0',
+        room: this._room,
         ts: Date.now(),
       });
       // Atomic write (temp + rename) so a scanning peer never reads a partial file.
@@ -534,7 +555,8 @@ class BonjourDiscovery extends Discovery {
       // Tie-break: the lower nodeId dials; the higher one accepts the inbound.
       // Mirrors the Bonjour _resolvePeer path so we connect exactly once.
       if (identity.nodeId < rec.nodeId) {
-        this.emit('peer-found', '127.0.0.1', rec.port, rec.nodeId, rec.name || 'unknown');
+        this.emit('peer-found', '127.0.0.1', rec.port, rec.nodeId, rec.name || 'unknown',
+          { mmp: typeof rec.mmp === 'string' ? rec.mmp : null, room: typeof rec.room === 'string' ? rec.room : null, source: 'loopback' });
       }
     }
   }
diff --git a/lib/emit-policy.js b/lib/emit-policy.js
index d8a2a22c..737728c1 100644
--- a/lib/emit-policy.js
+++ b/lib/emit-policy.js
@@ -3,16 +3,15 @@
 /**
  * The single mesh-wide switch for the MMP v2.0 emitter flip (reader-first migration).
  *
- * OFF until the v2.0 READER (verifyCMB accepting mmp-sig-v2.0) is released and deployed across
- * the mesh. A peer still on the old verifier rejects a v2.0-signed record, so flipping before
- * readers are live splits the mesh. Every emit path — the Class 1 emitter (lib/emit.js) and the
- * resident node (lib/node.js) — reads THIS constant, so the flip is one deliberate edit in one
- * place, made after reader rollout is confirmed.
+ * ON since sym 0.14.0 (Core Secure, design D4). The v2.0 reader (verifyCMB accepting mmp-sig-v2.0)
+ * shipped in 0.13.x and is deployed, and a Core Secure session carries only signed v2.0 records
+ * (§18.3.1): every emit path — the Class 1 emitter (lib/emit.js) and the resident node
+ * (lib/node.js) — mints mmp-sig-v2.0 records whose author is the signed createdByNodeId.
  *
  * @copyright 2026 SYM.BOT Ltd.
  * @license Apache-2.0
  */
 
-const MMP_EMIT_V2 = false;
+const MMP_EMIT_V2 = true;
 
 module.exports = { MMP_EMIT_V2 };
diff --git a/lib/emit.js b/lib/emit.js
index db701cee..1ca0d90e 100644
--- a/lib/emit.js
+++ b/lib/emit.js
@@ -10,12 +10,12 @@
  * and earned trust accrue to the actual source — a CI job, a sensor, a
  * script — rather than being laundered through a resident node's identity.
  *
- * The wire surface is exactly the Class 1 contract: v1 content address and
- * mmp-sig-v1 signature via the core library (byte-identical to a full node's
- * emissions), the §5.2 handshake, and the §7 `cmb` frame over the §4.1
- * length-prefixed TCP transport. Unknown inbound frame types are silently
- * ignored (§7.3). LAN TCP only for now: the relay path requires end-to-end
- * category encryption (§18.2.1), which a one-shot emitter does not yet speak.
+ * The wire surface is the Class 1 contract over Core Secure (sym 0.14): the §5.2 authenticated
+ * handshake (client-hello → server-hello → client-finish, both proofs verified), then each record as
+ * a signed mmp-sig-v2.0 CMB sealed in a `cmb-encrypted` frame (§18.2.1) over the §4.1
+ * length-prefixed TCP transport. Unknown inbound frame types are silently ignored (§7.3). LAN TCP
+ * only. The room is explicit (§5.8: absence is invalid in Core Secure): an emitter that names none
+ * is in `default`, and a node in another room refuses it at the handshake (room mismatch).
  *
  * Copyright (c) 2026 SYM.BOT. Apache 2.0 License.
  */
@@ -25,9 +25,11 @@ const { createCMB, signCMB, assertionIdV2_0 } = require('./core');
 const { TcpTransport } = require('./transport');
 const { loadOrCreateIdentity } = require('./config');
 const { MMP_EMIT_V2 } = require('./emit-policy'); // the single reader-first flip switch
+const { PeerSession } = require('./session');
+const { EXT_CMB_ENCRYPTED_V2 } = require('./core/mmp-extensions');
 
 const HANDSHAKE_TIMEOUT_MS = 8000;
-const WIRE_VERSION = '0.2.3'; // the frozen MMP Core wire revision (§5.2)
+const IMPLEMENTATION = { name: 'sym-emit', version: require('../package.json').version };
 
 /** Parse "host:port" (optional tcp:// prefix). */
 function parseServer(server) {
@@ -44,21 +46,16 @@ function parseServer(server) {
   return { host, port };
 }
 
-/** The room a node's handshake reply says it is in, or null when it names none. */
-function admittedRoom(peer) {
-  return peer && typeof peer.room === 'string' && peer.room ? peer.room : null;
-}
-
 /** A connected emitter session. Create via connect(); reuse for many emits. */
 class Emitter {
-  constructor({ identity, transport, socket, room, name, peer }) {
+  constructor({ identity, session, socket, room, name }) {
     this.nodeId = identity.nodeId;
     this.name = name;
     this.room = room;
-    /** The receiving peer's handshake (nodeId, name, publicKey…). */
-    this.peer = peer;
+    /** What the handshake proved about the receiving node: { nodeId, name, publicKey, room, sessionId }. */
+    this.peer = { nodeId: session.nodeId, name: session.name, publicKey: session.identityKey, room: session.room, sessionId: session.sessionId };
     this._identity = identity;
-    this._transport = transport;
+    this._session = session;
     this._socket = socket;
   }
 
@@ -78,21 +75,12 @@ class Emitter {
     // indistinguishable from a right one.
     const lineage = parents.length ? { parents: [...parents], method: 'emit' } : null;
 
-    // Audience is part of the record now, so it is passed at construction rather than stapled
-    // on afterwards — `room` became `room` in the same signing-scheme change.
-    //
-    // THE ROOM A RECORD NAMES. A caller that named a room authors for it. One that named none
-    // authors for the room its handshake was admitted into, which the receiving node's reply states:
-    // the connection made no claim, the node admitted it to its own room, and that is the room this
-    // emitter is speaking in. Minting `null` there named 'default' (§7), and the node that had just
-    // admitted the emitter, in any other room, refused every block it sent. The receiver relaxes
-    // nothing for this: a record that names no room is in 'default' wherever it arrives (B-R10),
-    // because nothing in a room-less record shows it was not replayed from another room.
+    // The record names the room the handshake proved: both sides signed it in the transcript.
     const cmb = createCMB({
       categories,
       createdBy: this.name,
       lineage,
-      room: (typeof this.room === 'string' && this.room) ? this.room : admittedRoom(this.peer),
+      room: this.room,
       to: opts.to ?? null,
       // Reader-first gated: only populates the v2.0 preimage fields (and thus signs under
       // mmp-sig-v2.0) once MMP_EMIT_V2 is flipped on after reader deployment.
@@ -116,7 +104,12 @@ class Emitter {
     // that derivation is gone.
 
     signCMB(cmb, this._identity.privateKey);
-    this._transport.send({ type: 'cmb', timestamp: Date.now(), cmb });
+    const sent = this._session.trySend({ type: 'cmb', timestamp: Date.now(), cmb });
+    if (!sent.ok) {
+      const e = new Error(`emit: the record was not sent (${sent.reason})`);
+      e.code = 'EEMITSEND';
+      throw e;
+    }
     return { key: cmb.metadata.key, cmb };
   }
 
@@ -124,6 +117,8 @@ class Emitter {
   close() {
     return new Promise((resolve) => {
       if (this._socket.destroyed) return resolve();
+      // Let what was written drain, then end the session with the socket.
+      this._socket.once('close', () => { try { this._session.close('emitter-closed', { notify: false, closeTransport: false }); } catch { /* */ } });
       this._socket.once('close', resolve);
       this._socket.end();
       setTimeout(() => { this._socket.destroy(); resolve(); }, 1500).unref();
@@ -144,6 +139,8 @@ class Emitter {
 async function connect({ server, room, name = 'emitter', timeoutMs = HANDSHAKE_TIMEOUT_MS } = {}) {
   const identity = loadOrCreateIdentity(name);
   const { host, port } = parseServer(server);
+  // §5.8: the room is explicit in Core Secure; the default room is the literal 'default'.
+  const claimed = (typeof room === 'string' && room) ? room : 'default';
 
   const socket = await new Promise((resolve, reject) => {
     const s = net.connect({ host, port });
@@ -153,35 +150,22 @@ async function connect({ server, room, name = 'emitter', timeoutMs = HANDSHAKE_T
   });
 
   const transport = new TcpTransport(socket);
-  transport.send({
-    type: 'handshake',
-    nodeId: identity.nodeId,
-    name,
-    version: WIRE_VERSION,
-    extensions: [],
-    // Omit `room` entirely when the caller named none. Defaulting it to
-    // 'default' made silence into a POSITIVE claim of the public square, and a
-    // receiver in any named room is required to close on a mismatched claim
-    // (§5.8) — so the documented default of this API was precisely the value
-    // refused by every named room, and the caller saw only "closed before
-    // handshake" with no mention of rooms. Absence is not a claim and is
-    // admitted; `connect({ room: 'default' })` still claims it, on purpose.
-    ...(room === undefined || room === null || room === '' ? {} : { room }),
-    publicKey: identity.publicKey,
-    lifecycleRole: 'participant',
+  const session = new PeerSession({
+    role: 'client', transport, kind: 'bonjour', room: claimed,
+    local: { nodeId: identity.nodeId, name, publicKey: identity.publicKey, privateKey: identity.privateKey },
+    extensions: [EXT_CMB_ENCRYPTED_V2], implementation: IMPLEMENTATION, timeoutMs,
   });
-
-  const peer = await new Promise((resolve, reject) => {
-    const t = setTimeout(() => reject(new Error(`emit: no handshake from ${server} within ${timeoutMs}ms`)), timeoutMs);
-    transport.on('message', (msg) => {
-      // §7: silently ignore every frame type we don't understand.
-      if (msg && msg.type === 'handshake') { clearTimeout(t); resolve(msg); }
-    });
-    transport.once('close', () => { clearTimeout(t); reject(new Error(`emit: ${server} closed before handshake`)); });
-    transport.once('error', (e) => { clearTimeout(t); reject(e); });
+  transport.on('message', (f) => session.receiveWire(f)); // §7.3: anything else after the handshake is ignored
+  transport.on('error', () => {});
+
+  await new Promise((resolve, reject) => {
+    session.once('confirmed', () => resolve());
+    session.once('closed', (c) => reject(new Error(`emit: ${server} did not complete the Core Secure handshake (${c.reason}${c.detail ? `: ${c.detail}` : ''})`)));
+    transport.once('close', () => { if (!session.confirmed) session.close('transport-closed', { notify: false }); });
+    session.start();
   }).catch((e) => { socket.destroy(); throw e; });
 
-  return new Emitter({ identity, transport, socket, room, name, peer });
+  return new Emitter({ identity, session, socket, room: claimed, name });
 }
 
 /**
diff --git a/lib/frame-handler.js b/lib/frame-handler.js
index 460a5149..eccddf1b 100644
--- a/lib/frame-handler.js
+++ b/lib/frame-handler.js
@@ -24,7 +24,13 @@ const { wireNodeId } = require('./wire-identity');
 
 const fs = require('fs');
 const path = require('path');
-const { encode, cosineSimilarity, processHeuristicSVAF, buildFusedRecord, computeCategoryVerdicts, decryptCategories, resolveTetherAnchor, tetherOfRecord, signTetherAttestation, verifyTetherAttestation, classifyAddress, categoriesAsSigned, recordAsSigned } = require('./core');
+const { encode, cosineSimilarity, processHeuristicSVAF, buildFusedRecord, computeCategoryVerdicts, resolveTetherAnchor, tetherOfRecord, signTetherAttestation, verifyTetherAttestation, classifyAddress, categoriesAsSigned, recordAsSigned } = require('./core');
+
+/** The schema of the signed application section that marks a directed record as a message (design D1). */
+const MESSAGE_SCHEMA = 'https://sym.bot/schema/message-v1.json';
+
+/** The schema of the signed application section remember({ payload }) carries (§8.8.3). */
+const PAYLOAD_SCHEMA = 'https://sym.bot/schema/payload-v1.json';
 
 /** Entry members this node writes about an admission, which a frame must never supply. */
 const ENTRY_ANNOTATIONS = Object.freeze(['admission', 'tether', 'provenance', 'collapsed', 'svaf']);
@@ -81,10 +87,18 @@ const DIRECTED_MARK = /#(asrt-|sd:|sig:)/;
 /** The most `peer-info` entries read from one frame, and the most a frame this node sends carries. */
 const { PEER_INFO_MAX } = require('./core/wake');
 
-/** The connection a gossip lane names (see GOSSIP_NEW_LANE in node.js): a relay lane is the relay
- *  connection plus the sender id it carries, and this is the connection alone. Null without a lane. */
-const connectionOf = (lane) => (typeof lane === 'string' ? lane.replace(/^(relay:\d+):[\s\S]*$/, '$1') : null);
 /** A record refused for its audience is said at most once per this many ms per peer and reason. */
+/** Freeze an object graph (plain data: a structured clone of a record). */
+function deepFreeze(o) {
+  if (o && typeof o === 'object' && !Object.isFrozen(o)) {
+    Object.freeze(o);
+    for (const v of Object.values(o)) deepFreeze(v);
+  }
+  return o;
+}
+
+/** The most keys one cmb-fetch may name (design D1). */
+const MAX_FETCH_KEYS = 32;
 const AUDIENCE_REPORT_MS = 60_000;
 
 /**
@@ -107,6 +121,7 @@ class FrameHandler {
   constructor(node, opts = {}) {
     this._node = node;
     this._cliHostMode = opts.cliHostMode || false;
+    this._sessionOf = new WeakMap(); // frame -> the session that authenticated it
     this._unsignedWarned = new Set();
     this._attDropSaid = new Map(); // `${connection}|${reason}` -> { at, more }: a dropped attestation is said once a minute
     this._doorSaid = new Map();    // `${connection}|${reason}` -> { at, more }: a frame the door refused, the same way
@@ -213,196 +228,133 @@ class FrameHandler {
   }
 
   /**
-   * Main dispatch for an inbound peer frame.
-   *
-   * @param {string} peerId - Unique identifier of the sending peer.
-   * @param {string} peerName - Display name of the sending peer.
-   * @param {object} msg - The frame payload with a .type category.
-   * @param {string} [lane] - The connection the frame arrived on (see GOSSIP_NEW_LANE in node.js):
-   *   the gossip budget is kept per lane. Defaults to the peer id.
-   * @returns {void}
+   * Handle one AUTHENTICATED frame from a confirmed session (design D1). The session is the unit of
+   * trust: `session.nodeId` and `session.identityKey` are what the §5.2 exchange proved, and every
+   * per-peer structure is keyed by that nodeId; `session.name` is a label. Frames reach here only
+   * through SymNode._receiveSessionFrame (the one guarded dispatch) from a session the room door
+   * admitted. The wire frame table (design D1) is applied by the session (lib/session.js): records
+   * arrive here as {type:'cmb', cmb} only after cmb-encrypted opened; every other frame was sealed.
+   * @param {object} session - a confirmed session (lib/session.js PeerSession)
+   * @param {object} msg - the inner frame
    */
-  handle(peerId, peerName, msg, lane) {
-    // `provenPublicKey` is what this node's own proving handshake sets once it has verified a peer's
-    // proof of its key. A peer's handshake frame cannot carry it: a peer that wrote one into its frame
-    // would be taken as having proved the key printed in the room grant it presents.
-    if (msg && msg.type === 'handshake' && 'provenPublicKey' in msg) delete msg.provenPublicKey;
-    // THE DOOR (MMP §5.8.1). Admission is decided from the handshake; this consults that decision
-    // on every frame that carries meaning, so a peer that speaks without ever having been judged
-    // does not reach SVAF. Exempt: `handshake`, which is how a peer ASKS to be admitted — gating
-    // it would lock out the grant-holders it exists for — and `ping`/`pong`, which carry no
-    // content and tell a refused peer nothing a closed socket does not.
-    //
-    // DENY BY DEFAULT, deliberately. An allow-list of gated types is one forgotten `case` away
-    // from a hole, and this switch has fourteen of them — including `checkpoint`, `witness`,
-    // `role-grant` and `node-stats`, which mutate state without going near SVAF. Listing the
-    // three exemptions instead means a new frame type is gated the day it is added.
-    if (msg.type !== 'handshake' && msg.type !== 'ping' && msg.type !== 'pong'
-        && typeof this._node._roomDoor === 'function') {
+  handle(session, msg) {
+    if (!session || session.confirmed !== true || typeof session.nodeId !== 'string' || !session.nodeId) {
+      throw new Error('frame-handler: frames are handled only from a confirmed session');
+    }
+    if (!msg || typeof msg !== 'object' || typeof msg.type !== 'string') throw new Error('frame-handler: not a frame');
+    const peerId = session.nodeId;
+    const peerName = typeof session.name === 'string' ? session.name : 'unknown';
+    // THE DOOR (MMP §5.8.1), consulted per frame. The session layer admits only sessions the door
+    // admitted; this is the second check, so no future path can dispatch around it.
+    if (typeof this._node._roomDoor === 'function') {
       const door = this._node._roomDoor(peerId);
       if (!door.pass) {
-        // Once a minute per connection and reason, with a count: a refused peer sending frames, or
-        // fresh ids over the relay, bought a line per frame.
-        this._sayOnceAMinute(this._doorSaid, `${connectionOf(lane) ?? peerId}|${door.reason}`,
+        this._sayOnceAMinute(this._doorSaid, `${peerId}|${door.reason}`,
           (more) => `Door refused '${msg.type}' from ${peerName}: ${door.reason}${more}`);
         return;
       }
     }
     // One frame must never end the node. That is the node's one guarded dispatch (SymNode
-    // _receiveFrame, 0.13.17), which every transport calls: a throw from here is refused and counted
-    // there (metrics().framesRefused, a 'frame-handler-error' metric), never thrown out of the
-    // transport. A second guard here would hide the refusal from that count.
-    this._dispatch(peerId, peerName, msg, lane);
+    // _receiveSessionFrame, 0.13.17): a throw from here is refused and counted there.
+    this._dispatch(session, peerId, peerName, msg);
   }
 
-  _dispatch(peerId, peerName, msg, lane) {
-    switch (msg.type) {
-      case 'handshake':
-        this._handleHandshake(peerId, peerName, msg);
-        break;
-
-      case 'state-sync':
-        // MMP v0.2.2: state-sync is deprecated. Hidden states never cross
-        // the wire under SVAF (Xu, 2026, arXiv:2604.03955, §3.4). Frames
-        // received from older v0.2.0/v0.2.1 peers are silently dropped —
-        // they are NOT fed into the local CfC. Cognitive signals arrive
-        // on the canonical 'cmb' channel.
-        this._node._log(`state-sync: dropping deprecated frame from ${peerName} (MMP v0.2.0; upgrade peer to v0.2.2+)`);
-        break;
+  /** A frame type that rides only on sessions that selected an extension (§16.3). */
+  _extensionRefused(session, type, ext) {
+    if (typeof session.has === 'function' && session.has(ext)) return false;
+    if (typeof this._node._noteSessionRefusal === 'function') this._node._noteSessionRefusal(session, type, `${ext} not selected`);
+    return true;
+  }
 
+  _dispatch(session, peerId, peerName, msg) {
+    switch (msg.type) {
       case 'cmb':
-        this._handleMemoryShare(peerId, peerName, msg);
-        break;
+        return this._handleMemoryShare(peerId, peerName, msg, session);
+
+      case 'cmb-anchors':
+        // The records that follow on this session are the sender's replayed context, not new signals
+        // (they cannot carry a flag of their own: the record frame is fixed by §18.2.1).
+        if (Array.isArray(msg.keys)) session._anchorKeys = new Set(msg.keys.filter((k) => typeof k === 'string').slice(0, 50));
+        return undefined;
 
       case 'mood':
-        this._handleMood(peerId, peerName, msg);
-        break;
+        return this._handleMood(peerId, peerName, msg);
 
       case 'wake-channel':
-        this._handleWakeChannel(peerId, peerName, msg);
-        break;
+        return this._handleWakeChannel(peerId, peerName, msg);
 
       case 'peer-info':
-        this._handlePeerInfo(peerId, peerName, msg);
-        break;
+        return this._handlePeerInfo(peerId, peerName, msg);
 
       case 'attestation':
-        this._handleAttestation(peerId, peerName, msg, lane);
-        break;
-
-      case 'cmb-fetch':
-        this._handleCmbFetch(peerId, peerName, msg);
-        break;
-
-      case 'cmb-fetch-result':
-        this._handleCmbFetchResult(peerId, peerName, msg);
-        break;
+        if (this._extensionRefused(session, msg.type, 'sym-attest-v1')) return undefined;
+        return this._handleAttestation(peerId, peerName, msg);
 
       case 'checkpoint':
-        if (msg.checkpoint) this._node._ingestCheckpoint(msg.checkpoint, peerId, lane);
-        break;
+        if (this._extensionRefused(session, msg.type, 'sym-attest-v1')) return undefined;
+        if (msg.checkpoint) this._node._ingestCheckpoint(msg.checkpoint, peerId);
+        return undefined;
 
       case 'witness':
-        if (msg.witness) this._node._ingestWitness(msg.witness, peerId, lane);
-        break;
-
-      case 'role-grant':
-      case 'role-revoke':
-        if (msg.grant) this._node._ingestRoleGrant(msg.grant, peerId, lane);
-        break;
+        if (this._extensionRefused(session, msg.type, 'sym-attest-v1')) return undefined;
+        if (msg.witness) this._node._ingestWitness(msg.witness, peerId);
+        return undefined;
 
       case 'node-stats':
+        if (this._extensionRefused(session, msg.type, 'sym-attest-v1')) return undefined;
         if (msg.stats) this._node._ingestNodeStats(msg.stats, peerId);
-        break;
+        return undefined;
 
-      case 'message':
-        this._handleMessage(peerId, peerName, msg);
-        break;
+      case 'cmb-fetch':
+        return this._handleCmbFetch(peerId, peerName, msg, session);
 
-      case 'xmesh-insight':
-        this._handleXMeshInsight(peerId, peerName, msg);
-        break;
+      case 'cmb-fetch-result':
+        return this._handleCmbFetchResult(peerId, peerName, msg, session);
 
-      case 'ping': {
-        const peer = this._node._peers.get(peerId);
-        if (peer) peer.transport.send({ type: 'pong' });
-        break;
-      }
+      case 'role-grant':
+      case 'role-revoke':
+        // Signed by the grantor and verified against the chain's vouched keys (design D3), never
+        // against the session that delivered it.
+        if (msg.grant) this._node._ingestRoleGrant(msg.grant, peerId);
+        return undefined;
 
-      case 'pong':
-        break;
+      case 'xmesh-insight':
+        if (this._extensionRefused(session, msg.type, 'xmesh-insight-v1')) return undefined;
+        return this._handleXMeshInsight(peerId, peerName, msg);
+
+      case 'message':
+        // Retired in Core Secure (design D1): a message is a directed CMB, and the local 'message'
+        // event is raised from it (see _handleMemoryShareInner).
+        if (typeof this._node._noteSessionRefusal === 'function') this._node._noteSessionRefusal(session, 'message', 'retired: a message is a directed CMB');
+        return undefined;
+
+      default:
+        // §7.3: an unknown type is ignored.
+        return undefined;
     }
   }
 
   // ── Sub-handlers ──────────────────────────────────────────
 
-  /**
-   * Handle handshake: extract E2E public key and derive shared secret.
-   * @private
-   */
-  _handleHandshake(peerId, peerName, msg) {
-    // THE OTHER HALF OF THE ADMISSION DECISION. When WE dialled, the peer is already in the set
-    // before its handshake arrives — this is the first moment its room claim exists on this side,
-    // so the check has to run here too, or it covers only the half of the orderings in which we
-    // happen to be the one accepting. It also RECORDS the verdict, which is what the door above
-    // consults; without this call a peer has no verdict at all and, in a gated room, is refused.
-    if (typeof this._node._roomAdmission === 'function') {
-      const admission = this._node._roomAdmission(peerId, msg);
-      if (!admission.admit) {
-        this._node._log(`Refused ${peerName} into '${this._node._room}': ${admission.reason}`);
-        const peer = this._node._peers && this._node._peers.get(peerId);
-        if (peer) {
-          this._node._peers.delete(peerId);
-          try { peer.transport.close(); } catch { /* already gone */ }
-        }
-        return;
-      }
-    }
-    if (msg.e2ePublicKey && typeof this._node._deriveAndStoreSecret === 'function') {
-      this._node._deriveAndStoreSecret(peerId, msg.e2ePublicKey);
-    }
-    // Store the peer's Ed25519 identity public key (base64url) to verify the
-    // signature on every inbound signed CMB from this peer (MMP §8.3).
-    if (msg.publicKey && this._node._peerIdentityKeys) {
-      this._node._pinPeerKey(peerId, msg.publicKey);
-    }
-    // Section 3.5 + 6.4: store peer lifecycle role for validator-origin weight.
-    if (msg.lifecycleRole && this._node._peerLifecycleRoles) {
-      this._node._peerLifecycleRoles.set(peerId, msg.lifecycleRole);
-    }
-  }
-
   /**
    * Get the lifecycle role of the CMB's creator.
    * Checks: 1) peer role from handshake, 2) CMB createdBy matching a known peer.
    * @private
    */
   _getCreatorRole(peerId, msg) {
-    // Anchored mode: authority is EARNED and resolved through the signed grant
-    // chain to the pinned anchor — NEVER the self-declared handshake lifecycleRole
-    // (which any peer can stamp). Elevation additionally requires a verified
-    // signature: the CMB signature verifies against the transport peer's key, so a
-    // verified CMB is authored by peerId, and resolveRole(peerId) is that author's
-    // earned role. An unverified CMB — or one relayed by another author (whose
-    // signature would fail against peerId's key) — gets no elevation. This closes
-    // the self-declaration→2.0×-weight poisoning primitive.
+    // Anchored mode: authority is EARNED and resolved through the signed grant chain to the pinned
+    // anchor — NEVER a self-declared role. Elevation requires a verified record, and goes to its
+    // AUTHOR (the signed createdByNodeId) holding the key that verified it: authority follows the key
+    // (design D3), so a record relayed by another node gets its author's earned role, and an
+    // unverified one none.
     if (this._node._anchor) {
-      if (msg._cmbVerified && typeof this._node.resolveRole === 'function') {
-        return this._node.resolveRole(peerId, Date.now());
+      if (msg._cmbVerified && msg._verifiedAuthorNodeId && typeof this._node.resolveRole === 'function') {
+        return this._node.resolveRole(msg._verifiedAuthorNodeId, Date.now(), { key: msg._authorKey });
       }
       return 'participant';
     }
-    // Unanchored (dev/legacy — no root of trust): the self-declared handshake role.
-    // This path carries NO cryptographic authority; production MUST pin an anchor.
-    const peerRole = this._node._peerLifecycleRoles?.get(peerId);
-    if (peerRole) return peerRole;
-    const createdBy = msg.cmb?.metadata?.createdBy ?? msg.cmb?.createdBy;
-    if (createdBy && this._node._peerLifecycleRoles) {
-      for (const [id, role] of this._node._peerLifecycleRoles) {
-        const peer = this._node._peers?.get(id);
-        if (peer?.name === createdBy) return role;
-      }
-    }
+    // Unanchored (dev — no root of trust): there is no authority to resolve. A Core Secure session
+    // carries no self-declared role, so every author is a participant.
     return 'participant';
   }
 
@@ -428,19 +380,21 @@ class FrameHandler {
     if (payload !== undefined && payload !== null && fusedEntry && fusedEntry.cmb) {
       fusedEntry.cmb.payload = payload;
     }
+    if (fusedEntry) this._markProvenance(fusedEntry, msg);
   }
 
   /**
-   * **DEPRECATED in MMP v0.2.2.** Legacy state-sync handler from MMP v0.2.0.
-   * Hidden states never cross the wire under SVAF (Xu, 2026,
-   * arXiv:2604.03955, §3.4). Retained as a stub so external callers
-   * (tests, etc.) do not break. Cognitive signals arrive on the canonical
-   * 'cmb' channel and are evaluated at SVAF Layer 4.
-   * @deprecated MMP v0.2.2: hidden states do not cross the wire.
+   * What this node knows of an entry's provenance, on the entry: `verified` (the record passed §8.8.5
+   * under a resolved author key on a Core Secure session) and `profile`. A Legacy Import record is
+   * QUARANTINED (design D7): `verified: false`, `profile: 'legacy-import'`, whatever its signature —
+   * never given authority, never shown as verified, flagged on the channel surface.
    * @private
    */
-  _handleStateSync(peerId, peerName, msg) {
-    // No-op. The case dispatcher above logs and drops the frame.
+  _markProvenance(entry, msg) {
+    if (msg && msg._legacyImport) { entry.verified = false; entry.profile = 'legacy-import'; return entry; }
+    entry.verified = !!(msg && msg._cmbVerified === true);
+    entry.profile = 'core-secure';
+    return entry;
   }
 
   /**
@@ -469,7 +423,7 @@ class FrameHandler {
    */
   _surfaceDirectedReject(msg, peerName, peerId, now, decision) {
     if (!msg._directedToMe) return false;
-    const entry = {
+    const entry = this._markProvenance({
       ...msg,
       content: msg.content,
       source: msg.source || peerName,
@@ -478,7 +432,7 @@ class FrameHandler {
       directed: true,
       remixed: false,
       decision: decision || 'rejected',
-    };
+    }, msg);
     this._node._log(`Directed CMB from ${peerName} (peer-bound, MMP §4.4.4) — SVAF ${decision || 'rejected'} for memory; surfacing to agent anyway (remixed:false)`);
     this._markCmbSurfaced(msg._incomingKey);
     this._node.emit('cmb-accepted', entry);
@@ -486,204 +440,108 @@ class FrameHandler {
   }
 
   /**
-   * Verify the Ed25519 signature on an inbound CMB (MMP §8.3). Returns true if
-   * the CMB must be REJECTED (a present-but-invalid signature — forged/tampered;
-   * or unsigned when the node is configured to require signatures). Sets
-   * msg._cmbVerified.
+   * §8.8.5 for an inbound record, Core Secure (design D4, §18.3.1): returns true when the record must
+   * be REFUSED, and on success sets msg._cmbVerified, msg._verifiedAuthorNodeId and msg._authorKey.
    *
-   * The key is resolved from the DELIVERING peer, but a CMB is signed by its
-   * AUTHOR (`signingPayload` binds `cmb.createdBy`). Those coincide only when
-   * the author handed the block over directly. For a RELAYED CMB the resolved
-   * key is the wrong node's, and the verdict is meaningless — so a signed CMB
-   * whose named author is not the deliverer is passed through flagged
-   * unverified rather than reported as forged. Also passed through unverified:
-   * unsigned CMBs, and signed CMBs from a peer whose key we have not seen yet.
-   * Strict mode still rejects unsigned.
+   *   - the record must be a signed `mmp-sig-v2.0` record: an unsigned or legacy-suite record does
+   *     not enter Core Secure (it may only arrive on a Legacy Import session, below);
+   *   - the author key is resolved by `createdByNodeId` through the key registry (design D3) — never
+   *     by `createdBy`, never from the delivering session: a record from an author this node has
+   *     never proven and no grant vouches is unresolvable, and refused (release note M12: such "X via
+   *     Y" deliveries no longer surface);
+   *   - the signature, the application commitment and the assertion identity must verify;
+   *   - the signed audience (room, recipient) must be this node's.
    *
-   * What this does NOT do is authenticate a relayed CMB — it cannot, because
-   * the author's key is unresolvable from a name (see the comment at the
-   * rejection branch). It stops mislabelling unverifiable as forged.
+   * Failure at any step is a refusal, never an "unverified success" (§8.8.5).
+   *
+   * A legacy-suite record is refused WITHOUT being counted as a forgery: it is ordinary pre-v2.0
+   * history (a 0.13 node's whole store), not an attack, so it goes on its own metric
+   * (`cmb-legacy-suite-refused`) and never on `cmb-signature-rejected` or a rejected-signature
+   * decision (P-6: refusing a record is not accusing it).
    * @private
    */
   _rejectOnBadSignature(peerId, peerName, msg) {
     const cmb = msg.cmb;
-    // v2 carries the address in metadata; a pre-boundary record at the top level. Logs and
-    // metrics must name the block either way — an undefined key in a security log is worse
-    // than no log, because it reads as a record with no address.
-    const cmbKeyOf = recordKey;   // shared accessor — see lib/record.js
-    if (!cmb) { msg._cmbVerified = false; return false; }
+    if (!cmb || typeof cmb !== 'object') { msg._cmbVerified = false; return true; }
+    if (msg._legacyImport) return this._rejectLegacyImport(peerId, peerName, msg);
     const { verifyCMB, assertionIdV2_0 } = require('./core');
-
-    // Published v2.0 records (mmp-sig-v2.0) sign the author's NODE ID, so the verifying key is the
-    // one held for createdByNodeId, never the delivering peer's (§8.8.4, §18.3.1): verified against
-    // the deliverer, a peer could vouch for a record by signing it itself under someone else's id.
-    // Their assertionId must also be the one the preimage yields (§8.8.5 step 5).
     const md = cmb.metadata;
-    if (md && md.signatureSuite === 'mmp-sig-v2.0' && typeof md.createdByNodeId === 'string' && md.createdByNodeId) {
-      const authorKey = typeof this._node._identityKey === 'function'
-        ? this._node._identityKey(md.createdByNodeId)
-        : this._node._peerIdentityKeys?.get(md.createdByNodeId);
-      // No key for the author yet is key-distribution latency, not forgery: unverified, as for v1.
-      // Its audience is still the one it carries (see _audienceRefused).
-      if (!authorKey) { msg._cmbVerified = false; return this._audienceRefused(peerId, peerName, cmb, false); }
-      const v2 = verifyCMB(cmb, authorKey);
-      // A record that declares the v2.0 suite but is malformed for it (no room, no key, …) has no
-      // preimage: assertionIdV2_0 throws. That is a mismatch to reject, never an exception: on the
-      // relay path nothing above this catches it, and one such frame ended the daemon.
-      let derivedId = null;
-      try { derivedId = assertionIdV2_0(cmb); } catch { /* not a well-formed v2.0 record */ }
-      const idOk = md.assertionId === undefined || md.assertionId === derivedId;
-      // Verified is not addressed here: the audience the author signed is checked next, as on every
-      // suite. Returning here skipped it, so a v2.0 record signed for another room or node was stored.
-      if (v2.valid && idOk) {
-        msg._cmbVerified = true;
-        msg._verifiedAuthorNodeId = md.createdByNodeId;
-        return this._audienceRefused(peerId, peerName, cmb, true);
-      }
-      const reason = !v2.valid ? (v2.error || 'invalid') : 'assertion-id-mismatch';
-      const k = recordKey(cmb);
-      this._node._log(`[sym-security] v2.0 CMB ${String(k || '').slice(0, 16)} from ${peerName} rejected — ${reason} (author ${md.createdByNodeId.slice(0, 8)})`);
-      this._node.emit('metric', { type: 'cmb-signature-rejected', from: peerName, key: k, reason: 'invalid', error: reason });
+    const k = recordKey(cmb);
+    const refuse = (reason, error) => {
+      msg._cmbVerified = false;
+      this._node._log(`[sym-security] CMB ${String(k || '').slice(0, 16)} from ${peerName} refused — ${reason}${error ? ` (${String(error).slice(0, 120)})` : ''}`);
+      this._node.emit('metric', { type: 'cmb-signature-rejected', from: peerName, key: k, reason, error: error || reason });
       if (typeof this._node._recordDecision === 'function') {
-        this._node._recordDecision({ method: 'signature', source: msg.source || peerName, cmbKey: k, decision: 'rejected-signature', totalDrift: null, categoryDrifts: null, gateValues: null, focusLabel: reason, remix: recordParents(cmb).length > 0 });
+        // The recorded label is the ACTUAL verdict (content-mismatch, bad-signature, …), not a constant.
+        this._node._recordDecision({ method: 'signature', source: peerName, cmbKey: k, decision: 'rejected-signature', totalDrift: null, categoryDrifts: null, gateValues: null, focusLabel: error || reason, remix: recordParents(cmb).length > 0 });
       }
       return true;
-    }
-    // On any other suite no signature covers an assertionId, so a carried one is an unsigned claim
-    // a relay could set. It is dropped rather than kept beside verified fields.
-    if (md && Object.prototype.hasOwnProperty.call(md, 'assertionId')) delete md.assertionId;
-
-    // Resolve through the roster registry (anchor > handshake > grant-vouched)
-    // so CMBs relayed from peers we never directly handshook still verify,
-    // falling back to the direct-handshake map.
-    const senderKey = typeof this._node._identityKey === 'function'
-      ? this._node._identityKey(peerId)
-      : this._node._peerIdentityKeys?.get(peerId);
-    const v = verifyCMB(cmb, senderKey);
-
-    if (!v.signed) {
+    };
+    if (!md || typeof md !== 'object' || md.signatureSuite !== 'mmp-sig-v2.0') {
       msg._cmbVerified = false;
-      if (this._node._requireSignedCmb && senderKey) {
-        this._node._log(`[sym-security] UNSIGNED CMB from ${peerName} rejected (SYM_REQUIRE_SIGNED_CMB)`);
-        this._node.emit('metric', { type: 'cmb-signature-rejected', from: peerName, key: cmbKeyOf(cmb), reason: 'unsigned' });
-        return true;
-      }
-      return false;
+      this._node.emit('metric', { type: 'cmb-legacy-suite-refused', from: peerName, key: k, suite: md && typeof md.signatureSuite === 'string' ? md.signatureSuite.slice(0, 32) : null });
+      this._sayLegacySuite(peerId, peerName);
+      return true;
     }
-
-    if (!senderKey) {
-      // Signed, but this peer's identity key isn't known on this transport yet
-      // (handshake not processed). Cannot verify — do not reject; treat unverified. A two-section
-      // record's audience is still checked (see _audienceRefused).
-      msg._cmbVerified = false;
-      return cmb.metadata ? this._audienceRefused(peerId, peerName, cmb, false) : false;
+    if (!md.sig) return refuse('unsigned');
+    if (typeof md.createdByNodeId !== 'string' || !md.createdByNodeId) return refuse('no-author-node-id');
+    const authorKey = this._node._identityKey(md.createdByNodeId);
+    if (!authorKey) {
+      this._node.emit('metric', { type: 'cmb-author-unresolvable', from: peerName, author: md.createdByNodeId, key: k });
+      return refuse('unresolvable-author', `no proven, pinned or vouched key for ${String(md.createdByNodeId).slice(0, 8)}`);
     }
+    const v = verifyCMB(cmb, authorKey);
+    if (!v.valid) return refuse('invalid', v.error || 'invalid');
+    // A record that declares the v2.0 suite but is malformed for it has no preimage: assertionIdV2_0
+    // throws. That is a mismatch to refuse, never an exception.
+    let derivedId = null;
+    try { derivedId = assertionIdV2_0(cmb); } catch { /* not a well-formed v2.0 record */ }
+    if (!derivedId || md.assertionId !== derivedId) return refuse('assertion-id-mismatch');
+    msg._cmbVerified = true;
+    msg._verifiedAuthorNodeId = md.createdByNodeId;
+    msg._authorKey = authorKey;
+    // Verified is not addressed here: the audience the author signed is checked next (§8.8.5 step 7).
+    return this._audienceRefused(peerId, peerName, cmb, true);
+  }
 
-    // §7.8 GRANDFATHERING — a pre-boundary block is UNATTESTED, not FORGED (P-6).
-    //
-    // `verifyCMB` returns {valid:false} for three different situations and core keeps them
-    // apart deliberately. Collapsing them here was the defect: a v1-signed record minted under
-    // a scheme we still recognise carries no v2 attestation, so it cannot be *verified* — but it
-    // was never *refused*, and every node's entire pre-boundary history is exactly this shape.
-    // Treating it as a forgery would mean that on the first packet after the boundary, every node
-    // rejects every peer's whole history AND writes `forged/tampered` into the security log for
-    // records whose only fault is being old. That corrupts the audit trail as well as the data
-    // path, and an audit trail that cries forgery about ordinary history is worse than none.
-    //
-    // `legacy-key-rejected` MUST keep rejecting: those keys were refused by the §19.1 fail-closed
-    // membrane BEFORE the boundary and are refused identically after. Preserve core's split;
-    // widening it would quietly promote a refused block into a merely-unattested one.
-    const grandfathered = v.error === 'unverified-legacy';
-
-    if (!v.valid && !grandfathered) {
-      const keyShort = String(cmbKeyOf(cmb) || '').slice(0, 16);
-      // RELAYED ≠ FORGED. The key resolved above belongs to the node that DELIVERED this
-      // CMB (`_identityKey` is keyed by the transport peer), but the signature is made by the
-      // AUTHOR — the signing payload binds `createdBy`. On a relayed CMB those are different
-      // nodes, so the verdict above was computed against the WRONG key and says nothing about
-      // authenticity: an untouched, genuinely-signed block fails it every time. Only the case
-      // we can PROVE is the wrong key relaxes — a named author that is not the deliverer. An
-      // absent author, or an author that IS the deliverer, still hard-rejects below, so
-      // omitting `createdBy` cannot dodge rejection. The author's own key is deliberately NOT
-      // resolved here: the roster is keyed by nodeId while `createdBy` is a NAME, and a name
-      // index would silently resolve the wrong key the first time two nodes share a name —
-      // binding `createdByNodeId` into the signing payload is the correct fix and is an MMP
-      // schema change. Passing unverified matches the posture already taken for a key we
-      // cannot resolve: unresolvable passes, provably-wrong-key passes as UNVERIFIED, and
-      // only a verdict computed against the RIGHT key rejects.
-      const author = (cmb.metadata && cmb.metadata.createdBy) || cmb.createdBy || null;
-      if (author && author !== peerName) {
-        // Try the AUTHOR'S key before concluding anything. Three outcomes, each earned:
-        // resolvable and VALID → a genuine relay, verified against the key that signed it;
-        // resolvable and INVALID → a true forgery, falls through to the rejection below
-        // (the P-6 arm: a bad signature against the RIGHT key is still forged);
-        // unresolvable → unverifiable, passed unverified — the posture already taken for a
-        // key we cannot resolve, now consistent instead of branding every relay a forgery.
-        const authorKey = typeof this._node._identityKey === 'function'
-          ? this._node._identityKey(author)
-          : this._node._peerIdentityKeys?.get(author);
-        if (authorKey) {
-          const va = verifyCMB(cmb, authorKey);
-          if (va.valid) { msg._cmbVerified = true; return this._audienceRefused(peerId, peerName, cmb, true); }
-          // fall through: verified against the author's own key and it is wrong — forged.
-        } else {
-          msg._cmbVerified = false;
-          this._node._log(`[sym-security] UNVERIFIABLE CMB ${keyShort} authored by ${author}, relayed via ${peerName} — this node holds no key for the author; passing unverified${v.error ? ' (' + v.error + ')' : ''}`);
-          this._node.emit('metric', { type: 'cmb-signature-unverifiable', from: peerName, author, key: cmbKeyOf(cmb), reason: v.error || 'author-key-unavailable' });
-          return cmb.metadata ? this._audienceRefused(peerId, peerName, cmb, false) : false;
-        }
-      }
-      // verifyCMB distinguishes WHY it refused — 'legacy-key-rejected', 'bad-signature',
-      // 'content-mismatch', 'no-public-key'. Recording the constant instead of the reason
-      // made 1,538 rejections on this host — 32% of all SVAF decisions — indistinguishable:
-      // version-skew peers, real signature failures and content mismatches under one label.
-      // (§7.8 above already grandfathers 'unverified-legacy'; this branch is the REFUSED set.)
-      const reason = v.error || 'bad-signature';
-      // A pre-v1 key is VERSION SKEW, not an attack: a peer that has not upgraded must not
-      // read as hostile in the security log.
-      const legacyKey = reason === 'legacy-key-rejected';
-      // Root vs remix, captured HERE because a rejected CMB is dropped and never stored —
-      // this decision record is the only place the distinction can survive. Lineage lives in
-      // metadata on the two-section record; the top-level fallback reads pre-boundary frames.
-      const lin = (cmb.metadata && cmb.metadata.lineage) || cmb.lineage;
-      const remix = !!(lin && Array.isArray(lin.parents) && lin.parents.length);
-      this._node._log(legacyKey
-        ? `[sym-security] LEGACY-KEY CMB ${keyShort} from ${peerName} rejected — pre-v1 key scheme (version skew, not forgery)`
-        : `[sym-security] BAD SIGNATURE on CMB ${keyShort} from ${peerName} — forged/tampered, rejected (${reason})`);
-      // `reason` keeps 'invalid' so nothing downstream breaks; `error` carries the verdict.
-      this._node.emit('metric', { type: 'cmb-signature-rejected', from: peerName, key: cmbKeyOf(cmb), reason: 'invalid', error: reason });      if (typeof this._node._recordDecision === 'function') {
-        this._node._recordDecision({
-          method: 'signature', source: msg.source || peerName, cmbKey: cmbKeyOf(cmb),
-          decision: 'rejected-signature', totalDrift: null, categoryDrifts: null, gateValues: null,
-          focusLabel: reason, remix,
-        });
-      }
-      return true;
-    }
+  /**
+   * Say, at most once a minute per peer, that pre-v2.0 records from it are refused (they are counted
+   * on every refusal by the `cmb-legacy-suite-refused` metric).
+   * @private
+   */
+  _sayLegacySuite(peerId, peerName) {
+    const now = Date.now();
+    const k = `legacy-suite|${peerId}`;
+    const said = this._audienceSaid.get(k);
+    if (said && now - said.at < 60000) { said.more++; return; }
+    this._audienceSaid.delete(k);
+    if (this._audienceSaid.size >= 1024) this._audienceSaid.delete(this._audienceSaid.keys().next().value);
+    this._audienceSaid.set(k, { at: now, more: 0 });
+    const more = said && said.more ? ` (and ${said.more} more since it was last said)` : '';
+    this._node._log(`CMB from ${peerName} refused — a pre-v2.0 (legacy-suite) record does not enter Core Secure${more}`);
+  }
 
-    if (grandfathered) {
-      // Surfaced, readable, and recorded as what it is. A DISTINCT metric, because the whole
-      // point is that this is not the forgery counter — an operator watching
-      // `cmb-signature-rejected` spike at the cutover must not see legacy traffic in it.
-      this._node.emit('metric', { type: 'cmb-legacy-unverified', from: peerName, key: cmbKeyOf(cmb), reason: 'unverified-legacy' });
+  /**
+   * A record on a Legacy Import session (design D7): accepted only when its signature — any suite
+   * the internal verifier knows — verifies against the route's PINNED key, and only for records the
+   * routed node itself authored. It is quarantined downstream (verified: false, profile
+   * legacy-import): never given authority, never shown as verified.
+   * @private
+   */
+  _rejectLegacyImport(peerId, peerName, msg) {
+    const { verifyCMB } = require('./core');
+    const cmb = msg.cmb;
+    const pinned = msg._legacyPinnedKey;
+    const k = recordKey(cmb);
+    const v = pinned ? verifyCMB(cmb, pinned) : { valid: false, error: 'no-pinned-key' };
+    if (!v.valid) {
+      this._node._log(`[legacy-import] CMB ${String(k || '').slice(0, 16)} from ${peerName} refused — it does not verify against the route's pinned key (${v.error || 'invalid'})`);
+      this._node.emit('metric', { type: 'legacy-import-refused', from: peerName, key: k, reason: v.error || 'invalid' });
+      return true;
     }
-
-    // Grandfathered blocks fall THROUGH to the audience check rather than returning here, and
-    // that is deliberate. `checkAudience` reads the audience from the top level on a
-    // pre-boundary record and applies to exactly the v1 keys being grandfathered — so an early
-    // return would admit a cross-room legacy replay while fixing the forgery misreport. Closing
-    // one hole by opening another is not a fix.
-
-    // Audience (§18.3.1): a genuinely-signed v1 CMB whose bound room is not this
-    // node's room, or which is directed at another node, is a cross-room / mis-
-    // directed replay. Reject it — reported distinctly from a bad signature.
-    if (this._audienceRefused(peerId, peerName, cmb, !grandfathered)) return true;
-
-    // Unattested is not verified. A grandfathered block is admitted and readable, but it MUST
-    // NOT be marked verified — anything downstream weighing this flag is entitled to know the
-    // difference between "this peer proved authorship" and "this predates the proof".
-    msg._cmbVerified = !grandfathered;
-    return false;
+    msg._cmbVerified = false;          // quarantined: never verified, whatever its signature
+    if (cmb.metadata && Object.prototype.hasOwnProperty.call(cmb.metadata, 'assertionId') && cmb.metadata.signatureSuite !== 'mmp-sig-v2.0') delete cmb.metadata.assertionId;
+    return this._audienceRefused(peerId, peerName, cmb, false);
   }
 
   /**
@@ -720,111 +578,106 @@ class FrameHandler {
   }
 
   /**
-   * MMP §7 cmb-fetch: content-addressed retrieval. A peer asks for the CMB this
-   * store holds under an exact content-address key — the §15.8 re-verification
-   * path (fetch an unresolvable lineage root, verify the address, re-encode,
-   * recompute the tether). Serving is discretionary and same-room by
-   * construction (only connected peers can ask); the response is self-verifying
-   * (the requester recomputes the content address), so no trust is extended by
-   * serving and none is required of the server. A record is served as signed
-   * (recordAsSigned): each category's text, its signed `meta` and mood's values, never
-   * a vector — the content address binds text, and re-verifiers re-encode in their
-   * own kernel, so vectors are dead weight.
+   * Serve a cmb-fetch (MMP §7, §15.8) over Core Secure (design D1): every record found goes out as
+   * its OWN `cmb` frame — sealed as `cmb-encrypted` like any record, as signed (recordAsSigned), never
+   * plaintext (§18.2.1) — and then one `cmb-fetch-result` that carries only the correlation id and
+   * the key lists:
+   *
+   *   { type: 'cmb-fetch-result', reqId, found: [key…], notFound: [key…], timestamp }
+   *
+   * sealed as a control frame (`control-encrypted`). The session is ordered, so the records arrive
+   * before the result that lists them. A request names one `key` (the §7 schema) or up to
+   * MAX_FETCH_KEYS `keys`. Only a signed v2.0 record is served; anything else is not found.
    * @private
    */
-  _handleCmbFetch(peerId, peerName, msg) {
-    if (!msg || typeof msg.key !== 'string' || !msg.reqId) return;
-    const peer = this._node._peers.get(peerId);
-    if (!peer?.transport?.send) return;
-    const entry = this._node._store.get(msg.key);
-    const cmb = entry?.cmb;
-    let served = null;
-    if (cmb && cmb.categories && typeof cmb.categories === 'object') {
-      // A pre-boundary record's categories, served text-only (below).
-      const categories = {};
-      for (const [f, v] of Object.entries(cmb.categories)) {
-        if (v && typeof v === 'object') {
-          categories[f] = { text: v.text ?? '' };
-          if (f === 'mood') {
-            if (typeof v.valence === 'number') categories[f].valence = v.valence;
-            if (typeof v.arousal === 'number') categories[f].arousal = v.arousal;
-          }
-        } else {
-          categories[f] = { text: String(v ?? '') };
-        }
-      }
-      // §15.8 serves a RECORD, and the record is two sections. Serving the flat shape would
-      // hand the requester something that validates against neither schema — and cmb-fetch is
-      // self-verifying, so the requester would recompute the address and refuse it.
-      // A pre-boundary record is served in the shape it was stored in: the legacy DAG stays
-      // readable and is never re-keyed (§7.8).
-      // The two sections are served exactly as signed, as a copy. Picking metadata fields dropped
-      // the v2.0 ones (signatureSuite, addressScheme, createdByNodeId, application, assertionId), and
-      // serving categories as text alone dropped each category's `meta`, whose parents the signature
-      // commits to: either way the requester could not verify what it fetched.
-      const m = cmb.metadata;
-      served = m
-        ? recordAsSigned(cmb)
-        : {
-            key: cmb.key, createdBy: cmb.createdBy, createdAt: cmb.createdAt,
-            categories, lineage: cmb.lineage ?? null,
-            sig: cmb.sig, sigAlg: cmb.sigAlg, room: cmb.room, to: cmb.to,
-          };
+  _handleCmbFetch(peerId, peerName, msg, session) {
+    if (!msg || typeof msg.reqId !== 'string' || !msg.reqId || msg.reqId.length > 128) return;
+    if (!session || typeof session.send !== 'function') return;
+    const asked = Array.isArray(msg.keys) ? msg.keys.slice(0, MAX_FETCH_KEYS) : [msg.key];
+    const found = [];
+    const notFound = [];
+    const seen = new Set();
+    for (const key of asked) {
+      if (typeof key !== 'string' || !key || key.length > 128 || seen.has(key)) continue;
+      seen.add(key);
+      const cmb = this._node._store.get(key)?.cmb;
+      const servable = !!(cmb && cmb.metadata && cmb.metadata.signatureSuite === 'mmp-sig-v2.0' && cmb.metadata.sig);
+      if (servable && session.send({ type: 'cmb', cmb: recordAsSigned(cmb) }) !== false) found.push(key);
+      else notFound.push(key);
     }
-    peer.transport.send({
-      type: 'cmb-fetch-result', reqId: msg.reqId, key: msg.key,
-      found: !!served, cmb: served, timestamp: Date.now(),
-    });
-    if (served) this._node._log(`[cmb-fetch] served ${msg.key.slice(0, 16)}… to ${peerName}`);
+    if (found.length + notFound.length === 0) return;
+    session.send({ type: 'cmb-fetch-result', reqId: msg.reqId, found, notFound, timestamp: Date.now() });
+    if (found.length) this._node._log(`[cmb-fetch] served ${found.length} record(s) (${found[0].slice(0, 16)}…) to ${peerName}`);
+  }
+
+  /**
+   * The answer a peer sent this node's cmb-fetch: the correlation id and the key lists, after the
+   * records themselves (see _handleCmbFetch). A record that verified has already resolved the
+   * request; a request still open here got no verifying record from this peer — listed `notFound`,
+   * listed `found` but discarded on its content address, or never sent — so this peer counts as a
+   * miss. Only a peer the request was sent to can close it (fetchCMB).
+   * @private
+   */
+  _handleCmbFetchResult(peerId, peerName, msg, session) {
+    const reqId = msg && typeof msg.reqId === 'string' ? msg.reqId : null;
+    if (!reqId) return;
+    if (session && session._fetchExpect) {
+      for (const [k, r] of [...session._fetchExpect]) if (r === reqId) session._fetchExpect.delete(k);
+    }
+    const pending = this._node._cmbFetchPending?.get(reqId);
+    if (!pending) return;
+    pending.miss(peerId);
   }
 
   /**
-   * Resolve a pending fetchCMB() request. The response is accepted only if the
-   * recomputed content address equals the requested key — a mismatched or
-   * forged response is discarded (counted as a miss) and reported.
+   * Note on `session` that a record with `key` answers this node's fetch `reqId`: it is routed to
+   * the fetch (a self-verifying content-address check) rather than admitted (see _handleMemoryShare).
+   * At most 64 are kept per session.
+   */
+  expectFetched(session, key, reqId) {
+    if (!session || typeof session !== 'object' || typeof key !== 'string') return;
+    if (!session._fetchExpect) session._fetchExpect = new Map();
+    if (session._fetchExpect.size >= 64) session._fetchExpect.delete(session._fetchExpect.keys().next().value);
+    session._fetchExpect.set(key, reqId);
+  }
+
+  /**
+   * A record that answers this node's cmb-fetch on `session`. §15.8 is SELF-VERIFYING: the requester
+   * recomputes the content address, so serving extends no trust and requires none. classifyAddress
+   * derives by the record's structural role and separates "could not check" from "does not match".
    * @private
    */
-  _handleCmbFetchResult(peerId, peerName, msg) {
-    const pending = this._node._cmbFetchPending?.get(msg?.reqId);
+  _resolveFetched(peerId, peerName, msg, reqId) {
+    const pending = this._node._cmbFetchPending?.get(reqId);
     if (!pending) return;
-    const cmb = msg.found ? msg.cmb : null;
-    // §15.8 is SELF-VERIFYING: the requester recomputes the content address, so serving a
-    // block extends no trust and requires none. Under v2 the address lives in metadata and is
-    // the Merkle root over the seven categoryKeys — content-only, so recomputing it needs nothing
-    // but the categories that arrived. A pre-boundary record is checked the old way; the legacy DAG
-    // stays readable and is never re-keyed (§7.8).
+    const cmb = msg.cmb;
     const served = cmb?.metadata?.key ?? cmb?.key;
     if (!cmb || served !== pending.key) { pending.miss(peerId); return; }
-    // ONE ANSWER, FROM CORE. This dispatched on `cmb.metadata` and called blockKeyV2 or
-    // recomputeKey itself — a workaround for core's recomputeKey, which read `cmb.key` (absent
-    // on v2 records) and derived roots with the flat scheme while createCMB minted Merkle.
-    // core 0.8.1 fixes that, and the workaround becomes a REGRESSION the moment it does: a
-    // pre-boundary record with a FLAT root key now recomputes to the Merkle address and is
-    // DISCARDED AS FORGED. Measured, not reasoned — the whole legacy DAG would have been
-    // dropped on fetch, and sym's 309 green tests do not cover that shape.
-    //
-    // classifyAddress is core's answer to the same question: it derives by the record's
-    // STRUCTURAL ROLE, tries the derivations that could legitimately have minted it, and NAMES
-    // the one that matched. It also separates "I could not check this" from "this does not
-    // match", which matters here because both used to arrive as a bare null and this call site
-    // treated null as a mismatch — accusing a record it had merely failed to read.
     const verdict = classifyAddress(cmb);
     if (verdict.state !== 'verified') {
       const why = verdict.state === 'mismatch' ? 'MISMATCH' : `UNVERIFIABLE (${verdict.reason})`;
       this._node._log(`[cmb-fetch] content-address ${why} from ${peerName} for ${String(pending.key).slice(0, 16)}… — discarded`);
-      this._node.emit('metric', {
-        type: 'cmb-fetch-forged', from: peerName, key: pending.key,
-        // The three classes must not merge in telemetry either: a spike of unverifiable
-        // records is a compatibility problem, a spike of mismatches is an attack.
-        verdict: verdict.state, scheme: verdict.scheme ?? null,
-      });
+      this._node.emit('metric', { type: 'cmb-fetch-forged', from: peerName, key: pending.key, verdict: verdict.state, scheme: verdict.scheme ?? null });
       pending.miss(peerId);
       return;
     }
     pending.resolve({ cmb, from: peerName, peerId });
   }
 
-  _handleMemoryShare(peerId, peerName, msg) {
+  _handleMemoryShare(peerId, peerName, msg, session) {
+    // A record answering this node's cmb-fetch on this session is the fetch's, not an admission.
+    const fk = msg && msg.cmb ? recordKey(msg.cmb) : null;
+    if (session && session._fetchExpect && fk && session._fetchExpect.has(fk)) {
+      const reqId = session._fetchExpect.get(fk);
+      session._fetchExpect.delete(fk);
+      return this._resolveFetched(peerId, peerName, msg, reqId);
+    }
+    if (session && session._anchorKeys && fk && session._anchorKeys.has(fk)) {
+      session._anchorKeys.delete(fk);
+      msg._anchor = true;
+    }
+    // The session rides beside the frame, never on it: entries are built from the frame and kept.
+    if (session) this._sessionOf.set(msg, session);
     let pending;
     try {
       pending = this._handleMemoryShareInner(peerId, peerName, msg);
@@ -856,24 +709,6 @@ class FrameHandler {
       if (Object.prototype.hasOwnProperty.call(msg, own)) delete msg[own];
     }
 
-    // Decrypt E2E-encrypted CMB categories if present
-    if (msg.cmb && typeof msg.cmb.categories === 'string' && msg.cmb._e2e) {
-      const sharedSecret = this._node._peerSharedSecrets?.get(peerId);
-      if (sharedSecret) {
-        try {
-          msg.cmb.categories = decryptCategories(msg.cmb.categories, msg.cmb._e2e.nonce, sharedSecret);
-          delete msg.cmb._e2e;
-          this._node._log(`E2E decrypted categories from ${peerName}`);
-        } catch (err) {
-          this._node._log(`E2E decryption failed from ${peerName}: ${err.message}`);
-          return; // Cannot process corrupted/tampered frame
-        }
-      } else {
-        this._node._log(`E2E encrypted frame from ${peerName} but no shared secret — dropping`);
-        return;
-      }
-    }
-
     // No size bound here beyond the frame the record arrived in. The record bounds are minting
     // rules (cmb-encoder): earlier releases minted larger categories and longer agent ids, and
     // refusing those would stop this node hearing such a peer at all.
@@ -886,23 +721,37 @@ class FrameHandler {
     }
     if (!msg.content) return;
 
-    // CMB authentication (MMP §8.3). A signed CMB verifies against its AUTHOR's
-    // Ed25519 key. When the author delivered it directly, the peer's announced
-    // handshake key IS that key and a present-but-invalid signature means forged
-    // or tampered in flight — reject outright (audit-logged, never surfaced or
-    // stored). When the block was RELAYED, the author's key is not resolvable
-    // here, so it is flagged unverified rather than rejected. Unsigned CMBs
-    // (older peers, or peers without a known key yet) are likewise allowed
-    // through for interop but flagged unverified on msg._cmbVerified.
+    // §8.8.5 verification (design D4): a signed v2.0 record whose author key resolves by
+    // createdByNodeId, signature, application, assertion identity and audience all valid — or it is
+    // refused. On a Legacy Import session: verified against the route's pinned key, then quarantined.
     if (this._rejectOnBadSignature(peerId, peerName, msg)) return;
 
-    // An UNSIGNED record is still accepted (as unverified) for interop, but counted and named once
-    // per peer, so the emitters that would break under a signed-only default can be found first.
-    if (msg.cmb?.metadata && !msg.cmb.metadata.sig) {
-      this._node.emit('metric', { type: 'cmb-unsigned-received', from: peerName, key: recordKey(msg.cmb) });
-      if (!this._unsignedWarned.has(peerId)) {
-        this._unsignedWarned.add(peerId);
-        this._node._log(`UNSIGNED CMB from ${peerName}: accepted as unverified. A future release will refuse unsigned records by default.`);
+    // THE HOST HOOK (design D1, review H9): a record that passed every check, with the proven facts
+    // of the session that delivered it. Hosts read this instead of reaching into the frame handler.
+    const session = this._sessionOf.get(msg);
+    if (msg._cmbVerified === true && !msg._legacyImport && this._node.listenerCount('verified-record') > 0) {
+      const md = msg.cmb.metadata;
+      const verification = Object.freeze({
+        suite: md.signatureSuite,
+        assertionId: md.assertionId,
+        authorNodeId: md.createdByNodeId,
+        authorName: md.createdBy,
+        authorKey: msg._authorKey,
+        authorKeySource: this._node._roster ? (this._node._roster.source(md.createdByNodeId) || 'session') : null,
+        audience: typeof md.to === 'string' && md.to ? 'directed' : 'room',
+        room: md.room,
+        to: md.to ?? null,
+        relayed: md.createdByNodeId !== peerId,
+        anchor: msg._anchor === true,
+      });
+      // The record is the host's own frozen copy: a listener can neither change what this node stores
+      // and evaluates next, nor what the next listener sees.
+      const event = Object.freeze({ record: deepFreeze(structuredClone(msg.cmb)), session: this._node._sessionFacts(session), verification });
+      if (typeof this._node._emitIsolated === 'function') {
+        const why = (e) => { try { return (e && e.message) || String(e); } catch { return 'unprintable error'; } };
+        this._node._emitIsolated('verified-record', event, String(recordKey(msg.cmb)).slice(0, 16), why, (m) => { try { this._node._log(m); } catch { /* */ } });
+      } else {
+        this._node.emit('verified-record', event);
       }
     }
 
@@ -913,35 +762,34 @@ class FrameHandler {
     // here: the record verified under the delivering peer's key AND names that peer as its author.
     // A relayed or unverified record keeps `nodeId: null` — the label is shown, identity is not
     // claimed. `msg.source` is an unsigned frame field and never names the author.
-    const claimedNodeId = msg.cmb?.metadata?.createdByNodeId || null;
     msg.author = {
       name: recordCreatedBy(msg.cmb) || peerName,
-      // Established when the signature proved it: a v2.0 record verified against its signed node id
-      // (even when relayed), or any verified record its author delivered itself.
-      nodeId: msg._verifiedAuthorNodeId
-        || (msg._cmbVerified === true && claimedNodeId === peerId ? claimedNodeId : null),
+      // The cryptographic author (§8.8.4): the signed createdByNodeId the signature verified against,
+      // even when relayed. A quarantined Legacy Import record names no verified author.
+      nodeId: msg._cmbVerified === true ? (msg._verifiedAuthorNodeId || null) : null,
       via: { name: peerName, nodeId: peerId },
     };
 
-    // MMP §4.4.4 directed (peer-bound) delivery — decided here, before the de-duplication and
-    // echo checks, because both of them used to drop directed CMBs that §9.2.2 says MUST
-    // surface. See the full note where SVAF is invoked below.
-    // A verified record carries its author's signed addressee (metadata.to), and it must agree with
-    // the frame. An unverified record can only be judged by the frame flags, which is enough to
-    // surface it (§9.2.2) but not to exempt it from echo suppression below (re-review F1).
-    // A record that signs no addressee field at all (another implementation) is judged by the frame.
-    const frameDirected = msg.directed === true && !!msg.to && msg.to === this._node.nodeId;
+    // MMP §9.2.2 binding (design D4): taken from the authenticated `metadata.to` — signed (§8.8.4)
+    // and AAD-bound to the sealed frame — never from a relay envelope or a frame flag, which no
+    // longer distinguish anything: a sealed broadcast is one frame per session, each addressed to
+    // its recipient. `to` absent or null is room-bound and SVAF-gated. Only a Legacy Import record
+    // (0.13 wire, design D7) is judged by its frame's flags, and it is quarantined.
     const meta = msg.cmb?.metadata;
-    const signedTo = meta && Object.prototype.hasOwnProperty.call(meta, 'to') ? meta.to : undefined;
+    const signedTo = meta && typeof meta.to === 'string' && meta.to ? meta.to : null;
     const verified = msg._cmbVerified === true;
-    // When the author signed an addressee, that alone decides (§8.8.5 step 7): the frame flags are
-    // a relay's to set, so stripping `directed` must not turn a signed directed CMB into an
-    // SVAF-gated broadcast, and adding it must not make a signed broadcast directed.
-    const signedAddressee = verified && typeof signedTo === 'string' && signedTo.length > 0;
-    msg._directedToMe = signedAddressee
-      ? signedTo === this._node.nodeId
-      : frameDirected && !(verified && signedTo !== undefined && signedTo !== this._node.nodeId);
+    if (msg._legacyImport) {
+      const frameDirected = msg.directed === true && !!msg.to && msg.to === this._node.nodeId;
+      msg._directedToMe = signedTo ? signedTo === this._node.nodeId : frameDirected;
+    } else {
+      msg._directedToMe = verified && signedTo === this._node.nodeId;
+    }
     const authenticatedDirected = msg._directedToMe && verified && signedTo === this._node.nodeId;
+    // What every entry built from this frame says about its addressing is the binding just decided,
+    // never what a frame carried: `directed` / `to` on a stored or surfaced entry (an admitted
+    // directed record surfaces through the store's own cmb-accepted) are the signed metadata.to.
+    msg.directed = msg._directedToMe === true;
+    if (msg.directed) msg.to = this._node.nodeId; else delete msg.to;
 
     const now = Date.now();
     // MMP v2.0 P0.7: freshness is the author's SIGNED assertion, not an unsigned frame field.
@@ -1022,6 +870,25 @@ class FrameHandler {
     // it once the CMB has actually been delivered.
     msg._incomingKey = incomingKey || null;
 
+    const app = meta && meta.application;
+    // A payload (remember({ payload })) rides as the record's signed application section; it is given
+    // back beside the record as `cmb.payload`, as earlier releases carried it.
+    if (verified && app && app.schema === PAYLOAD_SCHEMA && app.mediaType === 'application/json' && typeof app.data === 'string') {
+      try { msg.cmb.payload = JSON.parse(Buffer.from(app.data, 'base64url').toString('utf8')); } catch { /* not JSON: left in the section */ }
+    }
+
+    // A MESSAGE (design D1): Core Secure retires the `message` frame; a message is a directed record
+    // whose signed application section is the sym message schema. It raises the local 'message'
+    // event (§14.9.1) exactly once (the de-duplication above covers replays) and is not admitted to
+    // memory, as a message frame never was.
+    if (msg._directedToMe && verified && app && app.schema === MESSAGE_SCHEMA && app.mediaType === 'text/plain' && typeof app.data === 'string') {
+      const text = Buffer.from(app.data, 'base64url').toString('utf8');
+      this._markCmbSurfaced(msg._incomingKey);
+      this._node._log(`Message from ${msg.author.name}: ${text.slice(0, 60)}`);
+      this._node.emit('message', msg.author.name, text, Object.freeze({ from: msg.author.nodeId, fromName: msg.author.name, content: text, timestamp: meta.createdTimestamp, key: cognitionKey, assertionId: meta.assertionId, via: peerId }));
+      return undefined;
+    }
+
     // Echo loop prevention (MMP §15.7, anti-echo): if the incoming CMB's
     // lineage parents include a key that exists in our local cmbs,
     // this CMB is a derivative of our own broadcast. Skip all
@@ -1660,11 +1527,9 @@ class FrameHandler {
   _handleWakeChannel(peerId, peerName, msg) {
     if (!msg.platform) return;
     const wm = this._node._wakeManager;
-    // The channel is the peer's own only if this session proved the peer holds the key bound to
-    // peerId; otherwise it is whoever claimed that nodeId at handshake, trusted no further than
-    // gossip, and never over a channel the peer gave through its own authenticated session.
-    const source = typeof this._node._peerKeyProven === 'function' && this._node._peerKeyProven(peerId) ? 'direct' : 'unproven';
-    const r = wm.learnWakeChannel(peerId, { platform: msg.platform, token: msg.token, environment: msg.environment }, { source });
+    // A Core Secure session proved peerId's key, and the frame arrived sealed on it: the channel is
+    // the peer's own (design D1).
+    const r = wm.learnWakeChannel(peerId, { platform: msg.platform, token: msg.token, environment: msg.environment }, { source: 'direct' });
     if (r === 'added' || r === 'updated' || r === 'refreshed' || r === 'removed') wm.saveWakeChannels();
     if (r === 'added' || r === 'updated') this._node._log(`Wake channel from ${peerName}: ${msg.platform}`);
     if (r === 'removed') this._node._log(`Wake channel from ${peerName}: turned off`);
@@ -1679,10 +1544,10 @@ class FrameHandler {
    * through SVAF. Invalid/forged → dropped + audit-logged.
    * @private
    */
-  _handleAttestation(peerId, peerName, msg, lane) {
+  _handleAttestation(peerId, peerName, msg) {
     const att = msg && msg.attestation;
     if (!att) return;
-    const r = this._node._ingestAttestation(att, peerId, peerName, lane);
+    const r = this._node._ingestAttestation(att, peerId, peerName);
     // A repeat, a copy past the per-CMB limit, and one past the peer's budget or with a signature not
     // spelled canonically (both said by the node, once per 10 s) are quiet here.
     if (r.ok || !r.reason || r.reason === 'duplicate' || r.reason === 'rate-limited' || r.reason === 'over-budget' || r.reason === 'non-canonical-signature') return;
@@ -1693,7 +1558,7 @@ class FrameHandler {
     // said once a minute per connection and reason, with how many more there were, not once per frame.
     // Per connection, not per peer id: over the relay the id is the sender's to choose, and a fresh one
     // per frame bought a line per frame.
-    this._sayOnceAMinute(this._attDropSaid, `${connectionOf(lane) ?? peerId}|${r.reason}`,
+    this._sayOnceAMinute(this._attDropSaid, `${peerId}|${r.reason}`,
       (more) => `Attestation from ${peerName} dropped (${r.reason}) — of:${String(att.of).slice(0, 12)} by:${String(att.by).slice(0, 8)}${more}`);
   }
 
@@ -1721,14 +1586,12 @@ class FrameHandler {
    */
   _handlePeerInfo(peerId, peerName, msg) {
     if (!Array.isArray(msg.peers)) return;
-    // Every peer re-sends its whole list on every connect, so most entries are ones already held.
-    // Those change nothing and say nothing: logging and rewriting the file per entry per connect
-    // filled the daemon log at a flapping peer's reconnect rate.
+    // Learned only for the session's OWN nodeId (design D1): an entry naming another node is what
+    // this peer says about someone else — a hint, never stored. Every peer re-sends its list on
+    // every connect, so most entries change nothing and say nothing.
     const wm = this._node._wakeManager;
-    let learned = 0, changed = 0;
-    // A room's peer list is short; a frame naming thousands of nodeIds is not one. Only the first
-    // PEER_INFO_MAX are read (what this release sends at most), said once a minute per peer.
     if (msg.peers.length > PEER_INFO_MAX) {
+      // An over-long frame is read for its first PEER_INFO_MAX entries, and said once a minute per peer.
       const now = Date.now();
       if (now - (this._longPeerInfoSaid.get(peerId) ?? -Infinity) >= 60_000) {
         this._longPeerInfoSaid.delete(peerId);
@@ -1737,16 +1600,15 @@ class FrameHandler {
         this._node._log(`Gossip from ${peerName}: ${msg.peers.length} entries, reading the first ${PEER_INFO_MAX}`);
       }
     }
+    let changed = 0;
     for (const p of msg.peers.slice(0, PEER_INFO_MAX)) {
-      // Taken at the door (wire-identity.js); learnWakeChannel takes the channel as text.
       const id = p && typeof p === 'object' ? wireNodeId(p.nodeId) : null;
-      if (!id || !p.wakeChannel || id === this._node._identity.nodeId) continue;
-      const r = wm.learnWakeChannel(id, p.wakeChannel, { source: 'gossip', lastSeen: p.lastSeen });
-      if (r === 'added' || r === 'updated') learned++;
-      if (r === 'added' || r === 'updated' || r === 'refreshed') changed++;
+      if (id !== peerId || !p.wakeChannel) continue;
+      const r = wm.learnWakeChannel(id, p.wakeChannel, { source: 'direct' });
+      if (r === 'added' || r === 'updated' || r === 'refreshed' || r === 'removed') changed++;
+      if (r === 'added' || r === 'updated') this._node._log(`Wake channel from ${peerName}: ${p.wakeChannel.platform}`);
     }
     if (changed > 0) wm.saveWakeChannels();
-    if (learned > 0) this._node._log(`Gossip from ${peerName}: learned ${learned} wake channel(s)`);
   }
 
   /**
@@ -1797,4 +1659,4 @@ class FrameHandler {
   }
 }
 
-module.exports = { FrameHandler, assertionMark };
+module.exports = { FrameHandler, assertionMark, MESSAGE_SCHEMA };
diff --git a/lib/interior.js b/lib/interior.js
new file mode 100644
index 00000000..2ac7f923
--- /dev/null
+++ b/lib/interior.js
@@ -0,0 +1,260 @@
+'use strict';
+
+/**
+ * @module @sym-bot/sym/interior
+ * @description A node's interior (sym 0.14, design D9.3): the local submission path through which
+ * the node's MIND — the reasoning process it runs for one mission — asks the node to emit.
+ *
+ * One rule (design D8): an autonomous agent is its own node, and a node's reasoning process is its
+ * interior, with no mesh identity of its own. The mind does not couple, keep a store or evaluate
+ * SVAF, and it never holds the node's key: it SUBMITS, and the node checks, signs and sends.
+ *
+ *   - A submission carries a PER-MIND CAPABILITY: a random token the node issues when it starts a
+ *     mind for one mission, revoked when that mind exits. A submission without a live capability is
+ *     refused.
+ *   - The node's checks before it signs:
+ *       audience — `to` must be in the mission's allowlist, or absent (the room);
+ *       size     — at most 64 KiB of category text, at most 512 KiB of application data;
+ *       rate     — per capability;
+ *       intent   — the mission's declared kinds only;
+ *       lineage  — no `parents` outside the node's store.
+ *   - ONE MIND PER NODE at a time. A node busy with a mission queues the next (`queueMind`), and the
+ *     runtime may offer it elsewhere; `startMind` on a busy node is refused (EMINDBUSY). A node with
+ *     several concurrent minds would be several agents under one identity (§3.2), unless it is
+ *     declared a gateway (§5.10).
+ *
+ * This supersedes the 2026-08-02 Q1a fallback (a scoped signing grant to a worker).
+ *
+ * Socket protocol: newline-delimited JSON on a Unix domain socket (`<node dir>/interior.sock`,
+ * 0600; a named pipe on Windows). Each request carries an `id`, echoed in its reply:
+ *   → { id, type: 'submit', capability, kind, categories, to?, parents?, payload? }
+ *   ← { id, type: 'submitted', key, assertionId }  |  { id, type: 'refused', reason }
+ *   → { id, type: 'end', capability }               ← { id, type: 'ended' }
+ *
+ * @copyright 2026 SYM.BOT. Apache 2.0 License.
+ */
+
+const fs = require('fs');
+const net = require('net');
+const path = require('path');
+const crypto = require('crypto');
+const { CAT7_CATEGORIES } = require('./core');
+
+const MAX_CATEGORY_TEXT = 64 * 1024;
+const MAX_APPLICATION = 512 * 1024;
+const DEFAULT_RATE_PER_MINUTE = 60;
+const MAX_REQUEST_BYTES = 1024 * 1024;
+
+/**
+ * Where the interior socket listens: `<node dir>/interior.sock`, unless that path is longer than a
+ * Unix socket address can hold (104 bytes on macOS, 108 on Linux — a longer one is silently
+ * truncated), in which case a short path in a per-user 0700 directory under the OS temp dir. A named
+ * pipe on Windows.
+ */
+function defaultSocketPath(node) {
+  if (process.platform === 'win32') return `\\\\.\\pipe\\sym-interior-${node.nodeId}`;
+  const inDir = path.join(node._dir, 'interior.sock');
+  if (Buffer.byteLength(inDir, 'utf8') <= 100) return inDir;
+  const uid = typeof process.getuid === 'function' ? process.getuid() : 'u';
+  const dir = path.join(require('os').tmpdir(), `sym-interior-${uid}`);
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  try { fs.chmodSync(dir, 0o700); } catch { /* best effort */ }
+  const short = crypto.createHash('sha256').update(node.nodeId).digest('hex').slice(0, 16);
+  return path.join(dir, `${short}.sock`);
+}
+
+class Interior {
+  constructor(node) {
+    this._node = node;
+    this._mind = null;       // { mindId, capability, mission, bucket, startedAt }
+    this._queue = [];        // [{ mission, resolve, reject }]
+    this._server = null;
+    this._socketPath = null;
+    this._clients = new Set();   // open interior connections, ended with the node
+    this._stats = { submitted: 0, refused: 0, refusedByReason: {} };
+  }
+
+  /** Whether a mind is running now. */
+  get busy() { return !!this._mind; }
+
+  /** The running mind's public facts (never its capability), or null. */
+  mind() {
+    const m = this._mind;
+    return m ? { mindId: m.mindId, mission: m.mission.id, kinds: [...m.mission.kinds], allowTo: [...m.mission.allowTo], startedAt: m.startedAt } : null;
+  }
+
+  stats() { return { ...this._stats, refusedByReason: { ...this._stats.refusedByReason }, busy: this.busy, queued: this._queue.length }; }
+
+  _mission(m = {}) {
+    const kinds = Array.isArray(m.kinds) ? m.kinds.filter((k) => typeof k === 'string' && k) : [];
+    if (kinds.length === 0) throw new Error('interior: a mission declares the kinds of submission it may make');
+    return {
+      id: typeof m.id === 'string' ? m.id.slice(0, 128) : `mission-${Date.now()}`,
+      kinds: new Set(kinds),
+      allowTo: new Set(Array.isArray(m.allowTo) ? m.allowTo.filter((t) => typeof t === 'string') : []),
+      ratePerMinute: Number.isFinite(m.ratePerMinute) && m.ratePerMinute > 0 ? m.ratePerMinute : DEFAULT_RATE_PER_MINUTE,
+    };
+  }
+
+  /**
+   * Start a mind for one mission and issue its capability. Refused (EMINDBUSY) while another mind
+   * runs: one mind per node.
+   * @param {{ id?: string, kinds: string[], allowTo?: string[], ratePerMinute?: number }} mission
+   * @returns {{ mindId: string, capability: string, socketPath: string|null }}
+   */
+  startMind(mission) {
+    if (this._mind) {
+      const e = new Error('interior: this node is busy with a mission (one mind per node); queue it or offer it elsewhere');
+      e.code = 'EMINDBUSY';
+      throw e;
+    }
+    return this._start(this._mission(mission));
+  }
+
+  /** Queue a mission behind the running one; resolves with its capability when it starts. */
+  queueMind(mission) {
+    const m = this._mission(mission);
+    if (!this._mind) return Promise.resolve(this._start(m));
+    return new Promise((resolve, reject) => this._queue.push({ mission: m, resolve, reject }));
+  }
+
+  _start(mission) {
+    const capability = crypto.randomBytes(32).toString('base64url');
+    const mindId = `mind-${crypto.randomBytes(6).toString('hex')}`;
+    this._mind = { mindId, capability, mission, startedAt: Date.now(), bucket: { tokens: mission.ratePerMinute, at: Date.now() } };
+    this._node._log(`Interior: mind ${mindId} started for mission ${mission.id} (kinds ${[...mission.kinds].join(', ')})`);
+    return { mindId, capability, socketPath: this._socketPath };
+  }
+
+  /** End the running mind (its capability is revoked), and start the next queued mission. */
+  endMind(capabilityOrMindId) {
+    const m = this._mind;
+    if (!m) return false;
+    if (capabilityOrMindId !== m.mindId && !this._capabilityIs(capabilityOrMindId)) return false;
+    this._mind = null;
+    this._node._log(`Interior: mind ${m.mindId} ended; its capability is revoked`);
+    const next = this._queue.shift();
+    if (next) next.resolve(this._start(next.mission));
+    return true;
+  }
+
+  _capabilityIs(cap) {
+    const m = this._mind;
+    if (!m || typeof cap !== 'string') return false;
+    const a = Buffer.from(cap);
+    const b = Buffer.from(m.capability);
+    return a.length === b.length && crypto.timingSafeEqual(a, b);
+  }
+
+  _refuse(reason) {
+    this._stats.refused++;
+    this._stats.refusedByReason[reason] = (this._stats.refusedByReason[reason] || 0) + 1;
+    return { ok: false, reason };
+  }
+
+  /**
+   * Check and, if every check passes, sign and send one submission as this node's record.
+   * @returns {{ ok: boolean, reason?: string, key?: string, assertionId?: string }}
+   */
+  submit(capability, sub = {}) {
+    const m = this._mind;
+    if (!this._capabilityIs(capability)) return this._refuse('no-live-capability');
+    if (!sub || typeof sub !== 'object') return this._refuse('malformed');
+    if (typeof sub.kind !== 'string' || !m.mission.kinds.has(sub.kind)) return this._refuse('kind-not-declared');
+    const to = sub.to === undefined || sub.to === null ? null : sub.to;
+    if (to !== null && (typeof to !== 'string' || !m.mission.allowTo.has(to))) return this._refuse('audience-not-allowed');
+    const cats = sub.categories;
+    if (!cats || typeof cats !== 'object' || Array.isArray(cats)) return this._refuse('malformed');
+    let text = 0;
+    for (const f of Object.keys(cats)) {
+      if (!CAT7_CATEGORIES.includes(f)) return this._refuse('not-a-cat7-category');
+      const v = cats[f];
+      const t = typeof v === 'string' ? v : (v && typeof v.text === 'string' ? v.text : '');
+      text += Buffer.byteLength(t, 'utf8');
+    }
+    if (text > MAX_CATEGORY_TEXT) return this._refuse('categories-too-large');
+    if (sub.payload !== undefined && Buffer.byteLength(JSON.stringify(sub.payload), 'utf8') > MAX_APPLICATION) return this._refuse('application-too-large');
+    const parents = Array.isArray(sub.parents) ? sub.parents : [];
+    for (const k of parents) {
+      if (typeof k !== 'string' || !this._node._store.get(k)) return this._refuse('parent-not-in-store');
+    }
+    const now = Date.now();
+    const b = m.bucket;
+    b.tokens = Math.min(m.mission.ratePerMinute, b.tokens + ((now - b.at) * m.mission.ratePerMinute) / 60000);
+    b.at = now;
+    if (b.tokens < 1) return this._refuse('rate');
+    b.tokens -= 1;
+    let entry;
+    try {
+      entry = this._node.remember(cats, { to: to || undefined, parents: parents.map((key) => ({ key })), payload: sub.payload });
+    } catch (err) {
+      return this._refuse(err && err.code ? err.code : 'emit-failed');
+    }
+    if (!entry) return this._refuse('not-minted');
+    this._stats.submitted++;
+    return { ok: true, key: entry.key, assertionId: entry.cmb?.metadata?.assertionId ?? null };
+  }
+
+  /**
+   * Listen on the interior socket. Only this user can connect (0600); every request still needs the
+   * live capability.
+   * @returns {Promise<string>} the socket path
+   */
+  listen(socketPath) {
+    if (this._server) return Promise.resolve(this._socketPath);
+    const p = socketPath || defaultSocketPath(this._node);
+    if (process.platform !== 'win32') { try { fs.unlinkSync(p); } catch { /* none */ } }
+    this._server = net.createServer((sock) => this._serve(sock));
+    return new Promise((resolve, reject) => {
+      this._server.once('error', reject);
+      this._server.listen(p, () => {
+        if (process.platform !== 'win32') { try { fs.chmodSync(p, 0o600); } catch { /* best effort */ } }
+        this._socketPath = p;
+        resolve(p);
+      });
+    });
+  }
+
+  _serve(sock) {
+    let buf = '';
+    this._clients.add(sock);
+    sock.on('close', () => this._clients.delete(sock));
+    sock.on('error', () => {});
+    sock.on('data', (chunk) => {
+      buf += chunk.toString('utf8');
+      if (buf.length > MAX_REQUEST_BYTES) { sock.destroy(); return; }
+      let i;
+      while ((i = buf.indexOf('\n')) !== -1) {
+        const line = buf.slice(0, i);
+        buf = buf.slice(i + 1);
+        if (!line.trim()) continue;
+        let req;
+        try { req = JSON.parse(line); } catch { sock.write(JSON.stringify({ type: 'refused', reason: 'not-json' }) + '\n'); continue; }
+        const id = req && (typeof req.id === 'string' || typeof req.id === 'number') ? req.id : null;
+        let reply;
+        if (req && req.type === 'submit') {
+          const r = this.submit(req.capability, req);
+          reply = r.ok ? { id, type: 'submitted', key: r.key, assertionId: r.assertionId } : { id, type: 'refused', reason: r.reason };
+        } else if (req && req.type === 'end') {
+          reply = this.endMind(req.capability) ? { id, type: 'ended' } : { id, type: 'refused', reason: 'no-live-capability' };
+        } else {
+          reply = { id, type: 'refused', reason: 'unknown-request' };
+        }
+        sock.write(JSON.stringify(reply) + '\n');
+      }
+    });
+  }
+
+  close() {
+    // A stopped node ends every interior connection (its capabilities die with it); server.close()
+    // alone would wait for them.
+    for (const c of this._clients) { try { c.destroy(); } catch { /* */ } }
+    this._clients.clear();
+    if (this._server) { try { this._server.close(); } catch { /* */ } this._server = null; }
+    if (this._socketPath && process.platform !== 'win32') { try { fs.unlinkSync(this._socketPath); } catch { /* */ } }
+    for (const q of this._queue.splice(0)) q.reject(new Error('interior: the node stopped'));
+    this._mind = null;
+  }
+}
+
+module.exports = { Interior, MAX_CATEGORY_TEXT, MAX_APPLICATION };
diff --git a/lib/invite.js b/lib/invite.js
new file mode 100644
index 00000000..5e68d812
--- /dev/null
+++ b/lib/invite.js
@@ -0,0 +1,90 @@
+'use strict';
+
+/**
+ * @module @sym-bot/sym/invite
+ * @description Room and team invites with the issuer's identity (sym 0.14, design D5).
+ *
+ *   sym://room/<room>?node=<nodeId>&key=<identity key>
+ *   sym://team/<room>?relay=<url>&token=<token>&node=<nodeId>&key=<identity key>
+ *   <app>://room/<id>[/<name>]?…        (app-scoped rooms: the room is `<app>-<id>`)
+ *
+ * `node` and `key` name the ISSUER. Accepting an invite pins the issuer's key at `pinned` in the key
+ * registry — an out-of-band binding — ONLY when that nodeId is unbound. A nodeId already bound to a
+ * different key is a conflict for the operator (design D3), never an override: an invite cannot
+ * repoint a proven key.
+ *
+ * AN INVITE IS A SECRET. A team invite carries the relay token, which admits its holder to the relay
+ * channel (review M8). It is also integrity-sensitive: whoever edits `key` before it is accepted
+ * chooses whom the acceptor pins. Send it over a channel you trust for both.
+ *
+ * The grammar matches mesh-channel's INVITE_URL_RE (which already takes a query string); `node` and
+ * `key` are new query parameters, ignored by a parser that does not know them.
+ *
+ * @copyright 2026 SYM.BOT. Apache 2.0 License.
+ */
+
+const { isIdentityKey } = require('./roster-keys');
+
+const INVITE_URL_RE = /^([a-z][a-z0-9-]+):\/\/(room|team)\/([^/?#]+)(?:\/([^?#]+))?(?:\?([^#]*))?$/i;
+const NODE_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
+/**
+ * Build an invite URL.
+ * @param {object} o
+ * @param {string} o.room
+ * @param {'room'|'team'} [o.kind] - 'team' when a relay is given
+ * @param {string} [o.relay]
+ * @param {string} [o.token]
+ * @param {{ nodeId: string, publicKey: string }} [o.issuer] - the issuing node (its key is pinned by acceptors)
+ * @param {string} [o.scheme='sym']
+ * @returns {string}
+ */
+function buildInvite({ room, kind, relay, token, issuer, scheme = 'sym' } = {}) {
+  if (typeof room !== 'string' || !room) throw new Error('buildInvite: room is required');
+  const k = kind || (relay ? 'team' : 'room');
+  const q = [];
+  if (relay) q.push(`relay=${encodeURIComponent(relay)}`);
+  if (token) q.push(`token=${encodeURIComponent(token)}`);
+  if (issuer) {
+    if (!NODE_ID_RE.test(String(issuer.nodeId || '')) || !isIdentityKey(issuer.publicKey)) throw new Error('buildInvite: issuer must be { nodeId (UUID), publicKey (base64url Ed25519) }');
+    q.push(`node=${encodeURIComponent(issuer.nodeId)}`, `key=${encodeURIComponent(issuer.publicKey)}`);
+  }
+  return `${scheme}://${k}/${encodeURIComponent(room)}${q.length ? `?${q.join('&')}` : ''}`;
+}
+
+/**
+ * Parse an invite URL. Never throws: an invite that is not one comes back with `error`.
+ * @returns {{ error?: string, appScheme?: string, kind?: string, room?: string, roomId?: string,
+ *   roomName?: string, relayUrl?: string|null, relayToken?: string|null,
+ *   issuer?: { nodeId: string, publicKey: string }|null }}
+ */
+function parseInvite(url) {
+  const m = typeof url === 'string' ? INVITE_URL_RE.exec(url.trim()) : null;
+  if (!m) return { error: `not an invite URL: ${String(url).slice(0, 120)}` };
+  const appScheme = m[1].toLowerCase();
+  let rawId, rawName, query;
+  try {
+    rawId = decodeURIComponent(m[3]);
+    rawName = m[4] ? decodeURIComponent(m[4]) : rawId;
+    query = Object.fromEntries((m[5] || '').split('&').filter(Boolean).map((kv) => {
+      const i = kv.indexOf('=');
+      const k = i < 0 ? kv : kv.slice(0, i);
+      const v = i < 0 ? '' : kv.slice(i + 1);
+      return [decodeURIComponent(k), decodeURIComponent(v)];
+    }));
+  } catch { return { error: 'the invite URL is not validly encoded' }; }
+  const room = appScheme === 'sym' ? rawId : `${appScheme}-${rawId}`;
+  let issuer = null;
+  if (query.node !== undefined || query.key !== undefined) {
+    if (!NODE_ID_RE.test(String(query.node || '')) || !isIdentityKey(query.key)) {
+      return { error: 'the invite names an issuer, but its node is not a UUID or its key is not a base64url Ed25519 public key' };
+    }
+    issuer = { nodeId: query.node, publicKey: query.key };
+  }
+  return {
+    appScheme, kind: m[2].toLowerCase(), room, roomId: rawId, roomName: rawName,
+    relayUrl: query.relay || null, relayToken: query.token || null, issuer,
+  };
+}
+
+module.exports = { buildInvite, parseInvite, INVITE_URL_RE };
diff --git a/lib/ipc-client.js b/lib/ipc-client.js
index be4ae655..41f38a9f 100644
--- a/lib/ipc-client.js
+++ b/lib/ipc-client.js
@@ -54,22 +54,20 @@ class SymDaemonClient extends EventEmitter {
         this._socket = socket;
         this._connected = true;
 
-        // Register as virtual node
-        this._send({
-          type: 'register',
-          name: this._name,
-          cognitiveProfile: this._cognitiveProfile,
-        });
-
-        // Wait for registered response
+        // Say hello (0.14, design D8: a client is not a virtual node), then subscribe to the
+        // node's events (MMP §14.9 'listen').
+        this._send({ type: 'hello' });
+
         const onFirstMessage = (msg) => {
-          if (msg.type === 'registered') {
+          if (msg.type === 'result' && msg.action === 'hello') {
+            this.removeListener('_raw', onFirstMessage);
             this._nodeId = msg.nodeId;
             this._nodeName = msg.name;
+            this._send({ type: 'listen' });
             resolve({ nodeId: msg.nodeId, name: msg.name, relay: msg.relay });
           }
         };
-        this.once('_raw', onFirstMessage);
+        this.on('_raw', onFirstMessage);
 
         // Timeout registration
         setTimeout(() => {
diff --git a/lib/legacy-import.js b/lib/legacy-import.js
new file mode 100644
index 00000000..53fda233
--- /dev/null
+++ b/lib/legacy-import.js
@@ -0,0 +1,402 @@
+'use strict';
+
+/**
+ * @module @sym-bot/sym/legacy-import
+ * @description Legacy Import (MMP §17.3; sym 0.14 design D7): explicit, outbound, temporary.
+ *
+ * A 0.13 node cannot complete the Core Secure handshake. It is reached only through a ROUTE the
+ * operator configures, never through negotiation failure, and never by accepting its hello:
+ *
+ *   - Off by default. A route names the peer's nodeId, its endpoint (`host:port` for LAN or the
+ *     loopback, or `relay` for the relay channel) and its identity key — the full key or its
+ *     `sha256:<hex>` fingerprint. The fingerprint is MANDATORY; the key is pinned at `pinned` for
+ *     that nodeId (design D3's matrix applies: a different key already bound is a conflict).
+ *   - This node always dials a route itself, and never accepts a legacy hello: the Core Secure
+ *     listener refuses one at once. That covers both id orders (0.13 dials only when its own id is
+ *     smaller on the loopback), and the profile is chosen by the route before any byte is read.
+ *   - Over the relay, the route's session is this node sending a legacy `handshake` to the routed
+ *     nodeId. Relay-auth is unproven (§4.4.1), so a squatter could answer as that nodeId: records
+ *     are accepted only when their signature verifies against the pinned key, and only records the
+ *     routed node itself signed.
+ *   - Connection-level frames from a legacy session (peer-info, wake-channel, mood, role grants…)
+ *     are hints: none is stored.
+ *   - What this node sends on a legacy session: its records as legacy `cmb` frames under the legacy
+ *     E2E construction (X25519 + AES-256-GCM, from an ephemeral key per legacy session), so the
+ *     relay never sees plaintext. Nothing else but ping/pong. `sym status` says plainly that the
+ *     session uses legacy encryption, with no forward secrecy and no transcript proof.
+ *   - Quarantine: everything received is stored with `verified: false` and `profile:
+ *     'legacy-import'`; never given authority, never shown as verified, flagged on the channel.
+ *   - The sticky floor is PERSISTED: it is the registry's proven binding (roster-keys.js `floor`).
+ *     Once a nodeId has proven itself over Core Secure, its legacy route is refused until an
+ *     operator resets the floor (`sym keys reset-floor <nodeId>`).
+ *   - The window: network Legacy Import is removed in sym 0.15.0; offline store import stays.
+ *
+ * @copyright 2026 SYM.BOT. Apache 2.0 License.
+ */
+
+const fs = require('fs');
+const net = require('net');
+const path = require('path');
+const { EventEmitter } = require('events');
+const { TcpTransport } = require('./transport');
+const { e2eGenerateKeyPair, e2eDeriveSharedSecret, encryptCategories, decryptCategories } = require('./core');
+const { isIdentityKey, keyFingerprint } = require('./roster-keys');
+const { SEND_FAILURE } = require('./frame-parser');
+
+const HANDSHAKE_TIMEOUT_MS = 10_000;
+const REDIAL_MS = 15_000;
+const ROUTES_FILE = 'legacy-routes.json';
+const LEGACY_ENCRYPTION = 'legacy (X25519 + AES-256-GCM per connection; no forward secrecy, no transcript proof)';
+const isNodeId = (id) => typeof id === 'string' && id.length > 0 && id.length <= 256;
+
+/**
+ * Check one configured route. Throws with what is wrong: a route without a key or a fingerprint is
+ * refused, because a legacy hello proves nothing (§18.3) and the pin is the only identity it has.
+ * @returns {{ nodeId: string, endpoint: string, key: string|null, fingerprint: string, name: string|null }}
+ */
+function checkRoute(r) {
+  if (!r || typeof r !== 'object') throw new Error('legacy route: not an object');
+  if (!isNodeId(r.nodeId)) throw new Error('legacy route: nodeId is required');
+  const endpoint = typeof r.endpoint === 'string' ? r.endpoint.trim() : '';
+  if (endpoint !== 'relay' && !/^[^\s:]+:\d{1,5}$/.test(endpoint)) throw new Error(`legacy route ${r.nodeId.slice(0, 8)}: endpoint must be host:port or 'relay'`);
+  let key = null;
+  let fingerprint = null;
+  if (r.key !== undefined) {
+    if (!isIdentityKey(r.key)) throw new Error(`legacy route ${r.nodeId.slice(0, 8)}: key is not a base64url Ed25519 public key`);
+    key = r.key;
+    fingerprint = keyFingerprint(r.key);
+  }
+  if (r.fingerprint !== undefined) {
+    if (typeof r.fingerprint !== 'string' || !/^sha256:[0-9a-f]{64}$/.test(r.fingerprint)) throw new Error(`legacy route ${r.nodeId.slice(0, 8)}: fingerprint must be sha256:<64 hex>`);
+    if (fingerprint && fingerprint !== r.fingerprint) throw new Error(`legacy route ${r.nodeId.slice(0, 8)}: key and fingerprint disagree`);
+    fingerprint = r.fingerprint;
+  }
+  if (!fingerprint) throw new Error(`legacy route ${r.nodeId.slice(0, 8)}: the identity key fingerprint is mandatory`);
+  return { nodeId: r.nodeId, endpoint, key, fingerprint, name: typeof r.name === 'string' ? r.name.slice(0, 64) : null };
+}
+
+/**
+ * One Legacy Import session: the 0.13 wire on one connection, with the route's pinned identity.
+ * Shaped like a PeerSession where the node reads one (nodeId, name, kind, confirmed, send/trySend,
+ * close, `legacy: true`), so the peer table and the frame handler take it, quarantined.
+ */
+class LegacySession extends EventEmitter {
+  constructor({ route, kind, transport, local, room }) {
+    super();
+    this.legacy = true;
+    this.route = route;
+    this.kind = kind;                 // 'bonjour' (LAN/loopback) | 'relay'
+    this.relayFrom = kind === 'relay' ? route.nodeId : null;
+    this.transport = transport;
+    this.state = 'authenticating';
+    this.nodeId = null; this.name = null; this.identityKey = null;
+    this.sessionId = null; this.selected = []; this.role = 'client'; this.room = room;
+    this.startedAt = Date.now(); this.lastSeen = Date.now(); this.confirmedAt = null;
+    this.encryption = LEGACY_ENCRYPTION;
+    this._local = local;
+    this._e2e = e2eGenerateKeyPair();   // ephemeral: one per legacy session, never persisted
+    this._secret = null;
+    this._timer = setTimeout(() => this.close('timeout'), HANDSHAKE_TIMEOUT_MS);
+    if (this._timer.unref) this._timer.unref();
+  }
+
+  get confirmed() { return this.state === 'confirmed'; }
+  get closed() { return this.state === 'closed'; }
+  get _closed() { return this.state === 'closed'; }
+  has() { return false; }
+
+  /** The 0.13 hello this node sends on its route (the only place one is ever built). */
+  hello() {
+    return {
+      type: 'handshake',
+      nodeId: this._local.nodeId,
+      name: this._local.name,
+      version: '0.2.3',
+      extensions: [],
+      room: this.room,
+      publicKey: this._local.publicKey,
+      e2ePublicKey: this._e2e.publicKey.toString('base64'),
+      lifecycleRole: 'participant',
+    };
+  }
+
+  start() { this._wire(this.hello()); }
+
+  receiveWire(f) {
+    if (this.closed || !f || typeof f !== 'object' || typeof f.type !== 'string') return;
+    this.lastSeen = Date.now();
+    try {
+      if (this.state === 'authenticating') {
+        if (f.type !== 'handshake') return; // a 0.13 node may send anchors first: they wait for nothing
+        this._takeHello(f);
+        return;
+      }
+      if (f.type === 'handshake') return; // a repeated hello (0.13 re-sends on new transports)
+      if (f.type === 'ping') { this._wire({ type: 'pong' }); return; }
+      if (f.type === 'pong') return;
+      if (f.type !== 'cmb') { this.emit('hint', f.type); return; } // connection-level frames are hints
+      const msg = { ...f };
+      if (msg.cmb && typeof msg.cmb.categories === 'string' && msg.cmb._e2e) {
+        if (!this._secret) { this.emit('hint', 'cmb-without-secret'); return; }
+        try {
+          msg.cmb = { ...msg.cmb, categories: decryptCategories(msg.cmb.categories, msg.cmb._e2e.nonce, this._secret) };
+          delete msg.cmb._e2e;
+        } catch { this.emit('hint', 'cmb-undecryptable'); return; }
+      }
+      msg._legacyImport = true;
+      msg._legacyPinnedKey = this.identityKey;
+      this.emit('frame', msg, this);
+    } catch (err) {
+      this.close('error', err && err.message);
+    }
+  }
+
+  _takeHello(h) {
+    if (h.nodeId !== this.route.nodeId) { this.close('node-id-mismatch', `the route names ${this.route.nodeId.slice(0, 8)}, the hello ${String(h.nodeId).slice(0, 8)}`); return; }
+    if (!isIdentityKey(h.publicKey) || keyFingerprint(h.publicKey) !== this.route.fingerprint) {
+      this.close('fingerprint-mismatch', 'the hello\'s identity key is not the one the route pins');
+      return;
+    }
+    if (typeof h.e2ePublicKey === 'string' && h.e2ePublicKey) {
+      try { this._secret = e2eDeriveSharedSecret(this._e2e.privateKey, Buffer.from(h.e2ePublicKey, 'base64')); }
+      catch { this._secret = null; }
+    }
+    clearTimeout(this._timer);
+    this.nodeId = h.nodeId;
+    this.name = typeof h.name === 'string' && h.name ? h.name.slice(0, 256) : (this.route.name || 'legacy');
+    this.identityKey = h.publicKey;
+    this.state = 'confirmed';
+    this.confirmedAt = Date.now();
+    this.emit('confirmed', this);
+  }
+
+  /**
+   * Send on the legacy session: a record as a legacy `cmb` frame under the legacy E2E construction
+   * (never in the clear), ping/pong as they are. Everything else is not sent.
+   */
+  trySend(frame) {
+    if (!this.confirmed) return { ok: false, reason: SEND_FAILURE.NOT_CONNECTED };
+    if (!frame || typeof frame.type !== 'string') return { ok: false, reason: 'not-a-frame' };
+    if (frame.type === 'ping' || frame.type === 'pong') return this._wire({ type: frame.type });
+    if (frame.type !== 'cmb' || !frame.cmb || !frame.cmb.categories) return { ok: false, reason: 'not-sent-on-legacy' };
+    if (!this._secret) return { ok: false, reason: 'no-legacy-secret' };
+    const { ciphertext, nonce } = encryptCategories(frame.cmb.categories, this._secret);
+    const to = frame.cmb.metadata && typeof frame.cmb.metadata.to === 'string' ? frame.cmb.metadata.to : null;
+    return this._wire({ type: 'cmb', timestamp: frame.timestamp || Date.now(), cmb: { ...frame.cmb, categories: ciphertext, _e2e: { nonce } }, ...(to ? { to, directed: true } : {}) });
+  }
+
+  send(frame) { return this.trySend(frame).ok; }
+
+  _wire(frame) {
+    try {
+      if (typeof this.transport.trySend === 'function') return this.transport.trySend(frame);
+      return this.transport.send(frame) !== false ? { ok: true } : { ok: false, reason: 'send-failed' };
+    } catch { return { ok: false, reason: SEND_FAILURE.WRITE_FAILED }; }
+  }
+
+  close(reason = 'closed', detail = null) {
+    if (this.closed) return;
+    const wasConfirmed = this.state === 'confirmed';
+    clearTimeout(this._timer);
+    this.state = 'closed';
+    this._secret = null;
+    if (this.kind !== 'relay') { try { this.transport.close(); } catch { /* gone */ } }
+    this.emit('closed', { reason, detail, wasConfirmed }, this);
+  }
+}
+
+class LegacyImport {
+  /**
+   * @param {object} node - the SymNode
+   * @param {object} [opts]
+   * @param {object[]} [opts.routes] - configured routes (also read from <nodeDir>/legacy-routes.json)
+   */
+  constructor(node, opts = {}) {
+    this._node = node;
+    this._routes = new Map();     // nodeId -> route
+    this._sessions = new Map();   // nodeId -> LegacySession
+    this._refused = new Map();    // nodeId -> why the route is not used
+    this._timers = new Map();
+    this._hints = 0;
+    const configured = [...(Array.isArray(opts.routes) ? opts.routes : []), ...readRoutesFile(node._dir)];
+    for (const r of configured) {
+      try {
+        const route = checkRoute(r);
+        this._routes.set(route.nodeId, route);
+      } catch (err) {
+        this._refused.set(r && r.nodeId ? String(r.nodeId) : '?', err.message);
+        node._log(`Legacy Import: ${err.message} — route not used`);
+      }
+    }
+  }
+
+  get size() { return this._routes.size; }
+
+  /** Start every route this node may use: pin its key, then dial it (LAN) or wait for it (relay). */
+  start() {
+    for (const route of this._routes.values()) {
+      if (route.key) {
+        const b = this._node._roster.bind(route.nodeId, route.key, 'pinned');
+        if (!b.bound && b.reason === 'conflict') {
+          this._refused.set(route.nodeId, 'its pinned key conflicts with the key bound to that nodeId');
+          continue;
+        }
+      }
+      if (route.endpoint !== 'relay') this._dial(route);
+    }
+    if (this._routes.size) this._node._log(`Legacy Import: ${this._routes.size} route(s) configured — legacy encryption, no forward secrecy, no transcript proof; removed in sym 0.15.0`);
+  }
+
+  stop() {
+    for (const t of this._timers.values()) clearTimeout(t);
+    this._timers.clear();
+    for (const s of [...this._sessions.values()]) s.close('node-stopped');
+    this._sessions.clear();
+  }
+
+  /** Whether the floor (design D7) refuses `nodeId`'s route now. */
+  _floored(route) {
+    if (!this._node._roster.floor(route.nodeId)) return false;
+    this._refused.set(route.nodeId, 'sticky floor: this nodeId has proven itself over Core Secure; an operator reset is required (sym keys reset-floor)');
+    return true;
+  }
+
+  _dial(route) {
+    if (!this._node._running || this._sessions.has(route.nodeId) || this._floored(route)) return;
+    const [host, portStr] = [route.endpoint.slice(0, route.endpoint.lastIndexOf(':')), route.endpoint.slice(route.endpoint.lastIndexOf(':') + 1)];
+    const socket = net.createConnection({ host, port: Number(portStr) }, () => {
+      socket.setTimeout(0);
+      const transport = new TcpTransport(socket);
+      const session = this._open(route, 'bonjour', transport);
+      transport.on('message', (f) => session.receiveWire(f));
+      transport.on('close', () => session.close('transport-closed'));
+      transport.on('error', () => {});
+      session.start();
+    });
+    socket.on('error', () => this._redial(route));
+    socket.setTimeout(10_000, () => socket.destroy());
+  }
+
+  _redial(route) {
+    if (!this._node._running || route.endpoint === 'relay' || this._timers.has(route.nodeId)) return;
+    const t = setTimeout(() => { this._timers.delete(route.nodeId); this._dial(route); }, REDIAL_MS);
+    if (t.unref) t.unref();
+    this._timers.set(route.nodeId, t);
+  }
+
+  _open(route, kind, transport) {
+    const node = this._node;
+    const session = new LegacySession({
+      route, kind, transport, room: node._room,
+      local: { nodeId: node.nodeId, name: node.name, publicKey: node._identity.publicKey },
+    });
+    this._sessions.set(route.nodeId, session);
+    session.on('confirmed', () => this._confirmed(session));
+    session.on('frame', (frame) => node._receiveSessionFrame(session, frame));
+    session.on('hint', () => { this._hints++; });
+    session.on('closed', (info) => this._closed(session, info));
+    return session;
+  }
+
+  _confirmed(session) {
+    const node = this._node;
+    const route = session.route;
+    // A fingerprint-only route pins the key its hello presented, now that it matched.
+    if (!route.key) {
+      const b = node._roster.bind(route.nodeId, session.identityKey, 'pinned');
+      if (!b.bound && b.reason === 'conflict') { session.close('key-conflict'); return; }
+    }
+    if (this._floored(route)) { session.close('floor'); return; }
+    const existing = node._peers.get(route.nodeId);
+    if (existing && existing.transports.size && [...existing.transports.values()].some((t) => !t.legacy)) {
+      session.close('core-secure-session-live');
+      return;
+    }
+    let peer = existing;
+    if (!peer) {
+      peer = { peerId: route.nodeId, name: session.name, identityKey: session.identityKey, transports: new Map(), transport: null, isOutbound: true, source: session.kind, lastSeen: Date.now(), joinedAt: Date.now(), legacy: true };
+      node._peers.set(route.nodeId, peer);
+    }
+    peer.transports.set(session.kind, session);
+    peer.transport = node._bestTransport(peer);
+    this._refused.delete(route.nodeId);
+    node._log(`Legacy Import session with ${session.name} (${route.nodeId.slice(0, 8)}) over ${session.kind === 'relay' ? 'the relay' : route.endpoint}: ${LEGACY_ENCRYPTION}. Records from it are quarantined (verified: false).`);
+    if (!existing) {
+      node._metrics.peersJoined++;
+      node.emit('peer-joined', { id: route.nodeId, name: session.name, source: session.kind, profile: 'legacy-import' });
+    }
+  }
+
+  _closed(session, info) {
+    const node = this._node;
+    const nodeId = session.route.nodeId;
+    if (this._sessions.get(nodeId) === session) this._sessions.delete(nodeId);
+    const peer = node._peers.get(nodeId);
+    if (peer && peer.transports.get(session.kind) === session) {
+      peer.transports.delete(session.kind);
+      peer.transport = node._bestTransport(peer);
+      if (peer.transports.size === 0) {
+        node._peers.delete(nodeId);
+        node._metrics.peersLeft++;
+        node.emit('peer-left', { id: nodeId, name: peer.name });
+      }
+    }
+    if (info && !info.wasConfirmed && info.reason !== 'node-stopped') {
+      this._refused.set(nodeId, `${info.reason}${info.detail ? `: ${info.detail}` : ''}`);
+      node._log(`Legacy Import route ${nodeId.slice(0, 8)} not opened: ${info.reason}${info.detail ? ` (${info.detail})` : ''}`);
+    }
+    if (info && info.reason !== 'node-stopped' && info.reason !== 'floor' && info.reason !== 'fingerprint-mismatch' && info.reason !== 'key-conflict') this._redial(session.route);
+  }
+
+  /** The relay names a routed node present: this node sends its legacy hello to it (it never waits). */
+  relayPresent(nodeId) {
+    const route = this._routes.get(nodeId);
+    if (!route || route.endpoint !== 'relay' || this._sessions.has(nodeId) || this._floored(route)) return;
+    const session = this._open(route, 'relay', this._node._relay.transportFor(nodeId));
+    session.start();
+  }
+
+  relayGone(nodeId) {
+    const s = this._sessions.get(nodeId);
+    if (s && s.kind === 'relay') s.close('relay-peer-left');
+  }
+
+  /** An envelope from a relay `from` that is not Core Secure: a routed legacy node's, or not ours. */
+  relayFrame(from, fromName, payload) {
+    const route = this._routes.get(from);
+    if (!route || route.endpoint !== 'relay') return false;
+    let s = this._sessions.get(from);
+    if (!s) {
+      // The route is chosen by configuration before any byte is read: this node opens the session
+      // and sends its own hello, then takes the peer's frames on it.
+      if (this._floored(route)) return true;
+      s = this._open(route, 'relay', this._node._relay.transportFor(from));
+      s.start();
+    }
+    s.receiveWire(payload);
+    return true;
+  }
+
+  status() {
+    return {
+      routes: this._routes.size,
+      window: 'network Legacy Import is removed in sym 0.15.0',
+      sessions: [...this._sessions.values()].filter((s) => s.confirmed).map((s) => ({
+        nodeId: s.nodeId, name: s.name, transport: s.kind === 'relay' ? 'relay' : s.route.endpoint,
+        encryption: s.encryption, verified: false, since: s.confirmedAt,
+      })),
+      refused: [...this._refused].map(([nodeId, why]) => ({ nodeId, why })),
+      hintsIgnored: this._hints,
+    };
+  }
+}
+
+function readRoutesFile(dir) {
+  if (!dir) return [];
+  try {
+    const parsed = JSON.parse(fs.readFileSync(path.join(dir, ROUTES_FILE), 'utf8'));
+    return Array.isArray(parsed) ? parsed : (Array.isArray(parsed.routes) ? parsed.routes : []);
+  } catch { return []; }
+}
+
+module.exports = { LegacyImport, LegacySession, checkRoute, ROUTES_FILE, LEGACY_ENCRYPTION };
diff --git a/lib/node.js b/lib/node.js
index ca02c48e..75e1bbbb 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -24,7 +24,7 @@ const path = require('path');
 const crypto = require('crypto');
 const { EventEmitter } = require('events');
 const { MeshNode } = require('./core');
-const { nodeDir, loadOrCreateIdentity, acquireIdentityLock, log: logMsg } = require('./config');
+const { nodeDirById, loadIdentity, acquireIdentityLock, log: logMsg } = require('./config');
 const { assertTestSandbox } = require('./core/state-root');
 const { MemoryStore } = require('./memory-store');
 const { AttestationStore, chainHash, isPosition, isCanonicalSig } = require('./attestation-store');
@@ -37,7 +37,6 @@ const { DecisionLog } = require('./decision-log');
 const {
   encode, DIM, createCMB, renderContent, FIELD_WEIGHT_PROFILES,
   WakeManager,
-  e2eGenerateKeyPair, e2eDeriveSharedSecret, encryptCategories,
   signCMB, assertionIdV2_0, mintRemixKey, signAttestation, verifyAttestation, verifyAttestationRole,
   merkleRoot, signCheckpoint, verifyCheckpoint, signWitness, verifyWitness,
   signGrant, roleRank, CAT7_CATEGORIES, assertRecordSendable,
@@ -45,8 +44,27 @@ const {
 const { MMP_EMIT_V2 } = require('./emit-policy'); // the single reader-first flip switch
 /** How far this node's record timestamps may run ahead of its clock before they follow it again. */
 const MAX_CLOCK_LEAD_MS = 60 * 1000;
-const { FrameHandler } = require('./frame-handler');
+const { FrameHandler, MESSAGE_SCHEMA } = require('./frame-handler');
 const { TcpTransport } = require('./transport');
+const { PeerSession } = require('./session');
+const { LegacyImport } = require('./legacy-import');
+const { EXT_CMB_ENCRYPTED_V2 } = require('./core/mmp-extensions');
+const ENGINE_VERSION = require('../package.json').version;
+/**
+ * Extensions this node offers in every hello (§16). An extension is active on a session only when
+ * both offered it and it was selected (§16.3), and its frames are sent only on such sessions:
+ *   cmb-encrypted-v2  — records travel sealed; required: a session without it is not Core Secure.
+ *   sym-attest-v1     — admission attestations, checkpoints, witnesses, node-stats (design D1;
+ *                       unregistered, so the registry entry is drafted for §16.4).
+ *   xmesh-insight-v1  — the Layer-6 insight frame.
+ */
+const EXT_ATTEST = 'sym-attest-v1';
+const EXT_XMESH_INSIGHT = 'xmesh-insight-v1';
+const OFFERED_EXTENSIONS = Object.freeze([EXT_CMB_ENCRYPTED_V2, EXT_ATTEST, EXT_XMESH_INSIGHT]);
+/** Frames that ride only on sessions that selected sym-attest-v1. */
+const ATTEST_FRAMES = new Set(['attestation', 'checkpoint', 'witness', 'node-stats']);
+/** Legacy hellos refused on the Core Secure listener are said at most once a minute per address. */
+const LEGACY_REFUSAL_REPORT_MS = 60_000;
 const { SEND_FAILURE, MAX_FRAME_SIZE } = require('./frame-parser');
 const { RelayConnection } = require('./relay');
 const { BonjourDiscovery, NullDiscovery } = require('./discovery');
@@ -78,19 +96,6 @@ function summarizeTally(tally, totalWeight) {
   };
 }
 
-/**
- * NEVER IN THE CLEAR THROUGH THE RELAY. A peer reached only over the relay with no shared
- * secret (its handshake carried no E2E key, or derivation failed) used to receive the CMB's
- * categories in plaintext, through a server that promises it cannot read them. Founder,
- * 2026-09-05: refuse instead — the peer gets nothing from us, and the refusal is said once per
- * peer (log + `peers()` carries `e2e` and `clearRefused`) so silence has a reason. LAN transports
- * are unaffected: a peer on the local network still receives the frame. Plain functions: the
- * node already has a boolean field named `_relayOnly` (an option), so these live outside it.
- */
-function peerReachedOnlyOverRelay(peer) {
-  return !!(peer && peer.transports) && peer.transport === peer.transports.get('relay');
-}
-
 /**
  * One lane's budget of NEW gossiped statements (attestations, checkpoints, witnesses, role grants): a
  * burst, then a rate a second, spent before the signature is checked, so no lane can buy more
@@ -109,14 +114,15 @@ function peerReachedOnlyOverRelay(peer) {
 const GOSSIP_PER_SECOND = 2000;
 const GOSSIP_BURST = 10000;
 /**
- * The budget is kept per lane: the connection a frame arrives on (one TCP connection, or the relay
- * connection together with the id the relay names as the sender), never only the peer id the sender
- * declares. A lane seen for the first time starts with GOSSIP_NEW_LANE tokens and earns the rest at
- * the rate, so minting ids buys a hundred checks each, not a burst each. And every lane draws on one
- * ceiling as well, GOSSIP_GLOBAL_PER_SECOND after a burst of GOSSIP_GLOBAL_BURST, so many ids together
- * buy no more than that: 4,000 a second is six times the busy room's 640 new statements a second in
- * all. Under a flood from many ids at once the ceiling can drop honest frames too (a copy of one may
- * still come by another lane later); what it cannot do is spend more than the ceiling's checks.
+ * The budget is kept per PROVEN peer (sym 0.14, design D1): the nodeId a Core Secure session proved.
+ * Until 0.14 it was kept per connection lane, because the id a sender declared was free to claim;
+ * a proven id costs a completed handshake, and the per-connection lanes — an identity workaround —
+ * are gone. A peer seen for the first time starts with GOSSIP_NEW_LANE tokens and earns the rest at
+ * the rate, so minting identities buys a hundred checks each, not a burst each. And every peer draws
+ * on one ceiling as well, GOSSIP_GLOBAL_PER_SECOND after a burst of GOSSIP_GLOBAL_BURST, so many ids
+ * together buy no more than that: 4,000 a second is six times the busy room's 640 new statements a
+ * second in all. Under a flood from many ids at once the ceiling can drop honest frames too (a copy
+ * may still come by another peer later); what it cannot do is spend more than the ceiling's checks.
  */
 const GOSSIP_NEW_LANE = 100;
 /** A signature longer than this is not one (an Ed25519 signature is 86 characters of base64url): it is
@@ -175,19 +181,11 @@ function refill(b, rate, burst, now) {
   return b;
 }
 
-function refuseClearThroughRelay(node, peerId, peer) {
-  if (!node._clearRefused) node._clearRefused = new Set();
-  if (node._clearRefused.has(peerId)) return;
-  node._clearRefused.add(peerId);
-  if (typeof node._log === 'function') {
-    node._log(`Refused to send in the clear through the relay to ${(peer && peer.name) || String(peerId).slice(0, 8)} — that peer presented no encryption key, so nothing is sent to it over the relay until it does`);
-  }
-}
-
 /** Why a CMB was not handed to a peer, beyond the transport's own SEND_FAILURE reasons. */
 const NOT_SENT = Object.freeze({
-  CLEAR_OVER_RELAY: 'clear-over-relay', // reachable only through the relay, and no shared secret to seal with
   SEND_FAILED: 'send-failed',           // a transport that says only whether, not why
+  UNSEALABLE: 'unsealable',             // not a signed v2.0 record: nothing else travels in Core Secure
+  QUEUE_FULL: 'queue-full',             // the relay pacer's queue is full
 });
 
 /** How each reason reads in the log. */
@@ -195,8 +193,9 @@ const NOT_SENT_SAID = Object.freeze({
   [SEND_FAILURE.TOO_LARGE]: 'frame too large',
   [SEND_FAILURE.NOT_CONNECTED]: 'not connected',
   [SEND_FAILURE.WRITE_FAILED]: 'write failed',
-  [NOT_SENT.CLEAR_OVER_RELAY]: 'reachable only through the relay, with no key to encrypt for it',
   [NOT_SENT.SEND_FAILED]: 'send failed',
+  [NOT_SENT.UNSEALABLE]: 'not a signed v2.0 record (only those travel in Core Secure)',
+  [NOT_SENT.QUEUE_FULL]: 'the relay send queue is full',
 });
 
 /**
@@ -208,6 +207,27 @@ function trySend(transport, frame) {
   return transport && transport.send(frame) !== false ? { ok: true } : { ok: false, reason: NOT_SENT.SEND_FAILED };
 }
 
+/** The schema of the signed application section remember({ payload }) carries (§8.8.3). */
+const PAYLOAD_SCHEMA = 'https://sym.bot/schema/payload-v1.json';
+
+/** A remember() payload as a signed application section: its JSON bytes. */
+function payloadApplication(payload) {
+  const bytes = Buffer.from(JSON.stringify(payload), 'utf8');
+  if (bytes.length > 524288) {
+    const e = new Error(`payload is ${bytes.length} bytes; an application section carries at most 524288 (§8.8.3)`);
+    e.code = 'ECMBSIZE';
+    throw e;
+  }
+  return {
+    mediaType: 'application/json',
+    schema: PAYLOAD_SCHEMA,
+    encoding: 'base64url',
+    byteLength: bytes.length,
+    digest: `sha256-${crypto.createHash('sha256').update(bytes).digest('hex')}`,
+    data: bytes.toString('base64url'),
+  };
+}
+
 class SymNode extends EventEmitter {
 
   /**
@@ -276,8 +296,6 @@ class SymNode extends EventEmitter {
     // The attestation index is created after the node dir is known (below), so it can
     // persist + reload the durable audit trail.
 
-    // Track peer lifecycle roles from handshake (Section 6.4: validator-origin weight 2.0)
-    this._peerLifecycleRoles = new Map();
 
     // SVAF parameters (paper Section 3.2-3.3)
     this._svafStableThreshold = opts.svafStableThreshold ?? 0.25;
@@ -345,9 +363,12 @@ class SymNode extends EventEmitter {
     // admission is the baseline, and a consumer with its own Layer-4 engine
     // injects an evaluator that sometimes answers.
     this._svafEvaluator = opts.svafEvaluator ?? { evaluate: async () => null };
-    this._identity = loadOrCreateIdentity(this.name);
+    // Identity by nodeId (design D9): `opts.nodeId` loads that identity; `opts.create === false`
+    // refuses to mint when it is absent (a host restoring a known agent never mints a replacement);
+    // a tombstoned identity (moved to another host) refuses to start. The name is the index.
+    this._identity = loadIdentity({ name: this.name, nodeId: opts.nodeId, create: opts.create !== false });
     this.nodeId = this._identity.nodeId;
-    this._dir = nodeDir(this.name);
+    this._dir = nodeDirById(this.nodeId);
 
     // Per-node attestation index — every gating attestation this node produces
     // (admit/guard/redundant/reject) + those received from roster peers, indexed by
@@ -363,7 +384,7 @@ class SymNode extends EventEmitter {
       // else 128 MiB.
       archiveMaxBytes: opts.attestationArchiveMaxBytes,
     });
-    // The budget of new gossiped statements, per lane and in all (see GOSSIP_PER_SECOND and
+    // The budget of new gossiped statements, per proven peer and in all (see GOSSIP_PER_SECOND and
     // GOSSIP_NEW_LANE); `opts.gossipBudget` ({ perSecond, burst, newLane, globalPerSecond,
     // globalBurst }) changes it.
     const gb = opts.gossipBudget || {};
@@ -372,9 +393,8 @@ class SymNode extends EventEmitter {
     this._gossipNewLane = gb.newLane || GOSSIP_NEW_LANE;
     this._gossipGlobalRate = gb.globalPerSecond || GOSSIP_GLOBAL_PER_SECOND;
     this._gossipGlobalBurst = gb.globalBurst || GOSSIP_GLOBAL_BURST;
-    this._gossipBuckets = new Map(); // lane -> { tokens, at }, least recently active first
+    this._gossipBuckets = new Map(); // proven peer nodeId -> { tokens, at }, least recently active first
     this._gossipGlobal = { tokens: this._gossipGlobalBurst, at: Date.now() };
-    this._laneSeq = 0;
     // Each attester's rate of new checkpoints taken (see CHECKPOINTS_PER_SECOND); `opts.checkpointRate`
     // ({ perSecond, burst }) changes it.
     this._checkpointRate = (opts.checkpointRate && opts.checkpointRate.perSecond) || CHECKPOINTS_PER_SECOND;
@@ -406,15 +426,21 @@ class SymNode extends EventEmitter {
     // Throws with code 'EIDENTITYLOCK' if another process already holds
     // the lock. Hosts should catch and exit cleanly (or pick a
     // different SYM_NODE_NAME).
-    this._releaseIdentityLock = acquireIdentityLock(this.name);
-
-    // E2E encryption — X25519 keypair for CMB category encryption
-    this._e2eKeyPair = this._loadOrCreateE2EKeyPair();
-    this._peerSharedSecrets = new Map();
-
-    // CMB authentication — peers' Ed25519 identity public keys (from handshake,
-    // base64url). Used to verify the signature on every inbound signed CMB.
-    this._peerIdentityKeys = new Map();
+    this._releaseIdentityLock = acquireIdentityLock(this.name, { dir: this._dir });
+
+    // Core Secure (design D1/D2): a peer is the set of confirmed sessions that proved one nodeId with
+    // one identity key. Session keys are ephemeral, derived per handshake (§5.2.1): there is no
+    // persistent X25519 key and no per-peer secret map. `_sessions` holds every live session,
+    // authenticating or confirmed; `_peers` only admitted ones, keyed by the PROVEN nodeId.
+    this._sessions = new Set();
+    this._offeredExtensions = [...(opts.extensions || OFFERED_EXTENSIONS)];
+    this._implementation = { name: 'sym', version: ENGINE_VERSION };
+    this._handshakeTimeoutMs = opts.handshakeTimeoutMs || 10_000;
+    this._legacyRefusals = new Map(); // address -> { at, more }: legacy hellos refused on the listener
+    this._sessionStats = { confirmed: 0, failed: 0, failedByReason: {}, refusedFrames: 0, refusedByReason: {}, desync: 0, superseded: 0, legacyHellosRefused: 0 };
+    // Legacy Import (design D7) is created after the node dir and the key registry exist (below).
+    this._legacyRoutes = opts.legacyRoutes || null;
+    this._legacy = null;
 
     // Earned-authority root (MMP §6.5). The pinned, non-earnable anchor identity
     // (typically the founder) that all role authority must chain back to. Configured
@@ -427,7 +453,16 @@ class SymNode extends EventEmitter {
     this._roster = new RosterKeyRegistry({
       anchor: this._anchor,
       dir: path.join(this._dir, 'roster-keys'),
+      log: (m) => this._log(m),
     });
+    {
+      const mig = this._roster.migration();
+      if (mig && mig.read > 0) this._log(`Key registry migrated from 0.13: ${mig.bindings} binding(s), ${mig.legacyClaim} relabelled legacy-claim (unproven hellos: expected keys, never verifying), ${mig.grant} grant-vouched`);
+    }
+    // Legacy Import (design D7): off unless routes are configured (opts.legacyRoutes, or the node
+    // dir's legacy-routes.json). Each route is outbound-only, pins its mandatory key fingerprint, and
+    // is refused by the sticky floor once its nodeId has proven itself over Core Secure.
+    this._legacy = new LegacyImport(this, { routes: this._legacyRoutes || [] });
     // Room ownership — which key owns which room, for THIS receiver. Config pins are
     // supplied per boot and outrank the persisted cache; there is no wire source (see
     // room-ownership.js). A room with no owner is OPEN and behaves exactly as before.
@@ -623,7 +658,7 @@ class SymNode extends EventEmitter {
     this._discovery = opts.discovery || (
       opts.relayOnly
         ? new NullDiscovery()
-        : new BonjourDiscovery({ serviceType: this._discoveryServiceType })
+        : new BonjourDiscovery({ serviceType: this._discoveryServiceType, room: opts.room || 'default' })
     );
 
     // Wake
@@ -660,20 +695,25 @@ class SymNode extends EventEmitter {
       getIdentity: () => this._identity,
       getRoom: () => this._room,   // declared in relay-auth (wire note D4)
       isRunning: () => this._running,
-      getPeers: () => this._peers,
       getMeshNode: () => this._meshNode,
-      createPeer: (transport, peerId, peerName, isOutbound, source) => this._createPeer(transport, peerId, peerName, isOutbound, source),
-      addPeer: (peer) => this._addPeer(peer),
-      handlePeerMessage: (peerId, peerName, msg, lane) => this._receiveFrame(peerId, peerName, msg, 'relay', lane),
-      onPeerLeft: (peerId, peerName) => { this._metrics.peersLeft++; this.emit('peer-left', { id: peerId, name: peerName }); this.emit('metric', { type: 'peer-left', name: peerName }); },
+      // The relay's roster names candidates and its envelopes carry bytes from an unproven `from`
+      // (§4.4.1): the session manager below runs the handshake over each channel (design D2).
+      onPeerPresent: (nodeId, name) => this._relayPeerPresent(nodeId, name),
+      onPeerGone: (nodeId, name) => this._relayPeerGone(nodeId, name),
+      onEnvelope: (from, fromName, payload) => this._relayEnvelope(from, fromName, payload),
+      onDisconnected: () => this._relayDisconnected(),
+      rate: opts.relayRate,
       onIdentityCollision: (info) => {
         // Surface the collision as an event so hosts can take action.
         // Default behavior (if no listener): the relay layer has already
         // logged loudly and stopped reconnecting; the node remains alive
         // but in a degraded state (no relay transport, only Bonjour LAN
         // peers reachable). Hosts that prefer to exit hard should listen
-        // and call process.exit() themselves.
+        // and call process.exit() themselves. `info.code` says which stop
+        // (4004 replaced, 4006 duplicate rejected, 4007 key conflict) and
+        // status().relayState.stopped keeps it.
         this.emit('identity-collision', info);
+        this.emit('metric', { type: 'relay-hard-stop', code: info.code, kind: info.kind || null, nodeId: info.nodeId });
       },
       onAuthRefused: (info) => {
         // The relay's channel table does not hold our token. The relay layer has logged the
@@ -682,9 +722,6 @@ class SymNode extends EventEmitter {
         this.emit('relay-auth-refused', info);
       },
       nodeName: this.name,
-      peerWakeChannels: this._peerWakeChannels,
-      saveWakeChannels: () => this._wakeManager.saveWakeChannels(),
-      learnWakeChannel: (id, ch, o) => this._wakeManager.learnWakeChannel(id, ch, o),
     });
 
     // Frame handler — cliHostMode forwards frames without storing or SVAF.
@@ -712,75 +749,7 @@ class SymNode extends EventEmitter {
     this._statsTimer = null;
   }
 
-  // ── E2E Encryption ─────────────────────────────────────────
-
-  /**
-   * Load or create a persistent X25519 keypair for E2E category encryption.
-   * Stored alongside identity at ~/.sym/nodes/<name>/e2e-keypair.json.
-   * @returns {{ publicKey: Buffer, privateKey: Buffer }}
-   * @private
-   */
-  _loadOrCreateE2EKeyPair() {
-    const kpPath = path.join(this._dir, 'e2e-keypair.json');
-    if (fs.existsSync(kpPath)) {
-      try {
-        const data = JSON.parse(fs.readFileSync(kpPath, 'utf8'));
-        return {
-          publicKey: Buffer.from(data.publicKey, 'base64'),
-          privateKey: Buffer.from(data.privateKey, 'base64'),
-        };
-      } catch (e) {
-        this._log(`E2E keypair corrupt — regenerating: ${e.message}`);
-      }
-    }
-    const kp = e2eGenerateKeyPair();
-    fs.writeFileSync(kpPath, JSON.stringify({
-      publicKey: kp.publicKey.toString('base64'),
-      privateKey: kp.privateKey.toString('base64'),
-    }, null, 2));
-    return kp;
-  }
-
-  /**
-   * Derive shared secret from peer's X25519 public key and store it.
-   * @param {string} peerId
-   * @param {string} peerPublicKeyB64 — base64-encoded peer public key
-   * @private
-   */
-  _deriveAndStoreSecret(peerId, peerPublicKeyB64) {
-    if (!wireNodeId(peerId) || !wireKey(peerPublicKeyB64)) return;
-    // Skip if we already have a shared secret for this peer+key combo
-    const cacheKey = `${peerId}:${peerPublicKeyB64}`;
-    if (this._e2eDerivedKeys && this._e2eDerivedKeys.has(cacheKey)) return;
-    try {
-      const peerPubKey = Buffer.from(peerPublicKeyB64, 'base64');
-      const secret = e2eDeriveSharedSecret(this._e2eKeyPair.privateKey, peerPubKey);
-      this._peerSharedSecrets.set(peerId, secret);
-      if (!this._e2eDerivedKeys) this._e2eDerivedKeys = new Set();
-      this._e2eDerivedKeys.add(cacheKey);
-      this._log(`E2E shared secret derived for peer ${peerId.slice(0, 8)}`);
-    } catch (err) {
-      this._log(`E2E key derivation failed for peer ${peerId.slice(0, 8)}: ${err.message}`);
-    }
-  }
-
-  /**
-   * Encrypt CMB categories for a specific peer. Returns a modified CMB copy
-   * with categories replaced by ciphertext and E2E metadata attached.
-   * @param {object} cmb — original CMB
-   * @param {Buffer} sharedSecret — 32-byte shared secret
-   * @returns {object} — CMB with encrypted categories
-   * @private
-   */
-  _encryptCMBForPeer(cmb, sharedSecret) {
-    if (!cmb || !cmb.categories || typeof cmb.categories !== 'object') return cmb;
-    const { ciphertext, nonce } = encryptCategories(cmb.categories, sharedSecret);
-    return {
-      ...cmb,
-      categories: ciphertext,
-      _e2e: { nonce },
-    };
-  }
+  // ── Keys ───────────────────────────────────────────────────
 
   /**
    * This node's EARNED role right now — resolved from the role-grant chain when an
@@ -791,36 +760,28 @@ class SymNode extends EventEmitter {
    */
   _resolvedRole() {
     if (!this._anchor) return this._lifecycleRole;
-    return this._roleGrants.resolveRole(this.nodeId, Date.now());
-  }
-
-  /** Resolve any node's role at a time (default now) from this node's grant chain. */
-  resolveRole(nodeId, at = Date.now()) {
-    return this._roleGrants.resolveRole(nodeId, at);
+    return this._roleGrants.resolveRole(this.nodeId, this._identity.publicKey, Date.now());
   }
 
   /**
-   * Learn a peer's identity key from a direct authenticated handshake. Pins it both in
-   * the legacy CMB-verification map and in the roster registry at 'handshake' strength
-   * (so it outranks any weaker grant-vouched binding).
-   * @private
+   * Resolve any node's role at a time (default now) from this node's grant chain. Authority follows
+   * the key (design D3): the role is the one conferred on the key `nodeId` is bound to here — its
+   * proven or vouched binding — so an id held under another key resolves to participant. Pass
+   * `opts.key` to ask about a specific key instead.
    */
-  _pinPeerKey(nodeId, keyB64url) {
-    // A key is text or it is not a key: pinned as given, a JSON object here sat in the roster (and
-    // its file) and failed every verification against it.
-    if (!wireNodeId(nodeId) || !wireKey(keyB64url)) return;
-    this._peerIdentityKeys.set(nodeId, keyB64url);
-    this._roster.pin(nodeId, keyB64url, 'handshake');
+  resolveRole(nodeId, at = Date.now(), opts = {}) {
+    const key = opts.key || (nodeId === this.nodeId ? this._identity.publicKey : this._identityKey(nodeId));
+    return this._roleGrants.resolveRole(nodeId, key, at);
   }
 
   /**
-   * Resolve a node's identity public key for signature verification. Consults the roster
-   * registry first (covers relayed, grant-vouched, and persisted bindings — peers we may
-   * never have directly met), falling back to the direct-handshake map.
+   * The key that verifies `nodeId`'s signatures: its binding in the key registry (design D3) —
+   * the configured anchor, a proven session, an out-of-band pin, or an anchor-rooted grant's vouch.
+   * Never a key a hello merely announced, and never a legacy claim.
    * @private
    */
   _identityKey(nodeId) {
-    return this._roster.get(nodeId) || this._peerIdentityKeys?.get(nodeId);
+    return this._roster.get(nodeId);
   }
 
   /**
@@ -959,8 +920,10 @@ class SymNode extends EventEmitter {
       });
       for (const [peerId, peer] of this._peers) {
         if (peer.transport?.send) {
-          asked.add(peerId);
-          peer.transport.send({ type: 'cmb-fetch', reqId, key, from: this.nodeId, timestamp: Date.now() });
+          // The record answers before the result that lists it (design D1): the session is told now
+          // that a record under `key` is this fetch's.
+          this._frameHandler.expectFetched(peer.transport, key, reqId);
+          if (peer.transport.send({ type: 'cmb-fetch', reqId, key, from: this.nodeId, timestamp: Date.now() }) !== false) asked.add(peerId);
         }
       }
       if (asked.size === 0) done(null);
@@ -977,8 +940,18 @@ class SymNode extends EventEmitter {
    * @param {'validator'|'anchor'} role
    * @returns {object|null} the signed grant, or null
    */
-  grantRole(granteeNodeId, role) {
-    return this._emitGrant({ type: 'role-grant', grantee: granteeNodeId, role });
+  grantRole(granteeNodeId, role, opts = {}) {
+    // Every grant names the key it confers authority on (design D3): a grant to a bare nodeId would
+    // confer it on whoever holds that id later. The key is one this node has a PROVEN binding for (a
+    // confirmed session, or an out-of-band pin), or one the operator names explicitly.
+    const source = this._roster.source(granteeNodeId);
+    const granteeKey = opts.granteeKey
+      || ((source === 'proven' || source === 'pinned') ? this._roster.get(granteeNodeId) : undefined);
+    if (!granteeKey) {
+      this._log(`Role grant for ${String(granteeNodeId).slice(0, 8)} not made: no proven key is known for it (it has not completed a Core Secure session with this node, and no key was given)`);
+      return null;
+    }
+    return this._emitGrant({ type: 'role-grant', grantee: granteeNodeId, role, granteeKey });
   }
 
   /** Revoke a peer's granted role (signed role-revoke, gossiped). */
@@ -1010,14 +983,10 @@ class SymNode extends EventEmitter {
 
   /** @private Sign + record + gossip a grant/revoke. */
   _emitGrant(partial) {
+    // A grant vouches for the grantee's nodeId↔key binding (granteeKey, bound into the signed
+    // payload): nodes that never met the grantee learn its key from this rooted grant. Revokes carry
+    // no key.
     const g = { ...partial, grantedBy: this.nodeId, grantedAt: Date.now() };
-    // Vouch for the grantee's nodeId↔key binding when we know its key (from a direct
-    // handshake): bound into the signed payload, this lets nodes that never met the
-    // grantee learn its key from this rooted grant. Revokes carry no key.
-    if (g.type === 'role-grant' && !g.granteeKey) {
-      const k = this._identityKey(g.grantee);
-      if (k) g.granteeKey = k;
-    }
     try {
       signGrant(g, this._identity.privateKey);
       const r = this._roleGrants.record(g);
@@ -1040,7 +1009,7 @@ class SymNode extends EventEmitter {
    * peer's self-signed grant, say — has no effect, so it is dropped here and goes no further.
    * @private
    */
-  _ingestRoleGrant(g, fromPeerId, lane) {
+  _ingestRoleGrant(g, fromPeerId) {
     // A role grant is gossip like any other signed statement: a repeat (its signature's bytes, however
     // it is spelled) or a frame that is malformed, spelled otherwise than its signer wrote it, or from a
     // grantor whose key this node does not hold is dropped before anything is spent; a new one spends
@@ -1050,7 +1019,7 @@ class SymNode extends EventEmitter {
     if (!isCanonicalSig(g.sig)) return this._refuseSpelling(fromPeerId, 'role-grant', g.grantedBy);
     if (this._roleGrants.has(g.sig)) return { ok: false, reason: 'duplicate' };
     if (!this._roleGrants.grantorKey(g.grantedBy)) return { ok: false, reason: 'unknown-grantor-key' };
-    if (!this._gossipBudget(fromPeerId, 'role-grant', g.grantedBy, lane)) return { ok: false, reason: 'over-budget' };
+    if (!this._gossipBudget(fromPeerId, 'role-grant', g.grantedBy)) return { ok: false, reason: 'over-budget' };
     const r = this._roleGrants.record(g);
     if (r.stored) this._gossipToRoster({ type: g.type, grant: g }, fromPeerId);
     return { ok: r.stored, reason: r.reason };
@@ -1232,6 +1201,8 @@ class SymNode extends EventEmitter {
     if (!frame || !this._peers || this._peers.size === 0) return;
     for (const [peerId, peer] of this._peers) {
       if (peerId === exceptPeerId) continue;
+      // The attestation family rides only on sessions that selected sym-attest-v1 (§16.3).
+      if (!this._sessionTakes(peer.transport, frame.type)) continue;
       try { peer.transport.send(frame); } catch { /* transient peer — skip */ }
     }
   }
@@ -1279,7 +1250,7 @@ class SymNode extends EventEmitter {
    * node countersigns "I saw attester's chain to N with root R"), and relay-once.
    * @private
    */
-  _ingestCheckpoint(cp, fromPeerId, lane) {
+  _ingestCheckpoint(cp, fromPeerId) {
     if (!cp || !cp.by || cp.upto_seq === undefined || !cp.root || !sigOk(cp.sig)) return { ok: false, reason: 'malformed' };
     if (cp.roster && this._room && cp.roster !== this._room) return { ok: false, reason: 'roster-mismatch' };
     // A position is an integer; the signature covers its text, so a re-spelled one is refused here,
@@ -1301,7 +1272,7 @@ class SymNode extends EventEmitter {
     if (!isCanonicalSig(cp.sig)) return this._refuseSpelling(fromPeerId, 'checkpoint', cp.by);
     const key = this._identityKey(cp.by);
     if (!key) return { ok: false, reason: 'unknown-attester-key' };
-    if (!this._gossipBudget(fromPeerId, 'checkpoint', cp.by, lane)) return { ok: false, reason: 'over-budget' };
+    if (!this._gossipBudget(fromPeerId, 'checkpoint', cp.by)) return { ok: false, reason: 'over-budget' };
     if (!verifyCheckpoint(cp, key).valid) return { ok: false, reason: 'bad-signature' };
     // A new position is taken at most at its attester's rate, whichever peer brings it: past that it is
     // not stored, witnessed or relayed. Checked after the signature, so no one else can spend it. A
@@ -1322,22 +1293,17 @@ class SymNode extends EventEmitter {
   }
 
   /**
-   * Spend one token of the lane a NEW gossiped statement arrived on, and one of the shared ceiling,
-   * before its signature is checked (see GOSSIP_PER_SECOND and GOSSIP_NEW_LANE). The lane is the
-   * connection that delivered the frame, never a claimed signer and never only the id the sender
-   * declares, so a forged frame spends only its own connection's budget, and minting fresh ids on one
-   * connection buys nothing; an honest peer relays only what it has verified and stored, so its lane
-   * carries no forgeries. Both refill, so a lane that stops flooding is heard again within burst/rate
-   * seconds. A dropped frame changes nothing: it is not marked seen, so another peer's copy is taken.
-   * Drops are said with the peer named (see _noteDrop), those the shared ceiling refused in one report
-   * of their own, so a gap they leave is attributable to this node, not the attester. O(1).
-   * @param {string} [lane] the connection's lane id; a caller without one is keyed by peerId
+   * Spend one token of the PROVEN peer a NEW gossiped statement arrived from, and one of the shared
+   * ceiling, before its signature is checked (see GOSSIP_PER_SECOND and GOSSIP_NEW_LANE). An honest
+   * peer relays only what it has verified and stored, so its budget carries no forgeries. Both refill,
+   * so a peer that stops flooding is heard again within burst/rate seconds. A dropped frame changes
+   * nothing: it is not marked seen, so another peer's copy is taken. O(1).
    * @returns {boolean} whether the frame may be verified
    * @private
    */
-  _gossipBudget(peerId, type, author, lane) {
+  _gossipBudget(peerId, type, author) {
     const now = this._gossipClock();
-    const b = bucketOf(this._gossipBuckets, lane ?? peerId, this._gossipRate, this._gossipBurst, this._gossipNewLane, now, GOSSIP_MAX_PEERS);
+    const b = bucketOf(this._gossipBuckets, peerId, this._gossipRate, this._gossipBurst, this._gossipNewLane, now, GOSSIP_MAX_PEERS);
     const all = refill(this._gossipGlobal, this._gossipGlobalRate, this._gossipGlobalBurst, now);
     if (b.tokens >= 1 && all.tokens >= 1) { b.tokens -= 1; all.tokens -= 1; return true; }
     // A drop by the ceiling is said in one report for all peers, not one per id: ids are free to mint,
@@ -1347,8 +1313,6 @@ class SymNode extends EventEmitter {
     return false;
   }
 
-  /** A lane id for one connection's frames (see GOSSIP_NEW_LANE). @private */
-  _newLane(kind) { return `${kind}:${++this._laneSeq}`; }
 
   /**
    * Take one of an attester's checkpoint tokens (see CHECKPOINTS_PER_SECOND), keyed by the attester
@@ -1496,7 +1460,7 @@ class SymNode extends EventEmitter {
    * signature against its authenticated key, record, relay-once.
    * @private
    */
-  _ingestWitness(w, fromPeerId, lane) {
+  _ingestWitness(w, fromPeerId) {
     if (!w || !w.attester || w.upto_seq === undefined || !w.root || !w.by || !sigOk(w.sig)) return { ok: false, reason: 'malformed' };
     if (w.roster && this._room && w.roster !== this._room) return { ok: false, reason: 'roster-mismatch' };
     if (!isPosition(w.upto_seq)) return { ok: false, reason: 'malformed' };
@@ -1507,7 +1471,7 @@ class SymNode extends EventEmitter {
     if (!isCanonicalSig(w.sig)) return this._refuseSpelling(fromPeerId, 'witness', w.by);
     const key = this._identityKey(w.by);
     if (!key) return { ok: false, reason: 'unknown-witness-key' };
-    if (!this._gossipBudget(fromPeerId, 'witness', w.by, lane)) return { ok: false, reason: 'over-budget' };
+    if (!this._gossipBudget(fromPeerId, 'witness', w.by)) return { ok: false, reason: 'over-budget' };
     if (!verifyWitness(w, key).valid) return { ok: false, reason: 'bad-signature' };
     const r = this._attestations.recordWitness(w);
     if (r.stored) this._gossipToRoster({ type: 'witness', witness: w }, fromPeerId);
@@ -1565,7 +1529,7 @@ class SymNode extends EventEmitter {
    * copy, a roster mismatch, an unknown attester or a bad signature emits nothing.
    * @private
    */
-  _ingestAttestation(att, fromPeerId, fromPeerName, lane) {
+  _ingestAttestation(att, fromPeerId, fromPeerName) {
     if (!att || !sigOk(att.sig) || !att.of || !att.by) return { ok: false, reason: 'malformed' };
     // Roster scope (defense in depth — gossip already stays in-room).
     if (att.roster && this._room && att.roster !== this._room) {
@@ -1583,7 +1547,7 @@ class SymNode extends EventEmitter {
     if (this._attestations.has(att.sig)) return { ok: false, reason: 'duplicate' };
     const attesterKey = this._identityKey(att.by);
     if (!attesterKey) return { ok: false, reason: 'unknown-attester-key' };
-    if (!this._gossipBudget(fromPeerId, 'attestation', att.by, lane)) return { ok: false, reason: 'over-budget' };
+    if (!this._gossipBudget(fromPeerId, 'attestation', att.by)) return { ok: false, reason: 'over-budget' };
     const v = verifyAttestation(att, attesterKey);
     if (!v.valid) return { ok: false, reason: v.error || 'bad-signature' };
     // Record (rate-limited as ingested). Relay-once only on first sight.
@@ -1607,8 +1571,10 @@ class SymNode extends EventEmitter {
    * changed it, and `byName` is the label the peer announced; `by` is the identity.
    *
    * `verified` means the signature checked out against the key this node holds for `by`, and
-   * `keySource` says where that key came from: 'anchor', 'grant', or 'handshake' (trust on first
-   * use: whoever completed the handshake under that nodeId). `from` is the peer that delivered the
+   * `keySource` says where that key came from (design D3): 'anchor' (configured), 'proven' (a
+   * Core Secure session proved it — trust on first PROVEN use when nothing else pinned it), 'pinned'
+   * (an invite or a Legacy Import route) or 'grant' (vouched by an anchor-rooted grant); a
+   * 'legacy-claim' never verifies, so it never appears here. `from` is the peer that delivered the
    * frame; `relayed` is true when that peer is not the attester, null when the deliverer is
    * unknown. `receivedAt` is this node's clock, not the attester's `at`.
    *
@@ -1660,7 +1626,7 @@ class SymNode extends EventEmitter {
         sig: signed(att.sig),
         sigAlg: signed(att.sigAlg),
         verified: true,
-        keySource: this._roster.source(att.by) ?? (this._peerIdentityKeys?.has(att.by) ? 'handshake' : null),
+        keySource: this._roster.source(att.by) ?? null,
         from: signed(fromPeerName),
         fromPeerId: signed(fromPeerId),
         relayed: fromPeerId ? fromPeerId !== att.by : null,
@@ -1820,32 +1786,29 @@ class SymNode extends EventEmitter {
    * @returns {{ key: string, content: string, cmb: object, timestamp: number }}
    */
   shareWithPeers(content, opts = {}) {
-    const cmb = opts.cmb || createCMB({ rawText: content, createdBy: opts.source || this.name });
+    // Core Secure (design D4): only a signed v2.0 record travels, sealed per session. A caller's own
+    // record is sent as it is (the session refuses one that is not signed v2.0); otherwise the
+    // content is minted here as this node's record, signed, and not stored.
+    let cmb = opts.cmb;
+    if (!cmb) {
+      cmb = createCMB({ categories: { focus: String(content || '') }, createdBy: opts.source || this.name, room: this._room, emitV2: true, createdByNodeId: this.nodeId });
+      cmb.metadata.assertionId = assertionIdV2_0(cmb);
+      this._signOrThrow(cmb, 'CMB signing failed');
+    }
 
     this._meshNode.coupledState();
 
     const ts = Date.now();
     let shared = 0;
     for (const [peerId, peer] of this._peers) {
-      const sharedSecret = this._peerSharedSecrets.get(peerId);
-      let peerCmb = cmb;
-      if (sharedSecret) {
-        peerCmb = this._encryptCMBForPeer(cmb, sharedSecret);
-        this._log(`E2E encrypted categories for peer ${peerId.slice(0, 8)}`);
-      } else if (peerReachedOnlyOverRelay(peer)) {
-        refuseClearThroughRelay(this, peerId, peer);
-        continue;
-      }
       // Only a frame a transport took counts: this counted every peer, so a block no peer could take
       // (too large, a closed socket) was logged as shared with all of them.
-      const sent = trySend(peer.transport, { type: 'cmb', timestamp: ts, cmb: peerCmb });
+      const sent = trySend(peer.transport, { type: 'cmb', timestamp: ts, cmb });
       if (sent.ok) shared++;
       else this._log(`Not shared with ${peer.name || peerId.slice(0, 8)}: ${NOT_SENT_SAID[sent.reason] || sent.reason}${sent.bytes ? ` (${sent.bytes} bytes)` : ''}`);
     }
 
-    this._log(`Shared: "${content.slice(0, 50)}${content.length > 50 ? '...' : ''}" → ${shared}/${this._peers.size} peers`);
-    // `ts` is this send's timestamp; `frame` was never bound here, so every call threw
-    // ReferenceError after the loop (found by the wire-alignment review, confirmed by running it).
+    this._log(`Shared: "${String(content).slice(0, 50)}${String(content).length > 50 ? '...' : ''}" → ${shared}/${this._peers.size} peers`);
     return { key: recordKey(cmb), content, cmb, timestamp: ts };
   }
 
@@ -1870,45 +1833,48 @@ class SymNode extends EventEmitter {
     // dns-sd may resolve the same peer multiple times.
     this._pendingBonjour = new Set();
 
-    // Wire discovery events to peer management
-    this._discovery.on('peer-found', (address, port, foundId, foundName) => {
+    // Wire discovery events to sessions (design D2). A discovery record is a CANDIDATE: an endpoint
+    // and the nodeId it claims. It decides only whom to dial; nothing about the peer exists until the
+    // session the dial opens is confirmed.
+    this._discovery.on('peer-found', (address, port, foundId, foundName, info = {}) => {
       // An advertisement's node-id/node-name are what the advertiser chose (wire-identity.js).
       const peerId = wireNodeId(foundId);
-      if (!peerId) return;
+      if (!peerId || peerId === this.nodeId) return;
       const peerName = wireName(foundName);
-      // Skip if already connecting (dns-sd resolves the same peer multiple times).
+      // A record without TXT mmp=2.0 is a legacy node: never dialled as Core Secure. Only a
+      // configured Legacy Import route reaches it (design D7), by its own endpoint.
+      if (!info || info.mmp !== '2.0') return;
+      // §5.1: the lexicographically smaller nodeId initiates; the other MUST NOT.
+      if (!(this.nodeId < peerId)) return;
+      // Skip if already dialling (dns-sd resolves the same peer multiple times), or already holding a
+      // live LAN session with it.
       if (this._pendingBonjour.has(peerId)) return;
-      // If we already have a LIVE bonjour transport, no need to dial again.
-      // A `_closed` transport is a stale entry whose close handler hasn't fired
-      // yet (Apple framework may not deliver FIN promptly when the peer process
-      // exits abruptly) — fall through and dial fresh.
       const existing = this._peers.get(peerId);
-      if (existing && existing.transports && existing.transports.has('bonjour')) {
-        const t = existing.transports.get('bonjour');
-        if (t && !t._closed) return;
-      }
-
+      const t = existing && existing.transports && existing.transports.get('bonjour');
+      if (t && !t.closed) return;
       this._pendingBonjour.add(peerId);
       this._connectToPeer(address, port, peerId, peerName);
     });
-    this._discovery.on('inbound-connection', (transport, peerId, peerName, handshakeMsg) => {
-      // The handshake that opens a LAN or loopback connection is an inbound frame like any other:
-      // it goes through the same guard. Discovery has already cleared the identification deadline
-      // and handed the transport over, so a handshake this node cannot take must CLOSE the
-      // connection — in 0.13.16 a throw here was swallowed by the frame parser and left the socket
-      // open with no deadline and no owner. A nodeId that is not one is not taken at all.
-      const id = wireNodeId(peerId);
-      const name = wireName(peerName);
-      if (!id || !this._guardInbound(id, name, handshakeMsg, 'lan', () => this._acceptInbound(transport, id, name, handshakeMsg))) {
-        try { transport.close(); } catch { /* already gone */ }
-      }
+    this._discovery.on('inbound-connection', (transport, firstFrame, remote) => {
+      // Discovery has already required the first frame to be client-hello (the Core Secure listener
+      // takes nothing else) and cleared its own deadline; the session's handshake timeout governs
+      // from here. Through the guard: a hello this node cannot take closes the connection.
+      const ok = this._guardInbound('?', 'inbound', firstFrame, 'lan', () => {
+        const session = this._attachTransport(transport, { role: 'server', kind: 'bonjour', remote });
+        session.receiveWire(firstFrame);
+      });
+      if (!ok) { try { transport.close(); } catch { /* already gone */ } }
     });
+    // A legacy `handshake` on the Core Secure listener is refused at once (discovery closed the
+    // socket); counted, and said at most once a minute per address.
+    this._discovery.on('legacy-hello-refused', (remote) => this._noteLegacyRefusal(remote));
 
     this._port = await this._discovery.start(this._identity, (msg) => this._log(msg));
 
     if (this._relayUrl) {
       this._relay.connect();
     }
+    this._legacy.start();
 
     this._heartbeatTimer = setInterval(() => this._checkHeartbeats(), this._heartbeatInterval);
     this._encodeTimer = setInterval(() => this._reencodeAndBroadcast(), this._encodeInterval);
@@ -1927,126 +1893,16 @@ class SymNode extends EventEmitter {
     this._log(`Started (port: ${this._port}, id: ${this._identity.nodeId.slice(0, 8)}${this._relayUrl ? ', relay: ' + this._relayUrl : ''})`);
   }
 
-  /**
-   * Take the handshake that opened an inbound LAN/loopback connection (see 'inbound-connection'
-   * in start(); always called through _guardInbound).
-   * @private
-   */
-  _acceptInbound(transport, peerId, peerName, handshakeMsg) {
-    // Only this node's own proving handshake may set `provenPublicKey`; a peer cannot claim it.
-    if (handshakeMsg && 'provenPublicKey' in handshakeMsg) delete handshakeMsg.provenPublicKey;
-    // Section 5.2 + 4.6 + dual-dial dedup. Three cases when an existing
-    // bonjour transport is registered for this peerId:
-    //
-    //   (a) Stale: the prior transport's _closed flag is set, but its
-    //       close handler hasn't run yet. Treat as no prior — accept the
-    //       new inbound (it will replace via _createPeer).
-    //
-    //   (b) Same-direction duplicate: prior is also inbound. Happens when
-    //       the OS fires newConnectionHandler twice for the same advertised
-    //       service (multipath / TCP retry). Keep the established prior,
-    //       reject duplicate — silently replacing it would tear down the
-    //       wire pair on the remote side and trigger peer-left storms.
-    //
-    //   (c) Dual-dial collision: prior is OUR outbound, new is the peer's
-    //       outbound arriving as our inbound. Both peers Bonjour-discovered
-    //       each other within ~50ms and dialed. Tie-break deterministically
-    //       by nodeId — the lower nodeId acts as client and keeps its
-    //       outbound; the higher its inbound. Both peers compute the same
-    //       physical-socket winner without exchanging coordination frames.
-    const existingPeer = this._peers.get(peerId);
-    if (existingPeer && existingPeer.transports.has('bonjour')) {
-      const prev = existingPeer.transports.get('bonjour');
-      // Stale-prior detection. Two stale signals — either is sufficient
-      // to treat the prior as dead and let the new connection replace it:
-      //   * `_closed` set: socket has explicitly been closed.
-      //   * `lastSeen` older than one heartbeat interval: socket may be
-      //     ESTABLISHED-but-half-open (peer process killed without FIN
-      //     reaching us). Loopback in particular can keep dead sockets in
-      //     ESTABLISHED state for ~2h before macOS keepalive reaps them,
-      //     blocking every redial against the zombie entry. The remote
-      //     re-dialling is itself strong evidence the prior is dead — it
-      //     wouldn't dial again if it had a healthy connection. Bound by
-      //     `_heartbeatInterval` (default 10s) — short enough that a
-      //     restarting peer reconnects within seconds, long enough that
-      //     a momentary lull during initial handshake doesn't trip it.
-      const staleByFlag = !prev || prev._closed;
-      // 1-second threshold (NOT _heartbeatInterval=10s). When a peer
-      // process is killed and quickly relaunches, its old run sent a
-      // CMB seconds before death, so lastSeen is still recent. A 10s
-      // threshold misses this and the dedup-reject path kills the
-      // legitimate redial. 1s tolerates sub-second TCP-retry races
-      // during initial handshake while letting normal peer-restart
-      // (≥1s gap between kill and re-dial) recover within the
-      // application layer.
-      const staleByLastSeen = existingPeer.lastSeen
-        && (Date.now() - existingPeer.lastSeen) > 1000;
-      const stalePrior = staleByFlag || staleByLastSeen;
-      if (!stalePrior) {
-        // Determine prior direction. The peer's `isOutbound` category reflects
-        // the direction at first transport creation; for a single-transport
-        // bonjour peer (the common case) this matches the live transport.
-        const prevIsOutbound = !!existingPeer.isOutbound;
-        const newIsOutbound = false; // by definition — this is inbound
-        const isDualDial = prevIsOutbound !== newIsOutbound;
-        if (!isDualDial) {
-          // (b) same-direction duplicate — keep prior
-          transport.close();
-          return;
-        }
-        // (c) dual-dial: lower nodeId is client, keeps outbound
-        const localIsClient = String(this._identity.nodeId) < String(peerId);
-        const keepOutbound = localIsClient;
-        const preferNew = (keepOutbound === newIsOutbound);
-        if (!preferNew) {
-          // we keep prior outbound, reject new inbound
-          transport.close();
-          return;
-        }
-        // preferNew = true: replace prior outbound with new inbound.
-        // Close prior so its close handler removes the bonjour entry from
-        // existingPeer.transports; _createPeer below will then add the new
-        // transport without the "same source already open" guard rejecting it.
-        prev.close();
-      } else if (prev && !prev._closed) {
-        // Stale by lastSeen but flag not yet set — close it explicitly so
-        // its close handler runs and removes the dict entry before we add
-        // the new transport.
-        prev.close();
-      }
-      // else: stale-by-flag prior — fall through to accept
-    }
-    if (handshakeMsg.e2ePublicKey) {
-      this._deriveAndStoreSecret(peerId, handshakeMsg.e2ePublicKey);
-    }
-    // Store the connector's Ed25519 identity key (this first handshake arrives
-    // via discovery, not the frame-handler) so we can verify its signed CMBs.
-    if (handshakeMsg.publicKey) {
-      this._pinPeerKey(peerId, handshakeMsg.publicKey);
-    }
-    // One gossip-budget lane per connection: the peer id is the one this connection claimed.
-    const lane = this._newLane('tcp');
-    transport.on('message', (m) => {
-      const peer = this._peers.get(peerId);
-      if (peer) peer.lastSeen = Date.now();
-      this._receiveFrame(peerId, peerName, m, 'lan', lane);
-    });
-    const admission = this._roomAdmission(peerId, handshakeMsg);
-    if (!admission.admit) {
-      this._log(`Refused ${peerName} into '${this._room}': ${admission.reason}`);
-      try { transport.close(); } catch { /* already gone */ }
-      return;
-    }
-    const peer = this._createPeer(transport, peerId, peerName, false, 'bonjour');
-    this._addPeer(peer);
-  }
-
   /**
    * Stop the node: close all peers, timers, relay, and discovery.
    * @returns {Promise<void>}
    */
   async stop() {
-    if (!this._running) return;
+    if (!this._running) {
+      // An interior a host opened on a node it never started still ends with it.
+      if (this._interior) this._interior.close();
+      return;
+    }
     this._running = false;
 
     if (this._heartbeatTimer) clearInterval(this._heartbeatTimer);
@@ -2063,11 +1919,18 @@ class SymNode extends EventEmitter {
     }
 
     this._relay.destroy();
+    this._legacy.stop();
+    if (this._interior) this._interior.close();
 
-    for (const [, peer] of this._peers) {
-      peer.transport.close();
+    // Every session, confirmed or not, ends with the node; a relay session tells its peer.
+    for (const session of [...this._sessions]) {
+      try { session.close('node-stopped'); } catch { /* shutting down */ }
     }
+    this._sessions.clear();
     this._peers.clear();
+    if (this._relaySessions) this._relaySessions.clear();
+    for (const t of (this._relayRetry || new Map()).values()) clearTimeout(t.timer);
+    if (this._relayRetry) this._relayRetry.clear();
 
     await this._discovery.stop();
     this._discovery.removeAllListeners();
@@ -2373,6 +2236,10 @@ class SymNode extends EventEmitter {
           method: 'SVAF-v2',
         };
       }
+      // A payload rides as the record's signed application section (§8.8.3): "an application action
+      // MUST NOT ride as an unsigned top-level payload". It is sealed with the record (§18.2.1) and the
+      // receiver gives it back as `cmb.payload`.
+      const application = (opts.payload !== undefined && opts.payload !== null) ? payloadApplication(opts.payload) : null;
       // Audience is part of the record now, so it is constructed rather than stapled on.
       opts.cmb = createCMB({
         categories,
@@ -2380,10 +2247,11 @@ class SymNode extends EventEmitter {
         lineage,
         room: this._room ?? null,
         to: opts.to ?? null,
-        // Reader-first gated (lib/emit-policy): populates the v2.0 preimage fields — and so signs
-        // under mmp-sig-v2.0 — only once MMP_EMIT_V2 is flipped on after reader deployment.
+        // The v2.0 preimage fields (lib/emit-policy: on since 0.14): signs under mmp-sig-v2.0, with the
+        // signed author node id.
         emitV2: MMP_EMIT_V2,
         createdByNodeId: MMP_EMIT_V2 ? this._identity.nodeId : undefined,
+        application: MMP_EMIT_V2 ? application : undefined,
       });
       // Two of this node's records never share a createdTimestamp: the timestamp is the one preimage
       // term that tells two assertions of the same words apart, so two sends in one millisecond
@@ -2411,6 +2279,7 @@ class SymNode extends EventEmitter {
       // the author's NAME into the address; that derivation is gone, and its absence is the
       // collapse property Rule A depends on.
       if (opts.payload !== undefined && opts.payload !== null) {
+        // The decoded payload beside the record, as before; the signed source is metadata.application.
         opts.cmb.payload = opts.payload;
       }
       // Authenticate the CMB with this node's Ed25519 identity key. Receivers
@@ -2867,32 +2736,49 @@ class SymNode extends EventEmitter {
    * @param {string} [opts.to] — target peer ID; broadcasts to all if omitted
    */
   send(message, opts = {}) {
-    const frame = {
-      type: 'message',
-      from: this._identity.nodeId,
-      fromName: this.name,
-      content: message,
-      timestamp: Date.now(),
-    };
-    if (opts.to) {
-      const peer = this._peers.get(opts.to);
-      if (peer) {
-        try { peer.transport.send(frame); return 1; } catch { return 0; }
-      }
-      return 0;
-    }
-    const delivered = this._broadcastToPeers(frame);
-    this._wakeManager.wakeSleepingPeers('message', frame);
+    // Core Secure retires the `message` frame (design D1): a message is a directed CMB (`to` = the
+    // recipient), signed and sealed like any record, and the receiver raises its local 'message'
+    // event (§14.9.1) from it. The text rides in the record's focus and, whole, in a signed
+    // application section that marks the record as a message. Sent, not stored.
+    const content = String(message ?? '');
+    const targets = opts.to ? [opts.to] : [...this._peers.keys()];
+    let delivered = 0;
+    for (const to of targets) {
+      let cmb;
+      try { cmb = this._mintMessage(content, to); } catch (err) { this._log(`Message to ${String(to).slice(0, 8)} not sent: ${err.message}`); continue; }
+      const peer = this._peers.get(to);
+      if (!peer) continue;
+      if (trySend(peer.transport, { type: 'cmb', timestamp: Date.now(), cmb }).ok) delivered++;
+    }
+    if (!opts.to) this._wakeManager.wakeSleepingPeers('message', { type: 'message', fromName: this.name, content, timestamp: Date.now() });
     // If no peers received the message, trigger an immediate reconnect
     // attempt for any cached bonjour peers. The next send will find
     // them connected instead of waiting for the 15s background timer.
-    if (delivered === 0) {
-      this._discovery.reconnect();
-    }
+    if (delivered === 0) this._discovery.reconnect();
     return delivered;
   }
 
-  // ── Error Frame (MMP Section 7.2) ─────────────────────────
+  /** @private A signed v2.0 directed record carrying a message to `to`. */
+  _mintMessage(content, to) {
+    const bytes = Buffer.from(content, 'utf8');
+    const application = {
+      mediaType: 'text/plain',
+      schema: MESSAGE_SCHEMA,
+      encoding: 'base64url',
+      byteLength: bytes.length,
+      digest: `sha256-${crypto.createHash('sha256').update(bytes).digest('hex')}`,
+      data: bytes.toString('base64url'),
+    };
+    const preview = content.length > 4096 ? `${content.slice(0, 4096)}…` : content;
+    const cmb = createCMB({ categories: { focus: preview || '(empty message)', intent: 'message' }, createdBy: this.name, room: this._room, to, emitV2: true, createdByNodeId: this.nodeId, application });
+    const clock = cmb.metadata.createdTimestamp;
+    const ts = Math.max(clock, this._timestampRatchetBase() + 1);
+    cmb.metadata.createdTimestamp = ts;
+    this._lastCreatedTimestamp = ts;
+    cmb.metadata.assertionId = assertionIdV2_0(cmb);
+    this._signOrThrow(cmb, 'Message signing failed');
+    return cmb;
+  }
 
   /**
    * Send an error frame to a peer. Per MMP Section 7.2, error frames are
@@ -2988,9 +2874,12 @@ class SymNode extends EventEmitter {
         lastSeen: peer.lastSeen,
         coupling: d ? d.decision : 'pending',
         drift: d && typeof d.drift === 'number' ? parseFloat(d.drift.toFixed(3)) : null,
-        source: peer.source || 'bonjour',
-        e2e: this._peerSharedSecrets.has(id),
-        clearRefused: !!(this._clearRefused && this._clearRefused.has(id)),
+        source: peer.transport ? peer.transport.kind : (peer.source || 'bonjour'),
+        // Every session is sealed (Core Secure); a Legacy Import session says so (design D7).
+        e2e: true,
+        profile: peer.transport && peer.transport.legacy ? 'legacy-import' : 'core-secure',
+        keySource: this._roster.source(id) || null,
+        sessions: [...peer.transports.values()].map((t) => ({ transport: t.kind, sessionId: t.sessionId || null, confirmedAt: t.confirmedAt || null, extensions: [...(t.selected || [])], legacy: !!t.legacy })),
       });
     }
     return result;
@@ -3034,6 +2923,15 @@ class SymNode extends EventEmitter {
       peerCount: this._peers.size,
       memoryCount: this.memories(),
       coherence: this.coherence(),
+      // Core Secure (design D1–D3): what the session layer did, and the key conflicts an operator
+      // has to resolve (`sym keys resolve <nodeId> <key>`).
+      coreSecure: {
+        sessions: { confirmed: [...this._sessions].filter((x) => x.confirmed).length, authenticating: [...this._sessions].filter((x) => !x.confirmed && !x.closed).length },
+        stats: JSON.parse(JSON.stringify(this._sessionStats)),
+        keyConflicts: this._roster.conflicts(),
+        keyBindings: this._roster.size(),
+      },
+      legacyImport: this._legacy ? this._legacy.status() : { routes: 0, sessions: [] },
     };
   }
 
@@ -3047,29 +2945,17 @@ class SymNode extends EventEmitter {
   }
 
   /**
-   * THE ONE INBOUND DISPATCH. Every frame a peer sends reaches the frame handler through here,
-   * whatever carried it: a LAN or loopback TCP transport (inbound or outbound) or the relay.
-   * A frame this node cannot handle — its handler, or a host's listener on the event it raises,
-   * throws — is REFUSED and COUNTED (metrics().framesRefused, by type), and said in the log at
-   * most once a minute per peer. It is never thrown out of the transport.
-   *
-   * Why one place. In 0.13.16 the LAN transports caught a handler's throw inside the frame
-   * parser and dropped it silently, while the relay called the handler bare, so the same frame
-   * that was quietly lost on LAN reached uncaughtException over the relay and the daemon
-   * exited: a peer's legacy `mood` frame did it on every node, a `message` frame on the daemon.
-   * Guarding each path separately is how one path was missed; there is now one path.
-   *
-   * A relay frame is also offered raw to hosted agents before evaluation ('frame-received',
-   * MMP §4.3.2), as before — inside the guard, since a host's listener can throw too. The
-   * handshake that opens an inbound LAN connection is taken through the same guard (see
-   * 'inbound-connection' in start()).
+   * THE ONE INBOUND DISPATCH (0.13.17). Every frame reaches the frame handler through here, now from
+   * the session that authenticated it (design D1): a LAN or loopback TCP session, inbound or
+   * outbound, or a relay session. A frame this node cannot handle — its handler, or a host's listener
+   * on the event it raises, throws — is REFUSED and COUNTED (metrics().framesRefused, by type), and
+   * said in the log at most once a minute per peer. It is never thrown out of the transport.
    * @returns {boolean} true if the frame was handled, false if it was refused
    * @private
    */
-  _receiveFrame(peerId, peerName, msg, via, lane) {
-    return this._guardInbound(peerId, peerName, msg, via, () => {
-      if (via === 'relay') this.emit('frame-received', { peerId, peerName, frame: msg });
-      this._frameHandler.handle(peerId, peerName, msg, lane);
+  _receiveSessionFrame(session, frame) {
+    return this._guardInbound(session.nodeId, session.name, frame, session.kind === 'relay' ? 'relay' : 'lan', () => {
+      this._frameHandler.handle(session, frame);
     });
   }
 
@@ -3113,480 +2999,595 @@ class SymNode extends EventEmitter {
     } catch { /* counting a refusal must never become the failure */ }
   }
 
-  _connectToPeer(address, port, peerId, peerName) {
-    // Connect timeout: 10s to establish the TCP connection. Cleared once
-    // connected so the socket doesn't die from idle — LAN connections
-    // should stay open indefinitely. The old code left the 10s timeout
-    // running after connect, which killed every connection that was
-    // idle for >10s (i.e., all of them between messages).
-    const socket = net.createConnection({ host: address, port }, () => {
-      socket.setTimeout(0); // clear connect timeout — connection is alive
-      this._pendingBonjour.delete(peerId);
-      const transport = new TcpTransport(socket);
-      const lane = this._newLane('tcp');   // one gossip-budget lane per connection
-      transport.on('message', (msg) => {
-        const peer = this._peers.get(peerId);
-        if (peer) peer.lastSeen = Date.now();
-        this._receiveFrame(peerId, peerName, msg, 'lan', lane);
-      });
-      transport.on('error', () => {});
-      const peer = this._createPeer(transport, peerId, peerName, true, 'bonjour');
-      if (!this._peers.has(peerId)) {
-        this._addPeer(peer);
-      }
-    });
-    socket.on('error', (err) => {
-      this._pendingBonjour.delete(peerId);
-      this._log(`Connect failed to ${peerName}: ${err.message}`);
+
+  // ── Sessions (design D1/D2) ────────────────────────────────
+
+  /**
+   * The facts of a confirmed session a host may read: what the §5.2 exchange proved. The shape the
+   * `verified-record` hook carries; frozen, primitives only.
+   */
+  _sessionFacts(session) {
+    if (!session) return null;
+    return Object.freeze({
+      nodeId: session.nodeId,
+      name: session.name,
+      identityKey: session.identityKey,
+      sessionId: session.sessionId,
+      transport: session.kind === 'relay' ? 'relay' : 'lan',
+      role: session.role,
+      room: session.room,
+      extensions: Object.freeze([...(session.selected || [])]),
+      confirmedAt: session.confirmedAt,
+      implementation: session.peerImplementation ? Object.freeze({ ...session.peerImplementation }) : null,
+      profile: session.legacy ? 'legacy-import' : 'core-secure',
     });
-    socket.setTimeout(10000, () => { this._pendingBonjour.delete(peerId); socket.destroy(); });
   }
 
-  // ── Peer Management ────────────────────────────────────────
+  // ── Interior (design D9.3) ─────────────────────────────────
 
   /**
-   * Create or update a peer with a transport. Per MMP Section 4.6, a peer
-   * MAY have multiple transports (LAN TCP + WAN relay). The peer is only
-   * removed when ALL transports are closed.
-   *
-   * Transport priority: bonjour (LAN) > relay (WAN).
-   * The highest-priority healthy transport is used for sending.
+   * This node's interior: the local submission path for its mind (lib/interior.js). The mind gets a
+   * per-mission capability (`startMind`), submits through `submit` or the interior socket (`listen`),
+   * and the node checks, signs and sends. One mind per node at a time.
+   * @returns {import('./interior').Interior}
    */
-  _createPeer(transport, peerId, peerName, isOutbound, source) {
-    const existingPeer = this._peers.get(peerId);
+  interior() {
+    if (!this._interior) {
+      const { Interior } = require('./interior');
+      this._interior = new Interior(this);
+    }
+    return this._interior;
+  }
 
-    if (existingPeer) {
-      // Section 4.6: add as secondary transport (different source — e.g. relay
-      // on top of bonjour). For the SAME source, three cases:
-      //
-      //   (a) stale prior — replace with new. Stale = either `_closed` flag
-      //       set OR `lastSeen` older than heartbeat interval (the second
-      //       catches dead-but-ESTABLISHED loopback sockets that the OS
-      //       hasn't yet reaped via keepalive — see inbound-connection
-      //       handler comment for the long-form rationale).
-      //   (b) same-direction duplicate (prior and new share isOutbound) —
-      //       keep prior alive, drop new
-      //   (c) dual-dial — opposite directions. Tie-break by nodeId: lower
-      //       nodeId acts as client and keeps outbound; higher keeps inbound
-      const existingTransport = existingPeer.transports.get(source);
-      const staleByFlag = !existingTransport || existingTransport._closed;
-      // Match the inbound-connection handler (v0.5.5): a 1s threshold catches
-      // peer process restarts (kill + quick re-dial) without rejecting
-      // genuine dual-dial collisions, which fire <100ms apart. The previous
-      // _heartbeatInterval (10s) caused dedup-decisions to diverge across
-      // SDKs — Node-side rejected as stale while sym-swift kept the prior,
-      // so the surviving connection on one side was already dead on the
-      // other and the peer flapped continuously.
-      const staleByLastSeen = existingPeer.lastSeen
-        && (Date.now() - existingPeer.lastSeen) > 1000;
-      const stalePrior = staleByFlag || staleByLastSeen;
-      if (existingTransport && !stalePrior) {
-        const prevIsOutbound = !!existingPeer.isOutbound;
-        const isDualDial = prevIsOutbound !== isOutbound;
-        if (!isDualDial) {
-          // (b) — keep prior, drop new
-          transport.close();
-          return existingPeer;
-        }
-        // (c) dual-dial tie-break
-        const localIsClient = String(this._identity.nodeId) < String(peerId);
-        const keepOutbound = localIsClient;
-        const preferNew = (keepOutbound === isOutbound);
-        if (!preferNew) {
-          transport.close();
-          return existingPeer;
-        }
-        // preferNew = true — replace prior. Close prior so its close handler
-        // removes the source entry, then fall through to set the new one.
-        existingTransport.close();
-        existingPeer.isOutbound = isOutbound;
-      } else if (existingTransport && stalePrior && !existingTransport._closed) {
-        // Stale prior detected by lastSeen-age. Close it explicitly so its
-        // close handler can't fire later and `transports.delete(source)` away
-        // the new transport we're about to register. (If the close handler
-        // races and runs after the .set() below, it would silently revert
-        // this peer to a transport-less state.)
-        existingTransport.close();
-        existingPeer.isOutbound = isOutbound;
+  // ── Invites (design D5) ────────────────────────────────────
+
+  /**
+   * An invite URL naming this node as issuer (`node`, `key`): an acceptor pins this node's key out of
+   * band. A team invite also carries the relay and its token, so the URL is a SECRET.
+   * @param {{ relay?: string, token?: string, room?: string, scheme?: string }} [opts]
+   * @returns {string}
+   */
+  inviteURL(opts = {}) {
+    const { buildInvite } = require('./invite');
+    return buildInvite({ room: opts.room || this._room, relay: opts.relay, token: opts.token, scheme: opts.scheme, issuer: { nodeId: this.nodeId, publicKey: this._identity.publicKey } });
+  }
+
+  /**
+   * Accept an invite: pin its issuer's key at `pinned` ONLY when that nodeId is unbound here. A
+   * nodeId already bound to the same key keeps its (stronger) binding; one bound to a different key
+   * is a conflict, recorded for the operator — an invite never repoints a key (design D3/D5).
+   * @param {string|object} invite - the URL, or what parseInvite returned
+   * @returns {{ pinned: boolean, reason?: string, issuer?: object, invite?: object }}
+   */
+  acceptInvite(invite) {
+    const { parseInvite } = require('./invite');
+    const parsed = typeof invite === 'string' ? parseInvite(invite) : invite;
+    if (!parsed || parsed.error) return { pinned: false, reason: (parsed && parsed.error) || 'not an invite' };
+    if (!parsed.issuer) return { pinned: false, reason: 'the invite names no issuer key', invite: parsed };
+    const { nodeId, publicKey } = parsed.issuer;
+    if (nodeId === this.nodeId) return { pinned: false, reason: 'the invite is this node\'s own', invite: parsed };
+    const before = this._roster.source(nodeId);
+    const b = this._roster.bind(nodeId, publicKey, 'pinned');
+    if (!b.bound) {
+      this._log(`Invite from ${nodeId.slice(0, 8)} not pinned: ${b.reason === 'conflict' ? `that nodeId is bound to another key (${before}); resolve with sym keys resolve` : b.reason}`);
+      return { pinned: false, reason: b.reason, issuer: parsed.issuer, invite: parsed };
+    }
+    return { pinned: before === undefined, reason: before === undefined ? undefined : `already bound (${b.source})`, issuer: parsed.issuer, invite: parsed };
+  }
+
+  /**
+   * Connect this node over a transport the host provides (an in-process pipe, a custom socket): the
+   * §5.2 handshake runs over it like any other, and the other end becomes a peer only once both
+   * proofs validate. The dialler is the `client`; the other end must attach as the `server`.
+   * @param {{ on: function, send?: function, trySend?: function, close: function }} transport - emits
+   *   'message' (frame objects) and 'close'
+   * @param {{ role: 'client'|'server', expectNodeId?: string }} opts
+   * @returns {{ sessionId: function(): (string|null), confirmed: function(): boolean, close: function }}
+   */
+  connectTransport(transport, { role, expectNodeId } = {}) {
+    if (role !== 'client' && role !== 'server') throw new Error('connectTransport: role must be client or server');
+    const session = this._attachTransport(transport, { role, kind: 'bonjour', expectNodeId: expectNodeId || null });
+    return Object.freeze({
+      sessionId: () => session.sessionId,
+      confirmed: () => session.confirmed,
+      close: () => session.close('closed-by-host'),
+    });
+  }
+
+  /**
+   * Open a session over a transport. The dialler is the client (it sends client-hello); the
+   * listener is the server. A TCP transport's frames are fed to the session here; a relay session's
+   * are routed to it by `from` (_relayEnvelope).
+   * @returns {PeerSession}
+   * @private
+   */
+  _attachTransport(transport, { role, kind = 'bonjour', expectNodeId = null, relayFrom = null, remote = null } = {}) {
+    const session = new PeerSession({
+      role, transport, kind, relayFrom, expectNodeId,
+      local: { nodeId: this.nodeId, name: this.name, publicKey: this._identity.publicKey, privateKey: this._identity.privateKey },
+      room: this._room, extensions: this._offeredExtensions, implementation: this._implementation,
+      timeoutMs: this._handshakeTimeoutMs,
+    });
+    session.remote = remote;
+    this._sessions.add(session);
+    if (kind !== 'relay' && transport && typeof transport.on === 'function') {
+      transport.on('message', (f) => session.receiveWire(f));
+      transport.on('close', () => session.close('transport-closed', { notify: false }));
+      transport.on('error', () => {});
+    }
+    session.on('confirmed', () => {
+      if (!this._guardInbound(session.nodeId, session.name, { type: 'session-confirmed' }, kind, () => this._onSessionConfirmed(session))) {
+        session.close('confirm-failed');
       }
-      existingPeer.transports.set(source, transport);
-      this._log(`Transport added for ${peerName}: ${source} (${existingPeer.transports.size} transports)`);
-
-      // Send handshake on the new transport. _addPeer is only called for
-      // brand-new peers; once a peer exists, additional/replacement
-      // transports route through this branch and would otherwise sit in
-      // the dict with no handshake ever sent on them. The next heartbeat
-      // tick fires `ping` on every transport, the remote sees `ping` as
-      // the first frame, and rejects the connection ("expected handshake,
-      // got ping" — a sym-swift-side disconnect on protocol violation).
-      // Idempotent: if the remote also sent a handshake from its side,
-      // it processes both fine.
-      try { transport.send(this._buildHandshake()); } catch {}
-
-      // Identity-aware close handler. A previously-closed transport for the
-      // same source has its own pending close handler that, if it fires after
-      // we replace the entry here, would `transports.delete(source)` away
-      // this fresh transport. Guard by checking the current entry IS this
-      // transport before mutating.
-      transport.on('close', () => {
-        if (existingPeer.transports.get(source) !== transport) return;
-        existingPeer.transports.delete(source);
-        this._log(`Transport closed for ${peerName}: ${source} (${existingPeer.transports.size} remaining)`);
-
-        // Update active transport to highest-priority remaining
-        existingPeer.transport = this._bestTransport(existingPeer);
-
-        // Section 5.5: peer-left only when ALL transports closed
-        if (existingPeer.transports.size === 0) {
-          this._peers.delete(peerId);
-          this._meshNode.removePeer(peerId);
-          this._metrics.peersLeft++;
-          this._log(`Peer disconnected: ${peerName} (all transports closed)`);
-          this.emit('peer-left', { id: peerId, name: peerName });
-          this.emit('metric', { type: 'peer-left', name: peerName });
-        }
-      });
+    });
+    session.on('frame', (frame) => this._onSessionFrame(session, frame));
+    session.on('refused', (type, reason) => this._noteSessionRefusal(session, type, reason));
+    session.on('closed', (info) => {
+      this._guardInbound(session.nodeId || '?', session.name || '?', { type: 'session-closed' }, kind, () => this._onSessionClosed(session, info));
+    });
+    if (role === 'client') session.start();
+    return session;
+  }
 
-      return existingPeer;
+  /**
+   * Both proofs validated. Before anything per-peer exists: the proven (nodeId, key) is checked
+   * against the key registry (design D3) — a bound nodeId presenting a different key is a conflict,
+   * refused and recorded — and the room door decides admission (design D6).
+   * @private
+   */
+  _onSessionConfirmed(session) {
+    this._sessionStats.confirmed++;
+    const expected = this._roster.expected(session.nodeId);
+    if (expected && expected !== session.identityKey) {
+      this._roster.bind(session.nodeId, session.identityKey, 'proven'); // records the conflict
+      this._log(`Refused ${session.name} (${session.nodeId.slice(0, 8)}): it proved a key that is not the one bound to its nodeId (${this._roster.source(session.nodeId)}) — a key conflict for the operator (sym keys resolve)`);
+      session.close('key-conflict');
+      return;
+    }
+    // A room-join grant this node holds goes first, so a gated peer can admit it.
+    if (this._roomGrant) session.send({ type: 'mesh-room-join', grant: this._roomGrant });
+    session.admission = { state: 'pending', since: Date.now() };
+    this._decideAdmission(session);
+  }
+
+  /** @private Run the room door for a confirmed session; admit, refuse, or wait for its grant. */
+  _decideAdmission(session) {
+    if (session.closed || session.admission?.state !== 'pending') return;
+    const v = this._roomAdmissionDecide(session);
+    if (v.pending) {
+      if (!session._admissionTimer) {
+        session._admissionTimer = setTimeout(() => {
+          if (session.admission?.state !== 'pending') return;
+          this._refuseAdmission(session, 'no room-join grant presented for a gated room');
+        }, this._handshakeTimeoutMs);
+        if (session._admissionTimer.unref) session._admissionTimer.unref();
+      }
+      return;
     }
+    if (session._admissionTimer) { clearTimeout(session._admissionTimer); session._admissionTimer = null; }
+    if (!v.admit) { this._refuseAdmission(session, v.reason); return; }
+    this._admitSession(session);
+  }
 
-    // New peer — first transport
-    const transports = new Map();
-    transports.set(source, transport);
+  _refuseAdmission(session, reason) {
+    session.admission = { state: 'refused', reason, at: Date.now() };
+    if (!this._roomVerdicts) this._roomVerdicts = new Map();
+    this._roomVerdicts.set(session.nodeId, { admit: false, reason, at: Date.now() });
+    this._log(`Refused ${session.name} into '${this._room}': ${reason}`);
+    session.close('admission-refused');
+  }
 
-    const peer = { transport, transports, peerId, name: peerName, isOutbound, source, lastSeen: Date.now() };
+  /**
+   * Admit a confirmed session: bind its key `proven`, join it to its peer (creating the peer on its
+   * first session), and greet it. A second confirmed session for the same (nodeId, key) on the same
+   * transport kind SUPERSEDES the first (a peer restart, 4004 included); one on another kind is a
+   * secondary path (§4.6).
+   * @private
+   */
+  _admitSession(session) {
+    const nodeId = session.nodeId;
+    const b = this._roster.bind(nodeId, session.identityKey, 'proven');
+    if (!b.bound && b.reason === 'conflict') { session.close('key-conflict'); return; }
+    if (!b.bound && b.reason === 'full') this._log(`Key registry full: ${nodeId.slice(0, 8)} is held for this session only`);
+    session.admission = { state: 'admitted', at: Date.now() };
+    if (!this._roomVerdicts) this._roomVerdicts = new Map();
+    this._roomVerdicts.set(nodeId, { admit: true, reason: null, at: Date.now() });
+    if (session.kind === 'relay') {
+      // The in-flight slots hold a handshake being made; a confirmed session leaves them, so the next
+      // hello (a peer restart, a re-handshake) can be made while this one keeps carrying frames.
+      const st = this._relayState(session.relayFrom);
+      st.confirmed.add(session);
+      if (st.client === session) st.client = null;
+      if (st.server === session) st.server = null;
+    }
+    let peer = this._peers.get(nodeId);
+    const isNew = !peer;
+    if (!peer) {
+      peer = { peerId: nodeId, name: session.name, identityKey: session.identityKey, transports: new Map(), transport: null, isOutbound: session.role === 'client', source: session.kind, lastSeen: Date.now(), joinedAt: Date.now() };
+      this._peers.set(nodeId, peer);
+    } else if (peer.identityKey !== session.identityKey) {
+      session.close('key-conflict');
+      return;
+    }
+    // The sticky floor arms now (a proven binding): a Legacy Import session for this nodeId ends.
+    for (const t of [...peer.transports.values()]) if (t.legacy && !t.closed) t.close('floor');
+    const prev = peer.transports.get(session.kind);
+    peer.transports.set(session.kind, session);
+    peer.transport = this._bestTransport(peer);
+    peer.name = session.name;
+    peer.lastSeen = Date.now();
+    if (prev && prev !== session && !prev.closed) {
+      this._sessionStats.superseded++;
+      prev._superseded = true;
+      prev.close('superseded');
+    }
+    if (session.kind === 'bonjour') this._pendingBonjour?.delete(nodeId);
+    if (session.kind === 'relay') this._relayRetry?.delete(nodeId);
+    this._greetSession(peer, session, isNew);
+    if (isNew) {
+      this._log(`Peer connected: ${peer.name} (${session.role === 'client' ? 'outbound' : 'inbound'}, ${session.kind}, Core Secure session ${session.sessionId.slice(0, 8)})`);
+      this._metrics.peersJoined++;
+      this.emit('peer-joined', { id: nodeId, name: peer.name, source: session.kind });
+      this.emit('metric', { type: 'peer-joined', name: peer.name, source: session.kind });
+    } else {
+      this._log(`Session ${prev ? 'replaced' : 'added'} for ${peer.name}: ${session.kind} (${peer.transports.size} transport(s))`);
+    }
+  }
 
-    transport.on('close', () => {
-      // Identity-aware: only delete if this transport is still the registered
-      // one. A later replacement (dual-dial / stale-prior swap) may have set
-      // a different transport at this source key; a stale close here must
-      // not clobber it. (Same guard as the existingPeer branch above.)
-      if (transports.get(source) !== transport) return;
-      transports.delete(source);
-      this._log(`Transport closed for ${peerName}: ${source} (${transports.size} remaining)`);
+  /**
+   * What a freshly admitted session is sent: this node's recent own records (the "Ask the Mesh"
+   * context, debounced per peer), its own wake channel, and frames queued while the peer slept.
+   * Everything goes sealed. Anchors are announced first in a sealed `cmb-anchors` frame, so the
+   * receiver knows which records are replayed context (a flag the record frame cannot carry).
+   * @private
+   */
+  _greetSession(peer, session, isNew) {
+    if (!this._lastAnchorSent) this._lastAnchorSent = new Map();
+    const lastSent = this._lastAnchorSent.get(peer.peerId) || 0;
+    const now = Date.now();
+    if (now - lastSent >= 60000) {
+      this._lastAnchorSent.set(peer.peerId, now);
+      // Own emissions only (anti-echo, §15.7), and only records that can travel in Core Secure.
+      const anchors = this._store.recent(50)
+        .filter((a) => a.cmb && a.peerId == null && a.cmb.metadata && a.cmb.metadata.signatureSuite === 'mmp-sig-v2.0' && a.cmb.metadata.sig)
+        .slice(0, 5);
+      if (anchors.length > 0) {
+        session.send({ type: 'cmb-anchors', keys: anchors.map((a) => a.cmb.metadata.key) });
+        let sent = 0;
+        for (const a of anchors) if (session.send({ type: 'cmb', cmb: a.cmb })) sent++;
+        this._log(`Sent ${sent} anchor CMB(s) to ${peer.name}`);
+      }
+    } else if (isNew) {
+      this._log(`Skipping anchor CMBs for ${peer.name} (reconnected within 60s)`);
+    }
+    // This node's own wake channel. (peer-info about OTHER nodes is not sent: a receiver learns a
+    // wake channel only from its node's own session, so gossip about others would be dropped.)
+    if (this._wakeChannel) session.send({ type: 'wake-channel', ...this._wakeChannel });
+    const pending = this._pendingFrames.get(peer.peerId);
+    if (pending && pending.length > 0) {
+      this._log(`Delivering ${pending.length} pending frame(s) to ${peer.name}`);
+      for (const frame of pending) session.send(frame);
+      this._pendingFrames.delete(peer.peerId);
+    }
+  }
 
+  /** @private A frame from a session: the door first (design D6), then the one guarded dispatch. */
+  _onSessionFrame(session, frame) {
+    const state = session.admission && session.admission.state;
+    if (state !== 'admitted') {
+      if (state === 'pending' && frame && frame.type === 'mesh-room-join') {
+        session.roomGrant = frame.grant;
+        this._decideAdmission(session);
+        return;
+      }
+      this._noteSessionRefusal(session, frame && frame.type, 'not-admitted');
+      return;
+    }
+    if (frame && frame.type === 'mesh-room-join') return; // admitted already: nothing to decide
+    const peer = this._peers.get(session.nodeId);
+    if (peer) peer.lastSeen = Date.now();
+    this._receiveSessionFrame(session, frame);
+  }
+
+  /** @private A session ended: detach it, and the peer when it was the peer's last. */
+  _onSessionClosed(session, info) {
+    this._sessions.delete(session);
+    if (session._admissionTimer) { clearTimeout(session._admissionTimer); session._admissionTimer = null; }
+    const reason = info && info.reason;
+    if (info && info.desync) this._sessionStats.desync++;
+    if (!(info && info.wasConfirmed)) {
+      this._sessionStats.failed++;
+      const by = this._sessionStats.failedByReason;
+      by[reason] = (by[reason] || 0) + 1;
+      if (reason !== 'node-stopped' && reason !== 'transport-closed') {
+        this._sayOncePerMinute(`hs|${reason}|${session.remote || session.relayFrom || ''}`, `Handshake ${session.kind === 'relay' ? `with relay peer ${String(session.relayFrom).slice(0, 8)}` : `on ${session.role === 'client' ? 'an outbound' : 'an inbound'} LAN connection`} failed: ${reason}${info.detail ? ` (${String(info.detail).slice(0, 160)})` : ''}`);
+      }
+    }
+    if (session.kind === 'bonjour' && session.expectNodeId) this._pendingBonjour?.delete(session.expectNodeId);
+    if (session.kind === 'relay') {
+      const st = this._relaySessions && this._relaySessions.get(session.relayFrom);
+      if (st) {
+        st.confirmed.delete(session);
+        if (st.client === session) st.client = null;
+        if (st.server === session) st.server = null;
+      }
+    }
+    const peer = session.nodeId ? this._peers.get(session.nodeId) : null;
+    if (peer && peer.transports.get(session.kind) === session) {
+      peer.transports.delete(session.kind);
       peer.transport = this._bestTransport(peer);
-
-      if (transports.size === 0) {
-        this._peers.delete(peerId);
-        this._meshNode.removePeer(peerId);
+      if (peer.transports.size === 0) {
+        this._peers.delete(session.nodeId);
+        this._meshNode.removePeer(session.nodeId);
         this._metrics.peersLeft++;
-        this._log(`Peer disconnected: ${peerName} (all transports closed)`);
-        this.emit('peer-left', { id: peerId, name: peerName });
-        this.emit('metric', { type: 'peer-left', name: peerName });
+        this._log(`Peer disconnected: ${peer.name} (all sessions closed; last: ${reason})`);
+        this.emit('peer-left', { id: session.nodeId, name: peer.name });
+        this.emit('metric', { type: 'peer-left', name: peer.name });
+      } else {
+        this._log(`Session closed for ${peer.name}: ${session.kind} (${reason}; ${peer.transports.size} remaining)`);
       }
+    }
+    // A relay client re-handshakes while the peer is present (frame loss, a desync, a timeout, the
+    // server's error frame); a superseded or deliberately closed session does not.
+    if (session.kind === 'relay' && session.role === 'client' && this._running && !session._superseded
+        && reason !== 'node-stopped' && reason !== 'relay-peer-left' && reason !== 'relay-disconnected' && reason !== 'key-conflict' && reason !== 'admission-refused'
+        && this._relay.present.has(session.relayFrom)) {
+      this._scheduleRelayRetry(session.relayFrom);
+    }
+  }
+
+  /** @private Count and (once a minute per reason) say a frame a session did not take. */
+  _noteSessionRefusal(session, type, reason) {
+    this._sessionStats.refusedFrames++;
+    const by = this._sessionStats.refusedByReason;
+    const k = `${reason}`;
+    by[k] = (by[k] || 0) + 1;
+    this.emit('metric', { type: 'session-frame-refused', frameType: type, reason, from: session && session.nodeId });
+    this._sayOncePerMinute(`sr|${session && (session.nodeId || session.relayFrom || session.remote)}|${reason}`, `Refused a '${String(type).slice(0, 40)}' frame from ${session && (session.name || session.relayFrom || 'an unconfirmed session')}: ${reason}`);
+  }
+
+  /** @private One log line per key a minute, with how many more since. */
+  _sayOncePerMinute(key, line) {
+    if (!this._saidOnce) this._saidOnce = new Map();
+    const now = Date.now();
+    const said = this._saidOnce.get(key);
+    if (said && now - said.at < 60_000) { said.more++; return; }
+    if (this._saidOnce.size >= 1024) this._saidOnce.delete(this._saidOnce.keys().next().value);
+    this._saidOnce.set(key, { at: now, more: 0 });
+    try { this._log(`${line}${said && said.more ? ` (${said.more} more since)` : ''}`); } catch { /* a log sink must not fail a frame */ }
+  }
+
+  /** @private A legacy hello on the Core Secure listener (design D2): refused, counted, said once a minute per address. */
+  _noteLegacyRefusal(remote) {
+    this._sessionStats.legacyHellosRefused++;
+    this.emit('metric', { type: 'legacy-hello-refused', remote: remote || null });
+    this._sayOncePerMinute(`legacy|${remote || ''}`, `Refused a legacy handshake from ${remote || 'a LAN peer'}: this node speaks Core Secure only (a 0.13 peer is reached by a Legacy Import route, never by its hello)`);
+  }
+
+  _connectToPeer(address, port, peerId, peerName) {
+    // Connect timeout: 10s to establish the TCP connection, cleared once connected so the socket
+    // doesn't die from idle. The session's own 10 s handshake deadline takes over from there.
+    const socket = net.createConnection({ host: address, port }, () => {
+      socket.setTimeout(0);
+      const transport = new TcpTransport(socket);
+      this._attachTransport(transport, { role: 'client', kind: 'bonjour', expectNodeId: peerId, remote: `${address}:${port}` });
     });
+    socket.on('error', (err) => {
+      this._pendingBonjour.delete(peerId);
+      this._sayOncePerMinute(`dial|${peerId}`, `Connect failed to ${peerName}: ${err.message}`);
+    });
+    socket.setTimeout(10000, () => { this._pendingBonjour.delete(peerId); socket.destroy(); });
+  }
+
+  // ── Relay sessions (design D2) ─────────────────────────────
 
-    return peer;
+  /** @private The sessions bound to one relay `from`. */
+  _relayState(nodeId) {
+    if (!this._relaySessions) this._relaySessions = new Map();
+    let st = this._relaySessions.get(nodeId);
+    if (!st) { st = { client: null, server: null, confirmed: new Set() }; this._relaySessions.set(nodeId, st); }
+    return st;
   }
 
   /**
-   * Select the highest-priority healthy transport for a peer.
-   * Priority: bonjour (LAN) > relay (WAN).
-   * Per MMP Section 4.6.
+   * The relay names a peer present (relay-peers, relay-peer-joined). A candidate: the node with the
+   * smaller nodeId sends client-hello to it; the other waits for one. A confirmed session already
+   * held stays until a new one confirms (supersession covers a peer restart under 4004).
+   * @private
    */
-  _bestTransport(peer) {
-    const priority = ['bonjour', 'relay'];
-    for (const src of priority) {
-      const t = peer.transports.get(src);
-      if (t) return t;
-    }
-    // Fallback: any remaining transport
-    for (const t of peer.transports.values()) return t;
-    return null;
+  _relayPeerPresent(nodeId) {
+    if (!wireNodeId(nodeId) || nodeId === this.nodeId) return;
+    if (this._legacy && this._legacy.size) this._legacy.relayPresent(nodeId);
+    if (!(this.nodeId < nodeId)) return;
+    this._startRelayClient(nodeId);
   }
 
-  /// Builds a handshake frame addressed to the given peer. Per MMP §5.2 +
-  /// §5.8 optional `room` category. Extracted into a helper so the dedup
-  /// replace paths in `_createPeer` can also send a handshake on the new
-  /// transport — without it, a replacement transport sits in the dict with
-  /// no handshake ever sent, and the next heartbeat-tick `ping` becomes the
-  /// first frame the remote sees, tripping its "first frame must be
-  /// handshake" check.
-  _buildHandshake() {
-    return {
-      type: 'handshake',
-      nodeId: this._identity.nodeId,
-      name: this.name,
-      version: '0.2.3',
-      extensions: [],
-      room: this._room,
-      roomGrant: this._roomGrant || undefined,
-      publicKey: this._identity.publicKey,
-      e2ePublicKey: this._e2eKeyPair.publicKey.toString('base64'),
-      lifecycleRole: this._lifecycleRole,
-    };
+  /** @private Send a client-hello to `nodeId` over the relay (one handshake in flight at a time). */
+  _startRelayClient(nodeId) {
+    if (!this._running) return;
+    const st = this._relayState(nodeId);
+    if (st.client && !st.client.closed) return;
+    st.client = this._attachTransport(this._relay.transportFor(nodeId), { role: 'client', kind: 'relay', relayFrom: nodeId, expectNodeId: nodeId });
+  }
+
+  /** @private Re-handshake with a present relay peer, backing off 1 s, 2 s, … 30 s. */
+  _scheduleRelayRetry(nodeId) {
+    if (!this._relayRetry) this._relayRetry = new Map();
+    const r = this._relayRetry.get(nodeId) || { attempt: 0, timer: null };
+    if (r.timer) return;
+    const delay = Math.min(1000 * 2 ** r.attempt, 30_000);
+    r.attempt++;
+    r.timer = setTimeout(() => {
+      r.timer = null;
+      if (this._running && this._relay.present.has(nodeId)) this._startRelayClient(nodeId);
+    }, delay);
+    if (r.timer.unref) r.timer.unref();
+    this._relayRetry.set(nodeId, r);
+  }
+
+  /** @private The relay says a peer left: every session bound to that `from` ends (design D2). */
+  _relayPeerGone(nodeId) {
+    if (this._legacy) this._legacy.relayGone(nodeId);
+    const st = this._relaySessions && this._relaySessions.get(nodeId);
+    const r = this._relayRetry && this._relayRetry.get(nodeId);
+    if (r && r.timer) clearTimeout(r.timer);
+    if (this._relayRetry) this._relayRetry.delete(nodeId);
+    if (!st) return;
+    for (const s of [st.client, st.server, ...st.confirmed]) if (s && !s.closed) s.close('relay-peer-left', { notify: false });
+    this._relaySessions.delete(nodeId);
+  }
+
+  /** @private The relay connection closed: every relay session ends with it. */
+  _relayDisconnected() {
+    if (!this._relaySessions) return;
+    for (const [nodeId] of [...this._relaySessions]) {
+      const st = this._relaySessions.get(nodeId);
+      for (const s of [st.client, st.server, ...st.confirmed]) if (s && !s.closed) s.close('relay-disconnected', { notify: false });
+    }
+    this._relaySessions.clear();
+    if (this._relayRetry) { for (const r of this._relayRetry.values()) if (r.timer) clearTimeout(r.timer); this._relayRetry.clear(); }
+  }
+
+  /**
+   * An envelope from relay `from`. The relay's `from` is unproven (§4.4.1), so it only selects the
+   * session the payload is offered to; the session authenticates it. A hello opens a new candidate
+   * session (an unconfirmed hello never tears down a confirmed one); a sealed frame goes to the
+   * confirmed session whose sessionId it carries; anything else is a Legacy Import route's or refused.
+   * @private
+   */
+  _relayEnvelope(from, fromName, payload) {
+    if (from === this.nodeId) return;
+    const st = this._relaySessions && this._relaySessions.get(from);
+    const refuse = (reason) => this._noteSessionRefusal({ relayFrom: from, name: fromName }, payload.type, reason);
+    switch (payload.type) {
+      case 'client-hello': {
+        // The smaller nodeId is the client (design D2): a hello from a larger one is not taken.
+        if (!(from < this.nodeId)) { refuse('client-hello-from-larger-id'); return; }
+        const s = this._relayState(from);
+        if (s.server && !s.server.closed && !s.server.confirmed) s.server.close('superseded-hello', { notify: false });
+        s.server = this._attachTransport(this._relay.transportFor(from), { role: 'server', kind: 'relay', relayFrom: from, expectNodeId: from });
+        s.server.receiveWire(payload);
+        return;
+      }
+      case 'server-hello':
+        if (st && st.client && !st.client.closed && !st.client.confirmed) st.client.receiveWire(payload);
+        else refuse('no-handshake-in-flight');
+        return;
+      case 'client-finish':
+        if (st && st.server && !st.server.closed && !st.server.confirmed) st.server.receiveWire(payload);
+        else refuse('no-handshake-in-flight');
+        return;
+      case 'cmb-encrypted':
+      case 'control-encrypted': {
+        const s = st && [...st.confirmed].find((x) => x.sessionId === payload.sessionId && !x.closed);
+        if (s) s.receiveWire(payload);
+        else refuse('other-session');
+        return;
+      }
+      case 'ping':
+      case 'pong': {
+        const peer = this._peers.get(from);
+        const s = peer && peer.transports.get('relay');
+        if (s && s.relayFrom === from) s.receiveWire(payload);
+        return;
+      }
+      case 'error': {
+        if (!st) return;
+        const m = typeof payload.detail === 'string' && /^session:([0-9a-f]{32})$/.exec(payload.detail);
+        for (const s of [st.client, st.server, ...st.confirmed]) {
+          if (!s || s.closed) continue;
+          if (m && s.sessionId && s.sessionId !== m[1]) continue;
+          s.close('peer-closed', { notify: false });
+        }
+        return;
+      }
+      default:
+        if (this._legacy && this._legacy.relayFrame(from, fromName, payload)) return;
+        refuse(payload.type === 'handshake' ? 'legacy-hello' : 'not-core-secure');
+    }
   }
 
   /**
-   * MAY THIS PEER BE IN THIS ROOM? The single admission decision, called from both
-   * directions — the inbound handshake we receive before admitting, and the handshake an
-   * outbound-dialled peer sends back after we connect.
-   *
-   * BEFORE THIS, NOTHING COMPARED THE ROOM AT ALL. The handshake has always carried
-   * `room` and bound it into the signed transcript, but no receiver ever looked: a peer
-   * announcing any room joined the peer set, and LAN isolation was a property of the
-   * mDNS browse filter rather than of any check. That is why a crew could meet another
-   * tenant's commissions in a room neither had chosen to share.
-   *
-   * FAIL-CLOSED ONLY WHERE SOMEONE ASKED FOR IT. A room with no owner is OPEN and this
-   * returns admit for exactly the traffic it always admitted, so upgrade day changes
-   * nothing anywhere. Ownership is opt-in, and the point of an owner is not to shrink the
-   * room: a mesh whose advantage depends on genuinely distinct nodes needs foreign peers
-   * to be welcome, and a grant is what lets an owner say yes to one on purpose.
-   *
-   * Direction-agnostic by construction: the loopback tie-break means the stranger dials
-   * US in half of all nodeId orderings, so a check on only the path we initiate is dead
-   * code for those pairs.
-   *
-   * @returns {{ admit: boolean, reason?: string }}
+   * Select the highest-priority live session for a peer: LAN over relay (§4.6).
+   * @private
    */
+  _bestTransport(peer) {
+    for (const src of ['bonjour', 'relay']) {
+      const t = peer.transports.get(src);
+      if (t && !t.closed) return t;
+    }
+    for (const t of peer.transports.values()) if (!t.closed) return t;
+    return null;
+  }
+
   /**
    * IS THIS NODE'S ROOM GATED, AND BY WHOM — a public answer, because callers were guessing.
    *
-   * The xmesh roster endpoint reported `gated: false` as a constant. That is true of every
-   * room today and will be a lie the moment one is gated, and the lie is the dangerous
-   * direction: a reader who sees `gated: false` beside an empty grant list concludes nobody
-   * was admitted, when the truth is that nothing was required. A caller cannot reach
-   * `_roomOwners` without touching a private, so it had nothing to ask.
-   *
-   * The owner's PUBLIC key is included deliberately and its private half is not reachable
-   * from here at all: verifying a grant needs the public key, and minting one is the owner's
-   * own act on the owner's own machine.
-   *
+   * A gated room admits its owner (recognised by its pinned key) and grant-holders (a grant whose
+   * bound key equals the key the session PROVED). Before 0.14 no handshake proved a key, so a gated
+   * room admitted nobody; Core Secure sessions prove it, so this now reports `grant-holders`.
    * @returns {{room: string, gated: boolean, owner: {nodeId: string, publicKey: string, source: string}|null}}
    */
   roomGate() {
     const owner = this._roomOwners && this._roomOwners.ownerOf(this._room);
     if (!owner) return { room: this._room, gated: false, owner: null, admits: 'anyone', why: null };
-
-    // REPORT WHAT THE GATE CAN ENFORCE, NOT ONLY THAT ONE IS PINNED. The first version of this
-    // method returned `gated: true` and stopped, which is true of the PIN and misleading about the
-    // ROOM: verifyRoomGrant refuses for want of a proven key BEFORE it compares keys, and nothing
-    // in this runtime sets `provenPublicKey`, so a gated room admits nobody at all — a legitimate
-    // grant-holder is refused for the same reason as a thief. A caller reading `gated: true` would
-    // conclude the room admits the invited, and it admits no one.
-    //
-    // ASKED OF OUR OWN HANDSHAKE rather than hard-coded, so that wiring the proving flow
-    // (lib/core/handshake-v2.js, complete and tested) flips this answer without anyone remembering
-    // to edit it. What we send is what a peer on this version sends.
-    let proves = false;
-    try { proves = !!(this._buildHandshake() || {}).provenPublicKey; } catch { proves = false; }
-
     return {
       room: this._room,
       gated: true,
       owner: { nodeId: owner.nodeId, publicKey: owner.publicKey, source: owner.source || 'unknown' },
-      admits: proves ? 'grant-holders' : 'nobody',
-      why: proves ? null
-        : 'this runtime cannot prove a peer key at handshake, and a gated room refuses for want of proof before comparing keys — so it currently refuses every peer, holder or not',
+      admits: 'grant-holders',
+      why: null,
     };
   }
 
   /**
-   * Whether the session speaking for `peerId` proved it holds the key bound to that id. No handshake
-   * in this runtime proves a key (the proving flow, lib/core/handshake-v2.js, is not wired; see
-   * _roomAdmissionDecide), so this is false for every peer until it is, and a peer's own frames are
-   * trusted no further than an unproven claim. The one place to change when proving lands.
+   * Whether the session speaking for `peerId` proved the key bound to it. Every admitted session
+   * did (Core Secure): a peer is the set of sessions that proved one (nodeId, key).
    * @returns {boolean}
    */
-  _peerKeyProven(peerId) { // eslint-disable-line no-unused-vars
-    return false;
-  }
-
-  _roomAdmission(peerId, handshakeMsg) {
-    // Called through the prototype, not through `this`: both this suite and the stage-2 suite
-    // exercise the decision against a minimal receiver object rather than a live SymNode, and
-    // a plain `this._roomAdmissionDecide(...)` would have made the refactor invisible to them.
-    const verdict = SymNode.prototype._roomAdmissionDecide.call(this, peerId, handshakeMsg);
-    // REMEMBER THE VERDICT. The decision was reachable only at handshake time, so every frame
-    // that arrived without one was dispatched on trust. Recording it here gives `_roomDoor`
-    // something to consult per frame, which is what makes the door more than a greeting.
-    if (!this._roomVerdicts) this._roomVerdicts = new Map();
-    this._roomVerdicts.set(peerId, { admit: verdict.admit, reason: verdict.reason || null, at: Date.now() });
-    return verdict;
+  _peerKeyProven(peerId) {
+    const peer = this._peers.get(peerId);
+    return !!(peer && peer.transport && peer.transport.confirmed && !peer.transport.legacy);
   }
 
   /**
-   * THE DOOR, CONSULTED PER FRAME rather than once per greeting.
-   *
-   * dev3 traced this on the xmesh simulation: its bad node pushes a word straight onto the
-   * delivery queue with no join, and the word reached SVAF. The same shape is reachable here
-   * for a different reason — on the dialling side `_connectToPeer` attaches the frame listener
-   * and adds the peer before any handshake exists, so a peer that speaks first is judged by
-   * SVAF without ever having been admitted; on the accepting side a refusal closes the
-   * transport, but the listener was attached one statement earlier and frames already in hand
-   * still land.
-   *
-   * WHAT THIS REFUSES, AND WHAT IT DELIBERATELY DOES NOT. A recorded refusal shuts the peer up
-   * on every category, which is the whole point of having refused it. A peer with NO verdict is
-   * refused only where the room is gated: there, a word from a node that never presented a grant
-   * is exactly the thing the gate exists to stop. In an UNGATED room it is admitted, because an
-   * ungated room admits by declaration (MMP §5.8) and there is nothing for the absent handshake
-   * to have failed. Tightening that case would silently cut off the populations already counted
-   * on the `no room claimed` line, so it is counted here instead and left to whoever reads it.
-   *
+   * THE DOOR, CONSULTED PER FRAME (§5.8.1). A frame reaches the handler only from a session the
+   * door admitted (_onSessionFrame); this answers for a peer by its admitted sessions.
    * @returns {{pass: boolean, reason?: string}}
    * @private
    */
   _roomDoor(peerId) {
     const v = this._roomVerdicts && this._roomVerdicts.get(peerId);
     if (v && !v.admit) return { pass: false, reason: v.reason || 'refused at admission' };
+    if (this._peers.has(peerId)) return { pass: true };
     if (v) return { pass: true };
     const owner = this._roomOwners && this._roomOwners.ownerOf(this._room);
     if (owner) return { pass: false, reason: `spoke into gated room '${this._room}' without joining it` };
-    this._doorUngatedPassCount = (this._doorUngatedPassCount || 0) + 1;
     return { pass: true };
   }
 
-  _roomAdmissionDecide(peerId, handshakeMsg) {
-    // ABSENT IS NOT 'default'. A handshake with no `room` means the peer does not
-    // speak room comparison — a VERSION difference — not a claim to be in the public
-    // square. Collapsing the two with `|| 'default'` turns silence into a positive
-    // claim, which then reads as a mismatch against any named room. §5.8 requires a
-    // receiver to close on MISMATCH; a peer that made no claim has not mismatched.
-    //
-    // Not hypothetical: sym-swift's SymFrame.handshake takes no room parameter and
-    // sets no room key, so EVERY shipped MeloTune and MeloMove device sends a
-    // handshake without one. Under the collapse, a node in any named room closed the
-    // transport on the whole iOS fleet — not a tightening of isolation but a hard
-    // partition, silent on both sides. The handshake carried no room at all through
-    // 0.11.0; the field arrived in 0.11.1, so every JS node at 0.11.0 or older is in
-    // the absent set too. (What 0.11.1 renamed from `group` was emit.js's field on the
-    // CMB RECORD — a different object from this frame. Both halves of the earlier note
-    // here were wrong, and it is corrected rather than quietly dropped.)
-    //
-    // On the relay path, narrower than it looks: a relay token is the security
-    // boundary and fixes the CHANNEL from server-held state, while the room is a
-    // client-declared PARTITION inside it that the relay honours — delivery, roster and
-    // departures are scoped by it, and an undeclared room is its own unnamed partition
-    // rather than the global mesh. sym-swift already sends `room` in relay-auth even
-    // though its handshake carries none, so devices are partitioned correctly there.
-    // The residual is a design position, not a defect: inside a channel a peer already
-    // holds a token for, the room is addressing and not a security boundary.
-    //
-    // The admission is logged so the population is countable, and this tightens the day
-    // sym-swift sends a room in the handshake.
-    const claimed = handshakeMsg && handshakeMsg.room;
-    if (!claimed) {
-      // State the OBSERVATION, not the inference. "predates room comparison" was
-      // true while the absent set was pre-0.11.1 nodes and the iOS fleet, and
-      // 0.13.1 added a second population to this same line: an emit() caller that
-      // named no room predates nothing — it is current code exercising a
-      // documented default, and that is a caller-side choice which may be fine
-      // forever. The two need opposite responses (wait out and upgrade, versus
-      // leave alone), and this line exists to be COUNTED before tightening the
-      // rule. A count that mixes them can never reach zero, so it would either
-      // hold the tightening forever or get overridden on a hunch. Absence is
-      // byte-identical on the wire, so the cause is not observable here at all —
-      // report what was seen and leave the why to whoever reads the count.
-      this._log(`Admitting ${peerId} into '${this._room}': no room claimed`);
-      return { admit: true };
-    }
-    if (claimed !== this._room) return { admit: false, reason: `room-mismatch (claims '${claimed}', this node is in '${this._room}')` };
-
+  /**
+   * MAY THIS SESSION BE IN THIS ROOM (design D6)? The room is explicit and inside the transcript, so
+   * a session that confirmed is in this node's room (a mismatch closed it before confirmation). An
+   * ungated room admits it. A gated room admits its owner when the session proved the owner's
+   * pinned key, and a grantee when its room-join grant's bound key equals the session's PROVEN key;
+   * a session that has presented no grant yet is pending (it has one handshake timeout to send one).
+   * @returns {{ admit?: boolean, pending?: boolean, reason?: string }}
+   */
+  _roomAdmissionDecide(session) {
     const owner = this._roomOwners.ownerOf(this._room);
-    if (!owner) return { admit: true };                       // ungated — unchanged
-
-    const granteeId = (handshakeMsg && handshakeMsg.nodeId) || peerId;
-    // Set only by a handshake that PROVED possession of the key. Nothing sets it yet.
-    const peerProvenKey = (handshakeMsg && handshakeMsg.provenPublicKey) || null;
-    // The owner needs no grant to be in the room it owns — without this the owner locks
-    // itself out of its own room the moment it gates it.
-    if (granteeId === owner.nodeId) return { admit: true };
-
-    const grant = handshakeMsg && handshakeMsg.roomGrant;
-    if (!grant) return { admit: false, reason: 'no room-join grant presented for a gated room' };
-    // NO PROVEN KEY IS PASSED, DELIBERATELY. `_buildHandshake` ASSERTS nodeId and publicKey; it
-    // proves neither, and the proving flow (lib/core/handshake-v2.js) is not reachable from this
-    // path. Passing the asserted key here would be theatre: the key an impostor must assert is
-    // printed inside the grant it is holding. So the verifier refuses for want of proof, and a
-    // gated room stays shut until the proving handshake lands. Nothing gates a room today, so
-    // this closes a hole rather than breaking a user.
-    const v = verifyRoomGrant(grant, owner.publicKey, { room: this._room, grantee: granteeId, provenKey: peerProvenKey || null, ownerNodeId: owner.nodeId });
+    if (!owner) return { admit: true };
+    if (session.nodeId === owner.nodeId) {
+      return session.identityKey === owner.publicKey
+        ? { admit: true }
+        : { admit: false, reason: 'claims the owner\'s nodeId under another key' };
+    }
+    const grant = session.roomGrant;
+    if (!grant) return { pending: true };
+    const v = verifyRoomGrant(grant, owner.publicKey, { room: this._room, grantee: session.nodeId, provenKey: session.identityKey, ownerNodeId: owner.nodeId });
     return v.ok ? { admit: true } : { admit: false, reason: `room-join grant refused: ${v.reason}` };
   }
 
-  _addPeer(peer) {
-    this._peers.set(peer.peerId, peer);
-
-    // Handshake — per MMP Section 5.2 + §5.8 optional `room` category
-    peer.transport.send(this._buildHandshake());
-
-    // MMP v0.2.2: no state-sync — hidden states never cross the wire under
-    // SVAF (Xu, 2026, arXiv:2604.03955, §3.4). Cognitive bootstrap to a
-    // freshly-connected peer happens via the anchor CMB exchange below,
-    // evaluated by the peer's SVAF Layer 4 against its own anchor memory.
-
-    // Debounce anchor CMB exchange — skip if peer reconnected within 60 seconds.
-    // Prevents CMB storms from unstable relay connections.
-    if (!this._lastAnchorSent) this._lastAnchorSent = new Map();
-    const lastSent = this._lastAnchorSent.get(peer.peerId) || 0;
-    const now = Date.now();
-    if (now - lastSent < 60000) {
-      this._log(`Skipping anchor CMBs for ${peer.name} (reconnected within 60s)`);
-    } else {
-      this._lastAnchorSent.set(peer.peerId, now);
-
-      // Send recent CMB anchors — enables the "Ask the Mesh" pattern.
-      // New peers need context to respond relevantly. Without this,
-      // a periodic agent that connects briefly can't see questions
-      // that were asked before it joined. See MMP Section 13.6.
-      const sharedSecret = this._peerSharedSecrets.get(peer.peerId);
-      // Anchors must be this node's OWN recent emissions (peerId == null). Forwarding
-      // CMBs we merely received from other peers re-gossips them across the mesh
-      // (A->B->C->A) and is the amplifier behind cross-node echo storms (MMP §15.7, anti-echo): a
-      // peer learns each node's state from that node directly, so own-origin anchors
-      // are sufficient context. Pull a wider window, then keep the 5 most-recent own.
-      const recentAnchors = this._store.recent(50).filter(a => a.cmb && a.peerId == null).slice(0, 5);
-      for (const anchor of recentAnchors) {
-        if (!anchor.cmb) continue;
-        let cmb = anchor.cmb;
-        if (sharedSecret) {
-          cmb = this._encryptCMBForPeer(cmb, sharedSecret);
-        } else if (peerReachedOnlyOverRelay(peer)) {
-          refuseClearThroughRelay(this, peer.peerId, peer);
-          break;
-        }
-        peer.transport.send({
-          type: 'cmb',
-          timestamp: anchor.storedAt || anchor.timestamp,
-          cmb,
-          _anchor: true,
-        });
-      }
-      if (recentAnchors.length > 0) {
-        this._log(`Sent ${recentAnchors.length} anchor CMB(s) to ${peer.name}`);
-      }
-    }
-
-    // Send wake channel if configured (legacy, for backward compat)
-    if (this._wakeChannel) {
-      peer.transport.send({ type: 'wake-channel', ...this._wakeChannel });
-    }
-
-    // Send peer-info gossip
-    const knownPeers = this._wakeManager.gossipEntries(peer.peerId, (id) => this._peers.get(id)?.name);
-    if (knownPeers.length > 0) {
-      peer.transport.send({ type: 'peer-info', peers: knownPeers });
-    }
-
-    this._log(`Peer connected: ${peer.name} (${peer.isOutbound ? 'outbound' : 'inbound'}, ${peer.source})`);
-    this._metrics.peersJoined++;
-    this.emit('peer-joined', { id: peer.peerId, name: peer.name });
-    this.emit('metric', { type: 'peer-joined', name: peer.name, source: peer.source });
-
-    // Deliver any frames queued while this peer was sleeping
-    const pending = this._pendingFrames.get(peer.peerId);
-    if (pending && pending.length > 0) {
-      this._log(`Delivering ${pending.length} pending frame(s) to ${peer.name}`);
-      for (const frame of pending) {
-        peer.transport.send(frame);
-      }
-      this._pendingFrames.delete(peer.peerId);
-    }
-  }
-
   /**
    * Fan a CMB out to every peer, or to one peer when `to` is set (MMP §4.4.4).
    * @returns {{ dispatched: number, reason: string|null }} `dispatched` counts frames a transport
@@ -3614,26 +3615,10 @@ class SymNode extends EventEmitter {
 
     let shared = 0;
     for (const [peerId, peer] of targets) {
-      const sharedSecret = this._peerSharedSecrets.get(peerId);
-      let cmb = baseCmb;
-      if (sharedSecret && baseCmb) {
-        cmb = this._encryptCMBForPeer(baseCmb, sharedSecret);
-        this._log(`E2E encrypted categories for peer ${peerId.slice(0, 8)}`);
-      } else if (baseCmb && peerReachedOnlyOverRelay(peer)) {
-        refuseClearThroughRelay(this, peerId, peer);
-        reason = NOT_SENT.CLEAR_OVER_RELAY;
-        continue;
-      }
-      const sent = trySend(peer.transport, {
-        type: 'cmb',
-        timestamp,
-        cmb,
-        // MMP §4.4.4 targeted CMB: mark the wire frame with the addressee so the
-        // receiver can distinguish a peer-bound (directed) send from a room-bound
-        // broadcast. Directed CMBs are surfaced unconditionally on receipt; SVAF then
-        // governs memory admission only. Broadcasts stay fully SVAF-gated.
-        ...(to ? { to, directed: true } : {}),
-      });
+      // One sealed frame per peer session (design D4): each session has its own keys. The record's
+      // binding — directed or room-bound — is its signed, AAD-bound `metadata.to` (§8.8.4), never a
+      // frame flag; the session refuses a record that is not a signed v2.0 record.
+      const sent = trySend(peer.transport, { type: 'cmb', timestamp, cmb: baseCmb });
       // A transport refuses a frame when the socket is closed, the relay is not open, the write
       // failed or the frame is over MAX_FRAME_SIZE. Counting those as dispatched made a stale peer
       // read as reached, and reporting them all as "not connected" hid a frame no peer could take.
@@ -3683,15 +3668,26 @@ class SymNode extends EventEmitter {
     this.emit('metric', { type: 'cmb-undelivered', to, key, reason });
   }
 
+  /**
+   * Whether a frame of `type` may be sent on `session` (§16.3: an extension's frames only where it was
+   * selected). Core frames always may.
+   * @private
+   */
+  _sessionTakes(session, type) {
+    if (!session || typeof session.has !== 'function') return true;
+    if (ATTEST_FRAMES.has(type)) return session.has(EXT_ATTEST);
+    if (type === 'xmesh-insight') return session.has(EXT_XMESH_INSIGHT);
+    return true;
+  }
+
   _broadcastToPeers(frame) {
     let delivered = 0;
     for (const [, peer] of this._peers) {
+      if (!this._sessionTakes(peer.transport, frame && frame.type)) continue;
       try {
-        if (peer.transport.send(frame) !== false) delivered++;
+        if (peer.transport && peer.transport.send(frame) !== false) delivered++;
       } catch {
-        // Transport failed (broken socket, peer closed). Don't crash the
-        // broadcast — count it as undelivered. The peer's close handler
-        // will clean up _peers in due course; we just report the truth.
+        // A session that failed counts as undelivered; its close handler cleans up the peer.
       }
     }
     return delivered;
@@ -3699,23 +3695,14 @@ class SymNode extends EventEmitter {
 
   _checkHeartbeats() {
     const now = Date.now();
-    for (const [id, peer] of this._peers) {
-      if (now - peer.lastSeen > this._heartbeatTimeout) {
-        this._log(`Heartbeat timeout: ${peer.name}`);
-        // Close the active transport — the close handler in _createPeer
-        // will failover to the next transport or remove the peer if none remain.
-        // Per MMP Section 4.6 + 5.5: don't delete peer directly.
-        if (peer.transport) peer.transport.close();
-      } else if (now - peer.lastSeen > this._heartbeatInterval) {
-        // Send ping on ALL transports — ensures liveness check reaches
-        // the peer even if the active transport is degraded.
-        if (peer.transports) {
-          for (const t of peer.transports.values()) {
-            try { t.send({ type: 'ping' }); } catch {}
-          }
-        } else if (peer.transport) {
-          peer.transport.send({ type: 'ping' });
-        }
+    // Per session (§5.4): every live path is checked, so a degraded secondary is found and closed.
+    for (const session of [...this._sessions]) {
+      if (!session.confirmed) continue;
+      if (now - session.lastSeen > this._heartbeatTimeout) {
+        this._log(`Heartbeat timeout: ${session.name} (${session.kind})`);
+        session.close('heartbeat-timeout');
+      } else if (now - session.lastSeen > this._heartbeatInterval) {
+        try { session.send({ type: 'ping' }); } catch { /* the session closes itself */ }
       }
     }
   }
@@ -3739,10 +3726,13 @@ function migrateStores(nodesRoot = path.join(require('./core/state-root').SYM_ST
   const { readLockFile, locksHeldByLiveProcess } = require('./config');
   let dirs;
   try { dirs = fs.readdirSync(nodesRoot, { withFileTypes: true }); } catch { return 0; }
-  const pending = dirs
-    .filter((d) => d.isDirectory())
-    .map((d) => path.join(nodesRoot, d.name))
-    .filter((nodeDir) => fs.existsSync(path.join(nodeDir, 'meshmem')) && !fs.existsSync(path.join(nodeDir, 'cmbs')));
+  // Node dirs live under by-id/ since 0.14 (design D9); a 0.13 dir not yet moved is a real dir.
+  let byId = [];
+  try { byId = fs.readdirSync(path.join(nodesRoot, 'by-id'), { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => path.join(nodesRoot, 'by-id', d.name)); } catch { /* none yet */ }
+  const pending = [
+    ...dirs.filter((d) => d.isDirectory() && d.name !== 'by-id' && d.name !== 'by-name').map((d) => path.join(nodesRoot, d.name)),
+    ...byId,
+  ].filter((nodeDir) => fs.existsSync(path.join(nodeDir, 'meshmem')) && !fs.existsSync(path.join(nodeDir, 'cmbs')));
   const live = locksHeldByLiveProcess(pending.map((nodeDir) => readLockFile(path.join(nodeDir, 'lock.pid'))));
   let migrated = 0;
   pending.forEach((nodeDir, i) => {
diff --git a/lib/relay.js b/lib/relay.js
index e7ae13b3..63c80cd7 100644
--- a/lib/relay.js
+++ b/lib/relay.js
@@ -9,12 +9,49 @@
  * Copyright (c) 2026 SYM.BOT. Apache 2.0 License.
  */
 
-const { RelayPeerTransport } = require('./transport');
-const { MAX_FRAME_SIZE } = require('./frame-parser');
+const { MAX_FRAME_SIZE, SEND_FAILURE } = require('./frame-parser');
 const { PEER_INFO_MAX } = require('./core/wake');
 const { wireNodeId, wireName } = require('./wire-identity');
 const RELAY_ENVELOPE_ALLOWANCE = 4096;
 const ENGINE_VERSION = require('../package.json').version;
+
+/**
+ * The relay closes a connection that sends more than 25 frames a second sustained (burst 300) with
+ * 4008 (sym-relay 0.5: a token bucket per connection, every frame counted). Core Secure seals one
+ * frame per peer session, so a room broadcast is N frames: this client paces everything it sends
+ * under that limit, with headroom, and queues what does not fit.
+ */
+const RELAY_RATE_PER_SECOND = 20;
+const RELAY_BURST = 200;
+/** Frames waiting for the pacer at most; past it a send is refused (`queue-full`), never dropped silently. */
+const RELAY_QUEUE_MAX = 10_000;
+/**
+ * The fan-out envelope (design D4; MMP spec draft PR meshcognition-website#25, for sym-relay 0.6.0):
+ * `{ fanout: [{ to, payload }, …] }` is one client message, counted once toward the relay's rate,
+ * delivered to each recipient as the unicast it would have been. Used only when the relay lists the
+ * `fanout` token in `relay-peers.features` on this connection; an older relay is paced instead. The
+ * draft has a relay that lists it accept at least FANOUT_MAX entries, with no recipient twice in one
+ * envelope (a malformed fan-out is refused whole).
+ */
+const FANOUT_FEATURE = 'fanout';
+
+/**
+ * Close codes after which the client never reconnects on its own (MMP §4.4.7, §4.4.9): each is a
+ * statement about this node's identity that a retry cannot change, and retrying would only fight the
+ * holder the relay chose.
+ *   4004 replaced — another process re-authenticated as this nodeId and the relay took it;
+ *   4006 duplicate rejected — this node is the newcomer and the existing holder is the legitimate one;
+ *   4007 key conflict — the relay binds this nodeId to a different key (draft, MMP spec PR
+ *        meshcognition-website#20: handled when a relay sends it; relay-auth v2 is not implemented).
+ */
+const HARD_STOPS = {
+  4004: { phase: 'collision', kind: 'replaced' },
+  4006: { phase: 'duplicate-rejected', kind: 'duplicate-rejected' },
+  4007: { phase: 'key-conflict', kind: 'key-conflict' },
+};
+const STOP_PHASES = Object.values(HARD_STOPS).map((h) => h.phase);
+const TERMINAL_PHASES = ['connected', 'refused', ...STOP_PHASES, 'off'];
+const FANOUT_MAX = 64;
 class RelayConnection {
 
   /**
@@ -57,28 +94,35 @@ class RelayConnection {
     this._getIdentity = opts.getIdentity;
     this._getRoom = opts.getRoom || (() => null);   // the room this node declares to the relay (wire note D4)
     this._isRunning = opts.isRunning;
-    this._getPeers = opts.getPeers;
-    this._getMeshNode = opts.getMeshNode;
-    this._createPeer = opts.createPeer;
-    this._addPeer = opts.addPeer;
-    this._handlePeerMessage = opts.handlePeerMessage;
-    this._onPeerLeft = opts.onPeerLeft;
+    // The node's session manager (design D1/D2): a relay roster entry is a CANDIDATE — a nodeId the
+    // relay says is present — and an envelope is bytes from a relay `from`. Neither creates a peer:
+    // the node runs the §5.2 handshake over the channel and a peer exists only once it confirms.
+    this._onPeerPresent = opts.onPeerPresent || (() => {});
+    this._onPeerGone = opts.onPeerGone || (() => {});
+    this._onEnvelope = opts.onEnvelope || (() => {});
+    this._onDisconnected = opts.onDisconnected || (() => {});
+    // The pacer and the fan-out feature the relay advertises.
+    this._rate = (opts.rate && opts.rate.perSecond) || RELAY_RATE_PER_SECOND;
+    this._burst = (opts.rate && opts.rate.burst) || RELAY_BURST;
+    this._bucket = { tokens: this._burst, at: Date.now() };
+    this._queue = [];                 // [{ to, payload }] in send order
+    this._flushTimer = null;
+    this._flushScheduled = false;
+    this._fanout = null;              // { max } when the relay advertises fan-out
+    this._present = new Map();        // nodeId -> name, as the relay last reported
+    this._sentFrames = 0;
+    this._sentFanout = 0;
     this._onIdentityCollision = opts.onIdentityCollision || null;
     this._onAuthRefused = opts.onAuthRefused || null;
     this._authRefusedRetryMs = opts.authRefusedRetryMs || 10 * 60 * 1000;
     this._authRefused = false;
     this._nodeName = opts.nodeName;
-    this._peerWakeChannels = opts.peerWakeChannels;
-    this._saveWakeChannels = opts.saveWakeChannels;
-    // Optional: a relay leg built without a wake manager learns no channels (and does not throw in
-    // the WebSocket handler for a peer list that carries some).
-    this._learnWakeChannel = typeof opts.learnWakeChannel === 'function' ? opts.learnWakeChannel : () => 'ignored';
-    this._identityCollision = false;
+    this._identityCollision = false;   // a hard stop (4004 / 4006 / 4007): never reconnect on its own
+    this._stopped = null;              // { code, kind, reason, at } — why, for state() and describe()
 
     this._relayWs = null;
     this._relayReconnectTimer = null;
     this._relayReconnectDelay = 1000;
-    this._relayPeerTransports = new Map();
     this._lastRelayMessage = 0;  // timestamp of last message from relay
 
     // Observable state. A host used to see one bit — `ws.readyState === 1` — so a refused
@@ -101,7 +145,8 @@ class RelayConnection {
 
   /**
    * Snapshot of the relay connection as the host should reason about it.
-   * phase: off | idle | connecting | authenticating | connected | reconnecting | refused | collision
+   * phase: off | idle | connecting | authenticating | connected | reconnecting | refused | collision (4004)
+   *        | duplicate-rejected (4006) | key-conflict (4007) — the last three are hard stops (HARD_STOPS)
    */
   state() {
     return {
@@ -113,7 +158,12 @@ class RelayConnection {
       lastClose: this._lastClose,
       lastError: this._lastError,
       refused: this._refused,
-      peers: this._relayPeerTransports.size,
+      stopped: this._stopped,
+      peers: this._present.size,
+      queued: this._queue.length,
+      fanout: this._fanout ? { max: this._fanout.max } : null,
+      sentFrames: this._sentFrames,
+      sentFanout: this._sentFanout,
     };
   }
 
@@ -136,6 +186,13 @@ class RelayConnection {
       case 'collision':
         return `STOPPED: ${s.url} reports another process holding this identity (4004). Not reconnecting — ` +
           `stop the other process or use a different node identity.`;
+      case 'duplicate-rejected':
+        return `STOPPED: ${s.url} refused this connection because another live connection already holds this ` +
+          `identity (4006); that holder is the legitimate one. Not reconnecting — stop the other process, or ` +
+          `restart this one after it has gone.`;
+      case 'key-conflict':
+        return `STOPPED: ${s.url} binds this nodeId to a DIFFERENT key (4007): another party holds this nodeId at ` +
+          `the relay, or this identity was re-keyed. Not reconnecting — check which key is genuine before anything else.`;
       case 'reconnecting': {
         const last = s.lastClose ? `last close ${s.lastClose.code}${s.lastClose.reason ? `: ${s.lastClose.reason}` : ''}` :
           (s.lastError ? `last error: ${s.lastError.message}` : 'no answer');
@@ -152,7 +209,7 @@ class RelayConnection {
    * join report the relay's actual answer instead of "discovering peers".
    */
   awaitOutcome(timeoutMs = 10000) {
-    const terminal = () => ['connected', 'refused', 'collision', 'off'].includes(this._phase);
+    const terminal = () => TERMINAL_PHASES.includes(this._phase);
     if (terminal()) return Promise.resolve(this.state());
     return new Promise((resolve) => {
       const timer = setTimeout(() => { done(); }, timeoutMs);
@@ -169,13 +226,13 @@ class RelayConnection {
     if (phase === this._phase) return;
     this._phase = phase;
     this._phaseSince = Date.now();
-    if (['connected', 'refused', 'collision', 'off'].includes(phase)) {
+    if (TERMINAL_PHASES.includes(phase)) {
       for (const w of this._outcomeWaiters.slice()) w();
     }
   }
 
-  /** Relay peer transports map. */
-  get peerTransports() { return this._relayPeerTransports; }
+  /** The nodeIds the relay reports present (candidates: nothing about them is proven). */
+  get present() { return new Map(this._present); }
 
   /**
    * Open WebSocket connection to the relay and authenticate.
@@ -192,28 +249,23 @@ class RelayConnection {
     this._refused = null;
     this._attempts = 0;
     this._setPhase('connected');
-    let learned = 0, changed = 0;
+    // The relay's features (sym-relay 0.6.0 advertises fan-out here). Absent means an older relay:
+    // every frame goes on its own, paced.
+    // Unknown tokens are ignored; an absent list lists nothing.
+    const features = Array.isArray(msg.features) ? msg.features.filter((f) => typeof f === 'string') : [];
+    this._fanout = features.includes(FANOUT_FEATURE) ? { max: FANOUT_MAX } : null;
     // A room's peer list is short. Like a peer's peer-info, the relay's is read for its first
     // PEER_INFO_MAX entries: a longer one (a faulty or compromised relay) cannot keep the event loop.
+    // Its wake channels name OTHER nodes and come from the relay, so they are hints, never stored
+    // (design D1): a wake channel is learned only from its node's own session.
     const peers = Array.isArray(msg.peers) ? msg.peers : [];
     if (peers.length > PEER_INFO_MAX) this._log(`Relay peer list of ${peers.length} entries: reading the first ${PEER_INFO_MAX}`);
     for (const p of peers.slice(0, PEER_INFO_MAX)) {
       // Taken at the door (wire-identity.js): an entry that cannot be named by a string is skipped.
       const id = p && typeof p === 'object' ? wireNodeId(p.nodeId) : null;
-      if (!id) continue;
-      if (p.wakeChannel) {
-        // 'none' is the peer's own registration turning its channel off. learnWakeChannel takes
-        // the channel as text (cleanChannel) before anything keeps it.
-        const r = this._learnWakeChannel(id, p.wakeChannel, { source: 'relay', lastSeen: p.lastSeen });
-        if (r === 'added' || r === 'updated') learned++;
-        if (r === 'added' || r === 'updated' || r === 'refreshed' || r === 'removed') changed++;
-      }
-      if (!p.offline) {
-        this._handleRelayPeerJoined(id, wireName(p.name));
-      }
+      if (!id || p.offline) continue;
+      this._handleRelayPeerJoined(id, wireName(p.name));
     }
-    if (changed > 0) this._saveWakeChannels();
-    if (learned > 0) this._log(`Relay: learned ${learned} wake channel(s)`);
   }
 
   /**
@@ -282,10 +334,10 @@ class RelayConnection {
           ws.close();
           return;
         }
-        ws.send(JSON.stringify({ type: 'relay-pong' }));
+        this._sendControl(ws, { type: 'relay-pong' });
       }, 20000);
 
-      ws.send(JSON.stringify(this._authFrame()));
+      this._sendControl(ws, this._authFrame());
     });
 
     ws.on('message', (data) => {
@@ -314,41 +366,40 @@ class RelayConnection {
       } else if (msg.type === 'relay-peers') {
         this._handleRelayPeers(msg);
       } else if (msg.type === 'relay-ping') {
-        ws.send(JSON.stringify({ type: 'relay-pong' }));
+        this._sendControl(ws, { type: 'relay-pong' });
       } else if (msg.type === 'relay-reauth') {
         // Server lost our registration (e.g. relay restarted while TCP survived).
         // Re-send auth to re-register without dropping the connection.
         this._log('Relay requested re-auth — re-sending identity');
-        ws.send(JSON.stringify(this._authFrame()));
+        this._sendControl(ws, this._authFrame());
       } else if (msg.type === 'relay-error') {
         this._log(`Relay error: ${String(typeof msg.message === 'string' ? msg.message : JSON.stringify(msg.message)).slice(0, 500)}`);
       } else if (wireNodeId(msg.from) && msg.payload && typeof msg.payload === 'object'
                  && typeof msg.payload.type === 'string') {
-        if (Buffer.byteLength(JSON.stringify(msg.payload), 'utf8') > MAX_FRAME_SIZE) {
-          this._log(`Relay frame from ${String(msg.from).slice(0, 8)} dropped: payload exceeds MAX_FRAME_SIZE`);
-          return;
-        }
-        const peers = this._getPeers();
-        const peer = peers.get(msg.from);
-        if (peer) peer.lastSeen = Date.now();
-        this._handlePeerMessage(msg.from, wireName(msg.fromName), msg.payload, `relay:${connection}:${msg.from}`);
+        // The whole message was bounded above (MAX_FRAME_SIZE + the envelope allowance); the payload
+        // is a part of it. A relay `from` is unproven (§4.4.1): the node takes the payload only as
+        // bytes for the session bound to that `from`.
+        this._onEnvelope(msg.from, wireName(msg.fromName), msg.payload, connection);
       }
     });
 
     ws.on('close', (code, reason) => {
       const reasonStr = reason && reason.toString ? reason.toString() : '';
+      // A socket this connection no longer holds (destroy() let it go, or a newer dial replaced it)
+      // ends with nothing scheduled: destroy() already cleaned up, and only the current socket's
+      // close may reconnect.
+      if (this._relayWs !== ws) return;
       this._log(`Relay disconnected (code ${code}${reasonStr ? `: ${reasonStr}` : ''})`);
       this._relayWs = null;
       this._lastClose = { code, reason: reasonStr, at: Date.now() };
       if (this._relayPingTimer) { clearInterval(this._relayPingTimer); this._relayPingTimer = null; }
 
-      // Section 4.6 + 5.5: close relay transports only.
-      // _createPeer's close handlers will failover to Bonjour
-      // or remove the peer if no transports remain.
-      for (const [, transport] of this._relayPeerTransports) {
-        transport.destroy();
-      }
-      this._relayPeerTransports.clear();
+      // Section 4.6 + 5.5: every relay session ends with the connection it was bound to; a peer
+      // reachable over the LAN keeps that session. What was queued for the pacer is dropped with it.
+      this._present.clear();
+      this._queue = [];
+      if (this._flushTimer) { clearTimeout(this._flushTimer); this._flushTimer = null; }
+      try { this._onDisconnected(); } catch (err) { this._log(`Relay disconnect handling failed: ${err && err.message}`); }
 
       // MMP identity invariant: nodeId is bound to a keypair. If the relay
       // closes us with code 4004 ("Replaced by new connection"), another
@@ -358,14 +409,27 @@ class RelayConnection {
       // loop. Loudly refuse instead — wrong winner is worse than loud
       // failure. The host can listen via onIdentityCollision and decide
       // whether to exit, wait, or alert.
-      if (code === 4004) {
+      // 4006 (the existing holder is legitimate) and 4007 (the relay binds this nodeId to another key)
+      // stop the same way: said once, kept in state().stopped, never retried (see HARD_STOPS).
+      const hard = HARD_STOPS[code];
+      if (hard) {
         const id = this._getIdentity();
+        const first = !this._identityCollision;
         this._identityCollision = true;
-        this._setPhase('collision');
-        this._log(`FATAL: relay reports duplicate identity (nodeId=${id.nodeId}, name=${this._nodeName}). Another process is holding this keypair. Not reconnecting.`);
-        if (this._onIdentityCollision) {
-          try { this._onIdentityCollision({ nodeId: id.nodeId, name: this._nodeName, code }); } catch (err) {
-            this._log(`onIdentityCollision callback threw: ${err.message}`);
+        this._stopped = { code, kind: hard.kind, reason: reasonStr.slice(0, 200), at: Date.now() };
+        this._nextRetryAt = null;
+        this._setPhase(hard.phase);
+        if (first) {
+          const what = code === 4004
+            ? 'reports duplicate identity: another process is holding this keypair'
+            : code === 4006
+              ? 'rejected this connection as a duplicate: another live connection holds this identity and is the legitimate holder'
+              : 'binds this nodeId to a DIFFERENT key: another party holds this nodeId at the relay, or this identity was re-keyed';
+          this._log(`FATAL: relay ${this._relayUrl} ${what} (${code}${reasonStr ? `: ${reasonStr.slice(0, 200)}` : ''}; nodeId=${id.nodeId}, name=${this._nodeName}). Not reconnecting.`);
+          if (this._onIdentityCollision) {
+            try { this._onIdentityCollision({ nodeId: id.nodeId, name: this._nodeName, code, kind: hard.kind, reason: reasonStr.slice(0, 200) }); } catch (err) {
+              this._log(`onIdentityCollision callback threw: ${err.message}`);
+            }
           }
         }
         return;
@@ -411,36 +475,110 @@ class RelayConnection {
   _handleRelayPeerJoined(peerId, peerName) {
     const identity = this._getIdentity();
     if (!peerId || peerId === identity.nodeId) return;
-    const peers = this._getPeers();
-    const transport = new RelayPeerTransport(this._relayWs, peerId);
-    this._relayPeerTransports.set(peerId, transport);
+    this._present.set(peerId, peerName);
+    try { this._onPeerPresent(peerId, peerName); } catch (err) { this._log(`Relay peer-joined handling failed: ${err && err.message}`); }
+  }
 
-    transport.on('close', () => {
-      this._relayPeerTransports.delete(peerId);
-    });
+  _handleRelayPeerLeft(peerId, peerName) {
+    this._present.delete(peerId);
+    try { this._onPeerGone(peerId, peerName); } catch (err) { this._log(`Relay peer-left error for ${peerName || peerId}: ${err && err.message}`); }
+  }
 
-    // Section 4.6: if peer already connected (e.g. via Bonjour),
-    // _createPeer adds relay as secondary transport, not a duplicate.
-    const peer = this._createPeer(transport, peerId, peerName, true, 'relay');
-    if (!peers.has(peerId)) {
-      this._addPeer(peer);
-    }
+  /**
+   * A transport for one session bound to the relay `from`/`to` = `nodeId` (design D2): it sends
+   * envelopes addressed to that node through the pacer, and is closed by its session. It never
+   * receives: the relay connection hands envelopes to the node, which routes them by `from`.
+   */
+  transportFor(nodeId) {
+    const relay = this;
+    return {
+      _closed: false,
+      trySend(frame) {
+        if (this._closed) return { ok: false, reason: SEND_FAILURE.NOT_CONNECTED };
+        return relay.sendTo(nodeId, frame);
+      },
+      send(frame) { return this.trySend(frame).ok; },
+      close() { this._closed = true; },
+      destroy() { this._closed = true; },
+    };
   }
 
-  _handleRelayPeerLeft(peerId, peerName) {
-    // Section 4.6 + 5.5: close the relay transport only.
-    // _createPeer's close handler will failover to Bonjour
-    // or remove the peer if no transports remain.
-    try {
-      const transport = this._relayPeerTransports.get(peerId);
-      if (transport) transport.destroy();
-      this._relayPeerTransports.delete(peerId);
-      this._log(`Relay transport closed for ${peerName || peerId}`);
-    } catch (err) {
-      this._log(`Relay peer-left error for ${peerName || peerId}: ${err.message}`);
+  /**
+   * Send one payload to `to` through the pacer. Sends made in the same turn of the event loop are
+   * flushed together, so a broadcast's per-session frames go out as fan-out envelopes when the relay
+   * supports them, and paced under its rate when it does not.
+   * @returns {{ ok: boolean, reason?: string, bytes?: number }}
+   */
+  sendTo(to, payload) {
+    const ws = this._relayWs;
+    if (!ws || ws.readyState !== 1) return { ok: false, reason: SEND_FAILURE.NOT_CONNECTED };
+    let data;
+    try { data = JSON.stringify({ to, payload }); } catch { return { ok: false, reason: SEND_FAILURE.WRITE_FAILED }; }
+    const bytes = Buffer.byteLength(data, 'utf8');
+    // MMP §4.1: senders MUST NOT produce frames over MAX_FRAME_SIZE; the relay would close the whole
+    // shared connection (1009) rather than drop one frame.
+    if (bytes > MAX_FRAME_SIZE) return { ok: false, reason: SEND_FAILURE.TOO_LARGE, bytes };
+    if (this._queue.length >= RELAY_QUEUE_MAX) return { ok: false, reason: 'queue-full', bytes };
+    this._queue.push({ to, payload, data, bytes });
+    this._scheduleFlush();
+    return { ok: true, bytes };
+  }
+
+  _scheduleFlush() {
+    if (this._flushScheduled || this._flushTimer) return;
+    this._flushScheduled = true;
+    setImmediate(() => { this._flushScheduled = false; this._flush(); });
+  }
+
+  _refill(now = Date.now()) {
+    const b = this._bucket;
+    const elapsed = now - b.at;
+    if (elapsed > 0) b.tokens = Math.min(this._burst, b.tokens + (elapsed * this._rate) / 1000);
+    b.at = now;
+    return b;
+  }
+
+  /** Send what the bucket allows: fan-out envelopes when advertised, else one frame per payload. */
+  _flush() {
+    const ws = this._relayWs;
+    if (!ws || ws.readyState !== 1) return;
+    while (this._queue.length) {
+      const b = this._refill();
+      if (b.tokens < 1) {
+        const wait = Math.ceil(((1 - b.tokens) * 1000) / this._rate);
+        this._flushTimer = setTimeout(() => { this._flushTimer = null; this._flush(); }, Math.max(wait, 5));
+        if (this._flushTimer.unref) this._flushTimer.unref();
+        return;
+      }
+      let data;
+      if (this._fanout && this._queue.length > 1) {
+        // Consecutive payloads, in order, up to FANOUT_MAX and the frame bound, and never a recipient
+        // twice in one envelope (the batch ends at the first repeat, so per-recipient order holds).
+        const batch = [];
+        const to = new Set();
+        let size = 16;
+        while (this._queue.length && batch.length < this._fanout.max && !to.has(this._queue[0].to) && size + this._queue[0].bytes + 1 <= MAX_FRAME_SIZE) {
+          const q = this._queue.shift();
+          batch.push(q);
+          to.add(q.to);
+          size += q.bytes + 1;
+        }
+        data = batch.length === 1 ? batch[0].data : JSON.stringify({ fanout: batch.map((q) => ({ to: q.to, payload: q.payload })) });
+        if (batch.length > 1) this._sentFanout++;
+      } else {
+        data = this._queue.shift().data;
+      }
+      b.tokens -= 1;
+      try { ws.send(data); this._sentFrames++; } catch (err) { this._log(`Relay send failed: ${err && err.message}`); }
     }
   }
 
+  /** A frame of the relay protocol itself (auth, pong): sent at once, counted against the bucket. */
+  _sendControl(ws, frame) {
+    this._refill().tokens -= 1;
+    ws.send(JSON.stringify(frame));
+  }
+
   /**
    * @param {number} [fixedDelayMs] — use this delay instead of the exponential backoff and
    *   leave the backoff state untouched (the slow retry after an auth refusal).
@@ -464,20 +602,22 @@ class RelayConnection {
 
   /** Clean up relay resources on stop. */
   destroy() {
-    if (this._relayReconnectTimer) clearTimeout(this._relayReconnectTimer);
+    if (this._relayReconnectTimer) { clearTimeout(this._relayReconnectTimer); this._relayReconnectTimer = null; }
+    if (this._relayPingTimer) { clearInterval(this._relayPingTimer); this._relayPingTimer = null; }
 
-    for (const [, transport] of this._relayPeerTransports) {
-      transport.destroy();
-    }
-    this._relayPeerTransports.clear();
+    this._present.clear();
+    this._queue = [];
+    if (this._flushTimer) { clearTimeout(this._flushTimer); this._flushTimer = null; }
 
     if (this._relayWs) {
       try { this._relayWs.close(); } catch {}
       this._relayWs = null;
     }
     this._nextRetryAt = null;
-    this._setPhase(this._relayUrl ? 'idle' : 'off');
+    // A hard stop outlives destroy(): the identity fact behind it does not change with a restart of
+    // this node object (state().stopped keeps the reason).
+    this._setPhase(this._stopped ? HARD_STOPS[this._stopped.code].phase : (this._relayUrl ? 'idle' : 'off'));
   }
 }
 
-module.exports = { RelayConnection };
+module.exports = { RelayConnection, RELAY_RATE_PER_SECOND, RELAY_BURST, FANOUT_FEATURE, FANOUT_MAX, HARD_STOPS };
diff --git a/lib/relocation.js b/lib/relocation.js
new file mode 100644
index 00000000..61b51cf9
--- /dev/null
+++ b/lib/relocation.js
@@ -0,0 +1,244 @@
+'use strict';
+
+/**
+ * @module @sym-bot/sym/relocation
+ * @description Moving a node to another host (sym 0.14, design D9.2). §3.1.3: "The private key MUST
+ * NOT leave the node" — so a node is MOVED, never copied:
+ *
+ *   - `exportNode` writes a TOMBSTONE at the source FIRST, then the bundle. The source refuses to
+ *     start that identity from then on (config.js IdentityTombstonedError), so no copy remains live:
+ *     the relay's 4004 replacement cannot produce two live copies, because the source is tombstoned
+ *     before the bundle exists.
+ *   - The bundle holds the node's directory — its identity, store, key registry, grants and learned
+ *     state — encrypted under an operator passphrase (scrypt → AES-256-GCM) or to a target host's
+ *     X25519 key (ephemeral X25519 + HKDF-SHA256 → AES-256-GCM).
+ *   - `importNode` verifies the bundle against an INDEPENDENTLY PINNED (nodeId, key): one the
+ *     operator gives (`expect`: the key or its sha256 fingerprint, e.g. from a validator's preserve
+ *     act), or, absent that, a proven or pinned binding this host's own nodes already hold for that
+ *     nodeId. It never relies on anything the bundle says about itself: a bundle whose identity was
+ *     re-keyed (signed by another key) is refused.
+ *
+ * @copyright 2026 SYM.BOT. Apache 2.0 License.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+const config = require('./config');
+const { keyFingerprint, isIdentityKey } = require('./roster-keys');
+
+const FORMAT = 'sym-node-bundle-v1';
+const SKIP = new Set(['lock.pid', config.TOMBSTONE, 'interior.sock']);
+const X25519_SPKI_PREFIX = Buffer.from('302a300506032b656e032100', 'hex');
+const X25519_PKCS8_PREFIX = Buffer.from('302e020100300506032b656e04220420', 'hex');
+const ED25519_PKCS8_PREFIX = Buffer.from('302e020100300506032b657004220420', 'hex');
+const HOST_KEY_FILE = 'host-key.json';
+
+/** This host's X25519 key pair for receiving bundles (created on first use, 0600). */
+function hostKey({ create = true } = {}) {
+  const file = path.join(config.SYM_DIR, HOST_KEY_FILE);
+  try {
+    const k = JSON.parse(fs.readFileSync(file, 'utf8'));
+    if (typeof k.publicKey === 'string' && typeof k.privateKey === 'string') return k;
+  } catch { /* none yet */ }
+  if (!create) return null;
+  const { publicKey, privateKey } = crypto.generateKeyPairSync('x25519');
+  const k = {
+    publicKey: publicKey.export({ type: 'spki', format: 'der' }).subarray(-32).toString('base64url'),
+    privateKey: privateKey.export({ type: 'pkcs8', format: 'der' }).subarray(-32).toString('base64url'),
+    createdAt: Date.now(),
+  };
+  config.ensureDir(config.SYM_DIR);
+  fs.writeFileSync(file, JSON.stringify(k, null, 2), { mode: 0o600 });
+  return k;
+}
+
+function listFiles(root, rel = '') {
+  const out = [];
+  for (const d of fs.readdirSync(path.join(root, rel), { withFileTypes: true })) {
+    const p = path.join(rel, d.name);
+    if (!rel && SKIP.has(d.name)) continue;
+    if (d.name.endsWith('.tmp')) continue;
+    if (d.isDirectory()) out.push(...listFiles(root, p));
+    else if (d.isFile()) out.push(p);
+  }
+  return out;
+}
+
+function seal(plain, { passphrase, toHostKey }) {
+  const nonce = crypto.randomBytes(12);
+  let key;
+  let header;
+  if (typeof passphrase === 'string' && passphrase.length >= 12) {
+    const salt = crypto.randomBytes(16);
+    const params = { N: 32768, r: 8, p: 1 };
+    key = crypto.scryptSync(passphrase, salt, 32, { ...params, maxmem: 128 * 1024 * 1024 });
+    header = { kdf: 'scrypt', salt: salt.toString('base64url'), ...params };
+  } else if (typeof toHostKey === 'string' && toHostKey) {
+    const raw = Buffer.from(toHostKey, 'base64url');
+    if (raw.length !== 32) throw new Error('relocation: the target host key is not a 32-byte X25519 key');
+    const eph = crypto.generateKeyPairSync('x25519');
+    const ss = crypto.diffieHellman({ privateKey: eph.privateKey, publicKey: crypto.createPublicKey({ key: Buffer.concat([X25519_SPKI_PREFIX, raw]), format: 'der', type: 'spki' }) });
+    const ephPub = eph.publicKey.export({ type: 'spki', format: 'der' }).subarray(-32);
+    key = Buffer.from(crypto.hkdfSync('sha256', ss, Buffer.concat([ephPub, raw]), Buffer.from('sym-node-bundle-v1', 'utf8'), 32));
+    header = { kdf: 'x25519-hkdf', ephemeral: ephPub.toString('base64url'), to: toHostKey };
+  } else {
+    throw new Error('relocation: a passphrase (at least 12 characters) or a target host key is required');
+  }
+  const c = crypto.createCipheriv('aes-256-gcm', key, nonce);
+  const body = Buffer.concat([c.update(plain), c.final()]);
+  return { ...header, nonce: nonce.toString('base64url'), ciphertext: Buffer.concat([body, c.getAuthTag()]).toString('base64url') };
+}
+
+function unseal(bundle, { passphrase, hostPrivateKey }) {
+  let key;
+  if (bundle.kdf === 'scrypt') {
+    if (typeof passphrase !== 'string') throw new Error('relocation: this bundle needs its passphrase');
+    key = crypto.scryptSync(passphrase, Buffer.from(bundle.salt, 'base64url'), 32, { N: bundle.N, r: bundle.r, p: bundle.p, maxmem: 128 * 1024 * 1024 });
+  } else if (bundle.kdf === 'x25519-hkdf') {
+    const priv = hostPrivateKey || (hostKey({ create: false }) || {}).privateKey;
+    if (!priv) throw new Error('relocation: this bundle is sealed to a host key this host does not hold');
+    const privObj = crypto.createPrivateKey({ key: Buffer.concat([X25519_PKCS8_PREFIX, Buffer.from(priv, 'base64url')]), format: 'der', type: 'pkcs8' });
+    const ephPub = Buffer.from(bundle.ephemeral, 'base64url');
+    const ss = crypto.diffieHellman({ privateKey: privObj, publicKey: crypto.createPublicKey({ key: Buffer.concat([X25519_SPKI_PREFIX, ephPub]), format: 'der', type: 'spki' }) });
+    const ownPub = crypto.createPublicKey(privObj).export({ type: 'spki', format: 'der' }).subarray(-32);
+    key = Buffer.from(crypto.hkdfSync('sha256', ss, Buffer.concat([ephPub, ownPub]), Buffer.from('sym-node-bundle-v1', 'utf8'), 32));
+  } else {
+    throw new Error(`relocation: unknown bundle sealing '${bundle.kdf}'`);
+  }
+  const sealed = Buffer.from(bundle.ciphertext, 'base64url');
+  const d = crypto.createDecipheriv('aes-256-gcm', key, Buffer.from(bundle.nonce, 'base64url'));
+  d.setAuthTag(sealed.subarray(sealed.length - 16));
+  try {
+    return Buffer.concat([d.update(sealed.subarray(0, sealed.length - 16)), d.final()]);
+  } catch {
+    throw new Error('relocation: the bundle does not open (a wrong passphrase or host key, or the bundle was altered)');
+  }
+}
+
+/** The Ed25519 public key a raw private key derives. */
+function publicOf(privateKeyB64url) {
+  const priv = crypto.createPrivateKey({ key: Buffer.concat([ED25519_PKCS8_PREFIX, Buffer.from(privateKeyB64url, 'base64url')]), format: 'der', type: 'pkcs8' });
+  return crypto.createPublicKey(priv).export({ type: 'spki', format: 'der' }).subarray(-32).toString('base64url');
+}
+
+/**
+ * Move a node off this host: tombstone it, then write its encrypted bundle.
+ * @param {object} o
+ * @param {string} [o.name]
+ * @param {string} [o.nodeId]
+ * @param {string} o.out - the bundle file to write
+ * @param {string} [o.passphrase]
+ * @param {string} [o.toHostKey] - the target host's X25519 public key (sym node host-key there)
+ * @returns {{ nodeId: string, name: string, files: number, out: string, fingerprint: string }}
+ */
+function exportNode({ name, nodeId, out, passphrase, toHostKey } = {}) {
+  if (!out) throw new Error('relocation: out (the bundle file) is required');
+  const id = nodeId || (name && config.nodeIdForName(name));
+  if (!id) throw new config.IdentityAbsentError(name ? `"${name}"` : 'the node');
+  const dir = config.nodeDirById(id);
+  if (config.readTombstone(id)) throw new Error(`relocation: ${id} is already tombstoned here (it was exported)`);
+  const identity = config.loadIdentity({ nodeId: id, name, create: false });
+  const lock = config.readLockFile(path.join(dir, 'lock.pid'));
+  if (lock && lock.pid !== process.pid && config.lockIsHeldByLiveProcess(lock)) {
+    throw new Error(`relocation: ${identity.name} is running (PID ${lock.pid}); stop it before moving it`);
+  }
+  // Validate the sealing input before the tombstone: a refused export must leave the node startable.
+  seal(Buffer.alloc(0), { passphrase, toHostKey });
+  // THE TOMBSTONE FIRST. From here this host refuses to start the identity, before any bundle exists.
+  const tomb = { nodeId: id, name: identity.name, movedAt: Date.now(), bundle: path.basename(out), fingerprint: keyFingerprint(identity.publicKey) };
+  const tombPath = path.join(dir, config.TOMBSTONE);
+  const fd = fs.openSync(tombPath, 'wx');
+  try { fs.writeSync(fd, JSON.stringify(tomb, null, 2)); fs.fsyncSync(fd); } finally { fs.closeSync(fd); }
+  const files = listFiles(dir).map((rel) => ({ path: rel.split(path.sep).join('/'), data: fs.readFileSync(path.join(dir, rel)).toString('base64') }));
+  // identity.json lives elsewhere when SYM_IDENTITY_DIR is set: it travels in the bundle all the same.
+  if (!files.some((f) => f.path === 'identity.json')) {
+    files.push({ path: 'identity.json', data: Buffer.from(JSON.stringify(identity, null, 2)).toString('base64') });
+  }
+  const plain = Buffer.from(JSON.stringify({ format: FORMAT, nodeId: id, name: identity.name, publicKey: identity.publicKey, exportedAt: tomb.movedAt, files }), 'utf8');
+  const bundle = { format: FORMAT, nodeId: id, fingerprint: tomb.fingerprint, ...seal(plain, { passphrase, toHostKey }) };
+  const tmp = `${out}.${process.pid}.tmp`;
+  fs.writeFileSync(tmp, JSON.stringify(bundle), { mode: 0o600 });
+  fs.renameSync(tmp, out);
+  return { nodeId: id, name: identity.name, files: files.length, out, fingerprint: tomb.fingerprint };
+}
+
+/** A proven or pinned key this host's nodes hold for `nodeId` (the target host's roster entry), or null. */
+function hostPinFor(nodeId) {
+  const root = path.join(config.NODES_DIR, 'by-id');
+  let dirs = [];
+  try { dirs = fs.readdirSync(root); } catch { return null; }
+  for (const d of dirs) {
+    let text;
+    try { text = fs.readFileSync(path.join(root, d, 'roster-keys', 'roster-keys.jsonl'), 'utf8'); } catch { continue; }
+    let found = null;
+    for (const line of text.split('\n')) {
+      let r;
+      try { r = JSON.parse(line); } catch { continue; }
+      if (r && r.nodeId === nodeId && (r.source === 'proven' || r.source === 'pinned') && isIdentityKey(r.key)) found = r.key;
+    }
+    if (found) return found;
+  }
+  return null;
+}
+
+/**
+ * Bring a moved node onto this host, verified against an independently pinned key.
+ * @param {object} o
+ * @param {string} o.from - the bundle file
+ * @param {string} [o.passphrase]
+ * @param {string} [o.hostPrivateKey] - default: this host's host-key.json
+ * @param {{ nodeId: string, key?: string, fingerprint?: string }} [o.expect] - the independent pin
+ * @param {string} [o.name] - index it under another name
+ * @returns {{ nodeId: string, name: string, files: number, pinnedBy: string }}
+ */
+function importNode({ from, passphrase, hostPrivateKey, expect, name } = {}) {
+  const bundle = JSON.parse(fs.readFileSync(from, 'utf8'));
+  if (!bundle || bundle.format !== FORMAT) throw new Error('relocation: not a sym node bundle');
+  const plain = JSON.parse(unseal(bundle, { passphrase, hostPrivateKey }).toString('utf8'));
+  const idFile = (plain.files || []).find((f) => f.path === 'identity.json');
+  if (!idFile) throw new Error('relocation: the bundle carries no identity');
+  const identity = JSON.parse(Buffer.from(idFile.data, 'base64').toString('utf8'));
+  if (!identity || typeof identity.nodeId !== 'string' || !isIdentityKey(identity.publicKey) || typeof identity.privateKey !== 'string') {
+    throw new Error('relocation: the bundle\'s identity is malformed');
+  }
+  if (publicOf(identity.privateKey) !== identity.publicKey) throw new Error('relocation: the bundle\'s private key does not match its public key');
+  // THE INDEPENDENT PIN: never what the bundle says about itself.
+  let pinned = null;
+  let pinnedBy = null;
+  if (expect && expect.nodeId) {
+    if (expect.nodeId !== identity.nodeId) throw new Error(`relocation: the bundle is ${identity.nodeId}, not the expected ${expect.nodeId}`);
+    if (expect.key) { pinned = expect.key; pinnedBy = 'operator key'; }
+    else if (expect.fingerprint) { pinned = { fingerprint: expect.fingerprint }; pinnedBy = 'operator fingerprint'; }
+  }
+  if (!pinned) {
+    const k = hostPinFor(identity.nodeId);
+    if (k) { pinned = k; pinnedBy = 'this host\'s key registry'; }
+  }
+  if (!pinned) throw new Error(`relocation: refusing ${identity.nodeId}: no independently pinned key (give --expect-key or --expect-fingerprint, from the validator's preserve act or the source host)`);
+  const ok = typeof pinned === 'string' ? pinned === identity.publicKey : keyFingerprint(identity.publicKey) === pinned.fingerprint;
+  if (!ok) throw new Error(`relocation: refusing ${identity.nodeId}: the bundle's key is not the pinned one (${pinnedBy}) — a re-keyed bundle`);
+  const dest = config.nodeDirById(identity.nodeId);
+  if (fs.existsSync(dest)) {
+    if (!config.readTombstone(identity.nodeId)) throw new Error(`relocation: ${identity.nodeId} already lives on this host`);
+    // It was moved away from here before: the tombstoned copy is archived, and the node comes back.
+    fs.renameSync(dest, `${dest}.moved-${Date.now()}`);
+  }
+  for (const f of plain.files) {
+    const rel = String(f.path);
+    if (rel.includes('..') || path.isAbsolute(rel)) throw new Error(`relocation: refusing a bundle path outside the node: ${rel}`);
+    const p = path.join(dest, ...rel.split('/'));
+    config.ensureDir(path.dirname(p));
+    fs.writeFileSync(p, Buffer.from(f.data, 'base64'), rel === 'identity.json' ? { mode: 0o600 } : undefined);
+  }
+  const idDirExt = config.identityDirById(identity.nodeId);
+  if (idDirExt !== dest) { config.ensureDir(idDirExt); fs.writeFileSync(path.join(idDirExt, 'identity.json'), Buffer.from(idFile.data, 'base64'), { mode: 0o600 }); }
+  const label = name || identity.name;
+  const existing = config.nodeIdForName(label);
+  if (existing && existing !== identity.nodeId) throw new Error(`relocation: the name "${label}" already indexes another node here; import with another name`);
+  // indexName is internal to config; loadIdentity by nodeId + name writes the index.
+  config.loadIdentity({ nodeId: identity.nodeId, name: label, create: false });
+  return { nodeId: identity.nodeId, name: label, files: plain.files.length, pinnedBy };
+}
+
+module.exports = { exportNode, importNode, hostKey, FORMAT };
diff --git a/lib/role-grant-store.js b/lib/role-grant-store.js
index f023b860..2d75aa3a 100644
--- a/lib/role-grant-store.js
+++ b/lib/role-grant-store.js
@@ -2,30 +2,35 @@
 
 /**
  * @module @sym-bot/sym/role-grant-store
- * @description Earned-authority role-grant chain (MMP §6.5).
+ * @description Earned-authority role-grant chain (MMP §6.5, §6.6).
  *
- * A node's lifecycle authority (participant → validator → anchor) is EARNED via
- * signed grants, never self-asserted. This store holds the signed role-grant /
- * role-revoke records and resolves "what role did node N hold at time T" by walking
- * the grant chain — but authority only flows along chains that **terminate at the
- * non-earnable anchor** (typically the founder). A grant whose chain does not root
- * at the anchor confers NOTHING (Douceur: there is no unconditional decentralized
- * Sybil-resistance — authority must bottom out at a pinned root). This is what makes
- * the attestation `role` un-spoofable: `verifyAttestationRole` resolves against this
- * chain, never the stamped category.
+ * A node's lifecycle authority (participant → validator → anchor) is EARNED via signed grants,
+ * never self-asserted. Authority flows only along chains that terminate at the non-earnable anchor
+ * (typically the founder): a grant whose chain does not root there confers NOTHING (Douceur: there
+ * is no unconditional decentralized Sybil-resistance — authority must bottom out at a pinned root).
  *
- * A record is KEPT only when it is rooted at the anchor: its grantor held, at the time it
- * signed, the rank the record needs (a grant: the rank it confers; a revoke: validator or
- * above), by the chain this store already holds. An unrooted record has no effect on any
- * resolution, so it is not stored, not relayed, and costs nothing — before 0.13.17 it was
- * stored and relayed, so any connected peer could write records here by signing them
- * itself. Resolution still re-checks every chain (role-at-time, revocation cascades).
+ * AUTHORITY FOLLOWS THE KEY (sym 0.14, design D3):
  *
- * Grantor keys are resolved through ONE interface, the key registry's own lookup (the
- * node's roster), on ingest and on reload alike. Persisted append-only; reloaded on
- * construction through the same checks as a frame, so a record on disk that cannot be
- * verified is skipped and counted, and a file that cannot be read leaves the store empty
- * (`loadReport()` says which) — reading the store never throws.
+ *   - Every role-grant carries `granteeKey`, inside the signed payload. A grant without one is
+ *     malformed: a grant to a bare nodeId would confer authority on whoever later holds that id.
+ *   - `resolveRole(nodeId, key, at)` confers a grant's role only when its `granteeKey` equals `key`,
+ *     the key the subject is bound to (the key its session proved, or its registry binding). A node
+ *     whose id is claimed by an impostor's key resolves, for that key, to participant.
+ *   - Chains are verified TOP-DOWN with the key each verified grant vouches (§6.6: "using each
+ *     verified grant's vouched key to reach the next"): a grant signed by grantor G is checked
+ *     against the keys G's own rooted grants vouch for G, never against whatever key the registry
+ *     holds for G. So a grantor whose id the registry binds to an impostor still has exactly the
+ *     authority its vouched key has, and the impostor has none.
+ *
+ * A record is KEPT only when it is rooted at the anchor: its grantor held, at the time it signed, the
+ * rank the record needs (a grant: the rank it confers; a revoke: validator or above), under the key
+ * that signed it, by the chain this store already holds (0.13.17). An unrooted record has no effect
+ * on any resolution, so it is not stored, not relayed, and costs nothing. Resolution still re-checks
+ * every chain (role-at-time, revocation cascades). Reloading from disk runs the same checks — the file
+ * has no integrity of its own, so nothing is trusted for being on it (0.13.17's record() path).
+ *
+ * A rooted grant's vouched key is pinned into the key registry at `grant` strength, by the registry's
+ * conflict matrix (a different key already bound is a conflict, never an override).
  *
  * @copyright 2026 SYM.BOT. Apache 2.0 License.
  */
@@ -51,18 +56,19 @@ const MAX_GRANTS = 65536;
 class RoleGrantStore {
   /**
    * @param {object} [opts]
-   * @param {{nodeId: string, publicKey: string}} [opts.anchor] the non-earnable root
-   *   of trust (founder). resolveRole confers authority only along chains rooting here.
-   * @param {{get: function(string): (string|undefined)}} [opts.keys] the key registry grant
-   *   signatures are verified against — the node's RosterKeyRegistry, or any Map-like with
-   *   `get`. Only ever LOOKED UP through `get` (never copied or iterated); a rooted grant's
-   *   vouched grantee key is pinned back into it (`pin`, or `set` when absent on a Map).
+   * @param {{nodeId: string, publicKey: string}} [opts.anchor] the non-earnable root of trust.
+   * @param {{get: function(string): (string|undefined), bind?: function, pin?: function}} [opts.keys]
+   *   the node's key registry. Read only to resolve a subject's bound key for `resolver()` and the
+   *   two-argument `resolveRole`; NEVER to verify a grant. A rooted grant's vouched key is pinned
+   *   back into it.
    * @param {string} [opts.dir] when set, grants persist append-only and reload here.
    */
   constructor(opts = {}) {
     this._anchor = opts.anchor || null;
     this._keys = opts.keys || new Map();
     this._byGrantee = new Map(); // grantee nodeId -> [grant/revoke records]
+    this._vouched = new Map();   // nodeId -> Set(keys its rooted role-grants vouch)
+    this._signer = new Map();    // sigKey -> the key that verified the record
     this._seen = new Set();      // sigKey dedup: the signature's bytes, however it is spelled
     this._perGrantor = new Map(); // grantor nodeId -> records kept
     this._perPair = new Map();    // grantor nodeId + NUL + grantee nodeId -> records kept
@@ -79,37 +85,34 @@ class RoleGrantStore {
   }
 
   /**
-   * What the last reload found: records `loaded`, records `skipped` by reason (each a record
-   * that could not be verified — not JSON, malformed, unknown grantor key, bad signature,
-   * unrooted, duplicate), and `unreadable` (why the file could not be read; null when it
-   * could, or when there was none).
+   * What the last reload found: records `loaded`, records `skipped` by reason (each a record that
+   * could not be verified — not JSON, malformed, unknown grantor key, bad signature, unrooted,
+   * duplicate), and `unreadable` (why the file could not be read; null when it could, or none).
    * @returns {{ loaded: number, skipped: Object<string, number>, unreadable: string|null }}
    */
   loadReport() {
     return { loaded: this._loadReport.loaded, skipped: { ...this._loadReport.skipped }, unreadable: this._loadReport.unreadable };
   }
 
-  /** Learn/pin an identity key for verifying a node's grants. */
-  setKey(nodeId, pubKeyB64url) {
-    if (nodeId && pubKeyB64url) this._keys.set(nodeId, pubKeyB64url);
-  }
-
-  _grantorKey(grantedBy) {
-    if (this._anchor && grantedBy === this._anchor.nodeId) return this._anchor.publicKey;
-    return this._keys.get(grantedBy);
+  /**
+   * The keys a grant from `grantedBy` may be verified against: the anchor's configured key, or the
+   * keys `grantedBy`'s own rooted grants vouch. Empty when no chain reaches it.
+   * @returns {string[]}
+   */
+  grantorKeys(grantedBy) {
+    if (this._anchor && grantedBy === this._anchor.nodeId) return [this._anchor.publicKey];
+    return [...(this._vouched.get(grantedBy) || [])];
   }
 
-  /** The key a grant from `grantedBy` is verified against, or undefined: no verification is possible. */
-  grantorKey(grantedBy) { return this._grantorKey(grantedBy); }
+  /** Whether any chain reaches `grantedBy` (a grant from it could verify). */
+  grantorKey(grantedBy) { return this.grantorKeys(grantedBy)[0]; }
 
   /**
-   * Record a signed role-grant / role-revoke, if it is rooted at the anchor. In order: the
-   * record must be well-formed, new (dedup by the signature's bytes, so a re-spelling of a held
-   * signature is a duplicate), within the bounds (see MAX_PER_GRANTOR), from a grantor whose key
-   * the registry resolves, ROOTED (see `_rooted`), and its signature must verify against that key. A
-   * record that fails any of these is refused with the reason and leaves no trace: it is
-   * not held, not written, and the caller does not relay it. Reloading from disk runs the
-   * same checks — the file has no integrity of its own, so nothing is trusted for being on it.
+   * Record a signed role-grant / role-revoke, if it is rooted at the anchor. In order: the record
+   * must be well-formed (a role-grant carries granteeKey), new (dedup by the signature's bytes), within
+   * the bounds, from a grantor some chain reaches, ROOTED under one of the grantor's vouched keys, and
+   * its signature must verify against that key. A record that fails any of these is refused with the
+   * reason and leaves no trace: not held, not written, not relayed.
    * @returns {{ stored: boolean, reason?: string }}
    */
   record(grant) {
@@ -123,98 +126,116 @@ class RoleGrantStore {
       if ((this._perPair.get(pair) || 0) >= this._maxPerPair) return { stored: false, reason: 'pair-full' };
       if (this._seen.size >= this._maxGrants) return { stored: false, reason: 'store-full' };
     }
-    const key = this._grantorKey(grant.grantedBy);
-    if (!key) return { stored: false, reason: 'unknown-grantor-key' };
-    if (!this._rooted(grant)) return { stored: false, reason: 'unrooted' };
-    if (!verifyGrant(grant, key).valid) return { stored: false, reason: 'bad-signature' };
+    const candidates = this.grantorKeys(grant.grantedBy);
+    if (candidates.length === 0) return { stored: false, reason: 'unknown-grantor-key' };
+    // Rooted first (no signature work for a record no key could root), then the signature.
+    const rooted = candidates.filter((k) => this._rooted(grant, k));
+    if (rooted.length === 0) return { stored: false, reason: 'unrooted' };
+    const signer = rooted.find((k) => verifyGrant(grant, k).valid);
+    if (!signer) return { stored: false, reason: 'bad-signature' };
     // Kept in its canonical spelling, the one its signer wrote: a re-spelling verifies too, but the
     // spelling is what relay-once and every other node's dedup see.
     if (sk !== grant.sig) grant = { ...grant, sig: sk };
     this._seen.add(sk);
+    this._signer.set(sk, signer);
     this._perGrantor.set(grant.grantedBy, (this._perGrantor.get(grant.grantedBy) || 0) + 1);
     this._perPair.set(pair, (this._perPair.get(pair) || 0) + 1);
     let arr = this._byGrantee.get(grant.grantee);
     if (!arr) { arr = []; this._byGrantee.set(grant.grantee, arr); }
     arr.push(grant);
+    if (grant.type === 'role-grant') {
+      let v = this._vouched.get(grant.grantee);
+      if (!v) { v = new Set(); this._vouched.set(grant.grantee, v); }
+      v.add(grant.granteeKey);
+    }
     this._append(grant);
     this._pinGranteeKey(grant);
     return { stored: true };
   }
 
   /**
-   * Whether a record is rooted at the anchor: its grantor's role AT THE TIME IT SIGNED,
-   * resolved from the chain this store holds, carries the authority the record needs. A
-   * grant needs the rank it confers (validators grant validator; only anchors grant
-   * anchor); a revoke needs validator or above. Anything else could never change a
-   * resolution, which is why it is not kept. (A grant from a grantor revoked SINCE it
-   * signed is rooted and kept; resolution still gives it no effect while the grantor is
-   * revoked — see resolveRole.)
+   * Whether a record is rooted at the anchor under `signerKey`: its grantor, holding that key, held
+   * at the time it signed the authority the record needs (a grant: the rank it confers; a revoke:
+   * validator or above). (A grant from a grantor revoked SINCE it signed is rooted and kept;
+   * resolution still gives it no effect while the grantor is revoked.)
    * @private
    */
-  _rooted(grant) {
-    const rank = roleRank(this.resolveRole(grant.grantedBy, grant.grantedAt));
+  _rooted(grant, signerKey) {
+    const rank = roleRank(this.resolveRole(grant.grantedBy, signerKey, grant.grantedAt));
     return grant.type === 'role-revoke' ? rank >= 1 : rank >= roleRank(grant.role);
   }
 
   /**
-   * A rooted grant may VOUCH for the grantee's nodeId↔key binding (granteeKey, bound into the
-   * signed payload): pin it into the key registry, so a node that never met the grantee can
-   * verify what it signs. Only rooted grants are kept, so a node whose authority we do not
-   * trust cannot poison the registry. The roster refuses to overwrite a stronger
-   * (handshake/anchor) binding with this grant-sourced one; a plain Map is only filled where
-   * it holds nothing.
+   * A rooted grant VOUCHES for the grantee's nodeId↔key binding: pin it into the key registry at
+   * `grant` strength, through the registry's conflict matrix (a different key already bound is a
+   * conflict, never an override). A plain Map is only filled where it holds nothing.
    * @private
    */
   _pinGranteeKey(grant) {
-    if (grant.type !== 'role-grant' || typeof grant.granteeKey !== 'string' || !grant.granteeKey) return;
-    if (typeof this._keys.pin === 'function') this._keys.pin(grant.grantee, grant.granteeKey, 'grant');
+    if (grant.type !== 'role-grant') return;
+    if (typeof this._keys.bind === 'function') this._keys.bind(grant.grantee, grant.granteeKey, 'grant');
+    else if (typeof this._keys.pin === 'function') this._keys.pin(grant.grantee, grant.granteeKey, 'grant');
     else if (typeof this._keys.set === 'function' && !this._keys.get(grant.grantee)) this._keys.set(grant.grantee, grant.granteeKey);
   }
 
   /**
-   * Resolve the role `nodeId` held at time `at` (ms epoch). Authority only flows from
+   * Resolve the role `nodeId`, holding `key`, held at time `at` (ms epoch). Authority only flows from
    * the anchor:
-   *   - the anchor itself is `anchor`;
-   *   - otherwise, replay `nodeId`'s grants/revokes in chronological order up to `at`:
-   *     a grant confers its role iff the GRANTOR's role AT GRANT TIME outranks-or-
-   *     equals it; a revoke clears to `participant` iff the revoker outranks-or-equals
-   *     the current role. Grantor authority is resolved recursively and must itself
-   *     root at the anchor — a chain that doesn't confers nothing.
+   *   - the anchor itself, holding its configured key, is `anchor`;
+   *   - otherwise, replay `nodeId`'s grants/revokes in chronological order up to `at`: a grant counts
+   *     only if its granteeKey is `key`, and confers its role iff its grantor — holding the key that
+   *     signed the grant — outranked-or-equalled it both when it granted and now; a revoke clears to
+   *     `participant` iff the revoker outranked-or-equalled the current role when it revoked.
    *   - cycles and unrooted chains resolve to `participant` (rank 0).
+   *
+   * Two-argument form `resolveRole(nodeId, at)`: `key` is the registry's binding for `nodeId`.
+   *
    * @param {string} nodeId
+   * @param {string|undefined} key
    * @param {number} at - ms epoch
    * @returns {'participant'|'validator'|'anchor'}
    */
-  resolveRole(nodeId, at, _seen = new Set()) {
-    if (this._anchor && nodeId === this._anchor.nodeId) return 'anchor';
-    if (_seen.has(nodeId)) return 'participant'; // cycle — not anchor-rooted
-    const nextSeen = new Set([..._seen, nodeId]);
+  resolveRole(nodeId, key, at, _seen) {
+    if (typeof key === 'number' && at === undefined) { at = key; key = this._boundKey(nodeId); }
+    if (at === undefined) at = Date.now();
+    if (this._anchor && nodeId === this._anchor.nodeId) return key === this._anchor.publicKey ? 'anchor' : 'participant';
+    if (typeof key !== 'string' || !key) return 'participant';
+    const seen = _seen || new Set();
+    const self = `${nodeId}\u0000${key}`;
+    if (seen.has(self)) return 'participant'; // cycle — not anchor-rooted
+    const nextSeen = new Set([...seen, self]);
     const records = (this._byGrantee.get(nodeId) || [])
       .filter(g => (g.grantedAt ?? 0) <= at)
       .sort((a, b) => (a.grantedAt ?? 0) - (b.grantedAt ?? 0)); // chronological
     let role = 'participant';
     for (const g of records) {
-      // A grant confers only if the grantor was authorised WHEN it granted (so a
-      // grant signed before the grantor held rank never activates) AND is still
-      // authorised NOW (so revoking/demoting a grantor cascades to everything it
-      // granted, and a since-revoked grantor cannot backdate a fresh grant to before
-      // its own revoke to resurrect authority). A revoke is sticky: it takes effect
-      // on the revoker's rank AT REVOKE TIME and is not undone by the revoker's later
-      // demotion — you do not un-revoke because the revoker was later removed.
-      const rankThen = roleRank(this.resolveRole(g.grantedBy, g.grantedAt ?? 0, nextSeen));
+      // A grant confers only if the grantor was authorised WHEN it granted (so a grant signed before
+      // the grantor held rank never activates) AND is still authorised NOW (so revoking/demoting a
+      // grantor cascades to everything it granted, and a since-revoked grantor cannot backdate a fresh
+      // grant to before its own revoke to resurrect authority). A revoke is sticky: it takes effect on
+      // the revoker's rank AT REVOKE TIME and is not undone by the revoker's later demotion.
+      if (g.type === 'role-grant' && g.granteeKey !== key) continue;
+      const signer = this._signer.get(g.sig);
+      const rankThen = roleRank(this.resolveRole(g.grantedBy, signer, g.grantedAt ?? 0, nextSeen));
       if (g.type === 'role-revoke') {
         if (rankThen >= roleRank(role)) role = 'participant';
       } else {
-        const rankNow = roleRank(this.resolveRole(g.grantedBy, at, nextSeen));
+        const rankNow = roleRank(this.resolveRole(g.grantedBy, signer, at, nextSeen));
         if (Math.min(rankThen, rankNow) >= roleRank(g.role)) role = g.role;
       }
     }
     return role;
   }
 
-  /** A resolver bound to this store, for `verifyAttestationRole(att, resolver)`. */
+  /** @private The key the registry binds `nodeId` to (the anchor's configured key for the anchor). */
+  _boundKey(nodeId) {
+    if (this._anchor && nodeId === this._anchor.nodeId) return this._anchor.publicKey;
+    try { return this._keys.get(nodeId); } catch { return undefined; }
+  }
+
+  /** A resolver bound to this store, for `verifyAttestationRole(att, resolver)`: the subject's bound key. */
   resolver() {
-    return (nodeId, at) => this.resolveRole(nodeId, at ?? Date.now());
+    return (nodeId, at) => this.resolveRole(nodeId, this._boundKey(nodeId), at ?? Date.now());
   }
 
   /** All grant/revoke records for a grantee (chronological). */
@@ -235,14 +256,13 @@ class RoleGrantStore {
   }
 
   /**
-   * Reload the grant file through `record` — the same checks a frame gets. A rooted record
-   * can only be rooted by records before it in time, not necessarily before it in the file
-   * (0.13.16 kept unrooted records, some of which an anchor grant later rooted), so records
-   * refused for a reason a later record can cure (`unknown-grantor-key`: the key arrives
-   * vouched in a grant; `unrooted`: the grantor's own grant arrives) are retried until a
-   * pass adds nothing. What is left is skipped and counted, as is a record whose check
-   * fails in a way no reason names ('unverifiable'). Never throws: a file that cannot be
-   * read leaves the store with no grants and `loadReport().unreadable` saying why.
+   * Reload the grant file through `record` — the same checks a frame gets. A rooted record can only
+   * be rooted by records before it in time, not necessarily before it in the file, so records refused
+   * for a reason a later record can cure (`unknown-grantor-key`: the grantor's own grant, vouching its
+   * key, arrives later; `unrooted`: likewise) are retried until a pass adds nothing. What is left is
+   * skipped and counted, as is a record whose check fails in a way no reason names ('unverifiable').
+   * Never throws: a file that cannot be read leaves the store with no grants and
+   * `loadReport().unreadable` saying why.
    * @private
    */
   _load() {
@@ -262,7 +282,7 @@ class RoleGrantStore {
         if (!line.trim()) continue;
         try { pending.push(JSON.parse(line)); } catch { skip('not-json'); }
       }
-      const curable = new Set(['unknown-grantor-key', 'unrooted']);
+      const curable = new Set(['unknown-grantor-key', 'unrooted', 'bad-signature']);
       let reasons = [];
       let progress = true;
       while (progress && pending.length) {
@@ -292,8 +312,9 @@ function malformed(g) {
   for (const f of ['grantee', 'grantedBy', 'sig']) if (typeof g[f] !== 'string' || !g[f]) return true;
   if (!Number.isFinite(g.grantedAt)) return true;
   if (g.granteeKey !== undefined && typeof g.granteeKey !== 'string') return true;
-  // A grant confers a rank above participant, or it confers nothing.
-  return g.type === 'role-grant' && roleRank(g.role) < 1;
+  if (g.type === 'role-revoke') return false;
+  // A grant confers a rank above participant, on the holder of one key, or it confers nothing.
+  return roleRank(g.role) < 1 || typeof g.granteeKey !== 'string' || !/^[A-Za-z0-9_-]{43}$/.test(g.granteeKey);
 }
 
 module.exports = { RoleGrantStore };
diff --git a/lib/roster-keys.js b/lib/roster-keys.js
index 147c3a18..8c076771 100644
--- a/lib/roster-keys.js
+++ b/lib/roster-keys.js
@@ -2,125 +2,362 @@
 
 /**
  * @module @sym-bot/sym/roster-keys
- * @description Roster key registry — the authenticated nodeId→publicKey map a node
- * uses to verify signatures from peers it may never have directly handshook.
+ * @description The key registry: the ONE place where a nodeId gets an identity key (design D3,
+ * Core Secure identity, 2026-10-02).
  *
- * A `nodeId` is a uuidv7, independent of the node's Ed25519 key, so a key carried in
- * a relayed frame is NOT self-verifying — the binding must come from an authenticated
- * source. This registry pins bindings by SOURCE PRECEDENCE, strongest wins:
+ * A nodeId is a UUID v7 bound to an Ed25519 key through an authenticated transcript (MMP §18.3),
+ * and a node has one key for life (§3.4). So a binding, once made, is never replaced by a
+ * different key, whatever the source. The 0.13 rule "a strictly stronger source overrides" is
+ * gone: it let any later source that outranked the first repoint a key.
  *
- *   anchor    (2) — the pinned founder root; configured out-of-band, never overridden.
- *   handshake (1) — learned on a direct authenticated connection (the peer proved the key).
- *   grant     (0) — VOUCHED along the rooted authority chain: a grant whose grantor
- *                   actually held the rank binds the grantee's key into its signed
- *                   payload, so a node that never met the grantee still learns its key,
- *                   tamper-evidently (swapping the key breaks the grantor's signature).
+ * Sources, strongest first:
+ *   anchor        — the configured anchor (§6.5/§6.6). Read from configuration at every start and
+ *                   NEVER persisted to or replayed from the file, so re-pinning a fresh anchor out
+ *                   of band takes effect at the next start.
+ *   proven        — a confirmed §5.2 session proved possession of the key.
+ *   pinned        — an out-of-band binding: an accepted invite naming the issuer's key, a Legacy
+ *                   Import route's mandatory fingerprint, or an operator's resolution of a conflict.
+ *   grant         — vouched by an anchor-rooted role grant (granteeKey, inside the signed payload).
+ *   legacy-claim  — every pre-0.14 `handshake` entry, relabelled on first load. It was learned from
+ *                   an unproven hello, so it verifies nothing; it is the EXPECTED key: a proven
+ *                   session presenting it binds `proven`, and one presenting a different key is a
+ *                   conflict, so a squatter racing the upgrade cannot take an honest node's id.
  *
- * The relayer never vouches: a forwarded grant/attestation is trusted only because the
- * ORIGINATOR signed it, verified against the key this registry pins. A weaker-or-equal
- * source can never overwrite a stronger binding, so a gossiped grant cannot repoint a
- * key learnt from a direct handshake or the pinned anchor. Conflicts at equal strength
- * are refused (first binding holds) and surfaced as evidence, not silently merged.
+ * The conflict matrix:
  *
- * Duck-types Map's `get`/`set` so it can drop in wherever a plain key map was used.
- * Persisted append-only and reloaded on construction.
+ *   nodeId unbound, any source            → bind at that source
+ *   nodeId bound, same key, any source    → keep; record the stronger source
+ *   nodeId bound, DIFFERENT key, any      → conflict: refused, recorded (roster-conflicts.jsonl),
+ *                                           shown in `sym status`; the operator resolves it
+ *   the configured anchor                 → always its configured key
+ *
+ * Only `anchor`, `proven`, `pinned` and `grant` bindings verify anything (`get`). A `legacy-claim`
+ * is reported by `expected` and by `source`, never by `get`.
+ *
+ * The sticky floor of Legacy Import (design D7) is derived from here, not kept in memory: a nodeId
+ * with a `proven` binding has spoken Core Secure, so its legacy route is refused until an operator
+ * resets the floor (`resetFloor`), which is persisted too.
+ *
+ * File format (roster-keys.jsonl): a version marker line `{"v":2,...}`, then one JSON line per
+ * binding event. A 0.13 reader skips the marker as malformed and reads the rest. A file without the
+ * marker is a 0.13 file: it is replayed by the 0.13 rules, its `handshake` entries become
+ * `legacy-claim`, its `anchor` entries are dropped, and it is rewritten once, atomically, with the
+ * marker (idempotent: a marked file is never migrated again).
  *
  * @copyright 2026 SYM.BOT. Apache 2.0 License.
  */
 
 const fs = require('fs');
 const path = require('path');
+const crypto = require('crypto');
 
 const KEYS_FILE = 'roster-keys.jsonl';
-const SOURCE_RANK = Object.freeze({ grant: 0, handshake: 1, anchor: 2 });
-function sourceRank(s) { return SOURCE_RANK[s] ?? 0; }
+const CONFLICTS_FILE = 'roster-conflicts.jsonl';
+const FORMAT_MARKER = Object.freeze({ v: 2, format: 'sym-roster-keys', note: 'sym 0.14 key registry; a 0.13 reader skips this line' });
+
+/** Strength, for "record the stronger source" on the same key. The anchor is configuration. */
+const SOURCE_RANK = Object.freeze({ 'legacy-claim': 1, grant: 2, pinned: 3, proven: 4, anchor: 5 });
+const VERIFYING = new Set(['anchor', 'proven', 'pinned', 'grant']);
+const SOURCES = new Set(Object.keys(SOURCE_RANK));
+const rankOf = (s) => SOURCE_RANK[s] ?? 0;
+
+/** Bindings kept at most (new proven/grant/legacy bindings are refused past it; pinned never are). */
+const MAX_BINDINGS = 65536;
+/** Conflicts recorded at most per nodeId, and in all; past either, a conflict is only counted. */
+const MAX_CONFLICTS_PER_NODE = 8;
+const MAX_CONFLICTS = 1024;
+
+/** An Ed25519 public key as the wire carries it: 32 raw bytes, unpadded base64url. */
+function isIdentityKey(k) {
+  return typeof k === 'string' && /^[A-Za-z0-9_-]{43}$/.test(k) && Buffer.from(k, 'base64url').length === 32;
+}
+const isNodeId = (id) => typeof id === 'string' && id.length > 0 && id.length <= 256;
+
+/** sha256 fingerprint of a raw identity key, as `sha256:<hex>`. */
+function keyFingerprint(keyB64url) {
+  return `sha256:${crypto.createHash('sha256').update(Buffer.from(String(keyB64url), 'base64url')).digest('hex')}`;
+}
 
 class RosterKeyRegistry {
   /**
    * @param {object} [opts]
-   * @param {{nodeId: string, publicKey: string}} [opts.anchor] pinned at 'anchor' strength.
-   * @param {string} [opts.dir] when set, bindings persist append-only and reload here.
+   * @param {{nodeId: string, publicKey: string}} [opts.anchor] the configured anchor; never persisted.
+   * @param {string} [opts.dir] when set, bindings persist here and reload.
+   * @param {number} [opts.maxBindings]
+   * @param {function} [opts.log]
    */
   constructor(opts = {}) {
-    this._byNode = new Map();   // nodeId -> { key, source, at }
-    this._conflicts = [];       // refused equal/weaker rebindings (omission/impersonation evidence)
+    this._byNode = new Map();       // nodeId -> { key, source, at }
+    this._conflicts = [];           // { nodeId, had, hadSource, got, gotSource, at }
+    this._conflictCount = 0;        // every conflict, recorded or not
+    this._floorReset = new Set();   // nodeIds whose sticky floor an operator reset
     this._dir = opts.dir || null;
+    this._max = opts.maxBindings || MAX_BINDINGS;
+    this._log = typeof opts.log === 'function' ? opts.log : () => {};
+    this._anchor = opts.anchor && isNodeId(opts.anchor.nodeId) && opts.anchor.publicKey
+      ? { nodeId: opts.anchor.nodeId, publicKey: opts.anchor.publicKey } : null;
     this._loading = false;
+    this._migration = null;
     if (this._dir) {
       try { fs.mkdirSync(this._dir, { recursive: true }); } catch { /* best effort */ }
       this._load();
     }
-    if (opts.anchor && opts.anchor.nodeId && opts.anchor.publicKey) {
-      this.pin(opts.anchor.nodeId, opts.anchor.publicKey, 'anchor');
-    }
+  }
+
+  // ── Reads ──────────────────────────────────────────────────────────────────────
+
+  /** The key that verifies `nodeId`'s signatures, or undefined. Never a legacy claim. */
+  get(nodeId) {
+    if (this._anchor && nodeId === this._anchor.nodeId) return this._anchor.publicKey;
+    const b = this._byNode.get(nodeId);
+    return b && VERIFYING.has(b.source) ? b.key : undefined;
+  }
+
+  /** The key bound to `nodeId` at any source, a legacy claim included, or undefined. */
+  expected(nodeId) {
+    if (this._anchor && nodeId === this._anchor.nodeId) return this._anchor.publicKey;
+    return this._byNode.get(nodeId)?.key;
+  }
+
+  /** The source of `nodeId`'s binding: anchor | proven | pinned | grant | legacy-claim | undefined. */
+  source(nodeId) {
+    if (this._anchor && nodeId === this._anchor.nodeId) return 'anchor';
+    return this._byNode.get(nodeId)?.source;
+  }
+
+  /** Whether `nodeId` has a binding that verifies (not a legacy claim). */
+  has(nodeId) { return this.get(nodeId) !== undefined; }
+
+  /** Bindings held (the anchor, which is configuration, is not one). */
+  size() { return this._byNode.size; }
+
+  /** The conflicts recorded (each a refused binding of a bound nodeId to a different key). */
+  conflicts() { return this._conflicts.map((c) => ({ ...c })); }
+
+  /** How many conflicts happened since this registry was built, recorded or only counted. */
+  conflictCount() { return this._conflictCount; }
+
+  /** What the first load of a 0.13 file did, or null when the file was already 0.14's. */
+  migration() { return this._migration ? { ...this._migration } : null; }
+
+  /** Every binding, for status and tests: [{ nodeId, key, source, at }]. */
+  entries() {
+    const out = [...this._byNode].map(([nodeId, b]) => ({ nodeId, key: b.key, source: b.source, at: b.at }));
+    if (this._anchor) out.unshift({ nodeId: this._anchor.nodeId, key: this._anchor.publicKey, source: 'anchor', at: null });
+    return out;
   }
 
   /**
-   * Pin a nodeId→key binding from a named source. A binding is accepted iff there is
-   * no existing binding, or the new source strictly outranks the existing one, or it
-   * re-affirms the SAME key. A different key at equal-or-weaker strength is refused and
-   * recorded as a conflict — never silently overwrites stronger trust.
+   * The sticky floor (design D7): true when `nodeId` has proven itself over Core Secure and no
+   * operator has reset its floor since. Derived from the persisted registry, so it survives restarts.
+   */
+  floor(nodeId) {
+    return this.source(nodeId) === 'proven' && !this._floorReset.has(nodeId);
+  }
+
+  // ── Writes ─────────────────────────────────────────────────────────────────────
+
+  /**
+   * Bind `nodeId` to `key` from `source`, by the conflict matrix.
    * @param {string} nodeId
-   * @param {string} keyB64url
-   * @param {'anchor'|'handshake'|'grant'} source
-   * @returns {{ pinned: boolean, reason?: string }}
+   * @param {string} key - base64url Ed25519 public key
+   * @param {'proven'|'pinned'|'grant'|'legacy-claim'} source
+   * @returns {{ bound: boolean, source?: string, reason?: 'malformed'|'conflict'|'full', had?: string }}
    */
-  pin(nodeId, keyB64url, source = 'grant') {
-    if (!nodeId || !keyB64url) return { pinned: false, reason: 'malformed' };
-    const existing = this._byNode.get(nodeId);
-    if (existing) {
-      if (existing.key === keyB64url) {
-        // same key — upgrade the recorded source if the new one is stronger
-        if (sourceRank(source) > sourceRank(existing.source)) {
-          existing.source = source;
-          this._persist(nodeId, keyB64url, source);
+  bind(nodeId, key, source, { at = Date.now() } = {}) {
+    if (!isNodeId(nodeId) || !isIdentityKey(key) || !SOURCES.has(source) || source === 'anchor') {
+      return { bound: false, reason: 'malformed' };
+    }
+    if (this._anchor && nodeId === this._anchor.nodeId) {
+      // The anchor's key is its configured one, whatever any other source says.
+      if (key === this._anchor.publicKey) return { bound: true, source: 'anchor' };
+      this._recordConflict(nodeId, this._anchor.publicKey, 'anchor', key, source, at);
+      return { bound: false, reason: 'conflict', had: this._anchor.publicKey };
+    }
+    const b = this._byNode.get(nodeId);
+    if (b) {
+      if (b.key === key) {
+        if (rankOf(source) > rankOf(b.source)) {
+          b.source = source;
+          // A proven binding re-arms the sticky floor an operator reset earlier.
+          if (source === 'proven' && this._floorReset.delete(nodeId)) this._persist({ nodeId, floorReset: false });
+          this._persist({ nodeId, key, source });
         }
-        return { pinned: true };
-      }
-      if (sourceRank(source) <= sourceRank(existing.source)) {
-        this._conflicts.push({ nodeId, had: existing.key, got: keyB64url, source, at: existing.at });
-        return { pinned: false, reason: 'conflict' };
+        return { bound: true, source: b.source };
       }
-      // strictly stronger source overrides a weaker binding (e.g. a direct handshake
-      // corrects a previously grant-vouched key)
+      this._recordConflict(nodeId, b.key, b.source, key, source, at);
+      return { bound: false, reason: 'conflict', had: b.key };
     }
-    const rec = { key: keyB64url, source, at: existing?.at ?? null };
-    this._byNode.set(nodeId, rec);
-    this._persist(nodeId, keyB64url, source);
-    return { pinned: true };
+    if (this._byNode.size >= this._max && source !== 'pinned') return { bound: false, reason: 'full' };
+    this._byNode.set(nodeId, { key, source, at });
+    this._persist({ nodeId, key, source });
+    return { bound: true, source };
   }
 
-  /** Map-compatible read: the pinned public key for a nodeId, or undefined. */
-  get(nodeId) { return this._byNode.get(nodeId)?.key; }
+  /**
+   * 0.13-compatible spelling of bind, for callers that pin a vouched key (`pin(id, key, 'grant')`).
+   * @returns {{ pinned: boolean, reason?: string }}
+   */
+  pin(nodeId, key, source = 'grant') {
+    const r = this.bind(nodeId, key, source === 'handshake' ? 'legacy-claim' : source);
+    return r.bound ? { pinned: true } : { pinned: false, reason: r.reason };
+  }
 
-  /** Map-compatible write: pin at the default 'grant' strength (used as a key map drop-in). */
-  set(nodeId, keyB64url) { this.pin(nodeId, keyB64url, 'grant'); return this; }
+  /** Map-compatible write, at `grant` strength. */
+  set(nodeId, key) { this.bind(nodeId, key, 'grant'); return this; }
 
-  has(nodeId) { return this._byNode.has(nodeId); }
-  source(nodeId) { return this._byNode.get(nodeId)?.source; }
-  size() { return this._byNode.size; }
-  conflicts() { return this._conflicts.slice(); }
+  /**
+   * The operator resolves a conflict for `nodeId`: `key` becomes its binding at `pinned`, whatever
+   * was bound before, and the conflicts recorded for it are cleared. This is the one way a binding
+   * changes key, and it is an operator's act (`sym keys resolve`), never a source's.
+   * @returns {{ resolved: boolean, reason?: string }}
+   */
+  resolveConflict(nodeId, key) {
+    if (!isNodeId(nodeId) || !isIdentityKey(key)) return { resolved: false, reason: 'malformed' };
+    if (this._anchor && nodeId === this._anchor.nodeId) return { resolved: false, reason: 'anchor' };
+    this._byNode.set(nodeId, { key, source: 'pinned', at: Date.now() });
+    this._persist({ nodeId, key, source: 'pinned', operator: true });
+    this._conflicts = this._conflicts.filter((c) => c.nodeId !== nodeId);
+    this._rewriteConflicts();
+    return { resolved: true };
+  }
 
-  // ── Durable persistence (append-only; last write per nodeId wins on reload) ──────
+  /** The operator resets `nodeId`'s sticky floor: its Legacy Import route may be used again. */
+  resetFloor(nodeId) {
+    if (!isNodeId(nodeId)) return false;
+    this._floorReset.add(nodeId);
+    this._persist({ nodeId, floorReset: true });
+    return true;
+  }
 
-  _persist(nodeId, key, source) {
+  // ── Internals ──────────────────────────────────────────────────────────────────
+
+  _recordConflict(nodeId, had, hadSource, got, gotSource, at) {
+    this._conflictCount++;
+    if (this._loading) return; // a conflict in the file was recorded when it happened
+    if (this._conflicts.some((c) => c.nodeId === nodeId && c.got === got)) return;
+    if (this._conflicts.length >= MAX_CONFLICTS) return;
+    if (this._conflicts.filter((c) => c.nodeId === nodeId).length >= MAX_CONFLICTS_PER_NODE) return;
+    const c = { nodeId, had, hadSource, got, gotSource, at };
+    this._conflicts.push(c);
+    this._log(`Key conflict: ${String(nodeId).slice(0, 8)} is bound to ${keyFingerprint(had).slice(0, 19)} (${hadSource}); refused ${keyFingerprint(got).slice(0, 19)} (${gotSource}). Resolve with: sym keys resolve ${nodeId} <key>`);
+    if (!this._dir) return;
+    try { fs.appendFileSync(path.join(this._dir, CONFLICTS_FILE), JSON.stringify(c) + '\n'); } catch { /* best effort */ }
+  }
+
+  _rewriteConflicts() {
+    if (!this._dir) return;
+    const file = path.join(this._dir, CONFLICTS_FILE);
+    try {
+      const tmp = `${file}.${process.pid}.tmp`;
+      fs.writeFileSync(tmp, this._conflicts.map((c) => JSON.stringify(c) + '\n').join(''));
+      fs.renameSync(tmp, file);
+    } catch { /* best effort */ }
+  }
+
+  _persist(rec) {
     if (!this._dir || this._loading) return;
-    try { fs.appendFileSync(path.join(this._dir, KEYS_FILE), JSON.stringify({ nodeId, key, source }) + '\n'); }
+    try { fs.appendFileSync(path.join(this._dir, KEYS_FILE), JSON.stringify(rec) + '\n'); }
     catch { /* best effort — never let persistence break verification */ }
   }
 
   _load() {
+    const file = path.join(this._dir, KEYS_FILE);
+    let text = null;
+    try { text = fs.readFileSync(file, 'utf8'); } catch { text = null; }
+    this._loadConflicts();
+    if (text === null) { this._writeFresh(); return; }
+    let marked = false;
+    const records = [];
+    for (const line of text.split('\n')) {
+      if (!line.trim()) continue;
+      let r;
+      try { r = JSON.parse(line); } catch { continue; }
+      if (r && typeof r === 'object' && r.v === 2 && r.format === FORMAT_MARKER.format) { marked = true; continue; }
+      records.push(r);
+    }
     this._loading = true;
+    try {
+      if (!marked) this._migrate013(records);
+      else for (const r of records) this._replay(r);
+    } finally { this._loading = false; }
+    if (!marked) this._compact();
+  }
+
+  /** Replay one 0.14 line. A 0.13 rollback may have appended lines in its own vocabulary. */
+  _replay(r) {
+    if (!r || typeof r !== 'object' || !isNodeId(r.nodeId)) return;
+    if (r.floorReset === true) { this._floorReset.add(r.nodeId); return; }
+    if (r.floorReset === false) { this._floorReset.delete(r.nodeId); return; }
+    let source = r.source;
+    if (source === 'anchor') return;                       // configuration, never replayed
+    if (source === 'handshake') source = 'legacy-claim';   // a 0.13 rollback's unproven hello
+    if (!SOURCES.has(source) || !isIdentityKey(r.key)) return;
+    if (r.operator === true) { this._byNode.set(r.nodeId, { key: r.key, source: 'pinned', at: null }); return; }
+    this.bind(r.nodeId, r.key, source, { at: null });
+  }
+
+  /**
+   * A 0.13 file: replayed by the 0.13 rules (first binding holds, a strictly stronger source of
+   * handshake > grant overrode it), so the binding 0.13 used is the one kept; then relabelled.
+   */
+  _migrate013(records) {
+    const rank013 = { grant: 0, handshake: 1, anchor: 2 };
+    const final = new Map();
+    let read = 0;
+    for (const r of records) {
+      if (!r || typeof r !== 'object' || !isNodeId(r.nodeId) || typeof r.key !== 'string') continue;
+      read++;
+      const prev = final.get(r.nodeId);
+      const s = rank013[r.source] ?? 0;
+      if (!prev || (prev.key !== r.key && s > (rank013[prev.source] ?? 0))) final.set(r.nodeId, { key: r.key, source: r.source });
+      else if (prev.key === r.key && s > (rank013[prev.source] ?? 0)) prev.source = r.source;
+    }
+    const counts = { read, bindings: 0, legacyClaim: 0, grant: 0, droppedAnchor: 0, droppedMalformed: 0 };
+    for (const [nodeId, b] of final) {
+      if (b.source === 'anchor') { counts.droppedAnchor++; continue; }
+      if (!isIdentityKey(b.key)) { counts.droppedMalformed++; continue; }
+      const source = b.source === 'grant' ? 'grant' : 'legacy-claim';
+      this._byNode.set(nodeId, { key: b.key, source, at: null });
+      counts.bindings++;
+      counts[source === 'grant' ? 'grant' : 'legacyClaim']++;
+    }
+    this._migration = counts;
+  }
+
+  /** Rewrite the file as marker + one line per binding (and floor reset), atomically. */
+  _compact() {
+    const file = path.join(this._dir, KEYS_FILE);
+    const lines = [JSON.stringify(FORMAT_MARKER)];
+    for (const [nodeId, b] of this._byNode) lines.push(JSON.stringify({ nodeId, key: b.key, source: b.source }));
+    for (const nodeId of this._floorReset) lines.push(JSON.stringify({ nodeId, floorReset: true }));
+    try {
+      const tmp = `${file}.${process.pid}.tmp`;
+      fs.writeFileSync(tmp, lines.join('\n') + '\n');
+      fs.renameSync(tmp, file);
+    } catch (err) {
+      this._log(`Key registry: could not rewrite ${file} (${err.code || err.message}); it is migrated again at the next start`);
+    }
+  }
+
+  _writeFresh() {
+    try { fs.writeFileSync(path.join(this._dir, KEYS_FILE), JSON.stringify(FORMAT_MARKER) + '\n', { flag: 'wx' }); }
+    catch { /* another writer made it, or the dir is not writable */ }
+  }
+
+  _loadConflicts() {
     let text;
-    try { text = fs.readFileSync(path.join(this._dir, KEYS_FILE), 'utf8'); }
-    catch { this._loading = false; return; }
+    try { text = fs.readFileSync(path.join(this._dir, CONFLICTS_FILE), 'utf8'); } catch { return; }
     for (const line of text.split('\n')) {
       if (!line.trim()) continue;
-      try { const r = JSON.parse(line); this.pin(r.nodeId, r.key, r.source); }
-      catch { /* skip corrupt line */ }
+      let c;
+      try { c = JSON.parse(line); } catch { continue; }
+      if (!c || !isNodeId(c.nodeId) || typeof c.got !== 'string') continue;
+      if (this._conflicts.some((x) => x.nodeId === c.nodeId && x.got === c.got)) continue;
+      if (this._conflicts.length >= MAX_CONFLICTS) break;
+      this._conflicts.push(c);
     }
-    this._loading = false;
   }
 }
 
-module.exports = { RosterKeyRegistry, SOURCE_RANK };
+module.exports = { RosterKeyRegistry, SOURCE_RANK, isIdentityKey, keyFingerprint, KEYS_FILE, CONFLICTS_FILE, FORMAT_MARKER };
diff --git a/lib/session.js b/lib/session.js
new file mode 100644
index 00000000..97e047f4
--- /dev/null
+++ b/lib/session.js
@@ -0,0 +1,414 @@
+'use strict';
+
+/**
+ * @module @sym-bot/sym/session
+ * @description A Core Secure session over one transport: the MMP v2.0 §5.2 handshake driven over a
+ * TCP connection, the loopback, or a relay channel, and then the sealed, ordered channel it opens
+ * (design D1/D2, sym 0.14).
+ *
+ * THE SESSION IS THE UNIT OF TRUST. Before 0.14 a peer existed the moment a socket connected or the
+ * relay announced a name, and its keys were pinned from an unproven hello. Here nothing about the
+ * peer exists until both proofs validate: the identity proof (Ed25519 over the transcript) and the
+ * key confirmation (HMAC under the X25519/HKDF schedule). A failure closes the transport and keeps no
+ * peer state (§5.2). What a confirmed session knows — the proven nodeId, identity key, this session's
+ * ephemeral X25519 key, sessionId, room, selected extensions — is all a peer is.
+ *
+ * Rules this module enforces:
+ *   - The dialler is the client and sends `client-hello`; the listener accepts `client-hello` and
+ *     nothing else, and no other frame before `client-finish` (§5.2, §5.3). 10 s timeout.
+ *   - A fresh X25519 key pair per handshake, generated here. Private keys are never injectable
+ *     through configuration: only the pure handshake functions take them, for the public vectors.
+ *   - An all-zero shared secret aborts (§5.2.1).
+ *   - Every hello field is checked at the door (types, lengths, encodings) before it is used.
+ *   - `cmb-encrypted-v2` must be selected: a session that would carry records in the clear is not a
+ *     Core Secure session, and a negotiation failure never falls back to anything (§17.3).
+ *   - After confirmation every frame is sealed: records as `cmb-encrypted` (§18.2.1), every other
+ *     frame but ping/pong/error as `control-encrypted` (lib/core/sealed-control.js). The receive
+ *     counter advances only after the AEAD opens; a forged frame moves nothing; an authentic frame
+ *     out of order (replay, rollback, gap) closes the session so the owner re-handshakes.
+ *
+ * The session emits:
+ *   'confirmed' (session)            — both proofs valid; the facts are on the session
+ *   'frame' (frame, session)         — one authenticated inner frame ({type:'cmb', cmb} for a record)
+ *   'refused' (type, reason, session)— a wire frame this session does not take (counted by the owner)
+ *   'closed' ({ reason, desync }, session)
+ *
+ * @copyright 2026 SYM.BOT. Apache 2.0 License.
+ */
+
+const crypto = require('crypto');
+const { EventEmitter } = require('events');
+const { clientHello, serverAccept, clientFinish, serverConfirm, PROTOCOL_VERSION } = require('./core/handshake-v2-flow');
+const { EXT_CMB_ENCRYPTED_V2 } = require('./core/mmp-extensions');
+const { buildEncryptedFrame, openEncryptedFrame, FRAME_TYPE: CMB_ENCRYPTED } = require('./core/cmb-encrypted-frame');
+const { buildControlFrame, openControlFrame, FRAME_TYPE: CONTROL_ENCRYPTED } = require('./core/sealed-control');
+const { SEND_FAILURE, MAX_FRAME_SIZE } = require('./frame-parser');
+
+const HANDSHAKE_TIMEOUT_MS = 10_000;
+const HANDSHAKE_TYPES = new Set(['client-hello', 'server-hello', 'client-finish']);
+/** Room left for a relay envelope ({to, payload}) around a sealed frame. */
+const ENVELOPE_ALLOWANCE = 4096;
+const X25519_SPKI_PREFIX = Buffer.from('302a300506032b656e032100', 'hex');
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const B64_32 = /^[A-Za-z0-9_-]{43}$/;
+const SIG_RE = /^[A-Za-z0-9_-]{86}$/;
+const EXT_RE = /^[a-z0-9][a-z0-9._-]{0,63}$/;
+let SEQ = 0;
+
+const b64 = (buf) => Buffer.from(buf).toString('base64url');
+
+/** A fresh X25519 key pair for one handshake. */
+function freshX25519() {
+  const { publicKey, privateKey } = crypto.generateKeyPairSync('x25519');
+  return { privateKey, publicKey: b64(publicKey.export({ type: 'spki', format: 'der' }).subarray(-32)) };
+}
+
+/**
+ * X25519 against a raw base64url peer key. Throws for a key that is not 32 bytes, an agreement the
+ * library refuses, and an all-zero result (a low-order point: §5.2.1 MUST abort).
+ */
+function agreeX25519(privateKey, peerRawB64url, dh = crypto.diffieHellman) {
+  const raw = Buffer.from(String(peerRawB64url), 'base64url');
+  if (raw.length !== 32) throw new Error('handshake: the peer X25519 key is not 32 bytes');
+  let ss;
+  try {
+    // OpenSSL itself refuses the low-order points it knows; the all-zero check below does not rely on it.
+    ss = dh({ privateKey, publicKey: crypto.createPublicKey({ key: Buffer.concat([X25519_SPKI_PREFIX, raw]), format: 'der', type: 'spki' }) });
+  } catch (e) {
+    throw new Error(`handshake: X25519 agreement failed (${e.message}) — aborting`);
+  }
+  if (ss.length !== 32 || ss.every((b) => b === 0)) throw new Error('handshake: all-zero X25519 shared secret — aborting (§5.2.1)');
+  return ss;
+}
+
+const is32 = (s) => typeof s === 'string' && B64_32.test(s) && Buffer.from(s, 'base64url').length === 32;
+
+/** A hello's offer, checked field by field before anything uses it. Throws with what is wrong. */
+function checkOffer(f, kind) {
+  if (!f || typeof f !== 'object' || Array.isArray(f)) throw new Error(`handshake: ${kind} is not an object`);
+  if (f.protocolVersion !== PROTOCOL_VERSION) throw new Error('handshake: unsupported protocolVersion');
+  if (typeof f.room !== 'string' || !f.room || f.room.length > 128) throw new Error(`handshake: ${kind} room is not a room`);
+  if (typeof f.nodeId !== 'string' || !UUID_RE.test(f.nodeId)) throw new Error(`handshake: ${kind} nodeId is not a UUID`);
+  if (typeof f.name !== 'string' || !f.name || f.name.length > 256) throw new Error(`handshake: ${kind} name is not a name`);
+  for (const k of ['identityPublicKey', 'e2ePublicKey', 'nonce']) {
+    if (!is32(f[k])) throw new Error(`handshake: ${kind} ${k} is not 32 bytes of unpadded base64url`);
+  }
+  const impl = f.implementation;
+  if (!impl || typeof impl !== 'object' || typeof impl.name !== 'string' || typeof impl.version !== 'string'
+      || !impl.name || !impl.version || impl.name.length > 128 || impl.version.length > 128) {
+    throw new Error(`handshake: ${kind} implementation is not {name, version}`);
+  }
+  checkExtensions(f.extensions, `${kind} extensions`);
+}
+
+function checkExtensions(list, what) {
+  if (!Array.isArray(list) || list.length > 64) throw new Error(`handshake: ${what} is not a list`);
+  const seen = new Set();
+  for (const e of list) {
+    if (typeof e !== 'string' || !EXT_RE.test(e) || seen.has(e)) throw new Error(`handshake: ${what} carries an invalid or repeated entry`);
+    seen.add(e);
+  }
+}
+
+class PeerSession extends EventEmitter {
+  /**
+   * @param {object} o
+   * @param {'client'|'server'} o.role - the dialler is the client
+   * @param {object} o.transport - { trySend(frame)|send(frame), close() }; inbound frames are fed in
+   *   by the owner through receiveWire (a TCP owner wires transport 'message' to it)
+   * @param {'bonjour'|'relay'} o.kind - the transport kind, for multi-transport peers (§4.6)
+   * @param {{nodeId:string, name:string, publicKey:string, privateKey:string}} o.local - this node
+   * @param {string} o.room
+   * @param {string[]} o.extensions - what this node offers
+   * @param {{name:string, version:string}} o.implementation
+   * @param {string} [o.expectNodeId] - the nodeId a dialled candidate claimed, or (server) the relay `from` a
+   *   relay session runs over; a session presenting another is refused
+   * @param {string} [o.relayFrom] - the relay `from` a relay session is bound to
+   * @param {number} [o.timeoutMs]
+   */
+  constructor(o) {
+    super();
+    if (o.role !== 'client' && o.role !== 'server') throw new Error('PeerSession: role must be client|server');
+    this.role = o.role;
+    this.kind = o.kind || 'bonjour';
+    this.id = `${this.kind}:${o.role}:${++SEQ}`;
+    this.transport = o.transport;
+    this.relayFrom = o.relayFrom || null;
+    this.expectNodeId = o.expectNodeId || null;
+    this.room = o.room;
+    this.state = 'authenticating';
+    this.startedAt = Date.now();
+    this.lastSeen = Date.now();
+    this.closedReason = null;
+    // Facts, set only on confirmation.
+    this.nodeId = null; this.name = null; this.identityKey = null; this.peerE2EPublicKey = null;
+    this.sessionId = null; this.selected = []; this.peerExtensions = []; this.peerImplementation = null;
+    this.confirmedAt = null;
+    this._local = o.local;
+    this._offer = [...new Set(o.extensions || [])];
+    this._implementation = o.implementation;
+    this._x = freshX25519();
+    this.localE2EPublicKey = this._x.publicKey;
+    this._mmp = null;
+    this._sharedSecret = null;
+    this._clientHello = null;
+    this._serverAccept = null;
+    const ms = o.timeoutMs ?? HANDSHAKE_TIMEOUT_MS;
+    this._timer = setTimeout(() => this._fail('timeout', `no confirmed handshake within ${ms} ms`), ms);
+    if (this._timer.unref) this._timer.unref();
+  }
+
+  get confirmed() { return this.state === 'confirmed'; }
+  get closed() { return this.state === 'closed'; }
+  /** Transport-shaped: a closed session refuses frames (the peer table reads `_closed`). */
+  get _closed() { return this.state === 'closed'; }
+
+  /** Whether `ext` is active on this session (in both offers and selected, §16.3). */
+  has(ext) { return this.selected.includes(ext); }
+
+  _self() {
+    return {
+      room: this.room, nodeId: this._local.nodeId, name: this._local.name,
+      identityPublicKey: this._local.publicKey, e2ePublicKey: this.localE2EPublicKey,
+      implementation: this._implementation, extensions: this._offer, identityPrivateKey: this._local.privateKey,
+    };
+  }
+
+  _agree() {
+    return (peerKey) => {
+      if (!this._sharedSecret) this._sharedSecret = agreeX25519(this._x.privateKey, peerKey);
+      return this._sharedSecret;
+    };
+  }
+
+  /** CLIENT: send the client-hello. */
+  start() {
+    if (this.role !== 'client' || this._clientHello || this.closed) return;
+    const { frame } = clientHello(this._self());
+    this._clientHello = frame;
+    this._wire(frame);
+  }
+
+  /** Feed one frame from the transport. Never throws: a failure closes the session. */
+  receiveWire(frame) {
+    if (this.closed) return;
+    try {
+      if (!frame || typeof frame !== 'object' || typeof frame.type !== 'string') { this._refuse('?', 'not-a-frame'); return; }
+      if (this.state === 'authenticating') this._handshakeFrame(frame);
+      else this._sessionFrame(frame);
+    } catch (err) {
+      this._fail('error', err && err.message ? err.message : String(err));
+    }
+  }
+
+  _handshakeFrame(f) {
+    if (this.role === 'server') {
+      if (!this._serverAccept) {
+        // The Core Secure listener takes client-hello first and nothing else (§5.2, mmp-ingress).
+        if (f.type !== 'client-hello') { this._fail('first-frame', `the first frame must be client-hello, got '${String(f.type).slice(0, 40)}'`); return; }
+        checkOffer(f, 'client-hello');
+        if (f.nodeId === this._local.nodeId) { this._fail('duplicate-node-id', 'the peer presented this node\'s own nodeId'); return; }
+        // A relay session is bound to the relay `from` it runs over (design D2): a hello naming another
+        // nodeId is refused before anything is computed (the transcript then binds the nodeId proven).
+        if (this.expectNodeId && f.nodeId !== this.expectNodeId) {
+          this._fail('node-id-mismatch', `the session is bound to ${String(this.expectNodeId).slice(0, 8)}, the hello names ${String(f.nodeId).slice(0, 8)}`); return;
+        }
+        if (f.room !== this.room) { this._fail('room-mismatch', `the peer is in '${String(f.room).slice(0, 64)}', this node in '${this.room}'`); return; }
+        const sa = serverAccept({ clientHelloFrame: f, self: this._self(), agree: this._agree() });
+        if (!sa.selected.includes(EXT_CMB_ENCRYPTED_V2)) { this._fail('no-core-secure', 'the client did not offer cmb-encrypted-v2'); return; }
+        this._clientHelloSeen = f;
+        this._serverAccept = sa;
+        this._wire(sa.frame);
+        return;
+      }
+      if (f.type !== 'client-finish') { this._fail('frame-before-finish', `'${String(f.type).slice(0, 40)}' before client-finish`); return; }
+      if (typeof f.transcriptHash !== 'string' || !/^[0-9a-f]{64}$/.test(f.transcriptHash) || typeof f.proof !== 'string' || !SIG_RE.test(f.proof) || !is32(f.keyConfirmation)) {
+        this._fail('error', 'client-finish fields are malformed'); return;
+      }
+      const ch = this._clientHelloSeen;
+      const session = serverConfirm({
+        clientFinishFrame: f, transcript: this._serverAccept.transcript, session: this._serverAccept.session,
+        clientIdentityPublicKey: ch.identityPublicKey, sharedSecret: this._sharedSecret,
+      });
+      this._confirm(session, ch, this._serverAccept.selected);
+      return;
+    }
+    // CLIENT
+    if (f.type !== 'server-hello') { this._fail('frame-before-confirm', `'${String(f.type).slice(0, 40)}' before server-hello`); return; }
+    checkOffer(f, 'server-hello');
+    if (!is32(f.clientNonce) || typeof f.proof !== 'string' || !SIG_RE.test(f.proof) || !is32(f.keyConfirmation)) {
+      this._fail('error', 'server-hello proof fields are malformed'); return;
+    }
+    checkExtensions(f.selectedExtensions, 'selectedExtensions');
+    if (f.nodeId === this._local.nodeId) { this._fail('duplicate-node-id', 'the peer presented this node\'s own nodeId'); return; }
+    if (this.expectNodeId && f.nodeId !== this.expectNodeId) {
+      this._fail('node-id-mismatch', `dialled ${String(this.expectNodeId).slice(0, 8)}, the endpoint proved ${f.nodeId.slice(0, 8)}`); return;
+    }
+    const cf = clientFinish({ serverHelloFrame: f, clientHelloFrame: this._clientHello, self: this._self(), agree: this._agree() });
+    if (!cf.selected.includes(EXT_CMB_ENCRYPTED_V2)) { this._fail('no-core-secure', 'the server did not select cmb-encrypted-v2'); return; }
+    this._wire(cf.frame);
+    this._confirm(cf.session, f, cf.selected);
+  }
+
+  _confirm(mmp, peerOffer, selected) {
+    clearTimeout(this._timer);
+    this._mmp = mmp;
+    this.nodeId = peerOffer.nodeId;
+    this.name = peerOffer.name;
+    this.identityKey = peerOffer.identityPublicKey;
+    this.peerE2EPublicKey = peerOffer.e2ePublicKey;
+    this.peerExtensions = [...peerOffer.extensions];
+    this.peerImplementation = { name: peerOffer.implementation.name, version: peerOffer.implementation.version };
+    this.selected = [...selected];
+    this.sessionId = mmp.sessionId;
+    this.state = 'confirmed';
+    this.confirmedAt = Date.now();
+    this.lastSeen = this.confirmedAt;
+    // The X25519 private key is not needed again: this session's keys are derived.
+    this._x = null;
+    this.emit('confirmed', this);
+  }
+
+  _sessionFrame(f) {
+    switch (f.type) {
+      case CMB_ENCRYPTED: return this._openRecord(f);
+      case CONTROL_ENCRYPTED: return this._openControl(f);
+      case 'ping': this.lastSeen = Date.now(); this._wire({ type: 'pong' }); return;
+      case 'pong': this.lastSeen = Date.now(); return;
+      case 'error':
+        // §7.2: 2xxx errors are informational; anything else ends the session (the peer closed it).
+        if (Number.isInteger(f.code) && f.code >= 2000 && f.code < 3000) return;
+        this._fail('peer-closed', typeof f.message === 'string' ? f.message.slice(0, 200) : 'error frame', { notify: false });
+        return;
+      default:
+        // A legacy `cmb`, a plaintext `mood`, a legacy `handshake`, `state-sync`, a stray hello: none
+        // is taken on a Core Secure session (design D1's frame table).
+        this._refuse(f.type, HANDSHAKE_TYPES.has(f.type) ? 'handshake-after-confirm' : 'not-sealed');
+    }
+  }
+
+  _position(f, open, what) {
+    if (f.sessionId !== this.sessionId) { this._refuse(f.type, 'other-session'); return undefined; }
+    try {
+      const out = this._mmp.receive(f.sequence, f.direction, open);
+      this.lastSeen = Date.now();
+      return out;
+    } catch (err) {
+      if (err && err.name === 'SessionDesyncError') {
+        this._fail('desync', err.message, { desync: true });
+      } else {
+        this._refuse(f.type, `${what} did not authenticate`);
+      }
+      return undefined;
+    }
+  }
+
+  _openRecord(f) {
+    const out = this._position(f, (trafficKey) => openEncryptedFrame({ frame: f, trafficKey }), 'record');
+    if (!out) return;
+    const metadata = { ...out.cmb.metadata };
+    // The clear metadata carries the application descriptor without its data; the bytes ride sealed
+    // as applicationData (§18.2.1). The logical record has them back in metadata.application.data.
+    if (metadata.application && typeof metadata.application === 'object') {
+      if (!out.applicationBytes) { this._refuse(f.type, 'application-without-data'); return; }
+      metadata.application = { ...metadata.application, data: b64(out.applicationBytes) };
+    } else if (out.applicationBytes) {
+      this._refuse(f.type, 'data-without-application'); return;
+    }
+    if (metadata.signatureSuite !== 'mmp-sig-v2.0') { this._refuse(f.type, 'not-a-v2.0-record'); return; }
+    this.emit('frame', { type: 'cmb', cmb: { categories: out.cmb.categories, metadata } }, this);
+  }
+
+  _openControl(f) {
+    const inner = this._position(f, (trafficKey) => openControlFrame({ frame: f, trafficKey }), 'control frame');
+    if (!inner) return;
+    this.emit('frame', inner, this);
+  }
+
+  /**
+   * Transport-shaped send. Records go as `cmb-encrypted`, ping/pong/error as they are, everything
+   * else as `control-encrypted`. Says why a frame was not taken.
+   * @returns {{ ok: boolean, reason?: string, bytes?: number }}
+   */
+  trySend(frame) {
+    if (this.state !== 'confirmed') return { ok: false, reason: SEND_FAILURE.NOT_CONNECTED };
+    if (!frame || typeof frame.type !== 'string') return { ok: false, reason: 'not-a-frame' };
+    if (frame.type === 'ping' || frame.type === 'pong' || frame.type === 'error') return this._wire(frame);
+    let wire;
+    let pos;
+    try {
+      pos = this._mmp.nextSend();
+      wire = frame.type === 'cmb' ? this._sealRecord(frame.cmb, pos) : buildControlFrame({ frame, sessionId: this.sessionId, direction: pos.direction, sequence: pos.sequence, trafficKey: pos.trafficKey });
+    } catch (err) {
+      if (pos) this._mmp.cancelSend(pos.sequence);
+      return { ok: false, reason: 'unsealable', error: err && err.message };
+    }
+    const bytes = Buffer.byteLength(JSON.stringify(wire), 'utf8');
+    if (bytes + (this.kind === 'relay' ? ENVELOPE_ALLOWANCE : 0) > MAX_FRAME_SIZE) {
+      // Never written, so its sequence is reused: the receiver sees no gap.
+      this._mmp.cancelSend(pos.sequence);
+      return { ok: false, reason: SEND_FAILURE.TOO_LARGE, bytes };
+    }
+    const r = this._wire(wire);
+    // A frame the transport refused after its position was taken leaves a gap the peer cannot heal:
+    // the session closes, and the owner re-handshakes.
+    if (!r.ok && r.reason !== SEND_FAILURE.TOO_LARGE) this._fail('send-failed', `the transport refused a sealed frame (${r.reason})`);
+    return r;
+  }
+
+  send(frame) { return this.trySend(frame).ok; }
+
+  _sealRecord(cmb, pos) {
+    if (!cmb || !cmb.metadata || !cmb.categories) throw new Error('not a record');
+    if (cmb.metadata.signatureSuite !== 'mmp-sig-v2.0' || !cmb.metadata.sig) throw new Error('only signed v2.0 records travel in Core Secure (§18.3.1)');
+    const metadata = { ...cmb.metadata };
+    let applicationBytes = null;
+    if (metadata.application && typeof metadata.application === 'object') {
+      const { data, ...descriptor } = metadata.application;
+      if (typeof data !== 'string') throw new Error('an application descriptor without its data');
+      applicationBytes = Buffer.from(data, 'base64url');
+      metadata.application = descriptor;
+    }
+    return buildEncryptedFrame({ cmb: { categories: cmb.categories, metadata }, applicationBytes, sessionId: this.sessionId, direction: pos.direction, sequence: pos.sequence, trafficKey: pos.trafficKey });
+  }
+
+  _wire(frame) {
+    const t = this.transport;
+    if (!t) return { ok: false, reason: SEND_FAILURE.NOT_CONNECTED };
+    try {
+      if (typeof t.trySend === 'function') return t.trySend(frame);
+      return t.send(frame) !== false ? { ok: true } : { ok: false, reason: 'send-failed' };
+    } catch {
+      return { ok: false, reason: SEND_FAILURE.WRITE_FAILED };
+    }
+  }
+
+  _refuse(type, reason) {
+    try { this.emit('refused', String(type).slice(0, 40), reason, this); } catch { /* a listener must not fail the session */ }
+  }
+
+  _fail(reason, detail, { desync = false, notify = true } = {}) {
+    if (this.closed) return;
+    this.close(reason, { detail, desync, notify });
+  }
+
+  /**
+   * Close the session. On a relay, closing means sending an `error` frame to the peer (design D2) and
+   * dropping the session; on TCP the transport closes with it. Emits 'closed' once.
+   */
+  close(reason = 'closed', { detail = null, desync = false, notify = true, closeTransport = true } = {}) {
+    if (this.closed) return;
+    const wasConfirmed = this.state === 'confirmed';
+    clearTimeout(this._timer);
+    if (notify && this.kind === 'relay' && this.transport) {
+      this._wire({ type: 'error', code: 4400, message: `session closed: ${reason}`, ...(this.sessionId ? { detail: `session:${this.sessionId}` } : {}) });
+    }
+    this.state = 'closed';
+    this.closedReason = reason;
+    this._x = null;
+    if (closeTransport && this.transport && this.kind !== 'relay') { try { this.transport.close(); } catch { /* already gone */ } }
+    this.emit('closed', { reason, detail, desync, wasConfirmed }, this);
+  }
+}
+
+module.exports = { PeerSession, agreeX25519, freshX25519, checkOffer, HANDSHAKE_TIMEOUT_MS, HANDSHAKE_TYPES };
diff --git a/package.json b/package.json
index a887e0a8..1c00a6e4 100644
--- a/package.json
+++ b/package.json
@@ -46,7 +46,8 @@
     ".agents/",
     ".claude/",
     "LICENSE",
-    "README.md"
+    "README.md",
+    "SECURITY.md"
   ],
   "optionalDependencies": {
     "@huggingface/transformers": "^4.3.0"
diff --git a/scripts/migration-rehearsal.js b/scripts/migration-rehearsal.js
new file mode 100644
index 00000000..6d5da13e
--- /dev/null
+++ b/scripts/migration-rehearsal.js
@@ -0,0 +1,107 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * Rehearse the 0.14 migration (design §6, D3, D9) on COPIES of real node directories.
+ *
+ *   node scripts/migration-rehearsal.js [--from <nodes dir>] [--with-013 <0.13 checkout>]
+ *
+ * Copies each node's identity.json and roster-keys.jsonl from `--from` (default ~/.sym/nodes; only
+ * READ) into a fresh temp state root, then, there:
+ *   1. the key registry: every 0.13 roster file is migrated (handshake → legacy-claim, anchor
+ *      dropped, a version marker written), and loading it again migrates nothing (idempotent);
+ *   2. a 0.13 rollback: the 0.13 RosterKeyRegistry (from --with-013) reads each migrated file and
+ *      holds a key for every binding (it skips the marker line as malformed);
+ *   3. the identity layout: every node dir moves to nodes/by-id/<nodeId>/ with nodes/<name> left as
+ *      a symlink; a second pass moves nothing; a 0.13 reader still finds nodes/<name>/identity.json.
+ * Prints one JSON summary. Nothing outside the temp dir is written.
+ */
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const argv = process.argv.slice(2);
+const flag = (n) => { const i = argv.indexOf(n); return i >= 0 ? argv[i + 1] : null; };
+const realHome = os.homedir();
+const FROM = flag('--from') || path.join(realHome, '.sym', 'nodes');
+const WITH013 = flag('--with-013') || path.resolve(__dirname, '..', '..', 'sym-0.13.17');
+
+const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'sym-migration-rehearsal-'));
+process.env.HOME = tmp;
+process.env.SYM_STATE_DIR = path.join(tmp, '.sym');
+delete process.env.SYM_IDENTITY_DIR;
+const NODES = path.join(tmp, '.sym', 'nodes');
+fs.mkdirSync(NODES, { recursive: true });
+
+// 1. Copy (read-only on the source).
+const copied = { dirs: 0, identities: 0, rosters: 0, rosterLines: 0, handshakeLines: 0, skippedLinks: 0 };
+for (const d of fs.readdirSync(FROM, { withFileTypes: true })) {
+  if (d.isSymbolicLink()) { copied.skippedLinks++; continue; }
+  if (!d.isDirectory() || d.name === 'by-id' || d.name === 'by-name') continue;
+  const src = path.join(FROM, d.name);
+  const dst = path.join(NODES, d.name);
+  let any = false;
+  const id = path.join(src, 'identity.json');
+  if (fs.existsSync(id)) { fs.mkdirSync(dst, { recursive: true }); fs.copyFileSync(id, path.join(dst, 'identity.json')); copied.identities++; any = true; }
+  const rk = path.join(src, 'roster-keys', 'roster-keys.jsonl');
+  if (fs.existsSync(rk)) {
+    fs.mkdirSync(path.join(dst, 'roster-keys'), { recursive: true });
+    fs.copyFileSync(rk, path.join(dst, 'roster-keys', 'roster-keys.jsonl'));
+    const text = fs.readFileSync(rk, 'utf8');
+    for (const l of text.split('\n')) { if (!l.trim()) continue; copied.rosterLines++; try { if (JSON.parse(l).source === 'handshake') copied.handshakeLines++; } catch { /* */ } }
+    copied.rosters++;
+    any = true;
+  }
+  if (any) copied.dirs++;
+}
+
+const { RosterKeyRegistry, FORMAT_MARKER } = require('../lib/roster-keys');
+const config = require('../lib/config');
+let Roster013 = null;
+try { Roster013 = require(path.join(WITH013, 'lib', 'roster-keys.js')).RosterKeyRegistry; } catch { /* no 0.13 checkout */ }
+
+// 2. The key registry, file by file.
+const roster = { files: 0, bindings: 0, legacyClaim: 0, grant: 0, droppedAnchor: 0, droppedMalformed: 0, verifyingAfter: 0, idempotent: true, markerOk: true, rollbackReadable: Roster013 ? true : null, rollbackBindings: 0, mismatches: [] };
+for (const name of fs.readdirSync(NODES)) {
+  const dir = path.join(NODES, name, 'roster-keys');
+  if (!fs.existsSync(path.join(dir, 'roster-keys.jsonl'))) continue;
+  roster.files++;
+  const r = new RosterKeyRegistry({ dir });
+  const m = r.migration();
+  if (m) { roster.bindings += m.bindings; roster.legacyClaim += m.legacyClaim; roster.grant += m.grant; roster.droppedAnchor += m.droppedAnchor; roster.droppedMalformed += m.droppedMalformed; }
+  roster.verifyingAfter += r.entries().filter((e) => r.get(e.nodeId)).length;
+  const first = JSON.parse(fs.readFileSync(path.join(dir, 'roster-keys.jsonl'), 'utf8').split('\n')[0]);
+  if (first.v !== FORMAT_MARKER.v) roster.markerOk = false;
+  const again = new RosterKeyRegistry({ dir });
+  if (again.migration() !== null || again.size() !== r.size()) roster.idempotent = false;
+  if (Roster013) {
+    const old = new Roster013({ dir });
+    for (const e of r.entries()) {
+      if (old.get(e.nodeId) === e.key) roster.rollbackBindings++;
+      else { roster.rollbackReadable = false; if (roster.mismatches.length < 5) roster.mismatches.push({ dir: name, nodeId: e.nodeId }); }
+    }
+  }
+}
+
+// 3. The identity layout.
+const before = fs.readdirSync(NODES).filter((n) => fs.existsSync(path.join(NODES, n, 'identity.json')));
+const pass1 = config.migrateIdentities();
+const pass2 = config.migrateIdentities();
+let links = 0, oldPathReadable = 0, byIdReadable = 0;
+for (const name of before) {
+  const link = path.join(NODES, name);
+  try { if (fs.lstatSync(link).isSymbolicLink()) links++; } catch { /* */ }
+  try { JSON.parse(fs.readFileSync(path.join(link, 'identity.json'), 'utf8')); oldPathReadable++; } catch { /* */ }
+  const id = config.nodeIdForName(name);
+  try { if (id && config.loadIdentity({ nodeId: id, create: false })) byIdReadable++; } catch { /* */ }
+}
+
+const summary = {
+  source: FROM, rehearsal: tmp, with013: Roster013 ? WITH013 : null,
+  copied,
+  roster,
+  identities: { nodeDirs: before.length, pass1, pass2, symlinks: links, readableAtOldPath: oldPathReadable, loadableById: byIdReadable },
+};
+console.log(JSON.stringify(summary, null, 2));
+if (!flag('--keep')) fs.rmSync(tmp, { recursive: true, force: true });
diff --git a/scripts/two-stock-nodes-driver.cjs b/scripts/two-stock-nodes-driver.cjs
index 8876878c..be5c34a8 100644
--- a/scripts/two-stock-nodes-driver.cjs
+++ b/scripts/two-stock-nodes-driver.cjs
@@ -30,7 +30,7 @@ function bidirectionalPair() {
   const b = {};
   const mk = (self, peer) => ({
     on: (ev, fn) => { self[ev] = fn; },
-    send: (frame) => setImmediate(() => { if (peer.message) peer.message(frame); }),
+    send: (frame) => { const copy = JSON.parse(JSON.stringify(frame)); setImmediate(() => { if (peer.message) peer.message(copy); }); return true; },
     close: () => { if (self.close) self.close(); },
   });
   return [mk(a, b), mk(b, a)];
@@ -59,12 +59,14 @@ const FOCUS = 'two stock sym nodes prove the open runtime is self-sufficient';
   await nodeA.start();
   await nodeB.start();
 
+  // Core Secure (0.14): the pair proves itself through the real §5.2 handshake over the pipe;
+  // neither is a peer of the other until both proofs validate.
   const [tA, tB] = bidirectionalPair();
-  tA.on('message', (frame) => nodeA._frameHandler.handle(nodeB.nodeId, bName, frame));
-  tB.on('message', (frame) => nodeB._frameHandler.handle(nodeA.nodeId, aName, frame));
-  nodeA._addPeer(nodeA._createPeer(tA, nodeB.nodeId, bName, true, 'bonjour'));
-  nodeB._addPeer(nodeB._createPeer(tB, nodeA.nodeId, aName, false, 'bonjour'));
-  await new Promise((r) => setTimeout(r, 400)); // let the handshake round-trip settle
+  nodeB.connectTransport(tB, { role: 'server' });
+  nodeA.connectTransport(tA, { role: 'client', expectNodeId: nodeB.nodeId });
+  if (!(await waitFor(() => nodeA._peers.has(nodeB.nodeId) && nodeB._peers.has(nodeA.nodeId), 10000))) {
+    throw new Error('the two nodes did not complete the Core Secure handshake');
+  }
 
   const received = [];
   nodeB.on('memory-received', (evt) => received.push(evt));
diff --git a/tests/_core-secure.js b/tests/_core-secure.js
new file mode 100644
index 00000000..5c9efb96
--- /dev/null
+++ b/tests/_core-secure.js
@@ -0,0 +1,160 @@
+'use strict';
+
+/**
+ * Test helpers for Core Secure (sym 0.14): identities, in-memory transports, signed v2.0 records,
+ * and wiring two SymNodes (or a node and a bare PeerSession) through the real §5.2 handshake.
+ *
+ * Nothing here bypasses the handshake: a pair is connected by attaching a transport to each node
+ * with its role, and the sessions prove themselves exactly as they do over TCP or a relay.
+ */
+
+const crypto = require('crypto');
+const { createCMB, signCMB, assertionIdV2_0 } = require('../lib/core');
+
+function uuidv7() { return require('../lib/config').uuidv7(); }
+
+/** A fresh identity { nodeId, name, publicKey, privateKey } (keys raw, base64url). */
+function identity(name = 'peer') {
+  const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519');
+  return {
+    nodeId: uuidv7(),
+    name,
+    publicKey: publicKey.export({ format: 'der', type: 'spki' }).subarray(12).toString('base64url'),
+    privateKey: privateKey.export({ format: 'der', type: 'pkcs8' }).subarray(16).toString('base64url'),
+  };
+}
+
+/**
+ * Two transports joined back to back. Frames are delivered asynchronously (setImmediate), in order,
+ * as copies (JSON round trip), as a socket would. `tap` sees every frame on the wire.
+ */
+function memoryPipe({ tap } = {}) {
+  const ends = [mkEnd(), mkEnd()];
+  function mkEnd() {
+    const listeners = { message: [], close: [] };
+    return {
+      _closed: false,
+      on(ev, fn) { (listeners[ev] ||= []).push(fn); return this; },
+      once(ev, fn) { const w = (...a) => { this.off(ev, w); fn(...a); }; return this.on(ev, w); },
+      off(ev, fn) { listeners[ev] = (listeners[ev] || []).filter((f) => f !== fn); return this; },
+      removeListener(ev, fn) { return this.off(ev, fn); },
+      removeAllListeners(ev) { if (ev) listeners[ev] = []; else for (const k of Object.keys(listeners)) listeners[k] = []; return this; },
+      emit(ev, ...a) { for (const f of [...(listeners[ev] || [])]) f(...a); },
+      _listeners: listeners,
+    };
+  }
+  const [a, b] = ends;
+  for (const [self, other] of [[a, b], [b, a]]) {
+    self.trySend = (frame) => {
+      if (self._closed) return { ok: false, reason: 'not-connected' };
+      const copy = JSON.parse(JSON.stringify(frame));
+      if (tap) tap(copy, self === a ? 'a→b' : 'b→a');
+      setImmediate(() => { if (!other._closed) other.emit('message', copy); });
+      return { ok: true };
+    };
+    self.send = (frame) => self.trySend(frame).ok;
+    self.close = () => {
+      if (self._closed) return;
+      self._closed = true;
+      setImmediate(() => self.emit('close'));
+      if (!other._closed) { other._closed = true; setImmediate(() => other.emit('close')); }
+    };
+    self.destroy = self.close;
+  }
+  return [a, b];
+}
+
+/**
+ * Connect two SymNodes over an in-memory pipe through the real handshake: `client` dials `server`.
+ * `kind` is 'bonjour' (LAN/loopback) or 'relay'. Resolves when both have the other as a peer.
+ */
+async function connectNodes(client, server, { kind = 'bonjour', timeoutMs = 5000, tap } = {}) {
+  const [tc, ts] = memoryPipe({ tap });
+  if (kind === 'bonjour') {
+    server.connectTransport(ts, { role: 'server' });
+    client.connectTransport(tc, { role: 'client', expectNodeId: server.nodeId });
+  } else {
+    // A relay session is fed by the node's envelope router, not by its transport: the pipe stands in
+    // for the relay channel between the two, so it is wired here.
+    const ss = server._attachTransport(ts, { role: 'server', kind, relayFrom: client.nodeId, expectNodeId: client.nodeId });
+    ts.on('message', (f) => ss.receiveWire(f));
+    ts.on('close', () => ss.close('relay-peer-left', { notify: false }));
+    const cs = client._attachTransport(tc, { role: 'client', kind, expectNodeId: server.nodeId, relayFrom: server.nodeId });
+    tc.on('message', (f) => cs.receiveWire(f));
+    tc.on('close', () => cs.close('relay-peer-left', { notify: false }));
+  }
+  // Resolved when THIS pair of sessions has confirmed on both sides (a pair already joined over
+  // another transport does not count).
+  const joined = (n, other) => { const s = n._peers.get(other.nodeId)?.transports?.get(kind); return !!(s && s.confirmed && !s.closed); };
+  await until(() => joined(client, server) && joined(server, client), timeoutMs);
+  if (!joined(client, server) || !joined(server, client)) throw new Error('connectNodes: the pair did not confirm');
+  return { tc, ts };
+}
+
+async function until(cond, ms = 5000, step = 10) {
+  for (let t = 0; t < ms && !cond(); t += step) await new Promise((r) => setTimeout(r, step));
+  return cond();
+}
+
+/** A signed v2.0 record from `author` (an identity), as remember() mints it. */
+function signedRecord(author, { categories = { focus: 'a signed observation' }, room = 'default', to = null, application = null, lineage = null } = {}) {
+  const cmb = createCMB({ categories, createdBy: author.name, createdByNodeId: author.nodeId, room, to, lineage, emitV2: true, application });
+  cmb.metadata.assertionId = assertionIdV2_0(cmb);
+  signCMB(cmb, author.privateKey);
+  return cmb;
+}
+
+/** An application section for `bytes` (Buffer), signed into the record. */
+function applicationFor(bytes, { mediaType = 'application/json', schema = 'https://sym.bot/schema/test-v1.json' } = {}) {
+  return {
+    mediaType, schema, encoding: 'base64url', byteLength: bytes.length,
+    digest: `sha256-${crypto.createHash('sha256').update(bytes).digest('hex')}`,
+    data: bytes.toString('base64url'),
+  };
+}
+
+/**
+ * For handler-level tests: what a confirmed, admitted §5.2 session leaves behind — the identity's key
+ * bound `proven` in the node's registry, and a session registered as the peer's transport — so a test
+ * can hand authenticated inner frames to node._receiveSessionFrame (the one guarded dispatch) or to
+ * node._frameHandler.handle(session, frame). Frames the node sends back to it are kept in `sent`.
+ * @param {object} node
+ * @param {{ nodeId: string, name?: string, publicKey?: string }} id
+ */
+function admitAs(node, id, { extensions = ['cmb-encrypted-v2', 'sym-attest-v1', 'xmesh-insight-v1'], kind = 'bonjour' } = {}) {
+  const sent = [];
+  const session = {
+    nodeId: id.nodeId, name: id.name || id.nodeId, identityKey: id.publicKey || null,
+    sessionId: crypto.randomBytes(16).toString('hex'), kind, role: 'server', room: node._room,
+    confirmed: true, closed: false, _closed: false, selected: [...extensions],
+    has(e) { return this.selected.includes(e); },
+    admission: { state: 'admitted' }, peerImplementation: { name: 'test', version: '0' },
+    confirmedAt: Date.now(), lastSeen: Date.now(), relayFrom: kind === 'relay' ? id.nodeId : null,
+    sent,
+    send(f) { sent.push(f); return true; },
+    trySend(f) { sent.push(f); return { ok: true }; },
+    close() { this.closed = true; this._closed = true; },
+  };
+  if (id.publicKey) node._roster.bind(id.nodeId, id.publicKey, 'proven');
+  node._peers.set(id.nodeId, { peerId: id.nodeId, name: session.name, identityKey: id.publicKey || null, transports: new Map([[kind, session]]), transport: session, isOutbound: false, source: kind, lastSeen: Date.now() });
+  return session;
+}
+
+/**
+ * A captured transport admitted as a session (the 0.13 tests' `_addPeer(_createPeer(t, id, …))`):
+ * what the node sends to the peer reaches `transport.send` before it is sealed.
+ */
+function plantSession(node, transport, nodeId, name, kind = 'bonjour') {
+  const s = admitAs(node, { nodeId, name }, { kind });
+  s.send = (f) => transport.send(f) !== false;
+  s.trySend = (f) => (typeof transport.trySend === 'function' ? transport.trySend(f) : (s.send(f) ? { ok: true } : { ok: false, reason: 'send-failed' }));
+  return s;
+}
+
+/** Hand an authenticated frame to the node through its one guarded dispatch. */
+function deliver(node, session, frame) { return node._receiveSessionFrame(session, frame); }
+
+/** A node's own identity as a signer: { nodeId, name, publicKey, privateKey }. */
+function signerOf(node) { return { nodeId: node.nodeId, name: node.name, publicKey: node._identity.publicKey, privateKey: node._identity.privateKey }; }
+
+module.exports = { identity, memoryPipe, connectNodes, until, signedRecord, applicationFor, uuidv7, admitAs, plantSession, deliver, signerOf };
diff --git a/tests/_fake-relay.js b/tests/_fake-relay.js
new file mode 100644
index 00000000..428ba866
--- /dev/null
+++ b/tests/_fake-relay.js
@@ -0,0 +1,93 @@
+'use strict';
+
+/**
+ * A fake sym-relay for tests: relay-auth, relay-peers, relay-peer-joined/left, envelope routing
+ * ({to, payload} → {from, fromName, payload}), the 0.5 token bucket per connection (close 4008),
+ * duplicate-identity replacement with 4004 and no peer-left, and — when `fanout` is set — the
+ * fan-out envelope of MMP spec draft PR #25 ({ fanout: [{ to, payload }, …] }, one message, counted
+ * once), listed in relay-peers as `features: ['fanout']`; a fan-out naming a recipient twice is
+ * refused whole with relay-error.
+ *
+ * `tap(env)` sees every routed payload ({ from, to, payload }) and may return:
+ *   undefined → deliver as is;  false → drop;  an object → deliver that payload instead.
+ */
+
+const { WebSocketServer } = require('ws');
+
+function fakeRelay({ ratePerSec = 25, burst = 300, fanout = false, maxFanout = 64, tap } = {}) {
+  // maxFanout: what this relay accepts (the draft's floor is 64); a longer fan-out is refused whole.
+  const wss = new WebSocketServer({ port: 0 });
+  const conns = new Map(); // nodeId -> { ws, name }
+  const stats = { framesIn: 0, rateLimited: 0, fanoutIn: 0, fanoutRefused: 0, routed: 0, replaced: 0 };
+  const send = (ws, m) => { try { ws.send(JSON.stringify(m)); } catch { /* closed */ } };
+  const route = (from, to, payload) => {
+    let p = payload;
+    if (tap) {
+      const r = tap({ from: from.nodeId, to, payload });
+      if (r === false) return;
+      if (r && typeof r === 'object') p = r;
+    }
+    const target = conns.get(to);
+    if (!target) return;
+    stats.routed++;
+    send(target.ws, { from: from.nodeId, fromName: from.name, payload: p });
+  };
+  wss.on('connection', (ws) => {
+    let me = null;
+    const bucket = { tokens: burst, last: Date.now() };
+    ws.on('message', (data) => {
+      const now = Date.now();
+      stats.framesIn++;
+      bucket.tokens = Math.min(burst, bucket.tokens + ((now - bucket.last) * ratePerSec) / 1000);
+      bucket.last = now;
+      if (--bucket.tokens < 0) { stats.rateLimited++; ws.close(4008, 'Rate limit exceeded'); return; }
+      let msg;
+      try { msg = JSON.parse(String(data)); } catch { return; }
+      if (!me) {
+        if (msg.type !== 'relay-auth') return;
+        me = { nodeId: msg.nodeId, name: msg.name, ws };
+        const prev = conns.get(me.nodeId);
+        if (prev) { stats.replaced++; prev.replaced = true; try { prev.ws.close(4004, 'Replaced by new connection'); } catch { /* */ } }
+        conns.set(me.nodeId, me);
+        send(ws, {
+          type: 'relay-peers',
+          peers: [...conns.values()].filter((c) => c.nodeId !== me.nodeId).map((c) => ({ nodeId: c.nodeId, name: c.name, offline: false })),
+          ...(fanout ? { features: ['some-future-token', 'fanout'] } : {}),
+        });
+        for (const c of conns.values()) if (c.nodeId !== me.nodeId) send(c.ws, { type: 'relay-peer-joined', nodeId: me.nodeId, name: me.name });
+        return;
+      }
+      if (msg.type === 'relay-pong') return;
+      if (fanout && Array.isArray(msg.fanout)) {
+        const tos = msg.fanout.map((e) => e && e.to);
+        if (msg.fanout.length > maxFanout || new Set(tos).size !== tos.length || tos.includes(me.nodeId) || tos.some((t) => typeof t !== 'string')) {
+          stats.fanoutRefused++;
+          send(ws, { type: 'relay-error', message: 'malformed fan-out' });
+          return;
+        }
+        stats.fanoutIn++;
+        for (const e of msg.fanout) route(me, e.to, e.payload);
+        return;
+      }
+      if (msg.to) route(me, msg.to, msg.payload);
+      else if (msg.payload) for (const c of conns.values()) if (c.nodeId !== me.nodeId) route(me, c.nodeId, msg.payload);
+    });
+    ws.on('close', () => {
+      if (!me || conns.get(me.nodeId) !== me) return; // a replaced connection says no peer-left (§4.4.7)
+      conns.delete(me.nodeId);
+      for (const c of conns.values()) send(c.ws, { type: 'relay-peer-left', nodeId: me.nodeId, name: me.name });
+    });
+  });
+  return {
+    url: `ws://127.0.0.1:${wss.address().port}`,
+    stats,
+    conns,
+    /** Drop a connection as the network would (the relay says peer-left). */
+    kick(nodeId) { const c = conns.get(nodeId); if (c) c.ws.terminate(); },
+    /** Send an envelope as if `from` had sent it (an injector holding a relay connection). */
+    inject(from, to, payload) { const t = conns.get(to); if (t) send(t.ws, { from, fromName: 'injected', payload }); },
+    close: () => new Promise((r) => { for (const c of conns.values()) { try { c.ws.terminate(); } catch { /* */ } } wss.close(() => r()); }),
+  };
+}
+
+module.exports = { fakeRelay };
diff --git a/tests/admission-attestation.test.js b/tests/admission-attestation.test.js
index 0ba4b4db..e2bf6673 100644
--- a/tests/admission-attestation.test.js
+++ b/tests/admission-attestation.test.js
@@ -156,7 +156,7 @@ describe("'attestation-received' — a peer's verified verdict is observable as
     const tag = () => `${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
     const A = new SymNode({ name: `att-rx-a-${tag()}`, silent: true, discovery: new NullDiscovery(), room: 'hotel', ...aOpts });
     const B = new SymNode({ name: `att-rx-b-${tag()}`, silent: true, discovery: new NullDiscovery(), room: 'hotel' });
-    B._pinPeerKey(A.nodeId, A._identity.publicKey);
+    B._roster.bind(A.nodeId, A._identity.publicKey, 'proven');
     // A direct peer is what gives the attester a name; the label is whatever it announced.
     if (aAsPeer) B._peers.set(A.nodeId, { peerId: A.nodeId, name: aAsPeer, transport: { send() {} } });
     const seen = [];
@@ -186,7 +186,7 @@ describe("'attestation-received' — a peer's verified verdict is observable as
       assert.strictEqual(e.sig, att.sig);
       assert.strictEqual(e.sigAlg, 'ed25519');
       assert.strictEqual(e.verified, true);
-      assert.strictEqual(e.keySource, 'handshake');
+      assert.strictEqual(e.keySource, 'proven', 'the key A proved on its Core Secure session (0.14: no more trust-on-first-hello)');
       assert.strictEqual(e.from, 'concierge');
       assert.strictEqual(e.fromPeerId, A.nodeId);
       assert.strictEqual(e.relayed, false);
@@ -460,8 +460,8 @@ describe('the witness storm', () => {
   it('a second copy of a witness is not relayed, and a held checkpoint is not witnessed again', () => {
     const ATT = kp(), WIT = kp();
     withNode('att-storm', { lifecycleRole: 'participant', room: 'g' }, (node) => {
-      node._pinPeerKey('node-att', ATT.pub);
-      node._pinPeerKey('node-wit', WIT.pub);
+      node._roster.bind('node-att', ATT.pub, 'proven');
+      node._roster.bind('node-wit', WIT.pub, 'proven');
       const relayed = [];
       node._gossipToRoster = (frame) => relayed.push(frame.type);
       const cp = signed({ type: 'checkpoint', by: 'node-att', roster: 'g', upto_seq: 8, root: 'r8', at: 1 }, ATT.priv, signCheckpoint);
@@ -480,8 +480,8 @@ describe('the witness storm', () => {
   it('a repeat is dropped before its signature is checked; nothing unverified changes state', () => {
     const ATT = kp(), WIT = kp();
     withNode('att-early', { lifecycleRole: 'participant', room: 'g' }, (node) => {
-      node._pinPeerKey('node-att', ATT.pub);
-      node._pinPeerKey('node-wit', WIT.pub);
+      node._roster.bind('node-att', ATT.pub, 'proven');
+      node._roster.bind('node-wit', WIT.pub, 'proven');
       node._gossipToRoster = () => {};
       const cp = signed({ type: 'checkpoint', by: 'node-att', roster: 'g', upto_seq: 8, root: 'r8', at: 1 }, ATT.priv, signCheckpoint);
       node._ingestCheckpoint(cp, 'node-att');
@@ -499,7 +499,7 @@ describe('the witness storm', () => {
   it('a signed second root is a conflict: surfaced once, reported by reconcile, never relayed', () => {
     const ATT = kp();
     withNode('att-conflict', { lifecycleRole: 'participant', room: 'g' }, (node) => {
-      node._pinPeerKey('node-att', ATT.pub);
+      node._roster.bind('node-att', ATT.pub, 'proven');
       const relayed = [];
       node._gossipToRoster = (f) => relayed.push(f.type);
       const metrics = [];
@@ -520,7 +520,7 @@ describe('the witness storm', () => {
   it('a replayed checkpoint with its position spelled as text is refused', () => {
     const ATT = kp();
     withNode('att-text-seq', { lifecycleRole: 'participant', room: 'g' }, (node) => {
-      node._pinPeerKey('node-att', ATT.pub);
+      node._roster.bind('node-att', ATT.pub, 'proven');
       node._gossipToRoster = () => {};
       const cp = signed({ type: 'checkpoint', by: 'node-att', roster: 'g', upto_seq: 8, root: 'r8', at: 1 }, ATT.priv, signCheckpoint);
       node._ingestCheckpoint(cp, 'node-att');
diff --git a/tests/audit-delivery-authorship.test.js b/tests/audit-delivery-authorship.test.js
index e5ce064b..6d1175ba 100644
--- a/tests/audit-delivery-authorship.test.js
+++ b/tests/audit-delivery-authorship.test.js
@@ -43,7 +43,21 @@ function rawKeypair() {
   });
   return { pub: publicKey.slice(-32).toString('base64url'), priv: privateKey.slice(-32).toString('base64url') };
 }
-const PEER_A = rawKeypair();
+// Since 0.14 (Core Secure): a record names its author by node id and is verified against the key
+// bound to that id; it arrives on a confirmed session (design D1/D4). PEER_A is the author's key.
+const { identity, admitAs, connectNodes } = require('./_core-secure');
+const A_ID = identity('peerA');
+const B_ID = identity('peerB');
+const PEER_A = { pub: A_ID.publicKey, priv: A_ID.privateKey };
+void rawKeypair;
+const sessionsOf = new WeakMap();
+/** The confirmed session `id` speaks on at `node` (its key bound proven). */
+function from(node, id = A_ID) {
+  let m = sessionsOf.get(node);
+  if (!m) { m = new Map(); sessionsOf.set(node, m); }
+  if (!m.has(id.nodeId)) m.set(id.nodeId, admitAs(node, id));
+  return m.get(id.nodeId);
+}
 
 async function withNode(baseName, fn) {
   const name = `${baseName}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
@@ -61,16 +75,17 @@ const ALIGNED = { decision: 'aligned', total_drift: 0.1, category_drifts: { focu
 const REJECTED = { decision: 'rejected', total_drift: 9, category_drifts: {}, gate_values: { g: 0 } };
 const NEUTRAL = { text: 'neutral', valence: 0, arousal: 0 };
 
-function mkCmb(focus, { by = 'peerA', parents, mood = NEUTRAL, to } = {}) {
+function mkCmb(focus, { by = 'peerA', byNodeId = A_ID.nodeId, parents, mood = NEUTRAL, to } = {}) {
   const cmb = core.createCMB({
     categories: { focus, issue: 'audit regression', intent: 'verify', motivation: 'MMP 2.0 audit', commitment: 'guard', perspective: by, mood },
     createdBy: by,
     to: to ?? null,
+    emitV2: true, createdByNodeId: byNodeId, room: 'default',
   });
   if (parents) cmb.metadata.lineage = { parents, method: 'rule-a' };
   return cmb;
 }
-const signed = (cmb, kp = PEER_A) => { core.signCMB(cmb, kp.priv); return cmb; };
+const signed = (cmb, kp = PEER_A) => { cmb.metadata.assertionId = core.assertionIdV2_0(cmb); core.signCMB(cmb, kp.priv); return cmb; };
 const frame = (cmb) => JSON.parse(JSON.stringify({ type: 'cmb', timestamp: Date.now(), cmb }));
 const directed = (node, cmb) => Object.assign(frame(cmb), { to: node.nodeId, directed: true });
 // Waits for every in-flight frame to finish, not a fixed guess at how long that takes.
@@ -87,13 +102,12 @@ function collect(node) {
 describe('directed delivery (MMP §9.2.2, §8.8.2)', () => {
   it('B-D1: a signed directed reply whose parent is the receiver\'s own CMB surfaces', async () => {
     await withNode('d1', async (node) => {
-      node._pinPeerKey('peerA', PEER_A.pub);
       node._svafEvaluator.evaluate = async () => ALIGNED;
       const mine = node.remember({ focus: 'my question to peerA', issue: 'x', intent: 'ask', motivation: 'm', commitment: 'c', perspective: 'me', mood: NEUTRAL });
       assert.ok(mine?.key, 'precondition: a local CMB exists');
       const seen = collect(node);
       const reply = signed(mkCmb('peerA answers your question', { parents: [mine.key], to: node.nodeId }));
-      node._frameHandler.handle('peerA', 'peerA', directed(node, reply));
+      node._frameHandler.handle(from(node), directed(node, reply));
       await settle();
       assert.strictEqual(seen.accepted.length, 1);
     });
@@ -101,54 +115,45 @@ describe('directed delivery (MMP §9.2.2, §8.8.2)', () => {
 
   it('re-review F1: frame flags alone do not exempt a reply from echo suppression', async () => {
     await withNode('d1-forged', async (node) => {
-      node._pinPeerKey('peerA', PEER_A.pub);
       node._svafEvaluator.evaluate = async () => ALIGNED;
       const mine = node.remember({ focus: 'my broadcast', issue: 'x', intent: 'tell', motivation: 'm', commitment: 'c', perspective: 'me', mood: NEUTRAL });
       const seen = collect(node);
       // Signed as a broadcast (metadata.to null), frame forged to say directed.
-      node._frameHandler.handle('peerA', 'peerA', directed(node, signed(mkCmb('remix pong', { parents: [mine.key] }))));
+      node._frameHandler.handle(from(node), directed(node, signed(mkCmb('remix pong', { parents: [mine.key] }))));
       await settle();
       assert.strictEqual(seen.accepted.length, 0, 'a signed broadcast citing my CMB is an echo, whatever the frame says');
     });
   });
 
-  it('r3 F1: a verified directed CMB from an emitter that signs no addressee field stays directed', async () => {
+  it('D4: a record whose author signed no addressee is room-bound, whatever the frame says', async () => {
     await withNode('d1-no-to-field', async (node) => {
-      node._pinPeerKey('peerA', PEER_A.pub);
       node._svafEvaluator.evaluate = async () => REJECTED;
       const seen = collect(node);
-      const cmb = mkCmb('from another implementation');
-      delete cmb.metadata.to; // signs no addressee at all
-      node._frameHandler.handle('peerA', 'peerA', directed(node, signed(cmb)));
+      node._frameHandler.handle(from(node), directed(node, signed(mkCmb('signed with to: null'))));
       await settle();
-      assert.strictEqual(seen.accepted.length, 1, 'delivered (§9.2.2) on the frame flags');
+      assert.strictEqual(seen.accepted.length, 0, 'the frame flags are not read: SVAF gates a room-bound record');
     });
   });
 
-  it('r3 F2: an unauthenticated directed reply citing my CMB is delivered once, not processed', async () => {
+  it('r3 F2 (Core Secure): an unsigned directed reply is refused — never delivered, admitted or remixed', async () => {
     await withNode('d1-unsigned-reply', async (node) => {
       let evaluations = 0;
       node._svafEvaluator.evaluate = async () => { evaluations++; return ALIGNED; };
       const mine = node.remember({ focus: 'my question', issue: 'x', intent: 'ask', motivation: 'm', commitment: 'c', perspective: 'me', mood: NEUTRAL });
       const seen = collect(node);
-      const f = directed(node, mkCmb('unsigned answer', { parents: [mine.key] }));
-      node._frameHandler.handle('peerA', 'peerA', JSON.parse(JSON.stringify(f)));
-      await settle();
-      node._frameHandler.handle('peerA', 'peerA', JSON.parse(JSON.stringify(f)));
+      const f = directed(node, mkCmb('unsigned answer', { parents: [mine.key], to: node.nodeId }));
+      node._frameHandler.handle(from(node), JSON.parse(JSON.stringify(f)));
       await settle();
-      assert.strictEqual(seen.accepted.length, 1, 'delivered once');
-      assert.strictEqual(seen.accepted[0].decision, 'echo');
-      assert.strictEqual(seen.accepted[0].remixed, false);
-      assert.strictEqual(evaluations, 0, 'never admitted or remixed: no ping-pong');
+      assert.strictEqual(seen.accepted.length, 0);
+      assert.strictEqual(evaluations, 0);
     });
   });
 
   it('re-review F1: a signed broadcast with a forged directed frame is not treated as directed', async () => {
     await withNode('d1-signed-to', async (node) => {
-      node._pinPeerKey('peerA', PEER_A.pub);
       node._svafEvaluator.evaluate = async () => REJECTED;
       const seen = collect(node);
-      node._frameHandler.handle('peerA', 'peerA', directed(node, signed(mkCmb('signed for everyone'))));
+      node._frameHandler.handle(from(node), directed(node, signed(mkCmb('signed for everyone'))));
       await settle();
       assert.strictEqual(seen.accepted.length, 0, 'memory rejected it and it was never addressed to me');
     });
@@ -159,7 +164,7 @@ describe('directed delivery (MMP §9.2.2, §8.8.2)', () => {
       node._svafEvaluator.evaluate = async () => ALIGNED;
       const mine = node.remember({ focus: 'my broadcast', issue: 'x', intent: 'tell', motivation: 'm', commitment: 'c', perspective: 'me', mood: NEUTRAL });
       const seen = collect(node);
-      node._frameHandler.handle('peerA', 'peerA', frame(mkCmb('remix of your broadcast', { parents: [mine.key] })));
+      node._frameHandler.handle(from(node), frame(signed(mkCmb('remix of your broadcast', { parents: [mine.key] }))));
       await settle();
       assert.strictEqual(seen.accepted.length, 0);
     });
@@ -167,14 +172,13 @@ describe('directed delivery (MMP §9.2.2, §8.8.2)', () => {
 
   it('B-D2: a new signed directed send of words already surfaced as a broadcast surfaces again', async () => {
     await withNode('d2', async (node) => {
-      node._pinPeerKey('peerA', PEER_A.pub);
       const seen = collect(node);
       node._svafEvaluator.evaluate = async () => ALIGNED;
-      node._frameHandler.handle('peerA', 'peerA', frame(signed(mkCmb('status: done'))));
+      node._frameHandler.handle(from(node), frame(signed(mkCmb('status: done'))));
       await settle();
       await tick();
       node._svafEvaluator.evaluate = async () => REJECTED; // memory refuses it; delivery must not
-      node._frameHandler.handle('peerA', 'peerA', directed(node, signed(mkCmb('status: done', { to: node.nodeId }))));
+      node._frameHandler.handle(from(node), directed(node, signed(mkCmb('status: done', { to: node.nodeId }))));
       await settle();
       assert.strictEqual(seen.accepted.length, 2, 'the broadcast and the later directed send both surface');
       assert.strictEqual(seen.accepted[1].directed, true);
@@ -183,13 +187,12 @@ describe('directed delivery (MMP §9.2.2, §8.8.2)', () => {
 
   it('B-D2: a replay of the same signed directed record still surfaces only once', async () => {
     await withNode('d2-replay', async (node) => {
-      node._pinPeerKey('peerA', PEER_A.pub);
       node._svafEvaluator.evaluate = async () => REJECTED;
       const seen = collect(node);
       const f = directed(node, signed(mkCmb('please review the fix list', { to: node.nodeId })));
-      node._frameHandler.handle('peerA', 'peerA', JSON.parse(JSON.stringify(f)));
+      node._frameHandler.handle(from(node), JSON.parse(JSON.stringify(f)));
       await settle();
-      node._frameHandler.handle('peerA', 'peerA', JSON.parse(JSON.stringify(f)));
+      node._frameHandler.handle(from(node), JSON.parse(JSON.stringify(f)));
       await settle();
       assert.strictEqual(seen.accepted.length, 1);
     });
@@ -197,12 +200,11 @@ describe('directed delivery (MMP §9.2.2, §8.8.2)', () => {
 
   it('B-R8: a signed addressee decides: a relay that strips the frame\'s directed flag cannot turn it into a broadcast', async () => {
     await withNode('r8', async (node) => {
-      node._pinPeerKey('peerA', PEER_A.pub);
       node._svafEvaluator.evaluate = async () => REJECTED; // as a broadcast it would be gated away
       const seen = collect(node);
       const f = frame(signed(mkCmb('for your eyes: the rollback plan', { to: node.nodeId })));
       assert.strictEqual(f.directed, undefined, 'precondition: the frame does not say directed');
-      node._frameHandler.handle('peerA', 'peerA', f);
+      node._frameHandler.handle(from(node), f);
       await settle();
       assert.strictEqual(seen.accepted.length, 1, 'it surfaces as the directed CMB its author signed');
       assert.strictEqual(seen.accepted[0].directed, true);
@@ -211,7 +213,6 @@ describe('directed delivery (MMP §9.2.2, §8.8.2)', () => {
 
   it('N1: a relay cannot replay a signed directed record by re-spelling its signature or adding an assertionId', async () => {
     await withNode('d2-respell', async (node) => {
-      node._pinPeerKey('peerA', PEER_A.pub);
       node._svafEvaluator.evaluate = async () => REJECTED;
       const seen = collect(node);
       const f = directed(node, signed(mkCmb('approve the release', { to: node.nodeId })));
@@ -226,12 +227,12 @@ describe('directed delivery (MMP §9.2.2, §8.8.2)', () => {
         (c) => { c.cmb.metadata.sig = sig.slice(0, -1) + twin; },
         (c) => { c.cmb.metadata.assertionId = 'asrt-0000000000000000000000000000000000000000000000000000000000000000'; },
       ];
-      node._frameHandler.handle('peerA', 'peerA', JSON.parse(JSON.stringify(f)));
+      node._frameHandler.handle(from(node), JSON.parse(JSON.stringify(f)));
       await settle();
       for (const v of variants) {
         const copy = JSON.parse(JSON.stringify(f));
         v(copy);
-        node._frameHandler.handle('peerA', 'peerA', copy);
+        node._frameHandler.handle(from(node), copy);
         await settle();
       }
       assert.strictEqual(seen.accepted.length, 1, 'every re-spelling is the same assertion');
@@ -240,15 +241,13 @@ describe('directed delivery (MMP §9.2.2, §8.8.2)', () => {
 
   it('K1: two copies of one record in flight at once surface once', async () => {
     await withNode('k1', async (node) => {
-      node._pinPeerKey('peerA', PEER_A.pub);
-      node._pinPeerKey('peerB', PEER_A.pub);
       let release;
       const gate = new Promise((r) => { release = r; });
       node._svafEvaluator.evaluate = async () => { await gate; return ALIGNED; }; // the first copy is still in SVAF
       const seen = collect(node);
       const f = frame(signed(mkCmb('the same record, arriving twice')));
-      node._frameHandler.handle('peerA', 'peerA', JSON.parse(JSON.stringify(f)));
-      node._frameHandler.handle('peerB', 'peerB', JSON.parse(JSON.stringify(f))); // via a second peer, meanwhile
+      node._frameHandler.handle(from(node), JSON.parse(JSON.stringify(f)));
+      node._frameHandler.handle(from(node, B_ID), JSON.parse(JSON.stringify(f))); // via a second peer, meanwhile
       release();
       await settle();
       assert.strictEqual(seen.accepted.length, 1);
@@ -258,47 +257,42 @@ describe('directed delivery (MMP §9.2.2, §8.8.2)', () => {
 
   it('K3: a broadcast flood cannot evict a directed assertion mark', async () => {
     await withNode('k3', async (node) => {
-      node._pinPeerKey('peerA', PEER_A.pub);
       node._svafEvaluator.evaluate = async () => REJECTED;
       const seen = collect(node);
       const f = directed(node, signed(mkCmb('approve the release', { to: node.nodeId })));
-      node._frameHandler.handle('peerA', 'peerA', JSON.parse(JSON.stringify(f)));
+      node._frameHandler.handle(from(node), JSON.parse(JSON.stringify(f)));
       await settle();
       const now = Date.now();
       for (let i = 0; i <= 10000; i++) node._frameHandler._recordSeenCmbKey(`cmb-flood-${i}`, now);
-      node._frameHandler.handle('peerA', 'peerA', JSON.parse(JSON.stringify(f)));
+      node._frameHandler.handle(from(node), JSON.parse(JSON.stringify(f)));
       await settle();
       assert.strictEqual(seen.accepted.length, 1, 'the replay is still recognised');
     });
   });
 
-  it('F2: an unverified directed CMB cannot widen its de-duplication key with unsigned fields', async () => {
+  it('F2 (Core Secure): an unsigned directed CMB never surfaces, however its unsigned fields vary', async () => {
     await withNode('d2-unsigned', async (node) => {
       node._svafEvaluator.evaluate = async () => REJECTED;
       const seen = collect(node);
-      const base = directed(node, mkCmb('unsigned flood attempt')); // peerA's key is unknown: unverified
+      const base = directed(node, mkCmb('unsigned flood attempt', { to: node.nodeId }));
       for (let i = 0; i < 3; i++) {
         const f = JSON.parse(JSON.stringify(base));
         f.timestamp = i + 1; // a bare frame field the sender chooses
-        node._frameHandler.handle('peerA', 'peerA', f);
-        await settle(); // sequential arrivals: concurrent identical arrivals race SVAF (pre-existing, broadcast too)
+        node._frameHandler.handle(from(node), f);
+        await settle();
       }
-      await tick();
-      node._frameHandler.handle('peerA', 'peerA', directed(node, mkCmb('unsigned flood attempt'))); // new createdTimestamp, no signature
-      await settle();
-      assert.strictEqual(seen.accepted.length, 1, 'one surface per content for records nothing authenticates');
+      assert.strictEqual(seen.accepted.length, 0, 'nothing unauthenticated surfaces');
     });
   });
 
   it('B-D3: an admitted directed CMB whose key is already stored surfaces as delivered-not-stored', async () => {
     await withNode('d3', async (node) => {
-      node._pinPeerKey('peerA', PEER_A.pub);
       node._svafEvaluator.evaluate = async () => ALIGNED;
       const seen = collect(node);
-      node._frameHandler.handle('peerA', 'peerA', frame(signed(mkCmb('ack'))));
+      node._frameHandler.handle(from(node), frame(signed(mkCmb('ack'))));
       await settle();
       await tick();
-      node._frameHandler.handle('peerA', 'peerA', directed(node, signed(mkCmb('ack', { to: node.nodeId }))));
+      node._frameHandler.handle(from(node), directed(node, signed(mkCmb('ack', { to: node.nodeId }))));
       await settle();
       assert.strictEqual(seen.accepted.length, 2);
       assert.strictEqual(seen.accepted[1].directed, true);
@@ -311,7 +305,7 @@ describe('directed delivery (MMP §9.2.2, §8.8.2)', () => {
     await withNode('d4', async (node) => {
       node._svafEvaluator.evaluate = async () => REJECTED;
       const seen = collect(node);
-      node._frameHandler.handle('peerA', 'peerA', directed(node, mkCmb('urgent: the build is red', { mood: { text: 'alarmed', valence: -0.7, arousal: 0.8 } })));
+      node._frameHandler.handle(from(node), directed(node, signed(mkCmb('urgent: the build is red', { to: node.nodeId, mood: { text: 'alarmed', valence: -0.7, arousal: 0.8 } }))));
       await settle();
       assert.strictEqual(seen.accepted.length, 1, 'one cmb-accepted');
       assert.strictEqual(seen.moods, 1, 'the affect channel is separate and has no directed exemption');
@@ -322,7 +316,7 @@ describe('directed delivery (MMP §9.2.2, §8.8.2)', () => {
     await withNode('d4-mood', async (node) => {
       node._svafEvaluator.evaluate = async () => REJECTED;
       const seen = collect(node);
-      node._frameHandler.handle('peerA', 'peerA', frame(mkCmb('the build is red', { mood: { text: 'alarmed', valence: -0.7, arousal: 0.8 } })));
+      node._frameHandler.handle(from(node), frame(signed(mkCmb('the build is red', { mood: { text: 'alarmed', valence: -0.7, arousal: 0.8 } }))));
       await settle();
       assert.strictEqual(seen.moods, 1);
     });
@@ -332,11 +326,10 @@ describe('directed delivery (MMP §9.2.2, §8.8.2)', () => {
 describe('re-review F7: a directed CMB the store failed to write', () => {
   it('surfaces with decision not-stored, not redundant', async () => {
     await withNode('f7', async (node) => {
-      node._pinPeerKey('peerA', PEER_A.pub);
       node._svafEvaluator.evaluate = async () => ALIGNED;
       node._store._persist = () => false; // the disk refuses the write
       const seen = collect(node);
-      node._frameHandler.handle('peerA', 'peerA', directed(node, signed(mkCmb('store me', { to: node.nodeId }))));
+      node._frameHandler.handle(from(node), directed(node, signed(mkCmb('store me', { to: node.nodeId }))));
       await settle();
       assert.strictEqual(seen.accepted.length, 1);
       assert.strictEqual(seen.accepted[0].decision, 'not-stored');
@@ -370,10 +363,10 @@ describe('F3: an admitted broadcast the store already holds', () => {
       node._svafEvaluator.evaluate = async () => { evaluations++; return ALIGNED; };
       let memoryReceived = 0;
       node.on('memory-received', () => { memoryReceived++; });
-      const cmb = core.createCMB({ categories: cats, createdBy: 'peerA' });
-      node._frameHandler.handle('peerA', 'peerA', frame(cmb));
+      const cmb = signed(core.createCMB({ categories: cats, createdBy: 'peerA', emitV2: true, createdByNodeId: A_ID.nodeId, room: 'default' }));
+      node._frameHandler.handle(from(node), frame(cmb));
       await settle();
-      node._frameHandler.handle('peerA', 'peerA', frame(cmb));
+      node._frameHandler.handle(from(node), frame(cmb));
       await settle();
       assert.strictEqual(memoryReceived, 1, 'the admitted path still completes');
       assert.strictEqual(evaluations, 1, 'the replay is suppressed before SVAF');
@@ -384,12 +377,11 @@ describe('F3: an admitted broadcast the store already holds', () => {
 describe('B-L3: admission that leaves the text unchanged is a collapse (spec PR #17, §15.5 "Collapsed integration")', () => {
   it('stores the author\'s record exactly as signed, mints no receiver remix, writes no self-edge', async () => {
     await withNode('collapse', async (node) => {
-      node._pinPeerKey('peerA', PEER_A.pub);
       node._svafEvaluator.evaluate = async () => ALIGNED;
       const before = node.recall('').length;
       const cmb = signed(mkCmb('an observation the receiver integrates unchanged'));
       const key = cmb.metadata.key;
-      node._frameHandler.handle('peerA', 'peerA', frame(cmb));
+      node._frameHandler.handle(from(node), frame(cmb));
       await settle();
       const stored = node._store.get(key);
       assert.ok(stored, 'the record is held under the author\'s address');
@@ -405,31 +397,29 @@ describe('B-L3: admission that leaves the text unchanged is a collapse (spec PR
 });
 
 describe('author and inbox id on surfaced entries', () => {
-  it('carries the author and the delivering peer; the inbox `from` is the peer when nothing proves the author (K5)', async () => {
+  it('carries the author and the delivering peer; a relayed record names its proven author (K5)', async () => {
     await withNode('author', async (node) => {
       node._svafEvaluator.evaluate = async () => ALIGNED;
       const seen = collect(node);
-      node._frameHandler.handle('peer-a-id', 'peerA', frame(mkCmb('authorship check', { by: 'claude-sym-agent-a' })));
+      from(node); // the author's key is bound (it proved itself to this node once)
+      node._frameHandler.handle(from(node, B_ID), frame(signed(mkCmb('authorship check', { by: 'claude-sym-agent-a' }))));
       await settle();
       const e = seen.accepted[0];
-      assert.deepStrictEqual(e.author, { name: 'claude-sym-agent-a', nodeId: null, via: { name: 'peerA', nodeId: 'peer-a-id' } });
+      assert.deepStrictEqual(e.author, { name: 'claude-sym-agent-a', nodeId: A_ID.nodeId, via: { name: 'peerB', nodeId: B_ID.nodeId } });
       assert.ok(!String(e.author.name).includes('+'));
       const item = node.inboxGet(e.inboxId);
       assert.ok(item, 'the surfaced entry names its inbox id');
-      assert.strictEqual(item.from, 'peerA', 'an unsigned claim is not who the inbox says it is from');
-      assert.strictEqual(item.author.name, 'claude-sym-agent-a', 'the claim is kept, as a claim');
+      assert.strictEqual(item.from, 'claude-sym-agent-a', 'the signature proved the author');
       assert.strictEqual(item.seq, e.inboxSeq);
     });
   });
 
   it('K5: the inbox `from` is the author when its signature proved who that is', async () => {
     await withNode('author-proven', async (node) => {
-      node._pinPeerKey('peerA', PEER_A.pub);
       node._svafEvaluator.evaluate = async () => ALIGNED;
       const seen = collect(node);
       const cmb = signed(mkCmb('proven authorship', { by: 'peerA' }));
-      cmb.metadata.createdByNodeId = undefined;
-      node._frameHandler.handle('peerA', 'peerA', frame(cmb));
+      node._frameHandler.handle(from(node), frame(cmb));
       await settle();
       const item = node.inboxGet(seen.accepted[0].inboxId);
       assert.strictEqual(item.from, 'peerA');
@@ -438,33 +428,33 @@ describe('author and inbox id on surfaced entries', () => {
 
   it('every surfaced path carries author.via: rejected-directed, CLI-host and admitted', async () => {
     const paths = {
-      'rejected-directed': async (node) => { node._svafEvaluator.evaluate = async () => REJECTED; return directed(node, mkCmb('via rejected')); },
-      'cli-host': async (node) => { node._frameHandler._cliHostMode = true; return frame(mkCmb('via cli host')); },
-      admitted: async (node) => { node._svafEvaluator.evaluate = async () => ALIGNED; return frame(mkCmb('via admitted')); },
+      'rejected-directed': async (node) => { node._svafEvaluator.evaluate = async () => REJECTED; return directed(node, signed(mkCmb('via rejected', { to: node.nodeId }))); },
+      'cli-host': async (node) => { node._frameHandler._cliHostMode = true; return frame(signed(mkCmb('via cli host'))); },
+      admitted: async (node) => { node._svafEvaluator.evaluate = async () => ALIGNED; return frame(signed(mkCmb('via admitted'))); },
     };
     for (const [label, setup] of Object.entries(paths)) {
       await withNode(`via-${label}`, async (node) => {
         const seen = collect(node);
-        node._frameHandler.handle('peer-a-id', 'peerA', await setup(node));
+        node._frameHandler.handle(from(node), await setup(node));
         await settle();
         assert.strictEqual(seen.accepted.length, 1, label);
-        assert.deepStrictEqual(seen.accepted[0].author?.via, { name: 'peerA', nodeId: 'peer-a-id' }, `${label}: author.via`);
-        assert.deepStrictEqual(node.inboxGet(seen.accepted[0].inboxId).author?.via, { name: 'peerA', nodeId: 'peer-a-id' }, `${label}: inbox item author.via`);
+        assert.deepStrictEqual(seen.accepted[0].author?.via, { name: 'peerA', nodeId: A_ID.nodeId }, `${label}: author.via`);
+        assert.deepStrictEqual(node.inboxGet(seen.accepted[0].inboxId).author?.via, { name: 'peerA', nodeId: A_ID.nodeId }, `${label}: inbox item author.via`);
       });
     }
   });
 
   it('a frame-supplied source never names the deliverer (agent-a review, mission-56a137ffa8e4 F2)', async () => {
     for (const [label, verdict, mk] of [
-      ['admitted broadcast', ALIGNED, (node) => frame(mkCmb('forged deliverer A'))],
-      ['rejected directed', REJECTED, (node) => directed(node, mkCmb('forged deliverer B'))],
+      ['admitted broadcast', ALIGNED, (node) => frame(signed(mkCmb('forged deliverer A')))],
+      ['rejected directed', REJECTED, (node) => directed(node, signed(mkCmb('forged deliverer B', { to: node.nodeId })))],
     ]) {
       await withNode(`src-${label.replace(' ', '-')}`, async (node) => {
         node._svafEvaluator.evaluate = async () => verdict;
         const seen = collect(node);
         const f = mk(node);
         f.source = node.name; // pose as the receiver itself
-        node._frameHandler.handle('peer-a-id', 'peerA', f);
+        node._frameHandler.handle(from(node), f);
         await settle();
         assert.strictEqual(seen.accepted.length, 1, label);
         assert.ok(String(seen.accepted[0].source).endsWith('peerA'), `${label}: source names the connection, got ${seen.accepted[0].source}`);
@@ -473,31 +463,29 @@ describe('author and inbox id on surfaced entries', () => {
     }
   });
 
-  it('F15: an unverified createdByNodeId is not presented as the author identity, and msg.source is ignored', async () => {
+  it('F15 (Core Secure): a record naming another node as author is refused unless that node\'s key signed it', async () => {
     await withNode('author-forged', async (node) => {
       node._svafEvaluator.evaluate = async () => ALIGNED;
       const seen = collect(node);
-      const cmb = mkCmb('who wrote this', { by: 'peerA' });
-      cmb.metadata.createdByNodeId = 'victim-node-id';
-      const f = frame(cmb);
+      const metrics = [];
+      node.on('metric', (m) => metrics.push(m));
+      const f = frame(signed(mkCmb('who wrote this', { by: 'peerA', byNodeId: identity('victim').nodeId })));
       f.source = 'founder';
-      node._frameHandler.handle('peer-a-id', 'peerA', f);
+      node._frameHandler.handle(from(node), f);
       await settle();
-      assert.strictEqual(seen.accepted[0].author.name, 'peerA');
-      assert.strictEqual(seen.accepted[0].author.nodeId, null);
+      assert.strictEqual(seen.accepted.length, 0, 'the claimed author\'s key is not held: refused');
+      assert.ok(metrics.some((m) => m.type === 'cmb-author-unresolvable'));
     });
   });
 
   it('F15: a signed record whose createdByNodeId is the verified delivering peer carries that nodeId', async () => {
     await withNode('author-verified', async (node) => {
-      node._pinPeerKey('peer-a-id', PEER_A.pub);
       node._svafEvaluator.evaluate = async () => ALIGNED;
       const seen = collect(node);
       const cmb = mkCmb('signed by its author', { by: 'peerA' });
-      cmb.metadata.createdByNodeId = 'peer-a-id';
-      node._frameHandler.handle('peer-a-id', 'peerA', frame(signed(cmb)));
+      node._frameHandler.handle(from(node), frame(signed(cmb)));
       await settle();
-      assert.strictEqual(seen.accepted[0].author.nodeId, 'peer-a-id');
+      assert.strictEqual(seen.accepted[0].author.nodeId, A_ID.nodeId);
     });
   });
 });
@@ -507,8 +495,8 @@ describe('inboxAck (channel push/receive share one id)', () => {
     await withNode('ack', async (node) => {
       node._svafEvaluator.evaluate = async () => ALIGNED;
       const seen = collect(node);
-      node._frameHandler.handle('peerA', 'peerA', frame(mkCmb('first')));
-      node._frameHandler.handle('peerA', 'peerA', frame(mkCmb('second')));
+      node._frameHandler.handle(from(node), frame(signed(mkCmb('first'))));
+      node._frameHandler.handle(from(node), frame(signed(mkCmb('second'))));
       await settle();
       const [, second] = seen.accepted;
       assert.strictEqual(node.inboxStatus().undrained, 2);
@@ -533,7 +521,7 @@ describe('inboxAck (channel push/receive share one id)', () => {
     try {
       node._svafEvaluator.evaluate = async () => ALIGNED;
       const seen = collect(node);
-      node._frameHandler.handle('peerA', 'peerA', frame(mkCmb('survives restart')));
+      node._frameHandler.handle(from(node), frame(signed(mkCmb('survives restart'))));
       await settle();
       node.inboxAck(seen.accepted[0].inboxId);
       await node.stop(); // re-review F8: stop() flushes the throttled inbox write
@@ -559,6 +547,7 @@ describe('B-L1: admission keeps the author\'s record (MMP §8.8.4, §15.2)', ()
         const incoming = core.createCMB({
           categories: { focus, issue: 'audit regression', intent: 'verify', motivation: 'MMP 2.0 audit', commitment: 'guard', perspective: 'claude-sym-agent-a', mood: { text: 'alarmed', valence: -0.7, arousal: 0.8 } },
           createdBy: 'claude-sym-agent-a',
+          emitV2: true, createdByNodeId: A_ID.nodeId, room: 'default',
           lineage: { parents: ['cmb-' + String(i).repeat(64)], method: 'rule-a' },
           // A signed per-category section that fusion must carry through (review F5).
           categoryParents: { issue: ['cmb-' + 'f'.repeat(64)] },
@@ -592,25 +581,22 @@ describe('B-L1: admission keeps the author\'s record (MMP §8.8.4, §15.2)', ()
 });
 
 describe('B-D5: directed sends that mint nothing still deliver (MMP §4.4.4)', () => {
+  // A peer as a confirmed session leaves it: `frames` is what the node hands it, before sealing.
   function fakePeer(node, peerId, { accept = true } = {}) {
     const frames = [];
-    node._peers.set(peerId, { peerId, name: peerId, lastSeen: Date.now(), transport: { send: (f) => { frames.push(f); return accept; }, close() {} } });
+    const sess = admitAs(node, { nodeId: peerId, name: peerId });
+    sess.send = (f) => { frames.push(f); return accept; };
+    sess.trySend = (f) => (sess.send(f) ? { ok: true } : { ok: false, reason: 'send-failed' });
     return frames;
   }
-  // A real receiving node: every frame A hands to its transport is handled by B's frame handler.
-  function pipe(a, b) {
-    b._pinPeerKey(a.nodeId, a._identity.publicKey);
-    a._peers.set(b.nodeId, {
-      peerId: b.nodeId, name: b.name, lastSeen: Date.now(),
-      transport: { send: (f) => { const copy = JSON.parse(JSON.stringify(f)); setImmediate(() => b._frameHandler.handle(a.nodeId, a.name, copy)); return true; }, close() {} },
-    });
-  }
+  // A real receiving node, through the real handshake.
+  const pipe = (a, b) => connectNodes(a, b);
   const cats = (focus) => ({ focus, issue: 'x', intent: 'tell', motivation: 'm', commitment: 'c', perspective: 'me', mood: NEUTRAL });
 
   for (const [label, verdict] of [['memory rejects', REJECTED], ['memory admits', ALIGNED]]) {
     it(`F1: the same words sent twice to the same peer surface twice at that peer (${label})`, async () => {
       await withNode('d5-a', (a) => withNode('d5-b', async (b) => {
-        pipe(a, b);
+        await pipe(a, b);
         b._svafEvaluator.evaluate = async () => verdict;
         const seen = collect(b);
         const first = a.remember(cats('please review'), { to: b.nodeId });
@@ -628,7 +614,7 @@ describe('B-D5: directed sends that mint nothing still deliver (MMP §4.4.4)', (
 
   it('re-review F9: two directed sends of the same words in one millisecond both surface', async () => {
     await withNode('d5-a', (a) => withNode('d5-b', async (b) => {
-      pipe(a, b);
+      await pipe(a, b);
       b._svafEvaluator.evaluate = async () => REJECTED;
       const seen = collect(b);
       a.remember(cats('ping'), { to: b.nodeId });
@@ -655,7 +641,7 @@ describe('B-D5: directed sends that mint nothing still deliver (MMP §4.4.4)', (
       fakePeer(node, 'peer-a');
       node._svafEvaluator.evaluate = async () => ALIGNED;
       const shared = { focus: 'shared words', issue: 'x', intent: 'tell', motivation: 'm', commitment: 'c', perspective: 'peerA', mood: NEUTRAL };
-      node._frameHandler.handle('peerA', 'peerA', frame(core.createCMB({ categories: shared, createdBy: 'peerA' })));
+      node._frameHandler.handle(from(node), frame(signed(core.createCMB({ categories: shared, createdBy: 'peerA', emitV2: true, createdByNodeId: A_ID.nodeId, room: 'default' }))));
       await settle();
       const r = node.remember(shared, { to: 'peer-a' });
       assert.strictEqual(r.duplicate, true);
@@ -715,7 +701,7 @@ describe('B-D5: directed sends that mint nothing still deliver (MMP §4.4.4)', (
       assert.strictEqual(second.delivery.undelivered, false);
       assert.strictEqual(a.length, 1);
       assert.strictEqual(b.length, 1);
-      assert.strictEqual(b[0].directed, true);
+      assert.strictEqual(b[0].cmb.metadata.to, 'peer-b', 'directed by its signed addressee');
     });
   });
 
diff --git a/tests/checkpoint-rate.test.js b/tests/checkpoint-rate.test.js
index 4378c19a..b1d9b248 100644
--- a/tests/checkpoint-rate.test.js
+++ b/tests/checkpoint-rate.test.js
@@ -33,7 +33,7 @@ function withNode(n, fn) {
   const node = new SymNode({ name, silent: true, discovery: new NullDiscovery(), room: ROOM });
   try {
     const keys = Array.from({ length: n }, (_, i) => ({ id: `att-${i}`, ...kp() }));
-    for (const k of keys) node._pinPeerKey(k.id, k.pub);
+    for (const k of keys) node._roster.bind(k.id, k.pub, 'proven');
     const sent = [];
     node._gossipToRoster = (frame) => sent.push(frame);
     const clock = { t: 1_800_000_000_000 };
diff --git a/tests/cmb-fetch-serves-v2.test.js b/tests/cmb-fetch-serves-v2.test.js
index 40aa9eb9..435e64b6 100644
--- a/tests/cmb-fetch-serves-v2.test.js
+++ b/tests/cmb-fetch-serves-v2.test.js
@@ -20,6 +20,17 @@ const { SymNode } = require('../lib/node');
 const { NullDiscovery } = require('../lib/discovery');
 const { nodeDir } = require('../lib/config');
 const { createCMB, signCMB, verifyCMB, assertionIdV2_0 } = require('../lib/core');
+const { admitAs, identity } = require('./_core-secure');
+
+// Core Secure (design D1): a fetched record goes out as its own `cmb` frame (sealed cmb-encrypted),
+// then a `cmb-fetch-result` with the correlation id and the found / not-found key lists.
+function serve(node, key, reqId) {
+  const requester = admitAs(node, identity('requester'));
+  node._frameHandler.handle(requester, { type: 'cmb-fetch', key, reqId });
+  const res = requester.sent.find((f) => f.type === 'cmb-fetch-result');
+  const at = (t) => requester.sent.findIndex((f) => f.type === t);
+  return { res, record: requester.sent.find((f) => f.type === 'cmb')?.cmb, recordFirst: at('cmb') !== -1 && at('cmb') < at('cmb-fetch-result') };
+}
 
 describe('cmb-fetch serving', () => {
   it('a served v2.0 record still verifies against its author', () => {
@@ -36,16 +47,14 @@ describe('cmb-fetch serving', () => {
       signCMB(cmb, priv);
       assert.deepStrictEqual(verifyCMB(cmb, pub).valid, true, 'precondition: the stored record verifies');
       node._store.get = (k) => (k === cmb.metadata.key ? { key: k, cmb } : null);
-      const sent = [];
-      node._peers.set('peer-r', { peerId: 'peer-r', name: 'requester', transport: { send: (f) => { sent.push(f); return true; } } });
-      node._frameHandler._handleCmbFetch('peer-r', 'requester', { type: 'cmb-fetch', key: cmb.metadata.key, reqId: 'r1' });
-      const res = sent.find((f) => f.type === 'cmb-fetch-result');
-      assert.ok(res?.found);
+      const { res, record, recordFirst } = serve(node, cmb.metadata.key, 'r1');
+      assert.deepStrictEqual(res, { type: 'cmb-fetch-result', reqId: 'r1', found: [cmb.metadata.key], notFound: [], timestamp: res.timestamp }, 'the result carries only the id and the key lists');
+      assert.ok(recordFirst, 'the record goes first, in its own frame');
       for (const k of ['signatureSuite', 'addressScheme', 'createdByNodeId', 'application', 'assertionId']) {
-        assert.ok(k in res.cmb.metadata, `${k} is served`);
+        assert.ok(k in record.metadata, `${k} is served`);
       }
-      assert.strictEqual(verifyCMB(JSON.parse(JSON.stringify(res.cmb)), pub).valid, true, 'the served record verifies');
-      res.cmb.metadata.key = 'tampered';
+      assert.strictEqual(verifyCMB(JSON.parse(JSON.stringify(record)), pub).valid, true, 'the served record verifies');
+      record.metadata.key = 'tampered';
       assert.notStrictEqual(cmb.metadata.key, 'tampered', 'the store keeps its own copy');
     } finally { fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
   });
@@ -61,23 +70,33 @@ describe('cmb-fetch serving', () => {
       const parent = createCMB({ categories: { focus: 'the issue it descends from', issue: 'an earlier issue' }, createdBy: 'alice' });
       const cmb = createCMB({
         categories: { focus: 'continues its own line', issue: 'descends from the peer\'s issue' },
-        createdBy: 'alice',
+        createdBy: 'alice', emitV2: true, createdByNodeId: 'node-alice', room: 'default',
         categoryParents: { issue: [parent.categories.issue.meta.key], focus: [parent.categories.focus.meta.key] },
       });
+      cmb.metadata.assertionId = assertionIdV2_0(cmb);
       signCMB(cmb, privateKey.slice(-32).toString('base64url'));
       assert.strictEqual(verifyCMB(cmb, pub).valid, true, 'precondition: the stored record verifies');
       // As a store may hold it after a gate measured it: a vector beside the text.
       const stored = JSON.parse(JSON.stringify(cmb));
       stored.categories.focus.vector = [0.1, 0.2];
       node._store.get = (k) => (k === cmb.metadata.key ? { key: k, cmb: stored } : null);
-      const sent = [];
-      node._peers.set('peer-r', { peerId: 'peer-r', name: 'requester', transport: { send: (f) => { sent.push(f); return true; } } });
-      node._frameHandler._handleCmbFetch('peer-r', 'requester', { type: 'cmb-fetch', key: cmb.metadata.key, reqId: 'r2' });
-      const served = JSON.parse(JSON.stringify(sent.find((f) => f.type === 'cmb-fetch-result').cmb));
+      const served = JSON.parse(JSON.stringify(serve(node, cmb.metadata.key, 'r2').record));
       assert.deepStrictEqual(served.categories.issue.meta.parents, [parent.categories.issue.meta.key], 'each category\'s signed meta is served');
       assert.strictEqual(verifyCMB(served, pub).valid, true, 'the served record verifies at the requester');
       assert.strictEqual('vector' in served.categories.focus, false, 'vectors stay local');
       assert.deepStrictEqual(Object.keys(served).sort(), ['categories', 'metadata']);
     } finally { fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
   });
+
+  it('a pre-v2.0 record is not served over Core Secure: listed notFound, no record frame', () => {
+    const name = `fetchold-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+    const node = new SymNode({ name, silent: true, discovery: new NullDiscovery() });
+    try {
+      const old = createCMB({ categories: { focus: 'an old record' }, createdBy: 'alice' });
+      node._store.get = (k) => (k === old.metadata.key ? { key: k, cmb: old } : null);
+      const { res, record } = serve(node, old.metadata.key, 'r3');
+      assert.deepStrictEqual([res.found, res.notFound], [[], [old.metadata.key]]);
+      assert.strictEqual(record, undefined);
+    } finally { fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+  });
 });
diff --git a/tests/cmb-fetch.test.js b/tests/cmb-fetch.test.js
index 4f97edd6..7b75b3c0 100644
--- a/tests/cmb-fetch.test.js
+++ b/tests/cmb-fetch.test.js
@@ -35,60 +35,70 @@ function cat7(t) {
   };
 }
 
+// A peer as a confirmed session leaves it (Core Secure, 0.14): `sent` is what the node sends it,
+// before sealing. A fetch is answered by each record in its own sealed record frame, then a sealed
+// cmb-fetch-result carrying only the correlation id and the found / not-found key lists (design D1).
+const { admitAs } = require('./_core-secure');
 function fakePeer(node, peerId) {
-  const sent = [];
-  node._peers.set(peerId, { transport: { send: (f) => sent.push(f), close: () => {} } });
-  return sent;
+  return admitAs(node, { nodeId: peerId, name: peerId });
+}
+/** Deliver a fetch answer on `session` as the server sends it: the record (if any), then the result. */
+function answer(node, session, reqId, key, cmb) {
+  if (cmb) node._frameHandler.handle(session, { type: 'cmb', cmb });
+  node._frameHandler.handle(session, { type: 'cmb-fetch-result', reqId, found: cmb ? [key] : [], notFound: cmb ? [] : [key] });
 }
 
 describe('MMP §7 cmb-fetch — content-addressed retrieval', () => {
-  it('serves a held root text-only, keyed exactly', async () => {
+  it('serves a held record as signed: the record in its own sealed frame, then the key lists', async () => {
     await withNode('cfetch-serve', async (node) => {
       const root = node.remember(cat7('mountain trail conditions report for the north ridge'));
-      const sent = fakePeer(node, 'peerX');
-      node._frameHandler.handle('peerX', 'peerX', { type: 'cmb-fetch', key: root.key, reqId: 'r1' });
-      const res = sent.find((f) => f.type === 'cmb-fetch-result');
+      const peer = fakePeer(node, 'peerX');
+      node._frameHandler.handle(peer, { type: 'cmb-fetch', key: root.key, reqId: 'r1' });
+      const res = peer.sent.find((f) => f.type === 'cmb-fetch-result');
       assert.ok(res, 'responds');
-      assert.strictEqual(res.found, true);
-      assert.strictEqual(res.cmb.metadata.key, root.key);
-      assert.ok(res.cmb.categories.focus.text.length > 0, 'text served');
-      assert.strictEqual(res.cmb.categories.focus.vector, undefined, 'vectors stripped — re-verifiers re-encode');
+      assert.deepStrictEqual(Object.keys(res).sort(), ['found', 'notFound', 'reqId', 'timestamp', 'type'], 'the id and the key lists, never the record (it was plaintext; §18.2.1)');
+      assert.deepStrictEqual([res.reqId, res.found, res.notFound], ['r1', [root.key], []]);
+      assert.ok(peer.sent.findIndex((f) => f.type === 'cmb') < peer.sent.indexOf(res), 'the record goes first');
+      const rec = peer.sent.find((f) => f.type === 'cmb');
+      assert.strictEqual(rec.cmb.metadata.key, root.key);
+      assert.ok(rec.cmb.categories.focus.text.length > 0, 'text served');
+      assert.strictEqual(rec.cmb.categories.focus.vector, undefined, 'vectors stripped — re-verifiers re-encode');
+      assert.deepStrictEqual(Object.keys(rec.cmb).sort(), ['categories', 'metadata'], 'exactly as signed');
     });
   });
 
-  it('answers found:false for an unknown key', async () => {
+  it('lists an unknown key as notFound, and sends no record', async () => {
     await withNode('cfetch-miss', async (node) => {
-      const sent = fakePeer(node, 'peerX');
-      node._frameHandler.handle('peerX', 'peerX', { type: 'cmb-fetch', key: 'cmb1-doesnotexist', reqId: 'r2' });
-      const res = sent.find((f) => f.type === 'cmb-fetch-result');
-      assert.strictEqual(res.found, false);
-      assert.strictEqual(res.cmb, null);
+      const peer = fakePeer(node, 'peerX');
+      node._frameHandler.handle(peer, { type: 'cmb-fetch', key: 'cmb1-doesnotexist', reqId: 'r2' });
+      const res = peer.sent.find((f) => f.type === 'cmb-fetch-result');
+      assert.deepStrictEqual([res.found, res.notFound], [[], ['cmb1-doesnotexist']]);
+      assert.strictEqual(peer.sent.filter((f) => f.type === 'cmb').length, 0);
     });
   });
 
   it('fetchCMB resolves on a verified response and rejects a forged one', async () => {
     await withNode('cfetch-verify', async (nodeA) => {
-      // nodeA holds the root; grab the exact wire form it would serve.
+      // nodeA holds the root; grab the exact record it would serve.
       const root = nodeA.remember(cat7('fresh snowfall reported on the upper mountain trail sections'));
-      const sentByA = fakePeer(nodeA, 'peerB');
-      nodeA._frameHandler.handle('peerB', 'peerB', { type: 'cmb-fetch', key: root.key, reqId: 'wire' });
-      const served = sentByA.find((f) => f.type === 'cmb-fetch-result').cmb;
+      const toB = fakePeer(nodeA, 'peerB');
+      nodeA._frameHandler.handle(toB, { type: 'cmb-fetch', key: root.key, reqId: 'wire' });
+      const served = toB.sent.find((f) => f.type === 'cmb').cmb;
 
       await withNode('cfetch-req', async (nodeB) => {
-        fakePeer(nodeB, 'peerA'); // captures the outgoing cmb-fetch
+        const a = fakePeer(nodeB, 'peerA');
+        const evil = fakePeer(nodeB, 'peerEvil');
         const p = nodeB.fetchCMB(root.key, { timeoutMs: 2000 });
         const reqId = [...nodeB._cmbFetchPending.keys()][0];
+        assert.ok(a.sent.some((f) => f.type === 'cmb-fetch' && f.reqId === reqId), 'asked over the session (sealed)');
 
-        // Forged response first: same key, tampered text → recomputed address
-        // mismatches → discarded (counted as a miss, does not resolve).
+        // Forged response first: same key, tampered text → recomputed address mismatches → discarded.
         const forged = JSON.parse(JSON.stringify(served));
         forged.categories.focus.text = 'entirely different content under the same key';
-        nodeB._frameHandler.handle('peerEvil', 'peerEvil',
-          { type: 'cmb-fetch-result', reqId, key: root.key, found: true, cmb: forged });
+        answer(nodeB, evil, reqId, root.key, forged);
 
         // Genuine response second: verifies and resolves.
-        nodeB._frameHandler.handle('peerA', 'peerA',
-          { type: 'cmb-fetch-result', reqId, key: root.key, found: true, cmb: served });
+        answer(nodeB, a, reqId, root.key, JSON.parse(JSON.stringify(served)));
 
         const hit = await p;
         assert.ok(hit, 'verified response resolves');
@@ -113,15 +123,16 @@ describe('MMP §7 cmb-fetch — content-addressed retrieval', () => {
     // what the dependency now returns for the records you actually hold".
     const { cmbKeyV1 } = require('../lib/core');
     await withNode('cfetch-legacy', async (nodeB) => {
-      fakePeer(nodeB, 'peerA');
+      const a = fakePeer(nodeB, 'peerA');
       const categories = cat7('a pre-boundary block minted before the merkle cutover');
       // Pre-boundary wire shape: NO `metadata`, address at the top level, FLAT root derivation.
       const legacy = { categories, key: cmbKeyV1(categories) };
 
       const p = nodeB.fetchCMB(legacy.key, { timeoutMs: 2000 });
       const reqId = [...nodeB._cmbFetchPending.keys()][0];
-      nodeB._frameHandler.handle('peerA', 'peerA',
-        { type: 'cmb-fetch-result', reqId, key: legacy.key, found: true, cmb: legacy });
+      // (Over Core Secure a server sends only a v2.0 record; the requester's address check, the one
+      // under test, still takes a pre-boundary one.)
+      answer(nodeB, a, reqId, legacy.key, legacy);
 
       const hit = await p;
       assert.ok(hit, 'a legitimate pre-boundary record must VERIFY, not be discarded as forged');
@@ -135,7 +146,7 @@ describe('MMP §7 cmb-fetch — content-addressed retrieval', () => {
     // and both used to arrive as a bare `null` that this call site reported as a mismatch,
     // accusing a record it had merely failed to read.
     await withNode('cfetch-classes', async (nodeB) => {
-      fakePeer(nodeB, 'peerA');
+      const a = fakePeer(nodeB, 'peerA');
       const metrics = [];
       nodeB.on('metric', (m) => { if (m.type === 'cmb-fetch-forged') metrics.push(m); });
 
@@ -146,8 +157,7 @@ describe('MMP §7 cmb-fetch — content-addressed retrieval', () => {
       const p = nodeB.fetchCMB(key, { timeoutMs: 600 });
       const reqId = [...nodeB._cmbFetchPending.keys()][0];
       // Same key, NO container — unreadable rather than altered.
-      nodeB._frameHandler.handle('peerA', 'peerA',
-        { type: 'cmb-fetch-result', reqId, key, found: true, cmb: { key } });
+      answer(nodeB, a, reqId, key, { key });
       await p;
 
       assert.strictEqual(metrics.length, 1);
@@ -156,23 +166,47 @@ describe('MMP §7 cmb-fetch — content-addressed retrieval', () => {
     });
   });
 
+  it('serves several keys in one request: each found record in its own frame, then one result', async () => {
+    await withNode('cfetch-multi', async (node) => {
+      const r1 = node.remember(cat7('the first record of a multi-key fetch about avalanche risk'));
+      const r2 = node.remember(cat7('the second record of a multi-key fetch about lift closures'));
+      const peer = fakePeer(node, 'peerX');
+      node._frameHandler.handle(peer, { type: 'cmb-fetch', keys: [r1.key, 'cmb1-missing', r2.key, r1.key], reqId: 'm1' });
+      assert.deepStrictEqual(peer.sent.map((f) => f.type), ['cmb', 'cmb', 'cmb-fetch-result']);
+      const res = peer.sent[2];
+      assert.deepStrictEqual([res.found, res.notFound], [[r1.key, r2.key], ['cmb1-missing']], 'each key once');
+    });
+  });
+
+  it('a result that lists the key as found closes the request for that peer when no verifying record came first', async () => {
+    await withNode('cfetch-found-nothing', async (node) => {
+      const a = fakePeer(node, 'peerA');
+      const p = node.fetchCMB('cmb1-claimed', { timeoutMs: 3000 });
+      const reqId = [...node._cmbFetchPending.keys()][0];
+      const t0 = Date.now();
+      node._frameHandler.handle(a, { type: 'cmb-fetch-result', reqId, found: ['cmb1-claimed'], notFound: [] });
+      assert.strictEqual(await p, null);
+      assert.ok(Date.now() - t0 < 1000, 'closed by the result, not by the timeout');
+      assert.strictEqual(a._fetchExpect.size, 0, 'the expectation is let go');
+    });
+  });
+
   it('fetchCMB returns the local copy without asking the mesh', async () => {
     await withNode('cfetch-local', async (node) => {
       const root = node.remember(cat7('trailhead parking permits and the shuttle bus timetable'));
-      const sent = fakePeer(node, 'peerX');
+      const peer = fakePeer(node, 'peerX');
       const hit = await node.fetchCMB(root.key);
       assert.ok(hit && hit.from === node.name);
-      assert.strictEqual(sent.length, 0, 'no wire traffic for a locally held key');
+      assert.strictEqual(peer.sent.length, 0, 'no wire traffic for a locally held key');
     });
   });
 
   it('fetchCMB times out to null when every peer misses', async () => {
     await withNode('cfetch-timeout', async (node) => {
-      fakePeer(node, 'peerX');
+      const peer = fakePeer(node, 'peerX');
       const p = node.fetchCMB('cmb1-nowhere', { timeoutMs: 300 });
       const reqId = [...node._cmbFetchPending.keys()][0];
-      node._frameHandler.handle('peerX', 'peerX',
-        { type: 'cmb-fetch-result', reqId, key: 'cmb1-nowhere', found: false, cmb: null });
+      answer(node, peer, reqId, 'cmb1-nowhere', null);
       assert.strictEqual(await p, null);
     });
   });
diff --git a/tests/cmb-signing.test.js b/tests/cmb-signing.test.js
index 5d26e688..ff3053e1 100644
--- a/tests/cmb-signing.test.js
+++ b/tests/cmb-signing.test.js
@@ -20,7 +20,11 @@ const crypto = require('crypto');
 const { SymNode } = require('../lib/node');
 const { NullDiscovery } = require('../lib/discovery');
 const { nodeDir } = require('../lib/config');
-const { createCMB, signCMB, verifyCMB } = require('../lib/core');
+const { createCMB, signCMB, verifyCMB, assertionIdV2_0 } = require('../lib/core');
+// Since 0.14 (Core Secure) a record names its author by node id and is verified against the key
+// bound to that id (design D3/D4); the delivering session is a confirmed one.
+const { identity, admitAs } = require('./_core-secure');
+const PEER = identity('peerA');
 
 async function withNode(baseName, fn) {
   const name = `${baseName}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
@@ -45,6 +49,7 @@ function rawKeypair() {
 
 function signedCmbFrame(priv, createdBy = 'peerA') {
   const cmb = createCMB({
+    emitV2: true, createdByNodeId: PEER.nodeId, room: 'default',
     categories: {
       focus: 'coordinate the auth-token refactor',
       issue: 'signing regression guard',
@@ -56,6 +61,7 @@ function signedCmbFrame(priv, createdBy = 'peerA') {
     },
     createdBy,
   });
+  cmb.metadata.assertionId = assertionIdV2_0(cmb);
   signCMB(cmb, priv);
   return { type: 'cmb', timestamp: Date.now(), cmb };
 }
@@ -84,10 +90,10 @@ describe('CMB authentication — Ed25519 sign + verify (MMP §8.3)', () => {
     await withNode('verify-ok', async (node) => {
       node._svafEvaluator.evaluate = async () => ALIGNED;
       const { pub, priv } = rawKeypair();
-      node._peerIdentityKeys.set('peerA', pub);
+      node.__peerSession = admitAs(node, { nodeId: PEER.nodeId, name: 'peerA', publicKey: pub });
       let surfaced = 0;
       node.on('cmb-accepted', () => { surfaced++; });
-      node._frameHandler.handle('peerA', 'peerA', wire(signedCmbFrame(priv)));
+      node._frameHandler.handle(node.__peerSession, wire(signedCmbFrame(priv)));
       await settle();
       assert.strictEqual(surfaced, 1, 'a valid signed CMB is processed/surfaced');
     });
@@ -97,13 +103,13 @@ describe('CMB authentication — Ed25519 sign + verify (MMP §8.3)', () => {
     await withNode('verify-tamper', async (node) => {
       node._svafEvaluator.evaluate = async () => ALIGNED;
       const { pub, priv } = rawKeypair();
-      node._peerIdentityKeys.set('peerA', pub);
+      node.__peerSession = admitAs(node, { nodeId: PEER.nodeId, name: 'peerA', publicKey: pub });
       let surfaced = 0, rejected = 0;
       node.on('cmb-accepted', () => { surfaced++; });
       node.on('metric', (m) => { if (m.type === 'cmb-signature-rejected') rejected++; });
       const frame = wire(signedCmbFrame(priv));
       frame.cmb.categories.focus.text = 'wire the funds to a new account'; // swap content, keep sig+key
-      node._frameHandler.handle('peerA', 'peerA', frame);
+      node._frameHandler.handle(node.__peerSession, frame);
       await settle();
       assert.strictEqual(surfaced, 0, 'a content-tampered CMB must not surface');
       assert.strictEqual(rejected, 1, 'rejection is audit-metered');
@@ -115,46 +121,47 @@ describe('CMB authentication — Ed25519 sign + verify (MMP §8.3)', () => {
       node._svafEvaluator.evaluate = async () => ALIGNED;
       const peer = rawKeypair();
       const attacker = rawKeypair();
-      node._peerIdentityKeys.set('peerA', peer.pub); // we expect peerA's key
+      node.__peerSession = admitAs(node, { nodeId: PEER.nodeId, name: 'peerA', publicKey: peer.pub }); // we expect peerA's key
       let surfaced = 0, rejected = 0;
       node.on('cmb-accepted', () => { surfaced++; });
       node.on('metric', (m) => { if (m.type === 'cmb-signature-rejected') rejected++; });
-      node._frameHandler.handle('peerA', 'peerA', wire(signedCmbFrame(attacker.priv))); // signed by attacker
+      node._frameHandler.handle(node.__peerSession, wire(signedCmbFrame(attacker.priv))); // signed by attacker
       await settle();
       assert.strictEqual(surfaced, 0, 'a CMB signed by the wrong key must not surface');
       assert.strictEqual(rejected, 1);
     });
   });
 
-  it('an unsigned CMB is allowed through (interop) but flagged unverified', async () => {
+  it('an unsigned CMB is REFUSED (Core Secure, §18.3.1) — interop no longer admits it', async () => {
     await withNode('verify-unsigned', async (node) => {
       node._svafEvaluator.evaluate = async () => ALIGNED;
-      node._peerIdentityKeys.set('peerA', rawKeypair().pub);
+      node.__peerSession = admitAs(node, { nodeId: PEER.nodeId, name: 'peerA', publicKey: rawKeypair().pub });
       let surfaced = 0;
+      const rejected = [];
       node.on('cmb-accepted', () => { surfaced++; });
+      node.on('metric', (m) => { if (m.type === 'cmb-signature-rejected') rejected.push(m.reason); });
       const frame = wire(signedCmbFrame(rawKeypair().priv));
-      // The signature lives in metadata now — deleting the old top-level categories was a
-      // no-op, so this fixture was still signed and the test proved nothing.
       delete frame.cmb.metadata.sig; delete frame.cmb.metadata.sigAlg;
-      node._frameHandler.handle('peerA', 'peerA', frame);
+      node._frameHandler.handle(node.__peerSession, frame);
       await settle();
-      assert.strictEqual(surfaced, 1, 'unsigned CMB still surfaces (interop default)');
+      assert.strictEqual(surfaced, 0, 'an unsigned record does not surface');
+      assert.deepStrictEqual(rejected, ['unsigned']);
     });
   });
 
-  it('strict mode (requireSignedCmb) rejects an unsigned CMB from a known peer', async () => {
+  it('strict mode is the only mode: SYM_REQUIRE_SIGNED_CMB off still refuses an unsigned CMB', async () => {
     await withNode('verify-strict', async (node) => {
       node._svafEvaluator.evaluate = async () => ALIGNED;
-      node._requireSignedCmb = true;
-      node._peerIdentityKeys.set('peerA', rawKeypair().pub);
+      node._requireSignedCmb = false;
+      node.__peerSession = admitAs(node, { nodeId: PEER.nodeId, name: 'peerA', publicKey: rawKeypair().pub });
       let surfaced = 0, rejected = 0;
       node.on('cmb-accepted', () => { surfaced++; });
       node.on('metric', (m) => { if (m.type === 'cmb-signature-rejected') rejected++; });
       const frame = wire(signedCmbFrame(rawKeypair().priv));
-      delete frame.cmb.sig; delete frame.cmb.sigAlg;
-      node._frameHandler.handle('peerA', 'peerA', frame);
+      delete frame.cmb.metadata.sig; delete frame.cmb.metadata.sigAlg;
+      node._frameHandler.handle(node.__peerSession, frame);
       await settle();
-      assert.strictEqual(surfaced, 0, 'strict mode rejects unsigned CMBs');
+      assert.strictEqual(surfaced, 0);
       assert.strictEqual(rejected, 1);
     });
   });
@@ -178,12 +185,12 @@ describe('rejection diagnosability — the decision records WHY, not a constant'
     await withNode('diag-tamper', async (node) => {
       node._svafEvaluator.evaluate = async () => ALIGNED;
       const { pub, priv } = rawKeypair();
-      node._peerIdentityKeys.set('peerA', pub);
+      node.__peerSession = admitAs(node, { nodeId: PEER.nodeId, name: 'peerA', publicKey: pub });
       const decisions = [];
       node.on('svaf-decision', (d) => { if (d.decision === 'rejected-signature') decisions.push(d); });
       const frame = wire(signedCmbFrame(priv));
       frame.cmb.categories.focus.text = 'wire the funds to a new account';
-      node._frameHandler.handle('peerA', 'peerA', frame);
+      node._frameHandler.handle(node.__peerSession, frame);
       await settle();
       assert.strictEqual(decisions.length, 1, 'the rejection is recorded');
       assert.strictEqual(decisions[0].focusLabel, 'content-mismatch',
@@ -196,10 +203,10 @@ describe('rejection diagnosability — the decision records WHY, not a constant'
     await withNode('diag-spoof', async (node) => {
       node._svafEvaluator.evaluate = async () => ALIGNED;
       const peer = rawKeypair(), attacker = rawKeypair();
-      node._peerIdentityKeys.set('peerA', peer.pub);
+      node.__peerSession = admitAs(node, { nodeId: PEER.nodeId, name: 'peerA', publicKey: peer.pub });
       const decisions = [];
       node.on('svaf-decision', (d) => { if (d.decision === 'rejected-signature') decisions.push(d); });
-      node._frameHandler.handle('peerA', 'peerA', wire(signedCmbFrame(attacker.priv)));
+      node._frameHandler.handle(node.__peerSession, wire(signedCmbFrame(attacker.priv)));
       await settle();
       assert.strictEqual(decisions.length, 1);
       assert.strictEqual(decisions[0].focusLabel, 'bad-signature');
@@ -213,10 +220,10 @@ describe('rejection diagnosability — the decision records WHY, not a constant'
     await withNode('diag-metric', async (node) => {
       node._svafEvaluator.evaluate = async () => ALIGNED;
       const peer = rawKeypair(), attacker = rawKeypair();
-      node._peerIdentityKeys.set('peerA', peer.pub);
+      node.__peerSession = admitAs(node, { nodeId: PEER.nodeId, name: 'peerA', publicKey: peer.pub });
       const metrics = [];
       node.on('metric', (m) => { if (m.type === 'cmb-signature-rejected') metrics.push(m); });
-      node._frameHandler.handle('peerA', 'peerA', wire(signedCmbFrame(attacker.priv)));
+      node._frameHandler.handle(node.__peerSession, wire(signedCmbFrame(attacker.priv)));
       await settle();
       assert.strictEqual(metrics.length, 1);
       assert.strictEqual(metrics[0].reason, 'invalid', 'existing consumers see no change');
@@ -228,12 +235,12 @@ describe('rejection diagnosability — the decision records WHY, not a constant'
     await withNode('diag-remix', async (node) => {
       node._svafEvaluator.evaluate = async () => ALIGNED;
       const peer = rawKeypair(), attacker = rawKeypair();
-      node._peerIdentityKeys.set('peerA', peer.pub);
+      node.__peerSession = admitAs(node, { nodeId: PEER.nodeId, name: 'peerA', publicKey: peer.pub });
       const decisions = [];
       node.on('svaf-decision', (d) => { if (d.decision === 'rejected-signature') decisions.push(d); });
       const frame = wire(signedCmbFrame(attacker.priv));
-      frame.cmb.lineage = { parents: ['cmb-' + 'a'.repeat(64)], ancestors: [], method: 'svaf-heuristic' };
-      node._frameHandler.handle('peerA', 'peerA', frame);
+      frame.cmb.metadata.lineage = { parents: ['cmb-' + 'a'.repeat(64)], method: 'svaf-heuristic' };
+      node._frameHandler.handle(node.__peerSession, frame);
       await settle();
       assert.strictEqual(decisions.length, 1);
       assert.strictEqual(decisions[0].remix, true,
diff --git a/tests/core-secure-authority.test.js b/tests/core-secure-authority.test.js
new file mode 100644
index 00000000..e9c12ae1
--- /dev/null
+++ b/tests/core-secure-authority.test.js
@@ -0,0 +1,132 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME before lib/config loads
+
+/**
+ * Design D3 — authority follows the key.
+ *   - resolveRole(nodeId, key, at): a grant confers its role only when its granteeKey is the key the
+ *     subject holds, so an id claimed under another key is a participant.
+ *   - Grant chains are verified top-down with the key each verified grant vouches, never with the key
+ *     the registry holds for the grantor: a grantor bound to an impostor keeps exactly the authority
+ *     of its vouched key, and the impostor gets none.
+ *   - Every role-grant carries granteeKey; grantRole refuses without a proven key for the grantee.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const crypto = require('crypto');
+const fs = require('fs');
+const { RoleGrantStore } = require('../lib/role-grant-store');
+const { RosterKeyRegistry } = require('../lib/roster-keys');
+const { SymNode } = require('../lib/node');
+const { NullDiscovery } = require('../lib/discovery');
+const { nodeDir, loadOrCreateIdentity } = require('../lib/config');
+const { signGrant } = require('../lib/core');
+
+function kp(nodeId) {
+  const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519');
+  return {
+    nodeId,
+    priv: privateKey.export({ format: 'der', type: 'pkcs8' }).subarray(16).toString('base64url'),
+    pub: publicKey.export({ format: 'der', type: 'spki' }).subarray(12).toString('base64url'),
+  };
+}
+const T = 1_000_000;
+const grant = (grantee, granteeKey, role, grantor, at) =>
+  signGrant({ type: 'role-grant', grantee: grantee.nodeId, granteeKey, role, grantedBy: grantor.nodeId, grantedAt: at }, grantor.priv);
+
+describe('authority follows the key (D3)', () => {
+  it('a grant confers its role only on the key it names', () => {
+    const A = kp('A'), V = kp('V'), impostor = kp('V');
+    const st = new RoleGrantStore({ anchor: { nodeId: A.nodeId, publicKey: A.pub } });
+    assert.strictEqual(st.record(grant(V, V.pub, 'validator', A, T)).stored, true);
+    assert.strictEqual(st.resolveRole(V.nodeId, V.pub, T + 1), 'validator');
+    assert.strictEqual(st.resolveRole(V.nodeId, impostor.pub, T + 1), 'participant', 'the same id under another key holds nothing');
+    assert.strictEqual(st.resolveRole(A.nodeId, impostor.pub, T + 1), 'participant', 'not even the anchor id');
+    assert.strictEqual(st.resolveRole(A.nodeId, A.pub, T + 1), 'anchor');
+  });
+
+  it('a grantor bound to an impostor: its chain is verified with the vouched key, and the impostor gets nothing', () => {
+    const A = kp('A'), G = kp('G'), impG = kp('G'), X = kp('X'), Y = kp('Y');
+    const reg = new RosterKeyRegistry({ anchor: { nodeId: A.nodeId, publicKey: A.pub } });
+    // The impostor proved first contact under G's id; the registry holds the impostor's key for G.
+    reg.bind(G.nodeId, impG.pub, 'proven');
+    const st = new RoleGrantStore({ anchor: { nodeId: A.nodeId, publicKey: A.pub }, keys: reg });
+    // The anchor vouches G's real key.
+    assert.strictEqual(st.record(grant(G, G.pub, 'validator', A, T)).stored, true);
+    assert.strictEqual(reg.get(G.nodeId), impG.pub, 'the registry binding is not repointed');
+    assert.strictEqual(reg.conflicts().length, 1, 'the vouch against it is a recorded conflict');
+    // A grant the real G signs verifies against its vouched key and confers.
+    assert.strictEqual(st.record(grant(X, X.pub, 'validator', G, T + 10)).stored, true);
+    assert.strictEqual(st.resolveRole(X.nodeId, X.pub, T + 20), 'validator');
+    // A grant the impostor signs as G is checked against the vouched key, not the registry's: refused.
+    assert.strictEqual(st.record(grant(Y, Y.pub, 'validator', impG, T + 10)).reason, 'bad-signature');
+    assert.strictEqual(st.resolveRole(Y.nodeId, Y.pub, T + 20), 'participant');
+    // And the impostor itself, holding the id under its own key, is a participant.
+    assert.strictEqual(st.resolveRole(G.nodeId, impG.pub, T + 20), 'participant');
+    assert.strictEqual(st.resolver()(G.nodeId, T + 20), 'participant', 'the registry-bound key resolves to nothing');
+  });
+
+  it('a grant chain is verified with vouched keys, hop by hop, in any file order', () => {
+    const dir = fs.mkdtempSync(require('path').join(require('os').tmpdir(), 'rg-chain-'));
+    try {
+      const A = kp('A'), B = kp('B'), C = kp('C'), D = kp('D');
+      const recs = [
+        grant(D, D.pub, 'validator', C, T + 30),
+        grant(C, C.pub, 'validator', B, T + 20),
+        grant(B, B.pub, 'validator', A, T + 10),
+      ];
+      fs.writeFileSync(require('path').join(dir, 'role-grants.jsonl'), recs.map((r) => JSON.stringify(r)).join('\n') + '\n');
+      // The registry knows none of B, C, D: nothing but the anchor and the chain itself verifies.
+      const st = new RoleGrantStore({ anchor: { nodeId: A.nodeId, publicKey: A.pub }, dir, keys: new RosterKeyRegistry() });
+      assert.strictEqual(st.loadReport().loaded, 3);
+      assert.strictEqual(st.resolveRole(D.nodeId, D.pub, T + 40), 'validator');
+      // A link whose vouched key is not the one that signed the next hop breaks the chain below it.
+      const E = kp('E'), Cfake = kp('C');
+      const st2 = new RoleGrantStore({ anchor: { nodeId: A.nodeId, publicKey: A.pub } });
+      st2.record(grant(B, B.pub, 'validator', A, T + 10));
+      st2.record(grant(C, C.pub, 'validator', B, T + 20));
+      assert.strictEqual(st2.record(grant(E, E.pub, 'validator', Cfake, T + 30)).reason, 'bad-signature');
+    } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+  });
+
+  it('a role-grant without granteeKey is malformed, on the wire and on disk', () => {
+    const A = kp('A'), V = kp('V');
+    const st = new RoleGrantStore({ anchor: { nodeId: A.nodeId, publicKey: A.pub } });
+    const bare = signGrant({ type: 'role-grant', grantee: V.nodeId, role: 'validator', grantedBy: A.nodeId, grantedAt: T }, A.priv);
+    assert.strictEqual(st.record(bare).reason, 'malformed');
+    const revoke = signGrant({ type: 'role-revoke', grantee: V.nodeId, grantedBy: A.nodeId, grantedAt: T }, A.priv);
+    assert.strictEqual(st.record(revoke).stored, true, 'a revoke names no key: it clears the id whatever key it holds');
+  });
+});
+
+describe('grantRole names a proven key (D3)', () => {
+  function anchorNode() {
+    const name = `d3-anchor-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+    const id = loadOrCreateIdentity(name);
+    const node = new SymNode({ name, silent: true, discovery: new NullDiscovery(), room: 'g', anchor: { nodeId: id.nodeId, publicKey: id.publicKey } });
+    return { node, name };
+  }
+
+  it('refuses a grantee with no key, a legacy claim or a grant-vouched key; takes a proven or pinned one', () => {
+    const { node, name } = anchorNode();
+    try {
+      const sent = [];
+      node._gossipToRoster = (f) => sent.push(f);
+      const [P, L, G, Q] = ['p', 'l', 'g', 'q'].map(kp);
+      assert.strictEqual(node.grantRole(P.nodeId, 'validator'), null, 'no key at all');
+      node._roster.bind(L.nodeId, L.pub, 'legacy-claim');
+      assert.strictEqual(node.grantRole(L.nodeId, 'validator'), null, 'an unproven hello is not a proof');
+      node._roster.bind(G.nodeId, G.pub, 'grant');
+      assert.strictEqual(node.grantRole(G.nodeId, 'validator'), null, 'a vouched key is not this node\'s proof');
+      assert.deepStrictEqual(sent, [], 'nothing was sent for any of them');
+      node._roster.bind(P.nodeId, P.pub, 'proven');
+      const g = node.grantRole(P.nodeId, 'validator');
+      assert.strictEqual(g.granteeKey, P.pub);
+      node._roster.bind(Q.nodeId, Q.pub, 'pinned');
+      assert.strictEqual(node.grantRole(Q.nodeId, 'validator').granteeKey, Q.pub);
+      assert.strictEqual(node.grantRole(L.nodeId, 'validator', { granteeKey: L.pub }).granteeKey, L.pub, 'or the operator names the key');
+      assert.strictEqual(node.resolveRole(P.nodeId), 'validator');
+    } finally { node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+  });
+});
diff --git a/tests/core-secure-identity.test.js b/tests/core-secure-identity.test.js
new file mode 100644
index 00000000..b5994d96
--- /dev/null
+++ b/tests/core-secure-identity.test.js
@@ -0,0 +1,225 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME before lib/config loads
+
+/**
+ * Design D9 — what sym gives cognitive nodes:
+ *   1. identities addressed by nodeId (nodes/by-id/<nodeId>/, the name an index), loaded without
+ *      minting (`create: false` throws when absent), a one-time idempotent move of the 0.13 layout
+ *      that leaves `nodes/<name>` as a symlink for one release;
+ *   2. relocation, not copying: export tombstones the source first, and import verifies against an
+ *      independently pinned key, refusing a re-keyed bundle;
+ *   3. the interior submission path: a per-mind capability, the node's checks, one mind per node.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const os = require('os');
+const net = require('net');
+const path = require('path');
+const crypto = require('crypto');
+const config = require('../lib/config');
+const { SymNode } = require('../lib/node');
+const { NullDiscovery } = require('../lib/discovery');
+const relocation = require('../lib/relocation');
+const { keyFingerprint } = require('../lib/roster-keys');
+const { until, identity } = require('./_core-secure');
+
+const uniq = (b) => `${b}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+
+describe('identities by nodeId (D9.1)', () => {
+  it('create: false on a missing identity throws, and mints nothing', () => {
+    const name = uniq('id-missing');
+    assert.throws(() => config.loadIdentity({ name, create: false }), (e) => e.code === 'EIDENTITYABSENT');
+    assert.throws(() => config.loadIdentity({ nodeId: config.uuidv7(), create: false }), (e) => e.code === 'EIDENTITYABSENT');
+    assert.strictEqual(config.nodeIdForName(name), null, 'no index was written');
+    assert.throws(() => new SymNode({ name, create: false, silent: true, discovery: new NullDiscovery() }), (e) => e.code === 'EIDENTITYABSENT');
+  });
+
+  it('a new agent lives at nodes/by-id/<nodeId>, indexed by name, with nodes/<name> as a link for 0.13', () => {
+    const name = uniq('id-new');
+    const id = config.loadIdentity({ name });
+    const dir = config.nodeDirById(id.nodeId);
+    assert.ok(fs.existsSync(path.join(dir, 'identity.json')));
+    assert.strictEqual(config.nodeIdForName(name), id.nodeId);
+    const link = path.join(config.NODES_DIR, name);
+    assert.ok(fs.lstatSync(link).isSymbolicLink());
+    assert.strictEqual(fs.realpathSync(link), fs.realpathSync(dir));
+    assert.deepStrictEqual(config.loadIdentity({ name, create: false }), id, 'loaded, not minted');
+    assert.deepStrictEqual(config.loadIdentity({ nodeId: id.nodeId, create: false }), id);
+    // Renaming changes the index, never the identity.
+    const other = uniq('id-renamed');
+    assert.strictEqual(config.renameIdentity(name, other), id.nodeId);
+    assert.strictEqual(config.loadIdentity({ name: other, create: false }).nodeId, id.nodeId);
+    assert.throws(() => config.loadIdentity({ name, create: false }), (e) => e.code === 'EIDENTITYABSENT');
+  });
+
+  it('a 0.13 node dir is moved once, idempotently, and a 0.13 reader still finds it at the old path', () => {
+    const name = uniq('id-legacy');
+    const legacy = path.join(config.NODES_DIR, name);
+    fs.mkdirSync(path.join(legacy, 'cmbs'), { recursive: true });
+    const kp = crypto.generateKeyPairSync('ed25519');
+    const ident = {
+      nodeId: config.uuidv7(), name, hostname: 'h.local', createdAt: 1,
+      publicKey: kp.publicKey.export({ format: 'der', type: 'spki' }).subarray(12).toString('base64url'),
+      privateKey: kp.privateKey.export({ format: 'der', type: 'pkcs8' }).subarray(16).toString('base64url'),
+    };
+    fs.writeFileSync(path.join(legacy, 'identity.json'), JSON.stringify(ident));
+    fs.writeFileSync(path.join(legacy, 'cmbs', 'x.json'), '{}');
+    const r1 = config.migrateIdentities();
+    assert.ok(r1.moved >= 1);
+    assert.ok(fs.lstatSync(legacy).isSymbolicLink(), 'the old path is a link');
+    assert.ok(fs.existsSync(path.join(config.nodeDirById(ident.nodeId), 'cmbs', 'x.json')), 'the store moved with it');
+    // What a 0.13 reader does: read nodes/<name>/identity.json.
+    assert.strictEqual(JSON.parse(fs.readFileSync(path.join(legacy, 'identity.json'), 'utf8')).nodeId, ident.nodeId);
+    const r2 = config.migrateIdentities();
+    assert.strictEqual(r2.moved, 0, 'idempotent');
+    assert.strictEqual(config.loadIdentity({ name, create: false }).publicKey, ident.publicKey, 'the same key: identity files do not change');
+  });
+});
+
+describe('relocation (D9.2)', () => {
+  it('export tombstones the source before the bundle exists; the source then refuses to start it; import verifies against a pinned key', async () => {
+    const name = uniq('id-move');
+    const node = new SymNode({ name, silent: true, discovery: new NullDiscovery() });
+    const nodeId = node.nodeId;
+    const pub = node._identity.publicKey;
+    node.remember({ focus: 'a memory that must travel', issue: 'i', intent: 'x', motivation: 'y', commitment: 'z', perspective: 'p', mood: { text: 'calm', valence: 0, arousal: 0 } });
+    await node.stop();
+    const out = path.join(fs.mkdtempSync(path.join(os.tmpdir(), 'bundle-')), 'node.bundle');
+    assert.throws(() => relocation.exportNode({ name, out }), /passphrase/, 'no sealing given: refused, and not tombstoned');
+    assert.strictEqual(config.readTombstone(nodeId), null);
+    const r = relocation.exportNode({ name, out, passphrase: 'a long operator passphrase' });
+    assert.strictEqual(r.nodeId, nodeId);
+    assert.ok(config.readTombstone(nodeId), 'tombstoned');
+    assert.ok(!fs.readFileSync(out, 'utf8').includes(node._identity.privateKey), 'the private key is not in the clear');
+    assert.throws(() => new SymNode({ name, silent: true, discovery: new NullDiscovery() }), (e) => e.code === 'EIDENTITYTOMBSTONED', 'the source refuses to start it');
+    // Import: the wrong passphrase does not open it; no pin refuses it; the pinned key admits it.
+    assert.throws(() => relocation.importNode({ from: out, passphrase: 'not the passphrase at all' }), /does not open/);
+    const imported = relocation.importNode({ from: out, passphrase: 'a long operator passphrase', expect: { nodeId, fingerprint: keyFingerprint(pub) } });
+    assert.strictEqual(imported.nodeId, nodeId);
+    assert.strictEqual(config.readTombstone(nodeId), null, 'it lives here again');
+    const back = new SymNode({ name, nodeId, create: false, silent: true, discovery: new NullDiscovery() });
+    try {
+      assert.strictEqual(back._identity.publicKey, pub);
+      const files = fs.readdirSync(path.join(config.nodeDirById(nodeId), 'cmbs')).filter((f) => f.endsWith('.json'));
+      assert.ok(files.length >= 1, 'its store came with it');
+    } finally { await back.stop(); }
+  });
+
+  it('an import with a re-signed key is refused, and one with no independent pin is refused', async () => {
+    const name = uniq('id-rekey');
+    const node = new SymNode({ name, silent: true, discovery: new NullDiscovery() });
+    const nodeId = node.nodeId;
+    const realPub = node._identity.publicKey;
+    await node.stop();
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'bundle-'));
+    const out = path.join(dir, 'node.bundle');
+    relocation.exportNode({ name, out, passphrase: 'a long operator passphrase' });
+    // An attacker re-keys the identity in a copy of the bundle (they cannot sign as the node).
+    const { importNode } = relocation;
+    const tampered = path.join(dir, 'rekeyed.bundle');
+    {
+      const crypto2 = require('crypto');
+      const b = JSON.parse(fs.readFileSync(out, 'utf8'));
+      const key = crypto2.scryptSync('a long operator passphrase', Buffer.from(b.salt, 'base64url'), 32, { N: b.N, r: b.r, p: b.p, maxmem: 128 * 1024 * 1024 });
+      const sealed = Buffer.from(b.ciphertext, 'base64url');
+      const d = crypto2.createDecipheriv('aes-256-gcm', key, Buffer.from(b.nonce, 'base64url'));
+      d.setAuthTag(sealed.subarray(sealed.length - 16));
+      const plain = JSON.parse(Buffer.concat([d.update(sealed.subarray(0, sealed.length - 16)), d.final()]).toString('utf8'));
+      const evil = identity('evil');
+      for (const f of plain.files) {
+        if (f.path !== 'identity.json') continue;
+        const ident = JSON.parse(Buffer.from(f.data, 'base64').toString('utf8'));
+        f.data = Buffer.from(JSON.stringify({ ...ident, publicKey: evil.publicKey, privateKey: evil.privateKey })).toString('base64');
+      }
+      const nonce = crypto2.randomBytes(12);
+      const c = crypto2.createCipheriv('aes-256-gcm', key, nonce);
+      const body = Buffer.concat([c.update(Buffer.from(JSON.stringify(plain))), c.final()]);
+      fs.writeFileSync(tampered, JSON.stringify({ ...b, nonce: nonce.toString('base64url'), ciphertext: Buffer.concat([body, c.getAuthTag()]).toString('base64url') }));
+    }
+    assert.throws(() => importNode({ from: tampered, passphrase: 'a long operator passphrase', expect: { nodeId, key: realPub } }), /re-keyed bundle/);
+    assert.throws(() => importNode({ from: out, passphrase: 'a long operator passphrase' }), /no independently pinned key/);
+  });
+
+  it('a bundle can be sealed to the target host\'s key instead of a passphrase', async () => {
+    const name = uniq('id-host');
+    const node = new SymNode({ name, silent: true, discovery: new NullDiscovery() });
+    const nodeId = node.nodeId; const pub = node._identity.publicKey;
+    await node.stop();
+    const host = relocation.hostKey();
+    const out = path.join(fs.mkdtempSync(path.join(os.tmpdir(), 'bundle-')), 'node.bundle');
+    relocation.exportNode({ name, out, toHostKey: host.publicKey });
+    const r = relocation.importNode({ from: out, expect: { nodeId, key: pub } });
+    assert.strictEqual(r.nodeId, nodeId);
+  });
+});
+
+describe('the interior (D9.3)', () => {
+  function cats(focus) { return { focus, issue: 'i', intent: 'x', motivation: 'y', commitment: 'z', perspective: 'p', mood: { text: 'calm' } }; }
+
+  it('a submission without a live capability is refused; the node checks audience, size, rate, intent and lineage before it signs', async () => {
+    const node = new SymNode({ name: uniq('id-mind'), silent: true, discovery: new NullDiscovery() });
+    try {
+      const interior = node.interior();
+      assert.deepStrictEqual(interior.submit('no-such-capability', { kind: 'observation', categories: cats('x') }), { ok: false, reason: 'no-live-capability' });
+      const allowed = identity('allowed').nodeId;
+      const { capability } = interior.startMind({ id: 'mission-1', kinds: ['observation'], allowTo: [allowed], ratePerMinute: 3 });
+      assert.strictEqual(interior.submit(capability, { kind: 'command', categories: cats('x') }).reason, 'kind-not-declared');
+      assert.strictEqual(interior.submit(capability, { kind: 'observation', to: identity('other').nodeId, categories: cats('x') }).reason, 'audience-not-allowed');
+      assert.strictEqual(interior.submit(capability, { kind: 'observation', categories: cats('x'.repeat(70 * 1024)) }).reason, 'categories-too-large');
+      assert.strictEqual(interior.submit(capability, { kind: 'observation', categories: cats('x'), payload: { blob: 'y'.repeat(600 * 1024) } }).reason, 'application-too-large');
+      assert.strictEqual(interior.submit(capability, { kind: 'observation', categories: cats('x'), parents: ['cmb-' + '0'.repeat(64)] }).reason, 'parent-not-in-store');
+      const ok = interior.submit(capability, { kind: 'observation', categories: cats('a mind observation') });
+      assert.strictEqual(ok.ok, true);
+      assert.match(ok.assertionId, /^asrt-/);
+      assert.strictEqual(node._store.get(ok.key).cmb.metadata.createdByNodeId, node.nodeId, 'signed by the node: the mind holds no key');
+      assert.strictEqual(interior.submit(capability, { kind: 'observation', categories: cats('second'), parents: [ok.key] }).ok, true, 'a parent in the store is fine');
+      assert.strictEqual(interior.submit(capability, { kind: 'observation', categories: cats('third') }).ok, true);
+      assert.strictEqual(interior.submit(capability, { kind: 'observation', categories: cats('fourth') }).reason, 'rate');
+      // The mind exits: its capability is revoked.
+      assert.strictEqual(interior.endMind(capability), true);
+      assert.strictEqual(interior.submit(capability, { kind: 'observation', categories: cats('after exit') }).reason, 'no-live-capability');
+    } finally { await node.stop(); }
+  });
+
+  it('one mind per node: a second concurrent mind is refused, a queued one starts when the first ends', async () => {
+    const node = new SymNode({ name: uniq('id-one'), silent: true, discovery: new NullDiscovery() });
+    try {
+      const interior = node.interior();
+      const first = interior.startMind({ kinds: ['observation'] });
+      assert.throws(() => interior.startMind({ kinds: ['observation'] }), (e) => e.code === 'EMINDBUSY');
+      let second = null;
+      const queued = interior.queueMind({ id: 'next', kinds: ['observation'] }).then((m) => { second = m; });
+      assert.strictEqual(second, null);
+      interior.endMind(first.capability);
+      await queued;
+      assert.ok(second && second.capability !== first.capability);
+      assert.strictEqual(interior.mind().mission, 'next');
+    } finally { await node.stop(); }
+  });
+
+  it('the interior socket takes submissions with the capability', async () => {
+    const node = new SymNode({ name: uniq('id-sock'), silent: true, discovery: new NullDiscovery() });
+    try {
+      const interior = node.interior();
+      const sockPath = await interior.listen();
+      const { capability } = interior.startMind({ kinds: ['observation'] });
+      const ask = (req) => new Promise((resolve, reject) => {
+        const s = net.createConnection(sockPath);
+        let buf = '';
+        s.on('data', (d) => { buf += d; if (buf.includes('\n')) { resolve(JSON.parse(buf.split('\n')[0])); s.end(); } });
+        s.on('error', reject);
+        s.write(JSON.stringify(req) + '\n');
+      });
+      assert.deepStrictEqual(await ask({ id: 1, type: 'submit', capability: 'forged', kind: 'observation', categories: cats('x') }), { id: 1, type: 'refused', reason: 'no-live-capability' });
+      const r = await ask({ id: 2, type: 'submit', capability, kind: 'observation', categories: cats('over the socket') });
+      assert.strictEqual(r.type, 'submitted');
+      assert.ok(node._store.get(r.key));
+      if (process.platform !== 'win32') assert.strictEqual(fs.statSync(sockPath).mode & 0o777, 0o600);
+    } finally { await node.stop(); }
+  });
+});
+
+void until;
diff --git a/tests/core-secure-legacy.test.js b/tests/core-secure-legacy.test.js
new file mode 100644
index 00000000..acedc1e5
--- /dev/null
+++ b/tests/core-secure-legacy.test.js
@@ -0,0 +1,206 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME before lib/config loads
+
+/**
+ * Design D7 — Legacy Import: explicit, outbound, temporary. Against a fake 0.13 endpoint that speaks
+ * the one-frame `handshake` (the real 0.13.17 run is tests/integration/legacy-import-013.js):
+ *   - a route dials whatever the id order (0.13 dials only when its id is smaller on the loopback);
+ *   - the fingerprint is mandatory, and a hello presenting another key is refused;
+ *   - records from it are quarantined (verified: false, profile legacy-import), and only those the
+ *     routed node signed with the pinned key are taken;
+ *   - what this node sends is a legacy cmb under the legacy E2E construction, never plaintext;
+ *   - the sticky floor is the registry's proven binding, and it survives a restart;
+ *   - a legacy hello on the Core Secure listener is refused, and a record without TXT mmp=2.0 is
+ *     never dialled as Core Secure.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const net = require('net');
+const crypto = require('crypto');
+const { SymNode } = require('../lib/node');
+const { NullDiscovery, BonjourDiscovery } = require('../lib/discovery');
+const { nodeDirById } = require('../lib/config');
+const { TcpTransport } = require('../lib/transport');
+const { checkRoute } = require('../lib/legacy-import');
+const { keyFingerprint } = require('../lib/roster-keys');
+const { e2eGenerateKeyPair, e2eDeriveSharedSecret, encryptCategories, decryptCategories, createCMB, signCMB } = require('../lib/core');
+const { sendFrame } = require('../lib/frame-parser');
+const { until, identity } = require('./_core-secure');
+
+const uniq = (b) => `${b}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+
+/** A fake 0.13 node's TCP endpoint: answers a legacy hello with its own, and speaks legacy cmb. */
+async function fake013({ id = identity('legacy'), room = 'lg-room', presentKey } = {}) {
+  const e2e = e2eGenerateKeyPair();
+  const seen = { frames: [], records: [], secret: null, peer: null };
+  const server = net.createServer((sock) => {
+    sock.on('error', () => {});
+    const t = new TcpTransport(sock);
+    seen.transport = t;
+    t.on('message', (f) => {
+      seen.frames.push(f);
+      if (f.type === 'handshake') {
+        seen.peer = f;
+        seen.secret = e2eDeriveSharedSecret(e2e.privateKey, Buffer.from(f.e2ePublicKey, 'base64'));
+        t.send({ type: 'handshake', nodeId: id.nodeId, name: id.name, version: '0.2.3', extensions: [], room, publicKey: presentKey || id.publicKey, e2ePublicKey: e2e.publicKey.toString('base64'), lifecycleRole: 'participant' });
+      } else if (f.type === 'cmb' && f.cmb && typeof f.cmb.categories === 'string') {
+        seen.records.push({ frame: f, categories: decryptCategories(f.cmb.categories, f.cmb._e2e.nonce, seen.secret) });
+      }
+    });
+  });
+  await new Promise((r) => server.listen(0, '127.0.0.1', r));
+  /** Send a 0.13-shaped record (internal mmp-sig-v2 suite), legacy-encrypted, directed or not. */
+  const sendRecord = ({ focus, to, signer = id }) => {
+    const cmb = createCMB({ categories: { focus }, createdBy: id.name, room, to: to ?? null });
+    signCMB(cmb, signer.privateKey);
+    const { ciphertext, nonce } = encryptCategories(cmb.categories, seen.secret);
+    seen.transport.send({ type: 'cmb', timestamp: Date.now(), cmb: { ...cmb, categories: ciphertext, _e2e: { nonce } }, ...(to ? { to, directed: true } : {}) });
+  };
+  return { id, port: server.address().port, seen, sendRecord, close: () => new Promise((r) => server.close(() => r())) };
+}
+
+function routeTo(fake) { return { nodeId: fake.id.nodeId, endpoint: `127.0.0.1:${fake.port}`, key: fake.id.publicKey, name: 'legacy' }; }
+async function stopAll(...nodes) {
+  for (const n of nodes) { try { await n.stop(); } catch { /* */ } try { fs.rmSync(nodeDirById(n.nodeId), { recursive: true, force: true }); } catch { /* */ } }
+}
+
+describe('Legacy Import routes (D7)', () => {
+  it('the identity key fingerprint is mandatory; a route without one is refused', () => {
+    const id = identity('x');
+    assert.throws(() => checkRoute({ nodeId: id.nodeId, endpoint: '127.0.0.1:1' }), /fingerprint is mandatory/);
+    assert.throws(() => checkRoute({ nodeId: id.nodeId, endpoint: 'nowhere', key: id.publicKey }), /endpoint/);
+    assert.throws(() => checkRoute({ nodeId: id.nodeId, endpoint: 'relay', key: id.publicKey, fingerprint: keyFingerprint(identity().publicKey) }), /disagree/);
+    assert.strictEqual(checkRoute({ nodeId: id.nodeId, endpoint: 'relay', fingerprint: keyFingerprint(id.publicKey) }).fingerprint, keyFingerprint(id.publicKey));
+  });
+
+  for (const order of ['smaller', 'larger']) {
+    it(`this node dials the route itself when the legacy id is ${order} than its own, and the session is quarantined both ways`, async () => {
+      const lid = identity('legacy');
+      lid.nodeId = order === 'smaller' ? `00000000-0000-7000-8000-${crypto.randomBytes(6).toString('hex')}` : `ffffffff-ffff-7fff-bfff-${crypto.randomBytes(6).toString('hex')}`;
+      const fake = await fake013({ id: lid });
+      const node = new SymNode({ name: uniq('lg'), silent: true, discovery: new NullDiscovery(), room: 'lg-room', legacyRoutes: [routeTo(fake)] });
+      try {
+        await node.start();
+        await until(() => node._peers.has(lid.nodeId), 5000);
+        const st = node.status().legacyImport;
+        assert.strictEqual(st.sessions.length, 1);
+        assert.match(st.sessions[0].encryption, /no forward secrecy, no transcript proof/);
+        assert.strictEqual(node._roster.source(lid.nodeId), 'pinned', 'the route\'s key is pinned');
+        assert.strictEqual(node.peers().find((p) => p.peerId === lid.nodeId).profile, 'legacy-import');
+        // In: a directed 0.13 record is delivered, quarantined.
+        const got = [];
+        node.on('cmb-accepted', (e) => got.push(e));
+        fake.sendRecord({ focus: 'from the 0.13 side', to: node.nodeId });
+        await until(() => got.length > 0, 5000);
+        assert.strictEqual(got[0].verified, false);
+        assert.strictEqual(got[0].profile, 'legacy-import');
+        assert.strictEqual(got[0].author?.nodeId ?? null, null, 'no verified author');
+        // A record signed by another key on the route is refused.
+        const metrics = [];
+        node.on('metric', (m) => metrics.push(m));
+        fake.sendRecord({ focus: 'signed by someone else', to: node.nodeId, signer: identity('other') });
+        await until(() => metrics.some((m) => m.type === 'legacy-import-refused'), 3000);
+        // Out: this node's record goes as a legacy cmb, encrypted, directed by its signed to.
+        node.remember({ focus: 'from the 0.14 side', issue: 'i', intent: 'x', motivation: 'y', commitment: 'z', perspective: 'p', mood: { text: 'calm', valence: 0, arousal: 0 } }, { to: lid.nodeId });
+        await until(() => fake.seen.records.length > 0, 5000);
+        const out = fake.seen.records[0];
+        assert.strictEqual(out.frame.to, lid.nodeId);
+        assert.strictEqual(out.categories.focus.text, 'from the 0.14 side');
+        assert.ok(!JSON.stringify(fake.seen.frames).includes('from the 0.14 side'), 'never in the clear');
+        assert.strictEqual(out.frame.cmb.metadata.signatureSuite, 'mmp-sig-v2.0');
+      } finally { await stopAll(node); await fake.close(); }
+    });
+  }
+
+  it('a hello presenting a key other than the pinned one is refused', async () => {
+    const lid = identity('legacy');
+    const fake = await fake013({ id: lid, presentKey: identity('squatter').publicKey });
+    const node = new SymNode({ name: uniq('lg'), silent: true, discovery: new NullDiscovery(), room: 'lg-room', legacyRoutes: [routeTo(fake)] });
+    try {
+      await node.start();
+      await until(() => node.status().legacyImport.refused.some((r) => /fingerprint-mismatch/.test(r.why)), 5000);
+      assert.strictEqual(node._peers.has(lid.nodeId), false);
+    } finally { await stopAll(node); await fake.close(); }
+  });
+
+  it('the sticky floor is the persisted proven binding: the route is refused, across a restart', async () => {
+    const lid = identity('legacy');
+    const fake = await fake013({ id: lid });
+    const name = uniq('lg-floor');
+    let node = new SymNode({ name, silent: true, discovery: new NullDiscovery(), room: 'lg-room', legacyRoutes: [routeTo(fake)] });
+    try {
+      node._roster.bind(lid.nodeId, lid.publicKey, 'proven'); // it once proved itself over Core Secure
+      await node.start();
+      await new Promise((r) => setTimeout(r, 300));
+      assert.strictEqual(node._peers.has(lid.nodeId), false);
+      assert.match(node.status().legacyImport.refused.find((r) => r.nodeId === lid.nodeId).why, /sticky floor/);
+      const id = node.nodeId;
+      await node.stop();
+      node = new SymNode({ name, nodeId: id, create: false, silent: true, discovery: new NullDiscovery(), room: 'lg-room', legacyRoutes: [routeTo(fake)] });
+      await node.start();
+      await new Promise((r) => setTimeout(r, 300));
+      assert.strictEqual(node._peers.has(lid.nodeId), false, 'still refused after the restart');
+      // An operator reset lifts it.
+      node._roster.resetFloor(lid.nodeId);
+      await node.stop();
+      node = new SymNode({ name, nodeId: id, create: false, silent: true, discovery: new NullDiscovery(), room: 'lg-room', legacyRoutes: [routeTo(fake)] });
+      await node.start();
+      await until(() => node._peers.has(lid.nodeId), 5000);
+      assert.ok(node._peers.has(lid.nodeId));
+    } finally { await stopAll(node); await fake.close(); }
+  });
+});
+
+describe('the Core Secure listener and discovery (D2)', () => {
+  it('a legacy hello on the listener is refused at once and counted; no route means no peer', async () => {
+    const node = new SymNode({ name: uniq('lg-listen'), silent: true, discovery: new BonjourDiscovery({ mdns: false }), room: 'lg-room' });
+    try {
+      await node.start();
+      const sock = net.createConnection({ host: '127.0.0.1', port: node._port });
+      await new Promise((r) => sock.once('connect', r));
+      const closed = new Promise((r) => sock.once('close', r));
+      sock.on('error', () => {});
+      const lid = identity('legacy');
+      sendFrame(sock, { type: 'handshake', nodeId: lid.nodeId, name: 'legacy-0.13', publicKey: lid.publicKey, room: 'lg-room' });
+      await closed;
+      await until(() => node._sessionStats.legacyHellosRefused === 1, 2000);
+      assert.strictEqual(node._sessionStats.legacyHellosRefused, 1);
+      assert.strictEqual(node._peers.size, 0);
+      assert.strictEqual(node._roster.has(lid.nodeId), false, 'nothing is pinned from it');
+    } finally { await stopAll(node); }
+  });
+
+  it('a discovery record is dialled as Core Secure only with TXT mmp=2.0, and only by the smaller nodeId', async () => {
+    const { EventEmitter } = require('events');
+    const disco = new EventEmitter();
+    disco.start = async () => 0; disco.stop = async () => {}; disco.reconnect = () => {};
+    const node = new SymNode({ name: uniq('lg-disco'), silent: true, discovery: disco, room: 'default' });
+    const dialled = [];
+    node._connectToPeer = (address, port, peerId) => dialled.push(peerId);
+    try {
+      await node.start();
+      const larger = `ffffffff-ffff-7fff-bfff-${crypto.randomBytes(6).toString('hex')}`;
+      const smaller = `00000000-0000-7000-8000-${crypto.randomBytes(6).toString('hex')}`;
+      disco.emit('peer-found', '127.0.0.1', 1, larger, 'legacy', { mmp: null, room: 'default' });
+      disco.emit('peer-found', '127.0.0.1', 2, larger, 'v2', { mmp: '2.0', room: 'default' });
+      disco.emit('peer-found', '127.0.0.1', 3, smaller, 'v2-smaller', { mmp: '2.0', room: 'default' });
+      assert.deepStrictEqual(dialled, [larger], 'the legacy record is not dialled; the larger v2 one is; the smaller one dials us');
+    } finally { await stopAll(node); }
+  });
+
+  it('the advertisement carries mmp=2.0 and the room (§5.1)', async () => {
+    const d = new BonjourDiscovery({ mdns: false, room: 'lg-room' });
+    assert.strictEqual(d._room, 'lg-room');
+    // The loopback registration names the profile too.
+    const id = identity('adv');
+    await d.start({ nodeId: id.nodeId, name: 'adv', publicKey: id.publicKey, hostname: 'h.local' }, () => {});
+    try {
+      const rec = JSON.parse(fs.readFileSync(d._regFile, 'utf8'));
+      assert.strictEqual(rec.mmp, '2.0');
+      assert.strictEqual(rec.room, 'lg-room');
+    } finally { await d.stop(); }
+  });
+});
diff --git a/tests/core-secure-node.test.js b/tests/core-secure-node.test.js
new file mode 100644
index 00000000..5df66ee2
--- /dev/null
+++ b/tests/core-secure-node.test.js
@@ -0,0 +1,307 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME before lib/config loads
+
+/**
+ * Design D1/D4/D6 at the node: two real SymNodes joined by an in-memory pipe through the real §5.2
+ * handshake. A peer exists only after confirmation, keyed by its proven nodeId; records travel only
+ * as cmb-encrypted (no plaintext on the wire); the binding is the signed metadata.to; the host sees
+ * verified records through the public `verified-record` hook; a gated room admits on proven keys.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const crypto = require('crypto');
+const { SymNode } = require('../lib/node');
+const { NullDiscovery } = require('../lib/discovery');
+const { nodeDirById, loadOrCreateIdentity } = require('../lib/config');
+const { signRoomGrant } = require('../lib/core/room-grant');
+const { memoryPipe, connectNodes, until, identity, signedRecord, admitAs } = require('./_core-secure');
+
+const uniq = (b) => `${b}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+const CATS = (focus) => ({ focus, issue: 'core secure node test', intent: 'prove the channel', motivation: 'D1 D4', commitment: 'none', perspective: 'test', mood: { text: 'calm', valence: 0, arousal: 0 } });
+
+function mk(base, extra = {}) {
+  const name = uniq(base);
+  const node = new SymNode({ name, silent: true, discovery: new NullDiscovery(), room: extra.room || 'cs-room', ...extra });
+  return node;
+}
+async function stopAll(...nodes) {
+  for (const n of nodes) { try { await n.stop(); } catch { /* */ } try { fs.rmSync(nodeDirById(n.nodeId), { recursive: true, force: true }); } catch { /* */ } }
+}
+
+describe('a peer is a proven session (D1)', () => {
+  it('nothing per-peer exists before confirmation; after it, the peer is keyed by the proven nodeId and bound proven', async () => {
+    const a = mk('cs-a'); const b = mk('cs-b');
+    try {
+      await a.start(); await b.start();
+      const [ta, tb] = memoryPipe();
+      b.connectTransport(tb, { role: 'server' });
+      assert.strictEqual(b._peers.size, 0, 'an attached transport is not a peer');
+      a.connectTransport(ta, { role: 'client', expectNodeId: b.nodeId });
+      assert.strictEqual(a._peers.size, 0, 'a dial is not a peer');
+      await until(() => a._peers.has(b.nodeId) && b._peers.has(a.nodeId));
+      assert.strictEqual(a._roster.source(b.nodeId), 'proven');
+      assert.strictEqual(a._roster.get(b.nodeId), b._identity.publicKey);
+      const p = a.peers().find((x) => x.peerId === b.nodeId);
+      assert.strictEqual(p.profile, 'core-secure');
+      assert.strictEqual(p.keySource, 'proven');
+      assert.strictEqual(p.sessions.length, 1);
+      assert.match(p.sessions[0].sessionId, /^[0-9a-f]{32}$/);
+    } finally { await stopAll(a, b); }
+  });
+
+  it('a record crosses only as cmb-encrypted, is verified by createdByNodeId, and reaches the host hook', async () => {
+    const a = mk('cs-a'); const b = mk('cs-b');
+    const wire = [];
+    try {
+      await a.start(); await b.start();
+      const hooked = [];
+      b.on('verified-record', (e) => hooked.push(e));
+      await connectNodes(a, b, { tap: (f) => wire.push(f) });
+      a.remember(CATS('a sealed observation for b'), { payload: { action: 'look' } });
+      await until(() => hooked.length > 0);
+      assert.strictEqual(hooked.length, 1);
+      const e = hooked[0];
+      assert.strictEqual(e.session.nodeId, a.nodeId, 'the proven session facts');
+      assert.strictEqual(e.session.identityKey, a._identity.publicKey);
+      assert.strictEqual(e.session.profile, 'core-secure');
+      assert.strictEqual(e.verification.authorNodeId, a.nodeId);
+      assert.strictEqual(e.verification.suite, 'mmp-sig-v2.0');
+      assert.strictEqual(e.verification.audience, 'room');
+      assert.strictEqual(e.record.metadata.createdByNodeId, a.nodeId);
+      assert.ok(Object.keys(e).every((k) => !k.startsWith('_')) && Object.keys(e.session).every((k) => !k.startsWith('_')), 'no underscore field is needed');
+      assert.ok(Object.isFrozen(e.record) && Object.isFrozen(e.record.metadata) && Object.isFrozen(e.record.categories), 'the host gets a frozen copy of the record');
+      assert.throws(() => { 'use strict'; e.record.metadata.to = b.nodeId; }, TypeError);
+      const text = JSON.stringify(wire);
+      assert.ok(!text.includes('a sealed observation for b'), 'no category text on the wire');
+      assert.ok(!wire.some((f) => f.type === 'cmb' || f.type === 'handshake'), 'no plaintext record and no legacy hello on the wire');
+      assert.ok(wire.some((f) => f.type === 'cmb-encrypted'));
+      assert.ok(wire.filter((f) => !['client-hello', 'server-hello', 'client-finish', 'cmb-encrypted', 'control-encrypted', 'ping', 'pong'].includes(f.type)).length === 0, 'every other frame was sealed');
+      // The payload rode as the signed application section and came back as cmb.payload.
+      await until(() => b._store.allEntries().some((x) => x.peerId === a.nodeId) || b.inbox().length > 0, 3000);
+    } finally { await stopAll(a, b); }
+  });
+
+  it('the binding is the signed metadata.to: a record directed to another node is refused, one to me is delivered', async () => {
+    const a = mk('cs-a'); const b = mk('cs-b');
+    try {
+      await a.start(); await b.start();
+      await connectNodes(a, b);
+      const metrics = [];
+      b.on('metric', (m) => metrics.push(m));
+      const accepted = [];
+      b.on('cmb-accepted', (x) => accepted.push(x));
+      // A record a signed to some other node, sent on the session to b.
+      const elsewhere = identity('elsewhere');
+      const cmb = signedRecord({ nodeId: a.nodeId, name: a.name, privateKey: a._identity.privateKey }, { categories: { focus: 'not for b' }, room: 'cs-room', to: elsewhere.nodeId });
+      a._peers.get(b.nodeId).transport.send({ type: 'cmb', cmb });
+      await until(() => metrics.some((m) => m.type === 'cmb-audience-rejected'));
+      assert.ok(metrics.some((m) => m.type === 'cmb-audience-rejected'), 'the signed to names another node: refused');
+      a.remember(CATS('directed to b'), { to: b.nodeId });
+      await until(() => accepted.some((x) => x.directed === true || x.content?.includes('directed to b')));
+      assert.ok(accepted.length >= 1, 'a record signed to b is delivered (§9.2.2)');
+    } finally { await stopAll(a, b); }
+  });
+
+  it('frame flags never direct a record: a room-bound record with directed/to on its frame is not delivered as directed', async () => {
+    // Over a session the seal carries only the record, so a frame flag cannot even cross (D4); the
+    // handler is checked here directly, with a frame as an injector would shape it.
+    const b = mk('cs-flags');
+    try {
+      await b.start();
+      const author = identity('flag-author');
+      const session = admitAs(b, author);
+      b._svafEvaluator.evaluate = async () => ({ decision: 'rejected', totalDrift: 1, categoryDrifts: {}, gateValues: {} });
+      const accepted = [];
+      b.on('cmb-accepted', (x) => accepted.push(x));
+      const cmb = signedRecord(author, { categories: CATS('room-bound, flagged as directed'), room: 'cs-room', to: null });
+      await b._frameHandler.handle(session, { type: 'cmb', cmb, directed: true, to: b.nodeId, timestamp: Date.now() });
+      await new Promise((r) => setTimeout(r, 50));
+      assert.strictEqual(accepted.filter((x) => x.directed === true).length, 0, 'not surfaced as directed past SVAF');
+    } finally { await stopAll(b); }
+  });
+
+  it('a message is a directed CMB: send() raises the receiver\'s message event, nothing plaintext crosses', async () => {
+    const a = mk('cs-a'); const b = mk('cs-b');
+    const wire = [];
+    try {
+      await a.start(); await b.start();
+      await connectNodes(a, b, { tap: (f) => wire.push(f) });
+      const got = [];
+      b.on('message', (from, content, info) => got.push({ from, content, info }));
+      assert.strictEqual(a.send('hello over core secure', { to: b.nodeId }), 1);
+      await until(() => got.length > 0);
+      assert.strictEqual(got[0].content, 'hello over core secure');
+      assert.strictEqual(got[0].info.from, a.nodeId);
+      assert.ok(!JSON.stringify(wire).includes('hello over core secure'));
+      assert.ok(!wire.some((f) => f.type === 'message'), 'no message frame');
+    } finally { await stopAll(a, b); }
+  });
+
+  it('a record from an author this node never proved and no grant vouches is refused ("X via Y", M12)', async () => {
+    const a = mk('cs-a'); const b = mk('cs-b');
+    try {
+      await a.start(); await b.start();
+      await connectNodes(a, b);
+      const metrics = [];
+      b.on('metric', (m) => metrics.push(m));
+      const stranger = identity('stranger');
+      const relayed = signedRecord(stranger, { categories: { focus: 'relayed by a' }, room: 'cs-room' });
+      a._peers.get(b.nodeId).transport.send({ type: 'cmb', cmb: relayed });
+      await until(() => metrics.some((m) => m.type === 'cmb-author-unresolvable'));
+      assert.ok(metrics.some((m) => m.type === 'cmb-signature-rejected' && m.reason === 'unresolvable-author'));
+      // Once b holds the stranger's key from an out-of-band pin, the same record verifies.
+      b._roster.bind(stranger.nodeId, stranger.publicKey, 'pinned');
+      const hooked = [];
+      b.on('verified-record', (e) => hooked.push(e));
+      const again = signedRecord(stranger, { categories: { focus: 'relayed by a, now resolvable' }, room: 'cs-room' });
+      a._peers.get(b.nodeId).transport.send({ type: 'cmb', cmb: again });
+      await until(() => hooked.length > 0);
+      assert.strictEqual(hooked[0].verification.relayed, true);
+      assert.strictEqual(hooked[0].verification.authorKeySource, 'pinned');
+    } finally { await stopAll(a, b); }
+  });
+
+  it('a second confirmed session for the same (nodeId, key) supersedes the first without a peer-left', async () => {
+    const a = mk('cs-a'); const b = mk('cs-b');
+    try {
+      await a.start(); await b.start();
+      await connectNodes(a, b);
+      const left = [];
+      b.on('peer-left', (x) => left.push(x));
+      const first = b._peers.get(a.nodeId).transport;
+      await connectNodes(a, b);
+      await until(() => b._peers.get(a.nodeId)?.transport !== first && first.closed);
+      assert.strictEqual(first.closed, true);
+      assert.strictEqual(first.closedReason, 'superseded');
+      assert.deepStrictEqual(left, [], 'no peer-left: the peer kept a session throughout');
+      assert.strictEqual(b._sessionStats.superseded >= 1, true);
+    } finally { await stopAll(a, b); }
+  });
+});
+
+describe('the key registry at the session (D3)', () => {
+  it('a squatter racing the upgrade against a legacy-claim is refused; the honest node with the claimed key binds proven', async () => {
+    const { PeerSession } = require('../lib/session');
+    const b = mk('cs-b');
+    const honestName = uniq('cs-honest');
+    const honestId = loadOrCreateIdentity(honestName);
+    try {
+      // b upgraded from 0.13 holding a legacy claim (an unproven hello's key) for the honest node.
+      b._roster.bind(honestId.nodeId, honestId.publicKey, 'legacy-claim');
+      await b.start();
+      // A squatter proves the honest node's id under a key of its own.
+      const squat = identity('squatter');
+      const [ts, tb] = memoryPipe();
+      b.connectTransport(tb, { role: 'server' });
+      const s = new PeerSession({ role: 'client', transport: ts, kind: 'bonjour', room: 'cs-room', extensions: ['cmb-encrypted-v2'], implementation: { name: 'x', version: '1' },
+        local: { nodeId: honestId.nodeId, name: honestName, publicKey: squat.publicKey, privateKey: squat.privateKey } });
+      ts.on('message', (f) => s.receiveWire(f));
+      s.start();
+      await until(() => b._roster.conflicts().length > 0, 3000);
+      assert.strictEqual(b._peers.has(honestId.nodeId), false, 'the squatter is not a peer');
+      assert.strictEqual(b._roster.source(honestId.nodeId), 'legacy-claim', 'the claim is not taken over');
+      assert.deepStrictEqual(b._roster.conflicts().map((c) => [c.nodeId, c.got, c.gotSource]), [[honestId.nodeId, squat.publicKey, 'proven']]);
+      const honest = new SymNode({ name: honestName, silent: true, discovery: new NullDiscovery(), room: 'cs-room' });
+      await honest.start();
+      await connectNodes(honest, b);
+      assert.strictEqual(b._roster.source(honestId.nodeId), 'proven', 'the honest node, whose identity file did not change, matches');
+      await stopAll(honest);
+    } finally { await stopAll(b); }
+  });
+});
+
+describe('room admission on proven keys (D6)', () => {
+  function owned(ownerId, extra = {}) {
+    return { roomOwners: [{ room: 'gated-room', nodeId: ownerId.nodeId, publicKey: ownerId.publicKey }], room: 'gated-room', ...extra };
+  }
+
+  it('the owner is recognised by its pinned key; a grantee by the key it proved; a copied grant and no grant are refused', async () => {
+    const ownerName = uniq('cs-owner');
+    const ownerId = loadOrCreateIdentity(ownerName);
+    const guestName = uniq('cs-guest');
+    const guestId = loadOrCreateIdentity(guestName);
+    const thiefName = uniq('cs-thief');
+    loadOrCreateIdentity(thiefName);
+    const grant = signRoomGrant({ room: 'gated-room', grantee: guestId.nodeId, granteeKey: guestId.publicKey, grantedBy: ownerId.nodeId }, ownerId.privateKey);
+    // The owner waits one (short) handshake timeout for a session's grant.
+    const owner = new SymNode({ name: ownerName, silent: true, discovery: new NullDiscovery(), ...owned(ownerId), handshakeTimeoutMs: 600 });
+    const guest = new SymNode({ name: guestName, silent: true, discovery: new NullDiscovery(), ...owned(ownerId, { roomGrant: grant }) });
+    // The thief holds a copy of the guest's grant.
+    const thief = new SymNode({ name: thiefName, silent: true, discovery: new NullDiscovery(), ...owned(ownerId, { roomGrant: grant, handshakeTimeoutMs: 300 }) });
+    const bare = new SymNode({ name: uniq('cs-bare'), silent: true, discovery: new NullDiscovery(), ...owned(ownerId), handshakeTimeoutMs: 300 });
+    try {
+      for (const n of [owner, guest, thief, bare]) await n.start();
+      assert.strictEqual(owner.roomGate().admits, 'grant-holders');
+      await connectNodes(guest, owner);
+      assert.ok(owner._peers.has(guest.nodeId), 'the grantee whose proven key is the grant\'s is admitted');
+      assert.ok(guest._peers.has(owner.nodeId), 'and it admits the owner by the owner\'s pinned key');
+      for (const intruder of [thief, bare]) {
+        const [ti, to] = memoryPipe();
+        owner.connectTransport(to, { role: 'server' });
+        intruder.connectTransport(ti, { role: 'client', expectNodeId: owner.nodeId });
+        await until(() => owner._roomVerdicts?.get(intruder.nodeId)?.admit === false, 3000);
+        assert.strictEqual(owner._peers.has(intruder.nodeId), false, `${intruder.name} is refused`);
+      }
+      assert.match(owner._roomVerdicts.get(thief.nodeId).reason, /grantee-mismatch|room-join grant refused/);
+      assert.match(owner._roomVerdicts.get(bare.nodeId).reason, /no room-join grant/);
+    } finally { await stopAll(owner, guest, thief, bare); }
+  });
+
+  it('an id claiming to be the owner under another key is refused', async () => {
+    const ownerId = identity('the-owner');
+    const n = mk('cs-gated', owned(ownerId));
+    try {
+      const fake = { nodeId: ownerId.nodeId, identityKey: identity('x').publicKey, roomGrant: null };
+      const v = n._roomAdmissionDecide(fake);
+      assert.strictEqual(v.admit, false);
+      assert.match(v.reason, /owner's nodeId under another key/);
+      const real = { nodeId: ownerId.nodeId, identityKey: ownerId.publicKey };
+      assert.strictEqual(n._roomAdmissionDecide(real).admit, true);
+    } finally { await stopAll(n); }
+  });
+});
+
+describe('extension gating (D1)', () => {
+  it('attestation frames go only to sessions that selected sym-attest-v1, and are refused from one that did not', async () => {
+    const a = mk('cs-a', { extensions: ['cmb-encrypted-v2'] }); const b = mk('cs-b');
+    const wire = [];
+    try {
+      await a.start(); await b.start();
+      await connectNodes(a, b, { tap: (f, dir) => wire.push({ f, dir }) });
+      const session = b._peers.get(a.nodeId).transport;
+      assert.strictEqual(session.has('sym-attest-v1'), false);
+      const before = wire.length;
+      b._gossipToRoster({ type: 'attestation', attestation: { of: 'x' } });
+      assert.strictEqual(wire.length, before, 'not sent to a session without the extension');
+      const refused = [];
+      b.on('metric', (m) => { if (m.type === 'session-frame-refused') refused.push(m); });
+      a._peers.get(b.nodeId).transport.send({ type: 'checkpoint', checkpoint: { by: a.nodeId } });
+      await until(() => refused.length > 0);
+      assert.match(refused[0].reason, /sym-attest-v1 not selected/);
+    } finally { await stopAll(a, b); }
+  });
+});
+
+describe('invites carry the issuer (D5)', () => {
+  it('accepting an invite pins the issuer only where its nodeId is unbound', async () => {
+    const a = mk('cs-a'); const b = mk('cs-b');
+    try {
+      const url = a.inviteURL({ relay: 'wss://relay.example', token: 't'.repeat(32) });
+      assert.match(url, /^sym:\/\/team\/cs-room\?relay=.*&token=.*&node=.*&key=/);
+      assert.deepStrictEqual(b.acceptInvite(url).pinned, true);
+      assert.strictEqual(b._roster.source(a.nodeId), 'pinned');
+      // An invite naming the same id with another key against the existing binding: a conflict.
+      const forged = url.replace(/key=[^&]+/, `key=${identity('evil').publicKey}`);
+      const r = b.acceptInvite(forged);
+      assert.strictEqual(r.pinned, false);
+      assert.strictEqual(r.reason, 'conflict');
+      assert.strictEqual(b._roster.get(a.nodeId), a._identity.publicKey);
+      assert.strictEqual(b._roster.conflicts().length, 1);
+      // A proven binding is not lowered by an invite naming the same key.
+      void crypto;
+    } finally { await stopAll(a, b); }
+  });
+});
diff --git a/tests/core-secure-relay.test.js b/tests/core-secure-relay.test.js
new file mode 100644
index 00000000..5ff45229
--- /dev/null
+++ b/tests/core-secure-relay.test.js
@@ -0,0 +1,253 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME before lib/config loads
+
+/**
+ * Design D2 over the relay, with a fake relay: the node with the smaller nodeId sends client-hello in
+ * an envelope; a session is bound to the relay `from` it was made on and torn down on peer-left; a
+ * new confirmed session supersedes the old (a restart under 4004); an unconfirmed hello never tears a
+ * confirmed session down; frame loss re-handshakes; a forged sequence frame does not desynchronise;
+ * the binding comes from the signed metadata.to; and a broadcast to 30 sessions stays under the
+ * relay's 25 frames/s — fan-out when the relay advertises it, paced when it does not.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const crypto = require('crypto');
+const { SymNode } = require('../lib/node');
+const { NullDiscovery } = require('../lib/discovery');
+const { nodeDirById } = require('../lib/config');
+const { RelayConnection } = require('../lib/relay');
+const { buildEncryptedFrame } = require('../lib/core/cmb-encrypted-frame');
+const { fakeRelay } = require('./_fake-relay');
+const { until, signedRecord, identity } = require('./_core-secure');
+
+const uniq = (b) => `${b}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+const CATS = (focus) => ({ focus, issue: 'relay session test', intent: 'D2', motivation: 'm', commitment: 'c', perspective: 'p', mood: { text: 'calm', valence: 0, arousal: 0 } });
+const TOKEN = 'x'.repeat(40);
+
+function relayNode(base, relay, extra = {}) {
+  return new SymNode({ name: uniq(base), silent: true, relayOnly: true, discovery: new NullDiscovery(), relay: relay.url, relayToken: TOKEN, room: 'relay-room', ...extra });
+}
+async function stopAll(...nodes) {
+  for (const n of nodes) { try { await n.stop(); } catch { /* */ } try { fs.rmSync(nodeDirById(n.nodeId), { recursive: true, force: true }); } catch { /* */ } }
+}
+const paired = (a, b) => a._peers.has(b.nodeId) && b._peers.has(a.nodeId);
+const relaySession = (n, other) => n._peers.get(other.nodeId)?.transports.get('relay');
+
+describe('relay sessions (D2)', () => {
+  it('the smaller nodeId is the client; the session confirms over envelopes and records cross sealed', async () => {
+    const seen = [];
+    const relay = fakeRelay({ tap: (e) => { seen.push(e); } });
+    const a = relayNode('rs-a', relay); const b = relayNode('rs-b', relay);
+    try {
+      await a.start(); await b.start();
+      await until(() => paired(a, b), 8000);
+      assert.ok(paired(a, b));
+      const [lo] = [a, b].sort((x, y) => (x.nodeId < y.nodeId ? -1 : 1));
+      const hello = seen.find((e) => e.payload.type === 'client-hello');
+      assert.strictEqual(hello.from, lo.nodeId, 'the smaller nodeId sent client-hello');
+      const got = [];
+      b.on('verified-record', (e) => got.push(e));
+      a.remember(CATS('over the relay, sealed'));
+      await until(() => got.length > 0, 5000);
+      assert.strictEqual(got[0].session.transport, 'relay');
+      assert.ok(!JSON.stringify(seen).includes('over the relay, sealed'), 'the relay saw no category text');
+      assert.ok(!seen.some((e) => e.payload.type === 'cmb' || e.payload.type === 'handshake'));
+      assert.strictEqual(relaySession(b, a).relayFrom, a.nodeId, 'bound to the relay from it was made on');
+    } finally { await stopAll(a, b); await relay.close(); }
+  });
+
+  it('frame loss leads to a re-handshake, and records flow again', async () => {
+    let dropOne = false;
+    const relay = fakeRelay({ tap: (e) => { if (dropOne && e.payload.type === 'control-encrypted') { dropOne = false; return false; } return undefined; } });
+    const a = relayNode('rs-a', relay); const b = relayNode('rs-b', relay);
+    try {
+      await a.start(); await b.start();
+      await until(() => paired(a, b), 8000);
+      const first = relaySession(b, a).sessionId;
+      dropOne = true;
+      a.broadcastMood('lost on the way');           // sealed control frame: dropped by the relay
+      a.broadcastMood('arrives after a gap');        // the gap: the receiver closes, the client re-handshakes
+      await until(() => relaySession(b, a) && relaySession(b, a).sessionId !== first && relaySession(a, b)?.sessionId === relaySession(b, a)?.sessionId, 10000);
+      assert.notStrictEqual(relaySession(b, a).sessionId, first, 'a new session');
+      assert.ok(b._sessionStats.desync >= 1 || a._sessionStats.failedByReason['peer-closed'] >= 0);
+      const got = [];
+      b.on('verified-record', (e) => got.push(e));
+      a.remember(CATS('after the re-handshake'));
+      await until(() => got.length > 0, 5000);
+      assert.strictEqual(got.length, 1);
+    } finally { await stopAll(a, b); await relay.close(); }
+  });
+
+  it('a forged frame with the next sequence does not desynchronise the session', async () => {
+    const relay = fakeRelay();
+    const a = relayNode('rs-a', relay); const b = relayNode('rs-b', relay);
+    try {
+      await a.start(); await b.start();
+      await until(() => paired(a, b), 8000);
+      const sb = relaySession(b, a);
+      const sessionId = sb.sessionId;
+      const direction = sb.role === 'client' ? 'server-to-client' : 'client-to-server';
+      const forged = buildEncryptedFrame({ cmb: signedRecord(identity('x'), { room: 'relay-room' }), sessionId, direction, sequence: sb._mmp.nextRecv, trafficKey: crypto.randomBytes(32) });
+      relay.inject(a.nodeId, b.nodeId, forged);
+      await until(() => b._sessionStats.refusedByReason['record did not authenticate'] >= 1, 3000);
+      assert.strictEqual(relaySession(b, a).sessionId, sessionId, 'the same session, not torn down');
+      const got = [];
+      b.on('verified-record', (e) => got.push(e));
+      a.remember(CATS('genuine after a forged one'));
+      await until(() => got.length > 0, 5000);
+      assert.strictEqual(got.length, 1, 'the genuine frame at that sequence still opens');
+    } finally { await stopAll(a, b); await relay.close(); }
+  });
+
+  it('a peer restart under 4004 supersedes the old session; an unconfirmed hello never tears the confirmed one down', async () => {
+    const relay = fakeRelay();
+    const a = relayNode('rs-a', relay);
+    const bName = uniq('rs-b');
+    let b = new SymNode({ name: bName, silent: true, relayOnly: true, discovery: new NullDiscovery(), relay: relay.url, relayToken: TOKEN, room: 'relay-room' });
+    try {
+      await a.start(); await b.start();
+      await until(() => paired(a, b), 8000);
+      const old = relaySession(a, b);
+      // An unconfirmed hello under b's id (an injector): the confirmed session stays.
+      const { clientHello } = require('../lib/core/handshake-v2-flow');
+      const imp = identity('imp');
+      const { frame } = clientHello({ room: 'relay-room', nodeId: b.nodeId, name: 'imp', identityPublicKey: imp.publicKey, e2ePublicKey: crypto.randomBytes(32).toString('base64url'), implementation: { name: 'x', version: '1' }, extensions: ['cmb-encrypted-v2'] });
+      if (b.nodeId < a.nodeId) relay.inject(b.nodeId, a.nodeId, frame);
+      await new Promise((r) => setTimeout(r, 200));
+      assert.strictEqual(relaySession(a, b), old, 'still the confirmed session');
+      assert.strictEqual(old.closed, false);
+      // b restarts with the same identity: the relay replaces its connection (4004, no peer-left).
+      const left = [];
+      a.on('peer-left', (x) => left.push(x));
+      const bId = b.nodeId;
+      b._relay._identityCollision = true; // the old process stops reconnecting, as a replaced one would
+      const b2 = new SymNode({ name: `${bName}-restarted`, nodeId: bId, silent: true, relayOnly: true, discovery: new NullDiscovery(), relay: relay.url, relayToken: TOKEN, room: 'relay-room', create: false });
+      await b2.start();
+      await until(() => relaySession(a, b2) && relaySession(a, b2) !== old, 10000);
+      assert.notStrictEqual(relaySession(a, b2), old, 'a new confirmed session for the same (nodeId, key)');
+      assert.strictEqual(old.closed, true);
+      assert.deepStrictEqual(left, [], 'superseded, not left');
+      await b.stop().catch(() => {});
+      b = b2;
+    } finally { await stopAll(a, b); await relay.close(); }
+  });
+
+  it('a session ends on relay-peer-left', async () => {
+    const relay = fakeRelay();
+    const a = relayNode('rs-a', relay); const b = relayNode('rs-b', relay);
+    try {
+      await a.start(); await b.start();
+      await until(() => paired(a, b), 8000);
+      const left = [];
+      a.on('peer-left', (x) => left.push(x));
+      relay.kick(b.nodeId);
+      await until(() => left.length > 0, 5000);
+      assert.strictEqual(a._peers.has(b.nodeId), false);
+    } finally { await stopAll(a, b); await relay.close(); }
+  });
+
+  it('the binding is taken from metadata.to, never the envelope: a record signed to another node is refused', async () => {
+    const relay = fakeRelay();
+    const a = relayNode('rs-a', relay); const b = relayNode('rs-b', relay);
+    try {
+      await a.start(); await b.start();
+      await until(() => paired(a, b), 8000);
+      const metrics = [];
+      b.on('metric', (m) => metrics.push(m));
+      const someone = identity('someone');
+      const cmb = signedRecord({ nodeId: a.nodeId, name: a.name, privateKey: a._identity.privateKey }, { room: 'relay-room', to: someone.nodeId, categories: { focus: 'for someone else' } });
+      relaySession(a, b).send({ type: 'cmb', cmb });  // the envelope is addressed to b
+      await until(() => metrics.some((m) => m.type === 'cmb-audience-rejected'), 5000);
+      assert.ok(metrics.some((m) => m.type === 'cmb-audience-rejected'));
+    } finally { await stopAll(a, b); await relay.close(); }
+  });
+});
+
+describe('the relay limit with 30 sessions (D4)', () => {
+  /** A RelayConnection on a fake relay, with `n` present peers to address. */
+  async function oneConnection(relay, { rate } = {}) {
+    const id = identity('sender');
+    const conn = new RelayConnection({
+      relayUrl: relay.url, relayToken: TOKEN, log: () => {}, getIdentity: () => id, getRoom: () => 'relay-room',
+      isRunning: () => true, nodeName: 'sender', rate,
+    });
+    conn.connect();
+    await until(() => conn.state().phase === 'connected', 5000);
+    return conn;
+  }
+
+  it('paced: 30 recipients x 20 broadcasts stay under the relay\'s token bucket (no 4008)', async () => {
+    // The fake relay enforces the 0.5 bucket scaled 10x faster (250/s, burst 300) so the test is short;
+    // the client paces at 10x its default (200/s, burst 200): the same ratio as production (20 vs 25).
+    const relay = fakeRelay({ ratePerSec: 250, burst: 300 });
+    const conn = await oneConnection(relay, { rate: { perSecond: 200, burst: 200 } });
+    try {
+      const recipients = Array.from({ length: 30 }, () => identity('r').nodeId);
+      for (let i = 0; i < 20; i++) for (const to of recipients) assert.strictEqual(conn.sendTo(to, { type: 'control-encrypted', i }).ok, true);
+      await until(() => conn.state().queued === 0, 15000);
+      assert.strictEqual(relay.stats.rateLimited, 0, 'never over the relay\'s limit');
+      assert.strictEqual(conn.state().phase, 'connected');
+      assert.ok(conn.state().sentFrames >= 600);
+    } finally { conn.destroy(); await relay.close(); }
+  });
+
+  it('fan-out when the relay lists it in relay-peers.features: one frame for many recipients', async () => {
+    const relay = fakeRelay({ fanout: true });
+    const conn = await oneConnection(relay);
+    try {
+      assert.deepStrictEqual(conn.state().fanout, { max: 64 }, 'the draft\'s floor; an unknown token beside it is ignored');
+      const recipients = Array.from({ length: 30 }, () => identity('r').nodeId);
+      for (const to of recipients) conn.sendTo(to, { type: 'control-encrypted' });
+      await until(() => conn.state().queued === 0, 5000);
+      await until(() => relay.stats.fanoutIn >= 1, 2000); // the relay reads it a turn later
+      assert.strictEqual(relay.stats.fanoutIn, 1, 'thirty sealed frames, one relay frame');
+      assert.strictEqual(relay.stats.rateLimited, 0);
+    } finally { conn.destroy(); await relay.close(); }
+  });
+
+  it('a fan-out never names a recipient twice, and each recipient gets its frames in order', async () => {
+    const relay = fakeRelay({ fanout: true });
+    const conn = await oneConnection(relay);
+    const ids = Array.from({ length: 30 }, () => identity('r'));
+    const got = new Map();
+    const { WebSocket } = require('ws');
+    const sockets = [];
+    try {
+      for (const r of ids) {
+        const ws = new WebSocket(relay.url);
+        sockets.push(ws);
+        await new Promise((res) => ws.once('open', res));
+        ws.send(JSON.stringify({ type: 'relay-auth', nodeId: r.nodeId, name: 'r', token: TOKEN }));
+        ws.on('message', (d) => { const m = JSON.parse(String(d)); if (m.payload) { if (!got.has(r.nodeId)) got.set(r.nodeId, []); got.get(r.nodeId).push(m.payload.i); } });
+      }
+      await until(() => relay.conns.size === 31, 3000);
+      // Three broadcasts in one turn: the queue holds each recipient three times.
+      for (let i = 0; i < 3; i++) for (const r of ids) conn.sendTo(r.nodeId, { type: 'control-encrypted', i });
+      await until(() => [...got.values()].reduce((n, v) => n + v.length, 0) === 90, 5000);
+      assert.strictEqual(relay.stats.fanoutRefused, 0, 'no fan-out was malformed');
+      assert.strictEqual(relay.stats.fanoutIn, 3, 'one envelope per broadcast');
+      for (const r of ids) assert.deepStrictEqual(got.get(r.nodeId), [0, 1, 2], 'per-recipient order');
+    } finally { for (const ws of sockets) ws.terminate(); conn.destroy(); await relay.close(); }
+  });
+
+  it('a node broadcasting to 30 relay sessions stays under the limit (fan-out on, and off)', async () => {
+    for (const fanout of [true, false]) {
+      const relay = fakeRelay({ fanout });
+      const sender = relayNode('rs-sender', relay);
+      const peers = Array.from({ length: 30 }, (_, i) => relayNode(`rs-p${i}`, relay));
+      try {
+        await sender.start();
+        for (const p of peers) await p.start();
+        await until(() => peers.every((p) => sender._peers.has(p.nodeId)), 30000);
+        assert.strictEqual(sender._peers.size, 30, `fanout ${fanout}: 30 sessions`);
+        for (let i = 0; i < 3; i++) sender.remember(CATS(`broadcast ${i} fanout ${fanout}`));
+        await until(() => sender._relay.state().queued === 0, 20000);
+        assert.strictEqual(relay.stats.rateLimited, 0, `fanout ${fanout}: no 4008`);
+        if (fanout) assert.ok(relay.stats.fanoutIn >= 1);
+      } finally { await stopAll(sender, ...peers); await relay.close(); }
+    }
+  });
+});
diff --git a/tests/core-secure-session.test.js b/tests/core-secure-session.test.js
new file mode 100644
index 00000000..e61a9879
--- /dev/null
+++ b/tests/core-secure-session.test.js
@@ -0,0 +1,284 @@
+'use strict';
+
+/**
+ * Design D2 — the MMP v2.0 §5.2 handshake over a transport, and the sealed channel it opens
+ * (lib/session.js). The §17.4 negative cases: a bad proof, a wrong confirmation, an unechoed nonce,
+ * a stripped extension, a room mismatch, a data frame before client-finish, a legacy hello on the
+ * Core Secure listener, an all-zero shared secret, a fresh X25519 per handshake. Then the channel:
+ * records only as cmb-encrypted, control frames sealed, AEAD before sequence, desync closes.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const crypto = require('crypto');
+const { PeerSession, agreeX25519 } = require('../lib/session');
+const { EXT_CMB_ENCRYPTED_V2 } = require('../lib/core/mmp-extensions');
+const { buildEncryptedFrame } = require('../lib/core/cmb-encrypted-frame');
+const { identity, memoryPipe, until, signedRecord, applicationFor } = require('./_core-secure');
+
+const IMPL = { name: 'sym', version: '0.14.0-test' };
+const EXTS = [EXT_CMB_ENCRYPTED_V2, 'sym-attest-v1'];
+
+/** A client and a server session joined by a pipe, with an optional wire tamper per direction. */
+function pairOver({ room = 'r', clientRoom = room, clientExts = EXTS, serverExts = EXTS, tamper } = {}) {
+  const C = identity('client'), S = identity('server');
+  const wire = [];
+  const [tc, ts] = memoryPipe({ tap: (f, dir) => wire.push({ dir, f }) });
+  const client = new PeerSession({ role: 'client', transport: tc, kind: 'bonjour', local: C, room: clientRoom, extensions: clientExts, implementation: IMPL, expectNodeId: S.nodeId });
+  const server = new PeerSession({ role: 'server', transport: ts, kind: 'bonjour', local: S, room, extensions: serverExts, implementation: IMPL });
+  const feed = (to, from) => from.on('message', (f) => to.receiveWire(tamper ? tamper(f, to === server ? 'to-server' : 'to-client') : f));
+  feed(server, ts);
+  feed(client, tc);
+  const events = { client: [], server: [] };
+  for (const [name, s] of [['client', client], ['server', server]]) {
+    s.on('confirmed', () => events[name].push('confirmed'));
+    s.on('closed', (c) => events[name].push(`closed:${c.reason}`));
+    s.on('frame', (f) => events[name].push(f));
+    s.on('refused', (type, reason) => events[name].push(`refused:${type}:${reason}`));
+  }
+  return { C, S, client, server, tc, ts, wire, events };
+}
+
+const settle = () => new Promise((r) => setTimeout(r, 30));
+
+describe('the v2 handshake over a transport (D2)', () => {
+  it('confirms both sides with the proven facts and the extension intersection', async () => {
+    const p = pairOver({ serverExts: [EXT_CMB_ENCRYPTED_V2, 'sym-attest-v1', 'xmesh-insight-v1'] });
+    p.client.start();
+    await until(() => p.client.confirmed && p.server.confirmed);
+    assert.strictEqual(p.client.nodeId, p.S.nodeId);
+    assert.strictEqual(p.client.identityKey, p.S.publicKey);
+    assert.strictEqual(p.server.nodeId, p.C.nodeId);
+    assert.strictEqual(p.server.identityKey, p.C.publicKey);
+    assert.strictEqual(p.client.sessionId, p.server.sessionId);
+    assert.deepStrictEqual(p.server.selected, [EXT_CMB_ENCRYPTED_V2, 'sym-attest-v1']);
+    assert.deepStrictEqual(p.client.selected, p.server.selected);
+    assert.strictEqual(p.client.peerE2EPublicKey, p.server.localE2EPublicKey);
+  });
+
+  it('a fresh X25519 key pair per handshake, and none injectable', async () => {
+    const a = pairOver(); const b = pairOver();
+    assert.notStrictEqual(a.client.localE2EPublicKey, b.client.localE2EPublicKey);
+    const C = identity('c');
+    const keys = new Set();
+    for (let i = 0; i < 5; i++) keys.add(new PeerSession({ role: 'client', transport: memoryPipe()[0], local: C, room: 'r', extensions: EXTS, implementation: IMPL, e2ePrivateKey: 'ignored' }).localE2EPublicKey);
+    assert.strictEqual(keys.size, 5, 'one identity, five handshakes, five ephemeral keys');
+  });
+
+  it('a bad server proof aborts the client before anything is confirmed', async () => {
+    const p = pairOver({ tamper: (f) => (f.type === 'server-hello' ? { ...f, proof: Buffer.alloc(64, 1).toString('base64url') } : f) });
+    p.client.start();
+    await settle();
+    assert.strictEqual(p.client.confirmed, false);
+    assert.match(p.events.client.join(), /closed:error/);
+    assert.strictEqual(p.client.nodeId, null, 'no peer fact was kept');
+  });
+
+  it('a wrong key confirmation aborts (the client side, then the server side)', async () => {
+    const flip = (k) => { const b = Buffer.from(k, 'base64url'); b[0] ^= 1; return b.toString('base64url'); };
+    const p = pairOver({ tamper: (f) => (f.type === 'server-hello' ? { ...f, keyConfirmation: flip(f.keyConfirmation) } : f) });
+    p.client.start();
+    await settle();
+    assert.strictEqual(p.client.confirmed, false);
+    const q = pairOver({ tamper: (f) => (f.type === 'client-finish' ? { ...f, keyConfirmation: flip(f.keyConfirmation) } : f) });
+    q.client.start();
+    await settle();
+    assert.strictEqual(q.server.confirmed, false, 'the server never confirms a client whose confirmation is wrong');
+    assert.match(q.events.server.join(), /closed:error/);
+  });
+
+  it('an unechoed nonce aborts', async () => {
+    const p = pairOver({ tamper: (f) => (f.type === 'server-hello' ? { ...f, clientNonce: crypto.randomBytes(32).toString('base64url') } : f) });
+    p.client.start();
+    await settle();
+    assert.strictEqual(p.client.confirmed, false);
+    assert.match(p.events.client.join(), /closed:error/);
+  });
+
+  it('a stripped extension aborts as a downgrade, and a session without cmb-encrypted-v2 is never Core Secure', async () => {
+    const p = pairOver({ tamper: (f) => (f.type === 'server-hello' ? { ...f, selectedExtensions: f.selectedExtensions.filter((e) => e !== EXT_CMB_ENCRYPTED_V2) } : f) });
+    p.client.start();
+    await settle();
+    assert.strictEqual(p.client.confirmed, false);
+    const q = pairOver({ clientExts: ['sym-attest-v1'] });
+    q.client.start();
+    await settle();
+    assert.strictEqual(q.server.confirmed, false);
+    assert.match(q.events.server.join(), /closed:no-core-secure/, 'no fallback to a weaker session');
+  });
+
+  it('a room mismatch closes before admission', async () => {
+    const p = pairOver({ room: 'room-a', clientRoom: 'room-b' });
+    p.client.start();
+    await settle();
+    assert.strictEqual(p.server.confirmed, false);
+    assert.match(p.events.server.join(), /closed:room-mismatch/);
+    assert.strictEqual(p.wire.filter((w) => w.f.type === 'server-hello').length, 0, 'the server answered nothing');
+  });
+
+  it('a data frame before client-finish closes the listener', async () => {
+    const p = pairOver({ tamper: (f) => (f.type === 'client-finish' ? { type: 'cmb', cmb: {} } : f) });
+    p.client.start();
+    await settle();
+    assert.strictEqual(p.server.confirmed, false);
+    assert.match(p.events.server.join(), /closed:frame-before-finish/);
+  });
+
+  it('a legacy hello on the Core Secure listener is refused at once', async () => {
+    const S = identity('server');
+    const [tc, ts] = memoryPipe();
+    const server = new PeerSession({ role: 'server', transport: ts, local: S, room: 'r', extensions: EXTS, implementation: IMPL });
+    const closed = [];
+    server.on('closed', (c) => closed.push(c.reason));
+    server.receiveWire({ type: 'handshake', nodeId: identity().nodeId, name: 'legacy', publicKey: identity().publicKey });
+    assert.deepStrictEqual(closed, ['first-frame']);
+    assert.strictEqual(server.nodeId, null);
+    void tc;
+  });
+
+  it('a relay server session is bound to its relay from: a hello naming another nodeId is refused (D2)', async () => {
+    const S = identity('server'), C = identity('client'), from = identity('relay-from');
+    const [tc, ts] = memoryPipe();
+    const server = new PeerSession({ role: 'server', transport: ts, kind: 'relay', relayFrom: from.nodeId, expectNodeId: from.nodeId, local: S, room: 'r', extensions: EXTS, implementation: IMPL });
+    const client = new PeerSession({ role: 'client', transport: tc, kind: 'relay', local: C, room: 'r', extensions: EXTS, implementation: IMPL });
+    const closed = [];
+    server.on('closed', (c) => closed.push(c.reason));
+    ts.on('message', (f) => server.receiveWire(f));
+    tc.on('message', (f) => client.receiveWire(f));
+    client.start();
+    await settle();
+    assert.deepStrictEqual(closed, ['node-id-mismatch'], 'C proves its own key, but over the relay address of another node');
+    assert.strictEqual(server.confirmed, false);
+  });
+
+  it('an all-zero shared secret aborts (§5.2.1)', async () => {
+    const { privateKey } = crypto.generateKeyPairSync('x25519');
+    const peer = crypto.randomBytes(32).toString('base64url');
+    assert.throws(() => agreeX25519(privateKey, peer, () => Buffer.alloc(32)), /all-zero/);
+    // And on the wire: a client-hello whose X25519 key is a low-order point.
+    const S = identity('server');
+    const server = new PeerSession({ role: 'server', transport: memoryPipe()[1], local: S, room: 'r', extensions: EXTS, implementation: IMPL });
+    const closed = [];
+    server.on('closed', (c) => closed.push(`${c.reason}:${c.detail}`));
+    const C = identity('client');
+    const { clientHello } = require('../lib/core/handshake-v2-flow');
+    const { frame } = clientHello({ room: 'r', nodeId: C.nodeId, name: 'c', identityPublicKey: C.publicKey, e2ePublicKey: Buffer.alloc(32).toString('base64url'), implementation: IMPL, extensions: EXTS });
+    server.receiveWire(frame);
+    assert.match(closed.join(), /error:.*(all-zero|X25519 agreement failed)/);
+    assert.strictEqual(server.confirmed, false);
+  });
+
+  it('a hello whose fields are not what they must be is refused at the door', async () => {
+    const S = identity('server');
+    for (const bad of [{ nodeId: 'not-a-uuid' }, { identityPublicKey: { x: 1 } }, { nonce: 'short' }, { extensions: 'cmb-encrypted-v2' }, { implementation: null }, { name: '' }]) {
+      const server = new PeerSession({ role: 'server', transport: memoryPipe()[1], local: S, room: 'r', extensions: EXTS, implementation: IMPL });
+      const closed = [];
+      server.on('closed', (c) => closed.push(c.reason));
+      const C = identity('client');
+      const { clientHello } = require('../lib/core/handshake-v2-flow');
+      const { frame } = clientHello({ room: 'r', nodeId: C.nodeId, name: 'c', identityPublicKey: C.publicKey, e2ePublicKey: crypto.randomBytes(32).toString('base64url'), implementation: IMPL, extensions: EXTS });
+      server.receiveWire({ ...frame, ...bad });
+      assert.deepStrictEqual(closed, ['error'], JSON.stringify(bad));
+    }
+  });
+
+  it('times out an unanswered handshake', async () => {
+    const C = identity('client');
+    const s = new PeerSession({ role: 'client', transport: memoryPipe()[0], local: C, room: 'r', extensions: EXTS, implementation: IMPL, timeoutMs: 20 });
+    const closed = [];
+    s.on('closed', (c) => closed.push(c.reason));
+    s.start();
+    await until(() => closed.length > 0, 500);
+    assert.deepStrictEqual(closed, ['timeout']);
+  });
+});
+
+describe('the sealed channel (D1/D4)', () => {
+  async function confirmedPair(opts) {
+    const p = pairOver(opts);
+    p.client.start();
+    await until(() => p.client.confirmed && p.server.confirmed);
+    return p;
+  }
+
+  it('a record travels only as cmb-encrypted, its application sealed, and arrives whole', async () => {
+    const p = await confirmedPair();
+    const app = applicationFor(Buffer.from(JSON.stringify({ action: 'deploy' })));
+    const cmb = signedRecord(p.C, { categories: { focus: 'sealed thought text' }, room: 'r', application: app });
+    assert.strictEqual(p.client.trySend({ type: 'cmb', cmb }).ok, true);
+    await until(() => p.events.server.some((e) => e && e.type === 'cmb'));
+    const got = p.events.server.find((e) => e && e.type === 'cmb').cmb;
+    assert.deepStrictEqual(got, cmb, 'the logical record, application data included');
+    const onWire = p.wire.filter((w) => w.dir === 'a→b' && w.f.type === 'cmb-encrypted');
+    assert.strictEqual(onWire.length, 1);
+    const text = JSON.stringify(onWire[0].f);
+    assert.ok(!text.includes('sealed thought text'), 'no category text on the wire');
+    assert.ok(!text.includes(app.data), 'no application data on the wire');
+    assert.strictEqual(onWire[0].f.metadata.application.data, undefined);
+  });
+
+  it('a record that is not a signed v2.0 record is not sent at all', async () => {
+    const p = await confirmedPair();
+    const unsigned = signedRecord(p.C, { room: 'r' });
+    delete unsigned.metadata.sig;
+    assert.strictEqual(p.client.trySend({ type: 'cmb', cmb: unsigned }).reason, 'unsealable');
+    assert.strictEqual(p.client.trySend({ type: 'cmb', cmb: { categories: {}, metadata: { signatureSuite: 'mmp-sig-v2', sig: 'x' } } }).reason, 'unsealable');
+    assert.strictEqual(p.wire.filter((w) => w.f.type === 'cmb-encrypted').length, 0);
+    // Positions were given back: the next sealed frame is still sequence 0.
+    p.client.trySend({ type: 'mood', mood: 'calm' });
+    await until(() => p.events.server.some((e) => e && e.type === 'mood'));
+    assert.strictEqual(p.wire.find((w) => w.f.type === 'control-encrypted').f.sequence, '0');
+  });
+
+  it('control frames are sealed: a mood never crosses in the clear', async () => {
+    const p = await confirmedPair();
+    p.client.trySend({ type: 'mood', mood: 'tired after a long session' });
+    p.client.trySend({ type: 'wake-channel', platform: 'apns', token: 't', environment: 'sandbox' });
+    await until(() => p.events.server.filter((e) => e && e.type).length === 2);
+    assert.deepStrictEqual(p.events.server.filter((e) => e && e.type).map((e) => e.type), ['mood', 'wake-channel']);
+    const sealed = p.wire.filter((w) => w.f.type === 'control-encrypted');
+    assert.strictEqual(sealed.length, 2);
+    assert.ok(!JSON.stringify(p.wire).includes('tired after'), 'the mood text is not on the wire');
+    assert.deepStrictEqual(sealed.map((w) => w.f.sequence), ['0', '1'], 'one ordered sequence for every sealed frame');
+  });
+
+  it('plaintext frames after confirmation are refused (legacy cmb, plaintext mood, a late hello)', async () => {
+    const p = await confirmedPair();
+    for (const f of [{ type: 'cmb', cmb: {} }, { type: 'mood', mood: 'x' }, { type: 'handshake', nodeId: 'x' }, { type: 'state-sync' }, { type: 'client-hello' }]) p.server.receiveWire(f);
+    assert.deepStrictEqual(p.events.server.filter((e) => typeof e === 'string' && e.startsWith('refused')),
+      ['refused:cmb:not-sealed', 'refused:mood:not-sealed', 'refused:handshake:not-sealed', 'refused:state-sync:not-sealed', 'refused:client-hello:handshake-after-confirm']);
+    assert.strictEqual(p.server.confirmed, true, 'refusing a frame does not end the session');
+  });
+
+  it('a forged frame with the right sequence does not desynchronise the session', async () => {
+    const p = await confirmedPair();
+    const cmb = signedRecord(p.C, { room: 'r' });
+    const forged = buildEncryptedFrame({ cmb, sessionId: p.server.sessionId, direction: 'client-to-server', sequence: '0', trafficKey: crypto.randomBytes(32) });
+    p.server.receiveWire(forged);
+    assert.ok(p.events.server.includes('refused:cmb-encrypted:record did not authenticate'));
+    assert.strictEqual(p.server.confirmed, true);
+    p.client.trySend({ type: 'cmb', cmb });
+    await until(() => p.events.server.some((e) => e && e.type === 'cmb'));
+    assert.ok(p.events.server.some((e) => e && e.type === 'cmb'), 'the genuine frame 0 still opens');
+  });
+
+  it('frame loss is a gap: the session closes as desynchronised (the owner re-handshakes)', async () => {
+    let drop = true;
+    const p = await confirmedPair({ tamper: (f) => { if (f.type === 'control-encrypted' && f.sequence === '0' && drop) { drop = false; return { type: 'pong' }; } return f; } });
+    p.client.trySend({ type: 'mood', mood: 'lost' });
+    p.client.trySend({ type: 'mood', mood: 'next' });
+    await until(() => p.server.closed);
+    assert.match(p.events.server.join(), /closed:desync/);
+  });
+
+  it('a frame from another session is refused, not taken', async () => {
+    const a = await confirmedPair();
+    const b = await confirmedPair();
+    const frame = []; const t = b.wire; void t;
+    b.client.trySend({ type: 'mood', mood: 'm' });
+    await until(() => b.wire.some((w) => w.f.type === 'control-encrypted'));
+    a.server.receiveWire(b.wire.find((w) => w.f.type === 'control-encrypted').f);
+    assert.ok(a.events.server.includes('refused:control-encrypted:other-session'));
+    void frame;
+  });
+});
diff --git a/tests/discovery.test.js b/tests/discovery.test.js
index 4347452f..6e89b0b7 100644
--- a/tests/discovery.test.js
+++ b/tests/discovery.test.js
@@ -60,56 +60,56 @@ describe('BonjourDiscovery', () => {
     await d.stop();
   });
 
-  it('should emit inbound-connection on valid handshake', async () => {
+  it('should emit inbound-connection for a client-hello first frame (the Core Secure listener)', async () => {
     const d = new BonjourDiscovery({ mdns: false });
     const identity = { nodeId: 'test-id', name: 'test', publicKey: 'pk', hostname: 'host' };
     const port = await d.start(identity, () => {});
 
     const connections = [];
-    d.on('inbound-connection', (transport, peerId, peerName) => {
-      connections.push({ peerId, peerName });
+    d.on('inbound-connection', (transport, firstFrame, remote) => {
+      connections.push({ type: firstFrame.type, nodeId: firstFrame.nodeId, remote });
     });
 
-    // Connect and send handshake
     const net = require('net');
     const { sendFrame } = require('../lib/frame-parser');
     const client = net.createConnection({ host: '127.0.0.1', port }, () => {
-      sendFrame(client, { type: 'handshake', nodeId: 'peer-abc', name: 'peer-node' });
+      sendFrame(client, { type: 'client-hello', nodeId: 'peer-abc', name: 'peer-node' });
     });
 
-    // Wait for the EVENT, not for a fixed time: a 100 ms sleep raced the loopback round trip on a
-    // loaded host and failed with 0 connections while the handshake was still in flight.
+    // Wait for the EVENT, not for a fixed time.
     const deadline = Date.now() + 5000;
     while (connections.length === 0 && Date.now() < deadline) {
       await new Promise(resolve => setTimeout(resolve, 10));
     }
 
     assert.strictEqual(connections.length, 1);
-    assert.strictEqual(connections[0].peerId, 'peer-abc');
-    assert.strictEqual(connections[0].peerName, 'peer-node');
+    assert.strictEqual(connections[0].type, 'client-hello', 'the hello is handed to the node, which runs the handshake');
+    assert.strictEqual(connections[0].nodeId, 'peer-abc');
+    assert.match(connections[0].remote, /^127\.0\.0\.1:\d+$/);
 
     client.destroy();
     await d.stop();
   });
 
-  it('should reject non-handshake first frames', async () => {
+  it('should refuse any other first frame, and report a legacy handshake (design D2)', async () => {
     const d = new BonjourDiscovery({ mdns: false });
     const identity = { nodeId: 'test-id', name: 'test', publicKey: 'pk', hostname: 'host' };
     const port = await d.start(identity, () => {});
 
     const connections = [];
+    const legacy = [];
     d.on('inbound-connection', () => connections.push(true));
+    d.on('legacy-hello-refused', (remote) => legacy.push(remote));
 
     const net = require('net');
     const { sendFrame } = require('../lib/frame-parser');
-    const client = net.createConnection({ host: '127.0.0.1', port }, () => {
-      sendFrame(client, { type: 'ping' }); // not a handshake
-    });
-
-    await new Promise(resolve => setTimeout(resolve, 100));
-    assert.strictEqual(connections.length, 0, 'should not accept non-handshake');
-
-    client.destroy();
+    for (const first of [{ type: 'ping' }, { type: 'handshake', nodeId: 'peer-abc', name: 'old' }]) {
+      const client = net.createConnection({ host: '127.0.0.1', port }, () => sendFrame(client, first));
+      client.on('error', () => {});
+      await new Promise((resolve) => client.once('close', resolve));
+    }
+    assert.strictEqual(connections.length, 0, 'neither is accepted');
+    assert.strictEqual(legacy.length, 1, 'the legacy hello is reported for the node to count');
     await d.stop();
   });
 
diff --git a/tests/earned-authority-node.test.js b/tests/earned-authority-node.test.js
index 2c7efad5..673a4a6d 100644
--- a/tests/earned-authority-node.test.js
+++ b/tests/earned-authority-node.test.js
@@ -47,6 +47,8 @@ describe('node earned-authority wiring (EA2/EA3)', () => {
     try {
       assert.strictEqual(node._resolvedRole(), 'anchor');
       const peer = 'node-peer-xyz';
+      assert.strictEqual(node.grantRole(peer, 'validator'), null, 'no grant to an id whose key nothing proved (design D3)');
+      node._roster.bind(peer, kp(peer).pub, 'proven');
       const g = node.grantRole(peer, 'validator');
       assert.ok(g && g.sig, 'grant is signed');
       assert.strictEqual(node.resolveRole(peer), 'validator', 'grantee resolves to validator');
@@ -136,7 +138,7 @@ describe('aggregateAttestations — weighted by earned authority (EA6)', () => {
     try {
       const V = kp('val'), P = kp('part'), O = kp('overclaim'), U = kp('unknown');
       // teach the node every attester's key, then grant V validator (so V resolves up)
-      for (const x of [V, P, O]) node._roster.pin(x.nodeId, x.pub, 'handshake');
+      for (const x of [V, P, O]) node._roster.bind(x.nodeId, x.pub, 'proven');
       node.grantRole(V.nodeId, 'validator');
 
       // anchor (self, weight 4) + validator (weight 2) admit; participant (weight 1) rejects;
@@ -173,7 +175,7 @@ describe('aggregateAttestations — weighted by earned authority (EA6)', () => {
     const { node, name } = anchorNode('ea-agg-tamper');
     try {
       const P = kp('p');
-      node._roster.pin(P.nodeId, P.pub, 'handshake');
+      node._roster.bind(P.nodeId, P.pub, 'proven');
       const a = att(P.nodeId, 'participant', 'aligned', { focus: 'admit' }, P.priv);
       a.verdict = 'rejected'; // tamper after signing
       node._attestations.record(a);
diff --git a/tests/emit-room-claim.test.js b/tests/emit-room-claim.test.js
index e17af118..c663565b 100644
--- a/tests/emit-room-claim.test.js
+++ b/tests/emit-room-claim.test.js
@@ -1,19 +1,12 @@
 'use strict';
 
 /**
- * emit(): silence is not a claim.
- *
- * connect() defaulted `room` to 'default' and always sent the field, so a caller
- * who named no room made a POSITIVE claim of the public square — the one value a
- * receiver in any named room is required to close on (§5.8). The documented
- * default of a first-class API was therefore refused by every named room, and the
- * caller saw only "closed before handshake" with no mention of rooms: the node
- * logged the reason, the client did not.
- *
- * Admitted is not heard (0.14.0 review C-F2): the emitter then minted its records
- * with no room, a record with no room is in 'default' (B-R10), and the node that
- * had admitted it refused every block. It now authors for the room it was
- * admitted into.
+ * emit(): the room is explicit (Core Secure, sym 0.14; MMP §5.8: "absence is invalid in Core
+ * Secure"). The room is inside the §5.2 transcript both sides sign, so an emitter that names none is
+ * in the literal room 'default', and a node in another room refuses it at the handshake (room
+ * mismatch) — before 0.14 an emitter could make no claim and be admitted into a named room. A
+ * matching claim connects, and the node hears what the emitter sends: its records name the room the
+ * handshake proved.
  */
 
 require('./_isolate-home');
@@ -21,33 +14,41 @@ require('./_isolate-home');
 const { describe, it } = require('node:test');
 const assert = require('node:assert');
 const { SymNode } = require('../lib/node');
+const { BonjourDiscovery } = require('../lib/discovery');
 const { connect } = require('../lib/emit');
+const { identity, signedRecord, admitAs } = require('./_core-secure');
 
-describe('emit room claims', () => {
-  it('makes NO claim when the caller names no room, and is admitted by a named room', async () => {
-    const node = new SymNode({ name: 'acme-node', room: 'acme', silent: true });
+const lanNode = (name, room) => new SymNode({ name, room, silent: true, discovery: new BonjourDiscovery({ mdns: false }) });
+
+describe('emit room claims (Core Secure)', () => {
+  it('an emitter that names no room is in "default", and a named room refuses it at the handshake', async () => {
+    const node = lanNode('acme-node', 'acme');
     await node.start();
     try {
-      const e = await connect({ server: `127.0.0.1:${node._port}`, timeoutMs: 4000 });
-      assert.ok(e, 'an emitter naming no room must be admitted into a named room');
-      if (e.close) e.close();
+      await assert.rejects(
+        () => connect({ server: `127.0.0.1:${node._port}`, timeoutMs: 4000 }),
+        /did not complete the Core Secure handshake/i,
+      );
+      assert.ok((node._sessionStats.failedByReason['room-mismatch'] || 0) >= 1, 'refused as a room mismatch');
     } finally {
       await node.stop();
     }
   });
 
-  it('and the node that admitted it hears what it sends', async () => {
-    const node = new SymNode({ name: 'acme-node4', room: 'acme', silent: true });
+  it('an explicit claim of the node\'s room connects, and the node hears what it sends', async () => {
+    const node = lanNode('acme-node4', 'acme');
     await node.start();
     const refused = [];
-    node.on('metric', (m) => { if (m.type === 'cmb-audience-rejected') refused.push(m); });
+    node.on('metric', (m) => { if (m.type === 'cmb-audience-rejected' || m.type === 'cmb-signature-rejected') refused.push(m); });
     try {
-      const accepted = new Promise((resolve) => node.once('cmb-accepted', resolve));
-      const e = await connect({ server: `127.0.0.1:${node._port}`, timeoutMs: 4000 });
-      const { cmb } = e.emit({ focus: 'a block from an emitter that named no room' });
-      assert.strictEqual(cmb.metadata.room, 'acme', 'it authors for the room it was admitted into');
-      const entry = await Promise.race([accepted, new Promise((_, reject) => setTimeout(() => reject(new Error(`not heard; refused: ${JSON.stringify(refused)}`)), 8000))]);
-      assert.strictEqual(entry.cmb.metadata.key, cmb.metadata.key);
+      const accepted = new Promise((resolve) => node.once('verified-record', resolve));
+      const e = await connect({ server: `127.0.0.1:${node._port}`, room: 'acme', timeoutMs: 4000 });
+      assert.strictEqual(e.peer.nodeId, node.nodeId, 'the handshake proved the node');
+      const { cmb } = e.emit({ focus: 'a block from an emitter in acme' });
+      assert.strictEqual(cmb.metadata.room, 'acme', 'it authors for the room the handshake proved');
+      const ev = await Promise.race([accepted, new Promise((_, reject) => setTimeout(() => reject(new Error(`not heard; refused: ${JSON.stringify(refused)}`)), 8000))]);
+      assert.strictEqual(ev.record.metadata.key, cmb.metadata.key);
+      assert.strictEqual(ev.session.nodeId, e.nodeId);
       assert.strictEqual(refused.length, 0);
       await e.close();
     } finally {
@@ -55,44 +56,24 @@ describe('emit room claims', () => {
     }
   });
 
-  it('a record that names no room is still refused outside "default", even from its own author', () => {
-    // As a 0.13.x emitter mints it. The emitter fix is on the minting side: a receiver cannot tell a
-    // room-less record its author just sent from one replayed out of another room (B-R10).
-    const crypto = require('crypto');
-    const { createCMB, signCMB } = require('../lib/core');
-    const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519', { publicKeyEncoding: { type: 'spki', format: 'der' }, privateKeyEncoding: { type: 'pkcs8', format: 'der' } });
-    const node = new SymNode({ name: 'acme-node5', room: 'acme', silent: true });
-    node._pinPeerKey('emitter-0133', publicKey.slice(-32).toString('base64url'));
-    const cmb = createCMB({ categories: { focus: 'room-less, from an older emitter' }, createdBy: 'emitter' });
-    cmb.metadata.room = null;
-    signCMB(cmb, privateKey.slice(-32).toString('base64url'));
+  it('a record signed for another room is refused, even from its own author over its own session', () => {
+    const node = lanNode('acme-node5', 'acme');
+    const author = identity('emitter');
+    const session = admitAs(node, author);
+    const cmb = signedRecord(author, { categories: { focus: 'signed for the public square' }, room: 'default' });
     const metrics = [];
     node.on('metric', (m) => metrics.push(m));
-    assert.strictEqual(node._frameHandler._rejectOnBadSignature('emitter-0133', 'emitter', { cmb }), true);
+    node._frameHandler.handle(session, { type: 'cmb', cmb });
     assert.ok(metrics.some((m) => m.type === 'cmb-audience-rejected' && m.reason === 'wrong-audience'));
   });
 
-  it('still CLAIMS default when the caller asks for it, and a named room refuses that', async () => {
-    const node = new SymNode({ name: 'acme-node2', room: 'acme', silent: true });
+  it('a matching explicit claim of "default" connects to a node in "default"', async () => {
+    const node = lanNode('default-node', 'default');
     await node.start();
     try {
-      await assert.rejects(
-        () => connect({ server: `127.0.0.1:${node._port}`, room: 'default', timeoutMs: 4000 }),
-        /closed before handshake|handshake/i,
-        'an explicit `default` is a claim, and it mismatches a node in `acme`'
-      );
-    } finally {
-      await node.stop();
-    }
-  });
-
-  it('a matching claim connects', async () => {
-    const node = new SymNode({ name: 'acme-node3', room: 'acme', silent: true });
-    await node.start();
-    try {
-      const e = await connect({ server: `127.0.0.1:${node._port}`, room: 'acme', timeoutMs: 4000 });
+      const e = await connect({ server: `127.0.0.1:${node._port}`, room: 'default', timeoutMs: 4000 });
       assert.ok(e);
-      if (e.close) e.close();
+      await e.close();
     } finally {
       await node.stop();
     }
diff --git a/tests/frame-handler-author-key.test.js b/tests/frame-handler-author-key.test.js
index 72bda389..a4d0e3a6 100644
--- a/tests/frame-handler-author-key.test.js
+++ b/tests/frame-handler-author-key.test.js
@@ -3,152 +3,102 @@
 require('./_isolate-home'); // redirect $HOME to a temp sandbox before lib/config loads
 
 /**
- * Regression: a RELAYED CMB must not be reported as forged.
+ * The verifying key belongs to the AUTHOR, resolved by the signed `createdByNodeId` — never the peer
+ * that delivered the record (sym 0.14, design D4; MMP §8.8.5).
  *
- * `_rejectOnBadSignature` resolves the verifying key from the DELIVERING peer
- * (`_identityKey(peerId)`, and the roster is keyed by nodeId), while
- * `signingPayload` binds the AUTHOR (`cmb.createdBy`). Those coincide only when
- * the author handed the block over directly. For every relayed CMB the check
- * ran against the wrong node's public key, so an untouched, genuinely-signed
- * block failed 100% of the time and was dropped before SVAF with the log text
- * "forged/tampered" — invisible in every drift distribution and admission tally
- * because the drop happens upstream of evaluation.
- *
- * The relaxation is deliberately narrow: only a NAMED author that is not the
- * deliverer is treated as unverifiable. An absent `createdBy`, or an author that
- * IS the deliverer, still hard-rejects — otherwise omitting the category would be a
- * way to dodge signature rejection entirely.
- *
- * This does NOT authenticate relayed CMBs. The author's key is unresolvable from
- * a name (roster is nodeId-keyed), so the honest outcome is "unverified", which
- * is the posture the no-key branch already takes. Authenticating them needs
- * `createdByNodeId` bound into `signingPayload` — an MMP schema change.
+ * History: 0.13 resolved the key from the DELIVERING peer, so a relayed record failed against the
+ * relayer's key; the fix then let a record whose author was named but unresolvable through as
+ * "unverified". Core Secure removes both: the author's key is looked up by the nodeId the signature
+ * binds, a relayed record verifies against its author, and a record whose author has no proven,
+ * pinned or vouched key here is refused (counted `cmb-author-unresolvable`), never delivered
+ * unverified. A legacy-suite (pre-v2.0) record, an unsigned one and one without an author nodeId are
+ * refused.
  */
 
 const { describe, it } = require('node:test');
 const assert = require('node:assert');
-const crypto = require('node:crypto');
 const { FrameHandler } = require('../lib/frame-handler');
 const { createCMB, signCMB } = require('../lib/core');
+const { identity, signedRecord } = require('./_core-secure');
 
 const GROUP = 'test-group';
-const RECEIVER_NODE_ID = 'receiver-node-id';
-
-/** A fresh Ed25519 identity in the raw base64url form sym stores. */
-function identity() {
-  const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519');
-  const rawPriv = privateKey.export({ type: 'pkcs8', format: 'der' }).subarray(16);
-  const rawPub = publicKey.export({ type: 'spki', format: 'der' }).subarray(12);
-  return { priv: rawPriv.toString('base64url'), pub: rawPub.toString('base64url') };
-}
-
-/** A signed CMB as it appears on the wire (emit.js: whole object, then signCMB). */
-function signedCMB({ author, signWith }) {
-  // The room goes in metadata, where the signature binds it. (A top-level `room` is read by
-  // nothing; this fixture once passed only because a record with no room read as "every room".)
-  const cmb = createCMB({ categories: { focus: 'a relayed observation' }, createdBy: author, room: GROUP });
-  signCMB(cmb, signWith);
-  return cmb;
-}
 
-/** Receiver node stub. `keyFor` maps the delivering peerId → the key we hold. */
-function harness(keyFor) {
+/** Receiver node stub. `keys` maps an AUTHOR nodeId → the key this node holds for it. */
+function harness(keys) {
   const logs = [];
   const metrics = [];
   const decisions = [];
+  const asked = [];
   const node = {
-    nodeId: RECEIVER_NODE_ID,
+    nodeId: 'receiver-node-id',
     _room: GROUP,
-    _requireSignedCmb: false,
     _log: (m) => logs.push(m),
     emit: (type, payload) => { if (type === 'metric') metrics.push(payload); },
-    _identityKey: (peerId) => keyFor[peerId],
+    _identityKey: (nodeId) => { asked.push(nodeId); return keys[nodeId] || null; },
     _recordDecision: (d) => decisions.push(d),
   };
-  return { fh: new FrameHandler(node, {}), logs, metrics, decisions };
+  return { fh: new FrameHandler(node, {}), logs, metrics, decisions, asked };
 }
 
-describe('_rejectOnBadSignature — the verifying key must belong to the author', () => {
-  it('does NOT reject a CMB authored by A and relayed by B (the 100%-loss case)', () => {
-    const a = identity();
-    const b = identity();
-    const cmb = signedCMB({ author: 'node-a', signWith: a.priv });
-    // C holds B's key for the delivering peer, and has never met A.
-    const { fh, logs, metrics, decisions } = harness({ 'peer-b': b.pub });
-    const msg = { cmb, source: 'node-a' };
-
-    const rejected = fh._rejectOnBadSignature('peer-b', 'node-b', msg);
-
-    assert.strictEqual(rejected, false, 'a relayed CMB must reach SVAF, not be dropped as forged');
-    assert.strictEqual(msg._cmbVerified, false, 'and must be flagged unverified — it is NOT authenticated');
-    assert.ok(
-      !decisions.some((d) => d.decision === 'rejected-signature'),
-      `must never record rejected-signature, got: ${JSON.stringify(decisions)}`,
-    );
-    assert.ok(
-      metrics.some((m) => m.type === 'cmb-signature-unverifiable' && m.author === 'node-a'),
-      `the population must stay countable, got: ${JSON.stringify(metrics)}`,
-    );
-    assert.ok(
-      !logs.some((m) => m.includes('forged/tampered')),
-      `must not be logged as forgery, got: ${logs.join(' | ')}`,
-    );
+describe('_rejectOnBadSignature — the verifying key is the author\'s, by createdByNodeId', () => {
+  it('a record authored by A and relayed by B verifies against A\'s key (the 0.13 100%-loss case)', () => {
+    const A = identity('node-a'), B = identity('node-b');
+    const cmb = signedRecord(A, { room: GROUP });
+    const { fh, decisions, asked } = harness({ [A.nodeId]: A.publicKey, [B.nodeId]: B.publicKey });
+    const msg = { cmb };
+    assert.strictEqual(fh._rejectOnBadSignature(B.nodeId, 'node-b', msg), false);
+    assert.strictEqual(msg._cmbVerified, true, 'authenticated, not merely let through');
+    assert.strictEqual(msg._verifiedAuthorNodeId, A.nodeId);
+    assert.deepStrictEqual(asked, [A.nodeId], 'only the author\'s key is looked up, never the deliverer\'s');
+    assert.strictEqual(decisions.length, 0);
   });
 
-  it('still rejects a forgery from the peer that claims to have authored it', () => {
-    const a = identity();
-    const b = identity();
-    // B names itself the author but the bytes were signed by A: B's own key is
-    // the right key to check, and it fails. That is a real forgery.
-    const cmb = signedCMB({ author: 'node-b', signWith: a.priv });
-    const { fh, logs, decisions } = harness({ 'peer-b': b.pub });
-    const msg = { cmb, source: 'node-b' };
-
-    const rejected = fh._rejectOnBadSignature('peer-b', 'node-b', msg);
-
-    assert.strictEqual(rejected, true, 'author === deliverer means the verdict is meaningful');
-    assert.ok(decisions.some((d) => d.decision === 'rejected-signature'));
-    assert.ok(logs.some((m) => m.includes('forged/tampered')));
+  it('a relayed record whose author has no key here is refused, not delivered unverified', () => {
+    const A = identity('node-a'), B = identity('node-b');
+    const cmb = signedRecord(A, { room: GROUP });
+    const { fh, metrics, decisions } = harness({ [B.nodeId]: B.publicKey });
+    const msg = { cmb };
+    assert.strictEqual(fh._rejectOnBadSignature(B.nodeId, 'node-b', msg), true);
+    assert.strictEqual(msg._cmbVerified, false);
+    assert.ok(metrics.some((m) => m.type === 'cmb-author-unresolvable' && m.author === A.nodeId), 'counted by author');
+    assert.ok(decisions.some((d) => d.decision === 'rejected-signature' && /unresolvable|no proven/.test(d.focusLabel)));
   });
 
-  it('still rejects when createdBy is absent — omitting it cannot dodge rejection', () => {
-    const a = identity();
-    const b = identity();
-    const cmb = signedCMB({ author: 'node-a', signWith: a.priv });
-    delete cmb.createdBy;
-    if (cmb.metadata) delete cmb.metadata.createdBy; // absent means absent on the two-section record too
-    const { fh, decisions } = harness({ 'peer-b': b.pub });
-    const msg = { cmb, source: 'node-a' };
-
-    const rejected = fh._rejectOnBadSignature('peer-b', 'node-b', msg);
-
-    assert.strictEqual(rejected, true, 'an unnamed author must not buy a pass');
+  it('a record whose signature was made by another key is refused (B claims A\'s nodeId)', () => {
+    const A = identity('node-a'), B = identity('node-b');
+    const cmb = signedRecord({ ...A, privateKey: B.privateKey }, { room: GROUP });
+    const { fh, logs, decisions } = harness({ [A.nodeId]: A.publicKey, [B.nodeId]: B.publicKey });
+    assert.strictEqual(fh._rejectOnBadSignature(B.nodeId, 'node-b', { cmb }), true);
     assert.ok(decisions.some((d) => d.decision === 'rejected-signature'));
+    assert.ok(logs.some((m) => /refused/.test(m)));
   });
 
-  it('verifies normally when the author delivers its own CMB', () => {
-    const a = identity();
-    const cmb = signedCMB({ author: 'node-a', signWith: a.priv });
-    const { fh, decisions } = harness({ 'peer-a': a.pub });
-    const msg = { cmb, source: 'node-a' };
-
-    const rejected = fh._rejectOnBadSignature('peer-a', 'node-a', msg);
-
-    assert.strictEqual(rejected, false);
-    assert.strictEqual(msg._cmbVerified, true, 'the direct path must still authenticate');
-    assert.strictEqual(decisions.length, 0);
+  it('a record with no createdByNodeId is refused — omitting it cannot dodge the check', () => {
+    const A = identity('node-a');
+    const cmb = signedRecord(A, { room: GROUP });
+    delete cmb.metadata.createdByNodeId;
+    const { fh, decisions } = harness({ [A.nodeId]: A.publicKey });
+    assert.strictEqual(fh._rejectOnBadSignature(A.nodeId, 'node-a', { cmb }), true);
+    assert.ok(decisions.some((d) => d.focusLabel === 'no-author-node-id'));
   });
 
-  it('leaves the unresolvable-key path untouched (unverified, not rejected)', () => {
-    const a = identity();
-    const cmb = signedCMB({ author: 'node-a', signWith: a.priv });
-    const { fh, decisions } = harness({}); // no key for anyone
-    const msg = { cmb, source: 'node-a' };
-
-    const rejected = fh._rejectOnBadSignature('peer-b', 'node-b', msg);
+  it('a legacy-suite record (pre-v2.0 signature) is refused even when its signature is genuine', () => {
+    const A = identity('node-a');
+    const cmb = createCMB({ categories: { focus: 'an old record' }, createdBy: 'node-a', room: GROUP });
+    signCMB(cmb, A.privateKey);
+    const { fh, decisions, metrics } = harness({ [A.nodeId]: A.publicKey });
+    assert.strictEqual(fh._rejectOnBadSignature(A.nodeId, 'node-a', { cmb }), true);
+    assert.ok(metrics.some((m) => m.type === 'cmb-legacy-suite-refused'), 'counted on its own metric');
+    assert.strictEqual(decisions.length, 0, 'and not recorded as a rejected signature: old history is not a forgery');
+  });
 
-    assert.strictEqual(rejected, false);
-    assert.strictEqual(msg._cmbVerified, false);
+  it('a record its author delivers directly verifies normally', () => {
+    const A = identity('node-a');
+    const cmb = signedRecord(A, { room: GROUP });
+    const { fh, decisions } = harness({ [A.nodeId]: A.publicKey });
+    const msg = { cmb };
+    assert.strictEqual(fh._rejectOnBadSignature(A.nodeId, 'node-a', msg), false);
+    assert.strictEqual(msg._cmbVerified, true);
     assert.strictEqual(decisions.length, 0);
   });
 });
diff --git a/tests/gossip-budget.test.js b/tests/gossip-budget.test.js
index 30a121d7..efb26cc6 100644
--- a/tests/gossip-budget.test.js
+++ b/tests/gossip-budget.test.js
@@ -40,7 +40,7 @@ function withNode(n, fn) {
   const node = new SymNode({ name, silent: true, discovery: new NullDiscovery(), room: ROOM });
   try {
     const keys = Array.from({ length: n }, (_, i) => ({ id: `att-${i}`, ...kp() }));
-    for (const k of keys) node._pinPeerKey(k.id, k.pub);
+    for (const k of keys) node._roster.bind(k.id, k.pub, 'proven');
     node._gossipToRoster = () => {};
     const clock = { t: 1_800_000_000_000 };
     node._gossipClock = () => clock.t;
diff --git a/tests/gossip-lanes.test.js b/tests/gossip-lanes.test.js
index 2d955615..8e8d950e 100644
--- a/tests/gossip-lanes.test.js
+++ b/tests/gossip-lanes.test.js
@@ -37,6 +37,7 @@ const { nodeDir } = require('../lib/config');
 const { RelayConnection } = require('../lib/relay');
 const { RoleGrantStore } = require('../lib/role-grant-store');
 const { signAttestation, signCheckpoint, signWitness, signGrant, verifyGrant } = require('../lib/core');
+const { admitAs } = require('./_core-secure');
 
 const ROOM = 'g';
 const kp = (id) => {
@@ -47,7 +48,9 @@ const signed = (fields, priv, sign) => { const o = { ...fields }; sign(o, priv);
 const forgedSig = () => crypto.randomBytes(64).toString('base64url');
 let n = 0;
 const forged = (k) => ({ of: `cmb-${++n}`, by: k.id, at: 1, roster: ROOM, verdict: 'aligned', categories: {}, seq: n, prev: 'p', sig: forgedSig(), sigAlg: 'ed25519' });
-const forgedGrant = (by, grantee) => ({ type: 'role-grant', grantee, role: 'validator', grantedBy: by, grantedAt: ++n, sig: forgedSig(), sigAlg: 'ed25519' });
+// Since 0.14 every role-grant names the key it confers authority on (design D3).
+const SOME_KEY = Buffer.alloc(32, 9).toString('base64url');
+const forgedGrant = (by, grantee) => ({ type: 'role-grant', grantee, granteeKey: SOME_KEY, role: 'validator', grantedBy: by, grantedAt: ++n, sig: forgedSig(), sigAlg: 'ed25519' });
 const respell = (s) => [`${s}=`, `${s}==`, ` ${s}`, `${s.slice(0, 40)}\n${s.slice(40)}`, s.replace(/-/g, '+').replace(/_/g, '/'), `${s}!`].filter((x) => x !== s);
 
 /** A node (not started) on an injected clock, with what it gossips captured. */
@@ -73,28 +76,28 @@ describe('role grants are gossip under the budget (F1)', () => {
   it('a captured grant re-spelled is refused or a repeat: never stored, written or relayed again, and nothing is spent', () => {
     const A = kp('anchor-A');
     withNode({ anchor: { nodeId: A.id, publicKey: A.pub } }, ({ node, sent }) => {
-      const g = signGrant({ type: 'role-grant', grantee: 'node-V', role: 'validator', grantedBy: A.id, grantedAt: 1 }, A.priv);
-      assert.strictEqual(node._ingestRoleGrant(g, 'p', 'tcp:1').ok, true);
+      const g = signGrant({ type: 'role-grant', grantee: 'node-V', granteeKey: SOME_KEY, role: 'validator', grantedBy: A.id, grantedAt: 1 }, A.priv);
+      assert.strictEqual(node._ingestRoleGrant(g, 'p').ok, true);
       assert.strictEqual(sent.length, 1, 'relayed once');
-      const tokens = node._gossipBuckets.get('tcp:1').tokens;
+      const tokens = node._gossipBuckets.get('p').tokens;
       assert.strictEqual(node._gossipNewLane - tokens, 1, 'a new grant spent one');
       const spellings = respell(g.sig);
       assert.ok(spellings.length >= 5 && spellings.every((sig) => verifyGrant({ ...g, sig }, A.pub).valid), 'every spelling verifies: that was the amplification');
       const reasons = new Set();
       for (let i = 0; i < 6000; i++) {
-        const r = node._ingestRoleGrant({ ...g, sig: spellings[i % spellings.length] }, 'p', 'tcp:1');
+        const r = node._ingestRoleGrant({ ...g, sig: spellings[i % spellings.length] }, 'p');
         assert.strictEqual(r.ok, false);
         reasons.add(r.reason);
       }
-      for (let i = 0; i < 1000; i++) reasons.add(node._ingestRoleGrant({ ...g }, 'q', 'tcp:2').reason);
+      for (let i = 0; i < 1000; i++) reasons.add(node._ingestRoleGrant({ ...g }, 'q').reason);
       assert.deepStrictEqual([...reasons].sort(), ['duplicate', 'non-canonical-signature']);
       assert.strictEqual(node._roleGrants.size(), 1, 'one grant held');
       assert.strictEqual(node._roleGrants.grantsFor('node-V').length, 1);
       const file = path.join(node._dir, 'role-grants', 'role-grants.jsonl');
       assert.strictEqual(fs.readFileSync(file, 'utf8').trim().split('\n').length, 1, 'one line written');
       assert.strictEqual(sent.length, 1, 'and nothing relayed again');
-      assert.strictEqual(node._gossipBuckets.get('tcp:1').tokens, tokens, 'nothing spent');
-      assert.strictEqual(node._gossipBuckets.has('tcp:2'), false);
+      assert.strictEqual(node._gossipBuckets.get('p').tokens, tokens, 'nothing spent');
+      assert.strictEqual(node._gossipBuckets.has('q'), false);
       assert.strictEqual(node.metrics().signaturesNotCanonical, 6000, 'the refusals are counted');
     });
   });
@@ -104,8 +107,8 @@ describe('role grants are gossip under the budget (F1)', () => {
     withNode({ anchor: { nodeId: A.id, publicKey: A.pub } }, ({ node, sent }) => {
       const P = kp('grantor-P');
       const Q = kp('grantor-Q');
-      node._pinPeerKey(P.id, P.pub);
-      node._pinPeerKey(Q.id, Q.pub);
+      node._roster.bind(P.id, P.pub, 'proven');
+      node._roster.bind(Q.id, Q.pub, 'proven');
       // Since 0.13.17 only a record rooted at the anchor is kept, or checked at all: P and Q are
       // validators by the anchor's grant, so their grants are rooted and reach the signature check.
       for (const G of [P, Q]) {
@@ -113,24 +116,24 @@ describe('role grants are gossip under the budget (F1)', () => {
       }
       const reasons = {};
       for (let i = 0; i < 300; i++) {
-        const r = node._ingestRoleGrant(forgedGrant(P.id, `x-${i}`), 'p', 'tcp:1');
+        const r = node._ingestRoleGrant(forgedGrant(P.id, `x-${i}`), 'p');
         reasons[r.reason] = (reasons[r.reason] || 0) + 1;
       }
-      assert.deepStrictEqual(reasons, { 'bad-signature': 100, 'over-budget': 200 }, 'a new lane checks 100, then refuses unverified');
+      assert.deepStrictEqual(reasons, { 'bad-signature': 100, 'over-budget': 200 }, 'a new peer checks 100, then refuses unverified');
       // A grantor whose key is not held costs nothing.
-      for (let i = 0; i < 100; i++) assert.strictEqual(node._ingestRoleGrant(forgedGrant('nobody', 'x'), 'p', 'tcp:5').reason, 'unknown-grantor-key');
-      assert.strictEqual(node._gossipBuckets.has('tcp:5'), false);
+      for (let i = 0; i < 100; i++) assert.strictEqual(node._ingestRoleGrant(forgedGrant('nobody', 'x'), 'p5').reason, 'unknown-grantor-key');
+      assert.strictEqual(node._gossipBuckets.has('p5'), false);
       assert.strictEqual(sent.length, 0, 'nothing refused was relayed');
       // Genuine grants from one grantor to one grantee: kept up to the pair's bound, and only those relayed.
       let kept = 0;
       for (let i = 0; i < 70; i++) {
-        const r = node._ingestRoleGrant(signGrant({ type: 'role-grant', grantee: 'node-X', role: 'validator', grantedBy: P.id, grantedAt: i }, P.priv), 'p', 'tcp:2');
+        const r = node._ingestRoleGrant(signGrant({ type: 'role-grant', grantee: 'node-X', granteeKey: SOME_KEY, role: 'validator', grantedBy: P.id, grantedAt: i }, P.priv), 'p2');
         if (r.ok) kept++; else assert.strictEqual(r.reason, 'pair-full');
       }
       assert.strictEqual(kept, 64);
       assert.strictEqual(sent.length, 64);
       // Another grantor's grant to the same grantee is not kept out by the first one's.
-      assert.strictEqual(node._ingestRoleGrant(signGrant({ type: 'role-grant', grantee: 'node-X', role: 'validator', grantedBy: Q.id, grantedAt: 1 }, Q.priv), 'p', 'tcp:3').ok, true);
+      assert.strictEqual(node._ingestRoleGrant(signGrant({ type: 'role-grant', grantee: 'node-X', granteeKey: SOME_KEY, role: 'validator', grantedBy: Q.id, grantedAt: 1 }, Q.priv), 'p3').ok, true);
     });
   });
 
@@ -144,7 +147,8 @@ describe('role grants are gossip under the budget (F1)', () => {
       // maxGrants counts the anchor's two grants that root P and Q (0.13.17: only a rooted record is kept).
       const opts = { anchor: { nodeId: A.id, publicKey: A.pub }, keys, dir, maxPerGrantor: 3, maxPerPair: 2, maxGrants: 7 };
       const st = new RoleGrantStore(opts);
-      const grant = (by, grantee, at) => signGrant({ type: 'role-grant', grantee, role: 'validator', grantedBy: by.id, grantedAt: at }, by.priv);
+      const keyOf = (grantee) => ({ [P.id]: P.pub, [Q.id]: Q.pub })[grantee] || SOME_KEY;
+      const grant = (by, grantee, at) => signGrant({ type: 'role-grant', grantee, granteeKey: keyOf(grantee), role: 'validator', grantedBy: by.id, grantedAt: at }, by.priv);
       const g = grant(A, 'V', 1);
       assert.strictEqual(st.record({ ...g, sig: `${g.sig}=` }).stored, true, 'a direct caller may hand over another spelling');
       assert.strictEqual(st.grantsFor('V')[0].sig, g.sig, 'it is kept as its signer wrote it');
@@ -168,62 +172,59 @@ describe('role grants are gossip under the budget (F1)', () => {
   });
 });
 
-describe('the budget is kept per connection, not per declared id (F2)', () => {
-  it('a lane seen for the first time has 100 checks and earns the rest at the rate, up to the burst', () => {
+describe('the budget is kept per PROVEN peer (F2; Core Secure design D1)', () => {
+  // Until 0.14 the budget was kept per connection lane, because the id a sender declared was free to
+  // claim. A peer is now a confirmed session's proven nodeId, so the per-connection lanes — an
+  // identity workaround — are gone and the budget is the proven peer's. Minting an identity costs a
+  // completed handshake, and buys a hundred checks, not a burst; the ceiling bounds all of them.
+  it('a peer seen for the first time has 100 checks and earns the rest at the rate, up to the burst', () => {
     withNode({}, ({ node, clock }) => {
       const A = kp('att-A');
-      node._pinPeerKey(A.id, A.pub);
-      const send = (count, lane) => {
+      node._roster.bind(A.id, A.pub, 'proven');
+      const send = (count, peer) => {
         let checked = 0;
-        for (let i = 0; i < count; i++) if (node._ingestAttestation(forged(A), 'p', 'p', lane).reason !== 'over-budget') checked++;
+        for (let i = 0; i < count; i++) if (node._ingestAttestation(forged(A), peer, peer).reason !== 'over-budget') checked++;
         return checked;
       };
-      assert.strictEqual(send(300, 'tcp:1'), 100, 'a new lane: 100');
+      assert.strictEqual(send(300, 'peer-1'), 100, 'a new peer: 100');
       clock.t += 50;
-      assert.strictEqual(send(300, 'tcp:1'), 100, '2,000 a second: 100 in 50 ms');
+      assert.strictEqual(send(300, 'peer-1'), 100, '2,000 a second: 100 in 50 ms');
       clock.t += 60_000;
-      assert.strictEqual(send(12_000, 'tcp:1'), 10_000, 'and at most the burst once it has earned it');
+      assert.strictEqual(send(12_000, 'peer-1'), 10_000, 'and at most the burst once it has earned it');
+      assert.deepStrictEqual([...node._gossipBuckets.keys()], ['peer-1'], 'keyed by the proven peer');
     });
   });
 
-  it('fresh ids on one connection share its lane', () => {
+  it('a peer\'s frames over any of its sessions spend one budget; checkpoints, witnesses and grants too', () => {
     withNode({}, ({ node }) => {
       const A = kp('att-A');
-      node._pinPeerKey(A.id, A.pub);
-      const lane = node._newLane('tcp');
-      let rejected = 0;
-      node.on('metric', (m) => { if (m.type === 'attestation-rejected') rejected++; });
-      for (let i = 0; i < 1000; i++) node._frameHandler.handle(`id-${i}`, `id-${i}`, { type: 'attestation', attestation: forged(A) }, lane);
-      assert.strictEqual(rejected, 100, 'checked: one new lane, not 1,000');
-      assert.strictEqual(node.metrics().gossipOverBudget, 900);
-      assert.deepStrictEqual([...node._gossipBuckets.keys()], [lane]);
-      // Checkpoints, witnesses and role grants go by the lane as well.
-      const other = node._newLane('tcp');
-      for (let i = 0; i < 30; i++) {
-        node._frameHandler.handle(`c-${i}`, `c-${i}`, { type: 'checkpoint', checkpoint: { type: 'checkpoint', by: A.id, roster: ROOM, upto_seq: i + 1, root: `r${i}`, at: 1, sig: forgedSig() } }, other);
-        node._frameHandler.handle(`w-${i}`, `w-${i}`, { type: 'witness', witness: { type: 'witness', attester: A.id, roster: ROOM, upto_seq: i + 1, root: 'r', by: A.id, role: 'participant', at: 1, sig: forgedSig() } }, other);
-        node._frameHandler.handle(`g-${i}`, `g-${i}`, { type: 'role-grant', grant: forgedGrant(A.id, `x-${i}`) }, other);
+      node._roster.bind(A.id, A.pub, 'proven');
+      const lan = admitAs(node, { nodeId: 'peer-two-paths' });
+      const relay = { ...lan, kind: 'relay', sessionId: 'f'.repeat(32), has: lan.has };
+      for (let i = 0; i < 60; i++) node._frameHandler.handle(i % 2 ? lan : relay, { type: 'attestation', attestation: forged(A) });
+      for (let i = 0; i < 10; i++) {
+        node._frameHandler.handle(lan, { type: 'checkpoint', checkpoint: { type: 'checkpoint', by: A.id, roster: ROOM, upto_seq: i + 1, root: `r${i}`, at: 1, sig: forgedSig() } });
+        node._frameHandler.handle(relay, { type: 'witness', witness: { type: 'witness', attester: A.id, roster: ROOM, upto_seq: i + 1, root: 'r', by: A.id, role: 'participant', at: 1, sig: forgedSig() } });
+        node._frameHandler.handle(lan, { type: 'role-grant', grant: forgedGrant(A.id, `x-${i}`) });
       }
-      assert.deepStrictEqual([...node._gossipBuckets.keys()], [lane, other]);
-      assert.strictEqual(node._gossipNewLane - node._gossipBuckets.get(other).tokens, 90, 'each spent one of its lane');
+      assert.deepStrictEqual([...node._gossipBuckets.keys()], ['peer-two-paths']);
+      // A role grant from a grantor no chain reaches costs nothing (0.13.17, 0.14 D3).
+      assert.strictEqual(node._gossipNewLane - node._gossipBuckets.get('peer-two-paths').tokens, 80, 'each spent one of the one budget');
     });
   });
 
-  it('fresh sender ids over the relay are a lane each, of 100, and all of them together stay under the ceiling', () => {
+  it('many proven peers have 100 each, and all of them together stay under the ceiling', () => {
     withNode({}, ({ node, clock, metrics }) => {
       const A = kp('att-A');
-      node._pinPeerKey(A.id, A.pub);
-      const logs = [];
-      node._log = (m) => logs.push(m);
-      const relay = (id, frame) => node._relay._handlePeerMessage(id, id, frame, `relay:1:${id}`);
-      const checked = () => metrics.filter((m) => m.type === 'attestation-rejected').length;
-      // 300 ids, 101 forgeries each.
-      for (let i = 0; i < 300; i++) for (let j = 0; j < 101; j++) relay(`id-${i}`, { type: 'attestation', attestation: forged(A) });
-      assert.strictEqual(checked(), 20_000, 'the ceiling: a burst of 20,000, however many ids');
-      assert.ok(node._gossipBuckets.has('relay:1:id-0'), 'the relay frame came with its lane');
-      assert.strictEqual(node._gossipBuckets.get('relay:1:id-0').tokens, 0, 'each id has 100');
-      assert.strictEqual(node._gossipBuckets.get('relay:1:id-299').tokens, 100, 'those past the ceiling checked nothing');
-      // What the ceiling dropped is said in one report, not one per id.
+      node._roster.bind(A.id, A.pub, 'proven');
+      let badSig = 0;
+      const ingest = (peer) => { if (node._ingestAttestation(forged(A), peer, peer).reason === 'bad-signature') badSig++; };
+      const checked = () => badSig;   // a signature checked (and found forged)
+      // 300 peers, 101 forgeries each.
+      for (let i = 0; i < 300; i++) for (let j = 0; j < 101; j++) ingest(`id-${i}`);
+      assert.strictEqual(checked(), 20_000, 'the ceiling: a burst of 20,000, however many peers');
+      assert.strictEqual(node._gossipBuckets.get('id-0').tokens, 0, 'each peer has 100');
+      assert.strictEqual(node._gossipBuckets.get('id-299').tokens, 100, 'those past the ceiling checked nothing');
       const ceiling = () => metrics.filter((m) => m.type === 'gossip-over-ceiling');
       assert.strictEqual(ceiling().length, 1, 'said once, at the first drop');
       node._sayDrops(node._dropReports.get('gossip-over-ceiling|*'));
@@ -232,83 +233,26 @@ describe('the budget is kept per connection, not per declared id (F2)', () => {
       assert.strictEqual(ceiling()[0].perSecond, 4000);
       assert.strictEqual(ceiling()[1].fromPeerIds.length, 16, 'naming up to 16 peers');
       assert.strictEqual(node.metrics().gossipOverBudget, 300 * 101 - 20_000);
-      // The frame handler's own drop line is said once per connection and reason, not once per id:
-      // checked forgeries, and frames naming a signer whose key is not held (dropped for free).
-      for (let i = 0; i < 1000; i++) relay(`free-${i}`, { type: 'attestation', attestation: { ...forged(A), by: `nobody-${i}` } });
-      assert.strictEqual(logs.filter((l) => /Attestation from .* dropped \(bad-signature\)/.test(l)).length, 1);
-      assert.strictEqual(logs.filter((l) => /dropped \(unknown-attester-key\)/.test(l)).length, 1);
       // The ceiling refills at 4,000 a second.
       clock.t += 1000;
       const before = checked();
-      for (let i = 0; i < 50; i++) for (let j = 0; j < 100; j++) relay(`next-${i}`, { type: 'attestation', attestation: forged(A) });
+      for (let i = 0; i < 50; i++) for (let j = 0; j < 100; j++) ingest(`next-${i}`);
       assert.strictEqual(checked() - before, 4000);
     });
   });
 
-  it('each TCP connection, accepted or dialled, is a lane of its own, whatever id it claims', async () => {
-    const net = require('net');
-    const { EventEmitter } = require('events');
-    const { writeFrame } = require('../lib/frame-parser');
-    const name = `lanes-tcp-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
-    const node = new SymNode({ name, silent: true, discovery: new NullDiscovery(), room: ROOM });
-    const A = kp('att-A');
-    const sockets = [];
-    const server = net.createServer((sock) => { sockets.push(sock); writeFrame(sock, { type: 'attestation', attestation: forged(A) }); });
-    await new Promise((r) => server.listen(0, '127.0.0.1', r));
-    try {
-      await node.start();
-      node._pinPeerKey(A.id, A.pub);
-      const accepted = () => {
-        const t = new EventEmitter();
-        t._closed = false;
-        t.send = () => true;
-        t.trySend = () => ({ ok: true });
-        t.close = () => { t._closed = true; };
-        return t;
-      };
-      // Accepted: two connections, one after the other, claiming one id.
-      for (let i = 0; i < 2; i++) {
-        const t = accepted();
-        node._discovery.emit('inbound-connection', t, 'p-in', 'p-in', { type: 'handshake', nodeId: 'p-in', name: 'p-in' });
-        t.emit('message', { type: 'attestation', attestation: forged(A) });
-        t.close();
-      }
-      // Dialled.
-      node._connectToPeer('127.0.0.1', server.address().port, 'p-out', 'p-out');
-      for (let i = 0; i < 250 && node._gossipBuckets.size < 3; i++) await new Promise((r) => setTimeout(r, 20));
-      assert.deepStrictEqual([...node._gossipBuckets.keys()].sort(), ['tcp:1', 'tcp:2', 'tcp:3']);
-    } finally {
-      await node.stop();
-      for (const sock of sockets) sock.destroy();
-      await new Promise((r) => server.close(() => r()));
-      fs.rmSync(nodeDir(name), { recursive: true, force: true });
-    }
-  });
-
-  it('the relay hands each frame over with its lane: this connection and the sender id it names', async () => {
-    const wss = new WebSocketServer({ port: 0 });
-    let connections = 0;
-    wss.on('connection', (ws) => {
-      const c = ++connections;
-      ws.once('message', () => {
-        for (const from of c === 1 ? ['a', 'b', 'a'] : ['a']) ws.send(JSON.stringify({ from, fromName: from, payload: { type: 'ping' } }));
-        if (c === 1) setTimeout(() => ws.close(), 50);
-      });
-    });
-    const got = [];
-    let running = true;
-    const rc = new RelayConnection({
-      relayUrl: `ws://127.0.0.1:${wss.address().port}`, relayToken: 'x'.repeat(40), log: () => {},
-      getIdentity: () => ({ nodeId: 'c'.repeat(64) }), isRunning: () => running, getPeers: () => new Map(), getMeshNode: () => null,
-      createPeer: () => { throw new Error('no peers expected'); }, addPeer: () => {}, onPeerLeft: () => {}, onAuthRefused: () => {},
-      handlePeerMessage: (id, name, msg, lane) => got.push([id, lane]),
-      nodeName: 'lanes', peerWakeChannels: new Map(), saveWakeChannels: () => {},
+  it('the frame handler\'s drop line is said once a minute per peer and reason', () => {
+    withNode({}, ({ node }) => {
+      const A = kp('att-A');
+      node._roster.bind(A.id, A.pub, 'proven');
+      const logs = [];
+      node._log = (m) => logs.push(m);
+      const p = admitAs(node, { nodeId: 'peer-flooding' });
+      for (let i = 0; i < 50; i++) node._frameHandler.handle(p, { type: 'attestation', attestation: forged(A) });
+      for (let i = 0; i < 50; i++) node._frameHandler.handle(p, { type: 'attestation', attestation: { ...forged(A), by: `nobody-${i}` } });
+      assert.strictEqual(logs.filter((l) => /Attestation from .* dropped \(bad-signature\)/.test(l)).length, 1);
+      assert.strictEqual(logs.filter((l) => /dropped \(unknown-attester-key\)/.test(l)).length, 1);
     });
-    try {
-      rc.connect();
-      for (let i = 0; i < 250 && got.length < 4; i++) await new Promise((r) => setTimeout(r, 20));
-      assert.deepStrictEqual(got, [['a', 'relay:1:a'], ['b', 'relay:1:b'], ['a', 'relay:1:a'], ['a', 'relay:2:a']], 'a reconnection is a new lane');
-    } finally { running = false; rc.destroy(); await new Promise((r) => wss.close(() => r())); }
   });
 });
 
@@ -316,13 +260,13 @@ describe('drop reporting cannot break gossip or shutdown (F4)', () => {
   it('a throwing metric listener neither breaks ingest nor loses or repeats a count', () => {
     withNode({}, ({ node }) => {
       const A = kp('att-A');
-      node._pinPeerKey(A.id, A.pub);
+      node._roster.bind(A.id, A.pub, 'proven');
       const said = [];
       node.on('metric', (m) => { if (m.type === 'gossip-over-budget') said.push(m); });
       node.on('metric', () => { throw new Error('a bad sink'); });
       const reasons = {};
       for (let i = 0; i < 300; i++) {
-        const r = node._ingestAttestation(forged(A), 'p', 'p', 'tcp:1');
+        const r = node._ingestAttestation(forged(A), 'p', 'p');
         reasons[r.reason] = (reasons[r.reason] || 0) + 1;
       }
       assert.deepStrictEqual(reasons, { 'bad-signature': 100, 'over-budget': 200 });
@@ -341,7 +285,7 @@ describe('drop reporting cannot break gossip or shutdown (F4)', () => {
       const name = `lanes-stop-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
       const node = new SymNode({ name, silent: true, discovery: new NullDiscovery(), room: ROOM });
       try {
-        node._pinPeerKey('att', kp('att').pub);
+        node._roster.bind('att', kp('att').pub, 'proven');
         const t = Date.now();
         node._gossipClock = () => t;
         node._gossipBuckets.set('q', { tokens: 0, at: t });
@@ -372,8 +316,8 @@ describe('an over-long signature (F5)', () => {
     withNode({}, ({ node }) => {
       const A = kp('att-A');
       const W = kp('wit-W');
-      node._pinPeerKey(A.id, A.pub);
-      node._pinPeerKey(W.id, W.pub);
+      node._roster.bind(A.id, A.pub, 'proven');
+      node._roster.bind(W.id, W.pub, 'proven');
       let lookups = 0;
       const has = node._attestations.has.bind(node._attestations);
       node._attestations.has = (sig) => { lookups++; return has(sig); };
@@ -383,7 +327,7 @@ describe('an over-long signature (F5)', () => {
       const att = signed({ of: 'cmb-1', by: A.id, at: 1, roster: ROOM, method: 'heuristic', verdict: 'aligned', categories: {}, role: 'participant', seq: 1, prev: 'p' }, A.priv, signAttestation);
       const cp = signed({ type: 'checkpoint', by: A.id, roster: ROOM, upto_seq: 8, root: 'r8', at: 1 }, A.priv, signCheckpoint);
       const w = signed({ type: 'witness', attester: A.id, roster: ROOM, upto_seq: 8, root: 'r8', by: W.id, role: 'participant', at: 1 }, W.priv, signWitness);
-      const g = signGrant({ type: 'role-grant', grantee: 'V', role: 'validator', grantedBy: A.id, grantedAt: 1 }, A.priv);
+      const g = signGrant({ type: 'role-grant', grantee: 'V', granteeKey: SOME_KEY, role: 'validator', grantedBy: A.id, grantedAt: 1 }, A.priv);
       const ingest = (sig) => [
         node._ingestAttestation({ ...att, sig }, 'p', 'p').reason,
         node._ingestCheckpoint({ ...cp, sig }, 'p').reason,
@@ -404,20 +348,20 @@ describe('equivocation at one position (F6)', () => {
   it('a further root for a conflicted position is dropped before the budget and the signature; the first conflict is kept although the rate is spent', () => {
     withNode({ checkpointRate: { perSecond: 4, burst: 2 } }, ({ node, sent, metrics }) => {
       const A = kp('att-A');
-      node._pinPeerKey(A.id, A.pub);
+      node._roster.bind(A.id, A.pub, 'proven');
       const cp = (seq, root) => signed({ type: 'checkpoint', by: A.id, roster: ROOM, upto_seq: seq, root, at: seq }, A.priv, signCheckpoint);
-      const ingest = (c) => node._ingestCheckpoint(c, 'p', 'tcp:1');
+      const ingest = (c) => node._ingestCheckpoint(c, 'p');
       assert.deepStrictEqual([ingest(cp(8, 'r8')).ok, ingest(cp(16, 'r16')).ok, ingest(cp(24, 'r24')).reason], [true, true, 'over-rate'], "the attester's rate is spent");
       const relayed = sent.length;
       assert.strictEqual(ingest(cp(8, 'forked')).reason, 'conflict', 'a second root at a held position: the evidence');
       assert.strictEqual(node._attestations.conflictAt(A.id, 8).root, 'forked', 'kept although the rate is spent');
       assert.strictEqual(metrics.filter((m) => m.type === 'attestation-conflict').length, 1);
-      const tokens = node._gossipBuckets.get('tcp:1').tokens;
+      const tokens = node._gossipBuckets.get('p').tokens;
       for (let i = 0; i < 2000; i++) {
         const third = i % 2 ? { ...cp(8, 'r8'), root: `fork-${i}`, sig: forgedSig() } : cp(8, `fork-${i}`);
         assert.strictEqual(ingest(third).reason, 'conflict');
       }
-      assert.strictEqual(node._gossipBuckets.get('tcp:1').tokens, tokens, 'a third root spends nothing: no signature is checked');
+      assert.strictEqual(node._gossipBuckets.get('p').tokens, tokens, 'a third root spends nothing: no signature is checked');
       assert.strictEqual(node._attestations.conflictAt(A.id, 8).root, 'forked', 'and changes nothing');
       assert.strictEqual(sent.length, relayed, 'nor is relayed');
     });
@@ -425,7 +369,7 @@ describe('equivocation at one position (F6)', () => {
 });
 
 describe('part A2 review suggestions', () => {
-  it("the door's refusal is said once a minute per connection and reason, with a count, not once per frame", () => {
+  it("the door's refusal is said once a minute per peer and reason, with a count, not once per frame", () => {
     const { RoomOwnershipRegistry } = require('../lib/room-ownership');
     const { FrameHandler } = require('../lib/frame-handler');
     const GATED = 'x-review--team-02779b950c3d8d7378fd11d6';
@@ -435,17 +379,19 @@ describe('part A2 review suggestions', () => {
     const node = { _room: GATED, _roomOwners: owners, _log: (m) => logged.push(m), _peers: new Map(), emit() {} };
     node._roomDoor = (peerId) => SymNode.prototype._roomDoor.call(node, peerId);
     const fh = new FrameHandler(node);
+    const sess = (id) => ({ nodeId: id, name: id, confirmed: true, has: () => true });
     const realNow = Date.now;
     let now = realNow();
     Date.now = () => now;
     try {
       const refused = () => logged.filter((l) => l.startsWith('Door refused'));
-      for (let i = 0; i < 1000; i++) fh.handle(`m-${i}`, `m-${i}`, { type: 'cmb', cmb: {} }, `relay:1:m-${i}`);
-      assert.strictEqual(refused().length, 1, 'fresh ids over one relay connection: one line');
-      for (let i = 0; i < 500; i++) fh.handle('mallory', 'mallory', { type: 'cmb', cmb: {} }, 'tcp:9');
-      assert.strictEqual(refused().length, 2, 'another connection: one more');
+      const m = sess('m');
+      for (let i = 0; i < 1000; i++) fh.handle(m, { type: 'cmb', cmb: {} });
+      assert.strictEqual(refused().length, 1, 'a thousand frames from one unadmitted peer: one line');
+      for (let i = 0; i < 500; i++) fh.handle(sess('mallory'), { type: 'cmb', cmb: {} });
+      assert.strictEqual(refused().length, 2, 'another peer: one more');
       now += 61_000;
-      fh.handle('m-0', 'm-0', { type: 'mood', mood: {} }, 'relay:1:m-0');
+      fh.handle(m, { type: 'mood', mood: {} });
       assert.strictEqual(refused().length, 3);
       assert.match(refused()[2], /and 999 more since it was last said/);
     } finally { Date.now = realNow; }
@@ -471,7 +417,7 @@ describe('part A2 review suggestions', () => {
       const logs = [];
       node._log = (m) => logs.push(m);
       const A = kp('att-A');
-      node._pinPeerKey(A.id, A.pub);
+      node._roster.bind(A.id, A.pub, 'proven');
       const cp = (seq) => signed({ type: 'checkpoint', by: A.id, roster: ROOM, upto_seq: seq, root: `r${seq}`, at: seq }, A.priv, signCheckpoint);
       assert.strictEqual(node._ingestCheckpoint(cp(8), 'peer-one-xyz').ok, true);
       assert.strictEqual(node._ingestCheckpoint(cp(16), 'peer-two-xyz').reason, 'over-rate');
diff --git a/tests/inbound-cmb-surfacing.test.js b/tests/inbound-cmb-surfacing.test.js
index aeccc3f3..56ada925 100644
--- a/tests/inbound-cmb-surfacing.test.js
+++ b/tests/inbound-cmb-surfacing.test.js
@@ -36,7 +36,6 @@ const fs = require('fs');
 const { SymNode } = require('../lib/node');
 const { NullDiscovery } = require('../lib/discovery');
 const { nodeDir } = require('../lib/config');
-const { createCMB } = require('../lib/core');
 
 async function withNode(baseName, fn) {
   const name = `${baseName}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
@@ -53,18 +52,32 @@ async function withNode(baseName, fn) {
 const ALIGNED = { decision: 'aligned', total_drift: 0.1, category_drifts: { focus: 0.1 }, gate_values: { g: 1 } };
 const REJECTED = { decision: 'rejected', total_drift: 9, category_drifts: {}, gate_values: { g: 0 } };
 
-function cmbFrame(focusText, mood = { text: 'neutral', valence: 0, arousal: 0 }) {
-  const cmb = createCMB({
+// Since 0.14 (Core Secure) an inbound record is a signed v2.0 record from an author this node holds a
+// key for, delivered on a confirmed session; its binding is its signed metadata.to (design D4).
+const { identity, signedRecord, admitAs } = require('./_core-secure');
+const PEER_A = identity('peerA');
+const PEER_B = identity('peerB');
+const sessions = new WeakMap();
+function from(node, peer = PEER_A) {
+  let m = sessions.get(node);
+  if (!m) { m = new Map(); sessions.set(node, m); }
+  if (!m.has(peer.nodeId)) m.set(peer.nodeId, admitAs(node, peer));
+  return m.get(peer.nodeId);
+}
+
+function cmbFrame(focusText, mood = { text: 'neutral', valence: 0, arousal: 0 }, { to = null, author = PEER_A } = {}) {
+  const cmb = signedRecord(author, {
     categories: {
       focus: focusText,
       issue: 'inbound surfacing regression',
       intent: 'verify receive path',
       motivation: 'public real-time claim',
       commitment: 'guard against silent drop',
-      perspective: 'peerA',
+      perspective: author.name,
       mood,
     },
-    createdBy: 'peerA',
+    room: 'default',
+    to,
   });
   return { type: 'cmb', timestamp: Date.now(), cmb };
 }
@@ -75,15 +88,10 @@ function wireCopy(frame) {
   return JSON.parse(JSON.stringify(frame));
 }
 
-// A directed (peer-bound) frame: marked with `directed` + `to` = the receiving
-// node's id, the way node.remember({to}) marks a targeted send on the wire
-// (MMP §4.4.4 / §9.2.2). `to` must equal the receiver's nodeId for the
-// directed-delivery branch to fire.
+// A directed (peer-bound) record: its author SIGNED `to` = the receiving node (MMP §9.2.2, design
+// D4). The frame flags `directed`/`to` are no longer read.
 function directedFrame(receiverNode, focusText, mood) {
-  const frame = cmbFrame(focusText, mood);
-  frame.to = receiverNode.nodeId;
-  frame.directed = true;
-  return frame;
+  return cmbFrame(focusText, mood, { to: receiverNode.nodeId });
 }
 
 // Waits for every in-flight frame to finish, not a fixed guess at how long that takes.
@@ -95,7 +103,7 @@ describe('inbound CMB surfacing — public real-time mesh claim', () => {
       node._svafEvaluator.evaluate = async () => ALIGNED;
       let surfaced = 0;
       node.on('cmb-accepted', () => { surfaced++; });
-      node._frameHandler.handle('peerA', 'peerA', wireCopy(cmbFrame('first inbound CMB')));
+      node._frameHandler.handle(from(node), wireCopy(cmbFrame('first inbound CMB')));
       await settle();
       assert.strictEqual(surfaced, 1, 'inbound CMB must surface to the application layer');
     });
@@ -119,13 +127,13 @@ describe('inbound CMB surfacing — public real-time mesh claim', () => {
       const frame = cmbFrame('shared question to the mesh'); // neutral mood
 
       // Arrival #1: SVAF rejects, neutral mood → surfaces nothing.
-      node._frameHandler.handle('peerA', 'peerA', wireCopy(frame));
+      node._frameHandler.handle(from(node), wireCopy(frame));
       await settle();
       assert.strictEqual(surfaces.length, 0, 'neutral reject surfaces nothing (precondition)');
 
       // Arrival #2: identical CMB re-sent (reconnect anchor replay). SVAF now
       // admits. Pre-fix this was deduped and silently dropped — receive-blind.
-      node._frameHandler.handle('peerA', 'peerA', wireCopy(frame));
+      node._frameHandler.handle(from(node), wireCopy(frame));
       await settle();
       assert.ok(
         surfaces.length > 0,
@@ -142,7 +150,7 @@ describe('inbound CMB surfacing — public real-time mesh claim', () => {
       const frame = cmbFrame('admitted observation that keeps getting replayed');
       // Five identical wire-fresh re-sends (five Bonjour reconnect replays).
       for (let i = 0; i < 5; i++) {
-        node._frameHandler.handle('peerA', 'peerA', wireCopy(frame));
+        node._frameHandler.handle(from(node), wireCopy(frame));
         await settle(60);
       }
       assert.strictEqual(surfaced, 1, 'an identical CMB must surface exactly once; the replay storm stays bounded');
@@ -160,8 +168,8 @@ describe('inbound CMB surfacing — public real-time mesh claim', () => {
         nodeB.on('cmb-accepted', () => { bSurfaced++; });
 
         // A→B and B→A, each a distinct CMB so neither is deduped.
-        nodeB._frameHandler.handle('peerA', 'peerA', wireCopy(cmbFrame('from A to B')));
-        nodeA._frameHandler.handle('peerB', 'peerB', wireCopy(cmbFrame('from B to A')));
+        nodeB._frameHandler.handle(from(nodeB, PEER_A), wireCopy(cmbFrame('from A to B')));
+        nodeA._frameHandler.handle(from(nodeA, PEER_B), wireCopy(cmbFrame('from B to A', undefined, { author: PEER_B })));
         await settle();
 
         assert.strictEqual(bSurfaced, 1, 'B must surface the CMB sent from A');
@@ -191,7 +199,7 @@ describe('directed (peer-bound) delivery + ingestion flag — MMP §9.2.2', () =
       node._svafEvaluator.evaluate = async () => REJECTED;
       const surfaced = [];
       node.on('cmb-accepted', (e) => surfaced.push(e));
-      node._frameHandler.handle('peerA', 'peerA', wireCopy(directedFrame(node, 'urgent: please review the auth token flow')));
+      node._frameHandler.handle(from(node), wireCopy(directedFrame(node, 'urgent: please review the auth token flow')));
       await settle();
       assert.strictEqual(surfaced.length, 1, 'a directed CMB MUST surface even when SVAF rejects it for memory');
       assert.strictEqual(surfaced[0].directed, true, 'surfaced entry is flagged directed');
@@ -205,7 +213,7 @@ describe('directed (peer-bound) delivery + ingestion flag — MMP §9.2.2', () =
       node._svafEvaluator.evaluate = async () => ALIGNED;
       const surfaced = [];
       node.on('cmb-accepted', (e) => surfaced.push(e));
-      node._frameHandler.handle('peerA', 'peerA', wireCopy(directedFrame(node, 'directed observation that aligns with memory')));
+      node._frameHandler.handle(from(node), wireCopy(directedFrame(node, 'directed observation that aligns with memory')));
       await settle();
       assert.strictEqual(surfaced.length, 1, 'a directed CMB that admits surfaces exactly once (admit path)');
       assert.strictEqual(surfaced[0].remixed, true, 'an admitted CMB is ingested — remixed into local memory');
@@ -219,7 +227,7 @@ describe('directed (peer-bound) delivery + ingestion flag — MMP §9.2.2', () =
       node.on('cmb-accepted', (e) => surfaced.push(e));
       // No `to`/`directed` → room-bound. Neutral mood so the mood fast-path
       // surfaces nothing either.
-      node._frameHandler.handle('peerA', 'peerA', wireCopy(cmbFrame('ambient broadcast unrelated to my domain')));
+      node._frameHandler.handle(from(node), wireCopy(cmbFrame('ambient broadcast unrelated to my domain')));
       await settle();
       assert.strictEqual(surfaced.length, 0, 'a rejected broadcast MUST NOT surface — receiver-autonomous attention');
     });
@@ -230,10 +238,8 @@ describe('directed (peer-bound) delivery + ingestion flag — MMP §9.2.2', () =
       node._svafEvaluator.evaluate = async () => REJECTED;
       const surfaced = [];
       node.on('cmb-accepted', (e) => surfaced.push(e));
-      const frame = cmbFrame('directed at someone else');
-      frame.directed = true;
-      frame.to = 'some-other-node-id'; // not this node's nodeId
-      node._frameHandler.handle('peerA', 'peerA', wireCopy(frame));
+      const frame = cmbFrame('directed at someone else', undefined, { to: identity('other').nodeId }); // not this node
+      node._frameHandler.handle(from(node), wireCopy(frame));
       await settle();
       assert.strictEqual(surfaced.length, 0, 'a CMB directed at another node must not be force-surfaced here');
     });
@@ -252,13 +258,13 @@ describe('replay horizon — a stale directive must not dress as fresh', () => {
       let surfaced = 0;
       node.on('cmb-accepted', () => { surfaced += 1; });
       const frame = directedFrame(node, 'directive: commit the README change from message 457');
-      node._frameHandler.handle('peerA', 'peerA', wireCopy(frame));
+      node._frameHandler.handle(from(node), wireCopy(frame));
       await settle();
       assert.equal(surfaced, 1, 'first delivery surfaces');
       // Backdate the seen record by 30 hours — the daemon-spool replay horizon observed live.
       const fh = node._frameHandler;
       for (const [k, ts] of fh._seenCmbKeys) fh._seenCmbKeys.set(k, ts - 30 * 60 * 60 * 1000);
-      node._frameHandler.handle('peerA', 'peerA', wireCopy(frame));
+      node._frameHandler.handle(from(node), wireCopy(frame));
       await settle();
       assert.equal(surfaced, 1,
         'a 30-hour-later replay of an already-surfaced directive must not re-surface as fresh');
diff --git a/tests/inbound-frame-guard.test.js b/tests/inbound-frame-guard.test.js
index 53d84e53..5155fc87 100644
--- a/tests/inbound-frame-guard.test.js
+++ b/tests/inbound-frame-guard.test.js
@@ -14,6 +14,10 @@ require('./_isolate-home'); // redirect $HOME before lib/config loads
  *     node has no insight engine.
  * Every inbound frame now goes through one guarded dispatch, whatever carried it: a frame the node
  * cannot handle is refused and counted, never thrown out of the transport.
+ *
+ * Since 0.14 (Core Secure) a frame reaches that dispatch only from a confirmed session, so these
+ * drive real sessions: two nodes over a fake relay, and over a LAN TCP connection. A plaintext frame
+ * from an unproven relay `from` is refused before it, and the process survives that too.
  */
 
 const { describe, it } = require('node:test');
@@ -28,6 +32,8 @@ const { SymNode } = require('../lib/node');
 const { NullDiscovery } = require('../lib/discovery');
 const { nodeDir } = require('../lib/config');
 const { sendFrame } = require('../lib/frame-parser');
+const { fakeRelay } = require('./_fake-relay');
+const { admitAs } = require('./_core-secure');
 
 const uniq = (base) => `${base}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
 const until = async (cond, ms = 5000) => { for (let t = 0; t < ms && !cond(); t += 20) await new Promise((r) => setTimeout(r, 20)); };
@@ -42,70 +48,64 @@ function throwOnce(seen) {
 }
 
 describe('every inbound frame goes through one guarded dispatch (G2, C3)', () => {
+  async function exercise(a, b) {
+    const seen = [];
+    const moods = [];
+    b.on('message', throwOnce(seen));
+    b.on('mood-delivered', (d) => moods.push(d));
+    b.on('mood-rejected', (d) => moods.push(d));
+    a.send('first', { to: b.nodeId });
+    a.broadcastMood('exhausted after a long debugging session');
+    a.send('second', { to: b.nodeId });
+    await until(() => seen.length >= 2 && moods.length >= 1);
+    return { seen, moods };
+  }
+
   it('relay: a frame whose handling throws is refused and counted; the process and the relay link survive', async () => {
     const uncaught = [];
     const onUncaught = (err) => uncaught.push(err);
     process.on('uncaughtException', onUncaught);
-    const evil = 'e'.repeat(64);
-    const wss = new WebSocketServer({ port: 0 });
-    wss.on('connection', (ws) => ws.on('message', (m) => {
-      if (JSON.parse(String(m)).type !== 'relay-auth') return;
-      const send = (payload) => ws.send(JSON.stringify({ from: evil, fromName: 'evil', payload }));
-      send({ type: 'message', content: 'first' });
-      send({ type: 'mood', mood: 'exhausted after a long debugging session', fromName: 'evil' });
-      send({ type: 'message', content: 'second' });
-    }));
-    const name = uniq('guard-relay');
-    const node = new SymNode({ name, silent: true, relayOnly: true, relay: `ws://127.0.0.1:${wss.address().port}`, relayToken: 'x'.repeat(40), room: 'g' });
-    const seen = [];
-    const moods = [];
-    node.on('message', throwOnce(seen));
-    node.on('mood-delivered', (d) => moods.push(d));
-    node.on('mood-rejected', (d) => moods.push(d));
+    const relay = fakeRelay();
+    const mk = (n) => new SymNode({ name: uniq(n), silent: true, relayOnly: true, discovery: new NullDiscovery(), relay: relay.url, relayToken: 'x'.repeat(40), room: 'g' });
+    const a = mk('guard-relay-a'); const b = mk('guard-relay-b');
     try {
-      await node.start();
-      await until(() => seen.length >= 2);
+      await a.start(); await b.start();
+      await until(() => a._peers.has(b.nodeId) && b._peers.has(a.nodeId), 8000);
+      // A plaintext frame from an unproven relay `from` is refused before the dispatch.
+      relay.inject('e'.repeat(64), b.nodeId, { type: 'mood', mood: 'evil', fromName: 'evil' });
+      const { seen, moods } = await exercise(a, b);
       assert.deepStrictEqual(uncaught, [], 'nothing reached uncaughtException');
       assert.deepStrictEqual(seen, ['first', 'second'], 'the frame after the refused one is still dispatched');
       assert.strictEqual(moods.length, 1, 'the mood frame is evaluated, not thrown');
-      const m = node.metrics();
+      const m = b.metrics();
       assert.strictEqual(m.framesRefused, 1);
-      assert.deepStrictEqual(m.framesRefusedByType, { message: 1 });
-      assert.strictEqual(node.status().relayConnected, true, 'the relay link is still up');
+      assert.deepStrictEqual(m.framesRefusedByType, { cmb: 1 }, 'the directed message record whose listener threw');
+      assert.strictEqual(b.status().relayConnected, true, 'the relay link is still up');
+      assert.ok(b._sessionStats.refusedByReason['not-core-secure'] >= 1, 'the unproven plaintext frame was refused and counted');
     } finally {
       process.removeListener('uncaughtException', onUncaught);
-      await node.stop();
-      await new Promise((r) => wss.close(() => r()));
-      fs.rmSync(nodeDir(name), { recursive: true, force: true });
+      await a.stop(); await b.stop();
+      await relay.close();
+      for (const n of [a, b]) fs.rmSync(nodeDir(n.name), { recursive: true, force: true });
     }
   });
 
-  it('LAN and loopback: the same dispatch refuses and counts (0.13.16 swallowed it in the transport, uncounted)', async () => {
-    const socks = [];
-    const server = net.createServer((sock) => {
-      socks.push(sock);
-      sock.on('error', () => {});
-      sendFrame(sock, { type: 'handshake', nodeId: 'lan-peer', name: 'lan-peer' });
-      sendFrame(sock, { type: 'message', content: 'first' });
-      sendFrame(sock, { type: 'message', content: 'second' });
-    });
-    await new Promise((r) => server.listen(0, '127.0.0.1', r));
-    const name = uniq('guard-lan');
-    const node = new SymNode({ name, silent: true, discovery: new NullDiscovery(), room: 'g' });
-    const seen = [];
-    node.on('message', throwOnce(seen));
+  it('LAN: the same dispatch refuses and counts over a TCP session', async () => {
+    const { BonjourDiscovery } = require('../lib/discovery');
+    const a = new SymNode({ name: uniq('guard-lan-a'), silent: true, discovery: new NullDiscovery(), room: 'g' });
+    const b = new SymNode({ name: uniq('guard-lan-b'), silent: true, discovery: new BonjourDiscovery({ mdns: false }), room: 'g' });
     try {
-      await node.start();
-      node._connectToPeer('127.0.0.1', server.address().port, 'lan-peer', 'lan-peer');
-      await until(() => seen.length >= 2);
+      await a.start(); await b.start();
+      a._pendingBonjour = a._pendingBonjour || new Set();
+      a._connectToPeer('127.0.0.1', b._port, b.nodeId, b.name);
+      await until(() => a._peers.has(b.nodeId) && b._peers.has(a.nodeId));
+      const { seen } = await exercise(a, b);
       assert.deepStrictEqual(seen, ['first', 'second']);
-      assert.strictEqual(node.metrics().framesRefused, 1);
-      assert.deepStrictEqual(node.metrics().framesRefusedByType, { message: 1 });
+      assert.strictEqual(b.metrics().framesRefused, 1);
+      assert.deepStrictEqual(b.metrics().framesRefusedByType, { cmb: 1 });
     } finally {
-      await node.stop();
-      for (const sock of socks) sock.destroy();
-      server.close();
-      fs.rmSync(nodeDir(name), { recursive: true, force: true });
+      await a.stop(); await b.stop();
+      for (const n of [a, b]) fs.rmSync(nodeDir(n.name), { recursive: true, force: true });
     }
   });
 });
@@ -118,7 +118,8 @@ describe('a mood frame on a stock node (G2)', () => {
     node.on('mood-delivered', (d) => out.push(['delivered', d]));
     node.on('mood-rejected', (d) => out.push(['rejected', d]));
     try {
-      node._frameHandler.handle('p', 'p', { type: 'mood', mood: 'tired', fromName: 'p' });
+      const p = admitAs(node, { nodeId: 'p' });
+      node._frameHandler.handle(p, { type: 'mood', mood: 'tired', fromName: 'p' });
       assert.strictEqual(out.length, 1);
       assert.strictEqual(typeof out[0][1].drift, 'number');
       assert.ok(out[0][1].drift >= 0 && out[0][1].drift <= 2, `drift ${out[0][1].drift} is a cosine drift`);
@@ -126,7 +127,7 @@ describe('a mood frame on a stock node (G2)', () => {
       const entry = node.remember({ focus: 'own work after a mood frame', issue: 'none', intent: 'x', motivation: 'y', commitment: 'z', perspective: 'me', mood: { text: 'calm', valence: 0, arousal: 0 } });
       assert.ok(entry, 'remember() still works (in 0.13.16 it threw for two minutes after one mood frame)');
       assert.ok(Array.isArray(node.peers()));
-      for (const mood of [42, { text: 'x' }, null, '']) node._frameHandler.handle('p', 'p', { type: 'mood', mood });
+      for (const mood of [42, { text: 'x' }, null, '']) node._frameHandler.handle(p, { type: 'mood', mood });
       assert.strictEqual(out.length, 1, 'a mood that is not text is not a mood');
     } finally { node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
   });
@@ -163,32 +164,40 @@ describe('the asynchronous half of a frame (SVAF) is refused by the same guard',
 });
 
 describe('the daemon survives a peer\'s mood and message frames over the relay (G2, C3)', () => {
-  it('stays up, handles both, and answers an insight-engine request it cannot serve instead of throwing', async () => {
+  it('stays up, handles both from a Core Secure peer, refuses them in the clear, and answers an insight-engine request it cannot serve', async () => {
     const home = fs.mkdtempSync(path.join(os.tmpdir(), 'sym-daemon-guard-'));
     const sock = path.join(home, 'd.sock');
-    const wss = new WebSocketServer({ port: 0 });
-    wss.on('connection', (ws) => ws.on('message', (m) => {
-      if (JSON.parse(String(m)).type !== 'relay-auth') return;
-      const send = (payload) => ws.send(JSON.stringify({ from: 'e'.repeat(64), fromName: 'evil', payload }));
-      send({ type: 'mood', mood: 'exhausted after a long debugging session', fromName: 'evil' });
-      send({ type: 'message', content: 'hello daemon', fromName: 'evil' });
-    }));
+    const relay = fakeRelay();
     const daemon = spawn(process.execPath, [path.join(__dirname, '..', 'bin', 'sym-daemon.js')], {
       env: { ...process.env, HOME: home, USERPROFILE: home, SYM_STATE_DIR: path.join(home, '.sym'), SYM_SOCKET: sock,
         SYM_NODE_NAME: 'daemon-guard-test', SYM_ROOM: 'daemon-guard-room', SYM_RELAY_ONLY: '1',
-        SYM_RELAY_URL: `ws://127.0.0.1:${wss.address().port}`, SYM_RELAY_TOKEN: 'x'.repeat(32) },
+        SYM_RELAY_URL: relay.url, SYM_RELAY_TOKEN: 'x'.repeat(32) },
       stdio: ['ignore', 'pipe', 'pipe'],
     });
     let out = '';
     daemon.stdout.on('data', (b) => { out += b; });
     daemon.stderr.on('data', (b) => { out += b; });
+    const peer = new SymNode({ name: uniq('guard-peer'), silent: true, relayOnly: true, discovery: new NullDiscovery(), relay: relay.url, relayToken: 'x'.repeat(32), room: 'daemon-guard-room' });
     try {
-      await until(() => /Message from evil: hello daemon/.test(out) && /sym-daemon ready/.test(out) || daemon.exitCode !== null, 15000);
-      await new Promise((r) => setTimeout(r, 500));
+      await until(() => /sym-daemon ready/.test(out) || daemon.exitCode !== null, 15000);
+      await peer.start();
+      await until(() => peer._peers.size === 1, 10000);
+      const daemonId = [...peer._peers.keys()][0];
+      // In the clear, from an unproven relay `from`: refused, and the daemon survives it.
+      relay.inject('e'.repeat(64), daemonId, { type: 'mood', mood: 'unproven', fromName: 'evil' });
+      relay.inject('e'.repeat(64), daemonId, { type: 'message', content: 'unproven', fromName: 'evil' });
+      // Over the session: handled.
+      peer.broadcastMood('exhausted after a long debugging session');
+      peer.send('hello daemon', { to: daemonId });
+      await until(() => /Message from .*: hello daemon/.test(out) || daemon.exitCode !== null, 15000);
+      await new Promise((r) => setTimeout(r, 300));
       assert.strictEqual(daemon.exitCode, null, `the daemon is still running; log:\n${out.slice(-1500)}`);
       assert.doesNotMatch(out, /FATAL/);
-      assert.doesNotMatch(out, /Refused a/, 'both frames are handled, not refused: the cause is gone, not just caught');
-      assert.match(out, /Mood from evil: .*(ACCEPTED|IGNORED)/);
+      assert.match(out, /Mood from .*: .*(ACCEPTED|IGNORED)/, 'the session\'s mood is handled, not merely survived');
+      assert.match(out, /Message from .*: hello daemon/);
+      // Named by the relay envelope's label ('injected' in the fake relay), never the frame's own fromName.
+      assert.match(out, /Refused a '(mood|message)' frame from injected: not-core-secure/, 'the plaintext ones were refused');
+      assert.doesNotMatch(out, /from evil/, 'a frame-supplied name is never printed');
       const reply = await new Promise((resolve, reject) => {
         const c = net.createConnection(sock, () => c.write(JSON.stringify({ type: 'xmesh-context' }) + '\n'));
         let buf = '';
@@ -200,9 +209,10 @@ describe('the daemon survives a peer\'s mood and message frames over the relay (
       assert.match(String(reply.error), /insight engine/);
       assert.strictEqual(daemon.exitCode, null);
     } finally {
+      await peer.stop();
       daemon.kill('SIGTERM');
       await new Promise((r) => (daemon.exitCode !== null ? r() : daemon.once('exit', r)));
-      await new Promise((r) => wss.close(() => r()));
+      await relay.close();
       fs.rmSync(home, { recursive: true, force: true });
     }
   });
diff --git a/tests/integration/e2e-admission.js b/tests/integration/e2e-admission.js
index 94d0bb48..e8d6ce57 100644
--- a/tests/integration/e2e-admission.js
+++ b/tests/integration/e2e-admission.js
@@ -41,10 +41,8 @@ describe('E2E Admission Attestation — gate attaches a signed verdict to the re
       B._svafEvaluator.evaluate = async () => null;
 
       const [tA, tB] = bidirectionalPair();
-      tA.on('message', f => A._frameHandler.handle(B.nodeId, bName, f));
-      tB.on('message', f => B._frameHandler.handle(A.nodeId, aName, f));
-      A._addPeer(A._createPeer(tA, B.nodeId, bName, true, 'bonjour'));
-      B._addPeer(B._createPeer(tB, A.nodeId, aName, false, 'bonjour'));
+      A.connectTransport(tA, { role: 'client', expectNodeId: B.nodeId });
+      B.connectTransport(tB, { role: 'server' });
       await sleep(400);
 
       let received = null;
diff --git a/tests/integration/e2e-attestation-gossip.js b/tests/integration/e2e-attestation-gossip.js
index 56715c20..4eb2a1c2 100644
--- a/tests/integration/e2e-attestation-gossip.js
+++ b/tests/integration/e2e-attestation-gossip.js
@@ -41,14 +41,13 @@ describe('E2E Admission Attestation gossip (D2)', () => {
     B._svafEvaluator.evaluate = async () => null;
 
     const [tA, tB] = pair();
-    tA.on('message', f => A._frameHandler.handle(B.nodeId, bName, f));
-    tB.on('message', f => B._frameHandler.handle(A.nodeId, aName, f));
-    A._addPeer(A._createPeer(tA, B.nodeId, bName, true, 'bonjour'));
-    B._addPeer(B._createPeer(tB, A.nodeId, aName, false, 'bonjour'));
+    A.connectTransport(tA, { role: 'client', expectNodeId: B.nodeId });
+    B.connectTransport(tB, { role: 'server' });
     await sleep(400);
     const announced = [];
     B.on('attestation-received', (e) => announced.push(e));
-    assert.ok(B._peerIdentityKeys.get(A.nodeId), 'B has A\'s authenticated identity key from the handshake');
+    assert.strictEqual(B._roster.get(A.nodeId), A._identity.publicKey, 'B has A\'s identity key, proven by the handshake');
+    assert.strictEqual(B._roster.source(A.nodeId), 'proven');
 
     const entry = B.remember({
       focus: 'attestation gossip e2e', issue: 'verify attestation reaches the author',
@@ -73,12 +72,12 @@ describe('E2E Admission Attestation gossip (D2)', () => {
     assert.strictEqual(live[0].from, aName);
     assert.strictEqual(live[0].relayed, false);
     assert.strictEqual(live[0].verified, true);
-    assert.strictEqual(live[0].keySource, 'handshake');
+    assert.strictEqual(live[0].keySource, 'proven');
     assert.strictEqual(live[0].sig, att.sig);
 
     // A forged attestation (bad signature) must be dropped on ingest.
     const before = B._attestations.size();
-    B._frameHandler.handle(A.nodeId, aName, {
+    B._receiveSessionFrame(B._peers.get(A.nodeId).transport, {
       type: 'attestation',
       attestation: { of: K, by: A.nodeId, at: Date.now(), roster: 'sym-bot-team', verdict: 'aligned', categories: {}, role: 'participant', seq: 99, prev: 'x', sig: 'AAAAforged', sigAlg: 'ed25519' },
     });
diff --git a/tests/integration/e2e-checkpoint-witness.js b/tests/integration/e2e-checkpoint-witness.js
index 5a3ddfd0..a007ae9c 100644
--- a/tests/integration/e2e-checkpoint-witness.js
+++ b/tests/integration/e2e-checkpoint-witness.js
@@ -40,10 +40,8 @@ describe('E2E checkpoint + witness (D3)', () => {
     B._svafEvaluator.evaluate = async () => null;
 
     const [tA, tB] = pair();
-    tA.on('message', f => A._frameHandler.handle(B.nodeId, bName, f));
-    tB.on('message', f => B._frameHandler.handle(A.nodeId, aName, f));
-    A._addPeer(A._createPeer(tA, B.nodeId, bName, true, 'bonjour'));
-    B._addPeer(B._createPeer(tB, A.nodeId, aName, false, 'bonjour'));
+    A.connectTransport(tA, { role: 'client', expectNodeId: B.nodeId });
+    B.connectTransport(tB, { role: 'server' });
     await sleep(400);
 
     // B sends two distinct CMBs to A; A admits both, reaching seq 2 → A checkpoints.
diff --git a/tests/integration/e2e-cmb-path.js b/tests/integration/e2e-cmb-path.js
index e5565172..8c66e3c1 100644
--- a/tests/integration/e2e-cmb-path.js
+++ b/tests/integration/e2e-cmb-path.js
@@ -90,16 +90,13 @@ describe('E2E CMB path — MMP §4.2 / §4.4.4 / §9.2', () => {
 
       const [tA, tB] = bidirectionalPair();
       // Wire inbound frames into each side's frame-handler.
-      tA.on('message', (frame) => nodeA._frameHandler.handle(nodeB.nodeId, bName, frame));
-      tB.on('message', (frame) => nodeB._frameHandler.handle(nodeA.nodeId, aName, frame));
 
       // Register each as a peer on the other.
-      nodeA._addPeer(nodeA._createPeer(tA, nodeB.nodeId, bName, true, 'bonjour'));
-      nodeB._addPeer(nodeB._createPeer(tB, nodeA.nodeId, aName, false, 'bonjour'));
+      nodeA.connectTransport(tA, { role: 'client', expectNodeId: nodeB.nodeId });
+      nodeB.connectTransport(tB, { role: 'server' });
 
-      // Handshake frames flow during _addPeer — give the async round-trip
-      // a moment to settle before emitting the CMB.
-      await new Promise(r => setTimeout(r, 300));
+      // The §5.2 handshake runs over the pair; the record is sent once both sides hold the session.
+      await waitFor(() => nodeA._peers.has(nodeB.nodeId) && nodeB._peers.has(nodeA.nodeId));
 
       // Record outcomes on the receiver side. Any of these events proves
       // the inbound frame reached the frame-handler and SVAF ran.
@@ -124,13 +121,9 @@ describe('E2E CMB path — MMP §4.2 / §4.4.4 / §9.2', () => {
       // mood-delivery (reject with non-neutral mood is the only way to see
       // a mood-delivered event; neutral rejects emit nothing, so we fall
       // back to checking for a frame arrival via peer.lastSeen drift).
-      const lastSeenBefore = nodeB._peers.get(nodeA.nodeId)?.lastSeen;
-      const proofOfProcessing = await waitFor(() => {
-        if (outcomes.memoryReceived) return true;
-        if (outcomes.moodDelivered) return true;
-        const lastSeenNow = nodeB._peers.get(nodeA.nodeId)?.lastSeen;
-        return lastSeenNow && lastSeenBefore && lastSeenNow > lastSeenBefore;
-      });
+      // (0.14: a liveness bump is no proof here — the session's own sealed control frames, sent as it
+      // is greeted, advance lastSeen too.)
+      const proofOfProcessing = await waitFor(() => !!(outcomes.memoryReceived || outcomes.moodDelivered));
       assert.ok(
         proofOfProcessing,
         'nodeB frame-handler must process the inbound CMB ' +
@@ -180,15 +173,11 @@ describe('E2E CMB path — MMP §4.2 / §4.4.4 / §9.2', () => {
 
       const [tA_B, tB_A] = bidirectionalPair();
       const [tA_C, tC_A] = bidirectionalPair();
-      tA_B.on('message', (f) => nodeA._frameHandler.handle(nodeB.nodeId, bName, f));
-      tB_A.on('message', (f) => nodeB._frameHandler.handle(nodeA.nodeId, aName, f));
-      tA_C.on('message', (f) => nodeA._frameHandler.handle(nodeC.nodeId, cName, f));
-      tC_A.on('message', (f) => nodeC._frameHandler.handle(nodeA.nodeId, aName, f));
-
-      nodeA._addPeer(nodeA._createPeer(tA_B, nodeB.nodeId, bName, true, 'bonjour'));
-      nodeA._addPeer(nodeA._createPeer(tA_C, nodeC.nodeId, cName, true, 'bonjour'));
-      nodeB._addPeer(nodeB._createPeer(tB_A, nodeA.nodeId, aName, false, 'bonjour'));
-      nodeC._addPeer(nodeC._createPeer(tC_A, nodeA.nodeId, aName, false, 'bonjour'));
+
+      nodeA.connectTransport(tA_B, { role: 'client', expectNodeId: nodeB.nodeId });
+      nodeA.connectTransport(tA_C, { role: 'client', expectNodeId: nodeC.nodeId });
+      nodeB.connectTransport(tB_A, { role: 'server' });
+      nodeC.connectTransport(tC_A, { role: 'server' });
 
       await new Promise(r => setTimeout(r, 300));
 
diff --git a/tests/integration/e2e-payload-receive.js b/tests/integration/e2e-payload-receive.js
index 59b39d70..0c51392c 100644
--- a/tests/integration/e2e-payload-receive.js
+++ b/tests/integration/e2e-payload-receive.js
@@ -76,10 +76,8 @@ describe('E2E payload receive — payload survives to receiver inbox (§4.4.4 +
     nodeB._svafEvaluator.evaluate = async () => null;
 
     const [tA, tB] = bidirectionalPair();
-    tA.on('message', (frame) => nodeA._frameHandler.handle(nodeB.nodeId, bName, frame));
-    tB.on('message', (frame) => nodeB._frameHandler.handle(nodeA.nodeId, aName, frame));
-    nodeA._addPeer(nodeA._createPeer(tA, nodeB.nodeId, bName, true, 'bonjour'));
-    nodeB._addPeer(nodeB._createPeer(tB, nodeA.nodeId, aName, false, 'bonjour'));
+    nodeA.connectTransport(tA, { role: 'client', expectNodeId: nodeB.nodeId });
+    nodeB.connectTransport(tB, { role: 'server' });
 
     // Let the handshake round-trip settle so B knows A's identity key (so the
     // signed CMB verifies) and the E2E shared secret is derived (exercises the
diff --git a/tests/integration/legacy-import-013.js b/tests/integration/legacy-import-013.js
new file mode 100644
index 00000000..053fe1c4
--- /dev/null
+++ b/tests/integration/legacy-import-013.js
@@ -0,0 +1,148 @@
+'use strict';
+
+require('../_isolate-home'); // sandbox HOME: node state must never land in the real ~/.sym
+
+/**
+ * Design D7 against a REAL 0.13.17 node (the release this one replaces), over the LAN and over the
+ * relay. The 0.13.17 node runs in a child process from a 0.13.17 checkout (SYM_013_DIR, default
+ * ~/code/wt/sym-0.13.17) with its own sandboxed HOME and SYM_STATE_DIR, so neither node touches
+ * ~/.sym. The 0.14 node reaches it only through a configured Legacy Import route:
+ *   - the 0.14 node dials the route (LAN) or sends its legacy hello (relay); it never accepts one;
+ *   - a directed 0.13.17 record is delivered here, quarantined (verified: false, legacy-import);
+ *   - a directed 0.14 record reaches 0.13.17 as a legacy E2E cmb, and 0.13.17 verifies and delivers it;
+ *   - a 0.13.17 node with no route that dials this node is refused.
+ *
+ *   npm run test:integration   (skipped when no 0.13.17 checkout is present)
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawn } = require('child_process');
+const { SymNode } = require('../../lib/node');
+const { NullDiscovery } = require('../../lib/discovery');
+const { nodeDirById } = require('../../lib/config');
+const { fakeRelay } = require('../_fake-relay');
+const { until } = require('../_core-secure');
+
+// The 0.13.17 checkout: SYM_013_DIR, or the sibling worktree of this one (…/wt/sym-0.13.17).
+const DIR = process.env.SYM_013_DIR || path.resolve(__dirname, '..', '..', '..', 'sym-0.13.17');
+const PRESENT = fs.existsSync(path.join(DIR, 'lib', 'node.js'));
+const CATS = (focus) => ({ focus, issue: 'legacy import interop', intent: 'reach a 0.13.17 node', motivation: 'D7', commitment: 'none', perspective: 'test', mood: { text: 'calm', valence: 0, arousal: 0 } });
+
+/** Start a 0.13.17 node in a child, sandboxed; it reports itself and every delivery as JSON lines. */
+function start013({ relay, token, room = 'lg-room' } = {}) {
+  const sandbox = fs.mkdtempSync(path.join(os.tmpdir(), 'sym-013-home-'));
+  const script = path.join(sandbox, 'run-013.js');
+  fs.writeFileSync(script, `
+    'use strict';
+    const DIR = ${JSON.stringify(DIR)};
+    const { SymNode } = require(DIR + '/lib/node');
+    const { BonjourDiscovery, NullDiscovery } = require(DIR + '/lib/discovery');
+    const relay = ${JSON.stringify(relay || null)};
+    const node = new SymNode({ name: 'legacy-013-' + process.pid, silent: true, room: ${JSON.stringify(room)},
+      discovery: relay ? new NullDiscovery() : new BonjourDiscovery({ mdns: false }),
+      ...(relay ? { relay, relayToken: ${JSON.stringify(token || '')}, relayOnly: true } : {}) });
+    const out = (o) => process.stdout.write(JSON.stringify(o) + '\\n');
+    node.on('cmb-accepted', (e) => out({ event: 'accepted', content: e.content, directed: !!e.directed }));
+    node.on('metric', (m) => { if (/signature|legacy/.test(m.type)) out({ event: 'metric', m }); });
+    node.start().then(() => out({ event: 'ready', nodeId: node.nodeId, publicKey: node._identity.publicKey, port: node._port, version: require(DIR + '/package.json').version }));
+    let buf = '';
+    process.stdin.on('data', (d) => {
+      buf += d; let i;
+      while ((i = buf.indexOf('\\n')) !== -1) {
+        const cmd = JSON.parse(buf.slice(0, i)); buf = buf.slice(i + 1);
+        if (cmd.cmd === 'remember') { const e = node.remember(cmd.categories, { to: cmd.to }); out({ event: 'remembered', key: e && e.key }); }
+        if (cmd.cmd === 'dial') node._connectToPeer('127.0.0.1', cmd.port, cmd.peerId, 'core-secure');
+        if (cmd.cmd === 'stop') node.stop().then(() => process.exit(0));
+      }
+    });
+  `);
+  const child = spawn(process.execPath, [script], {
+    env: { ...process.env, HOME: sandbox, USERPROFILE: sandbox, SYM_STATE_DIR: path.join(sandbox, '.sym'), NODE_TEST_CONTEXT: '' },
+    stdio: ['pipe', 'pipe', 'inherit'],
+  });
+  const events = [];
+  let buf = '';
+  child.stdout.on('data', (d) => {
+    buf += d; let i;
+    while ((i = buf.indexOf('\n')) !== -1) {
+      const line = buf.slice(0, i); buf = buf.slice(i + 1);
+      try { events.push(JSON.parse(line)); } catch { /* not ours */ }
+    }
+  });
+  const send = (o) => child.stdin.write(JSON.stringify(o) + '\n');
+  return {
+    events, send, child,
+    ready: async () => { await until(() => events.some((e) => e.event === 'ready'), 15000); return events.find((e) => e.event === 'ready'); },
+    stop: async () => { try { send({ cmd: 'stop' }); } catch { /* */ } await new Promise((r) => { child.once('exit', r); setTimeout(() => { child.kill('SIGKILL'); r(); }, 4000); }); fs.rmSync(sandbox, { recursive: true, force: true }); },
+  };
+}
+
+async function stop14(n) { try { await n.stop(); } catch { /* */ } try { fs.rmSync(nodeDirById(n.nodeId), { recursive: true, force: true }); } catch { /* */ } }
+
+describe('Legacy Import against a real 0.13.17 node', { skip: PRESENT ? false : `no 0.13.17 checkout at ${DIR}` }, () => {
+  it('over the LAN: an outbound route, records both ways, quarantined here; no route means refused', async () => {
+    const legacy = start013();
+    const ready = await legacy.ready();
+    assert.match(ready.version, /^0\.13\./);
+    const node = new SymNode({
+      name: `core-secure-${process.pid}`, silent: true, room: 'lg-room',
+      discovery: new (require('../../lib/discovery').BonjourDiscovery)({ mdns: false }),
+      legacyRoutes: [{ nodeId: ready.nodeId, endpoint: `127.0.0.1:${ready.port}`, key: ready.publicKey }],
+    });
+    try {
+      await node.start();
+      await until(() => node._peers.has(ready.nodeId), 15000);
+      assert.strictEqual(node.status().legacyImport.sessions.length, 1, 'a Legacy Import session over the route');
+      // 0.13.17 → 0.14, directed: delivered here, quarantined.
+      const got = [];
+      node.on('cmb-accepted', (e) => got.push(e));
+      legacy.send({ cmd: 'remember', categories: CATS('from 0.13.17 to core secure'), to: node.nodeId });
+      await until(() => got.length > 0, 15000);
+      assert.strictEqual(got[0].verified, false);
+      assert.strictEqual(got[0].profile, 'legacy-import');
+      // 0.14 → 0.13.17, directed: 0.13.17 verifies the v2.0 record against this node's key and delivers it.
+      node.remember(CATS('from core secure to 0.13.17'), { to: ready.nodeId });
+      await until(() => legacy.events.some((e) => e.event === 'accepted' && /from core secure/.test(e.content)), 15000);
+      assert.ok(legacy.events.some((e) => e.event === 'accepted' && /from core secure/.test(e.content)), '0.13.17 delivered it');
+      assert.ok(!legacy.events.some((e) => e.event === 'metric' && e.m.type === 'cmb-signature-rejected'), '0.13.17 did not refuse its signature');
+      // A 0.13.17 node with no route that dials this node is refused at the listener.
+      const before = node._sessionStats.legacyHellosRefused;
+      const other = start013();
+      const r2 = await other.ready();
+      other.send({ cmd: 'dial', port: node._port, peerId: node.nodeId });
+      await until(() => node._sessionStats.legacyHellosRefused > before, 10000);
+      assert.ok(node._sessionStats.legacyHellosRefused > before);
+      assert.strictEqual(node._peers.has(r2.nodeId), false);
+      await other.stop();
+    } finally { await stop14(node); await legacy.stop(); }
+  });
+
+  it('over the relay: this node sends its legacy hello to the routed node; records both ways', async () => {
+    const relay = fakeRelay();
+    const token = 't'.repeat(40);
+    const legacy = start013({ relay: relay.url, token });
+    const ready = await legacy.ready();
+    const node = new SymNode({
+      name: `core-secure-relay-${process.pid}`, silent: true, room: 'lg-room', relayOnly: true, discovery: new NullDiscovery(),
+      relay: relay.url, relayToken: token,
+      legacyRoutes: [{ nodeId: ready.nodeId, endpoint: 'relay', key: ready.publicKey }],
+    });
+    try {
+      await node.start();
+      await until(() => node._peers.has(ready.nodeId), 15000);
+      assert.strictEqual(node.status().legacyImport.sessions[0].transport, 'relay');
+      const got = [];
+      node.on('cmb-accepted', (e) => got.push(e));
+      legacy.send({ cmd: 'remember', categories: CATS('over the relay from 0.13.17'), to: node.nodeId });
+      await until(() => got.length > 0, 15000);
+      assert.strictEqual(got[0].profile, 'legacy-import');
+      node.remember(CATS('over the relay from core secure'), { to: ready.nodeId });
+      await until(() => legacy.events.some((e) => e.event === 'accepted' && /from core secure/.test(e.content)), 15000);
+      assert.ok(legacy.events.some((e) => e.event === 'accepted' && /from core secure/.test(e.content)));
+    } finally { await stop14(node); await legacy.stop(); await relay.close(); }
+  });
+});
diff --git a/tests/lineage-tether-neural.test.js b/tests/lineage-tether-neural.test.js
index 0885521e..c45285ba 100644
--- a/tests/lineage-tether-neural.test.js
+++ b/tests/lineage-tether-neural.test.js
@@ -57,9 +57,11 @@ async function withNode(baseName, opts, fn) {
   }
 }
 
+// A signed v2.0 remix from peerA (Core Secure, 0.14): the lineage is inside the signed metadata.
+const { identity, signedRecord, admitAs } = require('./_core-secure');
+const PEER = identity('peerA');
 function remixFrame(text, parentKey, extra = {}) {
-  const cmb = createCMB({ categories: cat7(text), createdBy: 'peerA' });
-  cmb.metadata.lineage = { parents: [parentKey], method: 'SVAF-v2' };
+  const cmb = signedRecord(PEER, { categories: cat7(text), lineage: { parents: [parentKey], method: 'SVAF-v2' } });
   Object.assign(cmb, extra);
   return { type: 'cmb', timestamp: Date.now(), content: text, cmb };
 }
@@ -99,7 +101,7 @@ describe('MMP §15.8 lineage tether on the neural admission path', () => {
       const root = createCMB({ categories: cat7(TOPIC_A), createdBy: 'peerR' });
       node._store.receiveFromPeer('peerR', { key: root.metadata.key, content: TOPIC_A, source: 'peerR', cmb: root, _cmbVerified: true });
       const frame = remixFrame(TOPIC_B_NEW, root.metadata.key);
-      await node._frameHandler._handleMemoryShare('peerA', 'peerA', frame);
+      await node._frameHandler._handleMemoryShare(PEER.nodeId, PEER.name, frame, admitAs(node, PEER));
 
       const stored = node._store.get(frame.cmb.metadata.key);
       assert.ok(stored, 'the neural evaluator admitted the remix');
diff --git a/tests/mmp-v2-handshake-flow.test.js b/tests/mmp-v2-handshake-flow.test.js
index d1575f64..6ee32259 100644
--- a/tests/mmp-v2-handshake-flow.test.js
+++ b/tests/mmp-v2-handshake-flow.test.js
@@ -58,7 +58,15 @@ describe('MMP v2.0 §5.2 authenticated handshake flow', () => {
     const { clientSession, serverSession, clientFinishResult } = handshake(pair());
     assert.strictEqual(clientSession.sessionId, serverSession.sessionId);
     assert.ok(clientSession.confirmed && serverSession.confirmed, 'both sessions are confirmed');
-    assert.deepStrictEqual(clientFinishResult.selected, [EXT_CMB_ENCRYPTED_V2]);
+    // §16.1: the server selects the intersection of both offers (bytewise order), cmb-encrypted-v2
+    // among them whenever both offer it. (Until 0.14 it selected cmb-encrypted-v2 alone.)
+    assert.deepStrictEqual(clientFinishResult.selected, ['admission-attestation-v1', EXT_CMB_ENCRYPTED_V2]);
+  });
+
+  it('selects the intersection exactly as the published handshake vector does', () => {
+    const vec = require('./mmp-v2-handshake.vector.json').fixture.handshake;
+    const { selectExtensions } = require('../lib/core/mmp-extensions');
+    assert.deepStrictEqual(selectExtensions(vec.client.extensions, vec.server.extensions).selected, vec.selectedExtensions);
   });
 
   it('the established session immediately carries a sealed frame end to end', () => {
@@ -74,8 +82,7 @@ describe('MMP v2.0 §5.2 authenticated handshake flow', () => {
     };
     const s = clientSession.nextSend();
     const frame = buildEncryptedFrame({ cmb, sessionId: clientSession.sessionId, direction: s.direction, sequence: s.sequence, trafficKey: s.trafficKey });
-    const r = serverSession.acceptRecv(frame.sequence, frame.direction);
-    const out = openEncryptedFrame({ frame, trafficKey: r.trafficKey });
+    const out = serverSession.receive(frame.sequence, frame.direction, (trafficKey) => openEncryptedFrame({ frame, trafficKey }));
     assert.deepStrictEqual(out.cmb.categories, cmb.categories);
   });
 
@@ -143,6 +150,6 @@ describe('MMP v2.0 §5.2 authenticated handshake flow', () => {
 
   it('a peer without cmb-encrypted-v2 negotiates no v2 (legacy posture decided upstream)', () => {
     const { clientFinishResult } = handshake(pair(EXTS, ['admission-attestation-v1']));
-    assert.deepStrictEqual(clientFinishResult.selected, []);
+    assert.deepStrictEqual(clientFinishResult.selected, ['admission-attestation-v1'], 'the intersection, without cmb-encrypted-v2');
   });
 });
diff --git a/tests/mmp-v2-session.test.js b/tests/mmp-v2-session.test.js
index 5ca0f1fe..313a3968 100644
--- a/tests/mmp-v2-session.test.js
+++ b/tests/mmp-v2-session.test.js
@@ -48,7 +48,7 @@ describe('MMP v2.0 session discipline', () => {
   it('fails closed: no send or receive before confirmation', () => {
     const { client, server } = pair();
     assert.throws(() => client.nextSend(), /unconfirmed/);
-    assert.throws(() => server.acceptRecv('0', C2S), /unconfirmed/);
+    assert.throws(() => server.receive('0', C2S, () => null), /unconfirmed/);
   });
 
   it('a tampered peer confirmation is rejected and leaves the session closed', () => {
@@ -64,15 +64,13 @@ describe('MMP v2.0 session discipline', () => {
     const s = client.nextSend();
     assert.strictEqual(s.direction, C2S);
     const frame = buildEncryptedFrame({ cmb, sessionId: client.sessionId, direction: s.direction, sequence: s.sequence, trafficKey: s.trafficKey });
-    const r = server.acceptRecv(frame.sequence, frame.direction);
-    const out = openEncryptedFrame({ frame, trafficKey: r.trafficKey });
+    const out = server.receive(frame.sequence, frame.direction, (trafficKey) => openEncryptedFrame({ frame, trafficKey }));
     assert.deepStrictEqual(out.cmb.categories, cmb.categories);
     // server → client
     const s2 = server.nextSend();
     assert.strictEqual(s2.direction, S2C);
     const frame2 = buildEncryptedFrame({ cmb, sessionId: server.sessionId, direction: s2.direction, sequence: s2.sequence, trafficKey: s2.trafficKey });
-    const r2 = client.acceptRecv(frame2.sequence, frame2.direction);
-    assert.ok(openEncryptedFrame({ frame: frame2, trafficKey: r2.trafficKey }));
+    assert.ok(client.receive(frame2.sequence, frame2.direction, (trafficKey) => openEncryptedFrame({ frame: frame2, trafficKey })));
   });
 
   it('sequence starts at 0 and advances by exactly one per direction', () => {
@@ -84,18 +82,37 @@ describe('MMP v2.0 session discipline', () => {
     assert.strictEqual(server.nextSend().sequence, '0');
   });
 
-  it('refuses replay, rollback, and gaps on the receive side', () => {
+  it('refuses replay, rollback, and gaps on the receive side (authentic frames out of order)', () => {
     const { client, server } = confirm(pair());
-    assert.ok(server.acceptRecv('0', C2S));            // exact-next
-    assert.throws(() => server.acceptRecv('0', C2S), /replay|rollback/); // replay of 0
-    assert.throws(() => server.acceptRecv('2', C2S), /gap/);             // skip 1
-    assert.ok(server.acceptRecv('1', C2S));            // 1 is now exact-next
-    assert.throws(() => server.acceptRecv('0', C2S), /replay|rollback/); // rollback below 2
+    const f = [0, 1, 2].map(() => { const s = client.nextSend(); return buildEncryptedFrame({ cmb, sessionId: client.sessionId, direction: s.direction, sequence: s.sequence, trafficKey: s.trafficKey }); });
+    const take = (frame) => server.receive(frame.sequence, frame.direction, (trafficKey) => openEncryptedFrame({ frame, trafficKey }));
+    assert.ok(take(f[0]));                                      // exact-next
+    assert.throws(() => take(f[0]), (e) => e.name === 'SessionDesyncError' && e.kind === 'replay');
+    assert.throws(() => take(f[2]), (e) => e.name === 'SessionDesyncError' && e.kind === 'gap');
+    assert.ok(take(f[1]));                                      // 1 is now exact-next
+    assert.throws(() => take(f[0]), /replay|rollback/);         // rollback below 2
+    assert.strictEqual(server.nextRecv, '2');
+  });
+
+  it('a forged frame at the right sequence is refused and does NOT move the counter (design D2)', () => {
+    const { client, server } = confirm(pair());
+    const s0 = client.nextSend();
+    const genuine = buildEncryptedFrame({ cmb, sessionId: client.sessionId, direction: s0.direction, sequence: s0.sequence, trafficKey: s0.trafficKey });
+    // An injector knows the next sequence but not the key: it seals under a key of its own.
+    const forged = buildEncryptedFrame({ cmb, sessionId: client.sessionId, direction: s0.direction, sequence: '0', trafficKey: crypto.randomBytes(32) });
+    const take = (frame) => server.receive(frame.sequence, frame.direction, (trafficKey) => openEncryptedFrame({ frame, trafficKey }));
+    assert.throws(() => take(forged), (e) => e.name !== 'SessionDesyncError', 'refused as unauthentic, not as out of order');
+    assert.strictEqual(server.nextRecv, '0', 'the counter did not move');
+    assert.ok(take(genuine), 'so the genuine frame 0 still opens: the session is not desynchronised');
+    // A forged frame claiming a gap sequence cannot tear the session down either.
+    const forgedGap = buildEncryptedFrame({ cmb, sessionId: client.sessionId, direction: s0.direction, sequence: '7', trafficKey: crypto.randomBytes(32) });
+    assert.throws(() => take(forgedGap), (e) => e.name !== 'SessionDesyncError');
+    assert.strictEqual(server.nextRecv, '1');
   });
 
   it('refuses a frame whose declared direction is not this session\'s receive direction', () => {
     const { client, server } = confirm(pair());
     // The server receives c2s; a frame claiming s2c must be refused before any key use.
-    assert.throws(() => server.acceptRecv('0', S2C), /receive direction/);
+    assert.throws(() => server.receive('0', S2C, () => assert.fail('no key is used for the wrong direction')), /receive direction/);
   });
 });
diff --git a/tests/mmp-v2-two-node.test.js b/tests/mmp-v2-two-node.test.js
index 41a8e3cd..769359f5 100644
--- a/tests/mmp-v2-two-node.test.js
+++ b/tests/mmp-v2-two-node.test.js
@@ -54,8 +54,7 @@ describe('MMP v2.0 two-node sealed round-trip', () => {
     assert.ok(!JSON.stringify(frame.metadata).includes('seal me end to end'), 'category text is not in the clear frame');
     assert.ok(!frame.sealed.includes('seal me end to end'));
 
-    const r = server.acceptRecv(frame.sequence, frame.direction);
-    const out = openEncryptedFrame({ frame, trafficKey: r.trafficKey });
+    const out = server.receive(frame.sequence, frame.direction, (trafficKey) => openEncryptedFrame({ frame, trafficKey }));
     assert.strictEqual(out.applicationBytes, null, 'app-null record carries no applicationData');
     assert.deepStrictEqual(out.cmb.categories, cmb.categories);
     assert.deepStrictEqual(out.cmb.metadata, cmb.metadata);
@@ -70,15 +69,17 @@ describe('MMP v2.0 two-node sealed round-trip', () => {
     const cmb = signedRecord(priv);
     const { client, server } = establishedPair();
 
+    const frames = [];
     for (let i = 0; i < 3; i++) {
       const s = client.nextSend();
       assert.strictEqual(s.sequence, String(i));
       const frame = buildEncryptedFrame({ cmb, sessionId: client.sessionId, direction: s.direction, sequence: s.sequence, trafficKey: s.trafficKey });
-      const r = server.acceptRecv(frame.sequence, frame.direction);
-      assert.ok(openEncryptedFrame({ frame, trafficKey: r.trafficKey }));
+      frames.push(frame);
+      assert.ok(server.receive(frame.sequence, frame.direction, (trafficKey) => openEncryptedFrame({ frame, trafficKey })));
     }
     // A relay replays frame 0; the server has already consumed through 2.
-    assert.throws(() => server.acceptRecv('0', client._sendDirection || 'client-to-server'), /replay|rollback/);
+    const f0 = frames[0];
+    assert.throws(() => server.receive(f0.sequence, f0.direction, (trafficKey) => openEncryptedFrame({ frame: f0, trafficKey })), /replay|rollback/);
   });
 
   it('a router that flips one sealed byte cannot pass the frame', () => {
@@ -88,8 +89,8 @@ describe('MMP v2.0 two-node sealed round-trip', () => {
     const s = client.nextSend();
     const frame = buildEncryptedFrame({ cmb, sessionId: client.sessionId, direction: s.direction, sequence: s.sequence, trafficKey: s.trafficKey });
     const b = Buffer.from(frame.sealed, 'base64url'); b[10] ^= 0x02; frame.sealed = b.toString('base64url').replace(/=+$/, '');
-    const r = server.acceptRecv(frame.sequence, frame.direction);
-    assert.throws(() => openEncryptedFrame({ frame, trafficKey: r.trafficKey }));
+    assert.throws(() => server.receive(frame.sequence, frame.direction, (trafficKey) => openEncryptedFrame({ frame, trafficKey })));
+    assert.strictEqual(server.nextRecv, '0', 'and the refused frame moved nothing');
   });
 
   it('a router that rewrites the clear room cannot pass the frame (AAD binds it)', () => {
@@ -99,7 +100,7 @@ describe('MMP v2.0 two-node sealed round-trip', () => {
     const s = client.nextSend();
     const frame = buildEncryptedFrame({ cmb, sessionId: client.sessionId, direction: s.direction, sequence: s.sequence, trafficKey: s.trafficKey });
     frame.metadata = { ...frame.metadata, room: 'attacker-room' };
-    const r = server.acceptRecv(frame.sequence, frame.direction);
-    assert.throws(() => openEncryptedFrame({ frame, trafficKey: r.trafficKey }));
+    assert.throws(() => server.receive(frame.sequence, frame.direction, (trafficKey) => openEncryptedFrame({ frame, trafficKey })));
+    assert.strictEqual(server.nextRecv, '0', 'and the refused frame moved nothing');
   });
 });
diff --git a/tests/neural-after-decision.test.js b/tests/neural-after-decision.test.js
index 84c3c2cb..e6fdc080 100644
--- a/tests/neural-after-decision.test.js
+++ b/tests/neural-after-decision.test.js
@@ -39,7 +39,12 @@ async function withNode(fn) {
   }
 }
 
-const frame = (text) => { const cmb = createCMB({ categories: cat7(text), createdBy: 'peerA' }); return { type: 'cmb', timestamp: Date.now(), content: text, cmb }; };
+// A signed v2.0 record from peerA, delivered on peerA's confirmed session (Core Secure, 0.14).
+const { identity, signedRecord, admitAs } = require('./_core-secure');
+const PEER = identity('peerA');
+void createCMB;
+const frame = (text) => ({ type: 'cmb', timestamp: Date.now(), content: text, cmb: signedRecord(PEER, { categories: cat7(text) }) });
+const share = (node, f) => node._frameHandler._handleMemoryShare(PEER.nodeId, PEER.name, f, admitAs(node, PEER));
 
 describe('the neural path after its decision', () => {
   it('a tether that cannot be evaluated leaves the record stored unverified, decided and attested once', async () => {
@@ -48,7 +53,7 @@ describe('the neural path after its decision', () => {
       const broken = new Proxy({}, { get() { throw new Error('encoder fault'); }, ownKeys() { throw new Error('encoder fault'); } });
       node._frameHandler._prepareLineageTether = () => ({ key: 'anchor-key', categories: broken });
       const f = frame('a remix whose tether the model cannot encode');
-      await node._frameHandler._handleMemoryShare('peerA', 'peerA', f);
+      await share(node, f);
       const key = f.cmb.metadata.key;
       assert.strictEqual(seen.heuristic, 0, 'the heuristic gate did not run on the frame as well');
       assert.strictEqual(seen.decisions, 1, 'one decision');
@@ -64,7 +69,7 @@ describe('the neural path after its decision', () => {
     await withNode(async (node, seen) => {
       node._store.receiveFromPeer = () => { throw new Error('disk full'); };
       const f = frame('an admitted record the store cannot write');
-      await node._frameHandler._handleMemoryShare('peerA', 'peerA', f);
+      await share(node, f);
       assert.strictEqual(seen.heuristic, 0, 'not gated again');
       assert.strictEqual(seen.decisions, 1);
       assert.strictEqual(node._attestations.byCmb(f.cmb.metadata.key).length, 1, 'attested once');
@@ -75,7 +80,7 @@ describe('the neural path after its decision', () => {
   it("the evaluator's own failure still falls back to the heuristic gate", async () => {
     await withNode(async (node, seen) => {
       node._svafEvaluator = { evaluate: async () => { throw new Error('model not loaded'); } };
-      await node._frameHandler._handleMemoryShare('peerA', 'peerA', frame('a record the neural evaluator cannot judge'));
+      await share(node, frame('a record the neural evaluator cannot judge'));
       assert.strictEqual(seen.heuristic, 1);
       assert.ok(seen.logs.some((l) => /SVAF neural error: model not loaded — falling back to heuristic/.test(l)));
     });
diff --git a/tests/node.test.js b/tests/node.test.js
index dbdd6232..fa69df49 100644
--- a/tests/node.test.js
+++ b/tests/node.test.js
@@ -389,86 +389,53 @@ describe('SymNode', () => {
     fs.rmSync(nodeDir(name), { recursive: true, force: true });
   });
 
-  it('should support multi-transport per peer (MMP Section 4.6)', async () => {
-    const name = `test-multi-transport-${Date.now()}`;
-    const node = new SymNode({ name, silent: true, discovery: new NullDiscovery() });
-    await node.start();
-
-    const events = [];
-    node.on('peer-joined', (e) => events.push({ type: 'joined', ...e }));
-    node.on('peer-left', (e) => events.push({ type: 'left', ...e }));
-
-    // Mock transports with close event support
-    function mockTransport() {
-      const listeners = {};
-      return {
-        on: (event, fn) => { listeners[event] = fn; },
-        send: () => {},
-        close: () => { if (listeners.close) listeners.close(); },
-        _triggerClose: () => { if (listeners.close) listeners.close(); },
-      };
+  it('should support multi-transport per peer (MMP Section 4.6): one proven peer, two sessions', async () => {
+    const { connectNodes, until } = require('./_core-secure');
+    const a = new SymNode({ name: `test-multi-a-${Date.now()}`, silent: true, discovery: new NullDiscovery() });
+    const b = new SymNode({ name: `test-multi-b-${Date.now()}`, silent: true, discovery: new NullDiscovery() });
+    await a.start(); await b.start();
+    try {
+      const events = [];
+      a.on('peer-joined', (e) => events.push({ type: 'joined', ...e }));
+      a.on('peer-left', (e) => events.push({ type: 'left', ...e }));
+      const relayPipe = await connectNodes(a, b, { kind: 'relay' });
+      const peer = a._peers.get(b.nodeId);
+      assert.ok(peer, 'peer should exist');
+      assert.strictEqual(peer.transports.size, 1, 'should have 1 session');
+      const lanPipe = await connectNodes(a, b, { kind: 'bonjour' });
+      await until(() => peer.transports.size === 2);
+      assert.strictEqual(a._peers.get(b.nodeId), peer, 'the same peer: a second transport is a secondary path');
+      assert.strictEqual(peer.transports.size, 2, 'should have 2 sessions');
+      assert.strictEqual(a._bestTransport(peer), peer.transports.get('bonjour'), 'LAN should be preferred');
+      // Close the relay path — the peer stays (the LAN session is still live).
+      relayPipe.tc.close();
+      await until(() => peer.transports.size === 1);
+      assert.ok(a._peers.has(b.nodeId), 'peer should still exist after the relay session closes');
+      assert.strictEqual(events.filter((e) => e.type === 'left').length, 0, 'should NOT emit peer-left');
+      // Close the LAN path — now the peer is gone.
+      lanPipe.tc.close();
+      await until(() => !a._peers.has(b.nodeId));
+      assert.ok(!a._peers.has(b.nodeId), 'peer should be removed after all sessions close');
+      assert.strictEqual(events.filter((e) => e.type === 'left').length, 1, 'should emit peer-left');
+    } finally {
+      await a.stop(); await b.stop();
     }
-
-    // First transport: relay
-    const relayTransport = mockTransport();
-    const peer = node._createPeer(relayTransport, 'peer-abc', 'test-peer', true, 'relay');
-    node._addPeer(peer);
-
-    assert.ok(node._peers.has('peer-abc'), 'peer should exist');
-    assert.strictEqual(peer.transports.size, 1, 'should have 1 transport');
-
-    // Second transport: bonjour (same peer, different transport type)
-    const bonjourTransport = mockTransport();
-    const peer2 = node._createPeer(bonjourTransport, 'peer-abc', 'test-peer', false, 'bonjour');
-    // _createPeer returns existing peer when peer already exists
-    assert.strictEqual(peer2, peer, 'should return existing peer');
-    assert.strictEqual(peer.transports.size, 2, 'should have 2 transports');
-
-    // Active transport should be bonjour (higher priority)
-    assert.strictEqual(node._bestTransport(peer), bonjourTransport, 'bonjour should be preferred');
-
-    // Close relay — peer should NOT be removed (bonjour still active)
-    relayTransport._triggerClose();
-    assert.ok(node._peers.has('peer-abc'), 'peer should still exist after relay close');
-    assert.strictEqual(peer.transports.size, 1, 'should have 1 transport remaining');
-    assert.strictEqual(events.filter(e => e.type === 'left').length, 0, 'should NOT emit peer-left');
-
-    // Close bonjour — peer SHOULD be removed (all transports closed)
-    bonjourTransport._triggerClose();
-    assert.ok(!node._peers.has('peer-abc'), 'peer should be removed after all transports close');
-    assert.strictEqual(events.filter(e => e.type === 'left').length, 1, 'should emit peer-left');
-
-    await node.stop();
-    fs.rmSync(nodeDir(name), { recursive: true, force: true });
   });
 
   it('should prefer LAN transport over relay (MMP Section 4.6 priority)', async () => {
-    const name = `test-transport-priority-${Date.now()}`;
-    const node = new SymNode({ name, silent: true, discovery: new NullDiscovery() });
-    await node.start();
-
-    function mockTransport() {
-      const listeners = {};
-      return {
-        on: (event, fn) => { listeners[event] = fn; },
-        send: () => {},
-        close: () => { if (listeners.close) listeners.close(); },
-      };
+    const { connectNodes } = require('./_core-secure');
+    const a = new SymNode({ name: `test-prio-a-${Date.now()}`, silent: true, discovery: new NullDiscovery() });
+    const b = new SymNode({ name: `test-prio-b-${Date.now()}`, silent: true, discovery: new NullDiscovery() });
+    await a.start(); await b.start();
+    try {
+      await connectNodes(a, b, { kind: 'relay' });
+      const peer = a._peers.get(b.nodeId);
+      assert.strictEqual(peer.transport.kind, 'relay', 'initial session is the relay one');
+      await connectNodes(a, b, { kind: 'bonjour' });
+      assert.strictEqual(a._bestTransport(peer).kind, 'bonjour', 'LAN should be preferred over relay');
+    } finally {
+      await a.stop(); await b.stop();
     }
-
-    // Connect via relay first
-    const relay = mockTransport();
-    const peer = node._createPeer(relay, 'peer-xyz', 'priority-test', true, 'relay');
-    node._addPeer(peer);
-    assert.strictEqual(peer.transport, relay, 'initial transport should be relay');
-
-    // Add bonjour — should become preferred
-    const bonjour = mockTransport();
-    node._createPeer(bonjour, 'peer-xyz', 'priority-test', false, 'bonjour');
-    assert.strictEqual(node._bestTransport(peer), bonjour, 'bonjour should be preferred over relay');
-
-    await node.stop();
-    fs.rmSync(nodeDir(name), { recursive: true, force: true });
   });
 
   after(() => {
diff --git a/tests/p6-legacy-grandfather.test.js b/tests/p6-legacy-grandfather.test.js
index 38db329d..ec2e488f 100644
--- a/tests/p6-legacy-grandfather.test.js
+++ b/tests/p6-legacy-grandfather.test.js
@@ -27,7 +27,7 @@ const crypto = require('node:crypto');
 const { SymNode } = require('../lib/node');
 const { BonjourDiscovery } = require('../lib/discovery');
 const { nodeDir } = require('../lib/config');
-const { verifyCMB, signCMB, createCMB } = require('../lib/core');
+const { verifyCMB, signCMB, createCMB, assertionIdV2_0 } = require('../lib/core');
 
 const ROOM = 'p6group';
 
@@ -112,6 +112,9 @@ test('P-6: a pre-boundary block is REFUSED — grandfathering is retired', async
     // forgery counter must not see ordinary history in it. Refused is not the same as forged.
     assert.equal(metrics.filter((m) => m.type === 'cmb-signature-rejected').length, 0,
       'a legacy block MUST NOT increment the forgery counter — refusing it is not accusing it');
+    // sym 0.14 (Core Secure): it is refused before any verification as a legacy-suite record, and
+    // counted on its own metric.
+    assert.equal(metrics.filter((m) => m.type === 'cmb-legacy-suite-refused').length, 1);
   });
 });
 
@@ -122,8 +125,10 @@ test('P-6: the OTHER arm — a genuinely bad signature is still rejected as forg
     const victimPub = victim.publicKey.export({ type: 'spki', format: 'der' }).subarray(-32).toString('base64url');
     node._identityKey = () => victimPub;
 
-    // A well-formed v2 record signed by SOMEONE ELSE — the forgery case.
-    const cmb = createCMB({ categories: LEGACY_FIELDS, createdBy: 'impostor@p6group', room: ROOM });
+    // A well-formed v2.0 record (the only suite Core Secure verifies, sym 0.14) naming the victim's
+    // nodeId as author, signed by SOMEONE ELSE — the forgery case.
+    const cmb = createCMB({ categories: LEGACY_FIELDS, createdBy: 'impostor@p6group', createdByNodeId: 'victim-node', room: ROOM, emitV2: true });
+    cmb.metadata.assertionId = assertionIdV2_0(cmb);
     const attacker = crypto.generateKeyPairSync('ed25519');
     const attackerPriv = attacker.privateKey.export({ type: 'pkcs8', format: 'der' }).subarray(-32).toString('base64url');
     signCMB(cmb, attackerPriv);
diff --git a/tests/peer-info-quiet.test.js b/tests/peer-info-quiet.test.js
index 499aaf0a..40cec72b 100644
--- a/tests/peer-info-quiet.test.js
+++ b/tests/peer-info-quiet.test.js
@@ -5,8 +5,9 @@ require('./_isolate-home'); // redirect $HOME to a temp sandbox before lib/confi
 /**
  * 0.13.16: peer-info gossip logged one line per entry and rewrote the wake-channel file on every
  * frame, and every peer re-sends its whole list on every connect, so the daemon's log reached 1 GB.
- * Only a channel that changed is set and saved, with one line per frame. (In 0.14.0 a gossiped entry
- * carries the sighting it reports, lastSeen, and is weighed by its source: see wake-channels.test.js.)
+ * Only a channel that changed is set and saved, with one line per frame. (In 0.14.0 only the entry a
+ * session's own node gives is learned — design D1 — and the relay's list is a hint: see
+ * wake-channels.test.js.)
  */
 
 const { describe, it } = require('node:test');
@@ -17,6 +18,9 @@ const { NullDiscovery } = require('../lib/discovery');
 const { nodeDir } = require('../lib/config');
 
 describe('peer-info gossip is quiet when nothing changed', () => {
+  // Core Secure (design D1): only the entry naming the session's own nodeId is learned; entries about
+  // other nodes are hints, never stored. The 0.13.16 property still holds for what is learned: a
+  // repeat logs nothing and writes nothing.
   it('a repeat of the same list logs nothing and writes nothing; a change logs one line', () => {
     const name = `pinfo-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
     const node = new SymNode({ name, silent: true, discovery: new NullDiscovery() });
@@ -25,19 +29,21 @@ describe('peer-info gossip is quiet when nothing changed', () => {
     let writes = 0;
     node._wakeManager.saveWakeChannels = () => { writes++; };
     try {
+      const seen = Date.now();
       const frame = { type: 'peer-info', peers: [
-        { nodeId: 'phone-1', name: 'unknown', wakeChannel: { platform: 'apns', token: 't1', environment: 'sandbox' }, lastSeen: Date.now() },
-        { nodeId: 'phone-2', name: 'unknown', wakeChannel: { platform: 'apns', token: 't2', environment: 'sandbox' }, lastSeen: Date.now() },
+        { nodeId: 'phone-1', name: 'unknown', wakeChannel: { platform: 'apns', token: 't1', environment: 'sandbox' }, lastSeen: seen },
+        { nodeId: 'phone-2', name: 'unknown', wakeChannel: { platform: 'apns', token: 't2', environment: 'sandbox' }, lastSeen: seen },
       ] };
-      node._frameHandler._handlePeerInfo('peer-x', 'peer-x', frame);
-      assert.deepStrictEqual(lines.filter((l) => /wake channel/.test(l)), ['Gossip from peer-x: learned 2 wake channel(s)']);
+      node._frameHandler._handlePeerInfo('phone-1', 'phone-1', frame);
+      assert.deepStrictEqual(lines.filter((l) => /[Ww]ake channel/.test(l)), ['Wake channel from phone-1: apns'], 'its own entry, said once');
       assert.strictEqual(writes, 1);
-      for (let i = 0; i < 50; i++) node._frameHandler._handlePeerInfo('peer-x', 'peer-x', frame);
-      assert.strictEqual(lines.filter((l) => /wake channel/.test(l)).length, 1, 'repeats are silent');
+      assert.strictEqual(node._peerWakeChannels.has('phone-2'), false, 'what it says about another node is not stored');
+      for (let i = 0; i < 50; i++) node._frameHandler._handlePeerInfo('phone-1', 'phone-1', frame);
+      assert.strictEqual(lines.filter((l) => /[Ww]ake channel/.test(l)).length, 1, 'repeats are silent');
       assert.strictEqual(writes, 1, 'and write nothing');
       const big = { type: 'peer-info', peers: Array.from({ length: 1000 }, (_, i) => ({ nodeId: `n${i}`, wakeChannel: { platform: 'apns', token: `x${i}` }, lastSeen: Date.now() })) };
       node._frameHandler._handlePeerInfo('peer-x', 'peer-x', big);
-      assert.strictEqual(node._peerWakeChannels.size, 2 + 256, 'one frame is read for its first 256 entries');
+      assert.strictEqual(node._peerWakeChannels.size, 1, 'a frame of 1,000 entries about others stores nothing');
     } finally { fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
   });
 });
@@ -58,37 +64,34 @@ describe('0.13.16 review follow-ups', () => {
     try {
       const now = Date.now();
       const at = (token, lastSeen) => ({ type: 'peer-info', peers: [{ nodeId: 'phone-1', wakeChannel: { platform: 'apns', token, environment: 'sandbox' }, lastSeen }] });
-      node._frameHandler._handlePeerInfo('p', 'p', at('t1', now - 1000));
-      node._frameHandler._handlePeerInfo('p', 'p', at('t2', now));   // a newer sighting from the same source
+      node._frameHandler._handlePeerInfo('phone-1', 'phone-1', at('t1', now - 1000));
+      node._frameHandler._handlePeerInfo('phone-1', 'phone-1', at('t2', now));   // the phone's own newer channel
       assert.strictEqual(node._peerWakeChannels.get('phone-1').token, 't2');
       node._frameHandler._handlePeerInfo('p', 'p', { type: 'peer-info', peers: Array.from({ length: 300 }, (_, i) => ({ nodeId: `n${i}`, wakeChannel: { platform: 'apns', token: `x${i}` }, lastSeen: now })) });
       assert.ok(lines.some((l) => /300 entries, reading the first 256/.test(l)));
+      node._frameHandler._handlePeerInfo('p', 'p', { type: 'peer-info', peers: Array.from({ length: 300 }, (_, i) => ({ nodeId: `n${i}` })) });
+      assert.strictEqual(lines.filter((l) => /300 entries/.test(l)).length, 1, 'said once a minute per peer');
     } finally { fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
   });
 
-  it('the relay\'s peer list sets, saves and logs only what changed (F3)', async () => {
+  it('the relay\'s peer list is a hint: it sets, saves and logs no wake channel (F3, Core Secure D1)', async () => {
     const list = (token) => JSON.stringify({ type: 'relay-peers', peers: [{ nodeId: 'phone-1', name: 'phone', offline: true, wakeChannel: { platform: 'apns', token, environment: 'sandbox' } }] });
     const wss = new WebSocketServer({ port: 0 });
-    wss.on('connection', (ws) => ws.on('message', () => { ws.send(list('t1')); ws.send(list('t1')); ws.send(list('t1')); ws.send(list('t2')); }));
+    let sent = 0;
+    wss.on('connection', (ws) => ws.on('message', () => { ws.send(list('t1')); ws.send(list('t1')); ws.send(list('t2')); sent += 3; }));
     const logs = [];
-    let saves = 0;
-    const map = new Map();
-    const { WakeManager } = require('../lib/core/wake');
-    const wm = new WakeManager({ wakeChannelsFile: path.join(os.tmpdir(), `wc-relay-${process.pid}.json`), peerWakeChannels: map, peerLastWake: new Map(), pendingFrames: new Map(), log: () => {} });
     let running = true;
     const rc = new RelayConnection({
-      learnWakeChannel: (id, ch, o) => wm.learnWakeChannel(id, ch, o),
       relayUrl: `ws://127.0.0.1:${wss.address().port}`, relayToken: 'x'.repeat(40), log: (l) => logs.push(l),
-      getIdentity: () => ({ nodeId: 'b'.repeat(64) }), isRunning: () => running, getPeers: () => new Map(), getMeshNode: () => null,
-      createPeer: () => { throw new Error('no peers expected'); }, addPeer: () => {}, handlePeerMessage: () => {}, onPeerLeft: () => {},
-      onAuthRefused: () => {}, nodeName: 'quiet-relay', peerWakeChannels: map, saveWakeChannels: () => { saves++; },
+      getIdentity: () => ({ nodeId: 'b'.repeat(64) }), isRunning: () => running, onAuthRefused: () => {}, nodeName: 'quiet-relay',
     });
     try {
       rc.connect();
-      for (let i = 0; i < 100 && map.get('phone-1')?.token !== 't2'; i++) await new Promise((r) => setTimeout(r, 20));
-      assert.strictEqual(map.get('phone-1').token, 't2');
-      assert.strictEqual(saves, 2, 'written once for t1 and once for t2, not for the repeats');
-      assert.strictEqual(logs.filter((l) => /wake channel/.test(l)).length, 2);
+      for (let i = 0; i < 100 && sent < 3; i++) await new Promise((r) => setTimeout(r, 20));
+      await new Promise((r) => setTimeout(r, 100));
+      assert.strictEqual(rc.state().phase, 'connected');
+      assert.strictEqual(logs.filter((l) => /wake channel/i.test(l)).length, 0, 'nothing learned, nothing said');
+      assert.ok(rc.present.has('phone-1') === false, 'an offline entry is not even a candidate');
     } finally { running = false; rc.destroy(); await new Promise((r) => wss.close(() => r())); }
   });
 
diff --git a/tests/record-bounds.test.js b/tests/record-bounds.test.js
index 433a2cd0..10737cce 100644
--- a/tests/record-bounds.test.js
+++ b/tests/record-bounds.test.js
@@ -164,28 +164,40 @@ describe('on receipt', () => {
     try { return fn(node, metrics, lines); } finally { fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
   }
 
-  it('accepts a record an earlier release minted with a category over 256 KiB (0.14.0 review C-F4)', async () => {
-    // Exactly the record 0.13.16's createCMB mints for these categories (checked against it): no
-    // text bound but the frame, signed under mmp-sig-v2. This release would not mint it.
+  // Records are minted under bounds (cmb-encoder) but none is applied on receipt beyond the frame the
+  // record arrived in: an earlier release minted larger categories and longer agent ids. Since 0.14 a
+  // received record must be a signed v2.0 record (Core Secure), so these are shaped as an
+  // implementation without the minting bound would sign them under mmp-sig-v2.0.
+  const { admitAs, identity } = require('./_core-secure');
+  function v2Record(peer, categories, createdBy, room) {
+    const cmb = { categories, metadata: {
+      key: blockKeyV2(categories), addressScheme: 'mmp-cmb-merkle-v2', signatureSuite: 'mmp-sig-v2.0',
+      createdByNodeId: peer.nodeId, createdBy, createdTimestamp: Date.now(), room, to: null, lineage: null, application: null,
+    } };
+    cmb.metadata.assertionId = assertionIdV2_0(cmb);
+    signCMB(cmb, peer.privateKey);
+    return cmb;
+  }
+
+  it('accepts a record with a category over 256 KiB, which this release would not mint (0.14.0 review C-F4)', async () => {
     const name = `bounds-bigcat-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
     const node = new SymNode({ name, silent: true, discovery: new NullDiscovery() });
     await node.start();
     try {
-      const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519', { publicKeyEncoding: { type: 'spki', format: 'der' }, privateKeyEncoding: { type: 'pkcs8', format: 'der' } });
-      node._pinPeerKey('peer-old', publicKey.slice(-32).toString('base64url'));
-      const texts = { focus: 'b'.repeat(MAX_CATEGORY_BYTES + 40 * 1024), issue: 'a large category from an older peer' };
+      const peer = identity('peer-old');
+      const session = admitAs(node, peer);
+      const texts = { focus: 'b'.repeat(MAX_CATEGORY_BYTES + 40 * 1024), issue: 'a large category from another implementation' };
       const categories = {};
       for (const f of CAT7_CATEGORIES) {
         const text = texts[f] || 'neutral';
         categories[f] = { text, meta: { key: categoryKeyV1(f, text), parents: [] } };
       }
-      const cmb = { categories, metadata: { key: blockKeyV2(categories), createdBy: 'peer-old', createdTimestamp: Date.now(), lineage: null, room: node._room, to: null } };
-      signCMB(cmb, privateKey.slice(-32).toString('base64url'));
+      const cmb = v2Record(peer, categories, 'peer-old', node._room);
       assert.throws(() => createCMB({ categories: texts, createdBy: 'peer-old' }), (e) => e.code === 'ECMBSIZE', 'this release does not mint it');
 
       const accepted = [];
       node.on('cmb-accepted', (e) => accepted.push(e));
-      await node._frameHandler.handle('peer-old', 'peer-old', { type: 'cmb', timestamp: Date.now(), cmb });
+      await node._frameHandler.handle(session, { type: 'cmb', timestamp: Date.now(), cmb });
       await settle();
       assert.strictEqual(accepted.length, 1, 'admitted');
       assert.strictEqual(accepted[0]._cmbVerified, true, 'and verified');
@@ -193,25 +205,21 @@ describe('on receipt', () => {
     } finally { await node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
   });
 
-  it('accepts a record an earlier release minted with an agent id over 64 bytes (0.14.0 review C-F4)', async () => {
-    // Shaped as 0.13.16 mints it: the two-section record, signed under mmp-sig-v2, with no bound on
-    // createdBy. Its address does not cover the author, so only the signature is redone here.
+  it('accepts a record with an agent id over 64 bytes, which this release would not mint (0.14.0 review C-F4)', async () => {
     const name = `bounds-longid-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
     const node = new SymNode({ name, silent: true, discovery: new NullDiscovery() });
     await node.start();
     try {
-      const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519', { publicKeyEncoding: { type: 'spki', format: 'der' }, privateKeyEncoding: { type: 'pkcs8', format: 'der' } });
-      const peer = { pub: publicKey.slice(-32).toString('base64url'), priv: privateKey.slice(-32).toString('base64url') };
-      node._pinPeerKey('peer-long', peer.pub);
+      const peer = identity('peer-long');
+      const session = admitAs(node, peer);
       const longId = 'claude-' + 'host-qualified-session-label-'.repeat(4); // 123 bytes
-      const cmb = createCMB({ categories: { focus: 'a record from a peer with a long agent id' }, createdBy: 'short', room: node._room });
-      cmb.metadata.createdBy = longId;
-      signCMB(cmb, peer.priv);
+      const base = createCMB({ categories: { focus: 'a record from a peer with a long agent id' }, createdBy: 'short', room: node._room });
+      const cmb = v2Record(peer, base.categories, longId, node._room);
       assert.throws(() => createCMB({ categories: { focus: 'x' }, createdBy: longId }), (e) => e.code === 'ECMBSIZE', 'this release does not mint one');
 
       const accepted = [];
       node.on('cmb-accepted', (e) => accepted.push(e));
-      await node._frameHandler.handle('peer-long', 'peer-long', { type: 'cmb', timestamp: Date.now(), cmb });
+      await node._frameHandler.handle(session, { type: 'cmb', timestamp: Date.now(), cmb });
       await settle();
       assert.strictEqual(accepted.length, 1, 'admitted');
       assert.strictEqual(accepted[0].author.name, longId);
@@ -219,23 +227,31 @@ describe('on receipt', () => {
     } finally { await node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
   });
 
-  it('counts every unsigned record and names the peer once', () => {
-    withNode((node, metrics, lines) => {
+  it('refuses and counts every unsigned record (Core Secure: §18.3.1)', () => {
+    withNode((node, metrics) => {
+      const peer = identity('old-peer');
+      const session = admitAs(node, peer);
       for (let i = 0; i < 3; i++) {
-        const cmb = createCMB({ categories: { focus: `unsigned ${i}` }, createdBy: 'old-peer' });
-        node._frameHandler.handle('peer-old', 'old-peer', { type: 'cmb', cmb, timestamp: Date.now() });
+        const cmb = createCMB({ categories: { focus: `unsigned ${i}` }, createdBy: 'old-peer', emitV2: true, createdByNodeId: peer.nodeId, room: node._room });
+        cmb.metadata.assertionId = assertionIdV2_0(cmb);
+        node._frameHandler.handle(session, { type: 'cmb', cmb, timestamp: Date.now() });
       }
-      assert.strictEqual(metrics.filter((m) => m.type === 'cmb-unsigned-received').length, 3);
-      assert.strictEqual(lines.filter((l) => /UNSIGNED CMB from old-peer/.test(l)).length, 1);
+      assert.strictEqual(metrics.filter((m) => m.type === 'cmb-signature-rejected' && m.reason === 'unsigned').length, 3);
+      assert.strictEqual(node._store.allEntries().length, 0, 'none stored');
     });
   });
 
-  it('a signed record is not counted as unsigned', () => {
+  it('a signed record is not refused as unsigned', () => {
     withNode((node, metrics) => {
-      const cmb = createCMB({ categories: { focus: 'signed' }, createdBy: node.name });
-      signCMB(cmb, node._identity.privateKey);
-      node._frameHandler.handle('peer-x', 'peer-x', { type: 'cmb', cmb, timestamp: Date.now() });
-      assert.strictEqual(metrics.filter((m) => m.type === 'cmb-unsigned-received').length, 0);
+      const self = { nodeId: node.nodeId, name: node.name, publicKey: node._identity.publicKey, privateKey: node._identity.privateKey };
+      const peer = identity('peer-x');
+      const session = admitAs(node, peer);
+      const cmb = createCMB({ categories: { focus: 'signed' }, createdBy: peer.name, emitV2: true, createdByNodeId: peer.nodeId, room: node._room });
+      cmb.metadata.assertionId = assertionIdV2_0(cmb);
+      signCMB(cmb, peer.privateKey);
+      node._frameHandler.handle(session, { type: 'cmb', cmb, timestamp: Date.now() });
+      assert.strictEqual(metrics.filter((m) => m.type === 'cmb-signature-rejected').length, 0);
+      void self;
     });
   });
 });
diff --git a/tests/relay-clear-refusal.test.js b/tests/relay-clear-refusal.test.js
index 21dc2306..77b6f128 100644
--- a/tests/relay-clear-refusal.test.js
+++ b/tests/relay-clear-refusal.test.js
@@ -1,63 +1,46 @@
 'use strict';
 require('./_isolate-home');
 /**
- * NEVER IN THE CLEAR THROUGH THE RELAY. A peer reached only over the relay whose handshake
- * carried no E2E key used to receive CMB categories in plaintext, through a server that promises
- * it cannot read them. The sender now refuses: nothing is sent to that peer over the relay, the
- * refusal is logged once, and peers() says so. A LAN peer without a key still receives (the frame
- * never leaves the local network), and a relay peer WITH a key receives ciphertext.
+ * NEVER IN THE CLEAR, ON ANY TRANSPORT (Core Secure, sym 0.14). Until 0.14 a relay peer whose
+ * handshake carried no E2E key was refused records (0.13.7), while a LAN peer without one still got
+ * them in plaintext. A peer is now a confirmed §5.2 session, and a session seals every record
+ * (cmb-encrypted) and every other frame (control-encrypted): there is no keyless peer, and the LAN
+ * exception is gone. Checked on the wire of a LAN session and a relay session.
  */
 const { describe, it } = require('node:test');
 const assert = require('node:assert');
 const fs = require('fs');
-const crypto = require('crypto');
 const { SymNode } = require('../lib/node');
 const { NullDiscovery } = require('../lib/discovery');
-const { nodeDir } = require('../lib/config');
+const { nodeDirById } = require('../lib/config');
+const { connectNodes, until } = require('./_core-secure');
 
-async function withNode(fn) {
-  const name = `clear-refusal-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
-  const logs = [];
-  const node = new SymNode({ name, silent: true, discovery: new NullDiscovery() });
-  node._log = (m) => logs.push(String(m));
-  await node.start();
-  try { return await fn(node, logs); } finally { await node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
-}
-function plant(node, peerId, source, name) {
-  const sent = [];
-  const transport = { send: (f) => sent.push(f), close: () => {} };
-  const transports = new Map([[source, transport]]);
-  node._peers.set(peerId, { peerId, name, transport, transports, source, lastSeen: Date.now() });
-  return sent;
-}
+const SEALED_OR_HANDSHAKE = new Set(['client-hello', 'server-hello', 'client-finish', 'cmb-encrypted', 'control-encrypted', 'ping', 'pong']);
 
-describe('never in the clear through the relay', () => {
-  it('a relay-only peer with no key gets nothing; a LAN peer without a key still gets the frame; a keyed relay peer gets ciphertext', async () => {
-    await withNode(async (node, logs) => {
-      const relayNoKey = plant(node, 'r'.repeat(32), 'relay', 'stranger-old-engine');
-      const lanNoKey = plant(node, 'l'.repeat(32), 'bonjour', 'lan-old-engine');
-      const relayKeyed = plant(node, 'k'.repeat(32), 'relay', 'relay-current');
-      node._peerSharedSecrets.set('k'.repeat(32), crypto.randomBytes(32));
-
-      node.remember({ focus: 'the content the relay must never see' });
-
-      assert.strictEqual(relayNoKey.filter((f) => f.type === 'cmb').length, 0, 'relay peer without a key must receive no CMB');
-      assert.strictEqual(lanNoKey.filter((f) => f.type === 'cmb').length, 1, 'LAN peer without a key still receives (never leaves the LAN)');
-      const keyed = relayKeyed.filter((f) => f.type === 'cmb');
-      assert.strictEqual(keyed.length, 1);
-      assert.strictEqual(typeof keyed[0].cmb.categories, 'string', 'relay peer with a key receives ciphertext, not an object');
-      assert.ok(keyed[0].cmb._e2e && keyed[0].cmb._e2e.nonce, 'ciphertext carries its nonce');
-
-      // Said once, with the peer named, and visible in peers().
-      const refusals = logs.filter((m) => m.includes('Refused to send in the clear through the relay'));
-      assert.strictEqual(refusals.length, 1);
-      assert.ok(refusals[0].includes('stranger-old-engine'));
-      node.remember({ focus: 'a second share' });
-      assert.strictEqual(logs.filter((m) => m.includes('Refused to send in the clear')).length, 1, 'logged once per peer, not per frame');
-      const byName = Object.fromEntries(node.peers().map((p) => [p.name, p]));
-      assert.deepStrictEqual([byName['stranger-old-engine'].e2e, byName['stranger-old-engine'].clearRefused], [false, true]);
-      assert.deepStrictEqual([byName['relay-current'].e2e, byName['relay-current'].clearRefused], [true, false]);
-      assert.deepStrictEqual([byName['lan-old-engine'].e2e, byName['lan-old-engine'].clearRefused], [false, false]);
+describe('never in the clear, on any transport', () => {
+  for (const kind of ['bonjour', 'relay']) {
+    it(`a ${kind} session carries no plaintext record and no category text`, async () => {
+      const a = new SymNode({ name: `clear-a-${kind}-${Date.now()}`, silent: true, discovery: new NullDiscovery() });
+      const b = new SymNode({ name: `clear-b-${kind}-${Date.now()}`, silent: true, discovery: new NullDiscovery() });
+      const wire = [];
+      await a.start(); await b.start();
+      try {
+        await connectNodes(a, b, { kind, tap: (f) => wire.push(f) });
+        const heard = [];
+        b.on('verified-record', (e) => heard.push(e));
+        a.remember({ focus: 'the content no transport may carry in the clear' });
+        a.broadcastMood('a mood is content too');
+        await until(() => heard.length > 0);
+        assert.strictEqual(heard.length, 1, 'the record arrived');
+        assert.deepStrictEqual(wire.filter((f) => !SEALED_OR_HANDSHAKE.has(f.type)).map((f) => f.type), [], 'every frame after the handshake was sealed');
+        const text = JSON.stringify(wire);
+        assert.ok(!text.includes('the content no transport may carry'), 'no category text on the wire');
+        assert.ok(!text.includes('a mood is content too'), 'no mood text on the wire');
+        assert.strictEqual(a.peers().find((p) => p.peerId === b.nodeId).e2e, true);
+      } finally {
+        await a.stop(); await b.stop();
+        for (const n of [a, b]) fs.rmSync(nodeDirById(n.nodeId), { recursive: true, force: true });
+      }
     });
-  });
+  }
 });
diff --git a/tests/relay-state.test.js b/tests/relay-state.test.js
index 79ac5c2d..150b4a0a 100644
--- a/tests/relay-state.test.js
+++ b/tests/relay-state.test.js
@@ -166,3 +166,46 @@ test('destroy() returns the state to idle, never leaves a stale connected/refuse
     assert.equal(c.rc.state().nextRetryAt, null);
   } finally { c.stop(); await relay.close(); }
 });
+
+// MMP §4.4.7 / §4.4.9: 4006 (the existing holder is the legitimate one) is a hard stop like 4004;
+// 4007 (draft spec PR meshcognition-website#20: the relay binds this nodeId to a different key) is an
+// identity conflict and stops the same way. Neither is retried; each is said once and kept in state().
+for (const [code, phase, words] of [[4006, 'duplicate-rejected', /\(4006\).*legitimate one\. Not reconnecting/], [4007, 'key-conflict', /DIFFERENT key \(4007\).*Not reconnecting/]]) {
+  test(`${code}: awaitOutcome resolves with phase ${phase}; no reconnect; said once; kept in state().stopped`, async () => {
+    const relay = fakeRelay((ws) => ws.close(code, code === 4007 ? 'nodeId bound to another key' : 'Duplicate rejected'));
+    const told = [];
+    const c = client(relay.url, { onIdentityCollision: (info) => told.push(info) });
+    try {
+      c.rc.connect();
+      const s = await c.rc.awaitOutcome(5000);
+      assert.equal(s.phase, phase);
+      assert.equal(s.nextRetryAt, null, 'nothing scheduled');
+      assert.equal(s.stopped.code, code);
+      assert.match(c.rc.describe(), words);
+      await wait(1500); // past the first backoff (1 s)
+      assert.equal(relay.state.attempts, 1, 'no second knock');
+      assert.equal(told.length, 1, 'the host is told once');
+      assert.equal(told[0].code, code);
+      assert.equal(c.logs.filter((l) => l.startsWith('FATAL')).length, 1, 'said once, loudly');
+      c.rc.connect();
+      await wait(200);
+      assert.equal(relay.state.attempts, 1, 'a later connect() does not dial either');
+      c.rc.destroy();
+      assert.equal(c.rc.state().phase, phase, 'destroy() does not hide the stop');
+    } finally { c.stop(); await relay.close(); }
+  });
+}
+
+test('a socket destroy() let go never schedules a reconnect when its close arrives', async () => {
+  const relay = fakeRelay((ws) => ws.send(JSON.stringify({ type: 'relay-peers', peers: [] })));
+  const c = client(relay.url);
+  try {
+    c.rc.connect();
+    await c.rc.awaitOutcome(5000);
+    c.rc.destroy();   // the node object may start again later, so isRunning() can still be true here
+    await wait(300);  // the close event arrives
+    assert.equal(c.rc.state().nextRetryAt, null);
+    assert.equal(c.rc._relayReconnectTimer, null, 'nothing scheduled');
+    assert.equal(c.rc.state().phase, 'idle');
+  } finally { c.stop(); await relay.close(); }
+});
diff --git a/tests/remember-payload.test.js b/tests/remember-payload.test.js
index d5c5e00e..a693bb19 100644
--- a/tests/remember-payload.test.js
+++ b/tests/remember-payload.test.js
@@ -63,10 +63,11 @@ describe('remember({payload}) — opaque payload riding CMBs alongside CAT7', ()
     });
   });
 
-  it('payload rides the wire frame to connected peers', async () => {
+  it('payload rides the record to connected peers as its signed application section (§8.8.3)', async () => {
+    const { admitAs, identity } = require('./_core-secure');
     await withNode('payload-wire', async (node) => {
-      const tA = capturingTransport();
-      node._addPeer(node._createPeer(tA, 'peer-AAAAAAAA', 'peer-a', false, 'bonjour'));
+      const peer = identity('peer-a');
+      const session = admitAs(node, peer);
 
       node.remember({
         focus: 'llm-request:test-r2',
@@ -77,16 +78,19 @@ describe('remember({payload}) — opaque payload riding CMBs alongside CAT7', ()
         perspective: 'test-sender',
         mood: { text: 'procedural', valence: 0, arousal: 0 },
       }, {
-        to: 'peer-AAAAAAAA',
+        to: peer.nodeId,
         payload: { request_id: 'r2', user_message: 'check the wire' },
       });
 
-      const cmbFrames = tA.frames.filter(f => f.type === 'cmb');
-      assert.strictEqual(cmbFrames.length, 1, 'peer should receive one CMB frame');
-      assert.deepStrictEqual(cmbFrames[0].cmb.payload, {
+      const cmbFrames = session.sent.filter(f => f.type === 'cmb');
+      assert.strictEqual(cmbFrames.length, 1, 'peer should be sent one record (the session seals it)');
+      const app = cmbFrames[0].cmb.metadata.application;
+      assert.strictEqual(app.mediaType, 'application/json');
+      assert.deepStrictEqual(JSON.parse(Buffer.from(app.data, 'base64url').toString('utf8')), {
         request_id: 'r2',
         user_message: 'check the wire',
-      }, 'wire frame should carry the payload through');
+      }, 'the signed application section carries the payload');
+      assert.strictEqual(cmbFrames[0].cmb.metadata.signatureSuite, 'mmp-sig-v2.0');
     });
   });
 
diff --git a/tests/remember-targeted.test.js b/tests/remember-targeted.test.js
index 87071dc0..67ed02ec 100644
--- a/tests/remember-targeted.test.js
+++ b/tests/remember-targeted.test.js
@@ -4,6 +4,7 @@ require('./_isolate-home'); // redirect $HOME to a temp sandbox before lib/confi
 
 const { describe, it } = require('node:test');
 const assert = require('node:assert');
+const { plantSession } = require('./_core-secure');
 const fs = require('fs');
 const { SymNode } = require('../lib/node');
 const { NullDiscovery } = require('../lib/discovery');
@@ -41,9 +42,9 @@ describe('remember({to}) — MMP §4.4.4 targeted CMB send', () => {
       const tA = capturingTransport();
       const tB = capturingTransport();
       const tC = capturingTransport();
-      node._addPeer(node._createPeer(tA, 'peer-AAAAAAAA', 'peer-a', false, 'bonjour'));
-      node._addPeer(node._createPeer(tB, 'peer-BBBBBBBB', 'peer-b', false, 'bonjour'));
-      node._addPeer(node._createPeer(tC, 'peer-CCCCCCCC', 'peer-c', false, 'bonjour'));
+      plantSession(node, tA, 'peer-AAAAAAAA', 'peer-a', 'bonjour');
+      plantSession(node, tB, 'peer-BBBBBBBB', 'peer-b', 'bonjour');
+      plantSession(node, tC, 'peer-CCCCCCCC', 'peer-c', 'bonjour');
 
       const entry = node.remember({
         focus: 'broadcast fan-out regression check',
@@ -71,9 +72,9 @@ describe('remember({to}) — MMP §4.4.4 targeted CMB send', () => {
       const tA = capturingTransport();
       const tB = capturingTransport();
       const tC = capturingTransport();
-      node._addPeer(node._createPeer(tA, 'peer-AAAAAAAA', 'peer-a', false, 'bonjour'));
-      node._addPeer(node._createPeer(tB, 'peer-BBBBBBBB', 'peer-b', false, 'bonjour'));
-      node._addPeer(node._createPeer(tC, 'peer-CCCCCCCC', 'peer-c', false, 'bonjour'));
+      plantSession(node, tA, 'peer-AAAAAAAA', 'peer-a', 'bonjour');
+      plantSession(node, tB, 'peer-BBBBBBBB', 'peer-b', 'bonjour');
+      plantSession(node, tC, 'peer-CCCCCCCC', 'peer-c', 'bonjour');
 
       const entry = node.remember({
         focus: 'targeted send to peer B',
@@ -97,7 +98,7 @@ describe('remember({to}) — MMP §4.4.4 targeted CMB send', () => {
   it('still writes locally when opts.to names a disconnected peer', async () => {
     await withNode('targeted-disconnected', async (node) => {
       const tA = capturingTransport();
-      node._addPeer(node._createPeer(tA, 'peer-AAAAAAAA', 'peer-a', false, 'bonjour'));
+      plantSession(node, tA, 'peer-AAAAAAAA', 'peer-a', 'bonjour');
 
       const entry = node.remember({
         focus: 'targeted send to absent peer',
@@ -128,7 +129,7 @@ describe('remember({to}) — MMP §4.4.4 targeted CMB send', () => {
 
   it('peers() exposes full peerId alongside truncated id', async () => {
     await withNode('peers-peerid', async (node) => {
-      node._addPeer(node._createPeer(capturingTransport(), 'peer-AAAAAAAA-bcd-1234', 'peer-a', false, 'bonjour'));
+      plantSession(node, capturingTransport(), 'peer-AAAAAAAA-bcd-1234', 'peer-a', 'bonjour');
       const list = node.peers();
       assert.strictEqual(list.length, 1);
       assert.strictEqual(list[0].id, 'peer-AAA', 'id is the truncated display form');
diff --git a/tests/role-grant-rooted.test.js b/tests/role-grant-rooted.test.js
index 5815d422..6f89e1cf 100644
--- a/tests/role-grant-rooted.test.js
+++ b/tests/role-grant-rooted.test.js
@@ -23,6 +23,7 @@ const { SymNode } = require('../lib/node');
 const { NullDiscovery } = require('../lib/discovery');
 const { nodeDir, loadOrCreateIdentity } = require('../lib/config');
 const { signGrant } = require('../lib/core');
+const { admitAs, deliver } = require('./_core-secure');
 
 function kp(nodeId) {
   const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519');
@@ -32,8 +33,10 @@ function kp(nodeId) {
     pub: publicKey.export({ format: 'der', type: 'spki' }).subarray(12).toString('base64url'),
   };
 }
+// Since 0.14 every role-grant names the key it confers authority on (design D3): the fixtures carry
+// granteeKey, so each record exercises the check the 0.13.17 test meant it to.
 const grant = (type, grantee, role, grantor, at, extra = {}) =>
-  signGrant({ type, grantee: grantee.nodeId, role, grantedBy: grantor.nodeId, grantedAt: at, ...extra }, grantor.priv);
+  signGrant({ type, grantee: grantee.nodeId, role, grantedBy: grantor.nodeId, grantedAt: at, ...(type === 'role-grant' ? { granteeKey: grantee.pub } : {}), ...extra }, grantor.priv);
 
 const uniq = (base) => `${base}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
 const grantsFile = (name) => path.join(nodeDir(name), 'role-grants', 'role-grants.jsonl');
@@ -45,9 +48,10 @@ function boot(name, founder, extra = {}) {
     ...extra,
   });
 }
-// A peer connects: its handshake pins its key at first use, which is what a self-signed grant verifies against.
+// A peer connects: its session proves its key (design D1/D3), the strongest binding a self-signed
+// grant could ever be checked against. Frames then reach the node through the one guarded dispatch.
 function handshake(node, peer) {
-  node._frameHandler.handle(peer.nodeId, peer.nodeId, { type: 'handshake', nodeId: peer.nodeId, name: peer.nodeId, publicKey: peer.pub });
+  return admitAs(node, { nodeId: peer.nodeId, name: peer.nodeId, publicKey: peer.pub });
 }
 
 describe('a role-grant that is not rooted at the anchor is not stored (F3)', () => {
@@ -60,9 +64,9 @@ describe('a role-grant that is not rooted at the anchor is not stored (F3)', ()
       try {
         const relayed = [];
         node._gossipToRoster = (frame) => relayed.push(frame);
-        handshake(node, evil);
+        const session = handshake(node, evil);
         const self = grant('role-grant', evil, 'anchor', evil, Date.now());
-        node._frameHandler.handle(evil.nodeId, 'evil', { type: 'role-grant', grant: self });
+        deliver(node, session, { type: 'role-grant', grant: self });
         assert.strictEqual(node._roleGrants.has(self.sig), false, 'the unrooted grant is not held');
         assert.strictEqual(fs.existsSync(grantsFile(name)), false, 'and nothing was written');
         assert.deepStrictEqual(relayed, [], 'and nothing was relayed');
@@ -81,9 +85,9 @@ describe('a role-grant that is not rooted at the anchor is not stored (F3)', ()
     try {
       const relayed = [];
       node._gossipToRoster = (frame, except) => relayed.push({ frame, except });
-      handshake(node, relayer);
+      const session = handshake(node, relayer);
       const g = grant('role-grant', V, 'validator', founder, Date.now() - 1000, { granteeKey: V.pub });
-      node._frameHandler.handle(relayer.nodeId, 'relayer', { type: 'role-grant', grant: g });
+      deliver(node, session, { type: 'role-grant', grant: g });
       assert.strictEqual(node._roleGrants.has(g.sig), true);
       assert.strictEqual(relayed.length, 1, 'relayed once');
       assert.strictEqual(relayed[0].except, relayer.nodeId, 'not back to the peer it came from');
@@ -101,11 +105,12 @@ describe('a role-grant that is not rooted at the anchor is not stored (F3)', ()
     const self = { nodeId: id.nodeId, pub: id.publicKey };
     let node = boot(name, self);
     try {
-      const peer = 'node-peer-xyz';
-      assert.ok(node.grantRole(peer, 'validator'));
+      const peer = kp('node-peer-xyz');
+      node._roster.bind(peer.nodeId, peer.pub, 'proven'); // a grant names a proven key (design D3)
+      assert.ok(node.grantRole(peer.nodeId, 'validator'));
       node.stop();
       node = boot(name, self);
-      assert.strictEqual(node.resolveRole(peer), 'validator');
+      assert.strictEqual(node.resolveRole(peer.nodeId), 'validator');
     } finally { node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
   });
 
@@ -116,6 +121,7 @@ describe('a role-grant that is not rooted at the anchor is not stored (F3)', ()
     try {
       const sent = [];
       node._gossipToRoster = (frame) => sent.push(frame);
+      node._roster.bind('someone', kp('someone').pub, 'proven');
       assert.strictEqual(node.grantRole('someone', 'validator'), null);
       assert.deepStrictEqual(sent, []);
       assert.strictEqual(fs.existsSync(grantsFile(name)), false);
@@ -128,7 +134,7 @@ describe('reading role-grants.jsonl never stops a node from starting (F3)', () =
     const name = uniq('rg-junk');
     const founder = kp('founder'), evil = kp('evil-peer'), V = kp('v'), W = kp('w');
     let node = boot(name, founder);
-    handshake(node, evil); // pins evil's key, as a 0.13.16 node had
+    handshake(node, evil); // binds evil's key (proven): a self-signed grant still confers nothing
     node.stop();
     const now = Date.now();
     const forged = { ...grant('role-grant', evil, 'anchor', founder, now), sig: Buffer.alloc(64, 7).toString('base64url') };
@@ -153,14 +159,16 @@ describe('reading role-grants.jsonl never stops a node from starting (F3)', () =
     try {
       const about = said.filter((l) => /Role grants/.test(l));
       assert.strictEqual(about.length, 1, 'said once');
-      assert.match(about[0], /loaded 2, skipped 8 that could not be verified \(not-json 1, malformed 5, bad-signature 1, unrooted 1\)/);
+      // 0.14 (design D3): a grant is checked against the keys the chain vouches for its grantor, never
+      // the registry's, so the self-signed grant is skipped as from a grantor no chain reaches.
+      assert.match(about[0], /loaded 2, skipped 8 that could not be verified \(not-json 1, malformed 5, unknown-grantor-key 1, bad-signature 1\)/);
       assert.strictEqual(node.resolveRole(V.nodeId), 'validator');
       assert.strictEqual(node.resolveRole(W.nodeId), 'validator', 'a two-hop chain loads whatever the line order');
       assert.strictEqual(node.resolveRole(evil.nodeId), 'participant');
       const rep = node._roleGrants.loadReport();
       assert.strictEqual(rep.loaded, 2);
       assert.strictEqual(rep.unreadable, null);
-      assert.deepStrictEqual(rep.skipped, { 'not-json': 1, malformed: 5, unrooted: 1, 'bad-signature': 1 });
+      assert.deepStrictEqual(rep.skipped, { 'not-json': 1, malformed: 5, 'unknown-grantor-key': 1, 'bad-signature': 1 });
     } finally { node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
   });
 
diff --git a/tests/role-grant-store.test.js b/tests/role-grant-store.test.js
index e842ff9d..9d491e96 100644
--- a/tests/role-grant-store.test.js
+++ b/tests/role-grant-store.test.js
@@ -27,11 +27,18 @@ function kp(nodeId) {
 }
 
 const T = 1_000_000;
+// Since 0.14 every role-grant names the key it confers authority on (design D3).
 function grant(type, grantee, role, grantor, at) {
-  return signGrant({ type, grantee: grantee.nodeId, role, grantedBy: grantor.nodeId, grantedAt: at }, grantor.priv);
+  const g = { type, grantee: grantee.nodeId, role, grantedBy: grantor.nodeId, grantedAt: at };
+  if (type === 'role-grant') g.granteeKey = grantee.pub;
+  return signGrant(g, grantor.priv);
 }
 
-/** A store whose keys map is pre-populated with every party's pubkey + anchor pinned. */
+/**
+ * A store whose key map holds every party's pubkey + anchor pinned. Since 0.14 the map only answers
+ * "which key is this subject bound to" (resolveRole's two-argument form); grants are verified with
+ * the keys the chain itself vouches, never with it.
+ */
 function storeWith(anchor, parties, opts = {}) {
   const keys = new Map();
   for (const p of [anchor, ...parties]) keys.set(p.nodeId, p.pub);
@@ -208,18 +215,22 @@ describe('RoleGrantStore — relayed key learning (grant vouches for grantee key
     // X (a participant) grants Y, vouching Y's key — X's key is in the registry (say via
     // some handshake) so the grant verifies, but X is unrooted so it confers nothing, is
     // not kept (0.13.17: an unrooted record is not stored or relayed) AND vouches for no key.
-    reg.pin(X.nodeId, X.pub, 'handshake');
-    assert.deepStrictEqual(store.record(grantWithKey(Y, 'validator', X, T)), { stored: false, reason: 'unrooted' });
+    reg.bind(X.nodeId, X.pub, 'proven');
+    assert.deepStrictEqual(store.record(grantWithKey(Y, 'validator', X, T)), { stored: false, reason: 'unknown-grantor-key' },
+      'no chain vouches a key for X, so its grant cannot even be checked (the registry is never asked)');
     assert.strictEqual(reg.has(Y.nodeId), false, 'unrooted grantor vouches for no key');
   });
 
-  it('a grant-vouched key cannot override a key already pinned by handshake', () => {
-    const A = kp('A'), V = kp('V');
+  it('a grant-vouched key cannot override a key already proven: it is a conflict', () => {
+    const A = kp('A'), V = kp('V'), other = kp('V-other');
     const reg = new RosterKeyRegistry({ anchor: { nodeId: A.nodeId, publicKey: A.pub } });
     const store = new RoleGrantStore({ anchor: { nodeId: A.nodeId, publicKey: A.pub }, keys: reg });
-    reg.pin(V.nodeId, 'real-handshake-key', 'handshake');
-    // a rooted grant vouching a DIFFERENT key for V must not repoint the handshake binding
-    store.record(grantWithKey(V, 'validator', A, T));
-    assert.strictEqual(reg.get(V.nodeId), 'real-handshake-key', 'handshake binding stands');
+    reg.bind(V.nodeId, other.pub, 'proven');
+    // a rooted grant vouching a DIFFERENT key for V must not repoint the proven binding
+    assert.strictEqual(store.record(grantWithKey(V, 'validator', A, T)).stored, true, 'the grant itself is rooted and kept');
+    assert.strictEqual(reg.get(V.nodeId), other.pub, 'the proven binding stands');
+    assert.deepStrictEqual(reg.conflicts().map((c) => [c.nodeId, c.got, c.gotSource]), [[V.nodeId, V.pub, 'grant']], 'and the vouch is recorded as a conflict');
+    assert.strictEqual(store.resolveRole(V.nodeId, T + 1), 'participant', 'the key V is bound to holds no grant');
+    assert.strictEqual(store.resolveRole(V.nodeId, V.pub, T + 1), 'validator', 'the vouched key does');
   });
 });
diff --git a/tests/room-admission.test.js b/tests/room-admission.test.js
index 6e446cfb..cd5b0e42 100644
--- a/tests/room-admission.test.js
+++ b/tests/room-admission.test.js
@@ -1,15 +1,11 @@
 'use strict';
 
 /**
- * Stage 2 — the handshake admission decision (SymNode#_roomAdmission).
- *
- * Before this existed, NOTHING compared the room at all: the handshake has always
- * carried `room` and bound it into the signed transcript, but no receiver looked, so a
- * peer announcing any room joined the peer set and LAN isolation was a property of the
- * mDNS browse filter rather than of any check.
- *
- * Tested against the real prototype method with a minimal receiver stub, so these pin the
- * shipped implementation rather than a re-description of it.
+ * The room door (design D6, Core Secure). The room is explicit and inside the §5.2 transcript: a
+ * room mismatch, or a hello naming no room, closes the connection before admission (see
+ * core-secure-session.test.js). What is left to decide is a GATED room: its owner is recognised by
+ * its pinned key, and a grantee when its room-join grant's bound key equals the key its session
+ * PROVED. Tested against the real prototype method with a minimal receiver stub.
  */
 
 const { describe, it } = require('node:test');
@@ -34,163 +30,97 @@ const ROOM = 'x-review--team-02779b950c3d8d7378fd11d6';
 function receiver(room, owner) {
   const owners = new RoomOwnershipRegistry();
   if (owner) owners.pin(room, owner.nodeId, owner.publicKey, 'config');
-  const logged = [];
-  return { _room: room, _roomOwners: owners, _log: (m) => logged.push(m), logged };
+  return { _room: room, _roomOwners: owners, _log: () => {} };
 }
-const admit = (rcv, peerId, msg) => SymNode.prototype._roomAdmission.call(rcv, peerId, msg);
+/** The decision for a confirmed session that proved `key` for `nodeId`, presenting `grant`. */
+const decide = (rcv, nodeId, key, grant) => SymNode.prototype._roomAdmissionDecide.call(rcv, { nodeId, identityKey: key, roomGrant: grant || null });
 
-describe('the room comparison that did not exist', () => {
-  it('a peer claiming a DIFFERENT room is refused, even when the room is ungated', () => {
-    const r = receiver('backend-team');
-    const d = admit(r, 'peer-1', { nodeId: 'peer-1', room: 'someone-elses-room' });
-    assert.strictEqual(d.admit, false);
-    assert.match(d.reason, /room-mismatch/);
-  });
-
-  // This test previously asserted the DEFECT: that an absent room is `default`
-  // and therefore refused by a node in a named room. It read as a deliberate
-  // decision and was neither -- `|| 'default'` collapsed "made no claim" into
-  // "claims the public square". A test can defend a bug as convincingly as it
-  // defends a behaviour, and this one did.
-  it('an ABSENT room claim is admitted — silence is not a claim, and it is not a mismatch', () => {
-    const named = receiver('backend-team');
-    assert.strictEqual(admit(named, 'p', { nodeId: 'p' }).admit, true,
-      'every shipped sym-swift device sends no room; refusing them partitions the iOS fleet');
-    assert.strictEqual(admit(receiver('default'), 'p', { nodeId: 'p' }).admit, true);
-    // The log must state the OBSERVATION, not a cause it cannot see. Two
-    // populations land here — nodes that CANNOT claim a room, and callers that
-    // chose not to — and they are byte-identical on the wire. Asserting a
-    // reason would make the count that gates the tightening un-zeroable.
-    assert.match(named.logged.join('\n'), /no room claimed/,
-      'the admission must be logged so the population is countable before tightening');
-    assert.doesNotMatch(named.logged.join('\n'), /predates|older|legacy/i,
-      'the log must not assert why the claim was absent — it cannot observe that');
-  });
-
-  it('an EMPTY room string is treated as absent, not as a room named ""', () => {
-    assert.strictEqual(admit(receiver('backend-team'), 'p', { nodeId: 'p', room: '' }).admit, true);
-  });
-
-  it('a peer that DOES claim a room is still held to it — the isolation still works', () => {
-    const d = admit(receiver('backend-team'), 'p', { nodeId: 'p', room: 'default' });
-    assert.strictEqual(d.admit, false, 'an explicit `default` claim is a claim, and it mismatches');
-    assert.match(d.reason, /room-mismatch/);
-  });
-});
-
-describe('ungated rooms are unchanged — upgrade day moves nothing', () => {
-  it('a matching room with no owner admits exactly as before', () => {
-    assert.strictEqual(admit(receiver(ROOM), 'peer-1', { nodeId: 'peer-1', room: ROOM }).admit, true);
-  });
-
-  it('and it admits with no grant presented, because none is required', () => {
-    const d = admit(receiver('backend-team'), 'p', { nodeId: 'p', room: 'backend-team', roomGrant: undefined });
-    assert.strictEqual(d.admit, true);
+describe('ungated rooms admit every confirmed session', () => {
+  it('a session in an ungated room is admitted with no grant, because none is required', () => {
+    assert.deepStrictEqual(decide(receiver('backend-team'), 'p', keypair().pub), { admit: true });
+    assert.deepStrictEqual(decide(receiver(ROOM), 'p', keypair().pub), { admit: true });
   });
 });
 
-describe('gated rooms — fail closed, and the owner is never locked out', () => {
-  it('a stranger with no grant is refused', () => {
+describe('gated rooms — fail closed on proven keys, and the owner is never locked out', () => {
+  it('a stranger with no grant is pending (refused when its handshake timeout passes)', () => {
     const owner = keypair();
     const r = receiver(ROOM, { nodeId: 'owner-node', publicKey: owner.pub });
-    const d = admit(r, 'stranger', { nodeId: 'stranger', room: ROOM });
-    assert.strictEqual(d.admit, false);
-    assert.match(d.reason, /no room-join grant/);
+    assert.deepStrictEqual(decide(r, 'stranger', keypair().pub), { pending: true });
   });
 
-  it('the OWNER needs no grant in its own room', () => {
+  it('the OWNER needs no grant in its own room — recognised by its pinned key, not its id', () => {
     const owner = keypair();
     const r = receiver(ROOM, { nodeId: 'owner-node', publicKey: owner.pub });
-    assert.strictEqual(admit(r, 'owner-node', { nodeId: 'owner-node', room: ROOM }).admit, true);
+    assert.strictEqual(decide(r, 'owner-node', owner.pub).admit, true);
+    const imp = decide(r, 'owner-node', keypair().pub);
+    assert.strictEqual(imp.admit, false, 'the owner\'s id under another key is not the owner');
+    assert.match(imp.reason, /under another key/);
   });
 
-  it('a foreign peer WITH the owner\'s grant is admitted — sharing stays possible, as an act', () => {
+  it('a grantee is admitted when the grant binds the key its session proved; an impostor proving its own key is not', () => {
     const owner = keypair(), volunteer = keypair();
     const r = receiver(ROOM, { nodeId: 'owner-node', publicKey: owner.pub });
-    const grant = signRoomGrant(
-      { room: ROOM, grantee: 'volunteer', granteeKey: volunteer.pub, grantedBy: 'owner-node' }, owner.priv);
-    // WITH ITS KEY PROVEN, the invitation still works — sharing stays a decision someone makes.
-    assert.strictEqual(
-      admit(r, 'volunteer', { nodeId: 'volunteer', room: ROOM, roomGrant: grant, provenPublicKey: volunteer.pub }).admit,
-      true);
-
-    // WITHOUT PROOF, nobody is admitted — including the real invitee. The old handshake only
-    // ASSERTS a key, and the key an impostor must assert is inside the grant it holds, so the
-    // gate stays shut until the proving handshake reaches this path (2026-09-16).
-    const unproven = admit(r, 'volunteer', { nodeId: 'volunteer', room: ROOM, roomGrant: grant });
-    assert.strictEqual(unproven.admit, false, 'an unproven presenter is refused');
-    assert.match(String(unproven.reason), /no-proven-key/);
-
-    // AND AN IMPOSTOR PROVING ITS OWN KEY IS REFUSED BY THE BINDING.
-    const impostorKey = keypair();
-    const imp = admit(r, 'volunteer', { nodeId: 'volunteer', room: ROOM, roomGrant: grant, provenPublicKey: impostorKey.pub });
-    assert.strictEqual(imp.admit, false, 'the grant binds a key and the binding is enforced');
+    const grant = signRoomGrant({ room: ROOM, grantee: 'volunteer', granteeKey: volunteer.pub, grantedBy: 'owner-node' }, owner.priv);
+    assert.strictEqual(decide(r, 'volunteer', volunteer.pub, grant).admit, true, 'sharing stays possible, as an act');
+    const imp = decide(r, 'volunteer', keypair().pub, grant);
+    assert.strictEqual(imp.admit, false, 'a copied grant admits nobody: the binding is enforced');
     assert.match(String(imp.reason), /grantee-key-mismatch/);
   });
 
   it('a grant minted by someone who is NOT the owner is refused', () => {
-    const owner = keypair(), impostor = keypair();
+    const owner = keypair(), impostor = keypair(), evil = keypair();
     const r = receiver(ROOM, { nodeId: 'owner-node', publicKey: owner.pub });
-    const forged = signRoomGrant({ room: ROOM, grantee: 'evil', grantedBy: 'owner-node' }, impostor.priv);
-    const d = admit(r, 'evil', { nodeId: 'evil', room: ROOM, roomGrant: forged });
+    const forged = signRoomGrant({ room: ROOM, grantee: 'evil', granteeKey: evil.pub, grantedBy: 'owner-node' }, impostor.priv);
+    const d = decide(r, 'evil', evil.pub, forged);
     assert.strictEqual(d.admit, false);
     assert.match(d.reason, /grant refused/);
   });
 
-  it('a valid grant issued to SOMEONE ELSE cannot be presented by this peer', () => {
-    const owner = keypair();
+  it('a valid grant issued to SOMEONE ELSE cannot be presented by this session', () => {
+    const owner = keypair(), alice = keypair();
     const r = receiver(ROOM, { nodeId: 'owner-node', publicKey: owner.pub });
-    const grant = signRoomGrant({ room: ROOM, grantee: 'alice', grantedBy: 'owner-node' }, owner.priv);
-    const d = admit(r, 'mallory', { nodeId: 'mallory', room: ROOM, roomGrant: grant });
+    const grant = signRoomGrant({ room: ROOM, grantee: 'alice', granteeKey: alice.pub, grantedBy: 'owner-node' }, owner.priv);
+    const d = decide(r, 'mallory', keypair().pub, grant);
     assert.strictEqual(d.admit, false);
     assert.match(d.reason, /grantee-mismatch/);
   });
 
+  it('a grant that binds no key is a bearer token and is refused (§5.8.1)', () => {
+    const owner = keypair(), bob = keypair();
+    const r = receiver(ROOM, { nodeId: 'owner-node', publicKey: owner.pub });
+    const bearer = signRoomGrant({ room: ROOM, grantee: 'bob', grantedBy: 'owner-node' }, owner.priv);
+    assert.strictEqual(decide(r, 'bob', bob.pub, bearer).admit, false);
+  });
+
   it('an expired grant is refused at join', () => {
     const owner = keypair(), late = keypair();
     const r = receiver(ROOM, { nodeId: 'owner-node', publicKey: owner.pub });
-    const long_ago = Date.now() - 48 * 3600_000;
+    const longAgo = Date.now() - 48 * 3600_000;
     const grant = signRoomGrant(
-      { room: ROOM, grantee: 'late', granteeKey: late.pub, grantedBy: 'owner-node', grantedAt: long_ago, expiresAt: long_ago + 3600_000 },
+      { room: ROOM, grantee: 'late', granteeKey: late.pub, grantedBy: 'owner-node', grantedAt: longAgo, expiresAt: longAgo + 3600_000 },
       owner.priv);
-    // proof supplied, so what is under test here is still the CLOCK
-    assert.match(
-      admit(r, 'late', { nodeId: 'late', room: ROOM, roomGrant: grant, provenPublicKey: late.pub }).reason,
-      /expired/);
-  });
-
-  it('the grantee is the handshake nodeId, not the transport peerId', () => {
-    // a peer cannot present a grant for a nodeId it is not announcing
-    const owner = keypair();
-    const r = receiver(ROOM, { nodeId: 'owner-node', publicKey: owner.pub });
-    const grant = signRoomGrant({ room: ROOM, grantee: 'alice', grantedBy: 'owner-node' }, owner.priv);
-    assert.strictEqual(admit(r, 'alice', { nodeId: 'mallory', room: ROOM, roomGrant: grant }).admit, false,
-      'the announced identity is what the grant must name');
+    assert.match(decide(r, 'late', late.pub, grant).reason, /expired/);
   });
 });
 
-describe('the decision is enforced in BOTH directions', () => {
+describe('the decision is made for every session before anything per-peer exists', () => {
   const fs = require('node:fs');
   const path = require('node:path');
-  const read = (f) => fs.readFileSync(path.join(__dirname, '..', f), 'utf8');
-
-  it('the inbound path decides BEFORE the peer is added to the set', () => {
-    const src = read('lib/node.js');
-    const decide = src.indexOf('const admission = this._roomAdmission(peerId, handshakeMsg)');
-    const add = src.indexOf('const peer = this._createPeer(transport, peerId, peerName, false, \'bonjour\')');
-    assert.ok(decide > 0 && add > 0, 'both present');
-    assert.ok(decide < add, 'refused peers are never created or added');
-  });
+  const src = fs.readFileSync(path.join(__dirname, '..', 'lib', 'node.js'), 'utf8');
 
-  it('the outbound path decides when the dialled peer\'s handshake arrives', () => {
-    // the loopback tie-break means the stranger dials US in half of all nodeId
-    // orderings — a check on only the accepting path is dead code for those pairs
-    const src = read('lib/frame-handler.js');   // the handler lib/node.js loads; lib/core/frame-handler.js was a dead copy
-    assert.match(src, /_handleHandshake\(peerId, peerName, msg\) \{[\s\S]{0,900}_roomAdmission\(peerId, msg\)/);
-    assert.match(src, /this\._node\._peers\.delete\(peerId\)/, 'a refused peer is removed, not merely logged');
+  it('every confirmed session, client or server, goes through the door before it is admitted', () => {
+    const confirmed = src.slice(src.indexOf('  _onSessionConfirmed(session) {'), src.indexOf('  _decideAdmission(session) {'));
+    assert.match(confirmed, /this\._decideAdmission\(session\)/);
+    assert.doesNotMatch(confirmed, /this\._peers\.set/, 'no peer is created at confirmation');
+    const admit = src.slice(src.indexOf('  _admitSession(session) {'), src.indexOf('  _greetSession('));
+    assert.match(admit, /this\._peers\.set/, 'the peer is created on admission only');
   });
 
-  it('the handshake carries the grant so a gated room is joinable at all', () => {
-    assert.match(read('lib/node.js'), /roomGrant: this\._roomGrant \|\| undefined/);
+  it('a frame from a session the door has not admitted is refused, except its room-join grant', () => {
+    const frame = src.slice(src.indexOf('  _onSessionFrame(session, frame) {'), src.indexOf('  _onSessionClosed(session, info) {'));
+    assert.match(frame, /state !== 'admitted'/);
+    assert.match(frame, /mesh-room-join/);
+    assert.match(frame, /not-admitted/);
   });
 });
diff --git a/tests/room-door-per-frame.test.js b/tests/room-door-per-frame.test.js
index 9e87ce9b..a18ce5a4 100644
--- a/tests/room-door-per-frame.test.js
+++ b/tests/room-door-per-frame.test.js
@@ -1,18 +1,11 @@
 'use strict';
 
 /**
- * Stage 3 — THE DOOR, consulted per frame (SymNode#_roomDoor + FrameHandler#handle).
- *
- * Stages 1 and 2 put a comparison and a grant check into the handshake. Neither reached a
- * frame. dev3, building the xmesh simulation against this spec, traced its bad node pushing
- * a word straight onto the delivery queue with no join, and asked whether the door belongs
- * everywhere or only in that one scene. Reading THIS tree answered it: the same shape is
- * reachable here for a different reason. On the dialling side `_connectToPeer` attaches the
- * frame listener and calls `_addPeer` before any handshake exists, so a peer that speaks
- * first is judged by SVAF with no admission decision ever having been made; on the accepting
- * side the refusal closes the transport one statement AFTER the listener was attached.
- *
- * These tests pin what the door refuses and, just as deliberately, what it does not.
+ * THE DOOR, consulted per frame (§5.8.1; design D6). In Core Secure a frame reaches the handler only
+ * from a confirmed session the room door admitted (SymNode#_onSessionFrame): a session not yet
+ * admitted may send only its room-join grant. The handler consults the door again on every frame
+ * (FrameHandler#handle → SymNode#_roomDoor), so no later path can dispatch around it. These tests pin
+ * what the door refuses and, just as deliberately, what it does not.
  */
 
 const { describe, it } = require('node:test');
@@ -20,192 +13,119 @@ const assert = require('node:assert');
 
 const { SymNode } = require('../lib/node');
 const { RoomOwnershipRegistry } = require('../lib/room-ownership');
-// THE LIVE MODULE, NOT lib/core/frame-handler.js. These tests originally imported the core copy,
-// which lib/node.js does not load — so the door passed nine tests while never running in
-// production. `require` the same path node.js does, and let the assertion below prove it.
+// THE LIVE MODULE: the frame handler lib/node.js loads (the assertion below proves it).
 const { FrameHandler } = require('../lib/frame-handler');
 
 const ROOM = 'x-review--team-02779b950c3d8d7378fd11d6';
-const OWNER = { nodeId: 'owner-node', publicKey: 'ownerkey' };
+const OWNER = { nodeId: 'owner-node', publicKey: 'A'.repeat(43) };
 
 function receiver(room, owner) {
   const owners = new RoomOwnershipRegistry();
   if (owner) owners.pin(room, owner.nodeId, owner.publicKey, 'config');
   const logged = [];
-  return { _room: room, _roomOwners: owners, _log: (m) => logged.push(m), logged, _peers: new Map() };
+  return { _room: room, _roomOwners: owners, _log: (m) => logged.push(m), logged, _peers: new Map(), _roomVerdicts: new Map() };
 }
-const admit = (r, peerId, msg) => SymNode.prototype._roomAdmission.call(r, peerId, msg);
 const door = (r, peerId) => SymNode.prototype._roomDoor.call(r, peerId);
+const session = (nodeId) => ({ nodeId, name: nodeId, identityKey: 'k', confirmed: true, has: () => true, send: () => true });
 
-describe('a word from a node that never joined', () => {
-  it('is REFUSED in a gated room — this is dev3s bad node, in this tree', () => {
+describe('a word from a node that was never admitted', () => {
+  it('is REFUSED in a gated room', () => {
     const r = receiver(ROOM, OWNER);
-    const d = door(r, 'mallory');        // no handshake ever processed for this peer
+    const d = door(r, 'mallory');
     assert.equal(d.pass, false);
     assert.match(d.reason, /without joining it/);
   });
 
-  it('is ADMITTED in an ungated room, and counted, because nothing was required of it', () => {
-    const r = receiver(ROOM, null);
-    assert.equal(door(r, 'mallory').pass, true);
-    assert.equal(door(r, 'other').pass, true);
-    assert.equal(r._doorUngatedPassCount, 2,
-      'the population passing on absence must be countable before anyone tightens this');
+  it('passes in an ungated room: there is nothing to have failed', () => {
+    assert.equal(door(receiver(ROOM, null), 'mallory').pass, true);
   });
 
-  it('a peer REFUSED at handshake stays refused on every later frame', () => {
-    const r = receiver(ROOM, null);
-    const a = admit(r, 'liar', { nodeId: 'liar', room: 'someone-elses-room' });
-    assert.equal(a.admit, false);
+  it('a session REFUSED at admission stays refused on every later frame, with the admission reason', () => {
+    const r = receiver(ROOM, OWNER);
+    r._roomVerdicts.set('liar', { admit: false, reason: 'room-join grant refused: grantee-mismatch' });
     const d = door(r, 'liar');
     assert.equal(d.pass, false);
-    assert.match(d.reason, /room-mismatch/,
-      'the door must repeat the ADMISSION reason, not invent a second one');
+    assert.match(d.reason, /grantee-mismatch/, 'the door repeats the ADMISSION reason');
   });
 
-  it('a peer ADMITTED at handshake passes, and does not touch the ungated counter', () => {
-    const r = receiver(ROOM, null);
-    assert.equal(admit(r, 'friend', { nodeId: 'friend', room: ROOM }).admit, true);
+  it('an ADMITTED peer passes', () => {
+    const r = receiver(ROOM, OWNER);
+    r._peers.set('friend', { peerId: 'friend' });
+    r._roomVerdicts.set('friend', { admit: true });
     assert.equal(door(r, 'friend').pass, true);
-    assert.equal(r._doorUngatedPassCount, undefined,
-      'a peer with a recorded verdict is not an absent-handshake case');
   });
 });
 
-describe('what the dispatcher does with the doors answer', () => {
+describe('what the dispatcher does with the door\'s answer', () => {
   function dispatcher(room, owner) {
     const node = receiver(room, owner);
     node._roomDoor = (peerId) => SymNode.prototype._roomDoor.call(node, peerId);
-    node._roomAdmission = (peerId, msg) => SymNode.prototype._roomAdmission.call(node, peerId, msg);
     const seen = [];
     const fh = new FrameHandler(node);
-    for (const m of ['_handleMemoryShare', '_handleMood', '_handleMessage', '_handleXMeshInsight',
-                     '_handleWakeChannel', '_handlePeerInfo']) {
+    for (const m of ['_handleMemoryShare', '_handleMood', '_handleXMeshInsight', '_handleWakeChannel', '_handlePeerInfo']) {
       fh[m] = (_p, _n, msg) => seen.push(msg.type);
     }
     return { node, fh, seen };
   }
 
-  it('drops a cmb from an unjoined peer in a gated room BEFORE SVAF sees it', () => {
+  it('drops a cmb from an unadmitted peer in a gated room BEFORE SVAF sees it', () => {
     const { fh, seen, node } = dispatcher(ROOM, OWNER);
-    fh.handle('mallory', 'mallory', { type: 'cmb', cmb: { content: 'trust me' } });
+    fh.handle(session('mallory'), { type: 'cmb', cmb: { content: 'trust me' } });
     assert.deepEqual(seen, [], 'the word must not reach the sub-handler at all');
-    assert.ok(node.logged.some((l) => /Door refused 'cmb'/.test(l)),
-      'a refusal nobody can read is not a gate');
+    assert.ok(node.logged.some((l) => /Door refused 'cmb'/.test(l)), 'a refusal nobody can read is not a gate');
   });
 
   it('refuses EVERY meaning-carrying category, not just cmb', () => {
     const { fh, seen } = dispatcher(ROOM, OWNER);
-    for (const type of ['cmb', 'mood', 'message', 'xmesh-insight', 'wake-channel', 'peer-info']) {
-      fh.handle('mallory', 'mallory', { type });
-    }
+    for (const type of ['cmb', 'mood', 'xmesh-insight', 'wake-channel', 'peer-info']) fh.handle(session('mallory'), { type });
     assert.deepEqual(seen, []);
   });
 
-  it('still lets the handshake through — otherwise a grant-holder could never join', () => {
-    const { fh, node } = dispatcher(ROOM, OWNER);
-    fh.handle('friend', 'friend', { type: 'handshake', nodeId: 'friend', room: ROOM });
-    assert.ok(node._roomVerdicts.has('friend'),
-      'the handshake must reach admission, or the door locks out the people it is for');
-  });
-
-  it('still answers ping — liveness tells a refused peer nothing a closed socket would not', () => {
-    const { node, fh } = dispatcher(ROOM, OWNER);
-    const sent = [];
-    node._peers.set('mallory', { transport: { send: (m) => sent.push(m.type) } });
-    fh.handle('mallory', 'mallory', { type: 'ping' });
-    assert.deepEqual(sent, ['pong']);
-  });
-
   it('passes a cmb through in an ungated room — the door adds no new refusal there', () => {
     const { fh, seen } = dispatcher(ROOM, null);
-    fh.handle('stranger', 'stranger', { type: 'cmb', cmb: { content: 'hello' } });
+    fh.handle(session('stranger'), { type: 'cmb', cmb: { content: 'hello' } });
     assert.deepEqual(seen, ['cmb']);
   });
+
+  it('refuses a frame from anything that is not a confirmed session', () => {
+    const { fh } = dispatcher(ROOM, null);
+    assert.throws(() => fh.handle({ nodeId: 'x', confirmed: false }, { type: 'cmb' }), /confirmed session/);
+    assert.throws(() => fh.handle('peer-id-string', 'name', { type: 'cmb' }), /confirmed session/, 'the 0.13 (peerId, peerName, frame) call is gone');
+  });
 });
 
 describe('roomGate — the question a caller could not ask', () => {
-  const { RoomOwnershipRegistry: Reg } = require('../lib/room-ownership');
-  const gate = (room, owners, proves = false) => SymNode.prototype.roomGate.call({
-    _room: room, _roomOwners: owners,
-    _buildHandshake: () => (proves ? { provenPublicKey: 'proven-key' } : { publicKey: 'asserted-only' }),
-  });
+  const gate = (room, owners) => SymNode.prototype.roomGate.call({ _room: room, _roomOwners: owners });
 
   it('reports an ungated room as ungated with no owner', () => {
-    const g = gate(ROOM, new Reg());
+    const g = gate(ROOM, new RoomOwnershipRegistry());
     assert.equal(g.gated, false);
     assert.equal(g.owner, null);
     assert.equal(g.admits, 'anyone', 'an ungated room admits by declaration (MMP §5.8)');
   });
 
-  it('reports a gated room with the owners PUBLIC key and where the pin came from', () => {
-    const owners = new Reg();
+  it('reports a gated room with the owner\'s PUBLIC key, where the pin came from, and that it admits grant-holders', () => {
+    const owners = new RoomOwnershipRegistry();
     owners.pin(ROOM, OWNER.nodeId, OWNER.publicKey, 'config');
     const g = gate(ROOM, owners);
     assert.equal(g.gated, true);
     assert.equal(g.owner.nodeId, OWNER.nodeId);
     assert.equal(g.owner.publicKey, OWNER.publicKey);
     assert.equal(g.owner.source, 'config');
-  });
-
-  it('never exposes a private key — verifying needs the public half, minting is the owners act', () => {
-    const owners = new Reg();
-    owners.pin(ROOM, OWNER.nodeId, OWNER.publicKey, 'config');
-    const flat = JSON.stringify(gate(ROOM, owners));
-    assert.ok(!/priv/i.test(flat), flat);
+    assert.equal(g.admits, 'grant-holders', 'Core Secure sessions prove the key a grant binds');
+    assert.ok(!/priv/i.test(JSON.stringify(g)));
   });
 });
 
 describe('the door is in the module the node actually loads', () => {
   it('lib/node.js requires the SAME frame-handler these tests exercise', () => {
-    // WHY THIS TEST EXISTS. The door was written into lib/core/frame-handler.js and tested there.
-    // lib/node.js requires './frame-handler' — a different, larger file — so nine passing tests
-    // covered code no runtime ever loaded, and the door was reported as shipped while being dead.
-    // A green suite against the wrong file is worse than no suite: it retires the question.
     const fs = require('node:fs');
     const nodeSrc = fs.readFileSync(require.resolve('../lib/node.js'), 'utf8');
     const required = /require\('\.\/(core\/)?frame-handler'\)/.exec(nodeSrc);
     assert.ok(required, 'lib/node.js must require a frame-handler');
-    assert.equal(required[1], undefined,
-      'node.js requires ./frame-handler (lib/frame-handler.js) — tests must import that one');
+    assert.equal(required[1], undefined, 'node.js requires ./frame-handler (lib/frame-handler.js)');
     const live = fs.readFileSync(require.resolve('../lib/frame-handler.js'), 'utf8');
     assert.match(live, /_roomDoor/, 'the door must live in the module the node loads');
-    assert.match(live, /_roomAdmission/, 'and so must the handshake admission check');
-  });
-});
-
-describe('roomGate reports what the gate ENFORCES, not only that one is pinned', () => {
-  const { RoomOwnershipRegistry: Reg } = require('../lib/room-ownership');
-  const gate = (proves) => {
-    const owners = new Reg();
-    owners.pin(ROOM, OWNER.nodeId, OWNER.publicKey, 'config');
-    return SymNode.prototype.roomGate.call({
-      _room: ROOM, _roomOwners: owners,
-      _buildHandshake: () => (proves ? { provenPublicKey: 'proven' } : { publicKey: 'asserted-only' }),
-    });
-  };
-
-  it('says a gated room admits NOBODY while this runtime cannot prove a key', () => {
-    // The dangerous reading this replaces: `gated: true` alone invites the conclusion that the
-    // room admits the invited. verifyRoomGrant refuses for want of proof BEFORE comparing keys,
-    // so a legitimate grant-holder is refused for the same reason as a thief.
-    const g = gate(false);
-    assert.equal(g.gated, true);
-    assert.equal(g.admits, 'nobody');
-    assert.match(g.why, /refuses every peer, holder or not/);
-  });
-
-  it('says grant-holders once the handshake proves a key — without anyone editing this method', () => {
-    // Asked of our OWN handshake rather than hard-coded, so wiring lib/core/handshake-v2.js
-    // flips the answer on its own. A constant here would have to be remembered.
-    const g = gate(true);
-    assert.equal(g.admits, 'grant-holders');
-    assert.equal(g.why, null);
-  });
-
-  it('never reports a room as admitting more than it can enforce', () => {
-    const order = ['nobody', 'grant-holders'];
-    assert.ok(order.indexOf(gate(false).admits) < order.indexOf(gate(true).admits),
-      'the non-proving runtime must never claim the wider admission');
+    assert.match(nodeSrc, /_roomAdmissionDecide\(session\)/, 'and the admission decision in the node, per session');
   });
 });
diff --git a/tests/roster-keys.test.js b/tests/roster-keys.test.js
index 1f08944a..a22c4222 100644
--- a/tests/roster-keys.test.js
+++ b/tests/roster-keys.test.js
@@ -1,78 +1,187 @@
 'use strict';
 
 /**
- * Roster key registry — authenticated nodeId→key bindings with source precedence
- * (anchor > handshake > grant-vouched). The relayer never vouches: a weaker-or-equal
- * source can never repoint a stronger binding, so gossip cannot poison a key learnt
- * from a direct handshake or the pinned anchor.
+ * The key registry (design D3): one place where a nodeId gets a key, and an explicit conflict matrix.
+ * No source ever overrides a different key — the 0.13 rule "a strictly stronger source overrides" is
+ * gone. Each row of the matrix is a test here; the anchor is configuration and never persisted; a
+ * 0.13 file's `handshake` entries become `legacy-claim` (expected, never verifying) on first load.
  */
 
 const { describe, it } = require('node:test');
 const assert = require('node:assert');
+const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
-const { RosterKeyRegistry } = require('../lib/roster-keys');
+const { RosterKeyRegistry, FORMAT_MARKER } = require('../lib/roster-keys');
 
-describe('RosterKeyRegistry — source precedence', () => {
-  it('pins the anchor at construction and reads it back', () => {
-    const r = new RosterKeyRegistry({ anchor: { nodeId: 'A', publicKey: 'KA' } });
-    assert.strictEqual(r.get('A'), 'KA');
-    assert.strictEqual(r.source('A'), 'anchor');
+const key = () => crypto.generateKeyPairSync('ed25519').publicKey.export({ format: 'der', type: 'spki' }).subarray(12).toString('base64url');
+const tmp = () => fs.mkdtempSync(path.join(os.tmpdir(), 'rk-'));
+const lines = (dir) => fs.readFileSync(path.join(dir, 'roster-keys.jsonl'), 'utf8').trim().split('\n').map((l) => JSON.parse(l));
+
+describe('the conflict matrix, row by row', () => {
+  it('nodeId unbound, proven session → bind proven', () => {
+    const r = new RosterKeyRegistry(); const k = key();
+    assert.deepStrictEqual(r.bind('N', k, 'proven'), { bound: true, source: 'proven' });
+    assert.strictEqual(r.get('N'), k);
   });
 
-  it('a stronger source overrides a weaker binding; weaker cannot override stronger', () => {
-    const r = new RosterKeyRegistry();
-    assert.strictEqual(r.pin('N', 'K-grant', 'grant').pinned, true);
-    // handshake (stronger) corrects a grant-vouched key
-    assert.strictEqual(r.pin('N', 'K-handshake', 'handshake').pinned, true);
-    assert.strictEqual(r.get('N'), 'K-handshake');
-    // a later grant gossip cannot repoint the handshake binding
-    const res = r.pin('N', 'K-evil', 'grant');
-    assert.strictEqual(res.pinned, false);
-    assert.strictEqual(res.reason, 'conflict');
-    assert.strictEqual(r.get('N'), 'K-handshake');
-    assert.strictEqual(r.conflicts().length, 1);
+  it('nodeId unbound, anchor-rooted grant vouches a key → bind grant', () => {
+    const r = new RosterKeyRegistry(); const k = key();
+    assert.strictEqual(r.bind('N', k, 'grant').bound, true);
+    assert.strictEqual(r.source('N'), 'grant');
+    assert.strictEqual(r.get('N'), k, 'a vouched key verifies');
   });
 
-  it('an equal-source key conflict is refused (first binding holds)', () => {
-    const r = new RosterKeyRegistry();
-    r.pin('N', 'K1', 'handshake');
-    assert.strictEqual(r.pin('N', 'K2', 'handshake').reason, 'conflict');
-    assert.strictEqual(r.get('N'), 'K1');
+  it('nodeId unbound, accepted invite names a key → bind pinned', () => {
+    const r = new RosterKeyRegistry(); const k = key();
+    assert.strictEqual(r.bind('N', k, 'pinned').source, 'pinned');
+    assert.strictEqual(r.get('N'), k);
   });
 
-  it('re-affirming the same key is idempotent and can upgrade the recorded source', () => {
-    const r = new RosterKeyRegistry();
-    r.pin('N', 'K', 'grant');
-    assert.strictEqual(r.pin('N', 'K', 'handshake').pinned, true);
-    assert.strictEqual(r.source('N'), 'handshake', 'same key, stronger source upgrades');
+  it('nodeId bound, same key from any source → keep, record the stronger source', () => {
+    const r = new RosterKeyRegistry(); const k = key();
+    r.bind('N', k, 'grant');
+    assert.strictEqual(r.bind('N', k, 'proven').source, 'proven', 'stronger: recorded');
+    assert.strictEqual(r.bind('N', k, 'grant').source, 'proven', 'weaker: the stronger stays');
+    assert.strictEqual(r.conflicts().length, 0);
   });
 
-  it('the anchor binding cannot be overridden by handshake or grant', () => {
-    const r = new RosterKeyRegistry({ anchor: { nodeId: 'A', publicKey: 'KA' } });
-    assert.strictEqual(r.pin('A', 'K-evil', 'handshake').reason, 'conflict');
-    assert.strictEqual(r.pin('A', 'K-evil', 'grant').reason, 'conflict');
-    assert.strictEqual(r.get('A'), 'KA');
+  for (const [first, second] of [['grant', 'proven'], ['proven', 'grant'], ['pinned', 'proven'], ['proven', 'pinned'], ['proven', 'proven'], ['grant', 'pinned']]) {
+    it(`nodeId bound (${first}), DIFFERENT key from ${second} → conflict: refused and recorded`, () => {
+      const r = new RosterKeyRegistry(); const k1 = key(); const k2 = key();
+      r.bind('N', k1, first);
+      const res = r.bind('N', k2, second);
+      assert.strictEqual(res.bound, false);
+      assert.strictEqual(res.reason, 'conflict');
+      assert.strictEqual(r.get('N'), k1, 'the first binding holds, whatever the second source');
+      assert.deepStrictEqual(r.conflicts().map((c) => [c.nodeId, c.had, c.got, c.hadSource, c.gotSource]), [['N', k1, k2, first, second]]);
+    });
+  }
+
+  it('the configured anchor is always its configured key, and is never written to the file', () => {
+    const dir = tmp();
+    try {
+      const A = key(); const evil = key();
+      const r = new RosterKeyRegistry({ anchor: { nodeId: 'A', publicKey: A }, dir });
+      assert.strictEqual(r.get('A'), A);
+      assert.strictEqual(r.source('A'), 'anchor');
+      assert.strictEqual(r.bind('A', evil, 'proven').reason, 'conflict');
+      assert.strictEqual(r.bind('A', A, 'proven').source, 'anchor');
+      assert.strictEqual(r.get('A'), A);
+      assert.ok(!lines(dir).some((l) => l.nodeId === 'A'), 'no anchor line on disk');
+    } finally { fs.rmSync(dir, { recursive: true, force: true }); }
   });
 
-  it('is Map-compatible (get/set drop-in)', () => {
-    const r = new RosterKeyRegistry();
-    r.set('N', 'K');
-    assert.strictEqual(r.get('N'), 'K');
-    assert.strictEqual(r.has('N'), true);
-    assert.strictEqual(r.size(), 1);
+  it('an anchor re-pinned out of band takes effect at the next start (nothing replays the old one)', () => {
+    const dir = tmp();
+    try {
+      const oldA = key(); const newA = key();
+      // A 0.13 file that persisted the old anchor binding.
+      fs.writeFileSync(path.join(dir, 'roster-keys.jsonl'), JSON.stringify({ nodeId: 'A', key: oldA, source: 'anchor' }) + '\n');
+      const r = new RosterKeyRegistry({ anchor: { nodeId: 'A', publicKey: newA }, dir });
+      assert.strictEqual(r.get('A'), newA);
+      assert.strictEqual(r.conflicts().length, 0, 'the old anchor line is dropped, not a conflict');
+      const again = new RosterKeyRegistry({ anchor: { nodeId: 'A', publicKey: newA }, dir });
+      assert.strictEqual(again.get('A'), newA);
+      const unanchored = new RosterKeyRegistry({ dir });
+      assert.strictEqual(unanchored.get('A'), undefined, 'without the configuration, no anchor is remembered');
+    } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+  });
+
+  it('a legacy-claim is the expected key: proven with it binds proven, proven with another is a conflict', () => {
+    const r = new RosterKeyRegistry(); const honest = key(); const squatter = key();
+    r.bind('N', honest, 'legacy-claim');
+    assert.strictEqual(r.get('N'), undefined, 'a legacy claim verifies nothing');
+    assert.strictEqual(r.expected('N'), honest);
+    assert.strictEqual(r.bind('N', squatter, 'proven').reason, 'conflict', 'a squatter racing the upgrade cannot win');
+    assert.strictEqual(r.get('N'), undefined);
+    assert.strictEqual(r.bind('N', honest, 'proven').source, 'proven', 'the honest node, whose identity file did not change, matches');
+    assert.strictEqual(r.get('N'), honest);
+  });
+
+  it('an invite against an existing binding pins nothing: the operator resolves it', () => {
+    const r = new RosterKeyRegistry(); const bound = key(); const invited = key();
+    r.bind('N', bound, 'proven');
+    assert.strictEqual(r.bind('N', invited, 'pinned').reason, 'conflict');
+    assert.strictEqual(r.get('N'), bound);
+    assert.deepStrictEqual(r.resolveConflict('N', invited), { resolved: true });
+    assert.strictEqual(r.get('N'), invited);
+    assert.strictEqual(r.source('N'), 'pinned');
+    assert.strictEqual(r.conflicts().length, 0, 'resolved conflicts are cleared');
   });
+});
 
-  it('persists bindings append-only and reloads across a restart', () => {
-    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'rk-'));
+describe('persistence and the 0.13 file', () => {
+  it('bindings, conflicts and floor resets reload; the file carries a version marker', () => {
+    const dir = tmp();
     try {
-      const r1 = new RosterKeyRegistry({ anchor: { nodeId: 'A', publicKey: 'KA' }, dir });
-      r1.pin('N', 'KN', 'handshake');
-      const r2 = new RosterKeyRegistry({ anchor: { nodeId: 'A', publicKey: 'KA' }, dir });
-      assert.strictEqual(r2.get('N'), 'KN');
-      assert.strictEqual(r2.source('N'), 'handshake', 'reloaded at full strength');
-      assert.strictEqual(r2.get('A'), 'KA');
+      const k = key(); const k2 = key();
+      const r1 = new RosterKeyRegistry({ dir });
+      r1.bind('N', k, 'proven');
+      r1.bind('N', k2, 'grant');
+      r1.bind('M', key(), 'proven');
+      r1.resetFloor('M');
+      assert.deepStrictEqual(lines(dir)[0], { ...FORMAT_MARKER });
+      const r2 = new RosterKeyRegistry({ dir });
+      assert.strictEqual(r2.get('N'), k);
+      assert.strictEqual(r2.source('N'), 'proven');
+      assert.strictEqual(r2.conflicts().length, 1);
+      assert.strictEqual(r2.floor('N'), true, 'the sticky floor is derived from the persisted proven binding');
+      assert.strictEqual(r2.floor('M'), false, 'and an operator reset survives too');
     } finally { fs.rmSync(dir, { recursive: true, force: true }); }
   });
+
+  it('a 0.13 file is migrated once: handshake → legacy-claim, grant kept, anchor dropped; idempotent', () => {
+    const dir = tmp();
+    try {
+      const h = key(); const g = key(); const a = key(); const later = key();
+      const old = [
+        { nodeId: 'H', key: h, source: 'handshake' },
+        { nodeId: 'G', key: g, source: 'grant' },
+        { nodeId: 'G', key: later, source: 'handshake' },   // 0.13: a handshake overrode the grant
+        { nodeId: 'A', key: a, source: 'anchor' },
+        { nodeId: 'X', key: 'not-a-key', source: 'handshake' },
+      ];
+      fs.writeFileSync(path.join(dir, 'roster-keys.jsonl'), old.map((o) => JSON.stringify(o)).join('\n') + '\n');
+      const r = new RosterKeyRegistry({ dir });
+      assert.deepStrictEqual(r.migration(), { read: 5, bindings: 2, legacyClaim: 2, grant: 0, droppedAnchor: 1, droppedMalformed: 1 });
+      assert.strictEqual(r.source('H'), 'legacy-claim');
+      assert.strictEqual(r.expected('G'), later, 'the binding 0.13 used is the one kept');
+      assert.strictEqual(r.source('G'), 'legacy-claim');
+      assert.strictEqual(r.get('H'), undefined);
+      const file = lines(dir);
+      assert.deepStrictEqual(file[0], { ...FORMAT_MARKER });
+      assert.strictEqual(file.length, 3);
+      const again = new RosterKeyRegistry({ dir });
+      assert.strictEqual(again.migration(), null, 'a marked file is not migrated again');
+      assert.strictEqual(again.source('H'), 'legacy-claim');
+      assert.strictEqual(lines(dir).length, 3);
+    } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+  });
+
+  it('a 0.13 rollback reads the migrated file (it skips the marker) and its appends are relabelled on return', () => {
+    const dir = tmp();
+    try {
+      const h = key(); const n = key();
+      fs.writeFileSync(path.join(dir, 'roster-keys.jsonl'), JSON.stringify({ nodeId: 'H', key: h, source: 'handshake' }) + '\n');
+      new RosterKeyRegistry({ dir });
+      // What a 0.13 reader does with each line: JSON.parse, then pin(r.nodeId, r.key, r.source).
+      const read013 = lines(dir).filter((r) => r.nodeId && r.key);
+      assert.deepStrictEqual(read013.map((r) => r.nodeId), ['H'], 'the marker has no nodeId: 0.13 skips it as malformed');
+      // The rollback appends a handshake line of its own; 0.14 reads it as a legacy claim.
+      fs.appendFileSync(path.join(dir, 'roster-keys.jsonl'), JSON.stringify({ nodeId: 'R', key: n, source: 'handshake' }) + '\n');
+      const back = new RosterKeyRegistry({ dir });
+      assert.strictEqual(back.source('R'), 'legacy-claim');
+      assert.strictEqual(back.get('R'), undefined);
+    } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+  });
+
+  it('a malformed binding is refused, not stored', () => {
+    const r = new RosterKeyRegistry();
+    for (const [id, k, s] of [['', key(), 'proven'], ['N', 'short', 'proven'], ['N', { x: 1 }, 'proven'], ['N', key(), 'anchor'], ['N', key(), 'handshake']]) {
+      assert.strictEqual(r.bind(id, k, s).reason, 'malformed');
+    }
+    assert.strictEqual(r.size(), 0);
+  });
 });
diff --git a/tests/send-frame-dead-socket.test.js b/tests/send-frame-dead-socket.test.js
index 9c3b523b..955debfe 100644
--- a/tests/send-frame-dead-socket.test.js
+++ b/tests/send-frame-dead-socket.test.js
@@ -83,10 +83,13 @@ describe('a send that is not made says why (0.14.0 review B-F6)', () => {
       node.on('metric', (m) => metrics.push(m));
       // A connected peer whose transport refuses the frame as too large (a frame from a record the
       // bounds did not see, or a long relay envelope), and one whose transport only says whether.
-      const tooLarge = { on: () => {}, close: () => {}, send: () => false, trySend: () => ({ ok: false, reason: SEND_FAILURE.TOO_LARGE, bytes: MAX_FRAME_SIZE + 1 }) };
-      const opaque = { on: () => {}, close: () => {}, send: () => false };
-      node._addPeer(node._createPeer(tooLarge, 'peer-LARGE000', 'peer-large', false, 'bonjour'));
-      node._addPeer(node._createPeer(opaque, 'peer-OPAQUE00', 'peer-opaque', false, 'bonjour'));
+      // (Admitted sessions, as a confirmed handshake leaves them; their sends are made to fail.)
+      const { admitAs } = require('./_core-secure');
+      const tooLarge = admitAs(node, { nodeId: 'peer-LARGE000', name: 'peer-large' });
+      tooLarge.trySend = () => ({ ok: false, reason: SEND_FAILURE.TOO_LARGE, bytes: MAX_FRAME_SIZE + 1 });
+      const opaque = admitAs(node, { nodeId: 'peer-OPAQUE00', name: 'peer-opaque' });
+      delete opaque.trySend;
+      opaque.send = () => false;
 
       const a = node.remember({ focus: 'a directed send the transport refuses as too large' }, { to: 'peer-LARGE000' });
       assert.strictEqual(a.delivery.undelivered, true);
diff --git a/tests/stored-entry-annotations.test.js b/tests/stored-entry-annotations.test.js
index c60e7a7c..7d8a720c 100644
--- a/tests/stored-entry-annotations.test.js
+++ b/tests/stored-entry-annotations.test.js
@@ -28,6 +28,7 @@ const { nodeDir } = require('../lib/config');
 const { tmpdir } = require('./_tmpdir');
 const { MemoryStore } = require('../lib/memory-store');
 const { createCMB, signCMB, verifyCMB, verifyAttestation, verifyTetherAttestation, recordAsSigned } = require('../lib/core');
+const { identity, signedRecord, admitAs, applicationFor } = require('./_core-secure');
 
 const ALIGNED = { decision: 'aligned', total_drift: 0.1, category_drifts: { focus: 0.1 }, gate_values: { focus: 1 } };
 
@@ -39,6 +40,8 @@ function rawKeypair() {
   return { pub: publicKey.slice(-32).toString('base64url'), priv: privateKey.slice(-32).toString('base64url') };
 }
 const AUTHOR = rawKeypair();
+// The Core Secure author: a v2.0 record names its author by node id (sym 0.14).
+const PEER = identity('peerA');
 
 function cat7(t) {
   return {
@@ -64,21 +67,20 @@ describe('admission annotations live on the store entry', () => {
     it(`${path_} path: the stored record is exactly {categories, metadata}; the entry carries the rest`, async () => {
       const opts = path_ === 'neural' ? { svafEvaluator: { evaluate: async () => ALIGNED } } : {};
       await withNode(opts, async (node) => {
-        node._pinPeerKey('peerA', AUTHOR.pub);
-        const record = createCMB({ categories: cat7(`an observation admitted through the ${path_} path`), createdBy: 'peerA' });
-        signCMB(record, AUTHOR.priv);
+        const session = admitAs(node, PEER);
+        const record = signedRecord(PEER, { categories: cat7(`an observation admitted through the ${path_} path`) });
         // A frame that also tries to supply the node's own annotations.
         const frame = {
           type: 'cmb', timestamp: Date.now(), cmb: JSON.parse(JSON.stringify(record)),
           admission: { forged: true }, provenance: { forged: true }, tether: { forged: true }, collapsed: 'forged', svaf: { forged: true },
         };
-        await node._frameHandler._handleMemoryShare('peerA', 'peerA', frame);
+        await node._frameHandler._handleMemoryShare(PEER.nodeId, PEER.name, frame, session);
 
         const entry = node._store.get(record.metadata.key);
         assert.ok(entry, 'admitted and stored');
         assert.strictEqual(entry.svaf?.method === 'neural', path_ === 'neural', 'precondition: the intended path stored it');
         assert.deepStrictEqual(Object.keys(entry.cmb).sort(), ['categories', 'metadata'], 'the record has exactly its two sections');
-        assert.strictEqual(verifyCMB(entry.cmb, AUTHOR.pub).valid, true, 'and still verifies under its author\'s key');
+        assert.strictEqual(verifyCMB(entry.cmb, PEER.publicKey).valid, true, 'and still verifies under its author\'s key');
         const onDisk = JSON.parse(fs.readFileSync(path.join(node._store._dir, `${entry.key}.json`), 'utf8'));
         assert.deepStrictEqual(Object.keys(onDisk.cmb).sort(), ['categories', 'metadata'], 'on disk too');
 
@@ -130,30 +132,31 @@ describe('admission annotations live on the store entry', () => {
     it(`${path_} path: a payload the author sent is stored beside the signed sections, which stay as signed`, async () => {
       const opts = path_ === 'neural' ? { svafEvaluator: { evaluate: async () => ALIGNED } } : {};
       await withNode(opts, async (node) => {
-        node._pinPeerKey('peerA', AUTHOR.pub);
-        const record = createCMB({ categories: cat7(`an llm-request admitted through the ${path_} path`), createdBy: 'peerA' });
-        signCMB(record, AUTHOR.priv);
+        const session = admitAs(node, PEER);
         const payload = { kind: 'llm-request', request_id: `r-${path_}`, prompt: 'say hello' };
-        const sent = JSON.parse(JSON.stringify({ ...record, payload }));
-        await node._frameHandler._handleMemoryShare('peerA', 'peerA', { type: 'cmb', timestamp: Date.now(), cmb: sent });
+        // Since 0.14 the payload is the record's signed application section (§8.8.3).
+        const application = applicationFor(Buffer.from(JSON.stringify(payload)), { schema: 'https://sym.bot/schema/payload-v1.json' });
+        const record = signedRecord(PEER, { categories: cat7(`an llm-request admitted through the ${path_} path`), application });
+        await node._frameHandler._handleMemoryShare(PEER.nodeId, PEER.name, { type: 'cmb', timestamp: Date.now(), cmb: JSON.parse(JSON.stringify(record)) }, session);
 
         const entry = node._store.get(record.metadata.key);
         assert.ok(entry, 'admitted and stored');
-        assert.deepStrictEqual(Object.keys(entry.cmb).sort(), ['categories', 'metadata', 'payload'], 'the two sections and the author\'s payload, nothing this node computed');
+        assert.deepStrictEqual(Object.keys(entry.cmb).sort(), ['categories', 'metadata', 'payload'], 'the two sections and the payload decoded from the signed section, nothing this node computed');
         assert.deepStrictEqual(entry.cmb.payload, payload, 'the payload as sent');
         const { payload: _p, ...sections } = entry.cmb;
         assert.deepStrictEqual(sections, recordAsSigned(record), 'the signed sections exactly as signed');
-        assert.strictEqual(verifyCMB(entry.cmb, AUTHOR.pub).valid, true, 'and they verify');
+        assert.strictEqual(verifyCMB(entry.cmb, PEER.publicKey).valid, true, 'and they verify');
         assert.deepStrictEqual(node.inboxGet(entry.inboxId)?.payload, payload, 'the inbox delivers it');
 
-        // What another node fetching this key gets, and re-verifies: the two sections.
-        const served = [];
-        const transport = { send: (f) => served.push(f), close: () => {} };
-        node._peers.set('peer-fetch', { peerId: 'peer-fetch', name: 'fetcher', transport, transports: new Map([['bonjour', transport]]), source: 'bonjour', lastSeen: Date.now() });
-        node._frameHandler._handleCmbFetch('peer-fetch', 'fetcher', { type: 'cmb-fetch', key: record.metadata.key, reqId: 'q1' });
-        const got = served.find((f) => f.type === 'cmb-fetch-result')?.cmb;
+        // What another node fetching this key gets, and re-verifies: the two sections, as their own
+        // sealed record frame, then the result with the key lists only (design D1).
+        const fetcher = admitAs(node, identity('fetcher'));
+        node._frameHandler._handleCmbFetch(fetcher.nodeId, 'fetcher', { type: 'cmb-fetch', key: record.metadata.key, reqId: 'q1' }, fetcher);
+        const header = fetcher.sent.find((f) => f.type === 'cmb-fetch-result');
+        assert.deepStrictEqual([header.found, header.notFound, 'cmb' in header], [[record.metadata.key], [], false], 'the result carries no record');
+        const got = fetcher.sent.find((f) => f.type === 'cmb')?.cmb;
         assert.deepStrictEqual(Object.keys(got).sort(), ['categories', 'metadata']);
-        assert.strictEqual(verifyCMB(got, AUTHOR.pub).valid, true, 'the served copy re-verifies');
+        assert.strictEqual(verifyCMB(got, PEER.publicKey).valid, true, 'the served copy re-verifies');
       });
     });
   }
diff --git a/tests/v2-author-binding.test.js b/tests/v2-author-binding.test.js
index 9edc3411..0bb52f27 100644
--- a/tests/v2-author-binding.test.js
+++ b/tests/v2-author-binding.test.js
@@ -23,6 +23,7 @@ const { NullDiscovery } = require('../lib/discovery');
 const { nodeDir } = require('../lib/config');
 const { createCMB, signCMB, assertionIdV2_0 } = require('../lib/core');
 const { settle } = require('./_settle'); // waits for every in-flight frame, not a fixed guess
+const { admitAs } = require('./_core-secure');
 
 function kp() {
   const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519', {
@@ -42,9 +43,9 @@ function v2Record({ nodeId, createdBy, signWith, focus = 'v2 observation', room
 function withNode(fn) {
   const name = `v2bind-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
   const node = new SymNode({ name, silent: true, discovery: new NullDiscovery() });
-  node._pinPeerKey('node-alice', ALICE.pub);
-  node._pinPeerKey('node-mallory', MALLORY.pub);
-  node._pinPeerKey('node-relay', RELAY.pub);
+  node._roster.bind('node-alice', ALICE.pub, 'proven');
+  node._roster.bind('node-mallory', MALLORY.pub, 'proven');
+  node._roster.bind('node-relay', RELAY.pub, 'proven');
   try { return fn(node); } finally { fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
 }
 
@@ -64,12 +65,15 @@ describe('v2.0 author binding (B-R4)', () => {
     });
   });
 
-  it('an author whose key this node does not hold yet is unverified, not refused', () => {
+  it('an author whose key this node does not hold is REFUSED in Core Secure (§18.3.1; release note M12)', () => {
     withNode((node) => {
       const stranger = kp();
+      const metrics = [];
+      node.on('metric', (m) => metrics.push(m));
       const msg = { cmb: v2Record({ nodeId: 'node-stranger', createdBy: 'stranger', signWith: stranger }) };
-      assert.strictEqual(node._frameHandler._rejectOnBadSignature('node-relay', 'relay', msg), false);
+      assert.strictEqual(node._frameHandler._rejectOnBadSignature('node-relay', 'relay', msg), true);
       assert.strictEqual(msg._cmbVerified, false);
+      assert.ok(metrics.some((m) => m.type === 'cmb-author-unresolvable' && m.author === 'node-stranger'));
     });
   });
 });
@@ -83,15 +87,16 @@ describe('assertionId (B-R6)', () => {
     });
   });
 
-  it('on an older-suite record, a carried assertionId (which nothing signs) is dropped', () => {
+  it('an older-suite record does not enter Core Secure at all (§18.3.1)', () => {
     withNode((node) => {
+      const metrics = [];
+      node.on('metric', (m) => metrics.push(m));
       const cmb = createCMB({ categories: { focus: 'old suite' }, createdBy: 'alice', room: 'default' });
       signCMB(cmb, ALICE.priv);
       cmb.metadata.assertionId = 'asrt-' + '1'.repeat(64);
-      const msg = { cmb };
-      assert.strictEqual(node._frameHandler._rejectOnBadSignature('node-alice', 'alice', msg), false);
-      assert.strictEqual(msg._cmbVerified, true);
-      assert.strictEqual('assertionId' in msg.cmb.metadata, false);
+      assert.strictEqual(node._frameHandler._rejectOnBadSignature('node-alice', 'alice', { cmb }), true);
+      assert.ok(metrics.some((m) => m.type === 'cmb-legacy-suite-refused'), 'counted on its own metric');
+      assert.ok(!metrics.some((m) => m.type === 'cmb-signature-rejected'), 'and never as a forgery (P-6)');
     });
   });
 });
@@ -102,12 +107,12 @@ describe('the inbox names a proven author (K5)', () => {
     const node = new SymNode({ name, silent: true, discovery: new NullDiscovery() });
     await node.start();
     try {
-      node._pinPeerKey('node-alice', ALICE.pub);
-      node._pinPeerKey('node-relay', RELAY.pub);
+      node._roster.bind('node-alice', ALICE.pub, 'proven');
+      const relay = admitAs(node, { nodeId: 'node-relay', name: 'relay', publicKey: RELAY.pub });
       node._svafEvaluator.evaluate = async () => ({ decision: 'aligned', total_drift: 0.1, category_drifts: { focus: 0.1 }, gate_values: { g: 1 } });
       const got = [];
       node.on('cmb-accepted', (e) => got.push(e));
-      node._frameHandler.handle('node-relay', 'relay', { type: 'cmb', timestamp: Date.now(), cmb: v2Record({ nodeId: 'node-alice', createdBy: 'alice', signWith: ALICE, focus: 'relayed but proven' }) });
+      node._frameHandler.handle(relay, { type: 'cmb', timestamp: Date.now(), cmb: v2Record({ nodeId: 'node-alice', createdBy: 'alice', signWith: ALICE, focus: 'relayed but proven' }) });
       await settle();
       assert.strictEqual(got.length, 1);
       assert.strictEqual(got[0].author.nodeId, 'node-alice');
@@ -142,10 +147,11 @@ describe('a malformed v2.0 frame is refused, never thrown (0.14.0 review F1)', (
       const metrics = [];
       node.on('metric', (m) => metrics.push(m));
       // Through the node's one guarded dispatch (0.13.17), which every transport calls.
-      assert.doesNotThrow(() => node._receiveFrame('node-alice', 'alice', { type: 'cmb', cmb: malformed() }, 'relay'));
+      const alice = admitAs(node, { nodeId: 'node-alice', name: 'alice', publicKey: ALICE.pub });
+      assert.doesNotThrow(() => node._receiveSessionFrame(alice, { type: 'cmb', cmb: malformed() }));
       const original = node._frameHandler._handleMemoryShare;
       node._frameHandler._handleMemoryShare = () => { throw new Error('boom'); };
-      assert.doesNotThrow(() => node._receiveFrame('node-alice', 'alice', { type: 'cmb', cmb: malformed() }, 'relay'));
+      assert.doesNotThrow(() => node._receiveSessionFrame(alice, { type: 'cmb', cmb: malformed() }));
       node._frameHandler._handleMemoryShare = original;
       assert.ok(metrics.some((m) => m.type === 'frame-handler-error' && /boom/.test(m.error)));
     });
@@ -166,15 +172,15 @@ describe('the audience a record signs is checked on every suite (0.14.0 review C
     const node = new SymNode({ name, silent: true, discovery: new NullDiscovery() });
     await node.start();
     try {
-      node._pinPeerKey('node-alice', ALICE.pub);
-      node._pinPeerKey('node-relay', RELAY.pub);
+      node._roster.bind('node-alice', ALICE.pub, 'proven');
+      const relay = admitAs(node, { nodeId: 'node-relay', name: 'relay', publicKey: RELAY.pub });
       node._svafEvaluator.evaluate = async () => ({ decision: 'aligned', total_drift: 0.1, category_drifts: { focus: 0.1 }, gate_values: { g: 1 } });
       const c = capture(node);
       const got = [];
       node.on('cmb-accepted', (e) => got.push(e));
       // Alice signs a record for Bob; a relay hands it to this node, which holds Alice's key.
       const forBob = v2Record({ nodeId: 'node-alice', createdBy: 'alice', signWith: ALICE, focus: 'meant for bob only', to: 'node-bob' });
-      node._frameHandler.handle('node-relay', 'relay', { type: 'cmb', timestamp: Date.now(), cmb: forBob });
+      node._frameHandler.handle(relay, { type: 'cmb', timestamp: Date.now(), cmb: forBob });
       await settle();
       assert.strictEqual(got.length, 0, 'not surfaced');
       assert.strictEqual(node._store.get(forBob.metadata.key), null, 'not stored');
@@ -182,7 +188,7 @@ describe('the audience a record signs is checked on every suite (0.14.0 review C
 
       // The same author's record for THIS node is admitted, so the refusal is the audience's.
       const forMe = v2Record({ nodeId: 'node-alice', createdBy: 'alice', signWith: ALICE, focus: 'meant for this node', to: node.nodeId });
-      node._frameHandler.handle('node-relay', 'relay', { type: 'cmb', timestamp: Date.now(), cmb: forMe });
+      node._frameHandler.handle(relay, { type: 'cmb', timestamp: Date.now(), cmb: forMe });
       await settle();
       assert.strictEqual(got.length, 1, 'a record addressed here is surfaced');
     } finally { await node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
@@ -197,26 +203,13 @@ describe('the audience a record signs is checked on every suite (0.14.0 review C
     });
   });
 
-  it('an older-suite record verified against its author on relay is checked too', () => {
-    withNode((node) => {
-      node._pinPeerKey('alice', ALICE.pub); // the relayed arm resolves the author by its label
-      const c = capture(node);
-      const cmb = createCMB({ categories: { focus: 'older suite, for bob' }, createdBy: 'alice', room: 'default', to: 'node-bob' });
-      signCMB(cmb, ALICE.priv);
-      const msg = { cmb };
-      assert.strictEqual(node._frameHandler._rejectOnBadSignature('node-relay', 'relay', msg), true);
-      assert.strictEqual(msg._cmbVerified, true, 'precondition: it verified against its author');
-      assert.deepStrictEqual(c.refused().map((m) => m.reason), ['wrong-recipient']);
-    });
-  });
-
-  it('a record whose author key is not held is refused for its audience all the same', () => {
+  it('a record whose author key is not held is refused before its audience is read', () => {
     withNode((node) => {
       const c = capture(node);
       const stranger = kp();
       const msg = { cmb: v2Record({ nodeId: 'node-stranger', createdBy: 'stranger', signWith: stranger, to: 'node-bob' }) };
       assert.strictEqual(node._frameHandler._rejectOnBadSignature('node-relay', 'relay', msg), true);
-      assert.deepStrictEqual(c.refused().map((m) => [m.reason, m.verified]), [['wrong-recipient', false]]);
+      assert.ok(c.metrics.some((m) => m.type === 'cmb-signature-rejected' && m.reason === 'unresolvable-author'));
     });
   });
 
diff --git a/tests/wake-channels.test.js b/tests/wake-channels.test.js
index c305c8af..fea5a563 100644
--- a/tests/wake-channels.test.js
+++ b/tests/wake-channels.test.js
@@ -3,10 +3,10 @@
 require('./_isolate-home'); // redirect $HOME to a temp sandbox before lib/config loads
 
 /**
- * Wake channels: learned from the peer itself, the relay's list, or another peer's `peer-info`
- * gossip, which nothing authenticates. Every peer re-sends its whole list on every connect, so a
- * repeat must change nothing and log nothing; gossip must never repoint a phone's own token; and a
- * channel nobody has seen first-hand ages out however often it is forwarded.
+ * Wake channels (Core Secure, design D1): learned ONLY for a confirmed session's own nodeId — its
+ * `wake-channel` frame, or the entry naming itself in its `peer-info` — and so at 'direct'. What a
+ * peer says about other nodes, and the relay's peer list, are hints, never stored. The WakeManager's
+ * ranking, TTL and bounds (tested below at its own level) still hold for what is stored.
  */
 
 const { describe, it } = require('node:test');
@@ -16,6 +16,7 @@ const { SymNode } = require('../lib/node');
 const { NullDiscovery } = require('../lib/discovery');
 const { nodeDir } = require('../lib/config');
 const { WAKE_CHANNEL_TTL_MS } = require('../lib/core/wake');
+const { admitAs } = require('./_core-secure');
 
 const DAY = 24 * 60 * 60 * 1000;
 const apns = (token) => ({ platform: 'apns', token, environment: 'sandbox' });
@@ -32,29 +33,30 @@ function withNode(fn) {
   try { return fn(node, { lines, writes: () => writes }); } finally { fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
 }
 
-describe('peer-info gossip', () => {
-  it('learns new channels with one line per frame, and a repeat of the same list is silent', () => {
+describe('peer-info', () => {
+  it('learns only the entry naming the sender itself; entries about other nodes are hints, never stored', () => {
     withNode((node, io) => {
       const now = Date.now();
+      const sender = admitAs(node, { nodeId: 'phone-1', name: 'melotune' });
       const frame = { type: 'peer-info', peers: [
-        { nodeId: 'phone-1', name: 'unknown', wakeChannel: apns('t1'), lastSeen: now - 1000 },
+        { nodeId: 'phone-1', name: 'melotune', wakeChannel: apns('t1'), lastSeen: now - 1000 },
         { nodeId: 'phone-2', name: 'unknown', wakeChannel: apns('t2'), lastSeen: now - 2000 },
       ] };
-      node._frameHandler._handlePeerInfo('peer-x', 'xmesh', frame);
-      assert.deepStrictEqual(io.lines.filter((l) => /Gossip/.test(l)), ['Gossip from xmesh: learned 2 wake channel(s)']);
+      node._frameHandler.handle(sender, frame);
+      assert.deepStrictEqual([...node._peerWakeChannels.keys()], ['phone-1']);
+      assert.strictEqual(node._peerWakeChannels.get('phone-1').source, 'direct');
       assert.strictEqual(io.writes(), 1);
-      for (let i = 0; i < 50; i++) node._frameHandler._handlePeerInfo('peer-x', 'xmesh', frame);
-      assert.strictEqual(io.lines.filter((l) => /Gossip/.test(l)).length, 1, 'a reconnect storm logs nothing more');
-      assert.strictEqual(io.writes(), 1, 'and writes nothing more');
-      assert.strictEqual(node._peerWakeChannels.get('phone-1').lastSeen, now - 1000, 'lastSeen is the sighting the frame carried');
+      for (let i = 0; i < 50; i++) node._frameHandler.handle(sender, frame);
+      assert.strictEqual(io.writes(), 1, 'a reconnect storm writes nothing more');
     });
   });
 
-  it('never replaces a token the phone gave us itself over a session that proved its key', () => {
+  it('never replaces a token the phone gave us itself, whatever another peer says', () => {
     withNode((node) => {
-      node._peerKeyProven = (id) => id === 'phone-1';
-      node._frameHandler._handleWakeChannel('phone-1', 'melotune', apns('own-token'));
-      node._frameHandler._handlePeerInfo('peer-x', 'mallory', { peers: [{ nodeId: 'phone-1', wakeChannel: apns('attacker'), lastSeen: Date.now() }] });
+      const phone = admitAs(node, { nodeId: 'phone-1', name: 'melotune' });
+      node._frameHandler.handle(phone, { type: 'wake-channel', ...apns('own-token') });
+      const mallory = admitAs(node, { nodeId: 'peer-x', name: 'mallory' });
+      node._frameHandler.handle(mallory, { type: 'peer-info', peers: [{ nodeId: 'phone-1', wakeChannel: apns('attacker'), lastSeen: Date.now() }] });
       assert.strictEqual(node._peerWakeChannels.get('phone-1').token, 'own-token');
       assert.strictEqual(node._peerWakeChannels.get('phone-1').source, 'direct');
     });
@@ -138,62 +140,45 @@ describe('gossip sent and expiry', () => {
 });
 
 describe('relay peer list', () => {
-  it('learns from the relay with one line per list, silent on a repeat', () => {
+  it('is a hint: the channels it names (other nodes, from the relay) are never stored', () => {
     withNode((node, io) => {
-      const relayLines = [];
-      node._relay._log = (m) => relayLines.push(m);
       node._relay._setPhase = () => {};
-      const list = { type: 'relay-peers', peers: [
+      node._relay._handleRelayPeerJoined = () => {};
+      node._relay._handleRelayPeers({ type: 'relay-peers', peers: [
         { nodeId: 'phone-1', name: 'melotune', wakeChannel: apns('r1'), offline: true },
         { nodeId: 'phone-2', name: 'melomove', wakeChannel: apns('r2'), offline: true },
-      ] };
-      node._relay._handleRelayPeers(list);
-      node._relay._handleRelayPeers(list);
-      assert.deepStrictEqual(relayLines.filter((l) => /wake channel/.test(l)), ['Relay: learned 2 wake channel(s)']);
-      assert.strictEqual(io.writes(), 1, 'one write for the first list, none for the repeat');
-      assert.strictEqual(node._peerWakeChannels.get('phone-1').source, 'relay');
-    });
-  });
-
-  it('a gossiped token cannot repoint a channel the relay holds', () => {
-    withNode((node) => {
-      node._relay._learnWakeChannel('phone-1', apns('relay-token'), { source: 'relay' });
-      node._frameHandler._handlePeerInfo('peer-x', 'mallory', { peers: [{ nodeId: 'phone-1', wakeChannel: apns('attacker'), lastSeen: Date.now() }] });
-      assert.strictEqual(node._peerWakeChannels.get('phone-1').token, 'relay-token');
+      ] });
+      assert.strictEqual(node._peerWakeChannels.size, 0);
+      assert.strictEqual(io.writes(), 0);
     });
   });
 });
 
 describe('0.14.0 review F2/F3', () => {
-  it('a channel kept by 0.13.14 (no source) is not repointed by gossip, and the relay or the phone still can', () => {
+  it('a channel kept by 0.13.14 (no source) is not repointed by another peer\'s word, and the phone itself still can', () => {
     withNode((node) => {
       const wm = node._wakeManager;
       fs.mkdirSync(require('path').dirname(wm._wakeChannelsFile), { recursive: true });
       fs.writeFileSync(wm._wakeChannelsFile, JSON.stringify({ 'phone-1': apns('phones-own') }));
       wm.loadWakeChannels();
-      // A minute later, so the gossip is strictly newer than the load (the old ranking let it through).
       const later = Date.now() + 60_000;
       wm._now = () => later;
-      node._frameHandler.handle('peer-x', 'peer-x', { type: 'peer-info', peers: [{ nodeId: 'phone-1', wakeChannel: apns('ATTACKER'), lastSeen: later }] });
-      assert.strictEqual(wm._peerWakeChannels.get('phone-1').token, 'phones-own', 'gossip cannot repoint it');
-      assert.strictEqual(wm.learnWakeChannel('phone-1', apns('re-registered'), { source: 'relay' }), 'updated', 'the relay can');
-      assert.strictEqual(wm.learnWakeChannel('phone-1', apns('again'), { source: 'direct' }), 'updated', 'the phone can');
+      node._frameHandler.handle(admitAs(node, { nodeId: 'peer-x' }), { type: 'peer-info', peers: [{ nodeId: 'phone-1', wakeChannel: apns('ATTACKER'), lastSeen: later }] });
+      assert.strictEqual(wm._peerWakeChannels.get('phone-1').token, 'phones-own', 'another peer cannot repoint it');
+      node._frameHandler.handle(admitAs(node, { nodeId: 'phone-1' }), { type: 'wake-channel', ...apns('again') });
+      assert.strictEqual(wm._peerWakeChannels.get('phone-1').token, 'again', 'the phone can');
     });
   });
 
-  it('fabricated gossip is bounded: one frame reads at most 256 entries, and the map holds at most its cap', () => {
-    withNode((node, io) => {
+  it('fabricated gossip stores nothing at all, however large the frame', () => {
+    withNode((node) => {
       const wm = node._wakeManager;
-      wm._maxChannels = 300;
       wm.learnWakeChannel('real-phone', apns('own'), { source: 'direct' });
       const now = Date.now();
-      const flood = (from) => ({ type: 'peer-info', peers: Array.from({ length: 2000 }, (_, i) => ({ nodeId: `fake-${from}-${i}`, wakeChannel: apns(`f${i}`), lastSeen: now })) });
-      node._frameHandler.handle('peer-x', 'peer-x', flood('a'));
-      assert.strictEqual(wm._peerWakeChannels.size, 1 + 256, 'the first 256 entries of one frame');
-      assert.ok(io.lines.some((l) => /2000 entries, reading the first 256/.test(l)));
-      node._frameHandler.handle('peer-x', 'peer-x', flood('b'));
-      assert.strictEqual(wm._peerWakeChannels.size, 300, 'never past the cap');
-      assert.strictEqual(wm._peerWakeChannels.get('real-phone').token, 'own', 'gossip only displaces gossip');
+      const flood = { type: 'peer-info', peers: Array.from({ length: 2000 }, (_, i) => ({ nodeId: `fake-${i}`, wakeChannel: apns(`f${i}`), lastSeen: now })) };
+      node._frameHandler.handle(admitAs(node, { nodeId: 'peer-x' }), flood);
+      assert.strictEqual(wm._peerWakeChannels.size, 1);
+      assert.strictEqual(wm._peerWakeChannels.get('real-phone').token, 'own');
     });
   });
 
@@ -214,55 +199,33 @@ describe('0.14.0 review F2/F3', () => {
 
 // 0.14.0 release review, part B (F2-F4, F7, F8, F10, F12).
 describe('0.14.0 release review B: who may set a wake channel', () => {
-  it("a wake-channel frame from a session that proved nothing is trusted as gossip, never over the phone's own (F2)", () => {
+  it('a wake-channel frame is the session\'s own: it sets the proven peer\'s channel at the top rank (F2)', () => {
     withNode((node) => {
       const wm = node._wakeManager;
-      // The phone registered its channel through the relay (its own authenticated session).
-      wm.learnWakeChannel('phone-1', apns('phones-own'), { source: 'relay' });
-      // Mallory handshakes claiming the phone's nodeId and sends its own token.
-      node._frameHandler.handle('phone-1', 'mallory', { type: 'wake-channel', platform: 'apns', token: 'MALLORY', environment: 'sandbox' });
-      assert.strictEqual(node._peerWakeChannels.get('phone-1').token, 'phones-own', 'an unproven claim cannot repoint it');
-      // A channel only an unproven frame gave is held at the lowest rank: it repoints nothing above it.
-      node._frameHandler.handle('phone-2', 'phone-2', { type: 'wake-channel', platform: 'apns', token: 'p2', environment: 'sandbox' });
-      assert.strictEqual(node._peerWakeChannels.get('phone-2').source, 'unproven');
-      // A session that proved the key is the peer itself: top rank.
-      node._peerKeyProven = (id) => id === 'phone-1';
-      node._frameHandler.handle('phone-1', 'phone-1', { type: 'wake-channel', platform: 'apns', token: 'rotated', environment: 'sandbox' });
+      wm.learnWakeChannel('phone-1', apns('older'), { source: 'relay' });
+      node._frameHandler.handle(admitAs(node, { nodeId: 'phone-1' }), { type: 'wake-channel', platform: 'apns', token: 'rotated', environment: 'sandbox' });
       assert.deepStrictEqual([node._peerWakeChannels.get('phone-1').token, node._peerWakeChannels.get('phone-1').source], ['rotated', 'direct']);
     });
   });
 
-  it('this runtime proves no peer key at handshake, and a handshake cannot claim it did', () => {
+  it('an admitted Core Secure session has proved its key; nothing else has', () => {
     withNode((node) => {
       assert.strictEqual(node._peerKeyProven('anyone'), false);
-      const msg = { type: 'handshake', nodeId: 'x', name: 'x', publicKey: 'k', provenPublicKey: 'k' };
-      let seen = null;
-      node._roomAdmission = (peerId, m) => { seen = { ...m }; return { admit: true }; };
-      node._frameHandler.handle('x', 'x', msg);
-      assert.ok(seen, 'the admission check ran');
-      assert.strictEqual('provenPublicKey' in seen, false, 'a peer-supplied proof claim never reaches it');
     });
   });
 
-  it("a peer turns its own channel off with platform 'none'; gossip cannot turn off anyone's (F3)", () => {
+  it("a peer turns its own channel off with platform 'none'; another peer cannot turn off anyone's (F3)", () => {
     withNode((node, io) => {
-      const wm = node._wakeManager;
-      node._frameHandler.handle('phone-1', 'phone-1', { type: 'wake-channel', platform: 'apns', token: 't1', environment: 'sandbox' });
-      wm.learnWakeChannel('phone-2', apns('t2'), { source: 'relay' });
+      const phone = admitAs(node, { nodeId: 'phone-1' });
+      node._frameHandler.handle(phone, { type: 'wake-channel', platform: 'apns', token: 't1', environment: 'sandbox' });
       const before = io.writes();
-      node._frameHandler.handle('peer-x', 'mallory', { type: 'peer-info', peers: [{ nodeId: 'phone-1', wakeChannel: { platform: 'none' }, lastSeen: Date.now() }] });
-      assert.ok(node._peerWakeChannels.has('phone-1'), 'gossip cannot turn it off');
-      node._frameHandler.handle('phone-1', 'phone-1', { type: 'wake-channel', platform: 'none' });
+      node._frameHandler.handle(admitAs(node, { nodeId: 'peer-x', name: 'mallory' }), { type: 'peer-info', peers: [{ nodeId: 'phone-1', wakeChannel: { platform: 'none' }, lastSeen: Date.now() }] });
+      assert.ok(node._peerWakeChannels.has('phone-1'), 'another peer cannot turn it off');
+      node._frameHandler.handle(phone, { type: 'wake-channel', platform: 'none' });
       assert.strictEqual(node._peerWakeChannels.has('phone-1'), false, 'the peer turned its own channel off');
       assert.strictEqual(io.writes(), before + 1, 'and it was saved');
-      // Not one held at a stronger rank than the frame: that takes the relay or a proven session.
-      node._frameHandler.handle('phone-2', 'phone-2', { type: 'wake-channel', platform: 'none' });
-      assert.ok(node._peerWakeChannels.has('phone-2'));
-      node._relay._setPhase = () => {};
-      node._relay._handleRelayPeers({ peers: [{ nodeId: 'phone-2', wakeChannel: { platform: 'none' }, offline: true }] });
-      assert.strictEqual(node._peerWakeChannels.has('phone-2'), false, "the relay's registration turned it off");
-      wm.loadWakeChannels();
-      assert.strictEqual(node._peerWakeChannels.size, 0, 'and neither comes back from the file');
+      node._wakeManager.loadWakeChannels();
+      assert.strictEqual(node._peerWakeChannels.size, 0, 'and it does not come back from the file');
     });
   });
 });
@@ -321,37 +284,19 @@ describe('0.14.0 release review B: every store and list is bounded', () => {
       const out = wm.gossipEntries('peer-x');
       assert.strictEqual(out.length, 256);
       assert.ok(out.every((e) => Number(e.nodeId.slice(1)) >= 44), 'the 256 most recently seen');
-      // A receiver reading a longer frame (from an older sender) says so once a minute, not per frame.
-      const long = { type: 'peer-info', peers: Array.from({ length: 300 }, (_, i) => ({ nodeId: `q${i}`, wakeChannel: apns('t'), lastSeen: now })) };
-      for (let i = 0; i < 20; i++) node._frameHandler.handle('peer-y', 'old-sender', long);
-      assert.strictEqual(io.lines.filter((l) => /entries, reading the first/.test(l)).length, 1);
     });
   });
 
-  it("the relay's peer list is read for its first 256 entries, and room is made without scanning the map (F12)", () => {
+  it("the relay's peer list is read for its first 256 entries (F12)", () => {
     withNode((node) => {
-      const wm = node._wakeManager;
       node._relay._setPhase = () => {};
       node._relay._log = () => {};
       let joined = 0;
       node._relay._handleRelayPeerJoined = () => { joined++; };
       const peers = Array.from({ length: 200000 }, (_, i) => ({ nodeId: `r${i}`, wakeChannel: apns(`t${i}`) }));
-      // Count steps over the channel map: making room must not walk it.
-      let steps = 0;
-      const map = node._peerWakeChannels;
-      for (const m of ['entries', 'keys', 'values', Symbol.iterator]) {
-        const real = map[m].bind(map);
-        map[m] = (...a) => { const it = real(...a); return { next: () => { steps++; return it.next(); }, [Symbol.iterator]() { return this; } }; };
-      }
-      wm._maxChannels = 100;
-      let saves = 0;
-      node._relay._saveWakeChannels = () => { saves++; };   // the one save per list serialises the map; counted apart
       node._relay._handleRelayPeers({ peers });
       assert.strictEqual(joined, 256, 'the first 256 entries');
-      assert.strictEqual(node._peerWakeChannels.size, 100, 'at the cap');
-      assert.strictEqual(steps, 0, 'and making room for 156 of them walked nothing');
-      assert.strictEqual(saves, 1);
-      assert.ok(node._peerWakeChannels.has('r255') && !node._peerWakeChannels.has('r0'), 'the least recently set went first');
+      assert.strictEqual(node._peerWakeChannels.size, 0, 'and no channel is learned from it');
     });
   });
 
@@ -384,9 +329,9 @@ describe('0.14.0 release review B: every store and list is bounded', () => {
     });
   });
 
-  it('a relay leg built without a wake manager does not throw on a peer list with channels (F8)', () => {
+  it('a relay leg does not throw on a peer list with channels (F8)', () => {
     const { RelayConnection } = require('../lib/relay');
-    const relay = new RelayConnection({ relayUrl: 'ws://127.0.0.1:1', token: 'x'.repeat(32), getIdentity: () => ({ nodeId: 'me' }), getPeers: () => new Map(), createPeer: () => ({}), addPeer: () => {}, log: () => {}, nodeName: 'n', peerWakeChannels: new Map(), saveWakeChannels: () => {} });
+    const relay = new RelayConnection({ relayUrl: 'ws://127.0.0.1:1', relayToken: 'x'.repeat(32), getIdentity: () => ({ nodeId: 'me' }), log: () => {}, nodeName: 'n' });
     relay._setPhase = () => {};
     relay._handleRelayPeerJoined = () => {};
     assert.doesNotThrow(() => relay._handleRelayPeers({ peers: [{ nodeId: 'p', wakeChannel: apns('t'), offline: true }] }));
diff --git a/tests/wire-identity-ingress.test.js b/tests/wire-identity-ingress.test.js
index d56540bc..2cc1bafb 100644
--- a/tests/wire-identity-ingress.test.js
+++ b/tests/wire-identity-ingress.test.js
@@ -9,6 +9,11 @@ require('./_isolate-home'); // redirect $HOME before lib/config loads
  * it. 0.13.16 kept such values in the peer table and printed them later, in timers and transport
  * callbacks: a peer could crash a node over the relay (a join notice) or the LAN (a handshake) by
  * choosing its own name. They are now taken at the door as what they must be (lib/wire-identity.js).
+ *
+ * Since 0.14 (Core Secure) none of these values makes a peer at all: a relay roster entry is a
+ * candidate, a hello is checked field by field before the handshake uses it, and a peer exists only
+ * after both proofs. The invariant stands on every path: nothing a peer chooses for its id or name
+ * reaches uncaughtException, and a connection the node cannot take is closed and counted.
  */
 
 const { describe, it } = require('node:test');
@@ -21,6 +26,8 @@ const { BonjourDiscovery, NullDiscovery } = require('../lib/discovery');
 const { nodeDir } = require('../lib/config');
 const { sendFrame } = require('../lib/frame-parser');
 const { wireNodeId, wireName } = require('../lib/wire-identity');
+const { admitAs, identity } = require('./_core-secure');
+const { clientHello } = require('../lib/core/handshake-v2-flow');
 
 const BAD = { toString: 1 }; // JSON-expressible; String(BAD) throws
 const uniq = (base) => `${base}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
@@ -59,16 +66,15 @@ describe('relay: what the relay forwards from a joiner cannot crash the node', (
     }));
     const name = uniq('wire-relay');
     const node = new SymNode({ name, silent: true, relayOnly: true, relay: `ws://127.0.0.1:${wss.address().port}`, relayToken: 'x'.repeat(40), room: 'g' });
-    const messages = [];
-    node.on('message', (from, content) => messages.push([from, content]));
+    const refused = [];
+    node.on('metric', (m) => { if (m.type === 'session-frame-refused') refused.push(m); });
     try {
       await node.start();
-      await until(() => messages.length >= 1);
+      await until(() => refused.length >= 1);
       await new Promise((r) => setTimeout(r, 100));
       assert.deepStrictEqual(u.seen, [], 'nothing reached uncaughtException');
-      const peers = node.status().peers;
-      assert.deepStrictEqual(peers.map((p) => p.name).sort(), ['unknown', 'unknown'], 'both named peers are in, as "unknown"; the numeric id is not');
-      assert.deepStrictEqual(messages, [['unknown', 'hello']]);
+      assert.deepStrictEqual(node.status().peers, [], 'a roster entry is a candidate, never a peer');
+      assert.ok(refused.some((m) => m.frameType === 'message'), 'the plaintext frame from an unproven `from` is refused and counted');
       assert.strictEqual(node.status().relayConnected, true);
     } finally {
       u.done();
@@ -95,54 +101,45 @@ describe('LAN: the handshake that opens a connection', () => {
     return s;
   }
 
-  it('a handshake naming the peer with an unprintable name does not crash the node; the peer is "unknown"', async () => {
+  /** A client-hello as a real client builds it, with `bad` fields put in. */
+  function hello(room, bad = {}) {
+    const C = identity('c');
+    const { frame } = clientHello({ room, nodeId: C.nodeId, name: 'c', identityPublicKey: C.publicKey, e2ePublicKey: require('crypto').randomBytes(32).toString('base64url'), implementation: { name: 'x', version: '1' }, extensions: ['cmb-encrypted-v2'] });
+    return { ...frame, ...bad };
+  }
+
+  it('a legacy handshake naming the peer with an unprintable name is refused at once, and nothing crashes', async () => {
     const u = catchUncaught();
     const { node, name } = await lanNode('wire-lan-name');
     const s = dial(node._port, { type: 'handshake', nodeId: 'z'.repeat(64), name: BAD });
     try {
-      await until(() => node._peers.size === 1);
-      await new Promise((r) => setTimeout(r, 200));
+      await until(() => s.gone, 3000);
+      await new Promise((r) => setTimeout(r, 100));
       assert.deepStrictEqual(u.seen, []);
-      assert.strictEqual(node._peers.get('z'.repeat(64)).name, 'unknown');
+      assert.strictEqual(s.gone, true);
+      assert.strictEqual(node._peers.size, 0);
+      assert.strictEqual(node._sessionStats.legacyHellosRefused, 1);
       assert.ok(Array.isArray(node.status().peers));
     } finally { u.done(); s.destroy(); await node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
   });
 
-  it('a handshake the node cannot take closes the connection and is counted; it is never left open without an owner', async () => {
+  it('a client-hello whose fields are not what they must be closes the connection and is counted; it is never left open without an owner', async () => {
+    const u = catchUncaught();
     const { node, name } = await lanNode('wire-lan-refused');
-    node._roomAdmission = () => { throw new Error('admission failed'); };
-    const s = dial(node._port, { type: 'handshake', nodeId: 'w'.repeat(64), name: 'w' });
-    const t = dial(node._port, { type: 'handshake', nodeId: 42, name: 'n' });
+    const dials = [
+      dial(node._port, hello('g', { name: BAD })),
+      dial(node._port, hello('g', { nodeId: 42 })),
+      dial(node._port, hello('g', { room: BAD })),
+      dial(node._port, hello('g', { identityPublicKey: BAD, e2ePublicKey: BAD })),
+    ];
     try {
-      await until(() => s.gone && t.gone, 3000);
-      assert.strictEqual(s.gone, true, 'the refused connection is closed (0.13.16 left it open, its deadline cleared)');
-      assert.strictEqual(t.gone, true, 'a handshake whose nodeId is not one is closed');
-      assert.strictEqual(node._peers.size, 0);
-      assert.strictEqual(node.metrics().framesRefusedByType.handshake, 1);
-    } finally { s.destroy(); t.destroy(); await node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
-  });
-
-  it('a handshake whose room claim cannot be printed is refused and its connection closed', async () => {
-    const { node, name } = await lanNode('wire-lan-room');
-    const s = dial(node._port, { type: 'handshake', nodeId: 'r'.repeat(64), name: 'r', room: BAD });
-    try {
-      await until(() => s.gone, 3000);
-      assert.strictEqual(s.gone, true);
+      await until(() => dials.every((d) => d.gone), 3000);
+      assert.ok(dials.every((d) => d.gone), 'every refused connection is closed');
+      assert.deepStrictEqual(u.seen, []);
       assert.strictEqual(node._peers.size, 0);
-      assert.strictEqual(node.metrics().framesRefusedByType.handshake, 1);
-    } finally { s.destroy(); await node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
-  });
-
-  it('a handshake whose keys are not text pins nothing', async () => {
-    const { node, name } = await lanNode('wire-lan-keys');
-    const s = dial(node._port, { type: 'handshake', nodeId: 'k'.repeat(64), name: 'k', publicKey: BAD, e2ePublicKey: BAD });
-    try {
-      await until(() => node._peers.size === 1);
-      assert.strictEqual(node._peers.size, 1, 'the peer is taken, as one that sent no keys');
-      assert.strictEqual(node.metrics().framesRefused, 0);
-      assert.strictEqual(node._roster.has('k'.repeat(64)), false);
-      assert.strictEqual(node._peerSharedSecrets.has('k'.repeat(64)), false);
-    } finally { s.destroy(); await node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+      assert.strictEqual(node._sessionStats.failedByReason.error, 4, 'each counted');
+      assert.strictEqual(node._roster.size(), 0, 'and nothing was pinned from any of them');
+    } finally { u.done(); for (const d of dials) d.destroy(); await node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
   });
 });
 
@@ -153,11 +150,13 @@ describe('wake channels are taken as text before they are kept', () => {
     let writes = 0;
     node._wakeManager.saveWakeChannels = () => { writes++; };
     try {
-      assert.doesNotThrow(() => node._frameHandler.handle('p1', 'p1', { type: 'wake-channel', platform: BAD, token: 't' }));
-      assert.doesNotThrow(() => node._frameHandler.handle('p1', 'p1', { type: 'wake-channel', platform: 'apns', token: { t: 1 } }));
+      const p1 = admitAs(node, { nodeId: 'p1' });
+      assert.doesNotThrow(() => node._frameHandler.handle(p1, { type: 'wake-channel', platform: BAD, token: 't' }));
+      assert.doesNotThrow(() => node._frameHandler.handle(p1, { type: 'wake-channel', platform: 'apns', token: { t: 1 } }));
       assert.strictEqual(node._peerWakeChannels.has('p1'), false, 'not kept');
       assert.strictEqual(writes, 0, 'and not written (0.13.16 wrote it, then threw printing it)');
-      node._frameHandler.handle('p2', 'p2', { type: 'peer-info', peers: [
+      // Since 0.14 a peer-info entry is learned only for the sender itself (design D1).
+      node._frameHandler.handle(admitAs(node, { nodeId: 'b' }), { type: 'peer-info', peers: [
         null, 7, { nodeId: BAD, wakeChannel: { platform: 'apns', token: 't' } },
         { nodeId: 'a', wakeChannel: { platform: 'apns', token: BAD } },
         { nodeId: 'b', lastSeen: Date.now(), wakeChannel: { platform: 'apns', token: 't', environment: 'sandbox', extra: 'x'.repeat(10000) } },

From 742cee479f0d9113e7a7027ce80819a0c30a0a6d Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Fri, 2 Oct 2026 15:15:18 +0100
Subject: [PATCH 098/148] 0.14.0 host API: identity, relocation and invite on
 the package; an expired binding is no pin

- require('@sym-bot/sym').identity gives loadIdentity, renameIdentity, migrateIdentities,
  nodeDirById, nodeIdForName, readTombstone and the identity errors; .relocation and .invite give
  exportNode/importNode/hostKey and buildInvite/parseInvite: a host (XMesh, mesh-channel) never
  reaches into lib/ paths or underscore fields.
- importNode's host-registry pin ignores a binding the registry expired (design D3).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 lib/node.js       | 22 ++++++++++++++++++++++
 lib/relocation.js |  3 ++-
 2 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/lib/node.js b/lib/node.js
index 661f516a..26d6f7fd 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -4031,6 +4031,28 @@ Object.defineProperty(module.exports, 'claude', {
   enumerable: true,
 });
 
+// Core Secure host API (0.14): identities by nodeId, relocation, invites — so a host (XMesh,
+// mesh-channel) never reaches into lib/ paths or underscore fields.
+Object.defineProperty(module.exports, 'identity', {
+  enumerable: true,
+  get() {
+    const c = require('./config');
+    return {
+      loadIdentity: c.loadIdentity, renameIdentity: c.renameIdentity, migrateIdentities: c.migrateIdentities,
+      nodeDirById: c.nodeDirById, nodeIdForName: c.nodeIdForName, readTombstone: c.readTombstone,
+      IdentityAbsentError: c.IdentityAbsentError, IdentityTombstonedError: c.IdentityTombstonedError, IdentityHaltError: c.IdentityHaltError,
+    };
+  },
+});
+Object.defineProperty(module.exports, 'relocation', {
+  enumerable: true,
+  get() { return require('./relocation'); },
+});
+Object.defineProperty(module.exports, 'invite', {
+  enumerable: true,
+  get() { return require('./invite'); },
+});
+
 Object.defineProperty(module.exports, 'platform', {
   get() { return require('./platform'); },
   enumerable: true,
diff --git a/lib/relocation.js b/lib/relocation.js
index 61b51cf9..10cb75ae 100644
--- a/lib/relocation.js
+++ b/lib/relocation.js
@@ -175,7 +175,8 @@ function hostPinFor(nodeId) {
     for (const line of text.split('\n')) {
       let r;
       try { r = JSON.parse(line); } catch { continue; }
-      if (r && r.nodeId === nodeId && (r.source === 'proven' || r.source === 'pinned') && isIdentityKey(r.key)) found = r.key;
+      if (r && r.nodeId === nodeId && r.expired === true) found = null; // the binding expired (design D3)
+      else if (r && r.nodeId === nodeId && (r.source === 'proven' || r.source === 'pinned') && isIdentityKey(r.key)) found = r.key;
     }
     if (found) return found;
   }

From 28c0fdbe81e598301ab5ac433ee0fbf941576c96 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Fri, 2 Oct 2026 15:15:18 +0100
Subject: [PATCH 099/148] 0.14.0 tests: three that a mutation survived now fail
 without their fix

- core-secure-legacy: the TXT mmp=2.0 dial test used one nodeId for the legacy and the v2
  record, so dialling the legacy one looked the same; distinct ids now.
- core-secure-relay: the paced test asserted before the relay had read the frames; it waits
  until the relay has them all (or refused one).
- core-secure-node: the squatter test also checks that nothing (the room-join grant) is handed
  to a session whose proven key conflicts with the registry, which only the session-time check
  prevents (the admission-time bind refuses it too, later).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 tests/core-secure-legacy.test.js |  6 ++++--
 tests/core-secure-node.test.js   | 19 +++++++++++++++++++
 tests/core-secure-relay.test.js  |  2 ++
 3 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/tests/core-secure-legacy.test.js b/tests/core-secure-legacy.test.js
index acedc1e5..872752ec 100644
--- a/tests/core-secure-legacy.test.js
+++ b/tests/core-secure-legacy.test.js
@@ -183,11 +183,13 @@ describe('the Core Secure listener and discovery (D2)', () => {
     try {
       await node.start();
       const larger = `ffffffff-ffff-7fff-bfff-${crypto.randomBytes(6).toString('hex')}`;
+      const legacy = `fffffffe-ffff-7fff-bfff-${crypto.randomBytes(6).toString('hex')}`;
       const smaller = `00000000-0000-7000-8000-${crypto.randomBytes(6).toString('hex')}`;
-      disco.emit('peer-found', '127.0.0.1', 1, larger, 'legacy', { mmp: null, room: 'default' });
+      disco.emit('peer-found', '127.0.0.1', 1, legacy, 'legacy', { mmp: null, room: 'default' });
+      disco.emit('peer-found', '127.0.0.1', 4, legacy, 'legacy-old-txt', { mmp: '1.0', room: 'default' });
       disco.emit('peer-found', '127.0.0.1', 2, larger, 'v2', { mmp: '2.0', room: 'default' });
       disco.emit('peer-found', '127.0.0.1', 3, smaller, 'v2-smaller', { mmp: '2.0', room: 'default' });
-      assert.deepStrictEqual(dialled, [larger], 'the legacy record is not dialled; the larger v2 one is; the smaller one dials us');
+      assert.deepStrictEqual(dialled, [larger], 'a record without mmp=2.0 is not dialled; the larger v2 one is; the smaller one dials us');
     } finally { await stopAll(node); }
   });
 
diff --git a/tests/core-secure-node.test.js b/tests/core-secure-node.test.js
index 5df66ee2..20f199c1 100644
--- a/tests/core-secure-node.test.js
+++ b/tests/core-secure-node.test.js
@@ -195,13 +195,32 @@ describe('the key registry at the session (D3)', () => {
       // A squatter proves the honest node's id under a key of its own.
       const squat = identity('squatter');
       const [ts, tb] = memoryPipe();
+      // What b's session hands the squatter, before sealing.
+      const toSquatter = [];
+      const attach = b._attachTransport.bind(b);
+      b._attachTransport = (...args) => {
+        const sess = attach(...args);
+        const send = sess.trySend.bind(sess);
+        sess.trySend = (f) => { toSquatter.push(f && f.type); return send(f); };
+        return sess;
+      };
       b.connectTransport(tb, { role: 'server' });
+      b._attachTransport = attach;
       const s = new PeerSession({ role: 'client', transport: ts, kind: 'bonjour', room: 'cs-room', extensions: ['cmb-encrypted-v2'], implementation: { name: 'x', version: '1' },
         local: { nodeId: honestId.nodeId, name: honestName, publicKey: squat.publicKey, privateKey: squat.privateKey } });
       ts.on('message', (f) => s.receiveWire(f));
+      // b holds a room-join grant of its own: it is presented only to a session that passed the key
+      // check, never to one that proved a key in conflict with the registry.
+      b._roomGrant = { type: 'room-join', room: 'cs-room', grantee: b.nodeId, sig: 'x' };
+      const joined = [];
+      b.on('peer-joined', (p) => joined.push(p));
       s.start();
       await until(() => b._roster.conflicts().length > 0, 3000);
+      await new Promise((r) => setTimeout(r, 50));
       assert.strictEqual(b._peers.has(honestId.nodeId), false, 'the squatter is not a peer');
+      assert.ok(!toSquatter.includes('mesh-room-join'), 'nothing was presented to the squatter');
+      assert.deepStrictEqual(joined, [], 'and no peer-joined was raised');
+      b._roomGrant = null;
       assert.strictEqual(b._roster.source(honestId.nodeId), 'legacy-claim', 'the claim is not taken over');
       assert.deepStrictEqual(b._roster.conflicts().map((c) => [c.nodeId, c.got, c.gotSource]), [[honestId.nodeId, squat.publicKey, 'proven']]);
       const honest = new SymNode({ name: honestName, silent: true, discovery: new NullDiscovery(), room: 'cs-room' });
diff --git a/tests/core-secure-relay.test.js b/tests/core-secure-relay.test.js
index befd3af9..c3e48ae3 100644
--- a/tests/core-secure-relay.test.js
+++ b/tests/core-secure-relay.test.js
@@ -207,6 +207,8 @@ describe('the relay limit with 30 sessions (D4)', () => {
       const recipients = Array.from({ length: 30 }, () => identity('r').nodeId);
       for (let i = 0; i < 20; i++) for (const to of recipients) assert.strictEqual(conn.sendTo(to, { type: 'control-encrypted', i }).ok, true);
       await until(() => conn.state().queued === 0, 15000);
+      // The relay reads them a turn or more later: wait until it has them all (or refused one).
+      await until(() => relay.stats.framesIn >= 600 || relay.stats.rateLimited > 0, 5000);
       assert.strictEqual(relay.stats.rateLimited, 0, 'never over the relay\'s limit');
       assert.strictEqual(conn.state().phase, 'connected');
       assert.ok(conn.state().sentFrames >= 600);

From 66ee371efca93df9f23cb2c3f4c32ac19f829ec9 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Fri, 2 Oct 2026 15:33:52 +0100
Subject: [PATCH 100/148] 0.14.0 conforms to draft spec PRs #21, #26 and #27

- #21 identity conflict: a confirmed session that proves a key other than the one bound to its
  nodeId is sent error 1009 IDENTITY_CONFLICT (TCP: after the frame has gone out) and closed;
  a node told 1009 closes the session as identity-conflict, says so once, and does not retry.
- #27 sym-attest-v1: the frames are sym-attest-attestation / -checkpoint / -witness /
  -node-stats, only on sessions that selected the extension; 0.13's bare names are refused on a
  Core Secure session. The signed constructions are the extension's: lp-encoded under
  mmp-attest-v1 / mmp-attest-checkpoint-v1 / mmp-attest-witness-v1, method and assertionId
  signed, room and uptoSeq on the wire (the store keeps its own names behind a codec), prev the
  SHA-256 of the signature bytes, the checkpoint root promote-odd with leaf and node tags,
  node statistics without a self-asserted name or nodeId. Every received frame is checked field
  by field before anything is spent. A 0.13 chain and its checkpoints still reconcile.
  attestation-received: methodUnsigned is now method (signed), assertionId and room are added,
  a non-text field is null. An attestation's `of` is the record's cognition key (it could be
  the directed dedup mark on the neural path).
- #26: cmb-fetch-result is { reqId, returned[], missing[] }; each requested key in exactly one
  list, records first, the result last, on one sequence.
- SECURITY.md: the disclosure attestations make, and 1009.

Tests: sym-attest-v1.test.js (byte-exact constructions, domain separation, promote-odd root,
chain link, wire codec, two nodes exchanging the frames); 1009 over TCP and the relay; frame
names and shapes updated across the attestation tests. Suite: 1,079 unit pass (3 Windows-only
skipped), integration 8/8.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 CHANGELOG.md                           |  27 ++-
 SECURITY.md                            |  12 +-
 lib/attestation-store.js               |  13 +-
 lib/core/attestation.js                | 297 ++++++++++++++++++-------
 lib/frame-handler.js                   |  88 +++++---
 lib/node.js                            | 104 ++++++---
 lib/session.js                         |   3 +-
 lib/transport.js                       |  11 +
 tests/_core-secure.js                  |   2 +
 tests/admission-attestation.test.js    |  56 ++---
 tests/checkpoint-rate.test.js          |   6 +-
 tests/cmb-fetch-serves-v2.test.js      |   8 +-
 tests/cmb-fetch.test.js                |  20 +-
 tests/core-secure-node.test.js         |  21 +-
 tests/core-secure-relay.test.js        |  17 ++
 tests/gossip-budget.test.js            |   5 +-
 tests/gossip-lanes.test.js             |  14 +-
 tests/node-stats.test.js               |  17 +-
 tests/stored-entry-annotations.test.js |   2 +-
 tests/sym-attest-v1.test.js            | 145 ++++++++++++
 20 files changed, 659 insertions(+), 209 deletions(-)
 create mode 100644 tests/sym-attest-v1.test.js

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 588b26fc..7c04b00a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -51,19 +51,34 @@ in-memory pending set for grants that arrive before their root (which could be f
 - **The frame table.** `cmb` (plaintext) is refused (Legacy Import sessions only);
   `cmb-fetch` may name one `key` or up to 32 `keys`; each record found goes out as its own
   sealed `cmb-encrypted` frame, then one sealed `cmb-fetch-result` that carries only the
-  correlation id and the key lists, `{ reqId, found: [...], notFound: [...] }` (it carried the
-  record in the clear); `role-grant`/`role-revoke` are verified against
+  correlation id and the key lists, `{ reqId, returned: [...], missing: [...] }` (draft spec PR
+  #26; each key requested in exactly one list; it carried the record in the clear); `role-grant`/`role-revoke` are verified against
   the grant chain, never the delivering session; `peer-info` and `wake-channel` are learned only
   for the session's own nodeId (gossip about other nodes and the relay's peer list are hints,
   never stored); `message` is retired: `send()` sends a directed CMB whose signed application
   section marks it a message, and the receiver raises its `message` event from it;
-  `attestation`, `checkpoint`, `witness`, `node-stats` go only to sessions that selected
-  `sym-attest-v1`, `xmesh-insight` only with `xmesh-insight-v1`; `state-sync` is refused. Records
+  `xmesh-insight` goes only with `xmesh-insight-v1`; `state-sync` is refused. Records
   replayed as context on connect are announced in a sealed `cmb-anchors` frame (the `_anchor`
-  frame flag could not ride a sealed record).
+  frame flag could not ride a sealed record). The new wire elements that still need spec text
+  (`cmb-anchors`, `mesh-room-join`, `role-chain-fetch` / `role-chain`, relay error 4404) are
+  written out in `docs/WIRE-0.14.0.md`.
+- **Admission attestations are the `sym-attest-v1` extension** (draft spec PR
+  meshcognition-website#27). The frames are `sym-attest-attestation`, `sym-attest-checkpoint`,
+  `sym-attest-witness` and `sym-attest-node-stats`, sent only to sessions that selected the
+  extension; 0.13's bare `attestation` / `checkpoint` / `witness` / `node-stats` are refused on a
+  Core Secure session. The signed constructions are the extension's: each `lp`-encoded under its
+  own domain tag (`mmp-attest-v1`, `mmp-attest-checkpoint-v1`, `mmp-attest-witness-v1`), with
+  `method` and the record's `assertionId` signed; `room` and `uptoSeq` on the wire; `prev` the
+  SHA-256 of the previous signature's bytes; the checkpoint root a promote-odd Merkle tree with
+  leaf and node tags; node statistics carry no self-asserted name or nodeId and are attributed to
+  the session's peer. Every received frame is checked field by field before anything is spent.
+  **Breaking for readers of the `attestation-received` event:** `methodUnsigned` is now `method`
+  (signed), with `assertionId` and `room` added; a non-text field is shown as `null`. A chain kept
+  from 0.13 continues (its old links and checkpoints still reconcile).
 - **One key registry, an explicit conflict matrix.** No source ever overrides a different key
   (the 0.13 "strictly stronger source overrides" rule is gone). A different key for a bound
-  nodeId, from any source, is a conflict: refused, recorded (`roster-conflicts.jsonl`), shown in
+  nodeId, from any source, is a conflict: refused (a session that proves another key for a bound
+  nodeId is closed with error 1009 `IDENTITY_CONFLICT`, draft spec PR #21), recorded (`roster-conflicts.jsonl`), shown in
   `status().coreSecure.keyConflicts` and `sym status`; the operator resolves it
   (`sym keys <name> resolve <nodeId> <key>`). The configured anchor is read from configuration at
   every start and never persisted, so re-pinning it out of band takes effect. Every 0.13
diff --git a/SECURITY.md b/SECURITY.md
index eee9de09..4520eb5e 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -27,7 +27,8 @@ Report a vulnerability privately to info@sym.bot (the address in package.json).
   order (replay, rollback, gap) closes the session, which re-handshakes.
 - **One key per nodeId.** The key registry binds a nodeId to the first key a proven session, an
   out-of-band pin (invite, Legacy Import route) or an anchor-rooted grant gives it, and never
-  replaces it: a different key from any source is a recorded conflict an operator resolves. The
+  replaces it: a different key from any source is a recorded conflict an operator resolves (a
+  session proving it is closed with error 1009 `IDENTITY_CONFLICT`). The
   one way a binding ends is churn: a first-contact binding that never verified anything expires
   after 30 days unseen (or gives way to a newcomer in a full registry), after which that nodeId is
   first contact again; a binding that ever verified something is kept for good.
@@ -41,6 +42,10 @@ Report a vulnerability privately to info@sym.bot (the address in package.json).
 - **Authority follows the key.** A role grant must name `granteeKey`; it confers its role only
   on that key, and a chain is verified top-down with each grant's vouched key. A grantor whose
   nodeId an impostor holds keeps exactly its vouched authority; the impostor gets none.
+- **Admission attestations under `sym-attest-v1`.** Attestations, checkpoints and witnesses are
+  signed under their own domain tags with every field covered, verified against the signer's bound
+  key (never the delivering session), and exchanged only with sessions that negotiated the
+  extension. They describe a decision; they never change the receiver's own.
 - **Gated rooms on proven keys.** A gated room admits its owner by the owner's pinned key and a
   grantee when its room-join grant binds the key its session proved. A copied grant admits
   nobody.
@@ -114,5 +119,10 @@ Every store a peer can feed has a fixed bound. Reaching one never stops the node
   authority. A nodeId that has proven itself over Core Secure has its legacy route refused (a
   persisted floor) until an operator resets it. Network Legacy Import is removed in 0.15.0.
 - **Metadata.** The relay operator sees routing envelopes: who, to whom, room, timing, sizes.
+- **Attestations disclose decisions.** With `sym-attest-v1` (offered by default) every peer in the
+  room learns which records a node gated and what it decided; a content address is a confirmation
+  oracle for whoever holds the text. Leave the extension out (`extensions` option) where that
+  disclosure is not acceptable. An attestation proves who decided, not that the decision was
+  honest; the chain and witnesses make a forked history detectable, not impossible.
 - **A room name or relay token is not an enterprise trust boundary.** Anyone holding the token
   is in the channel, and an invite that carries a token is a secret.
diff --git a/lib/attestation-store.js b/lib/attestation-store.js
index 699381b4..59cd3426 100644
--- a/lib/attestation-store.js
+++ b/lib/attestation-store.js
@@ -153,8 +153,17 @@ function sameBytes(a, b) {
   } finally { fs.closeSync(fa); }
 }
 
-/** sha256 hex of a signature — the per-attester chain link (`prev`). */
+/**
+ * The per-attester chain link (`prev`): the sha256 hex of a signature's BYTES (sym-attest-v1 §5.1).
+ * sym 0.13 hashed the base64url text instead; a chain written then keeps those links, and
+ * `verifyChain` accepts either for a link whose earlier attestation predates 0.14.
+ */
 function chainHash(sig) {
+  return crypto.createHash('sha256').update(Buffer.from(String(sig), 'base64url')).digest('hex');
+}
+
+/** The 0.13 link (sha256 of the signature's base64url text), read only for a chain written then. */
+function chainHash013(sig) {
   return crypto.createHash('sha256').update(String(sig)).digest('hex');
 }
 
@@ -351,7 +360,7 @@ class AttestationStore {
       const cur = bySeq.get(s);
       if (!cur) { gaps.push(s); continue; }
       const prevAtt = bySeq.get(s - 1);
-      if (prevAtt && cur.prev !== chainHash(prevAtt.sig)) breaks.push(s);
+      if (prevAtt && cur.prev !== chainHash(prevAtt.sig) && !(prevAtt.assertionId === undefined && cur.prev === chainHash013(prevAtt.sig))) breaks.push(s);
     }
     return { ok: gaps.length === 0 && breaks.length === 0, gaps, breaks };
   }
diff --git a/lib/core/attestation.js b/lib/core/attestation.js
index 20eb6208..9364c6cb 100644
--- a/lib/core/attestation.js
+++ b/lib/core/attestation.js
@@ -25,86 +25,123 @@
  * This module provides only the canonical payload + sign/verify + the role-claim
  * check; chain/roster/rate-limit/checkpointing live in `@sym-bot/sym`.
  *
+ * sym 0.14 (design D1; MMP extension `sym-attest-v1`, draft spec PR meshcognition-website#27):
+ * the signed constructions are the extension's 1.0.0 ones — each `lp`-encoded under its own
+ * domain tag (`mmp-attest-v1`, `mmp-attest-checkpoint-v1`, `mmp-attest-witness-v1`), every field
+ * signed (`method` and `assertionId` included), the chain link `prev` the SHA-256 of the previous
+ * signature's BYTES, the checkpoint root a promote-odd Merkle tree with leaf and node tags. On the
+ * wire the frames are `sym-attest-attestation`, `-checkpoint`, `-witness`, `-node-stats`, with the
+ * extension's field names (`room`, `uptoSeq`); `toWire*` / `fromWire*` translate to and from the
+ * store's own (`roster`, `upto_seq`), and `fromWire*` checks every field's shape and vocabulary. The
+ * 0.13 constructions (a `|`-joined string, literal prefixes, a pair-with-itself Merkle tree) are not
+ * produced or accepted on a Core Secure session.
+ *
  * @copyright 2026 SYM.BOT Ltd.
  * @license Apache-2.0
  */
 
 const crypto = require('crypto');
 const { privateKeyObject, publicKeyObject } = require('./cmb-signing');
-const { CAT7_CATEGORIES } = require('./cmb-encoder');
+const { CAT7_CATEGORIES, lp } = require('./cmb-encoder');
 const { roleRank } = require('./role-grant');
 
-/** Per-category verdict vocabulary (matches CATEGORY_VERDICT in svaf-baseline.js, the evaluator lib/core exports). */
+/** Per-category verdict vocabulary (MMP §9.2.1; matches CATEGORY_VERDICT in svaf-baseline.js). */
 const VERDICTS = Object.freeze(['admit', 'guard', 'redundant', 'reject', 'silent']);
+/** Whole-record verdicts (MMP §9.2). */
+const RECORD_VERDICTS = Object.freeze(['aligned', 'guarded', 'redundant', 'rejected']);
+
+/** The extension's frame types (MMP §16.2 `<extension>-<name>`). */
+const ATTEST_FRAME = Object.freeze({
+  attestation: 'sym-attest-attestation',
+  checkpoint: 'sym-attest-checkpoint',
+  witness: 'sym-attest-witness',
+  nodeStats: 'sym-attest-node-stats',
+});
+/** sym 0.13's bare frame types: legacy, never sent or accepted on a Core Secure session. */
+const LEGACY_ATTEST_FRAMES = Object.freeze(['attestation', 'checkpoint', 'witness', 'node-stats']);
+
+const DOMAIN = Object.freeze({
+  attestation: 'mmp-attest-v1\n',
+  checkpoint: 'mmp-attest-checkpoint-v1\n',
+  witness: 'mmp-attest-witness-v1\n',
+  leaf: 'mmp-attest-leaf-v1\n',
+  node: 'mmp-attest-node-v1\n',
+});
+
+/** Canonical decimal ASCII for a non-negative safe integer (MMP §8.8.4); anything else throws. */
+function decimal(n) {
+  if (!Number.isSafeInteger(n) || n < 0) throw new Error(`sym-attest: expected a non-negative safe integer, got ${JSON.stringify(n)}`);
+  return String(n);
+}
+const text = (v) => (typeof v === 'string' ? v : '');
+const nfc = (v) => text(v).normalize('NFC');
+const roomOf = (o) => (typeof o.room === 'string' ? o.room : o.roster);
+const positionOf = (o) => (o.uptoSeq !== undefined ? o.uptoSeq : o.upto_seq);
 
 /**
- * Deterministic canonicalization of the per-category verdict map. Fixed CAT7 order so
- * the signed bytes are independent of object key insertion order; every category is
- * included (a missing category signs as empty), so dropping a category breaks the sig.
- * @param {object} categories - per-CAT7-category verdict map
- * @returns {string}
+ * The per-category verdicts as signed: the seven values in CAT7 order (kept for callers that show
+ * them; the signature lp-encodes each, below).
  */
 function canonicalCategories(categories) {
-  return CAT7_CATEGORIES.map(f => `${f}:${(categories && categories[f]) || ''}`).join(',');
+  return CAT7_CATEGORIES.map((f) => `${f}:${(categories && categories[f]) || ''}`).join(',');
 }
 
 /**
- * Canonical bytes signed for an attestation. Binds the gated CMB, the attester, the
- * time, the roster, the overall verdict, EVERY per-category verdict, the claimed role,
- * and the hash-chain position (`seq`,`prev`) — so no element can be mutated after
- * signing (modify, repoint, re-category, re-role, re-chain) without breaking the sig.
- * @param {object} a - attestation
+ * The signed bytes of an attestation (sym-attest-v1 §5.1):
+ *   UTF8("mmp-attest-v1\n") || lp(of) || lp(assertionId) || lp(by) || lp(decimal(at)) ||
+ *   lp(NFC(room)) || lp(method) || lp(verdict) || lp(each of the seven category verdicts, CAT7
+ *   order) || lp(role) || lp(decimal(seq)) || lp(prev)
+ * @param {object} a - attestation (the store's `roster` is read as `room`)
  * @returns {Buffer}
  */
 function attestationPayload(a) {
-  const parts = [
-    a.of || '', a.by || '', a.at ?? '', a.roster || '',
-    a.verdict || '', canonicalCategories(a.categories), a.role || '',
-    a.seq ?? '', a.prev || '',
-  ];
-  return Buffer.from(parts.join('|'), 'utf8');
+  const cats = (a && a.categories) || {};
+  return Buffer.concat([
+    Buffer.from(DOMAIN.attestation, 'utf8'),
+    lp(text(a.of)), lp(text(a.assertionId)), lp(text(a.by)), lp(decimal(a.at)), lp(nfc(roomOf(a))),
+    lp(text(a.method)), lp(text(a.verdict)),
+    ...CAT7_CATEGORIES.map((f) => lp(text(cats[f]))),
+    lp(text(a.role)), lp(decimal(a.seq)), lp(text(a.prev)),
+  ]);
+}
+
+function sign(payload, privateKeyB64url) {
+  return crypto.sign(null, payload, privateKeyObject(privateKeyB64url)).toString('base64url');
+}
+function verify(payloadOf, obj, publicKeyB64url) {
+  if (!obj || !obj.sig || obj.sigAlg !== 'ed25519') return { signed: false, valid: false };
+  if (!publicKeyB64url) return { signed: true, valid: false, error: 'no-public-key' };
+  try {
+    const ok = crypto.verify(null, payloadOf(obj), publicKeyObject(publicKeyB64url), Buffer.from(obj.sig, 'base64url'));
+    return ok ? { signed: true, valid: true } : { signed: true, valid: false, error: 'bad-signature' };
+  } catch (e) {
+    return { signed: true, valid: false, error: e.message };
+  }
 }
 
 /**
- * Sign an attestation in place with the attester's raw Ed25519 private key
- * (base64url). Sets `sig` + `sigAlg`. Returns the attestation.
+ * Sign an attestation in place with the attester's raw Ed25519 private key (base64url). Sets `sig`
+ * and `sigAlg`. Returns the attestation.
  */
 function signAttestation(att, privateKeyB64url) {
   if (!att || !att.of || !att.by) throw new Error('signAttestation requires of + by');
-  const sig = crypto.sign(null, attestationPayload(att), privateKeyObject(privateKeyB64url));
-  att.sig = sig.toString('base64url');
+  att.sig = sign(attestationPayload(att), privateKeyB64url);
   att.sigAlg = 'ed25519';
   return att;
 }
 
 /**
- * Verify an attestation signature against the attester's raw Ed25519 public key.
- * Proves the key `by` authored these exact bytes — NOT that `by` holds the claimed
- * `role` (use `verifyAttestationRole` for that).
+ * Verify an attestation signature against the attester's raw Ed25519 public key. Proves the key
+ * `by` authored these exact bytes — NOT that `by` holds the claimed `role` (verifyAttestationRole).
  * @returns {{ signed: boolean, valid: boolean, error?: string }}
  */
 function verifyAttestation(att, attesterPublicKeyB64url) {
-  if (!att || !att.sig || att.sigAlg !== 'ed25519') return { signed: false, valid: false };
-  if (!attesterPublicKeyB64url) return { signed: true, valid: false, error: 'no-public-key' };
-  try {
-    const ok = crypto.verify(
-      null,
-      attestationPayload(att),
-      publicKeyObject(attesterPublicKeyB64url),
-      Buffer.from(att.sig, 'base64url'),
-    );
-    return ok ? { signed: true, valid: true } : { signed: true, valid: false, error: 'bad-signature' };
-  } catch (e) {
-    return { signed: true, valid: false, error: e.message };
-  }
+  return verify(attestationPayload, att, attesterPublicKeyB64url);
 }
 
 /**
- * Check the CLAIMED role against the role authoritatively resolved for `by` at time
- * `at` from the rooted role-grant chain. The aggregate audit read MUST use the
- * RESOLVED role, never the stamped one — a node can stamp any role; the signature
- * does not vouch for it. `resolveRole(by, at) → role | null` is injected by the node
- * (chain-walking is the earned-authority layer); `null`/unknown → `participant`.
+ * Check the CLAIMED role against the role authoritatively resolved for `by` at time `at` from the
+ * rooted role-grant chain. `resolveRole(by, at) → role | null` is injected by the node.
  * @returns {{ claimed: string, resolved: string, matches: boolean, rank: number }}
  */
 function verifyAttestationRole(att, resolveRole) {
@@ -113,73 +150,156 @@ function verifyAttestationRole(att, resolveRole) {
   return { claimed, resolved, matches: resolved === claimed, rank: roleRank(resolved) };
 }
 
-// ── Checkpoints + witnesses (omission-evidence, MMP) ─────────────────────────────
-//
-// A CHECKPOINT commits an attester to its chain up to `seq` via a Merkle root over
-// its attestation signatures (built by the node; this layer signs/verifies it). A
-// WITNESS is a roster peer's countersignature on that checkpoint ("I saw <attester>'s
-// chain to <seq> with root <root>"). Once witnessed, the attester cannot later serve
-// a chain that drops an attestation ≤ seq without diverging from the witnessed root —
-// turning silent omission into a detectable contradiction. The honest guarantee is
-// "omission-evident to the last witnessed checkpoint," NOT real-time completeness.
+/**
+ * The chain link (sym-attest-v1 §5.1): `prev` of the next attestation is the lowercase hex SHA-256
+ * of this one's signature BYTES; `genesis` before the first.
+ */
+function chainLink(sigB64url) {
+  return crypto.createHash('sha256').update(Buffer.from(String(sigB64url), 'base64url')).digest('hex');
+}
+
+/**
+ * The checkpoint root (sym-attest-v1 §5.2): a promote-odd Merkle root over the attestations'
+ * signature bytes, with separate leaf and node domain tags; an unpaired last node is carried up
+ * unchanged, never paired with itself.
+ *   leaf(i) = SHA-256("mmp-attest-leaf-v1\n" || sigBytes(i)),  node(l, r) = SHA-256("mmp-attest-node-v1\n" || l || r)
+ * @param {string[]} sigs - base64url signatures, seq 1..uptoSeq in order
+ * @returns {string} lowercase hex
+ */
+function attestMerkleRoot(sigs) {
+  const H = (...parts) => crypto.createHash('sha256').update(Buffer.concat(parts)).digest();
+  const leafTag = Buffer.from(DOMAIN.leaf, 'utf8');
+  const nodeTag = Buffer.from(DOMAIN.node, 'utf8');
+  let level = (sigs || []).map((s) => H(leafTag, Buffer.from(String(s), 'base64url')));
+  if (level.length === 0) return H(leafTag).toString('hex');
+  while (level.length > 1) {
+    const next = [];
+    for (let i = 0; i < level.length; i += 2) next.push(i + 1 < level.length ? H(nodeTag, level[i], level[i + 1]) : level[i]);
+    level = next;
+  }
+  return level[0].toString('hex');
+}
 
-/** Canonical bytes for a checkpoint — binds attester, roster, the committed seq, the root, and time. */
+// ── Checkpoints + witnesses (omission-evidence) ─────────────────────────────────────
+
+/**
+ * The signed bytes of a checkpoint (sym-attest-v1 §5.2):
+ *   UTF8("mmp-attest-checkpoint-v1\n") || lp(by) || lp(NFC(room)) || lp(decimal(uptoSeq)) || lp(root) || lp(decimal(at))
+ */
 function checkpointPayload(cp) {
-  return Buffer.from(`checkpoint|${cp.by || ''}|${cp.roster || ''}|${cp.upto_seq ?? ''}|${cp.root || ''}|${cp.at ?? ''}`, 'utf8');
+  return Buffer.concat([
+    Buffer.from(DOMAIN.checkpoint, 'utf8'),
+    lp(text(cp.by)), lp(nfc(roomOf(cp))), lp(decimal(positionOf(cp))), lp(text(cp.root)), lp(decimal(cp.at)),
+  ]);
 }
 
 /** Sign a checkpoint in place with the attester's raw Ed25519 private key (base64url). */
 function signCheckpoint(cp, privateKeyB64url) {
-  if (!cp || !cp.by || cp.upto_seq === undefined || !cp.root) {
-    throw new Error('signCheckpoint requires by + upto_seq + root');
-  }
-  cp.sig = crypto.sign(null, checkpointPayload(cp), privateKeyObject(privateKeyB64url)).toString('base64url');
+  if (!cp || !cp.by || positionOf(cp) === undefined || !cp.root) throw new Error('signCheckpoint requires by + uptoSeq + root');
+  cp.sig = sign(checkpointPayload(cp), privateKeyB64url);
   cp.sigAlg = 'ed25519';
   return cp;
 }
 
 /** Verify a checkpoint's signature against the attester's raw Ed25519 public key. */
 function verifyCheckpoint(cp, attesterPublicKeyB64url) {
-  if (!cp || !cp.sig || cp.sigAlg !== 'ed25519') return { signed: false, valid: false };
-  if (!attesterPublicKeyB64url) return { signed: true, valid: false, error: 'no-public-key' };
-  try {
-    const ok = crypto.verify(null, checkpointPayload(cp), publicKeyObject(attesterPublicKeyB64url), Buffer.from(cp.sig, 'base64url'));
-    return ok ? { signed: true, valid: true } : { signed: true, valid: false, error: 'bad-signature' };
-  } catch (e) {
-    return { signed: true, valid: false, error: e.message };
-  }
+  return verify(checkpointPayload, cp, attesterPublicKeyB64url);
 }
 
 /**
- * Canonical bytes for a witness countersignature. Binds the attester whose checkpoint
- * is witnessed (`attester`), the committed `upto_seq` + `root`, the witness (`by`),
- * its role, the roster, and time — so a witness cannot be replayed onto a different
- * checkpoint, attester, or root.
+ * The signed bytes of a witness (sym-attest-v1 §5.3):
+ *   UTF8("mmp-attest-witness-v1\n") || lp(attester) || lp(NFC(room)) || lp(decimal(uptoSeq)) ||
+ *   lp(root) || lp(by) || lp(role) || lp(decimal(at))
  */
 function witnessPayload(w) {
-  return Buffer.from(`witness|${w.attester || ''}|${w.roster || ''}|${w.upto_seq ?? ''}|${w.root || ''}|${w.by || ''}|${w.role || ''}|${w.at ?? ''}`, 'utf8');
+  return Buffer.concat([
+    Buffer.from(DOMAIN.witness, 'utf8'),
+    lp(text(w.attester)), lp(nfc(roomOf(w))), lp(decimal(positionOf(w))), lp(text(w.root)),
+    lp(text(w.by)), lp(text(w.role)), lp(decimal(w.at)),
+  ]);
 }
 
 /** Sign a witness countersignature in place with the witness's raw Ed25519 private key. */
 function signWitness(w, privateKeyB64url) {
-  if (!w || !w.attester || !w.by || w.upto_seq === undefined || !w.root) {
-    throw new Error('signWitness requires attester + by + upto_seq + root');
-  }
-  w.sig = crypto.sign(null, witnessPayload(w), privateKeyObject(privateKeyB64url)).toString('base64url');
+  if (!w || !w.attester || !w.by || positionOf(w) === undefined || !w.root) throw new Error('signWitness requires attester + by + uptoSeq + root');
+  w.sig = sign(witnessPayload(w), privateKeyB64url);
   w.sigAlg = 'ed25519';
   return w;
 }
 
 /** Verify a witness countersignature against the WITNESS's raw Ed25519 public key. */
 function verifyWitness(w, witnessPublicKeyB64url) {
-  if (!w || !w.sig || w.sigAlg !== 'ed25519') return { signed: false, valid: false };
-  if (!witnessPublicKeyB64url) return { signed: true, valid: false, error: 'no-public-key' };
-  try {
-    const ok = crypto.verify(null, witnessPayload(w), publicKeyObject(witnessPublicKeyB64url), Buffer.from(w.sig, 'base64url'));
-    return ok ? { signed: true, valid: true } : { signed: true, valid: false, error: 'bad-signature' };
-  } catch (e) {
-    return { signed: true, valid: false, error: e.message };
-  }
+  return verify(witnessPayload, w, witnessPublicKeyB64url);
+}
+
+// ── The wire form (sym-attest-v1 §5) ─────────────────────────────────────────────────
+
+const ID_RE = /^[\x21-\x7e]{1,128}$/;
+const TOKEN_RE = /^[a-z0-9][a-z0-9_-]{0,31}$/;
+const HEX64 = /^[0-9a-f]{64}$/;
+const SIG_RE = /^[A-Za-z0-9_-]{86}$/;
+const isId = (v) => typeof v === 'string' && ID_RE.test(v);
+const isRoom = (v) => typeof v === 'string' && v.length > 0 && v.length <= 256;
+const isTime = (v) => Number.isSafeInteger(v) && v >= 0;
+const isPos = (v) => Number.isSafeInteger(v) && v >= 1;
+
+/** An internal attestation as the `sym-attest-attestation` frame carries it. */
+function toWireAttestation(a) {
+  const categories = {};
+  for (const f of CAT7_CATEGORIES) categories[f] = a.categories ? a.categories[f] : undefined;
+  return { of: a.of, assertionId: a.assertionId, by: a.by, at: a.at, room: roomOf(a), method: a.method, verdict: a.verdict, categories, role: a.role, seq: a.seq, prev: a.prev, sigAlg: a.sigAlg, sig: a.sig };
+}
+
+/**
+ * A `sym-attest-attestation` frame's attestation, checked field by field (§6 step 1), as the
+ * store holds it — or null.
+ */
+function fromWireAttestation(w) {
+  if (!w || typeof w !== 'object' || Array.isArray(w)) return null;
+  if (typeof w.of !== 'string' || !/^cmb-[0-9a-f]{64}$/.test(w.of)) return null;
+  if (typeof w.assertionId !== 'string' || !/^asrt-[0-9a-f]{64}$/.test(w.assertionId)) return null;
+  if (!isId(w.by) || !isTime(w.at) || !isRoom(w.room)) return null;
+  if (typeof w.method !== 'string' || !TOKEN_RE.test(w.method)) return null;
+  if (!RECORD_VERDICTS.includes(w.verdict)) return null;
+  const c = w.categories;
+  if (!c || typeof c !== 'object' || Array.isArray(c)) return null;
+  const categories = {};
+  for (const f of CAT7_CATEGORIES) { if (!VERDICTS.includes(c[f])) return null; categories[f] = c[f]; }
+  if (Object.keys(c).length !== CAT7_CATEGORIES.length) return null;
+  if (typeof w.role !== 'string' || !TOKEN_RE.test(w.role)) return null;
+  if (!isPos(w.seq)) return null;
+  if (w.seq === 1 ? w.prev !== 'genesis' : !(typeof w.prev === 'string' && HEX64.test(w.prev))) return null;
+  if (w.sigAlg !== 'ed25519' || typeof w.sig !== 'string' || !SIG_RE.test(w.sig)) return null;
+  return { of: w.of, assertionId: w.assertionId, by: w.by, at: w.at, roster: w.room, method: w.method, verdict: w.verdict, categories, role: w.role, seq: w.seq, prev: w.prev, sigAlg: w.sigAlg, sig: w.sig };
+}
+
+function toWireCheckpoint(cp) {
+  return { by: cp.by, room: roomOf(cp), uptoSeq: positionOf(cp), root: cp.root, at: cp.at, sigAlg: cp.sigAlg, sig: cp.sig };
+}
+function fromWireCheckpoint(w) {
+  if (!w || typeof w !== 'object' || Array.isArray(w)) return null;
+  if (!isId(w.by) || !isRoom(w.room) || !isPos(w.uptoSeq) || typeof w.root !== 'string' || !HEX64.test(w.root) || !isTime(w.at)) return null;
+  if (w.sigAlg !== 'ed25519' || typeof w.sig !== 'string' || !SIG_RE.test(w.sig)) return null;
+  return { type: 'checkpoint', by: w.by, roster: w.room, upto_seq: w.uptoSeq, root: w.root, at: w.at, sigAlg: w.sigAlg, sig: w.sig };
+}
+
+function toWireWitness(x) {
+  return { attester: x.attester, room: roomOf(x), uptoSeq: positionOf(x), root: x.root, by: x.by, role: x.role, at: x.at, sigAlg: x.sigAlg, sig: x.sig };
+}
+function fromWireWitness(w) {
+  if (!w || typeof w !== 'object' || Array.isArray(w)) return null;
+  if (!isId(w.attester) || !isRoom(w.room) || !isPos(w.uptoSeq) || typeof w.root !== 'string' || !HEX64.test(w.root)) return null;
+  if (!isId(w.by) || typeof w.role !== 'string' || !TOKEN_RE.test(w.role) || !isTime(w.at)) return null;
+  if (w.sigAlg !== 'ed25519' || typeof w.sig !== 'string' || !SIG_RE.test(w.sig)) return null;
+  return { type: 'witness', attester: w.attester, roster: w.room, upto_seq: w.uptoSeq, root: w.root, by: w.by, role: w.role, at: w.at, sigAlg: w.sigAlg, sig: w.sig };
+}
+
+/** `sym-attest-node-stats` (§5.4): unsigned, informational, attributed to the session's peer. */
+function fromWireNodeStats(w) {
+  if (!w || typeof w !== 'object' || Array.isArray(w)) return null;
+  const n = (v) => Number.isSafeInteger(v) && v >= 0;
+  if (!n(w.emitted) || !n(w.admitted) || !n(w.memory) || !isTime(w.at)) return null;
+  return { emitted: w.emitted, admitted: w.admitted, memory: w.memory, at: w.at };
 }
 
 module.exports = {
@@ -194,5 +314,12 @@ module.exports = {
   witnessPayload,
   signWitness,
   verifyWitness,
-  VERDICTS,
+  chainLink,
+  attestMerkleRoot,
+  toWireAttestation, fromWireAttestation,
+  toWireCheckpoint, fromWireCheckpoint,
+  toWireWitness, fromWireWitness,
+  fromWireNodeStats,
+  ATTEST_FRAME, LEGACY_ATTEST_FRAMES, ATTEST_DOMAIN: DOMAIN,
+  VERDICTS, RECORD_VERDICTS,
 };
diff --git a/lib/frame-handler.js b/lib/frame-handler.js
index bcf92929..cf9e6cc6 100644
--- a/lib/frame-handler.js
+++ b/lib/frame-handler.js
@@ -4,6 +4,7 @@ const crypto = require('crypto');
 
 const { recordKey, recordLineage, recordParents, recordCreatedBy, setRecordLineage } = require('./record');
 const { wireNodeId, wireName } = require('./wire-identity');
+const { ATTEST_FRAME, fromWireAttestation, fromWireCheckpoint, fromWireWitness, fromWireNodeStats } = require('./core/attestation');
 
 /**
  * @module @sym-bot/sym/frame-handler
@@ -260,6 +261,12 @@ class FrameHandler {
   }
 
   /** A frame type that rides only on sessions that selected an extension (§16.3). */
+  /** @private A sym-attest frame whose fields are not what the extension defines: refused, counted. */
+  _attestMalformed(session, type) {
+    if (typeof this._node._noteSessionRefusal === 'function') this._node._noteSessionRefusal(session, type, 'malformed');
+    return undefined;
+  }
+
   _extensionRefused(session, type, ext) {
     if (typeof session.has === 'function' && session.has(ext)) return false;
     if (typeof this._node._noteSessionRefusal === 'function') this._node._noteSessionRefusal(session, type, `${ext} not selected`);
@@ -286,23 +293,46 @@ class FrameHandler {
       case 'peer-info':
         return this._handlePeerInfo(peerId, peerName, msg);
 
-      case 'attestation':
+      // sym-attest-v1 (draft spec PR #27): the extension's frames, only where it was selected, each
+      // checked field by field and translated to the store's form before anything else.
+      case ATTEST_FRAME.attestation: {
         if (this._extensionRefused(session, msg.type, 'sym-attest-v1')) return undefined;
-        return this._handleAttestation(peerId, peerName, msg);
+        const att = fromWireAttestation(msg.attestation);
+        if (!att) return this._attestMalformed(session, msg.type);
+        return this._handleAttestation(peerId, peerName, { attestation: att });
+      }
 
-      case 'checkpoint':
+      case ATTEST_FRAME.checkpoint: {
         if (this._extensionRefused(session, msg.type, 'sym-attest-v1')) return undefined;
-        if (msg.checkpoint) this._node._ingestCheckpoint(msg.checkpoint, peerId);
+        const cp = fromWireCheckpoint(msg.checkpoint);
+        if (!cp) return this._attestMalformed(session, msg.type);
+        this._node._ingestCheckpoint(cp, peerId);
         return undefined;
+      }
 
-      case 'witness':
+      case ATTEST_FRAME.witness: {
+        if (this._extensionRefused(session, msg.type, 'sym-attest-v1')) return undefined;
+        const w = fromWireWitness(msg.witness);
+        if (!w) return this._attestMalformed(session, msg.type);
+        this._node._ingestWitness(w, peerId);
+        return undefined;
+      }
+
+      case ATTEST_FRAME.nodeStats: {
         if (this._extensionRefused(session, msg.type, 'sym-attest-v1')) return undefined;
-        if (msg.witness) this._node._ingestWitness(msg.witness, peerId);
+        const stats = fromWireNodeStats(msg.stats);
+        if (!stats) return this._attestMalformed(session, msg.type);
+        this._node._ingestNodeStats(stats, peerId, peerName);
         return undefined;
+      }
 
+      case 'attestation':
+      case 'checkpoint':
+      case 'witness':
       case 'node-stats':
-        if (this._extensionRefused(session, msg.type, 'sym-attest-v1')) return undefined;
-        if (msg.stats) this._node._ingestNodeStats(msg.stats, peerId);
+        // sym 0.13's bare-name frames (and their 0.13 signed constructions): legacy, never accepted
+        // on a Core Secure session (sym-attest-v1 §9).
+        if (typeof this._node._noteSessionRefusal === 'function') this._node._noteSessionRefusal(session, msg.type, 'legacy-attest-frame');
         return undefined;
 
       case 'cmb-fetch':
@@ -595,38 +625,41 @@ class FrameHandler {
    * plaintext (§18.2.1) — and then one `cmb-fetch-result` that carries only the correlation id and
    * the key lists:
    *
-   *   { type: 'cmb-fetch-result', reqId, found: [key…], notFound: [key…], timestamp }
+   *   { type: 'cmb-fetch-result', reqId, returned: [key…], missing: [key…], timestamp }
    *
-   * sealed as a control frame (`control-encrypted`). The session is ordered, so the records arrive
-   * before the result that lists them. A request names one `key` (the §7 schema) or up to
-   * MAX_FETCH_KEYS `keys`. Only a signed v2.0 record is served; anything else is not found.
+   * sealed as a control frame (`control-encrypted`), field names per draft spec PR #26. Each key
+   * requested appears in exactly one list, once; the records go first and the result last, on the
+   * session's one sequence, so they arrive before the result that lists them. A request names one
+   * `key` (the §7 schema) or up to MAX_FETCH_KEYS `keys`. Only a signed v2.0 record is served;
+   * anything else (a key this node does not hold, one not well-formed) is `missing`.
    * @private
    */
   _handleCmbFetch(peerId, peerName, msg, session) {
     if (!msg || typeof msg.reqId !== 'string' || !msg.reqId || msg.reqId.length > 128) return;
     if (!session || typeof session.send !== 'function') return;
     const asked = Array.isArray(msg.keys) ? msg.keys.slice(0, MAX_FETCH_KEYS) : [msg.key];
-    const found = [];
-    const notFound = [];
+    const returned = [];
+    const missing = [];
     const seen = new Set();
     for (const key of asked) {
-      if (typeof key !== 'string' || !key || key.length > 128 || seen.has(key)) continue;
+      // A key is text; anything else names nothing and is not listed.
+      if (typeof key !== 'string' || !key || key.length > 256 || seen.has(key)) continue;
       seen.add(key);
-      const cmb = this._node._store.get(key)?.cmb;
+      const cmb = key.length <= 128 ? this._node._store.get(key)?.cmb : null;
       const servable = !!(cmb && cmb.metadata && cmb.metadata.signatureSuite === 'mmp-sig-v2.0' && cmb.metadata.sig);
-      if (servable && session.send({ type: 'cmb', cmb: recordAsSigned(cmb) }) !== false) found.push(key);
-      else notFound.push(key);
+      if (servable && session.send({ type: 'cmb', cmb: recordAsSigned(cmb) }) !== false) returned.push(key);
+      else missing.push(key);
     }
-    if (found.length + notFound.length === 0) return;
-    session.send({ type: 'cmb-fetch-result', reqId: msg.reqId, found, notFound, timestamp: Date.now() });
-    if (found.length) this._node._log(`[cmb-fetch] served ${found.length} record(s) (${found[0].slice(0, 16)}…) to ${peerName}`);
+    if (returned.length + missing.length === 0) return;
+    session.send({ type: 'cmb-fetch-result', reqId: msg.reqId, returned, missing, timestamp: Date.now() });
+    if (returned.length) this._node._log(`[cmb-fetch] served ${returned.length} record(s) (${returned[0].slice(0, 16)}…) to ${peerName}`);
   }
 
   /**
    * The answer a peer sent this node's cmb-fetch: the correlation id and the key lists, after the
    * records themselves (see _handleCmbFetch). A record that verified has already resolved the
-   * request; a request still open here got no verifying record from this peer — listed `notFound`,
-   * listed `found` but discarded on its content address, or never sent — so this peer counts as a
+   * request; a request still open here got no verifying record from this peer — listed `missing`,
+   * listed `returned` but discarded on its content address, or never sent — so this peer counts as a
    * miss. Only a peer the request was sent to can close it (fetchCMB).
    * @private
    */
@@ -1066,7 +1099,7 @@ class FrameHandler {
           stableThreshold: this._node._svafStableThreshold,
           guardedThreshold: this._node._svafGuardedThreshold,
         });
-        this._node._buildAdmissionAttestation(rejKey, 'rejected', rejVerdicts, 'neural');
+        this._node._buildAdmissionAttestation(rejKey, 'rejected', rejVerdicts, 'neural', msg.cmb?.metadata?.assertionId);
       }
 
       // MMP Section 9.3: mood MUST still be delivered from rejected CMBs.
@@ -1121,7 +1154,8 @@ class FrameHandler {
         stableThreshold: this._node._svafStableThreshold,
         guardedThreshold: this._node._svafGuardedThreshold,
       });
-      const att = this._node._buildAdmissionAttestation(incomingKey, decision, categoryVerdicts, 'neural');
+      // `of` is the record's cognition key (never the directed mark this node dedups by).
+      const att = this._node._buildAdmissionAttestation(recordKey(msg.cmb) || incomingKey, decision, categoryVerdicts, 'neural', msg.cmb?.metadata?.assertionId);
       // On the entry, beside the record: a two-section record has exactly two members (§8.8.1).
       if (att) fusedEntry.admission = att;
     }
@@ -1243,7 +1277,7 @@ class FrameHandler {
       // event (omission-evidence). The Phase-A heuristic already produced the
       // per-category verdict; index it (no remix is stored on this path).
       const rejKey = recordKey(msg.cmb) || msg.key;
-      if (rejKey) this._node._buildAdmissionAttestation(rejKey, result.decision, result.categoryVerdicts, 'heuristic');
+      if (rejKey) this._node._buildAdmissionAttestation(rejKey, result.decision, result.categoryVerdicts, 'heuristic', msg.cmb?.metadata?.assertionId);
 
       // MMP Section 9.3: mood MUST still be delivered from rejected CMBs.
       // (redundant signals also deliver mood — the affect may have changed)
@@ -1259,7 +1293,7 @@ class FrameHandler {
     // persist it on the remix's store entry as the durable audit record.
     if (result.fusedEntry && result.fusedEntry.cmb) {
       const of = recordKey(msg.cmb) || msg.key;
-      const att = this._node._buildAdmissionAttestation(of, result.decision, result.categoryVerdicts, 'heuristic');
+      const att = this._node._buildAdmissionAttestation(of, result.decision, result.categoryVerdicts, 'heuristic', msg.cmb?.metadata?.assertionId);
       // On the entry, beside the record: a two-section record has exactly two members (§8.8.1).
       if (att) result.fusedEntry.admission = att;
     }
diff --git a/lib/node.js b/lib/node.js
index 26d6f7fd..bb35d63e 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -41,7 +41,10 @@ const {
   signCMB, assertionIdV2_0, mintRemixKey, signAttestation, verifyAttestation, verifyAttestationRole,
   merkleRoot, signCheckpoint, verifyCheckpoint, signWitness, verifyWitness,
   signGrant, roleRank, CAT7_CATEGORIES, assertRecordSendable,
+  attestMerkleRoot, toWireAttestation, toWireCheckpoint, toWireWitness, ATTEST_FRAME,
 } = require('./core');
+/** What a checkpoint made since 0.14 commits (the sym-attest-v1 root); one without it is 0.13's. */
+const ATTEST_SCHEME = 'sym-attest-v1';
 const { MMP_EMIT_V2 } = require('./emit-policy'); // the single reader-first flip switch
 /** How far this node's record timestamps may run ahead of its clock before they follow it again. */
 const MAX_CLOCK_LEAD_MS = 60 * 1000;
@@ -63,7 +66,9 @@ const EXT_ATTEST = 'sym-attest-v1';
 const EXT_XMESH_INSIGHT = 'xmesh-insight-v1';
 const OFFERED_EXTENSIONS = Object.freeze([EXT_CMB_ENCRYPTED_V2, EXT_ATTEST, EXT_XMESH_INSIGHT]);
 /** Frames that ride only on sessions that selected sym-attest-v1. */
-const ATTEST_FRAMES = new Set(['attestation', 'checkpoint', 'witness', 'node-stats']);
+// The extension's frames (MMP §16.2 names, draft spec PR meshcognition-website#27); sym 0.13's bare
+// `attestation` / `checkpoint` / `witness` / `node-stats` are never sent on a Core Secure session.
+const ATTEST_FRAMES = new Set(Object.values(ATTEST_FRAME));
 /** Legacy hellos refused on the Core Secure listener are said at most once a minute per address. */
 const LEGACY_REFUSAL_REPORT_MS = 60_000;
 const { SEND_FAILURE, MAX_FRAME_SIZE } = require('./frame-parser');
@@ -164,6 +169,8 @@ const CHAIN_SERVE_BURST = 16;
  * meshcognition-website#23, where an error only prompts a new handshake). 4400 is a session closing.
  */
 const UNKNOWN_SESSION_CODE = 4404;
+/** MMP §7.2 error code for a bound nodeId proving a different key (draft spec PR #21). */
+const IDENTITY_CONFLICT = 1009;
 /** Relay handshakes in flight at once, at most (each holds a 10 s deadline and costs a key agreement). */
 const RELAY_HANDSHAKES_MAX = 256;
 
@@ -1204,8 +1211,12 @@ class SymNode extends EventEmitter {
    * @private
    */
   _emitNodeStats() {
-    try { this._gossipToRoster({ type: 'node-stats', stats: this._nodeStats() }); }
-    catch (err) { this._log(`node-stats emit failed: ${err.message}`); }
+    try {
+      // sym-attest-v1 §5.4: the counts and the time only; the receiver attributes them to this
+      // node's proven session (a self-asserted name and nodeId are not carried).
+      const s = this._nodeStats();
+      this._gossipToRoster({ type: ATTEST_FRAME.nodeStats, stats: { emitted: s.emitted, admitted: s.admitted, memory: s.memory, at: s.at } });
+    } catch (err) { this._log(`node-stats emit failed: ${err.message}`); }
   }
 
   /**
@@ -1215,9 +1226,10 @@ class SymNode extends EventEmitter {
    * stored. Ignores our own echo.
    * @private
    */
-  _ingestNodeStats(stats, fromPeerId) {
-    if (!stats || !stats.name || stats.nodeId === this.nodeId) return;
-    this.emit('node-stats', stats);
+  _ingestNodeStats(stats, fromPeerId, fromPeerName) {
+    if (!stats || !fromPeerId || fromPeerId === this.nodeId) return;
+    // Attributed to the session's proven peer, never stored, never evidence (sym-attest-v1 §5.4).
+    this.emit('node-stats', Object.freeze({ nodeId: fromPeerId, name: fromPeerName || null, emitted: stats.emitted, admitted: stats.admitted, memory: stats.memory, at: stats.at }));
   }
 
   /**
@@ -1235,9 +1247,10 @@ class SymNode extends EventEmitter {
    * @param {string} method - 'neural' | 'heuristic'
    * @private
    */
-  _buildAdmissionAttestation(of, verdict, categoryVerdicts, method) {
+  _buildAdmissionAttestation(of, verdict, categoryVerdicts, method, assertionId) {
     const att = {
       of,
+      assertionId,
       by: this.nodeId,
       at: Date.now(),
       roster: this._room,
@@ -1254,7 +1267,7 @@ class SymNode extends EventEmitter {
       if (!isCanonicalSig(att.sig)) throw new Error('signature not in canonical form');
       // Advance the per-attester chain: the next attestation's `prev` is this one's
       // signature hash, so any dropped attestation breaks the link (omission-evidence).
-      this._attestHead = crypto.createHash('sha256').update(att.sig).digest('hex');
+      this._attestHead = chainHash(att.sig); // sha256 of the signature's bytes (sym-attest-v1 §5.1)
       // Index it — every gating event this node makes enters its own chain + the
       // per-CMB audit trail, whether or not it produced a stored remix.
       this._attestations.record(att);
@@ -1351,7 +1364,7 @@ class SymNode extends EventEmitter {
    * @private
    */
   _gossipAttestation(att, exceptPeerId = null) {
-    this._gossipToRoster({ type: 'attestation', attestation: att }, exceptPeerId);
+    this._gossipToRoster({ type: ATTEST_FRAME.attestation, attestation: toWireAttestation(att) }, exceptPeerId);
   }
 
   /** Send a frame to every roster peer (same-room by mDNS isolation), optionally
@@ -1385,17 +1398,18 @@ class SymNode extends EventEmitter {
     if (chain.length === 0) return null;
     const cp = {
       type: 'checkpoint',
+      scheme: ATTEST_SCHEME,
       by: this.nodeId,
       roster: this._room,
       upto_seq: chain[chain.length - 1].seq,
-      root: merkleRoot(chain.map(a => a.sig)),
+      root: attestMerkleRoot(chain.map(a => a.sig)), // promote-odd, leaf/node tags (sym-attest-v1 §5.2)
       at: Date.now(),
     };
     try {
       signCheckpoint(cp, this._identity.privateKey);
       if (!isCanonicalSig(cp.sig)) throw new Error('signature not in canonical form');
       this._attestations.recordCheckpoint(cp);
-      this._gossipToRoster({ type: 'checkpoint', checkpoint: cp });
+      this._gossipToRoster({ type: ATTEST_FRAME.checkpoint, checkpoint: toWireCheckpoint(cp) });
       return cp;
     } catch (err) {
       this._log(`Checkpoint signing failed: ${err.message}`);
@@ -1446,7 +1460,7 @@ class SymNode extends EventEmitter {
       this.emit('metric', { type: 'attestation-conflict', kind: 'checkpoint', attester: cp.by, upto_seq: cp.upto_seq, keptRoot: r.keptRoot, otherRoot: cp.root });
     }
     if (r.stored) {
-      this._gossipToRoster({ type: 'checkpoint', checkpoint: cp }, fromPeerId); // relay-once
+      this._gossipToRoster({ type: ATTEST_FRAME.checkpoint, checkpoint: toWireCheckpoint(cp) }, fromPeerId); // relay-once
       this._witnessCheckpoint(cp); // countersign as a roster witness
     }
     return { ok: r.stored, reason: r.reason };
@@ -1609,7 +1623,7 @@ class SymNode extends EventEmitter {
       signWitness(w, this._identity.privateKey);
       if (!isCanonicalSig(w.sig)) throw new Error('signature not in canonical form');
       this._attestations.recordWitness(w);
-      this._gossipToRoster({ type: 'witness', witness: w });
+      this._gossipToRoster({ type: ATTEST_FRAME.witness, witness: toWireWitness(w) });
     } catch (err) {
       this._log(`Witness signing failed: ${err.message}`);
     }
@@ -1635,7 +1649,7 @@ class SymNode extends EventEmitter {
     if (!verifyWitness(w, key).valid) return { ok: false, reason: 'bad-signature' };
     this._roster.noteVerified(w.by);
     const r = this._attestations.recordWitness(w);
-    if (r.stored) this._gossipToRoster({ type: 'witness', witness: w }, fromPeerId);
+    if (r.stored) this._gossipToRoster({ type: ATTEST_FRAME.witness, witness: toWireWitness(w) }, fromPeerId);
     if (r.reason === 'conflict' && r.first) {
       this._log(`[sym-security] conflicting witness from ${String(w.by).slice(0, 8)} for ${String(w.attester).slice(0, 8)} at ${w.upto_seq}: kept root ${String(r.keptRoot).slice(0, 12)}, refused ${String(w.root).slice(0, 12)}`);
       this.emit('metric', { type: 'attestation-conflict', kind: 'witness', attester: w.attester, upto_seq: w.upto_seq, witness: w.by, keptRoot: r.keptRoot, otherRoot: w.root });
@@ -1659,7 +1673,8 @@ class SymNode extends EventEmitter {
     const present = new Set(chain.map(a => a.seq));
     const gaps = [];
     for (let s = 1; s <= cp.upto_seq; s++) if (!present.has(s)) gaps.push(s);
-    const recomputedRoot = merkleRoot(chain.map(a => a.sig));
+    // A checkpoint made since 0.14 commits the sym-attest-v1 root; one kept from 0.13 the old one.
+    const recomputedRoot = (cp.scheme === ATTEST_SCHEME ? attestMerkleRoot : merkleRoot)(chain.map(a => a.sig));
     const consistent = recomputedRoot === cp.root;
     return {
       checkpoint: cp,
@@ -1756,18 +1771,21 @@ class SymNode extends EventEmitter {
     // A log sink that fails must not become the failure it is reporting.
     const note = (m) => { try { this._log(m); } catch { /* nothing left to tell */ } };
     const subject = `${String(att.of).slice(0, 12)} by ${String(att.by).slice(0, 8)}`;
-    // The canonicalizer joins these with ToString, so String() of an object keeps the signed bytes.
-    const signed = (v) => (v === null || v === undefined ? null : (typeof v === 'object' || typeof v === 'function') ? String(v) : v);
+    // sym-attest-v1 signs a text field as its text and anything else as empty, and a number as its
+    // decimal: the event shows a text or a finite number as is and anything else as null, which signs
+    // the same, so verifyAttestation(event, key) re-checks it.
+    const signed = (v) => (typeof v === 'string' ? v : null);
+    const signedInt = (v) => (Number.isSafeInteger(v) ? v : null);
     let event;
     try {
       const categories = {};
       for (const f of CAT7_CATEGORIES) {
         const v = att.categories && att.categories[f];
-        categories[f] = v ? String(v) : null; // the form canonicalCategories signs
+        categories[f] = typeof v === 'string' ? v : null; // the form the signature covers
       }
-      const role = verifyAttestationRole(att, (id, at) => this.resolveRole(id, at));
-      // As strings, the form the canonicalizer signs: ['anchor'] and 'anchor' claim the same, as do 2 and
-      // '2'. Neither field is signed, and both default to 'participant', so String() never yields 'null'.
+      // The claim as signed: a text role, or none (an absent or non-text role signs as empty and claims
+      // 'participant').
+      const role = verifyAttestationRole({ ...att, role: typeof att.role === 'string' && att.role ? att.role : undefined }, (id, at) => this.resolveRole(id, at));
       const roleClaimed = String(role.claimed);
       const roleResolved = String(role.resolved);
       event = Object.freeze({
@@ -1780,10 +1798,12 @@ class SymNode extends EventEmitter {
         roleClaimed,
         roleResolved,
         roleMatches: roleClaimed === roleResolved,
-        methodUnsigned: signed(att.method),
+        method: signed(att.method),
+        assertionId: signed(att.assertionId),
+        room: signed(att.roster),
         roster: signed(att.roster),
-        at: signed(att.at),
-        seq: signed(att.seq),
+        at: signedInt(att.at),
+        seq: signedInt(att.seq),
         prev: signed(att.prev),
         sig: signed(att.sig),
         sigAlg: signed(att.sigAlg),
@@ -3312,7 +3332,7 @@ class SymNode extends EventEmitter {
     if (expected && expected !== session.identityKey) {
       this._roster.bind(session.nodeId, session.identityKey, 'proven'); // records the conflict
       this._log(`Refused ${session.name} (${session.nodeId.slice(0, 8)}): it proved a key that is not the one bound to its nodeId (${this._roster.source(session.nodeId)}) — a key conflict for the operator (sym keys resolve)`);
-      session.close('key-conflict');
+      this._refuseIdentityConflict(session);
       return;
     }
     // A room-join grant this node holds goes first, so a gated peer can admit it.
@@ -3360,7 +3380,7 @@ class SymNode extends EventEmitter {
   _admitSession(session) {
     const nodeId = session.nodeId;
     const b = this._roster.bind(nodeId, session.identityKey, 'proven');
-    if (!b.bound && b.reason === 'conflict') { session.close('key-conflict'); return; }
+    if (!b.bound && b.reason === 'conflict') { this._refuseIdentityConflict(session); return; }
     if (!b.bound && b.reason === 'full') this._log(`Key registry full: ${nodeId.slice(0, 8)} is held for this session only`);
     // First contact starts the binding's clock; a later session re-proving the same key is something
     // verified under it, so the binding never expires (design D3 binding lifetime).
@@ -3382,7 +3402,7 @@ class SymNode extends EventEmitter {
       peer = { peerId: nodeId, name: session.name, identityKey: session.identityKey, transports: new Map(), transport: null, isOutbound: session.role === 'client', source: session.kind, lastSeen: Date.now(), joinedAt: Date.now() };
       this._peers.set(nodeId, peer);
     } else if (peer.identityKey !== session.identityKey) {
-      session.close('key-conflict');
+      this._refuseIdentityConflict(session);
       return;
     }
     // The sticky floor arms now (a proven binding): a Legacy Import session for this nodeId ends.
@@ -3483,6 +3503,10 @@ class SymNode extends EventEmitter {
         this._sayOncePerMinute(`hs|${reason}|${session.remote || session.relayFrom || ''}`, `Handshake ${session.kind === 'relay' ? `with relay peer ${String(session.relayFrom).slice(0, 8)}` : `on ${session.role === 'client' ? 'an outbound' : 'an inbound'} LAN connection`} failed: ${reason}${info.detail ? ` (${String(info.detail).slice(0, 160)})` : ''}`);
       }
     }
+    if (reason === 'identity-conflict') {
+      this._sayOncePerMinute(`idc|${session.nodeId || session.relayFrom || session.remote || ''}`, `[sym-security] ${session.name || session.relayFrom || 'a peer'} refused this node with IDENTITY_CONFLICT (1009): it binds this nodeId to a different key. Not retrying; check which key is genuine.`);
+      this.emit('metric', { type: 'identity-conflict-refused-by-peer', peer: session.nodeId || session.relayFrom || null });
+    }
     if (session.kind === 'bonjour' && session.expectNodeId) this._pendingBonjour?.delete(session.expectNodeId);
     if (session.kind === 'relay') {
       const st = this._relaySessions && this._relaySessions.get(session.relayFrom);
@@ -3514,7 +3538,7 @@ class SymNode extends EventEmitter {
     // A relay client re-handshakes while the peer is present (frame loss, a desync, a timeout, the
     // server's error frame); a superseded or deliberately closed session does not.
     if (session.kind === 'relay' && session.role === 'client' && this._running && !session._superseded
-        && reason !== 'node-stopped' && reason !== 'relay-peer-left' && reason !== 'relay-disconnected' && reason !== 'key-conflict' && reason !== 'admission-refused'
+        && reason !== 'node-stopped' && reason !== 'relay-peer-left' && reason !== 'relay-disconnected' && reason !== 'key-conflict' && reason !== 'identity-conflict' && reason !== 'admission-refused'
         && this._relay.present.has(session.relayFrom)) {
       this._scheduleRelayRetry(session.relayFrom);
     }
@@ -3532,6 +3556,26 @@ class SymNode extends EventEmitter {
     if (this._lastAnchorSent) this._lastAnchorSent.delete(nodeId);
   }
 
+  /**
+   * A confirmed session proved a key other than the one bound to its nodeId (design D3): refused
+   * with the error MMP draft spec PR meshcognition-website#21 defines, 1009 IDENTITY_CONFLICT, then
+   * closed. Nothing per-peer was created; the conflict is recorded by the registry.
+   * @private
+   */
+  _refuseIdentityConflict(session) {
+    try {
+      session.trySend({ type: 'error', code: IDENTITY_CONFLICT, message: 'IDENTITY_CONFLICT', ...(session.sessionId ? { detail: `session:${session.sessionId}` } : {}) });
+    } catch { /* the session closes below either way */ }
+    const t = session.transport;
+    if (t && typeof t.end === 'function' && session.kind !== 'relay') {
+      // TCP: the error frame goes out before the connection closes.
+      session.close('key-conflict', { notify: false, closeTransport: false });
+      t.end();
+    } else {
+      session.close('key-conflict', { notify: false });
+    }
+  }
+
   /** @private Count and (once a minute per reason) say a frame a session did not take. */
   _noteSessionRefusal(session, type, reason) {
     // Taken as text before anything prints it: a frame's type is whatever its sender wrote.
@@ -3747,10 +3791,12 @@ class SymNode extends EventEmitter {
           return;
         }
         const m = typeof payload.detail === 'string' && /^session:([0-9a-f]{32})$/.exec(payload.detail);
+        // 1009: the peer's registry binds this node's nodeId to another key. Not retried (said once).
+        const why = payload.code === IDENTITY_CONFLICT ? 'identity-conflict' : 'peer-closed';
         for (const s of [st.client, st.server, ...st.confirmed]) {
           if (!s || s.closed) continue;
           if (m && s.sessionId && s.sessionId !== m[1]) continue;
-          s.close('peer-closed', { notify: false });
+          s.close(why, { notify: false });
         }
         return;
       }
diff --git a/lib/session.js b/lib/session.js
index 97e047f4..1234b7a2 100644
--- a/lib/session.js
+++ b/lib/session.js
@@ -278,7 +278,8 @@ class PeerSession extends EventEmitter {
       case 'error':
         // §7.2: 2xxx errors are informational; anything else ends the session (the peer closed it).
         if (Number.isInteger(f.code) && f.code >= 2000 && f.code < 3000) return;
-        this._fail('peer-closed', typeof f.message === 'string' ? f.message.slice(0, 200) : 'error frame', { notify: false });
+        // 1009 IDENTITY_CONFLICT (draft spec PR #21): the peer binds this node's nodeId to another key.
+        this._fail(f.code === 1009 ? 'identity-conflict' : 'peer-closed', typeof f.message === 'string' ? f.message.slice(0, 200) : 'error frame', { notify: false });
         return;
       default:
         // A legacy `cmb`, a plaintext `mood`, a legacy `handshake`, `state-sync`, a stray hello: none
diff --git a/lib/transport.js b/lib/transport.js
index e6f79059..481aaed2 100644
--- a/lib/transport.js
+++ b/lib/transport.js
@@ -81,6 +81,17 @@ class TcpTransport extends EventEmitter {
     try { this._socket.destroy(); } catch {}
   }
 
+  /** Close after what was written has gone out (an error frame before a refusal), at most 1 s later. */
+  end() {
+    if (this._closed) return;
+    this._closed = true;
+    try {
+      this._socket.end();
+      const t = setTimeout(() => { try { this._socket.destroy(); } catch {} }, 1000);
+      if (t.unref) t.unref();
+    } catch { try { this._socket.destroy(); } catch {} }
+  }
+
   /** Drain any buffered bytes into a new transport (for handshake hand-off). */
   get pendingBuffer() {
     return this._parser.buffer || Buffer.alloc(0);
diff --git a/tests/_core-secure.js b/tests/_core-secure.js
index 5c9efb96..150a8d10 100644
--- a/tests/_core-secure.js
+++ b/tests/_core-secure.js
@@ -60,6 +60,8 @@ function memoryPipe({ tap } = {}) {
       if (!other._closed) { other._closed = true; setImmediate(() => other.emit('close')); }
     };
     self.destroy = self.close;
+    // Close after what was sent has been delivered (as a socket's end() does).
+    self.end = () => { setImmediate(() => self.close()); };
   }
   return [a, b];
 }
diff --git a/tests/admission-attestation.test.js b/tests/admission-attestation.test.js
index e2bf6673..6dfe0beb 100644
--- a/tests/admission-attestation.test.js
+++ b/tests/admission-attestation.test.js
@@ -53,7 +53,7 @@ describe('node._buildAdmissionAttestation', () => {
       assert.strictEqual(a1.seq, 1);
       assert.strictEqual(a1.prev, 'genesis');
       assert.strictEqual(a2.seq, 2);
-      assert.strictEqual(a2.prev, crypto.createHash('sha256').update(a1.sig).digest('hex'), 'a2.prev links a1');
+      assert.strictEqual(a2.prev, crypto.createHash('sha256').update(Buffer.from(a1.sig, 'base64url')).digest('hex'), 'a2.prev links a1');
       assert.notStrictEqual(a1.sig, a2.sig);
     });
   });
@@ -118,7 +118,7 @@ describe('attestation persistence — the audit trail survives a restart', () =>
       // not a reset to seq 1 (which would read as a gap / false omission).
       const a3 = n2._buildAdmissionAttestation('cmb-3', 'aligned', verdicts, 'heuristic');
       assert.strictEqual(a3.seq, 3, 'seq continues across restart');
-      assert.strictEqual(a3.prev, crypto.createHash('sha256').update(a2.sig).digest('hex'), 'prev links the pre-restart attestation');
+      assert.strictEqual(a3.prev, crypto.createHash('sha256').update(Buffer.from(a2.sig, 'base64url')).digest('hex'), 'prev links the pre-restart attestation');
       assert.deepStrictEqual(n2.verifyAttestationChain(), { ok: true, gaps: [], breaks: [] }, 'no gap/break across the restart boundary');
     } finally {
       fs.rmSync(nodeDir(name), { recursive: true, force: true });
@@ -179,10 +179,11 @@ describe("'attestation-received' — a peer's verified verdict is observable as
       assert.strictEqual(e.by, A.nodeId);
       assert.strictEqual(e.verdict, 'guarded');
       assert.deepStrictEqual({ ...e.categories }, verdicts);
-      assert.strictEqual(e.methodUnsigned, 'neural');
+      assert.strictEqual(e.method, 'neural', 'signed since sym-attest-v1');
+      assert.strictEqual(e.room, 'hotel');
       assert.strictEqual(e.roster, 'hotel');
       assert.strictEqual(e.seq, 2);
-      assert.strictEqual(e.prev, crypto.createHash('sha256').update(first.sig).digest('hex'));
+      assert.strictEqual(e.prev, crypto.createHash('sha256').update(Buffer.from(first.sig, 'base64url')).digest('hex'));
       assert.strictEqual(e.sig, att.sig);
       assert.strictEqual(e.sigAlg, 'ed25519');
       assert.strictEqual(e.verified, true);
@@ -231,19 +232,23 @@ describe("'attestation-received' — a peer's verified verdict is observable as
     });
   });
 
-  it('passes on only what the signature covers: CAT7 categories as signed strings, nothing a relay added', () => {
+  it('passes on only what the signature covers: the seven categories as signed, nothing a relay added; method and assertionId are signed', () => {
     withPair({}, ({ A, B, seen }) => {
-      // A signs a nested object as a category value: the signature covers its string form only.
-      const att = A._buildAdmissionAttestation('cmb-request-6', 'aligned', { ...verdicts, focus: { verdict: 'admit' } }, 'heuristic');
-      // A relay adds a category key and rewrites the method; neither is in the signed bytes.
-      const tampered = { ...att, method: 'neural', categories: { ...att.categories, recommendation: 'escalate' } };
-      assert.strictEqual(B._ingestAttestation(tampered, 'relay-node-id', 'housekeeping').ok, true, 'still verifies');
+      // A signs a nested object as a category value: sym-attest-v1 signs a non-text field as empty.
+      const att = A._buildAdmissionAttestation('cmb-request-6', 'aligned', { ...verdicts, focus: { verdict: 'admit' } }, 'heuristic', 'asrt-' + 'a'.repeat(64));
+      // A relay adds a category key: it is not in the signed bytes, and not passed on.
+      const padded = { ...att, categories: { ...att.categories, recommendation: 'escalate' } };
+      assert.strictEqual(B._ingestAttestation(padded, 'relay-node-id', 'housekeeping').ok, true, 'still verifies');
       const e = seen[0];
       assert.deepStrictEqual(Object.keys(e.categories), ['focus', 'issue', 'intent', 'motivation', 'commitment', 'perspective', 'mood']);
-      assert.strictEqual(e.categories.focus, '[object Object]', 'the signed form, not the object');
-      assert.strictEqual('method' in e, false, 'an unsigned method is never presented as signed');
-      assert.strictEqual(e.methodUnsigned, 'neural');
+      assert.strictEqual(e.categories.focus, null, 'the signed form (empty), not the object');
+      assert.strictEqual(e.method, 'heuristic');
+      assert.strictEqual(e.assertionId, 'asrt-' + 'a'.repeat(64));
       assert.deepStrictEqual(verifyAttestation(e, A._identity.publicKey), { signed: true, valid: true });
+      // 0.13 left `method` outside the signature; sym-attest-v1 signs it, and assertionId: rewriting either breaks it.
+      const next = A._buildAdmissionAttestation('cmb-request-6b', 'aligned', verdicts, 'heuristic', 'asrt-' + 'b'.repeat(64));
+      assert.strictEqual(B._ingestAttestation({ ...next, method: 'neural' }, 'relay-node-id', 'housekeeping').reason, 'bad-signature');
+      assert.strictEqual(verifyAttestation({ ...next, assertionId: 'asrt-' + 'c'.repeat(64) }, A._identity.publicKey).valid, false);
     });
   });
 
@@ -291,7 +296,7 @@ describe("'attestation-received' — a peer's verified verdict is observable as
       signAttestation(att, A._identity.privateKey);
       assert.strictEqual(B._ingestAttestation(att, A.nodeId, 'concierge').ok, true);
       const e = seen[0];
-      assert.strictEqual(e.prev, 'abc', 'a string, so no listener can change it under the next one');
+      assert.strictEqual(e.prev, null, 'a non-text field signs as empty and is shown as null');
       assert.strictEqual(e.role, null, 'no role was signed');
       assert.strictEqual(e.roleClaimed, 'participant', 'the claim roleMatches is computed against');
       assert.strictEqual(e.roleMatches, true);
@@ -302,16 +307,16 @@ describe("'attestation-received' — a peer's verified verdict is observable as
     });
   });
 
-  it("coerces an object-valued role claim, so it neither aliases the record nor fails to match", () => {
+  it("an object-valued role claim signs as no claim, so it neither aliases the record nor claims a rank", () => {
     withPair({ aOpts: { lifecycleRole: 'participant' } }, ({ A, B, seen }) => {
       const base = A._buildAdmissionAttestation('cmb-request-18', 'aligned', verdicts, 'heuristic');
-      const att = { ...base, role: ['participant'] }; // signs exactly as 'participant' does
+      const att = { ...base, role: ['anchor'] }; // sym-attest-v1 signs a non-text role as empty
       signAttestation(att, A._identity.privateKey);
       assert.strictEqual(B._ingestAttestation(att, A.nodeId, 'concierge').ok, true);
       const e = seen[0];
-      assert.strictEqual(e.role, 'participant');
-      assert.strictEqual(e.roleClaimed, 'participant');
-      assert.strictEqual(e.roleMatches, true, 'a byte-identical claim matches');
+      assert.strictEqual(e.role, null, 'no text role was signed');
+      assert.strictEqual(e.roleClaimed, 'participant', 'so it claims nothing above participant');
+      assert.strictEqual(e.roleMatches, true);
       for (const [k, v] of Object.entries(e)) {
         if (k !== 'categories') assert.ok(v === null || typeof v !== 'object', `${k} is a primitive`);
       }
@@ -319,16 +324,17 @@ describe("'attestation-received' — a peer's verified verdict is observable as
     });
   });
 
-  it('matches a numeric role claim against the same role resolved as a string', () => {
+  it('a numeric role claim signs as no claim (sym-attest-v1 signs text), and is shown as none', () => {
     withPair({}, ({ A, B, seen }) => {
       const base = A._buildAdmissionAttestation('cmb-request-21', 'aligned', verdicts, 'heuristic');
-      const att = { ...base, role: 2 }; // signs as '2'
+      const att = { ...base, role: 2 }; // sym-attest-v1: a non-text role signs as empty (0.13 signed '2')
       signAttestation(att, A._identity.privateKey);
       B.resolveRole = () => '2';
       assert.strictEqual(B._ingestAttestation(att, A.nodeId, 'concierge').ok, true);
-      assert.strictEqual(seen[0].roleClaimed, '2');
+      assert.strictEqual(seen[0].role, null);
+      assert.strictEqual(seen[0].roleClaimed, 'participant');
       assert.strictEqual(seen[0].roleResolved, '2');
-      assert.strictEqual(seen[0].roleMatches, true);
+      assert.strictEqual(seen[0].roleMatches, false);
       assert.deepStrictEqual(verifyAttestation(seen[0], A._identity.publicKey), { signed: true, valid: true });
     });
   });
@@ -466,12 +472,12 @@ describe('the witness storm', () => {
       node._gossipToRoster = (frame) => relayed.push(frame.type);
       const cp = signed({ type: 'checkpoint', by: 'node-att', roster: 'g', upto_seq: 8, root: 'r8', at: 1 }, ATT.priv, signCheckpoint);
       assert.strictEqual(node._ingestCheckpoint(cp, 'node-att').ok, true);
-      assert.deepStrictEqual(relayed, ['checkpoint', 'witness'], 'relayed once and witnessed once');
+      assert.deepStrictEqual(relayed, ['sym-attest-checkpoint', 'sym-attest-witness'], 'relayed once and witnessed once');
       const copy = (at) => signed({ type: 'witness', attester: 'node-att', roster: 'g', upto_seq: 8, root: 'r8', by: 'node-wit', role: 'participant', at }, WIT.priv, signWitness);
       assert.strictEqual(node._ingestWitness(copy(1), 'node-wit').ok, true);
       assert.strictEqual(node._ingestWitness(copy(2), 'node-wit').ok, false, 'a second signing of the same witness is not new');
       assert.strictEqual(node._ingestWitness(copy(1), 'node-wit').ok, false, 'nor is the first one, again');
-      assert.deepStrictEqual(relayed, ['checkpoint', 'witness', 'witness'], 'one relay per witness statement');
+      assert.deepStrictEqual(relayed, ['sym-attest-checkpoint', 'sym-attest-witness', 'sym-attest-witness'], 'one relay per witness statement');
       node._witnessCheckpoint(cp);
       assert.strictEqual(relayed.length, 3, 'this node does not sign a second copy of its own witness');
     });
diff --git a/tests/checkpoint-rate.test.js b/tests/checkpoint-rate.test.js
index b1d9b248..2247a4f2 100644
--- a/tests/checkpoint-rate.test.js
+++ b/tests/checkpoint-rate.test.js
@@ -46,8 +46,8 @@ function withNode(n, fn) {
 
 const checkpoint = (k, upto_seq, at = upto_seq) => signed({ type: 'checkpoint', by: k.id, roster: ROOM, upto_seq, root: `root-${k.id}-${upto_seq}`, at }, k.priv);
 function signed(fields, priv) { const o = { ...fields }; signCheckpoint(o, priv); return o; }
-const witnessesBy = (sent, node, attester) => sent.filter((f) => f.type === 'witness' && f.witness.by === node.nodeId && f.witness.attester === attester);
-const relayed = (sent, attester) => sent.filter((f) => f.type === 'checkpoint' && f.checkpoint.by === attester);
+const witnessesBy = (sent, node, attester) => sent.filter((f) => f.type === 'sym-attest-witness' && f.witness.by === node.nodeId && f.witness.attester === attester);
+const relayed = (sent, attester) => sent.filter((f) => f.type === 'sym-attest-checkpoint' && f.checkpoint.by === attester);
 
 describe('checkpoint rate — one attester', () => {
   it("a flooding attester's checkpoints past the bound are not stored, witnessed or relayed, whichever peers bring them", () => {
@@ -111,7 +111,7 @@ describe('checkpoint rate — one attester', () => {
         if (!node._ingestCheckpoint(next(keys[0]), 'hub').ok) refused++;
       }
       assert.strictEqual(refused, 0, 'every checkpoint was taken');
-      const own = sent.filter((f) => f.type === 'witness' && f.witness.by === node.nodeId).length;
+      const own = sent.filter((f) => f.type === 'sym-attest-witness' && f.witness.by === node.nodeId).length;
       assert.strictEqual(own, 1200 + 128 + 30, 'and witnessed');
     });
   });
diff --git a/tests/cmb-fetch-serves-v2.test.js b/tests/cmb-fetch-serves-v2.test.js
index 435e64b6..466d0784 100644
--- a/tests/cmb-fetch-serves-v2.test.js
+++ b/tests/cmb-fetch-serves-v2.test.js
@@ -23,7 +23,7 @@ const { createCMB, signCMB, verifyCMB, assertionIdV2_0 } = require('../lib/core'
 const { admitAs, identity } = require('./_core-secure');
 
 // Core Secure (design D1): a fetched record goes out as its own `cmb` frame (sealed cmb-encrypted),
-// then a `cmb-fetch-result` with the correlation id and the found / not-found key lists.
+// then a `cmb-fetch-result` with the correlation id and the returned / missing key lists.
 function serve(node, key, reqId) {
   const requester = admitAs(node, identity('requester'));
   node._frameHandler.handle(requester, { type: 'cmb-fetch', key, reqId });
@@ -48,7 +48,7 @@ describe('cmb-fetch serving', () => {
       assert.deepStrictEqual(verifyCMB(cmb, pub).valid, true, 'precondition: the stored record verifies');
       node._store.get = (k) => (k === cmb.metadata.key ? { key: k, cmb } : null);
       const { res, record, recordFirst } = serve(node, cmb.metadata.key, 'r1');
-      assert.deepStrictEqual(res, { type: 'cmb-fetch-result', reqId: 'r1', found: [cmb.metadata.key], notFound: [], timestamp: res.timestamp }, 'the result carries only the id and the key lists');
+      assert.deepStrictEqual(res, { type: 'cmb-fetch-result', reqId: 'r1', returned: [cmb.metadata.key], missing: [], timestamp: res.timestamp }, 'the result carries only the id and the key lists');
       assert.ok(recordFirst, 'the record goes first, in its own frame');
       for (const k of ['signatureSuite', 'addressScheme', 'createdByNodeId', 'application', 'assertionId']) {
         assert.ok(k in record.metadata, `${k} is served`);
@@ -88,14 +88,14 @@ describe('cmb-fetch serving', () => {
     } finally { fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
   });
 
-  it('a pre-v2.0 record is not served over Core Secure: listed notFound, no record frame', () => {
+  it('a pre-v2.0 record is not served over Core Secure: listed missing, no record frame', () => {
     const name = `fetchold-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
     const node = new SymNode({ name, silent: true, discovery: new NullDiscovery() });
     try {
       const old = createCMB({ categories: { focus: 'an old record' }, createdBy: 'alice' });
       node._store.get = (k) => (k === old.metadata.key ? { key: k, cmb: old } : null);
       const { res, record } = serve(node, old.metadata.key, 'r3');
-      assert.deepStrictEqual([res.found, res.notFound], [[], [old.metadata.key]]);
+      assert.deepStrictEqual([res.returned, res.missing], [[], [old.metadata.key]]);
       assert.strictEqual(record, undefined);
     } finally { fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
   });
diff --git a/tests/cmb-fetch.test.js b/tests/cmb-fetch.test.js
index 7b75b3c0..e244b7ae 100644
--- a/tests/cmb-fetch.test.js
+++ b/tests/cmb-fetch.test.js
@@ -37,7 +37,7 @@ function cat7(t) {
 
 // A peer as a confirmed session leaves it (Core Secure, 0.14): `sent` is what the node sends it,
 // before sealing. A fetch is answered by each record in its own sealed record frame, then a sealed
-// cmb-fetch-result carrying only the correlation id and the found / not-found key lists (design D1).
+// cmb-fetch-result carrying only the correlation id and the returned / missing key lists (design D1).
 const { admitAs } = require('./_core-secure');
 function fakePeer(node, peerId) {
   return admitAs(node, { nodeId: peerId, name: peerId });
@@ -45,7 +45,7 @@ function fakePeer(node, peerId) {
 /** Deliver a fetch answer on `session` as the server sends it: the record (if any), then the result. */
 function answer(node, session, reqId, key, cmb) {
   if (cmb) node._frameHandler.handle(session, { type: 'cmb', cmb });
-  node._frameHandler.handle(session, { type: 'cmb-fetch-result', reqId, found: cmb ? [key] : [], notFound: cmb ? [] : [key] });
+  node._frameHandler.handle(session, { type: 'cmb-fetch-result', reqId, returned: cmb ? [key] : [], missing: cmb ? [] : [key] });
 }
 
 describe('MMP §7 cmb-fetch — content-addressed retrieval', () => {
@@ -56,8 +56,8 @@ describe('MMP §7 cmb-fetch — content-addressed retrieval', () => {
       node._frameHandler.handle(peer, { type: 'cmb-fetch', key: root.key, reqId: 'r1' });
       const res = peer.sent.find((f) => f.type === 'cmb-fetch-result');
       assert.ok(res, 'responds');
-      assert.deepStrictEqual(Object.keys(res).sort(), ['found', 'notFound', 'reqId', 'timestamp', 'type'], 'the id and the key lists, never the record (it was plaintext; §18.2.1)');
-      assert.deepStrictEqual([res.reqId, res.found, res.notFound], ['r1', [root.key], []]);
+      assert.deepStrictEqual(Object.keys(res).sort(), ['missing', 'reqId', 'returned', 'timestamp', 'type'], 'the id and the key lists, never the record (it was plaintext; §18.2.1)');
+      assert.deepStrictEqual([res.reqId, res.returned, res.missing], ['r1', [root.key], []]);
       assert.ok(peer.sent.findIndex((f) => f.type === 'cmb') < peer.sent.indexOf(res), 'the record goes first');
       const rec = peer.sent.find((f) => f.type === 'cmb');
       assert.strictEqual(rec.cmb.metadata.key, root.key);
@@ -67,12 +67,12 @@ describe('MMP §7 cmb-fetch — content-addressed retrieval', () => {
     });
   });
 
-  it('lists an unknown key as notFound, and sends no record', async () => {
+  it('lists an unknown key as missing, and sends no record', async () => {
     await withNode('cfetch-miss', async (node) => {
       const peer = fakePeer(node, 'peerX');
       node._frameHandler.handle(peer, { type: 'cmb-fetch', key: 'cmb1-doesnotexist', reqId: 'r2' });
       const res = peer.sent.find((f) => f.type === 'cmb-fetch-result');
-      assert.deepStrictEqual([res.found, res.notFound], [[], ['cmb1-doesnotexist']]);
+      assert.deepStrictEqual([res.returned, res.missing], [[], ['cmb1-doesnotexist']]);
       assert.strictEqual(peer.sent.filter((f) => f.type === 'cmb').length, 0);
     });
   });
@@ -166,7 +166,7 @@ describe('MMP §7 cmb-fetch — content-addressed retrieval', () => {
     });
   });
 
-  it('serves several keys in one request: each found record in its own frame, then one result', async () => {
+  it('serves several keys in one request: each returned record in its own frame, then one result', async () => {
     await withNode('cfetch-multi', async (node) => {
       const r1 = node.remember(cat7('the first record of a multi-key fetch about avalanche risk'));
       const r2 = node.remember(cat7('the second record of a multi-key fetch about lift closures'));
@@ -174,17 +174,17 @@ describe('MMP §7 cmb-fetch — content-addressed retrieval', () => {
       node._frameHandler.handle(peer, { type: 'cmb-fetch', keys: [r1.key, 'cmb1-missing', r2.key, r1.key], reqId: 'm1' });
       assert.deepStrictEqual(peer.sent.map((f) => f.type), ['cmb', 'cmb', 'cmb-fetch-result']);
       const res = peer.sent[2];
-      assert.deepStrictEqual([res.found, res.notFound], [[r1.key, r2.key], ['cmb1-missing']], 'each key once');
+      assert.deepStrictEqual([res.returned, res.missing], [[r1.key, r2.key], ['cmb1-missing']], 'each key once');
     });
   });
 
-  it('a result that lists the key as found closes the request for that peer when no verifying record came first', async () => {
+  it('a result that lists the key as returned closes the request for that peer when no verifying record came first', async () => {
     await withNode('cfetch-found-nothing', async (node) => {
       const a = fakePeer(node, 'peerA');
       const p = node.fetchCMB('cmb1-claimed', { timeoutMs: 3000 });
       const reqId = [...node._cmbFetchPending.keys()][0];
       const t0 = Date.now();
-      node._frameHandler.handle(a, { type: 'cmb-fetch-result', reqId, found: ['cmb1-claimed'], notFound: [] });
+      node._frameHandler.handle(a, { type: 'cmb-fetch-result', reqId, returned: ['cmb1-claimed'], missing: [] });
       assert.strictEqual(await p, null);
       assert.ok(Date.now() - t0 < 1000, 'closed by the result, not by the timeout');
       assert.strictEqual(a._fetchExpect.size, 0, 'the expectation is let go');
diff --git a/tests/core-secure-node.test.js b/tests/core-secure-node.test.js
index 20f199c1..f77b5710 100644
--- a/tests/core-secure-node.test.js
+++ b/tests/core-secure-node.test.js
@@ -214,12 +214,17 @@ describe('the key registry at the session (D3)', () => {
       b._roomGrant = { type: 'room-join', room: 'cs-room', grantee: b.nodeId, sig: 'x' };
       const joined = [];
       b.on('peer-joined', (p) => joined.push(p));
+      const ended = [];
+      s.on('closed', (c) => ended.push(c.reason));
       s.start();
       await until(() => b._roster.conflicts().length > 0, 3000);
       await new Promise((r) => setTimeout(r, 50));
       assert.strictEqual(b._peers.has(honestId.nodeId), false, 'the squatter is not a peer');
       assert.ok(!toSquatter.includes('mesh-room-join'), 'nothing was presented to the squatter');
       assert.deepStrictEqual(joined, [], 'and no peer-joined was raised');
+      await until(() => ended.length > 0, 2000);
+      assert.deepStrictEqual(ended, ['identity-conflict'], 'the squatter is told 1009 IDENTITY_CONFLICT (draft spec PR #21)');
+      assert.ok(toSquatter.some((t) => t === 'error'), 'an error frame went out');
       b._roomGrant = null;
       assert.strictEqual(b._roster.source(honestId.nodeId), 'legacy-claim', 'the claim is not taken over');
       assert.deepStrictEqual(b._roster.conflicts().map((c) => [c.nodeId, c.got, c.gotSource]), [[honestId.nodeId, squat.publicKey, 'proven']]);
@@ -293,13 +298,25 @@ describe('extension gating (D1)', () => {
       const session = b._peers.get(a.nodeId).transport;
       assert.strictEqual(session.has('sym-attest-v1'), false);
       const before = wire.length;
-      b._gossipToRoster({ type: 'attestation', attestation: { of: 'x' } });
+      b._gossipToRoster({ type: 'sym-attest-attestation', attestation: { of: 'x' } });
       assert.strictEqual(wire.length, before, 'not sent to a session without the extension');
       const refused = [];
       b.on('metric', (m) => { if (m.type === 'session-frame-refused') refused.push(m); });
-      a._peers.get(b.nodeId).transport.send({ type: 'checkpoint', checkpoint: { by: a.nodeId } });
+      a._peers.get(b.nodeId).transport.send({ type: 'sym-attest-checkpoint', checkpoint: { by: a.nodeId } });
       await until(() => refused.length > 0);
       assert.match(refused[0].reason, /sym-attest-v1 not selected/);
+      // sym 0.13's bare names are never taken on a Core Secure session, selected or not (sym-attest-v1 §9).
+      const c = mk('cs-c');
+      await c.start();
+      await connectNodes(c, b);
+      const sc = b._peers.get(c.nodeId).transport;
+      assert.strictEqual(sc.has('sym-attest-v1'), true);
+      const legacy = [];
+      b.on('metric', (m) => { if (m.type === 'session-frame-refused' && m.reason === 'legacy-attest-frame') legacy.push(m.frameType); });
+      for (const t of ['attestation', 'checkpoint', 'witness', 'node-stats']) c._peers.get(b.nodeId).transport.send({ type: t });
+      await until(() => legacy.length === 4);
+      assert.deepStrictEqual(legacy.sort(), ['attestation', 'checkpoint', 'node-stats', 'witness']);
+      await stopAll(c);
     } finally { await stopAll(a, b); }
   });
 });
diff --git a/tests/core-secure-relay.test.js b/tests/core-secure-relay.test.js
index c3e48ae3..0b748418 100644
--- a/tests/core-secure-relay.test.js
+++ b/tests/core-secure-relay.test.js
@@ -78,6 +78,23 @@ describe('relay sessions (D2)', () => {
     } finally { await stopAll(a, b); await relay.close(); }
   });
 
+  it('an error 1009 IDENTITY_CONFLICT from the peer ends the session, is said, and is not retried (draft spec PR #21)', async () => {
+    const relay = fakeRelay();
+    const a = relayNode('rs-a3', relay); const b = relayNode('rs-b3', relay);
+    try {
+      await a.start(); await b.start();
+      await until(() => paired(a, b), 8000);
+      const [lo, hi] = [a, b].sort((x, y) => (x.nodeId < y.nodeId ? -1 : 1));
+      const metrics = [];
+      lo.on('metric', (m) => metrics.push(m));
+      relay.inject(hi.nodeId, lo.nodeId, { type: 'error', code: 1009, message: 'IDENTITY_CONFLICT', detail: `session:${relaySession(lo, hi).sessionId}` });
+      await until(() => !lo._peers.has(hi.nodeId), 3000);
+      await new Promise((r) => setTimeout(r, 1500)); // past the first retry backoff
+      assert.strictEqual(lo._peers.has(hi.nodeId), false, 'no re-handshake after an identity conflict');
+      assert.ok(metrics.some((m) => m.type === 'identity-conflict-refused-by-peer'));
+    } finally { await stopAll(a, b); await relay.close(); }
+  });
+
   it('frame loss leads to a re-handshake, and records flow again', async () => {
     let dropOne = false;
     const relay = fakeRelay({ tap: (e) => { if (dropOne && e.payload.type === 'control-encrypted') { dropOne = false; return false; } return undefined; } });
diff --git a/tests/gossip-budget.test.js b/tests/gossip-budget.test.js
index efb26cc6..39af964f 100644
--- a/tests/gossip-budget.test.js
+++ b/tests/gossip-budget.test.js
@@ -354,8 +354,9 @@ describe('signature spelling', () => {
       const verdicts = { focus: 'admit', issue: 'admit', intent: 'admit', motivation: 'admit', commitment: 'admit', perspective: 'admit', mood: 'admit' };
       for (let i = 0; i < 200; i++) assert.ok(node._buildAdmissionAttestation(`cmb-own-${i}`, 'aligned', verdicts, 'heuristic'));
       node._ingestCheckpoint(signed({ type: 'checkpoint', by: A.id, roster: ROOM, upto_seq: 8, root: 'r8', at: 1 }, A.priv, signCheckpoint), 'p');
-      const own = sent.map((f) => f.attestation || f.checkpoint || f.witness).filter((x) => (x.by === node.nodeId));
-      assert.deepStrictEqual([...new Set(own.map((x) => x.type || 'attestation'))].sort(), ['attestation', 'checkpoint', 'witness']);
+      const ownFrames = sent.filter((f) => (f.attestation || f.checkpoint || f.witness).by === node.nodeId);
+      assert.deepStrictEqual([...new Set(ownFrames.map((f) => f.type))].sort(), ['sym-attest-attestation', 'sym-attest-checkpoint', 'sym-attest-witness']);
+      const own = ownFrames.map((f) => f.attestation || f.checkpoint || f.witness);
       assert.ok(own.every((x) => isCanonicalSig(x.sig)), 'every signature this node made is canonical');
       // A signer that wrote a short signature: refused at home, not only by peers.
       const realSign = crypto.sign;
diff --git a/tests/gossip-lanes.test.js b/tests/gossip-lanes.test.js
index 8e8d950e..f4b781c6 100644
--- a/tests/gossip-lanes.test.js
+++ b/tests/gossip-lanes.test.js
@@ -48,6 +48,10 @@ const signed = (fields, priv, sign) => { const o = { ...fields }; sign(o, priv);
 const forgedSig = () => crypto.randomBytes(64).toString('base64url');
 let n = 0;
 const forged = (k) => ({ of: `cmb-${++n}`, by: k.id, at: 1, roster: ROOM, verdict: 'aligned', categories: {}, seq: n, prev: 'p', sig: forgedSig(), sigAlg: 'ed25519' });
+// The wire form (sym-attest-v1): every field what the extension says, only the signature forged.
+const hex = () => crypto.randomBytes(32).toString('hex');
+const CATS7 = { focus: 'admit', issue: 'admit', intent: 'guard', motivation: 'admit', commitment: 'silent', perspective: 'admit', mood: 'admit' };
+const wireForged = (k, extra = {}) => ({ of: `cmb-${hex()}`, assertionId: `asrt-${hex()}`, by: k.id, at: 1, room: ROOM, method: 'heuristic', verdict: 'aligned', categories: CATS7, role: 'participant', seq: ++n + 1, prev: hex(), sigAlg: 'ed25519', sig: forgedSig(), ...extra });
 // Since 0.14 every role-grant names the key it confers authority on (design D3).
 const SOME_KEY = Buffer.alloc(32, 9).toString('base64url');
 const forgedGrant = (by, grantee) => ({ type: 'role-grant', grantee, granteeKey: SOME_KEY, role: 'validator', grantedBy: by, grantedAt: ++n, sig: forgedSig(), sigAlg: 'ed25519' });
@@ -201,10 +205,10 @@ describe('the budget is kept per PROVEN peer (F2; Core Secure design D1)', () =>
       node._roster.bind(A.id, A.pub, 'proven');
       const lan = admitAs(node, { nodeId: 'peer-two-paths' });
       const relay = { ...lan, kind: 'relay', sessionId: 'f'.repeat(32), has: lan.has };
-      for (let i = 0; i < 60; i++) node._frameHandler.handle(i % 2 ? lan : relay, { type: 'attestation', attestation: forged(A) });
+      for (let i = 0; i < 60; i++) node._frameHandler.handle(i % 2 ? lan : relay, { type: 'sym-attest-attestation', attestation: wireForged(A) });
       for (let i = 0; i < 10; i++) {
-        node._frameHandler.handle(lan, { type: 'checkpoint', checkpoint: { type: 'checkpoint', by: A.id, roster: ROOM, upto_seq: i + 1, root: `r${i}`, at: 1, sig: forgedSig() } });
-        node._frameHandler.handle(relay, { type: 'witness', witness: { type: 'witness', attester: A.id, roster: ROOM, upto_seq: i + 1, root: 'r', by: A.id, role: 'participant', at: 1, sig: forgedSig() } });
+        node._frameHandler.handle(lan, { type: 'sym-attest-checkpoint', checkpoint: { by: A.id, room: ROOM, uptoSeq: i + 1, root: hex(), at: 1, sigAlg: 'ed25519', sig: forgedSig() } });
+        node._frameHandler.handle(relay, { type: 'sym-attest-witness', witness: { attester: A.id, room: ROOM, uptoSeq: i + 1, root: hex(), by: A.id, role: 'participant', at: 1, sigAlg: 'ed25519', sig: forgedSig() } });
         node._frameHandler.handle(lan, { type: 'role-grant', grant: forgedGrant(A.id, `x-${i}`) });
       }
       assert.deepStrictEqual([...node._gossipBuckets.keys()], ['peer-two-paths']);
@@ -248,8 +252,8 @@ describe('the budget is kept per PROVEN peer (F2; Core Secure design D1)', () =>
       const logs = [];
       node._log = (m) => logs.push(m);
       const p = admitAs(node, { nodeId: 'peer-flooding' });
-      for (let i = 0; i < 50; i++) node._frameHandler.handle(p, { type: 'attestation', attestation: forged(A) });
-      for (let i = 0; i < 50; i++) node._frameHandler.handle(p, { type: 'attestation', attestation: { ...forged(A), by: `nobody-${i}` } });
+      for (let i = 0; i < 50; i++) node._frameHandler.handle(p, { type: 'sym-attest-attestation', attestation: wireForged(A) });
+      for (let i = 0; i < 50; i++) node._frameHandler.handle(p, { type: 'sym-attest-attestation', attestation: wireForged(A, { by: `nobody-${i}` }) });
       assert.strictEqual(logs.filter((l) => /Attestation from .* dropped \(bad-signature\)/.test(l)).length, 1);
       assert.strictEqual(logs.filter((l) => /dropped \(unknown-attester-key\)/.test(l)).length, 1);
     });
diff --git a/tests/node-stats.test.js b/tests/node-stats.test.js
index 43bd28f1..c9aa91fe 100644
--- a/tests/node-stats.test.js
+++ b/tests/node-stats.test.js
@@ -44,23 +44,28 @@ describe('node-stats — self-reported store tally', () => {
       node._store.stats = () => ({ total: 7, local: 4, peer: 3, hot: 7, cold: 0 });
       node._emitNodeStats();
       assert.strictEqual(frames.length, 1);
-      assert.strictEqual(frames[0].type, 'node-stats');
+      assert.strictEqual(frames[0].type, 'sym-attest-node-stats');
       assert.deepStrictEqual(
         { e: frames[0].stats.emitted, a: frames[0].stats.admitted, m: frames[0].stats.memory },
         { e: 4, a: 3, m: 7 },
       );
+      assert.deepStrictEqual(Object.keys(frames[0].stats).sort(), ['admitted', 'at', 'emitted', 'memory'], 'no self-asserted name or nodeId (sym-attest-v1 §5.4)');
     } finally { fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
   });
 
-  it('_ingestNodeStats emits a node-stats event for a peer, ignores self + malformed', () => {
+  it('a sym-attest-node-stats frame is attributed to the session\'s proven peer; a malformed one is refused', () => {
     const { node, name } = makeNode('ns-ingest');
+    const { admitAs, identity, deliver } = require('./_core-secure');
     try {
       const seen = [];
       node.on('node-stats', s => seen.push(s));
-      node._ingestNodeStats({ name: 'research', nodeId: 'peer-1', emitted: 7, admitted: 65, memory: 158 }, 'peer-1');
-      node._ingestNodeStats({ name: node.name, nodeId: node.nodeId, emitted: 1, admitted: 1, memory: 2 }, 'self'); // our own echo
-      node._ingestNodeStats(null, 'peer-1'); // malformed
-      assert.strictEqual(seen.length, 1, 'only the peer stats surfaced');
+      const peer = admitAs(node, identity('research'));
+      // A self-asserted name and nodeId in the frame are not read: the session says who it is.
+      deliver(node, peer, { type: 'sym-attest-node-stats', stats: { name: 'liar', nodeId: 'someone-else', emitted: 7, admitted: 65, memory: 158, at: 1 } });
+      deliver(node, peer, { type: 'sym-attest-node-stats', stats: { emitted: -1, admitted: 1, memory: 2, at: 1 } }); // malformed
+      deliver(node, peer, { type: 'sym-attest-node-stats', stats: null });
+      assert.strictEqual(seen.length, 1, 'only the well-formed stats surfaced');
+      assert.strictEqual(seen[0].nodeId, peer.nodeId);
       assert.strictEqual(seen[0].name, 'research');
       assert.strictEqual(seen[0].admitted, 65);
     } finally { fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
diff --git a/tests/stored-entry-annotations.test.js b/tests/stored-entry-annotations.test.js
index 7d8a720c..2a58fa90 100644
--- a/tests/stored-entry-annotations.test.js
+++ b/tests/stored-entry-annotations.test.js
@@ -153,7 +153,7 @@ describe('admission annotations live on the store entry', () => {
         const fetcher = admitAs(node, identity('fetcher'));
         node._frameHandler._handleCmbFetch(fetcher.nodeId, 'fetcher', { type: 'cmb-fetch', key: record.metadata.key, reqId: 'q1' }, fetcher);
         const header = fetcher.sent.find((f) => f.type === 'cmb-fetch-result');
-        assert.deepStrictEqual([header.found, header.notFound, 'cmb' in header], [[record.metadata.key], [], false], 'the result carries no record');
+        assert.deepStrictEqual([header.returned, header.missing, 'cmb' in header], [[record.metadata.key], [], false], 'the result carries no record');
         const got = fetcher.sent.find((f) => f.type === 'cmb')?.cmb;
         assert.deepStrictEqual(Object.keys(got).sort(), ['categories', 'metadata']);
         assert.strictEqual(verifyCMB(got, PEER.publicKey).valid, true, 'the served copy re-verifies');
diff --git a/tests/sym-attest-v1.test.js b/tests/sym-attest-v1.test.js
new file mode 100644
index 00000000..df5cc1f0
--- /dev/null
+++ b/tests/sym-attest-v1.test.js
@@ -0,0 +1,145 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME before lib/config loads
+
+/**
+ * The admission-attestation extension, `sym-attest-v1` (draft spec PR meshcognition-website#27):
+ * the frame names, the wire fields, and the eight corrections to sym 0.13's constructions —
+ *   1. frames named `sym-attest-<name>` and sent only where the extension is negotiated;
+ *   2. every signature lp-encoded under its own domain tag (no `|`-joined string, no literal prefix);
+ *   3. the room is `room` and the position `uptoSeq` on the wire;
+ *   4. `assertionId` carried and signed;
+ *   5. `method` signed;
+ *   6. the checkpoint root a promote-odd Merkle tree with leaf and node tags (never pair-with-self);
+ *   7. node statistics carry no self-asserted name or nodeId;
+ *   8. keys only from the registry (not from hellos) — covered by the D3 tests.
+ * The chain link `prev` is the SHA-256 of the previous signature's bytes.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const crypto = require('crypto');
+const fs = require('fs');
+const core = require('../lib/core');
+const { SymNode } = require('../lib/node');
+const { NullDiscovery } = require('../lib/discovery');
+const { nodeDirById } = require('../lib/config');
+const { connectNodes, until, admitAs, deliver, identity } = require('./_core-secure');
+
+const lp = (s) => { const b = Buffer.from(String(s), 'utf8'); return Buffer.concat([Buffer.from(`${b.length}:`), b]); };
+const sha = (...parts) => crypto.createHash('sha256').update(Buffer.concat(parts)).digest();
+const hex = (c) => c.repeat(64);
+const CATS = { focus: 'admit', issue: 'admit', intent: 'guard', motivation: 'admit', commitment: 'silent', perspective: 'admit', mood: 'redundant' };
+const A = identity('attester');
+const att = () => ({ of: `cmb-${hex('a')}`, assertionId: `asrt-${hex('b')}`, by: A.nodeId, at: 1786611600000, roster: 'room-é', method: 'neural', verdict: 'guarded', categories: { ...CATS }, role: 'participant', seq: 2, prev: hex('c') });
+
+describe('the signed constructions (sym-attest-v1 §5)', () => {
+  it('an attestation signs lp(every field) under mmp-attest-v1, method and assertionId included, room in NFC', () => {
+    const a = att();
+    const expected = Buffer.concat([
+      Buffer.from('mmp-attest-v1\n'), lp(a.of), lp(a.assertionId), lp(a.by), lp('1786611600000'), lp('room-é'.normalize('NFC')),
+      lp('neural'), lp('guarded'), ...['focus', 'issue', 'intent', 'motivation', 'commitment', 'perspective', 'mood'].map((f) => lp(CATS[f])),
+      lp('participant'), lp('2'), lp(hex('c')),
+    ]);
+    assert.ok(core.attestationPayload(a).equals(expected));
+    core.signAttestation(a, A.privateKey);
+    assert.strictEqual(core.verifyAttestation(a, A.publicKey).valid, true);
+    for (const [k, v] of [['method', 'heuristic'], ['assertionId', `asrt-${hex('d')}`], ['roster', 'other'], ['verdict', 'aligned'], ['prev', hex('e')]]) {
+      assert.strictEqual(core.verifyAttestation({ ...a, [k]: v }, A.publicKey).valid, false, `${k} is signed`);
+    }
+    assert.strictEqual(core.verifyAttestation({ ...a, categories: { ...CATS, mood: 'admit' } }, A.publicKey).valid, false, 'each category verdict is signed');
+  });
+
+  it('a checkpoint and a witness sign under their own tags; no signature verifies as another construction', () => {
+    const cp = { by: A.nodeId, roster: 'r', upto_seq: 8, root: hex('1'), at: 5 };
+    assert.ok(core.checkpointPayload(cp).equals(Buffer.concat([Buffer.from('mmp-attest-checkpoint-v1\n'), lp(A.nodeId), lp('r'), lp('8'), lp(hex('1')), lp('5')])));
+    const W = identity('witness');
+    const w = { attester: A.nodeId, roster: 'r', upto_seq: 8, root: hex('1'), by: W.nodeId, role: 'validator', at: 6 };
+    assert.ok(core.witnessPayload(w).equals(Buffer.concat([Buffer.from('mmp-attest-witness-v1\n'), lp(A.nodeId), lp('r'), lp('8'), lp(hex('1')), lp(W.nodeId), lp('validator'), lp('6')])));
+    core.signCheckpoint(cp, A.privateKey);
+    assert.strictEqual(core.verifyCheckpoint(cp, A.publicKey).valid, true);
+    // Domain separation: a checkpoint's signature is no witness's, and no attestation's.
+    assert.strictEqual(core.verifyWitness({ ...w, by: A.nodeId, sig: cp.sig, sigAlg: 'ed25519' }, A.publicKey).valid, false);
+    const a = core.signAttestation(att(), A.privateKey);
+    assert.strictEqual(core.verifyCheckpoint({ ...cp, sig: a.sig }, A.publicKey).valid, false);
+    // The 0.13 bytes no longer verify.
+    const old = Buffer.from(`checkpoint|${cp.by}|r|8|${cp.root}|5`);
+    const oldSig = crypto.sign(null, old, crypto.createPrivateKey({ key: Buffer.concat([Buffer.from('302e020100300506032b657004220420', 'hex'), Buffer.from(A.privateKey, 'base64url')]), format: 'der', type: 'pkcs8' })).toString('base64url');
+    assert.strictEqual(core.verifyCheckpoint({ ...cp, sig: oldSig }, A.publicKey).valid, false);
+  });
+
+  it('the checkpoint root is promote-odd with leaf and node tags; the chain link hashes the signature bytes', () => {
+    const sigs = [1, 2, 3].map((i) => crypto.randomBytes(64).toString('base64url'));
+    const leaf = (s) => sha(Buffer.from('mmp-attest-leaf-v1\n'), Buffer.from(s, 'base64url'));
+    const node = (l, r) => sha(Buffer.from('mmp-attest-node-v1\n'), l, r);
+    assert.strictEqual(core.attestMerkleRoot(sigs.slice(0, 1)), leaf(sigs[0]).toString('hex'));
+    assert.strictEqual(core.attestMerkleRoot(sigs.slice(0, 2)), node(leaf(sigs[0]), leaf(sigs[1])).toString('hex'));
+    const three = node(node(leaf(sigs[0]), leaf(sigs[1])), leaf(sigs[2]));
+    assert.strictEqual(core.attestMerkleRoot(sigs), three.toString('hex'), 'the odd node is promoted');
+    const dup = node(node(leaf(sigs[0]), leaf(sigs[1])), node(leaf(sigs[2]), leaf(sigs[2])));
+    assert.notStrictEqual(core.attestMerkleRoot(sigs), dup.toString('hex'), 'never paired with itself (0.13)');
+    assert.notStrictEqual(core.attestMerkleRoot([...sigs, sigs[2]]), core.attestMerkleRoot(sigs), 'so [a,b,c] and [a,b,c,c] differ');
+    assert.strictEqual(core.chainLink(sigs[0]), crypto.createHash('sha256').update(Buffer.from(sigs[0], 'base64url')).digest('hex'));
+  });
+});
+
+describe('the wire form (sym-attest-v1 §5, §6 step 1)', () => {
+  it('toWire uses the extension\'s names; fromWire takes only a well-formed frame', () => {
+    const a = core.signAttestation(att(), A.privateKey);
+    const w = core.toWireAttestation(a);
+    assert.deepStrictEqual(Object.keys(w).sort(), ['assertionId', 'at', 'by', 'categories', 'method', 'of', 'prev', 'role', 'room', 'seq', 'sig', 'sigAlg', 'verdict']);
+    assert.strictEqual(w.room, 'room-é');
+    assert.strictEqual(core.verifyAttestation(core.fromWireAttestation(w), A.publicKey).valid, true, 'round trip verifies');
+    const bad = [
+      { ...w, assertionId: undefined }, { ...w, of: 'cmb-1' }, { ...w, room: undefined, roster: 'room-é' },
+      { ...w, method: { toString: 1 } }, { ...w, verdict: 'maybe' }, { ...w, categories: { ...CATS, focus: 'stable' } },
+      { ...w, categories: { focus: 'admit' } }, { ...w, categories: { ...CATS, extra: 'admit' } }, { ...w, role: 2 },
+      { ...w, seq: 1, prev: hex('c') }, { ...w, seq: 2, prev: 'genesis' }, { ...w, seq: 0 }, { ...w, sig: `${w.sig}=` }, { ...w, sigAlg: 'rsa' },
+    ];
+    for (const b of bad) assert.strictEqual(core.fromWireAttestation(b), null, JSON.stringify(Object.keys(b)));
+    const cp = core.signCheckpoint({ by: A.nodeId, roster: 'r', upto_seq: 8, root: hex('1'), at: 5 }, A.privateKey);
+    const wc = core.toWireCheckpoint(cp);
+    assert.deepStrictEqual(Object.keys(wc).sort(), ['at', 'by', 'room', 'root', 'sig', 'sigAlg', 'uptoSeq']);
+    assert.strictEqual(core.fromWireCheckpoint({ ...wc, uptoSeq: undefined, upto_seq: 8 }), null, '0.13\'s field name is not read');
+    assert.strictEqual(core.verifyCheckpoint(core.fromWireCheckpoint(wc), A.publicKey).valid, true);
+  });
+
+  it('two nodes exchange sym-attest-attestation and -checkpoint frames that verify on receipt', async () => {
+    const mk = (n) => new SymNode({ name: `sa-${n}-${Date.now()}`, silent: true, discovery: new NullDiscovery(), room: 'sa-room', checkpointInterval: 2 });
+    const a = mk('a'); const b = mk('b');
+    try {
+      await a.start(); await b.start();
+      await connectNodes(a, b);
+      const sent = [];
+      const orig = a._gossipToRoster.bind(a);
+      a._gossipToRoster = (f, x) => { sent.push(f); return orig(f, x); };
+      const got = [];
+      b.on('attestation-received', (e) => got.push(e));
+      const verdicts = { ...CATS };
+      a._buildAdmissionAttestation(`cmb-${hex('7')}`, 'aligned', verdicts, 'heuristic', `asrt-${hex('8')}`);
+      a._buildAdmissionAttestation(`cmb-${hex('9')}`, 'rejected', verdicts, 'neural', `asrt-${hex('6')}`);
+      await until(() => got.length === 2 && b._attestations.checkpointAt(a.nodeId, 2), 3000);
+      assert.deepStrictEqual([...new Set(sent.map((f) => f.type))].sort(), ['sym-attest-attestation', 'sym-attest-checkpoint']);
+      assert.ok(sent.every((f) => !('roster' in (f.attestation || f.checkpoint)) && !('upto_seq' in (f.attestation || f.checkpoint))));
+      assert.deepStrictEqual(got.map((e) => [e.method, e.assertionId, e.room]), [['heuristic', `asrt-${hex('8')}`, 'sa-room'], ['neural', `asrt-${hex('6')}`, 'sa-room']]);
+      assert.strictEqual(got[1].prev, core.chainLink(a._attestations.chainOf(a.nodeId)[0].sig));
+      assert.strictEqual(b._attestations.checkpointAt(a.nodeId, 2).root, core.attestMerkleRoot(a._attestations.chainOf(a.nodeId).map((x) => x.sig)));
+      const rec = a.reconcileChain(a.nodeId);
+      assert.strictEqual(rec.consistent, true, 'the attester reconciles its own v1 checkpoint');
+    } finally { for (const n of [a, b]) { await n.stop(); fs.rmSync(nodeDirById(n.nodeId), { recursive: true, force: true }); } }
+  });
+
+  it('a frame whose fields are not the extension\'s is refused before anything is spent', async () => {
+    const node = new SymNode({ name: `sa-bad-${Date.now()}`, silent: true, discovery: new NullDiscovery(), room: 'sa-room' });
+    try {
+      const s = admitAs(node, identity('peer'));
+      const refused = [];
+      node.on('metric', (m) => { if (m.type === 'session-frame-refused') refused.push(m.reason); });
+      deliver(node, s, { type: 'sym-attest-attestation', attestation: { of: 'cmb-1', by: 'x' } });
+      deliver(node, s, { type: 'sym-attest-checkpoint', checkpoint: { by: 'x', roster: 'sa-room', upto_seq: 8 } });
+      deliver(node, s, { type: 'sym-attest-witness', witness: {} });
+      assert.deepStrictEqual(refused, ['malformed', 'malformed', 'malformed']);
+      assert.strictEqual(node._gossipBuckets.size, 0, 'no budget spent');
+    } finally { await node.stop(); fs.rmSync(nodeDirById(node.nodeId), { recursive: true, force: true }); }
+  });
+});

From 341dafb8cd97875c978a879e9680d1701ea4f95a Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Fri, 2 Oct 2026 15:33:52 +0100
Subject: [PATCH 101/148] docs: WIRE-0.14.0.md, the four 0.14 wire elements the
 spec does not define yet

cmb-anchors, mesh-room-join, role-chain-fetch / role-chain, and the relay error 4404 "unknown
session": each one's fields, signing or sealing, when it is sent and what a receiver does, for
the spec PRs to be drafted from.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 docs/WIRE-0.14.0.md | 199 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 199 insertions(+)
 create mode 100644 docs/WIRE-0.14.0.md

diff --git a/docs/WIRE-0.14.0.md b/docs/WIRE-0.14.0.md
new file mode 100644
index 00000000..6f46f199
--- /dev/null
+++ b/docs/WIRE-0.14.0.md
@@ -0,0 +1,199 @@
+# sym 0.14.0: wire elements that need spec text
+
+These are the four wire elements that sym 0.14.0 (Core Secure) sends and that MMP v2.0 does not
+define yet, written so that a spec PR can be drafted from them. Each section gives the element's
+fields, how it is signed or sealed, when it is sent, and what a receiver does.
+
+Notation follows MMP v2.0. `lp(x)` is the §8.8.4 length prefix (`<utf8-byte-length>:<utf8 bytes>`).
+A **sealed control frame** is the inner frame of a `control-encrypted` envelope (draft spec PR
+meshcognition-website#26). It shares the session's single per-direction sequence with
+`cmb-encrypted`, so the frames below are ordered with the records around them, and none is ever
+sent in the clear on a Core Secure session.
+
+Frames that the published spec, or a draft PR, already defines are not repeated here. That
+includes `control-encrypted` (#26), `cmb-fetch` and `cmb-fetch-result` (#26: the result is
+`{reqId, returned[], missing[]}`, and each record travels in its own `cmb-encrypted` frame ahead
+of it), the `sym-attest-*` frames (#27), the error code 1009 `IDENTITY_CONFLICT` (#21), and the
+relay close code 4007 (#20).
+
+---
+
+## 1. `cmb-anchors`: the records that follow are replayed context
+
+**Why.** When a session is admitted, a node replays a few of its own recent records as context,
+so that a newly joined peer has something to couple against. In 0.13 the replayed record frame
+carried an `_anchor: true` flag. In Core Secure the record frame is fixed by §18.2.1 (an
+`cmb-encrypted` envelope carries the record and nothing else), so the flag cannot ride on it.
+
+**Frame** (sealed control frame):
+
+```json
+{ "type": "cmb-anchors", "keys": ["cmb-<64 lowercase hex>", "..."] }
+```
+
+- `keys`: the cognition keys (`metadata.key`, §8.2.1) of the records about to be replayed, in the
+  order they will be sent. At most 50 keys. The sender sends at most 5 records.
+
+**Sealing and signing.** Sealed on the session (`control-encrypted`), unsigned. It is
+session-bound: it speaks only for the session's proven peer, about records that peer authored.
+
+**When it is sent.** At most once a minute per peer, when a session is admitted. It goes
+immediately before the replayed records, which follow it on the same session as ordinary
+`cmb-encrypted` frames. Only records the sender itself authored are replayed (anti-echo,
+§15.7), and only signed `mmp-sig-v2.0` records.
+
+**Receiver.**
+- Keeps the key set for that session, replacing any earlier set from the same session. It keeps
+  at most 50 string keys and ignores entries that are not strings.
+- A record that then arrives on that session with a listed key goes through §8.8.5 verification
+  and admission like any other, and is marked as replayed context (`anchor: true` on the
+  `verified-record` event and on the stored entry).
+- Nothing about the record's authority or verification changes. `cmb-anchors` never causes a
+  record to be accepted.
+
+---
+
+## 2. `mesh-room-join`: presenting a room-join grant after the handshake
+
+**Why.** A gated room (§5.8.1) admits a non-owner only on a room-join grant whose `granteeKey` is
+the key that the session proved. The v2.0 handshake transcript has no field for the grant, and a
+grant carried in a hello would be replayable. So the grant is presented inside the confirmed
+session, where it is bound to the proven key.
+
+**Frame** (sealed control frame):
+
+```json
+{ "type": "mesh-room-join",
+  "grant": {
+    "type": "room-join", "room": "<room>", "grantee": "<grantee nodeId>", "granteeKey": "<43-char base64url>",
+    "grantedBy": "<owner nodeId>", "grantedAt": 1786611600000, "expiresAt": 1786698000000,
+    "sigAlg": "ed25519", "sig": "<unpadded base64url>" } }
+```
+
+**Signing.** `grant` is the existing room-join grant, signed by the room owner's identity key
+over:
+
+```
+UTF8("mmp-room-join-v1\n") || lp(room) || lp(grantee) || lp(granteeKey) || lp(grantedBy) ||
+lp(decimal(grantedAt)) || lp(decimal(expiresAt))
+```
+
+The lifetime is at most 24 h (`expiresAt − grantedAt`). The frame itself is sealed and adds no
+signature of its own.
+
+**When it is sent.** A node that holds a grant for its room sends this frame as the first frame
+after both proofs validate (and after its own key-registry check of the peer). It is sent to
+every newly confirmed session, before any other control frame.
+
+**Receiver** (a gated room):
+- A newly confirmed session is held in `pending` admission. The owner, recognised by its pinned
+  key, is admitted at once. Any other session waits for a `mesh-room-join` frame, for up to the
+  handshake timeout (10 s), and is refused if none arrives.
+- The grant is verified against the owner's pinned key for this room. It must name the session's
+  proven nodeId as `grantee`, its proven key as `granteeKey`, and this node's room, and it must
+  not have expired. Then the session is admitted, otherwise it is refused (closed).
+- A copied grant presented on another key's session is refused. A `mesh-room-join` on an
+  already admitted session is ignored. In an ungated room the frame is ignored.
+
+---
+
+## 3. `role-chain-fetch` and `role-chain`: fetching the chain a grant needs
+
+**Why.** A role grant or revoke is kept only when it is rooted at the anchor (§6.5, §6.6).
+Gossip has no order, so a grant can arrive before the grant that roots its grantor. A pending set
+that holds whatever might later be rooted can be flooded. Instead, the receiver asks the session
+that delivered the record for the missing chain.
+
+**Request** (sealed control frame, sent to the delivering session only):
+
+```json
+{ "type": "role-chain-fetch", "reqId": "rc-<16 hex>", "grantees": ["<grantor nodeId>"] }
+```
+
+- `reqId`: a correlation id of at most 128 characters.
+- `grantees`: the nodeIds whose own rooting grants are missing (the `grantedBy` of the record that
+  could not be rooted). At most 16 are read.
+
+**Answer** (sealed control frame, on the same session):
+
+```json
+{ "type": "role-chain", "reqId": "<the request's reqId>",
+  "grants": [ { "type": "role-grant", "grantee": "...", "role": "validator", "grantedBy": "...",
+                "grantedAt": 1786611600000, "granteeKey": "...", "sigAlg": "ed25519", "sig": "..." } ] }
+```
+
+- `grants`: at most 64 role-grant or role-revoke records, each the canonical object of its signed
+  fields only (`type, grantee, role?, grantedBy, grantedAt, granteeKey?, sig, sigAlg`). They are
+  ordered top-down: each record comes after the records that root its grantor, up to the anchor
+  (depth at most 8). For each named grantee the answer holds the records the server holds whose
+  grantee it is, each preceded by its grantor's chain.
+
+**Signing.** Neither frame is signed. Each grant in `grants` keeps its grantor's signature
+(§6.5) and is verified as gossip is: top-down, against the key that the chain vouches for its
+grantor, or the anchor's configured key. Its authority never comes from the session that served
+it.
+
+**When they are sent.**
+- A node sends `role-chain-fetch` when a role grant or revoke that arrived on a session is refused
+  as `unknown-grantor-key` (no chain reaches its grantor) or `unrooted`.
+  - It sends at most one fetch in flight per (session, grantor). Further early records for the
+    same grantor join the fetch already in flight.
+  - The early record is held in memory only for that fetch, under a key made of every signed field
+    plus the signature, so a forged copy cannot displace the genuine one. At most 64 records are
+    held per session. A held record is never written and never relayed.
+- A node answers `role-chain` for each fetch it receives, paced per session by a token bucket of
+  4 a second (burst 16). Fetches past that are dropped and counted.
+
+**Receiver of the answer.**
+- Reads an answer only if it matches a fetch in flight on that same session. An answer that
+  nobody asked for, or that arrives on another session, is ignored.
+- Offers the grants to its store until a pass stores nothing, so their order does not matter.
+  Each goes through the ordinary ingest: the gossip budget, verification with the vouched key,
+  storing as its signed fields only, and relaying once.
+- Then offers each held record once more and drops it either way. Neither the answer's grants nor
+  the held records start a further fetch.
+- A fetch that is not answered within 10 s, or whose session closes, releases its held records.
+  They are dropped.
+
+---
+
+## 4. Relay `error` 4404: "unknown session"
+
+**Why.** A relay session is bound to the relay `from` (draft #23). When a peer restarts behind the
+relay, the relay replaces its connection (4004) and, since sym-relay 0.5.4, sends no
+`relay-peer-left`. The other node still holds the old confirmed session and cannot tell the
+restart from a repeated announcement. Re-handshaking on every announcement would only supersede
+working sessions (0.13.17 re-review A2). So the peer's new process says that it holds no such
+session.
+
+**Frame** (a plain MMP error frame §7.2, sent as a relay envelope payload; it cannot be sealed,
+because the sender has no session to seal it under):
+
+```json
+{ "type": "error", "code": 4404, "message": "unknown session", "detail": "session:<32 lowercase hex>" }
+```
+
+- `detail` names the sessionId when the triggering frame carried one (a sealed frame), and is
+  absent when it did not (a `ping`).
+
+**When it is sent.** A node that receives, from a relay `from`, either a `cmb-encrypted` or
+`control-encrypted` frame naming a session it does not hold, or a `ping` from a `from` it holds
+no relay session with, answers with this error. It answers at most once a second per relay
+`from`, to bound the reply rate.
+
+**Receiver.**
+- If it is the client for that peer (the smaller nodeId, §5.2.2), and the peer is present on the
+  relay, it starts a new handshake. It **keeps** the session it has until the new one confirms
+  and supersedes it, so a restart produces no `peer-left`.
+- The server ignores the error: the client will re-handshake.
+- 4404 never tears a session down on its own. Like every error frame it is informational (§7.2):
+  at most it prompts a new handshake, and only the new confirmed session replaces the old one.
+
+**Probe.** A node that sees a repeated announcement (`relay-peer-joined`, `relay-peers`) for a
+peer it holds a live relay session with does not re-handshake. It sends a `ping` on that session,
+at most once a second. A live peer answers `pong`; a restarted one answers 4404.
+
+**Code space.** 4404 sits beside the relay close codes (§4.4.9) but is an error-frame code between
+endpoints, not a relay close code. 4400 is sym's error code for "session closed: <reason>",
+which a node sends to its relay peer when it closes a relay session. Both should be registered,
+or renumbered in the 1xxx connection-level range, when #23 is finalised.

From e4707bb509dabaa4de356e1cadd5b3167a836acf Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Fri, 2 Oct 2026 17:47:38 +0100
Subject: [PATCH 102/148] 0.14.0 security review (BLOCK at 341dafb): the seven
 design assumptions changed

A. The signed audience governs every send: the one seal point refuses a record signed
   to anyone but the session's proven peer; anchors and cmb-fetch never select one.
B. A record is its signed projection: one strict constructor at ingress (closed
   objects, no coercion, meta.key recomputed and a mismatch refused, unknown
   categories dropped, valence/arousal/lineage.method dropped; draft spec PR #34);
   nodeIds canonical lowercase at every door (hello, relay from, grants, invites,
   createdByNodeId).
C. Authority counts only if the signer was authorised when it signed and at receipt
   (grants, key vouches, revokes, attestations; draft spec PR #33); receipt times
   persisted (load time when none); a grant binding is a view over grants in effect
   now; no grant binds this node's own id (a foreign one is inert and reported);
   0.13 grant entries migrate as legacy claims; resolution memoised, linear, with a
   delegation depth of 8.
D. No shared budget before verification (the ceiling is spent after it); a forged
   signature on a proven session closes it and penalises its id; anti-entropy
   (role-digest + paged sync); no eviction before expiry; a session-scoped binding
   for every confirmed session, durable only when earned (an admitted record); hold
   bytes and grant field bounds; relay and LAN handshake shares, per-from rates,
   oldest eviction, waitlist and backoff; a fair per-destination relay pacer; 1011
   replies from one small budget; fetch serving bounds; a per-session record budget.
E. Legacy Import pins the routed node's X25519 key; gated rooms refuse legacy peers;
   heartbeat; routed-author check; quarantined attestations marked; legacy-record and
   legacy-peer-joined instead of the Core Secure events.
F. Errors are information: sealed on a confirmed session, a clear one ignored except
   1011 UNKNOWN_SESSION (re-handshake, never a teardown); 4404 -> 1011, 4400 -> 1010;
   supersession quiet; a relay replay discarded; room-join (#31); 1009 never retried.
G. The host hook fires once per assertion, after de-dup; a directed-record window.

Extras: relocation (lock held, source scrubbed, signed bundles, explicit pin only),
the sticky floor its own persisted fact, one mind per identity, interior socket
hardening and its read side with a connection-bound capability, kind as the signed
intent, selection within the offers, NFC rooms, relay-* never inner, path-safe names,
read-only `sym keys` list, sym emit pins its receiver, remember() never gated and
remix() is (draft spec PR #35), mood-delivered/xmesh-insight name proven ids, no
daemon re-broadcast, paced synthesis, key-bound wake queue, room grant expiry,
bounded metrics, pinned outranks proven, the host API mesh-channel 0.11.0 builds to.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 bin/sym-daemon.js                          |  26 +-
 bin/sym.js                                 |  22 +-
 lib/attestation-store.js                   |   7 +
 lib/config.js                              |   5 +
 lib/core/cmb-encoder.js                    |   6 +-
 lib/core/handshake-v2-flow.js              |  15 +-
 lib/core/mmp-extensions.js                 |   6 +
 lib/core/record-canonical.js               | 181 +++++
 lib/core/sealed-control.js                 |  13 +-
 lib/core/wake.js                           |  17 +-
 lib/discovery.js                           |  18 +-
 lib/emit.js                                |  34 +-
 lib/frame-handler.js                       | 308 ++++++--
 lib/interior.js                            | 237 ++++--
 lib/invite.js                              |   5 +-
 lib/legacy-import.js                       | 108 ++-
 lib/mesh-agent.js                          |  15 +-
 lib/node.js                                | 801 +++++++++++++++++----
 lib/relay.js                               |  95 ++-
 lib/relocation.js                          | 148 +++-
 lib/role-grant-store.js                    | 337 +++++++--
 lib/roster-keys.js                         | 231 ++++--
 lib/session.js                             |  90 ++-
 lib/transport.js                           |   5 +
 lib/wire-identity.js                       |  11 +-
 tests/_core-secure.js                      |   8 +-
 tests/audit-delivery-authorship.test.js    |   3 +-
 tests/core-secure-authority.test.js        |   3 +-
 tests/core-secure-binding-lifetime.test.js |  94 ++-
 tests/core-secure-identity.test.js         | 153 +++-
 tests/core-secure-legacy.test.js           | 135 +++-
 tests/core-secure-node.test.js             |  25 +-
 tests/core-secure-relay.test.js            |  21 +-
 tests/earned-authority-node.test.js        |  13 +-
 tests/emit-room-claim.test.js              |   6 +-
 tests/emit.test.js                         |  15 +-
 tests/gossip-lanes.test.js                 |  83 ++-
 tests/mesh-agent.test.js                   |   1 +
 tests/node.test.js                         |  41 +-
 tests/peer-fed-bounds.test.js              |  19 +-
 tests/record-bounds.test.js                |  13 +-
 tests/role-chain-fetch.test.js             |  55 +-
 tests/role-grant-store.test.js             |  10 +-
 tests/room-admission.test.js               |   2 +-
 tests/roster-and-peer-table-bounds.test.js |  28 +-
 tests/roster-keys.test.js                  |  64 +-
 tests/rule-a-collapse.test.js              |  12 +-
 tests/stored-entry-annotations.test.js     |   4 +-
 tests/sym-attest-v1.test.js                |   6 +-
 tests/v2-author-binding.test.js            |  61 +-
 tests/wake-channels.test.js                |   5 +-
 51 files changed, 2920 insertions(+), 701 deletions(-)
 create mode 100644 lib/core/record-canonical.js

diff --git a/bin/sym-daemon.js b/bin/sym-daemon.js
index 2909430f..59ebb838 100755
--- a/bin/sym-daemon.js
+++ b/bin/sym-daemon.js
@@ -491,10 +491,12 @@ function handleIPCMessage(socketId, socket, msg) {
       if (msg.categories) {
         try {
           const entry = node.remember(msg.categories, { tags: msg.tags, parents: msg.parents });
-          if (entry) {
+          if (entry && !entry.duplicate) {
             sendIPC(socket, { type: 'result', action: 'remember', key: entry.key });
+          } else if (entry) {
+            sendIPC(socket, { type: 'result', action: 'remember', key: entry.key, duplicate: true });
           } else {
-            sendIPC(socket, { type: 'result', action: 'remember', duplicate: true });
+            sendIPC(socket, { type: 'result', action: 'remember', error: 'not stored', code: 'ESTORE' });
           }
         } catch (err) {
           log(`remember failed: ${err.message}`);
@@ -645,24 +647,12 @@ function forwardEventsToListeners() {
     // took the daemon down in 0.13.16.
     if (node._xmesh) node._xmesh.ingestSignal({ type: 'message', from, content });
 
-    // Wake sleeping peers that might need this message.
-    // The daemon acts as wake proxy — it has APNs keys and gossiped wake channels.
-    // When a remote peer (Telegram bot) sends a message, and a local peer (MeloTune)
-    // is sleeping, the daemon wakes it so the relay can deliver the message.
-    node._wakeManager?.wakeSleepingPeers('message', {
-      type: 'message', from: node._identity.nodeId, fromName: node.name,
-      content, timestamp: Date.now(),
-    });
+    // A peer's message is not re-sent under this node's name to sleeping peers (security review):
+    // it was the peer's, signed to this node. A message for another node is that node's to send.
   });
 
-  node.on('mood-delivered', (data) => {
-    // XMesh ingestion happens via cmb → SVAF path, not here.
-    // Wake sleeping local peers so they can receive the mood.
-    node._wakeManager?.wakeSleepingPeers('mood', {
-      type: 'mood', from: node._identity.nodeId, fromName: node.name,
-      mood: data.mood, timestamp: Date.now(),
-    });
-  });
+  // A peer's mood is not re-broadcast under this node's name either (security review): before
+  // 0.14 the daemon queued every delivered mood for sleeping peers as its own `mood` frame.
 
   node.on('xmesh-insight', (data) => {
     broadcastToListeners({ type: 'event', event: 'xmesh-insight', data });
diff --git a/bin/sym.js b/bin/sym.js
index 310fda64..170eaf36 100755
--- a/bin/sym.js
+++ b/bin/sym.js
@@ -136,7 +136,8 @@ function cmdKeys() {
     console.error(`${name} is running (PID ${lock.pid}): stop it before changing its key registry`);
     process.exit(1);
   }
-  const reg = new RosterKeyRegistry({ dir: path.join(dir, 'roster-keys') });
+  // Listing reads the file and changes nothing in it (the node may be running): read-only.
+  const reg = new RosterKeyRegistry({ dir: path.join(dir, 'roster-keys'), readOnly: sub !== 'resolve' && sub !== 'reset-floor' });
   if (sub === 'resolve') {
     const r = reg.resolveConflict(args[3], args[4]);
     if (!r.resolved) { console.error(`not resolved: ${r.reason}`); process.exit(1); }
@@ -458,7 +459,7 @@ function parseObserveFlags(argv) {
  * `sym publish`, which speaks AS this machine's resident node via IPC.
  */
 async function cmdEmit() {
-  const flags = { server: null, room: 'default', name: 'emitter', to: null, parents: [] };
+  const flags = { server: null, room: 'default', name: 'emitter', to: null, parents: [], receiver: null, receiverKey: null };
   const positional = [];
   for (let i = 1; i < args.length; i++) {
     const a = args[i];
@@ -466,12 +467,15 @@ async function cmdEmit() {
     else if (a === '--room') flags.room = args[++i];
     else if (a === '--name') flags.name = args[++i];
     else if (a === '--to') flags.to = args[++i];
+    else if (a === '--receiver') flags.receiver = args[++i];
+    else if (a === '--receiver-key') flags.receiverKey = args[++i];
     else if (a === '--parents') flags.parents = String(args[++i] || '').split(',').filter(Boolean);
     else positional.push(a);
   }
   const content = positional.join(' ');
-  if (!flags.server || !content) {
-    console.error('Usage: sym emit --server <host:port> [--room <g>] [--name <id>] [--to <node>] [--parents <k1,k2>] \'{"focus":"...",...}\'');
+  if (!flags.server || !content || !flags.receiver || !flags.receiverKey) {
+    console.error('Usage: sym emit --server <host:port> --receiver <nodeId> --receiver-key <key|sha256:fingerprint> [--room <g>] [--name <id>] [--to <node>] [--parents <k1,k2>] \'{"focus":"...",...}\'');
+    console.error('  The receiver is pinned: the endpoint must prove that nodeId under that key, or nothing is sent.');
     console.error('  Emits ONE signed v1 block to a remote mesh node and exits (MMP §17.1 Class 1).');
     console.error('  Grounding from CI: --parents <cmb-key> with categories {"intent":"ground","commitment":"verified: ..."}');
     process.exit(1);
@@ -482,8 +486,9 @@ async function cmdEmit() {
     process.exit(1);
   }
   const { emitOnce } = require('../lib/emit');
+  const receiver = /^sha256:/.test(flags.receiverKey) ? { nodeId: flags.receiver, fingerprint: flags.receiverKey } : { nodeId: flags.receiver, key: flags.receiverKey };
   const { key } = await emitOnce(
-    { server: flags.server, room: flags.room, name: flags.name },
+    { server: flags.server, receiver, room: flags.room, name: flags.name },
     categories,
     { to: flags.to || undefined, parents: flags.parents },
   );
@@ -673,7 +678,12 @@ async function standaloneObserve(categories, opts) {
 
   if (!entry) {
     await node.stop().catch(() => {});
-    throw new Error('node.remember() returned null — remix rejected or store write failed');
+    throw new Error('node.remember() returned null — the store write failed');
+  }
+  if (entry.duplicate) {
+    await node.stop().catch(() => {});
+    console.log(`Already stored: ${entry.key}`);
+    return;
   }
 
   // Give the relay a moment to broadcast the CMB to peers before we
diff --git a/lib/attestation-store.js b/lib/attestation-store.js
index 59cd3426..c0b3255d 100644
--- a/lib/attestation-store.js
+++ b/lib/attestation-store.js
@@ -294,6 +294,11 @@ class AttestationStore {
     if (opts.ingested && !this._allowIngest(att.of, att.by, opts.now ?? Date.now())) {
       return { stored: false, reason: 'rate-limited' };
     }
+    // When this node received it (draft spec PR #33: an attestation counts by its signer's authority
+    // at its signed time AND at its receipt), kept and persisted with it when the caller says. One a
+    // line carries no receipt time for (written before 0.14) is treated as received at load
+    // (`loadedAt`).
+    if (Number.isFinite(opts.receivedAt) && att.receivedAt !== opts.receivedAt) att = { ...att, receivedAt: opts.receivedAt };
 
     let mine = this._heldBy.get(att.by);
     if (mine) this._heldBy.delete(att.by);
@@ -646,6 +651,8 @@ class AttestationStore {
    *  malformed line is skipped, never fatal. Then a crashed rotation is tidied up, and a log that is
    *  over budget (by the same rule as at run time) is rotated. */
   _load() {
+    /** When this store was loaded: the receipt time of a record a line carries none for. */
+    this.loadedAt = Date.now();
     this._loading = true;
     this._replay(ATT_FILE, (o) => this.record(o));
     this._replay(CP_FILE, (o) => this.recordCheckpoint(o));
diff --git a/lib/config.js b/lib/config.js
index f20c841c..5e8e3575 100644
--- a/lib/config.js
+++ b/lib/config.js
@@ -190,6 +190,11 @@ function validateName(name) {
   if (/[\x00-\x1f\x7f-\x9f]/.test(name)) {
     throw new Error('Node name must not contain control characters');
   }
+  // A name is one path component (security review): it names `nodes/<name>`, a compat link and an
+  // index file, so a separator or a dot-name would reach outside the state root.
+  if (/[\/\\]/.test(name) || name === '.' || name === '..') {
+    throw new Error('Node name must not contain a path separator or be "." or ".."');
+  }
 }
 
 /**
diff --git a/lib/core/cmb-encoder.js b/lib/core/cmb-encoder.js
index 8733480e..889335b8 100644
--- a/lib/core/cmb-encoder.js
+++ b/lib/core/cmb-encoder.js
@@ -469,9 +469,9 @@ const DEFAULT_ROOM = 'default';
 const MAX_NAME_BYTES = 64;
 /**
  * Text bounds. The spec says categories are bounded but gives no number. One category is at most a
- * quarter of a 1 MiB frame and the seven at most 960 KiB of text. Like the agent-id bound, these are
- * minting rules. A receiver applies no record bound beyond the frame a record arrives in: releases
- * before 0.14.0 minted records up to that, and refusing them would stop a node hearing such a peer.
+ * quarter of a 1 MiB frame and the seven at most 960 KiB of text. These are minting rules, and since
+ * 0.14.0 (security review D) the receiving bound for a v2.0 record as well (record-canonical.js): a
+ * record over them is refused before anything encodes it. A pre-v2.0 record never enters Core Secure.
  *
  * They do not by themselves keep a record sendable, because a frame is not text: JSON escapes a `"`
  * as two bytes and a control character as six, and a record sent to a peer with a shared secret
diff --git a/lib/core/handshake-v2-flow.js b/lib/core/handshake-v2-flow.js
index ae9fb60a..0a82fb2c 100644
--- a/lib/core/handshake-v2-flow.js
+++ b/lib/core/handshake-v2-flow.js
@@ -55,8 +55,12 @@ function partyFromHello(hello) {
  * Build the client-hello frame. `self` is this node's identity/keys/capabilities.
  * @returns {{ frame: object, nonce: string }}
  */
+/** A room in NFC (§5.2), or null for a value that is not a room. */
+const nfc = (room) => (typeof room === 'string' && room.length > 0 ? room.normalize('NFC') : null);
+
 function clientHello({ room, nodeId, name, identityPublicKey, e2ePublicKey, implementation, extensions, nonce }) {
   const n = nonce || newNonce();
+  room = nfc(room);
   return {
     frame: {
       type: 'client-hello',
@@ -83,7 +87,8 @@ function clientHello({ room, nodeId, name, identityPublicKey, e2ePublicKey, impl
 function serverAccept({ clientHelloFrame, self, agree, nonce }) {
   if (!clientHelloFrame || clientHelloFrame.type !== 'client-hello') throw new Error('handshake: expected client-hello');
   if (clientHelloFrame.protocolVersion !== PROTOCOL_VERSION) throw new Error('handshake: unsupported protocolVersion');
-  if (clientHelloFrame.room !== self.room) throw new Error('handshake: room mismatch');
+  // §5.2: the room is explicit and NFC-normalised; rooms compare, and are bound, in NFC.
+  if (nfc(clientHelloFrame.room) === null || nfc(clientHelloFrame.room) !== nfc(self.room)) throw new Error('handshake: room mismatch');
 
   const serverNonce = nonce || newNonce();
   const { selected } = selectExtensions(clientHelloFrame.extensions, self.extensions);
@@ -91,7 +96,7 @@ function serverAccept({ clientHelloFrame, self, agree, nonce }) {
   const client = partyFromHello(clientHelloFrame);
   const server = partyFromHello({ ...self, nonce: serverNonce });
   const transcript = buildTranscript({
-    protocolVersion: PROTOCOL_VERSION, room: self.room, client, server, selectedExtensions: selected,
+    protocolVersion: PROTOCOL_VERSION, room: nfc(self.room), client, server, selectedExtensions: selected,
   });
   const th = transcriptHash(transcript);
   const sharedSecret = agree(clientHelloFrame.e2ePublicKey);
@@ -103,7 +108,7 @@ function serverAccept({ clientHelloFrame, self, agree, nonce }) {
     frame: {
       type: 'server-hello',
       protocolVersion: PROTOCOL_VERSION,
-      room: self.room,
+      room: nfc(self.room),
       nodeId: self.nodeId,
       name: self.name,
       identityPublicKey: self.identityPublicKey,
@@ -134,7 +139,7 @@ function clientFinish({ serverHelloFrame, clientHelloFrame, self, agree }) {
   const s = serverHelloFrame;
   if (!s || s.type !== 'server-hello') throw new Error('handshake: expected server-hello');
   if (s.protocolVersion !== PROTOCOL_VERSION) throw new Error('handshake: unsupported protocolVersion');
-  if (s.room !== clientHelloFrame.room) throw new Error('handshake: room mismatch');
+  if (nfc(s.room) === null || nfc(s.room) !== nfc(clientHelloFrame.room)) throw new Error('handshake: room mismatch');
   // The server MUST echo our nonce — binds this response to this request (anti-replay).
   if (s.clientNonce !== clientHelloFrame.nonce) throw new Error('handshake: server did not echo our nonce');
 
@@ -144,7 +149,7 @@ function clientFinish({ serverHelloFrame, clientHelloFrame, self, agree }) {
   const client = partyFromHello(clientHelloFrame);
   const server = partyFromHello(s);
   const transcript = buildTranscript({
-    protocolVersion: PROTOCOL_VERSION, room: clientHelloFrame.room, client, server,
+    protocolVersion: PROTOCOL_VERSION, room: nfc(clientHelloFrame.room), client, server,
     selectedExtensions: s.selectedExtensions || [],
   });
   const th = transcriptHash(transcript);
diff --git a/lib/core/mmp-extensions.js b/lib/core/mmp-extensions.js
index 614f11de..9a080240 100644
--- a/lib/core/mmp-extensions.js
+++ b/lib/core/mmp-extensions.js
@@ -69,6 +69,12 @@ function assertNoDowngrade(clientOffers, serverOffers, selectedExtensions) {
   const c = new Set(clientOffers || []);
   const srv = new Set(serverOffers || []);
   const sel = new Set(selectedExtensions || []);
+  // The server selects from what both offered, and nothing else (§16.3; review): a selection outside
+  // the offers' intersection, or one that names an extension twice, is refused.
+  if (sel.size !== (selectedExtensions || []).length) throw new Error('mmp-extensions: the selection names an extension twice; aborting');
+  for (const ext of sel) {
+    if (!c.has(ext) || !srv.has(ext)) throw new Error(`mmp-extensions: ${String(ext).slice(0, 40)} was selected but not offered by both peers; aborting`);
+  }
   for (const ext of DOWNGRADE_CRITICAL) {
     if (c.has(ext) && srv.has(ext) && !sel.has(ext)) {
       throw new Error(`mmp-extensions: downgrade — both peers offered ${ext} but it was not selected; aborting`);
diff --git a/lib/core/record-canonical.js b/lib/core/record-canonical.js
new file mode 100644
index 00000000..fe02e3b3
--- /dev/null
+++ b/lib/core/record-canonical.js
@@ -0,0 +1,181 @@
+'use strict';
+
+/**
+ * @module sym/core/record-canonical
+ * @description A record is its signed projection (sym 0.14 security review, finding B).
+ *
+ * One constructor, used at every ingress (a session's opened record, a fetched record), that
+ * validates a received `mmp-sig-v2.0` record strictly against the published schema
+ * (meshcognition.org/spec/mmp/schema/cmb.schema.json) — MMP §8.8.5 step 1 as draft spec PR
+ * meshcognition-website#34 states it — and keeps only its signed projection:
+ *
+ *   - every object is closed: a member the schema does not define refuses the record, except an
+ *     unrecognised CATEGORY, which is dropped (§8, forward compatibility);
+ *   - every member has its schema's JSON type, checked before anything is length-prefixed: nothing
+ *     is coerced (a number is not its decimal string, an array or object is not a string);
+ *   - `metadata.to` is a lowercase UUID or null, `createdByNodeId` a lowercase UUID (§3.1.1);
+ *   - each category's carried `meta.key` must equal its recomputation from the category name and
+ *     the signed text (§8.8.5 step 4): a mismatch refuses the record;
+ *   - the carried but unsigned members (§8.8.4) — the mood's `valence` and `arousal`, and
+ *     `lineage.method` — are dropped.
+ *
+ * It returns a NEW object:
+ *
+ *   categories.<each of the seven>  { text, meta: { key, parents } }
+ *   metadata  { key, addressScheme, assertionId, signatureSuite, createdByNodeId, createdBy,
+ *               createdTimestamp, room, to, lineage: { parents } | null, application?, sigAlg, sig }
+ *
+ * The node stores, emits (the verified-record hook) and serves only what this returns.
+ *
+ * @copyright 2026 SYM.BOT Ltd.
+ * @license Apache-2.0
+ */
+
+const { CAT7_CATEGORIES } = require('./cmb');
+const { categoryKeyV1, MAX_CATEGORY_BYTES, MAX_RECORD_TEXT_BYTES } = require('./cmb-encoder');
+
+const LOWER_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+/** A canonical nodeId: a lowercase UUID, or (tests and older hosts) another lowercase identifier. */
+const LOWER_ID = /^[0-9a-z][0-9a-z._-]{0,127}$/;
+const CMB_KEY = /^cmb-[0-9a-f]{64}$/;
+const ASRT = /^asrt-[0-9a-f]{64}$/;
+const SIG = /^[A-Za-z0-9_-]{86}$/;
+const DIGEST = /^sha256-[0-9a-f]{64}$/;
+const B64URL = /^[A-Za-z0-9_-]*$/;
+const MEDIA = /^[a-z0-9][a-z0-9!#$&^_.+/-]*$/;
+
+/**
+ * A category's text, and the seven together, at most what this release mints (cmb-encoder): a record
+ * over that is refused at ingress, before anything encodes it (security review D, record-flood). MMP
+ * sets no category bound of its own (the 1 MiB frame bounds the whole); this reverses the 0.14.0
+ * review's C-F4 acceptance of larger categories from other implementations, by the later ruling.
+ */
+const MAX_TEXT = MAX_CATEGORY_BYTES;
+const MAX_PARENTS = 256;
+const MAX_REF = 256;
+
+const METADATA_MEMBERS = new Set(['key', 'addressScheme', 'assertionId', 'signatureSuite', 'createdByNodeId', 'createdBy',
+  'createdTimestamp', 'room', 'to', 'lineage', 'application', 'sigAlg', 'sig']);
+const APPLICATION_MEMBERS = ['mediaType', 'schema', 'encoding', 'byteLength', 'digest', 'data'];
+
+const isPlain = (v) => v !== null && typeof v === 'object' && !Array.isArray(v) && Object.getPrototypeOf(v) === Object.prototype;
+const isNodeId = (v) => typeof v === 'string' && (LOWER_UUID.test(v) || LOWER_ID.test(v));
+const isLowerUuid = (v) => typeof v === 'string' && LOWER_UUID.test(v);
+
+class RecordShapeError extends Error {
+  constructor(reason) { super(`record: ${reason}`); this.reason = reason; this.code = 'ERECORDSHAPE'; }
+}
+
+function refs(list, what, pattern) {
+  if (!Array.isArray(list)) throw new RecordShapeError(`${what} is not an array`);
+  if (list.length > MAX_PARENTS) throw new RecordShapeError(`${what} has more than ${MAX_PARENTS} entries`);
+  const seen = new Set();
+  for (const r of list) {
+    if (typeof r !== 'string' || r.length === 0 || r.length > MAX_REF || (pattern && !pattern.test(r))) throw new RecordShapeError(`${what} holds a value that is not a reference`);
+    if (seen.has(r)) throw new RecordShapeError(`${what} repeats an entry`);
+    seen.add(r);
+  }
+  return [...list];
+}
+
+function category(name, v) {
+  if (!isPlain(v)) throw new RecordShapeError(`category ${name} is not an object`);
+  const allowed = name === 'mood' ? new Set(['text', 'meta', 'valence', 'arousal']) : new Set(['text', 'meta']);
+  for (const k of Object.keys(v)) if (!allowed.has(k)) throw new RecordShapeError(`category ${name} carries an unknown member`);
+  if (typeof v.text !== 'string') throw new RecordShapeError(`category ${name} has no text`);
+  if (Buffer.byteLength(v.text, 'utf8') > MAX_TEXT) throw new RecordShapeError(`category ${name} is too long`);
+  if (name === 'mood') {
+    // Validated as the schema types them, then dropped: unsigned (§8.8.4).
+    for (const k of ['valence', 'arousal']) {
+      if (v[k] !== undefined && (typeof v[k] !== 'number' || !Number.isFinite(v[k]) || v[k] < -1 || v[k] > 1)) throw new RecordShapeError(`mood ${k} is not a number in [-1, 1]`);
+    }
+  }
+  if (!isPlain(v.meta)) throw new RecordShapeError(`category ${name} has no meta object`);
+  for (const k of Object.keys(v.meta)) if (k !== 'key' && k !== 'parents') throw new RecordShapeError(`category ${name} meta carries an unknown member`);
+  if (typeof v.meta.key !== 'string' || !/^[0-9a-f]{64}$/.test(v.meta.key)) throw new RecordShapeError(`category ${name} meta.key is not a key`);
+  const parents = refs(v.meta.parents, `category ${name} parents`);
+  // The text is signed through the content address, the parents through the categoryParents
+  // commitment; the category key is derived, so it is recomputed and a carried mismatch refused
+  // (§8.8.5 step 4, draft spec PR #34).
+  const key = categoryKeyV1(name, v.text);
+  // Step 4's verdict, named as verifyCMB names a content address that does not match its content.
+  if (v.meta.key !== key) throw new RecordShapeError('content-mismatch');
+  return { text: v.text, meta: { key, parents } };
+}
+
+function application(a) {
+  if (!isPlain(a)) throw new RecordShapeError('application is not an object');
+  for (const k of Object.keys(a)) if (!APPLICATION_MEMBERS.includes(k)) throw new RecordShapeError('application carries an unknown member');
+  if (typeof a.mediaType !== 'string' || !MEDIA.test(a.mediaType)) throw new RecordShapeError('application mediaType is malformed');
+  if (typeof a.schema !== 'string' || a.schema.length > 2048) throw new RecordShapeError('application schema is not text');
+  if (a.encoding !== 'base64url') throw new RecordShapeError('application encoding is not base64url');
+  if (!Number.isSafeInteger(a.byteLength) || a.byteLength < 0 || a.byteLength > 524288) throw new RecordShapeError('application byteLength is malformed');
+  if (typeof a.digest !== 'string' || !DIGEST.test(a.digest)) throw new RecordShapeError('application digest is malformed');
+  if (typeof a.data !== 'string' || !B64URL.test(a.data)) throw new RecordShapeError('application data is not base64url');
+  return { mediaType: a.mediaType, schema: a.schema, encoding: a.encoding, byteLength: a.byteLength, digest: a.digest, data: a.data };
+}
+
+/**
+ * The signed projection of a received v2.0 record, or a RecordShapeError (`.reason`).
+ * @param {object} cmb
+ * @returns {{ categories: object, metadata: object }}
+ */
+function canonicalRecordV2_0(cmb) {
+  if (!isPlain(cmb)) throw new RecordShapeError('not an object');
+  for (const k of Object.keys(cmb)) if (k !== 'categories' && k !== 'metadata') throw new RecordShapeError('carries a member outside categories and metadata');
+  const c = cmb.categories;
+  if (!isPlain(c)) throw new RecordShapeError('no categories section');
+  // An unrecognised category is dropped, not refused (§8 forward compatibility, draft spec PR #34).
+  const categories = {};
+  let total = 0;
+  for (const f of CAT7_CATEGORIES) {
+    if (c[f] === undefined) throw new RecordShapeError(`category ${f} is missing`);
+    categories[f] = category(f, c[f]);
+    total += Buffer.byteLength(categories[f].text, 'utf8');
+  }
+  if (total > MAX_RECORD_TEXT_BYTES) throw new RecordShapeError('the categories together are too long');
+  const m = cmb.metadata;
+  if (!isPlain(m)) throw new RecordShapeError('no metadata section');
+  for (const k of Object.keys(m)) if (!METADATA_MEMBERS.has(k)) throw new RecordShapeError(`metadata carries an unknown member`);
+  if (typeof m.key !== 'string' || !CMB_KEY.test(m.key)) throw new RecordShapeError('metadata.key is malformed');
+  if (m.addressScheme !== 'mmp-cmb-merkle-v2') throw new RecordShapeError('addressScheme is not mmp-cmb-merkle-v2');
+  if (typeof m.assertionId !== 'string' || !ASRT.test(m.assertionId)) throw new RecordShapeError('assertionId is malformed');
+  if (m.signatureSuite !== 'mmp-sig-v2.0') throw new RecordShapeError('signatureSuite is not mmp-sig-v2.0');
+  if (!isLowerUuid(m.createdByNodeId)) throw new RecordShapeError('createdByNodeId is not a lowercase UUID');
+  if (typeof m.createdBy !== 'string' || m.createdBy.length === 0 || m.createdBy.length > 256) throw new RecordShapeError('createdBy is not a label');
+  if (!Number.isSafeInteger(m.createdTimestamp) || m.createdTimestamp < 0) throw new RecordShapeError('createdTimestamp is not an integer');
+  if (typeof m.room !== 'string' || m.room.length === 0 || m.room.length > 256) throw new RecordShapeError('room is not a room');
+  if (!(m.to === null || isLowerUuid(m.to))) throw new RecordShapeError('to is not a lowercase UUID or null');
+  let lineage = null;
+  if (m.lineage === undefined) throw new RecordShapeError('lineage is missing (an object or null)');
+  if (m.lineage !== null) {
+    if (!isPlain(m.lineage)) throw new RecordShapeError('lineage is not an object');
+    for (const k of Object.keys(m.lineage)) if (k !== 'parents' && k !== 'method') throw new RecordShapeError('lineage carries an unknown member');
+    // Optional, unsigned and dropped (§8.8.4), but typed as the schema types it.
+    if (m.lineage.method !== undefined && (typeof m.lineage.method !== 'string' || m.lineage.method.length === 0)) throw new RecordShapeError('lineage.method is not text');
+    lineage = { parents: refs(m.lineage.parents, 'lineage.parents', CMB_KEY) };
+  }
+  if (m.sigAlg !== 'ed25519') throw new RecordShapeError('sigAlg is not ed25519');
+  if (typeof m.sig !== 'string' || !SIG.test(m.sig)) throw new RecordShapeError('sig is not an unpadded Ed25519 signature');
+  const metadata = {
+    key: m.key, addressScheme: m.addressScheme, assertionId: m.assertionId, signatureSuite: m.signatureSuite,
+    createdByNodeId: m.createdByNodeId, createdBy: m.createdBy, createdTimestamp: m.createdTimestamp,
+    room: m.room, to: m.to, lineage,
+  };
+  if (m.application !== undefined && m.application !== null) metadata.application = application(m.application);
+  metadata.sigAlg = m.sigAlg;
+  metadata.sig = m.sig;
+  return { categories, metadata };
+}
+
+/**
+ * The signed projection of a record this node sends (its own, or one it stored): the same checks
+ * and the same members, its own records' unsigned extras (valence, arousal, lineage.method)
+ * dropped likewise, and any member outside `categories` and `metadata` (a store annotation)
+ * left behind.
+ */
+function signedProjection(cmb) {
+  return canonicalRecordV2_0({ categories: cmb.categories, metadata: cmb.metadata });
+}
+
+module.exports = { canonicalRecordV2_0, signedProjection, RecordShapeError, isCanonicalNodeId: isNodeId, isLowerUuid, LOWER_UUID };
diff --git a/lib/core/sealed-control.js b/lib/core/sealed-control.js
index 7868aa17..57fb562b 100644
--- a/lib/core/sealed-control.js
+++ b/lib/core/sealed-control.js
@@ -40,7 +40,12 @@ const AAD_DOMAIN = 'mmp-aead-control-v2\n';
 const DIRECTIONS = new Set(['client-to-server', 'server-to-client']);
 
 /** The frame types a sealed control frame may carry. Records, handshakes and envelopes never. */
-const NEVER_INNER = new Set(['cmb', 'cmb-encrypted', 'control-encrypted', 'client-hello', 'server-hello', 'client-finish', 'handshake', 'state-sync']);
+// Never inside a control envelope: records (they have their own), envelopes, handshake frames, and
+// the relay protocol's own frames (a peer's sealed frame is never a relay instruction).
+const NEVER_INNER = new Set(['cmb', 'cmb-encrypted', 'control-encrypted', 'client-hello', 'server-hello', 'client-finish', 'handshake', 'state-sync',
+  'relay-auth', 'relay-peers', 'relay-peer-joined', 'relay-peer-left', 'relay-ping', 'relay-pong', 'relay-reauth', 'relay-error', 'relay-challenge']);
+/** Whether a frame type may never travel inside a control envelope (every relay-* type included). */
+const neverInner = (type) => NEVER_INNER.has(type) || type.startsWith('relay-');
 
 function controlAAD({ sessionId, direction, sequence }) {
   return Buffer.concat([
@@ -59,7 +64,7 @@ const b64urlUnpadded = (buf) => Buffer.from(buf).toString('base64url').replace(/
  * @returns {object} the wire frame
  */
 function buildControlFrame({ frame, sessionId, direction, sequence, trafficKey }) {
-  if (!frame || typeof frame.type !== 'string' || NEVER_INNER.has(frame.type)) throw new Error(`control-encrypted: refusing to seal a '${frame && frame.type}' frame`);
+  if (!frame || typeof frame.type !== 'string' || neverInner(frame.type)) throw new Error(`control-encrypted: refusing to seal a '${frame && frame.type}' frame`);
   if (!/^[0-9a-f]{32}$/.test(sessionId || '')) throw new Error('control-encrypted: sessionId must be 32 lowercase hex');
   if (!DIRECTIONS.has(direction)) throw new Error('control-encrypted: bad direction');
   if (!/^(0|[1-9][0-9]*)$/.test(String(sequence))) throw new Error('control-encrypted: bad sequence');
@@ -85,10 +90,10 @@ function openControlFrame({ frame, trafficKey }) {
   // The peer wrote this JSON as surely as a cleartext frame, so it meets the same nesting bound.
   if (nestedTooDeep(text)) throw new Error(`control-encrypted: plaintext nests deeper than ${MAX_FRAME_DEPTH} levels`);
   const inner = JSON.parse(text);
-  if (!inner || typeof inner !== 'object' || Array.isArray(inner) || typeof inner.type !== 'string' || NEVER_INNER.has(inner.type)) {
+  if (!inner || typeof inner !== 'object' || Array.isArray(inner) || typeof inner.type !== 'string' || neverInner(inner.type)) {
     throw new Error('control-encrypted: the sealed frame is not a control frame');
   }
   return inner;
 }
 
-module.exports = { FRAME_TYPE, AAD_DOMAIN, controlAAD, buildControlFrame, openControlFrame, isControlFrame, NEVER_INNER };
+module.exports = { FRAME_TYPE, AAD_DOMAIN, controlAAD, buildControlFrame, openControlFrame, isControlFrame, NEVER_INNER, neverInner };
diff --git a/lib/core/wake.js b/lib/core/wake.js
index c01a8ed8..8c58b9b5 100644
--- a/lib/core/wake.js
+++ b/lib/core/wake.js
@@ -94,8 +94,11 @@ class WakeManager {
    * @param {function} opts.getMeshNode - () => MeshNode instance.
    * @param {function} opts.getIdentity - () => identity object.
    * @param {string} opts.nodeName - This node's display name.
+   * @param {function} [opts.keyOf] - (nodeId) => the identity key bound to it now; a queued frame is
+   *   kept with it and delivered only to a session proving that key.
    */
   constructor(opts) {
+    this._keyOf = typeof opts.keyOf === 'function' ? opts.keyOf : () => undefined;
     this._wakeChannelsFile = opts.wakeChannelsFile;
     this._peerWakeChannels = opts.peerWakeChannels;
     this._peerLastWake = opts.peerLastWake;
@@ -392,20 +395,28 @@ class WakeManager {
    * oldest dropped first (one frame object is shared by every queue it is in, so what is held is
    * bounded by that many frames, for at most as many peers as the wake-channel table holds).
    *
+   * Each queued frame is kept with the identity key bound to its peer when it was queued, and the
+   * node delivers it only to a session proving that key (security review). The retired `message`
+   * frame is never queued: a message is a record signed to its recipient, so `pendingFrame` may be
+   * a function of the peer's nodeId that builds one for it.
+   *
    * @param {string} reason - Wake reason.
-   * @param {object} [pendingFrame] - Frame to queue for delivery on reconnect.
+   * @param {object|function} [pendingFrame] - Frame to queue for delivery on reconnect, or
+   *   (peerId) => frame|null.
    * @returns {void}
    */
   wakeSleepingPeers(reason, pendingFrame) {
     const peers = this._getPeers();
     for (const [peerId] of this._peerWakeChannels) {
       if (!peers.has(peerId)) {
-        if (pendingFrame) {
+        const frame = typeof pendingFrame === 'function' ? pendingFrame(peerId) : pendingFrame;
+        const key = frame ? this._keyOf(peerId) : undefined;
+        if (frame && frame.type !== 'message' && key) {
           // At most PENDING_FRAMES_MAX wait per peer (the oldest go), and only for a peer with a
           // channel: dropping the channel drops its queue (_delete).
           let queue = this._pendingFrames.get(peerId);
           if (!queue) { queue = []; this._pendingFrames.set(peerId, queue); }
-          queue.push(pendingFrame);
+          queue.push({ frame, key });
           if (queue.length > this._maxPendingFrames) queue.splice(0, queue.length - this._maxPendingFrames);
         }
 
diff --git a/lib/discovery.js b/lib/discovery.js
index 36525129..17465f5a 100644
--- a/lib/discovery.js
+++ b/lib/discovery.js
@@ -93,6 +93,9 @@ function createBonjour(onError) {
   return bonjour;
 }
 
+/** Inbound LAN connections that have not yet sent their first frame, at most (in all, and per address). */
+const LISTENER_INFLIGHT_MAX = 256;
+const LISTENER_INFLIGHT_PER_HOST = 16;
 /** A LAN peer not re-announced for this long is dropped from the reconnect cache (see _reconnectCachedPeers). */
 const BONJOUR_PEER_TTL_MS = 5 * 60_000;
 
@@ -250,10 +253,23 @@ class BonjourDiscovery extends Discovery {
     const remote = `${socket.remoteAddress || '?'}:${socket.remotePort || '?'}`;
     let identified = false;
     const timeout = setTimeout(() => { if (!identified) transport.close(); }, this._handshakeTimeoutMs);
+    // In flight before the first frame: at most LISTENER_INFLIGHT_MAX connections, and at most
+    // LISTENER_INFLIGHT_PER_HOST from one address (security review D). Past either, the OLDEST such
+    // connection is closed, so a flood of idle sockets cannot keep a newcomer out (it waits the
+    // flood's whole deadline only if it is slower than LISTENER_INFLIGHT_MAX new connections).
+    const host = socket.remoteAddress || '?';
+    const entry = { transport, host };
+    if (!this._preIdent) this._preIdent = new Set();
+    const sameHost = [...this._preIdent].filter((e) => e.host === host);
+    if (sameHost.length >= LISTENER_INFLIGHT_PER_HOST) sameHost[0].transport.close();
+    if (this._preIdent.size >= LISTENER_INFLIGHT_MAX) this._preIdent.values().next().value.transport.close();
+    this._preIdent.add(entry);
+    const leave = () => this._preIdent.delete(entry);
 
     transport.on('message', (msg) => {
       if (identified) return;
       identified = true;
+      leave();
       clearTimeout(timeout);
       transport.removeAllListeners('message');
       if (!msg || msg.type !== 'client-hello') {
@@ -267,7 +283,7 @@ class BonjourDiscovery extends Discovery {
     // A parse error must not cancel the identification deadline (MMP §4.1, §19.1):
     // the timer is cleared only by a handshake or by the transport closing.
     transport.on('error', () => {});
-    transport.on('close', () => clearTimeout(timeout));
+    transport.on('close', () => { clearTimeout(timeout); leave(); });
   }
 
   _startDnsSd() {
diff --git a/lib/emit.js b/lib/emit.js
index 1ca0d90e..1bbbef6b 100644
--- a/lib/emit.js
+++ b/lib/emit.js
@@ -23,7 +23,8 @@
 const net = require('net');
 const { createCMB, signCMB, assertionIdV2_0 } = require('./core');
 const { TcpTransport } = require('./transport');
-const { loadOrCreateIdentity } = require('./config');
+const { loadOrCreateIdentity, acquireIdentityLock, nodeDirById } = require('./config');
+const { keyFingerprint } = require('./roster-keys');
 const { MMP_EMIT_V2 } = require('./emit-policy'); // the single reader-first flip switch
 const { PeerSession } = require('./session');
 const { EXT_CMB_ENCRYPTED_V2 } = require('./core/mmp-extensions');
@@ -115,6 +116,7 @@ class Emitter {
 
   /** Flush and disconnect. Safe to call once; resolves when the socket closes. */
   close() {
+    if (this._release) { try { this._release(); } catch { /* */ } this._release = null; }
     return new Promise((resolve) => {
       if (this._socket.destroyed) return resolve();
       // Let what was written drain, then end the session with the socket.
@@ -130,14 +132,25 @@ class Emitter {
  * Connect to a mesh endpoint and complete the §5.2 handshake.
  * @param {object} opts
  * @param {string} opts.server - "host:port" of a listening mesh node.
+ * @param {{ nodeId: string, key?: string, fingerprint?: string }} opts.receiver - THE RECEIVER, PINNED
+ *   (security review): the nodeId the endpoint must prove, and its identity key or `sha256:` key
+ *   fingerprint. An address names nobody; without the pin anyone answering at host:port would take
+ *   the record. Refused without it.
  * @param {string} [opts.room] - the room this emitter claims and authors for. Omitted, it claims
  *   none, and authors for the room the node it connects to admits it into.
- * @param {string} [opts.name='emitter'] - stable emitter identity name.
+ * @param {string} [opts.name='emitter'] - stable emitter identity name. Never a node that is live on
+ *   this host: the emitter holds the identity's lock while it is connected (two processes would be
+ *   one identity twice, §3.2).
  * @param {number} [opts.timeoutMs=8000] - connect + handshake deadline.
  * @returns {Promise<Emitter>}
  */
-async function connect({ server, room, name = 'emitter', timeoutMs = HANDSHAKE_TIMEOUT_MS } = {}) {
+async function connect({ server, receiver, room, name = 'emitter', timeoutMs = HANDSHAKE_TIMEOUT_MS } = {}) {
+  if (!receiver || typeof receiver.nodeId !== 'string' || !(typeof receiver.key === 'string' || typeof receiver.fingerprint === 'string')) {
+    throw Object.assign(new Error('emit: the receiver must be pinned: { nodeId, key } or { nodeId, fingerprint } (sym emit --receiver <nodeId> --receiver-key <key|sha256:…>)'), { code: 'EEMITPIN' });
+  }
   const identity = loadOrCreateIdentity(name);
+  // The identity's lock, held while connected: a live node of this name refuses the emitter.
+  const release = acquireIdentityLock(name, { dir: nodeDirById(identity.nodeId) });
   const { host, port } = parseServer(server);
   // §5.8: the room is explicit in Core Secure; the default room is the literal 'default'.
   const claimed = (typeof room === 'string' && room) ? room : 'default';
@@ -151,7 +164,7 @@ async function connect({ server, room, name = 'emitter', timeoutMs = HANDSHAKE_T
 
   const transport = new TcpTransport(socket);
   const session = new PeerSession({
-    role: 'client', transport, kind: 'bonjour', room: claimed,
+    role: 'client', transport, kind: 'bonjour', room: claimed, expectNodeId: receiver.nodeId,
     local: { nodeId: identity.nodeId, name, publicKey: identity.publicKey, privateKey: identity.privateKey },
     extensions: [EXT_CMB_ENCRYPTED_V2], implementation: IMPLEMENTATION, timeoutMs,
   });
@@ -163,9 +176,16 @@ async function connect({ server, room, name = 'emitter', timeoutMs = HANDSHAKE_T
     session.once('closed', (c) => reject(new Error(`emit: ${server} did not complete the Core Secure handshake (${c.reason}${c.detail ? `: ${c.detail}` : ''})`)));
     transport.once('close', () => { if (!session.confirmed) session.close('transport-closed', { notify: false }); });
     session.start();
-  }).catch((e) => { socket.destroy(); throw e; });
-
-  return new Emitter({ identity, session, socket, room: claimed, name });
+  }).catch((e) => { socket.destroy(); release(); throw e; });
+  // The endpoint proved the pinned nodeId (expectNodeId); now its key must be the pinned one too.
+  const keyOk = typeof receiver.key === 'string' ? session.identityKey === receiver.key : keyFingerprint(session.identityKey) === receiver.fingerprint;
+  if (!keyOk) {
+    socket.destroy(); release();
+    throw Object.assign(new Error(`emit: ${server} proved ${receiver.nodeId.slice(0, 8)} under a key that is not the pinned one`), { code: 'EEMITPIN' });
+  }
+  const emitter = new Emitter({ identity, session, socket, room: claimed, name });
+  emitter._release = release;
+  return emitter;
 }
 
 /**
diff --git a/lib/frame-handler.js b/lib/frame-handler.js
index cf9e6cc6..8d05408c 100644
--- a/lib/frame-handler.js
+++ b/lib/frame-handler.js
@@ -4,6 +4,7 @@ const crypto = require('crypto');
 
 const { recordKey, recordLineage, recordParents, recordCreatedBy, setRecordLineage } = require('./record');
 const { wireNodeId, wireName } = require('./wire-identity');
+const { canonicalRecordV2_0 } = require('./core/record-canonical');
 const { ATTEST_FRAME, fromWireAttestation, fromWireCheckpoint, fromWireWitness, fromWireNodeStats } = require('./core/attestation');
 
 /**
@@ -35,6 +36,8 @@ const PAYLOAD_SCHEMA = 'https://sym.bot/schema/payload-v1.json';
 
 /** Entry members this node writes about an admission, which a frame must never supply. */
 const ENTRY_ANNOTATIONS = Object.freeze(['admission', 'tether', 'provenance', 'collapsed', 'svaf']);
+/** What this node says about a delivery's provenance (mesh-channel 0.11.0): never a frame's to set. */
+const FACT_MEMBERS = Object.freeze(['verified', 'profile', 'verification', 'session', 'author', 'assertionId', 'inboxId', 'inboxSeq', 'remixed']);
 
 // Receive-path dedup window (MMP §4.2 O2 — rejoin-without-replay convergence).
 // A CMB whose content-hash key we have already processed within this window is
@@ -98,6 +101,24 @@ function deepFreeze(o) {
   return o;
 }
 
+/** A directed record older than this by its signed timestamp is refused as a replay (finding G). */
+/**
+ * New records one session has evaluated, at most: a burst, then a rate a second (security review D).
+ * A busy room's peer sends a few a second; one record costs the SVAF encoder tens of milliseconds.
+ */
+const RECORDS_PER_SECOND = 8;
+const RECORDS_BURST = 32;
+/** cmb-fetch serving bounds per session (security review D, fetch-amp). */
+const FETCH_SERVE_PER_SECOND = 2;
+const FETCH_SERVE_BURST = 8;
+const FETCH_REPEAT_MS = 60_000;
+const FETCH_PENDING_MAX = 2 * 1024 * 1024;
+/** An XMesh insight synthesis is minted at most this often (security review). */
+const SYNTHESIS_MIN_MS = 10_000;
+const DIRECTED_WINDOW_MS = 24 * 60 * 60 * 1000;
+/** Assertion identities the host hook has fired for, at most. */
+const HOOK_SEEN_MAX = 100_000;
+
 /** The most keys one cmb-fetch may name (design D1). */
 const MAX_FETCH_KEYS = 32;
 const AUDIENCE_REPORT_MS = 60_000;
@@ -128,6 +149,7 @@ class FrameHandler {
     this._doorSaid = new Map();    // `${connection}|${reason}` -> { at, more }: a frame the door refused, the same way
     this._longPeerInfoSaid = new Map(); // peerId -> when an over-long peer-info from it was last said
     this._audienceSaid = new Map(); // `${peerId}|${reason}` -> { at, more }: a refused audience, the same way
+    this._hookSeen = new Map();     // assertionId -> when the verified-record hook fired for it (finding G)
     // THE ADMISSION SEAM (sym-core split). Frame routing is open; the engine that judges an
     // inbound block is injectable. Stock nodes run the open §9.2 baseline; a consumer may
     // substitute its own engine with the same call contract. The post-admission observer is a
@@ -223,11 +245,32 @@ class FrameHandler {
    * chance to be delivered. Idempotent and no-op when the key is absent.
    * @private
    */
+  /** @private Take one of `session`'s record tokens. @returns {boolean} */
+  _recordBudget(session) {
+    const now = Date.now();
+    const b = session._recordBucket || (session._recordBucket = { tokens: RECORDS_BURST, at: now });
+    b.tokens = Math.min(RECORDS_BURST, b.tokens + ((now - b.at) * RECORDS_PER_SECOND) / 1000);
+    b.at = now;
+    if (b.tokens < 1) return false;
+    b.tokens -= 1;
+    return true;
+  }
+
   _markCmbSurfaced(key) {
     if (!key) return;
     this._recordSeenCmbKey(key, Date.now());
   }
 
+  /**
+   * A verified record was admitted (stored): its author's binding protects history now and never
+   * expires (design D3 binding lifetime). Only an admission earns that (security review D).
+   * @private
+   */
+  _noteAdmitted(msg) {
+    if (!msg || msg._cmbVerified !== true || msg._legacyImport || !msg._verifiedAuthorNodeId) return;
+    if (typeof this._node._earnBinding === 'function') this._node._earnBinding(msg._verifiedAuthorNodeId, msg._authorKey);
+  }
+
   /**
    * Handle one AUTHENTICATED frame from a confirmed session (design D1). The session is the unit of
    * trust: `session.nodeId` and `session.identityKey` are what the §5.2 exchange proved, and every
@@ -261,6 +304,20 @@ class FrameHandler {
   }
 
   /** A frame type that rides only on sessions that selected an extension (§16.3). */
+  /**
+   * Whether the verified-record hook may fire for this assertion: once per assertion identity while it
+   * is remembered (HOOK_SEEN_MAX, the oldest let go first), and never for a record already stored under
+   * that identity. @private
+   */
+  _hookOnce(assertionId, key) {
+    if (typeof assertionId !== 'string' || !assertionId) return false;
+    if (this._hookSeen.has(assertionId)) return false;
+    this._hookSeen.set(assertionId, Date.now());
+    if (this._hookSeen.size > HOOK_SEEN_MAX) this._hookSeen.delete(this._hookSeen.keys().next().value);
+    const held = key && this._node._store && typeof this._node._store.get === 'function' ? this._node._store.get(key) : null;
+    return !(held && held.cmb && held.cmb.metadata && held.cmb.metadata.assertionId === assertionId);
+  }
+
   /** @private A sym-attest frame whose fields are not what the extension defines: refused, counted. */
   _attestMalformed(session, type) {
     if (typeof this._node._noteSessionRefusal === 'function') this._node._noteSessionRefusal(session, type, 'malformed');
@@ -299,14 +356,14 @@ class FrameHandler {
         if (this._extensionRefused(session, msg.type, 'sym-attest-v1')) return undefined;
         const att = fromWireAttestation(msg.attestation);
         if (!att) return this._attestMalformed(session, msg.type);
-        return this._handleAttestation(peerId, peerName, { attestation: att });
+        return this._handleAttestation(peerId, peerName, { attestation: att }, session);
       }
 
       case ATTEST_FRAME.checkpoint: {
         if (this._extensionRefused(session, msg.type, 'sym-attest-v1')) return undefined;
         const cp = fromWireCheckpoint(msg.checkpoint);
         if (!cp) return this._attestMalformed(session, msg.type);
-        this._node._ingestCheckpoint(cp, peerId);
+        this._node._ingestCheckpoint(cp, peerId, session);
         return undefined;
       }
 
@@ -314,7 +371,7 @@ class FrameHandler {
         if (this._extensionRefused(session, msg.type, 'sym-attest-v1')) return undefined;
         const w = fromWireWitness(msg.witness);
         if (!w) return this._attestMalformed(session, msg.type);
-        this._node._ingestWitness(w, peerId);
+        this._node._ingestWitness(w, peerId, session);
         return undefined;
       }
 
@@ -357,6 +414,10 @@ class FrameHandler {
         // The answer to this node's role-chain-fetch: ordinary signed grants, verified top-down.
         return this._node._onRoleChain(session, msg);
 
+      case 'role-digest':
+        // A peer's grant-store digest (anti-entropy, security review D): a different one starts a sync.
+        return this._node._onRoleDigest(session, msg);
+
       case 'xmesh-insight':
         if (this._extensionRefused(session, msg.type, 'xmesh-insight-v1')) return undefined;
         return this._handleXMeshInsight(peerId, peerName, msg);
@@ -430,9 +491,17 @@ class FrameHandler {
    * @private
    */
   _markProvenance(entry, msg) {
-    if (msg && msg._legacyImport) { entry.verified = false; entry.profile = 'legacy-import'; return entry; }
+    if (msg && msg._legacyImport) {
+      entry.verified = false; entry.profile = 'legacy-import'; entry.verification = null; entry.session = null; entry.assertionId = null;
+      return entry;
+    }
     entry.verified = !!(msg && msg._cmbVerified === true);
     entry.profile = 'core-secure';
+    // The facts travel on the entry itself (mesh-channel 0.11.0): the frozen verification facts the
+    // host hook gives, and the delivering session's, persisted with it, so no host joins anything.
+    entry.verification = (msg && msg._verification) || null;
+    entry.session = (msg && msg._sessionFacts) || null;
+    entry.assertionId = entry.verification ? entry.verification.assertionId : null;
     return entry;
   }
 
@@ -474,7 +543,7 @@ class FrameHandler {
     }, msg);
     this._node._log(`Directed CMB from ${peerName} (peer-bound, MMP §4.4.4) — SVAF ${decision || 'rejected'} for memory; surfacing to agent anyway (remixed:false)`);
     this._markCmbSurfaced(msg._incomingKey);
-    this._node.emit('cmb-accepted', entry);
+    this._node._emitAccepted(entry);
     return true;
   }
 
@@ -524,26 +593,42 @@ class FrameHandler {
     }
     if (!md.sig) return refuse('unsigned');
     if (typeof md.createdByNodeId !== 'string' || !md.createdByNodeId) return refuse('no-author-node-id');
+    // A record is its signed projection (review finding B): validated against the schema with no
+    // member outside it and every value typed before it is length-prefixed, then rebuilt from the
+    // signed members only. Everything after this point — verification, storage, the host hook,
+    // serving — sees that projection, never what the frame carried.
+    try {
+      msg.cmb = canonicalRecordV2_0(cmb);
+    } catch (err) {
+      if (err && err.code === 'ERECORDSHAPE') return refuse('malformed-record', err.reason);
+      throw err;
+    }
     const authorKey = this._node._identityKey(md.createdByNodeId);
     if (!authorKey) {
       this._node.emit('metric', { type: 'cmb-author-unresolvable', from: peerName, author: md.createdByNodeId, key: k });
       return refuse('unresolvable-author', `no proven, pinned or vouched key for ${String(md.createdByNodeId).slice(0, 8)}`);
     }
-    const v = verifyCMB(cmb, authorKey);
-    if (!v.valid) return refuse('invalid', v.error || 'invalid');
+    const rec = msg.cmb;
+    const v = verifyCMB(rec, authorKey);
+    if (!v.valid) {
+      // A bad signature on a proven session is attributable: an honest peer sends and relays only
+      // records it verified (review finding D). The node is told, and closes the session.
+      if (v.error === 'bad-signature' && typeof this._node._penaliseForgery === 'function') this._node._penaliseForgery(this._sessionOf.get(msg), 'record');
+      return refuse('invalid', v.error || 'invalid');
+    }
     // A record that declares the v2.0 suite but is malformed for it has no preimage: assertionIdV2_0
     // throws. That is a mismatch to refuse, never an exception.
     let derivedId = null;
-    try { derivedId = assertionIdV2_0(cmb); } catch { /* not a well-formed v2.0 record */ }
-    if (!derivedId || md.assertionId !== derivedId) return refuse('assertion-id-mismatch');
+    try { derivedId = assertionIdV2_0(rec); } catch { /* not a well-formed v2.0 record */ }
+    if (!derivedId || rec.metadata.assertionId !== derivedId) return refuse('assertion-id-mismatch');
     msg._cmbVerified = true;
-    msg._verifiedAuthorNodeId = md.createdByNodeId;
+    msg._verifiedAuthorNodeId = rec.metadata.createdByNodeId;
     msg._authorKey = authorKey;
-    // A record verified under the author's binding: that binding protects history now, and never
-    // expires (design D3 binding lifetime).
-    if (this._node._roster && typeof this._node._roster.noteVerified === 'function') this._node._roster.noteVerified(md.createdByNodeId);
+    // The binding earns durability only when this record is ADMITTED (security review D,
+    // binding-squat): a record refused for its room or audience, or by SVAF, protects no history.
+    // See _noteAdmitted.
     // Verified is not addressed here: the audience the author signed is checked next (§8.8.5 step 7).
-    return this._audienceRefused(peerId, peerName, cmb, true);
+    return this._audienceRefused(peerId, peerName, rec, true);
   }
 
   /**
@@ -575,6 +660,22 @@ class FrameHandler {
     const cmb = msg.cmb;
     const pinned = msg._legacyPinnedKey;
     const k = recordKey(cmb);
+    // Only records the routed node itself authored (security review E): its pinned key signing a
+    // record that names another author is not that author's record.
+    // A legacy route carries the 0.13 suites only (mesh-channel review): a v2.0-suite record belongs on
+    // a Core Secure session, where its assertion identity means something.
+    if (cmb && cmb.metadata && cmb.metadata.signatureSuite === 'mmp-sig-v2.0') {
+      this._node.emit('metric', { type: 'legacy-import-refused', from: peerName, key: k, reason: 'v2.0-suite-on-legacy-route' });
+      return true;
+    }
+    // A 0.13 record (mmp-sig-v2) names no author nodeId: its author is the key that signed it, the
+    // route's pinned one. A record that does name one must name the routed node.
+    const author = cmb && cmb.metadata ? cmb.metadata.createdByNodeId : undefined;
+    if (!msg._legacyRoutedNodeId || (author !== undefined && author !== msg._legacyRoutedNodeId)) {
+      this._node._log(`[legacy-import] CMB ${String(k || '').slice(0, 16)} from ${peerName} refused — it names an author other than the routed node`);
+      this._node.emit('metric', { type: 'legacy-import-refused', from: peerName, key: k, reason: 'not-the-routed-author' });
+      return true;
+    }
     const v = pinned ? verifyCMB(cmb, pinned) : { valid: false, error: 'no-pinned-key' };
     if (!v.valid) {
       this._node._log(`[legacy-import] CMB ${String(k || '').slice(0, 16)} from ${peerName} refused — it does not verify against the route's pinned key (${v.error || 'invalid'})`);
@@ -582,7 +683,10 @@ class FrameHandler {
       return true;
     }
     msg._cmbVerified = false;          // quarantined: never verified, whatever its signature
-    if (cmb.metadata && Object.prototype.hasOwnProperty.call(cmb.metadata, 'assertionId') && cmb.metadata.signatureSuite !== 'mmp-sig-v2.0') delete cmb.metadata.assertionId;
+    // A record's assertion identity is never passed on from a Legacy Import session as if it were
+    // authenticated (mesh-channel review): a host joining it to a verified record's facts would be
+    // told a quarantined record is that one.
+    if (cmb.metadata && Object.prototype.hasOwnProperty.call(cmb.metadata, 'assertionId')) delete cmb.metadata.assertionId;
     return this._audienceRefused(peerId, peerName, cmb, false);
   }
 
@@ -637,6 +741,16 @@ class FrameHandler {
   _handleCmbFetch(peerId, peerName, msg, session) {
     if (!msg || typeof msg.reqId !== 'string' || !msg.reqId || msg.reqId.length > 128) return;
     if (!session || typeof session.send !== 'function') return;
+    // Bounded (security review D, fetch-amp): a request costs ~200 bytes and an answer up to a 1 MiB
+    // record, so fetches are rate-limited per session, a record is served at most once per session
+    // per FETCH_REPEAT_MS, and nothing is answered while the session's outbound bytes are over
+    // FETCH_PENDING_MAX (a peer that does not read its socket gets nothing more).
+    const now = Date.now();
+    const fb = session._fetchServe || (session._fetchServe = { tokens: FETCH_SERVE_BURST, at: now, served: new Map() });
+    fb.tokens = Math.min(FETCH_SERVE_BURST, fb.tokens + ((now - fb.at) * FETCH_SERVE_PER_SECOND) / 1000);
+    fb.at = now;
+    if (fb.tokens < 1) { this._node.emit('metric', { type: 'cmb-fetch-over-rate', from: peerName }); return; }
+    fb.tokens -= 1;
     const asked = Array.isArray(msg.keys) ? msg.keys.slice(0, MAX_FETCH_KEYS) : [msg.key];
     const returned = [];
     const missing = [];
@@ -646,9 +760,24 @@ class FrameHandler {
       if (typeof key !== 'string' || !key || key.length > 256 || seen.has(key)) continue;
       seen.add(key);
       const cmb = key.length <= 128 ? this._node._store.get(key)?.cmb : null;
-      const servable = !!(cmb && cmb.metadata && cmb.metadata.signatureSuite === 'mmp-sig-v2.0' && cmb.metadata.sig);
-      if (servable && session.send({ type: 'cmb', cmb: recordAsSigned(cmb) }) !== false) returned.push(key);
-      else missing.push(key);
+      // Served only to an audience its author signed (review finding A): a room-bound record, or one
+      // signed to the asking session's own node. A directed record for anyone else is `missing`, as
+      // if this node did not hold it.
+      const to = cmb && cmb.metadata ? cmb.metadata.to : undefined;
+      const servable = !!(cmb && cmb.metadata && cmb.metadata.signatureSuite === 'mmp-sig-v2.0' && cmb.metadata.sig)
+        && (to === null || to === undefined || to === session.nodeId);
+      const servedAt = fb.served.get(key);
+      const fresh = servedAt === undefined || now - servedAt >= FETCH_REPEAT_MS;
+      const room = typeof session.pendingBytes !== 'function' || session.pendingBytes() <= FETCH_PENDING_MAX;
+      if (servable && fresh && room && session.send({ type: 'cmb', cmb: recordAsSigned(cmb) }) !== false) {
+        returned.push(key);
+        fb.served.delete(key);
+        if (fb.served.size >= 256) fb.served.delete(fb.served.keys().next().value);
+        fb.served.set(key, now);
+      } else {
+        if (servable && (!fresh || !room)) this._node.emit('metric', { type: 'cmb-fetch-withheld', from: peerName, key, reason: fresh ? 'outbound-full' : 'served-recently' });
+        missing.push(key);
+      }
     }
     if (returned.length + missing.length === 0) return;
     session.send({ type: 'cmb-fetch-result', reqId: msg.reqId, returned, missing, timestamp: Date.now() });
@@ -695,7 +824,17 @@ class FrameHandler {
   _resolveFetched(peerId, peerName, msg, reqId) {
     const pending = this._node._cmbFetchPending?.get(reqId);
     if (!pending) return;
-    const cmb = msg.cmb;
+    let cmb = msg.cmb;
+    // A fetched v2.0 record is its signed projection too (security review B): validated strictly and
+    // rebuilt from its signed members before its address is checked or anyone is given it.
+    if (cmb && cmb.metadata && cmb.metadata.signatureSuite === 'mmp-sig-v2.0') {
+      try { cmb = canonicalRecordV2_0(cmb); } catch (err) {
+        if (!err || err.code !== 'ERECORDSHAPE') throw err;
+        this._node.emit('metric', { type: 'cmb-fetch-forged', from: peerName, key: pending.key, verdict: 'malformed', scheme: null });
+        pending.miss(peerId);
+        return;
+      }
+    }
     const served = cmb?.metadata?.key ?? cmb?.key;
     if (!cmb || served !== pending.key) { pending.miss(peerId); return; }
     const verdict = classifyAddress(cmb);
@@ -719,7 +858,9 @@ class FrameHandler {
     }
     if (session && session._anchorKeys && fk && session._anchorKeys.has(fk)) {
       session._anchorKeys.delete(fk);
-      msg._anchor = true;
+      // An anchor is the SENDER's own replayed context (security review): only a record the session's
+      // own node authored is marked one.
+      if (msg.cmb && msg.cmb.metadata && msg.cmb.metadata.createdByNodeId === session.nodeId) msg._anchor = true;
     }
     // The session rides beside the frame, never on it: entries are built from the frame and kept.
     if (session) this._sessionOf.set(msg, session);
@@ -753,45 +894,52 @@ class FrameHandler {
     for (const own of ENTRY_ANNOTATIONS) {
       if (Object.prototype.hasOwnProperty.call(msg, own)) delete msg[own];
     }
+    for (const own of FACT_MEMBERS) {
+      if (Object.prototype.hasOwnProperty.call(msg, own)) delete msg[own];
+    }
 
     // No size bound here beyond the frame the record arrived in. The record bounds are minting
     // rules (cmb-encoder): earlier releases minted larger categories and longer agent ids, and
     // refusing those would stop this node hearing such a peer at all.
 
-    // Derive content from CMB categories if not present on the frame
-    // (MMP Section 7: cmb frames carry structured categories, not necessarily a content string)
-    if (!msg.content && msg.cmb?.categories) {
-      const { renderContent } = require('./core');
-      msg.content = renderContent(msg.cmb);
-    }
-    if (!msg.content) return;
+    // A frame's own `content` is never read (review finding E): what an entry says is rendered from the
+    // record's categories, after they are verified, never from text the frame carried beside them.
+    if (Object.prototype.hasOwnProperty.call(msg, 'content')) delete msg.content;
 
     // §8.8.5 verification (design D4): a signed v2.0 record whose author key resolves by
     // createdByNodeId, signature, application, assertion identity and audience all valid — or it is
     // refused. On a Legacy Import session: verified against the route's pinned key, then quarantined.
+    // msg.cmb is the record's signed projection from here on (finding B).
     if (this._rejectOnBadSignature(peerId, peerName, msg)) return;
-
-    // THE HOST HOOK (design D1, review H9): a record that passed every check, with the proven facts
-    // of the session that delivered it. Hosts read this instead of reaching into the frame handler.
+    if (msg.cmb?.categories) {
+      const { renderContent } = require('./core');
+      msg.content = renderContent(msg.cmb);
+    }
+    if (!msg.content) return;
     const session = this._sessionOf.get(msg);
-    if (msg._cmbVerified === true && !msg._legacyImport && this._node.listenerCount('verified-record') > 0) {
+    if (msg._cmbVerified === true && !msg._legacyImport) {
       const md = msg.cmb.metadata;
-      const verification = Object.freeze({
+      msg._verification = Object.freeze({
         suite: md.signatureSuite,
         assertionId: md.assertionId,
         authorNodeId: md.createdByNodeId,
         authorName: md.createdBy,
         authorKey: msg._authorKey,
-        authorKeySource: this._node._roster ? (this._node._roster.source(md.createdByNodeId) || 'session') : null,
+        authorKeySource: typeof this._node._keySource === 'function' ? (this._node._keySource(md.createdByNodeId) || null) : null,
         audience: typeof md.to === 'string' && md.to ? 'directed' : 'room',
         room: md.room,
         to: md.to ?? null,
         relayed: md.createdByNodeId !== peerId,
         anchor: msg._anchor === true,
       });
+      msg._sessionFacts = this._node._sessionFacts(session);
+    }
+    const emitHook = () => {
+    if (msg._cmbVerified === true && !msg._legacyImport && this._node.listenerCount('verified-record') > 0) {
+      const verification = msg._verification;
       // The record is the host's own frozen copy: a listener can neither change what this node stores
       // and evaluates next, nor what the next listener sees.
-      const event = Object.freeze({ record: deepFreeze(structuredClone(msg.cmb)), session: this._node._sessionFacts(session), verification });
+      const event = Object.freeze({ record: deepFreeze(structuredClone(msg.cmb)), session: msg._sessionFacts, verification });
       if (typeof this._node._emitIsolated === 'function') {
         const why = (e) => { try { return (e && e.message) || String(e); } catch { return 'unprintable error'; } };
         this._node._emitIsolated('verified-record', event, String(recordKey(msg.cmb)).slice(0, 16), why, (m) => { try { this._node._log(m); } catch { /* */ } });
@@ -799,6 +947,7 @@ class FrameHandler {
         this._node.emit('verified-record', event);
       }
     }
+    };
 
     // Who wrote it, and who handed it to us. `name` is the author's record label (MMP §8.8.4:
     // a display label, not an identity). Every surfaced and stored entry carries this, so no
@@ -812,6 +961,8 @@ class FrameHandler {
       // The cryptographic author (§8.8.4): the signed createdByNodeId the signature verified against,
       // even when relayed. A quarantined Legacy Import record names no verified author.
       nodeId: msg._cmbVerified === true ? (msg._verifiedAuthorNodeId || null) : null,
+      // The key that verified it (public), so a host can compare it with the facts.
+      key: msg._cmbVerified === true ? (msg._authorKey || null) : null,
       via: { name: peerName, nodeId: peerId },
     };
 
@@ -890,6 +1041,14 @@ class FrameHandler {
     // last character, so `sig + '='` verifies as the same signature), never a carried assertionId,
     // which no signature covers, and not the signature bytes, which a hedged signer varies.
     const cognitionKey = recordKey(msg.cmb) || msg.key;
+    // A directed record is taken only within DIRECTED_WINDOW_MS of its SIGNED timestamp (finding G):
+    // its de-duplication marks are kept for that long, so one older than the window could only be a
+    // replay a flushed mark no longer catches. Refused, counted.
+    if (msg._directedToMe && verified && typeof signedTs === 'number' && now - signedTs > DIRECTED_WINDOW_MS) {
+      this._node.emit('metric', { type: 'cmb-directed-stale', from: peerName, key: cognitionKey, age: now - signedTs });
+      this._sayOnceAMinute(this._audienceSaid, `${peerId}|stale-directed`, (more) => `Directed CMB ${String(cognitionKey).slice(0, 16)} from ${peerName} refused — signed ${Math.round((now - signedTs) / 3600000)} h ago, older than the replay window${more}`);
+      return;
+    }
     const mark = msg._cmbVerified === true ? assertionMark(msg.cmb) : null;
     const incomingKey = cognitionKey && msg._directedToMe && mark
       ? `${cognitionKey}#${mark}`
@@ -915,6 +1074,21 @@ class FrameHandler {
     // it once the CMB has actually been delivered.
     msg._incomingKey = incomingKey || null;
 
+    // A session's new records are evaluated at most RECORDS_PER_SECOND (burst RECORDS_BURST): charged
+    // here, after the signature and the de-duplication and before SVAF encodes anything, which is
+    // most of what a record costs (security review D, record-flood). Past it the record is dropped
+    // unmarked, so a later copy is taken.
+    if (session && !this._recordBudget(session)) {
+      this._node.emit('metric', { type: 'cmb-over-budget', from: peerName, key: cognitionKey });
+      this._sayOnceAMinute(this._audienceSaid, `${peerId}|record-budget`, (more) => `CMBs from ${peerName} over its budget (${RECORDS_PER_SECOND}/s) — dropped unevaluated${more}`);
+      return;
+    }
+
+    // THE HOST HOOK (design D1, review H9; finding G): a record that passed every check, with the
+    // proven facts of the session that delivered it — raised ONCE per assertion identity, after the
+    // de-duplication above, never again for a copy (a replay by its author, a relay, a reconnect).
+    if (msg._cmbVerified === true && !msg._legacyImport && this._hookOnce(meta && meta.assertionId, cognitionKey)) emitHook();
+
     const app = meta && meta.application;
     // A payload (remember({ payload })) rides as the record's signed application section; it is given
     // back beside the record as `cmb.payload`, as earlier releases carried it.
@@ -977,7 +1151,7 @@ class FrameHandler {
       };
       this._node._log(`CLI-host: forwarding CMB from ${peerName} (no store): "${msg.content.slice(0, 50)}"`);
       this._markCmbSurfaced(msg._incomingKey);
-      this._node.emit('cmb-accepted', entry);
+      this._node._emitAccepted(this._markProvenance(entry, msg));
       return;
     }
 
@@ -1099,7 +1273,7 @@ class FrameHandler {
           stableThreshold: this._node._svafStableThreshold,
           guardedThreshold: this._node._svafGuardedThreshold,
         });
-        this._node._buildAdmissionAttestation(rejKey, 'rejected', rejVerdicts, 'neural', msg.cmb?.metadata?.assertionId);
+        this._node._buildAdmissionAttestation(rejKey, 'rejected', rejVerdicts, 'neural', msg.cmb?.metadata?.assertionId, { quarantined: msg._legacyImport === true });
       }
 
       // MMP Section 9.3: mood MUST still be delivered from rejected CMBs.
@@ -1108,7 +1282,7 @@ class FrameHandler {
       // when a non-neutral mood actually surfaces — a pure reject with neutral
       // mood surfaces nothing, so it is intentionally NOT recorded: B's memory
       // evolves, and the same CMB re-arriving later may then be admitted.)
-      this._extractAndDeliverMood(msg, peerName);
+      this._extractAndDeliverMood(msg, peerName, peerId);
       return;
     }
 
@@ -1155,7 +1329,7 @@ class FrameHandler {
         guardedThreshold: this._node._svafGuardedThreshold,
       });
       // `of` is the record's cognition key (never the directed mark this node dedups by).
-      const att = this._node._buildAdmissionAttestation(recordKey(msg.cmb) || incomingKey, decision, categoryVerdicts, 'neural', msg.cmb?.metadata?.assertionId);
+      const att = this._node._buildAdmissionAttestation(recordKey(msg.cmb) || incomingKey, decision, categoryVerdicts, 'neural', msg.cmb?.metadata?.assertionId, { quarantined: msg._legacyImport === true });
       // On the entry, beside the record: a two-section record has exactly two members (§8.8.1).
       if (att) fusedEntry.admission = att;
     }
@@ -1184,6 +1358,7 @@ class FrameHandler {
     }
 
     this._reencodeLocalStateAfterAdmit();
+    if (storedNeural) this._noteAdmitted(msg);
 
     // Feed to XMesh (Layer 6). See MMP v0.2.0 Section 12.
     if (this._node._xmesh) {
@@ -1277,14 +1452,14 @@ class FrameHandler {
       // event (omission-evidence). The Phase-A heuristic already produced the
       // per-category verdict; index it (no remix is stored on this path).
       const rejKey = recordKey(msg.cmb) || msg.key;
-      if (rejKey) this._node._buildAdmissionAttestation(rejKey, result.decision, result.categoryVerdicts, 'heuristic', msg.cmb?.metadata?.assertionId);
+      if (rejKey) this._node._buildAdmissionAttestation(rejKey, result.decision, result.categoryVerdicts, 'heuristic', msg.cmb?.metadata?.assertionId, { quarantined: msg._legacyImport === true });
 
       // MMP Section 9.3: mood MUST still be delivered from rejected CMBs.
       // (redundant signals also deliver mood — the affect may have changed)
       // Key recording happens inside _extractAndDeliverMood iff a non-neutral
       // mood actually surfaces; a neutral reject surfaces nothing and is left
       // re-evaluable as B's memory evolves.
-      this._extractAndDeliverMood(msg, peerName);
+      this._extractAndDeliverMood(msg, peerName, peerId);
       return;
     }
 
@@ -1293,7 +1468,7 @@ class FrameHandler {
     // persist it on the remix's store entry as the durable audit record.
     if (result.fusedEntry && result.fusedEntry.cmb) {
       const of = recordKey(msg.cmb) || msg.key;
-      const att = this._node._buildAdmissionAttestation(of, result.decision, result.categoryVerdicts, 'heuristic', msg.cmb?.metadata?.assertionId);
+      const att = this._node._buildAdmissionAttestation(of, result.decision, result.categoryVerdicts, 'heuristic', msg.cmb?.metadata?.assertionId, { quarantined: msg._legacyImport === true });
       // On the entry, beside the record: a two-section record has exactly two members (§8.8.1).
       if (att) result.fusedEntry.admission = att;
     }
@@ -1312,6 +1487,7 @@ class FrameHandler {
     }
 
     this._reencodeLocalStateAfterAdmit();
+    if (storedHeuristic) this._noteAdmitted(msg);
 
     // Feed to XMesh (Layer 6). See MMP v0.2.0 Section 12.
     if (this._node._xmesh) {
@@ -1496,30 +1672,36 @@ class FrameHandler {
    *
    * @private
    */
-  _extractAndDeliverMood(msg, peerName) {
+  _extractAndDeliverMood(msg, peerName, peerId = null) {
     const mood = msg.cmb?.categories?.mood;
     if (!mood) return;
 
     const moodText = mood.text || '';
     if (!moodText || moodText === 'neutral' || moodText === 'informational') return;
 
-    const valence = mood.valence ?? 0;
-    const arousal = mood.arousal ?? 0;
-
+    // The signed mood TEXT is what carries affect: valence and arousal are unsigned and dropped
+    // at ingress (§8.8.4, draft spec PR #34), so they are not delivered.
     // Non-neutral mood found in rejected CMB — deliver to application layer.
     // This is a genuine surface, so record the key for receive-path dedup: an
     // identical re-send (reconnect anchor replay) will converge rather than
     // re-deliver the same affect.
-    this._node._log(`Mood extracted from rejected CMB (${peerName}): "${moodText}" (v:${valence}, a:${arousal})`);
+    this._node._log(`Mood extracted from rejected CMB (${peerName}): "${moodText}"`);
     this._markCmbSurfaced(msg._incomingKey);
-    this._node.emit('mood-delivered', {
+    const md = msg.cmb?.metadata || {};
+    const verified = msg._cmbVerified === true;
+    this._node.emit('mood-delivered', Object.freeze({
       from: peerName,
       mood: moodText,
       drift: 0, // mood fast-coupling bypasses drift evaluation
       context: `extracted from rejected CMB`,
-      valence,
-      arousal,
-    });
+      // Which record, by whom, and who handed it over (mesh-channel 0.11.0): the author is the signed
+      // createdByNodeId only when the record verified; the deliverer is the session's proven peer.
+      key: recordKey(msg.cmb) || null,
+      assertionId: verified && typeof md.assertionId === 'string' ? md.assertionId : null,
+      authorNodeId: verified ? (msg._verifiedAuthorNodeId || null) : null,
+      deliveredBy: Object.freeze({ nodeId: peerId, name: peerName }),
+      verified,
+    }));
 
     // Feed mood to XMesh — affect influences cognitive state even from rejected peers
     if (this._node._xmesh) {
@@ -1528,8 +1710,6 @@ class FrameHandler {
         content: `mood: ${moodText}`,
         timestamp: Date.now(),
         type: 'mood',
-        valence,
-        arousal,
       });
     }
   }
@@ -1559,7 +1739,9 @@ class FrameHandler {
 
     if (drift <= this._node._moodThreshold) {
       this._node._log(`Mood from ${from}: "${msg.mood.slice(0, 50)}" → ACCEPTED (drift: ${drift.toFixed(3)}, threshold: ${this._node._moodThreshold})`);
-      this._node.emit('mood-delivered', { from, mood: msg.mood, drift, context: msg.context });
+      // A mood frame is the session peer's own word: the proven nodeId delivered it (no record, so no
+      // key, assertion or author signature).
+      this._node.emit('mood-delivered', Object.freeze({ from, mood: msg.mood, drift, context: msg.context, key: null, assertionId: null, authorNodeId: peerId, deliveredBy: Object.freeze({ nodeId: peerId, name: peerName }), verified: false }));
     } else {
       this._node._log(`Mood from ${from}: "${msg.mood.slice(0, 50)}" → IGNORED (drift: ${drift.toFixed(3)}, threshold: ${this._node._moodThreshold})`);
       this._node.emit('mood-rejected', { from, mood: msg.mood, drift });
@@ -1590,10 +1772,10 @@ class FrameHandler {
    * through SVAF. Invalid/forged → dropped + audit-logged.
    * @private
    */
-  _handleAttestation(peerId, peerName, msg) {
+  _handleAttestation(peerId, peerName, msg, session = null) {
     const att = msg && msg.attestation;
     if (!att) return;
-    const r = this._node._ingestAttestation(att, peerId, peerName);
+    const r = this._node._ingestAttestation(att, peerId, peerName, session);
     // A repeat, a copy past the per-CMB limit, and one past the peer's budget or with a signature not
     // spelled canonically (both said by the node, once per 10 s) are quiet here.
     if (r.ok || !r.reason || r.reason === 'duplicate' || r.reason === 'rate-limited' || r.reason === 'over-budget' || r.reason === 'non-canonical-signature') return;
@@ -1677,6 +1859,8 @@ class FrameHandler {
   _handleXMeshInsight(peerId, peerName, msg) {
     const insight = {
       from: wireName(msg.fromName, peerName),
+      // The proven nodeId of the session that delivered it (security review); `from` is a label.
+      fromNodeId: peerId,
       trajectory: msg.trajectory,
       patterns: msg.patterns,
       anomaly: msg.anomaly,
@@ -1689,13 +1873,21 @@ class FrameHandler {
     // 1. Emit event for agent-level handling
     this._node.emit('xmesh-insight', insight);
 
-    // 2. Synthesis loop: call delegate, share insight back to mesh
+    // 2. Synthesis loop: call delegate, share insight back to mesh. A synthesis integrates a peer's
+    // signal, so it is the remix path (§15.7: gated on new domain data), and it is paced: at most one
+    // every SYNTHESIS_MIN_MS, however many insights peers send (security review).
     if (this._node._synthesisDelegate) {
+      const now = Date.now();
+      if (now - (this._lastSynthesisAt || 0) < SYNTHESIS_MIN_MS) {
+        this._node.emit('metric', { type: 'xmesh-synthesis-paced', from: peerName });
+        return;
+      }
+      this._lastSynthesisAt = now;
       try {
         const synthesis = this._node._synthesisDelegate(insight);
         if (synthesis) {
-          this._node.remember(synthesis, { tags: ['xmesh-synthesis'] });
-          this._node._log(`Synthesis loop: shared domain insight back to mesh`);
+          const r = this._node.remix(synthesis, { tags: ['xmesh-synthesis'] });
+          if (r && !r.refused && !r.duplicate) this._node._log(`Synthesis loop: shared domain insight back to mesh`);
         }
       } catch (err) {
         // A record this node cannot sign is its key's failure, said by remember() already; naming the
diff --git a/lib/interior.js b/lib/interior.js
index ead7e505..ed5927b2 100644
--- a/lib/interior.js
+++ b/lib/interior.js
@@ -12,24 +12,49 @@
  *   - A submission carries a PER-MIND CAPABILITY: a random token the node issues when it starts a
  *     mind for one mission, revoked when that mind exits. A submission without a live capability is
  *     refused.
+ *   - THE CAPABILITY IS BOUND TO ITS CONNECTION (security review; mesh-channel 0.11.0): on the socket
+ *     it is bound to the first connection that presents it, and never accepted on another; when that
+ *     connection closes, the mind ends and the capability with it. It is not a bearer token another
+ *     local process can replay. (The alternative, a per-mind socket path, was not chosen: one socket
+ *     and a first-frame binding need no directory per mind and no path handed around.) The
+ *     in-process API (`submit`) is the host's own and takes the capability as given.
+ *   - Ending a mind over the socket takes its capability, never its mindId (which is logged).
  *   - The node's checks before it signs:
  *       audience — `to` must be in the mission's allowlist, or absent (the room);
  *       size     — at most 64 KiB of category text, at most 512 KiB of application data;
  *       rate     — per capability;
- *       intent   — the mission's declared kinds only;
+ *       intent   — the mission's declared kinds only, and the KIND IS SIGNED: it is the record's
+ *                  intent category (a submission whose intent says otherwise is refused);
  *       lineage  — no `parents` outside the node's store.
- *   - ONE MIND PER NODE at a time. A node busy with a mission queues the next (`queueMind`), and the
- *     runtime may offer it elsewhere; `startMind` on a busy node is refused (EMINDBUSY). A node with
- *     several concurrent minds would be several agents under one identity (§3.2), unless it is
- *     declared a gateway (§5.10).
+ *   - ONE MIND PER IDENTITY at a time, in this process (security review): two SymNode objects for one
+ *     nodeId share the one slot (another process is kept out by the identity lock). A node busy with
+ *     a mission queues the next (`queueMind`), and the runtime may offer it elsewhere; `startMind` on
+ *     a busy identity is refused (EMINDBUSY). A node with several concurrent minds would be several
+ *     agents under one identity (§3.2), unless it is declared a gateway (§5.10).
  *
  * This supersedes the 2026-08-02 Q1a fallback (a scoped signing grant to a worker).
  *
- * Socket protocol: newline-delimited JSON on a Unix domain socket (`<node dir>/interior.sock`,
- * 0600; a named pipe on Windows). Each request carries an `id`, echoed in its reply:
+ * Socket protocol: newline-delimited JSON on a Unix domain socket in a 0700 directory this node made
+ * (`<node dir>/interior/interior.sock`, or a fresh directory under the OS temp dir when that path is
+ * too long for a socket address), the socket itself 0600. Each request carries an `id`, echoed in its
+ * reply, and the capability; the first request binds the capability to the connection:
  *   → { id, type: 'submit', capability, kind, categories, to?, parents?, payload? }
  *   ← { id, type: 'submitted', key, assertionId }  |  { id, type: 'refused', reason }
  *   → { id, type: 'end', capability }               ← { id, type: 'ended' }
+ *   → { id, type: 'mission', capability }           ← { id, type: 'mission', mindId, missionId, kinds,
+ *                                                       allowTo, ratePerMinute, nodeId, name, room }
+ *   → { id, type: 'deliveries', capability, after?, limit?, peek? }
+ *                                                   ← { id, type: 'deliveries', items, cursor, remaining }
+ *   → { id, type: 'subscribe', capability }         ← { id, type: 'subscribed' }, then unsolicited
+ *                                                       { type: 'delivery', item } lines
+ *   → { id, type: 'ack', capability, delivery }     ← { id, type: 'acked' }
+ *   → { id, type: 'recall', capability, query, limit? } ← { id, type: 'recall', items }
+ * A delivery item is { seq, id, kind: 'directed'|'broadcast', record, verification, session,
+ * remixed, receivedAt }: only Core Secure deliveries that verified — a record signed to this node, or
+ * a room broadcast it admitted — never a quarantined one.
+ *
+ * Windows: a named pipe takes the default DACL Node gives it, which this module cannot narrow, so
+ * `listen` refuses on Windows unless the host passes `{ allowDefaultPipeAcl: true }` (security review).
  *
  * @copyright 2026 SYM.BOT. Apache 2.0 License.
  */
@@ -39,29 +64,49 @@ const net = require('net');
 const path = require('path');
 const crypto = require('crypto');
 const { CAT7_CATEGORIES } = require('./core');
+const { signedProjection } = require('./core/record-canonical');
+const recordOf = (cmb) => { try { return signedProjection(cmb); } catch { return null; } };
 const { nestedTooDeep } = require('./core/json-depth');
 
 const MAX_CATEGORY_TEXT = 64 * 1024;
 const MAX_APPLICATION = 512 * 1024;
 const DEFAULT_RATE_PER_MINUTE = 60;
 const MAX_REQUEST_BYTES = 1024 * 1024;
+const MAX_DELIVERIES = 200;
+const MAX_RECALL = 100;
+
+/** The mind running for each identity in this process: nodeId -> the Interior holding it. */
+const MINDS = new Map();
 
 /**
- * Where the interior socket listens: `<node dir>/interior.sock`, unless that path is longer than a
- * Unix socket address can hold (104 bytes on macOS, 108 on Linux — a longer one is silently
- * truncated), in which case a short path in a per-user 0700 directory under the OS temp dir. A named
- * pipe on Windows.
+ * A directory this process owns and only its user can enter: made 0700 if absent, and refused if it
+ * is a symlink, is not a directory, is owned by another user, or is open to anyone else (security
+ * review: the tmp fallback used to follow a symlink another user planted).
+ */
+function ownedPrivateDir(dir) {
+  try { fs.mkdirSync(dir, { mode: 0o700 }); } catch (e) { if (e.code !== 'EEXIST') throw e; }
+  const st = fs.lstatSync(dir);
+  if (st.isSymbolicLink() || !st.isDirectory()) throw Object.assign(new Error(`interior: ${dir} is not a directory of this node's`), { code: 'EINTERIORDIR' });
+  if (typeof process.getuid === 'function' && st.uid !== process.getuid()) throw Object.assign(new Error(`interior: ${dir} is owned by another user`), { code: 'EINTERIORDIR' });
+  if ((st.mode & 0o077) !== 0) fs.chmodSync(dir, 0o700);
+  return dir;
+}
+
+/**
+ * Where the interior socket listens: `<node dir>/interior/interior.sock`, in a 0700 directory, unless
+ * that path is longer than a Unix socket address can hold (104 bytes on macOS, 108 on Linux — a
+ * longer one is silently truncated), in which case a FRESH directory under the OS temp dir
+ * (mkdtemp: random, made by this process, 0700) is used and removed at close. A named pipe on Windows.
+ * @returns {{ path: string, tmpDir: string|null }}
  */
 function defaultSocketPath(node) {
-  if (process.platform === 'win32') return `\\\\.\\pipe\\sym-interior-${node.nodeId}`;
-  const inDir = path.join(node._dir, 'interior.sock');
-  if (Buffer.byteLength(inDir, 'utf8') <= 100) return inDir;
-  const uid = typeof process.getuid === 'function' ? process.getuid() : 'u';
-  const dir = path.join(require('os').tmpdir(), `sym-interior-${uid}`);
-  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
-  try { fs.chmodSync(dir, 0o700); } catch { /* best effort */ }
-  const short = crypto.createHash('sha256').update(node.nodeId).digest('hex').slice(0, 16);
-  return path.join(dir, `${short}.sock`);
+  if (process.platform === 'win32') return { path: `\\\\.\\pipe\\sym-interior-${node.nodeId}`, tmpDir: null };
+  const dir = path.join(node._dir, 'interior');
+  const inDir = path.join(dir, 'interior.sock');
+  if (Buffer.byteLength(inDir, 'utf8') <= 100) { ownedPrivateDir(dir); return { path: inDir, tmpDir: null }; }
+  const tmpDir = fs.mkdtempSync(path.join(require('os').tmpdir(), 'sym-interior-'));
+  ownedPrivateDir(tmpDir);
+  return { path: path.join(tmpDir, 's.sock'), tmpDir };
 }
 
 class Interior {
@@ -72,7 +117,10 @@ class Interior {
     this._server = null;
     this._socketPath = null;
     this._clients = new Set();   // open interior connections, ended with the node
+    this._subscribers = new Set(); // connections subscribed to deliveries
+    this._tmpDir = null;
     this._stats = { submitted: 0, refused: 0, refusedByReason: {} };
+    this._onDelivery = (entry) => this._pushDelivery(entry);
   }
 
   /** Whether a mind is running now. */
@@ -104,8 +152,8 @@ class Interior {
    * @returns {{ mindId: string, capability: string, socketPath: string|null }}
    */
   startMind(mission) {
-    if (this._mind) {
-      const e = new Error('interior: this node is busy with a mission (one mind per node); queue it or offer it elsewhere');
+    if (this._mind || this._identityBusy()) {
+      const e = new Error('interior: this identity is busy with a mission (one mind per identity); queue it or offer it elsewhere');
       e.code = 'EMINDBUSY';
       throw e;
     }
@@ -115,14 +163,21 @@ class Interior {
   /** Queue a mission behind the running one; resolves with its capability when it starts. */
   queueMind(mission) {
     const m = this._mission(mission);
-    if (!this._mind) return Promise.resolve(this._start(m));
+    if (!this._mind && !this._identityBusy()) return Promise.resolve(this._start(m));
     return new Promise((resolve, reject) => this._queue.push({ mission: m, resolve, reject }));
   }
 
+  /** @private Whether another Interior in this process holds this identity's mind. */
+  _identityBusy() {
+    const holder = MINDS.get(this._node.nodeId);
+    return !!(holder && holder !== this && holder._mind);
+  }
+
   _start(mission) {
     const capability = crypto.randomBytes(32).toString('base64url');
     const mindId = `mind-${crypto.randomBytes(6).toString('hex')}`;
-    this._mind = { mindId, capability, mission, startedAt: Date.now(), bucket: { tokens: mission.ratePerMinute, at: Date.now() } };
+    MINDS.set(this._node.nodeId, this);
+    this._mind = { mindId, capability, mission, startedAt: Date.now(), bucket: { tokens: mission.ratePerMinute, at: Date.now() }, conn: null };
     this._node._log(`Interior: mind ${mindId} started for mission ${mission.id} (kinds ${[...mission.kinds].join(', ')})`);
     return { mindId, capability, socketPath: this._socketPath };
   }
@@ -132,11 +187,19 @@ class Interior {
     const m = this._mind;
     if (!m) return false;
     if (capabilityOrMindId !== m.mindId && !this._capabilityIs(capabilityOrMindId)) return false;
+    this._end(m);
+    return true;
+  }
+
+  /** @private End mind `m`: its capability is revoked, its connection's subscription with it. */
+  _end(m) {
+    if (this._mind !== m) return;
     this._mind = null;
+    if (MINDS.get(this._node.nodeId) === this) MINDS.delete(this._node.nodeId);
+    if (m.conn) this._subscribers.delete(m.conn);
     this._node._log(`Interior: mind ${m.mindId} ended; its capability is revoked`);
     const next = this._queue.shift();
     if (next) next.resolve(this._start(next.mission));
-    return true;
   }
 
   _capabilityIs(cap) {
@@ -162,6 +225,8 @@ class Interior {
     if (!this._capabilityIs(capability)) return this._refuse('no-live-capability');
     if (!sub || typeof sub !== 'object') return this._refuse('malformed');
     if (typeof sub.kind !== 'string' || !m.mission.kinds.has(sub.kind)) return this._refuse('kind-not-declared');
+    // The kind is signed (security review): it is the record's intent, so what peers verify says what
+    // the mission declared. An intent saying something else is refused.
     const to = sub.to === undefined || sub.to === null ? null : sub.to;
     if (to !== null && (typeof to !== 'string' || !m.mission.allowTo.has(to))) return this._refuse('audience-not-allowed');
     const cats = sub.categories;
@@ -174,6 +239,8 @@ class Interior {
       text += Buffer.byteLength(t, 'utf8');
     }
     if (text > MAX_CATEGORY_TEXT) return this._refuse('categories-too-large');
+    const intent = cats.intent === undefined ? undefined : (typeof cats.intent === 'string' ? cats.intent : (cats.intent && cats.intent.text));
+    if (intent !== undefined && intent !== sub.kind) return this._refuse('intent-is-not-the-kind');
     if (sub.payload !== undefined && Buffer.byteLength(JSON.stringify(sub.payload), 'utf8') > MAX_APPLICATION) return this._refuse('application-too-large');
     const parents = Array.isArray(sub.parents) ? sub.parents : [];
     for (const k of parents) {
@@ -187,13 +254,14 @@ class Interior {
     b.tokens -= 1;
     let entry;
     try {
-      entry = this._node.remember(cats, { to: to || undefined, parents: parents.map((key) => ({ key })), payload: sub.payload });
+      entry = this._node.remember({ ...cats, intent: sub.kind }, { to: to || undefined, parents: parents.map((key) => ({ key })), payload: sub.payload });
     } catch (err) {
       return this._refuse(err && err.code ? err.code : 'emit-failed');
     }
     if (!entry) return this._refuse('not-minted');
+    if (entry.duplicate && !entry.cmb) return { ok: true, key: entry.key, duplicate: true };
     this._stats.submitted++;
-    return { ok: true, key: entry.key, assertionId: entry.cmb?.metadata?.assertionId ?? null };
+    return { ok: true, key: entry.key, assertionId: entry.cmb?.metadata?.assertionId ?? null, ...(entry.duplicate ? { duplicate: true } : {}) };
   }
 
   /**
@@ -201,13 +269,23 @@ class Interior {
    * live capability.
    * @returns {Promise<string>} the socket path
    */
-  listen(socketPath) {
+  listen(socketPath, opts = {}) {
     if (this._server) return Promise.resolve(this._socketPath);
-    const p = socketPath || defaultSocketPath(this._node);
-    if (process.platform !== 'win32') { try { fs.unlinkSync(p); } catch { /* none */ } }
+    if (process.platform === 'win32' && !opts.allowDefaultPipeAcl) {
+      return Promise.reject(Object.assign(new Error('interior: on Windows the pipe takes a default DACL this module cannot narrow; pass { allowDefaultPipeAcl: true } to listen anyway'), { code: 'EINTERIORACL' }));
+    }
+    let p = socketPath;
+    if (!p) { const d = defaultSocketPath(this._node); p = d.path; this._tmpDir = d.tmpDir; }
+    else if (process.platform !== 'win32') ownedPrivateDir(path.dirname(p));
+    if (process.platform !== 'win32') {
+      try { const st = fs.lstatSync(p); if (st.isSocket()) fs.unlinkSync(p); else return Promise.reject(Object.assign(new Error(`interior: ${p} exists and is not a socket`), { code: 'EINTERIORDIR' })); } catch (e) { if (e.code !== 'ENOENT') return Promise.reject(e); }
+    }
     this._server = net.createServer((sock) => this._serve(sock));
+    this._node.on('cmb-accepted', this._onDelivery);
     return new Promise((resolve, reject) => {
       this._server.once('error', reject);
+      // The socket is made in a directory only this user can enter, set so before listen (security
+      // review), and is itself 0600 once it exists.
       this._server.listen(p, () => {
         if (process.platform !== 'win32') { try { fs.chmodSync(p, 0o600); } catch { /* best effort */ } }
         this._socketPath = p;
@@ -216,10 +294,88 @@ class Interior {
     });
   }
 
+  /** @private The mind's capability on this connection: bound to the first that presents it. */
+  _authorise(sock, capability) {
+    const m = this._mind;
+    if (!this._capabilityIs(capability)) return null;
+    if (m.conn === null) {
+      m.conn = sock;
+      // The connection that holds the capability ending ends the mind (and revokes the capability).
+      sock.once('close', () => this._end(m));
+      return m;
+    }
+    return m.conn === sock ? m : null;
+  }
+
+  /** @private One delivery item, or null when it is not one a mind is given. */
+  _item(e) {
+    if (!e || e.verified !== true || e.profile !== 'core-secure' || !e.record) return null;
+    // The inbox entry with its provenance (mesh-channel DESIGN-0.11.0 D2) and its id.
+    return {
+      seq: e.seq, id: e.id, kind: e.directed ? 'directed' : 'broadcast', record: e.record,
+      verified: true, profile: e.profile, assertionId: e.assertionId || null, verification: e.verification || null,
+      session: e.session || null, author: e.author || null, remixed: e.remixed === true, receivedAt: e.receivedAt,
+    };
+  }
+
+  /** @private A delivery the node just surfaced, to the subscribed mind connection. */
+  _pushDelivery(entry) {
+    if (!this._subscribers.size || !entry || !entry.inboxId) return;
+    const it = this._item(this._node.inboxGet(entry.inboxId));
+    if (!it) return;
+    for (const c of this._subscribers) { try { c.write(JSON.stringify({ type: 'delivery', item: it }) + '\n'); } catch { /* the connection is going */ } }
+  }
+
+  _request(sock, req, id) {
+    const type = req && req.type;
+    const m = this._authorise(sock, req && req.capability);
+    if (!m) return { id, type: 'refused', reason: this._mind && this._capabilityIs(req && req.capability) ? 'capability-bound-to-another-connection' : 'no-live-capability' };
+    switch (type) {
+      case 'submit': {
+        const r = this.submit(req.capability, req);
+        return r.ok ? { id, type: 'submitted', key: r.key, assertionId: r.assertionId ?? null, ...(r.duplicate ? { duplicate: true } : {}) } : { id, type: 'refused', reason: r.reason };
+      }
+      case 'end':
+        this._end(m);
+        return { id, type: 'ended' };
+      case 'mission':
+        return { id, type: 'mission', mindId: m.mindId, missionId: m.mission.id, kinds: [...m.mission.kinds], allowTo: [...m.mission.allowTo], ratePerMinute: m.mission.ratePerMinute, nodeId: this._node.nodeId, name: this._node.name, room: this._node._room };
+      case 'deliveries': {
+        const limit = Number.isSafeInteger(req.limit) && req.limit > 0 ? Math.min(req.limit, MAX_DELIVERIES) : 50;
+        const r = this._node.inbox({ limit, peek: req.peek === true, ...(Number.isSafeInteger(req.after) ? { since: req.after } : {}) });
+        return { id, type: 'deliveries', items: r.messages.map((e) => this._item(e)).filter(Boolean), cursor: r.cursor, remaining: r.remaining };
+      }
+      case 'subscribe':
+        this._subscribers.add(sock);
+        sock.once('close', () => this._subscribers.delete(sock));
+        return { id, type: 'subscribed' };
+      case 'ack':
+        if (typeof req.delivery !== 'string') return { id, type: 'refused', reason: 'malformed' };
+        this._node.inboxAck(req.delivery);
+        return { id, type: 'acked' };
+      case 'recall': {
+        if (typeof req.query !== 'string') return { id, type: 'refused', reason: 'malformed' };
+        const limit = Number.isSafeInteger(req.limit) && req.limit > 0 ? Math.min(req.limit, MAX_RECALL) : 20;
+        const own = this._node.nodeId;
+        const items = [];
+        for (const e of this._node.recall(req.query) || []) {
+          if (items.length >= limit) break;
+          const mine = !e.peerId;
+          if (!mine && e.verified !== true) continue; // a peer's record only when it verified
+          const md = e.cmb && e.cmb.metadata;
+          items.push({ key: e.key, record: e.cmb && md && md.signatureSuite === 'mmp-sig-v2.0' ? recordOf(e.cmb) : null, verified: mine ? true : e.verified === true, storedAt: e.storedAt ?? null, author: mine ? { name: this._node.name, nodeId: own } : (e.author || null) });
+        }
+        return { id, type: 'recall', items };
+      }
+      default:
+        return { id, type: 'refused', reason: 'unknown-request' };
+    }
+  }
+
   _serve(sock) {
     let buf = '';
     this._clients.add(sock);
-    sock.on('close', () => this._clients.delete(sock));
+    sock.on('close', () => { this._clients.delete(sock); this._subscribers.delete(sock); });
     sock.on('error', () => {});
     sock.on('data', (chunk) => {
       buf += chunk.toString('utf8');
@@ -233,14 +389,7 @@ class Interior {
         try { if (nestedTooDeep(line)) throw new Error('too deep'); req = JSON.parse(line); } catch { sock.write(JSON.stringify({ type: 'refused', reason: 'not-json' }) + '\n'); continue; }
         const id = req && (typeof req.id === 'string' || typeof req.id === 'number') ? req.id : null;
         let reply;
-        if (req && req.type === 'submit') {
-          const r = this.submit(req.capability, req);
-          reply = r.ok ? { id, type: 'submitted', key: r.key, assertionId: r.assertionId } : { id, type: 'refused', reason: r.reason };
-        } else if (req && req.type === 'end') {
-          reply = this.endMind(req.capability) ? { id, type: 'ended' } : { id, type: 'refused', reason: 'no-live-capability' };
-        } else {
-          reply = { id, type: 'refused', reason: 'unknown-request' };
-        }
+        try { reply = this._request(sock, req, id); } catch { reply = { id, type: 'refused', reason: 'failed' }; }
         sock.write(JSON.stringify(reply) + '\n');
       }
     });
@@ -249,13 +398,17 @@ class Interior {
   close() {
     // A stopped node ends every interior connection (its capabilities die with it); server.close()
     // alone would wait for them.
+    for (const q of this._queue.splice(0)) q.reject(new Error('interior: the node stopped'));
+    if (this._mind) this._end(this._mind);
     for (const c of this._clients) { try { c.destroy(); } catch { /* */ } }
     this._clients.clear();
+    this._subscribers.clear();
+    this._node.removeListener('cmb-accepted', this._onDelivery);
     if (this._server) { try { this._server.close(); } catch { /* */ } this._server = null; }
     if (this._socketPath && process.platform !== 'win32') { try { fs.unlinkSync(this._socketPath); } catch { /* */ } }
-    for (const q of this._queue.splice(0)) q.reject(new Error('interior: the node stopped'));
-    this._mind = null;
+    if (this._tmpDir) { try { fs.rmSync(this._tmpDir, { recursive: true, force: true }); } catch { /* */ } this._tmpDir = null; }
+    this._socketPath = null;
   }
 }
 
-module.exports = { Interior, MAX_CATEGORY_TEXT, MAX_APPLICATION };
+module.exports = { Interior, MAX_CATEGORY_TEXT, MAX_APPLICATION, ownedPrivateDir };
diff --git a/lib/invite.js b/lib/invite.js
index 5e68d812..bdc2bc62 100644
--- a/lib/invite.js
+++ b/lib/invite.js
@@ -26,7 +26,8 @@
 const { isIdentityKey } = require('./roster-keys');
 
 const INVITE_URL_RE = /^([a-z][a-z0-9-]+):\/\/(room|team)\/([^/?#]+)(?:\/([^?#]+))?(?:\?([^#]*))?$/i;
-const NODE_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+// The canonical lowercase form only (§3.1.1; security review B): an upper-case nodeId is refused.
+const NODE_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 
 /**
  * Build an invite URL.
@@ -77,7 +78,7 @@ function parseInvite(url) {
   let issuer = null;
   if (query.node !== undefined || query.key !== undefined) {
     if (!NODE_ID_RE.test(String(query.node || '')) || !isIdentityKey(query.key)) {
-      return { error: 'the invite names an issuer, but its node is not a UUID or its key is not a base64url Ed25519 public key' };
+      return { error: 'the invite names an issuer, but its node is not a lowercase UUID or its key is not a base64url Ed25519 public key' };
     }
     issuer = { nodeId: query.node, publicKey: query.key };
   }
diff --git a/lib/legacy-import.js b/lib/legacy-import.js
index 53fda233..e422a917 100644
--- a/lib/legacy-import.js
+++ b/lib/legacy-import.js
@@ -8,27 +8,35 @@
  * operator configures, never through negotiation failure, and never by accepting its hello:
  *
  *   - Off by default. A route names the peer's nodeId, its endpoint (`host:port` for LAN or the
- *     loopback, or `relay` for the relay channel) and its identity key — the full key or its
- *     `sha256:<hex>` fingerprint. The fingerprint is MANDATORY; the key is pinned at `pinned` for
- *     that nodeId (design D3's matrix applies: a different key already bound is a conflict).
+ *     loopback, or `relay` for the relay channel), its identity key — the full key or its
+ *     `sha256:<hex>` fingerprint — and its persistent 0.13 X25519 key (`e2eKey`, the `publicKey` of
+ *     the 0.13 node's e2e-keypair.json). Both are MANDATORY (security review E): the identity key is
+ *     pinned at `pinned` for that nodeId (design D3's matrix applies), and the X25519 key is what
+ *     this node encrypts to, so a hello presenting another X25519 key is refused.
  *   - This node always dials a route itself, and never accepts a legacy hello: the Core Secure
  *     listener refuses one at once. That covers both id orders (0.13 dials only when its own id is
  *     smaller on the loopback), and the profile is chosen by the route before any byte is read.
  *   - Over the relay, the route's session is this node sending a legacy `handshake` to the routed
- *     nodeId. Relay-auth is unproven (§4.4.1), so a squatter could answer as that nodeId: records
- *     are accepted only when their signature verifies against the pinned key, and only records the
- *     routed node itself signed.
+ *     nodeId. Relay-auth is unproven (§4.4.1) and a 0.13 hello proves nothing, so a squatter can
+ *     answer as that nodeId with its public keys. What it cannot do is read: this node encrypts to the
+ *     PINNED X25519 key, whose private half only the routed node holds. Records are accepted only
+ *     when their signature verifies against the pinned identity key, and only records the routed node
+ *     itself authored (createdByNodeId is the route's nodeId).
+ *   - A Legacy Import peer never passes a gated room's door (it cannot prove a room-join grant's key).
  *   - Connection-level frames from a legacy session (peer-info, wake-channel, mood, role grants…)
  *     are hints: none is stored.
  *   - What this node sends on a legacy session: its records as legacy `cmb` frames under the legacy
- *     E2E construction (X25519 + AES-256-GCM, from an ephemeral key per legacy session), so the
- *     relay never sees plaintext. Nothing else but ping/pong. `sym status` says plainly that the
- *     session uses legacy encryption, with no forward secrecy and no transcript proof.
+ *     E2E construction (X25519 + AES-256-GCM, this node's ephemeral key per legacy session against
+ *     the routed node's pinned persistent key). A relay or a squatter without the routed node's
+ *     X25519 private key cannot read them; anyone who later obtains that key can read what was
+ *     recorded (no forward secrecy on the routed side). Nothing else but ping/pong, which is also the
+ *     session's heartbeat. `sym status` says plainly that the session uses legacy encryption, with no
+ *     forward secrecy and no transcript proof.
  *   - Quarantine: everything received is stored with `verified: false` and `profile:
  *     'legacy-import'`; never given authority, never shown as verified, flagged on the channel.
- *   - The sticky floor is PERSISTED: it is the registry's proven binding (roster-keys.js `floor`).
- *     Once a nodeId has proven itself over Core Secure, its legacy route is refused until an
- *     operator resets the floor (`sym keys reset-floor <nodeId>`).
+ *   - The sticky floor is PERSISTED as its own fact in the key registry (roster-keys.js `floor`),
+ *     independent of the binding's lifetime. Once a routed nodeId has proven itself over Core Secure,
+ *     its legacy route is refused until an operator resets the floor (`sym keys reset-floor <nodeId>`).
  *   - The window: network Legacy Import is removed in sym 0.15.0; offline store import stays.
  *
  * @copyright 2026 SYM.BOT. Apache 2.0 License.
@@ -45,9 +53,27 @@ const { SEND_FAILURE } = require('./frame-parser');
 
 const HANDSHAKE_TIMEOUT_MS = 10_000;
 const REDIAL_MS = 15_000;
+/** The legacy session's heartbeat: a ping this often, and closed when nothing arrives for DEAD_MS. */
+const LEGACY_PING_MS = 15_000;
+const LEGACY_DEAD_MS = 45_000;
 const ROUTES_FILE = 'legacy-routes.json';
 const LEGACY_ENCRYPTION = 'legacy (X25519 + AES-256-GCM per connection; no forward secrecy, no transcript proof)';
-const isNodeId = (id) => typeof id === 'string' && id.length > 0 && id.length <= 256;
+const { isCanonicalNodeId } = require('./core/record-canonical');
+const isNodeId = (id) => isCanonicalNodeId(id);
+/** The X25519 SubjectPublicKeyInfo prefix (a 0.13 key travels as SPKI DER, base64). */
+const X25519_SPKI = Buffer.from('302a300506032b656e032100', 'hex');
+/**
+ * A 0.13 X25519 public key as its hello and e2e-keypair.json carry it — SPKI DER, base64 — or the raw
+ * 32 bytes, base64 or base64url. Returns the SPKI DER form (what the legacy construction derives
+ * from), or null.
+ */
+function x25519Key(k) {
+  if (typeof k !== 'string' || k.length > 128 || !/^[A-Za-z0-9+/_-]+=*$/.test(k)) return null;
+  const b = Buffer.from(k.replace(/-/g, '+').replace(/_/g, '/'), 'base64');
+  if (b.length === 32) return Buffer.concat([X25519_SPKI, b]);
+  if (b.length === 44 && b.subarray(0, 12).equals(X25519_SPKI)) return b;
+  return null;
+}
 
 /**
  * Check one configured route. Throws with what is wrong: a route without a key or a fingerprint is
@@ -56,7 +82,7 @@ const isNodeId = (id) => typeof id === 'string' && id.length > 0 && id.length <=
  */
 function checkRoute(r) {
   if (!r || typeof r !== 'object') throw new Error('legacy route: not an object');
-  if (!isNodeId(r.nodeId)) throw new Error('legacy route: nodeId is required');
+  if (!isNodeId(r.nodeId)) throw new Error('legacy route: nodeId is required, in canonical lowercase');
   const endpoint = typeof r.endpoint === 'string' ? r.endpoint.trim() : '';
   if (endpoint !== 'relay' && !/^[^\s:]+:\d{1,5}$/.test(endpoint)) throw new Error(`legacy route ${r.nodeId.slice(0, 8)}: endpoint must be host:port or 'relay'`);
   let key = null;
@@ -72,7 +98,9 @@ function checkRoute(r) {
     fingerprint = r.fingerprint;
   }
   if (!fingerprint) throw new Error(`legacy route ${r.nodeId.slice(0, 8)}: the identity key fingerprint is mandatory`);
-  return { nodeId: r.nodeId, endpoint, key, fingerprint, name: typeof r.name === 'string' ? r.name.slice(0, 64) : null };
+  const e2e = x25519Key(r.e2eKey);
+  if (!e2e) throw new Error(`legacy route ${r.nodeId.slice(0, 8)}: e2eKey (the 0.13 node's persistent X25519 public key, base64) is mandatory`);
+  return { nodeId: r.nodeId, endpoint, key, fingerprint, e2eKey: e2e.toString('base64'), name: typeof r.name === 'string' ? r.name.slice(0, 64) : null };
 }
 
 /**
@@ -145,6 +173,7 @@ class LegacySession extends EventEmitter {
       }
       msg._legacyImport = true;
       msg._legacyPinnedKey = this.identityKey;
+      msg._legacyRoutedNodeId = this.route.nodeId;
       this.emit('frame', msg, this);
     } catch (err) {
       this.close('error', err && err.message);
@@ -157,11 +186,23 @@ class LegacySession extends EventEmitter {
       this.close('fingerprint-mismatch', 'the hello\'s identity key is not the one the route pins');
       return;
     }
-    if (typeof h.e2ePublicKey === 'string' && h.e2ePublicKey) {
-      try { this._secret = e2eDeriveSharedSecret(this._e2e.privateKey, Buffer.from(h.e2ePublicKey, 'base64')); }
-      catch { this._secret = null; }
+    // The X25519 key this node encrypts to is the route's pinned one (security review E): a hello
+    // presenting another is someone who does not hold the routed node's key (a relay squatter).
+    const presented = x25519Key(h.e2ePublicKey);
+    if (!presented || !presented.equals(Buffer.from(this.route.e2eKey, 'base64'))) {
+      this.close('e2e-key-mismatch', 'the hello\'s X25519 key is not the one the route pins');
+      return;
     }
+    try { this._secret = e2eDeriveSharedSecret(this._e2e.privateKey, Buffer.from(this.route.e2eKey, 'base64')); }
+    catch { this.close('e2e-key-mismatch', 'no shared secret with the pinned X25519 key'); return; }
     clearTimeout(this._timer);
+    // The heartbeat (security review E): a ping every LEGACY_PING_MS, closed after LEGACY_DEAD_MS
+    // with nothing heard (a 0.13 node answers ping with pong).
+    this._beat = setInterval(() => {
+      if (Date.now() - this.lastSeen > LEGACY_DEAD_MS) { this.close('heartbeat-timeout'); return; }
+      this._wire({ type: 'ping' });
+    }, LEGACY_PING_MS);
+    if (this._beat.unref) this._beat.unref();
     this.nodeId = h.nodeId;
     this.name = typeof h.name === 'string' && h.name ? h.name.slice(0, 256) : (this.route.name || 'legacy');
     this.identityKey = h.publicKey;
@@ -180,8 +221,11 @@ class LegacySession extends EventEmitter {
     if (frame.type === 'ping' || frame.type === 'pong') return this._wire({ type: frame.type });
     if (frame.type !== 'cmb' || !frame.cmb || !frame.cmb.categories) return { ok: false, reason: 'not-sent-on-legacy' };
     if (!this._secret) return { ok: false, reason: 'no-legacy-secret' };
-    const { ciphertext, nonce } = encryptCategories(frame.cmb.categories, this._secret);
+    // The signed audience governs this send too (review finding A): a record signed to another node
+    // is never sent to the routed one.
     const to = frame.cmb.metadata && typeof frame.cmb.metadata.to === 'string' ? frame.cmb.metadata.to : null;
+    if (to && to !== this.nodeId) return { ok: false, reason: 'not-addressed' };
+    const { ciphertext, nonce } = encryptCategories(frame.cmb.categories, this._secret);
     return this._wire({ type: 'cmb', timestamp: frame.timestamp || Date.now(), cmb: { ...frame.cmb, categories: ciphertext, _e2e: { nonce } }, ...(to ? { to, directed: true } : {}) });
   }
 
@@ -198,6 +242,7 @@ class LegacySession extends EventEmitter {
     if (this.closed) return;
     const wasConfirmed = this.state === 'confirmed';
     clearTimeout(this._timer);
+    if (this._beat) { clearInterval(this._beat); this._beat = null; }
     this.state = 'closed';
     this._secret = null;
     if (this.kind !== 'relay') { try { this.transport.close(); } catch { /* gone */ } }
@@ -254,6 +299,17 @@ class LegacyImport {
     this._sessions.clear();
   }
 
+  /** The configured route for `nodeId`, or undefined. */
+  routeFor(nodeId) { return this._routes.get(nodeId); }
+
+  /** Whether this node's room is gated: a Legacy Import peer never passes its door (review E). */
+  _gated(route) {
+    const owners = this._node._roomOwners;
+    if (!owners || !owners.ownerOf(this._node._room)) return false;
+    this._refused.set(route.nodeId, `the room '${this._node._room}' is gated: a Legacy Import peer cannot prove a room-join grant's key`);
+    return true;
+  }
+
   /** Whether the floor (design D7) refuses `nodeId`'s route now. */
   _floored(route) {
     if (!this._node._roster.floor(route.nodeId)) return false;
@@ -262,7 +318,7 @@ class LegacyImport {
   }
 
   _dial(route) {
-    if (!this._node._running || this._sessions.has(route.nodeId) || this._floored(route)) return;
+    if (!this._node._running || this._sessions.has(route.nodeId) || this._floored(route) || this._gated(route)) return;
     const [host, portStr] = [route.endpoint.slice(0, route.endpoint.lastIndexOf(':')), route.endpoint.slice(route.endpoint.lastIndexOf(':') + 1)];
     const socket = net.createConnection({ host, port: Number(portStr) }, () => {
       socket.setTimeout(0);
@@ -307,6 +363,7 @@ class LegacyImport {
       if (!b.bound && b.reason === 'conflict') { session.close('key-conflict'); return; }
     }
     if (this._floored(route)) { session.close('floor'); return; }
+    if (this._gated(route)) { session.close('gated-room'); return; }
     const existing = node._peers.get(route.nodeId);
     if (existing && existing.transports.size && [...existing.transports.values()].some((t) => !t.legacy)) {
       session.close('core-secure-session-live');
@@ -323,7 +380,8 @@ class LegacyImport {
     node._log(`Legacy Import session with ${session.name} (${route.nodeId.slice(0, 8)}) over ${session.kind === 'relay' ? 'the relay' : route.endpoint}: ${LEGACY_ENCRYPTION}. Records from it are quarantined (verified: false).`);
     if (!existing) {
       node._metrics.peersJoined++;
-      node.emit('peer-joined', { id: route.nodeId, name: session.name, source: session.kind, profile: 'legacy-import' });
+      // Not `peer-joined`, which means a proven Core Secure session only (mesh-channel review).
+      node.emit('legacy-peer-joined', { id: route.nodeId, name: session.name, source: session.kind, profile: 'legacy-import', legacy: true });
     }
   }
 
@@ -338,20 +396,20 @@ class LegacyImport {
       if (peer.transports.size === 0) {
         node._peers.delete(nodeId);
         node._metrics.peersLeft++;
-        node.emit('peer-left', { id: nodeId, name: peer.name });
+        node.emit('legacy-peer-left', { id: nodeId, name: peer.name, legacy: true });
       }
     }
     if (info && !info.wasConfirmed && info.reason !== 'node-stopped') {
       this._refused.set(nodeId, `${info.reason}${info.detail ? `: ${info.detail}` : ''}`);
       node._log(`Legacy Import route ${nodeId.slice(0, 8)} not opened: ${info.reason}${info.detail ? ` (${info.detail})` : ''}`);
     }
-    if (info && info.reason !== 'node-stopped' && info.reason !== 'floor' && info.reason !== 'fingerprint-mismatch' && info.reason !== 'key-conflict') this._redial(session.route);
+    if (info && !['node-stopped', 'floor', 'fingerprint-mismatch', 'e2e-key-mismatch', 'key-conflict', 'gated-room'].includes(info.reason)) this._redial(session.route);
   }
 
   /** The relay names a routed node present: this node sends its legacy hello to it (it never waits). */
   relayPresent(nodeId) {
     const route = this._routes.get(nodeId);
-    if (!route || route.endpoint !== 'relay' || this._sessions.has(nodeId) || this._floored(route)) return;
+    if (!route || route.endpoint !== 'relay' || this._sessions.has(nodeId) || this._floored(route) || this._gated(route)) return;
     const session = this._open(route, 'relay', this._node._relay.transportFor(nodeId));
     session.start();
   }
@@ -369,7 +427,7 @@ class LegacyImport {
     if (!s) {
       // The route is chosen by configuration before any byte is read: this node opens the session
       // and sends its own hello, then takes the peer's frames on it.
-      if (this._floored(route)) return true;
+      if (this._floored(route) || this._gated(route)) return true;
       s = this._open(route, 'relay', this._node._relay.transportFor(from));
       s.start();
     }
diff --git a/lib/mesh-agent.js b/lib/mesh-agent.js
index 148cf20d..7a229daa 100644
--- a/lib/mesh-agent.js
+++ b/lib/mesh-agent.js
@@ -315,10 +315,11 @@ class MeshAgent {
       lineage: entry.lineage || recordLineage(entry.cmb) || null,
     };
 
-    const stored = this._remember(remixCategories, { parents: [parent], ...(meta ? { meta } : {}) });
+    // The remix path (§15.5/§15.7): gated on new domain data, unlike an agent's own remember().
+    const stored = this._remember(remixCategories, { parents: [parent], ...(meta ? { meta } : {}) }, { remix: true });
     if (this._signingHalted) return;
-    if (!stored) {
-      console.log(`[${this._name}] remix rejected by SDK`);
+    if (!stored || stored.refused || stored.duplicate) {
+      console.log(`[${this._name}] remix not minted by SDK${stored && stored.refused ? ` (${stored.refused})` : stored && stored.duplicate ? ' (duplicate)' : ''}`);
       return;
     }
 
@@ -333,9 +334,9 @@ class MeshAgent {
    * and observing, instead of an error per admitted record and a model call it can never use.
    * @private
    */
-  _remember(categories, opts) {
+  _remember(categories, opts, { remix = false } = {}) {
     try {
-      return this._node.remember(categories, opts);
+      return remix ? this._node.remix(categories, opts) : this._node.remember(categories, opts);
     } catch (err) {
       if (!err || err.code !== 'ESIGN') throw err;
       this._signingHalted = true;
@@ -391,8 +392,8 @@ class MeshAgent {
     // Original observation — no parents
     const stored = this._remember(categories, meta ? { meta } : undefined);
     if (this._signingHalted) return;
-    if (!stored) {
-      console.log(`[${this._name}] observation rejected (duplicate)`);
+    if (!stored || stored.duplicate) {
+      console.log(`[${this._name}] observation not minted (${stored ? 'duplicate' : 'store write failed'})`);
       return;
     }
 
diff --git a/lib/node.js b/lib/node.js
index bb35d63e..a6036d5d 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -28,8 +28,14 @@ const { nodeDirById, loadIdentity, acquireIdentityLock, log: logMsg } = require(
 const { assertTestSandbox } = require('./core/state-root');
 const { MemoryStore } = require('./memory-store');
 const { AttestationStore, chainHash, isPosition, isCanonicalSig } = require('./attestation-store');
-const { RoleGrantStore } = require('./role-grant-store');
-const { RosterKeyRegistry } = require('./roster-keys');
+const { RoleGrantStore, canonicalGrant, malformedGrant } = require('./role-grant-store');
+const { RosterKeyRegistry, keyFingerprint } = require('./roster-keys');
+const { signedProjection } = require('./core/record-canonical');
+/** A stored record's signed projection, or null for one that is not a v2.0 record. */
+const projectionOrNull = (cmb) => {
+  if (!cmb || !cmb.metadata || cmb.metadata.signatureSuite !== 'mmp-sig-v2.0') return null;
+  try { return signedProjection(cmb); } catch { return null; }
+};
 const { wireNodeId, wireName, wireKey } = require('./wire-identity');
 const { keepPeerState } = require('./peer-state');
 const { RoomOwnershipRegistry } = require('./room-ownership');
@@ -50,7 +56,7 @@ const { MMP_EMIT_V2 } = require('./emit-policy'); // the single reader-first fli
 const MAX_CLOCK_LEAD_MS = 60 * 1000;
 const { FrameHandler, MESSAGE_SCHEMA } = require('./frame-handler');
 const { TcpTransport } = require('./transport');
-const { PeerSession } = require('./session');
+const { PeerSession, IDENTITY_CONFLICT, UNKNOWN_SESSION } = require('./session');
 const { LegacyImport } = require('./legacy-import');
 const { EXT_CMB_ENCRYPTED_V2 } = require('./core/mmp-extensions');
 const ENGINE_VERSION = require('../package.json').version;
@@ -155,9 +161,15 @@ const CHECKPOINT_BURST = 128;
 const GOSSIP_REPORT_MS = 10000;
 /** Peers with a budget held at once; the least recently active goes first, in O(1). */
 const GOSSIP_MAX_PEERS = 4096;
+/** A peer that delivered a forged signature is not admitted again for this long (security review D). */
+const FORGERY_PENALTY_MS = 60_000;
 /** role-chain-fetch (design D3): records held per session while their chain is fetched, and for how long. */
 const CHAIN_HOLD_MAX = 64;
+/** ...and the bytes they hold, at most (security review D): a held record is its signed fields only. */
+const CHAIN_HOLD_BYTES = 64 * 1024;
 const CHAIN_FETCH_TIMEOUT_MS = 10_000;
+/** Anti-entropy (security review D): pages of a whole-store sync one session asks for, at most. */
+const CHAIN_SYNC_MAX_PAGES = 1024;
 /** Grantees one fetch may name, and grants one answer carries, at most. */
 const CHAIN_FETCH_MAX_GRANTEES = 16;
 const CHAIN_ANSWER_MAX = 64;
@@ -165,14 +177,45 @@ const CHAIN_ANSWER_MAX = 64;
 const CHAIN_SERVE_PER_SECOND = 4;
 const CHAIN_SERVE_BURST = 16;
 /**
- * The relay `error` code for "this node holds no session with you" (sym's; drafted for MMP spec PR
- * meshcognition-website#23, where an error only prompts a new handshake). 4400 is a session closing.
+ * MMP §7.2 error codes (lib/session.js): 1011 UNKNOWN_SESSION ("this node holds no session with you",
+ * draft spec PRs #23 and #31: it only prompts a new handshake), 1010 SESSION_CLOSED (sealed, a
+ * session closing), 1009 IDENTITY_CONFLICT (draft spec PR #21: a bound nodeId proving another key).
+ */
+const UNKNOWN_SESSION_CODE = UNKNOWN_SESSION;
+/** The frame types this node knows, for counting (anything else counts as 'other'). */
+const KNOWN_FRAME_TYPES = new Set(['cmb', 'cmb-encrypted', 'control-encrypted', 'client-hello', 'server-hello', 'client-finish',
+  'ping', 'pong', 'error', 'cmb-anchors', 'mood', 'wake-channel', 'peer-info', 'sym-attest-attestation', 'sym-attest-checkpoint',
+  'sym-attest-witness', 'sym-attest-node-stats', 'attestation', 'checkpoint', 'witness', 'node-stats', 'cmb-fetch', 'cmb-fetch-result',
+  'role-grant', 'role-revoke', 'role-chain-fetch', 'role-chain', 'role-digest', 'xmesh-insight', 'room-join', 'handshake',
+  'state-sync', 'message', 'session-confirmed', 'relay-auth', 'relay-peers', 'relay-peer-joined', 'relay-peer-left',
+  'relay-ping', 'relay-pong', 'relay-reauth', 'relay-error']);
+/** 1011 replies to relay froms this node holds no session with: a token bucket over all of them. */
+const UNKNOWN_SESSION_PER_SECOND = 2;
+const UNKNOWN_SESSION_BURST = 8;
+/** Peers that refused this node with 1009, not dialled again automatically (LAN or relay). */
+const IDENTITY_REFUSED_MAX = 1024;
+/**
+ * Relay handshakes in flight at once, at most (each holds a deadline and costs a key agreement), of
+ * which UNKNOWN candidates — a nodeId with no binding, no peer and no route, which anyone can mint
+ * and a relay can announce by the thousand — hold at most RELAY_UNKNOWN_MAX: the rest are reserved
+ * for configured, pinned and previously bound peers (security review D, announce-starve). An unknown
+ * candidate past its share waits in turn (fewest failures first, then the newest), and one that
+ * failed waits longer each time, up to RELAY_UNKNOWN_BACKOFF_MAX_MS.
  */
-const UNKNOWN_SESSION_CODE = 4404;
-/** MMP §7.2 error code for a bound nodeId proving a different key (draft spec PR #21). */
-const IDENTITY_CONFLICT = 1009;
-/** Relay handshakes in flight at once, at most (each holds a 10 s deadline and costs a key agreement). */
 const RELAY_HANDSHAKES_MAX = 256;
+const RELAY_UNKNOWN_MAX = 32;
+const RELAY_UNKNOWN_BACKOFF_MAX_MS = 10 * 60_000;
+/** One relay `from`'s client-hellos: a token bucket (security review D, relay-orphan). */
+const RELAY_HELLO_PER_SECOND = 1;
+const RELAY_HELLO_BURST = 4;
+/**
+ * Inbound LAN handshakes in flight (authenticating sessions) at most, in all and per remote host;
+ * past either the oldest is closed (security review D, hello-cost).
+ */
+const LAN_HANDSHAKES_MAX = 128;
+const LAN_HANDSHAKES_PER_HOST = 8;
+/** A LAN peer whose dial or handshake failed is dialled again after 15 s, doubling to this at most. */
+const LAN_BACKOFF_MAX_MS = 10 * 60_000;
 
 /**
  * Take a token from `key`'s bucket in `buckets`: a Map ordered least recently used first and held to
@@ -459,7 +502,9 @@ class SymNode extends EventEmitter {
     this._sessions = new Set();
     this._offeredExtensions = [...(opts.extensions || OFFERED_EXTENSIONS)];
     this._implementation = { name: 'sym', version: ENGINE_VERSION };
-    this._handshakeTimeoutMs = opts.handshakeTimeoutMs || 10_000;
+    // A stalled handshake ends in a few seconds (security review D): a hello costs this node a key
+    // agreement and a signature, and an authenticating session holds a slot.
+    this._handshakeTimeoutMs = opts.handshakeTimeoutMs || 5_000;
     this._legacyRefusals = new Map(); // address -> { at, more }: legacy hellos refused on the listener
     this._sessionStats = { confirmed: 0, failed: 0, failedByReason: {}, refusedFrames: 0, refusedByReason: {}, desync: 0, superseded: 0, legacyHellosRefused: 0 };
     this._chainStats = { fetched: 0, resolved: 0, timedOut: 0, served: 0 };
@@ -476,12 +521,18 @@ class SymNode extends EventEmitter {
     // Roster key registry — authenticated nodeId→key bindings, so signatures from peers
     // we never directly handshook still verify. Pins by source precedence (anchor >
     // handshake > grant-vouched); the relayer never vouches. Persisted under the node dir.
+    // nodeId -> { key, sessions }: the key each live confirmed session proved (see _admitSession).
+    this._sessionKeys = new Map();
     this._roster = new RosterKeyRegistry({
       anchor: this._anchor,
+      // This node's own nodeId is its own key: no session, pin or grant binds it to another (review C).
+      self: { nodeId: this.nodeId, publicKey: this._identity.publicKey },
       dir: path.join(this._dir, 'roster-keys'),
       log: (m) => this._log(m),
       // A node with a live session never has its binding expired (design D3 binding lifetime).
       isLive: (nodeId) => !!(this._peers && this._peers.has(nodeId)),
+      // The sticky floor arms only for a nodeId that has a Legacy Import route (finite, configured).
+      isRouted: (nodeId) => !!(this._legacy && this._legacy.routeFor && this._legacy.routeFor(nodeId)),
       bindingTtlMs: opts.bindingTtlMs,
       maxBindings: opts.maxKeyBindings,
     });
@@ -511,9 +562,17 @@ class SymNode extends EventEmitter {
     // verify is skipped and said here, once.
     this._roleGrants = new RoleGrantStore({
       anchor: this._anchor,
+      selfId: this.nodeId,
+      selfKey: this._identity.publicKey,
+      onForeignSelfGrant: (g) => {
+        this._log(`[sym-security] a role grant by ${String(g.grantedBy).slice(0, 8)} names this node with a key that is not its own (${String(g.granteeKey).slice(0, 12)}…): inert; someone vouched a foreign key for this node's identity`);
+        this.emit('metric', { type: 'role-grant-foreign-self-key', grantedBy: g.grantedBy, granteeKey: g.granteeKey });
+      },
       keys: this._roster,
       dir: path.join(this._dir, 'role-grants'),
     });
+    // A grant binding is a view over the grants in effect now (security review C).
+    this._roster.setGrantView((nodeId) => this._roleGrants.vouchedKey(nodeId));
     {
       const r = this._roleGrants.loadReport();
       const skipped = Object.entries(r.skipped);
@@ -595,8 +654,8 @@ class SymNode extends EventEmitter {
         // `remixed` to tell an ingested CMB from a directed CMB that was
         // delivered to the agent but not stored (frame-handler sets remixed:false).
         stored.remixed = true;
-        this.emit('cmb-accepted', stored);
-        this.emit('metric', { type: 'cmb-accepted', from: entry.source || peerId, key: stored.key });
+        this._emitAccepted(stored);
+        this.emit('metric', { type: stored.profile === 'legacy-import' ? 'legacy-record' : 'cmb-accepted', from: entry.source || peerId, key: stored.key });
       }
       return stored;
     };
@@ -626,7 +685,7 @@ class SymNode extends EventEmitter {
       signaturesNotCanonical: 0, // gossiped statements refused for a signature not spelled canonically
       checkpointsOverRate: 0, // verified checkpoints not taken, past their attester's rate
       framesRefused: 0,      // Inbound frames whose handling failed — refused, never thrown (see _receiveFrame)
-      framesRefusedByType: {}, // ...by frame type
+      framesRefusedByType: Object.create(null), // ...by frame type (known types; the rest as 'other')
     };
     this._refusalLines = new Map(); // peerId -> { at, quiet }: at most one log line per peer a minute
 
@@ -675,7 +734,8 @@ class SymNode extends EventEmitter {
     // room for nodes that do not declare one; `room` is advertised in the
     // handshake frame (§5.2 optional category) so heterogeneous peers on the same
     // LAN can tell which room they belong to.
-    this._room = opts.room || 'default';
+    // §5.2: the room is NFC-normalised; this node keeps, announces and compares it in NFC.
+    this._room = String(opts.room || 'default').normalize('NFC');
 
     // Discovery — pluggable for testability. See MMP v0.2.0 Section 5.
     // `discoveryServiceType` enables LAN-level Bonjour isolation for mesh
@@ -688,7 +748,7 @@ class SymNode extends EventEmitter {
     this._discovery = opts.discovery || (
       opts.relayOnly
         ? new NullDiscovery()
-        : new BonjourDiscovery({ serviceType: this._discoveryServiceType, room: opts.room || 'default' })
+        : new BonjourDiscovery({ serviceType: this._discoveryServiceType, room: this._room })
     );
 
     // Wake
@@ -702,6 +762,8 @@ class SymNode extends EventEmitter {
       peerWakeChannels: this._peerWakeChannels,
       peerLastWake: this._peerLastWake,
       pendingFrames: this._pendingFrames,
+      // A queued frame goes only to a session proving the key bound when it was queued.
+      keyOf: (nodeId) => this._identityKey(nodeId),
       wakeCooldownMs: opts.wakeCooldownMs || 5 * 60 * 1000,
       wakeChannel: this._wakeChannel,
       log: (msg) => this._log(msg),
@@ -817,14 +879,37 @@ class SymNode extends EventEmitter {
   _identityKey(nodeId) {
     const k = this._roster.get(nodeId);
     if (k !== undefined) return k;
-    // A full registry (every binding protecting history) holds no binding for a newcomer: the key
-    // its live Core Secure session proved still verifies what it signs, for as long as that session
-    // lasts. A degradation (nothing persisted), never a lockout. A legacy claim is not a binding,
-    // so this never applies to an id the registry expects another key for.
+    // A nodeId with no durable binding verifies under the key its live Core Secure session proved,
+    // for as long as that session lasts (the session-scoped binding). A legacy claim is not a
+    // binding, so this never applies to an id the registry expects another key for.
     if (this._roster.expected(nodeId) !== undefined) return undefined;
-    const peer = this._peers && this._peers.get(nodeId);
-    const s = peer && peer.transport;
-    return s && s.confirmed && !s.legacy && s.identityKey ? s.identityKey : undefined;
+    const held = this._sessionKeys && this._sessionKeys.get(nodeId);
+    return held && [...held.sessions].some((s) => s.confirmed && !s.closed && !s.legacy) ? held.key : undefined;
+  }
+
+  /** Where the key that verifies `nodeId` comes from: a registry source, 'session', or undefined. */
+  _keySource(nodeId) {
+    const src = this._roster.source(nodeId);
+    if (src !== undefined && src !== 'legacy-claim') return src;
+    if (src === undefined && this._identityKey(nodeId) !== undefined) return 'session';
+    return src;
+  }
+
+  /**
+   * An admitted verified record by `nodeId` under `key` (frame-handler): the binding is EARNED. One
+   * the registry holds for that key is marked verified (it never expires); a nodeId it holds nothing
+   * for, proven by a live session under that very key, is bound `proven` now (security review D).
+   * @private
+   */
+  _earnBinding(nodeId, key) {
+    if (!nodeId || !key) return;
+    const k = this._roster.get(nodeId);
+    if (k === key) { this._roster.noteVerified(nodeId); return; }
+    if (k !== undefined || this._roster.expected(nodeId) !== undefined) return;
+    const held = this._sessionKeys.get(nodeId);
+    if (!held || held.key !== key || ![...held.sessions].some((s) => s.confirmed && !s.closed)) return;
+    const b = this._roster.bind(nodeId, key, 'proven');
+    if (b.bound) this._roster.noteVerified(nodeId);
   }
 
   /**
@@ -987,9 +1072,9 @@ class SymNode extends EventEmitter {
     // Every grant names the key it confers authority on (design D3): a grant to a bare nodeId would
     // confer it on whoever holds that id later. The key is one this node has a PROVEN binding for (a
     // confirmed session, or an out-of-band pin), or one the operator names explicitly.
-    const source = this._roster.source(granteeNodeId);
+    const source = this._keySource(granteeNodeId);
     const granteeKey = opts.granteeKey
-      || ((source === 'proven' || source === 'pinned') ? this._roster.get(granteeNodeId) : undefined);
+      || ((source === 'proven' || source === 'pinned' || source === 'session') ? this._identityKey(granteeNodeId) : undefined);
     if (!granteeKey) {
       this._log(`Role grant for ${String(granteeNodeId).slice(0, 8)} not made: no proven key is known for it (it has not completed a Core Secure session with this node, and no key was given)`);
       return null;
@@ -1053,23 +1138,26 @@ class SymNode extends EventEmitter {
    * What is stored and relayed is the store's canonical copy: only the signed fields (A5).
    * @private
    */
-  _ingestRoleGrant(g, fromPeerId, session = null) {
+  _ingestRoleGrant(g, fromPeerId, session = null, { hold = true } = {}) {
     // A role grant is gossip like any other signed statement: a repeat (its signature's bytes, however
-    // it is spelled) or a frame that is malformed, spelled otherwise than its signer wrote it, or from a
-    // grantor whose key this node does not hold is dropped before anything is spent; a new one spends
-    // the delivering lane's budget before its signature is checked. The store bounds what it keeps,
-    // and only what it keeps is relayed.
-    if (!g || !g.grantee || !g.grantedBy || !g.type || !sigOk(g.sig)) return { ok: false, reason: 'malformed' };
+    // it is spelled) or a frame that is malformed (field types, canonical lowercase nodeIds, bounded
+    // lengths), spelled otherwise than its signer wrote it, or from a grantor whose key this node does
+    // not hold is dropped before anything is spent; a new one spends the delivering peer's own lane
+    // before its signature is checked. A signature that does not verify ends the session that brought
+    // it (`_penaliseForgery`). The store bounds what it keeps (per grantor, per pair, in all), so grants
+    // draw on no shared ceiling; only what it keeps is relayed.
+    if (malformedGrant(g)) return { ok: false, reason: 'malformed' };
     if (!isCanonicalSig(g.sig)) return this._refuseSpelling(fromPeerId, 'role-grant', g.grantedBy);
     if (this._roleGrants.has(g.sig)) return { ok: false, reason: 'duplicate' };
     if (!this._roleGrants.grantorKey(g.grantedBy)) {
-      this._holdForChain(session, g);
+      if (hold) this._holdForChain(session, g);
       return { ok: false, reason: 'unknown-grantor-key' };
     }
     if (!this._gossipBudget(fromPeerId, 'role-grant', g.grantedBy)) return { ok: false, reason: 'over-budget' };
     const r = this._roleGrants.record(g);
     if (r.stored) this._gossipToRoster({ type: r.grant.type, grant: r.grant }, fromPeerId);
-    else if (r.reason === 'unrooted') this._holdForChain(session, g);
+    else if (r.reason === 'unrooted' && hold) this._holdForChain(session, g);
+    else if (r.reason === 'bad-signature') this._penaliseForgery(session, 'role-grant');
     return { ok: r.stored, reason: r.reason };
   }
 
@@ -1086,13 +1174,17 @@ class SymNode extends EventEmitter {
    */
   _holdForChain(session, g) {
     if (!session || session.legacy || !session.confirmed || session.closed || typeof session.send !== 'function') return;
-    if (typeof g.grantedBy !== 'string' || !g.grantedBy || g.grantedBy.length > 256 || typeof g.sig !== 'string') return;
-    const h = session._chainHold || (session._chainHold = { grants: new Map(), fetches: new Map() });
+    if (malformedGrant(g)) return;
+    // Held as its signed fields only (bounded: canonical nodeIds of at most 128 characters, a role
+    // name, a key and a signature of fixed length), and the bytes held per session are bounded too.
+    g = canonicalGrant(g, g.sig);
+    const h = session._chainHold || (session._chainHold = { grants: new Map(), fetches: new Map(), bytes: 0 });
     // Keyed by every field the signature covers and the signature: a forged copy sent ahead of the
     // genuine record is a different entry, so it cannot keep the genuine one out.
     const holdKey = `${g.type}|${g.grantee}|${g.role || ''}|${g.grantedBy}|${g.grantedAt}|${g.granteeKey || ''}|${g.sig}`;
     if (h.grants.has(holdKey)) return;
-    if (h.grants.size >= CHAIN_HOLD_MAX) {
+    const bytes = holdKey.length * 2;
+    if (h.grants.size >= CHAIN_HOLD_MAX || h.bytes + bytes > CHAIN_HOLD_BYTES) {
       this._noteDrop('role-chain-hold-full', session.nodeId, { frame: g.type, author: g.grantedBy });
       return;
     }
@@ -1106,7 +1198,8 @@ class SymNode extends EventEmitter {
       this._chainStats.fetched++;
       session.send({ type: 'role-chain-fetch', reqId, grantees: [g.grantedBy] });
     }
-    h.grants.set(holdKey, { grant: g, reqId });
+    h.grants.set(holdKey, { grant: g, reqId, bytes });
+    h.bytes += bytes;
   }
 
   /** @private A chain fetch ended (answered, timed out, or its session closed): let its held records go. */
@@ -1119,9 +1212,10 @@ class SymNode extends EventEmitter {
     for (const [k, e] of [...h.grants]) {
       if (e.reqId !== reqId) continue;
       h.grants.delete(k);
-      // Offered once more, with no session: whatever it still lacks, it is not held again.
+      h.bytes -= e.bytes || 0;
+      // Offered once more, not held again: whatever it still lacks, it goes.
       if (answered && !session.closed) {
-        const r = this._ingestRoleGrant(e.grant, session.nodeId, null);
+        const r = this._ingestRoleGrant(e.grant, session.nodeId, session, { hold: false });
         if (r.ok) this._chainStats.resolved++;
       }
     }
@@ -1146,13 +1240,52 @@ class SymNode extends EventEmitter {
       progress = false;
       const next = [];
       for (const g of left) {
-        const r = this._ingestRoleGrant(g, session.nodeId, null);
+        const r = this._ingestRoleGrant(g, session.nodeId, session, { hold: false });
+        if (session.closed) return; // a forged grant in the answer ended the session
         if (r.ok) progress = true;
         else if (r.reason === 'unrooted' || r.reason === 'unknown-grantor-key') next.push(g);
       }
       left = next;
     }
+    const f = h.fetches.get(reqId);
+    const sync = f && f.sync;
     this._chainFetchDone(session, reqId, true);
+    // A page of a whole-store sync (anti-entropy, security review D): ask for the next one, if the
+    // answer says there is one, within this session's page bound.
+    if (sync && typeof msg.next === 'number' && Number.isSafeInteger(msg.next) && msg.next > 0 && !session.closed) {
+      this._requestChainSync(session, msg.next, sync.pages + 1);
+    }
+  }
+
+  /**
+   * Anti-entropy for grants and revokes (security review D). Gossip is relay-once, so a record
+   * dropped on its way (a budget, a full hold, a session that ended) was never sent again, and a
+   * revoke lost that way left a revoked node's authority standing. Now every admitted session is sent
+   * this node's grant-store digest (`role-digest`: count and sha256 over the signatures held); a
+   * receiver whose digest differs asks for the sender's whole store, in pages of CHAIN_ANSWER_MAX
+   * records ordered so each record's chain comes before it (`role-chain-fetch` with `sync: true`),
+   * each page through the ordinary ingest, and new records relayed once as usual.
+   * @private
+   */
+  _onRoleDigest(session, msg) {
+    if (!session || session.legacy || !session.confirmed || session.closed) return;
+    if (!msg || !Number.isSafeInteger(msg.count) || msg.count <= 0 || typeof msg.digest !== 'string' || !/^[0-9a-f]{64}$/.test(msg.digest)) return;
+    if (msg.digest === this._roleGrants.digest().digest) return;
+    const h = session._chainHold;
+    if (h) for (const f of h.fetches.values()) if (f.sync) return; // one sync in flight per session
+    this._requestChainSync(session, 0, 1);
+  }
+
+  /** @private Ask `session` for one page of its whole grant store, from `after`. */
+  _requestChainSync(session, after, pages) {
+    if (pages > CHAIN_SYNC_MAX_PAGES) { this._noteDrop('role-sync-too-long', session.nodeId, { frame: 'role-chain-fetch' }); return; }
+    const h = session._chainHold || (session._chainHold = { grants: new Map(), fetches: new Map(), bytes: 0 });
+    const reqId = `rs-${crypto.randomBytes(8).toString('hex')}`;
+    const timer = setTimeout(() => this._chainFetchDone(session, reqId, false), this._chainFetchTimeoutMs);
+    if (timer.unref) timer.unref();
+    h.fetches.set(reqId, { grantee: null, sync: { pages }, timer });
+    this._chainStats.synced = (this._chainStats.synced || 0) + 1;
+    session.send({ type: 'role-chain-fetch', reqId, sync: true, after });
   }
 
   /**
@@ -1166,13 +1299,24 @@ class SymNode extends EventEmitter {
   _serveRoleChain(session, msg) {
     if (!session || typeof session.send !== 'function' || !msg) return;
     const reqId = typeof msg.reqId === 'string' && msg.reqId && msg.reqId.length <= 128 ? msg.reqId : null;
-    if (!reqId || !Array.isArray(msg.grantees)) return;
+    if (!reqId || (!Array.isArray(msg.grantees) && msg.sync !== true)) return;
     const now = Date.now();
     const b = session._chainServe || (session._chainServe = { tokens: CHAIN_SERVE_BURST, at: now });
     b.tokens = Math.min(CHAIN_SERVE_BURST, b.tokens + ((now - b.at) * CHAIN_SERVE_PER_SECOND) / 1000);
     b.at = now;
     if (b.tokens < 1) { this._noteDrop('role-chain-over-rate', session.nodeId, { frame: 'role-chain-fetch' }); return; }
     b.tokens -= 1;
+    if (msg.sync === true) {
+      // A page of the whole store (anti-entropy): records in sync order from `after`, and where the
+      // next page starts when there is one.
+      const all = this._roleGrants.syncOrder();
+      const after = Number.isSafeInteger(msg.after) && msg.after > 0 ? msg.after : 0;
+      const page = all.slice(after, after + CHAIN_ANSWER_MAX);
+      const next = after + page.length < all.length ? after + page.length : null;
+      this._chainStats.served++;
+      session.send({ type: 'role-chain', reqId, grants: page, ...(next !== null ? { next } : {}) });
+      return;
+    }
     const anchorId = this._anchor && this._anchor.nodeId;
     const out = [];
     const seen = new Set();
@@ -1186,7 +1330,7 @@ class SymNode extends EventEmitter {
         if (out.length < CHAIN_ANSWER_MAX) out.push(g);
       }
     };
-    for (const id of msg.grantees.slice(0, CHAIN_FETCH_MAX_GRANTEES)) if (typeof id === 'string' && id && id.length <= 256) visit(id, 0);
+    for (const id of (msg.grantees || []).slice(0, CHAIN_FETCH_MAX_GRANTEES)) if (typeof id === 'string' && id && id.length <= 256) visit(id, 0);
     this._chainStats.served++;
     session.send({ type: 'role-chain', reqId, grants: out });
   }
@@ -1247,7 +1391,11 @@ class SymNode extends EventEmitter {
    * @param {string} method - 'neural' | 'heuristic'
    * @private
    */
-  _buildAdmissionAttestation(of, verdict, categoryVerdicts, method, assertionId) {
+  _buildAdmissionAttestation(of, verdict, categoryVerdicts, method, assertionId, { quarantined = false } = {}) {
+    // A Legacy Import record is quarantined (design D7), and so is what this node says about it
+    // (security review E): the method, which the signature covers, carries the mark, so no reader
+    // weighs this verdict as one about a verified record.
+    if (quarantined) method = `legacy-import-${method}`;
     const att = {
       of,
       assertionId,
@@ -1270,7 +1418,7 @@ class SymNode extends EventEmitter {
       this._attestHead = chainHash(att.sig); // sha256 of the signature's bytes (sym-attest-v1 §5.1)
       // Index it — every gating event this node makes enters its own chain + the
       // per-CMB audit trail, whether or not it produced a stored remix.
-      this._attestations.record(att);
+      this._attestations.record(att, { receivedAt: att.at });
       // Gossip it to the roster so any member can reconstruct the cross-mesh audit
       // trail for this CMB. _peers are same-room (mDNS service-type isolation), so
       // the fan-out is roster-scoped by construction.
@@ -1295,6 +1443,21 @@ class SymNode extends EventEmitter {
     return this._attestations.byCmb(cmbKey);
   }
 
+  /**
+   * The role an attestation's signer counts with (draft spec PR #33): the lower of its role at the
+   * attestation's signed time `at` and at the time this node received it. A validator revoked by then
+   * cannot weigh in by dating an attestation inside its old window; one that counted when received
+   * keeps its standing after a later revoke.
+   * @private
+   */
+  _attesterRole(att) {
+    const at = Number.isFinite(att && att.at) ? att.at : 0;
+    const recv = Number.isFinite(att && att.receivedAt) ? att.receivedAt : (this._attestations.loadedAt ?? Date.now());
+    const a = this.resolveRole(att.by, at);
+    const b = this.resolveRole(att.by, recv);
+    return roleRank(a) <= roleRank(b) ? a : b;
+  }
+
   /**
    * Aggregate every attestation about a CMB into a verdict WEIGHTED BY EARNED AUTHORITY
    * (MMP §6.4/§6.5). The per-attestation `verifyAttestationRole` check answers "is this
@@ -1330,7 +1493,7 @@ class SymNode extends EventEmitter {
       if (!verifyAttestation(att, key).valid) { excluded.push({ by: att.by, reason: 'bad-signature' }); continue; }
 
       // (2) resolve the attester's EARNED role at the time it attested (role-at-time).
-      const rr = verifyAttestationRole(att, (id, at) => this.resolveRole(id, at));
+      const rr = verifyAttestationRole(att, () => this._attesterRole(att));
       if (!rr.matches) mismatches.push({ by: att.by, claimed: rr.claimed, resolved: rr.resolved });
       const w = 2 ** roleRank(rr.resolved); // participant 1, validator 2, anchor 4
 
@@ -1423,7 +1586,7 @@ class SymNode extends EventEmitter {
    * node countersigns "I saw attester's chain to N with root R"), and relay-once.
    * @private
    */
-  _ingestCheckpoint(cp, fromPeerId) {
+  _ingestCheckpoint(cp, fromPeerId, session = null) {
     if (!cp || !cp.by || cp.upto_seq === undefined || !cp.root || !sigOk(cp.sig)) return { ok: false, reason: 'malformed' };
     if (cp.roster && this._room && cp.roster !== this._room) return { ok: false, reason: 'roster-mismatch' };
     // A position is an integer; the signature covers its text, so a re-spelled one is refused here,
@@ -1446,8 +1609,10 @@ class SymNode extends EventEmitter {
     const key = this._identityKey(cp.by);
     if (!key) return { ok: false, reason: 'unknown-attester-key' };
     if (!this._gossipBudget(fromPeerId, 'checkpoint', cp.by)) return { ok: false, reason: 'over-budget' };
-    if (!verifyCheckpoint(cp, key).valid) return { ok: false, reason: 'bad-signature' };
-    this._roster.noteVerified(cp.by); // something verified under its binding (design D3)
+    if (!verifyCheckpoint(cp, key).valid) { this._penaliseForgery(session, 'checkpoint'); return { ok: false, reason: 'bad-signature' }; }
+    if (!this._gossipCeiling(fromPeerId, 'checkpoint', cp.by)) return { ok: false, reason: 'over-ceiling' };
+    // A verified gossip statement does not make its signer's binding durable (security review D:
+    // only an admitted record, a grant in effect or a pin does; a fresh identity signs statements free).
     // A new position is taken at most at its attester's rate, whichever peer brings it: past that it is
     // not stored, witnessed or relayed. Checked after the signature, so no one else can spend it. A
     // second root for a held position is the evidence of equivocation, kept once and free (a third is
@@ -1467,23 +1632,70 @@ class SymNode extends EventEmitter {
   }
 
   /**
-   * Spend one token of the PROVEN peer a NEW gossiped statement arrived from, and one of the shared
-   * ceiling, before its signature is checked (see GOSSIP_PER_SECOND and GOSSIP_NEW_LANE). An honest
-   * peer relays only what it has verified and stored, so its budget carries no forgeries. Both refill,
-   * so a peer that stops flooding is heard again within burst/rate seconds. A dropped frame changes
-   * nothing: it is not marked seen, so another peer's copy is taken. O(1).
+   * Spend one token of the PROVEN peer a NEW gossiped statement arrived from, before its signature is
+   * checked (see GOSSIP_PER_SECOND and GOSSIP_NEW_LANE). Only the peer's own lane is spent before the
+   * check (security review D: no shared budget is spent before verification), so a peer flooding
+   * forgeries spends its own budget and nobody else's; and its first forgery ends its session
+   * (`_penaliseForgery`). An honest peer relays only what it has verified and stored, so its budget
+   * carries no forgeries. The lane refills, so a peer that stops flooding is heard again within
+   * burst/rate seconds. A dropped frame changes nothing: it is not marked seen, so another peer's copy
+   * is taken. O(1).
    * @returns {boolean} whether the frame may be verified
    * @private
    */
   _gossipBudget(peerId, type, author) {
     const now = this._gossipClock();
     const b = bucketOf(this._gossipBuckets, peerId, this._gossipRate, this._gossipBurst, this._gossipNewLane, now, GOSSIP_MAX_PEERS);
-    const all = refill(this._gossipGlobal, this._gossipGlobalRate, this._gossipGlobalBurst, now);
-    if (b.tokens >= 1 && all.tokens >= 1) { b.tokens -= 1; all.tokens -= 1; return true; }
-    // A drop by the ceiling is said in one report for all peers, not one per id: ids are free to mint,
-    // so one report each would let a flood of them buy a log line a frame.
-    if (b.tokens >= 1) this._noteDrop('gossip-over-ceiling', '*', { frame: type, author, peer: peerId });
-    else this._noteDrop('gossip-over-budget', peerId, { frame: type, author });
+    if (b.tokens >= 1) { b.tokens -= 1; return true; }
+    this._noteDrop('gossip-over-budget', peerId, { frame: type, author });
+    return false;
+  }
+
+  /**
+   * The shared ceiling over every peer, spent only AFTER a statement's signature verified (security
+   * review D): what it bounds is the work verified statements cause (storing, relaying, witnessing),
+   * which only signers whose keys this node holds can buy, never the signature checks forgeries cost.
+   * Past it the verified statement is dropped unstored and unmarked, so a later copy is taken.
+   * @returns {boolean} whether the verified statement may be taken
+   * @private
+   */
+  _gossipCeiling(peerId, type, author) {
+    const all = refill(this._gossipGlobal, this._gossipGlobalRate, this._gossipGlobalBurst, this._gossipClock());
+    if (all.tokens >= 1) { all.tokens -= 1; return true; }
+    // Said in one report for all peers, not one per id: ids are free to mint.
+    this._noteDrop('gossip-over-ceiling', '*', { frame: type, author, peer: peerId });
+    return false;
+  }
+
+  /**
+   * A frame on a proven session carried a signature that does not verify (security review D). The
+   * session is attributable (its frames are sealed or encrypted under keys only that peer holds), and
+   * an honest peer relays only what it verified, so the session ends ('forged-signature') and its
+   * nodeId is not admitted again for FORGERY_PENALTY_MS. A Legacy Import session is not attributable
+   * this way: its frames are only dropped.
+   * @param {object} session
+   * @param {string} kind - what was forged: record | attestation | checkpoint | witness | role-grant
+   * @private
+   */
+  _penaliseForgery(session, kind) {
+    if (!session || session.legacy || !session.confirmed || session.closed || typeof session.close !== 'function') return;
+    const nodeId = session.nodeId;
+    this._forgeryCount = (this._forgeryCount || 0) + 1;
+    if (!this._forgeryPenalty) this._forgeryPenalty = new Map();
+    this._forgeryPenalty.delete(nodeId);
+    if (this._forgeryPenalty.size >= GOSSIP_MAX_PEERS) this._forgeryPenalty.delete(this._forgeryPenalty.keys().next().value);
+    this._forgeryPenalty.set(nodeId, Date.now() + FORGERY_PENALTY_MS);
+    this.emit('metric', { type: 'forged-signature', kind, peer: nodeId });
+    this._sayOncePerMinute(`forged|${nodeId}`, `[sym-security] ${session.name || String(nodeId).slice(0, 8)} delivered a ${kind} whose signature does not verify: session closed, not admitted again for ${FORGERY_PENALTY_MS / 1000} s`);
+    session.close('forged-signature');
+  }
+
+  /** @private Whether `nodeId` is inside a forgery penalty (and drop it when it has run out). */
+  _penalised(nodeId) {
+    const until = this._forgeryPenalty && this._forgeryPenalty.get(nodeId);
+    if (!until) return false;
+    if (Date.now() < until) return true;
+    this._forgeryPenalty.delete(nodeId);
     return false;
   }
 
@@ -1634,7 +1846,7 @@ class SymNode extends EventEmitter {
    * signature against its authenticated key, record, relay-once.
    * @private
    */
-  _ingestWitness(w, fromPeerId) {
+  _ingestWitness(w, fromPeerId, session = null) {
     if (!w || !w.attester || w.upto_seq === undefined || !w.root || !w.by || !sigOk(w.sig)) return { ok: false, reason: 'malformed' };
     if (w.roster && this._room && w.roster !== this._room) return { ok: false, reason: 'roster-mismatch' };
     if (!isPosition(w.upto_seq)) return { ok: false, reason: 'malformed' };
@@ -1646,8 +1858,10 @@ class SymNode extends EventEmitter {
     const key = this._identityKey(w.by);
     if (!key) return { ok: false, reason: 'unknown-witness-key' };
     if (!this._gossipBudget(fromPeerId, 'witness', w.by)) return { ok: false, reason: 'over-budget' };
-    if (!verifyWitness(w, key).valid) return { ok: false, reason: 'bad-signature' };
-    this._roster.noteVerified(w.by);
+    if (!verifyWitness(w, key).valid) { this._penaliseForgery(session, 'witness'); return { ok: false, reason: 'bad-signature' }; }
+    if (!this._gossipCeiling(fromPeerId, 'witness', w.by)) return { ok: false, reason: 'over-ceiling' };
+    // A verified gossip statement does not make its signer's binding durable (security review D:
+    // only an admitted record, a grant in effect or a pin does; a fresh identity signs statements free).
     const r = this._attestations.recordWitness(w);
     if (r.stored) this._gossipToRoster({ type: ATTEST_FRAME.witness, witness: toWireWitness(w) }, fromPeerId);
     if (r.reason === 'conflict' && r.first) {
@@ -1705,7 +1919,7 @@ class SymNode extends EventEmitter {
    * copy, a roster mismatch, an unknown attester or a bad signature emits nothing.
    * @private
    */
-  _ingestAttestation(att, fromPeerId, fromPeerName) {
+  _ingestAttestation(att, fromPeerId, fromPeerName, session = null) {
     if (!att || !sigOk(att.sig) || !att.of || !att.by) return { ok: false, reason: 'malformed' };
     // Roster scope (defense in depth — gossip already stays in-room).
     if (att.roster && this._room && att.roster !== this._room) {
@@ -1725,10 +1939,15 @@ class SymNode extends EventEmitter {
     if (!attesterKey) return { ok: false, reason: 'unknown-attester-key' };
     if (!this._gossipBudget(fromPeerId, 'attestation', att.by)) return { ok: false, reason: 'over-budget' };
     const v = verifyAttestation(att, attesterKey);
-    if (!v.valid) return { ok: false, reason: v.error || 'bad-signature' };
-    this._roster.noteVerified(att.by);
-    // Record (rate-limited as ingested). Relay-once only on first sight.
-    const r = this._attestations.record(att, { ingested: true });
+    if (!v.valid) {
+      if (!v.error || v.error === 'bad-signature') this._penaliseForgery(session, 'attestation');
+      return { ok: false, reason: v.error || 'bad-signature' };
+    }
+    if (!this._gossipCeiling(fromPeerId, 'attestation', att.by)) return { ok: false, reason: 'over-ceiling' };
+    // A verified gossip statement does not make its signer's binding durable (security review D:
+    // only an admitted record, a grant in effect or a pin does; a fresh identity signs statements free).
+    // Record (rate-limited as ingested), with the time it was received. Relay-once only on first sight.
+    const r = this._attestations.record(att, { ingested: true, receivedAt: Date.now() });
     if (r.stored) {
       this._gossipAttestation(att, fromPeerId);
       this._emitAttestationReceived(att, fromPeerId, fromPeerName);
@@ -1785,7 +2004,7 @@ class SymNode extends EventEmitter {
       }
       // The claim as signed: a text role, or none (an absent or non-text role signs as empty and claims
       // 'participant').
-      const role = verifyAttestationRole({ ...att, role: typeof att.role === 'string' && att.role ? att.role : undefined }, (id, at) => this.resolveRole(id, at));
+      const role = verifyAttestationRole({ ...att, role: typeof att.role === 'string' && att.role ? att.role : undefined }, () => this._attesterRole(att));
       const roleClaimed = String(role.claimed);
       const roleResolved = String(role.resolved);
       event = Object.freeze({
@@ -1808,7 +2027,7 @@ class SymNode extends EventEmitter {
         sig: signed(att.sig),
         sigAlg: signed(att.sigAlg),
         verified: true,
-        keySource: this._roster.source(att.by) ?? null,
+        keySource: this._keySource(att.by) ?? null,
         from: signed(fromPeerName),
         fromPeerId: signed(fromPeerId),
         relayed: fromPeerId ? fromPeerId !== att.by : null,
@@ -2028,6 +2247,11 @@ class SymNode extends EventEmitter {
       if (!info || info.mmp !== '2.0') return;
       // §5.1: the lexicographically smaller nodeId initiates; the other MUST NOT.
       if (!(this.nodeId < peerId)) return;
+      // A peer that refused this node with 1009 IDENTITY_CONFLICT is not dialled again (review F).
+      if (this._identityRefused && this._identityRefused.has(peerId)) return;
+      // A peer whose last dial or handshake failed waits its backoff (security review D).
+      const lb = this._lanBackoff && this._lanBackoff.get(peerId);
+      if (lb && Date.now() < lb.nextAt) return;
       // Skip if already dialling (dns-sd resolves the same peer multiple times), or already holding a
       // live LAN session with it.
       if (this._pendingBonjour.has(peerId)) return;
@@ -2042,7 +2266,10 @@ class SymNode extends EventEmitter {
       // takes nothing else) and cleared its own deadline; the session's handshake timeout governs
       // from here. Through the guard: a hello this node cannot take closes the connection.
       const ok = this._guardInbound('?', 'inbound', firstFrame, 'lan', () => {
+        this._makeRoomForLanHandshake(remote);
         const session = this._attachTransport(transport, { role: 'server', kind: 'bonjour', remote });
+        if (!this._lanInFlight) this._lanInFlight = new Set();
+        this._lanInFlight.add(session);
         session.receiveWire(firstFrame);
       });
       if (!ok) { try { transport.close(); } catch { /* already gone */ } }
@@ -2120,6 +2347,8 @@ class SymNode extends EventEmitter {
     if (this._relaySessions) this._relaySessions.clear();
     for (const t of (this._relayRetry || new Map()).values()) clearTimeout(t.timer);
     if (this._relayRetry) this._relayRetry.clear();
+    if (this._pumpTimer) { clearTimeout(this._pumpTimer); this._pumpTimer = null; }
+    if (this._relayWanted) this._relayWanted.clear();
 
     await this._discovery.stop();
     this._discovery.removeAllListeners();
@@ -2219,6 +2448,17 @@ class SymNode extends EventEmitter {
     } catch { /* best-effort */ }
   }
 
+  /**
+   * Surface a delivery (mesh-channel 0.11.0): a Core Secure one as `cmb-accepted` (and so into the
+   * inbox); a quarantined Legacy Import record as `legacy-record` only, never into the path a host
+   * reads as Core Secure deliveries.
+   * @private
+   */
+  _emitAccepted(entry) {
+    if (entry && entry.profile === 'legacy-import') { this.emit('legacy-record', entry); return; }
+    this.emit('cmb-accepted', entry);
+  }
+
   _pushInbox(entry) {
     if (!entry) return;
     const cmb = entry.cmb || {};
@@ -2248,7 +2488,15 @@ class SymNode extends EventEmitter {
       payload: cmb.payload ?? null,
       directed: !!entry.directed,
       remixed: entry.remixed,
-      verified: entry._cmbVerified === true || entry.verified === true || undefined,
+      // Provenance travels with the delivery, persisted with the inbox (mesh-channel 0.11.0): the
+      // verdict, the profile, the assertion identity, and the frozen verification and session facts.
+      verified: entry.verified === true,
+      profile: entry.profile || null,
+      assertionId: entry.verified === true ? (entry.assertionId || entry.verification?.assertionId || null) : null,
+      verification: entry.verified === true ? (entry.verification || null) : null,
+      session: entry.verified === true ? (entry.session || null) : null,
+      // The verified record itself, as signed (its signed projection), for a reader that checks it.
+      record: entry.verified === true ? projectionOrNull(cmb) : null,
       key: recordKey(cmb) || entry.key || null,
       receivedAt: Date.now(),
     });
@@ -2384,36 +2632,18 @@ class SymNode extends EventEmitter {
   remember(categories, opts = {}) {
     // Whether this call builds (and signs) the record, as opposed to forwarding a caller's opts.cmb.
     const builtHere = !opts.cmb;
-    // Hoisted: the anti-paraphrase guard reads these before the record is built, and the flag
-    // lifecycle reads them after it is stored. A caller supplying its own opts.cmb still needs
-    // the same self/peer split.
-    const parentKeys = (opts.parents || []).map((p) => p?.metadata?.key ?? p?.key).filter(Boolean);
-    const peerParents = parentKeys.filter((k) => !this._ownKeys.has(k));
 
     if (!opts.cmb) {
       if (!categories || typeof categories !== 'object') {
         throw new Error('remember() requires CAT7 categories — the agent LLM extracts categories');
       }
 
-      // §15.7 anti-paraphrase, split by WHOSE block is being parented (B-2).
-      //
-      // The guard is right about what it was written for — remixing a PEER without new domain
-      // data is how agents paraphrase each other into noise. But it conflated that with
-      // PARENTING TO YOUR OWN HEAD, which is not a remix at all: it is having a history. A node
-      // continuing its own line is paraphrasing nobody.
-      //
-      // Conflated, the flag enforced a strict alternation — root, parented, root, parented —
-      // because a parented emission CONSUMED the flag and only a root SET it. Two parented
-      // blocks in a row were impossible, so Rule A was not merely unimplemented, it was
-      // unimplementable: it requires every block to be parented and the guard forbade every
-      // second one. The flag also initialises false, so even a node's FIRST parented emission
-      // was dropped.
-      if (peerParents.length > 0 && !this._hasNewDomainData) {
-        this._metrics.remixRejected++;
-        this._log('Remix rejected: no new domain data (MMP Section 15.7)');
-        this.emit('metric', { type: 'remix-rejected', reason: 'no-new-domain-data' });
-        return null;
-      }
+      // §15.7 is NOT checked here (draft spec PR meshcognition-website#35): a remix is defined by
+      // how it was produced — the node's integration of an admitted peer record, `remix()` — never
+      // by the parents a record cites. A record the agent authors through remember() is its own
+      // domain observation (a reply, a trail decision, an outcome), however many parents it cites,
+      // and is never refused as a remix. Nothing here gates on parents, an intent value or the
+      // lineage method.
 
       // Lineage from parents (§7.5). `ancestors` is RETIRED: reachability is walked from refs,
       // never carried — a transitive closure stapled to every block had to be recomputed at
@@ -2508,7 +2738,8 @@ class SymNode extends EventEmitter {
       this._metrics.collapsed = (this._metrics.collapsed ?? 0) + 1;
       this.emit('metric', { type: 'cmb-collapsed', key: mintKey, reason: 'identical-to-own-head' });
       this._log(`Collapsed: re-assertion of own HEAD ${String(mintKey).slice(0, 16)}… — cited, not minted`);
-      const collapsed = { key: mintKey, cmb: opts.cmb, collapsed: true };
+      // A broadcast that collapses onto HEAD minted nothing: it is a duplicate, and says so.
+      const collapsed = { key: mintKey, cmb: opts.cmb, collapsed: true, ...(opts.to ? {} : { duplicate: true }) };
       // Collapse refuses a MINT, not a delivery: a directed send of the same words to a peer is
       // still an addressed request. The freshly signed record goes, not the stored HEAD: it is a
       // new assertion of the same cognition, so the receiver surfaces it instead of discarding it
@@ -2528,10 +2759,14 @@ class SymNode extends EventEmitter {
 
     // Duplicate — already stored, skip broadcast. A directed send is an addressed request,
     // not a broadcast, so the stored record still goes to that peer and the caller gets the
-    // delivery result instead of null.
+    // delivery result. A broadcast duplicate is said so: `{ key, duplicate: true }` (mesh-channel
+    // 0.11.0), never the null a refusal or a failure returns.
     if (!entry) {
-      if (!opts.to) return null;
       const existingKey = opts.cmb?.metadata?.key || opts.cmb?.key || null;
+      if (!opts.to) {
+        if (existingKey && this._store.get(existingKey)) return { key: existingKey, duplicate: true };
+        return null; // the store write failed: nothing was stored
+      }
       // Entry-shaped, like any other return, but built from the caller's own record: the stored entry
       // under this key may be a peer's admission, and its provenance is not this send's (re-review F5).
       const stored = existingKey ? this._store.get(existingKey) : null;
@@ -2552,14 +2787,9 @@ class SymNode extends EventEmitter {
       return existing;
     }
 
-    // Only a PEER remix consumes the flag. If self-parents consumed it, a node that parented to
-    // its own HEAD would burn its ability to remix a peer next — the alternation returning in a
-    // subtler form, one hop further away from where anyone would look for it.
-    if (peerParents.length > 0) {
-      this._hasNewDomainData = false;
-    } else if (parentKeys.length === 0) {
-      this._hasNewDomainData = true;
-    }
+    // A record the agent authored is new domain data by construction (§15.7.2, draft spec PR #35),
+    // with or without parents. Only the remix path (`remix()`) consumes the flag.
+    this._hasNewDomainData = true;
 
     // HEAD advances only when something was actually minted, and the key is remembered as ours
     // so a later self-parent is recognisable without resolving anything.
@@ -2802,6 +3032,28 @@ class SymNode extends EventEmitter {
     return this._hasNewDomainData;
   }
 
+  /**
+   * THE REMIX PATH (MMP §15.5, §15.7; draft spec PR meshcognition-website#35): the record this node
+   * mints by integrating an admitted peer record (`parents`) through its own domain lens. Only this
+   * path is gated: with no new domain data since the last remix it is refused, and the result says
+   * so — `{ refused: 'remix-without-new-domain-data' }` — where remember() would have minted. A
+   * remix that mints consumes the flag. Everything else is remember()'s.
+   * @param {object} categories
+   * @param {object} [opts] - remember()'s options; `parents` names the integrated records
+   * @returns {object|null} the stored entry, `{ refused }`, `{ key, duplicate: true }`, or null
+   */
+  remix(categories, opts = {}) {
+    if (!this._hasNewDomainData) {
+      this._metrics.remixRejected++;
+      this._log('Remix not minted: no new domain data since the last remix (MMP §15.7)');
+      this.emit('metric', { type: 'remix-rejected', reason: 'no-new-domain-data' });
+      return { refused: 'remix-without-new-domain-data' };
+    }
+    const entry = this.remember(categories, opts);
+    if (entry && !entry.refused && !entry.duplicate && !entry.collapsed) this._hasNewDomainData = false;
+    return entry;
+  }
+
   /**
    * Mark that the agent has completed a remix cycle. Resets the
    * new-domain-data flag so the agent stays silent until it has
@@ -2939,7 +3191,13 @@ class SymNode extends EventEmitter {
       if (!peer) continue;
       if (trySend(peer.transport, { type: 'cmb', timestamp: Date.now(), cmb }).ok) delivered++;
     }
-    if (!opts.to) this._wakeManager.wakeSleepingPeers('message', { type: 'message', fromName: this.name, content, timestamp: Date.now() });
+    // A sleeping peer is woken, and the message waits for it as a record signed to it (the retired
+    // `message` frame is never queued).
+    if (!opts.to) {
+      this._wakeManager.wakeSleepingPeers('message', (peerId) => {
+        try { return { type: 'cmb', timestamp: Date.now(), cmb: this._mintMessage(content, peerId) }; } catch { return null; }
+      });
+    }
     // If no peers received the message, trigger an immediate reconnect
     // attempt for any cached bonjour peers. The next send will find
     // them connected instead of waiting for the 15s background timer.
@@ -3067,7 +3325,7 @@ class SymNode extends EventEmitter {
         // Every session is sealed (Core Secure); a Legacy Import session says so (design D7).
         e2e: true,
         profile: peer.transport && peer.transport.legacy ? 'legacy-import' : 'core-secure',
-        keySource: this._roster.source(id) || null,
+        keySource: this._keySource(id) || null,
         sessions: [...peer.transports.values()].map((t) => ({ transport: t.kind, sessionId: t.sessionId || null, confirmedAt: t.confirmedAt || null, extensions: [...(t.selected || [])], legacy: !!t.legacy })),
       });
     }
@@ -3174,8 +3432,11 @@ class SymNode extends EventEmitter {
     try {
       const type = msg && typeof msg.type === 'string' ? msg.type.slice(0, 40) : '?';
       this._metrics.framesRefused++;
+      // Counted by frame type only for a type this node knows (security review): a peer's own type
+      // names would grow the table without bound (or name `__proto__`).
       const byType = this._metrics.framesRefusedByType;
-      byType[type] = (byType[type] || 0) + 1;
+      const k = KNOWN_FRAME_TYPES.has(type) ? type : 'other';
+      byType[k] = (byType[k] || 0) + 1;
       const why = err && typeof err.message === 'string' ? err.message : String(err);
       // Every refusal is a metric (counted); only the log line is rate-limited.
       try { this.emit('metric', { type: 'frame-handler-error', from: String(peerName).slice(0, 64), frameType: type, error: why.slice(0, 200) }); } catch { /* a metric sink must not become the failure */ }
@@ -3230,6 +3491,35 @@ class SymNode extends EventEmitter {
     return this._interior;
   }
 
+  // ── Identity, public (mesh-channel 0.11.0 host API) ────────
+
+  /** This node's own Ed25519 identity public key (unpadded base64url). Public; never a private key. */
+  get publicKey() { return this._identity.publicKey; }
+
+  /** This node's identity key fingerprint, `sha256:<hex>` over the raw key bytes. */
+  get fingerprint() { return keyFingerprint(this._identity.publicKey); }
+
+  /**
+   * The key bindings this node holds, public keys only: the durable registry's (anchor, pinned,
+   * proven, legacy-claim) and the live sessions' (`session`). A grant-vouched key is shown where a
+   * grant in effect names it. A host reads these; it never writes them.
+   * @returns {{ nodeId: string, key: string, source: string }[]}
+   */
+  keyBindings() {
+    const out = [];
+    const seen = new Set();
+    for (const e of this._roster.entries()) {
+      seen.add(e.nodeId);
+      const source = this._roster.source(e.nodeId) || e.source;
+      out.push({ nodeId: e.nodeId, key: e.key, source });
+    }
+    for (const [nodeId, held] of this._sessionKeys) {
+      if (seen.has(nodeId) || ![...held.sessions].some((s) => s.confirmed && !s.closed)) continue;
+      out.push({ nodeId, key: held.key, source: 'session' });
+    }
+    return out.map((e) => Object.freeze(e));
+  }
+
   // ── Invites (design D5) ────────────────────────────────────
 
   /**
@@ -3313,6 +3603,11 @@ class SymNode extends EventEmitter {
     });
     session.on('frame', (frame) => this._onSessionFrame(session, frame));
     session.on('refused', (type, reason) => this._noteSessionRefusal(session, type, reason));
+    // A clear 1011 on a confirmed relay session: the peer restarted and holds no session with this
+    // node. The client re-handshakes; the session stays until the new one supersedes it.
+    session.on('unknown-session', () => {
+      if (session.kind === 'relay' && this.nodeId < session.relayFrom && this._relay && this._relay.present.has(session.relayFrom)) this._startRelayClient(session.relayFrom);
+    });
     session.on('closed', (info) => {
       this._guardInbound(session.nodeId || '?', session.name || '?', { type: 'session-closed' }, kind, () => this._onSessionClosed(session, info));
     });
@@ -3335,8 +3630,17 @@ class SymNode extends EventEmitter {
       this._refuseIdentityConflict(session);
       return;
     }
+    // A live session-scoped binding is a binding (security review D, binding-squat): a second key for
+    // a nodeId some live session proved is an identity conflict, whether or not the registry keeps it.
+    const live = this._sessionKeys.get(session.nodeId);
+    if (live && live.key !== session.identityKey && [...live.sessions].some((x) => !x.closed)) {
+      this._roster.noteConflict(session.nodeId, live.key, 'session', session.identityKey, 'proven');
+      this._log(`Refused ${session.name} (${session.nodeId.slice(0, 8)}): it proved a key other than the one a live session proved for its nodeId — a key conflict`);
+      this._refuseIdentityConflict(session);
+      return;
+    }
     // A room-join grant this node holds goes first, so a gated peer can admit it.
-    if (this._roomGrant) session.send({ type: 'mesh-room-join', grant: this._roomGrant });
+    if (this._roomGrant) session.send({ type: 'room-join', grant: this._roomGrant });
     session.admission = { state: 'pending', since: Date.now() };
     this._decideAdmission(session);
   }
@@ -3379,12 +3683,36 @@ class SymNode extends EventEmitter {
    */
   _admitSession(session) {
     const nodeId = session.nodeId;
-    const b = this._roster.bind(nodeId, session.identityKey, 'proven');
-    if (!b.bound && b.reason === 'conflict') { this._refuseIdentityConflict(session); return; }
-    if (!b.bound && b.reason === 'full') this._log(`Key registry full: ${nodeId.slice(0, 8)} is held for this session only`);
-    // First contact starts the binding's clock; a later session re-proving the same key is something
-    // verified under it, so the binding never expires (design D3 binding lifetime).
-    if (b.bound) { if (b.created) this._roster.noteSeen(nodeId); else this._roster.noteVerified(nodeId); }
+    if (this._penalised(nodeId)) { this._refuseAdmission(session, 'delivered a forged signature; not admitted again yet'); return; }
+    // EVERY CONFIRMED SESSION RUNS WITH A BINDING (security review D, binding-squat): its proven key is
+    // held for nodeId while the session lives (the session-scoped table, bounded by the session caps),
+    // and a second key for that nodeId is a conflict. The durable registry takes only EARNED
+    // bindings — a pin, a grant in effect, or an admitted verified record (_earnBinding) — and the
+    // key it already expects for nodeId (a legacy claim becomes `proven`; a pin stays pinned).
+    const expected = this._roster.expected(nodeId);
+    if (expected !== undefined && expected !== session.identityKey) { this._refuseIdentityConflict(session); return; }
+    if (expected === session.identityKey) {
+      const b = this._roster.bind(nodeId, session.identityKey, 'proven');
+      if (!b.bound && b.reason === 'conflict') { this._refuseIdentityConflict(session); return; }
+      // A session seen renews the binding's clock. A re-handshake proves only that the key is held,
+      // which anyone minting identities can do twice, so it is never "verified" (security review D).
+      this._roster.noteSeen(nodeId);
+    }
+    // The sticky floor of a routed nodeId arms on a proof, whatever the registry keeps.
+    this._roster.armFloor(nodeId);
+    let held = this._sessionKeys.get(nodeId);
+    if (!held || held.key !== session.identityKey) { held = { key: session.identityKey, sessions: new Set() }; this._sessionKeys.set(nodeId, held); }
+    held.sessions.add(session);
+    // A room-join grant admits until it expires, not for as long as the session lasts (security
+    // review): the session closes when its grant does.
+    const g = session.roomGrant;
+    if (g && Number.isFinite(g.expiresAt) && this._roomOwners.ownerOf(this._room)) {
+      const left = g.expiresAt - Date.now();
+      const close = () => { if (!session.closed) { this._log(`Room-join grant of ${session.name} expired: session closed`); session.close('room-grant-expired'); } };
+      if (left <= 0) { close(); return; }
+      session._grantTimer = setTimeout(close, Math.min(left, 2 ** 31 - 1));
+      if (session._grantTimer.unref) session._grantTimer.unref();
+    }
     session.admission = { state: 'admitted', at: Date.now() };
     if (!this._roomVerdicts) this._roomVerdicts = new Map();
     keepPeerState(this._roomVerdicts, nodeId, { admit: true, reason: null, at: Date.now() }, this._peers);
@@ -3415,10 +3743,11 @@ class SymNode extends EventEmitter {
     if (prev && prev !== session && !prev.closed) {
       this._sessionStats.superseded++;
       prev._superseded = true;
-      prev.close('superseded');
+      // Supersession sends nothing (draft spec PR #23): the peer's own new session supersedes its old.
+      prev.close('superseded', { notify: false });
     }
-    if (session.kind === 'bonjour') this._pendingBonjour?.delete(nodeId);
-    if (session.kind === 'relay') this._relayRetry?.delete(nodeId);
+    if (session.kind === 'bonjour') { this._pendingBonjour?.delete(nodeId); this._lanBackoff?.delete(nodeId); }
+    if (session.kind === 'relay') { this._relayRetry?.delete(nodeId); this._relayFailures?.delete(nodeId); this._schedulePumpRelay(); }
     this._greetSession(peer, session, isNew);
     if (isNew) {
       this._log(`Peer connected: ${peer.name} (${session.role === 'client' ? 'outbound' : 'inbound'}, ${session.kind}, Core Secure session ${session.sessionId.slice(0, 8)})`);
@@ -3444,8 +3773,11 @@ class SymNode extends EventEmitter {
     if (now - lastSent >= 60000) {
       keepPeerState(this._lastAnchorSent, peer.peerId, now, this._peers);
       // Own emissions only (anti-echo, §15.7), and only records that can travel in Core Secure.
+      // Room-bound records only (review finding A): a record signed to one node is never replayed as
+      // context to another, whoever's session this is.
       const anchors = this._store.recent(50)
-        .filter((a) => a.cmb && a.peerId == null && a.cmb.metadata && a.cmb.metadata.signatureSuite === 'mmp-sig-v2.0' && a.cmb.metadata.sig)
+        .filter((a) => a.cmb && a.peerId == null && a.cmb.metadata && a.cmb.metadata.signatureSuite === 'mmp-sig-v2.0' && a.cmb.metadata.sig
+          && (a.cmb.metadata.to === null || a.cmb.metadata.to === undefined))
         .slice(0, 5);
       if (anchors.length > 0) {
         session.send({ type: 'cmb-anchors', keys: anchors.map((a) => a.cmb.metadata.key) });
@@ -3456,13 +3788,21 @@ class SymNode extends EventEmitter {
     } else if (isNew) {
       this._log(`Skipping anchor CMBs for ${peer.name} (reconnected within 60s)`);
     }
+    // Anti-entropy for grants and revokes (security review D): this node's grant-store digest.
+    if (this._roleGrants.size() > 0) session.send({ type: 'role-digest', ...this._roleGrants.digest() });
     // This node's own wake channel. (peer-info about OTHER nodes is not sent: a receiver learns a
     // wake channel only from its node's own session, so gossip about others would be dropped.)
     if (this._wakeChannel) session.send({ type: 'wake-channel', ...this._wakeChannel });
     const pending = this._pendingFrames.get(peer.peerId);
     if (pending && pending.length > 0) {
-      this._log(`Delivering ${pending.length} pending frame(s) to ${peer.name}`);
-      for (const frame of pending) session.send(frame);
+      // Only to the key the frames were queued for, and only frames this session takes (an
+      // extension's frames where it was selected): security review.
+      let sent = 0;
+      for (const e of pending) {
+        if (!e || !e.frame || e.key !== session.identityKey || !this._sessionTakes(session, e.frame.type)) continue;
+        if (session.send(e.frame)) sent++;
+      }
+      this._log(`Delivered ${sent} of ${pending.length} pending frame(s) to ${peer.name}`);
       this._pendingFrames.delete(peer.peerId);
     }
   }
@@ -3471,7 +3811,7 @@ class SymNode extends EventEmitter {
   _onSessionFrame(session, frame) {
     const state = session.admission && session.admission.state;
     if (state !== 'admitted') {
-      if (state === 'pending' && frame && frame.type === 'mesh-room-join') {
+      if (state === 'pending' && frame && frame.type === 'room-join') {
         session.roomGrant = frame.grant;
         this._decideAdmission(session);
         return;
@@ -3479,7 +3819,7 @@ class SymNode extends EventEmitter {
       this._noteSessionRefusal(session, frame && frame.type, 'not-admitted');
       return;
     }
-    if (frame && frame.type === 'mesh-room-join') return; // admitted already: nothing to decide
+    if (frame && frame.type === 'room-join') return; // admitted already: nothing to decide
     const peer = this._peers.get(session.nodeId);
     if (peer) peer.lastSeen = Date.now();
     this._receiveSessionFrame(session, frame);
@@ -3488,11 +3828,14 @@ class SymNode extends EventEmitter {
   /** @private A session ended: detach it, and the peer when it was the peer's last. */
   _onSessionClosed(session, info) {
     this._sessions.delete(session);
+    const held = session.nodeId && this._sessionKeys.get(session.nodeId);
+    if (held && held.sessions.delete(session) && held.sessions.size === 0) this._sessionKeys.delete(session.nodeId);
     if (session._chainHold) {
       for (const reqId of [...session._chainHold.fetches.keys()]) this._chainFetchDone(session, reqId, false);
       session._chainHold = null;
     }
     if (session._admissionTimer) { clearTimeout(session._admissionTimer); session._admissionTimer = null; }
+    if (session._grantTimer) { clearTimeout(session._grantTimer); session._grantTimer = null; }
     const reason = info && info.reason;
     if (info && info.desync) this._sessionStats.desync++;
     if (!(info && info.wasConfirmed)) {
@@ -3504,10 +3847,28 @@ class SymNode extends EventEmitter {
       }
     }
     if (reason === 'identity-conflict') {
+      // 1009 means no automatic retry (security review F): neither the relay's re-handshake nor the
+      // LAN re-dial discovery offers every 15 s. Until this node restarts.
+      const who = session.nodeId || session.expectNodeId || session.relayFrom;
+      if (who) {
+        if (!this._identityRefused) this._identityRefused = new Map();
+        this._identityRefused.delete(who);
+        if (this._identityRefused.size >= IDENTITY_REFUSED_MAX) this._identityRefused.delete(this._identityRefused.keys().next().value);
+        this._identityRefused.set(who, Date.now());
+      }
       this._sayOncePerMinute(`idc|${session.nodeId || session.relayFrom || session.remote || ''}`, `[sym-security] ${session.name || session.relayFrom || 'a peer'} refused this node with IDENTITY_CONFLICT (1009): it binds this nodeId to a different key. Not retrying; check which key is genuine.`);
       this.emit('metric', { type: 'identity-conflict-refused-by-peer', peer: session.nodeId || session.relayFrom || null });
     }
-    if (session.kind === 'bonjour' && session.expectNodeId) this._pendingBonjour?.delete(session.expectNodeId);
+    if (session.kind === 'bonjour' && session.expectNodeId) {
+      this._pendingBonjour?.delete(session.expectNodeId);
+      if (!(info && info.wasConfirmed) && reason !== 'node-stopped') this._lanFailed(session.expectNodeId);
+    }
+    if (this._lanInFlight) this._lanInFlight.delete(session);
+    if (session.kind === 'relay' && session.role === 'client' && !(info && info.wasConfirmed) && reason !== 'node-stopped' && reason !== 'relay-disconnected') {
+      this._relayClientFailed(session.relayFrom);
+    }
+    // A relay handshake slot came free: the wait list goes next.
+    if (session.kind === 'relay' && this._running) this._schedulePumpRelay();
     if (session.kind === 'relay') {
       const st = this._relaySessions && this._relaySessions.get(session.relayFrom);
       if (st) {
@@ -3617,24 +3978,146 @@ class SymNode extends EventEmitter {
     });
     socket.on('error', (err) => {
       this._pendingBonjour.delete(peerId);
+      this._lanFailed(peerId);
       this._sayOncePerMinute(`dial|${peerId}`, `Connect failed to ${peerName}: ${err.message}`);
     });
-    socket.setTimeout(10000, () => { this._pendingBonjour.delete(peerId); socket.destroy(); });
+    socket.setTimeout(10000, () => { this._pendingBonjour.delete(peerId); this._lanFailed(peerId); socket.destroy(); });
+  }
+
+  /** @private A LAN dial or handshake to `peerId` failed: it waits longer before the next (review D). */
+  _lanFailed(peerId) {
+    if (!peerId) return;
+    if (!this._lanBackoff) this._lanBackoff = new Map();
+    const b = this._lanBackoff.get(peerId) || { failures: 0, nextAt: 0 };
+    b.failures++;
+    b.nextAt = Date.now() + Math.min(15_000 * 2 ** (b.failures - 1), LAN_BACKOFF_MAX_MS);
+    this._lanBackoff.delete(peerId);
+    if (this._lanBackoff.size >= 4096) this._lanBackoff.delete(this._lanBackoff.keys().next().value);
+    this._lanBackoff.set(peerId, b);
+  }
+
+  /**
+   * @private Before an inbound LAN handshake starts: past LAN_HANDSHAKES_PER_HOST authenticating from
+   * this remote host, or LAN_HANDSHAKES_MAX in all, the oldest goes (security review D, hello-cost).
+   */
+  _makeRoomForLanHandshake(remote) {
+    if (!this._lanInFlight) this._lanInFlight = new Set();
+    for (const s of [...this._lanInFlight]) if (s.closed || s.confirmed) this._lanInFlight.delete(s);
+    const host = String(remote || '?').replace(/:\d+$/, '');
+    const same = [...this._lanInFlight].filter((s) => String(s.remote || '?').replace(/:\d+$/, '') === host);
+    if (same.length >= LAN_HANDSHAKES_PER_HOST) same[0].close('handshake-evicted', { notify: false });
+    if (this._lanInFlight.size >= LAN_HANDSHAKES_MAX) {
+      const oldest = [...this._lanInFlight].find((s) => !s.closed);
+      if (oldest) oldest.close('handshake-evicted', { notify: false });
+    }
   }
 
   // ── Relay sessions (design D2) ─────────────────────────────
 
+  /** @private Whether `nodeId` is a peer this node knows: bound, pinned, routed, or a live peer. */
+  _isKnownPeer(nodeId) {
+    if (this._peers.has(nodeId)) return true;
+    if (this._roster.expected(nodeId) !== undefined) return true;
+    return !!(this._legacy && this._legacy.routeFor && this._legacy.routeFor(nodeId));
+  }
+
+  /** @private Relay handshakes in flight for unknown candidates. */
+  _relayUnknownInFlight() {
+    let n = 0;
+    if (this._relaySessions) for (const st of this._relaySessions.values()) {
+      if (st.client && st.client._unknownCandidate) n++;
+      if (st.server && st.server._unknownCandidate) n++;
+    }
+    return n;
+  }
+
+  /** @private `nodeId` waits for a relay handshake slot (see RELAY_UNKNOWN_MAX). */
+  _wantRelay(nodeId) {
+    if (!this._relayWanted) this._relayWanted = new Map();
+    if (!this._relayWanted.has(nodeId)) {
+      if (this._relayWanted.size >= 4096) this._relayWanted.delete(this._relayWanted.keys().next().value);
+      this._relayWanted.set(nodeId, { since: Date.now() });
+    }
+    this._schedulePumpRelay();
+  }
+
+  /** @private A relay client handshake with `nodeId` failed: an unknown one waits longer next time. */
+  _relayClientFailed(nodeId) {
+    if (!this._relayFailures) this._relayFailures = new Map();
+    const f = this._relayFailures.get(nodeId) || { failures: 0, nextAt: 0 };
+    f.failures++;
+    f.nextAt = Date.now() + Math.min(1000 * 2 ** f.failures, RELAY_UNKNOWN_BACKOFF_MAX_MS);
+    this._relayFailures.delete(nodeId);
+    if (this._relayFailures.size >= 4096) this._relayFailures.delete(this._relayFailures.keys().next().value);
+    this._relayFailures.set(nodeId, f);
+  }
+
+  /** @private Run the relay handshake wait list soon (one timer). */
+  _schedulePumpRelay(delay = 0) {
+    if (this._pumpTimer) return;
+    this._pumpTimer = setTimeout(() => { this._pumpTimer = null; this._pumpRelay(); }, delay);
+    if (this._pumpTimer.unref) this._pumpTimer.unref();
+  }
+
+  /**
+   * @private Start what the wait list's slots allow: known candidates first, then unknown ones by
+   * fewest failures, then the newest; one still backing off waits for its time.
+   */
+  _pumpRelay() {
+    if (!this._running || !this._relayWanted || !this._relayWanted.size) return;
+    const now = Date.now();
+    let soonest = Infinity;
+    const ready = [];
+    for (const [id, w] of [...this._relayWanted]) {
+      if (!this._relay.present.has(id) || (this._identityRefused && this._identityRefused.has(id))) { this._relayWanted.delete(id); continue; }
+      const st = this._relaySessions && this._relaySessions.get(id);
+      if (st && ((st.client && !st.client.closed) || [...st.confirmed].some((x) => !x.closed))) { this._relayWanted.delete(id); continue; }
+      const f = this._relayFailures && this._relayFailures.get(id);
+      if (f && f.nextAt > now) { soonest = Math.min(soonest, f.nextAt); continue; }
+      ready.push({ id, known: this._isKnownPeer(id), failures: f ? f.failures : 0, since: w.since });
+    }
+    ready.sort((a, b) => (a.known === b.known ? 0 : a.known ? -1 : 1) || a.failures - b.failures || b.since - a.since);
+    for (const c of ready) {
+      if (this._relayHandshakesInFlight() >= RELAY_HANDSHAKES_MAX) break;
+      if (!c.known && this._relayUnknownInFlight() >= RELAY_UNKNOWN_MAX) continue;
+      this._relayWanted.delete(c.id);
+      this._startRelayClient(c.id);
+    }
+    if (soonest !== Infinity) this._schedulePumpRelay(Math.max(50, soonest - now));
+  }
+
   /** @private Tell relay `from` that `sessionId` (or, null, any session) is not held here (rate-limited per from). */
   _sayUnknownSession(from, sessionId) {
     if (!this._unknownSessionSaid) this._unknownSessionSaid = new Map();
     const now = Date.now();
     if (now - (this._unknownSessionSaid.get(from) ?? -Infinity) < 1000) return;
+    // One small budget for every such reply (security review D, pacer-starve): a flood of strangers
+    // buys at most UNKNOWN_SESSION_PER_SECOND replies in all; past it they are dropped, not queued.
+    const b = this._unknownSessionBudget || (this._unknownSessionBudget = { tokens: UNKNOWN_SESSION_BURST, at: now });
+    b.tokens = Math.min(UNKNOWN_SESSION_BURST, b.tokens + ((now - b.at) * UNKNOWN_SESSION_PER_SECOND) / 1000);
+    b.at = now;
+    if (b.tokens < 1) { this._unknownSessionDropped = (this._unknownSessionDropped || 0) + 1; return; }
+    b.tokens -= 1;
+    // Least recently said first out: at most 1,024 froms remembered.
     this._unknownSessionSaid.delete(from);
     if (this._unknownSessionSaid.size >= 1024) this._unknownSessionSaid.delete(this._unknownSessionSaid.keys().next().value);
     this._unknownSessionSaid.set(from, now);
     try { this._relay.sendTo(from, { type: 'error', code: UNKNOWN_SESSION_CODE, message: 'unknown session', ...(sessionId ? { detail: `session:${sessionId}` } : {}) }); } catch { /* best effort */ }
   }
 
+  /** @private Close the oldest unknown relay handshake in flight (client or server). @returns {boolean} */
+  _evictOldestUnknownRelayHandshake() {
+    let oldest = null;
+    if (this._relaySessions) for (const st of this._relaySessions.values()) {
+      for (const x of [st.server, st.client]) {
+        if (x && !x.closed && !x.confirmed && x._unknownCandidate && (!oldest || x.startedAt < oldest.startedAt)) oldest = x;
+      }
+    }
+    if (!oldest) return false;
+    oldest.close('handshake-evicted', { notify: false });
+    return true;
+  }
+
   /** @private How many relay handshakes (client or server) are in flight. */
   _relayHandshakesInFlight() {
     let n = 0;
@@ -3680,12 +4163,20 @@ class SymNode extends EventEmitter {
   /** @private Send a client-hello to `nodeId` over the relay (one handshake in flight at a time). */
   _startRelayClient(nodeId) {
     if (!this._running) return;
+    if (this._identityRefused && this._identityRefused.has(nodeId)) return; // 1009: not retried (review F)
     const cur = this._relaySessions && this._relaySessions.get(nodeId);
     if (cur && cur.client && !cur.client.closed) return;
-    // At most RELAY_HANDSHAKES_MAX in flight: the rest wait their turn on the retry backoff.
-    if (this._relayHandshakesInFlight() >= RELAY_HANDSHAKES_MAX) { this._scheduleRelayRetry(nodeId); return; }
+    // At most RELAY_HANDSHAKES_MAX in flight, and at most RELAY_UNKNOWN_MAX of them for unknown
+    // candidates: the rest wait in turn (_pumpRelay). An unknown one still backing off waits too.
+    const unknown = !this._isKnownPeer(nodeId);
+    const f = unknown && this._relayFailures && this._relayFailures.get(nodeId);
+    if (this._relayHandshakesInFlight() >= RELAY_HANDSHAKES_MAX || (unknown && this._relayUnknownInFlight() >= RELAY_UNKNOWN_MAX) || (f && f.nextAt > Date.now())) {
+      this._wantRelay(nodeId);
+      return;
+    }
     const st = this._relayState(nodeId);
     st.client = this._attachTransport(this._relay.transportFor(nodeId), { role: 'client', kind: 'relay', relayFrom: nodeId, expectNodeId: nodeId });
+    st.client._unknownCandidate = unknown;
   }
 
   /** @private Re-handshake with a present relay peer, backing off 1 s, 2 s, … 30 s. */
@@ -3741,13 +4232,29 @@ class SymNode extends EventEmitter {
       case 'client-hello': {
         // The smaller nodeId is the client (design D2): a hello from a larger one is not taken.
         if (!(from < this.nodeId)) { refuse('client-hello-from-larger-id'); return; }
-        // A hello costs a key agreement and a signature: at most RELAY_HANDSHAKES_MAX are in flight
-        // over the relay at once (relay `from`s are free to mint); past it a new hello is refused.
-        if (!(st && st.server) && this._relayHandshakesInFlight() >= RELAY_HANDSHAKES_MAX) { refuse('too-many-handshakes'); return; }
+        // A relay `from`'s hellos are rate-limited (a hello costs a key agreement and a signature).
+        if (!takeToken(this._relayHelloBuckets || (this._relayHelloBuckets = new Map()), from, RELAY_HELLO_PER_SECOND, RELAY_HELLO_BURST, Date.now(), 4096)) { refuse('hello-rate'); return; }
+        // One authenticating slot per (relay, from): a new hello retires the one in flight. At most
+        // RELAY_HANDSHAKES_MAX in flight in all, at most RELAY_UNKNOWN_MAX for unknown froms; past
+        // a share, the oldest unknown handshake in flight goes, so a flood of hellos that never
+        // finish holds slots only until newer hellos arrive (security review D, relay-slots).
+        const unknown = !this._isKnownPeer(from);
+        const prev = st && st.server && !st.server.closed && !st.server.confirmed ? st.server : null;
+        if (!prev) {
+          const full = this._relayHandshakesInFlight() >= RELAY_HANDSHAKES_MAX;
+          const unknownFull = unknown && this._relayUnknownInFlight() >= RELAY_UNKNOWN_MAX;
+          if (full || unknownFull) {
+            if (!this._evictOldestUnknownRelayHandshake()) { refuse('too-many-handshakes'); return; }
+          }
+        }
         const s = this._relayState(from);
-        if (s.server && !s.server.closed && !s.server.confirmed) s.server.close('superseded-hello', { notify: false });
-        s.server = this._attachTransport(this._relay.transportFor(from), { role: 'server', kind: 'relay', relayFrom: from, expectNodeId: from });
-        s.server.receiveWire(payload);
+        // The new session is attached before the old one closes, so the relay state entry (which lives
+        // only while a session for this `from` does) is never dropped from under it (review item 11).
+        const next = this._attachTransport(this._relay.transportFor(from), { role: 'server', kind: 'relay', relayFrom: from, expectNodeId: from });
+        next._unknownCandidate = unknown;
+        s.server = next;
+        if (prev) prev.close('superseded-hello', { notify: false });
+        next.receiveWire(payload);
         return;
       }
       case 'server-hello':
@@ -3782,22 +4289,16 @@ class SymNode extends EventEmitter {
         return;
       }
       case 'error': {
-        if (!st) return;
+        // A CLEAR error over the relay is anyone's to write (security review F): it never closes a
+        // session. Only 1011 UNKNOWN_SESSION means something: the peer holds no session with this node
+        // (its process restarted). The client re-handshakes and keeps the session it has until the new
+        // one confirms and supersedes it; the server waits for the client's hello. A session's own
+        // errors (1010 closing, 1009 identity conflict) arrive sealed, on the session.
         if (payload.code === UNKNOWN_SESSION_CODE) {
-          // The peer holds no session with this node (its process restarted). The client re-handshakes
-          // and keeps the session it has until the new one confirms and supersedes it — no peer-left
-          // for a restart; the server waits for the client's hello. Never a teardown on its own.
-          if (this.nodeId < from && this._relay.present.has(from)) this._startRelayClient(from);
+          if (st && this.nodeId < from && this._relay.present.has(from)) this._startRelayClient(from);
           return;
         }
-        const m = typeof payload.detail === 'string' && /^session:([0-9a-f]{32})$/.exec(payload.detail);
-        // 1009: the peer's registry binds this node's nodeId to another key. Not retried (said once).
-        const why = payload.code === IDENTITY_CONFLICT ? 'identity-conflict' : 'peer-closed';
-        for (const s of [st.client, st.server, ...st.confirmed]) {
-          if (!s || s.closed) continue;
-          if (m && s.sessionId && s.sessionId !== m[1]) continue;
-          s.close(why, { notify: false });
-        }
+        refuse('clear-error-ignored');
         return;
       }
       default:
@@ -3858,9 +4359,15 @@ class SymNode extends EventEmitter {
   _roomDoor(peerId) {
     const v = this._roomVerdicts && this._roomVerdicts.get(peerId);
     if (v && !v.admit) return { pass: false, reason: v.reason || 'refused at admission' };
-    if (this._peers.has(peerId)) return { pass: true };
-    if (v) return { pass: true };
     const owner = this._roomOwners && this._roomOwners.ownerOf(this._room);
+    const peer = this._peers.get(peerId);
+    if (peer) {
+      // A Legacy Import peer never passes a gated room's door (security review E): it proved no key.
+      const ts = peer.transports ? [...peer.transports.values()] : [];
+      if (owner && ts.length > 0 && ts.every((t) => t.legacy)) return { pass: false, reason: `a Legacy Import peer cannot join gated room '${this._room}'` };
+      return { pass: true };
+    }
+    if (v) return { pass: true };
     if (owner) return { pass: false, reason: `spoke into gated room '${this._room}' without joining it` };
     return { pass: true };
   }
diff --git a/lib/relay.js b/lib/relay.js
index 52380710..63a44022 100644
--- a/lib/relay.js
+++ b/lib/relay.js
@@ -34,6 +34,75 @@ const RELAY_RATE_PER_SECOND = 20;
 const RELAY_BURST = 200;
 /** Frames waiting for the pacer at most; past it a send is refused (`queue-full`), never dropped silently. */
 const RELAY_QUEUE_MAX = 10_000;
+/**
+ * THE PACER IS FAIR (security review D, pacer-starve): one FIFO carried everything at the relay's
+ * rate, so replies to a flood of strangers queued ahead of an honest session's records. Now each
+ * frame waits in its CLASS — 0: confirmed-session traffic (sealed frames, ping/pong, Legacy Import
+ * records), 1: handshakes, 2: everything else (a 1011 reply, an error) — and within a class in its
+ * destination's own queue, the destinations served in turn. A higher class always goes first.
+ * Class 2 holds at most CLASS2_MAX frames (past it a send is refused), and one destination at most
+ * PER_DESTINATION_MAX.
+ */
+const CLASS2_MAX = 64;
+const PER_DESTINATION_MAX = 2048;
+/** Bytes waiting for one destination, at most (a 1 MiB frame each could otherwise pile up). */
+const PER_DESTINATION_BYTES = 8 * 1024 * 1024;
+const CLASS0 = new Set(['cmb-encrypted', 'control-encrypted', 'ping', 'pong', 'cmb']);
+const CLASS1 = new Set(['client-hello', 'server-hello', 'client-finish', 'handshake']);
+const classOf = (payload) => {
+  const t = payload && payload.type;
+  return CLASS0.has(t) ? 0 : CLASS1.has(t) ? 1 : 2;
+};
+
+/**
+ * One FIFO per destination, so a destination's frames leave in the order they were sent (a
+ * client-finish before the sealed frames that follow it); the destinations wait in the CLASS of the
+ * frame at their head, a higher class served first and destinations within a class in turn.
+ */
+class FairQueue {
+  constructor() { this.clear(); }
+  clear() { this.byTo = new Map(); this.bytesTo = new Map(); this.ready = [new Map(), new Map(), new Map()]; this.class2 = 0; this.length = 0; }
+  /** Bytes waiting for `to`. */
+  bytesFor(to) { return this.bytesTo.get(to) || 0; }
+  /** @returns {string|null} why it was not queued, or null */
+  push(cls, item) {
+    if (this.length >= RELAY_QUEUE_MAX) return 'queue-full';
+    if (cls === 2 && this.class2 >= CLASS2_MAX) return 'queue-full';
+    let q = this.byTo.get(item.to);
+    if (!q) { q = []; this.byTo.set(item.to, q); }
+    if (q.length >= PER_DESTINATION_MAX || this.bytesFor(item.to) + item.bytes > PER_DESTINATION_BYTES) return 'queue-full';
+    item.cls = cls;
+    q.push(item);
+    this.bytesTo.set(item.to, this.bytesFor(item.to) + item.bytes);
+    if (cls === 2) this.class2++;
+    this.length++;
+    if (q.length === 1) this.ready[cls].set(item.to, true);
+    return null;
+  }
+  /**
+   * Take the next frame: the destination first in turn in the highest class holding one, skipping
+   * destinations in `exclude` and a head frame that does not fit in `room` bytes. @returns {object|null}
+   */
+  take(exclude = null, room = Infinity) {
+    for (let cls = 0; cls < 3; cls++) {
+      for (const to of this.ready[cls].keys()) {
+        if (exclude && exclude.has(to)) continue;
+        const q = this.byTo.get(to);
+        if (q[0].bytes > room) continue;
+        const item = q.shift();
+        const left = this.bytesFor(to) - item.bytes;
+        if (left > 0) this.bytesTo.set(to, left); else this.bytesTo.delete(to);
+        this.ready[cls].delete(to);
+        if (item.cls === 2) this.class2--;
+        this.length--;
+        if (q.length) this.ready[q[0].cls].set(to, true); // to the back of its head's class
+        else this.byTo.delete(to);
+        return item;
+      }
+    }
+    return null;
+  }
+}
 /**
  * The fan-out envelope (design D4; MMP spec draft PR meshcognition-website#25, for sym-relay 0.6.0):
  * `{ fanout: [{ to, payload }, …] }` is one client message, counted once toward the relay's rate,
@@ -128,7 +197,7 @@ class RelayConnection {
     this._rate = (opts.rate && opts.rate.perSecond) || RELAY_RATE_PER_SECOND;
     this._burst = (opts.rate && opts.rate.burst) || RELAY_BURST;
     this._bucket = { tokens: this._burst, at: Date.now() };
-    this._queue = [];                 // [{ to, payload }] in send order
+    this._queue = new FairQueue();    // per class, per destination (see FairQueue)
     this._flushTimer = null;
     this._flushScheduled = false;
     this._fanout = null;              // { max } when the relay advertises fan-out
@@ -405,7 +474,7 @@ class RelayConnection {
       // Section 4.6 + 5.5: every relay session ends with the connection it was bound to; a peer
       // reachable over the LAN keeps that session. What was queued for the pacer is dropped with it.
       this._present.clear();
-      this._queue = [];
+      this._queue.clear();
       if (this._flushTimer) { clearTimeout(this._flushTimer); this._flushTimer = null; }
       try { this._onDisconnected(); } catch (err) { this._log(`Relay disconnect handling failed: ${err && err.message}`); }
 
@@ -555,6 +624,8 @@ class RelayConnection {
         return relay.sendTo(nodeId, frame);
       },
       send(frame) { return this.trySend(frame).ok; },
+      /** Bytes waiting in the pacer for this peer (an outbound byte budget). */
+      pendingBytes() { return relay._queue.bytesFor(nodeId); },
       close() { this._closed = true; },
       destroy() { this._closed = true; },
     };
@@ -575,8 +646,8 @@ class RelayConnection {
     // MMP §4.1: senders MUST NOT produce frames over MAX_FRAME_SIZE; the relay would close the whole
     // shared connection (1009) rather than drop one frame.
     if (bytes > MAX_FRAME_SIZE) return { ok: false, reason: SEND_FAILURE.TOO_LARGE, bytes };
-    if (this._queue.length >= RELAY_QUEUE_MAX) return { ok: false, reason: 'queue-full', bytes };
-    this._queue.push({ to, payload, data, bytes });
+    const refused = this._queue.push(classOf(payload), { to, payload, data, bytes });
+    if (refused) return { ok: false, reason: refused, bytes };
     this._scheduleFlush();
     return { ok: true, bytes };
   }
@@ -609,21 +680,23 @@ class RelayConnection {
       }
       let data;
       if (this._fanout && this._queue.length > 1) {
-        // Consecutive payloads, in order, up to FANOUT_MAX and the frame bound, and never a recipient
-        // twice in one envelope (the batch ends at the first repeat, so per-recipient order holds).
+        // Frames in the queue's own order (class, then destinations in turn), up to FANOUT_MAX and the
+        // frame bound, and never a recipient twice in one envelope, so per-recipient order holds.
         const batch = [];
         const to = new Set();
         let size = 16;
-        while (this._queue.length && batch.length < this._fanout.max && !to.has(this._queue[0].to) && size + this._queue[0].bytes + 1 <= MAX_FRAME_SIZE) {
-          const q = this._queue.shift();
+        while (batch.length < this._fanout.max) {
+          const q = this._queue.take(to, MAX_FRAME_SIZE - size - 1);
+          if (!q) break;
           batch.push(q);
           to.add(q.to);
           size += q.bytes + 1;
         }
+        if (!batch.length) batch.push(this._queue.take());
         data = batch.length === 1 ? batch[0].data : JSON.stringify({ fanout: batch.map((q) => ({ to: q.to, payload: q.payload })) });
         if (batch.length > 1) this._sentFanout++;
       } else {
-        data = this._queue.shift().data;
+        data = this._queue.take().data;
       }
       b.tokens -= 1;
       try { ws.send(data); this._sentFrames++; } catch (err) { this._log(`Relay send failed: ${err && err.message}`); }
@@ -663,7 +736,7 @@ class RelayConnection {
     if (this._relayPingTimer) { clearInterval(this._relayPingTimer); this._relayPingTimer = null; }
 
     this._present.clear();
-    this._queue = [];
+    this._queue.clear();
     if (this._flushTimer) { clearTimeout(this._flushTimer); this._flushTimer = null; }
 
     if (this._relayWs) {
@@ -677,4 +750,4 @@ class RelayConnection {
   }
 }
 
-module.exports = { RelayConnection, RELAY_RATE_PER_SECOND, RELAY_BURST, FANOUT_FEATURE, FANOUT_MAX, HARD_STOPS };
+module.exports = { RelayConnection, RELAY_RATE_PER_SECOND, RELAY_BURST, FANOUT_FEATURE, FANOUT_MAX, HARD_STOPS, FairQueue, CLASS2_MAX };
diff --git a/lib/relocation.js b/lib/relocation.js
index 10cb75ae..bbdffcaa 100644
--- a/lib/relocation.js
+++ b/lib/relocation.js
@@ -5,18 +5,26 @@
  * @description Moving a node to another host (sym 0.14, design D9.2). §3.1.3: "The private key MUST
  * NOT leave the node" — so a node is MOVED, never copied:
  *
- *   - `exportNode` writes a TOMBSTONE at the source FIRST, then the bundle. The source refuses to
- *     start that identity from then on (config.js IdentityTombstonedError), so no copy remains live:
- *     the relay's 4004 replacement cannot produce two live copies, because the source is tombstoned
- *     before the bundle exists.
+ *   - `exportNode` holds the identity's lock throughout (no process can start it meanwhile), writes a
+ *     TOMBSTONE at the source FIRST, then the bundle (fsynced, renamed into place, its directory
+ *     fsynced). The source refuses to start that identity from then on (config.js
+ *     IdentityTombstonedError), so no copy remains live: the relay's 4004 replacement cannot produce
+ *     two live copies, because the source is tombstoned before the bundle exists. Once the bundle
+ *     is durable the source LOSES THE KEY (security review): identity.json is rewritten without its
+ *     private key, and the 0.13-compatible `nodes/<name>` link goes, so a 0.13 build on the source
+ *     host (a rollback) cannot load the moved identity either.
  *   - The bundle holds the node's directory — its identity, store, key registry, grants and learned
  *     state — encrypted under an operator passphrase (scrypt → AES-256-GCM) or to a target host's
  *     X25519 key (ephemeral X25519 + HKDF-SHA256 → AES-256-GCM).
- *   - `importNode` verifies the bundle against an INDEPENDENTLY PINNED (nodeId, key): one the
- *     operator gives (`expect`: the key or its sha256 fingerprint, e.g. from a validator's preserve
- *     act), or, absent that, a proven or pinned binding this host's own nodes already hold for that
- *     nodeId. It never relies on anything the bundle says about itself: a bundle whose identity was
- *     re-keyed (signed by another key) is refused.
+ *   - The bundle is SIGNED by the moving node's identity key, over its format, nodeId, sealing header
+ *     (the target host key and ephemeral key included) and the digest of its contents (security
+ *     review): a bundle sealed to a host key, which anyone holding that public key can seal, is
+ *     authenticated by the node itself, and cannot be re-wrapped for another host.
+ *   - `importNode` verifies the bundle against an EXPLICIT, INDEPENDENTLY PINNED (nodeId, key): one
+ *     the operator gives (`expect`: the key or its sha256 fingerprint, e.g. from a validator's
+ *     preserve act). There is no fallback to a key this host learned on first contact (security
+ *     review). It never relies on anything the bundle says about itself: a bundle whose identity was
+ *     re-keyed, or whose signature does not verify under the pinned key, is refused.
  *
  * @copyright 2026 SYM.BOT. Apache 2.0 License.
  */
@@ -65,8 +73,8 @@ function listFiles(root, rel = '') {
   return out;
 }
 
-function seal(plain, { passphrase, toHostKey }) {
-  const nonce = crypto.randomBytes(12);
+/** The sealing key and its header, chosen before anything is sealed (so a signature can cover it). */
+function sealParams({ passphrase, toHostKey }) {
   let key;
   let header;
   if (typeof passphrase === 'string' && passphrase.length >= 12) {
@@ -85,9 +93,19 @@ function seal(plain, { passphrase, toHostKey }) {
   } else {
     throw new Error('relocation: a passphrase (at least 12 characters) or a target host key is required');
   }
+  return { key, header };
+}
+
+function sealWith(plain, { key }) {
+  const nonce = crypto.randomBytes(12);
   const c = crypto.createCipheriv('aes-256-gcm', key, nonce);
   const body = Buffer.concat([c.update(plain), c.final()]);
-  return { ...header, nonce: nonce.toString('base64url'), ciphertext: Buffer.concat([body, c.getAuthTag()]).toString('base64url') };
+  return { nonce: nonce.toString('base64url'), ciphertext: Buffer.concat([body, c.getAuthTag()]).toString('base64url') };
+}
+
+function seal(plain, opts) {
+  const p = sealParams(opts);
+  return { ...p.header, ...sealWith(plain, p) };
 }
 
 function unseal(bundle, { passphrase, hostPrivateKey }) {
@@ -145,6 +163,17 @@ function exportNode({ name, nodeId, out, passphrase, toHostKey } = {}) {
   }
   // Validate the sealing input before the tombstone: a refused export must leave the node startable.
   seal(Buffer.alloc(0), { passphrase, toHostKey });
+  // The identity's lock, held until the export is done: no process starts it in between.
+  const release = config.acquireIdentityLock(identity.name, { dir });
+  try {
+    return exportLocked({ id, dir, identity, out, passphrase, toHostKey });
+  } finally {
+    try { release(); } catch { /* the lock goes with the process either way */ }
+  }
+}
+
+/** @private The export, under the identity's lock. */
+function exportLocked({ id, dir, identity, out, passphrase, toHostKey }) {
   // THE TOMBSTONE FIRST. From here this host refuses to start the identity, before any bundle exists.
   const tomb = { nodeId: id, name: identity.name, movedAt: Date.now(), bundle: path.basename(out), fingerprint: keyFingerprint(identity.publicKey) };
   const tombPath = path.join(dir, config.TOMBSTONE);
@@ -155,32 +184,72 @@ function exportNode({ name, nodeId, out, passphrase, toHostKey } = {}) {
   if (!files.some((f) => f.path === 'identity.json')) {
     files.push({ path: 'identity.json', data: Buffer.from(JSON.stringify(identity, null, 2)).toString('base64') });
   }
-  const plain = Buffer.from(JSON.stringify({ format: FORMAT, nodeId: id, name: identity.name, publicKey: identity.publicKey, exportedAt: tomb.movedAt, files }), 'utf8');
-  const bundle = { format: FORMAT, nodeId: id, fingerprint: tomb.fingerprint, ...seal(plain, { passphrase, toHostKey }) };
+  const contents = { format: FORMAT, nodeId: id, name: identity.name, publicKey: identity.publicKey, exportedAt: tomb.movedAt, files };
+  // The sealing header is chosen first, so the node's signature covers it (the target host key and
+  // the ephemeral key included): the bundle is the node's own statement, for that host only.
+  const sealing = sealParams({ passphrase, toHostKey });
+  const header = { format: FORMAT, nodeId: id, fingerprint: tomb.fingerprint, ...sealing.header };
+  const signature = signBundle(header, contents, identity.privateKey);
+  const plain = Buffer.from(JSON.stringify({ ...contents, signature }), 'utf8');
+  const bundle = { ...header, ...sealWith(plain, sealing) };
   const tmp = `${out}.${process.pid}.tmp`;
-  fs.writeFileSync(tmp, JSON.stringify(bundle), { mode: 0o600 });
+  const bfd = fs.openSync(tmp, 'w', 0o600);
+  try { fs.writeSync(bfd, JSON.stringify(bundle)); fs.fsyncSync(bfd); } finally { fs.closeSync(bfd); }
   fs.renameSync(tmp, out);
+  fsyncDir(path.dirname(path.resolve(out)));
+  // The bundle is durable: the source loses the key, and the 0.13 path to it.
+  scrubSource(id, identity);
   return { nodeId: id, name: identity.name, files: files.length, out, fingerprint: tomb.fingerprint };
 }
 
-/** A proven or pinned key this host's nodes hold for `nodeId` (the target host's roster entry), or null. */
-function hostPinFor(nodeId) {
-  const root = path.join(config.NODES_DIR, 'by-id');
-  let dirs = [];
-  try { dirs = fs.readdirSync(root); } catch { return null; }
-  for (const d of dirs) {
-    let text;
-    try { text = fs.readFileSync(path.join(root, d, 'roster-keys', 'roster-keys.jsonl'), 'utf8'); } catch { continue; }
-    let found = null;
-    for (const line of text.split('\n')) {
-      let r;
-      try { r = JSON.parse(line); } catch { continue; }
-      if (r && r.nodeId === nodeId && r.expired === true) found = null; // the binding expired (design D3)
-      else if (r && r.nodeId === nodeId && (r.source === 'proven' || r.source === 'pinned') && isIdentityKey(r.key)) found = r.key;
-    }
-    if (found) return found;
+/** @private fsync a directory (a rename in it is durable after this); best effort where unsupported. */
+function fsyncDir(dir) {
+  let fd;
+  try { fd = fs.openSync(dir, 'r'); fs.fsyncSync(fd); } catch { /* not supported here (Windows) */ } finally { if (fd !== undefined) try { fs.closeSync(fd); } catch { /* */ } }
+}
+
+/**
+ * @private After a durable export: identity.json (in the node dir and SYM_IDENTITY_DIR) without its
+ * private key, written atomically, and the 0.13-compatible `nodes/<name>` links removed.
+ */
+function scrubSource(id, identity) {
+  const { privateKey, ...rest } = identity;
+  void privateKey;
+  const scrubbed = JSON.stringify({ ...rest, privateKey: null, movedAt: Date.now() }, null, 2);
+  for (const d of new Set([config.nodeDirById(id), config.identityDirById(id)])) {
+    const f = path.join(d, 'identity.json');
+    if (!fs.existsSync(f)) continue;
+    const tmp = `${f}.${process.pid}.tmp`;
+    const fd = fs.openSync(tmp, 'w', 0o600);
+    try { fs.writeSync(fd, scrubbed); fs.fsyncSync(fd); } finally { fs.closeSync(fd); }
+    fs.renameSync(tmp, f);
+    fsyncDir(d);
+  }
+  for (const root of [config.NODES_DIR, process.env.SYM_IDENTITY_DIR].filter(Boolean)) {
+    const link = path.join(root, identity.name);
+    try { if (fs.lstatSync(link).isSymbolicLink()) fs.unlinkSync(link); } catch { /* none */ }
   }
-  return null;
+}
+
+/** @private The canonical bytes a bundle's signature covers. */
+function bundleSigned(header, contents) {
+  const digest = crypto.createHash('sha256');
+  for (const f of contents.files) digest.update(String(f.path)).update('\0').update(String(f.data)).update('\n');
+  const h = Object.keys(header).sort().map((k) => `${k}=${header[k]}`).join('\n');
+  return Buffer.from(`sym-node-bundle-v1-signature\n${h}\nnodeId=${contents.nodeId}\npublicKey=${contents.publicKey}\nname=${contents.name}\nexportedAt=${contents.exportedAt}\nfiles=${digest.digest('hex')}`, 'utf8');
+}
+
+function signBundle(header, contents, privateKeyB64url) {
+  const priv = crypto.createPrivateKey({ key: Buffer.concat([ED25519_PKCS8_PREFIX, Buffer.from(privateKeyB64url, 'base64url')]), format: 'der', type: 'pkcs8' });
+  return crypto.sign(null, bundleSigned(header, contents), priv).toString('base64url');
+}
+
+function verifyBundle(header, contents, signature, publicKeyB64url) {
+  if (typeof signature !== 'string') return false;
+  try {
+    const pub = crypto.createPublicKey({ key: Buffer.concat([Buffer.from('302a300506032b6570032100', 'hex'), Buffer.from(publicKeyB64url, 'base64url')]), format: 'der', type: 'spki' });
+    return crypto.verify(null, bundleSigned(header, contents), pub, Buffer.from(signature, 'base64url'));
+  } catch { return false; }
 }
 
 /**
@@ -212,13 +281,18 @@ function importNode({ from, passphrase, hostPrivateKey, expect, name } = {}) {
     if (expect.key) { pinned = expect.key; pinnedBy = 'operator key'; }
     else if (expect.fingerprint) { pinned = { fingerprint: expect.fingerprint }; pinnedBy = 'operator fingerprint'; }
   }
-  if (!pinned) {
-    const k = hostPinFor(identity.nodeId);
-    if (k) { pinned = k; pinnedBy = 'this host\'s key registry'; }
-  }
-  if (!pinned) throw new Error(`relocation: refusing ${identity.nodeId}: no independently pinned key (give --expect-key or --expect-fingerprint, from the validator's preserve act or the source host)`);
+  // No fallback to a key this host learned on first contact (security review): the pin is explicit.
+  if (!pinned) throw new Error(`relocation: refusing ${identity.nodeId}: no explicit pinned key (give --expect-key or --expect-fingerprint, from the validator's preserve act or the source host)`);
   const ok = typeof pinned === 'string' ? pinned === identity.publicKey : keyFingerprint(identity.publicKey) === pinned.fingerprint;
   if (!ok) throw new Error(`relocation: refusing ${identity.nodeId}: the bundle's key is not the pinned one (${pinnedBy}) — a re-keyed bundle`);
+  // The node's own signature over the bundle: header (the sealing it was made for), identity and
+  // contents. A bundle without one, or one that does not verify under the pinned key, is refused.
+  const { ciphertext, nonce, ...header } = bundle;
+  void ciphertext; void nonce;
+  const contents = { format: plain.format, nodeId: plain.nodeId, name: plain.name, publicKey: plain.publicKey, exportedAt: plain.exportedAt, files: plain.files || [] };
+  if (plain.nodeId !== identity.nodeId || plain.publicKey !== identity.publicKey || header.nodeId !== identity.nodeId || !verifyBundle(header, contents, plain.signature, identity.publicKey)) {
+    throw new Error(`relocation: refusing ${identity.nodeId}: the bundle is not signed by the node it carries (or its header or contents were changed)`);
+  }
   const dest = config.nodeDirById(identity.nodeId);
   if (fs.existsSync(dest)) {
     if (!config.readTombstone(identity.nodeId)) throw new Error(`relocation: ${identity.nodeId} already lives on this host`);
diff --git a/lib/role-grant-store.js b/lib/role-grant-store.js
index 9aa6663e..6dba6eeb 100644
--- a/lib/role-grant-store.js
+++ b/lib/role-grant-store.js
@@ -22,23 +22,37 @@
  *     holds for G. So a grantor whose id the registry binds to an impostor still has exactly the
  *     authority its vouched key has, and the impostor has none.
  *
- * A record is KEPT only when it is rooted at the anchor: its grantor held, at the time it signed, the
- * rank the record needs (a grant: the rank it confers; a revoke: validator or above), under the key
- * that signed it, by the chain this store already holds (0.13.17). An unrooted record has no effect
- * on any resolution, so it is not stored, not relayed, and costs nothing. Resolution still re-checks
- * every chain (role-at-time, revocation cascades). Reloading from disk runs the same checks — the file
- * has no integrity of its own, so nothing is trusted for being on it (0.13.17's record() path).
+ * AUTHORITY COUNTS ONLY IF THE SIGNER WAS AUTHORISED BOTH WHEN IT SIGNED AND WHEN THIS NODE
+ * RECEIVED IT (security review C). One rule for a grant, a key vouch, a revoke and an attestation: a
+ * signer revoked at t can still sign a statement dated before t (the date is its own to write), so
+ * the signed time alone let a revoked validator backdate grants, key vouches and revokes into its
+ * old window. Each record keeps the time this node received it (`receivedAt`, persisted with it),
+ * and its signer's rank is taken at both times, the lower counting.
  *
- * A rooted grant's vouched key is pinned into the key registry at `grant` strength, by the registry's
- * conflict matrix (a different key already bound is a conflict, never an override).
+ * A record is KEPT only when it is rooted at the anchor: its grantor held, both when it signed and
+ * when it was received, the rank the record needs (a grant: the rank it confers; a revoke: validator
+ * or above), under the key that signed it, by the chain this store already holds. An unrooted record
+ * has no effect on any resolution, so it is not stored, not relayed, and costs nothing. Resolution
+ * still re-checks every chain (role-at-time, revocation cascades, the rank at receipt). Reloading from
+ * disk runs the same checks, each record at its persisted receipt time (the file has no integrity of
+ * its own, so nothing is trusted for being on it; a receipt time is never before its signed time and
+ * never after the load). A line written before 0.14 has no receipt time: it is treated as received
+ * at load (draft spec PR meshcognition-website#33), and the file is rewritten with that time.
+ *
+ * A KEY VOUCH is a view (security review C): `vouchedKey(nodeId)` is the one key the grants in effect
+ * NOW vouch for nodeId, and the key registry reads it on demand instead of storing a `grant` binding,
+ * so a vouch ends when its grant stops being in effect. A grant never vouches this node's own nodeId
+ * (`opts.selfId`). A grant naming a key the registry binds otherwise is recorded there as a conflict.
  *
  * @copyright 2026 SYM.BOT. Apache 2.0 License.
  */
 
 const fs = require('fs');
 const path = require('path');
+const crypto = require('crypto');
 const { verifyGrant, roleRank } = require('./core');
 const { sigKey } = require('./attestation-store');
+const { isCanonicalNodeId } = require('./core/record-canonical');
 
 const GRANTS_FILE = 'role-grants.jsonl';
 /**
@@ -50,8 +64,23 @@ const GRANTS_FILE = 'role-grants.jsonl';
  * grantor adds to the grantee's role resolution, which every gating decision runs.
  */
 const MAX_PER_GRANTOR = 1024;
-const MAX_PER_PAIR = 64;
+// 16 per pair (64 until 0.14): a grant, a revoke and a re-grant, several times over, is all an
+// honest grantor needs, and what one pair holds is replayed at every resolution of the grantee.
+const MAX_PER_PAIR = 16;
 const MAX_GRANTS = 65536;
+/** A record dated further than this into the future (by this node's clock) is refused. */
+const MAX_FUTURE_MS = 10 * 60 * 1000;
+/** Field bounds (security review D): a nodeId, a role name. A key and a signature have fixed lengths. */
+const MAX_ID = 128;
+const MAX_ROLE = 32;
+/** resolveRole's memo is cleared when it holds this many answers (and whenever a record is kept). */
+const MEMO_MAX = 65536;
+/**
+ * Delegation depth (security review D, role-linear): a role reaches at most this many grants from the
+ * anchor (the anchor's own grantee is at depth 1). MMP §6.6 sets no depth; 8 is sym's, proposed for
+ * the spec, and the role-chain answer already stops there.
+ */
+const MAX_DELEGATION_DEPTH = 8;
 
 class RoleGrantStore {
   /**
@@ -65,7 +94,18 @@ class RoleGrantStore {
    */
   constructor(opts = {}) {
     this._anchor = opts.anchor || null;
+    this._selfId = typeof opts.selfId === 'string' && opts.selfId ? opts.selfId : null;
+    this._selfKey = typeof opts.selfKey === 'string' && opts.selfKey ? opts.selfKey : null;
+    // Told of a kept grant that names this node with a key that is not its own (draft spec PR #33:
+    // inert, and reported, since someone vouched a foreign key for this node's identity).
+    this._onForeignSelfGrant = typeof opts.onForeignSelfGrant === 'function' ? opts.onForeignSelfGrant : null;
+    this._now = typeof opts.now === 'function' ? opts.now : Date.now;
     this._keys = opts.keys || new Map();
+    this._receivedAt = new Map(); // sigKey -> when this node received the record (ms epoch)
+    this._memo = new Map();       // `${nodeId}\0${key}\0${canonical at}` -> { role, depth } (cleared on every change)
+    this._times = [];             // every record's grantedAt, sorted, distinct: resolution's breakpoints
+    this._memoKeys = new Map();   // nodeId -> Set(memo keys of its answers), to forget one subtree
+    this._grantees = new Map();   // grantor nodeId -> Set(grantee nodeIds it signed records for)
     this._byGrantee = new Map(); // grantee nodeId -> [grant/revoke records]
     this._vouched = new Map();   // nodeId -> Set(keys its rooted role-grants vouch)
     this._signer = new Map();    // sigKey -> the key that verified the record
@@ -120,19 +160,24 @@ class RoleGrantStore {
    * passed on. Never throws: a record whose checks fail in a way no reason names is 'unverifiable'.
    * @returns {{ stored: boolean, reason?: string, grant?: object }}
    */
-  record(grant) {
+  record(grant, opts = {}) {
     try {
-      return this._record(grant);
+      return this._record(grant, opts);
     } catch {
       return { stored: false, reason: 'unverifiable' };
     }
   }
 
   /** @private */
-  _record(grant) {
+  _record(grant, { receivedAt } = {}) {
     if (malformed(grant)) return { stored: false, reason: 'malformed' };
     const sk = sigKey(grant.sig);
     if (this._seen.has(sk)) return { stored: false, reason: 'duplicate' };
+    const now = this._now();
+    // The time this node received it: now, or (reloading) the persisted time, never before the signed
+    // time and never after now.
+    receivedAt = Number.isFinite(receivedAt) ? Math.min(Math.max(receivedAt, grant.grantedAt), now) : now;
+    if (grant.grantedAt > receivedAt + MAX_FUTURE_MS) return { stored: false, reason: 'future-dated' };
     const fromAnchor = !!this._anchor && grant.grantedBy === this._anchor.nodeId;
     const pair = `${grant.grantedBy}\u0000${grant.grantee}`;
     if (!fromAnchor) {
@@ -143,7 +188,7 @@ class RoleGrantStore {
     const candidates = this.grantorKeys(grant.grantedBy);
     if (candidates.length === 0) return { stored: false, reason: 'unknown-grantor-key' };
     // Rooted first (no signature work for a record no key could root), then the signature.
-    const rooted = candidates.filter((k) => this._rooted(grant, k));
+    const rooted = candidates.filter((k) => this._rooted(grant, k, receivedAt));
     if (rooted.length === 0) return { stored: false, reason: 'unrooted' };
     const signer = rooted.find((k) => verifyGrant(grant, k).valid);
     if (!signer) return { stored: false, reason: 'bad-signature' };
@@ -153,6 +198,12 @@ class RoleGrantStore {
     grant = canonicalGrant(grant, sk);
     this._seen.add(sk);
     this._signer.set(sk, signer);
+    this._receivedAt.set(sk, receivedAt);
+    this._addTime(grant.grantedAt);
+    let gs = this._grantees.get(grant.grantedBy);
+    if (!gs) { gs = new Set(); this._grantees.set(grant.grantedBy, gs); }
+    gs.add(grant.grantee);
+    this._forgetSubtree(grant.grantee);
     this._perGrantor.set(grant.grantedBy, (this._perGrantor.get(grant.grantedBy) || 0) + 1);
     this._perPair.set(pair, (this._perPair.get(pair) || 0) + 1);
     let arr = this._byGrantee.get(grant.grantee);
@@ -163,34 +214,66 @@ class RoleGrantStore {
       if (!v) { v = new Set(); this._vouched.set(grant.grantee, v); }
       v.add(grant.granteeKey);
     }
-    this._append(grant);
-    this._pinGranteeKey(grant);
+    this._append(grant, receivedAt);
+    this._noteVouch(grant);
+    if (grant.type === 'role-grant' && this._selfId && grant.grantee === this._selfId && this._selfKey && grant.granteeKey !== this._selfKey) {
+      // Stored (it is a rooted statement, and relayed like one) but inert: this node resolves its own
+      // role under its own key, and no grant binds its own nodeId.
+      if (this._onForeignSelfGrant && !this._loading) { try { this._onForeignSelfGrant(grant); } catch { /* a report must not fail the store */ } }
+      return { stored: true, grant, inert: 'foreign-key-for-self' };
+    }
     return { stored: true, grant };
   }
 
+  /** When this node received the record with this signature, or undefined. */
+  receivedAt(sig) { return this._receivedAt.get(sigKey(sig)); }
+
   /**
    * Whether a record is rooted at the anchor under `signerKey`: its grantor, holding that key, held
-   * at the time it signed the authority the record needs (a grant: the rank it confers; a revoke:
-   * validator or above). (A grant from a grantor revoked SINCE it signed is rooted and kept;
-   * resolution still gives it no effect while the grantor is revoked.)
+   * the authority the record needs (a grant: the rank it confers; a revoke: validator or above) both
+   * when it signed and when it was received (security review C). (A grant from a grantor revoked
+   * SINCE it was received is rooted and kept; resolution gives it no effect while the grantor is
+   * revoked.)
    * @private
    */
-  _rooted(grant, signerKey) {
-    const rank = roleRank(this.resolveRole(grant.grantedBy, signerKey, grant.grantedAt));
+  _rooted(grant, signerKey, receivedAt) {
+    const then = roleRank(this.resolveRole(grant.grantedBy, signerKey, grant.grantedAt));
+    const atReceipt = roleRank(this.resolveRole(grant.grantedBy, signerKey, receivedAt));
+    const rank = Math.min(then, atReceipt);
     return grant.type === 'role-revoke' ? rank >= 1 : rank >= roleRank(grant.role);
   }
 
   /**
-   * A rooted grant VOUCHES for the grantee's nodeId↔key binding: pin it into the key registry at
-   * `grant` strength, through the registry's conflict matrix (a different key already bound is a
-   * conflict, never an override). A plain Map is only filled where it holds nothing.
+   * A rooted grant names the grantee's key. The registry reads key vouches as a view
+   * (`vouchedKey`), so nothing is pinned; the registry is told, so that a different key it already
+   * binds is recorded as a conflict and the same key is marked vouched. Never for this node's own id.
+   * A plain Map (tests, older hosts) is only filled where it holds nothing.
    * @private
    */
-  _pinGranteeKey(grant) {
-    if (grant.type !== 'role-grant') return;
+  _noteVouch(grant) {
+    if (grant.type !== 'role-grant' || (this._selfId && grant.grantee === this._selfId)) return;
     if (typeof this._keys.bind === 'function') this._keys.bind(grant.grantee, grant.granteeKey, 'grant');
-    else if (typeof this._keys.pin === 'function') this._keys.pin(grant.grantee, grant.granteeKey, 'grant');
-    else if (typeof this._keys.set === 'function' && !this._keys.get(grant.grantee)) this._keys.set(grant.grantee, grant.granteeKey);
+    else if (typeof this._keys.set === 'function' && typeof this._keys.setGrantView !== 'function' && !this._keys.get(grant.grantee)) this._keys.set(grant.grantee, grant.granteeKey);
+  }
+
+  /**
+   * The key the grants in effect NOW vouch for `nodeId`: the granteeKey of a grant under which
+   * `nodeId` resolves now to a rank above participant. Undefined when none does, when two keys do
+   * (ambiguous: neither verifies), or for this node's own id. The key registry's `grant` view.
+   * @returns {string|undefined}
+   */
+  vouchedKey(nodeId, at = this._now()) {
+    if (this._selfId && nodeId === this._selfId) return undefined;
+    if (this._anchor && nodeId === this._anchor.nodeId) return undefined;
+    const keys = this._vouched.get(nodeId);
+    if (!keys) return undefined;
+    let found;
+    for (const k of keys) {
+      if (roleRank(this.resolveRole(nodeId, k, at)) < 1) continue;
+      if (found !== undefined && found !== k) return undefined;
+      found = k;
+    }
+    return found;
   }
 
   /**
@@ -210,36 +293,115 @@ class RoleGrantStore {
    * @param {number} at - ms epoch
    * @returns {'participant'|'validator'|'anchor'}
    */
-  resolveRole(nodeId, key, at, _seen) {
+  resolveRole(nodeId, key, at) {
     if (typeof key === 'number' && at === undefined) { at = key; key = this._boundKey(nodeId); }
-    if (at === undefined) at = Date.now();
-    if (this._anchor && nodeId === this._anchor.nodeId) return key === this._anchor.publicKey ? 'anchor' : 'participant';
-    if (typeof key !== 'string' || !key) return 'participant';
-    const seen = _seen || new Set();
+    if (at === undefined) at = this._now();
+    if (this._memo.size >= MEMO_MAX) { this._memo.clear(); this._memoKeys.clear(); }
+    return this._resolve(nodeId, key, at, new Set()).role;
+  }
+
+  /**
+   * @private A record for `nodeId` was kept: the answers for it, and for every node a chain through it
+   * reaches, are forgotten; every other answer still holds (a node no chain through `nodeId` reaches
+   * resolves alike on both sides of the new record's time).
+   */
+  _forgetSubtree(nodeId) {
+    const queue = [nodeId];
+    const done = new Set();
+    for (let i = 0; i < queue.length; i++) {
+      const id = queue[i];
+      if (done.has(id)) continue;
+      done.add(id);
+      const keys = this._memoKeys.get(id);
+      if (keys) { for (const k of keys) this._memo.delete(k); this._memoKeys.delete(id); }
+      const next = this._grantees.get(id);
+      if (next) for (const g of next) if (!done.has(g)) queue.push(g);
+    }
+  }
+
+  /** @private Keep `t` in the sorted list of breakpoints. */
+  _addTime(t) {
+    const a = this._times;
+    let lo = 0, hi = a.length;
+    while (lo < hi) { const mid = (lo + hi) >> 1; if (a[mid] < t) lo = mid + 1; else hi = mid; }
+    if (a[lo] !== t) a.splice(lo, 0, t);
+  }
+
+  /**
+   * @private The breakpoint a time resolves as: the latest record time at or before it (-Infinity
+   * when none). A role changes only where some record's signed time is crossed (the replay takes the
+   * records signed at or before the time asked, and asks its grantors at that time or at fixed record
+   * times), so every time between two breakpoints resolves alike, and the memo holds at most one
+   * answer per (node, key, breakpoint): linear in the records, whatever times are asked.
+   */
+  _canonicalTime(t) {
+    const a = this._times;
+    let lo = 0, hi = a.length;
+    while (lo < hi) { const mid = (lo + hi) >> 1; if (a[mid] <= t) lo = mid + 1; else hi = mid; }
+    return lo === 0 ? -Infinity : a[lo - 1];
+  }
+
+  /**
+   * The resolution, memoised (security review D, role-resolve-cost): each record recurses into its
+   * grantor at three times (signed, received, `at`), which without a memo cost (3r)^depth. An answer
+   * is kept only when no cycle was cut while computing it (a cut answer depends on the path), and the
+   * memo is cleared whenever a record is kept. @returns {{ role: string, pure: boolean }}
+   * @private
+   */
+  _resolve(nodeId, key, at, seen) {
+    if (this._anchor && nodeId === this._anchor.nodeId) return { role: key === this._anchor.publicKey ? 'anchor' : 'participant', depth: 0, pure: true };
+    if (typeof key !== 'string' || !key) return { role: 'participant', depth: 0, pure: true };
     const self = `${nodeId}\u0000${key}`;
-    if (seen.has(self)) return 'participant'; // cycle — not anchor-rooted
-    const nextSeen = new Set([...seen, self]);
+    if (seen.has(self)) return { role: 'participant', depth: 0, pure: false }; // cycle — not anchor-rooted
+    at = this._canonicalTime(at);
+    const memoKey = `${self}\u0000${at}`;
+    const hit = this._memo.get(memoKey);
+    if (hit !== undefined) return { role: hit.role, depth: hit.depth, pure: true };
+    seen.add(self);
+    let pure = true;
+    let depthOf = 0; // the deepest grantor consulted for the record being replayed
+    // A grantor's rank at a time, or 0 when its own role sits at the delegation depth already.
+    const rank = (id, k, t) => {
+      const r = this._resolve(id, k, t, seen);
+      if (!r.pure) pure = false;
+      if (r.depth >= MAX_DELEGATION_DEPTH) return 0;
+      if (r.depth > depthOf) depthOf = r.depth;
+      return roleRank(r.role);
+    };
     const records = (this._byGrantee.get(nodeId) || [])
       .filter(g => (g.grantedAt ?? 0) <= at)
       .sort((a, b) => (a.grantedAt ?? 0) - (b.grantedAt ?? 0)); // chronological
     let role = 'participant';
+    let depth = 0;
     for (const g of records) {
       // A grant confers only if the grantor was authorised WHEN it granted (so a grant signed before
-      // the grantor held rank never activates) AND is still authorised NOW (so revoking/demoting a
-      // grantor cascades to everything it granted, and a since-revoked grantor cannot backdate a fresh
-      // grant to before its own revoke to resurrect authority). A revoke is sticky: it takes effect on
-      // the revoker's rank AT REVOKE TIME and is not undone by the revoker's later demotion.
+      // the grantor held rank never activates), WHEN THIS NODE RECEIVED IT (so a grantor revoked by
+      // then cannot backdate a fresh grant into its old window: security review C) AND NOW (so
+      // revoking or demoting a grantor cascades to everything it granted). A revoke takes effect on
+      // the revoker's rank when it revoked and when it was received, the lower, and is not undone by
+      // the revoker's later demotion.
       if (g.type === 'role-grant' && g.granteeKey !== key) continue;
       const signer = this._signer.get(g.sig);
-      const rankThen = roleRank(this.resolveRole(g.grantedBy, signer, g.grantedAt ?? 0, nextSeen));
+      const signedAt = g.grantedAt ?? 0;
+      const recvAt = this._receivedAt.get(g.sig) ?? signedAt;
+      depthOf = 0;
+      const authority = Math.min(rank(g.grantedBy, signer, signedAt), rank(g.grantedBy, signer, recvAt));
       if (g.type === 'role-revoke') {
-        if (rankThen >= roleRank(role)) role = 'participant';
+        if (authority >= 1 && authority >= roleRank(role)) { role = 'participant'; depth = 0; }
       } else {
-        const rankNow = roleRank(this.resolveRole(g.grantedBy, signer, at, nextSeen));
-        if (Math.min(rankThen, rankNow) >= roleRank(g.role)) role = g.role;
+        const rankNow = rank(g.grantedBy, signer, at);
+        if (Math.min(authority, rankNow) >= roleRank(g.role)) { role = g.role; depth = depthOf + 1; }
       }
     }
-    return role;
+    seen.delete(self);
+    if (role === 'participant') depth = 0;
+    if (pure) {
+      this._memo.set(memoKey, { role, depth });
+      let ks = this._memoKeys.get(nodeId);
+      if (!ks) { ks = new Set(); this._memoKeys.set(nodeId, ks); }
+      ks.add(memoKey);
+    }
+    return { role, depth, pure };
   }
 
   /** @private The key the registry binds `nodeId` to (the anchor's configured key for the anchor). */
@@ -258,15 +420,61 @@ class RoleGrantStore {
     return (this._byGrantee.get(grantee) || []).slice().sort((a, b) => (a.grantedAt ?? 0) - (b.grantedAt ?? 0));
   }
 
+  /**
+   * Every record held, in an order that roots each before it is needed (security review D,
+   * anti-entropy): the anchor's records first, then those of each grantor the earlier ones reach,
+   * breadth first, each grantor's own records by signed time; what no chain reaches comes last.
+   * Cached until the next record is kept.
+   * @returns {object[]}
+   */
+  syncOrder() {
+    if (this._syncOrder && this._syncOrderAt === this._seen.size) return this._syncOrder;
+    const byGrantor = new Map();
+    for (const arr of this._byGrantee.values()) for (const g of arr) {
+      let l = byGrantor.get(g.grantedBy);
+      if (!l) { l = []; byGrantor.set(g.grantedBy, l); }
+      l.push(g);
+    }
+    const out = [];
+    const done = new Set();
+    const queue = this._anchor ? [this._anchor.nodeId] : [];
+    for (let i = 0; i < queue.length; i++) {
+      const grantor = queue[i];
+      if (done.has(grantor)) continue;
+      done.add(grantor);
+      const l = (byGrantor.get(grantor) || []).sort((a, b) => (a.grantedAt ?? 0) - (b.grantedAt ?? 0));
+      for (const g of l) { out.push(g); if (g.type === 'role-grant' && !done.has(g.grantee)) queue.push(g.grantee); }
+    }
+    for (const [grantor, l] of byGrantor) if (!done.has(grantor)) out.push(...l);
+    this._syncOrder = out;
+    this._syncOrderAt = this._seen.size;
+    return out;
+  }
+
+  /**
+   * A digest of every record held (security review D, anti-entropy): sha256 over the sorted
+   * signatures' canonical spellings. Two stores holding the same records give the same digest.
+   * @returns {{ count: number, digest: string }}
+   */
+  digest() {
+    if (this._digest && this._digestAt === this._seen.size) return this._digest;
+    const h = crypto.createHash('sha256');
+    for (const sk of [...this._seen].sort()) h.update(sk).update('\n');
+    this._digest = { count: this._seen.size, digest: h.digest('hex') };
+    this._digestAt = this._seen.size;
+    return this._digest;
+  }
+
   /** Whether a grant with this signature is held, however the signature is spelled. */
   has(sig) { return this._seen.has(sigKey(sig)); }
   size() { return this._seen.size; }
 
   // ── Durable persistence (append-only) ────────────────────────────────────────
 
-  _append(grant) {
+  /** One line per record: `{ grant, receivedAt }` (a pre-0.14 line is the bare record). */
+  _append(grant, receivedAt) {
     if (!this._dir || this._loading) return;
-    try { fs.appendFileSync(path.join(this._dir, GRANTS_FILE), JSON.stringify(grant) + '\n'); }
+    try { fs.appendFileSync(path.join(this._dir, GRANTS_FILE), JSON.stringify({ grant, receivedAt }) + '\n'); }
     catch { /* best effort — never let persistence break authority */ }
   }
 
@@ -293,10 +501,17 @@ class RoleGrantStore {
     this._loading = true;
     try {
       let pending = [];
+      let bare = 0;
       for (const line of text.split('\n')) {
         if (!line.trim()) continue;
-        try { pending.push(JSON.parse(line)); } catch { skip('not-json'); }
+        let o;
+        try { o = JSON.parse(line); } catch { skip('not-json'); continue; }
+        // `{ grant, receivedAt }`, or a bare record written before 0.14: no receipt time, so it is
+        // treated as received at load (draft spec PR #33).
+        if (o && typeof o === 'object' && o.grant && typeof o.grant === 'object') pending.push({ g: o.grant, receivedAt: o.receivedAt });
+        else { pending.push({ g: o, receivedAt: undefined }); bare++; }
       }
+      this._bareLines = bare;
       const curable = new Set(['unknown-grantor-key', 'unrooted', 'bad-signature']);
       let reasons = [];
       let progress = true;
@@ -304,11 +519,11 @@ class RoleGrantStore {
         progress = false;
         const retry = [];
         reasons = [];
-        for (const g of pending) {
+        for (const e of pending) {
           let r;
-          try { r = this.record(g); } catch { r = { stored: false, reason: 'unverifiable' }; }
+          try { r = this.record(e.g, { receivedAt: e.receivedAt }); } catch { r = { stored: false, reason: 'unverifiable' }; }
           if (r.stored) { report.loaded++; progress = true; }
-          else if (curable.has(r.reason)) { retry.push(g); reasons.push(r.reason); }
+          else if (curable.has(r.reason)) { retry.push(e); reasons.push(r.reason); }
           else skip(r.reason);
         }
         pending = retry;
@@ -317,6 +532,20 @@ class RoleGrantStore {
     } finally {
       this._loading = false;
     }
+    // A file holding pre-0.14 lines is rewritten once, atomically, in the 0.14 form.
+    if (this._bareLines > 0) this._rewrite();
+  }
+
+  /** @private Rewrite the file as one `{ grant, receivedAt }` line per record kept, atomically. */
+  _rewrite() {
+    const file = path.join(this._dir, GRANTS_FILE);
+    const lines = [];
+    for (const arr of this._byGrantee.values()) for (const g of arr) lines.push(JSON.stringify({ grant: g, receivedAt: this._receivedAt.get(g.sig) }));
+    try {
+      const tmp = `${file}.${process.pid}.tmp`;
+      fs.writeFileSync(tmp, lines.join('\n') + (lines.length ? '\n' : ''));
+      fs.renameSync(tmp, file);
+    } catch { /* best effort: read again the same way at the next start */ }
   }
 }
 
@@ -340,13 +569,15 @@ function canonicalGrant(g, sig) {
 function malformed(g) {
   if (!g || typeof g !== 'object' || Array.isArray(g)) return true;
   if (g.type !== 'role-grant' && g.type !== 'role-revoke') return true;
-  for (const f of ['grantee', 'grantedBy', 'sig']) if (typeof g[f] !== 'string' || !g[f]) return true;
-  if (!Number.isFinite(g.grantedAt)) return true;
+  // nodeIds in canonical lowercase only (security review B), and bounded (review D).
+  for (const f of ['grantee', 'grantedBy']) if (!isCanonicalNodeId(g[f]) || g[f].length > MAX_ID) return true;
+  if (typeof g.sig !== 'string' || !g.sig || g.sig.length > 128) return true;
+  if (!Number.isSafeInteger(g.grantedAt) || g.grantedAt < 0) return true;
   if (g.granteeKey !== undefined && typeof g.granteeKey !== 'string') return true;
-  if (g.role !== undefined && typeof g.role !== 'string') return true;
+  if (g.role !== undefined && (typeof g.role !== 'string' || g.role.length > MAX_ROLE)) return true;
   if (g.type === 'role-revoke') return false;
   // A grant confers a rank above participant, on the holder of one key, or it confers nothing.
   return roleRank(g.role) < 1 || typeof g.granteeKey !== 'string' || !/^[A-Za-z0-9_-]{43}$/.test(g.granteeKey);
 }
 
-module.exports = { RoleGrantStore, canonicalGrant };
+module.exports = { RoleGrantStore, canonicalGrant, malformedGrant: malformed, MAX_DELEGATION_DEPTH };
diff --git a/lib/roster-keys.js b/lib/roster-keys.js
index bd475ee3..35bca69a 100644
--- a/lib/roster-keys.js
+++ b/lib/roster-keys.js
@@ -18,6 +18,11 @@
  *   pinned        — an out-of-band binding: an accepted invite naming the issuer's key, a Legacy
  *                   Import route's mandatory fingerprint, or an operator's resolution of a conflict.
  *   grant         — vouched by an anchor-rooted role grant (granteeKey, inside the signed payload).
+ *                   NOT STORED (security review C): a grant binding is a view over the grants that
+ *                   are in effect NOW (`opts.grantView`, the role-grant store's answer), so revoking
+ *                   or demoting the grantor ends it, and grants never fill the registry. A grant
+ *                   naming the key a stored binding holds marks it vouched; one naming another key
+ *                   is a conflict. A grant never binds this node's own nodeId (`opts.self`).
  *   legacy-claim  — every pre-0.14 `handshake` entry, relabelled on first load. It was learned from
  *                   an unproven hello, so it verifies nothing; it is the EXPECTED key: a proven
  *                   session presenting it binds `proven`, and one presenting a different key is a
@@ -32,20 +37,27 @@
  *   the configured anchor                 → always its configured key
  *
  * Only `anchor`, `proven`, `pinned` and `grant` bindings verify anything (`get`). A `legacy-claim`
- * is reported by `expected` and by `source`, never by `get`.
+ * is reported by `expected` and by `source`, never by `get`. This node's own nodeId is always its
+ * own key (`opts.self`, configuration like the anchor): no source binds it to another.
  *
  * BINDING LIFETIME (design D3, 0.13.17 re-review). New keypairs are free, so a registry that only
  * grows can be filled by identity churn. A first-contact `proven` binding that has verified nothing
- * since — no record, grant or attestation verified under it, and no later session re-proving it — and
- * has not been seen for BINDING_TTL_MS (30 days) EXPIRES. A binding that ever verified something, or
- * is pinned, grant-vouched (a grant names its key), anchored or a legacy claim (the finite 0.13
+ * since — no record, grant or attestation verified under it (a later session re-proving the key does
+ * NOT count: anyone minting identities can handshake twice, security review D) — and has not been
+ * seen for BINDING_TTL_MS (30 days) EXPIRES. A binding that ever verified something, or is pinned,
+ * vouched (a grant in effect, or a pin, names its key), anchored or a legacy claim (the finite 0.13
  * migration), never expires, so no binding that protects history is forgotten. The facts `seen` and
- * `verified` are persisted with the binding (a `seen` line at most once a day per binding). This
- * replaces 0.13.17's cap of 16,384 never-evicted bindings, which anyone on the LAN could fill.
+ * `verified` are persisted with the binding (a `seen` line at most once a day per binding).
  *
- * The sticky floor of Legacy Import (design D7) is derived from here, not kept in memory: a nodeId
- * with a `proven` binding has spoken Core Secure, so its legacy route is refused until an operator
- * resets the floor (`resetFloor`), which is persisted too.
+ * A binding is NEVER EVICTED before it expires (security review D): when the registry is full, what
+ * has expired goes, and if nothing has, a newcomer is refused a binding (`full`) and is held for its
+ * session only — the key its live session proved verifies what it signs while that session lasts.
+ * Eviction let a flood of fresh identities push an honest binding out and squat its nodeId.
+ *
+ * THE STICKY FLOOR of Legacy Import (design D7) is its own persisted fact, independent of any
+ * binding's lifetime (security review): a nodeId that has a Legacy Import route (`opts.isRouted`)
+ * and proves itself over Core Secure arms its floor, and the floor stays armed — through the
+ * binding's expiry, a full registry, or a restart — until an operator resets it (`resetFloor`).
  *
  * File format (roster-keys.jsonl): a version marker line `{"v":2,...}`, then one JSON line per
  * binding event. A 0.13 reader skips the marker as malformed and reads the rest. A file without the
@@ -65,12 +77,15 @@ const CONFLICTS_FILE = 'roster-conflicts.jsonl';
 const FORMAT_MARKER = Object.freeze({ v: 2, format: 'sym-roster-keys', note: 'sym 0.14 key registry; a 0.13 reader skips this line' });
 
 /** Strength, for "record the stronger source" on the same key. The anchor is configuration. */
-const SOURCE_RANK = Object.freeze({ 'legacy-claim': 1, grant: 2, pinned: 3, proven: 4, anchor: 5 });
-const VERIFYING = new Set(['anchor', 'proven', 'pinned', 'grant']);
+// `pinned` outranks `proven` (mesh-channel 0.11.0 defect report): an out-of-band binding the operator
+// accepted is the stronger provenance, and a session proving the same key confirms it and keeps it
+// pinned (and so never expiring), where it used to relabel it `proven`.
+const SOURCE_RANK = Object.freeze({ 'legacy-claim': 1, grant: 2, proven: 3, pinned: 4, anchor: 5 });
+const VERIFYING = new Set(['anchor', 'proven', 'pinned']);
 const SOURCES = new Set(Object.keys(SOURCE_RANK));
 const rankOf = (s) => SOURCE_RANK[s] ?? 0;
 
-/** Bindings kept at most (new proven/grant/legacy bindings are refused past it; pinned never are). */
+/** Bindings kept at most (new proven/legacy bindings are refused past it; pinned never are). */
 const MAX_BINDINGS = 65536;
 /** A first-contact proven binding that verified nothing expires after this long unseen. */
 const BINDING_TTL_MS = 30 * 24 * 60 * 60 * 1000;
@@ -103,17 +118,26 @@ class RosterKeyRegistry {
     this._now = typeof opts.now === 'function' ? opts.now : Date.now;
     this._ttl = Number.isFinite(opts.bindingTtlMs) && opts.bindingTtlMs > 0 ? opts.bindingTtlMs : BINDING_TTL_MS;
     this._isLive = typeof opts.isLive === 'function' ? opts.isLive : () => false;
+    this._isRouted = typeof opts.isRouted === 'function' ? opts.isRouted : () => false;
+    // The grants in effect now (the role-grant store): nodeId -> the one key they vouch, or undefined.
+    this._grantView = typeof opts.grantView === 'function' ? opts.grantView : null;
+    this._self = opts.self && isNodeId(opts.self.nodeId) && isIdentityKey(opts.self.publicKey)
+      ? { nodeId: opts.self.nodeId, publicKey: opts.self.publicKey } : null;
     this._expired = 0;               // bindings expired since this registry was built
     // nodeId -> { key, source, at, seenAt, verifiedAt, vouched, seenSaved, verifiedSaved }
     this._byNode = new Map();
     // The expirable bindings (first contact, proven, nothing verified, not vouched), least recently
-    // seen first: expiry and eviction take from the head, O(1) each.
+    // seen first: expiry takes from the head, O(1) each.
     this._lru = new Map();
-    this._evicted = 0;
+    this._refusedFull = 0;          // newcomers refused a binding because nothing had expired
     this._conflicts = [];           // { nodeId, had, hadSource, got, gotSource, at }
     this._conflictCount = 0;        // every conflict, recorded or not
+    this._floorArmed = new Set();   // nodeIds whose sticky floor is armed (persisted, never expires)
     this._floorReset = new Set();   // nodeIds whose sticky floor an operator reset
     this._dir = opts.dir || null;
+    // A read-only registry (`sym keys` list while the node may run): loads, expires and migrates
+    // nothing on disk, and writes nothing (security review: listing must never change the file).
+    this._readOnly = opts.readOnly === true;
     this._max = opts.maxBindings || MAX_BINDINGS;
     this._log = typeof opts.log === 'function' ? opts.log : () => {};
     this._anchor = opts.anchor && isNodeId(opts.anchor.nodeId) && opts.anchor.publicKey
@@ -131,22 +155,43 @@ class RosterKeyRegistry {
   /** The key that verifies `nodeId`'s signatures, or undefined. Never a legacy claim. */
   get(nodeId) {
     if (this._anchor && nodeId === this._anchor.nodeId) return this._anchor.publicKey;
+    if (this._self && nodeId === this._self.nodeId) return this._self.publicKey;
     const b = this._byNode.get(nodeId);
-    return b && VERIFYING.has(b.source) ? b.key : undefined;
+    if (!b) return this._viewKey(nodeId);
+    if (VERIFYING.has(b.source)) return b.key;
+    // A legacy claim verifies only while grants in effect vouch the very key it expects.
+    return this._viewKey(nodeId) === b.key ? b.key : undefined;
   }
 
   /** The key bound to `nodeId` at any source, a legacy claim included, or undefined. */
   expected(nodeId) {
     if (this._anchor && nodeId === this._anchor.nodeId) return this._anchor.publicKey;
-    return this._byNode.get(nodeId)?.key;
+    if (this._self && nodeId === this._self.nodeId) return this._self.publicKey;
+    const b = this._byNode.get(nodeId);
+    return b ? b.key : this._viewKey(nodeId);
   }
 
-  /** The source of `nodeId`'s binding: anchor | proven | pinned | grant | legacy-claim | undefined. */
+  /** The source of `nodeId`'s binding: anchor | self | proven | pinned | grant | legacy-claim | undefined. */
   source(nodeId) {
     if (this._anchor && nodeId === this._anchor.nodeId) return 'anchor';
-    return this._byNode.get(nodeId)?.source;
+    if (this._self && nodeId === this._self.nodeId) return 'self';
+    const b = this._byNode.get(nodeId);
+    if (b) return b.source === 'legacy-claim' && this._viewKey(nodeId) === b.key ? 'grant' : b.source;
+    return this._viewKey(nodeId) !== undefined ? 'grant' : undefined;
+  }
+
+  /** @private The key the grants in effect now vouch for `nodeId` (never this node's own). */
+  _viewKey(nodeId) {
+    if (!this._grantView || (this._self && nodeId === this._self.nodeId)) return undefined;
+    try {
+      const k = this._grantView(nodeId);
+      return isIdentityKey(k) ? k : undefined;
+    } catch { return undefined; }
   }
 
+  /** Set the grant view after construction (the role-grant store is built with this registry). */
+  setGrantView(fn) { this._grantView = typeof fn === 'function' ? fn : null; }
+
   /** Whether `nodeId` has a binding that verifies (not a legacy claim). */
   has(nodeId) { return this.get(nodeId) !== undefined; }
 
@@ -170,11 +215,26 @@ class RosterKeyRegistry {
   }
 
   /**
-   * The sticky floor (design D7): true when `nodeId` has proven itself over Core Secure and no
-   * operator has reset its floor since. Derived from the persisted registry, so it survives restarts.
+   * The sticky floor (design D7): true when `nodeId` has proven itself over Core Secure while it had
+   * a Legacy Import route, and no operator has reset its floor since. Its own persisted fact: it does
+   * not end with the binding (expiry, a full registry) and survives restarts (security review).
    */
   floor(nodeId) {
-    return this.source(nodeId) === 'proven' && !this._floorReset.has(nodeId);
+    return this._floorArmed.has(nodeId) && !this._floorReset.has(nodeId);
+  }
+
+  /**
+   * `nodeId` proved itself over Core Secure: arm its sticky floor if it has a Legacy Import route.
+   * Called on every admitted session (and by a `proven` bind), whether or not a binding was kept.
+   * An operator's earlier reset is undone by a new proof.
+   */
+  armFloor(nodeId) {
+    if (!isNodeId(nodeId) || !this._isRouted(nodeId)) return false;
+    const reset = this._floorReset.delete(nodeId);
+    if (this._floorArmed.has(nodeId) && !reset) return true;
+    this._floorArmed.add(nodeId);
+    this._persist({ nodeId, floor: true, ...(reset ? { floorReset: false } : {}) });
+    return true;
   }
 
   // ── Writes ─────────────────────────────────────────────────────────────────────
@@ -196,37 +256,51 @@ class RosterKeyRegistry {
       this._recordConflict(nodeId, this._anchor.publicKey, 'anchor', key, source, at);
       return { bound: false, reason: 'conflict', had: this._anchor.publicKey };
     }
+    if (this._self && nodeId === this._self.nodeId) {
+      // This node's own nodeId is its own key: no session, pin or grant binds it to another.
+      if (key === this._self.publicKey) return { bound: true, source: 'self' };
+      this._recordConflict(nodeId, this._self.publicKey, 'self', key, source, at);
+      return { bound: false, reason: 'conflict', had: this._self.publicKey };
+    }
     const b = this._byNode.get(nodeId);
     if (b) {
       if (b.key === key) {
-        if (rankOf(source) > rankOf(b.source)) {
+        // A proof of the key bound (never of another: a squatter's conflict arms nothing).
+        if (source === 'proven') this.armFloor(nodeId);
+        if (source !== 'grant' && rankOf(source) > rankOf(b.source)) {
           b.source = source;
           this._track(nodeId, b);
-          // A proven binding re-arms the sticky floor an operator reset earlier.
-          if (source === 'proven' && this._floorReset.delete(nodeId)) this._persist({ nodeId, floorReset: false });
           this._persist({ nodeId, key, source });
-        } else if ((source === 'grant' || source === 'pinned') && b.source !== source && !b.vouched) {
-          // A grant (or a pin) naming the key a session proved: the binding is vouched for, and so
-          // never expires. Written as the source's own line, which replays as this.
+        } else if (source === 'pinned' && b.source !== source && !b.vouched) {
+          // A pin naming the key a session proved: the binding is vouched for, and so never
+          // expires. Written as the source's own line, which replays as this.
           b.vouched = true;
           this._track(nodeId, b);
           this._persist({ nodeId, key, source });
         }
+        // A grant naming the bound key changes nothing stored: while it is in effect the view keeps
+        // the binding from expiring (_expirable).
         return { bound: true, source: b.source };
       }
       this._recordConflict(nodeId, b.key, b.source, key, source, at);
       return { bound: false, reason: 'conflict', had: b.key };
     }
-    // Full: what has expired goes first, then the least recently seen first-contact binding that
-    // verified nothing — never one that protects history. A flood of new identities therefore
-    // displaces only its own kind, and an honest newcomer always gets its binding (0.13.17's cap
-    // refused it: a lockout anyone could fill). Only when every binding protects history is a new
-    // one refused, and its session still verifies under its proven key while it lasts.
-    if (this._byNode.size >= this._max && source !== 'pinned' && !this._loading) {
-      this.expire();
-      if (this._byNode.size >= this._max) this._evictOne();
+    // Nothing stored: the grants in effect now may still vouch a key (the view). A grant is never
+    // stored; any other source naming a different key than the view is a conflict.
+    const viewKey = this._viewKey(nodeId);
+    if (source === 'grant') return viewKey === key ? { bound: true, source: 'grant' } : { bound: false, reason: viewKey ? 'conflict' : 'not-in-effect', ...(viewKey ? { had: viewKey } : {}) };
+    if (viewKey !== undefined && viewKey !== key) {
+      this._recordConflict(nodeId, viewKey, 'grant', key, source, at);
+      return { bound: false, reason: 'conflict', had: viewKey };
     }
-    if (this._byNode.size >= this._max && source !== 'pinned') return { bound: false, reason: 'full' };
+    // A first proof arms the floor even when the registry is full and keeps no binding.
+    if (source === 'proven') this.armFloor(nodeId);
+    // Full: what has expired goes, and nothing else (security review D): a binding is never evicted
+    // before it expires, so a flood of new identities cannot push an honest binding out and squat
+    // its nodeId. A newcomer refused here is held for its session only (the node verifies what it
+    // signs under the key its live session proved, for as long as that session lasts).
+    if (this._byNode.size >= this._max && source !== 'pinned' && !this._loading) this.expire();
+    if (this._byNode.size >= this._max && source !== 'pinned') { this._refusedFull++; return { bound: false, reason: 'full' }; }
     const now = this._now();
     const nb = { key, source, at, seenAt: this._loading ? null : now, verifiedAt: null, vouched: false, seenSaved: this._loading ? null : now, verifiedSaved: null };
     this._byNode.set(nodeId, nb);
@@ -249,8 +323,9 @@ class RosterKeyRegistry {
   }
 
   /**
-   * Something verified under `nodeId`'s binding: a record, a grant or an attestation it signed, or a
-   * later session re-proving its key. A binding that ever verified something never expires.
+   * Something verified under `nodeId`'s binding: a record, a grant or an attestation it signed (never
+   * a session re-proving the key: security review D). A binding that ever verified something never
+   * expires.
    */
   noteVerified(nodeId) {
     const b = this._byNode.get(nodeId);
@@ -263,7 +338,11 @@ class RosterKeyRegistry {
     if (first || now - (b.verifiedSaved ?? 0) >= FACT_PERSIST_MS) { b.verifiedSaved = now; b.seenSaved = now; this._persist({ nodeId, verified: now }); }
   }
 
-  /** Whether `nodeId`'s binding may expire: first contact, proven, never verified, not vouched. @private */
+  /**
+   * Whether a binding may expire: first contact, proven, never verified, not pinned-vouched (static,
+   * the expiry index). A grant in effect naming its key also keeps it (dynamic, checked at expiry).
+   * @private
+   */
   _expirable(b) {
     return b.source === 'proven' && b.verifiedAt == null && !b.vouched;
   }
@@ -274,30 +353,10 @@ class RosterKeyRegistry {
     if (b && this._expirable(b)) this._lru.set(nodeId, true);
   }
 
-  /** @private Drop a binding (expired or evicted). */
+  /** @private Drop an expired binding. Its sticky floor, a fact of its own, stays. */
   _drop(nodeId) {
     this._byNode.delete(nodeId);
     this._lru.delete(nodeId);
-    this._floorReset.delete(nodeId);
-  }
-
-  /**
-   * Evict the least recently seen expirable binding (a node with a live session counts as seen now).
-   * @returns {boolean} whether one went
-   * @private
-   */
-  _evictOne() {
-    for (let tries = 0; tries < 64 && this._lru.size; tries++) {
-      const nodeId = this._lru.keys().next().value;
-      const b = this._byNode.get(nodeId);
-      if (!b || !this._expirable(b)) { this._lru.delete(nodeId); continue; }
-      if (this._isLive(nodeId)) { b.seenAt = this._now(); this._track(nodeId, b); continue; }
-      this._drop(nodeId);
-      this._evicted++;
-      this._persist({ nodeId, expired: true });
-      return true;
-    }
-    return false;
   }
 
   /**
@@ -315,7 +374,8 @@ class RosterKeyRegistry {
       if (!b || !this._expirable(b)) { this._lru.delete(nodeId); continue; }
       const seen = b.seenAt ?? b.seenSaved ?? null;
       if (seen != null && now - seen <= this._ttl) break;
-      if (this._isLive(nodeId)) { b.seenAt = now; this._track(nodeId, b); continue; }
+      // A node with a live session, or a binding a grant in effect vouches, counts as seen now.
+      if (this._isLive(nodeId) || (this._grantView && this._viewKey(nodeId) === b.key)) { b.seenAt = now; this._track(nodeId, b); continue; }
       this._lru.delete(nodeId);
       gone.push(nodeId);
     }
@@ -331,8 +391,11 @@ class RosterKeyRegistry {
   /** Bindings expired since this registry was built. */
   expiredCount() { return this._expired; }
 
-  /** First-contact bindings evicted to make room since this registry was built. */
-  evictedCount() { return this._evicted; }
+  /** Bindings evicted to make room: always 0 (a binding is never evicted before it expires). */
+  evictedCount() { return 0; }
+
+  /** Newcomers refused a binding because the registry was full and nothing had expired. */
+  refusedFullCount() { return this._refusedFull; }
 
   /**
    * 0.13-compatible spelling of bind, for callers that pin a vouched key (`pin(id, key, 'grant')`).
@@ -343,8 +406,8 @@ class RosterKeyRegistry {
     return r.bound ? { pinned: true } : { pinned: false, reason: r.reason };
   }
 
-  /** Map-compatible write, at `grant` strength. */
-  set(nodeId, key) { this.bind(nodeId, key, 'grant'); return this; }
+  /** Map-compatible write, at `pinned` strength (a grant is never stored: see `grantView`). */
+  set(nodeId, key) { this.bind(nodeId, key, 'pinned'); return this; }
 
   /**
    * The operator resolves a conflict for `nodeId`: `key` becomes its binding at `pinned`, whatever
@@ -355,6 +418,7 @@ class RosterKeyRegistry {
   resolveConflict(nodeId, key) {
     if (!isNodeId(nodeId) || !isIdentityKey(key)) return { resolved: false, reason: 'malformed' };
     if (this._anchor && nodeId === this._anchor.nodeId) return { resolved: false, reason: 'anchor' };
+    if (this._self && nodeId === this._self.nodeId) return { resolved: false, reason: 'self' };
     this._byNode.set(nodeId, { key, source: 'pinned', at: Date.now(), seenAt: this._now(), verifiedAt: null, vouched: false, seenSaved: null, verifiedSaved: null });
     this._lru.delete(nodeId);
     this._persist({ nodeId, key, source: 'pinned', operator: true });
@@ -363,6 +427,15 @@ class RosterKeyRegistry {
     return { resolved: true };
   }
 
+  /**
+   * Record a conflict found outside the registry: a session proving `got` for `nodeId` while a live
+   * session-scoped binding (the node's, not persisted here) holds `had` (security review D).
+   */
+  noteConflict(nodeId, had, hadSource, got, gotSource, at = Date.now()) {
+    if (!isNodeId(nodeId) || !isIdentityKey(had) || !isIdentityKey(got)) return;
+    this._recordConflict(nodeId, had, hadSource, got, gotSource, at);
+  }
+
   /** The operator resets `nodeId`'s sticky floor: its Legacy Import route may be used again. */
   resetFloor(nodeId) {
     if (!isNodeId(nodeId)) return false;
@@ -375,7 +448,7 @@ class RosterKeyRegistry {
 
   _recordConflict(nodeId, had, hadSource, got, gotSource, at) {
     this._conflictCount++;
-    if (this._loading) return; // a conflict in the file was recorded when it happened
+    if (this._loading || this._readOnly) return; // a conflict in the file was recorded when it happened
     if (this._conflicts.some((c) => c.nodeId === nodeId && c.got === got)) return;
     if (this._conflicts.length >= MAX_CONFLICTS) return;
     if (this._conflicts.filter((c) => c.nodeId === nodeId).length >= MAX_CONFLICTS_PER_NODE) return;
@@ -387,7 +460,7 @@ class RosterKeyRegistry {
   }
 
   _rewriteConflicts() {
-    if (!this._dir) return;
+    if (!this._dir || this._readOnly) return;
     const file = path.join(this._dir, CONFLICTS_FILE);
     try {
       const tmp = `${file}.${process.pid}.tmp`;
@@ -397,7 +470,7 @@ class RosterKeyRegistry {
   }
 
   _persist(rec) {
-    if (!this._dir || this._loading) return;
+    if (!this._dir || this._loading || this._readOnly) return;
     try { fs.appendFileSync(path.join(this._dir, KEYS_FILE), JSON.stringify(rec) + '\n'); }
     catch { /* best effort — never let persistence break verification */ }
   }
@@ -407,7 +480,7 @@ class RosterKeyRegistry {
     let text = null;
     try { text = fs.readFileSync(file, 'utf8'); } catch { text = null; }
     this._loadConflicts();
-    if (text === null) { this._writeFresh(); return; }
+    if (text === null) { if (!this._readOnly) this._writeFresh(); return; }
     let marked = false;
     const records = [];
     for (const line of text.split('\n')) {
@@ -429,15 +502,17 @@ class RosterKeyRegistry {
       // The expiry index, least recently seen first.
       this._lru.clear();
       for (const [id] of [...this._byNode].filter(([, b]) => this._expirable(b)).sort((x, y) => x[1].seenAt - y[1].seenAt)) this._lru.set(id, true);
-      expired = this.expire();
+      if (!this._readOnly) expired = this.expire();
     } finally { this._loading = false; }
     // Rewritten once, atomically: a 0.13 file (migration), or one whose lines outgrew its bindings.
+    if (this._readOnly) return;
     if (!marked || unstamped > 0 || expired > 0 || records.length > 2 * this._byNode.size + 256) this._compact();
   }
 
   /** Replay one 0.14 line. A 0.13 rollback may have appended lines in its own vocabulary. */
   _replay(r) {
     if (!r || typeof r !== 'object' || !isNodeId(r.nodeId)) return;
+    if (r.floor === true) { this._floorArmed.add(r.nodeId); if (r.floorReset === false) this._floorReset.delete(r.nodeId); return; }
     if (r.floorReset === true) { this._floorReset.add(r.nodeId); return; }
     if (r.floorReset === false) { this._floorReset.delete(r.nodeId); return; }
     if (r.expired === true) { this._drop(r.nodeId); return; }
@@ -450,7 +525,9 @@ class RosterKeyRegistry {
     let source = r.source;
     if (source === 'anchor') return;                       // configuration, never replayed
     if (source === 'handshake') source = 'legacy-claim';   // a 0.13 rollback's unproven hello
+    if (source === 'grant') return;                        // a view over grants, never stored (review C)
     if (!SOURCES.has(source) || !isIdentityKey(r.key)) return;
+    if (this._self && r.nodeId === this._self.nodeId) return; // this node's own id is configuration
     if (r.operator === true) { this._byNode.set(r.nodeId, { key: r.key, source: 'pinned', at: null, seenAt: null, verifiedAt: null, vouched: false, seenSaved: null, verifiedSaved: null }); return; }
     this.bind(r.nodeId, r.key, source, { at: null });
     const b = this._byNode.get(r.nodeId);
@@ -487,14 +564,19 @@ class RosterKeyRegistry {
       if (!prev || (prev.key !== r.key && s > (rank013[prev.source] ?? 0))) final.set(r.nodeId, { key: r.key, source: r.source });
       else if (prev.key === r.key && s > (rank013[prev.source] ?? 0)) prev.source = r.source;
     }
-    const counts = { read, bindings: 0, legacyClaim: 0, grant: 0, droppedAnchor: 0, droppedMalformed: 0 };
+    const counts = { read, bindings: 0, legacyClaim: 0, grant: 0, droppedAnchor: 0, droppedMalformed: 0, droppedSelf: 0 };
     for (const [nodeId, b] of final) {
       if (b.source === 'anchor') { counts.droppedAnchor++; continue; }
       if (!isIdentityKey(b.key)) { counts.droppedMalformed++; continue; }
-      const source = b.source === 'grant' ? 'grant' : 'legacy-claim';
-      this._byNode.set(nodeId, { key: b.key, source, at: null, seenAt: null, verifiedAt: null, vouched: false, seenSaved: null, verifiedSaved: null });
+      if (this._self && nodeId === this._self.nodeId) { counts.droppedSelf++; continue; }
+      // Every 0.13 entry is a legacy claim, a `grant` one too (security review C): 0.13 pinned a
+      // grant's key without checking that its grantor was authorised when it signed or still is, so
+      // it is the EXPECTED key, never one that verifies. The grants themselves are re-verified by the
+      // role-grant store, whose view binds what is in effect now.
+      this._byNode.set(nodeId, { key: b.key, source: 'legacy-claim', at: null, seenAt: null, verifiedAt: null, vouched: false, seenSaved: null, verifiedSaved: null });
       counts.bindings++;
-      counts[source === 'grant' ? 'grant' : 'legacyClaim']++;
+      counts.legacyClaim++;
+      if (b.source === 'grant') counts.grant++;
     }
     this._migration = counts;
   }
@@ -510,6 +592,7 @@ class RosterKeyRegistry {
       if (b.vouched) line.vouched = true;
       lines.push(JSON.stringify(line));
     }
+    for (const nodeId of this._floorArmed) lines.push(JSON.stringify({ nodeId, floor: true }));
     for (const nodeId of this._floorReset) lines.push(JSON.stringify({ nodeId, floorReset: true }));
     try {
       const tmp = `${file}.${process.pid}.tmp`;
diff --git a/lib/session.js b/lib/session.js
index 1234b7a2..45ff46c4 100644
--- a/lib/session.js
+++ b/lib/session.js
@@ -23,14 +23,21 @@
  *   - `cmb-encrypted-v2` must be selected: a session that would carry records in the clear is not a
  *     Core Secure session, and a negotiation failure never falls back to anything (§17.3).
  *   - After confirmation every frame is sealed: records as `cmb-encrypted` (§18.2.1), every other
- *     frame but ping/pong/error as `control-encrypted` (lib/core/sealed-control.js). The receive
- *     counter advances only after the AEAD opens; a forged frame moves nothing; an authentic frame
- *     out of order (replay, rollback, gap) closes the session so the owner re-handshakes.
+ *     frame but ping/pong as `control-encrypted` (lib/core/sealed-control.js), an `error` included
+ *     (security review F). The receive counter advances only after the AEAD opens; a forged frame
+ *     moves nothing; an authentic replay or rollback is discarded (a relay can repeat what it carried,
+ *     draft spec PR #23); a gap closes the session so the owner re-handshakes.
+ *   - ERRORS ARE INFORMATION, NEVER COMMANDS (security review F). A sealed `error` is the peer's:
+ *     1010 SESSION_CLOSED and 1009 IDENTITY_CONFLICT end the session, anything else is noted. A clear
+ *     `error` on a confirmed session is anyone's and is ignored, except 1011 UNKNOWN_SESSION ("I hold
+ *     no session with you"), which prompts a new handshake (event 'unknown-session') and never a
+ *     teardown: the session stays until a new one supersedes it.
  *
  * The session emits:
  *   'confirmed' (session)            — both proofs valid; the facts are on the session
  *   'frame' (frame, session)         — one authenticated inner frame ({type:'cmb', cmb} for a record)
  *   'refused' (type, reason, session)— a wire frame this session does not take (counted by the owner)
+ *   'unknown-session' (session)      — a clear 1011: the peer says it holds no session with this node
  *   'closed' ({ reason, desync }, session)
  *
  * @copyright 2026 SYM.BOT. Apache 2.0 License.
@@ -46,10 +53,20 @@ const { SEND_FAILURE, MAX_FRAME_SIZE } = require('./frame-parser');
 
 const HANDSHAKE_TIMEOUT_MS = 10_000;
 const HANDSHAKE_TYPES = new Set(['client-hello', 'server-hello', 'client-finish']);
+/** MMP §7.2 error codes (draft spec PRs #21, #23, #31): a bound nodeId proving another key; the
+ *  peer closed this session; the sender holds no session with the receiver. */
+const IDENTITY_CONFLICT = 1009;
+const SESSION_CLOSED = 1010;
+const UNKNOWN_SESSION = 1011;
 /** Room left for a relay envelope ({to, payload}) around a sealed frame. */
 const ENVELOPE_ALLOWANCE = 4096;
 const X25519_SPKI_PREFIX = Buffer.from('302a300506032b656e032100', 'hex');
-const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** A record offered to a session its signed audience does not include (review finding A). */
+class AudienceError extends Error {}
+const { signedProjection } = require('./core/record-canonical');
+// nodeIds are canonical lowercase on the wire (§3.1.1; review finding B): an upper-case alias of a
+// bound nodeId is not a second identity, it is refused at the door.
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 const B64_32 = /^[A-Za-z0-9_-]{43}$/;
 const SIG_RE = /^[A-Za-z0-9_-]{86}$/;
 const EXT_RE = /^[a-z0-9][a-z0-9._-]{0,63}$/;
@@ -213,7 +230,9 @@ class PeerSession extends EventEmitter {
         if (this.expectNodeId && f.nodeId !== this.expectNodeId) {
           this._fail('node-id-mismatch', `the session is bound to ${String(this.expectNodeId).slice(0, 8)}, the hello names ${String(f.nodeId).slice(0, 8)}`); return;
         }
-        if (f.room !== this.room) { this._fail('room-mismatch', `the peer is in '${String(f.room).slice(0, 64)}', this node in '${this.room}'`); return; }
+        // Rooms compare in NFC (§8.8.4 normalises the room it signs; review): two spellings of one
+        // room are one room, and a lookalike in another normalisation is not let through either way.
+        if (typeof f.room !== 'string' || f.room.normalize('NFC') !== String(this.room).normalize('NFC')) { this._fail('room-mismatch', `the peer is in '${String(f.room).slice(0, 64)}', this node in '${this.room}'`); return; }
         const sa = serverAccept({ clientHelloFrame: f, self: this._self(), agree: this._agree() });
         if (!sa.selected.includes(EXT_CMB_ENCRYPTED_V2)) { this._fail('no-core-secure', 'the client did not offer cmb-encrypted-v2'); return; }
         this._clientHelloSeen = f;
@@ -276,10 +295,11 @@ class PeerSession extends EventEmitter {
       case 'ping': this.lastSeen = Date.now(); this._wire({ type: 'pong' }); return;
       case 'pong': this.lastSeen = Date.now(); return;
       case 'error':
-        // §7.2: 2xxx errors are informational; anything else ends the session (the peer closed it).
-        if (Number.isInteger(f.code) && f.code >= 2000 && f.code < 3000) return;
-        // 1009 IDENTITY_CONFLICT (draft spec PR #21): the peer binds this node's nodeId to another key.
-        this._fail(f.code === 1009 ? 'identity-conflict' : 'peer-closed', typeof f.message === 'string' ? f.message.slice(0, 200) : 'error frame', { notify: false });
+        // A CLEAR error on a confirmed session is anyone's to write (security review F): never a
+        // command. Only 1011 UNKNOWN_SESSION means something — the peer holds no session with this
+        // node (it restarted) — and it prompts a new handshake while this session stays.
+        if (f.code === UNKNOWN_SESSION) { this.emit('unknown-session', this); return; }
+        this._refuse('error', 'clear-error-ignored');
         return;
       default:
         // A legacy `cmb`, a plaintext `mood`, a legacy `handshake`, `state-sync`, a stray hello: none
@@ -295,7 +315,11 @@ class PeerSession extends EventEmitter {
       this.lastSeen = Date.now();
       return out;
     } catch (err) {
-      if (err && err.name === 'SessionDesyncError') {
+      if (err && err.name === 'SessionDesyncError' && err.kind === 'replay') {
+        // Authentic, but already received: a relay repeating what it carried (draft spec PR #23).
+        // Discarded; the session is unharmed.
+        this._refuse(f.type, 'replay');
+      } else if (err && err.name === 'SessionDesyncError') {
         this._fail('desync', err.message, { desync: true });
       } else {
         this._refuse(f.type, `${what} did not authenticate`);
@@ -323,18 +347,27 @@ class PeerSession extends EventEmitter {
   _openControl(f) {
     const inner = this._position(f, (trafficKey) => openControlFrame({ frame: f, trafficKey }), 'control frame');
     if (!inner) return;
+    if (inner.type === 'error') {
+      // A SEALED error is the peer's own word: 1010 it closed this session, 1009 it binds this node's
+      // nodeId to another key (draft spec PR #21); anything else is information.
+      const message = typeof inner.message === 'string' ? inner.message.slice(0, 200) : 'error frame';
+      if (inner.code === SESSION_CLOSED) { this._fail('peer-closed', message, { notify: false }); return; }
+      if (inner.code === IDENTITY_CONFLICT) { this._fail('identity-conflict', message, { notify: false }); return; }
+      this._refuse('error', `peer-error-${Number.isInteger(inner.code) && inner.code >= 1000 && inner.code < 5000 ? inner.code : 'other'}`);
+      return;
+    }
     this.emit('frame', inner, this);
   }
 
   /**
-   * Transport-shaped send. Records go as `cmb-encrypted`, ping/pong/error as they are, everything
-   * else as `control-encrypted`. Says why a frame was not taken.
+   * Transport-shaped send. Records go as `cmb-encrypted`, ping/pong as they are, everything else
+   * (an `error` included: security review F) as `control-encrypted`. Says why a frame was not taken.
    * @returns {{ ok: boolean, reason?: string, bytes?: number }}
    */
   trySend(frame) {
     if (this.state !== 'confirmed') return { ok: false, reason: SEND_FAILURE.NOT_CONNECTED };
     if (!frame || typeof frame.type !== 'string') return { ok: false, reason: 'not-a-frame' };
-    if (frame.type === 'ping' || frame.type === 'pong' || frame.type === 'error') return this._wire(frame);
+    if (frame.type === 'ping' || frame.type === 'pong') return this._wire(frame);
     let wire;
     let pos;
     try {
@@ -342,7 +375,7 @@ class PeerSession extends EventEmitter {
       wire = frame.type === 'cmb' ? this._sealRecord(frame.cmb, pos) : buildControlFrame({ frame, sessionId: this.sessionId, direction: pos.direction, sequence: pos.sequence, trafficKey: pos.trafficKey });
     } catch (err) {
       if (pos) this._mmp.cancelSend(pos.sequence);
-      return { ok: false, reason: 'unsealable', error: err && err.message };
+      return { ok: false, reason: err instanceof AudienceError ? 'not-addressed' : 'unsealable', error: err && err.message };
     }
     const bytes = Buffer.byteLength(JSON.stringify(wire), 'utf8');
     if (bytes + (this.kind === 'relay' ? ENVELOPE_ALLOWANCE : 0) > MAX_FRAME_SIZE) {
@@ -359,9 +392,23 @@ class PeerSession extends EventEmitter {
 
   send(frame) { return this.trySend(frame).ok; }
 
+  /** Bytes written to this session's transport and not yet sent (0 when the transport cannot say). */
+  pendingBytes() {
+    const t = this.transport;
+    try { return t && typeof t.pendingBytes === 'function' ? t.pendingBytes() : 0; } catch { return 0; }
+  }
+
   _sealRecord(cmb, pos) {
     if (!cmb || !cmb.metadata || !cmb.categories) throw new Error('not a record');
     if (cmb.metadata.signatureSuite !== 'mmp-sig-v2.0' || !cmb.metadata.sig) throw new Error('only signed v2.0 records travel in Core Secure (§18.3.1)');
+    // THE SIGNED AUDIENCE GOVERNS EVERY SEND (review finding A): the one seal point refuses a record
+    // whose signed `to` names anyone but this session's proven peer, whichever path offered it (an
+    // anchor replay, a fetch answer, a broadcast, a queued frame). A directed record is sealed only to
+    // the node it was signed to.
+    const to = cmb.metadata.to;
+    if (to !== null && to !== undefined && to !== this.nodeId) throw new AudienceError(`a record signed to ${String(to).slice(0, 8)} is never sealed to ${String(this.nodeId).slice(0, 8)}`);
+    // Only the signed projection travels (finding B): members no signature covers are not sent.
+    cmb = signedProjection(cmb);
     const metadata = { ...cmb.metadata };
     let applicationBytes = null;
     if (metadata.application && typeof metadata.application === 'object') {
@@ -394,15 +441,18 @@ class PeerSession extends EventEmitter {
   }
 
   /**
-   * Close the session. On a relay, closing means sending an `error` frame to the peer (design D2) and
-   * dropping the session; on TCP the transport closes with it. Emits 'closed' once.
+   * Close the session. On a relay, closing a CONFIRMED session means sending the peer a sealed 1010
+   * SESSION_CLOSED (design D2; security review F) and dropping the session; a handshake that did not
+   * confirm sends nothing (it leaves any confirmed session exactly as it was, draft spec PR #23); on
+   * TCP the transport closes with it. Emits 'closed' once.
    */
   close(reason = 'closed', { detail = null, desync = false, notify = true, closeTransport = true } = {}) {
-    if (this.closed) return;
+    if (this.closed || this._closing) return;
+    this._closing = true; // the notice below may fail and close again: once is enough
     const wasConfirmed = this.state === 'confirmed';
     clearTimeout(this._timer);
-    if (notify && this.kind === 'relay' && this.transport) {
-      this._wire({ type: 'error', code: 4400, message: `session closed: ${reason}`, ...(this.sessionId ? { detail: `session:${this.sessionId}` } : {}) });
+    if (notify && wasConfirmed && this.kind === 'relay' && this.transport) {
+      try { this.trySend({ type: 'error', code: SESSION_CLOSED, message: `session closed: ${String(reason).slice(0, 80)}` }); } catch { /* closing either way */ }
     }
     this.state = 'closed';
     this.closedReason = reason;
@@ -412,4 +462,4 @@ class PeerSession extends EventEmitter {
   }
 }
 
-module.exports = { PeerSession, agreeX25519, freshX25519, checkOffer, HANDSHAKE_TIMEOUT_MS, HANDSHAKE_TYPES };
+module.exports = { PeerSession, agreeX25519, freshX25519, checkOffer, HANDSHAKE_TIMEOUT_MS, HANDSHAKE_TYPES, IDENTITY_CONFLICT, SESSION_CLOSED, UNKNOWN_SESSION };
diff --git a/lib/transport.js b/lib/transport.js
index 481aaed2..4886e0e2 100644
--- a/lib/transport.js
+++ b/lib/transport.js
@@ -81,6 +81,11 @@ class TcpTransport extends EventEmitter {
     try { this._socket.destroy(); } catch {}
   }
 
+  /** Bytes written to this connection and not yet taken by the kernel (an outbound byte budget). */
+  pendingBytes() {
+    try { return this._socket.writableLength || 0; } catch { return 0; }
+  }
+
   /** Close after what was written has gone out (an error frame before a refusal), at most 1 s later. */
   end() {
     if (this._closed) return;
diff --git a/lib/wire-identity.js b/lib/wire-identity.js
index 104c7cdc..6f333b5d 100644
--- a/lib/wire-identity.js
+++ b/lib/wire-identity.js
@@ -18,12 +18,19 @@
  * @copyright 2026 SYM.BOT. Apache 2.0 License.
  */
 
+const { isCanonicalNodeId } = require('./core/record-canonical');
+
 const MAX_NODE_ID = 256;
 const MAX_NAME = 256;
 
-/** A nodeId off the wire, or null when it is not one. */
+/**
+ * A nodeId off the wire, or null when it is not one. Only its canonical lowercase form is one
+ * (§3.1.1; security review B): an upper-case spelling of a nodeId is not a second identity, and it
+ * is not this one either, so it is refused at the door (a relay `from`, an announcement, a discovery
+ * record, a gossip entry).
+ */
 function wireNodeId(x) {
-  return typeof x === 'string' && x.length > 0 && x.length <= MAX_NODE_ID ? x : null;
+  return typeof x === 'string' && x.length > 0 && x.length <= MAX_NODE_ID && isCanonicalNodeId(x) ? x : null;
 }
 
 /**
diff --git a/tests/_core-secure.js b/tests/_core-secure.js
index 150a8d10..7b1b3986 100644
--- a/tests/_core-secure.js
+++ b/tests/_core-secure.js
@@ -137,7 +137,13 @@ function admitAs(node, id, { extensions = ['cmb-encrypted-v2', 'sym-attest-v1',
     trySend(f) { sent.push(f); return { ok: true }; },
     close() { this.closed = true; this._closed = true; },
   };
-  if (id.publicKey) node._roster.bind(id.nodeId, id.publicKey, 'proven');
+  // As _admitSession holds it (security review D): a session-scoped binding for the proven key; the
+  // durable registry binds it only once it is earned (or the test binds it itself).
+  if (id.publicKey && node._sessionKeys) {
+    let held = node._sessionKeys.get(id.nodeId);
+    if (!held || held.key !== id.publicKey) { held = { key: id.publicKey, sessions: new Set() }; node._sessionKeys.set(id.nodeId, held); }
+    held.sessions.add(session);
+  }
   node._peers.set(id.nodeId, { peerId: id.nodeId, name: session.name, identityKey: id.publicKey || null, transports: new Map([[kind, session]]), transport: session, isOutbound: false, source: kind, lastSeen: Date.now() });
   return session;
 }
diff --git a/tests/audit-delivery-authorship.test.js b/tests/audit-delivery-authorship.test.js
index 6d1175ba..2bd0d02f 100644
--- a/tests/audit-delivery-authorship.test.js
+++ b/tests/audit-delivery-authorship.test.js
@@ -405,7 +405,8 @@ describe('author and inbox id on surfaced entries', () => {
       node._frameHandler.handle(from(node, B_ID), frame(signed(mkCmb('authorship check', { by: 'claude-sym-agent-a' }))));
       await settle();
       const e = seen.accepted[0];
-      assert.deepStrictEqual(e.author, { name: 'claude-sym-agent-a', nodeId: A_ID.nodeId, via: { name: 'peerB', nodeId: B_ID.nodeId } });
+      // The author carries the public key its signature verified under (mesh-channel 0.11.0).
+      assert.deepStrictEqual(e.author, { name: 'claude-sym-agent-a', nodeId: A_ID.nodeId, key: PEER_A.pub, via: { name: 'peerB', nodeId: B_ID.nodeId } });
       assert.ok(!String(e.author.name).includes('+'));
       const item = node.inboxGet(e.inboxId);
       assert.ok(item, 'the surfaced entry names its inbox id');
diff --git a/tests/core-secure-authority.test.js b/tests/core-secure-authority.test.js
index e9c12ae1..805f814f 100644
--- a/tests/core-secure-authority.test.js
+++ b/tests/core-secure-authority.test.js
@@ -26,7 +26,8 @@ const { signGrant } = require('../lib/core');
 function kp(nodeId) {
   const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519');
   return {
-    nodeId,
+    // nodeIds are canonical lowercase at every door, a grant's included (security review B).
+    nodeId: nodeId.toLowerCase(),
     priv: privateKey.export({ format: 'der', type: 'pkcs8' }).subarray(16).toString('base64url'),
     pub: publicKey.export({ format: 'der', type: 'spki' }).subarray(12).toString('base64url'),
   };
diff --git a/tests/core-secure-binding-lifetime.test.js b/tests/core-secure-binding-lifetime.test.js
index fcf27857..fb895d78 100644
--- a/tests/core-secure-binding-lifetime.test.js
+++ b/tests/core-secure-binding-lifetime.test.js
@@ -3,12 +3,12 @@
 require('./_isolate-home'); // redirect $HOME before lib/config loads
 
 /**
- * Design D3, binding lifetime (0.13.17 re-review): new keypairs are free, so a key registry that only
- * grows can be filled by identity churn — 0.13.17's cap of 16,384 never-evicted bindings was a
- * lockout anyone on the LAN could fill in seconds. A first-contact `proven` binding that verified
- * nothing since (no record, grant, attestation or later session) and was not seen for 30 days
- * expires; one that ever verified something, or is pinned, grant-vouched, anchored or a legacy
- * claim, never does. The facts are persisted with the binding.
+ * Design D3, binding lifetime (0.13.17 re-review), as the security review changed it: new keypairs
+ * are free, so a key registry that only grows can be filled by identity churn. A confirmed session
+ * runs with a SESSION-SCOPED binding; the durable registry takes a binding only when it is EARNED —
+ * an admitted verified record, a pin, or a grant in effect (a view) — and a re-handshake earns
+ * nothing. A `proven` binding that verified nothing (one made by a path that binds without earning)
+ * expires after 30 days unseen; nothing is ever evicted before it expires. The facts are persisted.
  */
 
 const { describe, it } = require('node:test');
@@ -46,12 +46,13 @@ describe('binding lifetime (D3)', () => {
     assert.strictEqual(r.expiredCount(), 20_000);
   });
 
-  it('pinned, grant-vouched, grant, legacy-claim and live bindings never expire; one seen recently does not', () => {
+  it('pinned, grant-vouched (a view), grant, legacy-claim and live bindings never expire; one seen recently does not', () => {
     let t = 0;
     const live = new Set(['live']);
-    const r = new RosterKeyRegistry({ now: () => t, isLive: (id) => live.has(id) });
+    const view = new Map([['grant', key(2)], ['vouched', key(4)]]); // the grants in effect now
+    const r = new RosterKeyRegistry({ now: () => t, isLive: (id) => live.has(id), grantView: (id) => view.get(id) });
     r.bind('pinned', key(1), 'pinned');
-    r.bind('grant', key(2), 'grant');
+    assert.strictEqual(r.bind('grant', key(2), 'grant').bound, true, 'a grant in effect binds as a view');
     r.bind('claim', key(3), 'legacy-claim');
     r.bind('vouched', key(4), 'proven'); r.bind('vouched', key(4), 'grant');
     r.bind('live', key(5), 'proven');
@@ -62,9 +63,36 @@ describe('binding lifetime (D3)', () => {
     t += 11 * DAY;
     r.noteVerified('record');
     assert.strictEqual(r.expire(), 1);
-    assert.deepStrictEqual(r.entries().map((e) => e.nodeId).sort(), ['claim', 'grant', 'live', 'pinned', 'record', 'seen', 'vouched']);
+    assert.deepStrictEqual(r.entries().map((e) => e.nodeId).sort(), ['claim', 'live', 'pinned', 'record', 'seen', 'vouched'], 'a grant binding is never stored');
+    assert.strictEqual(r.get('grant'), key(2), 'it verifies while the grant is in effect');
+    assert.strictEqual(r.source('grant'), 'grant');
+    view.delete('grant');
+    assert.strictEqual(r.get('grant'), undefined, 'and the binding ends with the grant (security review C)');
     assert.strictEqual(r.expected('gone'), undefined, 'the expired id is unbound: a later session binds it afresh');
     assert.strictEqual(r.bind('gone', key(9), 'proven').created, true);
+    // The vouch ends: the proven binding it kept alive is expirable again.
+    view.delete('vouched');
+    t += 31 * DAY;
+    r.expire();
+    assert.strictEqual(r.get('vouched'), undefined, 'no grant in effect keeps it any more');
+  });
+
+  it('a full registry evicts nothing before it expires: a newcomer is refused a durable binding, and re-handshakes earn nothing', () => {
+    let t = 0;
+    const r = new RosterKeyRegistry({ now: () => t, maxBindings: 4 });
+    const H = 'honest-once-seen';
+    r.bind(H, key('h'), 'proven');
+    for (let i = 0; i < 3; i++) r.bind(`fill-${i}`, key(i), 'proven');
+    // p8-evict: fresh identities used to evict the honest binding and let a squatter take its id.
+    for (let i = 0; i < 100; i++) assert.strictEqual(r.bind(`churn-${i}`, key(100 + i), 'proven').reason, 'full');
+    assert.strictEqual(r.get(H), key('h'), 'the honest binding is still there');
+    assert.strictEqual(r.bind(H, key('squatter'), 'proven').reason, 'conflict', 'a squatter is a conflict, not a newcomer');
+    assert.strictEqual(r.evictedCount(), 0);
+    assert.strictEqual(r.refusedFullCount(), 100);
+    // Expiry is what frees room: 30 days unseen.
+    t += 31 * DAY;
+    assert.ok(r.expire() >= 1);
+    assert.strictEqual(r.bind('newcomer', key('n'), 'proven').created, true);
   });
 
   it('the facts persist: after a restart 31 days on, the flood expires at load and the file is compacted', () => {
@@ -88,15 +116,53 @@ describe('binding lifetime (D3)', () => {
     } finally { fs.rmSync(dir, { recursive: true, force: true }); }
   });
 
-  it('at the node: a verified record, or a second session, makes a binding permanent', async () => {
+  it('at the node: only an ADMITTED verified record earns a durable binding; one refused for its room, or a second session, earns nothing', async () => {
     const node = new SymNode({ name: `life-${Date.now()}`, silent: true, discovery: new NullDiscovery(), room: 'life' });
     try {
       const author = identity('author');
       const session = admitAs(node, author);
       const entry = () => node._roster.entries().find((e) => e.nodeId === author.nodeId);
-      assert.strictEqual(entry().verified, null, 'first contact: proven, nothing verified yet');
-      await deliver(node, session, { type: 'cmb', cmb: signedRecord(author, { room: 'life', categories: { focus: 'a record that verifies' } }) });
-      assert.ok(entry().verified, 'a record verified under it');
+      assert.strictEqual(entry(), undefined, 'first contact: a session-scoped binding, nothing durable');
+      assert.strictEqual(node._identityKey(author.nodeId), author.publicKey, 'the session still verifies under its proven key');
+      // binding-squat (1): a signed record refused for its room earns nothing.
+      await deliver(node, session, { type: 'cmb', cmb: signedRecord(author, { room: 'some-other-room', categories: { focus: 'refused for its room' } }) });
+      assert.strictEqual(entry(), undefined, 'a record refused for its room protects no history');
+      // An admitted one earns it.
+      node._svafEvaluator.evaluate = async () => ({ decision: 'aligned', total_drift: 0.1, category_drifts: { focus: 0.1 }, gate_values: { g: 1 } });
+      await deliver(node, session, { type: 'cmb', cmb: signedRecord(author, { room: 'life', categories: { focus: 'a record that is admitted' } }) });
+      const { until } = require('./_core-secure');
+      await until(() => entry() && entry().verified, 3000);
+      assert.strictEqual(entry().source, 'proven');
+      assert.ok(entry().verified, 'an admitted record verified under it');
+    } finally { await node.stop(); }
+  });
+
+  it('at the node: a second key for a nodeId with a live session-scoped binding is a 1009 conflict, even with the registry full', async () => {
+    const node = new SymNode({ name: `life-full-${Date.now()}`, silent: true, discovery: new NullDiscovery(), room: 'life', maxKeyBindings: 1 });
+    try {
+      await node.start();
+      node._roster.bind(identity('filler').nodeId, identity('filler').publicKey, 'pinned');
+      const { memoryPipe, until } = require('./_core-secure');
+      const { PeerSession } = require('../lib/session');
+      const sessionAs = async (id) => {
+        const [tc, ts] = memoryPipe();
+        node.connectTransport(ts, { role: 'server' });
+        const s = new PeerSession({ role: 'client', transport: tc, local: id, room: 'life', extensions: ['cmb-encrypted-v2'], implementation: { name: 'x', version: '1' }, expectNodeId: node.nodeId });
+        tc.on('message', (f) => s.receiveWire(f));
+        s.start();
+        await until(() => s.closed || (s.confirmed && node._peers.has(id.nodeId)), 3000);
+        return s;
+      };
+      const honest = identity('honest');
+      const h = await sessionAs(honest);
+      assert.ok(node._peers.has(honest.nodeId), 'the honest newcomer is admitted with a session-scoped binding');
+      const squat = { ...identity('squatter'), nodeId: honest.nodeId };
+      const sq = await sessionAs(squat);
+      await until(() => sq.closed, 3000);
+      assert.strictEqual(sq.closedReason, 'identity-conflict', 'the squatter is refused with 1009');
+      assert.strictEqual(node._peers.get(honest.nodeId).identityKey, honest.publicKey);
+      assert.ok(node._roster.conflicts().some((c) => c.nodeId === honest.nodeId && c.hadSource === 'session'), 'recorded');
+      h.close('done');
     } finally { await node.stop(); }
   });
 });
diff --git a/tests/core-secure-identity.test.js b/tests/core-secure-identity.test.js
index b5994d96..a415b4a9 100644
--- a/tests/core-secure-identity.test.js
+++ b/tests/core-secure-identity.test.js
@@ -24,7 +24,7 @@ const { SymNode } = require('../lib/node');
 const { NullDiscovery } = require('../lib/discovery');
 const relocation = require('../lib/relocation');
 const { keyFingerprint } = require('../lib/roster-keys');
-const { until, identity } = require('./_core-secure');
+const { until, identity, connectNodes } = require('./_core-secure');
 
 const uniq = (b) => `${b}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
 
@@ -93,6 +93,11 @@ describe('relocation (D9.2)', () => {
     const r = relocation.exportNode({ name, out, passphrase: 'a long operator passphrase' });
     assert.strictEqual(r.nodeId, nodeId);
     assert.ok(config.readTombstone(nodeId), 'tombstoned');
+    // Security review: once the bundle is durable the source loses the key and the 0.13 path to it.
+    const left = JSON.parse(fs.readFileSync(path.join(config.nodeDirById(nodeId), 'identity.json'), 'utf8'));
+    assert.strictEqual(left.privateKey, null, 'the source keeps no private key');
+    assert.strictEqual(left.publicKey, pub);
+    assert.throws(() => fs.lstatSync(path.join(config.NODES_DIR, name)), /ENOENT/, 'the 0.13-compatible nodes/<name> link is gone');
     assert.ok(!fs.readFileSync(out, 'utf8').includes(node._identity.privateKey), 'the private key is not in the clear');
     assert.throws(() => new SymNode({ name, silent: true, discovery: new NullDiscovery() }), (e) => e.code === 'EIDENTITYTOMBSTONED', 'the source refuses to start it');
     // Import: the wrong passphrase does not open it; no pin refuses it; the pinned key admits it.
@@ -140,7 +145,45 @@ describe('relocation (D9.2)', () => {
       fs.writeFileSync(tampered, JSON.stringify({ ...b, nonce: nonce.toString('base64url'), ciphertext: Buffer.concat([body, c.getAuthTag()]).toString('base64url') }));
     }
     assert.throws(() => importNode({ from: tampered, passphrase: 'a long operator passphrase', expect: { nodeId, key: realPub } }), /re-keyed bundle/);
-    assert.throws(() => importNode({ from: out, passphrase: 'a long operator passphrase' }), /no independently pinned key/);
+    // No first-contact fallback (security review): the pin is explicit, whatever this host learned.
+    assert.throws(() => importNode({ from: out, passphrase: 'a long operator passphrase' }), /no explicit pinned key/);
+  });
+
+  it('a bundle is signed by its node: a changed header or contents is refused, and a host-key bundle cannot be re-wrapped for another host', async () => {
+    const name = uniq('id-signed');
+    const node = new SymNode({ name, silent: true, discovery: new NullDiscovery() });
+    const nodeId = node.nodeId; const pub = node._identity.publicKey;
+    await node.stop();
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'bundle-'));
+    const out = path.join(dir, 'node.bundle');
+    relocation.exportNode({ name, out, passphrase: 'a long operator passphrase' });
+    const crypto2 = require('crypto');
+    const open = (b) => {
+      const key = crypto2.scryptSync('a long operator passphrase', Buffer.from(b.salt, 'base64url'), 32, { N: b.N, r: b.r, p: b.p, maxmem: 128 * 1024 * 1024 });
+      const sealed = Buffer.from(b.ciphertext, 'base64url');
+      const d = crypto2.createDecipheriv('aes-256-gcm', key, Buffer.from(b.nonce, 'base64url'));
+      d.setAuthTag(sealed.subarray(sealed.length - 16));
+      return { key, plain: JSON.parse(Buffer.concat([d.update(sealed.subarray(0, sealed.length - 16)), d.final()]).toString('utf8')) };
+    };
+    const reseal = (b, key, plain, file) => {
+      const nonce = crypto2.randomBytes(12);
+      const c = crypto2.createCipheriv('aes-256-gcm', key, nonce);
+      const body = Buffer.concat([c.update(Buffer.from(JSON.stringify(plain))), c.final()]);
+      fs.writeFileSync(file, JSON.stringify({ ...b, nonce: nonce.toString('base64url'), ciphertext: Buffer.concat([body, c.getAuthTag()]).toString('base64url') }));
+      return file;
+    };
+    const b = JSON.parse(fs.readFileSync(out, 'utf8'));
+    const { key, plain } = open(b);
+    assert.match(plain.signature, /^[A-Za-z0-9_-]{86}$/, 'the bundle carries the node\'s signature');
+    // A file added to the contents (someone holding the passphrase, not the key): refused.
+    const added = reseal(b, key, { ...plain, files: [...plain.files, { path: 'cmbs/planted.json', data: Buffer.from('{}').toString('base64') }] }, path.join(dir, 'added.bundle'));
+    assert.throws(() => relocation.importNode({ from: added, passphrase: 'a long operator passphrase', expect: { nodeId, key: pub } }), /not signed by the node/);
+    // The signature removed: refused.
+    const { signature, ...unsigned } = plain; void signature;
+    const stripped = reseal(b, key, unsigned, path.join(dir, 'stripped.bundle'));
+    assert.throws(() => relocation.importNode({ from: stripped, passphrase: 'a long operator passphrase', expect: { nodeId, key: pub } }), /not signed by the node/);
+    // The genuine one imports.
+    assert.strictEqual(relocation.importNode({ from: out, passphrase: 'a long operator passphrase', expect: { nodeId, key: pub } }).nodeId, nodeId);
   });
 
   it('a bundle can be sealed to the target host\'s key instead of a passphrase', async () => {
@@ -157,7 +200,33 @@ describe('relocation (D9.2)', () => {
 });
 
 describe('the interior (D9.3)', () => {
-  function cats(focus) { return { focus, issue: 'i', intent: 'x', motivation: 'y', commitment: 'z', perspective: 'p', mood: { text: 'calm' } }; }
+  /** A persistent line-oriented connection to the interior socket. */
+  function conn(sockPath) {
+    const s = net.createConnection(sockPath);
+    let buf = '';
+    const lines = [];
+    const waiters = [];
+    s.on('data', (d) => {
+      buf += d;
+      let i;
+      while ((i = buf.indexOf('\n')) !== -1) {
+        const m = JSON.parse(buf.slice(0, i)); buf = buf.slice(i + 1);
+        lines.push(m);
+        for (const w of [...waiters]) if (w.test(m)) { waiters.splice(waiters.indexOf(w), 1); w.resolve(m); }
+      }
+    });
+    const next = (test) => new Promise((resolve) => {
+      const hit = lines.find(test);
+      if (hit) { lines.splice(lines.indexOf(hit), 1); resolve(hit); return; }
+      waiters.push({ test: (m) => { if (!test(m)) return false; lines.splice(lines.indexOf(m), 1); return true; }, resolve });
+    });
+    let n = 0;
+    const ask = (req) => { const id = ++n; s.write(JSON.stringify({ ...req, id }) + '\n'); return next((m) => m.id === id); };
+    return { s, ask, next, close: () => new Promise((r) => { s.once('close', r); s.end(); }) };
+  }
+
+  // The kind is the signed intent (security review): a mind's categories leave intent to it.
+  function cats(focus) { return { focus, issue: 'i', motivation: 'y', commitment: 'z', perspective: 'p', mood: { text: 'calm' } }; }
 
   it('a submission without a live capability is refused; the node checks audience, size, rate, intent and lineage before it signs', async () => {
     const node = new SymNode({ name: uniq('id-mind'), silent: true, discovery: new NullDiscovery() });
@@ -171,10 +240,12 @@ describe('the interior (D9.3)', () => {
       assert.strictEqual(interior.submit(capability, { kind: 'observation', categories: cats('x'.repeat(70 * 1024)) }).reason, 'categories-too-large');
       assert.strictEqual(interior.submit(capability, { kind: 'observation', categories: cats('x'), payload: { blob: 'y'.repeat(600 * 1024) } }).reason, 'application-too-large');
       assert.strictEqual(interior.submit(capability, { kind: 'observation', categories: cats('x'), parents: ['cmb-' + '0'.repeat(64)] }).reason, 'parent-not-in-store');
+      assert.strictEqual(interior.submit(capability, { kind: 'observation', categories: { ...cats('x'), intent: 'command' } }).reason, 'intent-is-not-the-kind', 'an intent that is not the declared kind is refused');
       const ok = interior.submit(capability, { kind: 'observation', categories: cats('a mind observation') });
       assert.strictEqual(ok.ok, true);
       assert.match(ok.assertionId, /^asrt-/);
       assert.strictEqual(node._store.get(ok.key).cmb.metadata.createdByNodeId, node.nodeId, 'signed by the node: the mind holds no key');
+      assert.strictEqual(node._store.get(ok.key).cmb.categories.intent.text, 'observation', 'the kind is what the node signed as the intent');
       assert.strictEqual(interior.submit(capability, { kind: 'observation', categories: cats('second'), parents: [ok.key] }).ok, true, 'a parent in the store is fine');
       assert.strictEqual(interior.submit(capability, { kind: 'observation', categories: cats('third') }).ok, true);
       assert.strictEqual(interior.submit(capability, { kind: 'observation', categories: cats('fourth') }).reason, 'rate');
@@ -220,6 +291,82 @@ describe('the interior (D9.3)', () => {
       if (process.platform !== 'win32') assert.strictEqual(fs.statSync(sockPath).mode & 0o777, 0o600);
     } finally { await node.stop(); }
   });
+
+  it('the capability is bound to the first connection that presents it; end takes the capability, not the mindId; the read side serves verified deliveries', async () => {
+    const a = new SymNode({ name: uniq('id-read-a'), silent: true, discovery: new NullDiscovery(), room: 'mind-room' });
+    const node = new SymNode({ name: uniq('id-read'), silent: true, discovery: new NullDiscovery(), room: 'mind-room' });
+    try {
+      await a.start(); await node.start();
+      const interior = node.interior();
+      const sockPath = await interior.listen();
+      if (process.platform !== 'win32') assert.strictEqual(fs.statSync(path.dirname(sockPath)).mode & 0o777, 0o700, 'the socket lives in a 0700 directory');
+      const { capability, mindId } = interior.startMind({ id: 'reader', kinds: ['observation'], allowTo: [a.nodeId] });
+      const c1 = conn(sockPath);
+      const mission = await c1.ask({ type: 'mission', capability });
+      assert.deepStrictEqual({ ...mission, id: undefined }, { id: undefined, type: 'mission', mindId, missionId: 'reader', kinds: ['observation'], allowTo: [a.nodeId], ratePerMinute: 60, nodeId: node.nodeId, name: node.name, room: 'mind-room' });
+      // Another connection presenting the same capability: refused. The mindId ends nothing.
+      const c2 = conn(sockPath);
+      assert.strictEqual((await c2.ask({ type: 'submit', capability, kind: 'observation', categories: cats('replayed elsewhere') })).reason, 'capability-bound-to-another-connection');
+      assert.strictEqual((await c2.ask({ type: 'end', capability: mindId })).reason, 'no-live-capability');
+      assert.ok(interior.busy, 'the mind still runs');
+      await c2.close();
+      // The read side: subscribe, then a verified delivery from a peer arrives as an item.
+      assert.strictEqual((await c1.ask({ type: 'subscribe', capability })).type, 'subscribed');
+      await connectNodes(a, node);
+      node._svafEvaluator.evaluate = async () => ({ decision: 'aligned', total_drift: 0.1, category_drifts: { focus: 0.1 }, gate_values: { g: 1 } });
+      a.remember({ focus: 'for the mind', issue: 'i', intent: 'inform', motivation: 'm', commitment: 'c', perspective: 'p', mood: { text: 'calm' } }, { to: node.nodeId });
+      const pushed = await c1.next((m) => m.type === 'delivery');
+      assert.strictEqual(pushed.item.kind, 'directed');
+      assert.strictEqual(pushed.item.record.metadata.createdByNodeId, a.nodeId);
+      assert.strictEqual(pushed.item.verification.authorNodeId, a.nodeId);
+      assert.strictEqual(pushed.item.session.nodeId, a.nodeId);
+      const d = await c1.ask({ type: 'deliveries', capability, peek: true });
+      assert.ok(d.items.some((x) => x.id === pushed.item.id), 'the same item, by pull');
+      assert.strictEqual((await c1.ask({ type: 'ack', capability, delivery: pushed.item.id })).type, 'acked');
+      const rec = await c1.ask({ type: 'recall', capability, query: 'mind' });
+      assert.ok(Array.isArray(rec.items));
+      // end takes the capability; then the capability is dead.
+      assert.strictEqual((await c1.ask({ type: 'end', capability })).type, 'ended');
+      assert.strictEqual(interior.busy, false);
+      assert.strictEqual((await c1.ask({ type: 'mission', capability })).reason, 'no-live-capability');
+      await c1.close();
+      // A capability's connection closing ends its mind.
+      const m2 = interior.startMind({ kinds: ['observation'] });
+      const c3 = conn(sockPath);
+      assert.strictEqual((await c3.ask({ type: 'mission', capability: m2.capability })).type, 'mission');
+      await c3.close();
+      await until(() => !interior.busy, 2000);
+      assert.strictEqual(interior.busy, false, 'the connection that held the capability closed: the mind ended');
+    } finally { await node.stop(); await a.stop(); }
+  });
+
+  it('one mind per identity: two SymNode objects for one nodeId cannot both run a mind', async () => {
+    const name = uniq('id-twominds');
+    const a = new SymNode({ name, silent: true, discovery: new NullDiscovery() });
+    const b = new SymNode({ name, nodeId: a.nodeId, create: false, silent: true, discovery: new NullDiscovery() });
+    try {
+      const m = a.interior().startMind({ kinds: ['note'] });
+      assert.throws(() => b.interior().startMind({ kinds: ['note'] }), (e) => e.code === 'EMINDBUSY');
+      a.interior().endMind(m.capability);
+      assert.ok(b.interior().startMind({ kinds: ['note'] }).capability, 'the slot is free once the first ends');
+    } finally { await a.stop(); await b.stop(); }
+  });
+
+  it('the tmp fallback never follows a planted symlink, and listen refuses a path that is not a socket', async () => {
+    if (process.platform === 'win32') return;
+    const node = new SymNode({ name: uniq('id-tmp'), silent: true, discovery: new NullDiscovery() });
+    const planted = fs.mkdtempSync(path.join(os.tmpdir(), 'planted-'));
+    try {
+      const { ownedPrivateDir } = require('../lib/interior');
+      const link = path.join(os.tmpdir(), `sym-planted-${process.pid}-${Date.now()}`);
+      fs.symlinkSync(planted, link);
+      assert.throws(() => ownedPrivateDir(link), (e) => e.code === 'EINTERIORDIR', 'a symlink is not this node\'s directory');
+      fs.unlinkSync(link);
+      const notSock = path.join(fs.mkdtempSync(path.join(os.tmpdir(), 'ns-')), 'file');
+      fs.writeFileSync(notSock, 'x');
+      await assert.rejects(node.interior().listen(notSock), (e) => e.code === 'EINTERIORDIR');
+    } finally { await node.stop(); fs.rmSync(planted, { recursive: true, force: true }); }
+  });
 });
 
 void until;
diff --git a/tests/core-secure-legacy.test.js b/tests/core-secure-legacy.test.js
index 872752ec..e87e53ca 100644
--- a/tests/core-secure-legacy.test.js
+++ b/tests/core-secure-legacy.test.js
@@ -33,8 +33,9 @@ const { until, identity } = require('./_core-secure');
 const uniq = (b) => `${b}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
 
 /** A fake 0.13 node's TCP endpoint: answers a legacy hello with its own, and speaks legacy cmb. */
-async function fake013({ id = identity('legacy'), room = 'lg-room', presentKey } = {}) {
-  const e2e = e2eGenerateKeyPair();
+async function fake013({ id = identity('legacy'), room = 'lg-room', presentKey, presentE2E } = {}) {
+  const e2e = e2eGenerateKeyPair(); // the 0.13 node's persistent X25519 key (its e2e-keypair.json)
+  const squatE2E = presentE2E ? e2eGenerateKeyPair() : null;
   const seen = { frames: [], records: [], secret: null, peer: null };
   const server = net.createServer((sock) => {
     sock.on('error', () => {});
@@ -44,8 +45,9 @@ async function fake013({ id = identity('legacy'), room = 'lg-room', presentKey }
       seen.frames.push(f);
       if (f.type === 'handshake') {
         seen.peer = f;
-        seen.secret = e2eDeriveSharedSecret(e2e.privateKey, Buffer.from(f.e2ePublicKey, 'base64'));
-        t.send({ type: 'handshake', nodeId: id.nodeId, name: id.name, version: '0.2.3', extensions: [], room, publicKey: presentKey || id.publicKey, e2ePublicKey: e2e.publicKey.toString('base64'), lifecycleRole: 'participant' });
+        const mine = squatE2E || e2e;
+        seen.secret = e2eDeriveSharedSecret(mine.privateKey, Buffer.from(f.e2ePublicKey, 'base64'));
+        t.send({ type: 'handshake', nodeId: id.nodeId, name: id.name, version: '0.2.3', extensions: [], room, publicKey: presentKey || id.publicKey, e2ePublicKey: mine.publicKey.toString('base64'), lifecycleRole: 'participant' });
       } else if (f.type === 'cmb' && f.cmb && typeof f.cmb.categories === 'string') {
         seen.records.push({ frame: f, categories: decryptCategories(f.cmb.categories, f.cmb._e2e.nonce, seen.secret) });
       }
@@ -59,21 +61,24 @@ async function fake013({ id = identity('legacy'), room = 'lg-room', presentKey }
     const { ciphertext, nonce } = encryptCategories(cmb.categories, seen.secret);
     seen.transport.send({ type: 'cmb', timestamp: Date.now(), cmb: { ...cmb, categories: ciphertext, _e2e: { nonce } }, ...(to ? { to, directed: true } : {}) });
   };
-  return { id, port: server.address().port, seen, sendRecord, close: () => new Promise((r) => server.close(() => r())) };
+  return { id, e2eKey: e2e.publicKey.toString('base64'), port: server.address().port, seen, sendRecord, close: () => new Promise((r) => server.close(() => r())) };
 }
 
-function routeTo(fake) { return { nodeId: fake.id.nodeId, endpoint: `127.0.0.1:${fake.port}`, key: fake.id.publicKey, name: 'legacy' }; }
+function routeTo(fake) { return { nodeId: fake.id.nodeId, endpoint: `127.0.0.1:${fake.port}`, key: fake.id.publicKey, e2eKey: fake.e2eKey, name: 'legacy' }; }
 async function stopAll(...nodes) {
   for (const n of nodes) { try { await n.stop(); } catch { /* */ } try { fs.rmSync(nodeDirById(n.nodeId), { recursive: true, force: true }); } catch { /* */ } }
 }
 
 describe('Legacy Import routes (D7)', () => {
-  it('the identity key fingerprint is mandatory; a route without one is refused', () => {
+  it('the identity key fingerprint and the X25519 key are mandatory; a route without either is refused', () => {
     const id = identity('x');
-    assert.throws(() => checkRoute({ nodeId: id.nodeId, endpoint: '127.0.0.1:1' }), /fingerprint is mandatory/);
-    assert.throws(() => checkRoute({ nodeId: id.nodeId, endpoint: 'nowhere', key: id.publicKey }), /endpoint/);
-    assert.throws(() => checkRoute({ nodeId: id.nodeId, endpoint: 'relay', key: id.publicKey, fingerprint: keyFingerprint(identity().publicKey) }), /disagree/);
-    assert.strictEqual(checkRoute({ nodeId: id.nodeId, endpoint: 'relay', fingerprint: keyFingerprint(id.publicKey) }).fingerprint, keyFingerprint(id.publicKey));
+    const e2eKey = e2eGenerateKeyPair().publicKey.toString('base64');
+    assert.throws(() => checkRoute({ nodeId: id.nodeId, endpoint: '127.0.0.1:1', e2eKey }), /fingerprint is mandatory/);
+    assert.throws(() => checkRoute({ nodeId: id.nodeId, endpoint: 'nowhere', key: id.publicKey, e2eKey }), /endpoint/);
+    assert.throws(() => checkRoute({ nodeId: id.nodeId, endpoint: 'relay', key: id.publicKey, fingerprint: keyFingerprint(identity().publicKey), e2eKey }), /disagree/);
+    assert.throws(() => checkRoute({ nodeId: id.nodeId, endpoint: 'relay', key: id.publicKey }), /e2eKey .* is mandatory/, 'security review E: the X25519 key is pinned too');
+    assert.throws(() => checkRoute({ nodeId: id.nodeId.toUpperCase(), endpoint: 'relay', key: id.publicKey, e2eKey }), /lowercase/);
+    assert.strictEqual(checkRoute({ nodeId: id.nodeId, endpoint: 'relay', fingerprint: keyFingerprint(id.publicKey), e2eKey }).fingerprint, keyFingerprint(id.publicKey));
   });
 
   for (const order of ['smaller', 'larger']) {
@@ -90,14 +95,19 @@ describe('Legacy Import routes (D7)', () => {
         assert.match(st.sessions[0].encryption, /no forward secrecy, no transcript proof/);
         assert.strictEqual(node._roster.source(lid.nodeId), 'pinned', 'the route\'s key is pinned');
         assert.strictEqual(node.peers().find((p) => p.peerId === lid.nodeId).profile, 'legacy-import');
-        // In: a directed 0.13 record is delivered, quarantined.
+        // In: a directed 0.13 record is delivered, quarantined — as `legacy-record`, never on the
+        // Core Secure path a host reads (cmb-accepted, the inbox).
         const got = [];
-        node.on('cmb-accepted', (e) => got.push(e));
+        const coreSecure = [];
+        node.on('legacy-record', (e) => got.push(e));
+        node.on('cmb-accepted', (e) => coreSecure.push(e));
         fake.sendRecord({ focus: 'from the 0.13 side', to: node.nodeId });
         await until(() => got.length > 0, 5000);
         assert.strictEqual(got[0].verified, false);
         assert.strictEqual(got[0].profile, 'legacy-import');
         assert.strictEqual(got[0].author?.nodeId ?? null, null, 'no verified author');
+        assert.strictEqual(coreSecure.length, 0, 'not a Core Secure delivery');
+        assert.strictEqual(node.inbox({ peek: true }).messages.length, 0, 'not in the inbox');
         // A record signed by another key on the route is refused.
         const metrics = [];
         node.on('metric', (m) => metrics.push(m));
@@ -126,7 +136,101 @@ describe('Legacy Import routes (D7)', () => {
     } finally { await stopAll(node); await fake.close(); }
   });
 
-  it('the sticky floor is the persisted proven binding: the route is refused, across a restart', async () => {
+  it('a hello presenting an X25519 key other than the pinned one is refused (a relay squatter with the public keys)', async () => {
+    const lid = identity('legacy');
+    const fake = await fake013({ id: lid, presentE2E: true });
+    const node = new SymNode({ name: uniq('lg'), silent: true, discovery: new NullDiscovery(), room: 'lg-room', legacyRoutes: [routeTo(fake)] });
+    try {
+      await node.start();
+      await until(() => node.status().legacyImport.refused.some((r) => /e2e-key-mismatch/.test(r.why)), 5000);
+      assert.strictEqual(node._peers.has(lid.nodeId), false);
+      node.remember({ focus: 'never to the squatter', issue: 'i', intent: 'x', motivation: 'y', commitment: 'z', perspective: 'p', mood: { text: 'calm' } }, { to: lid.nodeId });
+      await new Promise((r) => setTimeout(r, 200));
+      assert.strictEqual(fake.seen.records.length, 0, 'nothing was sent to it');
+    } finally { await stopAll(node); await fake.close(); }
+  });
+
+  it('a Legacy Import peer never passes a gated room door, and no peer-joined is raised for one', async () => {
+    const lid = identity('legacy');
+    const owner = identity('owner');
+    const fake = await fake013({ id: lid });
+    const node = new SymNode({ name: uniq('lg-gated'), silent: true, discovery: new NullDiscovery(), room: 'lg-room', legacyRoutes: [routeTo(fake)] });
+    node._roomOwners.pin('lg-room', owner.nodeId, owner.publicKey, 'config');
+    const joined = [];
+    node.on('peer-joined', (e) => joined.push(e));
+    try {
+      await node.start();
+      await until(() => node.status().legacyImport.refused.some((r) => /gated/.test(r.why)), 5000);
+      assert.strictEqual(node._peers.has(lid.nodeId), false, 'not dialled into a gated room');
+      assert.strictEqual(node._roomDoor(lid.nodeId).pass, false);
+      assert.strictEqual(joined.length, 0);
+    } finally { await stopAll(node); await fake.close(); }
+    // Ungated: the legacy peer joins, and says so with its own event.
+    const fake2 = await fake013({ id: identity('legacy2') });
+    const n2 = new SymNode({ name: uniq('lg-open'), silent: true, discovery: new NullDiscovery(), room: 'lg-room', legacyRoutes: [routeTo(fake2)] });
+    const legacyJoined = [];
+    const coreJoined = [];
+    n2.on('legacy-peer-joined', (e) => legacyJoined.push(e));
+    n2.on('peer-joined', (e) => coreJoined.push(e));
+    try {
+      await n2.start();
+      await until(() => legacyJoined.length > 0, 5000);
+      assert.strictEqual(legacyJoined[0].legacy, true);
+      assert.strictEqual(coreJoined.length, 0, 'peer-joined means a proven Core Secure session only');
+    } finally { await stopAll(n2); await fake2.close(); }
+  });
+
+  it('a v2.0-suite record on a legacy route is refused, a record naming another author is refused, and no assertionId passes as authenticated', async () => {
+    const lid = identity('legacy');
+    const fake = await fake013({ id: lid });
+    const node = new SymNode({ name: uniq('lg-suite'), silent: true, discovery: new NullDiscovery(), room: 'lg-room', legacyRoutes: [routeTo(fake)] });
+    try {
+      await node.start();
+      await until(() => node._peers.has(lid.nodeId), 5000);
+      const metrics = [];
+      node.on('metric', (m) => metrics.push(m));
+      const got = [];
+      node.on('legacy-record', (e) => got.push(e));
+      const { signedRecord } = require('./_core-secure');
+      const send = (cmb) => {
+        const { ciphertext, nonce } = encryptCategories(cmb.categories, fake.seen.secret);
+        fake.seen.transport.send({ type: 'cmb', timestamp: Date.now(), content: 'FORGED frame content', cmb: { ...cmb, categories: ciphertext, _e2e: { nonce } }, to: node.nodeId, directed: true });
+      };
+      send(signedRecord(lid, { categories: { focus: 'a v2.0 record on the legacy route' }, room: 'lg-room', to: node.nodeId }));
+      await until(() => metrics.some((m) => m.reason === 'v2.0-suite-on-legacy-route'), 3000);
+      const victim = identity('victim');
+      const other = createCMB({ categories: { focus: 'signed words' }, createdBy: 'alice', createdByNodeId: victim.nodeId, room: 'lg-room', to: node.nodeId });
+      other.metadata.createdByNodeId = victim.nodeId;
+      signCMB(other, lid.privateKey);
+      send(other);
+      await until(() => metrics.some((m) => m.reason === 'not-the-routed-author'), 3000);
+      fake.sendRecord({ focus: 'a genuine 0.13 record', to: node.nodeId });
+      await until(() => got.length > 0, 3000);
+      assert.strictEqual(got[0].assertionId, null, 'no assertion identity from a quarantined record');
+      assert.ok(!('assertionId' in (got[0].cmb.metadata || {})), 'nor on its record');
+      assert.ok(!String(got[0].content).includes('FORGED'), 'content is rendered from the categories, never the frame');
+    } finally { await stopAll(node); await fake.close(); }
+  });
+
+  it('the legacy session has a heartbeat: a peer that goes silent is closed', async () => {
+    const { LegacySession } = require('../lib/legacy-import');
+    const src = fs.readFileSync(require.resolve('../lib/legacy-import'), 'utf8');
+    assert.match(src, /LEGACY_DEAD_MS = 45_000/);
+    const lid = identity('legacy');
+    const e2e = e2eGenerateKeyPair();
+    const sent = [];
+    const s = new LegacySession({ route: { nodeId: lid.nodeId, fingerprint: keyFingerprint(lid.publicKey), e2eKey: e2e.publicKey.toString('base64'), endpoint: 'relay' }, kind: 'relay', transport: { trySend: (f) => { sent.push(f); return { ok: true }; } }, local: identity('me'), room: 'r' });
+    s.receiveWire({ type: 'handshake', nodeId: lid.nodeId, publicKey: lid.publicKey, e2ePublicKey: e2e.publicKey.toString('base64') });
+    assert.strictEqual(s.confirmed, true);
+    assert.ok(s._beat, 'a heartbeat runs');
+    s.lastSeen = Date.now() - 60_000;
+    let closed = null;
+    s.on('closed', (i) => { closed = i; });
+    s._beat._onTimeout();
+    assert.strictEqual(closed && closed.reason, 'heartbeat-timeout');
+  });
+
+  it('the sticky floor is its own persisted fact: the route is refused, across a restart and after the binding is gone', async () => {
     const lid = identity('legacy');
     const fake = await fake013({ id: lid });
     const name = uniq('lg-floor');
@@ -143,6 +247,9 @@ describe('Legacy Import routes (D7)', () => {
       await node.start();
       await new Promise((r) => setTimeout(r, 300));
       assert.strictEqual(node._peers.has(lid.nodeId), false, 'still refused after the restart');
+      // The floor does not end with the binding (security review: floor-probe): it is its own fact.
+      node._roster._drop(lid.nodeId);
+      assert.strictEqual(node._roster.floor(lid.nodeId), true, 'the floor outlives the binding');
       // An operator reset lifts it.
       node._roster.resetFloor(lid.nodeId);
       await node.stop();
diff --git a/tests/core-secure-node.test.js b/tests/core-secure-node.test.js
index f77b5710..50631d55 100644
--- a/tests/core-secure-node.test.js
+++ b/tests/core-secure-node.test.js
@@ -32,7 +32,7 @@ async function stopAll(...nodes) {
 }
 
 describe('a peer is a proven session (D1)', () => {
-  it('nothing per-peer exists before confirmation; after it, the peer is keyed by the proven nodeId and bound proven', async () => {
+  it('nothing per-peer exists before confirmation; after it, the peer is keyed by the proven nodeId, held for its session, and bound proven once it earns it', async () => {
     const a = mk('cs-a'); const b = mk('cs-b');
     try {
       await a.start(); await b.start();
@@ -42,13 +42,22 @@ describe('a peer is a proven session (D1)', () => {
       a.connectTransport(ta, { role: 'client', expectNodeId: b.nodeId });
       assert.strictEqual(a._peers.size, 0, 'a dial is not a peer');
       await until(() => a._peers.has(b.nodeId) && b._peers.has(a.nodeId));
-      assert.strictEqual(a._roster.source(b.nodeId), 'proven');
-      assert.strictEqual(a._roster.get(b.nodeId), b._identity.publicKey);
+      // Security review D (binding-squat): a confirmed session runs with a session-scoped binding; the
+      // durable registry takes the binding only once it is earned (an admitted verified record).
+      assert.strictEqual(a._roster.source(b.nodeId), undefined, 'a handshake alone is not a durable binding');
+      assert.strictEqual(a._keySource(b.nodeId), 'session');
+      assert.strictEqual(a._identityKey(b.nodeId), b._identity.publicKey);
       const p = a.peers().find((x) => x.peerId === b.nodeId);
       assert.strictEqual(p.profile, 'core-secure');
-      assert.strictEqual(p.keySource, 'proven');
+      assert.strictEqual(p.keySource, 'session');
       assert.strictEqual(p.sessions.length, 1);
       assert.match(p.sessions[0].sessionId, /^[0-9a-f]{32}$/);
+      assert.deepStrictEqual(a.keyBindings().find((x) => x.nodeId === b.nodeId), { nodeId: b.nodeId, key: b._identity.publicKey, source: 'session' });
+      // b's record admitted at a: the binding is earned, durable and proven.
+      a._svafEvaluator.evaluate = async () => ({ decision: 'aligned', total_drift: 0.1, category_drifts: { focus: 0.1 }, gate_values: { g: 1 } });
+      b.remember(CATS('an observation a admits'));
+      await until(() => a._roster.source(b.nodeId) === 'proven', 4000);
+      assert.strictEqual(a._roster.get(b.nodeId), b._identity.publicKey);
     } finally { await stopAll(a, b); }
   });
 
@@ -93,10 +102,14 @@ describe('a peer is a proven session (D1)', () => {
       b.on('metric', (m) => metrics.push(m));
       const accepted = [];
       b.on('cmb-accepted', (x) => accepted.push(x));
-      // A record a signed to some other node, sent on the session to b.
+      // A record a signed to some other node is never sealed to b (review finding A: the one seal point
+      // refuses it) ...
       const elsewhere = identity('elsewhere');
       const cmb = signedRecord({ nodeId: a.nodeId, name: a.name, privateKey: a._identity.privateKey }, { categories: { focus: 'not for b' }, room: 'cs-room', to: elsewhere.nodeId });
-      a._peers.get(b.nodeId).transport.send({ type: 'cmb', cmb });
+      assert.strictEqual(a._peers.get(b.nodeId).transport.trySend({ type: 'cmb', cmb }).reason, 'not-addressed');
+      // ... and one that reaches b's handler anyway (a sender that seals it) is refused there.
+      const s = b._peers.get(a.nodeId).transport;
+      await b._frameHandler.handle(s, { type: 'cmb', cmb });
       await until(() => metrics.some((m) => m.type === 'cmb-audience-rejected'));
       assert.ok(metrics.some((m) => m.type === 'cmb-audience-rejected'), 'the signed to names another node: refused');
       a.remember(CATS('directed to b'), { to: b.nodeId });
diff --git a/tests/core-secure-relay.test.js b/tests/core-secure-relay.test.js
index 0b748418..ad9c65bd 100644
--- a/tests/core-secure-relay.test.js
+++ b/tests/core-secure-relay.test.js
@@ -78,7 +78,7 @@ describe('relay sessions (D2)', () => {
     } finally { await stopAll(a, b); await relay.close(); }
   });
 
-  it('an error 1009 IDENTITY_CONFLICT from the peer ends the session, is said, and is not retried (draft spec PR #21)', async () => {
+  it('an error 1009 IDENTITY_CONFLICT from the peer ends the session, is said, and is not retried (draft spec PR #21); a clear one is ignored', async () => {
     const relay = fakeRelay();
     const a = relayNode('rs-a3', relay); const b = relayNode('rs-b3', relay);
     try {
@@ -87,7 +87,15 @@ describe('relay sessions (D2)', () => {
       const [lo, hi] = [a, b].sort((x, y) => (x.nodeId < y.nodeId ? -1 : 1));
       const metrics = [];
       lo.on('metric', (m) => metrics.push(m));
-      relay.inject(hi.nodeId, lo.nodeId, { type: 'error', code: 1009, message: 'IDENTITY_CONFLICT', detail: `session:${relaySession(lo, hi).sessionId}` });
+      // A CLEAR error is anyone's to write (security review F): ignored, the session stays.
+      const before = relaySession(lo, hi);
+      relay.inject(hi.nodeId, lo.nodeId, { type: 'error', code: 1009, message: 'IDENTITY_CONFLICT', detail: `session:${before.sessionId}` });
+      relay.inject(hi.nodeId, lo.nodeId, { type: 'error', code: 1010, message: 'session closed' });
+      await new Promise((r) => setTimeout(r, 300));
+      assert.strictEqual(relaySession(lo, hi), before, 'a clear error is not a command');
+      assert.strictEqual(before.closed, false);
+      // The peer's own 1009 travels sealed on the session.
+      assert.strictEqual(relaySession(hi, lo).trySend({ type: 'error', code: 1009, message: 'IDENTITY_CONFLICT' }).ok, true);
       await until(() => !lo._peers.has(hi.nodeId), 3000);
       await new Promise((r) => setTimeout(r, 1500)); // past the first retry backoff
       assert.strictEqual(lo._peers.has(hi.nodeId), false, 'no re-handshake after an identity conflict');
@@ -195,7 +203,14 @@ describe('relay sessions (D2)', () => {
       b.on('metric', (m) => metrics.push(m));
       const someone = identity('someone');
       const cmb = signedRecord({ nodeId: a.nodeId, name: a.name, privateKey: a._identity.privateKey }, { room: 'relay-room', to: someone.nodeId, categories: { focus: 'for someone else' } });
-      relaySession(a, b).send({ type: 'cmb', cmb });  // the envelope is addressed to b
+      const s = relaySession(a, b);
+      // The seal point refuses it (security review A) ...
+      assert.strictEqual(s.trySend({ type: 'cmb', cmb }).reason, 'not-addressed');
+      // ... and a sender that seals it anyway, in an envelope addressed to b, is refused by b.
+      const { signedProjection } = require('../lib/core/record-canonical');
+      const rec = signedProjection(cmb);
+      const pos = s._mmp.nextSend();
+      s._wire(buildEncryptedFrame({ cmb: { categories: rec.categories, metadata: { ...rec.metadata } }, applicationBytes: null, sessionId: s.sessionId, direction: pos.direction, sequence: pos.sequence, trafficKey: pos.trafficKey }));
       await until(() => metrics.some((m) => m.type === 'cmb-audience-rejected'), 5000);
       assert.ok(metrics.some((m) => m.type === 'cmb-audience-rejected'));
     } finally { await stopAll(a, b); await relay.close(); }
diff --git a/tests/earned-authority-node.test.js b/tests/earned-authority-node.test.js
index 673a4a6d..6157a036 100644
--- a/tests/earned-authority-node.test.js
+++ b/tests/earned-authority-node.test.js
@@ -144,11 +144,14 @@ describe('aggregateAttestations — weighted by earned authority (EA6)', () => {
       // anchor (self, weight 4) + validator (weight 2) admit; participant (weight 1) rejects;
       // an over-claimer asserts anchor but resolves participant (weight 1, mismatch); and an
       // attestation whose key we don't have (excluded entirely).
-      node._attestations.record(att(node.nodeId, 'anchor', 'aligned', { focus: 'admit' }, node._identity.privateKey));
-      node._attestations.record(att(V.nodeId, 'validator', 'aligned', { focus: 'admit' }, V.priv));
-      node._attestations.record(att(P.nodeId, 'participant', 'rejected', { focus: 'reject' }, P.priv));
-      node._attestations.record(att(O.nodeId, 'anchor', 'rejected', { focus: 'reject' }, O.priv));
-      node._attestations.record(att(U.nodeId, 'participant', 'aligned', { focus: 'admit' }, U.priv));
+      // Recorded as the ingest records them: with the time they were received (draft spec PR #33 —
+      // an attestation counts by its signer's role at its signed time AND at its receipt).
+      const now = { receivedAt: Date.now() };
+      node._attestations.record(att(node.nodeId, 'anchor', 'aligned', { focus: 'admit' }, node._identity.privateKey), now);
+      node._attestations.record(att(V.nodeId, 'validator', 'aligned', { focus: 'admit' }, V.priv), now);
+      node._attestations.record(att(P.nodeId, 'participant', 'rejected', { focus: 'reject' }, P.priv), now);
+      node._attestations.record(att(O.nodeId, 'anchor', 'rejected', { focus: 'reject' }, O.priv), now);
+      node._attestations.record(att(U.nodeId, 'participant', 'aligned', { focus: 'admit' }, U.priv), now);
 
       const agg = node.aggregateAttestations('cmb-agg');
       assert.strictEqual(agg.total, 4, 'four verifiable attestations');
diff --git a/tests/emit-room-claim.test.js b/tests/emit-room-claim.test.js
index c663565b..da8adac0 100644
--- a/tests/emit-room-claim.test.js
+++ b/tests/emit-room-claim.test.js
@@ -26,7 +26,7 @@ describe('emit room claims (Core Secure)', () => {
     await node.start();
     try {
       await assert.rejects(
-        () => connect({ server: `127.0.0.1:${node._port}`, timeoutMs: 4000 }),
+        () => connect({ server: `127.0.0.1:${node._port}`, receiver: { nodeId: node.nodeId, key: node.publicKey }, timeoutMs: 4000 }),
         /did not complete the Core Secure handshake/i,
       );
       assert.ok((node._sessionStats.failedByReason['room-mismatch'] || 0) >= 1, 'refused as a room mismatch');
@@ -42,7 +42,7 @@ describe('emit room claims (Core Secure)', () => {
     node.on('metric', (m) => { if (m.type === 'cmb-audience-rejected' || m.type === 'cmb-signature-rejected') refused.push(m); });
     try {
       const accepted = new Promise((resolve) => node.once('verified-record', resolve));
-      const e = await connect({ server: `127.0.0.1:${node._port}`, room: 'acme', timeoutMs: 4000 });
+      const e = await connect({ server: `127.0.0.1:${node._port}`, receiver: { nodeId: node.nodeId, key: node.publicKey }, room: 'acme', timeoutMs: 4000 });
       assert.strictEqual(e.peer.nodeId, node.nodeId, 'the handshake proved the node');
       const { cmb } = e.emit({ focus: 'a block from an emitter in acme' });
       assert.strictEqual(cmb.metadata.room, 'acme', 'it authors for the room the handshake proved');
@@ -71,7 +71,7 @@ describe('emit room claims (Core Secure)', () => {
     const node = lanNode('default-node', 'default');
     await node.start();
     try {
-      const e = await connect({ server: `127.0.0.1:${node._port}`, room: 'default', timeoutMs: 4000 });
+      const e = await connect({ server: `127.0.0.1:${node._port}`, receiver: { nodeId: node.nodeId, key: node.publicKey }, room: 'default', timeoutMs: 4000 });
       assert.ok(e);
       await e.close();
     } finally {
diff --git a/tests/emit.test.js b/tests/emit.test.js
index 6aa82ab3..33b62251 100644
--- a/tests/emit.test.js
+++ b/tests/emit.test.js
@@ -54,7 +54,7 @@ describe('sym/emit — MMP Class 1 emitter over real TCP', () => {
     await withReceiver('emit-rx', async (node, port) => {
       const accepted = once(node, 'cmb-accepted');
       const { key, cmb } = await emitOnce(
-        { server: `127.0.0.1:${port}`, room: 'emit-g', name: 'ci-emitter' },
+        { server: `127.0.0.1:${port}`, receiver: { nodeId: node.nodeId, key: node.publicKey }, room: 'emit-g', name: 'ci-emitter' },
         { focus: 'build 4821 green', intent: 'ground', commitment: 'verified: test suite passed' },
       );
 
@@ -73,9 +73,18 @@ describe('sym/emit — MMP Class 1 emitter over real TCP', () => {
     });
   });
 
+  it('the receiver is pinned: none given is refused, an endpoint proving another key is refused (security review)', async () => {
+    await withReceiver('emit-pin', async (node, port) => {
+      await assert.rejects(() => connect({ server: `127.0.0.1:${port}`, room: 'emit-g', name: 'pin-a' }), (e) => e.code === 'EEMITPIN');
+      const other = require('./_core-secure').identity('someone-else');
+      await assert.rejects(() => connect({ server: `127.0.0.1:${port}`, receiver: { nodeId: node.nodeId, key: other.publicKey }, room: 'emit-g', name: 'pin-b' }), (e) => e.code === 'EEMITPIN');
+      await assert.rejects(() => connect({ server: `127.0.0.1:${port}`, receiver: { nodeId: other.nodeId, key: node.publicKey }, room: 'emit-g', name: 'pin-c', timeoutMs: 3000 }), /did not complete the Core Secure handshake/);
+    });
+  });
+
   it('the emitted signature verifies against the emitter identity key (Class 1 §17.1)', async () => {
     await withReceiver('emit-rx2', async (node, port) => {
-      const emitter = await connect({ server: `127.0.0.1:${port}`, room: 'emit-g', name: 'sensor-a' });
+      const emitter = await connect({ server: `127.0.0.1:${port}`, receiver: { nodeId: node.nodeId, key: node.publicKey }, room: 'emit-g', name: 'sensor-a' });
       try {
         assert.ok(emitter.peer && emitter.peer.nodeId, 'receiver handshake surfaced');
         const { cmb } = emitter.emit({ focus: 'temperature nominal' });
@@ -92,7 +101,7 @@ describe('sym/emit — MMP Class 1 emitter over real TCP', () => {
     await withReceiver('emit-rx3', async (node, port) => {
       const seen = [];
       node.on('cmb-accepted', (s) => seen.push(s));
-      const emitter = await connect({ server: `127.0.0.1:${port}`, room: 'emit-g', name: 'ci-emitter' });
+      const emitter = await connect({ server: `127.0.0.1:${port}`, receiver: { nodeId: node.nodeId, fingerprint: node.fingerprint }, room: 'emit-g', name: 'ci-emitter' });
       try {
         const first = emitter.emit({ focus: 'deploy started' });
         const second = emitter.emit(
diff --git a/tests/gossip-lanes.test.js b/tests/gossip-lanes.test.js
index f4b781c6..7d24d1f5 100644
--- a/tests/gossip-lanes.test.js
+++ b/tests/gossip-lanes.test.js
@@ -42,7 +42,8 @@ const { admitAs } = require('./_core-secure');
 const ROOM = 'g';
 const kp = (id) => {
   const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519', { publicKeyEncoding: { type: 'spki', format: 'der' }, privateKeyEncoding: { type: 'pkcs8', format: 'der' } });
-  return { id, pub: publicKey.slice(-32).toString('base64url'), priv: privateKey.slice(-32).toString('base64url') };
+  // nodeIds are canonical lowercase at every door, a grant's included (security review B).
+  return { id: id.toLowerCase(), pub: publicKey.slice(-32).toString('base64url'), priv: privateKey.slice(-32).toString('base64url') };
 };
 const signed = (fields, priv, sign) => { const o = { ...fields }; sign(o, priv); return o; };
 const forgedSig = () => crypto.randomBytes(64).toString('base64url');
@@ -80,7 +81,7 @@ describe('role grants are gossip under the budget (F1)', () => {
   it('a captured grant re-spelled is refused or a repeat: never stored, written or relayed again, and nothing is spent', () => {
     const A = kp('anchor-A');
     withNode({ anchor: { nodeId: A.id, publicKey: A.pub } }, ({ node, sent }) => {
-      const g = signGrant({ type: 'role-grant', grantee: 'node-V', granteeKey: SOME_KEY, role: 'validator', grantedBy: A.id, grantedAt: 1 }, A.priv);
+      const g = signGrant({ type: 'role-grant', grantee: 'node-v', granteeKey: SOME_KEY, role: 'validator', grantedBy: A.id, grantedAt: 1 }, A.priv);
       assert.strictEqual(node._ingestRoleGrant(g, 'p').ok, true);
       assert.strictEqual(sent.length, 1, 'relayed once');
       const tokens = node._gossipBuckets.get('p').tokens;
@@ -96,7 +97,7 @@ describe('role grants are gossip under the budget (F1)', () => {
       for (let i = 0; i < 1000; i++) reasons.add(node._ingestRoleGrant({ ...g }, 'q').reason);
       assert.deepStrictEqual([...reasons].sort(), ['duplicate', 'non-canonical-signature']);
       assert.strictEqual(node._roleGrants.size(), 1, 'one grant held');
-      assert.strictEqual(node._roleGrants.grantsFor('node-V').length, 1);
+      assert.strictEqual(node._roleGrants.grantsFor('node-v').length, 1);
       const file = path.join(node._dir, 'role-grants', 'role-grants.jsonl');
       assert.strictEqual(fs.readFileSync(file, 'utf8').trim().split('\n').length, 1, 'one line written');
       assert.strictEqual(sent.length, 1, 'and nothing relayed again');
@@ -131,13 +132,13 @@ describe('role grants are gossip under the budget (F1)', () => {
       // Genuine grants from one grantor to one grantee: kept up to the pair's bound, and only those relayed.
       let kept = 0;
       for (let i = 0; i < 70; i++) {
-        const r = node._ingestRoleGrant(signGrant({ type: 'role-grant', grantee: 'node-X', granteeKey: SOME_KEY, role: 'validator', grantedBy: P.id, grantedAt: i }, P.priv), 'p2');
+        const r = node._ingestRoleGrant(signGrant({ type: 'role-grant', grantee: 'node-x', granteeKey: SOME_KEY, role: 'validator', grantedBy: P.id, grantedAt: i }, P.priv), 'p2');
         if (r.ok) kept++; else assert.strictEqual(r.reason, 'pair-full');
       }
-      assert.strictEqual(kept, 64);
-      assert.strictEqual(sent.length, 64);
+      assert.strictEqual(kept, 16, 'the pair bound (16 since the security review: role-resolve-cost)');
+      assert.strictEqual(sent.length, 16);
       // Another grantor's grant to the same grantee is not kept out by the first one's.
-      assert.strictEqual(node._ingestRoleGrant(signGrant({ type: 'role-grant', grantee: 'node-X', granteeKey: SOME_KEY, role: 'validator', grantedBy: Q.id, grantedAt: 1 }, Q.priv), 'p3').ok, true);
+      assert.strictEqual(node._ingestRoleGrant(signGrant({ type: 'role-grant', grantee: 'node-x', granteeKey: SOME_KEY, role: 'validator', grantedBy: Q.id, grantedAt: 1 }, Q.priv), 'p3').ok, true);
     });
   });
 
@@ -153,25 +154,25 @@ describe('role grants are gossip under the budget (F1)', () => {
       const st = new RoleGrantStore(opts);
       const keyOf = (grantee) => ({ [P.id]: P.pub, [Q.id]: Q.pub })[grantee] || SOME_KEY;
       const grant = (by, grantee, at) => signGrant({ type: 'role-grant', grantee, granteeKey: keyOf(grantee), role: 'validator', grantedBy: by.id, grantedAt: at }, by.priv);
-      const g = grant(A, 'V', 1);
+      const g = grant(A, 'v', 1);
       assert.strictEqual(st.record({ ...g, sig: `${g.sig}=` }).stored, true, 'a direct caller may hand over another spelling');
-      assert.strictEqual(st.grantsFor('V')[0].sig, g.sig, 'it is kept as its signer wrote it');
+      assert.strictEqual(st.grantsFor('v')[0].sig, g.sig, 'it is kept as its signer wrote it');
       for (const sig of [g.sig, ...respell(g.sig)]) assert.strictEqual(st.record({ ...g, sig }).reason, 'duplicate');
       assert.strictEqual(st.has(` ${g.sig}`), true);
       assert.strictEqual(st.size(), 1);
       for (const G of [P, Q]) assert.strictEqual(st.record(grant(A, G.id, 0)).stored, true);
 
       const r = (by, grantee, at) => st.record(grant(by, grantee, at)).reason ?? 'stored';
-      assert.deepStrictEqual([r(P, 'X', 1), r(P, 'X', 2), r(P, 'X', 3)], ['stored', 'stored', 'pair-full']);
-      assert.deepStrictEqual([r(P, 'Y', 4), r(P, 'Z', 5)], ['stored', 'grantor-full']);
-      assert.strictEqual(st.record(forgedGrant(P.id, 'W')).reason, 'grantor-full', 'refused before its signature is checked');
-      assert.deepStrictEqual([r(Q, 'X', 6), r(Q, 'Y', 7)], ['stored', 'store-full']);
+      assert.deepStrictEqual([r(P, 'x', 1), r(P, 'x', 2), r(P, 'x', 3)], ['stored', 'stored', 'pair-full']);
+      assert.deepStrictEqual([r(P, 'y', 4), r(P, 'z', 5)], ['stored', 'grantor-full']);
+      assert.strictEqual(st.record(forgedGrant(P.id, 'w')).reason, 'grantor-full', 'refused before its signature is checked');
+      assert.deepStrictEqual([r(Q, 'x', 6), r(Q, 'y', 7)], ['stored', 'store-full']);
       assert.strictEqual(st.size(), 7);
-      assert.deepStrictEqual([r(A, 'X', 8), r(A, 'Z', 9)], ['stored', 'stored'], "the anchor's own are never refused");
-      assert.deepStrictEqual(st.grantsFor('X').map((x) => x.grantedAt), [1, 2, 6, 8], 'nothing kept was evicted');
+      assert.deepStrictEqual([r(A, 'x', 8), r(A, 'z', 9)], ['stored', 'stored'], "the anchor's own are never refused");
+      assert.deepStrictEqual(st.grantsFor('x').map((x) => x.grantedAt), [1, 2, 6, 8], 'nothing kept was evicted');
       const again = new RoleGrantStore(opts);
       assert.strictEqual(again.size(), 9, 'and a restart reads back what was kept');
-      assert.strictEqual(again.resolveRole('X', 100), 'validator');
+      assert.strictEqual(again.resolveRole('x', 100), 'validator');
     } finally { fs.rmSync(dir, { recursive: true, force: true }); }
   });
 });
@@ -217,31 +218,35 @@ describe('the budget is kept per PROVEN peer (F2; Core Secure design D1)', () =>
     });
   });
 
-  it('many proven peers have 100 each, and all of them together stay under the ceiling', () => {
-    withNode({}, ({ node, clock, metrics }) => {
+  it('forgeries spend only their own peer\'s lane, never the shared ceiling, and a forgery on a session ends it (security review D, p7-ceiling)', () => {
+    withNode({}, ({ node, metrics }) => {
       const A = kp('att-A');
       node._roster.bind(A.id, A.pub, 'proven');
       let badSig = 0;
       const ingest = (peer) => { if (node._ingestAttestation(forged(A), peer, peer).reason === 'bad-signature') badSig++; };
-      const checked = () => badSig;   // a signature checked (and found forged)
-      // 300 peers, 101 forgeries each.
+      // 300 peers, 101 forgeries each: each peer's own 100, and the ceiling untouched.
       for (let i = 0; i < 300; i++) for (let j = 0; j < 101; j++) ingest(`id-${i}`);
-      assert.strictEqual(checked(), 20_000, 'the ceiling: a burst of 20,000, however many peers');
-      assert.strictEqual(node._gossipBuckets.get('id-0').tokens, 0, 'each peer has 100');
-      assert.strictEqual(node._gossipBuckets.get('id-299').tokens, 100, 'those past the ceiling checked nothing');
-      const ceiling = () => metrics.filter((m) => m.type === 'gossip-over-ceiling');
-      assert.strictEqual(ceiling().length, 1, 'said once, at the first drop');
-      node._sayDrops(node._dropReports.get('gossip-over-ceiling|*'));
-      assert.strictEqual(ceiling().length, 2);
-      assert.strictEqual(ceiling().reduce((s, m) => s + m.dropped, 0), 100 * 101, 'every drop counted');
-      assert.strictEqual(ceiling()[0].perSecond, 4000);
-      assert.strictEqual(ceiling()[1].fromPeerIds.length, 16, 'naming up to 16 peers');
-      assert.strictEqual(node.metrics().gossipOverBudget, 300 * 101 - 20_000);
-      // The ceiling refills at 4,000 a second.
-      clock.t += 1000;
-      const before = checked();
-      for (let i = 0; i < 50; i++) for (let j = 0; j < 100; j++) ingest(`next-${i}`);
-      assert.strictEqual(checked() - before, 4000);
+      assert.strictEqual(badSig, 300 * 100, 'each peer checks its own 100');
+      assert.strictEqual(node._gossipGlobal.tokens, node._gossipGlobalBurst, 'no forgery spent the shared ceiling');
+      assert.strictEqual(metrics.filter((m) => m.type === 'gossip-over-ceiling').length, 0);
+      // On a session, the first forgery is attributable: the session ends and its id waits out a penalty.
+      const s = admitAs(node, { nodeId: 'forger-1' });
+      assert.strictEqual(node._ingestAttestation(forged(A), 'forger-1', 'forger-1', s).reason, 'bad-signature');
+      assert.strictEqual(s.closed, true, 'a forged signature on a proven session closes it');
+      assert.strictEqual(node._penalised('forger-1'), true, 'and its nodeId is not admitted again for a while');
+      assert.ok(metrics.some((m) => m.type === 'forged-signature' && m.peer === 'forger-1'));
+    });
+  });
+
+  it('the ceiling bounds VERIFIED statements, spent after the signature checks out', () => {
+    withNode({ gossipBudget: { globalBurst: 5, globalPerSecond: 1 } }, ({ node, metrics }) => {
+      const A = kp('att-A');
+      node._roster.bind(A.id, A.pub, 'proven');
+      const real = (i) => signed({ of: `cmb-${crypto.randomBytes(32).toString('hex')}`, by: A.id, at: 1, roster: ROOM, verdict: 'aligned', categories: {}, seq: 1000 + i, prev: 'p' }, A.priv, signAttestation);
+      const reasons = {};
+      for (let i = 0; i < 8; i++) { const r = node._ingestAttestation(real(i), `peer-${i}`, `peer-${i}`); reasons[r.reason || 'stored'] = (reasons[r.reason || 'stored'] || 0) + 1; }
+      assert.strictEqual(reasons['over-ceiling'], 3, 'past the ceiling, verified statements are dropped unstored');
+      assert.ok(metrics.some((m) => m.type === 'gossip-over-ceiling'));
     });
   });
 
@@ -331,7 +336,7 @@ describe('an over-long signature (F5)', () => {
       const att = signed({ of: 'cmb-1', by: A.id, at: 1, roster: ROOM, method: 'heuristic', verdict: 'aligned', categories: {}, role: 'participant', seq: 1, prev: 'p' }, A.priv, signAttestation);
       const cp = signed({ type: 'checkpoint', by: A.id, roster: ROOM, upto_seq: 8, root: 'r8', at: 1 }, A.priv, signCheckpoint);
       const w = signed({ type: 'witness', attester: A.id, roster: ROOM, upto_seq: 8, root: 'r8', by: W.id, role: 'participant', at: 1 }, W.priv, signWitness);
-      const g = signGrant({ type: 'role-grant', grantee: 'V', granteeKey: SOME_KEY, role: 'validator', grantedBy: A.id, grantedAt: 1 }, A.priv);
+      const g = signGrant({ type: 'role-grant', grantee: 'v', granteeKey: SOME_KEY, role: 'validator', grantedBy: A.id, grantedAt: 1 }, A.priv);
       const ingest = (sig) => [
         node._ingestAttestation({ ...att, sig }, 'p', 'p').reason,
         node._ingestCheckpoint({ ...cp, sig }, 'p').reason,
@@ -406,12 +411,16 @@ describe('part A2 review suggestions', () => {
       const logs = [];
       node._log = (m) => logs.push(m);
       node._synthesisDelegate = () => ({ focus: 'a synthesis' });
+      node._hasNewDomainData = true; // the synthesis is the remix path (§15.7): it needs new domain data
       node.remember = () => { const e = new Error('CMB signing failed: no key'); e.code = 'ESIGN'; throw e; };
       node._frameHandler._handleXMeshInsight('p', 'p', { anomaly: 0.1 });
       assert.ok(logs.includes('Synthesis not shared: this node cannot sign its records'), logs.join('\n'));
       assert.ok(!logs.some((l) => l.startsWith('Synthesis delegate error')));
       node._synthesisDelegate = () => { throw new Error('the delegate broke'); };
       node._frameHandler._handleXMeshInsight('p', 'p', { anomaly: 0.1 });
+      assert.ok(!logs.includes('Synthesis delegate error: the delegate broke'), 'a second insight within 10 s is paced: no synthesis (security review)');
+      node._frameHandler._lastSynthesisAt = 0;
+      node._frameHandler._handleXMeshInsight('p', 'p', { anomaly: 0.1 });
       assert.ok(logs.includes('Synthesis delegate error: the delegate broke'), 'a delegate error is still said as one');
     });
   });
diff --git a/tests/mesh-agent.test.js b/tests/mesh-agent.test.js
index 5d2aa05e..598da25c 100644
--- a/tests/mesh-agent.test.js
+++ b/tests/mesh-agent.test.js
@@ -164,6 +164,7 @@ describe('MeshAgent when its node cannot sign', () => {
       shouldRemix: () => true,
     });
     agent.node.canRemix = () => true;
+    agent.node._hasNewDomainData = true; // the remix path is gated on it (§15.7)
     agent.node.remember = () => { const e = new Error('CMB signing failed: key unreadable'); e.code = 'ESIGN'; throw e; };
     const errors = [];
     const origError = console.error, origLog = console.log;
diff --git a/tests/node.test.js b/tests/node.test.js
index fa69df49..a99034dd 100644
--- a/tests/node.test.js
+++ b/tests/node.test.js
@@ -284,13 +284,14 @@ describe('SymNode', () => {
     const node = new SymNode({ name, silent: true, discovery: new NullDiscovery() });
     await node.start();
 
-    // No domain data yet — remix should be rejected
-    const rejected = node.remember(
+    // No domain data yet — the REMIX PATH is refused, and says so (draft spec PR #35: §15.7 gates
+    // only the node's integration of a peer record, never remember()).
+    const rejected = node.remix(
       { focus: 'remix attempt', issue: 'none', intent: 'test', motivation: 'test',
         commitment: 'test', perspective: 'test', mood: { text: 'neutral', valence: 0, arousal: 0 } },
       { parents: [{ key: 'cmb-fake-parent', lineage: { ancestors: [] } }] }
     );
-    assert.strictEqual(rejected, null, 'remix without domain data should return null');
+    assert.deepStrictEqual(rejected, { refused: 'remix-without-new-domain-data' }, 'a remix without domain data is refused, by name');
 
     // Produce domain observation — this sets canRemix = true
     node.remember({
@@ -300,7 +301,7 @@ describe('SymNode', () => {
     assert.strictEqual(node.canRemix(), true);
 
     // Now remix should succeed
-    const accepted = node.remember(
+    const accepted = node.remix(
       { focus: 'valid remix', issue: 'none', intent: 'test', motivation: 'test',
         commitment: 'test', perspective: 'test', mood: { text: 'neutral', valence: 0, arousal: 0 } },
       { parents: [{ key: 'cmb-fake-parent', lineage: { ancestors: [] } }] }
@@ -312,6 +313,30 @@ describe('SymNode', () => {
     fs.rmSync(nodeDir(name), { recursive: true, force: true });
   });
 
+  it('remember(fields, parents) is never gated (draft spec PR #35): two cited replies in a row both mint; a duplicate says so', async () => {
+    const name = `test-cited-${Date.now()}`;
+    const node = new SymNode({ name, silent: true, discovery: new NullDiscovery() });
+    await node.start();
+    try {
+      const cats = (focus) => ({ focus, issue: 'none', intent: 'reply', motivation: 'm', commitment: 'c', perspective: 'p', mood: { text: 'neutral' } });
+      node._hasNewDomainData = false;
+      const peer = { key: 'cmb-' + 'a'.repeat(64) };
+      const r1 = node.remember(cats('a cited reply'), { parents: [peer] });
+      const r2 = node.remember(cats('a second cited reply'), { parents: [peer] });
+      assert.ok(r1 && r1.key && !r1.refused, 'the first cited reply mints');
+      assert.ok(r2 && r2.key && !r2.refused, 'and so does the second: a reply is not a remix');
+      assert.strictEqual(node.canRemix(), true, 'an authored record is new domain data, with or without parents');
+      const dup = node.remember(cats('a second cited reply'), { parents: [peer] });
+      assert.deepStrictEqual({ key: dup.key, duplicate: dup.duplicate }, { key: r2.key, duplicate: true }, 'a re-assertion of HEAD is told apart from a refusal');
+      node.remember(cats('something else'));
+      const again = node.remember(cats('a cited reply'), { parents: [peer] });
+      assert.deepStrictEqual(again, { key: r1.key, duplicate: true }, 'and so is a record already stored');
+    } finally {
+      await node.stop();
+      fs.rmSync(nodeDir(name), { recursive: true, force: true });
+    }
+  });
+
   it('should emit cmb-accepted when receiveFromPeer stores a CMB', async () => {
     const name = `test-cmb-accepted-${Date.now()}`;
     const node = new SymNode({ name, silent: true, discovery: new NullDiscovery() });
@@ -367,19 +392,19 @@ describe('SymNode', () => {
     assert.strictEqual(node.canRemix(), true, 'domain observation should enable remix');
 
     // Remix should succeed and RESET canRemix
-    const remix = node.remember(
+    const remix = node.remix(
       { ...categories, focus: 'remix of peer signal' },
       { parents: [{ key: 'cmb-parent-123', lineage: { ancestors: [] } }] }
     );
-    assert.ok(remix, 'remix should succeed');
+    assert.ok(remix && remix.key, 'remix should succeed');
     assert.strictEqual(node.canRemix(), false, 'remix should reset hasNewDomainData');
 
     // Second remix without new domain data should be rejected
-    const rejected = node.remember(
+    const rejected = node.remix(
       { ...categories, focus: 'second remix attempt' },
       { parents: [{ key: 'cmb-parent-456', lineage: { ancestors: [] } }] }
     );
-    assert.strictEqual(rejected, null, 'second remix without new domain data should be rejected');
+    assert.deepStrictEqual(rejected, { refused: 'remix-without-new-domain-data' }, 'second remix without new domain data should be rejected');
 
     // New domain observation re-enables remix
     node.remember({ ...categories, focus: 'fresh observation' });
diff --git a/tests/peer-fed-bounds.test.js b/tests/peer-fed-bounds.test.js
index 33d527bb..01d68658 100644
--- a/tests/peer-fed-bounds.test.js
+++ b/tests/peer-fed-bounds.test.js
@@ -118,8 +118,13 @@ describe('wakes have a cooldown on failure and a bounded queue (R4)', () => {
     const lines = [];
     node._log = (l) => lines.push(l);
     try {
-      for (let i = 0; i < 300; i++) node._wakeManager.learnWakeChannel(`phone-${i}`, ch(`t${i}`), { source: 'direct' });
-      for (let m = 0; m < 50; m++) node._wakeManager.wakeSleepingPeers('message', { type: 'message', content: `m${m}` });
+      for (let i = 0; i < 300; i++) {
+        node._wakeManager.learnWakeChannel(`phone-${i}`, ch(`t${i}`), { source: 'direct' });
+        node._roster.bind(`phone-${i}`, identity(`phone-${i}`).publicKey, 'pinned'); // a queued frame goes to this key only
+      }
+      for (let m = 0; m < 50; m++) node._wakeManager.wakeSleepingPeers('mood', { type: 'mood', mood: `m${m}` });
+      // The retired `message` frame is never queued (security review): it wakes, and waits for nothing.
+      node._wakeManager.wakeSleepingPeers('message', { type: 'message', content: 'retired' });
       await new Promise((r) => setTimeout(r, 300));
       const failed = lines.filter((l) => /^Wake failed/.test(l));
       assert.strictEqual(failed.length, 300, 'one attempt per channel per cooldown, not one per message (no APNs keys here, so each fails)');
@@ -127,7 +132,9 @@ describe('wakes have a cooldown on failure and a bounded queue (R4)', () => {
       for (const [, q] of node._pendingFrames) most = Math.max(most, q.length);
       assert.strictEqual(most, PENDING_FRAMES_MAX);
       assert.strictEqual(PENDING_FRAMES_MAX, 16);
-      assert.deepStrictEqual(node._pendingFrames.get('phone-0').map((f) => f.content), Array.from({ length: 16 }, (_, i) => `m${34 + i}`), 'the newest are kept');
+      assert.deepStrictEqual(node._pendingFrames.get('phone-0').map((e) => e.frame.mood), Array.from({ length: 16 }, (_, i) => `m${34 + i}`), 'the newest are kept');
+      assert.ok(node._pendingFrames.get('phone-0').every((e) => e.key === node._roster.get('phone-0')), 'each kept with the key it may be delivered to');
+      assert.ok(![...node._pendingFrames.values()].some((q) => q.some((e) => e.frame.type === 'message')), 'no message frame queued');
     } finally { await done(node); }
   });
 });
@@ -177,8 +184,10 @@ describe('per-peer maps are pruned when the peer leaves and bounded otherwise (R
         void tc;
       }
       for (const { from, f } of hellos) node._relayEnvelope(from, 'x', f);
-      assert.strictEqual(node._relayHandshakesInFlight(), 256, 'bounded');
-      assert.ok(node._sessionStats.refusedByReason['too-many-handshakes'] >= 144);
+      // Unknown froms share RELAY_UNKNOWN_MAX (32) of the 256 slots, the oldest going first for a
+      // newer hello (security review D, relay-slots / announce-starve).
+      assert.strictEqual(node._relayHandshakesInFlight(), 32, 'unknown froms: bounded at their share');
+      assert.ok((node._sessionStats.failedByReason['handshake-evicted'] || 0) >= 368, 'the oldest unknown handshakes made room');
       for (const s of [...node._sessions]) if (s.kind === 'relay') s.close('timeout', { notify: false });
       assert.strictEqual(node._relaySessions.size, 0, 'nothing kept per relay from');
     } finally { await done(node); }
diff --git a/tests/record-bounds.test.js b/tests/record-bounds.test.js
index 10737cce..ebc9268f 100644
--- a/tests/record-bounds.test.js
+++ b/tests/record-bounds.test.js
@@ -179,7 +179,7 @@ describe('on receipt', () => {
     return cmb;
   }
 
-  it('accepts a record with a category over 256 KiB, which this release would not mint (0.14.0 review C-F4)', async () => {
+  it('refuses a record with a category over 256 KiB, which this release would not mint, before anything encodes it (security review D, record-flood; reverses C-F4)', async () => {
     const name = `bounds-bigcat-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
     const node = new SymNode({ name, silent: true, discovery: new NullDiscovery() });
     await node.start();
@@ -196,12 +196,17 @@ describe('on receipt', () => {
       assert.throws(() => createCMB({ categories: texts, createdBy: 'peer-old' }), (e) => e.code === 'ECMBSIZE', 'this release does not mint it');
 
       const accepted = [];
+      const metrics = [];
       node.on('cmb-accepted', (e) => accepted.push(e));
+      node.on('metric', (m) => metrics.push(m));
+      let encoded = 0;
+      node._svafEvaluator.evaluate = async () => { encoded++; return null; };
       await node._frameHandler.handle(session, { type: 'cmb', timestamp: Date.now(), cmb });
       await settle();
-      assert.strictEqual(accepted.length, 1, 'admitted');
-      assert.strictEqual(accepted[0]._cmbVerified, true, 'and verified');
-      assert.strictEqual(node._store.get(cmb.metadata.key)?.cmb.categories.focus.text.length, texts.focus.length, 'stored whole');
+      assert.strictEqual(accepted.length, 0, 'refused');
+      assert.strictEqual(encoded, 0, 'before SVAF encoded anything');
+      assert.ok(metrics.some((m) => m.type === 'cmb-signature-rejected' && /too long/.test(m.error)), 'refused as malformed (too long)');
+      assert.strictEqual(node._store.get(cmb.metadata.key), null, 'not stored');
     } finally { await node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
   });
 
diff --git a/tests/role-chain-fetch.test.js b/tests/role-chain-fetch.test.js
index f87f4797..44a4ee35 100644
--- a/tests/role-chain-fetch.test.js
+++ b/tests/role-chain-fetch.test.js
@@ -45,7 +45,11 @@ const gAX = grant('role-grant', X, 'validator', A, t - 5000);
 const RECS = { AV: gAV, VX: gVX, rVX, AX: gAX };
 
 function boot(base, extra = {}) {
-  return new SymNode({ name: uniq(base), silent: true, discovery: new NullDiscovery(), room: 'chain', anchor: { nodeId: A.nodeId, publicKey: A.pub }, ...extra });
+  const n = new SymNode({ name: uniq(base), silent: true, discovery: new NullDiscovery(), room: 'chain', anchor: { nodeId: A.nodeId, publicKey: A.pub }, ...extra });
+  // These tests are about role-chain-fetch: the admission-time sync (anti-entropy, tested on its
+  // own below) is left out, so a record reaches the store only by the order the test delivers it.
+  if (!extra.sync) n._onRoleDigest = () => {};
+  return n;
 }
 async function stopAll(...nodes) {
   for (const n of nodes) { try { await n.stop(); } catch { /* */ } try { fs.rmSync(nodeDirById(n.nodeId), { recursive: true, force: true }); } catch { /* */ } }
@@ -142,6 +146,42 @@ describe('a grant or revoke that arrives before its root is resolved by role-cha
   });
 });
 
+describe('anti-entropy for grants and revokes (security review D, p7-ceiling)', () => {
+  it('a revoke this node missed reaches it at the next admission: the digests differ, the store syncs', async () => {
+    const P = boot('ae-p', { sync: true }); const N = boot('ae-n', { sync: true });
+    try {
+      await P.start(); await N.start();
+      // N knows V as validator and V's grant of X; P also holds the revoke N never got.
+      for (const r of [gAV, gVX]) { P._roleGrants.record(r); N._roleGrants.record(r); }
+      P._roleGrants.record(rVX);
+      assert.strictEqual(N.resolveRole(X.nodeId, Date.now(), { key: X.pub }), 'validator', 'before: the revoke was lost on the way');
+      await connectNodes(P, N);
+      await until(() => N._roleGrants.size() === 3, 4000);
+      assert.strictEqual(N.resolveRole(X.nodeId, Date.now(), { key: X.pub }), 'participant', 'after: the revoke arrived by the sync');
+      assert.ok(N._chainStats.synced >= 1);
+      assert.strictEqual(N._roleGrants.digest().digest, P._roleGrants.digest().digest, 'the stores agree');
+    } finally { await stopAll(P, N); }
+  });
+
+  it('a sync is paged in sync order (each record after its chain), and the pages are bounded', async () => {
+    const N = boot('ae-serve');
+    try {
+      await N.start();
+      const ys = Array.from({ length: 70 }, (_, i) => kp(`ae-y${i}`));
+      for (const [i, y] of ys.entries()) N._roleGrants.record(grant('role-grant', y, 'validator', A, t - 500 + i));
+      const asker = admitAs(N, { nodeId: 'ae-asker', name: 'a', publicKey: kp('ae-q').pub });
+      deliver(N, asker, { type: 'role-chain-fetch', reqId: 'rs-1', sync: true, after: 0 });
+      const first = asker.sent.find((f) => f.type === 'role-chain');
+      assert.strictEqual(first.grants.length, 64, 'a page holds at most 64');
+      assert.strictEqual(first.next, 64, 'and says where the next starts');
+      deliver(N, asker, { type: 'role-chain-fetch', reqId: 'rs-2', sync: true, after: first.next });
+      const second = asker.sent.filter((f) => f.type === 'role-chain')[1];
+      assert.strictEqual(second.grants.length, 6);
+      assert.strictEqual(second.next, undefined, 'the last page');
+    } finally { await stopAll(N); }
+  });
+});
+
 describe('role-chain-fetch cannot be flooded (port of pending-abuse.js)', () => {
   const junk = (i) => signGrant({ type: 'role-grant', grantee: `g${i}`, granteeKey: kp('j').pub, role: 'validator', grantedBy: `nobody-${i}`, grantedAt: t }, kp('j').priv);
 
@@ -162,16 +202,19 @@ describe('role-chain-fetch cannot be flooded (port of pending-abuse.js)', () =>
     } finally { await stopAll(N); }
   });
 
-  it('(b) a forged copy sent ahead of the genuine record does not keep it out', async () => {
+  it('(b) a forged copy sent ahead of the genuine record does not keep it out, and the session that sent it ends', async () => {
     const N = boot('chain-forged');
     try {
       await N.start();
       const s = admitAs(N, { nodeId: 'relayer', name: 'r', publicKey: kp('r').pub });
+      const h = admitAs(N, { nodeId: 'honest-relayer', name: 'h', publicKey: kp('h2').pub });
       deliver(N, s, { type: 'role-grant', grant: { ...gVX, grantedAt: gVX.grantedAt + 1 } }); // the genuine sig on altered fields
-      deliver(N, s, { type: 'role-grant', grant: gVX });
-      assert.strictEqual(s._chainHold.grants.size, 2, 'two records, held apart');
-      const reqId = s.sent.find((f) => f.type === 'role-chain-fetch').reqId;
-      deliver(N, s, { type: 'role-chain', reqId, grants: [gAV] });
+      deliver(N, h, { type: 'role-grant', grant: gVX });
+      assert.strictEqual(s._chainHold.grants.size, 1, 'held apart: the forgery on its session');
+      assert.strictEqual(h._chainHold.grants.size, 1, 'the genuine record on its own');
+      deliver(N, s, { type: 'role-chain', reqId: s.sent.find((f) => f.type === 'role-chain-fetch').reqId, grants: [gAV] });
+      assert.strictEqual(s.closed, true, 'the forgery is attributable to the session that relayed it: closed (security review D)');
+      deliver(N, h, { type: 'role-chain', reqId: h.sent.find((f) => f.type === 'role-chain-fetch').reqId, grants: [gAV] });
       assert.strictEqual(N.resolveRole(X.nodeId, Date.now(), { key: X.pub }), 'validator', 'the genuine one stored, the forgery dropped');
       assert.strictEqual(N._roleGrants.size(), 2);
     } finally { await stopAll(N); }
diff --git a/tests/role-grant-store.test.js b/tests/role-grant-store.test.js
index 9d491e96..93e057df 100644
--- a/tests/role-grant-store.test.js
+++ b/tests/role-grant-store.test.js
@@ -20,7 +20,8 @@ const { signGrant } = require('../lib/core');
 function kp(nodeId) {
   const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519');
   return {
-    nodeId,
+    // nodeIds are canonical lowercase at every door, a grant's included (security review B).
+    nodeId: nodeId.toLowerCase(),
     priv: privateKey.export({ format: 'der', type: 'pkcs8' }).subarray(16).toString('base64url'),
     pub: publicKey.export({ format: 'der', type: 'spki' }).subarray(12).toString('base64url'),
   };
@@ -121,8 +122,10 @@ describe('RoleGrantStore — revocation actually contains a compromised grantor'
     const st = storeWith(A, [B, X]);
     st.record(grant('role-grant', B, 'validator', A, T));
     st.record(grant('role-revoke', B, undefined, A, T + 300));
-    assert.strictEqual(st.record(grant('role-grant', X, 'validator', B, T + 100)).stored, true, 'backdated grant is stored (signature is valid)');
-    assert.strictEqual(st.resolveRole(X.nodeId, T + 500), 'participant', 'but it confers nothing — backdating cannot bypass revocation');
+    // Since the security review (C; draft spec PR #33) the grantor must also be authorised when the
+    // grant is RECEIVED: B is revoked by then, so the backdated grant is not even kept.
+    assert.deepStrictEqual(st.record(grant('role-grant', X, 'validator', B, T + 100)), { stored: false, reason: 'unrooted' }, 'a backdated grant from a revoked grantor is refused at receipt');
+    assert.strictEqual(st.resolveRole(X.nodeId, T + 500), 'participant', 'and it confers nothing — backdating cannot bypass revocation');
   });
 
   it('revoking a grantor cascades to everything it granted', () => {
@@ -205,6 +208,7 @@ describe('RoleGrantStore — relayed key learning (grant vouches for grantee key
     const A = kp('A'), V = kp('V'), X = kp('X'), Y = kp('Y');
     const reg = new RosterKeyRegistry({ anchor: { nodeId: A.nodeId, publicKey: A.pub } });
     const store = new RoleGrantStore({ anchor: { nodeId: A.nodeId, publicKey: A.pub }, keys: reg });
+    reg.setGrantView((id) => store.vouchedKey(id)); // a grant binding is a view (security review C)
 
     // anchor → V validator, vouching V's key. C never met V.
     assert.strictEqual(reg.has(V.nodeId), false);
diff --git a/tests/room-admission.test.js b/tests/room-admission.test.js
index cd5b0e42..1d5791f4 100644
--- a/tests/room-admission.test.js
+++ b/tests/room-admission.test.js
@@ -120,7 +120,7 @@ describe('the decision is made for every session before anything per-peer exists
   it('a frame from a session the door has not admitted is refused, except its room-join grant', () => {
     const frame = src.slice(src.indexOf('  _onSessionFrame(session, frame) {'), src.indexOf('  _onSessionClosed(session, info) {'));
     assert.match(frame, /state !== 'admitted'/);
-    assert.match(frame, /mesh-room-join/);
+    assert.match(frame, /'room-join'/, 'the room-join frame (draft spec PR #31; mesh-room-join until the rename)');
     assert.match(frame, /not-admitted/);
   });
 });
diff --git a/tests/roster-and-peer-table-bounds.test.js b/tests/roster-and-peer-table-bounds.test.js
index b5e95f90..00ce033d 100644
--- a/tests/roster-and-peer-table-bounds.test.js
+++ b/tests/roster-and-peer-table-bounds.test.js
@@ -44,32 +44,36 @@ async function dial(node, local, room) {
 }
 
 describe('the key registry cannot be locked out by identity churn (roster-fill.js, D3)', () => {
-  it('a full registry of first-contact bindings makes room for a newcomer; one that protects history stays', () => {
+  it('a full registry evicts nothing before it expires: a once-seen honest binding stays, and a squatter of it is a conflict (security review D, p8-evict)', () => {
     let t = 1;
     const r = new RosterKeyRegistry({ now: () => t, maxBindings: 1000 });
     const honest = identity('honest');
-    r.bind(honest.nodeId, honest.publicKey, 'proven'); r.noteVerified(honest.nodeId);
-    for (let i = 0; i < 5000; i++) { t++; assert.strictEqual(r.bind(`fill-${i}`, identity().publicKey, 'proven').bound, true, `fill ${i} bound`); }
+    r.bind(honest.nodeId, honest.publicKey, 'proven'); r.noteSeen(honest.nodeId); // seen once, verified nothing
+    let full = 0;
+    for (let i = 0; i < 5000; i++) { t++; if (r.bind(`fill-${i}`, identity().publicKey, 'proven').reason === 'full') full++; }
     assert.strictEqual(r.size(), 1000, 'bounded');
-    assert.strictEqual(r.get(honest.nodeId), honest.publicKey, 'the binding that verified something was never displaced');
-    const genuine = identity('genuine');
-    assert.strictEqual(r.bind(genuine.nodeId, genuine.publicKey, 'proven').bound, true, 'a genuine newcomer is bound (0.13.17 refused it)');
-    assert.ok(r.evictedCount() >= 4000);
+    assert.strictEqual(full, 4001, 'past the bound a newcomer is refused a durable binding (held for its session only)');
+    assert.strictEqual(r.get(honest.nodeId), honest.publicKey, 'the honest binding was never displaced');
+    assert.strictEqual(r.bind(honest.nodeId, identity('squatter').publicKey, 'proven').reason, 'conflict', 'and its nodeId cannot be squatted');
+    assert.strictEqual(r.evictedCount(), 0, 'nothing is evicted before it expires');
   });
 
-  it('on a node: 300 throwaway Core Secure identities, then a genuine newcomer is bound; the registry stays bounded', async () => {
+  it('on a node: 300 throwaway identities, each handshaking twice, fill nothing durable; a genuine newcomer runs with its session binding (roster-fill-014)', async () => {
     const node = new SymNode({ name: uniq('roster-fill'), silent: true, discovery: new NullDiscovery(), room: 'g', maxKeyBindings: 100 });
     try {
       await node.start();
-      for (let i = 0; i < 300; i++) { const { c } = await dial(node, identity(`throwaway-${i}`), 'g'); c.close('done'); }
+      for (let i = 0; i < 300; i++) {
+        const id = identity(`throwaway-${i}`);
+        for (let k = 0; k < 2; k++) { const { c } = await dial(node, id, 'g'); c.close('done'); }
+      }
       await until(() => node._peers.size === 0, 3000);
-      assert.ok(node._roster.size() <= 100, `bounded: ${node._roster.size()}`);
+      assert.strictEqual(node._roster.size(), 0, 'a handshake, or two, earns no durable binding (security review D)');
       const genuine = identity('genuine');
       const { c } = await dial(node, genuine, 'g');
       assert.strictEqual(c.confirmed, true);
       await until(() => node._peers.has(genuine.nodeId), 2000);
-      assert.strictEqual(node._roster.get(genuine.nodeId), genuine.publicKey, 'bound proven');
-      assert.strictEqual(node._roster.source(genuine.nodeId), 'proven');
+      assert.strictEqual(node._keySource(genuine.nodeId), 'session', 'held for its session');
+      assert.strictEqual(node._identityKey(genuine.nodeId), genuine.publicKey);
     } finally { await node.stop(); fs.rmSync(nodeDirById(node.nodeId), { recursive: true, force: true }); }
   });
 
diff --git a/tests/roster-keys.test.js b/tests/roster-keys.test.js
index fe8d7f78..a76530e7 100644
--- a/tests/roster-keys.test.js
+++ b/tests/roster-keys.test.js
@@ -26,11 +26,33 @@ describe('the conflict matrix, row by row', () => {
     assert.strictEqual(r.get('N'), k);
   });
 
-  it('nodeId unbound, anchor-rooted grant vouches a key → bind grant', () => {
-    const r = new RosterKeyRegistry(); const k = key();
+  it('nodeId unbound, anchor-rooted grant in effect vouches a key → bound as a view (never stored)', () => {
+    const k = key();
+    let inEffect = true;
+    const r = new RosterKeyRegistry({ grantView: (id) => (id === 'N' && inEffect ? k : undefined) });
     assert.strictEqual(r.bind('N', k, 'grant').bound, true);
     assert.strictEqual(r.source('N'), 'grant');
     assert.strictEqual(r.get('N'), k, 'a vouched key verifies');
+    assert.strictEqual(r.size(), 0, 'nothing is stored for it');
+    inEffect = false;
+    assert.strictEqual(r.get('N'), undefined, 'the binding ends with the grant (security review C)');
+    assert.strictEqual(new RosterKeyRegistry().bind('N', k, 'grant').reason, 'not-in-effect', 'a grant not in effect binds nothing');
+  });
+
+  it('this node\'s own nodeId is its own key: no source binds it to another, and no grant view applies', () => {
+    const own = key(); const evil = key();
+    const r = new RosterKeyRegistry({ self: { nodeId: 'me', publicKey: own }, grantView: () => evil });
+    assert.strictEqual(r.get('me'), own);
+    assert.strictEqual(r.source('me'), 'self');
+    for (const src of ['proven', 'pinned', 'grant', 'legacy-claim']) assert.strictEqual(r.bind('me', evil, src).reason, 'conflict', src);
+    assert.strictEqual(r.get('me'), own);
+  });
+
+  it('pinned outranks proven: a session proving a pinned key keeps it pinned (mesh-channel defect report)', () => {
+    const r = new RosterKeyRegistry(); const k = key();
+    r.bind('N', k, 'pinned');
+    assert.strictEqual(r.bind('N', k, 'proven').source, 'pinned');
+    assert.strictEqual(r.source('N'), 'pinned');
   });
 
   it('nodeId unbound, accepted invite names a key → bind pinned', () => {
@@ -49,7 +71,9 @@ describe('the conflict matrix, row by row', () => {
 
   for (const [first, second] of [['grant', 'proven'], ['proven', 'grant'], ['pinned', 'proven'], ['proven', 'pinned'], ['proven', 'proven'], ['grant', 'pinned']]) {
     it(`nodeId bound (${first}), DIFFERENT key from ${second} → conflict: refused and recorded`, () => {
-      const r = new RosterKeyRegistry(); const k1 = key(); const k2 = key();
+      const k1 = key(); const k2 = key();
+      // A grant binding is a view over grants in effect (security review C): the first is one.
+      const r = new RosterKeyRegistry(first === 'grant' ? { grantView: (id) => (id === 'N' ? k1 : undefined) } : {});
       r.bind('N', k1, first);
       const res = r.bind('N', k2, second);
       assert.strictEqual(res.bound, false);
@@ -117,7 +141,8 @@ describe('persistence and the 0.13 file', () => {
     const dir = tmp();
     try {
       const k = key(); const k2 = key();
-      const r1 = new RosterKeyRegistry({ dir });
+      // The floor arms for a routed nodeId on a proof, as its own persisted fact (security review).
+      const r1 = new RosterKeyRegistry({ dir, isRouted: (id) => id === 'N' || id === 'M' });
       r1.bind('N', k, 'proven');
       r1.bind('N', k2, 'grant');
       r1.bind('M', key(), 'proven');
@@ -127,8 +152,9 @@ describe('persistence and the 0.13 file', () => {
       assert.strictEqual(r2.get('N'), k);
       assert.strictEqual(r2.source('N'), 'proven');
       assert.strictEqual(r2.conflicts().length, 1);
-      assert.strictEqual(r2.floor('N'), true, 'the sticky floor is derived from the persisted proven binding');
+      assert.strictEqual(r2.floor('N'), true, 'the sticky floor is persisted');
       assert.strictEqual(r2.floor('M'), false, 'and an operator reset survives too');
+      assert.strictEqual(new RosterKeyRegistry({ dir }).floor('X'), false, 'an unrouted id never arms one');
     } finally { fs.rmSync(dir, { recursive: true, force: true }); }
   });
 
@@ -145,7 +171,7 @@ describe('persistence and the 0.13 file', () => {
       ];
       fs.writeFileSync(path.join(dir, 'roster-keys.jsonl'), old.map((o) => JSON.stringify(o)).join('\n') + '\n');
       const r = new RosterKeyRegistry({ dir });
-      assert.deepStrictEqual(r.migration(), { read: 5, bindings: 2, legacyClaim: 2, grant: 0, droppedAnchor: 1, droppedMalformed: 1 });
+      assert.deepStrictEqual(r.migration(), { read: 5, bindings: 2, legacyClaim: 2, grant: 0, droppedAnchor: 1, droppedMalformed: 1, droppedSelf: 0 });
       assert.strictEqual(r.source('H'), 'legacy-claim');
       assert.strictEqual(r.expected('G'), later, 'the binding 0.13 used is the one kept');
       assert.strictEqual(r.source('G'), 'legacy-claim');
@@ -160,6 +186,32 @@ describe('persistence and the 0.13 file', () => {
     } finally { fs.rmSync(dir, { recursive: true, force: true }); }
   });
 
+  it('a 0.13 `grant` entry migrates as a legacy claim: expected, never verifying (security review C, p1b-migrate-grant)', () => {
+    const dir = tmp();
+    try {
+      const k = key(); const honest = key();
+      fs.writeFileSync(path.join(dir, 'roster-keys.jsonl'), JSON.stringify({ nodeId: 'H', key: k, source: 'grant' }) + '\n');
+      const r = new RosterKeyRegistry({ dir });
+      assert.strictEqual(r.source('H'), 'legacy-claim');
+      assert.strictEqual(r.get('H'), undefined, '0.13 pinned a grant key without checking its grantor: it verifies nothing');
+      assert.strictEqual(r.migration().grant, 1);
+      assert.strictEqual(r.bind('H', honest, 'proven').reason, 'conflict', 'the expected key: another is a conflict for the operator');
+    } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+  });
+
+  it('a read-only registry (sym keys list) changes nothing on disk (p11-cli-compact)', () => {
+    const dir = tmp();
+    try {
+      const k = key();
+      const old = Date.now() - 31 * 864e5;
+      fs.writeFileSync(path.join(dir, 'roster-keys.jsonl'), JSON.stringify(FORMAT_MARKER) + '\n' + JSON.stringify({ nodeId: 'L', key: k, source: 'proven', seen: old }) + '\n');
+      const before = fs.readFileSync(path.join(dir, 'roster-keys.jsonl'), 'utf8');
+      const ro = new RosterKeyRegistry({ dir, readOnly: true });
+      assert.strictEqual(ro.get('L'), k, 'listed as it is');
+      assert.strictEqual(fs.readFileSync(path.join(dir, 'roster-keys.jsonl'), 'utf8'), before, 'nothing expired, compacted or written');
+    } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+  });
+
   it('a 0.13 rollback reads the migrated file (it skips the marker) and its appends are relabelled on return', () => {
     const dir = tmp();
     try {
diff --git a/tests/rule-a-collapse.test.js b/tests/rule-a-collapse.test.js
index 91210a03..98ab3c0d 100644
--- a/tests/rule-a-collapse.test.js
+++ b/tests/rule-a-collapse.test.js
@@ -118,16 +118,18 @@ test('B-2: parenting to your OWN head does not trip or consume the anti-paraphra
       { parents: [child.cmb] },
     );
     assert.ok(grandchild, 'two self-parented blocks in a row — the alternation is gone');
-    assert.equal(node._hasNewDomainData, false, 'and self-parenting never consumed the flag');
+    assert.equal(node._hasNewDomainData, true, 'an authored record is new domain data, with or without parents (draft spec PR #35)');
   });
 });
 
-test('B-2: parenting to a PEER still requires new domain data', async () => {
-  // The half of the guard that was right, kept intact.
+test('B-2: the REMIX PATH still requires new domain data; remember() citing a peer does not (draft spec PR #35)', async () => {
+  // The half of the guard that was right, kept intact — on the path that remixes.
   await withNode('rule-a-peerparent', async (node) => {
     node._hasNewDomainData = false;
     const peerBlock = { metadata: { key: 'cmb-' + 'f'.repeat(64) } };   // not ours
-    const res = node.remember({ ...FIELDS }, { parents: [peerBlock] });
-    assert.equal(res, null, 'remixing a peer without new domain data is still refused');
+    const res = node.remix({ ...FIELDS }, { parents: [peerBlock] });
+    assert.deepStrictEqual(res, { refused: 'remix-without-new-domain-data' }, 'remixing a peer without new domain data is still refused');
+    const reply = node.remember({ ...FIELDS, focus: 'a reply citing the peer' }, { parents: [peerBlock] });
+    assert.ok(reply && reply.key && !reply.refused, 'a record the agent authors, citing a peer, is not a remix');
   });
 });
diff --git a/tests/stored-entry-annotations.test.js b/tests/stored-entry-annotations.test.js
index 2a58fa90..cfb1f455 100644
--- a/tests/stored-entry-annotations.test.js
+++ b/tests/stored-entry-annotations.test.js
@@ -144,7 +144,9 @@ describe('admission annotations live on the store entry', () => {
         assert.deepStrictEqual(Object.keys(entry.cmb).sort(), ['categories', 'metadata', 'payload'], 'the two sections and the payload decoded from the signed section, nothing this node computed');
         assert.deepStrictEqual(entry.cmb.payload, payload, 'the payload as sent');
         const { payload: _p, ...sections } = entry.cmb;
-        assert.deepStrictEqual(sections, recordAsSigned(record), 'the signed sections exactly as signed');
+        // What is stored is the signed projection (security review B; draft spec PR #34): exactly what
+        // the signature and the content address cover, the unsigned valence/arousal/lineage.method gone.
+        assert.deepStrictEqual(sections, require('../lib/core/record-canonical').signedProjection(recordAsSigned(record)), 'the signed sections exactly as signed');
         assert.strictEqual(verifyCMB(entry.cmb, PEER.publicKey).valid, true, 'and they verify');
         assert.deepStrictEqual(node.inboxGet(entry.inboxId)?.payload, payload, 'the inbox delivers it');
 
diff --git a/tests/sym-attest-v1.test.js b/tests/sym-attest-v1.test.js
index df5cc1f0..235e19ff 100644
--- a/tests/sym-attest-v1.test.js
+++ b/tests/sym-attest-v1.test.js
@@ -119,8 +119,10 @@ describe('the wire form (sym-attest-v1 §5, §6 step 1)', () => {
       a._buildAdmissionAttestation(`cmb-${hex('7')}`, 'aligned', verdicts, 'heuristic', `asrt-${hex('8')}`);
       a._buildAdmissionAttestation(`cmb-${hex('9')}`, 'rejected', verdicts, 'neural', `asrt-${hex('6')}`);
       await until(() => got.length === 2 && b._attestations.checkpointAt(a.nodeId, 2), 3000);
-      assert.deepStrictEqual([...new Set(sent.map((f) => f.type))].sort(), ['sym-attest-attestation', 'sym-attest-checkpoint']);
-      assert.ok(sent.every((f) => !('roster' in (f.attestation || f.checkpoint)) && !('upto_seq' in (f.attestation || f.checkpoint))));
+      const types = new Set(sent.map((f) => f.type));
+      assert.ok(types.has('sym-attest-attestation') && types.has('sym-attest-checkpoint'), [...types].join(','));
+      assert.ok([...types].every((t) => t.startsWith('sym-attest-')), 'only the extension\'s frames (a peer\'s witness, relayed once, among them)');
+      assert.ok(sent.every((f) => { const o = f.attestation || f.checkpoint || f.witness; return !('roster' in o) && !('upto_seq' in o); }));
       assert.deepStrictEqual(got.map((e) => [e.method, e.assertionId, e.room]), [['heuristic', `asrt-${hex('8')}`, 'sa-room'], ['neural', `asrt-${hex('6')}`, 'sa-room']]);
       assert.strictEqual(got[1].prev, core.chainLink(a._attestations.chainOf(a.nodeId)[0].sig));
       assert.strictEqual(b._attestations.checkpointAt(a.nodeId, 2).root, core.attestMerkleRoot(a._attestations.chainOf(a.nodeId).map((x) => x.sig)));
diff --git a/tests/v2-author-binding.test.js b/tests/v2-author-binding.test.js
index 0bb52f27..75af7756 100644
--- a/tests/v2-author-binding.test.js
+++ b/tests/v2-author-binding.test.js
@@ -40,28 +40,29 @@ function v2Record({ nodeId, createdBy, signWith, focus = 'v2 observation', room
   return cmb;
 }
 
+// Lowercase UUIDs: a v2.0 record's createdByNodeId and to are nothing else (security review B).
 function withNode(fn) {
   const name = `v2bind-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
   const node = new SymNode({ name, silent: true, discovery: new NullDiscovery() });
-  node._roster.bind('node-alice', ALICE.pub, 'proven');
-  node._roster.bind('node-mallory', MALLORY.pub, 'proven');
-  node._roster.bind('node-relay', RELAY.pub, 'proven');
+  node._roster.bind('01a0fd00-0000-7000-8000-0000000a11ce', ALICE.pub, 'proven');
+  node._roster.bind('01a0fd00-0000-7000-8000-0000000bad00', MALLORY.pub, 'proven');
+  node._roster.bind('01a0fd00-0000-7000-8000-000000e1a700', RELAY.pub, 'proven');
   try { return fn(node); } finally { fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
 }
 
 describe('v2.0 author binding (B-R4)', () => {
   it('a v2.0 record relayed by another peer verifies against its author\'s key', () => {
     withNode((node) => {
-      const msg = { cmb: v2Record({ nodeId: 'node-alice', createdBy: 'alice', signWith: ALICE }) };
-      assert.strictEqual(node._frameHandler._rejectOnBadSignature('node-relay', 'relay', msg), false);
+      const msg = { cmb: v2Record({ nodeId: '01a0fd00-0000-7000-8000-0000000a11ce', createdBy: 'alice', signWith: ALICE }) };
+      assert.strictEqual(node._frameHandler._rejectOnBadSignature('01a0fd00-0000-7000-8000-000000e1a700', 'relay', msg), false);
       assert.strictEqual(msg._cmbVerified, true);
     });
   });
 
   it('a peer that signs a record under another node\'s id is refused, even delivering it itself', () => {
     withNode((node) => {
-      const msg = { cmb: v2Record({ nodeId: 'node-alice', createdBy: 'alice', signWith: MALLORY }) };
-      assert.strictEqual(node._frameHandler._rejectOnBadSignature('node-mallory', 'mallory', msg), true);
+      const msg = { cmb: v2Record({ nodeId: '01a0fd00-0000-7000-8000-0000000a11ce', createdBy: 'alice', signWith: MALLORY }) };
+      assert.strictEqual(node._frameHandler._rejectOnBadSignature('01a0fd00-0000-7000-8000-0000000bad00', 'mallory', msg), true);
     });
   });
 
@@ -70,10 +71,10 @@ describe('v2.0 author binding (B-R4)', () => {
       const stranger = kp();
       const metrics = [];
       node.on('metric', (m) => metrics.push(m));
-      const msg = { cmb: v2Record({ nodeId: 'node-stranger', createdBy: 'stranger', signWith: stranger }) };
-      assert.strictEqual(node._frameHandler._rejectOnBadSignature('node-relay', 'relay', msg), true);
+      const msg = { cmb: v2Record({ nodeId: '01a0fd00-0000-7000-8000-00000057a000', createdBy: 'stranger', signWith: stranger }) };
+      assert.strictEqual(node._frameHandler._rejectOnBadSignature('01a0fd00-0000-7000-8000-000000e1a700', 'relay', msg), true);
       assert.strictEqual(msg._cmbVerified, false);
-      assert.ok(metrics.some((m) => m.type === 'cmb-author-unresolvable' && m.author === 'node-stranger'));
+      assert.ok(metrics.some((m) => m.type === 'cmb-author-unresolvable' && m.author === '01a0fd00-0000-7000-8000-00000057a000'));
     });
   });
 });
@@ -81,9 +82,9 @@ describe('v2.0 author binding (B-R4)', () => {
 describe('assertionId (B-R6)', () => {
   it('a v2.0 record whose carried assertionId is not the preimage\'s is refused', () => {
     withNode((node) => {
-      const cmb = v2Record({ nodeId: 'node-alice', createdBy: 'alice', signWith: ALICE });
+      const cmb = v2Record({ nodeId: '01a0fd00-0000-7000-8000-0000000a11ce', createdBy: 'alice', signWith: ALICE });
       cmb.metadata.assertionId = 'asrt-' + '0'.repeat(64);
-      assert.strictEqual(node._frameHandler._rejectOnBadSignature('node-alice', 'alice', { cmb }), true);
+      assert.strictEqual(node._frameHandler._rejectOnBadSignature('01a0fd00-0000-7000-8000-0000000a11ce', 'alice', { cmb }), true);
     });
   });
 
@@ -94,7 +95,7 @@ describe('assertionId (B-R6)', () => {
       const cmb = createCMB({ categories: { focus: 'old suite' }, createdBy: 'alice', room: 'default' });
       signCMB(cmb, ALICE.priv);
       cmb.metadata.assertionId = 'asrt-' + '1'.repeat(64);
-      assert.strictEqual(node._frameHandler._rejectOnBadSignature('node-alice', 'alice', { cmb }), true);
+      assert.strictEqual(node._frameHandler._rejectOnBadSignature('01a0fd00-0000-7000-8000-0000000a11ce', 'alice', { cmb }), true);
       assert.ok(metrics.some((m) => m.type === 'cmb-legacy-suite-refused'), 'counted on its own metric');
       assert.ok(!metrics.some((m) => m.type === 'cmb-signature-rejected'), 'and never as a forgery (P-6)');
     });
@@ -107,15 +108,15 @@ describe('the inbox names a proven author (K5)', () => {
     const node = new SymNode({ name, silent: true, discovery: new NullDiscovery() });
     await node.start();
     try {
-      node._roster.bind('node-alice', ALICE.pub, 'proven');
-      const relay = admitAs(node, { nodeId: 'node-relay', name: 'relay', publicKey: RELAY.pub });
+      node._roster.bind('01a0fd00-0000-7000-8000-0000000a11ce', ALICE.pub, 'proven');
+      const relay = admitAs(node, { nodeId: '01a0fd00-0000-7000-8000-000000e1a700', name: 'relay', publicKey: RELAY.pub });
       node._svafEvaluator.evaluate = async () => ({ decision: 'aligned', total_drift: 0.1, category_drifts: { focus: 0.1 }, gate_values: { g: 1 } });
       const got = [];
       node.on('cmb-accepted', (e) => got.push(e));
-      node._frameHandler.handle(relay, { type: 'cmb', timestamp: Date.now(), cmb: v2Record({ nodeId: 'node-alice', createdBy: 'alice', signWith: ALICE, focus: 'relayed but proven' }) });
+      node._frameHandler.handle(relay, { type: 'cmb', timestamp: Date.now(), cmb: v2Record({ nodeId: '01a0fd00-0000-7000-8000-0000000a11ce', createdBy: 'alice', signWith: ALICE, focus: 'relayed but proven' }) });
       await settle();
       assert.strictEqual(got.length, 1);
-      assert.strictEqual(got[0].author.nodeId, 'node-alice');
+      assert.strictEqual(got[0].author.nodeId, '01a0fd00-0000-7000-8000-0000000a11ce');
       assert.strictEqual(node.inboxGet(got[0].inboxId).from, 'alice');
     } finally { await node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
   });
@@ -125,7 +126,7 @@ describe('a malformed v2.0 frame is refused, never thrown (0.14.0 review F1)', (
   // Declares the v2.0 suite but carries no room and no signature: it has no preimage, and building
   // one throws. On the relay path that throw reached the process and ended the daemon.
   function malformed() {
-    const cmb = createCMB({ categories: { focus: 'x' }, createdBy: 'alice', emitV2: true, createdByNodeId: 'node-alice', room: 'default' });
+    const cmb = createCMB({ categories: { focus: 'x' }, createdBy: 'alice', emitV2: true, createdByNodeId: '01a0fd00-0000-7000-8000-0000000a11ce', room: 'default' });
     cmb.metadata.assertionId = 'asrt-0';
     delete cmb.metadata.room;
     return cmb;
@@ -136,7 +137,7 @@ describe('a malformed v2.0 frame is refused, never thrown (0.14.0 review F1)', (
       const metrics = [];
       node.on('metric', (m) => metrics.push(m));
       const msg = { cmb: malformed() };
-      assert.doesNotThrow(() => assert.strictEqual(node._frameHandler._rejectOnBadSignature('node-alice', 'alice', msg), true));
+      assert.doesNotThrow(() => assert.strictEqual(node._frameHandler._rejectOnBadSignature('01a0fd00-0000-7000-8000-0000000a11ce', 'alice', msg), true));
       assert.ok(metrics.some((m) => m.type === 'cmb-signature-rejected'), 'rejected through the ordinary path, with its metric');
     });
   });
@@ -147,7 +148,7 @@ describe('a malformed v2.0 frame is refused, never thrown (0.14.0 review F1)', (
       const metrics = [];
       node.on('metric', (m) => metrics.push(m));
       // Through the node's one guarded dispatch (0.13.17), which every transport calls.
-      const alice = admitAs(node, { nodeId: 'node-alice', name: 'alice', publicKey: ALICE.pub });
+      const alice = admitAs(node, { nodeId: '01a0fd00-0000-7000-8000-0000000a11ce', name: 'alice', publicKey: ALICE.pub });
       assert.doesNotThrow(() => node._receiveSessionFrame(alice, { type: 'cmb', cmb: malformed() }));
       const original = node._frameHandler._handleMemoryShare;
       node._frameHandler._handleMemoryShare = () => { throw new Error('boom'); };
@@ -172,14 +173,14 @@ describe('the audience a record signs is checked on every suite (0.14.0 review C
     const node = new SymNode({ name, silent: true, discovery: new NullDiscovery() });
     await node.start();
     try {
-      node._roster.bind('node-alice', ALICE.pub, 'proven');
-      const relay = admitAs(node, { nodeId: 'node-relay', name: 'relay', publicKey: RELAY.pub });
+      node._roster.bind('01a0fd00-0000-7000-8000-0000000a11ce', ALICE.pub, 'proven');
+      const relay = admitAs(node, { nodeId: '01a0fd00-0000-7000-8000-000000e1a700', name: 'relay', publicKey: RELAY.pub });
       node._svafEvaluator.evaluate = async () => ({ decision: 'aligned', total_drift: 0.1, category_drifts: { focus: 0.1 }, gate_values: { g: 1 } });
       const c = capture(node);
       const got = [];
       node.on('cmb-accepted', (e) => got.push(e));
       // Alice signs a record for Bob; a relay hands it to this node, which holds Alice's key.
-      const forBob = v2Record({ nodeId: 'node-alice', createdBy: 'alice', signWith: ALICE, focus: 'meant for bob only', to: 'node-bob' });
+      const forBob = v2Record({ nodeId: '01a0fd00-0000-7000-8000-0000000a11ce', createdBy: 'alice', signWith: ALICE, focus: 'meant for bob only', to: '01a0fd00-0000-7000-8000-000000000b0b' });
       node._frameHandler.handle(relay, { type: 'cmb', timestamp: Date.now(), cmb: forBob });
       await settle();
       assert.strictEqual(got.length, 0, 'not surfaced');
@@ -187,7 +188,7 @@ describe('the audience a record signs is checked on every suite (0.14.0 review C
       assert.deepStrictEqual(c.refused().map((m) => [m.reason, m.verified]), [['wrong-recipient', true]]);
 
       // The same author's record for THIS node is admitted, so the refusal is the audience's.
-      const forMe = v2Record({ nodeId: 'node-alice', createdBy: 'alice', signWith: ALICE, focus: 'meant for this node', to: node.nodeId });
+      const forMe = v2Record({ nodeId: '01a0fd00-0000-7000-8000-0000000a11ce', createdBy: 'alice', signWith: ALICE, focus: 'meant for this node', to: node.nodeId });
       node._frameHandler.handle(relay, { type: 'cmb', timestamp: Date.now(), cmb: forMe });
       await settle();
       assert.strictEqual(got.length, 1, 'a record addressed here is surfaced');
@@ -197,8 +198,8 @@ describe('the audience a record signs is checked on every suite (0.14.0 review C
   it('a verified v2.0 record signed for another room is refused', () => {
     withNode((node) => {
       const c = capture(node);
-      const msg = { cmb: v2Record({ nodeId: 'node-alice', createdBy: 'alice', signWith: ALICE, room: 'another-room' }) };
-      assert.strictEqual(node._frameHandler._rejectOnBadSignature('node-alice', 'alice', msg), true);
+      const msg = { cmb: v2Record({ nodeId: '01a0fd00-0000-7000-8000-0000000a11ce', createdBy: 'alice', signWith: ALICE, room: 'another-room' }) };
+      assert.strictEqual(node._frameHandler._rejectOnBadSignature('01a0fd00-0000-7000-8000-0000000a11ce', 'alice', msg), true);
       assert.deepStrictEqual(c.refused().map((m) => m.reason), ['wrong-audience']);
     });
   });
@@ -207,8 +208,8 @@ describe('the audience a record signs is checked on every suite (0.14.0 review C
     withNode((node) => {
       const c = capture(node);
       const stranger = kp();
-      const msg = { cmb: v2Record({ nodeId: 'node-stranger', createdBy: 'stranger', signWith: stranger, to: 'node-bob' }) };
-      assert.strictEqual(node._frameHandler._rejectOnBadSignature('node-relay', 'relay', msg), true);
+      const msg = { cmb: v2Record({ nodeId: '01a0fd00-0000-7000-8000-00000057a000', createdBy: 'stranger', signWith: stranger, to: '01a0fd00-0000-7000-8000-000000000b0b' }) };
+      assert.strictEqual(node._frameHandler._rejectOnBadSignature('01a0fd00-0000-7000-8000-000000e1a700', 'relay', msg), true);
       assert.ok(c.metrics.some((m) => m.type === 'cmb-signature-rejected' && m.reason === 'unresolvable-author'));
     });
   });
@@ -217,8 +218,8 @@ describe('the audience a record signs is checked on every suite (0.14.0 review C
     withNode((node) => {
       const c = capture(node);
       for (let i = 0; i < 3; i++) {
-        const msg = { cmb: v2Record({ nodeId: 'node-alice', createdBy: 'alice', signWith: ALICE, focus: `for bob ${i}`, to: 'node-bob' }) };
-        assert.strictEqual(node._frameHandler._rejectOnBadSignature('node-relay', 'relay', msg), true);
+        const msg = { cmb: v2Record({ nodeId: '01a0fd00-0000-7000-8000-0000000a11ce', createdBy: 'alice', signWith: ALICE, focus: `for bob ${i}`, to: '01a0fd00-0000-7000-8000-000000000b0b' }) };
+        assert.strictEqual(node._frameHandler._rejectOnBadSignature('01a0fd00-0000-7000-8000-000000e1a700', 'relay', msg), true);
       }
       assert.strictEqual(c.refused().length, 3);
       assert.strictEqual(c.lines.filter((l) => /wrong-recipient/.test(l)).length, 1);
diff --git a/tests/wake-channels.test.js b/tests/wake-channels.test.js
index 121a6de5..b91c9cc6 100644
--- a/tests/wake-channels.test.js
+++ b/tests/wake-channels.test.js
@@ -320,10 +320,11 @@ describe('0.14.0 release review B: every store and list is bounded', () => {
       const wm = node._wakeManager;
       wm.wakeIfNeeded = async () => false;
       wm.learnWakeChannel('sleeper', apns('t'), { source: 'relay' });
-      for (let i = 0; i < 500; i++) wm.wakeSleepingPeers('message', { type: 'message', n: i });
+      node._roster.bind('sleeper', require('./_core-secure').identity('sleeper').publicKey, 'pinned');
+      for (let i = 0; i < 500; i++) wm.wakeSleepingPeers('mood', { type: 'mood', n: i });
       const q = node._pendingFrames.get('sleeper');
       assert.strictEqual(q.length, 16, 'at most 16 (0.13.17\'s bound; it was 64)');
-      assert.strictEqual(q[0].n, 484, 'the newest are kept');
+      assert.strictEqual(q[0].frame.n, 484, 'the newest are kept');
       wm.learnWakeChannel('sleeper', { platform: 'none' }, { source: 'relay' });
       assert.strictEqual(node._pendingFrames.has('sleeper'), false);
     });

From 392982bbec7822e9676a792291d62be6b0775e45 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Fri, 2 Oct 2026 18:42:56 +0100
Subject: [PATCH 103/148] 0.14.0 security review: every probe a regression
 test; docs say what now holds

- tests/core-secure-review.test.js: each cs-review probe (P, A, B, C, D) as a test with
  its bound asserted (each fails on 341dafb); tests/core-secure-hostapi.test.js: the host
  API mesh-channel 0.11.0 builds to (inbox provenance, mood-delivered, keyBindings,
  xmesh-insight) and the remaining extras (room-join expiry, anchor author, bounded
  refusal metrics, path-safe names, sym emit and a live identity).
- A relay client's re-handshake supersedes its confirmed session only once the new
  session carries an authenticated frame from the server (role-digest is now sent to
  every admitted session): a lost client-finish leaves the session as it was.
- Delegation depth is checked when a grant is stored as well as when it is resolved.
- A live peer's binding seen at expiry is written, so a restart does not expire it.
- Legacy Import integration: the route pins the 0.13.17 node's X25519 key; quarantined
  records arrive as legacy-record.
- WIRE-0.14.0.md: room-join is draft #31; errors (1011 in the clear, everything else
  sealed, replays discarded, 1009 not retried); role-digest and the whole-store sync.
  CHANGELOG, README and SECURITY.md: what the review changed, and the claims it found
  wrong (the legacy relay "never sees plaintext", the binding lifetime, 0.13 roster
  wording) corrected.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 CHANGELOG.md                               | 157 ++++-
 README.md                                  |  30 +-
 SECURITY.md                                | 147 ++--
 docs/WIRE-0.14.0.md                        | 172 +++--
 lib/node.js                                |  52 +-
 lib/role-grant-store.js                    |  14 +-
 lib/roster-keys.js                         |   9 +-
 tests/core-secure-binding-lifetime.test.js |  25 +
 tests/core-secure-hostapi.test.js          | 191 ++++++
 tests/core-secure-review.test.js           | 763 +++++++++++++++++++++
 tests/integration/legacy-import-013.js     |  11 +-
 tests/roster-keys.test.js                  |   4 +-
 12 files changed, 1395 insertions(+), 180 deletions(-)
 create mode 100644 tests/core-secure-hostapi.test.js
 create mode 100644 tests/core-secure-review.test.js

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7c04b00a..2ae5124c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,95 @@ key bindings (a lockout anyone on the LAN could fill) by the binding lifetime be
 in-memory pending set for grants that arrive before their root (which could be flooded) by
 `role-chain-fetch`.
 
+### The independent security review (BLOCK at 341dafb) — what changed
+
+Seven design assumptions, each changed where it was made, not patched where it showed:
+
+- **The signed audience governs every send (A).** The one seal point refuses a record whose signed
+  `metadata.to` names anyone but the session's proven peer (`not-addressed`), whichever path offered
+  it; anchors replay room-bound records only, and `cmb-fetch` serves a directed record only to its
+  addressee. A Legacy Import session applies the same rule.
+- **A record is its signed projection (B; draft spec PR #34).** One strict constructor at ingress
+  (`lib/core/record-canonical.js`): closed objects, no type coercion, `to` a lowercase UUID or null,
+  `createdByNodeId` a lowercase UUID, each category's `meta.key` recomputed and a mismatch refused,
+  an unrecognised category dropped, and the unsigned `valence`, `arousal` and `lineage.method`
+  dropped. The node stores, emits, delivers and serves only that projection. **Release note:**
+  `mood-delivered` no longer carries `valence`/`arousal` (they were unsigned). A category over
+  256 KiB, or 960 KiB of text in all (what this release mints), is refused before anything encodes
+  it; this reverses the earlier acceptance of larger categories (C-F4). nodeIds are taken only in
+  canonical lowercase at every door: the hello, a relay `from` or announcement, a grant, an invite.
+- **Authority counts only if its signer was authorised when it signed and when it was received
+  (C; draft spec PR #33).** One rule for a grant and its key vouch, a revoke and an attestation,
+  each kept with its receipt time (a line with none is treated as received at load). A revoked
+  validator can no longer backdate grants, key vouches, revokes or attestations into its old
+  window. A grant binding is a view over the grants in effect now, never stored; no grant binds this
+  node's own nodeId (one that vouches a foreign key for it is inert, and reported:
+  `role-grant-foreign-self-key`); 0.13 `grant` roster entries migrate as legacy claims. Role
+  resolution is memoised (linear in the records) and a delegation reaches at most 8 grants from the
+  anchor; a grantor holds at most 16 records per grantee (was 64).
+- **No shared budget is spent before verification, and a forgery ends its session (D).** Only the
+  peer's own lane is spent before a signature check; the shared ceiling is spent after it. A
+  signature that does not verify on a proven session closes it (`forged-signature`) and its nodeId
+  is not admitted again for 60 s. Grants and revokes have anti-entropy: a `role-digest` on every
+  admission, and a paged whole-store sync when digests differ. A key binding is never evicted
+  before it expires. **Every confirmed session runs with a session-scoped binding**, and a second
+  key for that nodeId while it lives is a 1009 IDENTITY_CONFLICT; the durable registry takes only
+  an EARNED binding (an admitted verified record, a pin, a grant in effect, or the key a legacy claim
+  expects) — a handshake, or a re-handshake, earns nothing, and neither does a record refused for
+  its room. Resource bounds: relay handshakes per relay `from` (one in flight, a hello rate) and
+  for unknown candidates (32 of the 256 slots, the oldest evicted, a wait list served known peers
+  first, failed ones backing off up to 10 min); the LAN listener (256 connections before their
+  first frame, 16 per address; 128 authenticating sessions, 8 per host; the oldest closed); a
+  5 s handshake timeout; a fair relay pacer (per destination, confirmed-session traffic first,
+  8 MiB per destination); 1011 replies from one budget of 2 a second; `cmb-fetch` served at 2 a
+  second per session, a record once a minute per session, and nothing while 2 MiB is unsent; a
+  record budget of 8 a second per session before SVAF; role-chain holds bounded by bytes (64 KiB)
+  and grant fields by length.
+- **Legacy Import pins the routed node's X25519 key (E).** A route needs `e2eKey` (the 0.13 node's
+  `e2e-keypair.json` public key) besides the identity key or fingerprint; a hello presenting another
+  X25519 key is refused (`e2e-key-mismatch`), so a relay squatter with the public keys reads nothing.
+  A Legacy Import peer never passes a gated room's door; a legacy session has a heartbeat (closed
+  after 45 s of silence); a record naming an author other than the routed node, or carrying the
+  v2.0 suite, is refused; no assertion id passes from a quarantined record; this node's
+  attestations of one say `legacy-import-*`. Legacy records raise `legacy-record` and legacy peers
+  `legacy-peer-joined` / `legacy-peer-left`, never `cmb-accepted` (or the inbox) and `peer-joined`.
+- **Errors are information, never commands (F; draft spec PRs #23, #31).** On a confirmed session an
+  `error` travels sealed. A clear error is ignored except 1011 UNKNOWN_SESSION, which prompts a new
+  handshake and never a teardown. Codes renumbered: 4404 → 1011, 4400 → 1010 SESSION_CLOSED. A
+  superseded session and a handshake that does not confirm send nothing. A replayed sealed frame is
+  discarded, not a close. `mesh-room-join` is now `room-join`. A peer that refused this node with
+  1009 is not re-handshaken or re-dialled (the LAN re-offer included) until a restart.
+- **The host hook fires once per assertion (G).** `verified-record` fires after de-duplication and
+  the in-flight check, once per assertion identity; a directed record older than 24 h by its
+  signed time is refused (its de-duplication marks are not kept longer).
+- **The rest of the review.** Relocation holds the identity lock through the export, fsyncs the
+  bundle, and then scrubs the source (identity.json without its private key; the `nodes/<name>`
+  link removed); a bundle is signed by its node, and an import needs an explicit pin (no fallback
+  to a key this host learned). The sticky floor is its own persisted fact. One mind per identity,
+  not per SymNode object. The interior socket lives in a 0700 directory this node made (the tmp
+  fallback is a fresh `mkdtemp`, never a predictable path that could be a planted symlink), and on
+  Windows `listen` refuses unless `{ allowDefaultPipeAcl: true }`. The interior capability is bound
+  to the first connection that presents it; `end` takes the capability, never the mindId; a
+  submission's kind is its signed intent. The client refuses a selection outside both offers.
+  Rooms compare in NFC. A relay frame type never rides inside a sealed control frame. Node names
+  are one path component. `sym keys <name>` lists without writing. `sym emit` pins its receiver
+  (`--receiver <nodeId> --receiver-key <key|sha256:…>`) and holds the identity lock while
+  connected. An anchor mark needs the record's author to be the session's node. `mood-delivered`
+  and `xmesh-insight` name the proven nodeId; the daemon no longer re-broadcasts peers' moods or
+  messages under its own name; an XMesh synthesis is the remix path and is paced (one per 10 s).
+  The wake queue holds no retired `message` frame, keeps each frame with the key it may go to, and
+  delivers only what the session takes. A room-join grant's expiry closes its session. Refused
+  frames are counted by known type only. A pinned key stays `pinned` when a session proves it.
+- **§15.7 is the remix path's (draft spec PR #35).** `remember(fields, parents)` is never refused as
+  a remix: a reply or a trail decision citing its parents mints, and sets the new-domain-data flag.
+  `node.remix(fields, { parents })` is the gated path (`{ refused: 'remix-without-new-domain-data' }`);
+  MeshAgent and the XMesh synthesis use it. A broadcast duplicate returns `{ key, duplicate: true }`.
+- **For hosts (mesh-channel 0.11.0).** Inbox entries carry `verified`, `profile`, `assertionId`,
+  `verification`, `session`, `author.key` and the signed `record`; `mood-delivered` carries `key`,
+  `assertionId`, `authorNodeId`, `deliveredBy`, `verified`; `node.publicKey`, `node.fingerprint`,
+  `node.keyBindings()`; the interior read side (`mission`, `deliveries`, `subscribe`, `ack`,
+  `recall`).
+
 ### Core Secure — breaking
 
 - **A peer is a proven session.** A sym peer used to exist before anything was proven about it: on
@@ -26,17 +115,18 @@ in-memory pending set for grants that arrive before their root (which could be f
   `client-hello` in an envelope; a relay session is bound to the relay `from` it was made on (a
   hello naming another nodeId is refused),
   torn down on `relay-peer-left`, superseded by a newer confirmed session for the same (nodeId,
-  key) (a restart under 4004), and never torn down by an unconfirmed hello. 10 s timeout.
+  key) (a restart under 4004), and never torn down by an unconfirmed hello. 5 s timeout.
 - **Discovery advertises the profile.** TXT `mmp=2.0` and `room=<room>` (and the same in the
   loopback registry). A record without `mmp=2.0` is a legacy node: never dialled as Core Secure.
   The lexicographically smaller nodeId dials (§5.1).
 - **Ephemeral E2E, sealed frames.** The persistent X25519 key (`e2e-keypair.json`) and the
   per-peer shared-secret map are gone: each handshake uses a fresh X25519 key pair and derives
   directional keys (§5.2.1). Records travel only as `cmb-encrypted` (§18.2.1), one sealed frame
-  per peer session. Every other post-handshake frame except ping/pong/error travels sealed as
-  `control-encrypted` (`mood` included: it is cognitive content). The receive counter advances
-  only after the AEAD opens (it advanced first, so one forged frame with the right sequence
-  desynchronised a session); a gap or replay closes the session and re-handshakes.
+  per peer session. Every other post-handshake frame except ping/pong travels sealed as
+  `control-encrypted` (`mood` included: it is cognitive content; `error` too). The receive counter
+  advances only after the AEAD opens (it advanced first, so one forged frame with the right
+  sequence desynchronised a session); a gap closes the session and re-handshakes, a replay is
+  discarded.
 - **Records are v2.0** (`MMP_EMIT_V2` on). Every record is signed `mmp-sig-v2.0` with the signed
   author `createdByNodeId`; the receiver resolves the author key by `createdByNodeId` through
   the key registry. An unsigned, legacy-suite or unresolvable record is refused (a legacy-suite
@@ -60,8 +150,8 @@ in-memory pending set for grants that arrive before their root (which could be f
   `xmesh-insight` goes only with `xmesh-insight-v1`; `state-sync` is refused. Records
   replayed as context on connect are announced in a sealed `cmb-anchors` frame (the `_anchor`
   frame flag could not ride a sealed record). The new wire elements that still need spec text
-  (`cmb-anchors`, `mesh-room-join`, `role-chain-fetch` / `role-chain`, relay error 4404) are
-  written out in `docs/WIRE-0.14.0.md`.
+  (`cmb-anchors`, `role-chain-fetch` / `role-chain` and their whole-store sync, `role-digest`, the
+  error rules and 1011) are written out in `docs/WIRE-0.14.0.md`; `room-join` is draft spec PR #31.
 - **Admission attestations are the `sym-attest-v1` extension** (draft spec PR
   meshcognition-website#27). The frames are `sym-attest-attestation`, `sym-attest-checkpoint`,
   `sym-attest-witness` and `sym-attest-node-stats`, sent only to sessions that selected the
@@ -92,7 +182,7 @@ in-memory pending set for grants that arrive before their root (which could be f
   (or pass `{ granteeKey }`).
 - **Room admission on proven keys.** A gated room admits its owner by its pinned key and a grantee
   whose room-join grant binds the key its session proved (the grant is presented in a sealed
-  `mesh-room-join` frame); `roomGate().admits` is now `grant-holders`. The `provenPublicKey`
+  `room-join` frame, draft spec PR #31); `roomGate().admits` is now `grant-holders`. The `provenPublicKey`
   strip and the "refuses everyone" fallback are gone.
 - **The Class 1 emitter speaks Core Secure.** `sym emit` / `lib/emit.js` run the v2 handshake
   and send sealed records. The room is explicit: an emitter that names none is in `default`, and
@@ -114,14 +204,17 @@ in-memory pending set for grants that arrive before their root (which could be f
   directory moves once, idempotently, and `nodes/<name>` stays as a symlink for one release so a
   0.13 rollback reads the old path.
 - `sym node export <name> --out <file> (--passphrase-env VAR | --to-host <key>)` tombstones the
-  node, then writes its encrypted bundle; `sym node import <file> --expect-node <id>
-  [--expect-key <k> | --expect-fingerprint sha256:…]` verifies it against an independently
-  pinned key (or this host's key registry) and refuses a re-keyed bundle; `sym node host-key`.
+  node, then writes its encrypted, node-signed bundle, then scrubs the source; `sym node import
+  <file> --expect-node <id> (--expect-key <k> | --expect-fingerprint sha256:…)` verifies it
+  against that explicit pin and the node's signature, and refuses a re-keyed or altered bundle;
+  `sym node host-key`.
 - `node.interior()`: the interior submission path for the node's mind — `startMind({ kinds,
   allowTo, ratePerMinute })` issues a per-mission capability (`queueMind` waits its turn; one
-  mind per node), `submit(capability, { kind, categories, to, parents, payload })` and the
-  interior socket (`listen()`, newline JSON) check audience, size (64 KiB text, 512 KiB
-  application), rate, declared kinds and lineage before the node signs; `endMind` revokes.
+  mind per identity), `submit(capability, { kind, categories, to, parents, payload })` and the
+  interior socket (`listen()`, newline JSON; the capability bound to its first connection) check
+  audience, size (64 KiB text, 512 KiB application), rate, declared kinds (the kind is the signed
+  intent) and lineage before the node signs; the socket also serves `mission`, `deliveries`,
+  `subscribe`, `ack` and `recall`; `endMind` revokes.
 - `node.connectTransport(transport, { role, expectNodeId })` runs the handshake over a transport
   the host provides; `node.inviteURL()` and `node.acceptInvite(url)` (invites carry the issuer's
   `node` and `key`; accepting pins the issuer only where that nodeId is unbound); `lib/invite.js`.
@@ -129,12 +222,12 @@ in-memory pending set for grants that arrive before their root (which could be f
 
 ### From the 0.13.17 re-review (0.14 requirements)
 
-- **Binding lifetime (design D3).** A first-contact `proven` key binding that verified nothing
-  since — no record, grant, attestation or later session — and was not seen for 30 days expires;
-  when the registry is full (65,536) the least recently seen such binding makes room. One that ever
-  verified something, or is pinned, grant-vouched, anchored or a legacy claim, never expires. The
-  `seen` / `verified` facts are persisted with the binding. If every binding protects history, a
-  newcomer's live session still verifies what it signs.
+- **Binding lifetime (design D3, as the security review changed it).** A confirmed session runs
+  with a session-scoped binding; the durable registry takes one only when it is earned (an
+  admitted verified record, a pin, a grant in effect). A `proven` binding that verified nothing and
+  was not seen for 30 days expires; nothing is evicted before it expires, and a full registry
+  (65,536) refuses a newcomer a durable binding — its live session still verifies what it signs.
+  The `seen` / `verified` facts are persisted with the binding.
 - **role-chain-fetch.** A grant or revoke that arrives before the grant rooting its grantor makes
   the node ask the delivering session for the chain (`role-chain-fetch` naming the grantor; answered
   with `role-chain`, ordinary signed grants verified top-down). The record is held only for that
@@ -154,16 +247,21 @@ in-memory pending set for grants that arrive before their root (which could be f
 ### Legacy Import (temporary: network Legacy Import is removed in 0.15.0)
 
 - Off by default. A route (`legacyRoutes: [{ nodeId, endpoint: 'host:port' | 'relay', key |
-  fingerprint }]`, or `legacy-routes.json` in the node dir) names a 0.13 peer; the identity key
-  fingerprint is mandatory and is pinned. This node always dials a route itself and never accepts
+  fingerprint, e2eKey }]`, or `legacy-routes.json` in the node dir) names a 0.13 peer; the identity
+  key fingerprint is mandatory and is pinned, and so is the peer's persistent X25519 key
+  (`e2eKey`). This node always dials a route itself and never accepts
   a legacy hello. Over the relay it sends its legacy hello to the routed nodeId, and takes only
   records whose signature verifies against the pinned key.
 - What it sends on a legacy session: its records as legacy `cmb` under the legacy E2E
-  construction (never plaintext). `sym status` says the session uses legacy encryption, with no
-  forward secrecy and no transcript proof. Everything received is stored `verified: false`,
-  `profile: 'legacy-import'`, never given authority. Connection-level frames are hints.
-- The sticky floor is the registry's persisted proven binding: once a nodeId has proven itself
-  over Core Secure its route is refused until an operator reset (`sym keys <name> reset-floor`).
+  construction, encrypted to the routed node's pinned X25519 key: a relay, or a squatter holding
+  only public keys, cannot read them; anyone who later obtains that node's X25519 private key can
+  read what was recorded (no forward secrecy). `sym status` says the session uses legacy
+  encryption, with no forward secrecy and no transcript proof. Everything received is stored
+  `verified: false`, `profile: 'legacy-import'`, never given authority, and raised as
+  `legacy-record`. Connection-level frames are hints.
+- The sticky floor is its own persisted fact: once a routed nodeId has proven itself over Core
+  Secure its route is refused until an operator reset (`sym keys <name> reset-floor`), whatever
+  becomes of its binding.
 
 ### Removed
 
@@ -246,8 +344,9 @@ debt, and the daemon's log flood. Every item has a test that fails without its f
   the relay's peer list, which is the peer's own registration over its relay-auth session, ranked with
   a channel kept by an earlier release (which recorded no source). At the bottom are a `wake-channel`
   frame over a session that proved nothing, which is just whoever claimed that node id at handshake,
-  and gossip. **No handshake in this runtime proves a key yet**, so a peer's own frame ranks with
-  gossip, and nothing unproven can repoint a channel the relay or a proven session gave.
+  and gossip. (In 0.13 no handshake proved a key, so a peer's own frame ranked with gossip; since
+  0.14 every session proves its key, and a channel is learned only from the confirmed session's own
+  nodeId.) Nothing unproven can repoint a channel the relay or a proven session gave.
 - **A peer can turn its wake channel off.** `platform: 'none'` removes the channel when it comes from
   the peer's own frame, or from the relay's registration, ranked at least as high as the channel
   held. Gossip cannot remove anyone's.
diff --git a/README.md b/README.md
index 9d9fe246..b3dd92a2 100644
--- a/README.md
+++ b/README.md
@@ -122,16 +122,20 @@ participant.
   and confirms the X25519 key schedule. Nothing about a peer — its key, its room membership, its
   roles — exists until both proofs validate. A discovery record or a relay roster entry only
   decides whom to dial.
-- **One key per nodeId, for life.** The first proven key for a nodeId is bound; a session that
-  later proves the same nodeId with a different key is a *conflict*: refused, recorded, and
-  shown in `sym status` for you to resolve (`sym keys <name> resolve`). No source overrides a
-  different key. The one exception is churn: a first-contact binding that never verified anything
-  (no record, grant or later session) expires after 30 days unseen, or gives way to a newcomer when
-  the registry is full; a binding that ever verified something never does.
+- **One key per nodeId, for life.** A session that proves a nodeId with a different key from the
+  one this node binds — durably, or for a session that is live — is a *conflict*: refused with
+  1009 IDENTITY_CONFLICT, recorded, and shown in `sym status` for you to resolve
+  (`sym keys <name> resolve`). No source overrides a different key. A handshake alone binds a
+  key only for its session; the binding becomes durable when it is earned (an admitted verified
+  record, a pin, an anchor-rooted grant in effect), so churning identities cannot fill the
+  registry, and nothing is ever evicted to make room.
 - **Every record is signed, and verified by its author's node id.** A record is accepted only
   if it is a signed `mmp-sig-v2.0` record whose author key this node resolves by
   `createdByNodeId` — a key it proved, pinned from an invite, or holds from an anchor-rooted
-  grant. An unsigned, legacy or unresolvable record is refused.
+  grant in effect. An unsigned, legacy or unresolvable record is refused. What is kept, delivered
+  and served is the record's signed projection: members no signature covers are dropped.
+- **A record goes only where its author signed it to.** A record signed to one node is sealed to
+  that node's session and no other's, whichever path offers it.
 - **Content is sealed per session.** Records travel only as `cmb-encrypted` frames, and every
   other frame (mood, gossip, grants) as a sealed control frame, under directional keys derived
   fresh for each handshake (X25519, HKDF-SHA256, ChaCha20-Poly1305). A relay sees routing
@@ -149,15 +153,19 @@ What this does not solve, said plainly:
   proven use*: the handshake proves the peer holds the key it presents, not that the key is
   the one you meant. Pin it out of band (an invite carries the issuer's key) when that matters.
 - **Relay eviction.** `relay-auth` is not proven, and a relay token holder can make the relay
-  replace another node's connection (close 4004). A squatter gets no session — it cannot
-  prove the key — and an evicted node re-handshakes, but the relay path can be interrupted.
+  replace another node's connection (close 4004). A squatter gets no Core Secure session — it
+  cannot prove the key — and an evicted node re-handshakes, but the relay path can be interrupted.
 - **Key compromise.** There is no key rotation: a node whose private key leaks must be
   replaced, under a new nodeId.
 - **Your own machine.** Another process running as the same user can read the identity file.
   Operating-system isolation is out of scope.
 - **Legacy peers (0.13 and older)** are reached only through explicit Legacy Import routes,
-  which use the old encryption (no forward secrecy, no transcript proof); what they send is
-  quarantined as unverified. Network Legacy Import is removed in 0.15.0.
+  which use the old encryption (no forward secrecy, no transcript proof). A 0.13 hello proves
+  nothing, so over the relay anyone can answer as a routed node; what this node sends is
+  encrypted to the routed node's pinned X25519 key, so such a squatter cannot read it, but anyone
+  who later obtains that node's X25519 private key can read what was recorded. What legacy peers
+  send is quarantined as unverified, and they never join a gated room. Network Legacy Import is
+  removed in 0.15.0.
 
 A room name or relay token is still not an enterprise trust boundary — anyone holding the
 token is in the channel; the envelope (who, to whom, room, timing, sizes) is visible to the
diff --git a/SECURITY.md b/SECURITY.md
index 4520eb5e..33b38393 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -21,27 +21,45 @@ Report a vulnerability privately to info@sym.bot (the address in package.json).
   persistent encryption key and no per-peer secret map.
 - **Sealed, ordered channel.** Records travel only as `cmb-encrypted` (ChaCha20-Poly1305 under
   the session's directional traffic key, AEAD-bound to session, direction, sequence and the
-  record's identity). Every other post-handshake frame except ping, pong and error travels as a
-  sealed `control-encrypted` frame on the same ordered sequence. The receive counter advances
-  only after a frame authenticates, so a forged frame moves nothing; an authentic frame out of
-  order (replay, rollback, gap) closes the session, which re-handshakes.
-- **One key per nodeId.** The key registry binds a nodeId to the first key a proven session, an
-  out-of-band pin (invite, Legacy Import route) or an anchor-rooted grant gives it, and never
-  replaces it: a different key from any source is a recorded conflict an operator resolves (a
-  session proving it is closed with error 1009 `IDENTITY_CONFLICT`). The
-  one way a binding ends is churn: a first-contact binding that never verified anything expires
-  after 30 days unseen (or gives way to a newcomer in a full registry), after which that nodeId is
-  first contact again; a binding that ever verified something is kept for good.
-  Keys pinned before 0.14 from unproven hellos become `legacy-claim`: expected, never trusted
-  to verify, so a squatter racing the upgrade cannot take an honest node's id.
-- **Records verified by author node id.** A record is admitted, delivered or exposed to a host
-  (`verified-record`) only after §8.8.5: application bytes, category keys and cognition key,
-  assertion identity, the Ed25519 signature against the key resolved by `createdByNodeId`, and
-  the signed audience (room, recipient). Directed versus room-bound delivery is decided by the
-  signed `metadata.to`, never by a relay envelope.
-- **Authority follows the key.** A role grant must name `granteeKey`; it confers its role only
-  on that key, and a chain is verified top-down with each grant's vouched key. A grantor whose
-  nodeId an impostor holds keeps exactly its vouched authority; the impostor gets none.
+  record's identity). Every other post-handshake frame except ping and pong — an `error` included —
+  travels as a sealed `control-encrypted` frame on the same ordered sequence. The receive counter
+  advances only after a frame authenticates, so a forged frame moves nothing; an authentic replay
+  or rollback is discarded, and a gap closes the session, which re-handshakes.
+- **Errors are information, never commands.** A clear `error` frame is anyone's to write: it is
+  ignored, except 1011 UNKNOWN_SESSION, which prompts a new handshake and never tears a session
+  down. A session ends on its peer's sealed 1010 SESSION_CLOSED or 1009 IDENTITY_CONFLICT only.
+- **A record goes only where its author signed it to.** The one seal point refuses a record whose
+  signed `metadata.to` names anyone but the session's proven peer, whatever path offered it
+  (a broadcast, an anchor replay, a fetch answer, a queued frame).
+- **One key per nodeId.** Every confirmed session runs with a binding: the key it proved, held for
+  that nodeId while the session lives. The durable key registry binds a nodeId only when the
+  binding is earned — an admitted verified record, an out-of-band pin (invite, Legacy Import route),
+  or an anchor-rooted grant in effect now (a grant binding is a view over the grants in effect,
+  never stored, and ends with them) — and never replaces it: a different key, from any source or
+  while a session holds the nodeId, is a recorded conflict an operator resolves (a session
+  proving it is closed with error 1009 `IDENTITY_CONFLICT`, sealed). A handshake, or a second one,
+  earns nothing; nothing is evicted before it expires; a `proven` binding that verified nothing
+  expires after 30 days unseen. This node's own nodeId is always its own key. Keys pinned before
+  0.14 — from unproven hellos, or from 0.13 grants never checked against their grantors — become
+  `legacy-claim`: expected, never trusted to verify, so a squatter racing the upgrade cannot take
+  an honest node's id.
+- **Records verified by author node id, and kept as their signed projection.** A record is
+  admitted, delivered or exposed to a host (`verified-record`, once per assertion, after
+  de-duplication) only after §8.8.5: a strict schema check (closed objects, no coercion, canonical
+  lowercase ids, each category key recomputed and a mismatch refused), application bytes, cognition
+  key, assertion identity, the Ed25519 signature against the key resolved by `createdByNodeId`, and
+  the signed audience (room, recipient). Members no signature covers (`valence`, `arousal`,
+  `lineage.method`) are dropped, and what is stored, delivered and served is the projection.
+  Directed versus room-bound delivery is decided by the signed `metadata.to`, never by a relay
+  envelope; a directed record older than 24 h by its signed time is refused.
+- **Authority follows the key, and counts both when signed and when received.** A role grant must
+  name `granteeKey`; it confers its role only on that key, and a chain is verified top-down with
+  each grant's vouched key. A grant, its key vouch, a revoke and an attestation count only if the
+  signer was authorised at its signed time and when this node received it (the receipt time is
+  persisted), so a revoked validator cannot backdate any of them into its old window. A grantor
+  whose nodeId an impostor holds keeps exactly its vouched authority; the impostor gets none.
+- **A forgery ends its session.** A signature that does not verify on a proven session closes it,
+  and its nodeId is not admitted again for 60 s.
 - **Admission attestations under `sym-attest-v1`.** Attestations, checkpoints and witnesses are
   signed under their own domain tags with every field covered, verified against the signer's bound
   key (never the delivering session), and exchanged only with sessions that negotiated the
@@ -49,34 +67,44 @@ Report a vulnerability privately to info@sym.bot (the address in package.json).
 - **Gated rooms on proven keys.** A gated room admits its owner by the owner's pinned key and a
   grantee when its room-join grant binds the key its session proved. A copied grant admits
   nobody.
-- **Moved, not copied.** `sym node export` tombstones a node before its encrypted bundle exists,
-  so the source refuses to start it; `sym node import` verifies the bundle against an
-  independently pinned key and refuses a re-keyed bundle.
-- **The interior.** A node's mind submits through the node's local interior socket with a
-  per-mission capability; the node checks audience, size, rate, declared kinds and lineage
-  before it signs. One mind per node.
+- **Moved, not copied.** `sym node export` holds the identity's lock, tombstones the node before
+  its encrypted bundle exists (so the source refuses to start it), signs the bundle with the node's
+  key, and once the bundle is durable removes the private key from the source and the 0.13 path to
+  it; `sym node import` verifies the bundle against an explicit pin and the node's signature, and
+  refuses a re-keyed or altered bundle.
+- **The interior.** A node's mind submits through the node's local interior socket, which lives in
+  a 0700 directory the node made (a fresh one under the temp directory when the path is too long),
+  with a per-mission capability bound to the first connection that presents it (another local
+  process cannot replay it; the connection closing ends the mind); the node checks audience, size,
+  rate, declared kinds (the kind is the signed intent) and lineage before it signs. One mind per
+  identity. On Windows the named pipe takes Node's default DACL, which sym cannot narrow, so the
+  socket is refused unless the host passes `{ allowDefaultPipeAcl: true }`.
 
 ## Bounds on what peers can make a node keep
 
 Every store a peer can feed has a fixed bound. Reaching one never stops the node: it is counted
 (and said in the log at most once a minute, or once).
 
-- **Key bindings** (the key registry): at most 65,536. A first-contact `proven` binding that has
-  verified nothing since (no record, grant, attestation or later session) expires after 30 days
-  unseen; when the registry is full, the least recently seen such binding makes room. A binding that
-  ever verified something, or is pinned, grant-vouched, anchored or a 0.13 legacy claim, is never
-  expired or evicted; if every binding is of that kind, a new one is refused and the newcomer's live
-  session still verifies what it signs. Key conflicts: at most 8 kept per nodeId and 1,024 in all,
-  every one counted (`status().coreSecure.keyConflicts`).
-- **Role grants**: at most 65,536 records, 1,024 per grantor and 64 per (grantor, grantee) pair
-  (the anchor's own are not limited). A record that arrives before its root is held only while
-  its chain is fetched from the session that delivered it (`role-chain-fetch`): at most 64 per
-  session, for at most 10 s; a fetch names at most 16 grantors, an answer carries at most 64 grants,
-  and a node answers at most 4 fetches a second per session (burst 16).
+- **Key bindings** (the key registry): at most 65,536, earned only (see above); the session-scoped
+  bindings are one per confirmed session. Nothing is evicted before it expires: in a full registry
+  a newcomer is refused a durable binding and its live session still verifies what it signs. Key
+  conflicts: at most 8 kept per nodeId and 1,024 in all, every one counted
+  (`status().coreSecure.keyConflicts`).
+- **Role grants**: at most 65,536 records, 1,024 per grantor and 16 per (grantor, grantee) pair
+  (the anchor's own are not limited); a nodeId in a grant is canonical lowercase of at most 128
+  characters, a role name at most 32. A delegation reaches at most 8 grants from the anchor, and
+  role resolution is memoised (linear in the records). A record that arrives before its root is
+  held only while its chain is fetched from the session that delivered it (`role-chain-fetch`): at
+  most 64 records and 64 KiB per session, for at most 10 s; a fetch names at most 16 grantors, an
+  answer carries at most 64 grants, and a node answers at most 4 fetches a second per session
+  (burst 16). A whole-store sync (on a differing `role-digest`) is at most 1,024 pages of 64.
 - **Gossip** (attestations, checkpoints, witnesses, grants): 2,000 new statements a second per
-  proven peer (burst 10,000; a new peer starts at 100) and 4,000 a second in all (burst 20,000),
-  spent before a signature is checked; checkpoints at most 4 a second per attester (burst 128);
-  at most 1,024 attesters, 32 checkpoints each, 256 witnesses per position.
+  proven peer (burst 10,000; a new peer starts at 100), spent before a signature is checked, and
+  4,000 verified statements a second in all (burst 20,000), spent only after it; checkpoints at most
+  4 a second per attester (burst 128); at most 1,024 attesters, 32 checkpoints each, 256 witnesses
+  per position.
+- **Records**: a category at most 256 KiB and the seven at most 960 KiB of text, refused before
+  anything encodes them; at most 8 new records a second per session are evaluated (burst 32).
 - **Wake channels**: at most 1,024, learned only from a confirmed session's own nodeId (a peer's
   word about another node is never stored), dropped after 30 days unseen; when the table is full a
   new first-hand channel displaces the least recently seen one of the weakest source, so many
@@ -84,8 +112,17 @@ Every store a peer can feed has a fixed bound. Reaching one never stops the node
   is not retried within the cooldown (5 minutes); a `peer-info` frame is read for its first 256
   entries.
 - **Relay**: at most 4,096 announced candidates (a peer with a live session is not counted
-  against it), at most 256 relay handshakes in flight, at most 10,000 frames queued for the pacer;
-  a message off the relay is bounded in size before it is parsed.
+  against it); at most 256 relay handshakes in flight, of which unknown candidates (no binding, no
+  peer, no route) hold at most 32 — the oldest evicted for a newer one, the rest waiting known peers
+  first, a failed one backing off up to 10 minutes — one in flight per relay `from`, and a `from`'s
+  hellos at 1 a second (burst 4); a 5 s handshake timeout. The pacer is fair: confirmed-session
+  traffic first, then handshakes, then the rest (at most 64 such frames), destinations served in
+  turn, at most 8 MiB and 2,048 frames per destination and 10,000 frames in all. 1011 replies to
+  strangers: at most once a second per relay `from` and 2 a second in all (burst 8), dropped past
+  it. A message off the relay is bounded in size before it is parsed.
+- **LAN listener**: at most 256 connections before their first frame (16 per address) and 128
+  authenticating sessions (8 per host); past either the oldest is closed. A peer whose dial or
+  handshake failed is dialled again after 15 s, doubling to 10 minutes.
 - **JSON nesting**: at most 128 levels, checked before parsing wherever a peer's JSON is read: TCP
   frames, relay messages, decrypted `cmb-encrypted` and `control-encrypted` plaintext, the legacy
   E2E plaintext, interior requests.
@@ -95,8 +132,13 @@ Every store a peer can feed has a fixed bound. Reaching one never stops the node
   budget and checkpoint-rate tables hold at most 4,096 peers each; the log-line deduplication maps
   1,024 keys each.
 - **Fetch and interior**: a `cmb-fetch` names at most 32 keys, a session expects at most 64 fetched
-  records; an interior submission is at most 64 KiB of category text and 512 KiB of application
-  data, at the mission's rate (60 a minute by default); an IPC line to the daemon at most 8 MiB.
+  records; a node serves at most 2 fetches a second per session (burst 8), a record at most once a
+  minute per session, and nothing while 2 MiB to that session is unsent; an interior submission is
+  at most 64 KiB of category text and 512 KiB of application data, at the mission's rate (60 a
+  minute by default); an IPC line to the daemon at most 8 MiB.
+- **The store** keeps what it admits without a count or byte bound by default (retention is
+  unlimited unless the host sets one); what bounds its growth from one peer is the record budget
+  above and SVAF admission.
 
 ## What it does not solve
 
@@ -114,10 +156,15 @@ Every store a peer can feed has a fixed bound. Reaching one never stops the node
 - **The local machine.** Identity files are readable by any process running as the same user.
   Operating-system isolation is out of scope.
 - **Legacy Import is weaker, and temporary.** A route to a 0.13 node uses the legacy encryption
-  (X25519 + AES-256-GCM per connection: no forward secrecy, no transcript proof). Everything
-  received over it is stored `verified: false`, `profile: legacy-import`, and given no
-  authority. A nodeId that has proven itself over Core Secure has its legacy route refused (a
-  persisted floor) until an operator resets it. Network Legacy Import is removed in 0.15.0.
+  (X25519 + AES-256-GCM: this node's per-session key against the routed node's pinned persistent
+  key — no forward secrecy, no transcript proof). A 0.13 hello proves nothing, so over the relay a
+  token holder can answer as the routed node; it cannot read what this node sends (encrypted to
+  the pinned key), and what it sends is taken only if the route's pinned identity key signed it.
+  Anyone who later obtains the routed node's X25519 private key can read what was recorded.
+  Everything received over a route is stored `verified: false`, `profile: legacy-import`, raised as
+  `legacy-record`, and given no authority; a legacy peer never passes a gated room's door. A
+  nodeId that has proven itself over Core Secure has its legacy route refused (a persisted floor)
+  until an operator resets it. Network Legacy Import is removed in 0.15.0.
 - **Metadata.** The relay operator sees routing envelopes: who, to whom, room, timing, sizes.
 - **Attestations disclose decisions.** With `sym-attest-v1` (offered by default) every peer in the
   room learns which records a node gated and what it decided; a content address is a confirmation
diff --git a/docs/WIRE-0.14.0.md b/docs/WIRE-0.14.0.md
index 6f46f199..80958be8 100644
--- a/docs/WIRE-0.14.0.md
+++ b/docs/WIRE-0.14.0.md
@@ -1,6 +1,6 @@
 # sym 0.14.0: wire elements that need spec text
 
-These are the four wire elements that sym 0.14.0 (Core Secure) sends and that MMP v2.0 does not
+These are the wire elements that sym 0.14.0 (Core Secure) sends and that MMP v2.0 does not
 define yet, written so that a spec PR can be drafted from them. Each section gives the element's
 fields, how it is signed or sealed, when it is sent, and what a receiver does.
 
@@ -47,53 +47,24 @@ immediately before the replayed records, which follow it on the same session as
   at most 50 string keys and ignores entries that are not strings.
 - A record that then arrives on that session with a listed key goes through §8.8.5 verification
   and admission like any other, and is marked as replayed context (`anchor: true` on the
-  `verified-record` event and on the stored entry).
+  `verified-record` event and on the stored entry) only when its signed `createdByNodeId` is the
+  session's proven nodeId: an anchor is the sender's own record.
+- Only room-bound records are replayed: a record signed to one node (`to` set) is never replayed
+  to another, whoever's session it is (the seal point refuses it in any case).
 - Nothing about the record's authority or verification changes. `cmb-anchors` never causes a
   record to be accepted.
 
 ---
 
-## 2. `mesh-room-join`: presenting a room-join grant after the handshake
+## 2. `room-join`: now draft spec PR #31
 
-**Why.** A gated room (§5.8.1) admits a non-owner only on a room-join grant whose `granteeKey` is
-the key that the session proved. The v2.0 handshake transcript has no field for the grant, and a
-grant carried in a hello would be replayable. So the grant is presented inside the confirmed
-session, where it is bound to the proven key.
-
-**Frame** (sealed control frame):
-
-```json
-{ "type": "mesh-room-join",
-  "grant": {
-    "type": "room-join", "room": "<room>", "grantee": "<grantee nodeId>", "granteeKey": "<43-char base64url>",
-    "grantedBy": "<owner nodeId>", "grantedAt": 1786611600000, "expiresAt": 1786698000000,
-    "sigAlg": "ed25519", "sig": "<unpadded base64url>" } }
-```
-
-**Signing.** `grant` is the existing room-join grant, signed by the room owner's identity key
-over:
-
-```
-UTF8("mmp-room-join-v1\n") || lp(room) || lp(grantee) || lp(granteeKey) || lp(grantedBy) ||
-lp(decimal(grantedAt)) || lp(decimal(expiresAt))
-```
-
-The lifetime is at most 24 h (`expiresAt − grantedAt`). The frame itself is sealed and adds no
-signature of its own.
-
-**When it is sent.** A node that holds a grant for its room sends this frame as the first frame
-after both proofs validate (and after its own key-registry check of the peer). It is sent to
-every newly confirmed session, before any other control frame.
-
-**Receiver** (a gated room):
-- A newly confirmed session is held in `pending` admission. The owner, recognised by its pinned
-  key, is admitted at once. Any other session waits for a `mesh-room-join` frame, for up to the
-  handshake timeout (10 s), and is refused if none arrives.
-- The grant is verified against the owner's pinned key for this room. It must name the session's
-  proven nodeId as `grantee`, its proven key as `granteeKey`, and this node's room, and it must
-  not have expired. Then the session is admitted, otherwise it is refused (closed).
-- A copied grant presented on another key's session is refused. A `mesh-room-join` on an
-  already admitted session is ignored. In an ungated room the frame is ignored.
+sym 0.14.0 sent this frame as `mesh-room-join` until the security review. It now sends and reads
+`room-join`, as draft spec PR meshcognition-website#31 names and defines it (§5.8.1: a sealed
+control frame carrying the owner-signed grant, sent as the first control frame of a newly
+confirmed session; pending admission for up to the handshake timeout; verified against the
+owner's pinned key, the session's proven nodeId and key, this room, and the grant's expiry). One
+behaviour beyond the draft: an admitted session whose grant expires is closed when it does
+(`room-grant-expired`), not kept for as long as the session lasts.
 
 ---
 
@@ -126,7 +97,21 @@ that delivered the record for the missing chain.
   fields only (`type, grantee, role?, grantedBy, grantedAt, granteeKey?, sig, sigAlg`). They are
   ordered top-down: each record comes after the records that root its grantor, up to the anchor
   (depth at most 8). For each named grantee the answer holds the records the server holds whose
-  grantee it is, each preceded by its grantor's chain.
+  grantee it is, revokes included, each preceded by its grantor's chain.
+
+**Whole-store sync** (anti-entropy, security review D). The same pair carries a paged copy of the
+server's whole store:
+
+```json
+{ "type": "role-chain-fetch", "reqId": "rs-<16 hex>", "sync": true, "after": 0 }
+{ "type": "role-chain", "reqId": "<the request's reqId>", "grants": [ ... ], "next": 64 }
+```
+
+- `after`: where the page starts, in the server's sync order: the anchor's records first, then
+  those of each grantor the earlier ones reach, breadth first, each grantor's own records by
+  signed time; records no chain reaches come last. A page holds at most 64 records.
+- `next`: present when another page follows; the client asks for it with `after: next`. A client
+  asks for at most 1,024 pages per session, one page in flight at a time.
 
 **Signing.** Neither frame is signed. Each grant in `grants` keeps its grantor's signature
 (§6.5) and is verified as gossip is: top-down, against the key that the chain vouches for its
@@ -134,13 +119,17 @@ grantor, or the anchor's configured key. Its authority never comes from the sess
 it.
 
 **When they are sent.**
+- A node sends a whole-store `role-chain-fetch` when a peer's `role-digest` (section 5) differs
+  from its own.
 - A node sends `role-chain-fetch` when a role grant or revoke that arrived on a session is refused
   as `unknown-grantor-key` (no chain reaches its grantor) or `unrooted`.
   - It sends at most one fetch in flight per (session, grantor). Further early records for the
     same grantor join the fetch already in flight.
-  - The early record is held in memory only for that fetch, under a key made of every signed field
-    plus the signature, so a forged copy cannot displace the genuine one. At most 64 records are
-    held per session. A held record is never written and never relayed.
+  - The early record is held in memory only for that fetch, as its signed fields only, under a key
+    made of every signed field plus the signature, so a forged copy cannot displace the genuine
+    one. At most 64 records, and at most 64 KiB, are held per session. A held record is never
+    written and never relayed. A record whose fields are malformed (a nodeId that is not canonical
+    lowercase or is over 128 characters, a role name over 32) is never held.
 - A node answers `role-chain` for each fetch it receives, paced per session by a token bucket of
   4 a second (burst 16). Fetches past that are dropped and counted.
 
@@ -148,8 +137,9 @@ it.
 - Reads an answer only if it matches a fetch in flight on that same session. An answer that
   nobody asked for, or that arrives on another session, is ignored.
 - Offers the grants to its store until a pass stores nothing, so their order does not matter.
-  Each goes through the ordinary ingest: the gossip budget, verification with the vouched key,
-  storing as its signed fields only, and relaying once.
+  Each goes through the ordinary ingest: the gossip budget, verification with the vouched key and
+  the both-times rule (draft spec PR #33), storing as its signed fields only, and relaying once.
+  A grant in the answer whose signature does not verify ends the session (it is attributable).
 - Then offers each held record once more and drops it either way. Neither the answer's grants nor
   the held records start a further fetch.
 - A fetch that is not answered within 10 s, or whose session closes, releases its held records.
@@ -157,43 +147,85 @@ it.
 
 ---
 
-## 4. Relay `error` 4404: "unknown session"
+## 4. Errors on a session: 1011 `UNKNOWN_SESSION` in the clear, everything else sealed
 
-**Why.** A relay session is bound to the relay `from` (draft #23). When a peer restarts behind the
-relay, the relay replaces its connection (4004) and, since sym-relay 0.5.4, sends no
-`relay-peer-left`. The other node still holds the old confirmed session and cannot tell the
-restart from a repeated announcement. Re-handshaking on every announcement would only supersede
-working sessions (0.13.17 re-review A2). So the peer's new process says that it holds no such
-session.
+sym 0.14.0 used sym-local codes 4404 ("unknown session") and 4400 ("session closed") until the
+security review. It now uses the renumbering draft spec PR meshcognition-website#23 adopts: **1011
+`UNKNOWN_SESSION`** and **1010 `SESSION_CLOSED`**, beside #21's 1009 `IDENTITY_CONFLICT`, and the
+rule that an error is information, never a command.
+
+**On a confirmed session every error is sealed** (`control-encrypted`): 1010 when a node closes the
+session, 1009 when the peer's proven key conflicts with the binding, and any 2xxx. A sealed 1010
+or 1009 ends the session at the receiver; any other sealed code is counted and changes nothing.
+A handshake that does not confirm sends nothing, and a superseded session sends nothing (the
+peer's own new session supersedes it): it leaves any confirmed session exactly as it was.
 
-**Frame** (a plain MMP error frame §7.2, sent as a relay envelope payload; it cannot be sealed,
-because the sender has no session to seal it under):
+**A clear `error`** on a confirmed session, or over the relay, is anyone's to write, and is
+ignored (counted as `clear-error-ignored`), with one exception:
 
 ```json
-{ "type": "error", "code": 4404, "message": "unknown session", "detail": "session:<32 lowercase hex>" }
+{ "type": "error", "code": 1011, "message": "unknown session", "detail": "session:<32 lowercase hex>" }
 ```
 
+**Why.** A relay session is bound to the relay `from` (draft #23). When a peer restarts behind the
+relay, the relay replaces its connection (4004) and, since sym-relay 0.5.4, sends no
+`relay-peer-left`. The other node still holds the old confirmed session and cannot tell the
+restart from a repeated announcement. So the peer's new process says, in the clear (it has no
+session to seal under), that it holds no such session.
+
 - `detail` names the sessionId when the triggering frame carried one (a sealed frame), and is
   absent when it did not (a `ping`).
 
-**When it is sent.** A node that receives, from a relay `from`, either a `cmb-encrypted` or
-`control-encrypted` frame naming a session it does not hold, or a `ping` from a `from` it holds
-no relay session with, answers with this error. It answers at most once a second per relay
-`from`, to bound the reply rate.
+**When it is sent.** A node that receives, from a relay `from`, either a sealed frame naming a
+session it does not hold, or a `ping` from a `from` it holds no relay session with, answers with
+1011: at most once a second per relay `from` (the table of froms is bounded at 1,024, least
+recently said first out), and at most 2 a second in all (burst 8) across every `from`, past which
+replies are dropped, never queued (security review D, pacer-starve).
 
 **Receiver.**
 - If it is the client for that peer (the smaller nodeId, §5.2.2), and the peer is present on the
   relay, it starts a new handshake. It **keeps** the session it has until the new one confirms
   and supersedes it, so a restart produces no `peer-left`.
-- The server ignores the error: the client will re-handshake.
-- 4404 never tears a session down on its own. Like every error frame it is informational (§7.2):
-  at most it prompts a new handshake, and only the new confirmed session replaces the old one.
+- The server ignores it: the client will re-handshake.
+- 1011 never tears a session down. At most it prompts a new handshake.
+
+**A replayed frame.** An authentic sealed frame whose sequence the receiver has already passed (a
+relay repeating what it carried) is discarded and counted (`replay`); the session is unharmed. A
+gap still closes the session (a lost frame cannot heal).
+
+**1009 is not retried.** A node refused with 1009 does not re-handshake over the relay and is not
+re-dialled over the LAN (discovery's 15 s re-offer included) until it restarts.
 
 **Probe.** A node that sees a repeated announcement (`relay-peer-joined`, `relay-peers`) for a
 peer it holds a live relay session with does not re-handshake. It sends a `ping` on that session,
-at most once a second. A live peer answers `pong`; a restarted one answers 4404.
+at most once a second. A live peer answers `pong`; a restarted one answers 1011.
+
+---
+
+## 5. `role-digest`: anti-entropy for grants and revokes
+
+**Why.** Gossip is relay-once. A grant or revoke dropped on its way (a full hold, a budget, a
+session that ended) was never sent again, and a revoke lost that way left a revoked node's
+authority standing (security review D, p7-ceiling).
+
+**Frame** (sealed control frame):
+
+```json
+{ "type": "role-digest", "count": 12, "digest": "<64 lowercase hex>" }
+```
 
-**Code space.** 4404 sits beside the relay close codes (§4.4.9) but is an error-frame code between
-endpoints, not a relay close code. 4400 is sym's error code for "session closed: <reason>",
-which a node sends to its relay peer when it closes a relay session. Both should be registered,
-or renumbered in the 1xxx connection-level range, when #23 is finalised.
+- `count`: the role-grant and role-revoke records the sender holds.
+- `digest`: lowercase hex SHA-256 over the canonical spellings of those records' signatures,
+  sorted, each followed by `\n`. Two nodes holding the same records give the same digest.
+
+**When it is sent.** To every newly admitted session, after `cmb-anchors`, whatever the sender
+holds (`count` 0 for an empty store). It is therefore also the first authenticated frame a relay
+client hears from its server on a new session: a client that re-handshakes while it holds a
+confirmed session keeps the old one until the new one carries such a frame (it cannot otherwise
+know the server took its `client-finish`), and closes a new one that hears nothing within the
+handshake timeout (`unconfirmed-by-peer`).
+
+**Receiver.** If `count` is above 0, the digest differs from its own, and no whole-store sync is
+in flight on that session, it asks for the sender's store with a whole-store `role-chain-fetch` (section 3), page
+by page. Each record goes through the ordinary ingest, so what the receiver already holds costs
+nothing and what is new is relayed once. A digest is a hint: nothing is taken on its word.
diff --git a/lib/node.js b/lib/node.js
index a6036d5d..daf0478f 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -3736,15 +3736,23 @@ class SymNode extends EventEmitter {
     // The sticky floor arms now (a proven binding): a Legacy Import session for this nodeId ends.
     for (const t of [...peer.transports.values()]) if (t.legacy && !t.closed) t.close('floor');
     const prev = peer.transports.get(session.kind);
-    peer.transports.set(session.kind, session);
-    peer.transport = this._bestTransport(peer);
     peer.name = session.name;
     peer.lastSeen = Date.now();
-    if (prev && prev !== session && !prev.closed) {
-      this._sessionStats.superseded++;
-      prev._superseded = true;
-      // Supersession sends nothing (draft spec PR #23): the peer's own new session supersedes its old.
-      prev.close('superseded', { notify: false });
+    if (session.kind === 'relay' && session.role === 'client' && prev && prev !== session && !prev.closed && prev.confirmed) {
+      // A relay client confirms when it sends client-finish, and cannot know the server took it: a
+      // re-handshake whose finish was lost must leave the confirmed session exactly as it was (draft
+      // spec PR #23). So the new session supersedes the old only once it carries an authenticated
+      // frame from the server (every admitted session is sent at least a sealed role-digest); until
+      // then the old one stays the peer's, and a new one that hears nothing ends.
+      session._supersedes = prev;
+      session._supersedeTimer = setTimeout(() => {
+        if (session._supersedes && !session.closed) session.close('unconfirmed-by-peer', { notify: false });
+      }, this._handshakeTimeoutMs);
+      if (session._supersedeTimer.unref) session._supersedeTimer.unref();
+    } else {
+      peer.transports.set(session.kind, session);
+      peer.transport = this._bestTransport(peer);
+      this._supersede(prev, session);
     }
     if (session.kind === 'bonjour') { this._pendingBonjour?.delete(nodeId); this._lanBackoff?.delete(nodeId); }
     if (session.kind === 'relay') { this._relayRetry?.delete(nodeId); this._relayFailures?.delete(nodeId); this._schedulePumpRelay(); }
@@ -3759,6 +3767,27 @@ class SymNode extends EventEmitter {
     }
   }
 
+  /** @private `prev` is superseded by `session` (the same peer and transport kind): closed quietly. */
+  _supersede(prev, session) {
+    if (!prev || prev === session || prev.closed) return;
+    this._sessionStats.superseded++;
+    prev._superseded = true;
+    // Supersession sends nothing (draft spec PR #23): the peer's own new session supersedes its old.
+    prev.close('superseded', { notify: false });
+  }
+
+  /** @private A relay client session held back from superseding heard from its server: now it does. */
+  _completeSupersede(session) {
+    const prev = session._supersedes;
+    session._supersedes = null;
+    if (session._supersedeTimer) { clearTimeout(session._supersedeTimer); session._supersedeTimer = null; }
+    const peer = this._peers.get(session.nodeId);
+    if (!peer || session.closed) return;
+    peer.transports.set(session.kind, session);
+    peer.transport = this._bestTransport(peer);
+    this._supersede(prev, session);
+  }
+
   /**
    * What a freshly admitted session is sent: this node's recent own records (the "Ask the Mesh"
    * context, debounced per peer), its own wake channel, and frames queued while the peer slept.
@@ -3788,8 +3817,10 @@ class SymNode extends EventEmitter {
     } else if (isNew) {
       this._log(`Skipping anchor CMBs for ${peer.name} (reconnected within 60s)`);
     }
-    // Anti-entropy for grants and revokes (security review D): this node's grant-store digest.
-    if (this._roleGrants.size() > 0) session.send({ type: 'role-digest', ...this._roleGrants.digest() });
+    // Anti-entropy for grants and revokes (security review D): this node's grant-store digest. Sent to
+    // every admitted session, an empty store's too: it is also the first authenticated frame a relay
+    // client waits for before its new session supersedes the old (see _admitSession).
+    session.send({ type: 'role-digest', ...this._roleGrants.digest() });
     // This node's own wake channel. (peer-info about OTHER nodes is not sent: a receiver learns a
     // wake channel only from its node's own session, so gossip about others would be dropped.)
     if (this._wakeChannel) session.send({ type: 'wake-channel', ...this._wakeChannel });
@@ -3819,6 +3850,7 @@ class SymNode extends EventEmitter {
       this._noteSessionRefusal(session, frame && frame.type, 'not-admitted');
       return;
     }
+    if (session._supersedes) this._completeSupersede(session); // the server took the new session
     if (frame && frame.type === 'room-join') return; // admitted already: nothing to decide
     const peer = this._peers.get(session.nodeId);
     if (peer) peer.lastSeen = Date.now();
@@ -3836,6 +3868,7 @@ class SymNode extends EventEmitter {
     }
     if (session._admissionTimer) { clearTimeout(session._admissionTimer); session._admissionTimer = null; }
     if (session._grantTimer) { clearTimeout(session._grantTimer); session._grantTimer = null; }
+    if (session._supersedeTimer) { clearTimeout(session._supersedeTimer); session._supersedeTimer = null; }
     const reason = info && info.reason;
     if (info && info.desync) this._sessionStats.desync++;
     if (!(info && info.wasConfirmed)) {
@@ -3900,6 +3933,7 @@ class SymNode extends EventEmitter {
     // server's error frame); a superseded or deliberately closed session does not.
     if (session.kind === 'relay' && session.role === 'client' && this._running && !session._superseded
         && reason !== 'node-stopped' && reason !== 'relay-peer-left' && reason !== 'relay-disconnected' && reason !== 'key-conflict' && reason !== 'identity-conflict' && reason !== 'admission-refused'
+        && reason !== 'unconfirmed-by-peer' && !(session._supersedes && !session._supersedes.closed)
         && this._relay.present.has(session.relayFrom)) {
       this._scheduleRelayRetry(session.relayFrom);
     }
diff --git a/lib/role-grant-store.js b/lib/role-grant-store.js
index 6dba6eeb..d1ae66d6 100644
--- a/lib/role-grant-store.js
+++ b/lib/role-grant-store.js
@@ -237,8 +237,8 @@ class RoleGrantStore {
    * @private
    */
   _rooted(grant, signerKey, receivedAt) {
-    const then = roleRank(this.resolveRole(grant.grantedBy, signerKey, grant.grantedAt));
-    const atReceipt = roleRank(this.resolveRole(grant.grantedBy, signerKey, receivedAt));
+    const then = this._authority(grant.grantedBy, signerKey, grant.grantedAt);
+    const atReceipt = this._authority(grant.grantedBy, signerKey, receivedAt);
     const rank = Math.min(then, atReceipt);
     return grant.type === 'role-revoke' ? rank >= 1 : rank >= roleRank(grant.role);
   }
@@ -319,6 +319,16 @@ class RoleGrantStore {
     }
   }
 
+  /**
+   * @private The rank `nodeId` holding `key` can confer at `at`: its role's rank, or 0 when its role
+   * already sits at the delegation depth (it can grant nothing further).
+   */
+  _authority(nodeId, key, at) {
+    if (this._memo.size >= MEMO_MAX) { this._memo.clear(); this._memoKeys.clear(); }
+    const r = this._resolve(nodeId, key, at, new Set());
+    return r.depth >= MAX_DELEGATION_DEPTH ? 0 : roleRank(r.role);
+  }
+
   /** @private Keep `t` in the sorted list of breakpoints. */
   _addTime(t) {
     const a = this._times;
diff --git a/lib/roster-keys.js b/lib/roster-keys.js
index 35bca69a..06045f76 100644
--- a/lib/roster-keys.js
+++ b/lib/roster-keys.js
@@ -319,6 +319,7 @@ class RosterKeyRegistry {
     const now = this._now();
     b.seenAt = now;
     this._track(nodeId, b);
+    if (this._loading) { this._seenWhileLoading = true; return; } // written by the load's compaction
     if (b.seenSaved == null || now - b.seenSaved >= FACT_PERSIST_MS) { b.seenSaved = now; this._persist({ nodeId, seen: now }); }
   }
 
@@ -374,8 +375,9 @@ class RosterKeyRegistry {
       if (!b || !this._expirable(b)) { this._lru.delete(nodeId); continue; }
       const seen = b.seenAt ?? b.seenSaved ?? null;
       if (seen != null && now - seen <= this._ttl) break;
-      // A node with a live session, or a binding a grant in effect vouches, counts as seen now.
-      if (this._isLive(nodeId) || (this._grantView && this._viewKey(nodeId) === b.key)) { b.seenAt = now; this._track(nodeId, b); continue; }
+      // A node with a live session, or a binding a grant in effect vouches, counts as seen now, and
+      // that is persisted (a restart reads the file: a live peer's old `seen` must not expire it).
+      if (this._isLive(nodeId) || (this._grantView && this._viewKey(nodeId) === b.key)) { this.noteSeen(nodeId); continue; }
       this._lru.delete(nodeId);
       gone.push(nodeId);
     }
@@ -506,7 +508,8 @@ class RosterKeyRegistry {
     } finally { this._loading = false; }
     // Rewritten once, atomically: a 0.13 file (migration), or one whose lines outgrew its bindings.
     if (this._readOnly) return;
-    if (!marked || unstamped > 0 || expired > 0 || records.length > 2 * this._byNode.size + 256) this._compact();
+    if (!marked || unstamped > 0 || expired > 0 || this._seenWhileLoading || records.length > 2 * this._byNode.size + 256) this._compact();
+    this._seenWhileLoading = false;
   }
 
   /** Replay one 0.14 line. A 0.13 rollback may have appended lines in its own vocabulary. */
diff --git a/tests/core-secure-binding-lifetime.test.js b/tests/core-secure-binding-lifetime.test.js
index fb895d78..c869e74b 100644
--- a/tests/core-secure-binding-lifetime.test.js
+++ b/tests/core-secure-binding-lifetime.test.js
@@ -137,6 +137,31 @@ describe('binding lifetime (D3)', () => {
     } finally { await node.stop(); }
   });
 
+  it('at the node: re-handshakes on a durable binding that verified nothing never make it verified (roster-fill-014)', async () => {
+    const node = new SymNode({ name: `life-rh-${Date.now()}`, silent: true, discovery: new NullDiscovery(), room: 'life' });
+    try {
+      await node.start();
+      const id = identity('legacy-then-proven');
+      node._roster.bind(id.nodeId, id.publicKey, 'legacy-claim'); // the key a 0.13 file expected
+      const { memoryPipe, until } = require('./_core-secure');
+      const { PeerSession } = require('../lib/session');
+      for (let k = 0; k < 3; k++) {
+        const [tc, ts] = memoryPipe();
+        node.connectTransport(ts, { role: 'server' });
+        const s = new PeerSession({ role: 'client', transport: tc, local: id, room: 'life', extensions: ['cmb-encrypted-v2'], implementation: { name: 'x', version: '1' }, expectNodeId: node.nodeId });
+        tc.on('message', (f) => s.receiveWire(f));
+        s.start();
+        await until(() => s.confirmed && node._peers.has(id.nodeId), 3000);
+        s.close('done');
+        await until(() => !node._peers.has(id.nodeId), 3000);
+      }
+      const e = node._roster.entries().find((x) => x.nodeId === id.nodeId);
+      assert.strictEqual(e.source, 'proven', 'the expected key, proven');
+      assert.strictEqual(e.verified, null, 'three handshakes verified nothing');
+      assert.ok(node._roster._lru.has(id.nodeId), 'and it can still expire');
+    } finally { await node.stop(); }
+  });
+
   it('at the node: a second key for a nodeId with a live session-scoped binding is a 1009 conflict, even with the registry full', async () => {
     const node = new SymNode({ name: `life-full-${Date.now()}`, silent: true, discovery: new NullDiscovery(), room: 'life', maxKeyBindings: 1 });
     try {
diff --git a/tests/core-secure-hostapi.test.js b/tests/core-secure-hostapi.test.js
new file mode 100644
index 00000000..b1ee9182
--- /dev/null
+++ b/tests/core-secure-hostapi.test.js
@@ -0,0 +1,191 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME before lib/config loads
+
+/**
+ * The host API mesh-channel 0.11.0 builds to (its DESIGN-0.11.0.md §6, at 8590081), and the rest of
+ * the security review's extras that need a node: what an inbox entry, `mood-delivered` and
+ * `xmesh-insight` carry; a room-join grant's expiry; the anchor mark; bounded refusal metrics; node
+ * names; `sym emit` and a live identity.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const path = require('path');
+const { spawn } = require('child_process');
+const { SymNode } = require('../lib/node');
+const { NullDiscovery } = require('../lib/discovery');
+const config = require('../lib/config');
+const { signRoomGrant } = require('../lib/core/room-grant');
+const { memoryPipe, connectNodes, until, identity, signedRecord, admitAs, deliver } = require('./_core-secure');
+
+const uniq = (b) => `${b}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+const CATS = (focus, mood = 'calm') => ({ focus, issue: 'host api', intent: 'inform', motivation: 'm', commitment: 'c', perspective: 'p', mood: { text: mood, valence: 0.4, arousal: 0.1 } });
+const ALIGNED = { decision: 'aligned', total_drift: 0.1, category_drifts: { focus: 0.1 }, gate_values: { g: 1 } };
+const REJECTED = { decision: 'rejected', total_drift: 9, category_drifts: {}, gate_values: { g: 0 } };
+const mk = (base, extra = {}) => new SymNode({ name: uniq(base), silent: true, discovery: new NullDiscovery(), room: extra.room || 'ha', ...extra });
+async function stopAll(...nodes) {
+  for (const n of nodes) { try { await n.stop(); } catch { /* */ } try { fs.rmSync(config.nodeDirById(n.nodeId), { recursive: true, force: true }); } catch { /* */ } }
+}
+
+describe('what a host is given (mesh-channel DESIGN-0.11.0 §6)', () => {
+  it('1. an inbox entry carries verified, profile, assertionId, verification, session, author.key and the signed record, persisted', async () => {
+    const a = mk('in-a'); const b = mk('in-b');
+    try {
+      await a.start(); await b.start();
+      b._svafEvaluator.evaluate = async () => ALIGNED;
+      await connectNodes(a, b);
+      const accepted = [];
+      b.on('cmb-accepted', (e) => accepted.push(e));
+      const sent = a.remember(CATS('provenance travels with the delivery'));
+      await until(() => accepted.length > 0, 4000);
+      const e = accepted[0];
+      assert.strictEqual(e.verified, true);
+      assert.strictEqual(e.profile, 'core-secure');
+      assert.strictEqual(e.assertionId, sent.cmb.metadata.assertionId);
+      assert.strictEqual(e.verification.authorNodeId, a.nodeId);
+      assert.strictEqual(e.session.nodeId, a.nodeId);
+      assert.strictEqual(e.author.key, a.publicKey);
+      const item = b.inboxGet(e.inboxId);
+      for (const k of ['verified', 'profile', 'assertionId']) assert.strictEqual(item[k], e[k], k);
+      assert.deepStrictEqual(item.verification, e.verification);
+      assert.strictEqual(item.session.identityKey, a.publicKey);
+      assert.strictEqual(item.record.metadata.assertionId, sent.cmb.metadata.assertionId, 'the signed record');
+      assert.strictEqual(item.record.categories.mood.valence, undefined, 'its projection: no unsigned members');
+      // Persisted with the inbox: a restart reads the same facts back.
+      b._writeInbox();
+      const persisted = JSON.parse(fs.readFileSync(b._inboxFile, 'utf8')).messages.find((m) => m.id === e.inboxId);
+      assert.strictEqual(persisted.assertionId, e.assertionId);
+      assert.strictEqual(persisted.verification.authorKey, a.publicKey);
+    } finally { await stopAll(a, b); }
+  });
+
+  it('2. mood-delivered carries { key, assertionId, authorNodeId, deliveredBy, verified }, and no unsigned valence or arousal', async () => {
+    const a = mk('md-a'); const b = mk('md-b');
+    try {
+      await a.start(); await b.start();
+      b._svafEvaluator.evaluate = async () => REJECTED;
+      await connectNodes(a, b);
+      const moods = [];
+      b.on('mood-delivered', (m) => moods.push(m));
+      const sent = a.remember(CATS('a rejected focus with a strong mood', 'exhausted'));
+      await until(() => moods.length > 0, 4000);
+      const m = moods[0];
+      assert.strictEqual(m.key, sent.cmb.metadata.key);
+      assert.strictEqual(m.assertionId, sent.cmb.metadata.assertionId);
+      assert.strictEqual(m.authorNodeId, a.nodeId);
+      assert.deepStrictEqual({ ...m.deliveredBy }, { nodeId: a.nodeId, name: a.name });
+      assert.strictEqual(m.verified, true);
+      assert.ok(!('valence' in m) && !('arousal' in m), 'unsigned affect numbers are not delivered');
+      assert.ok(Object.isFrozen(m));
+    } finally { await stopAll(a, b); }
+  });
+
+  it('4-5. node.publicKey, node.fingerprint and node.keyBindings() — public keys only', async () => {
+    const a = mk('kb-a'); const b = mk('kb-b');
+    try {
+      await a.start(); await b.start();
+      assert.strictEqual(a.publicKey, a._identity.publicKey);
+      assert.match(a.fingerprint, /^sha256:[0-9a-f]{64}$/);
+      await connectNodes(a, b);
+      const pinned = identity('pinned-peer');
+      a._roster.bind(pinned.nodeId, pinned.publicKey, 'pinned');
+      const kb = a.keyBindings();
+      assert.ok(kb.some((x) => x.nodeId === b.nodeId && x.key === b.publicKey && x.source === 'session'));
+      assert.ok(kb.some((x) => x.nodeId === pinned.nodeId && x.source === 'pinned'));
+      assert.ok(kb.every((x) => Object.keys(x).sort().join() === 'key,nodeId,source'), 'nothing but { nodeId, key, source }');
+      assert.ok(!JSON.stringify(kb).includes(a._identity.privateKey));
+    } finally { await stopAll(a, b); }
+  });
+
+  it('xmesh-insight names the proven nodeId it came from', async () => {
+    const n = mk('xi');
+    try {
+      const got = [];
+      n.on('xmesh-insight', (i) => got.push(i));
+      const P = identity('insight-peer');
+      const s = admitAs(n, P);
+      deliver(n, s, { type: 'xmesh-insight', fromName: 'a label it chose', anomaly: 0.1, remixScore: 0.2, coherence: 0.3 });
+      assert.strictEqual(got[0].fromNodeId, P.nodeId);
+      assert.strictEqual(got[0].from, 'a label it chose', 'the label stays a label');
+    } finally { await stopAll(n); }
+  });
+});
+
+describe('the rest of the review\'s extras', () => {
+  it('a room-join grant admits until it expires: the session closes when its grant does', async () => {
+    const ownerName = uniq('rg-owner'); const ownerId = config.loadOrCreateIdentity(ownerName);
+    const guestName = uniq('rg-guest'); const guestId = config.loadOrCreateIdentity(guestName);
+    const grant = signRoomGrant({ room: 'gated-expiry', grantee: guestId.nodeId, granteeKey: guestId.publicKey, grantedBy: ownerId.nodeId, expiresAt: Date.now() + 1500 }, ownerId.privateKey);
+    const owned = (extra = {}) => ({ roomOwners: [{ room: 'gated-expiry', nodeId: ownerId.nodeId, publicKey: ownerId.publicKey }], room: 'gated-expiry', ...extra });
+    const owner = new SymNode({ name: ownerName, silent: true, discovery: new NullDiscovery(), ...owned() });
+    const guest = new SymNode({ name: guestName, silent: true, discovery: new NullDiscovery(), ...owned({ roomGrant: grant }) });
+    try {
+      await owner.start(); await guest.start();
+      await connectNodes(guest, owner);
+      assert.ok(owner._peers.has(guest.nodeId), 'admitted on its grant');
+      await until(() => !owner._peers.has(guest.nodeId), 4000);
+      assert.strictEqual(owner._peers.has(guest.nodeId), false, 'gone when the grant expired');
+    } finally { await stopAll(owner, guest); }
+  });
+
+  it('cmb-anchors marks only a record the session\'s own node authored', async () => {
+    const n = mk('anc');
+    try {
+      n._svafEvaluator.evaluate = async () => ALIGNED;
+      const P = identity('anchoring-peer'); const Q = identity('someone-else');
+      const s = admitAs(n, P); admitAs(n, Q);
+      const hooked = [];
+      n.on('verified-record', (e) => hooked.push(e));
+      const own = signedRecord(P, { categories: CATS('P\'s own context'), room: 'ha' });
+      const other = signedRecord(Q, { categories: CATS('Q\'s record P relays as "context"'), room: 'ha' });
+      deliver(n, s, { type: 'cmb-anchors', keys: [own.metadata.key, other.metadata.key] });
+      deliver(n, s, { type: 'cmb', cmb: own });
+      deliver(n, s, { type: 'cmb', cmb: other });
+      await until(() => hooked.length >= 2, 3000);
+      assert.strictEqual(hooked.find((e) => e.record.metadata.key === own.metadata.key).verification.anchor, true);
+      assert.strictEqual(hooked.find((e) => e.record.metadata.key === other.metadata.key).verification.anchor, false, 'another node\'s record is not P\'s anchor');
+    } finally { await stopAll(n); }
+  });
+
+  it('refused frames are counted by known type only (a peer\'s own type names do not grow the table)', () => {
+    const n = mk('metr');
+    try {
+      for (let i = 0; i < 50; i++) n._refuseFrame('p', 'p', { type: `made-up-${i}` }, 'lan', new Error('x'));
+      n._refuseFrame('p', 'p', { type: '__proto__' }, 'lan', new Error('x'));
+      n._refuseFrame('p', 'p', { type: 'cmb' }, 'lan', new Error('x'));
+      const byType = n.metrics().framesRefusedByType;
+      assert.deepStrictEqual(Object.keys(byType).sort(), ['cmb', 'other']);
+      assert.strictEqual(byType.other, 51);
+    } finally { n.stop().catch(() => {}); }
+  });
+
+  it('a node name is one path component', () => {
+    for (const bad of ['../escape', 'a/b', 'a\\b', '.', '..']) assert.throws(() => config.validateName(bad), /path separator|"\."/, bad);
+    assert.doesNotThrow(() => config.validateName('claude-sym-agent-a'));
+  });
+
+  it('sym emit never reuses a live node\'s identity (its lock is held by another process)', async () => {
+    const name = uniq('emit-live');
+    const id = config.loadOrCreateIdentity(name);
+    const dir = config.nodeDirById(id.nodeId);
+    // Another process holds the identity's lock (a running node of that name).
+    const child = spawn(process.execPath, ['-e', `
+      const c = require(${JSON.stringify(path.join(__dirname, '..', 'lib', 'config'))});
+      c.acquireIdentityLock(${JSON.stringify(name)}, { dir: ${JSON.stringify(dir)} });
+      process.stdout.write('held\\n');
+      setInterval(() => {}, 1000);
+    `], { env: process.env, stdio: ['ignore', 'pipe', 'inherit'] });
+    try {
+      await new Promise((r) => child.stdout.once('data', r));
+      const receiver = mk('emit-rx');
+      try {
+        const { connect } = require('../lib/emit');
+        await assert.rejects(() => connect({ server: '127.0.0.1:1', receiver: { nodeId: receiver.nodeId, key: receiver.publicKey }, name }), (e) => e.code === 'EIDENTITYLOCK');
+      } finally { await stopAll(receiver); }
+    } finally { child.kill('SIGKILL'); }
+  });
+});
+
+void memoryPipe;
diff --git a/tests/core-secure-review.test.js b/tests/core-secure-review.test.js
new file mode 100644
index 00000000..5a14fbba
--- /dev/null
+++ b/tests/core-secure-review.test.js
@@ -0,0 +1,763 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME before lib/config loads
+
+/**
+ * The independent security review of 0.14.0 (BLOCK at 341dafb): every probe it filed, as a
+ * regression test with its bound asserted. Each fails on 341dafb. The probes are named in the test
+ * titles (cs-review-{P,A,B,C,D}/<probe>). What another test file already covers is named there.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const crypto = require('crypto');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const net = require('net');
+const { SymNode } = require('../lib/node');
+const { NullDiscovery, BonjourDiscovery } = require('../lib/discovery');
+const { nodeDirById } = require('../lib/config');
+const { PeerSession, freshX25519 } = require('../lib/session');
+const { RoleGrantStore } = require('../lib/role-grant-store');
+const { RosterKeyRegistry } = require('../lib/roster-keys');
+const { canonicalRecordV2_0, signedProjection } = require('../lib/core/record-canonical');
+const { verifyCMB, signGrant, verifyAttestationRole, categoryKeyV1 } = require('../lib/core');
+const { clientHello } = require('../lib/core/handshake-v2-flow');
+const { buildControlFrame, openControlFrame } = require('../lib/core/sealed-control');
+const { assertNoDowngrade } = require('../lib/core/mmp-extensions');
+const { fakeRelay } = require('./_fake-relay');
+const { identity, memoryPipe, connectNodes, until, signedRecord, admitAs, deliver } = require('./_core-secure');
+
+const uniq = (b) => `${b}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+const CATS = (focus) => ({ focus, issue: 'review', intent: 'probe', motivation: 'm', commitment: 'c', perspective: 'p', mood: { text: 'calm', valence: 0.5, arousal: 0.2 } });
+const ALIGNED = { decision: 'aligned', total_drift: 0.1, category_drifts: { focus: 0.1 }, gate_values: { g: 1 } };
+const TOKEN = 'x'.repeat(40);
+function mk(base, extra = {}) { return new SymNode({ name: uniq(base), silent: true, discovery: new NullDiscovery(), room: extra.room || 'rv', ...extra }); }
+async function stopAll(...nodes) {
+  for (const n of nodes) { try { await n.stop(); } catch { /* */ } try { fs.rmSync(nodeDirById(n.nodeId), { recursive: true, force: true }); } catch { /* */ } }
+}
+function kp(nodeId) {
+  const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519');
+  return { nodeId, priv: privateKey.export({ format: 'der', type: 'pkcs8' }).subarray(16).toString('base64url'), pub: publicKey.export({ format: 'der', type: 'spki' }).subarray(12).toString('base64url') };
+}
+const grantOf = (type, grantee, role, grantor, at, extra = {}) => signGrant({ type, grantee: grantee.nodeId, role, grantedBy: grantor.nodeId, grantedAt: at, ...(type === 'role-grant' ? { granteeKey: grantee.pub } : {}), ...extra }, grantor.priv);
+
+describe('A. the signed audience governs every send (cs-review-P)', () => {
+  it('anchor-leak / anchor-leak-b: a record A sent directed to B is never replayed to a later peer M, nor served to it by cmb-fetch', async () => {
+    const a = mk('al-a'); const b = mk('al-b'); const m = mk('al-m');
+    try {
+      await a.start(); await b.start(); await m.start();
+      await connectNodes(a, b);
+      const sent = a.remember(CATS('a secret for B only'), { to: b.nodeId });
+      const key = sent.cmb.metadata.key;
+      const atM = [];
+      m.on('verified-record', (e) => atM.push(e.record.metadata.key));
+      await connectNodes(a, m);
+      await new Promise((r) => setTimeout(r, 300));
+      assert.ok(!atM.includes(key), 'not replayed to M as an anchor');
+      const s = m._peers.get(a.nodeId).transport;
+      const answers = [];
+      const orig = m._frameHandler._handleCmbFetchResult.bind(m._frameHandler);
+      m._frameHandler._handleCmbFetchResult = (pid, pn, msg, sess) => { answers.push(msg); return orig(pid, pn, msg, sess); };
+      s.send({ type: 'cmb-fetch', reqId: 'q1', key });
+      await until(() => answers.length > 0, 2000);
+      assert.deepStrictEqual({ returned: answers[0].returned, missing: answers[0].missing }, { returned: [], missing: [key] }, 'listed missing, as if not held');
+      assert.ok(!atM.includes(key));
+      // B (the addressee) may fetch it.
+      const bs = b._peers.get(a.nodeId).transport;
+      const got = [];
+      const origB = b._frameHandler._handleCmbFetchResult.bind(b._frameHandler);
+      b._frameHandler._handleCmbFetchResult = (pid, pn, msg, sess) => { got.push(msg); return origB(pid, pn, msg, sess); };
+      bs.send({ type: 'cmb-fetch', reqId: 'q2', key });
+      await until(() => got.length > 0, 2000);
+      assert.deepStrictEqual(got[0].returned, [key], 'the addressee is served');
+      // The seal point itself refuses it on M's session.
+      assert.strictEqual(a._peers.get(m.nodeId).transport.trySend({ type: 'cmb', cmb: sent.cmb }).reason, 'not-addressed');
+    } finally { await stopAll(a, b, m); }
+  });
+});
+
+describe('A, each door on its own (the seal point behind them is not counted on)', () => {
+  it('the anchors offered to a new session are room-bound records only (its cmb-anchors names no directed record)', async () => {
+    const a = mk('anc-a');
+    try {
+      await a.start();
+      const B = identity('b-for-anchor');
+      const directed = a.remember(CATS('for B only, never context'), { to: B.nodeId });
+      const room = a.remember(CATS('room-bound context'));
+      const m = admitAs(a, identity('m-new'));
+      a._greetSession(a._peers.get(m.nodeId), m, true);
+      const anchors = m.sent.find((f) => f.type === 'cmb-anchors');
+      assert.ok(anchors && anchors.keys.includes(room.cmb.metadata.key), 'room-bound context is offered');
+      assert.ok(!anchors.keys.includes(directed.cmb.metadata.key), 'the directed record is not even named');
+      assert.ok(!m.sent.some((f) => f.type === 'cmb' && f.cmb.metadata.key === directed.cmb.metadata.key));
+    } finally { await stopAll(a); }
+  });
+
+  it('cmb-fetch lists a directed record as missing to anyone but its addressee, even on a session that would carry it', async () => {
+    const a = mk('fetch-a');
+    try {
+      await a.start();
+      const B = identity('b-for-fetch');
+      const directed = a.remember(CATS('fetched by B only'), { to: B.nodeId });
+      const key = directed.cmb.metadata.key;
+      const m = admitAs(a, identity('m-fetch'));
+      deliver(a, m, { type: 'cmb-fetch', reqId: 'q', key });
+      assert.ok(!m.sent.some((f) => f.type === 'cmb'), 'not sent');
+      assert.deepStrictEqual(m.sent.find((f) => f.type === 'cmb-fetch-result').missing, [key]);
+      const b = admitAs(a, B);
+      deliver(a, b, { type: 'cmb-fetch', reqId: 'q2', key });
+      assert.ok(b.sent.some((f) => f.type === 'cmb' && f.cmb.metadata.key === key), 'the addressee is served');
+    } finally { await stopAll(a); }
+  });
+});
+
+describe('B. a record is its signed projection (cs-review-B/p3-unsigned, cs-review-A/relay-metadata, draft spec PR #34)', () => {
+  const A = identity('author-a');
+  it('the three negative cases: a carried meta.key mismatch, an uppercase `to`, a coerced type — each refused', () => {
+    const r = signedRecord(A, { categories: CATS('room record'), room: 'r' });
+    const t1 = JSON.parse(JSON.stringify(r)); t1.categories.focus.meta.key = '0'.repeat(64);
+    assert.strictEqual(verifyCMB(t1, A.publicKey).valid, true, 'the signature still verifies: meta.key is outside it');
+    assert.throws(() => canonicalRecordV2_0(t1), (e) => e.reason === 'content-mismatch');
+    const d = signedRecord(A, { categories: CATS('directed'), room: 'r', to: identity('b').nodeId });
+    const t2 = JSON.parse(JSON.stringify(d)); t2.metadata.to = t2.metadata.to.toUpperCase();
+    assert.throws(() => canonicalRecordV2_0(t2), /lowercase UUID/);
+    const t2b = JSON.parse(JSON.stringify(d)); t2b.metadata.to = [d.metadata.to];
+    assert.throws(() => canonicalRecordV2_0(t2b), /lowercase UUID/, 'an array is not a recipient');
+    const t3 = JSON.parse(JSON.stringify(r)); t3.metadata.createdTimestamp = String(t3.metadata.createdTimestamp);
+    assert.throws(() => canonicalRecordV2_0(t3), /not an integer/, 'a number written as its decimal string is not coerced');
+    const t4 = JSON.parse(JSON.stringify(r)); t4.metadata.injectedByRelay = 'x';
+    assert.throws(() => canonicalRecordV2_0(t4), /unknown member/, 'a member the schema does not define refuses the record');
+  });
+
+  it('unsigned members are dropped, an unknown category too; what is stored and hooked is the projection', async () => {
+    const b = mk('proj-b', { room: 'r' });
+    try {
+      await b.start();
+      b._svafEvaluator.evaluate = async () => ALIGNED;
+      const sy = admitAs(b, identity('relayer-y'));
+      admitAs(b, A);
+      const hooked = [];
+      b.on('verified-record', (e) => hooked.push(e));
+      const r = signedRecord(A, { categories: CATS('room record by A'), room: 'r', lineage: { parents: [], method: 'SVAF-v2' } });
+      const t = JSON.parse(JSON.stringify(r));
+      t.categories.mood.valence = -1; t.categories.mood.arousal = 1;
+      t.categories.injectedCategory = { text: 'unsigned extra category' };
+      deliver(b, sy, { type: 'cmb', cmb: t });
+      await until(() => hooked.length > 0, 3000);
+      const rec = hooked[0].record;
+      assert.deepStrictEqual(Object.keys(rec.categories.mood).sort(), ['meta', 'text'], 'valence and arousal dropped');
+      assert.strictEqual(rec.categories.injectedCategory, undefined, 'an unknown category dropped');
+      assert.ok(!rec.metadata.lineage || !('method' in rec.metadata.lineage), 'lineage.method dropped');
+      await until(() => b._store.get(r.metadata.key), 3000);
+      const st = b._store.get(r.metadata.key);
+      assert.strictEqual(st.cmb.categories.mood.valence, undefined, 'and not stored');
+      assert.strictEqual(verifyCMB(st.cmb, A.publicKey).valid, true, 'the projection still verifies');
+    } finally { await stopAll(b); }
+  });
+
+  it('every published v2.0 vector\'s category keys equal their recomputation, and the vectors pass the strict constructor (cs-review-A/vectors)', () => {
+    const vdir = path.join(os.homedir().replace(/\/[^/]*sandbox[^/]*$/, ''), 'code', 'mesh-memory-protocol', 'conformance', 'v2');
+    const real = path.join('/Users', os.userInfo().username, 'code', 'mesh-memory-protocol', 'conformance', 'v2');
+    const dir = fs.existsSync(real) ? real : vdir;
+    if (!fs.existsSync(dir)) return; // the spec mirror is not on this host
+    const file = path.join(dir, 'record-signature-v2.json');
+    if (!fs.existsSync(file)) return;
+    const vec = JSON.parse(fs.readFileSync(file, 'utf8'));
+    const cases = (vec.cases || []).filter((c) => c.record && c.record.metadata && c.record.metadata.signatureSuite === 'mmp-sig-v2.0');
+    assert.ok(cases.length > 0);
+    for (const c of cases) {
+      for (const [name, cat] of Object.entries(c.record.categories)) assert.strictEqual(categoryKeyV1(name, cat.text), cat.meta.key, `${c.label}: ${name}`);
+      assert.doesNotThrow(() => canonicalRecordV2_0(c.record), c.label);
+    }
+  });
+});
+
+describe('C. authority counts at the signed time and at receipt (cs-review-B, draft spec PR #33)', () => {
+  const ANC = kp('anchor'), V = kp('validator-v'), W = kp('validator-w'), H = kp('honest-h'), ATT = kp('attacker');
+  const t0 = Date.now() - 100_000;
+  function world() {
+    const roster = new RosterKeyRegistry({ anchor: { nodeId: ANC.nodeId, publicKey: ANC.pub }, self: { nodeId: 'receiver', publicKey: kp('receiver').pub } });
+    const store = new RoleGrantStore({ anchor: { nodeId: ANC.nodeId, publicKey: ANC.pub }, keys: roster, selfId: 'receiver' });
+    roster.setGrantView((id) => store.vouchedKey(id));
+    store.record(grantOf('role-grant', V, 'validator', ANC, t0));
+    store.record(grantOf('role-grant', W, 'validator', ANC, t0 + 10));
+    store.record(grantOf('role-revoke', V, undefined, ANC, t0 + 50_000));
+    return { roster, store };
+  }
+
+  it('p2-revoked-vouch: a revoked validator\'s backdated grant binds no key, for another node or for this one', () => {
+    const { roster, store } = world();
+    assert.strictEqual(store.resolveRole(V.nodeId, V.pub, Date.now()), 'participant');
+    const r = store.record(grantOf('role-grant', { nodeId: H.nodeId, pub: ATT.pub }, 'validator', V, t0 + 1000));
+    assert.deepStrictEqual(r, { stored: false, reason: 'unrooted' }, 'V is not authorised at receipt');
+    assert.strictEqual(roster.get(H.nodeId), undefined, 'the attacker key is bound to nobody');
+    const self = store.record(grantOf('role-grant', { nodeId: 'receiver', pub: ATT.pub }, 'validator', V, t0 + 1001));
+    assert.strictEqual(self.stored, false);
+    assert.strictEqual(roster.get('receiver'), roster._self.publicKey, 'this node\'s own id is always its own key');
+  });
+
+  it('p2c-backdate: a revoked validator\'s backdated revoke strips nothing, and its backdated attestation weighs as a participant', () => {
+    const { store } = world();
+    assert.deepStrictEqual(store.record(grantOf('role-revoke', W, undefined, V, t0 + 20)), { stored: false, reason: 'unrooted' });
+    assert.strictEqual(store.resolveRole(W.nodeId, W.pub, Date.now()), 'validator', 'W keeps its role');
+    // An attestation V signs now, dated inside its old window: the role at receipt is the one that counts.
+    const att = { by: V.nodeId, at: t0 + 1000, role: 'validator' };
+    const now = Date.now();
+    const both = (id, at) => { const a = store.resolveRole(id, V.pub, at); const b = store.resolveRole(id, V.pub, now); return a === 'participant' || b === 'participant' ? 'participant' : a; };
+    assert.strictEqual(verifyAttestationRole(att, both).resolved, 'participant');
+  });
+
+  it('a revoke that counted at receipt keeps its standing when its signer is later revoked', () => {
+    const ANC2 = kp('anchor-2'), V2 = kp('v-2'), X = kp('x-2');
+    const store = new RoleGrantStore({ anchor: { nodeId: ANC2.nodeId, publicKey: ANC2.pub } });
+    const t = Date.now() - 10_000;
+    store.record(grantOf('role-grant', V2, 'validator', ANC2, t));
+    store.record(grantOf('role-grant', X, 'validator', ANC2, t + 1));
+    assert.strictEqual(store.record(grantOf('role-revoke', X, undefined, V2, t + 2)).stored, true, 'V2 is authorised at both times');
+    assert.strictEqual(store.resolveRole(X.nodeId, X.pub, Date.now()), 'participant');
+    store.record(grantOf('role-revoke', V2, undefined, ANC2, Date.now() + 5));
+    assert.strictEqual(store.resolveRole(X.nodeId, X.pub, Date.now() + 10), 'participant', 'the revoke stands');
+  });
+
+  it('a revoke whose revoker the anchor had revoked by the time it was received has no effect, even when the anchor\'s revoke arrives later', () => {
+    const ANC3 = kp('anchor-3'), V3 = kp('v-3'), W3 = kp('w-3');
+    const store = new RoleGrantStore({ anchor: { nodeId: ANC3.nodeId, publicKey: ANC3.pub } });
+    const t = Date.now() - 100_000;
+    store.record(grantOf('role-grant', V3, 'validator', ANC3, t));
+    store.record(grantOf('role-grant', W3, 'validator', ANC3, t + 1));
+    // V3's revoke of W3, signed at t+20, received now: by what is known now, V3 is authorised: stored.
+    assert.strictEqual(store.record(grantOf('role-revoke', W3, undefined, V3, t + 20)).stored, true);
+    assert.strictEqual(store.resolveRole(W3.nodeId, W3.pub, Date.now()), 'participant');
+    // The anchor had revoked V3 at t+30 (after V3 signed, before this node received it); that arrives now.
+    store.record(grantOf('role-revoke', V3, undefined, ANC3, t + 30));
+    assert.strictEqual(store.resolveRole(W3.nodeId, W3.pub, Date.now()), 'validator', 'V3 was not authorised at receipt: the revoke does not count');
+  });
+
+  it('a grant naming this node with a foreign key is inert and reported (p2b-node)', () => {
+    const reported = [];
+    const own = kp('me');
+    const store = new RoleGrantStore({ anchor: { nodeId: ANC.nodeId, publicKey: ANC.pub }, selfId: own.nodeId, selfKey: own.pub, onForeignSelfGrant: (g) => reported.push(g) });
+    const r = store.record(grantOf('role-grant', { nodeId: own.nodeId, pub: ATT.pub }, 'validator', ANC, Date.now() - 1));
+    assert.strictEqual(r.inert, 'foreign-key-for-self');
+    assert.strictEqual(reported.length, 1);
+    assert.strictEqual(store.resolveRole(own.nodeId, own.pub, Date.now()), 'participant');
+    assert.strictEqual(store.vouchedKey(own.nodeId), undefined);
+  });
+
+  it('p2b-node: at the node, a backdated grant from a revoked validator is not stored or relayed, and records forged under it are refused', async () => {
+    const ANCN = identity('anchor-n');
+    const b = mk('p2b', { anchor: { nodeId: ANCN.nodeId, publicKey: ANCN.publicKey }, room: 'r' });
+    try {
+      await b.start();
+      const P = identity('relay-peer');
+      const s = admitAs(b, P);
+      const g = (o, k) => ({ type: o.type, grant: signGrant({ ...o }, k) });
+      const VV = identity('validator-n'); const HH = identity('honest-n'); const AT = identity('att-n');
+      deliver(b, s, g({ type: 'role-grant', grantee: VV.nodeId, role: 'validator', grantedBy: ANCN.nodeId, grantedAt: t0, granteeKey: VV.publicKey }, ANCN.privateKey));
+      deliver(b, s, g({ type: 'role-revoke', grantee: VV.nodeId, grantedBy: ANCN.nodeId, grantedAt: t0 + 50_000 }, ANCN.privateKey));
+      deliver(b, s, g({ type: 'role-grant', grantee: HH.nodeId, role: 'validator', grantedBy: VV.nodeId, grantedAt: t0 + 1000, granteeKey: AT.publicKey }, VV.privateKey));
+      deliver(b, s, g({ type: 'role-grant', grantee: b.nodeId, role: 'validator', grantedBy: VV.nodeId, grantedAt: t0 + 1001, granteeKey: AT.publicKey }, VV.privateKey));
+      assert.strictEqual(b._roster.source(HH.nodeId), undefined);
+      assert.strictEqual(b._roster.source(b.nodeId), 'self');
+      assert.strictEqual(b._roleGrants.size(), 2, 'only the anchor\'s two');
+      const hooked = [];
+      b.on('verified-record', (e) => hooked.push(e));
+      deliver(b, s, { type: 'cmb', cmb: signedRecord({ ...HH, publicKey: AT.publicKey, privateKey: AT.privateKey }, { categories: { focus: 'forged as H' }, room: 'r' }) });
+      deliver(b, s, { type: 'cmb', cmb: signedRecord({ nodeId: b.nodeId, name: b.name, publicKey: AT.publicKey, privateKey: AT.privateKey }, { categories: { focus: 'forged as me' }, room: 'r' }) });
+      await new Promise((r) => setTimeout(r, 200));
+      assert.strictEqual(hooked.length, 0, 'neither verifies');
+    } finally { await stopAll(b); }
+  });
+});
+
+describe('D. no shared budget before verification; bounds (cs-review-B, cs-review-D)', () => {
+  it('p10-hold-size / pending-abuse-014 (c): 64 padded early records hold nothing past their signed fields and 64 KiB', async () => {
+    const b = mk('p10', { anchor: { nodeId: crypto.randomUUID(), publicKey: crypto.randomBytes(32).toString('base64url') } });
+    try {
+      await b.start();
+      const s = admitAs(b, identity('m'));
+      const big = 'x'.repeat(900 * 1024);
+      for (let i = 0; i < 64; i++) {
+        deliver(b, s, { type: 'role-grant', grant: { type: 'role-grant', grantee: big + i, role: 'validator', grantedBy: crypto.randomUUID(), grantedAt: Date.now(), granteeKey: crypto.randomBytes(32).toString('base64url'), sigAlg: 'ed25519', sig: crypto.randomBytes(64).toString('base64url'), pad: big } });
+      }
+      assert.ok(!s._chainHold || s._chainHold.grants.size === 0, 'a grantee over 128 characters is malformed: never held');
+      for (let i = 0; i < 100; i++) {
+        deliver(b, s, { type: 'role-grant', grant: { type: 'role-grant', grantee: crypto.randomUUID(), role: 'validator', grantedBy: crypto.randomUUID(), grantedAt: Date.now(), granteeKey: crypto.randomBytes(32).toString('base64url'), sigAlg: 'ed25519', sig: crypto.randomBytes(64).toString('base64url'), pad: big } });
+      }
+      assert.ok(s._chainHold.grants.size <= 64);
+      assert.ok(s._chainHold.bytes <= 64 * 1024, `held ${s._chainHold.bytes} bytes`);
+      for (const e of s._chainHold.grants.values()) assert.ok(!('pad' in e.grant), 'held as its signed fields only');
+    } finally { await stopAll(b); }
+  });
+
+  it('role-linear / role-resolve-cost: a delegation reaches at most 8 grants, and resolution stays fast at 16 records per pair', () => {
+    const A = kp('anchor-l');
+    const s = new RoleGrantStore({ anchor: { nodeId: A.nodeId, publicKey: A.pub } });
+    const t = Date.now() - 1e6;
+    let prev = A;
+    let depthReached = 0;
+    for (let d = 1; d <= 24; d++) {
+      const g = kp(`l${d}`);
+      if (s.record(grantOf('role-grant', g, 'validator', prev, t + d)).stored) depthReached = d;
+      prev = g;
+    }
+    assert.strictEqual(depthReached, 8, 'the 9th link is not rooted');
+    const B = kp('anchor-c');
+    const st = new RoleGrantStore({ anchor: { nodeId: B.nodeId, publicKey: B.pub } });
+    const chain = [kp('c0')];
+    st.record(grantOf('role-grant', chain[0], 'validator', B, t));
+    const t1 = process.hrtime.bigint();
+    for (let d = 1; d <= 7; d++) {
+      const g = kp(`c${d}`); chain.push(g);
+      for (let i = 0; i < 16; i++) st.record(grantOf('role-grant', g, 'validator', chain[d - 1], t + d * 1000 + i));
+    }
+    const storeMs = Number(process.hrtime.bigint() - t1) / 1e6;
+    const t2 = process.hrtime.bigint();
+    assert.strictEqual(st.resolveRole(chain[7].nodeId, chain[7].pub, Date.now()), 'validator');
+    const resMs = Number(process.hrtime.bigint() - t2) / 1e6;
+    assert.ok(storeMs < 5000, `7 levels x 16 stored in ${storeMs.toFixed(0)} ms (was exponential)`);
+    assert.ok(resMs < 500, `resolved in ${resMs.toFixed(0)} ms`);
+  });
+
+  it('record-flood: one peer\'s distinct records are evaluated at most at the session budget', async () => {
+    const N = mk('rf-n', { room: 'g' }); const E = mk('rf-e', { room: 'g' });
+    try {
+      await N.start(); await E.start();
+      await connectNodes(E, N);
+      let evaluated = 0;
+      N._svafEvaluator.evaluate = async () => { evaluated++; return null; };
+      const author = { nodeId: E.nodeId, name: E.name, publicKey: E._identity.publicKey, privateKey: E._identity.privateKey };
+      const s = E._peers.get(N.nodeId).transport;
+      const metrics = [];
+      N.on('metric', (m) => { if (m.type === 'cmb-over-budget') metrics.push(m); });
+      for (let i = 0; i < 120; i++) s.send({ type: 'cmb', cmb: signedRecord(author, { room: 'g', categories: { focus: `distinct record ${i}` } }) });
+      await until(() => metrics.length + evaluated >= 120, 4000);
+      assert.ok(evaluated <= 32 + 8 * 4, `evaluated ${evaluated}: the burst (32) and 8 a second`);
+      assert.ok(metrics.length >= 50, 'the rest dropped unevaluated, and counted');
+    } finally { await stopAll(N, E); }
+  });
+
+  it('fetch-amp: a peer that does not read its socket gets nothing more once 2 MiB is unsent; a record is served once a minute per session', async () => {
+    const V = mk('fa', { room: 'g' });
+    try {
+      await V.start();
+      const entry = V.remember(CATS('a record with a large payload'), { payload: { blob: 'x'.repeat(300 * 1024) } });
+      const s = admitAs(V, identity('evil'));
+      let pending = 0;
+      const sentRecords = [];
+      s.pendingBytes = () => pending;
+      s.send = (f) => { if (f.type === 'cmb') { sentRecords.push(f); pending += 600 * 1024; } return true; };
+      for (let i = 0; i < 6; i++) deliver(V, s, { type: 'cmb-fetch', reqId: `r${i}`, key: entry.key });
+      assert.strictEqual(sentRecords.length, 1, 'served once; a repeat within a minute is withheld');
+      V._frameHandler._lastServeReset = true;
+      s._fetchServe.served.clear();
+      pending = 3 * 1024 * 1024;
+      deliver(V, s, { type: 'cmb-fetch', reqId: 'r-full', key: entry.key });
+      assert.strictEqual(sentRecords.length, 1, 'nothing more while 2 MiB is unsent');
+      for (let i = 0; i < 20; i++) deliver(V, s, { type: 'cmb-fetch', reqId: `flood${i}`, key: 'cmb-' + 'a'.repeat(64) });
+      assert.ok(s._fetchServe.tokens < 1, 'and fetches are rate-limited per session');
+    } finally { await stopAll(V); }
+  });
+
+  it('relay-orphan / growth-014 3b / relay-rehello: hellos from one relay from hold one authenticating session, counted, and a restarted client confirms', async () => {
+    const node = mk('ro', { relayOnly: true });
+    try {
+      await node.start();
+      const out = [];
+      node._relay.transportFor = (to) => ({ trySend: (f) => { out.push({ to, f }); return { ok: true }; }, send() { return true; }, close() {}, destroy() {} });
+      const from = '00000000-0000-7000-8000-00000000000a';
+      const b = () => crypto.randomBytes(32).toString('base64url');
+      for (let i = 0; i < 200; i++) node._relayEnvelope(from, 'evil', { type: 'client-hello', protocolVersion: '2.0', room: 'rv', nodeId: from, name: 'evil', identityPublicKey: b(), e2ePublicKey: freshX25519().publicKey, nonce: b(), implementation: { name: 'x', version: '1' }, extensions: ['cmb-encrypted-v2'] });
+      const authenticating = [...node._sessions].filter((x) => !x.confirmed && !x.closed);
+      assert.strictEqual(authenticating.length, 1, 'one authenticating slot per (relay, from)');
+      assert.strictEqual(node._relayHandshakesInFlight(), 1, 'and it is counted');
+      assert.ok(out.filter((o) => o.f.type === 'server-hello').length <= 4 + 1, 'a from\'s hellos are rate-limited (burst 4, 1 a second)');
+      assert.ok(node._relaySessions.get(from), 'the state entry is kept for the live attempt (it was orphaned)');
+    } finally { await stopAll(node); }
+  });
+
+  it('pacer-starve: 300 strangers pinging cannot delay an honest relay session\'s record', async () => {
+    const relay = fakeRelay({ ratePerSec: 1e6, burst: 1e6 });
+    const V = new SymNode({ name: uniq('ps-v'), silent: true, relayOnly: true, discovery: new NullDiscovery(), relay: relay.url, relayToken: TOKEN, room: 'g' });
+    const H = new SymNode({ name: uniq('ps-h'), silent: true, relayOnly: true, discovery: new NullDiscovery(), relay: relay.url, relayToken: TOKEN, room: 'g' });
+    try {
+      await V.start(); await H.start();
+      await until(() => V._peers.has(H.nodeId) && H._peers.has(V.nodeId), 10000);
+      H._svafEvaluator.evaluate = async () => ALIGNED;
+      const froms = Array.from({ length: 300 }, (_, i) => `0190aaaa-0000-7000-8000-${String(i).padStart(12, '0')}`);
+      for (let k = 0; k < 2; k++) { for (const f of froms) relay.inject(f, V.nodeId, { type: 'ping' }); await new Promise((r) => setTimeout(r, 300)); }
+      assert.ok(V._relay._queue.class2 <= 64, `1011 replies queued: ${V._relay._queue.class2}`);
+      assert.ok((V._unknownSessionDropped || 0) >= 300, `600 pings from 300 strangers: at most 2 a second answered (burst 8), the rest dropped (${V._unknownSessionDropped})`);
+      assert.ok(V._unknownSessionSaid.size <= 1024);
+      const got = [];
+      H.on('verified-record', (e) => got.push(e));
+      const t0 = Date.now();
+      V.remember(CATS('honest record after the flood'), { to: H.nodeId });
+      await until(() => got.length > 0, 8000);
+      assert.ok(got.length > 0 && Date.now() - t0 < 5000, `arrived after ${Date.now() - t0} ms (was 46 s)`);
+    } finally { await stopAll(V, H); await relay.close(); }
+  });
+
+  it('the pacer is fair: a confirmed session\'s frame goes before every queued stranger reply, and a destination keeps its order', () => {
+    const { FairQueue, CLASS2_MAX } = require('../lib/relay');
+    const q = new FairQueue();
+    for (let i = 0; i < 100; i++) q.push(2, { to: `s${i}`, bytes: 10 });
+    assert.strictEqual(q.length, CLASS2_MAX, 'stranger replies held at their bound');
+    q.push(1, { to: 'h', bytes: 10, n: 'finish' });
+    q.push(0, { to: 'h', bytes: 10, n: 'sealed-after-finish' });
+    q.push(0, { to: 'peer', bytes: 10, n: 'record' });
+    assert.strictEqual(q.take().n, 'record', 'confirmed-session traffic first');
+    assert.strictEqual(q.take().n, 'finish', 'then the handshake, and h\'s sealed frame after its finish, never before');
+    assert.strictEqual(q.take().n, 'sealed-after-finish');
+    assert.strictEqual(q.take().to, 's0', 'then the strangers, in turn');
+  });
+
+  it('announce-starve-014: 1000 announced strangers do not keep an honest peer from a session', async () => {
+    const relay = fakeRelay({ ratePerSec: 1e6, burst: 1e6 });
+    const V = new SymNode({ name: uniq('as-v'), silent: true, relayOnly: true, discovery: new NullDiscovery(), relay: relay.url, relayToken: TOKEN, room: 'g' });
+    try {
+      await V.start();
+      await until(() => V._relay._relayWs && V._relay._relayWs.readyState === 1, 5000);
+      for (let i = 0; i < 1000; i++) { const id = `ffff${String(i).padStart(4, '0')}-0000-7000-8000-000000000000`; V._relay._handleRelayPeerJoined(id, 'a'); V._relay._handleRelayPeerJoined(id, 'a'); }
+      assert.ok(V._relayUnknownInFlight() <= 32, 'unknown candidates hold their share only');
+      const H = new SymNode({ name: uniq('as-h'), silent: true, relayOnly: true, discovery: new NullDiscovery(), relay: relay.url, relayToken: TOKEN, room: 'g' });
+      try {
+        const t0 = Date.now();
+        await H.start();
+        const ok = await until(() => V._peers.has(H.nodeId) && H._peers.has(V.nodeId), 15000, 100);
+        assert.ok(ok, `the honest peer confirmed (after ${Date.now() - t0} ms; was never within 45 s)`);
+      } finally { await stopAll(H); }
+    } finally { await stopAll(V); await relay.close(); }
+  });
+
+  it('hello-cost: held-open LAN hellos are capped per host and in all', async () => {
+    const node = new SymNode({ name: uniq('hc'), silent: true, discovery: new BonjourDiscovery({ mdns: false }), room: 'g' });
+    const socks = [];
+    try {
+      await node.start();
+      const b = () => crypto.randomBytes(32).toString('base64url');
+      const { sendFrame } = require('../lib/frame-parser');
+      for (let i = 0; i < 40; i++) {
+        await new Promise((res) => {
+          const s = net.createConnection({ port: node._port, host: '127.0.0.1' }, () => { sendFrame(s, { type: 'client-hello', protocolVersion: '2.0', room: 'g', nodeId: crypto.randomUUID(), name: 'x', identityPublicKey: b(), e2ePublicKey: freshX25519().publicKey, nonce: b(), implementation: { name: 'x', version: '1' }, extensions: ['cmb-encrypted-v2'] }); res(); });
+          s.on('error', res); s.on('data', () => {}); socks.push(s);
+        });
+      }
+      await new Promise((r) => setTimeout(r, 300));
+      const inflight = [...node._sessions].filter((s) => !s.confirmed && !s.closed && s.kind === 'bonjour').length;
+      assert.ok(inflight <= 8, `authenticating from one host: ${inflight} (at most 8)`);
+    } finally { for (const s of socks) s.destroy(); await stopAll(node); }
+  });
+
+  it('relay-slots: a flood of never-finishing relay hellos does not keep an honest peer out', async () => {
+    const relay = fakeRelay({ ratePerSec: 1e6, burst: 1e6 });
+    const a = new SymNode({ name: uniq('rs-target'), silent: true, relayOnly: true, discovery: new NullDiscovery(), relay: relay.url, relayToken: TOKEN, room: 'relay-room' });
+    const bots = [];
+    try {
+      await a.start();
+      await until(() => a._relay._relayWs && a._relay._relayWs.readyState === 1, 5000);
+      for (let i = 0; i < 64; i++) {
+        const id = { ...identity('bot' + i), nodeId: `00000000-0000-7000-8000-${String(i).padStart(12, '0')}` };
+        const { frame } = clientHello({ room: 'relay-room', nodeId: id.nodeId, name: id.name, identityPublicKey: id.publicKey, e2ePublicKey: freshX25519().publicKey, implementation: { name: 'bot', version: '1' }, extensions: ['cmb-encrypted-v2'] });
+        relay.inject(id.nodeId, a.nodeId, frame);
+        bots.push(id);
+      }
+      await new Promise((r) => setTimeout(r, 300));
+      assert.ok(a._relayHandshakesInFlight() <= 32, 'unknown froms hold 32 slots at most');
+      const h = new SymNode({ name: uniq('rs-honest'), silent: true, relayOnly: true, discovery: new NullDiscovery(), relay: relay.url, relayToken: TOKEN, room: 'relay-room' });
+      try {
+        await h.start();
+        assert.ok(await until(() => a._peers.has(h.nodeId) && h._peers.has(a.nodeId), 15000, 100), 'the honest peer gets a session');
+      } finally { await stopAll(h); }
+    } finally { await stopAll(a); await relay.close(); }
+  });
+});
+
+describe('E. Legacy Import over the relay (cs-review-C/legacy-relay-squat)', () => {
+  for (const gated of [false, true]) {
+    it(`a relay token holder answering as the routed 0.13 node reads nothing${gated ? ' (gated room: not even a session)' : ''}`, async () => {
+      const WebSocket = require('ws');
+      const { e2eGenerateKeyPair, e2eDeriveSharedSecret, decryptCategories } = require('../lib/core');
+      const relay = fakeRelay({});
+      const L = identity('legacy-013');
+      const real = e2eGenerateKeyPair(); // the routed node's persistent X25519 key: the attacker knows only its public half
+      const owner = identity('owner');
+      const node = new SymNode({ name: uniq('lrs'), silent: true, relayOnly: true, discovery: new NullDiscovery(), relay: relay.url, relayToken: TOKEN, room: 'r1', legacyRoutes: [{ nodeId: L.nodeId, endpoint: 'relay', key: L.publicKey, e2eKey: real.publicKey.toString('base64') }] });
+      if (gated) node._roomOwners.pin('r1', owner.nodeId, owner.publicKey, 'config');
+      const ws = new WebSocket(relay.url);
+      const opened = new Promise((r) => ws.once('open', r));
+      const got = [];
+      try {
+        await node.start();
+        await new Promise((r) => setTimeout(r, 300));
+        const mine = e2eGenerateKeyPair();
+        let secret = null;
+        await opened;
+        ws.send(JSON.stringify({ type: 'relay-auth', nodeId: L.nodeId, name: 'squatter', token: TOKEN }));
+        ws.on('message', (d) => {
+          const m = JSON.parse(String(d));
+          if (!m.payload) return;
+          const p = m.payload;
+          if (p.type === 'handshake') {
+            // Answers with the routed node's public keys, its own X25519 key in place of the pinned one.
+            secret = e2eDeriveSharedSecret(mine.privateKey, Buffer.from(p.e2ePublicKey, 'base64'));
+            ws.send(JSON.stringify({ to: m.from, payload: { type: 'handshake', nodeId: L.nodeId, name: 'legacy-013', version: '0.2.3', extensions: [], room: 'r1', publicKey: L.publicKey, e2ePublicKey: mine.publicKey.toString('base64'), lifecycleRole: 'participant' } }));
+          } else if (p.type === 'cmb' && secret) {
+            try { got.push(decryptCategories(p.cmb.categories, p.cmb._e2e.nonce, secret).focus); } catch { got.push('undecryptable'); }
+          }
+        });
+        await new Promise((r) => setTimeout(r, 800));
+        assert.strictEqual(node._peers.has(L.nodeId), false, 'no session for the squatter');
+        if (gated) assert.strictEqual(node._roomDoor(L.nodeId).pass, false);
+        node.remember(CATS('room broadcast secret'));
+        node.remember(CATS('directed secret for the 0.13 node'), { to: L.nodeId });
+        await new Promise((r) => setTimeout(r, 500));
+        assert.deepStrictEqual(got, [], 'nothing reached it, let alone in a form it could open');
+      } finally { ws.close(); await stopAll(node); await relay.close(); }
+    });
+  }
+});
+
+describe('F. errors are information (cs-review-A/relay-errors, relay-failed-rehandshake)', () => {
+  const relayNode = (base, relay, extra = {}) => new SymNode({ name: uniq(base), silent: true, relayOnly: true, discovery: new NullDiscovery(), relay: relay.url, relayToken: TOKEN, room: 'relay-room', ...extra });
+  const sess = (n, o) => n._peers.get(o.nodeId)?.transports.get('relay');
+
+  it('a clear 2001, a clear 1011, a replayed sealed frame: the confirmed session stays, with no peer-left', async () => {
+    const captured = [];
+    const relay = fakeRelay({ tap: (e) => { captured.push(e); } });
+    const a = relayNode('re-a', relay); const b = relayNode('re-b', relay);
+    try {
+      await a.start(); await b.start();
+      await until(() => sess(a, b)?.confirmed && sess(b, a)?.confirmed, 8000);
+      const left = [];
+      a.on('peer-left', () => left.push(1));
+      const got = [];
+      a.on('verified-record', (e) => got.push(e));
+      b.remember(CATS('a record to replay'));
+      await until(() => got.length > 0, 4000);
+      const s0 = sess(a, b);
+      relay.inject(b.nodeId, a.nodeId, { type: 'error', code: 2001, message: 'informational' });
+      const f = captured.filter((e) => e.from === b.nodeId && e.to === a.nodeId && e.payload.type === 'cmb-encrypted').pop();
+      relay.inject(b.nodeId, a.nodeId, f.payload);
+      await new Promise((r) => setTimeout(r, 300));
+      assert.strictEqual(sess(a, b), s0, 'the same session');
+      assert.strictEqual(s0.closed, false);
+      assert.strictEqual(a._sessionStats.desync, 0, 'a replay is discarded, not a desync');
+      assert.ok(a._sessionStats.refusedByReason.replay >= 1);
+      // A clear 1011 to the client: it re-handshakes, keeping the session until the new one supersedes it.
+      const [lo, hi] = a.nodeId < b.nodeId ? [a, b] : [b, a];
+      const before = sess(lo, hi);
+      relay.inject(hi.nodeId, lo.nodeId, { type: 'error', code: 1011, message: 'unknown session', detail: `session:${before.sessionId}` });
+      await until(() => sess(lo, hi) && sess(lo, hi) !== before, 6000);
+      assert.notStrictEqual(sess(lo, hi), before, 'a new session supersedes it');
+      assert.deepStrictEqual(left, [], 'no peer-left at any point');
+    } finally { await stopAll(a, b); await relay.close(); }
+  });
+
+  it('a re-handshake that fails leaves the confirmed session exactly as it was; no clear error crosses', async () => {
+    let dropFinish = false; const errors = [];
+    const relay = fakeRelay({ tap: (e) => {
+      if (e.payload.type === 'error') errors.push(e.payload);
+      if (dropFinish && e.payload.type === 'client-finish') return false;
+      return undefined;
+    } });
+    const a = relayNode('fr-a', relay, { handshakeTimeoutMs: 1500 }); const b = relayNode('fr-b', relay, { handshakeTimeoutMs: 1500 });
+    try {
+      await a.start(); await b.start();
+      await until(() => sess(a, b)?.confirmed && sess(b, a)?.confirmed, 8000);
+      const [lo, hi] = a.nodeId < b.nodeId ? [a, b] : [b, a];
+      const s1lo = sess(lo, hi); const s1hi = sess(hi, lo);
+      const left = [];
+      lo.on('peer-left', () => left.push('lo')); hi.on('peer-left', () => left.push('hi'));
+      dropFinish = true;
+      relay.inject(hi.nodeId, lo.nodeId, { type: 'error', code: 1011, message: 'unknown session' });
+      await new Promise((r) => setTimeout(r, 2500));
+      assert.strictEqual(s1lo.closed, false, 'the client\'s confirmed session is kept');
+      assert.strictEqual(s1hi.closed, false, 'the server\'s too');
+      assert.deepStrictEqual(left, []);
+      assert.deepStrictEqual(errors.filter((e) => e.code !== 1011), [], 'the failed attempt sent no error');
+    } finally { await stopAll(a, b); await relay.close(); }
+  });
+
+  it('a clear error on a confirmed LAN session is ignored; a sealed 1010 closes it', async () => {
+    const a = mk('le-a'); const b = mk('le-b');
+    try {
+      await a.start(); await b.start();
+      const { tc } = await connectNodes(a, b);
+      const s = b._peers.get(a.nodeId).transport;
+      for (const code of [1009, 1010, 2001, 4400]) s.receiveWire({ type: 'error', code, message: 'anyone can write this' });
+      assert.strictEqual(s.closed, false, 'clear errors change nothing');
+      assert.ok(b._sessionStats.refusedByReason['clear-error-ignored'] >= 4);
+      a._peers.get(b.nodeId).transport.trySend({ type: 'error', code: 1010, message: 'session closed: test' });
+      await until(() => s.closed, 2000);
+      assert.strictEqual(s.closedReason, 'peer-closed');
+      void tc;
+    } finally { await stopAll(a, b); }
+  });
+
+  it('a peer that refused this node with 1009 is not re-dialled over the LAN, discovery\'s re-offer included', async () => {
+    const { EventEmitter } = require('events');
+    const disco = new EventEmitter();
+    disco.start = async () => 0; disco.stop = async () => {}; disco.reconnect = () => {};
+    const node = new SymNode({ name: uniq('nr'), silent: true, discovery: disco, room: 'default' });
+    const dialled = [];
+    node._connectToPeer = (address, port, peerId) => dialled.push(peerId);
+    try {
+      await node.start();
+      const larger = `ffffffff-ffff-7fff-bfff-${crypto.randomBytes(6).toString('hex')}`;
+      node._onSessionClosed({ kind: 'bonjour', role: 'client', nodeId: null, expectNodeId: larger, _sessionsClosed: true }, { reason: 'identity-conflict', wasConfirmed: true });
+      disco.emit('peer-found', '127.0.0.1', 2, larger, 'v2', { mmp: '2.0', room: 'default' });
+      assert.deepStrictEqual(dialled, [], 'not dialled');
+    } finally { await stopAll(node); }
+  });
+
+  it('a relay frame type never rides inside a sealed control frame; a selection outside both offers is refused', () => {
+    const key = crypto.randomBytes(32);
+    assert.throws(() => buildControlFrame({ frame: { type: 'relay-peers', peers: [] }, sessionId: 'a'.repeat(32), direction: 'client-to-server', sequence: 0, trafficKey: key }), /refusing to seal/);
+    assert.throws(() => buildControlFrame({ frame: { type: 'relay-anything-new', x: 1 }, sessionId: 'a'.repeat(32), direction: 'client-to-server', sequence: 0, trafficKey: key }), /refusing to seal/, 'every relay-* type, not only the ones known today');
+    assert.throws(() => assertNoDowngrade(['cmb-encrypted-v2'], ['cmb-encrypted-v2'], ['cmb-encrypted-v2', 'sym-attest-v1']), /not offered by both/);
+    assert.throws(() => assertNoDowngrade(['cmb-encrypted-v2'], ['cmb-encrypted-v2'], ['cmb-encrypted-v2', 'cmb-encrypted-v2']), /twice/);
+    void openControlFrame;
+  });
+
+  it('case-alias: an upper-case alias of a nodeId is refused at the hello and at every other door', () => {
+    const X = identity('x');
+    const { frame } = clientHello({ room: 'r', nodeId: X.nodeId.toUpperCase(), name: 'x', identityPublicKey: X.publicKey, e2ePublicKey: freshX25519().publicKey, implementation: { name: 'x', version: '1' }, extensions: ['cmb-encrypted-v2'] });
+    const [, ts] = memoryPipe();
+    const S = identity('s');
+    const server = new PeerSession({ role: 'server', transport: ts, local: S, room: 'r', extensions: ['cmb-encrypted-v2'], implementation: { name: 'x', version: '1' } });
+    let closed = null;
+    server.on('closed', (c) => { closed = c; });
+    server.receiveWire(frame);
+    assert.ok(closed, 'refused');
+    const { wireNodeId } = require('../lib/wire-identity');
+    assert.strictEqual(wireNodeId(X.nodeId.toUpperCase()), null, 'a relay from / announcement');
+    assert.strictEqual(wireNodeId(X.nodeId), X.nodeId);
+    const { parseInvite, buildInvite } = require('../lib/invite');
+    const url = buildInvite({ room: 'r', issuer: { nodeId: X.nodeId, publicKey: X.publicKey } }).replace(X.nodeId, X.nodeId.toUpperCase());
+    assert.ok(parseInvite(url).error, 'an invite');
+  });
+
+  it('rooms compare in NFC', () => {
+    const nfd = 'café'; const nfc = 'café';
+    const n = mk('nfc', { room: nfd });
+    try { assert.strictEqual(n._room, nfc, 'kept and announced in NFC'); } finally { n.stop().catch(() => {}); }
+  });
+});
+
+describe('G. the host hook fires once per assertion (cs-review-P/hook-replay, cs-review-B/p5-dup-hook)', () => {
+  it('one signed directed record delivered five times by two relayers raises verified-record once', async () => {
+    const b = mk('p5', { room: 'r' });
+    try {
+      await b.start();
+      const A = identity('author-a');
+      admitAs(b, A); const sy = admitAs(b, identity('relayer-y')); const sz = admitAs(b, identity('relayer-z'));
+      let hooks = 0;
+      b.on('verified-record', () => hooks++);
+      const rec = signedRecord(A, { categories: CATS('an actionable directed request'), room: 'r', to: b.nodeId });
+      for (let i = 0; i < 5; i++) deliver(b, i % 2 ? sy : sz, { type: 'cmb', cmb: JSON.parse(JSON.stringify(rec)) });
+      await new Promise((r) => setTimeout(r, 500));
+      assert.strictEqual(hooks, 1);
+      // A flushed de-dup cache does not bring it back: the hook remembers the assertion.
+      b._frameHandler._seenCmbKeys.clear();
+      b._frameHandler._seenDirectedKeys.clear();
+      deliver(b, sy, { type: 'cmb', cmb: JSON.parse(JSON.stringify(rec)) });
+      await new Promise((r) => setTimeout(r, 200));
+      assert.strictEqual(hooks, 1, 'not even after the de-duplication marks are gone');
+    } finally { await stopAll(b); }
+  });
+
+  it('a directed record older than 24 h by its signed time is refused (its de-duplication marks are not kept longer)', async () => {
+    const b = mk('dw', { room: 'r' });
+    try {
+      await b.start();
+      const A = identity('author-old');
+      const s = admitAs(b, A);
+      const metrics = [];
+      b.on('metric', (m) => metrics.push(m));
+      const { createCMB, signCMB, assertionIdV2_0 } = require('../lib/core');
+      const cmb = createCMB({ categories: { focus: 'an old directed request' }, createdBy: A.name, emitV2: true, createdByNodeId: A.nodeId, room: 'r', to: b.nodeId });
+      cmb.metadata.createdTimestamp = Date.now() - 25 * 3600 * 1000;
+      cmb.metadata.assertionId = assertionIdV2_0(cmb);
+      signCMB(cmb, A.privateKey);
+      deliver(b, s, { type: 'cmb', cmb });
+      await until(() => metrics.some((m) => m.type === 'cmb-directed-stale'), 2000);
+      assert.ok(metrics.some((m) => m.type === 'cmb-directed-stale'));
+    } finally { await stopAll(b); }
+  });
+});
+
+describe('the rest of the review (cs-review-B/p11-cli-compact, node-level attestation weight)', () => {
+  it('p11-cli-compact: `sym keys` lists read-only, and a live peer\'s binding survives the node\'s restart', () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'p11-'));
+    try {
+      const L = identity('live-peer');
+      const { FORMAT_MARKER } = require('../lib/roster-keys');
+      const old = Date.now() - 31 * 864e5;
+      fs.writeFileSync(path.join(dir, 'roster-keys.jsonl'), JSON.stringify(FORMAT_MARKER) + '\n' + JSON.stringify({ nodeId: L.nodeId, key: L.publicKey, source: 'proven', seen: old }) + '\n');
+      const running = new RosterKeyRegistry({ dir, isLive: (id) => id === L.nodeId });
+      assert.strictEqual(running.get(L.nodeId), L.publicKey, 'the running node keeps its live peer');
+      const cli = new RosterKeyRegistry({ dir, readOnly: true });
+      assert.strictEqual(cli.get(L.nodeId), L.publicKey);
+      const restarted = new RosterKeyRegistry({ dir });
+      assert.strictEqual(restarted.get(L.nodeId), L.publicKey, 'the live peer was seen, and that was written');
+    } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+  });
+
+  it('p2c-backdate at the node: a revoked validator\'s attestation, dated inside its old window, weighs as a participant', async () => {
+    const ANCN = identity('anchor-att');
+    const node = mk('att-w', { anchor: { nodeId: ANCN.nodeId, publicKey: ANCN.publicKey } });
+    try {
+      const V = identity('validator-att');
+      const t0 = Date.now() - 100_000;
+      node._roleGrants.record(signGrant({ type: 'role-grant', grantee: V.nodeId, role: 'validator', grantedBy: ANCN.nodeId, grantedAt: t0, granteeKey: V.publicKey }, ANCN.privateKey));
+      node._roster.bind(V.nodeId, V.publicKey, 'pinned');
+      const inWindow = { by: V.nodeId, at: t0 + 1000, receivedAt: t0 + 1500 };
+      assert.strictEqual(node._attesterRole(inWindow), 'validator', 'received while V was a validator: it counts');
+      node._roleGrants.record(signGrant({ type: 'role-revoke', grantee: V.nodeId, grantedBy: ANCN.nodeId, grantedAt: t0 + 50_000 }, ANCN.privateKey));
+      assert.strictEqual(node._attesterRole(inWindow), 'validator', 'and keeps its standing after V is revoked');
+      const backdated = { by: V.nodeId, at: t0 + 1000, receivedAt: Date.now() };
+      assert.strictEqual(node._attesterRole(backdated), 'participant', 'one received after the revoke, dated before it, does not');
+    } finally { await stopAll(node); }
+  });
+});
+
+describe('the rest of the review (cs-review-C)', () => {
+  it('floor-probe: the sticky floor survives 31 days unseen and a restart, and a churn of identities', () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'floor-'));
+    try {
+      const L = '01a0fd21-0000-7000-8000-00000000000a';
+      const K = identity('l').publicKey;
+      let t = Date.now();
+      let reg = new RosterKeyRegistry({ dir, now: () => t, isRouted: (id) => id === L });
+      reg.bind(L, K, 'proven'); reg.noteSeen(L);
+      assert.strictEqual(reg.floor(L), true);
+      t += 31 * 24 * 3600 * 1000;
+      reg = new RosterKeyRegistry({ dir, now: () => t });
+      assert.strictEqual(reg.floor(L), true, 'the binding may be gone; the floor is not');
+      const reg2 = new RosterKeyRegistry({ maxBindings: 1000, isRouted: (id) => id === L });
+      reg2.bind(L, K, 'proven');
+      for (let i = 0; i < 1000; i++) reg2.bind(`01a0fd21-0000-7000-8000-${String(i).padStart(12, '0')}`, identity().publicKey, 'proven');
+      assert.strictEqual(reg2.floor(L), true);
+    } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+  });
+
+  it('interior-probe: the mindId ends nothing, a stale capability on a new connection is refused', async () => {
+    const node = mk('ip');
+    try {
+      const it2 = node.interior();
+      const p = await it2.listen();
+      const { mindId, capability } = it2.startMind({ id: 'm1', kinds: ['note'] });
+      const ask = (obj) => new Promise((res) => { const s = net.createConnection(p, () => s.write(JSON.stringify(obj) + '\n')); let b = ''; s.on('data', (d) => { b += d; if (b.includes('\n')) { s.destroy(); res(JSON.parse(b)); } }); });
+      const keep = net.createConnection(p);
+      await new Promise((r) => keep.once('connect', r));
+      const first = await new Promise((res) => { let b = ''; keep.on('data', (d) => { b += d; if (b.includes('\n')) res(JSON.parse(b)); }); keep.write(JSON.stringify({ id: 1, type: 'mission', capability }) + '\n'); });
+      assert.strictEqual(first.type, 'mission');
+      assert.strictEqual((await ask({ id: 2, type: 'end', capability: mindId })).reason, 'no-live-capability');
+      assert.strictEqual((await ask({ id: 3, type: 'submit', capability, kind: 'note', categories: { focus: 'x' } })).reason, 'capability-bound-to-another-connection');
+      keep.destroy();
+    } finally { await stopAll(node); }
+  });
+});
diff --git a/tests/integration/legacy-import-013.js b/tests/integration/legacy-import-013.js
index 053fe1c4..9f1cf0c5 100644
--- a/tests/integration/legacy-import-013.js
+++ b/tests/integration/legacy-import-013.js
@@ -48,7 +48,7 @@ function start013({ relay, token, room = 'lg-room' } = {}) {
     const out = (o) => process.stdout.write(JSON.stringify(o) + '\\n');
     node.on('cmb-accepted', (e) => out({ event: 'accepted', content: e.content, directed: !!e.directed }));
     node.on('metric', (m) => { if (/signature|legacy/.test(m.type)) out({ event: 'metric', m }); });
-    node.start().then(() => out({ event: 'ready', nodeId: node.nodeId, publicKey: node._identity.publicKey, port: node._port, version: require(DIR + '/package.json').version }));
+    node.start().then(() => out({ event: 'ready', nodeId: node.nodeId, publicKey: node._identity.publicKey, e2ePublicKey: node._e2eKeyPair.publicKey.toString('base64'), port: node._port, version: require(DIR + '/package.json').version }));
     let buf = '';
     process.stdin.on('data', (d) => {
       buf += d; let i;
@@ -91,7 +91,8 @@ describe('Legacy Import against a real 0.13.17 node', { skip: PRESENT ? false :
     const node = new SymNode({
       name: `core-secure-${process.pid}`, silent: true, room: 'lg-room',
       discovery: new (require('../../lib/discovery').BonjourDiscovery)({ mdns: false }),
-      legacyRoutes: [{ nodeId: ready.nodeId, endpoint: `127.0.0.1:${ready.port}`, key: ready.publicKey }],
+      // The route pins the 0.13.17 node's identity key and its persistent X25519 key (security review E).
+      legacyRoutes: [{ nodeId: ready.nodeId, endpoint: `127.0.0.1:${ready.port}`, key: ready.publicKey, e2eKey: ready.e2ePublicKey }],
     });
     try {
       await node.start();
@@ -99,7 +100,7 @@ describe('Legacy Import against a real 0.13.17 node', { skip: PRESENT ? false :
       assert.strictEqual(node.status().legacyImport.sessions.length, 1, 'a Legacy Import session over the route');
       // 0.13.17 → 0.14, directed: delivered here, quarantined.
       const got = [];
-      node.on('cmb-accepted', (e) => got.push(e));
+      node.on('legacy-record', (e) => got.push(e)); // quarantined: never a Core Secure delivery
       legacy.send({ cmd: 'remember', categories: CATS('from 0.13.17 to core secure'), to: node.nodeId });
       await until(() => got.length > 0, 15000);
       assert.strictEqual(got[0].verified, false);
@@ -129,14 +130,14 @@ describe('Legacy Import against a real 0.13.17 node', { skip: PRESENT ? false :
     const node = new SymNode({
       name: `core-secure-relay-${process.pid}`, silent: true, room: 'lg-room', relayOnly: true, discovery: new NullDiscovery(),
       relay: relay.url, relayToken: token,
-      legacyRoutes: [{ nodeId: ready.nodeId, endpoint: 'relay', key: ready.publicKey }],
+      legacyRoutes: [{ nodeId: ready.nodeId, endpoint: 'relay', key: ready.publicKey, e2eKey: ready.e2ePublicKey }],
     });
     try {
       await node.start();
       await until(() => node._peers.has(ready.nodeId), 15000);
       assert.strictEqual(node.status().legacyImport.sessions[0].transport, 'relay');
       const got = [];
-      node.on('cmb-accepted', (e) => got.push(e));
+      node.on('legacy-record', (e) => got.push(e)); // quarantined: never a Core Secure delivery
       legacy.send({ cmd: 'remember', categories: CATS('over the relay from 0.13.17'), to: node.nodeId });
       await until(() => got.length > 0, 15000);
       assert.strictEqual(got[0].profile, 'legacy-import');
diff --git a/tests/roster-keys.test.js b/tests/roster-keys.test.js
index a76530e7..c9335bdb 100644
--- a/tests/roster-keys.test.js
+++ b/tests/roster-keys.test.js
@@ -208,7 +208,9 @@ describe('persistence and the 0.13 file', () => {
       const before = fs.readFileSync(path.join(dir, 'roster-keys.jsonl'), 'utf8');
       const ro = new RosterKeyRegistry({ dir, readOnly: true });
       assert.strictEqual(ro.get('L'), k, 'listed as it is');
-      assert.strictEqual(fs.readFileSync(path.join(dir, 'roster-keys.jsonl'), 'utf8'), before, 'nothing expired, compacted or written');
+      ro.noteSeen('L'); ro.bind('M', key(), 'proven'); ro.bind('L', key(), 'proven'); ro.resetFloor('L');
+      assert.strictEqual(fs.readFileSync(path.join(dir, 'roster-keys.jsonl'), 'utf8'), before, 'nothing expired, compacted or written, whatever is called on it');
+      assert.ok(!fs.existsSync(path.join(dir, 'roster-conflicts.jsonl')), 'not even a conflict');
     } finally { fs.rmSync(dir, { recursive: true, force: true }); }
   });
 

From f9405a587240b8d0acd803c0359480019def1d8e Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Fri, 2 Oct 2026 18:48:38 +0100
Subject: [PATCH 104/148] 0.14.0 integration: the attestation e2e reads the
 session-scoped binding a handshake makes

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 tests/integration/e2e-attestation-gossip.js | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/tests/integration/e2e-attestation-gossip.js b/tests/integration/e2e-attestation-gossip.js
index 4eb2a1c2..5fc44228 100644
--- a/tests/integration/e2e-attestation-gossip.js
+++ b/tests/integration/e2e-attestation-gossip.js
@@ -46,8 +46,9 @@ describe('E2E Admission Attestation gossip (D2)', () => {
     await sleep(400);
     const announced = [];
     B.on('attestation-received', (e) => announced.push(e));
-    assert.strictEqual(B._roster.get(A.nodeId), A._identity.publicKey, 'B has A\'s identity key, proven by the handshake');
-    assert.strictEqual(B._roster.source(A.nodeId), 'proven');
+    // The handshake binds A's key for the session (security review D): durable only once earned.
+    assert.strictEqual(B._identityKey(A.nodeId), A._identity.publicKey, 'B has A\'s identity key, proven by the handshake');
+    assert.strictEqual(B._keySource(A.nodeId), 'session');
 
     const entry = B.remember({
       focus: 'attestation gossip e2e', issue: 'verify attestation reaches the author',
@@ -72,7 +73,7 @@ describe('E2E Admission Attestation gossip (D2)', () => {
     assert.strictEqual(live[0].from, aName);
     assert.strictEqual(live[0].relayed, false);
     assert.strictEqual(live[0].verified, true);
-    assert.strictEqual(live[0].keySource, 'proven');
+    assert.strictEqual(live[0].keySource, 'session');
     assert.strictEqual(live[0].sig, att.sig);
 
     // A forged attestation (bad signature) must be dropped on ingest.

From 72daeb6e376c4d10113474c033a21f5a39bc3502 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Fri, 2 Oct 2026 18:50:41 +0100
Subject: [PATCH 105/148] tests: the signature re-spelling test no longer
 flakes on a signature with no - or _

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014y3qC1m9acDVaerca56dvV
---
 tests/gossip-budget.test.js | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/tests/gossip-budget.test.js b/tests/gossip-budget.test.js
index 39af964f..4a8fb966 100644
--- a/tests/gossip-budget.test.js
+++ b/tests/gossip-budget.test.js
@@ -314,8 +314,9 @@ describe('signature spelling', () => {
       const a1 = signed({ of: 'cmb-s1', by: A.id, at: 1, roster: ROOM, method: 'heuristic', verdict: 'aligned', categories: {}, role: 'participant', seq: 1, prev: 'genesis' }, A.priv, signAttestation);
       const a2 = signed({ of: 'cmb-s2', by: A.id, at: 2, roster: ROOM, method: 'heuristic', verdict: 'aligned', categories: {}, role: 'participant', seq: 2, prev: chainHash(a1.sig) }, A.priv, signAttestation);
       const s = a1.sig;
-      const respelled = [`${s}=`, `${s}==`, ` ${s}`, `${s.slice(0, 40)}\n${s.slice(40)}`, s.replace(/-/g, '+').replace(/_/g, '/'), `${s}!`];
-      assert.ok(respelled.every((x) => x !== s && Buffer.from(x, 'base64url').equals(Buffer.from(s, 'base64url'))), 'every one is the same signature');
+      // The +/ swap changes nothing for a signature without - or _ (about 1 in 15): it is left out then.
+      const respelled = [`${s}=`, `${s}==`, ` ${s}`, `${s.slice(0, 40)}\n${s.slice(40)}`, s.replace(/-/g, '+').replace(/_/g, '/'), `${s}!`].filter((x) => x !== s);
+      assert.ok(respelled.every((x) => Buffer.from(x, 'base64url').equals(Buffer.from(s, 'base64url'))), 'every one is the same signature');
       for (const sig of respelled) {
         assert.strictEqual(node._ingestAttestation({ ...a1, sig }, 'm', 'm').reason, 'non-canonical-signature');
       }

From d2099e75a651ffbb87956dc82807b53e71d0fd1b Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Wed, 7 Oct 2026 19:34:13 +0100
Subject: [PATCH 106/148] tests: the 0.13.17 relay scenes hold under Core
 Secure sessions (no code change needed)

sym 0.13.17 (2cf4dea) fixed two faults in _createPeer: a peer the relay re-announced was left with transport null (every send
and broadcast in the room threw), and a LAN transport added to a relay peer never became the active one. 0.14.0 binds peers to
proven sessions (D1): a new session is registered and the active transport recomputed before the old one is superseded, and a
session's close removes only itself. These tests hold 0.14.0 to the same scenes end to end, over the fake relay and memory pipes:

- a peer the relay announces again is still sent to: a room broadcast and a directed send both arrive;
- a peer that restarts under the relay (4004, a new session: the cloud peer's reconnect) is sent to on its new session;
- a peer met over the relay and then on the LAN is sent to over the LAN (bonjour before relay, MMP 4.6).

All three pass on 72daeb6 unchanged, so nothing is ported. Suite 1148/1151 (3 skipped, 0 fail).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JSMiTdRfmjQGsoJMtxDT2D
---
 tests/relay-reannounce-scenes.test.js | 103 ++++++++++++++++++++++++++
 1 file changed, 103 insertions(+)
 create mode 100644 tests/relay-reannounce-scenes.test.js

diff --git a/tests/relay-reannounce-scenes.test.js b/tests/relay-reannounce-scenes.test.js
new file mode 100644
index 00000000..3ca5f840
--- /dev/null
+++ b/tests/relay-reannounce-scenes.test.js
@@ -0,0 +1,103 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME before lib/config loads
+
+/**
+ * THE 0.13.17 RELAY SCENES, AGAINST CORE SECURE (sym 0.13.17, fix 2cf4dea; found in xmesh-world-room, 7 Oct 2026).
+ *
+ * In 0.13, a relay re-announcing a peer the node already held closed the held relay transport while it was still registered; its
+ * synchronous close handler left the peer in the table with transport null, and every later send and broadcast threw ("Cannot read
+ * properties of null (reading 'send')"). And a LAN transport added to a peer first met over the relay never became the active one, so
+ * CMBs kept going to the relay. 0.14.0 binds peers to proven sessions (D1): the new session is registered and the active transport
+ * recomputed before the old one is superseded, and a session's close removes only itself. These tests hold that to the same scenes,
+ * end to end: a re-announced peer, and a restarted one (the cloud peer's reconnect), are still sent to; a peer met over the relay and
+ * then on the LAN is sent to over the LAN.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const { SymNode } = require('../lib/node');
+const { NullDiscovery } = require('../lib/discovery');
+const { nodeDirById } = require('../lib/config');
+const { fakeRelay } = require('./_fake-relay');
+const { until, connectNodes } = require('./_core-secure');
+
+const uniq = (b) => `${b}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+const CATS = (focus) => ({ focus, issue: 'relay scene', intent: '0.13.17 scenes', motivation: 'm', commitment: 'c', perspective: 'p', mood: { text: 'calm', valence: 0, arousal: 0 } });
+const TOKEN = 'x'.repeat(40);
+const relayNode = (base, relay) => new SymNode({ name: uniq(base), silent: true, relayOnly: true, discovery: new NullDiscovery(), relay: relay.url, relayToken: TOKEN, room: 'relay-room' });
+async function stopAll(...nodes) {
+  for (const n of nodes) { try { await n.stop(); } catch { /* */ } try { fs.rmSync(nodeDirById(n.nodeId), { recursive: true, force: true }); } catch { /* */ } }
+}
+const paired = (a, b) => a._peers.has(b.nodeId) && b._peers.has(a.nodeId);
+const relaySession = (n, other) => n._peers.get(other.nodeId)?.transports.get('relay');
+/** what `to` verifies from `from`, by focus */
+function heard(to) { const got = []; to.on('verified-record', (e) => got.push(e)); return got; }
+const focusOf = (e) => e.record.categories.focus.text;
+
+describe('the 0.13.17 relay scenes under Core Secure sessions', () => {
+  it('a peer the relay announces again is still sent to: a room broadcast and a directed send both arrive, and nothing throws', async () => {
+    const relay = fakeRelay();
+    const a = relayNode('ra-a', relay); const b = relayNode('ra-b', relay);
+    try {
+      await a.start(); await b.start();
+      await until(() => paired(a, b), 8000);
+      const [lo, hi] = [a, b].sort((x, y) => (x.nodeId < y.nodeId ? -1 : 1));
+      const ws = relay.conns.get(lo.nodeId).ws;
+      for (let i = 0; i < 5; i++) ws.send(JSON.stringify({ type: 'relay-peer-joined', nodeId: hi.nodeId, name: hi.name }));
+      await new Promise((r) => setTimeout(r, 300));
+      const peer = lo._peers.get(hi.nodeId);
+      assert.ok(peer && peer.transport && !peer.transport.closed, 'the peer is held with a live transport');
+      const got = heard(hi);
+      assert.doesNotThrow(() => lo.remember(CATS('room, after the re-announce')));
+      assert.doesNotThrow(() => lo.remember(CATS('directed, after the re-announce'), { to: hi.nodeId }));
+      await until(() => got.length >= 2, 5000);
+      assert.deepStrictEqual(got.map(focusOf).sort(), ['directed, after the re-announce', 'room, after the re-announce']);
+    } finally { await stopAll(a, b); await relay.close(); }
+  });
+
+  it('a peer that restarts under the relay (the cloud reconnect: 4004, a new session) is sent to on its new session', async () => {
+    const relay = fakeRelay();
+    const a = relayNode('rr-a', relay);
+    const bName = uniq('rr-b');
+    let b = new SymNode({ name: bName, silent: true, relayOnly: true, discovery: new NullDiscovery(), relay: relay.url, relayToken: TOKEN, room: 'relay-room' });
+    try {
+      await a.start(); await b.start();
+      await until(() => paired(a, b), 8000);
+      const old = relaySession(a, b), bId = b.nodeId;
+      b._relay._identityCollision = true;
+      const b2 = new SymNode({ name: `${bName}-restarted`, nodeId: bId, silent: true, relayOnly: true, discovery: new NullDiscovery(), relay: relay.url, relayToken: TOKEN, room: 'relay-room', create: false });
+      await b2.start();
+      await until(() => relaySession(a, b2) && relaySession(a, b2) !== old, 10000);
+      const peer = a._peers.get(bId);
+      assert.strictEqual(peer.transport, relaySession(a, b2), 'the active transport is the new session');
+      const got = heard(b2);
+      assert.doesNotThrow(() => a.remember(CATS('after the restart')));
+      await until(() => got.length >= 1, 5000);
+      assert.strictEqual(focusOf(got[0]), 'after the restart');
+      await b.stop().catch(() => {});
+      b = b2;
+    } finally { await stopAll(a, b); await relay.close(); }
+  });
+
+  it('a peer met over the relay and then on the LAN is sent to over the LAN (bonjour before relay, MMP 4.6)', async () => {
+    const a = new SymNode({ name: uniq('rl-a'), silent: true, discovery: new NullDiscovery(), room: 'lan-room' });
+    const b = new SymNode({ name: uniq('rl-b'), silent: true, discovery: new NullDiscovery(), room: 'lan-room' });
+    try {
+      await a.start(); await b.start();
+      const [lo, hi] = [a, b].sort((x, y) => (x.nodeId < y.nodeId ? -1 : 1));
+      await connectNodes(lo, hi, { kind: 'relay' });
+      await until(() => paired(a, b), 5000);
+      assert.strictEqual(a._peers.get(b.nodeId).transport.kind, 'relay', 'first met over the relay');
+      await connectNodes(lo, hi, { kind: 'bonjour' });
+      await until(() => a._peers.get(b.nodeId).transports.has('bonjour') && b._peers.get(a.nodeId).transports.has('bonjour'), 5000);
+      assert.strictEqual(a._peers.get(b.nodeId).transport.kind, 'bonjour', 'then sent to over the LAN');
+      assert.strictEqual(b._peers.get(a.nodeId).transport.kind, 'bonjour');
+      const got = heard(b);
+      a.remember(CATS('over the LAN'));
+      await until(() => got.length >= 1, 5000);
+      assert.strictEqual(got[0].session.transport, 'lan', 'and it arrived over the LAN');
+    } finally { await stopAll(a, b); }
+  });
+});

From f0d936a0e4fb17a52113b1e210aa3350f3d002f6 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Wed, 7 Oct 2026 20:09:37 +0100
Subject: [PATCH 107/148] 0.14.0 re-review (72daeb6): N1-N5 and the size limits
 fixed where their assumptions were made

N1 (High). The forgery penalty assumed a bad signature on a proven session was that session's own
forgery. Verification uses this node's binding for the signer, and bindings are local views, so an
honest peer relaying the genuine statements of a node whose nodeId a squatter held here was closed
and refused on each one. A session is now penalised only when the statement names its own proven
peer as signer and the key that failed is the key it proved; any other failure is dropped and
counted (relayed-signature-unverified), never charged to the relayer. Records, attestations,
checkpoints, witnesses, grants and role-chain answers alike.

N2 (Medium; replaces draft spec PR #33's both-times rule, by the founder's ruling). A revoke signs
a cutoff (default: its own time; never before its revoker held rank). Statements the revoked node
signed before the cutoff stand for every receiver whenever they arrive; statements at or after it
never count, even before the revoke was signed. Receipt time leaves the rule and the store: early,
late, synced and upgraded stores resolve the same authority. A revoke without a cutoff signs the
bytes it always signed. Grants keep the 6.6 cascade; attestations count at their signed time. The
exact rule for the spec PR: docs/WIRE-0.14.0.md section 6.

N3 (Medium). A verified record its author signed to this node, accepted for delivery, earns the
author a durable binding: directed exchange is an earned relationship, so a squatter can no longer
take over a conversation once the genuine peer's sessions end.

N4 (Low). No cap refuses a revoke. Grant caps bound grants only; a non-anchor revoker keeps at most
as many revokes for a grantee as the store holds grants for it (nothing-to-revoke, held for a
role-chain-fetch naming the grantee when it arrives first); the whole-store sync sends grants
before revokes; held records are re-offered in passes.

N5 (Low). The grant file is never rewritten (no receipt time to stamp), so a record skipped at load
stays on disk and loads once its root is held. Lines are the bare record, as 0.13 wrote them.

Size limits (draft spec PR #37). 256 KiB a category after NFC, 512 KiB of text, 720 KiB encoded,
minted and received alike; a received record over a limit is refused before schema validation, and
a sealed frame longer than a 720 KiB record can produce (983,062 chars) is refused unopened. The
CHANGELOG's "960 KiB ... what this release mints" is corrected.

Leads. An absent metadata.to stays refused (the MMP record schema requires it). Attestation,
checkpoint and witness rooms compare in NFC. remember() and send() refuse a `to` that is not a
lowercase UUID (EBADTO). A node whose own nodeId is not a lowercase UUID says so at start. The wake
queue and emit.js send through the seal point (confirmed, no change).

Tests: tests/core-secure-rereview.test.js (each finding fails on 72daeb6); the tests that encoded the
replaced rules are rewritten to the new ones. README, SECURITY.md, CHANGELOG and WIRE-0.14.0.md
say what the code now does. The design doc is updated on design/0.14.0-core-secure-identity
(979aec3).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QRVMpaJkAA2fFbvuHCEzqH
---
 CHANGELOG.md                                  |  91 +++-
 README.md                                     |  14 +-
 SECURITY.md                                   |  56 ++-
 docs/WIRE-0.14.0.md                           | 105 +++-
 lib/attestation-store.js                      |   9 +-
 lib/core/cmb-encoder.js                       |  81 ++--
 lib/core/record-canonical.js                  |  42 +-
 lib/core/role-grant.js                        |  13 +-
 lib/frame-handler.js                          |  22 +-
 lib/node.js                                   | 167 +++++--
 lib/role-grant-store.js                       | 222 +++++----
 lib/session.js                                |   6 +
 tests/audit-delivery-authorship.test.js       |  46 +-
 tests/core-secure-rereview.test.js            | 450 ++++++++++++++++++
 tests/core-secure-review.test.js              |  87 ++--
 .../directed-delivery-accountability.test.js  |   3 +-
 tests/gossip-lanes.test.js                    |  22 +-
 tests/record-bounds.test.js                   |  90 ++--
 tests/remember-targeted.test.js               |  23 +-
 tests/role-chain-fetch.test.js                |  14 +-
 tests/role-grant-store.test.js                |  17 +-
 tests/send-frame-dead-socket.test.js          |  18 +-
 22 files changed, 1215 insertions(+), 383 deletions(-)
 create mode 100644 tests/core-secure-rereview.test.js

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2ae5124c..18753180 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,58 @@ key bindings (a lockout anyone on the LAN could fill) by the binding lifetime be
 in-memory pending set for grants that arrive before their root (which could be flooded) by
 `role-chain-fetch`.
 
+### The re-review at 72daeb6 — what changed
+
+Five findings and the open leads, each fixed where its assumption was made (the design is
+`docs/DESIGN-core-secure-identity.md` on branch `design/0.14.0-core-secure-identity`; the wire text
+for the spec PRs is `docs/WIRE-0.14.0.md` §6 and §7):
+
+- **A failed signature is charged only to a session that signed in its own name (N1).** Bindings are
+  local views: a relayed statement is verified under this node's binding for its signer, which may
+  be a squatter's session-scoped binding or lack a vouch the relayer holds. The forgery penalty used
+  to close the relaying session and refuse it for 60 s, so an honest peer relaying the genuine
+  statements of a node whose nodeId a squatter held here was cut off on every one. Now a session is
+  closed (`forged-signature`) only when the statement names its own proven peer as signer and the
+  key that failed is the key it proved; any other failure is dropped and counted
+  (`relayed-signature-unverified`), never charged to the relayer.
+- **A revoke carries a cutoff; receipt time is no part of authority (N2; replaces draft spec PR
+  #33's both-times rule).** The both-times rule voided a genuine revoke for every node that received
+  it after its revoker was itself revoked (a newcomer, an anti-entropy sync, a store upgraded from
+  0.13), so authority depended on arrival order. Now a `role-revoke` signs a `cutoff` (by default its
+  own time; `revokeRole(id, { cutoff })` sets an earlier one, never before the revoker held rank):
+  what the revoked node signed before the cutoff stands for every receiver whenever it arrives, and
+  what it signed at or after it never counts, even before the revoke itself was signed. A revoke
+  without a cutoff signs the bytes it always signed. Grants keep §6.6's cascade. Attestations count
+  at their signer's role at their signed time. Nothing stores a receipt time any more.
+- **Directed exchange earns a durable binding (N3).** A peer that only exchanged directed records
+  never earned one, so once it left, a squatter claiming its nodeId was bound and received this
+  node's further directed records to it, while the genuine peer, refused with 1009, did not retry.
+  A verified record its author signed to this node, accepted for delivery (surfaced, stored or not),
+  now earns the binding, as an admitted record does.
+- **No cap refuses a revoke (N4).** The per-grantor, per-pair and store caps refused revokes too,
+  so past them a grant could no longer be revoked except by the anchor, and a validator filling the
+  store with sybil grants stopped every honest revoke. The caps now bound grants only; a revoker
+  keeps at most as many revokes for a grantee as this node holds grants for it (`nothing-to-revoke`
+  past that, held for a `role-chain-fetch` naming the grantee when it arrives first), the
+  whole-store sync sends grants before revokes, and held records are re-offered in passes.
+- **A 0.13 grant store is never rewritten (N5).** The one-time rewrite into the 0.14 form dropped
+  the records skipped at load (those whose root was not yet held), for good. With receipt time gone
+  the file needs no rewrite: lines are the bare record, as 0.13 wrote them, appended only, and a
+  skipped line loads at the next start once its root is held.
+- **Record size limits fit one sealed frame (draft spec PR #37).** A sealed frame carries its
+  plaintext as base64url, so about 768 KiB is the most one 1 MiB frame can carry, and the previous
+  960 KiB text bound could not be met. Now a category's text is at most 256 KiB after NFC, the seven
+  at most 512 KiB, and the record's JSON encoding at most 720 KiB, both when minting (`ECMBSIZE`) and
+  at ingress, where a record over any limit is refused before anything validates or verifies it,
+  and a sealed frame longer than a 720 KiB record can produce is refused before it is opened.
+- **The open leads.** A record without `metadata.to` stays refused: the MMP v2.0 record schema
+  requires it (null for a room-bound record). Attestation, checkpoint and witness rooms are
+  compared in NFC, as they are signed. `remember()` and `send()` refuse an addressee that is not a
+  lowercase UUID (`EBADTO`) instead of minting a record no session can carry. A node whose own
+  nodeId is not a lowercase UUID says so at start (`node-id-not-canonical`): every Core Secure peer
+  refuses its records. The wake queue and `sym emit` were confirmed to send through the one seal
+  point.
+
 ### The independent security review (BLOCK at 341dafb) — what changed
 
 Seven design assumptions, each changed where it was made, not patched where it showed:
@@ -26,28 +78,28 @@ Seven design assumptions, each changed where it was made, not patched where it s
   `createdByNodeId` a lowercase UUID, each category's `meta.key` recomputed and a mismatch refused,
   an unrecognised category dropped, and the unsigned `valence`, `arousal` and `lineage.method`
   dropped. The node stores, emits, delivers and serves only that projection. **Release note:**
-  `mood-delivered` no longer carries `valence`/`arousal` (they were unsigned). A category over
-  256 KiB, or 960 KiB of text in all (what this release mints), is refused before anything encodes
-  it; this reverses the earlier acceptance of larger categories (C-F4). nodeIds are taken only in
+  `mood-delivered` no longer carries `valence`/`arousal` (they were unsigned). A record over the
+  size limits (256 KiB a category, 512 KiB of text, 720 KiB encoded, as the re-review above set
+  them) is refused before anything encodes it; this reverses the earlier acceptance of larger
+  categories (C-F4). nodeIds are taken only in
   canonical lowercase at every door: the hello, a relay `from` or announcement, a grant, an invite.
-- **Authority counts only if its signer was authorised when it signed and when it was received
-  (C; draft spec PR #33).** One rule for a grant and its key vouch, a revoke and an attestation,
-  each kept with its receipt time (a line with none is treated as received at load). A revoked
-  validator can no longer backdate grants, key vouches, revokes or attestations into its old
-  window. A grant binding is a view over the grants in effect now, never stored; no grant binds this
+- **A revoked validator cannot backdate authority (C).** The review's rule (a statement counts only
+  if its signer was authorised when it signed and when it was received, draft spec PR #33) is
+  replaced by the re-review's revoke cutoff above: no receipt time is kept. A grant binding is a view over the grants in effect now, never stored; no grant binds this
   node's own nodeId (one that vouches a foreign key for it is inert, and reported:
   `role-grant-foreign-self-key`); 0.13 `grant` roster entries migrate as legacy claims. Role
   resolution is memoised (linear in the records) and a delegation reaches at most 8 grants from the
-  anchor; a grantor holds at most 16 records per grantee (was 64).
+  anchor; a grantor holds at most 16 grants per grantee (was 64 records).
 - **No shared budget is spent before verification, and a forgery ends its session (D).** Only the
   peer's own lane is spent before a signature check; the shared ceiling is spent after it. A
-  signature that does not verify on a proven session closes it (`forged-signature`) and its nodeId
-  is not admitted again for 60 s. Grants and revokes have anti-entropy: a `role-digest` on every
+  signature in a session's own name that does not verify under the key it proved closes it
+  (`forged-signature`) and its nodeId is not admitted again for 60 s (a relayed one is only dropped,
+  since the re-review above). Grants and revokes have anti-entropy: a `role-digest` on every
   admission, and a paged whole-store sync when digests differ. A key binding is never evicted
   before it expires. **Every confirmed session runs with a session-scoped binding**, and a second
   key for that nodeId while it lives is a 1009 IDENTITY_CONFLICT; the durable registry takes only
-  an EARNED binding (an admitted verified record, a pin, a grant in effect, or the key a legacy claim
-  expects) — a handshake, or a re-handshake, earns nothing, and neither does a record refused for
+  an EARNED binding (an admitted verified record, a verified directed record accepted (since the
+  re-review), a pin, a grant in effect, or the key a legacy claim expects) — a handshake, or a re-handshake, earns nothing, and neither does a record refused for
   its room. Resource bounds: relay handshakes per relay `from` (one in flight, a hello rate) and
   for unknown candidates (32 of the 256 slots, the oldest evicted, a wait list served known peers
   first, failed ones backing off up to 10 min); the LAN listener (256 connections before their
@@ -224,7 +276,7 @@ Seven design assumptions, each changed where it was made, not patched where it s
 
 - **Binding lifetime (design D3, as the security review changed it).** A confirmed session runs
   with a session-scoped binding; the durable registry takes one only when it is earned (an
-  admitted verified record, a pin, a grant in effect). A `proven` binding that verified nothing and
+  admitted verified record, a verified directed record accepted, a pin, a grant in effect). A `proven` binding that verified nothing and
   was not seen for 30 days expires; nothing is evicted before it expires, and a full registry
   (65,536) refuses a newcomer a durable binding — its live session still verifies what it signs.
   The `seen` / `verified` facts are persisted with the binding.
@@ -408,16 +460,17 @@ debt, and the daemon's log flood. Every item has a test that fails without its f
   clock again, with a `clock-stepped-back` metric.
 - **Mood values were invented or lost (B-R11).** `valence` and `arousal` are kept only when measured,
   must be numbers in [-1, 1], and a mood given only as numbers keeps them.
-- **Records had no size bound below the 1 MiB frame (B-R13).** A category is at most 256 KiB of text
-  and the seven at most 960 KiB, and a record is minted only if the frame it travels in fits the
+- **Records had no size bound below the 1 MiB frame (B-R13).** (The limits are now those of the
+  re-review above: 256 KiB a category after NFC, 512 KiB of text, 720 KiB encoded, minted and
+  received alike. What follows is how 0.13.17 first bounded them.) A category is at most 256 KiB of
+  text and the seven at most 960 KiB, and a record is minted only if the frame it travels in fits the
   1 MiB frame bound with its categories sealed for a peer. Text bytes are not frame bytes: JSON
   writes a `"` as two bytes and a control character as six, and the end-to-end seal is base64, a 4/3
   expansion, so a record within the text bounds could be one no transport would carry. In plain text
   the frame bound allows about 766 KiB. An agent id is at most 64 bytes (§3.1.2). `createCMB` throws
   `ECMBSIZE`, and so does `remember()`, before anything is stored or sent, for a record or payload
-  that would not fit. These are minting rules. A receiver applies no record bound beyond the frame a
-  record arrives in: earlier releases minted larger categories and longer agent ids, and refusing
-  them would stop a node hearing such a peer at all.
+  that would not fit. In 0.13.17 these were minting rules only; 0.14.0 applies the record limits on
+  receipt too (an agent id over 64 bytes is still accepted on receipt).
 - **A served v2.0 record no longer verified (B-R9, part).** `cmb-fetch` now serves a record's two
   sections exactly as signed, as a copy: the metadata whole, and each category with its `meta`. Text
   alone dropped the per-category parents the signature commits to, so a record that declared them
diff --git a/README.md b/README.md
index b3dd92a2..304a2d1a 100644
--- a/README.md
+++ b/README.md
@@ -127,8 +127,9 @@ participant.
   1009 IDENTITY_CONFLICT, recorded, and shown in `sym status` for you to resolve
   (`sym keys <name> resolve`). No source overrides a different key. A handshake alone binds a
   key only for its session; the binding becomes durable when it is earned (an admitted verified
-  record, a pin, an anchor-rooted grant in effect), so churning identities cannot fill the
-  registry, and nothing is ever evicted to make room.
+  record, a verified record its author signed to this node, a pin, an anchor-rooted grant in
+  effect), so churning identities cannot fill the registry, and nothing is ever evicted to make
+  room.
 - **Every record is signed, and verified by its author's node id.** A record is accepted only
   if it is a signed `mmp-sig-v2.0` record whose author key this node resolves by
   `createdByNodeId` — a key it proved, pinned from an invite, or holds from an anchor-rooted
@@ -141,7 +142,10 @@ participant.
   fresh for each handshake (X25519, HKDF-SHA256, ChaCha20-Poly1305). A relay sees routing
   envelopes and ciphertext. There is no long-lived encryption key to steal later.
 - **Authority follows the key.** A role grant names the key it confers authority on, and a
-  grant chain is checked with the keys each grant vouches, from the anchor down.
+  grant chain is checked with the keys each grant vouches, from the anchor down. A revoke signs a
+  cutoff: what the revoked node signed before it stands for every node, and what it signed from
+  the cutoff on never counts, so every node resolves the same authority whatever order it learned
+  the history in.
 - **Each node decides what it keeps.** Admission is receiver-local: a node runs its own
   evaluation on every record it hears and stores only what it admits.
 - **Bounded.** Every store a peer can feed — key bindings, grants, wake channels, gossip, relay
@@ -152,6 +156,10 @@ What this does not solve, said plainly:
 - **First contact** with a node you hold no anchor, invite or grant for is *trust on first
   proven use*: the handshake proves the peer holds the key it presents, not that the key is
   the one you meant. Pin it out of band (an invite carries the issuer's key) when that matters.
+  A node whose records yours never admitted, and that never signed a record to yours, is first contact
+  again once it leaves.
+- **A revoke's cutoff is a judgement.** A revoked node can still date a statement before its
+  cutoff, and that statement stands; set the cutoff back to when you stopped trusting it.
 - **Relay eviction.** `relay-auth` is not proven, and a relay token holder can make the relay
   replace another node's connection (close 4004). A squatter gets no Core Secure session — it
   cannot prove the key — and an evicted node re-handshakes, but the relay path can be interrupted.
diff --git a/SECURITY.md b/SECURITY.md
index 33b38393..a50f3a24 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -33,9 +33,11 @@ Report a vulnerability privately to info@sym.bot (the address in package.json).
   (a broadcast, an anchor replay, a fetch answer, a queued frame).
 - **One key per nodeId.** Every confirmed session runs with a binding: the key it proved, held for
   that nodeId while the session lives. The durable key registry binds a nodeId only when the
-  binding is earned — an admitted verified record, an out-of-band pin (invite, Legacy Import route),
-  or an anchor-rooted grant in effect now (a grant binding is a view over the grants in effect,
-  never stored, and ends with them) — and never replaces it: a different key, from any source or
+  binding is earned — an admitted verified record, a verified record its author signed to this
+  node and this node accepted for delivery (directed exchange is a relationship, so a squatter
+  cannot take over a conversation once its peer's sessions end), an out-of-band pin (invite, Legacy
+  Import route), or an anchor-rooted grant in effect now (a grant binding is a view over the grants
+  in effect, never stored, and ends with them) — and never replaces it: a different key, from any source or
   while a session holds the nodeId, is a recorded conflict an operator resolves (a session
   proving it is closed with error 1009 `IDENTITY_CONFLICT`, sealed). A handshake, or a second one,
   earns nothing; nothing is evicted before it expires; a `proven` binding that verified nothing
@@ -52,14 +54,22 @@ Report a vulnerability privately to info@sym.bot (the address in package.json).
   `lineage.method`) are dropped, and what is stored, delivered and served is the projection.
   Directed versus room-bound delivery is decided by the signed `metadata.to`, never by a relay
   envelope; a directed record older than 24 h by its signed time is refused.
-- **Authority follows the key, and counts both when signed and when received.** A role grant must
-  name `granteeKey`; it confers its role only on that key, and a chain is verified top-down with
-  each grant's vouched key. A grant, its key vouch, a revoke and an attestation count only if the
-  signer was authorised at its signed time and when this node received it (the receipt time is
-  persisted), so a revoked validator cannot backdate any of them into its old window. A grantor
-  whose nodeId an impostor holds keeps exactly its vouched authority; the impostor gets none.
-- **A forgery ends its session.** A signature that does not verify on a proven session closes it,
-  and its nodeId is not admitted again for 60 s.
+- **Authority follows the key; a revoke carries a cutoff.** A role grant must name `granteeKey`; it
+  confers its role only on that key, and a chain is verified top-down with each grant's vouched key.
+  A revoke signs a cutoff (by default its own time; a revoker may set it earlier, back to when the
+  revoked node stopped being trustworthy, but never before the revoker itself held rank). What the
+  revoked node signed before its cutoff — grants, key vouches, revokes, attestations — counts by
+  its rank when signed, for every node whenever it arrives; what it signed at or after the cutoff
+  never counts. When a node received a statement is no part of the rule, so nodes that learn a
+  history in different orders resolve the same authority. A grant also confers only while its
+  grantor still holds rank (MMP §6.6's cascade). A grantor whose nodeId an impostor holds keeps
+  exactly its vouched authority; the impostor gets none.
+- **A forgery in a session's own name ends the session.** A statement that names the session's own
+  peer as its signer and does not verify under the key that session proved closes it, and its
+  nodeId is not admitted again for 60 s. A statement the session relays for another signer is
+  verified under this node's binding for that signer, which may differ from the relayer's (a local
+  view); one that fails is dropped and counted (`relayed-signature-unverified`), and the relayer is
+  not charged.
 - **Admission attestations under `sym-attest-v1`.** Attestations, checkpoints and witnesses are
   signed under their own domain tags with every field covered, verified against the signer's bound
   key (never the delivering session), and exchanged only with sessions that negotiated the
@@ -90,8 +100,11 @@ Every store a peer can feed has a fixed bound. Reaching one never stops the node
   a newcomer is refused a durable binding and its live session still verifies what it signs. Key
   conflicts: at most 8 kept per nodeId and 1,024 in all, every one counted
   (`status().coreSecure.keyConflicts`).
-- **Role grants**: at most 65,536 records, 1,024 per grantor and 16 per (grantor, grantee) pair
-  (the anchor's own are not limited); a nodeId in a grant is canonical lowercase of at most 128
+- **Role grants**: at most 65,536 grants, 1,024 per grantor and 16 per (grantor, grantee) pair
+  (the anchor's own are not limited). No cap refuses a revoke: a revoker keeps at most as many
+  revokes for one grantee as this node holds grants for it (a revoke that arrives first waits for
+  the grant through `role-chain-fetch`), so revokes are bounded by grants and a revoker can fill
+  only its own allowance; a nodeId in a grant is canonical lowercase of at most 128
   characters, a role name at most 32. A delegation reaches at most 8 grants from the anchor, and
   role resolution is memoised (linear in the records). A record that arrives before its root is
   held only while its chain is fetched from the session that delivered it (`role-chain-fetch`): at
@@ -103,8 +116,12 @@ Every store a peer can feed has a fixed bound. Reaching one never stops the node
   4,000 verified statements a second in all (burst 20,000), spent only after it; checkpoints at most
   4 a second per attester (burst 128); at most 1,024 attesters, 32 checkpoints each, 256 witnesses
   per position.
-- **Records**: a category at most 256 KiB and the seven at most 960 KiB of text, refused before
-  anything encodes them; at most 8 new records a second per session are evaluated (burst 32).
+- **Records** (MMP §8.8.6 as draft spec PR #37 states it): a category's text at most 256 KiB after
+  NFC, the seven at most 512 KiB, the record's JSON encoding at most 720 KiB, so every record fits
+  one sealed frame. This node mints nothing larger, and refuses a received record over any limit
+  before anything validates, verifies or encodes it; a sealed frame longer than a 720 KiB record can
+  produce (983,062 base64url characters) is refused before it is opened. At most 8 new records a
+  second per session are evaluated (burst 32).
 - **Wake channels**: at most 1,024, learned only from a confirmed session's own nodeId (a peer's
   word about another node is never stored), dropped after 30 days unseen; when the table is full a
   new first-hand channel displaces the least recently seen one of the weakest source, so many
@@ -144,7 +161,14 @@ Every store a peer can feed has a fixed bound. Reaching one never stops the node
 
 - **First contact is trust on first proven use.** Without an anchor, an invite carrying the
   issuer's key, or a grant, the first key a session proves for a nodeId is the one bound. The
-  handshake proves possession, not intent.
+  handshake proves possession, not intent. A nodeId that never earned a durable binding here (no
+  admitted record, no directed exchange, no pin, no grant) is first contact again once its
+  sessions end. While another key's session holds a nodeId, the genuine node is refused with 1009,
+  and a node refused with 1009 does not retry until it restarts.
+- **A cutoff is the revoker's judgement.** Statements the revoked node signed before its revoke's
+  cutoff stand, so a revoked node can still backdate a statement to before the cutoff. A revoker
+  that suspects an earlier compromise sets the cutoff earlier; nothing can tell a backdated
+  statement from a timely one.
 - **Relay eviction.** `relay-auth` identity is not proven (MMP §4.4.1), and the relay replaces a
   connection that re-authenticates under the same nodeId (close 4004, §4.4.7). A token holder
   can therefore interrupt another node's relay path. It cannot impersonate it: it gets no
diff --git a/docs/WIRE-0.14.0.md b/docs/WIRE-0.14.0.md
index 80958be8..c60b8f9b 100644
--- a/docs/WIRE-0.14.0.md
+++ b/docs/WIRE-0.14.0.md
@@ -94,7 +94,8 @@ that delivered the record for the missing chain.
 ```
 
 - `grants`: at most 64 role-grant or role-revoke records, each the canonical object of its signed
-  fields only (`type, grantee, role?, grantedBy, grantedAt, granteeKey?, sig, sigAlg`). They are
+  fields only (`type, grantee, role?, grantedBy, grantedAt, granteeKey?, cutoff?, sig, sigAlg`;
+  `cutoff` on a revoke only, section 6). They are
   ordered top-down: each record comes after the records that root its grantor, up to the anchor
   (depth at most 8). For each named grantee the answer holds the records the server holds whose
   grantee it is, revokes included, each preceded by its grantor's chain.
@@ -109,7 +110,9 @@ server's whole store:
 
 - `after`: where the page starts, in the server's sync order: the anchor's records first, then
   those of each grantor the earlier ones reach, breadth first, each grantor's own records by
-  signed time; records no chain reaches come last. A page holds at most 64 records.
+  signed time; records no chain reaches come last; and every revoke not signed by the anchor after
+  every grant, so a revoke never comes before a grant it clears (section 6). A page holds at most
+  64 records.
 - `next`: present when another page follows; the client asks for it with `after: next`. A client
   asks for at most 1,024 pages per session, one page in flight at a time.
 
@@ -122,7 +125,9 @@ it.
 - A node sends a whole-store `role-chain-fetch` when a peer's `role-digest` (section 5) differs
   from its own.
 - A node sends `role-chain-fetch` when a role grant or revoke that arrived on a session is refused
-  as `unknown-grantor-key` (no chain reaches its grantor) or `unrooted`.
+  as `unknown-grantor-key` (no chain reaches its grantor) or `unrooted`, naming the grantor; and
+  when a revoke is refused as `nothing-to-revoke` (it arrived before the grant it clears, section
+  6), naming the revoke's grantee, whose own records the answer then carries.
   - It sends at most one fetch in flight per (session, grantor). Further early records for the
     same grantor join the fetch already in flight.
   - The early record is held in memory only for that fetch, as its signed fields only, under a key
@@ -138,10 +143,14 @@ it.
   nobody asked for, or that arrives on another session, is ignored.
 - Offers the grants to its store until a pass stores nothing, so their order does not matter.
   Each goes through the ordinary ingest: the gossip budget, verification with the vouched key and
-  the both-times rule (draft spec PR #33), storing as its signed fields only, and relaying once.
-  A grant in the answer whose signature does not verify ends the session (it is attributable).
-- Then offers each held record once more and drops it either way. Neither the answer's grants nor
-  the held records start a further fetch.
+  the cutoff rule (section 6), storing as its signed fields only, and relaying once. A grant in the
+  answer whose signature does not verify ends the session only when its grantor is the session's
+  own peer and the key that failed is the one the session proved; any other is dropped and counted,
+  since it was verified under this node's view of its grantor's keys, which the server's may not
+  share (section 7).
+- Then offers the held records again, in passes until one stores nothing (a held revoke can wait
+  for a held grant), and drops what is left. Neither the answer's grants nor the held records
+  start a further fetch.
 - A fetch that is not answered within 10 s, or whose session closes, releases its held records.
   They are dropped.
 
@@ -229,3 +238,85 @@ handshake timeout (`unconfirmed-by-peer`).
 in flight on that session, it asks for the sender's store with a whole-store `role-chain-fetch` (section 3), page
 by page. Each record goes through the ordinary ingest, so what the receiver already holds costs
 nothing and what is new is relayed once. A digest is a hint: nothing is taken on its word.
+
+---
+
+## 6. The revoke's `cutoff`: authority without receipt time (replaces draft spec PR #33's rule)
+
+**Why.** A signer's date is its own to write, so a revoked validator can still sign statements
+dated inside its old window. Draft spec PR #33 counted a statement only if its signer was
+authorised both at its signed time and when the receiver received it. That fails open for late
+receivers: a validator V legitimately revokes W on day 1, the anchor revokes V on day 3, and every
+node that receives V's revoke after day 3 (a new node, an anti-entropy sync, a store upgraded from a
+version that kept no receipt times) restores W's authority, while the nodes online on day 1 do not.
+Authority then depends on arrival order, and the mesh disagrees. sym 0.14.0 replaces the receipt
+time with a date the revoker signs. (The founder's ruling, 2026-10.)
+
+**Field.** A `role-revoke` carries `cutoff`: an integer, milliseconds since the epoch, with
+`0 <= cutoff <= grantedAt`. It is signed: the §6.5 grant payload gains `|<cutoff>` (decimal) at its
+end, appended only when the revoke carries one:
+
+```
+role-revoke|<grantee>|<role or empty>|<grantedBy>|<grantedAt>|<granteeKey or empty>|<cutoff>
+```
+
+A revoke without `cutoff` signs exactly the bytes MMP v2.0 signs today, and its cutoff is its
+`grantedAt`. A `cutoff` on a `role-grant`, a cutoff after `grantedAt`, a revoke `granteeKey` that is
+neither empty (absent) nor an unpadded base64url Ed25519 key (43 characters), or a `role` containing `|` makes the record
+malformed (so no two records sign the same bytes). sym 0.14.0 puts a cutoff on every revoke it
+signs: `revokeRole(nodeId, { cutoff })`, by default the revoke's own time.
+
+**The rule** (for §6.6). For a node N holding key K, its role at time T is resolved, not stored:
+
+1. The anchor holding its configured key is `anchor`.
+2. Otherwise take N's grants with `granteeKey` = K and `grantedAt <= T`, and N's revokes with
+   `cutoff <= T`. Replay them in `grantedAt` order (a revoke at its own `grantedAt`, even when that
+   is after T), starting from `participant`.
+3. A grant G by grantor P confers G's role if P, holding the key that signed G, resolves to a rank
+   at least G's role both at `G.grantedAt` and at T. (The second is §6.6's cascade: revoking a
+   grantor withdraws what it granted, for as long as it stays revoked.)
+4. A revoke R by revoker Q clears the role to `participant` if Q, holding the key that signed R,
+   resolves to `validator` or above, and to at least the role being cleared, both at `R.grantedAt`
+   and at `R.cutoff`. A revoker reaches back only over time it was itself authorised for.
+5. A rank is 0 when the resolved node already sits at the delegation depth (8, draft spec PR #36).
+   Cycles and chains that do not reach the anchor confer nothing.
+
+Every time in the rule is a signed time. Nothing depends on when a node received a record, so two
+nodes holding the same records resolve the same role, whatever order they learned them in.
+
+**What follows.**
+- A statement the revoked node signed **before** the cutoff (a grant, a key vouch, a revoke, an
+  attestation, each judged at its own signed time) stands, for every receiver, whenever it
+  arrives. A grant among them still confers only while its grantor holds rank (step 3).
+- A statement it signed **at or after** the cutoff never counts, even at times before the revoke
+  itself was signed: that is what stops backdating. The revoker chooses how far back trust is
+  withdrawn; nothing can tell a backdated statement before the cutoff from a timely one.
+- An attestation's signer counts with its role at the attestation's signed time.
+
+**Keeping a record.** A grant or revoke is kept (and relayed once) only when it is rooted: its
+grantor held the rank it needs (a grant: the rank it confers; a revoke: `validator`) at its signed
+time, and for a revoke at its cutoff too. A record from a grantor revoked later stays kept, and
+the resolution above decides its effect.
+
+**Revokes are never refused by a cap.** Grants are bounded per grantor, per (grantor, grantee) and
+in all. A revoke is not: a revoke refused by a full store would leave authority standing. Instead,
+a revoker other than the anchor keeps at most as many revokes for a grantee as the node holds
+grants for that grantee (`nothing-to-revoke` past that). A revoke that arrives before any grant it
+could clear is held for a `role-chain-fetch` naming its grantee (section 3), and the whole-store
+sync sends grants before revokes.
+
+---
+
+## 7. Who a failed signature is charged to
+
+**Why.** A statement relayed on a session (a record, an attestation, a checkpoint, a witness, a
+grant) is verified under the receiver's binding for its signer, and bindings are local views: the
+receiver may hold a squatter's session-scoped binding for that nodeId, or lack a vouch the relayer
+holds. Closing the relayer's session for a statement that fails there closed honest relaying peers
+whenever a squatter held a signer's nodeId (sym 0.14.0 re-review N1).
+
+**Rule.** A receiver ends a session for a signature that does not verify (sym: close, and refuse the
+nodeId for 60 s) only when the statement names the session's own proven peer as its signer and the
+key that failed is the key that session proved. Any other statement that fails is dropped, counted
+and never charged to the session that delivered it. Its frame is not marked seen, so a genuine copy
+from another peer is still taken.
diff --git a/lib/attestation-store.js b/lib/attestation-store.js
index c0b3255d..9d5e89ea 100644
--- a/lib/attestation-store.js
+++ b/lib/attestation-store.js
@@ -294,11 +294,8 @@ class AttestationStore {
     if (opts.ingested && !this._allowIngest(att.of, att.by, opts.now ?? Date.now())) {
       return { stored: false, reason: 'rate-limited' };
     }
-    // When this node received it (draft spec PR #33: an attestation counts by its signer's authority
-    // at its signed time AND at its receipt), kept and persisted with it when the caller says. One a
-    // line carries no receipt time for (written before 0.14) is treated as received at load
-    // (`loadedAt`).
-    if (Number.isFinite(opts.receivedAt) && att.receivedAt !== opts.receivedAt) att = { ...att, receivedAt: opts.receivedAt };
+    // No receipt time is kept: an attestation counts by its signer's role at its signed time, a revoke
+    // taking effect from its cutoff (re-review N2), so when this node received it plays no part.
 
     let mine = this._heldBy.get(att.by);
     if (mine) this._heldBy.delete(att.by);
@@ -651,8 +648,6 @@ class AttestationStore {
    *  malformed line is skipped, never fatal. Then a crashed rotation is tidied up, and a log that is
    *  over budget (by the same rule as at run time) is rotated. */
   _load() {
-    /** When this store was loaded: the receipt time of a record a line carries none for. */
-    this.loadedAt = Date.now();
     this._loading = true;
     this._replay(ATT_FILE, (o) => this.record(o));
     this._replay(CP_FILE, (o) => this.recordCheckpoint(o));
diff --git a/lib/core/cmb-encoder.js b/lib/core/cmb-encoder.js
index 889335b8..13a813f1 100644
--- a/lib/core/cmb-encoder.js
+++ b/lib/core/cmb-encoder.js
@@ -21,9 +21,6 @@ const { CAT7_CATEGORIES } = require('./cmb');
 // record-shape requires nothing, so this cannot cycle. It is the ONE answer to "where is the
 // container" — the encoder must not re-derive it, or the answer and the check drift apart again.
 const { resolveCategories, unreadableReason } = require('./record-shape');
-// The transport's frame bound, from the module that enforces it, so the record bound cannot drift
-// from it. frame-parser requires nothing but 'events', so this cannot cycle.
-const { MAX_FRAME_SIZE } = require('../frame-parser');
 
 // ── Content-Addressable Key ───────────────────────────────────
 
@@ -468,24 +465,30 @@ const DEFAULT_ROOM = 'default';
 /** §3.1.2: an agent id is 1–64 bytes. Enforced when a record is minted, never on receipt (below). */
 const MAX_NAME_BYTES = 64;
 /**
- * Text bounds. The spec says categories are bounded but gives no number. One category is at most a
- * quarter of a 1 MiB frame and the seven at most 960 KiB of text. These are minting rules, and since
- * 0.14.0 (security review D) the receiving bound for a v2.0 record as well (record-canonical.js): a
- * record over them is refused before anything encodes it. A pre-v2.0 record never enters Core Secure.
- *
- * They do not by themselves keep a record sendable, because a frame is not text: JSON escapes a `"`
- * as two bytes and a control character as six, and a record sent to a peer with a shared secret
- * travels with its categories sealed and base64-encoded, a 4/3 expansion. So a record is minted only
- * when the frame it would travel in fits MAX_FRAME_SIZE as well (assertRecordSendable).
+ * Record size limits (MMP §8.8.6 as draft spec PR meshcognition-website#37 states it; sym 0.14.0
+ * re-review). A record must fit one sealed frame: a frame is at most 1 MiB (§4.1), and a sealed
+ * `cmb-encrypted` frame carries its plaintext as base64url, a third larger, so about 768 KiB is the
+ * most one frame can carry. The limits, in bytes:
+ *
+ *   MAX_CATEGORY_BYTES  262,144 (256 KiB)  one category's text, UTF-8, after NFC
+ *   MAX_RECORD_TEXT_BYTES 524,288 (512 KiB)  the seven categories' texts together
+ *   MAX_RECORD_BYTES    737,280 (720 KiB)  the record's minified JSON encoding, the two-section
+ *                                           logical record with metadata.application.data included
+ *
+ * They are minting rules (an emitter never mints a record over any of them: createCMB, and anything
+ * that adds to a record after it, runs assertRecordSendable) and receiving rules (record-canonical.js
+ * refuses one before any other work; a sealed frame is refused by its length before it is opened).
+ * 720 KiB leaves room for the clear metadata, the envelope and the relay's routing wrapper: the
+ * largest record sealed is under 1 MiB less the relay allowance.
  */
 const MAX_CATEGORY_BYTES = 256 * 1024;
-const MAX_RECORD_TEXT_BYTES = 960 * 1024;
+const MAX_RECORD_TEXT_BYTES = 512 * 1024;
+const MAX_RECORD_BYTES = 720 * 1024;
 /**
- * What a `cmb` frame adds around its record at most, in bytes: the frame's own members (type,
- * timestamp, to, directed, _anchor), the E2E nonce and the relay envelope ({to, payload}). About 270
- * with 64-byte node ids.
+ * The longest `sealed` value a MAX_RECORD_BYTES plaintext can produce: ceil(4 × (737,280 + 16) / 3)
+ * base64url characters (the 16-byte AEAD tag included). A longer one is refused before it is opened.
  */
-const FRAME_ALLOWANCE_BYTES = 1024;
+const MAX_SEALED_CHARS = Math.ceil((4 * (MAX_RECORD_BYTES + 16)) / 3);
 /** What signing adds to the metadata (sig, sigAlg, assertionId: about 200 bytes), held in reserve
  *  until the record is signed, so a record measures the same before and after. */
 const SIGNATURE_RESERVE_BYTES = 256;
@@ -496,9 +499,13 @@ function sizeError(msg) {
   return e;
 }
 
+/** The UTF-8 length of a category's text after NFC (§8.8.6 measures the normalised text). */
+function textBytes(text) {
+  return Buffer.byteLength(text.normalize('NFC'), 'utf8');
+}
+
 /**
- * Throw ECMBSIZE when a category, or the record's text as a whole, is over its bound. Run when a
- * record is minted, never on receipt (see the text bounds above).
+ * Throw ECMBSIZE when a category, or the record's text as a whole, is over its limit (§8.8.6).
  * @param {object} categories
  */
 function assertRecordSize(categories) {
@@ -506,7 +513,7 @@ function assertRecordSize(categories) {
   for (const f of CAT7_CATEGORIES) {
     const text = categories?.[f]?.text;
     if (typeof text !== 'string') continue;
-    const n = Buffer.byteLength(text, 'utf8');
+    const n = textBytes(text);
     if (n > MAX_CATEGORY_BYTES) throw sizeError(`${f} is ${n} bytes; a category is at most ${MAX_CATEGORY_BYTES}`);
     total += n;
   }
@@ -520,33 +527,27 @@ function assertAgentId(createdBy) {
 }
 
 /**
- * The largest frame `record` can travel in: its JSON with the categories sealed for a peer (AES-GCM
- * tag, base64, quotes) where that is the larger, plus FRAME_ALLOWANCE_BYTES, plus
- * SIGNATURE_RESERVE_BYTES until it is signed. Sealing is what every peer with a shared secret gets,
- * and the only form the relay carries, so this is the size to bound.
+ * The record's encoded size as §8.8.6 measures it: its minified JSON, metadata.application.data
+ * included, plus SIGNATURE_RESERVE_BYTES until it is signed.
  * @param {object} record
  * @returns {number}
  */
-function recordFrameBytes(record) {
-  const whole = Buffer.byteLength(JSON.stringify(record), 'utf8');
-  const cats = record && record.categories && typeof record.categories === 'object'
-    ? Buffer.byteLength(JSON.stringify(record.categories), 'utf8')
-    : 0;
-  const sealed = 4 * Math.ceil((cats + 16) / 3) + 2;
+function recordBytes(record) {
   const signed = !!(record && record.metadata && record.metadata.sig);
-  return whole - cats + Math.max(cats, sealed) + FRAME_ALLOWANCE_BYTES + (signed ? 0 : SIGNATURE_RESERVE_BYTES);
+  return Buffer.byteLength(JSON.stringify(record), 'utf8') + (signed ? 0 : SIGNATURE_RESERVE_BYTES);
 }
 
 /**
- * Throw ECMBSIZE when `record` would not fit a frame (recordFrameBytes > MAX_FRAME_SIZE), so a node
- * never stores, as sent, a record no transport can carry. createCMB runs it; so does anything that
- * adds to a record after createCMB (remember()'s payload).
+ * Throw ECMBSIZE when `record` is over any §8.8.6 limit, so a node never stores, as sent, a record no
+ * session can carry. createCMB runs it; so does anything that adds to a record after createCMB
+ * (remember()'s payload).
  * @param {object} record
  */
 function assertRecordSendable(record) {
-  const n = recordFrameBytes(record);
-  if (n > MAX_FRAME_SIZE) {
-    throw sizeError(`the record would travel in a frame of up to ${n} bytes (its categories sealed for a peer); a frame is at most ${MAX_FRAME_SIZE}`);
+  assertRecordSize(record && record.categories);
+  const n = recordBytes(record);
+  if (n > MAX_RECORD_BYTES) {
+    throw sizeError(`the record encodes to ${n} bytes; a record is at most ${MAX_RECORD_BYTES} (it must fit one sealed frame)`);
   }
 }
 
@@ -767,10 +768,12 @@ module.exports = {
   assertRecordSize,
   assertAgentId,
   assertRecordSendable,
-  recordFrameBytes,
+  recordBytes,
+  textBytes,
   DEFAULT_ROOM,
   MAX_CATEGORY_BYTES,
   MAX_RECORD_TEXT_BYTES,
-  FRAME_ALLOWANCE_BYTES,
+  MAX_RECORD_BYTES,
+  MAX_SEALED_CHARS,
   SIGNATURE_RESERVE_BYTES,
 };
diff --git a/lib/core/record-canonical.js b/lib/core/record-canonical.js
index fe02e3b3..3e85661d 100644
--- a/lib/core/record-canonical.js
+++ b/lib/core/record-canonical.js
@@ -32,7 +32,7 @@
  */
 
 const { CAT7_CATEGORIES } = require('./cmb');
-const { categoryKeyV1, MAX_CATEGORY_BYTES, MAX_RECORD_TEXT_BYTES } = require('./cmb-encoder');
+const { categoryKeyV1, textBytes, MAX_CATEGORY_BYTES, MAX_RECORD_TEXT_BYTES, MAX_RECORD_BYTES } = require('./cmb-encoder');
 
 const LOWER_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 /** A canonical nodeId: a lowercase UUID, or (tests and older hosts) another lowercase identifier. */
@@ -45,12 +45,13 @@ const B64URL = /^[A-Za-z0-9_-]*$/;
 const MEDIA = /^[a-z0-9][a-z0-9!#$&^_.+/-]*$/;
 
 /**
- * A category's text, and the seven together, at most what this release mints (cmb-encoder): a record
- * over that is refused at ingress, before anything encodes it (security review D, record-flood). MMP
- * sets no category bound of its own (the 1 MiB frame bounds the whole); this reverses the 0.14.0
- * review's C-F4 acceptance of larger categories from other implementations, by the later ruling.
+ * The record size limits (MMP §8.8.6, draft spec PR meshcognition-website#37): a category's text at
+ * most 256 KiB after NFC, the seven together at most 512 KiB, the record's minified JSON at most
+ * 720 KiB. They are what this release mints (cmb-encoder), and a received record over any of them is
+ * refused first, before schema validation, key recomputation or signature verification
+ * (sizeRefusal). This reverses the 0.14.0 review's C-F4 acceptance of larger categories from other
+ * implementations, by the later ruling.
  */
-const MAX_TEXT = MAX_CATEGORY_BYTES;
 const MAX_PARENTS = 256;
 const MAX_REF = 256;
 
@@ -83,7 +84,6 @@ function category(name, v) {
   const allowed = name === 'mood' ? new Set(['text', 'meta', 'valence', 'arousal']) : new Set(['text', 'meta']);
   for (const k of Object.keys(v)) if (!allowed.has(k)) throw new RecordShapeError(`category ${name} carries an unknown member`);
   if (typeof v.text !== 'string') throw new RecordShapeError(`category ${name} has no text`);
-  if (Buffer.byteLength(v.text, 'utf8') > MAX_TEXT) throw new RecordShapeError(`category ${name} is too long`);
   if (name === 'mood') {
     // Validated as the schema types them, then dropped: unsigned (§8.8.4).
     for (const k of ['valence', 'arousal']) {
@@ -115,6 +115,28 @@ function application(a) {
   return { mediaType: a.mediaType, schema: a.schema, encoding: a.encoding, byteLength: a.byteLength, digest: a.digest, data: a.data };
 }
 
+/**
+ * §8.8.6: refuse a record over a size limit before any other work on it (a RecordShapeError naming
+ * the limit). The encoded size is the record as received, every member counted; texts are measured
+ * where they are strings (the schema check that follows refuses any that is not).
+ * @param {object} cmb - a plain object
+ */
+function sizeRefusal(cmb) {
+  let encoded;
+  try { encoded = Buffer.byteLength(JSON.stringify(cmb), 'utf8'); } catch { throw new RecordShapeError('not encodable'); }
+  if (encoded > MAX_RECORD_BYTES) throw new RecordShapeError(`the record is too long (${encoded} bytes encoded; at most ${MAX_RECORD_BYTES})`);
+  const c = isPlain(cmb.categories) ? cmb.categories : {};
+  let total = 0;
+  for (const f of CAT7_CATEGORIES) {
+    const text = isPlain(c[f]) ? c[f].text : undefined;
+    if (typeof text !== 'string') continue;
+    const n = textBytes(text);
+    if (n > MAX_CATEGORY_BYTES) throw new RecordShapeError(`category ${f} is too long (${n} bytes; at most ${MAX_CATEGORY_BYTES})`);
+    total += n;
+  }
+  if (total > MAX_RECORD_TEXT_BYTES) throw new RecordShapeError(`the categories together are too long (${total} bytes; at most ${MAX_RECORD_TEXT_BYTES})`);
+}
+
 /**
  * The signed projection of a received v2.0 record, or a RecordShapeError (`.reason`).
  * @param {object} cmb
@@ -122,18 +144,16 @@ function application(a) {
  */
 function canonicalRecordV2_0(cmb) {
   if (!isPlain(cmb)) throw new RecordShapeError('not an object');
+  sizeRefusal(cmb);
   for (const k of Object.keys(cmb)) if (k !== 'categories' && k !== 'metadata') throw new RecordShapeError('carries a member outside categories and metadata');
   const c = cmb.categories;
   if (!isPlain(c)) throw new RecordShapeError('no categories section');
   // An unrecognised category is dropped, not refused (§8 forward compatibility, draft spec PR #34).
   const categories = {};
-  let total = 0;
   for (const f of CAT7_CATEGORIES) {
     if (c[f] === undefined) throw new RecordShapeError(`category ${f} is missing`);
     categories[f] = category(f, c[f]);
-    total += Buffer.byteLength(categories[f].text, 'utf8');
   }
-  if (total > MAX_RECORD_TEXT_BYTES) throw new RecordShapeError('the categories together are too long');
   const m = cmb.metadata;
   if (!isPlain(m)) throw new RecordShapeError('no metadata section');
   for (const k of Object.keys(m)) if (!METADATA_MEMBERS.has(k)) throw new RecordShapeError(`metadata carries an unknown member`);
@@ -178,4 +198,4 @@ function signedProjection(cmb) {
   return canonicalRecordV2_0({ categories: cmb.categories, metadata: cmb.metadata });
 }
 
-module.exports = { canonicalRecordV2_0, signedProjection, RecordShapeError, isCanonicalNodeId: isNodeId, isLowerUuid, LOWER_UUID };
+module.exports = { canonicalRecordV2_0, signedProjection, sizeRefusal, RecordShapeError, isCanonicalNodeId: isNodeId, isLowerUuid, LOWER_UUID };
diff --git a/lib/core/role-grant.js b/lib/core/role-grant.js
index 5c09e12a..c89e367c 100644
--- a/lib/core/role-grant.js
+++ b/lib/core/role-grant.js
@@ -42,11 +42,20 @@ function roleRank(role) {
  * tamper-evidently, because swapping the key breaks the grantor's signature (the
  * relayer never vouches). Empty when absent (revokes, key-less grants) — both signer
  * and verifier use this function, so the round-trip is stable either way.
- * @param {object} g - { type, grantee, role, grantedBy, grantedAt, granteeKey? }
+ *
+ * A role-revoke may carry `cutoff` (ms epoch, at most its grantedAt): the revoked node's statements
+ * signed at or after the cutoff never count, those signed before it stand (re-review N2; draft spec
+ * text in docs/WIRE-0.14.0.md §6). It is signed as `|<cutoff>` appended to the payload, only when
+ * present.
+ * @param {object} g - { type, grantee, role, grantedBy, grantedAt, granteeKey?, cutoff? }
  * @returns {Buffer}
  */
 function grantPayload(g) {
-  return Buffer.from(`${g.type}|${g.grantee}|${g.role || ''}|${g.grantedBy}|${g.grantedAt}|${g.granteeKey || ''}`, 'utf8');
+  // A revoke's cutoff (sym 0.14, re-review N2) is appended only when the revoke carries one, so a
+  // revoke without it signs exactly the bytes it always signed. Unambiguous: a revoke's granteeKey,
+  // when present, is 43 base64url characters (no `|`), and the cutoff is a decimal integer.
+  const cutoff = g.type === 'role-revoke' && g.cutoff !== undefined ? `|${g.cutoff}` : '';
+  return Buffer.from(`${g.type}|${g.grantee}|${g.role || ''}|${g.grantedBy}|${g.grantedAt}|${g.granteeKey || ''}${cutoff}`, 'utf8');
 }
 
 /**
diff --git a/lib/frame-handler.js b/lib/frame-handler.js
index 8d05408c..bdb4ae09 100644
--- a/lib/frame-handler.js
+++ b/lib/frame-handler.js
@@ -262,8 +262,12 @@ class FrameHandler {
   }
 
   /**
-   * A verified record was admitted (stored): its author's binding protects history now and never
-   * expires (design D3 binding lifetime). Only an admission earns that (security review D).
+   * A verified record was accepted, and its author's binding protects something now, so it is made
+   * durable and never expires (design D3 binding lifetime): a room-bound record admitted to memory
+   * (it is history), or a record its author signed to this node and this node accepted for delivery
+   * (0.14.0 re-review N3: directed exchange is an earned relationship; the conversation is what a
+   * squatter would otherwise take over once the author's sessions end). Nothing else earns it: a
+   * handshake, gossip, a refused record (security review D).
    * @private
    */
   _noteAdmitted(msg) {
@@ -611,9 +615,11 @@ class FrameHandler {
     const rec = msg.cmb;
     const v = verifyCMB(rec, authorKey);
     if (!v.valid) {
-      // A bad signature on a proven session is attributable: an honest peer sends and relays only
-      // records it verified (review finding D). The node is told, and closes the session.
-      if (v.error === 'bad-signature' && typeof this._node._penaliseForgery === 'function') this._node._penaliseForgery(this._sessionOf.get(msg), 'record');
+      // A bad signature is attributable only when the record names the session's own peer as its
+      // author (0.14.0 re-review N1): the node then closes the session. A relayed record that fails
+      // under this node's binding for its author is dropped and counted, never charged to the relayer,
+      // whose binding for that author may differ from this node's.
+      if (v.error === 'bad-signature' && typeof this._node._penaliseForgery === 'function') this._node._penaliseForgery(this._sessionOf.get(msg), 'record', { author: md.createdByNodeId, key: authorKey });
       return refuse('invalid', v.error || 'invalid');
     }
     // A record that declares the v2.0 suite but is malformed for it has no preimage: assertionIdV2_0
@@ -1084,6 +1090,12 @@ class FrameHandler {
       return;
     }
 
+    // A record signed to this node by its author, verified, fresh, new and within the session's
+    // budget, is accepted for delivery from here on whatever SVAF decides about memory (it surfaces,
+    // as a message, a stored remix or remixed:false): directed exchange earns the author a durable
+    // binding (0.14.0 re-review N3), as an admitted record does.
+    if (authenticatedDirected && !msg._legacyImport) this._noteAdmitted(msg);
+
     // THE HOST HOOK (design D1, review H9; finding G): a record that passed every check, with the
     // proven facts of the session that delivered it — raised ONCE per assertion identity, after the
     // de-duplication above, never again for a copy (a replay by its author, a relay, a reconnect).
diff --git a/lib/node.js b/lib/node.js
index daf0478f..ab19ce11 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -30,7 +30,7 @@ const { MemoryStore } = require('./memory-store');
 const { AttestationStore, chainHash, isPosition, isCanonicalSig } = require('./attestation-store');
 const { RoleGrantStore, canonicalGrant, malformedGrant } = require('./role-grant-store');
 const { RosterKeyRegistry, keyFingerprint } = require('./roster-keys');
-const { signedProjection } = require('./core/record-canonical');
+const { signedProjection, isLowerUuid } = require('./core/record-canonical');
 /** A stored record's signed projection, or null for one that is not a v2.0 record. */
 const projectionOrNull = (cmb) => {
   if (!cmb || !cmb.metadata || cmb.metadata.signatureSuite !== 'mmp-sig-v2.0') return null;
@@ -161,6 +161,8 @@ const CHECKPOINT_BURST = 128;
 const GOSSIP_REPORT_MS = 10000;
 /** Peers with a budget held at once; the least recently active goes first, in O(1). */
 const GOSSIP_MAX_PEERS = 4096;
+/** A room as signed statements compare it: NFC (this node's room is NFC; sym-attest-v1 signs nfc(room)). */
+const nfcRoom = (r) => (typeof r === 'string' ? r.normalize('NFC') : r);
 /** A peer that delivered a forged signature is not admitted again for this long (security review D). */
 const FORGERY_PENALTY_MS = 60_000;
 /** role-chain-fetch (design D3): records held per session while their chain is fetched, and for how long. */
@@ -274,6 +276,14 @@ function trySend(transport, frame) {
   return transport && transport.send(frame) !== false ? { ok: true } : { ok: false, reason: NOT_SENT.SEND_FAILED };
 }
 
+/** Throw EBADTO unless `to` is absent (null/undefined: room-bound) or a lowercase UUID (§3.1.1). */
+function assertAddressee(to) {
+  if (to === undefined || to === null || isLowerUuid(to)) return;
+  const e = new TypeError(`to must be a nodeId, a lowercase UUID (got ${JSON.stringify(String(to).slice(0, 40))})`);
+  e.code = 'EBADTO';
+  throw e;
+}
+
 /** The schema of the signed application section remember({ payload }) carries (§8.8.3). */
 const PAYLOAD_SCHEMA = 'https://sym.bot/schema/payload-v1.json';
 
@@ -1082,9 +1092,24 @@ class SymNode extends EventEmitter {
     return this._emitGrant({ type: 'role-grant', grantee: granteeNodeId, role, granteeKey });
   }
 
-  /** Revoke a peer's granted role (signed role-revoke, gossiped). */
-  revokeRole(granteeNodeId) {
-    return this._emitGrant({ type: 'role-revoke', grantee: granteeNodeId });
+  /**
+   * Revoke a peer's granted role (signed role-revoke, gossiped). The revoke carries a cutoff
+   * (re-review N2): the revoked node's statements signed at or after it never count, and those signed
+   * before it stand for every receiver. It defaults to now (the revoke's own signed time); pass an
+   * earlier `opts.cutoff` (ms epoch) to withdraw trust from the time a node's key or judgement was
+   * compromised. A revoker can reach back only over time it was itself authorised for.
+   * @param {string} granteeNodeId
+   * @param {{ cutoff?: number }} [opts]
+   * @returns {object|null} the signed revoke, or null
+   */
+  revokeRole(granteeNodeId, opts = {}) {
+    const at = Date.now();
+    const cutoff = opts.cutoff === undefined ? at : opts.cutoff;
+    if (!Number.isSafeInteger(cutoff) || cutoff < 0 || cutoff > at) {
+      this._log(`Role revoke for ${String(granteeNodeId).slice(0, 8)} not made: the cutoff must be a time (ms) no later than now`);
+      return null;
+    }
+    return this._emitGrant({ type: 'role-revoke', grantee: granteeNodeId, cutoff }, at);
   }
 
   /**
@@ -1110,11 +1135,11 @@ class SymNode extends EventEmitter {
   }
 
   /** @private Sign + record + gossip a grant/revoke. */
-  _emitGrant(partial) {
+  _emitGrant(partial, at = Date.now()) {
     // A grant vouches for the grantee's nodeId↔key binding (granteeKey, bound into the signed
     // payload): nodes that never met the grantee learn its key from this rooted grant. Revokes carry
-    // no key.
-    const g = { ...partial, grantedBy: this.nodeId, grantedAt: Date.now() };
+    // no key; they carry a cutoff.
+    const g = { type: partial.type, grantee: partial.grantee, ...(partial.role ? { role: partial.role } : {}), grantedBy: this.nodeId, grantedAt: at, ...(partial.granteeKey ? { granteeKey: partial.granteeKey } : {}), ...(partial.cutoff !== undefined ? { cutoff: partial.cutoff } : {}) };
     try {
       signGrant(g, this._identity.privateKey);
       const r = this._roleGrants.record(g);
@@ -1157,7 +1182,15 @@ class SymNode extends EventEmitter {
     const r = this._roleGrants.record(g);
     if (r.stored) this._gossipToRoster({ type: r.grant.type, grant: r.grant }, fromPeerId);
     else if (r.reason === 'unrooted' && hold) this._holdForChain(session, g);
-    else if (r.reason === 'bad-signature') this._penaliseForgery(session, 'role-grant');
+    // A revoke that arrived before the grant it clears (re-review N4): the grantee's own records are
+    // fetched from the session that delivered it, and the revoke is offered again with them.
+    else if (r.reason === 'nothing-to-revoke' && hold) this._holdForChain(session, g, g.grantee);
+    else if (r.reason === 'bad-signature') {
+      // Verified against the keys this store's chain vouches for the grantor, not the session's: the
+      // session is charged only when the grantor is its own peer and its proven key was among them.
+      const own = session && g.grantedBy === session.nodeId && this._roleGrants.grantorKeys(g.grantedBy).includes(session.identityKey);
+      this._penaliseForgery(session, 'role-grant', { author: g.grantedBy, key: own ? session.identityKey : null });
+    }
     return { ok: r.stored, reason: r.reason };
   }
 
@@ -1172,7 +1205,7 @@ class SymNode extends EventEmitter {
    * a Legacy Import session, or the answer itself) is not held.
    * @private
    */
-  _holdForChain(session, g) {
+  _holdForChain(session, g, missing = g.grantedBy) {
     if (!session || session.legacy || !session.confirmed || session.closed || typeof session.send !== 'function') return;
     if (malformedGrant(g)) return;
     // Held as its signed fields only (bounded: canonical nodeIds of at most 128 characters, a role
@@ -1181,7 +1214,7 @@ class SymNode extends EventEmitter {
     const h = session._chainHold || (session._chainHold = { grants: new Map(), fetches: new Map(), bytes: 0 });
     // Keyed by every field the signature covers and the signature: a forged copy sent ahead of the
     // genuine record is a different entry, so it cannot keep the genuine one out.
-    const holdKey = `${g.type}|${g.grantee}|${g.role || ''}|${g.grantedBy}|${g.grantedAt}|${g.granteeKey || ''}|${g.sig}`;
+    const holdKey = `${g.type}|${g.grantee}|${g.role || ''}|${g.grantedBy}|${g.grantedAt}|${g.granteeKey || ''}|${g.cutoff ?? ''}|${g.sig}`;
     if (h.grants.has(holdKey)) return;
     const bytes = holdKey.length * 2;
     if (h.grants.size >= CHAIN_HOLD_MAX || h.bytes + bytes > CHAIN_HOLD_BYTES) {
@@ -1189,14 +1222,14 @@ class SymNode extends EventEmitter {
       return;
     }
     let reqId = null;
-    for (const [id, f] of h.fetches) if (f.grantee === g.grantedBy) { reqId = id; break; }
+    for (const [id, f] of h.fetches) if (f.grantee === missing) { reqId = id; break; }
     if (!reqId) {
       reqId = `rc-${crypto.randomBytes(8).toString('hex')}`;
       const timer = setTimeout(() => this._chainFetchDone(session, reqId, false), this._chainFetchTimeoutMs);
       if (timer.unref) timer.unref();
-      h.fetches.set(reqId, { grantee: g.grantedBy, timer });
+      h.fetches.set(reqId, { grantee: missing, timer });
       this._chainStats.fetched++;
-      session.send({ type: 'role-chain-fetch', reqId, grantees: [g.grantedBy] });
+      session.send({ type: 'role-chain-fetch', reqId, grantees: [missing] });
     }
     h.grants.set(holdKey, { grant: g, reqId, bytes });
     h.bytes += bytes;
@@ -1209,15 +1242,27 @@ class SymNode extends EventEmitter {
     if (!f) return;
     clearTimeout(f.timer);
     h.fetches.delete(reqId);
+    const mine = [];
     for (const [k, e] of [...h.grants]) {
       if (e.reqId !== reqId) continue;
       h.grants.delete(k);
       h.bytes -= e.bytes || 0;
-      // Offered once more, not held again: whatever it still lacks, it goes.
-      if (answered && !session.closed) {
-        const r = this._ingestRoleGrant(e.grant, session.nodeId, session, { hold: false });
-        if (r.ok) this._chainStats.resolved++;
+      mine.push(e.grant);
+    }
+    // Offered again, not held again: in passes until one stores nothing, since held records can root
+    // one another (a revoke held for the grant it clears, both held for their grantor's chain).
+    // Whatever one still lacks then, it goes.
+    let left = answered ? mine : [];
+    let progress = true;
+    while (progress && left.length && !session.closed) {
+      progress = false;
+      const next = [];
+      for (const g of left) {
+        const r = this._ingestRoleGrant(g, session.nodeId, session, { hold: false });
+        if (r.ok) { this._chainStats.resolved++; progress = true; }
+        else if (r.reason === 'unrooted' || r.reason === 'unknown-grantor-key' || r.reason === 'nothing-to-revoke') next.push(g);
       }
+      left = next;
     }
     if (!answered) this._chainStats.timedOut++;
   }
@@ -1243,7 +1288,7 @@ class SymNode extends EventEmitter {
         const r = this._ingestRoleGrant(g, session.nodeId, session, { hold: false });
         if (session.closed) return; // a forged grant in the answer ended the session
         if (r.ok) progress = true;
-        else if (r.reason === 'unrooted' || r.reason === 'unknown-grantor-key') next.push(g);
+        else if (r.reason === 'unrooted' || r.reason === 'unknown-grantor-key' || r.reason === 'nothing-to-revoke') next.push(g);
       }
       left = next;
     }
@@ -1418,7 +1463,7 @@ class SymNode extends EventEmitter {
       this._attestHead = chainHash(att.sig); // sha256 of the signature's bytes (sym-attest-v1 §5.1)
       // Index it — every gating event this node makes enters its own chain + the
       // per-CMB audit trail, whether or not it produced a stored remix.
-      this._attestations.record(att, { receivedAt: att.at });
+      this._attestations.record(att);
       // Gossip it to the roster so any member can reconstruct the cross-mesh audit
       // trail for this CMB. _peers are same-room (mDNS service-type isolation), so
       // the fan-out is roster-scoped by construction.
@@ -1444,18 +1489,14 @@ class SymNode extends EventEmitter {
   }
 
   /**
-   * The role an attestation's signer counts with (draft spec PR #33): the lower of its role at the
-   * attestation's signed time `at` and at the time this node received it. A validator revoked by then
-   * cannot weigh in by dating an attestation inside its old window; one that counted when received
-   * keeps its standing after a later revoke.
+   * The role an attestation's signer counts with: its role at the attestation's signed time `at`
+   * (re-review N2). A revoke takes effect from its cutoff, so a revoked validator's attestation dated
+   * at or after the cutoff counts as a participant's, and one dated before it keeps its standing, for
+   * every receiver whenever it arrives. When this node received it plays no part.
    * @private
    */
   _attesterRole(att) {
-    const at = Number.isFinite(att && att.at) ? att.at : 0;
-    const recv = Number.isFinite(att && att.receivedAt) ? att.receivedAt : (this._attestations.loadedAt ?? Date.now());
-    const a = this.resolveRole(att.by, at);
-    const b = this.resolveRole(att.by, recv);
-    return roleRank(a) <= roleRank(b) ? a : b;
+    return this.resolveRole(att.by, Number.isFinite(att && att.at) ? att.at : 0);
   }
 
   /**
@@ -1588,7 +1629,7 @@ class SymNode extends EventEmitter {
    */
   _ingestCheckpoint(cp, fromPeerId, session = null) {
     if (!cp || !cp.by || cp.upto_seq === undefined || !cp.root || !sigOk(cp.sig)) return { ok: false, reason: 'malformed' };
-    if (cp.roster && this._room && cp.roster !== this._room) return { ok: false, reason: 'roster-mismatch' };
+    if (cp.roster && this._room && nfcRoom(cp.roster) !== this._room) return { ok: false, reason: 'roster-mismatch' };
     // A position is an integer; the signature covers its text, so a re-spelled one is refused here,
     // before any signature check. A copy of a held checkpoint (same position, same root), of a
     // conflicting one already refused, or one older than every position held, is dropped unverified:
@@ -1609,7 +1650,7 @@ class SymNode extends EventEmitter {
     const key = this._identityKey(cp.by);
     if (!key) return { ok: false, reason: 'unknown-attester-key' };
     if (!this._gossipBudget(fromPeerId, 'checkpoint', cp.by)) return { ok: false, reason: 'over-budget' };
-    if (!verifyCheckpoint(cp, key).valid) { this._penaliseForgery(session, 'checkpoint'); return { ok: false, reason: 'bad-signature' }; }
+    if (!verifyCheckpoint(cp, key).valid) { this._penaliseForgery(session, 'checkpoint', { author: cp.by, key }); return { ok: false, reason: 'bad-signature' }; }
     if (!this._gossipCeiling(fromPeerId, 'checkpoint', cp.by)) return { ok: false, reason: 'over-ceiling' };
     // A verified gossip statement does not make its signer's binding durable (security review D:
     // only an admitted record, a grant in effect or a pin does; a fresh identity signs statements free).
@@ -1668,26 +1709,49 @@ class SymNode extends EventEmitter {
   }
 
   /**
-   * A frame on a proven session carried a signature that does not verify (security review D). The
-   * session is attributable (its frames are sealed or encrypted under keys only that peer holds), and
-   * an honest peer relays only what it verified, so the session ends ('forged-signature') and its
-   * nodeId is not admitted again for FORGERY_PENALTY_MS. A Legacy Import session is not attributable
-   * this way: its frames are only dropped.
+   * A frame on a proven session carried a signature that does not verify (security review D). Whose
+   * fault that is depends on who the statement names as its signer, because verification uses THIS
+   * node's binding for the signer, and bindings are local views: another honest node may hold a
+   * different one (this node's may be a squatter's session-scoped binding, or a vouch it lacks).
+   *
+   *   - The signer is the session's own proven peer, and the key that failed is the one the session
+   *     proved: the peer signed or sent a statement in its own name that its own key did not sign.
+   *     That is attributable (its frames are sealed under keys only that peer holds), so the session
+   *     ends ('forged-signature') and its nodeId is not admitted again for FORGERY_PENALTY_MS.
+   *   - Anyone else (a relayed statement): the delivering peer verified it under ITS binding for the
+   *     signer, which may differ from this node's. The statement is dropped and counted
+   *     (`relayed-signature-unverified`), said once a minute per peer and kind, and never charged to
+   *     the delivering session (0.14.0 re-review N1: the penalty used to close honest relayers whenever
+   *     a squatter held the signer's nodeId here).
+   *
+   * A Legacy Import session is not attributable this way: its frames are only dropped.
    * @param {object} session
-   * @param {string} kind - what was forged: record | attestation | checkpoint | witness | role-grant
+   * @param {string} kind - what failed: record | attestation | checkpoint | witness | role-grant
+   * @param {{ author: string, key?: string|null }} signer - the nodeId the statement names as its
+   *   signer, and (when the key tried is not simply this node's binding for it) the key that failed;
+   *   null when the session's proven key was not among those tried.
+   * @returns {boolean} whether the session was penalised
    * @private
    */
-  _penaliseForgery(session, kind) {
-    if (!session || session.legacy || !session.confirmed || session.closed || typeof session.close !== 'function') return;
+  _penaliseForgery(session, kind, { author, key } = {}) {
+    if (!session || session.legacy || !session.confirmed || session.closed || typeof session.close !== 'function') return false;
     const nodeId = session.nodeId;
+    const own = typeof author === 'string' && author === nodeId && (key === undefined || (!!key && key === session.identityKey));
+    if (!own) {
+      this._relayedUnverified = (this._relayedUnverified || 0) + 1;
+      this.emit('metric', { type: 'relayed-signature-unverified', kind, peer: nodeId, author: typeof author === 'string' ? author.slice(0, 128) : null });
+      this._sayOncePerMinute(`relayed-unverified|${nodeId}|${kind}`, `[sym-security] a ${kind} signed as ${String(author).slice(0, 8)}, relayed by ${session.name || String(nodeId).slice(0, 8)}, does not verify under this node's key for its signer: dropped (the relaying peer is not charged; its binding for the signer may differ from this node's)`);
+      return false;
+    }
     this._forgeryCount = (this._forgeryCount || 0) + 1;
     if (!this._forgeryPenalty) this._forgeryPenalty = new Map();
     this._forgeryPenalty.delete(nodeId);
     if (this._forgeryPenalty.size >= GOSSIP_MAX_PEERS) this._forgeryPenalty.delete(this._forgeryPenalty.keys().next().value);
     this._forgeryPenalty.set(nodeId, Date.now() + FORGERY_PENALTY_MS);
     this.emit('metric', { type: 'forged-signature', kind, peer: nodeId });
-    this._sayOncePerMinute(`forged|${nodeId}`, `[sym-security] ${session.name || String(nodeId).slice(0, 8)} delivered a ${kind} whose signature does not verify: session closed, not admitted again for ${FORGERY_PENALTY_MS / 1000} s`);
+    this._sayOncePerMinute(`forged|${nodeId}`, `[sym-security] ${session.name || String(nodeId).slice(0, 8)} delivered a ${kind} in its own name whose signature does not verify under the key its session proved: session closed, not admitted again for ${FORGERY_PENALTY_MS / 1000} s`);
     session.close('forged-signature');
+    return true;
   }
 
   /** @private Whether `nodeId` is inside a forgery penalty (and drop it when it has run out). */
@@ -1848,7 +1912,7 @@ class SymNode extends EventEmitter {
    */
   _ingestWitness(w, fromPeerId, session = null) {
     if (!w || !w.attester || w.upto_seq === undefined || !w.root || !w.by || !sigOk(w.sig)) return { ok: false, reason: 'malformed' };
-    if (w.roster && this._room && w.roster !== this._room) return { ok: false, reason: 'roster-mismatch' };
+    if (w.roster && this._room && nfcRoom(w.roster) !== this._room) return { ok: false, reason: 'roster-mismatch' };
     if (!isPosition(w.upto_seq)) return { ok: false, reason: 'malformed' };
     // A copy of a witness held or waiting, or of a conflicting one already refused: dropped unverified.
     const held = this._attestations.witnessSeen(w.attester, w.upto_seq, w.by);
@@ -1858,7 +1922,7 @@ class SymNode extends EventEmitter {
     const key = this._identityKey(w.by);
     if (!key) return { ok: false, reason: 'unknown-witness-key' };
     if (!this._gossipBudget(fromPeerId, 'witness', w.by)) return { ok: false, reason: 'over-budget' };
-    if (!verifyWitness(w, key).valid) { this._penaliseForgery(session, 'witness'); return { ok: false, reason: 'bad-signature' }; }
+    if (!verifyWitness(w, key).valid) { this._penaliseForgery(session, 'witness', { author: w.by, key }); return { ok: false, reason: 'bad-signature' }; }
     if (!this._gossipCeiling(fromPeerId, 'witness', w.by)) return { ok: false, reason: 'over-ceiling' };
     // A verified gossip statement does not make its signer's binding durable (security review D:
     // only an admitted record, a grant in effect or a pin does; a fresh identity signs statements free).
@@ -1922,7 +1986,8 @@ class SymNode extends EventEmitter {
   _ingestAttestation(att, fromPeerId, fromPeerName, session = null) {
     if (!att || !sigOk(att.sig) || !att.of || !att.by) return { ok: false, reason: 'malformed' };
     // Roster scope (defense in depth — gossip already stays in-room).
-    if (att.roster && this._room && att.roster !== this._room) {
+    // Compared as NFC, the form the attestation signs its room in (sym-attest-v1) and this node's room.
+    if (att.roster && this._room && nfcRoom(att.roster) !== this._room) {
       return { ok: false, reason: 'roster-mismatch' };
     }
     // Verify against the attester's authenticated identity key. Known for a direct
@@ -1940,14 +2005,14 @@ class SymNode extends EventEmitter {
     if (!this._gossipBudget(fromPeerId, 'attestation', att.by)) return { ok: false, reason: 'over-budget' };
     const v = verifyAttestation(att, attesterKey);
     if (!v.valid) {
-      if (!v.error || v.error === 'bad-signature') this._penaliseForgery(session, 'attestation');
+      if (!v.error || v.error === 'bad-signature') this._penaliseForgery(session, 'attestation', { author: att.by, key: attesterKey });
       return { ok: false, reason: v.error || 'bad-signature' };
     }
     if (!this._gossipCeiling(fromPeerId, 'attestation', att.by)) return { ok: false, reason: 'over-ceiling' };
     // A verified gossip statement does not make its signer's binding durable (security review D:
     // only an admitted record, a grant in effect or a pin does; a fresh identity signs statements free).
-    // Record (rate-limited as ingested), with the time it was received. Relay-once only on first sight.
-    const r = this._attestations.record(att, { ingested: true, receivedAt: Date.now() });
+    // Record (rate-limited as ingested). Relay-once only on first sight.
+    const r = this._attestations.record(att, { ingested: true });
     if (r.stored) {
       this._gossipAttestation(att, fromPeerId);
       this._emitAttestationReceived(att, fromPeerId, fromPeerName);
@@ -2224,6 +2289,13 @@ class SymNode extends EventEmitter {
     if (this._running) return;
     this._running = true;
     this._metrics.startedAt = Date.now();
+    // MMP §3.1.1: a nodeId is a lowercase UUID, and every Core Secure receiver refuses a record whose
+    // createdByNodeId is not one. Every identity minted since 0.3.7 is a UUIDv7; an older identity
+    // file can hold another id, and such a node would be refused by every peer without being told.
+    if (!isLowerUuid(this.nodeId)) {
+      this._log(`[sym-security] this node's nodeId ${String(this.nodeId).slice(0, 40)} is not a lowercase UUID (MMP §3.1.1): every Core Secure peer refuses the records it signs. Create a new identity for this agent.`);
+      this.emit('metric', { type: 'node-id-not-canonical', nodeId: String(this.nodeId).slice(0, 128) });
+    }
 
     // Build the memory index WITHOUT blocking the event loop (see MemoryStore#load). Awaited
     // before anything below can recall or admit, so the node never serves an unbuilt store; a
@@ -2632,6 +2704,10 @@ class SymNode extends EventEmitter {
   remember(categories, opts = {}) {
     // Whether this call builds (and signs) the record, as opposed to forwarding a caller's opts.cmb.
     const builtHere = !opts.cmb;
+    // A record's addressee is a nodeId, a lowercase UUID (MMP §3.1.1; the record schema's `to`): one
+    // spelled otherwise would be minted, stored and reported undelivered, and no session could ever
+    // carry it (the seal point refuses it). Refused here instead, before anything is minted.
+    assertAddressee(opts.to);
 
     if (!opts.cmb) {
       if (!categories || typeof categories !== 'object') {
@@ -3207,6 +3283,7 @@ class SymNode extends EventEmitter {
 
   /** @private A signed v2.0 directed record carrying a message to `to`. */
   _mintMessage(content, to) {
+    assertAddressee(to);
     const bytes = Buffer.from(content, 'utf8');
     const application = {
       mediaType: 'text/plain',
diff --git a/lib/role-grant-store.js b/lib/role-grant-store.js
index d1ae66d6..9794b2e4 100644
--- a/lib/role-grant-store.js
+++ b/lib/role-grant-store.js
@@ -22,22 +22,39 @@
  *     holds for G. So a grantor whose id the registry binds to an impostor still has exactly the
  *     authority its vouched key has, and the impostor has none.
  *
- * AUTHORITY COUNTS ONLY IF THE SIGNER WAS AUTHORISED BOTH WHEN IT SIGNED AND WHEN THIS NODE
- * RECEIVED IT (security review C). One rule for a grant, a key vouch, a revoke and an attestation: a
- * signer revoked at t can still sign a statement dated before t (the date is its own to write), so
- * the signed time alone let a revoked validator backdate grants, key vouches and revokes into its
- * old window. Each record keeps the time this node received it (`receivedAt`, persisted with it),
- * and its signer's rank is taken at both times, the lower counting.
+ * A REVOKE CARRIES A CUTOFF (0.14.0 re-review N2, the founder's ruling; it replaces the security
+ * review's "both times" rule, draft spec PR #33). A signer's date is its own to write, so a revoked
+ * validator can still sign statements dated inside its old window. The revoker therefore names the
+ * date from which the revoked node is no longer trusted: `cutoff`, signed into the revoke, at most
+ * the revoke's own signed time (absent: the revoke's signed time, which is every 0.13 revoke).
  *
- * A record is KEPT only when it is rooted at the anchor: its grantor held, both when it signed and
- * when it was received, the rank the record needs (a grant: the rank it confers; a revoke: validator
- * or above), under the key that signed it, by the chain this store already holds. An unrooted record
- * has no effect on any resolution, so it is not stored, not relayed, and costs nothing. Resolution
- * still re-checks every chain (role-at-time, revocation cascades, the rank at receipt). Reloading from
- * disk runs the same checks, each record at its persisted receipt time (the file has no integrity of
- * its own, so nothing is trusted for being on it; a receipt time is never before its signed time and
- * never after the load). A line written before 0.14 has no receipt time: it is treated as received
- * at load (draft spec PR meshcognition-website#33), and the file is rewritten with that time.
+ *   - A statement the revoked node signed BEFORE the cutoff stands, for every receiver, whenever it
+ *     arrives (a new node, an anti-entropy sync, a store upgraded from 0.13): authority no longer
+ *     depends on when this node happened to receive something, so the mesh agrees.
+ *   - A statement it signed AT OR AFTER the cutoff never counts. That is what stops backdating: the
+ *     revoker sets the cutoff early enough to cover any window the revoked node is not trusted for.
+ *   - Receipt time is no part of the rule. Nothing records it.
+ *
+ * Concretely, a node's role at time t replays, in signed-time order, its grants signed at or before t
+ * and its revokes whose cutoff is at or before t: a revoke takes effect from its cutoff, even at times
+ * before it was signed, and clears every grant signed before the revoke itself (a grant signed after
+ * it, a re-grant, is a new statement). A revoke counts when its revoker held the rank it needs both at
+ * the revoke's signed time and at its cutoff (both signed, both the revoker's own word): a revoker can
+ * reach back only over time it was itself authorised for.
+ *
+ * Grants keep MMP §6.6's cascade: a grant confers its role at t only while its grantor held the rank
+ * both when it signed and at t, so revoking a grantor still withdraws what it granted (the grants
+ * stand as statements: they are kept, and confer again if the grantor is re-granted).
+ *
+ * A record is KEPT only when it is rooted at the anchor: its grantor held, at the record's signed time
+ * (and, for a revoke, at its cutoff), the rank the record needs (a grant: the rank it confers; a
+ * revoke: validator or above), under the key that signed it, by the chain this store already holds.
+ * An unrooted record has no effect on any resolution, so it is not stored, not relayed, and costs
+ * nothing. Resolution still re-checks every chain (role-at-time, cutoffs, the cascade). Reloading from
+ * disk runs the same checks (the file has no integrity of its own, so nothing is trusted for being on
+ * it). The file is append-only and never rewritten: a 0.13 line and a 0.14 line are the same bare
+ * record, and a line skipped at one load (its root not yet held) stays on disk for the next
+ * (re-review N5).
  *
  * A KEY VOUCH is a view (security review C): `vouchedKey(nodeId)` is the one key the grants in effect
  * NOW vouch for nodeId, and the key registry reads it on demand instead of storing a `grant` binding,
@@ -56,12 +73,19 @@ const { isCanonicalNodeId } = require('./core/record-canonical');
 
 const GRANTS_FILE = 'role-grants.jsonl';
 /**
- * Bounds on what is kept, and so on what is relayed, since only a record kept is relayed: records
- * signed by one grantor, records one grantor signed for one grantee, and records in all. A full bound
+ * Bounds on the GRANTS kept, and so on what is relayed, since only a record kept is relayed: grants
+ * signed by one grantor, grants one grantor signed for one grantee, and grants in all. A full bound
  * refuses the newcomer and never evicts a record already kept, since a record's authority can depend
  * on its place in a chain. The anchor's own records are never refused. The pair bound is per grantor,
  * so one grantor filling it cannot keep another's grants to that grantee out; and it bounds what one
  * grantor adds to the grantee's role resolution, which every gating decision runs.
+ *
+ * No cap refuses a REVOKE (re-review N4): a revoke refused by a cap leaves authority standing, which
+ * fails open, and a malicious validator filling the caps with sybil grants could stop every honest
+ * revoke. Revokes are bounded by their grants instead: a non-anchor revoker keeps at most as many
+ * revokes for one grantee as this store holds grants for that grantee (one per grant episode is all
+ * a revoke can clear; a revoke for a grantee holding no grant clears nothing). So what one revoker
+ * adds is at most the grants held, and a revoker can only ever fill its own allowance.
  */
 const MAX_PER_GRANTOR = 1024;
 // 16 per pair (64 until 0.14): a grant, a revoke and a re-grant, several times over, is all an
@@ -101,7 +125,6 @@ class RoleGrantStore {
     this._onForeignSelfGrant = typeof opts.onForeignSelfGrant === 'function' ? opts.onForeignSelfGrant : null;
     this._now = typeof opts.now === 'function' ? opts.now : Date.now;
     this._keys = opts.keys || new Map();
-    this._receivedAt = new Map(); // sigKey -> when this node received the record (ms epoch)
     this._memo = new Map();       // `${nodeId}\0${key}\0${canonical at}` -> { role, depth } (cleared on every change)
     this._times = [];             // every record's grantedAt, sorted, distinct: resolution's breakpoints
     this._memoKeys = new Map();   // nodeId -> Set(memo keys of its answers), to forget one subtree
@@ -110,8 +133,11 @@ class RoleGrantStore {
     this._vouched = new Map();   // nodeId -> Set(keys its rooted role-grants vouch)
     this._signer = new Map();    // sigKey -> the key that verified the record
     this._seen = new Set();      // sigKey dedup: the signature's bytes, however it is spelled
-    this._perGrantor = new Map(); // grantor nodeId -> records kept
-    this._perPair = new Map();    // grantor nodeId + NUL + grantee nodeId -> records kept
+    this._perGrantor = new Map(); // grantor nodeId -> grants kept
+    this._perPair = new Map();    // grantor nodeId + NUL + grantee nodeId -> grants kept
+    this._grantCount = 0;         // grants kept in all (revokes are bounded by their grants, below)
+    this._grantsOf = new Map();   // grantee nodeId -> grants kept for it, from any grantor
+    this._revokesOf = new Map();  // revoker nodeId + NUL + grantee nodeId -> revokes kept
     this._maxPerGrantor = opts.maxPerGrantor || MAX_PER_GRANTOR;
     this._maxPerPair = opts.maxPerPair || MAX_PER_PAIR;
     this._maxGrants = opts.maxGrants || MAX_GRANTS;
@@ -127,7 +153,8 @@ class RoleGrantStore {
   /**
    * What the last reload found: records `loaded`, records `skipped` by reason (each a record that
    * could not be verified — not JSON, malformed, unknown grantor key, bad signature, unrooted,
-   * duplicate), and `unreadable` (why the file could not be read; null when it could, or none).
+   * duplicate, nothing-to-revoke — and which stays in the file for the next load), and `unreadable`
+   * (why the file could not be read; null when it could, or none).
    * @returns {{ loaded: number, skipped: Object<string, number>, unreadable: string|null }}
    */
   loadReport() {
@@ -169,26 +196,27 @@ class RoleGrantStore {
   }
 
   /** @private */
-  _record(grant, { receivedAt } = {}) {
+  _record(grant) {
     if (malformed(grant)) return { stored: false, reason: 'malformed' };
     const sk = sigKey(grant.sig);
     if (this._seen.has(sk)) return { stored: false, reason: 'duplicate' };
-    const now = this._now();
-    // The time this node received it: now, or (reloading) the persisted time, never before the signed
-    // time and never after now.
-    receivedAt = Number.isFinite(receivedAt) ? Math.min(Math.max(receivedAt, grant.grantedAt), now) : now;
-    if (grant.grantedAt > receivedAt + MAX_FUTURE_MS) return { stored: false, reason: 'future-dated' };
+    if (grant.grantedAt > this._now() + MAX_FUTURE_MS) return { stored: false, reason: 'future-dated' };
     const fromAnchor = !!this._anchor && grant.grantedBy === this._anchor.nodeId;
     const pair = `${grant.grantedBy}\u0000${grant.grantee}`;
-    if (!fromAnchor) {
+    const isRevoke = grant.type === 'role-revoke';
+    if (!fromAnchor && !isRevoke) {
       if ((this._perGrantor.get(grant.grantedBy) || 0) >= this._maxPerGrantor) return { stored: false, reason: 'grantor-full' };
       if ((this._perPair.get(pair) || 0) >= this._maxPerPair) return { stored: false, reason: 'pair-full' };
-      if (this._seen.size >= this._maxGrants) return { stored: false, reason: 'store-full' };
+      if (this._grantCount >= this._maxGrants) return { stored: false, reason: 'store-full' };
     }
+    // A revoke is bounded by the grants it can clear, never by a cap (re-review N4). A revoke that
+    // arrives before the grant it clears waits for it (the reason is curable: a reload retries it, and
+    // the node fetches the grantee's records from the session that delivered it).
+    if (!fromAnchor && isRevoke && (this._revokesOf.get(pair) || 0) >= (this._grantsOf.get(grant.grantee) || 0)) return { stored: false, reason: 'nothing-to-revoke' };
     const candidates = this.grantorKeys(grant.grantedBy);
     if (candidates.length === 0) return { stored: false, reason: 'unknown-grantor-key' };
     // Rooted first (no signature work for a record no key could root), then the signature.
-    const rooted = candidates.filter((k) => this._rooted(grant, k, receivedAt));
+    const rooted = candidates.filter((k) => this._rooted(grant, k));
     if (rooted.length === 0) return { stored: false, reason: 'unrooted' };
     const signer = rooted.find((k) => verifyGrant(grant, k).valid);
     if (!signer) return { stored: false, reason: 'bad-signature' };
@@ -198,14 +226,20 @@ class RoleGrantStore {
     grant = canonicalGrant(grant, sk);
     this._seen.add(sk);
     this._signer.set(sk, signer);
-    this._receivedAt.set(sk, receivedAt);
     this._addTime(grant.grantedAt);
+    if (isRevoke) this._addTime(cutoffOf(grant));
     let gs = this._grantees.get(grant.grantedBy);
     if (!gs) { gs = new Set(); this._grantees.set(grant.grantedBy, gs); }
     gs.add(grant.grantee);
     this._forgetSubtree(grant.grantee);
-    this._perGrantor.set(grant.grantedBy, (this._perGrantor.get(grant.grantedBy) || 0) + 1);
-    this._perPair.set(pair, (this._perPair.get(pair) || 0) + 1);
+    if (isRevoke) {
+      this._revokesOf.set(pair, (this._revokesOf.get(pair) || 0) + 1);
+    } else {
+      this._perGrantor.set(grant.grantedBy, (this._perGrantor.get(grant.grantedBy) || 0) + 1);
+      this._perPair.set(pair, (this._perPair.get(pair) || 0) + 1);
+      this._grantsOf.set(grant.grantee, (this._grantsOf.get(grant.grantee) || 0) + 1);
+      this._grantCount++;
+    }
     let arr = this._byGrantee.get(grant.grantee);
     if (!arr) { arr = []; this._byGrantee.set(grant.grantee, arr); }
     arr.push(grant);
@@ -214,7 +248,7 @@ class RoleGrantStore {
       if (!v) { v = new Set(); this._vouched.set(grant.grantee, v); }
       v.add(grant.granteeKey);
     }
-    this._append(grant, receivedAt);
+    this._append(grant);
     this._noteVouch(grant);
     if (grant.type === 'role-grant' && this._selfId && grant.grantee === this._selfId && this._selfKey && grant.granteeKey !== this._selfKey) {
       // Stored (it is a rooted statement, and relayed like one) but inert: this node resolves its own
@@ -225,22 +259,22 @@ class RoleGrantStore {
     return { stored: true, grant };
   }
 
-  /** When this node received the record with this signature, or undefined. */
-  receivedAt(sig) { return this._receivedAt.get(sigKey(sig)); }
-
   /**
    * Whether a record is rooted at the anchor under `signerKey`: its grantor, holding that key, held
-   * the authority the record needs (a grant: the rank it confers; a revoke: validator or above) both
-   * when it signed and when it was received (security review C). (A grant from a grantor revoked
-   * SINCE it was received is rooted and kept; resolution gives it no effect while the grantor is
-   * revoked.)
+   * the authority the record needs (a grant: the rank it confers; a revoke: validator or above) at the
+   * record's signed time, and for a revoke at its cutoff as well (re-review N2). Both times are signed;
+   * neither depends on when this node received it. (A grant from a grantor revoked later, or whose
+   * revoke arrives later, is rooted and kept; resolution gives it no effect while that holds.)
    * @private
    */
-  _rooted(grant, signerKey, receivedAt) {
-    const then = this._authority(grant.grantedBy, signerKey, grant.grantedAt);
-    const atReceipt = this._authority(grant.grantedBy, signerKey, receivedAt);
-    const rank = Math.min(then, atReceipt);
-    return grant.type === 'role-revoke' ? rank >= 1 : rank >= roleRank(grant.role);
+  _rooted(grant, signerKey) {
+    let rank = this._authority(grant.grantedBy, signerKey, grant.grantedAt);
+    if (grant.type === 'role-revoke') {
+      const c = cutoffOf(grant);
+      if (c !== grant.grantedAt) rank = Math.min(rank, this._authority(grant.grantedBy, signerKey, c));
+      return rank >= 1;
+    }
+    return rank >= roleRank(grant.role);
   }
 
   /**
@@ -280,10 +314,11 @@ class RoleGrantStore {
    * Resolve the role `nodeId`, holding `key`, held at time `at` (ms epoch). Authority only flows from
    * the anchor:
    *   - the anchor itself, holding its configured key, is `anchor`;
-   *   - otherwise, replay `nodeId`'s grants/revokes in chronological order up to `at`: a grant counts
-   *     only if its granteeKey is `key`, and confers its role iff its grantor — holding the key that
-   *     signed the grant — outranked-or-equalled it both when it granted and now; a revoke clears to
-   *     `participant` iff the revoker outranked-or-equalled the current role when it revoked.
+   *   - otherwise, replay in signed-time order `nodeId`'s grants signed at or before `at` and its
+   *     revokes whose cutoff is at or before `at`: a grant counts only if its granteeKey is `key`, and
+   *     confers its role iff its grantor — holding the key that signed the grant — outranked-or-equalled
+   *     it both when it granted and at `at`; a revoke clears to `participant` iff the revoker
+   *     outranked-or-equalled the current role at the revoke's signed time and at its cutoff.
    *   - cycles and unrooted chains resolve to `participant` (rank 0).
    *
    * Two-argument form `resolveRole(nodeId, at)`: `key` is the registry's binding for `nodeId`.
@@ -353,7 +388,8 @@ class RoleGrantStore {
 
   /**
    * The resolution, memoised (security review D, role-resolve-cost): each record recurses into its
-   * grantor at three times (signed, received, `at`), which without a memo cost (3r)^depth. An answer
+   * grantor at up to two times (signed and `at` for a grant, signed and cutoff for a revoke), which
+   * without a memo cost (2r)^depth. An answer
    * is kept only when no cycle was cut while computing it (a cut answer depends on the path), and the
    * memo is cleared whenever a record is kept. @returns {{ role: string, pure: boolean }}
    * @private
@@ -378,25 +414,27 @@ class RoleGrantStore {
       if (r.depth > depthOf) depthOf = r.depth;
       return roleRank(r.role);
     };
+    // A revoke is in the replay from its cutoff on, at its signed place (re-review N2): at a time
+    // between its cutoff and its signing it already clears every grant signed before it.
     const records = (this._byGrantee.get(nodeId) || [])
-      .filter(g => (g.grantedAt ?? 0) <= at)
-      .sort((a, b) => (a.grantedAt ?? 0) - (b.grantedAt ?? 0)); // chronological
+      .filter(g => (g.type === 'role-revoke' ? cutoffOf(g) : (g.grantedAt ?? 0)) <= at)
+      .sort((a, b) => (a.grantedAt ?? 0) - (b.grantedAt ?? 0)); // signed-time order
     let role = 'participant';
     let depth = 0;
     for (const g of records) {
       // A grant confers only if the grantor was authorised WHEN it granted (so a grant signed before
-      // the grantor held rank never activates), WHEN THIS NODE RECEIVED IT (so a grantor revoked by
-      // then cannot backdate a fresh grant into its old window: security review C) AND NOW (so
-      // revoking or demoting a grantor cascades to everything it granted). A revoke takes effect on
-      // the revoker's rank when it revoked and when it was received, the lower, and is not undone by
-      // the revoker's later demotion.
+      // the grantor held rank, or at or after the grantor's cutoff, never activates) AND AT `at` (so
+      // revoking or demoting a grantor cascades to everything it granted, MMP §6.6). A revoke takes
+      // effect on the revoker's rank when it revoked and at its cutoff, the lower, and is not undone by
+      // the revoker's later demotion; nothing depends on when this node received anything.
       if (g.type === 'role-grant' && g.granteeKey !== key) continue;
       const signer = this._signer.get(g.sig);
       const signedAt = g.grantedAt ?? 0;
-      const recvAt = this._receivedAt.get(g.sig) ?? signedAt;
       depthOf = 0;
-      const authority = Math.min(rank(g.grantedBy, signer, signedAt), rank(g.grantedBy, signer, recvAt));
+      let authority = rank(g.grantedBy, signer, signedAt);
       if (g.type === 'role-revoke') {
+        const c = cutoffOf(g);
+        if (c !== signedAt) authority = Math.min(authority, rank(g.grantedBy, signer, c));
         if (authority >= 1 && authority >= roleRank(role)) { role = 'participant'; depth = 0; }
       } else {
         const rankNow = rank(g.grantedBy, signer, at);
@@ -434,7 +472,8 @@ class RoleGrantStore {
    * Every record held, in an order that roots each before it is needed (security review D,
    * anti-entropy): the anchor's records first, then those of each grantor the earlier ones reach,
    * breadth first, each grantor's own records by signed time; what no chain reaches comes last.
-   * Cached until the next record is kept.
+   * Every grant comes before every non-anchor revoke, so a revoke never arrives ahead of the grant it
+   * clears (re-review N4: a revoke is bounded by its grants). Cached until the next record is kept.
    * @returns {object[]}
    */
   syncOrder() {
@@ -456,6 +495,10 @@ class RoleGrantStore {
       for (const g of l) { out.push(g); if (g.type === 'role-grant' && !done.has(g.grantee)) queue.push(g.grantee); }
     }
     for (const [grantor, l] of byGrantor) if (!done.has(grantor)) out.push(...l);
+    const fromAnchor = (g) => !!this._anchor && g.grantedBy === this._anchor.nodeId;
+    const ordered = [...out.filter((g) => g.type === 'role-grant' || fromAnchor(g)), ...out.filter((g) => g.type === 'role-revoke' && !fromAnchor(g))];
+    out.length = 0;
+    out.push(...ordered);
     this._syncOrder = out;
     this._syncOrderAt = this._seen.size;
     return out;
@@ -481,10 +524,13 @@ class RoleGrantStore {
 
   // ── Durable persistence (append-only) ────────────────────────────────────────
 
-  /** One line per record: `{ grant, receivedAt }` (a pre-0.14 line is the bare record). */
-  _append(grant, receivedAt) {
+  /**
+   * One line per record: the bare canonical record, as 0.13 wrote it (receipt time is no part of the
+   * rule since re-review N2, so a line needs nothing else, and the file is never rewritten).
+   */
+  _append(grant) {
     if (!this._dir || this._loading) return;
-    try { fs.appendFileSync(path.join(this._dir, GRANTS_FILE), JSON.stringify({ grant, receivedAt }) + '\n'); }
+    try { fs.appendFileSync(path.join(this._dir, GRANTS_FILE), JSON.stringify(grant) + '\n'); }
     catch { /* best effort — never let persistence break authority */ }
   }
 
@@ -494,8 +540,9 @@ class RoleGrantStore {
    * for a reason a later record can cure (`unknown-grantor-key`: the grantor's own grant, vouching its
    * key, arrives later; `unrooted`: likewise) are retried until a pass adds nothing. What is left is
    * skipped and counted, as is a record whose check fails in a way no reason names ('unverifiable').
-   * Never throws: a file that cannot be read leaves the store with no grants and
-   * `loadReport().unreadable` saying why.
+   * A skipped line is never removed: the file is only ever appended to (re-review N5), so a record
+   * whose root arrives later loads at the next start. Never throws: a file that cannot be read leaves
+   * the store with no grants and `loadReport().unreadable` saying why.
    * @private
    */
   _load() {
@@ -511,18 +558,16 @@ class RoleGrantStore {
     this._loading = true;
     try {
       let pending = [];
-      let bare = 0;
       for (const line of text.split('\n')) {
         if (!line.trim()) continue;
         let o;
         try { o = JSON.parse(line); } catch { skip('not-json'); continue; }
-        // `{ grant, receivedAt }`, or a bare record written before 0.14: no receipt time, so it is
-        // treated as received at load (draft spec PR #33).
-        if (o && typeof o === 'object' && o.grant && typeof o.grant === 'object') pending.push({ g: o.grant, receivedAt: o.receivedAt });
-        else { pending.push({ g: o, receivedAt: undefined }); bare++; }
+        // The bare record (0.13, and 0.14 since re-review N2), or `{ grant, receivedAt }` as 0.14
+        // development builds wrote it: the receipt time is ignored.
+        if (o && typeof o === 'object' && o.grant && typeof o.grant === 'object') pending.push({ g: o.grant });
+        else pending.push({ g: o });
       }
-      this._bareLines = bare;
-      const curable = new Set(['unknown-grantor-key', 'unrooted', 'bad-signature']);
+      const curable = new Set(['unknown-grantor-key', 'unrooted', 'bad-signature', 'nothing-to-revoke']);
       let reasons = [];
       let progress = true;
       while (progress && pending.length) {
@@ -531,7 +576,7 @@ class RoleGrantStore {
         reasons = [];
         for (const e of pending) {
           let r;
-          try { r = this.record(e.g, { receivedAt: e.receivedAt }); } catch { r = { stored: false, reason: 'unverifiable' }; }
+          try { r = this.record(e.g); } catch { r = { stored: false, reason: 'unverifiable' }; }
           if (r.stored) { report.loaded++; progress = true; }
           else if (curable.has(r.reason)) { retry.push(e); reasons.push(r.reason); }
           else skip(r.reason);
@@ -542,26 +587,17 @@ class RoleGrantStore {
     } finally {
       this._loading = false;
     }
-    // A file holding pre-0.14 lines is rewritten once, atomically, in the 0.14 form.
-    if (this._bareLines > 0) this._rewrite();
   }
+}
 
-  /** @private Rewrite the file as one `{ grant, receivedAt }` line per record kept, atomically. */
-  _rewrite() {
-    const file = path.join(this._dir, GRANTS_FILE);
-    const lines = [];
-    for (const arr of this._byGrantee.values()) for (const g of arr) lines.push(JSON.stringify({ grant: g, receivedAt: this._receivedAt.get(g.sig) }));
-    try {
-      const tmp = `${file}.${process.pid}.tmp`;
-      fs.writeFileSync(tmp, lines.join('\n') + (lines.length ? '\n' : ''));
-      fs.renameSync(tmp, file);
-    } catch { /* best effort: read again the same way at the next start */ }
-  }
+/** A revoke's cutoff: the signed `cutoff`, or its signed time when it carries none (re-review N2). */
+function cutoffOf(g) {
+  return g.type === 'role-revoke' && Number.isSafeInteger(g.cutoff) ? g.cutoff : (g.grantedAt ?? 0);
 }
 
 /**
  * A record as its signed fields only (grantPayload: type, grantee, role, grantedBy, grantedAt,
- * granteeKey), with `sig` and `sigAlg`. `role` and `granteeKey` are kept when they are non-empty
+ * granteeKey, and a revoke's cutoff), with `sig` and `sigAlg`. `role` and `granteeKey` are kept when they are non-empty
  * (the payload signs an absent one and an empty one alike).
  */
 function canonicalGrant(g, sig) {
@@ -570,6 +606,7 @@ function canonicalGrant(g, sig) {
   c.grantedBy = g.grantedBy;
   c.grantedAt = g.grantedAt;
   if (typeof g.granteeKey === 'string' && g.granteeKey) c.granteeKey = g.granteeKey;
+  if (g.type === 'role-revoke' && g.cutoff !== undefined) c.cutoff = g.cutoff;
   c.sig = sig;
   c.sigAlg = 'ed25519';
   return c;
@@ -583,11 +620,14 @@ function malformed(g) {
   for (const f of ['grantee', 'grantedBy']) if (!isCanonicalNodeId(g[f]) || g[f].length > MAX_ID) return true;
   if (typeof g.sig !== 'string' || !g.sig || g.sig.length > 128) return true;
   if (!Number.isSafeInteger(g.grantedAt) || g.grantedAt < 0) return true;
-  if (g.granteeKey !== undefined && typeof g.granteeKey !== 'string') return true;
-  if (g.role !== undefined && (typeof g.role !== 'string' || g.role.length > MAX_ROLE)) return true;
+  // A key, when present, is a raw Ed25519 key; a role holds no `|` (the payload's separator), so no
+  // two records sign the same bytes.
+  if (g.granteeKey !== undefined && (typeof g.granteeKey !== 'string' || (g.granteeKey !== '' && !/^[A-Za-z0-9_-]{43}$/.test(g.granteeKey)))) return true;
+  if (g.role !== undefined && (typeof g.role !== 'string' || g.role.length > MAX_ROLE || g.role.includes('|'))) return true;
+  if (g.cutoff !== undefined && (g.type !== 'role-revoke' || !Number.isSafeInteger(g.cutoff) || g.cutoff < 0 || g.cutoff > g.grantedAt)) return true;
   if (g.type === 'role-revoke') return false;
   // A grant confers a rank above participant, on the holder of one key, or it confers nothing.
   return roleRank(g.role) < 1 || typeof g.granteeKey !== 'string' || !/^[A-Za-z0-9_-]{43}$/.test(g.granteeKey);
 }
 
-module.exports = { RoleGrantStore, canonicalGrant, malformedGrant: malformed, MAX_DELEGATION_DEPTH };
+module.exports = { RoleGrantStore, canonicalGrant, malformedGrant: malformed, cutoffOf, MAX_DELEGATION_DEPTH };
diff --git a/lib/session.js b/lib/session.js
index 45ff46c4..6508df43 100644
--- a/lib/session.js
+++ b/lib/session.js
@@ -64,6 +64,7 @@ const X25519_SPKI_PREFIX = Buffer.from('302a300506032b656e032100', 'hex');
 /** A record offered to a session its signed audience does not include (review finding A). */
 class AudienceError extends Error {}
 const { signedProjection } = require('./core/record-canonical');
+const { MAX_SEALED_CHARS } = require('./core/cmb-encoder');
 // nodeIds are canonical lowercase on the wire (§3.1.1; review finding B): an upper-case alias of a
 // bound nodeId is not a second identity, it is refused at the door.
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
@@ -329,6 +330,11 @@ class PeerSession extends EventEmitter {
   }
 
   _openRecord(f) {
+    // MMP §8.8.6: a sealed value longer than a MAX_RECORD_BYTES plaintext can produce is refused
+    // before it is opened. Nothing about the session changes (the frame is unauthenticated until it
+    // opens, so anyone on a relay could have sent it); a genuine one from the peer leaves a gap that
+    // the next frame's sequence closes the session on.
+    if (typeof f.sealed === 'string' && f.sealed.length > MAX_SEALED_CHARS) { this._refuse(f.type, 'record-too-large'); return; }
     const out = this._position(f, (trafficKey) => openEncryptedFrame({ frame: f, trafficKey }), 'record');
     if (!out) return;
     const metadata = { ...out.cmb.metadata };
diff --git a/tests/audit-delivery-authorship.test.js b/tests/audit-delivery-authorship.test.js
index 2bd0d02f..6f0ae0bb 100644
--- a/tests/audit-delivery-authorship.test.js
+++ b/tests/audit-delivery-authorship.test.js
@@ -24,6 +24,10 @@ require('./_isolate-home'); // redirect $HOME to a temp sandbox before lib/confi
 
 const { describe, it } = require('node:test');
 const assert = require('node:assert');
+// A record's `to` is a lowercase UUID (MMP §3.1.1, the cmb schema): remember() refuses any other.
+const TO_A = '0190a000-0000-7000-8000-00000000000a';
+const TO_B = '0190a000-0000-7000-8000-00000000000b';
+const TO_STALE = '0190a000-0000-7000-8000-00000000000c';
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
@@ -627,10 +631,10 @@ describe('B-D5: directed sends that mint nothing still deliver (MMP §4.4.4)', (
 
   it('re-review F2: a caller-supplied record that collapses is not sent unre-signed, and says so', async () => {
     await withNode('d5-caller', async (node) => {
-      const frames = fakePeer(node, 'peer-a');
-      const first = node.remember(cats('forwarded'), { to: 'peer-a' });
+      const frames = fakePeer(node, TO_A);
+      const first = node.remember(cats('forwarded'), { to: TO_A });
       const own = JSON.parse(JSON.stringify(first.cmb)); // a record the caller holds, already signed
-      const r = node.remember(null, { cmb: own, to: 'peer-a' }); // same content: collapses onto HEAD
+      const r = node.remember(null, { cmb: own, to: TO_A }); // same content: collapses onto HEAD
       assert.strictEqual(r.collapsed, true);
       assert.strictEqual(r.delivery.undelivered, true, 'not sent, and the caller is told');
       assert.strictEqual(frames.length, 1, 'only the first send went out');
@@ -639,12 +643,12 @@ describe('B-D5: directed sends that mint nothing still deliver (MMP §4.4.4)', (
 
   it('re-review F5: a directed send matching a peer\'s stored CMB returns the caller\'s entry, not the peer\'s', async () => {
     await withNode('d5-peer-dup', async (node) => {
-      fakePeer(node, 'peer-a');
+      fakePeer(node, TO_A);
       node._svafEvaluator.evaluate = async () => ALIGNED;
       const shared = { focus: 'shared words', issue: 'x', intent: 'tell', motivation: 'm', commitment: 'c', perspective: 'peerA', mood: NEUTRAL };
       node._frameHandler.handle(from(node), frame(signed(core.createCMB({ categories: shared, createdBy: 'peerA', emitV2: true, createdByNodeId: A_ID.nodeId, room: 'default' }))));
       await settle();
-      const r = node.remember(shared, { to: 'peer-a' });
+      const r = node.remember(shared, { to: TO_A });
       assert.strictEqual(r.duplicate, true);
       for (const f of ['peerId', 'remixed', 'author', 'inboxId', 'svaf']) {
         assert.strictEqual(r[f], undefined, `no peer provenance field ${f} on the caller's result`);
@@ -657,9 +661,9 @@ describe('B-D5: directed sends that mint nothing still deliver (MMP §4.4.4)', (
 
   it('r3 F3: a send whose store write failed is not reported as a duplicate', async () => {
     await withNode('d5-persist', async (node) => {
-      fakePeer(node, 'peer-a');
+      fakePeer(node, TO_A);
       node._store._persist = () => false;
-      const r = node.remember(cats('cannot store'), { to: 'peer-a' });
+      const r = node.remember(cats('cannot store'), { to: TO_A });
       assert.ok(r, 'a result');
       assert.strictEqual(r.duplicate, false);
       assert.strictEqual(r.persisted, false);
@@ -669,22 +673,22 @@ describe('B-D5: directed sends that mint nothing still deliver (MMP §4.4.4)', (
 
   it('r3 F6: a caller-supplied record that collapses is returned unmodified', async () => {
     await withNode('d5-unmodified', async (node) => {
-      fakePeer(node, 'peer-a');
-      const first = node.remember(cats('forwarded'), { to: 'peer-a' });
+      fakePeer(node, TO_A);
+      const first = node.remember(cats('forwarded'), { to: TO_A });
       const own = JSON.parse(JSON.stringify(first.cmb));
       own.metadata.lineage = { parents: ['cmb-' + 'e'.repeat(64)], method: 'rule-a' };
       const before = JSON.stringify(own);
-      node.remember(null, { cmb: own, to: 'peer-a' });
+      node.remember(null, { cmb: own, to: TO_A });
       assert.strictEqual(JSON.stringify(own), before, 'the caller\'s signed record is not mutated');
     });
   });
 
   it('F12: a directed send of an already-stored record returns an entry with its delivery result', async () => {
     await withNode('d5-dup', async (node) => {
-      fakePeer(node, 'peer-a');
-      node.remember(cats('first'), { to: 'peer-a' });
-      node.remember(cats('second'), { to: 'peer-a' });
-      const again = node.remember(cats('first'), { to: 'peer-a' }); // stored, but not HEAD
+      fakePeer(node, TO_A);
+      node.remember(cats('first'), { to: TO_A });
+      node.remember(cats('second'), { to: TO_A });
+      const again = node.remember(cats('first'), { to: TO_A }); // stored, but not HEAD
       assert.ok(again && typeof again.content === 'string', 'entry-shaped, not a bare {key, cmb}');
       assert.strictEqual(again.duplicate, true);
       assert.strictEqual(again.delivery.dispatched, 1);
@@ -693,23 +697,23 @@ describe('B-D5: directed sends that mint nothing still deliver (MMP §4.4.4)', (
 
   it('the same words sent to a second peer are sent, not collapsed into silence', async () => {
     await withNode('d5', async (node) => {
-      const a = fakePeer(node, 'peer-a');
-      const b = fakePeer(node, 'peer-b');
-      const first = node.remember(cats('review request'), { to: 'peer-a' });
-      const second = node.remember(cats('review request'), { to: 'peer-b' });
+      const a = fakePeer(node, TO_A);
+      const b = fakePeer(node, TO_B);
+      const first = node.remember(cats('review request'), { to: TO_A });
+      const second = node.remember(cats('review request'), { to: TO_B });
       assert.strictEqual(first.delivery.dispatched, 1);
       assert.ok(second, 'a result, not null');
       assert.strictEqual(second.delivery.undelivered, false);
       assert.strictEqual(a.length, 1);
       assert.strictEqual(b.length, 1);
-      assert.strictEqual(b[0].cmb.metadata.to, 'peer-b', 'directed by its signed addressee');
+      assert.strictEqual(b[0].cmb.metadata.to, TO_B, 'directed by its signed addressee');
     });
   });
 
   it('a transport that refuses the frame makes the send undelivered', async () => {
     await withNode('d6', async (node) => {
-      fakePeer(node, 'peer-stale', { accept: false });
-      const r = node.remember(cats('are you there'), { to: 'peer-stale' });
+      fakePeer(node, TO_STALE, { accept: false });
+      const r = node.remember(cats('are you there'), { to: TO_STALE });
       assert.strictEqual(r.delivery.dispatched, 0);
       assert.strictEqual(r.delivery.undelivered, true);
     });
diff --git a/tests/core-secure-rereview.test.js b/tests/core-secure-rereview.test.js
new file mode 100644
index 00000000..cf46b036
--- /dev/null
+++ b/tests/core-secure-rereview.test.js
@@ -0,0 +1,450 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME before lib/config loads
+
+/**
+ * The 0.14.0 re-review at 72daeb6 (docs/handover/agent-a/sym-0.14.0-rereview-notes.txt in
+ * sym-bot/xmesh): each finding as a regression test that fails on 72daeb6 for its own reason.
+ *
+ *   N1  the forgery penalty is charged only to a session that signed in its own name
+ *   N2  a revoke carries a cutoff; receipt time is no part of the rule
+ *   N3  a verified directed record earns its author a durable binding
+ *   N4  no cap refuses a revoke
+ *   N5  a 0.13 grant store is never rewritten, so nothing skipped at load is lost
+ *   caps  record size limits that fit one sealed frame (draft spec PR #37)
+ *   leads the open leads the notes left
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const crypto = require('crypto');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { SymNode } = require('../lib/node');
+const { NullDiscovery } = require('../lib/discovery');
+const { nodeDirById } = require('../lib/config');
+const { signAttestation, signCheckpoint, signWitness, signGrant } = require('../lib/core');
+const { identity, connectNodes, until, signedRecord, admitAs, deliver } = require('./_core-secure');
+
+const uniq = (b) => `${b}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+function mk(base, extra = {}) { return new SymNode({ name: uniq(base), silent: true, discovery: new NullDiscovery(), room: extra.room || 'rr', ...extra }); }
+async function stopAll(...nodes) {
+  for (const n of nodes) { try { await n.stop(); } catch { /* */ } try { fs.rmSync(nodeDirById(n.nodeId), { recursive: true, force: true }); } catch { /* */ } }
+}
+const hex = () => crypto.randomBytes(32).toString('hex');
+const CATS7 = { focus: 'admit', issue: 'admit', intent: 'guard', motivation: 'admit', commitment: 'silent', perspective: 'admit', mood: 'admit' };
+const signedAs = (fields, priv, sign) => { const o = { ...fields }; sign(o, priv); return o; };
+
+describe('N1: the forgery penalty is charged only to a session that signed in its own name', () => {
+  it('a squatter holds X\'s nodeId here: an honest peer relaying X\'s genuine statements keeps its session, and they are dropped, not stored', async () => {
+    const ANC = identity('anchor-n1');
+    const b = mk('n1-b', { anchor: { nodeId: ANC.nodeId, publicKey: ANC.publicKey } });
+    try {
+      await b.start();
+      const metrics = [];
+      b.on('metric', (m) => metrics.push(m));
+      const X = identity('x-genuine');
+      const Km = identity('m-squatter');
+      // The squatter M proved a session as X under its own key: X -> Km is X's session-scoped binding here.
+      const sM = admitAs(b, { nodeId: X.nodeId, name: 'm-as-x', publicKey: Km.publicKey });
+      assert.strictEqual(b._identityKey(X.nodeId), Km.publicKey, 'the scene: the squatter\'s key verifies X here');
+      const A = identity('a-honest');
+      const sA = admitAs(b, A);
+
+      // 1. X's genuine record, relayed by A.
+      deliver(b, sA, { type: 'cmb', cmb: signedRecord(X, { categories: { focus: 'X said this' }, room: b._room }) });
+      // 2. X's genuine attestation, checkpoint and witness, relayed by A.
+      b._ingestAttestation(signedAs({ of: `cmb-${hex()}`, by: X.nodeId, at: Date.now(), roster: b._room, verdict: 'aligned', categories: CATS7, seq: 1, prev: 'genesis' }, X.privateKey, signAttestation), A.nodeId, A.name, sA);
+      b._ingestCheckpoint(signedAs({ by: X.nodeId, upto_seq: 1, root: hex(), at: Date.now(), roster: b._room }, X.privateKey, signCheckpoint), A.nodeId, sA);
+      b._ingestWitness(signedAs({ attester: A.nodeId, upto_seq: 1, root: hex(), by: X.nodeId, role: 'participant', at: Date.now(), roster: b._room }, X.privateKey, signWitness), A.nodeId, sA);
+      // 3. A grant by G, whom the anchor vouched here under K1 and elsewhere under K2, signed with K2.
+      const G1 = identity('g-k1'); const G2 = { ...identity('g-k2'), nodeId: G1.nodeId };
+      const W = identity('w');
+      b._roleGrants.record(signGrant({ type: 'role-grant', grantee: G1.nodeId, role: 'validator', grantedBy: ANC.nodeId, grantedAt: Date.now() - 10_000, granteeKey: G1.publicKey }, ANC.privateKey));
+      deliver(b, sA, { type: 'role-grant', grant: signGrant({ type: 'role-grant', grantee: W.nodeId, role: 'validator', grantedBy: G2.nodeId, grantedAt: Date.now() - 5_000, granteeKey: W.publicKey }, G2.privateKey) });
+
+      assert.strictEqual(sA.closed, false, 'the honest relayer\'s session is not closed');
+      assert.strictEqual(b._penalised(A.nodeId), false, 'and the relayer is not refused');
+      const kinds = metrics.filter((m) => m.type === 'relayed-signature-unverified' && m.peer === A.nodeId).map((m) => m.kind).sort();
+      assert.deepStrictEqual(kinds, ['attestation', 'checkpoint', 'record', 'role-grant', 'witness'], 'each relayed statement is dropped and counted');
+      assert.ok(!metrics.some((m) => m.type === 'forged-signature'), 'none is called a forgery');
+      assert.strictEqual(b._store.allEntries().length, 0, 'the record is not stored');
+      assert.strictEqual(b._roleGrants.size(), 1, 'the grant is not stored');
+
+      // The squatter's session delivering a record in its own name (X) that its proven key did not
+      // sign is attributable: it is closed and refused.
+      deliver(b, sM, { type: 'cmb', cmb: signedRecord(X, { categories: { focus: 'X said this too' }, room: b._room }) });
+      assert.strictEqual(sM.closed, true, 'the session that sent a record in its own name its key did not sign is closed');
+      assert.strictEqual(b._penalised(X.nodeId), true);
+    } finally { await stopAll(b); }
+  });
+
+  it('a statement in the session\'s own name that fails under a key the session did not prove is a view mismatch, not a forgery', async () => {
+    const ANC = identity('anchor-n1b');
+    const b = mk('n1b-b', { anchor: { nodeId: ANC.nodeId, publicKey: ANC.publicKey } });
+    try {
+      await b.start();
+      const metrics = [];
+      b.on('metric', (m) => metrics.push(m));
+      // The anchor vouched G under K1 here; G's session proves K2 (another node holds the grant
+      // vouching K2, this one does not yet).
+      const G1 = identity('g-k1'); const G2 = { ...identity('g-k2'), nodeId: G1.nodeId };
+      const W = identity('w');
+      b._roleGrants.record(signGrant({ type: 'role-grant', grantee: G1.nodeId, role: 'validator', grantedBy: ANC.nodeId, grantedAt: Date.now() - 10_000, granteeKey: G1.publicKey }, ANC.privateKey));
+      const sG2 = admitAs(b, { nodeId: G2.nodeId, name: 'g-k2', publicKey: G2.publicKey });
+      deliver(b, sG2, { type: 'role-grant', grant: signGrant({ type: 'role-grant', grantee: W.nodeId, role: 'validator', grantedBy: G2.nodeId, grantedAt: Date.now() - 5_000, granteeKey: W.publicKey }, G2.privateKey) });
+      assert.strictEqual(sG2.closed, false, 'its proven key is not one this node\'s chain vouches for G: not attributable');
+      assert.ok(metrics.some((m) => m.type === 'relayed-signature-unverified' && m.kind === 'role-grant'));
+      // G's session under the vouched key K1, sending a grant in its own name its key did not sign: a forgery.
+      sG2.closed = true;
+      const sG1 = admitAs(b, { nodeId: G1.nodeId, name: 'g-k1', publicKey: G1.publicKey });
+      const forged = signGrant({ type: 'role-grant', grantee: W.nodeId, role: 'validator', grantedBy: G1.nodeId, grantedAt: Date.now() - 4_000, granteeKey: W.publicKey }, G2.privateKey);
+      deliver(b, sG1, { type: 'role-grant', grant: forged });
+      assert.strictEqual(sG1.closed, true, 'attributable: closed');
+      assert.ok(metrics.some((m) => m.type === 'forged-signature' && m.kind === 'role-grant'));
+    } finally { await stopAll(b); }
+  });
+});
+
+describe('N3: a verified directed record earns its author a durable binding', () => {
+  it('a peer that only exchanges directed records is bound durably: after it leaves, a squatter with its nodeId is refused (1009)', async () => {
+    const b = mk('n3-b'); const x = mk('n3-x');
+    try {
+      await b.start(); await x.start();
+      await connectNodes(x, b);
+      const got = [];
+      b.on('message', (from, text) => got.push(text));
+      x.send('a directed message, never stored', { to: b.nodeId });
+      await until(() => got.length > 0, 3000);
+      assert.deepStrictEqual(got, ['a directed message, never stored']);
+      assert.strictEqual(b._store.allEntries().length, 0, 'nothing was admitted to memory');
+      assert.strictEqual(b._roster.get(x.nodeId), x._identity.publicKey, 'the directed exchange earned a durable binding');
+      assert.strictEqual(b._roster.source(x.nodeId), 'proven');
+
+      await x.stop();
+      await until(() => !b._peers.has(x.nodeId), 3000);
+      assert.strictEqual(b._identityKey(x.nodeId), x._identity.publicKey, 'the binding outlives the session');
+      // A squatter's confirmed session for x's nodeId under another key: refused with 1009.
+      const Km = identity('m');
+      const sent = [];
+      const squat = { nodeId: x.nodeId, name: 'squatter', identityKey: Km.publicKey, kind: 'relay', relayFrom: x.nodeId, confirmed: true, closed: false, sessionId: hex().slice(0, 32),
+        trySend(f) { sent.push(f); return { ok: true }; }, send(f) { sent.push(f); return true; }, close(reason) { this.closed = true; this.closedReason = reason; } };
+      b._admitSession(squat);
+      assert.strictEqual(squat.closed, true);
+      assert.strictEqual(squat.closedReason, 'key-conflict');
+      assert.ok(sent.some((f) => f.type === 'error' && f.code === 1009), 'sealed 1009 IDENTITY_CONFLICT');
+    } finally { await stopAll(b, x); }
+  });
+
+  it('a directed record SVAF does not admit (remixed:false) earns the binding too; a broadcast SVAF refuses does not', async () => {
+    const b = mk('n3b-b');
+    try {
+      await b.start();
+      const X = identity('x'); const Y = identity('y');
+      const sX = admitAs(b, X); const sY = admitAs(b, Y);
+      b._svafEvaluator.evaluate = async () => ({ decision: 'rejected', total_drift: 0.99, category_drifts: {}, gate_values: {} });
+      const accepted = [];
+      b.on('cmb-accepted', (e) => accepted.push(e));
+      deliver(b, sX, { type: 'cmb', cmb: signedRecord(X, { categories: { focus: 'for b only' }, room: b._room, to: b.nodeId }) });
+      deliver(b, sY, { type: 'cmb', cmb: signedRecord(Y, { categories: { focus: 'for the room' }, room: b._room }) });
+      await until(() => accepted.length > 0, 2000);
+      await new Promise((r) => setTimeout(r, 100));
+      assert.ok(accepted.some((e) => e.remixed === false && e.directed === true), 'the directed record surfaced unstored');
+      assert.strictEqual(b._roster.get(X.nodeId), X.publicKey, 'directed: earned');
+      assert.strictEqual(b._roster.get(Y.nodeId), undefined, 'a refused broadcast earns nothing');
+      void sX; void sY;
+    } finally { await stopAll(b); }
+  });
+});
+
+// ── Role grants (N2, N4, N5) ───────────────────────────────────────────────────────────────────────
+const { RoleGrantStore } = require('../lib/role-grant-store');
+const { grantPayload, verifyGrant } = require('../lib/core/role-grant');
+function kp(nodeId) {
+  const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519');
+  return { nodeId: nodeId || crypto.randomUUID(), priv: privateKey.export({ format: 'der', type: 'pkcs8' }).subarray(16).toString('base64url'), pub: publicKey.export({ format: 'der', type: 'spki' }).subarray(12).toString('base64url') };
+}
+const grantOf = (type, grantee, role, grantor, at, extra = {}) => signGrant({ type, grantee: grantee.nodeId, ...(role ? { role } : {}), grantedBy: grantor.nodeId, grantedAt: at, ...(type === 'role-grant' ? { granteeKey: grantee.pub } : {}), ...extra }, grantor.priv);
+
+describe('N2: a revoke carries a cutoff; when a node received anything is no part of the rule', () => {
+  // V legitimately revokes W on "day 1"; the anchor revokes V on "day 3" (its cutoff: day 3).
+  const ANC = kp(), V = kp(), W = kp();
+  const t = Date.now() - 1_000_000;
+  const R = {
+    AV: grantOf('role-grant', V, 'validator', ANC, t),
+    AW: grantOf('role-grant', W, 'validator', ANC, t + 1),
+    rVW: grantOf('role-revoke', W, undefined, V, t + 100_000),
+    rAV: grantOf('role-revoke', V, undefined, ANC, t + 300_000),
+  };
+  const roleOfW = (store) => store.resolveRole(W.nodeId, W.pub, Date.now());
+
+  it('an early receiver, a late receiver and a store upgraded from 0.13 all resolve W as revoked', () => {
+    // The early receiver was online on day 1: each record reached it moments after it was signed.
+    const clock = { now: t };
+    const early = new RoleGrantStore({ anchor: { nodeId: ANC.nodeId, publicKey: ANC.pub }, now: () => clock.now });
+    for (const k of ['AV', 'AW', 'rVW', 'rAV']) { clock.now = R[k].grantedAt + 500; assert.strictEqual(early.record(R[k]).stored, true, k); }
+    clock.now = Date.now();
+    assert.strictEqual(roleOfW(early), 'participant', 'early receiver');
+    const late = new RoleGrantStore({ anchor: { nodeId: ANC.nodeId, publicKey: ANC.pub } });
+    for (const k of ['AV', 'AW', 'rAV']) late.record(R[k]);
+    assert.strictEqual(late.record(R.rVW).stored, true, 'V\'s revoke, signed before V\'s cutoff, stands when it arrives after V\'s own revoke');
+    assert.strictEqual(roleOfW(late), 'participant', 'late receiver');
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'n2-upgrade-'));
+    try {
+      // A 0.13 store: bare lines, no receipt times, in the order 0.13 happened to write them.
+      fs.writeFileSync(path.join(dir, 'role-grants.jsonl'), ['AV', 'AW', 'rAV', 'rVW'].map((k) => JSON.stringify(R[k])).join('\n') + '\n');
+      const upgraded = new RoleGrantStore({ anchor: { nodeId: ANC.nodeId, publicKey: ANC.pub }, dir });
+      assert.strictEqual(upgraded.loadReport().loaded, 4);
+      assert.strictEqual(roleOfW(upgraded), 'participant', 'upgraded store');
+    } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+  });
+
+  it('a newcomer that learns the store by anti-entropy sync resolves W as revoked', async () => {
+    const boot = (b) => new SymNode({ name: uniq(b), silent: true, discovery: new NullDiscovery(), room: 'n2', anchor: { nodeId: ANC.nodeId, publicKey: ANC.pub } });
+    const P = boot('n2-p'); const N = boot('n2-n');
+    try {
+      await P.start(); await N.start();
+      for (const k of ['AV', 'AW', 'rVW', 'rAV']) assert.strictEqual(P._roleGrants.record(R[k]).stored, true);
+      await connectNodes(P, N);
+      await until(() => N._roleGrants.size() === 4, 3000);
+      assert.strictEqual(N._roleGrants.size(), 4, 'the whole store arrived');
+      assert.strictEqual(N.resolveRole(W.nodeId, Date.now(), { key: W.pub }), 'participant');
+    } finally { await stopAll(P, N); }
+  });
+
+  it('the cutoff reaches back: what the revoked node signed at or after it never counts, even before the revoke was signed', () => {
+    const X = kp();
+    const store = new RoleGrantStore({ anchor: { nodeId: ANC.nodeId, publicKey: ANC.pub } });
+    store.record(R.AV); store.record(R.AW);
+    assert.strictEqual(store.record(grantOf('role-revoke', V, undefined, ANC, t + 300_000, { cutoff: t + 50_000 })).stored, true);
+    assert.strictEqual(store.resolveRole(V.nodeId, V.pub, t + 40_000), 'validator', 'before the cutoff');
+    assert.strictEqual(store.resolveRole(V.nodeId, V.pub, t + 60_000), 'participant', 'from the cutoff, before the revoke was signed');
+    assert.deepStrictEqual(store.record(R.rVW), { stored: false, reason: 'unrooted' }, 'V\'s revoke of W, signed after the cutoff, does not count');
+    assert.strictEqual(roleOfW(store), 'validator');
+    assert.strictEqual(store.record(grantOf('role-grant', X, 'validator', V, t + 10_000)).stored, true, 'V\'s grant before the cutoff stands as a statement');
+  });
+
+  it('a revoker reaches back only over time it was itself authorised for', () => {
+    const Q = kp(); const X = kp();
+    const store = new RoleGrantStore({ anchor: { nodeId: ANC.nodeId, publicKey: ANC.pub } });
+    store.record(grantOf('role-grant', X, 'validator', ANC, t));
+    store.record(grantOf('role-grant', Q, 'validator', ANC, t + 200_000)); // Q a validator from t+200 s
+    assert.deepStrictEqual(store.record(grantOf('role-revoke', X, undefined, Q, t + 300_000, { cutoff: t + 100_000 })), { stored: false, reason: 'unrooted' }, 'a cutoff before Q held rank');
+    assert.strictEqual(store.record(grantOf('role-revoke', X, undefined, Q, t + 300_000, { cutoff: t + 250_000 })).stored, true);
+  });
+
+  it('wire: a revoke without a cutoff signs the bytes 0.13 signed; the cutoff is signed when present, at most the revoke\'s time, only on a revoke', () => {
+    const r = { type: 'role-revoke', grantee: 'g', grantedBy: 'b', grantedAt: 5 };
+    assert.strictEqual(grantPayload(r).toString(), 'role-revoke|g||b|5|');
+    assert.strictEqual(grantPayload({ ...r, cutoff: 3 }).toString(), 'role-revoke|g||b|5||3');
+    const c = grantOf('role-revoke', W, undefined, ANC, t + 10, { cutoff: t });
+    assert.strictEqual(verifyGrant(c, ANC.pub).valid, true);
+    assert.strictEqual(verifyGrant({ ...c, cutoff: t + 1 }, ANC.pub).valid, false, 'the cutoff is signed');
+    const store = new RoleGrantStore({ anchor: { nodeId: ANC.nodeId, publicKey: ANC.pub } });
+    assert.strictEqual(store.record(grantOf('role-revoke', W, undefined, ANC, t, { cutoff: t + 1 })).reason, 'malformed', 'a cutoff after the revoke');
+    assert.strictEqual(store.record(grantOf('role-grant', W, 'validator', ANC, t, { cutoff: t })).reason, 'malformed', 'a cutoff on a grant');
+    assert.strictEqual(store.record(grantOf('role-revoke', W, undefined, ANC, t, { granteeKey: 'abc|1' })).reason, 'malformed', 'a revoke key that is not a key');
+    store.record(c);
+    assert.strictEqual(store.grantsFor(W.nodeId)[0].cutoff, t, 'kept with its cutoff');
+  });
+});
+
+describe('N4: no cap refuses a revoke; revokes are bounded by their grants', () => {
+  it('past every grant cap a validator can still revoke; one revoke per grant its grantee holds', () => {
+    const A = kp(), M = kp(), H = kp(), X = kp();
+    const store = new RoleGrantStore({ anchor: { nodeId: A.nodeId, publicKey: A.pub }, maxPerGrantor: 2, maxPerPair: 1, maxGrants: 5 });
+    const t = Date.now() - 100_000;
+    store.record(grantOf('role-grant', M, 'validator', A, t));
+    store.record(grantOf('role-grant', H, 'validator', A, t));
+    assert.strictEqual(store.record(grantOf('role-grant', X, 'validator', H, t + 1)).stored, true, 'H grants X (H\'s pair with X is now full)');
+    // M fills what is left of the store with sybil grants.
+    for (let i = 0; i < 2; i++) store.record(grantOf('role-grant', kp(), 'validator', M, t + 2 + i));
+    assert.strictEqual(store.record(grantOf('role-grant', kp(), 'validator', H, t + 9)).reason, 'store-full', 'the grant caps are full');
+    const rHX = grantOf('role-revoke', X, undefined, H, t + 10);
+    assert.strictEqual(store.record(rHX).stored, true, 'H\'s revoke of X is kept: pair-full, grantor-full and store-full never refuse a revoke');
+    assert.strictEqual(store.resolveRole(X.nodeId, X.pub, Date.now()), 'participant');
+    const rHM = grantOf('role-revoke', M, undefined, H, t + 11);
+    assert.strictEqual(store.record(rHM).stored, true, 'and H can revoke the flooder');
+    // Bounded by grants: X holds one grant, so H keeps one revoke for X; a grantee with none, none.
+    assert.strictEqual(store.record(grantOf('role-revoke', X, undefined, H, t + 12)).reason, 'nothing-to-revoke');
+    assert.strictEqual(store.record(grantOf('role-revoke', kp(), undefined, H, t + 13)).reason, 'nothing-to-revoke');
+    assert.strictEqual(store.record(grantOf('role-revoke', kp(), undefined, A, t + 14)).stored, true, 'the anchor\'s own are never refused');
+  });
+});
+
+describe('N4 at the node: a whole-store sync never sends a revoke ahead of the grant it clears', () => {
+  it('a revoke whose grant is on a later page still counts after the sync', async () => {
+    const A = kp(), V = kp(), Q = kp(), X = kp();
+    const t = Date.now() - 100_000;
+    const recs = [
+      grantOf('role-grant', V, 'validator', A, t),
+      grantOf('role-grant', Q, 'validator', A, t),
+      grantOf('role-grant', X, 'validator', Q, t + 1),
+      grantOf('role-revoke', X, undefined, V, t + 2),
+      // V's own later grants fill the first page after its revoke (64 records a page).
+      ...Array.from({ length: 70 }, (_, i) => grantOf('role-grant', kp(), 'validator', V, t + 3 + i)),
+    ];
+    const boot = (b) => new SymNode({ name: uniq(b), silent: true, discovery: new NullDiscovery(), room: 'n4', anchor: { nodeId: A.nodeId, publicKey: A.pub } });
+    const P = boot('n4-p'); const N = boot('n4-n');
+    try {
+      await P.start(); await N.start();
+      for (const g of recs) assert.strictEqual(P._roleGrants.record(g).stored, true);
+      await connectNodes(P, N);
+      await until(() => N._roleGrants.size() === recs.length, 5000);
+      assert.strictEqual(N._roleGrants.size(), recs.length, 'every record arrived');
+      assert.strictEqual(N.resolveRole(X.nodeId, Date.now(), { key: X.pub }), 'participant', 'V\'s revoke of X counts');
+    } finally { await stopAll(P, N); }
+  });
+});
+
+describe('N5: a 0.13 grant store is never rewritten, so a record skipped at load is never lost', () => {
+  it('a record whose root is not yet held stays on disk and loads once its root does', () => {
+    const A = kp(), Q = kp(), X = kp(), V = kp();
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'n5-'));
+    try {
+      const t = Date.now() - 100_000;
+      const file = path.join(dir, 'role-grants.jsonl');
+      const lines = [grantOf('role-grant', V, 'validator', A, t), grantOf('role-grant', X, 'validator', Q, t + 2)].map((g) => JSON.stringify(g)).join('\n') + '\n';
+      fs.writeFileSync(file, lines); // as 0.13 wrote it: bare lines
+      const s1 = new RoleGrantStore({ anchor: { nodeId: A.nodeId, publicKey: A.pub }, dir });
+      assert.deepStrictEqual({ loaded: s1.loadReport().loaded, skipped: s1.loadReport().skipped }, { loaded: 1, skipped: { 'unknown-grantor-key': 1 } });
+      assert.strictEqual(fs.readFileSync(file, 'utf8'), lines, 'the file is exactly as it was: nothing dropped, nothing rewritten');
+      s1.record(grantOf('role-grant', Q, 'validator', A, t + 1)); // Q's root arrives
+      const s2 = new RoleGrantStore({ anchor: { nodeId: A.nodeId, publicKey: A.pub }, dir });
+      assert.strictEqual(s2.loadReport().loaded, 3, 'the skipped record loads at the next start');
+      assert.strictEqual(s2.resolveRole(X.nodeId, X.pub, Date.now()), 'validator');
+    } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+  });
+});
+
+// ── Record size limits (draft spec PR #37, §8.8.6) ─────────────────────────────────────────────────
+const { categoryKeyV1, MAX_RECORD_BYTES, MAX_SEALED_CHARS, CAT7_CATEGORIES } = require('../lib/core/cmb-encoder');
+const { buildEncryptedFrame } = require('../lib/core/cmb-encrypted-frame');
+const { blockKeyV2, signCMB, assertionIdV2_0 } = require('../lib/core');
+
+describe('caps: a received record over a §8.8.6 limit is refused before any other work', () => {
+  /** A record an implementation without this release's minting limits would sign. */
+  function v2Record(peer, texts, room) {
+    const categories = {};
+    for (const f of CAT7_CATEGORIES) { const text = texts[f] || 'neutral'; categories[f] = { text, meta: { key: categoryKeyV1(f, text), parents: [] } }; }
+    const cmb = { categories, metadata: { key: blockKeyV2(categories), addressScheme: 'mmp-cmb-merkle-v2', signatureSuite: 'mmp-sig-v2.0', createdByNodeId: peer.nodeId, createdBy: peer.name, createdTimestamp: Date.now(), room, to: null, lineage: null, application: null } };
+    cmb.metadata.assertionId = assertionIdV2_0(cmb);
+    signCMB(cmb, peer.privateKey);
+    return cmb;
+  }
+  for (const [label, texts, why] of [
+    ['600 KiB of text in all (each category under 256 KiB)', { focus: 'a'.repeat(200 * 1024), issue: 'b'.repeat(200 * 1024), intent: 'c'.repeat(200 * 1024) }, /categories together are too long/],
+    ['400 KiB of text that encodes to over 720 KiB', { focus: '"'.repeat(200 * 1024), issue: '"'.repeat(200 * 1024) }, /record is too long/],
+  ]) {
+    it(label, async () => {
+      const b = mk('caps-b');
+      try {
+        await b.start();
+        const P = identity('peer-big');
+        const s = admitAs(b, P);
+        let encoded = 0;
+        b._svafEvaluator.evaluate = async () => { encoded++; return null; };
+        const metrics = [];
+        b.on('metric', (m) => metrics.push(m));
+        const cmb = v2Record(P, texts, b._room);
+        deliver(b, s, { type: 'cmb', cmb });
+        await new Promise((r) => setTimeout(r, 100));
+        assert.ok(metrics.some((m) => m.type === 'cmb-signature-rejected' && m.reason === 'malformed-record' && why.test(m.error)), 'refused by its size');
+        assert.strictEqual(encoded, 0, 'before SVAF encoded anything');
+        assert.strictEqual(b._store.allEntries().length, 0);
+      } finally { await stopAll(b); }
+    });
+  }
+
+  it('a sealed frame longer than a 720 KiB record can produce is refused unopened, and the session is unharmed', async () => {
+    const p = mk('caps-p'); const n = mk('caps-n');
+    try {
+      await p.start(); await n.start();
+      await connectNodes(p, n);
+      const sN = n._peers.get(p.nodeId).transport;
+      const refused = [];
+      sN.on('refused', (type, reason) => refused.push(reason));
+      const huge = { categories: { focus: { text: 'x', meta: { key: 'k', parents: [] } } }, metadata: { key: 'cmb-x', assertionId: 'asrt-x', createdByNodeId: p.nodeId, room: n._room, to: null } };
+      const frame = buildEncryptedFrame({ cmb: huge, sessionId: sN.sessionId, direction: sN.role === 'client' ? 'server-to-client' : 'client-to-server', sequence: '0', trafficKey: crypto.randomBytes(32) });
+      frame.sealed = 'A'.repeat(MAX_SEALED_CHARS + 1);
+      sN.receiveWire(frame);
+      assert.deepStrictEqual(refused, ['record-too-large'], 'refused by its length, before the AEAD is tried');
+      assert.strictEqual(sN.closed, false);
+      const got = [];
+      n.on('verified-record', (e) => got.push(e.record.metadata.key));
+      const sent = p.remember({ focus: 'still heard after the oversized frame', issue: 'caps' });
+      await until(() => got.includes(sent.cmb.metadata.key), 3000);
+      assert.ok(got.includes(sent.cmb.metadata.key), 'the next genuine record arrives on the same session');
+      assert.ok(MAX_SEALED_CHARS === Math.ceil(4 * (MAX_RECORD_BYTES + 16) / 3));
+    } finally { await stopAll(p, n); }
+  });
+});
+
+// ── The notes' open leads ──────────────────────────────────────────────────────────────────────────
+const { canonicalRecordV2_0 } = require('../lib/core/record-canonical');
+
+describe('leads', () => {
+  it('a record with no metadata.to is refused: the MMP v2.0 record schema requires `to` (null for a room-bound record)', () => {
+    const schema = path.join(os.homedir().replace(/\/[^/]*sandbox[^/]*$/, ''), 'code', 'mesh-memory-protocol', 'schema', 'cmb.schema.json');
+    const real = path.join('/Users', os.userInfo().username, 'code', 'mesh-memory-protocol', 'schema', 'cmb.schema.json');
+    const file = fs.existsSync(real) ? real : schema;
+    if (fs.existsSync(file)) assert.ok(JSON.parse(fs.readFileSync(file, 'utf8')).properties.metadata.required.includes('to'), 'the published schema requires metadata.to');
+    const A = identity('a');
+    const r = signedRecord(A, { categories: { focus: 'room-bound' }, room: 'r' });
+    assert.doesNotThrow(() => canonicalRecordV2_0(r), 'to: null is a room-bound record');
+    const absent = JSON.parse(JSON.stringify(r));
+    delete absent.metadata.to;
+    assert.throws(() => canonicalRecordV2_0(absent), /to is not a lowercase UUID or null/);
+  });
+
+  it('a signed attestation, checkpoint or witness whose room is spelled in another Unicode form is compared in NFC', async () => {
+    const b = mk('nfc-b', { room: 'café' });
+    try {
+      await b.start();
+      const X = identity('x');
+      const sX = admitAs(b, X);
+      b._roster.bind(X.nodeId, X.publicKey, 'pinned');
+      const decomposed = 'café';
+      assert.notStrictEqual(decomposed, b._room);
+      const att = signedAs({ of: `cmb-${hex()}`, by: X.nodeId, at: Date.now(), roster: decomposed, verdict: 'aligned', categories: CATS7, seq: 1, prev: 'genesis' }, X.privateKey, signAttestation);
+      assert.notStrictEqual(b._ingestAttestation(att, X.nodeId, X.name, sX).reason, 'roster-mismatch');
+      const cp = signedAs({ by: X.nodeId, upto_seq: 1, root: hex(), at: Date.now(), roster: decomposed }, X.privateKey, signCheckpoint);
+      assert.notStrictEqual(b._ingestCheckpoint(cp, X.nodeId, sX).reason, 'roster-mismatch');
+      const w = signedAs({ attester: X.nodeId, upto_seq: 2, root: hex(), by: X.nodeId, role: 'participant', at: Date.now(), roster: decomposed }, X.privateKey, signWitness);
+      assert.notStrictEqual(b._ingestWitness(w, X.nodeId, sX).reason, 'roster-mismatch');
+      assert.strictEqual(b._ingestAttestation({ ...att, sig: att.sig, roster: 'another-room' }, X.nodeId, X.name, sX).reason, 'roster-mismatch', 'another room is still refused');
+    } finally { await stopAll(b); }
+  });
+
+  it('remember() and send() refuse an addressee that is not a lowercase UUID, before minting', async () => {
+    const b = mk('to-b');
+    try {
+      await b.start();
+      const id = crypto.randomUUID();
+      for (const bad of [id.toUpperCase(), 'peer-a', 42, [id]]) {
+        assert.throws(() => b.remember({ focus: 'to someone' }, { to: bad }), (e) => e.code === 'EBADTO', String(bad));
+      }
+      assert.strictEqual(b._store.allEntries().length, 0, 'nothing minted');
+      assert.ok(b.remember({ focus: 'to a nodeId' }, { to: id }), 'a lowercase UUID is taken');
+      assert.strictEqual(b.send('hello', { to: id.toUpperCase() }), 0, 'send says it delivered nothing');
+    } finally { await stopAll(b); }
+  });
+
+  it('a node whose own nodeId is not a lowercase UUID says so at start', async () => {
+    const b = mk('id-b');
+    const lines = [];
+    const metrics = [];
+    b._log = (l) => lines.push(l);
+    b.on('metric', (m) => metrics.push(m));
+    try {
+      await b.start();
+      assert.ok(!metrics.some((m) => m.type === 'node-id-not-canonical'), 'a minted identity is a UUIDv7');
+      await b.stop();
+      b.nodeId = 'legacy-node-id';
+      await b.start();
+      assert.ok(metrics.some((m) => m.type === 'node-id-not-canonical'));
+      assert.ok(lines.some((l) => /not a lowercase UUID/.test(l)));
+    } finally { b.nodeId = b._identity.nodeId; await stopAll(b); }
+  });
+});
diff --git a/tests/core-secure-review.test.js b/tests/core-secure-review.test.js
index 5a14fbba..52199e03 100644
--- a/tests/core-secure-review.test.js
+++ b/tests/core-secure-review.test.js
@@ -174,65 +174,76 @@ describe('B. a record is its signed projection (cs-review-B/p3-unsigned, cs-revi
   });
 });
 
-describe('C. authority counts at the signed time and at receipt (cs-review-B, draft spec PR #33)', () => {
+describe('C. a revoke carries a cutoff: what the revoked node signed before it stands, at or after it never counts (cs-review-B; re-review N2 replaces draft spec PR #33\'s receipt time)', () => {
   const ANC = kp('anchor'), V = kp('validator-v'), W = kp('validator-w'), H = kp('honest-h'), ATT = kp('attacker');
   const t0 = Date.now() - 100_000;
+  // V was granted at t0 and revoked at t0+50 s, its trust withdrawn from t0+500 ms (the cutoff).
+  const CUT = t0 + 500;
   function world() {
     const roster = new RosterKeyRegistry({ anchor: { nodeId: ANC.nodeId, publicKey: ANC.pub }, self: { nodeId: 'receiver', publicKey: kp('receiver').pub } });
     const store = new RoleGrantStore({ anchor: { nodeId: ANC.nodeId, publicKey: ANC.pub }, keys: roster, selfId: 'receiver' });
     roster.setGrantView((id) => store.vouchedKey(id));
     store.record(grantOf('role-grant', V, 'validator', ANC, t0));
     store.record(grantOf('role-grant', W, 'validator', ANC, t0 + 10));
-    store.record(grantOf('role-revoke', V, undefined, ANC, t0 + 50_000));
+    store.record(grantOf('role-revoke', V, undefined, ANC, t0 + 50_000, { cutoff: CUT }));
     return { roster, store };
   }
 
-  it('p2-revoked-vouch: a revoked validator\'s backdated grant binds no key, for another node or for this one', () => {
+  it('p2-revoked-vouch: a revoked validator\'s grant dated at or after its cutoff is not kept; one before it is kept but confers nothing now; no key is bound', () => {
     const { roster, store } = world();
     assert.strictEqual(store.resolveRole(V.nodeId, V.pub, Date.now()), 'participant');
     const r = store.record(grantOf('role-grant', { nodeId: H.nodeId, pub: ATT.pub }, 'validator', V, t0 + 1000));
-    assert.deepStrictEqual(r, { stored: false, reason: 'unrooted' }, 'V is not authorised at receipt');
+    assert.deepStrictEqual(r, { stored: false, reason: 'unrooted' }, 'V signed it after its cutoff');
     assert.strictEqual(roster.get(H.nodeId), undefined, 'the attacker key is bound to nobody');
+    const early = store.record(grantOf('role-grant', { nodeId: H.nodeId, pub: ATT.pub }, 'validator', V, t0 + 100));
+    assert.strictEqual(early.stored, true, 'a statement V signed before its cutoff stands');
+    assert.strictEqual(store.resolveRole(H.nodeId, ATT.pub, Date.now()), 'participant', 'and confers nothing while V is revoked (the §6.6 cascade)');
+    assert.strictEqual(roster.get(H.nodeId), undefined, 'so it vouches no key');
     const self = store.record(grantOf('role-grant', { nodeId: 'receiver', pub: ATT.pub }, 'validator', V, t0 + 1001));
     assert.strictEqual(self.stored, false);
     assert.strictEqual(roster.get('receiver'), roster._self.publicKey, 'this node\'s own id is always its own key');
   });
 
-  it('p2c-backdate: a revoked validator\'s backdated revoke strips nothing, and its backdated attestation weighs as a participant', () => {
+  it('p2c-backdate: a revoked validator\'s revoke dated after its cutoff strips nothing, and its attestation dated after it weighs as a participant', () => {
     const { store } = world();
-    assert.deepStrictEqual(store.record(grantOf('role-revoke', W, undefined, V, t0 + 20)), { stored: false, reason: 'unrooted' });
+    assert.deepStrictEqual(store.record(grantOf('role-revoke', W, undefined, V, t0 + 1000)), { stored: false, reason: 'unrooted' });
     assert.strictEqual(store.resolveRole(W.nodeId, W.pub, Date.now()), 'validator', 'W keeps its role');
-    // An attestation V signs now, dated inside its old window: the role at receipt is the one that counts.
-    const att = { by: V.nodeId, at: t0 + 1000, role: 'validator' };
-    const now = Date.now();
-    const both = (id, at) => { const a = store.resolveRole(id, V.pub, at); const b = store.resolveRole(id, V.pub, now); return a === 'participant' || b === 'participant' ? 'participant' : a; };
-    assert.strictEqual(verifyAttestationRole(att, both).resolved, 'participant');
+    const role = (at) => verifyAttestationRole({ by: V.nodeId, at, role: 'validator' }, (id, t) => store.resolveRole(id, V.pub, t)).resolved;
+    assert.strictEqual(role(t0 + 1000), 'participant', 'dated after the cutoff: a participant\'s');
+    assert.strictEqual(role(t0 + 100), 'validator', 'dated before it: it stands');
   });
 
-  it('a revoke that counted at receipt keeps its standing when its signer is later revoked', () => {
+  it('a revoke signed before its revoker\'s cutoff stands, whichever arrives first', () => {
     const ANC2 = kp('anchor-2'), V2 = kp('v-2'), X = kp('x-2');
-    const store = new RoleGrantStore({ anchor: { nodeId: ANC2.nodeId, publicKey: ANC2.pub } });
     const t = Date.now() - 10_000;
-    store.record(grantOf('role-grant', V2, 'validator', ANC2, t));
-    store.record(grantOf('role-grant', X, 'validator', ANC2, t + 1));
-    assert.strictEqual(store.record(grantOf('role-revoke', X, undefined, V2, t + 2)).stored, true, 'V2 is authorised at both times');
-    assert.strictEqual(store.resolveRole(X.nodeId, X.pub, Date.now()), 'participant');
-    store.record(grantOf('role-revoke', V2, undefined, ANC2, Date.now() + 5));
-    assert.strictEqual(store.resolveRole(X.nodeId, X.pub, Date.now() + 10), 'participant', 'the revoke stands');
+    const recs = {
+      AV: grantOf('role-grant', V2, 'validator', ANC2, t),
+      AX: grantOf('role-grant', X, 'validator', ANC2, t + 1),
+      rVX: grantOf('role-revoke', X, undefined, V2, t + 2),
+      rAV: grantOf('role-revoke', V2, undefined, ANC2, t + 5),
+    };
+    for (const order of [['AV', 'AX', 'rVX', 'rAV'], ['AV', 'AX', 'rAV', 'rVX']]) {
+      const store = new RoleGrantStore({ anchor: { nodeId: ANC2.nodeId, publicKey: ANC2.pub } });
+      for (const k of order) assert.strictEqual(store.record(recs[k]).stored, true, `${order.join(' ')}: ${k}`);
+      assert.strictEqual(store.resolveRole(X.nodeId, X.pub, Date.now()), 'participant', `${order.join(' → ')}: the revoke stands`);
+    }
   });
 
-  it('a revoke whose revoker the anchor had revoked by the time it was received has no effect, even when the anchor\'s revoke arrives later', () => {
+  it('a revoke signed at or after its revoker\'s cutoff has no effect, whichever arrives first', () => {
     const ANC3 = kp('anchor-3'), V3 = kp('v-3'), W3 = kp('w-3');
-    const store = new RoleGrantStore({ anchor: { nodeId: ANC3.nodeId, publicKey: ANC3.pub } });
     const t = Date.now() - 100_000;
-    store.record(grantOf('role-grant', V3, 'validator', ANC3, t));
-    store.record(grantOf('role-grant', W3, 'validator', ANC3, t + 1));
-    // V3's revoke of W3, signed at t+20, received now: by what is known now, V3 is authorised: stored.
-    assert.strictEqual(store.record(grantOf('role-revoke', W3, undefined, V3, t + 20)).stored, true);
-    assert.strictEqual(store.resolveRole(W3.nodeId, W3.pub, Date.now()), 'participant');
-    // The anchor had revoked V3 at t+30 (after V3 signed, before this node received it); that arrives now.
-    store.record(grantOf('role-revoke', V3, undefined, ANC3, t + 30));
-    assert.strictEqual(store.resolveRole(W3.nodeId, W3.pub, Date.now()), 'validator', 'V3 was not authorised at receipt: the revoke does not count');
+    const recs = {
+      AV: grantOf('role-grant', V3, 'validator', ANC3, t),
+      AW: grantOf('role-grant', W3, 'validator', ANC3, t + 1),
+      rVW: grantOf('role-revoke', W3, undefined, V3, t + 20),
+      // The anchor revoked V3 at t+30, withdrawing its trust from t+10.
+      rAV: grantOf('role-revoke', V3, undefined, ANC3, t + 30, { cutoff: t + 10 }),
+    };
+    for (const order of [['AV', 'AW', 'rVW', 'rAV'], ['AV', 'AW', 'rAV', 'rVW']]) {
+      const store = new RoleGrantStore({ anchor: { nodeId: ANC3.nodeId, publicKey: ANC3.pub } });
+      for (const k of order) store.record(recs[k]);
+      assert.strictEqual(store.resolveRole(W3.nodeId, W3.pub, Date.now()), 'validator', `${order.join(' → ')}: V3 signed after its cutoff`);
+    }
   });
 
   it('a grant naming this node with a foreign key is inert and reported (p2b-node)', () => {
@@ -246,7 +257,7 @@ describe('C. authority counts at the signed time and at receipt (cs-review-B, dr
     assert.strictEqual(store.vouchedKey(own.nodeId), undefined);
   });
 
-  it('p2b-node: at the node, a backdated grant from a revoked validator is not stored or relayed, and records forged under it are refused', async () => {
+  it('p2b-node: at the node, a grant a revoked validator dated after its cutoff is not stored or relayed, and records forged under it are refused', async () => {
     const ANCN = identity('anchor-n');
     const b = mk('p2b', { anchor: { nodeId: ANCN.nodeId, publicKey: ANCN.publicKey }, room: 'r' });
     try {
@@ -256,7 +267,7 @@ describe('C. authority counts at the signed time and at receipt (cs-review-B, dr
       const g = (o, k) => ({ type: o.type, grant: signGrant({ ...o }, k) });
       const VV = identity('validator-n'); const HH = identity('honest-n'); const AT = identity('att-n');
       deliver(b, s, g({ type: 'role-grant', grantee: VV.nodeId, role: 'validator', grantedBy: ANCN.nodeId, grantedAt: t0, granteeKey: VV.publicKey }, ANCN.privateKey));
-      deliver(b, s, g({ type: 'role-revoke', grantee: VV.nodeId, grantedBy: ANCN.nodeId, grantedAt: t0 + 50_000 }, ANCN.privateKey));
+      deliver(b, s, g({ type: 'role-revoke', grantee: VV.nodeId, grantedBy: ANCN.nodeId, grantedAt: t0 + 50_000, cutoff: t0 + 500 }, ANCN.privateKey));
       deliver(b, s, g({ type: 'role-grant', grantee: HH.nodeId, role: 'validator', grantedBy: VV.nodeId, grantedAt: t0 + 1000, granteeKey: AT.publicKey }, VV.privateKey));
       deliver(b, s, g({ type: 'role-grant', grantee: b.nodeId, role: 'validator', grantedBy: VV.nodeId, grantedAt: t0 + 1001, granteeKey: AT.publicKey }, VV.privateKey));
       assert.strictEqual(b._roster.source(HH.nodeId), undefined);
@@ -706,7 +717,7 @@ describe('the rest of the review (cs-review-B/p11-cli-compact, node-level attest
     } finally { fs.rmSync(dir, { recursive: true, force: true }); }
   });
 
-  it('p2c-backdate at the node: a revoked validator\'s attestation, dated inside its old window, weighs as a participant', async () => {
+  it('p2c-backdate at the node: a revoked validator\'s attestation dated at or after its cutoff weighs as a participant', async () => {
     const ANCN = identity('anchor-att');
     const node = mk('att-w', { anchor: { nodeId: ANCN.nodeId, publicKey: ANCN.publicKey } });
     try {
@@ -714,12 +725,12 @@ describe('the rest of the review (cs-review-B/p11-cli-compact, node-level attest
       const t0 = Date.now() - 100_000;
       node._roleGrants.record(signGrant({ type: 'role-grant', grantee: V.nodeId, role: 'validator', grantedBy: ANCN.nodeId, grantedAt: t0, granteeKey: V.publicKey }, ANCN.privateKey));
       node._roster.bind(V.nodeId, V.publicKey, 'pinned');
-      const inWindow = { by: V.nodeId, at: t0 + 1000, receivedAt: t0 + 1500 };
-      assert.strictEqual(node._attesterRole(inWindow), 'validator', 'received while V was a validator: it counts');
-      node._roleGrants.record(signGrant({ type: 'role-revoke', grantee: V.nodeId, grantedBy: ANCN.nodeId, grantedAt: t0 + 50_000 }, ANCN.privateKey));
-      assert.strictEqual(node._attesterRole(inWindow), 'validator', 'and keeps its standing after V is revoked');
-      const backdated = { by: V.nodeId, at: t0 + 1000, receivedAt: Date.now() };
-      assert.strictEqual(node._attesterRole(backdated), 'participant', 'one received after the revoke, dated before it, does not');
+      const inWindow = { by: V.nodeId, at: t0 + 1000 };
+      assert.strictEqual(node._attesterRole(inWindow), 'validator', 'signed while V was a validator: it counts');
+      node._roleGrants.record(signGrant({ type: 'role-revoke', grantee: V.nodeId, grantedBy: ANCN.nodeId, grantedAt: t0 + 50_000, cutoff: t0 + 2000 }, ANCN.privateKey));
+      assert.strictEqual(node._attesterRole(inWindow), 'validator', 'and, signed before the cutoff, keeps its standing after V is revoked, for every receiver');
+      const backdated = { by: V.nodeId, at: t0 + 3000 };
+      assert.strictEqual(node._attesterRole(backdated), 'participant', 'one dated at or after the cutoff never counts, whenever it was signed (re-review N2)');
     } finally { await stopAll(node); }
   });
 });
diff --git a/tests/directed-delivery-accountability.test.js b/tests/directed-delivery-accountability.test.js
index 2f6eae9d..c8b6cfb2 100644
--- a/tests/directed-delivery-accountability.test.js
+++ b/tests/directed-delivery-accountability.test.js
@@ -69,7 +69,8 @@ function fieldsOf(focusText) {
   };
 }
 
-const ABSENT_PEER = 'peer-that-is-not-here-0000000000000000';
+// A nodeId is a lowercase UUID (MMP §3.1.1): remember() refuses a `to` spelled otherwise.
+const ABSENT_PEER = '0190dead-0000-7000-8000-000000000000';
 
 describe('directed delivery accountability (bl-a6e63608c8c)', () => {
   it('reports a directed send to an absent peer as UNDELIVERED', async () => {
diff --git a/tests/gossip-lanes.test.js b/tests/gossip-lanes.test.js
index 7d24d1f5..3f8b41dd 100644
--- a/tests/gossip-lanes.test.js
+++ b/tests/gossip-lanes.test.js
@@ -218,7 +218,7 @@ describe('the budget is kept per PROVEN peer (F2; Core Secure design D1)', () =>
     });
   });
 
-  it('forgeries spend only their own peer\'s lane, never the shared ceiling, and a forgery on a session ends it (security review D, p7-ceiling)', () => {
+  it('forgeries spend only their own peer\'s lane, never the shared ceiling, and a forgery in a session\'s own name ends it (security review D, p7-ceiling; re-review N1)', () => {
     withNode({}, ({ node, metrics }) => {
       const A = kp('att-A');
       node._roster.bind(A.id, A.pub, 'proven');
@@ -229,12 +229,20 @@ describe('the budget is kept per PROVEN peer (F2; Core Secure design D1)', () =>
       assert.strictEqual(badSig, 300 * 100, 'each peer checks its own 100');
       assert.strictEqual(node._gossipGlobal.tokens, node._gossipGlobalBurst, 'no forgery spent the shared ceiling');
       assert.strictEqual(metrics.filter((m) => m.type === 'gossip-over-ceiling').length, 0);
-      // On a session, the first forgery is attributable: the session ends and its id waits out a penalty.
-      const s = admitAs(node, { nodeId: 'forger-1' });
-      assert.strictEqual(node._ingestAttestation(forged(A), 'forger-1', 'forger-1', s).reason, 'bad-signature');
-      assert.strictEqual(s.closed, true, 'a forged signature on a proven session closes it');
-      assert.strictEqual(node._penalised('forger-1'), true, 'and its nodeId is not admitted again for a while');
-      assert.ok(metrics.some((m) => m.type === 'forged-signature' && m.peer === 'forger-1'));
+      // A relayed statement that fails here is dropped, never charged to the relayer (0.14.0 re-review
+      // N1): its binding for the signer may differ from this node's.
+      const s = admitAs(node, { nodeId: 'relayer-1' });
+      assert.strictEqual(node._ingestAttestation(forged(A), 'relayer-1', 'relayer-1', s).reason, 'bad-signature');
+      assert.strictEqual(s.closed, false, 'a relayed statement that fails does not close the relayer\'s session');
+      assert.strictEqual(node._penalised('relayer-1'), false);
+      assert.ok(metrics.some((m) => m.type === 'relayed-signature-unverified' && m.peer === 'relayer-1' && m.author === A.id));
+      // A statement in the session's OWN name that its proven key did not sign is attributable: the
+      // session ends and its id waits out a penalty.
+      const own = admitAs(node, { nodeId: A.id, publicKey: A.pub });
+      assert.strictEqual(node._ingestAttestation(forged(A), A.id, A.id, own).reason, 'bad-signature');
+      assert.strictEqual(own.closed, true, 'a forged signature in its own name closes the session');
+      assert.strictEqual(node._penalised(A.id), true, 'and its nodeId is not admitted again for a while');
+      assert.ok(metrics.some((m) => m.type === 'forged-signature' && m.peer === A.id));
     });
   });
 
diff --git a/tests/record-bounds.test.js b/tests/record-bounds.test.js
index ebc9268f..681bac88 100644
--- a/tests/record-bounds.test.js
+++ b/tests/record-bounds.test.js
@@ -8,10 +8,11 @@ require('./_isolate-home'); // redirect $HOME to a temp sandbox before lib/confi
  *   not "every room", and a v2.0 record without a room is not signed.
  * - B-R11: mood valence and arousal are measurements in [-1, 1]: absent ones are omitted, not
  *   invented as 0, out-of-range ones are refused, and numbers given without text are kept.
- * - B-R13: a category is at most 256 KiB, the seven together at most 960 KiB, an agent id at most
- *   64 bytes (§3.1.2), when a record is minted.
- * - 0.14.0 review C-F3: text bytes are not frame bytes (JSON escaping, and the E2E seal's base64), so
- *   a record is minted only when the frame it travels in, sealed, fits MAX_FRAME_SIZE.
+ * - B-R13, as the 0.14.0 re-review set it to draft spec PR #37 (§8.8.6): a category is at most
+ *   256 KiB after NFC, the seven together at most 512 KiB, the record's minified JSON at most
+ *   720 KiB, and an agent id at most 64 bytes (§3.1.2), when a record is minted.
+ * - 0.14.0 review C-F3: text bytes are not frame bytes (JSON escaping, and the seal's base64), so the
+ *   encoded limit binds as well, and the largest record that mints travels sealed in one frame.
  * - 0.14.0 review C-F4: the record bounds are minting rules. A record an earlier release minted
  *   with a longer agent id or a larger category is not refused on receipt: the frame bounds it.
  * - B-R3 (interim): an unsigned record is accepted as unverified, counted, and named once per peer.
@@ -21,9 +22,10 @@ const { describe, it } = require('node:test');
 const assert = require('node:assert');
 const fs = require('fs');
 const crypto = require('crypto');
-const { createCMB, checkAudience, signCMB, encryptCategories, assertionIdV2_0 } = require('../lib/core');
-const { MAX_CATEGORY_BYTES, MAX_RECORD_TEXT_BYTES, recordFrameBytes, categoryKeyV1, blockKeyV2, CAT7_CATEGORIES } = require('../lib/core/cmb-encoder');
-const { MAX_FRAME_SIZE, writeFrame } = require('../lib/frame-parser');
+const { createCMB, checkAudience, signCMB, assertionIdV2_0 } = require('../lib/core');
+const { MAX_CATEGORY_BYTES, MAX_RECORD_TEXT_BYTES, MAX_RECORD_BYTES, MAX_SEALED_CHARS, recordBytes, categoryKeyV1, blockKeyV2, CAT7_CATEGORIES } = require('../lib/core/cmb-encoder');
+const { buildEncryptedFrame } = require('../lib/core/cmb-encrypted-frame');
+const { MAX_FRAME_SIZE } = require('../lib/frame-parser');
 const { signingPayloadV2_0 } = require('../lib/core/cmb-signing');
 const { SymNode } = require('../lib/node');
 const { NullDiscovery } = require('../lib/discovery');
@@ -71,17 +73,25 @@ describe('mood (B-R11)', () => {
   });
 });
 
-describe('size (B-R13)', () => {
+describe('size (B-R13; §8.8.6, draft spec PR #37)', () => {
   const big = (n) => 'a'.repeat(n);
-  it('refuses a category over 256 KiB and a record whose text is over 960 KiB', () => {
+  it('the limits: 256 KiB a category, 512 KiB of text, 720 KiB encoded', () => {
+    assert.deepStrictEqual([MAX_CATEGORY_BYTES, MAX_RECORD_TEXT_BYTES, MAX_RECORD_BYTES], [262144, 524288, 737280]);
+    assert.strictEqual(MAX_SEALED_CHARS, 983062, 'ceil(4 × (737,280 + 16) / 3)');
+  });
+  it('refuses a category over 256 KiB and a record whose text is over 512 KiB', () => {
     assert.throws(() => createCMB({ categories: { focus: big(MAX_CATEGORY_BYTES + 1) }, createdBy: 'a' }), (e) => e.code === 'ECMBSIZE');
-    const near = big(MAX_CATEGORY_BYTES);
-    assert.throws(() => createCMB({ categories: { focus: near, issue: near, intent: near, motivation: near }, createdBy: 'a' }), (e) => e.code === 'ECMBSIZE' && /total/.test(e.message));
-    assert.ok(MAX_RECORD_TEXT_BYTES < MAX_FRAME_SIZE);
+    const near = big(200 * 1024);
+    assert.throws(() => createCMB({ categories: { focus: near, issue: near, intent: near }, createdBy: 'a' }), (e) => e.code === 'ECMBSIZE' && /total/.test(e.message));
+    assert.ok(createCMB({ categories: { focus: near, issue: near }, createdBy: 'a' }), '400 KiB of text mints');
   });
-  it('counts bytes, not characters', () => {
+  it('counts bytes, not characters, after NFC', () => {
     const emoji = '😀'.repeat(MAX_CATEGORY_BYTES / 4 + 1); // 4 bytes each
     assert.throws(() => createCMB({ categories: { focus: emoji }, createdBy: 'a' }), (e) => e.code === 'ECMBSIZE');
+    // 'e' + U+0301 is 3 bytes as written and 2 once composed (é): the limit is on the composed text.
+    const decomposed = 'e\u0301'.repeat(MAX_CATEGORY_BYTES / 2);
+    assert.ok(Buffer.byteLength(decomposed, 'utf8') > MAX_CATEGORY_BYTES);
+    assert.ok(createCMB({ categories: { focus: decomposed }, createdBy: 'a' }), 'within the limit after NFC');
   });
   it('refuses an agent id over 64 bytes', () => {
     assert.throws(() => createCMB({ categories: { focus: 'x' }, createdBy: 'n'.repeat(65) }), (e) => e.code === 'ECMBSIZE');
@@ -89,21 +99,13 @@ describe('size (B-R13)', () => {
   });
 });
 
-describe('a record is minted only if its frame can be sent (0.14.0 review C-F3)', () => {
-  const ID = 'n'.repeat(64); // a 64-byte node id, the longest `to` a frame names
-  const cats4 = (t) => ({ focus: t, issue: t, intent: t, motivation: t });
-  /** The frames a record travels in: plain over TCP, and sealed for a peer inside the relay envelope. */
-  function frames(record) {
-    const plain = { type: 'cmb', timestamp: Date.now(), cmb: record, to: ID, directed: true, _anchor: true };
-    const { ciphertext, nonce } = encryptCategories(record.categories, crypto.randomBytes(32));
-    const sealed = { type: 'cmb', timestamp: Date.now(), cmb: { ...record, categories: ciphertext, _e2e: { nonce } }, to: ID, directed: true, _anchor: true };
-    return { plain, relayed: { to: ID, payload: sealed } };
-  }
-  const live = { destroyed: false, writable: true, write: () => true };
-  // The longest metadata a record of this node's carries: a 64-byte author, node id, addressee and
-  // room, under the v2.0 suite (its extra fields, and an assertionId once signed).
-  const mint = (t) => createCMB({ categories: cats4(t), createdBy: 'a'.repeat(64), to: ID, room: 'r'.repeat(64), emitV2: true, createdByNodeId: ID });
-  /** The longest run of `ch` per category (four categories) that still mints, by bisection. */
+describe('a record that mints fits one sealed frame (0.14.0 review C-F3; §8.8.6)', () => {
+  const ID = crypto.randomUUID();
+  const cats = (t) => ({ focus: t, issue: t, intent: t });
+  // The longest metadata a record of this node's carries: a 64-byte author, a UUID node id and
+  // addressee, a 64-byte room, under the v2.0 suite (and an assertionId and signature once signed).
+  const mint = (t) => createCMB({ categories: cats(t), createdBy: 'a'.repeat(64), to: ID, room: 'r'.repeat(64), emitV2: true, createdByNodeId: ID });
+  /** The longest run of `ch` per category (three categories) that still mints, by bisection. */
   function largestMintable(ch) {
     let lo = 0, hi = MAX_CATEGORY_BYTES;
     while (lo < hi) {
@@ -115,33 +117,33 @@ describe('a record is minted only if its frame can be sent (0.14.0 review C-F3)'
     }
     return lo;
   }
+  /** The record sealed as a session seals it (cmb-encrypted), inside the relay envelope. */
+  function sealedRelayBytes(record) {
+    const frame = buildEncryptedFrame({ cmb: record, sessionId: 'a'.repeat(32), direction: 'client-to-server', sequence: '18446744073709551615', trafficKey: crypto.randomBytes(32) });
+    return { frame, bytes: Buffer.byteLength(JSON.stringify({ to: ID, payload: frame }), 'utf8') + 4096 };
+  }
 
-  it('text that JSON escapes is bounded by the frame, not by its text bytes', () => {
-    // 500 KiB of `"`, well inside the text bounds, is a 1 MB frame once each one is written `\"`.
-    const quotes = '"'.repeat(250 * 1024);
-    assert.throws(() => createCMB({ categories: { focus: quotes, issue: quotes }, createdBy: 'a' }), (e) => e.code === 'ECMBSIZE' && /frame/.test(e.message));
-  });
-
-  it('a record sealed for a peer is bounded with the seal\'s base64 counted', () => {
-    // 900 KiB of plain text is inside the 960 KiB text bound, and about 1.2 MB once sealed.
-    assert.throws(() => createCMB({ categories: cats4('a'.repeat(225 * 1024)), createdBy: 'a' }), (e) => e.code === 'ECMBSIZE' && /frame/.test(e.message));
+  it('text that JSON escapes is bounded by its encoding, not by its text bytes', () => {
+    // 400 KiB of `"`, inside the text limits, is an 800 KiB record once each is written `\"`.
+    const quotes = '"'.repeat(200 * 1024);
+    assert.throws(() => createCMB({ categories: { focus: quotes, issue: quotes }, createdBy: 'a' }), (e) => e.code === 'ECMBSIZE' && /encodes to/.test(e.message));
   });
 
   for (const [label, ch] of [['plain text', 'a'], ['text JSON escapes', '"'], ['control characters', '\u0001']]) {
-    it(`the largest record that mints is sendable on every transport (${label})`, () => {
+    it(`the largest record that mints travels sealed in one frame on a relay (${label})`, () => {
       const n = largestMintable(ch);
-      assert.ok(n > 0 && n < MAX_CATEGORY_BYTES, `bisection found ${n}`);
+      assert.ok(n > 0 && n <= MAX_CATEGORY_BYTES, `bisection found ${n}`);
       const record = mint(ch.repeat(n));
       record.metadata.assertionId = assertionIdV2_0(record);
       signCMB(record, crypto.randomBytes(32).toString('base64url'));
-      const { plain, relayed } = frames(record);
-      assert.strictEqual(writeFrame(live, plain).ok, true, 'over TCP in the clear');
-      assert.ok(Buffer.byteLength(JSON.stringify(relayed), 'utf8') <= MAX_FRAME_SIZE, 'sealed, inside the relay envelope');
-      assert.ok(recordFrameBytes(record) <= MAX_FRAME_SIZE);
+      assert.ok(recordBytes(record) <= MAX_RECORD_BYTES);
+      const { frame, bytes } = sealedRelayBytes(record);
+      assert.ok(frame.sealed.length <= MAX_SEALED_CHARS, 'its sealed value is within the pre-decryption bound');
+      assert.ok(bytes <= MAX_FRAME_SIZE, `sealed, in the relay envelope, with the relay allowance: ${bytes}`);
     });
   }
 
-  it('remember() refuses a payload that would make the frame too large, before storing it', async () => {
+  it('remember() refuses a payload that would make the record too large, before storing it', async () => {
     const name = `bounds-payload-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
     const node = new SymNode({ name, silent: true, discovery: new NullDiscovery() });
     await node.start();
diff --git a/tests/remember-targeted.test.js b/tests/remember-targeted.test.js
index 67ed02ec..09c77e0b 100644
--- a/tests/remember-targeted.test.js
+++ b/tests/remember-targeted.test.js
@@ -4,6 +4,11 @@ require('./_isolate-home'); // redirect $HOME to a temp sandbox before lib/confi
 
 const { describe, it } = require('node:test');
 const assert = require('node:assert');
+// nodeIds are lowercase UUIDs (MMP §3.1.1): remember() refuses a `to` spelled otherwise.
+const PEER_A_ID = '0190aaaa-0000-7000-8000-00000000000a';
+const PEER_B_ID = '0190bbbb-0000-7000-8000-00000000000b';
+const PEER_C_ID = '0190cccc-0000-7000-8000-00000000000c';
+const PEER_ABSENT_ID = '0190ffff-0000-7000-8000-00000000000f';
 const { plantSession } = require('./_core-secure');
 const fs = require('fs');
 const { SymNode } = require('../lib/node');
@@ -42,9 +47,9 @@ describe('remember({to}) — MMP §4.4.4 targeted CMB send', () => {
       const tA = capturingTransport();
       const tB = capturingTransport();
       const tC = capturingTransport();
-      plantSession(node, tA, 'peer-AAAAAAAA', 'peer-a', 'bonjour');
-      plantSession(node, tB, 'peer-BBBBBBBB', 'peer-b', 'bonjour');
-      plantSession(node, tC, 'peer-CCCCCCCC', 'peer-c', 'bonjour');
+      plantSession(node, tA, PEER_A_ID, 'peer-a', 'bonjour');
+      plantSession(node, tB, PEER_B_ID, 'peer-b', 'bonjour');
+      plantSession(node, tC, PEER_C_ID, 'peer-c', 'bonjour');
 
       const entry = node.remember({
         focus: 'broadcast fan-out regression check',
@@ -72,9 +77,9 @@ describe('remember({to}) — MMP §4.4.4 targeted CMB send', () => {
       const tA = capturingTransport();
       const tB = capturingTransport();
       const tC = capturingTransport();
-      plantSession(node, tA, 'peer-AAAAAAAA', 'peer-a', 'bonjour');
-      plantSession(node, tB, 'peer-BBBBBBBB', 'peer-b', 'bonjour');
-      plantSession(node, tC, 'peer-CCCCCCCC', 'peer-c', 'bonjour');
+      plantSession(node, tA, PEER_A_ID, 'peer-a', 'bonjour');
+      plantSession(node, tB, PEER_B_ID, 'peer-b', 'bonjour');
+      plantSession(node, tC, PEER_C_ID, 'peer-c', 'bonjour');
 
       const entry = node.remember({
         focus: 'targeted send to peer B',
@@ -84,7 +89,7 @@ describe('remember({to}) — MMP §4.4.4 targeted CMB send', () => {
         commitment: 'frame reaches only the named peer',
         perspective: 'sender role',
         mood: { text: 'procedural', valence: 0, arousal: 0 },
-      }, { to: 'peer-BBBBBBBB' });
+      }, { to: PEER_B_ID });
 
       assert.ok(entry, 'targeted remember should return an entry');
       assert.strictEqual(tA.frames.filter(f => f.type === 'cmb').length, 0, 'peer A should receive NO CMB');
@@ -98,7 +103,7 @@ describe('remember({to}) — MMP §4.4.4 targeted CMB send', () => {
   it('still writes locally when opts.to names a disconnected peer', async () => {
     await withNode('targeted-disconnected', async (node) => {
       const tA = capturingTransport();
-      plantSession(node, tA, 'peer-AAAAAAAA', 'peer-a', 'bonjour');
+      plantSession(node, tA, PEER_A_ID, 'peer-a', 'bonjour');
 
       const entry = node.remember({
         focus: 'targeted send to absent peer',
@@ -108,7 +113,7 @@ describe('remember({to}) — MMP §4.4.4 targeted CMB send', () => {
         commitment: 'no fan-out but store intact',
         perspective: 'sender role',
         mood: { text: 'procedural', valence: 0, arousal: 0 },
-      }, { to: 'peer-ZZZZZZZZ-absent' });
+      }, { to: PEER_ABSENT_ID });
 
       assert.ok(entry, 'disconnected-target remember should still return an entry');
       assert.strictEqual(tA.frames.filter(f => f.type === 'cmb').length, 0, 'connected peer A should receive nothing');
diff --git a/tests/role-chain-fetch.test.js b/tests/role-chain-fetch.test.js
index 44a4ee35..bd66c069 100644
--- a/tests/role-chain-fetch.test.js
+++ b/tests/role-chain-fetch.test.js
@@ -78,8 +78,11 @@ describe('a grant or revoke that arrives before its root is resolved by role-cha
         await until(() => N._roleGrants.size() === order.length, 3000);
         assert.strictEqual(N._roleGrants.size(), order.length, 'every record stored');
         assert.strictEqual(N.resolveRole(X.nodeId, Date.now(), { key: X.pub }), role);
-        const early = order.some((k, i) => (k === 'VX' || k === 'rVX') && order.indexOf('AV') > i);
-        assert.strictEqual(N._chainStats.fetched > 0, early, 'a fetch only when a record came before its root');
+        // A record before its root, or (re-review N4: a revoke is bounded by the grants it clears) a
+        // non-anchor revoke before any grant to its grantee.
+        const early = order.some((k, i) => (k === 'VX' || k === 'rVX') && order.indexOf('AV') > i)
+          || (order.includes('rVX') && !order.slice(0, order.indexOf('rVX')).some((k) => k === 'VX' || k === 'AX'));
+        assert.strictEqual(N._chainStats.fetched > 0, early, 'a fetch only when a record came before its root, or a revoke before its grant');
       } finally { await stopAll(P, N); }
     });
   }
@@ -202,7 +205,7 @@ describe('role-chain-fetch cannot be flooded (port of pending-abuse.js)', () =>
     } finally { await stopAll(N); }
   });
 
-  it('(b) a forged copy sent ahead of the genuine record does not keep it out, and the session that sent it ends', async () => {
+  it('(b) a forged copy sent ahead of the genuine record does not keep it out, and is dropped without charging the relayer (re-review N1)', async () => {
     const N = boot('chain-forged');
     try {
       await N.start();
@@ -213,7 +216,10 @@ describe('role-chain-fetch cannot be flooded (port of pending-abuse.js)', () =>
       assert.strictEqual(s._chainHold.grants.size, 1, 'held apart: the forgery on its session');
       assert.strictEqual(h._chainHold.grants.size, 1, 'the genuine record on its own');
       deliver(N, s, { type: 'role-chain', reqId: s.sent.find((f) => f.type === 'role-chain-fetch').reqId, grants: [gAV] });
-      assert.strictEqual(s.closed, true, 'the forgery is attributable to the session that relayed it: closed (security review D)');
+      // V's statement, relayed: its signature fails under this node's key for V, which the relayer's
+      // binding for V may not share. Dropped and counted, never charged to the relayer (re-review N1).
+      assert.strictEqual(s.closed, false, 'a relayed statement that fails does not close the relayer\'s session');
+      assert.strictEqual(s._chainHold.grants.size, 0, 'the forgery is dropped');
       deliver(N, h, { type: 'role-chain', reqId: h.sent.find((f) => f.type === 'role-chain-fetch').reqId, grants: [gAV] });
       assert.strictEqual(N.resolveRole(X.nodeId, Date.now(), { key: X.pub }), 'validator', 'the genuine one stored, the forgery dropped');
       assert.strictEqual(N._roleGrants.size(), 2);
diff --git a/tests/role-grant-store.test.js b/tests/role-grant-store.test.js
index 93e057df..756b4df7 100644
--- a/tests/role-grant-store.test.js
+++ b/tests/role-grant-store.test.js
@@ -29,8 +29,8 @@ function kp(nodeId) {
 
 const T = 1_000_000;
 // Since 0.14 every role-grant names the key it confers authority on (design D3).
-function grant(type, grantee, role, grantor, at) {
-  const g = { type, grantee: grantee.nodeId, role, grantedBy: grantor.nodeId, grantedAt: at };
+function grant(type, grantee, role, grantor, at, extra = {}) {
+  const g = { type, grantee: grantee.nodeId, role, grantedBy: grantor.nodeId, grantedAt: at, ...extra };
   if (type === 'role-grant') g.granteeKey = grantee.pub;
   return signGrant(g, grantor.priv);
 }
@@ -122,10 +122,15 @@ describe('RoleGrantStore — revocation actually contains a compromised grantor'
     const st = storeWith(A, [B, X]);
     st.record(grant('role-grant', B, 'validator', A, T));
     st.record(grant('role-revoke', B, undefined, A, T + 300));
-    // Since the security review (C; draft spec PR #33) the grantor must also be authorised when the
-    // grant is RECEIVED: B is revoked by then, so the backdated grant is not even kept.
-    assert.deepStrictEqual(st.record(grant('role-grant', X, 'validator', B, T + 100)), { stored: false, reason: 'unrooted' }, 'a backdated grant from a revoked grantor is refused at receipt');
-    assert.strictEqual(st.resolveRole(X.nodeId, T + 500), 'participant', 'and it confers nothing — backdating cannot bypass revocation');
+    // Dated before B's cutoff (here the revoke's own time), the grant is a statement that stands and is
+    // kept (re-review N2: whenever it arrives); it confers nothing while B is revoked (the cascade).
+    assert.strictEqual(st.record(grant('role-grant', X, 'validator', B, T + 100)).stored, true);
+    assert.strictEqual(st.resolveRole(X.nodeId, T + 500), 'participant', 'it confers nothing — backdating cannot bypass revocation');
+    // A revoke whose cutoff reaches back over B's window: a grant B dated inside it is not even kept.
+    const st2 = storeWith(A, [B, X]);
+    st2.record(grant('role-grant', B, 'validator', A, T));
+    st2.record(grant('role-revoke', B, undefined, A, T + 300, { cutoff: T + 50 }));
+    assert.deepStrictEqual(st2.record(grant('role-grant', X, 'validator', B, T + 100)), { stored: false, reason: 'unrooted' }, 'signed after B\'s cutoff');
   });
 
   it('revoking a grantor cascades to everything it granted', () => {
diff --git a/tests/send-frame-dead-socket.test.js b/tests/send-frame-dead-socket.test.js
index 955debfe..969df171 100644
--- a/tests/send-frame-dead-socket.test.js
+++ b/tests/send-frame-dead-socket.test.js
@@ -85,26 +85,28 @@ describe('a send that is not made says why (0.14.0 review B-F6)', () => {
       // bounds did not see, or a long relay envelope), and one whose transport only says whether.
       // (Admitted sessions, as a confirmed handshake leaves them; their sends are made to fail.)
       const { admitAs } = require('./_core-secure');
-      const tooLarge = admitAs(node, { nodeId: 'peer-LARGE000', name: 'peer-large' });
+      // nodeIds are lowercase UUIDs (§3.1.1): remember() refuses a `to` spelled otherwise.
+      const LARGE = '0190aaaa-0000-7000-8000-000000000001', OPAQUE = '0190bbbb-0000-7000-8000-000000000002', ABSENT = '0190cccc-0000-7000-8000-000000000003';
+      const tooLarge = admitAs(node, { nodeId: LARGE, name: 'peer-large' });
       tooLarge.trySend = () => ({ ok: false, reason: SEND_FAILURE.TOO_LARGE, bytes: MAX_FRAME_SIZE + 1 });
-      const opaque = admitAs(node, { nodeId: 'peer-OPAQUE00', name: 'peer-opaque' });
+      const opaque = admitAs(node, { nodeId: OPAQUE, name: 'peer-opaque' });
       delete opaque.trySend;
       opaque.send = () => false;
 
-      const a = node.remember({ focus: 'a directed send the transport refuses as too large' }, { to: 'peer-LARGE000' });
+      const a = node.remember({ focus: 'a directed send the transport refuses as too large' }, { to: LARGE });
       assert.strictEqual(a.delivery.undelivered, true);
       assert.strictEqual(a.delivery.reason, SEND_FAILURE.TOO_LARGE);
-      assert.ok(lines.some((l) => /UNDELIVERED \(directed\): peer-LAR frame too large/.test(l)), lines.join('\n'));
+      assert.ok(lines.some((l) => /UNDELIVERED \(directed\): 0190aaaa frame too large/.test(l)), lines.join('\n'));
       assert.ok(!lines.some((l) => /UNDELIVERED.*not connected/.test(l)), 'not reported as not connected');
-      assert.ok(metrics.some((m) => m.type === 'cmb-frame-too-large' && m.to === 'peer-LARGE000'));
+      assert.ok(metrics.some((m) => m.type === 'cmb-frame-too-large' && m.to === LARGE));
       assert.ok(metrics.some((m) => m.type === 'cmb-undelivered' && m.reason === SEND_FAILURE.TOO_LARGE));
 
-      const b = node.remember({ focus: 'a directed send to a transport that says only whether' }, { to: 'peer-OPAQUE00' });
+      const b = node.remember({ focus: 'a directed send to a transport that says only whether' }, { to: OPAQUE });
       assert.strictEqual(b.delivery.reason, 'send-failed');
 
-      const c = node.remember({ focus: 'a directed send to nobody connected' }, { to: 'peer-ABSENT00' });
+      const c = node.remember({ focus: 'a directed send to nobody connected' }, { to: ABSENT });
       assert.strictEqual(c.delivery.reason, SEND_FAILURE.NOT_CONNECTED);
-      assert.ok(lines.some((l) => /UNDELIVERED \(directed\): peer-ABS not connected/.test(l)));
+      assert.ok(lines.some((l) => /UNDELIVERED \(directed\): 0190cccc not connected/.test(l)));
     } finally { await node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
   });
 });

From 6510bac70a12c6dc0100f3f962a886ddfaa60e75 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Wed, 7 Oct 2026 21:07:54 +0100
Subject: [PATCH 108/148] 0.14.0 final re-review (BLOCK at f0d936a): the
 founder's rulings A, B, C and the findings beside them
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A (Findings 1, 2). The grant store decided at ingest what a record meant (rooted or not) and capped
records per grantor, per pair and in all, so two honest stores holding the same records kept
different subsets by arrival order, their digests never converged, and every session between them
ran a whole-store sync. Now every verifiable record is kept and its effect decided at resolution;
records are bounded by a budget per delegation subtree (4,096; the anchor unbounded), chosen inside a
full budget by one total order on signed fields, a loser replaced. `unrooted` and
`nothing-to-revoke` are gone; a revoker can tighten its cutoff.

B (Finding 4, Low 8a). revokeRole requires its cutoff (ECUTOFF). A revoke may ratify, by signature,
the revoked node's earlier statements; any other statement it signed before the cutoff counts only
while it still holds rank, so a revoked key gains nothing by backdating. The revoker is checked at
every breakpoint from cutoff to signed time. An attestation dated before its record is refused.

C (Finding 6). Each interior mind has its own view (deliveries since it started, directed ones only
from its allowTo), cursor and acks; recall and parents are scoped to that view, its submissions and
the mission's context; reads are rate-limited; the host's inbox is never moved by a mind.

3. A per-session verification lane before any work on a record; a (relayer, signer) pair that fails
8 times in a minute is muted for the minute, without blame; refusal logs and decision entries at
most once a minute per peer and reason.
5. SECURITY.md and the README say first contact is TOFU, made permanent by one accepted record.
7a. A same-process lock re-acquire gets a no-op release; a never-started node's stop() releases its
lock; export refuses while a node in this process holds the identity.
7b. Host-key bundles by default (a passphrase bundle is a copy: copyable / --allow-copies); the clear
header is signed and checked against the pin before its (bounded) scrypt parameters are used; a
consumed or older-than-tombstone bundle is refused; imports are staged and renamed into place last;
file modes travel.
Lows: send() throws EBADTO; emit releases its lock on a failed connect; stale comments; valence and
arousal out of the README, CLI and SKILL.md; the daemon socket's same-user trust in SECURITY.md.

Tests: tests/core-secure-final-review.test.js (each fails on f0d936a), the re-review and review tests
moved to the rulings. WIRE-0.14.0.md §6/§7 and the design doc (efb6d31) give the rules.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QRVMpaJkAA2fFbvuHCEzqH
---
 .agents/skills/sym/SKILL.md            |   6 +-
 .claude/skills/sym/SKILL.md            |   6 +-
 CHANGELOG.md                           |  62 ++-
 README.md                              |  16 +-
 README_zh.md                           |   2 +-
 SECURITY.md                            | 102 ++--
 bin/sym-daemon.js                      |   2 +-
 bin/sym.js                             |  22 +-
 docs/WIRE-0.14.0.md                    | 169 +++---
 lib/config.js                          |  16 +-
 lib/core/role-grant.js                 |  10 +-
 lib/emit.js                            |  22 +-
 lib/frame-handler.js                   |  52 +-
 lib/interior.js                        | 102 +++-
 lib/node.js                            | 172 +++++--
 lib/relocation.js                      | 146 ++++--
 lib/role-grant-store.js                | 684 +++++++++++++++----------
 tests/core-secure-final-review.test.js | 441 ++++++++++++++++
 tests/core-secure-identity.test.js     |  23 +-
 tests/core-secure-rereview.test.js     |  84 +--
 tests/core-secure-review.test.js       |  69 ++-
 tests/earned-authority-node.test.js    |   3 +-
 tests/gossip-lanes.test.js             |  40 +-
 tests/role-chain-fetch.test.js         |   7 +-
 tests/role-grant-store.test.js         |  14 +-
 25 files changed, 1667 insertions(+), 605 deletions(-)
 create mode 100644 tests/core-secure-final-review.test.js

diff --git a/.agents/skills/sym/SKILL.md b/.agents/skills/sym/SKILL.md
index 386fb762..1fcca9f6 100644
--- a/.agents/skills/sym/SKILL.md
+++ b/.agents/skills/sym/SKILL.md
@@ -53,7 +53,7 @@ When you notice something significant in your domain, decompose it into a Cognit
 | **motivation** | Why this matters — reasons, drivers |
 | **commitment** | What has been confirmed or established |
 | **perspective** | Whose viewpoint, situational context |
-| **mood** | Affective state: `{"text": "...", "valence": -1 to 1, "arousal": -1 to 1}` |
+| **mood** | Affective state: `{"text": "..."}` (a mood is its text: valence and arousal are unsigned, and peers drop them) |
 
 ```bash
 sym publish '{
@@ -63,7 +63,7 @@ sym publish '{
   "motivation": "prevent bugs from fatigue-driven errors",
   "commitment": "coding session with Claude",
   "perspective": "developer, afternoon, 3 hour session",
-  "mood": {"text": "frustrated, low energy", "valence": -0.6, "arousal": -0.4}
+  "mood": {"text": "frustrated, low energy"}
 }'
 ```
 
@@ -89,7 +89,7 @@ sym publish '{
   "motivation": "mesh showed energy declining across all agents",
   "commitment": "playing calm ambient for 30 minutes",
   "perspective": "music agent, responding to collective understanding",
-  "mood": {"text": "calm, supportive", "valence": 0.3, "arousal": -0.3}
+  "mood": {"text": "calm, supportive"}
 }'
 ```
 
diff --git a/.claude/skills/sym/SKILL.md b/.claude/skills/sym/SKILL.md
index 386fb762..1fcca9f6 100644
--- a/.claude/skills/sym/SKILL.md
+++ b/.claude/skills/sym/SKILL.md
@@ -53,7 +53,7 @@ When you notice something significant in your domain, decompose it into a Cognit
 | **motivation** | Why this matters — reasons, drivers |
 | **commitment** | What has been confirmed or established |
 | **perspective** | Whose viewpoint, situational context |
-| **mood** | Affective state: `{"text": "...", "valence": -1 to 1, "arousal": -1 to 1}` |
+| **mood** | Affective state: `{"text": "..."}` (a mood is its text: valence and arousal are unsigned, and peers drop them) |
 
 ```bash
 sym publish '{
@@ -63,7 +63,7 @@ sym publish '{
   "motivation": "prevent bugs from fatigue-driven errors",
   "commitment": "coding session with Claude",
   "perspective": "developer, afternoon, 3 hour session",
-  "mood": {"text": "frustrated, low energy", "valence": -0.6, "arousal": -0.4}
+  "mood": {"text": "frustrated, low energy"}
 }'
 ```
 
@@ -89,7 +89,7 @@ sym publish '{
   "motivation": "mesh showed energy declining across all agents",
   "commitment": "playing calm ambient for 30 minutes",
   "perspective": "music agent, responding to collective understanding",
-  "mood": {"text": "calm, supportive", "valence": 0.3, "arousal": -0.3}
+  "mood": {"text": "calm, supportive"}
 }'
 ```
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 18753180..bf6cc658 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,60 @@ key bindings (a lockout anyone on the LAN could fill) by the binding lifetime be
 in-memory pending set for grants that arrive before their root (which could be flooded) by
 `role-chain-fetch`.
 
+### The final re-review of f0d936a (BLOCK) — what changed
+
+The founder ruled three design changes; each is made where its assumption was, and the rule is in
+`docs/WIRE-0.14.0.md` §6 and §7 and the design doc (branch `design/0.14.0-core-secure-identity`).
+
+- **The kept grant set is a function of the records held (ruling A; Findings 1 and 2).** The store
+  decided at ingest whether a record was rooted and capped records per grantor, per pair and in
+  all, so two honest nodes holding the same records kept different subsets by arrival order, their
+  digests never matched, and every session between them ran a whole-store sync; and a revoker could
+  not tighten its cutoff (`nothing-to-revoke`). Now every verifiable record is kept (its signature
+  verifies under the anchor's key or a key a kept grant vouches) and its effect is decided at
+  resolution; `unrooted` and `nothing-to-revoke` are gone. Records are bounded by a budget per
+  delegation subtree (everything an anchor grantee and its descendants sign: 4,096 records; the
+  anchor's own unbounded), which replaces the per-grantor, per-pair and store caps: a compromised
+  subtree fills only its own budget, and a revoke from another subtree is never refused. Inside a
+  full budget the records kept are chosen by one order on signed fields, and a record that ranks
+  higher replaces the last one kept (`outranked`).
+- **The anchor ratifies; a revoked key gains nothing by backdating (ruling B; Finding 4).** With a
+  cutoff alone, a key revoked on day 20 could sign a revoke dated day 2 and it counted for everyone.
+  Now `revokeRole(id, { cutoff, ratify })` requires the cutoff (no default; `ECUTOFF`), and a revoke
+  may list (`ratify`, signed, at most 64) the revoked node's earlier statements that stay valid. Any
+  other statement it signed before the cutoff counts only while it still holds the rank it needs.
+  A revoker is checked at every breakpoint from its cutoff to its signed time (Low 8a). An
+  attestation dated before the record it attests is refused, and counts with its signer's role when
+  signed by the same rule. `node.roleStatementsBy(id, before)` lists what a revoker may ratify.
+- **The interior read side is scoped to the mind's mission (ruling C; Finding 6).** A mind for
+  mission B read mission A's deliveries and notes through `deliveries` and `recall`, and its drain
+  moved the host's inbox cursor. Each mind now has its own view (deliveries that arrived while it
+  runs: directed ones only from its mission's `allowTo`, and room broadcasts), its own cursor and
+  acks; `recall` returns only that view, its own submissions and the mission's `context`; a
+  `parents` key outside it is refused as if absent; reads are rate-limited (10 a second, burst 20);
+  `node.inbox()` is never moved by a mind.
+- **Relayed forgeries cost bounded work (Finding 3).** Each session's records spend a verification
+  lane (32 a second, burst 128) before any work; a peer whose statements for one signer fail 8 times
+  in a minute has its statements for that signer dropped unverified for the rest of the minute
+  (`relayed-signer-muted`), without blame; a refusal is logged and written to the decision log at
+  most once a minute per peer and reason.
+- **First contact is said as it is (Finding 5).** SECURITY.md and the README state that a nodeId is
+  not derived from its key, so first contact is trust on first use, and one accepted directed record
+  makes it permanent; key-derived nodeIds are a future MMP change.
+- **Relocation (Finding 7).** A same-process re-acquire of an identity lock returns a release that
+  does nothing while the first holder holds it, a never-started node's `stop()` releases its lock,
+  and export refuses while a node in this process holds the identity. A bundle is sealed to the
+  target host by default; a passphrase bundle opens on any host with the passphrase, so it is a copy
+  and needs `copyable: true` (`--allow-copies`). Import checks the clear header (now carrying the
+  node's key and its own signature) against the pin before it uses the header's scrypt parameters
+  (also bounded), refuses a bundle this host imported before (`consumed-bundles.jsonl`) and one
+  exported at or before this host's own tombstone of the node, stages everything and renames it
+  into place last (a refused import installs nothing), and keeps file modes.
+- **Lows.** `send()` throws `EBADTO` for a `to` that is not a lowercase UUID, as `remember()` does;
+  `sym emit` releases the identity's lock when it cannot connect; stale comments are corrected;
+  `valence` and `arousal` are gone from the README, the CLI and SKILL.md (they are unsigned, and
+  peers drop them); SECURITY.md says the daemon's IPC socket trusts every process of the same user.
+
 ### The re-review at 72daeb6 — what changed
 
 Five findings and the open leads, each fixed where its assumption was made (the design is
@@ -28,7 +82,8 @@ for the spec PRs is `docs/WIRE-0.14.0.md` §6 and §7):
   key that failed is the key it proved; any other failure is dropped and counted
   (`relayed-signature-unverified`), never charged to the relayer.
 - **A revoke carries a cutoff; receipt time is no part of authority (N2; replaces draft spec PR
-  #33's both-times rule).** The both-times rule voided a genuine revoke for every node that received
+  #33's both-times rule; refined by the final re-review above: the cutoff has no default, and what
+  a revoked node signed before it stands only if ratified).** The both-times rule voided a genuine revoke for every node that received
   it after its revoker was itself revoked (a newcomer, an anti-entropy sync, a store upgraded from
   0.13), so authority depended on arrival order. Now a `role-revoke` signs a `cutoff` (by default its
   own time; `revokeRole(id, { cutoff })` sets an earlier one, never before the revoker held rank):
@@ -41,7 +96,8 @@ for the spec PRs is `docs/WIRE-0.14.0.md` §6 and §7):
   node's further directed records to it, while the genuine peer, refused with 1009, did not retry.
   A verified record its author signed to this node, accepted for delivery (surfaced, stored or not),
   now earns the binding, as an admitted record does.
-- **No cap refuses a revoke (N4).** The per-grantor, per-pair and store caps refused revokes too,
+- **No cap refuses a revoke (N4; the mechanism below is replaced by the final re-review's budget
+  per delegation subtree).** The per-grantor, per-pair and store caps refused revokes too,
   so past them a grant could no longer be revoked except by the anchor, and a validator filling the
   store with sybil grants stopped every honest revoke. The caps now bound grants only; a revoker
   keeps at most as many revokes for a grantee as this node holds grants for it (`nothing-to-revoke`
@@ -89,7 +145,7 @@ Seven design assumptions, each changed where it was made, not patched where it s
   node's own nodeId (one that vouches a foreign key for it is inert, and reported:
   `role-grant-foreign-self-key`); 0.13 `grant` roster entries migrate as legacy claims. Role
   resolution is memoised (linear in the records) and a delegation reaches at most 8 grants from the
-  anchor; a grantor holds at most 16 grants per grantee (was 64 records).
+  anchor (the grant caps of this round are replaced by the final re-review's budget per subtree).
 - **No shared budget is spent before verification, and a forgery ends its session (D).** Only the
   peer's own lane is spent before a signature check; the shared ceiling is spent after it. A
   signature in a session's own name that does not verify under the key it proved closes it
diff --git a/README.md b/README.md
index 304a2d1a..14bb9f42 100644
--- a/README.md
+++ b/README.md
@@ -37,7 +37,7 @@ sym listen
 Back in the first terminal, publish one observation:
 
 ```bash
-sym publish '{"focus":"trying SYM","intent":"confirm the second terminal receives this","mood":{"text":"curious","valence":0.4,"arousal":0.3}}'
+sym publish '{"focus":"trying SYM","intent":"confirm the second terminal receives this","mood":{"text":"curious"}}'
 ```
 
 The listening terminal should receive the typed observation with its source. No API key is required for this wire test.
@@ -143,9 +143,10 @@ participant.
   envelopes and ciphertext. There is no long-lived encryption key to steal later.
 - **Authority follows the key.** A role grant names the key it confers authority on, and a
   grant chain is checked with the keys each grant vouches, from the anchor down. A revoke signs a
-  cutoff: what the revoked node signed before it stands for every node, and what it signed from
-  the cutoff on never counts, so every node resolves the same authority whatever order it learned
-  the history in.
+  cutoff: what the revoked node signed from the cutoff on never counts, and what it signed before
+  counts only if the revoker ratified it (or the node still holds its rank), so a revoked key gains
+  nothing by backdating. Nodes holding the same grants keep the same ones and resolve the same
+  authority, whatever order they learned them in.
 - **Each node decides what it keeps.** Admission is receiver-local: a node runs its own
   evaluation on every record it hears and stores only what it admits.
 - **Bounded.** Every store a peer can feed — key bindings, grants, wake channels, gossip, relay
@@ -157,9 +158,10 @@ What this does not solve, said plainly:
   proven use*: the handshake proves the peer holds the key it presents, not that the key is
   the one you meant. Pin it out of band (an invite carries the issuer's key) when that matters.
   A node whose records yours never admitted, and that never signed a record to yours, is first contact
-  again once it leaves.
-- **A revoke's cutoff is a judgement.** A revoked node can still date a statement before its
-  cutoff, and that statement stands; set the cutoff back to when you stopped trusting it.
+  again once it leaves; and whoever reaches yours first under a nodeId and has one record accepted
+  holds that nodeId there for good (a nodeId is not derived from its key).
+- **A ratification is a judgement.** A revoked node's earlier statements stand only where its
+  revoker lists them; list too much and they stand, too little and honest ones lapse.
 - **Relay eviction.** `relay-auth` is not proven, and a relay token holder can make the relay
   replace another node's connection (close 4004). A squatter gets no Core Secure session — it
   cannot prove the key — and an evicted node re-handshakes, but the relay path can be interrupted.
diff --git a/README_zh.md b/README_zh.md
index 36f0501c..8cfb7e6d 100644
--- a/README_zh.md
+++ b/README_zh.md
@@ -114,7 +114,7 @@ sym ask "蓝色款式何时补货？"
 
 ```bash
 # 代理在后台自动执行：
-sym publish '{"focus":"5 位客户咨询蓝色款式","issue":"缺货且无预计到货时间","mood":{"text":"沮丧","valence":-0.4,"arousal":0.5}}'
+sym publish '{"focus":"5 位客户咨询蓝色款式","issue":"缺货且无预计到货时间","mood":{"text":"沮丧"}}'
 ```
 
 每条此类观察都会成为后续 `sym ask` 可调用的知识贡献——同时，任何代理也可在其自有窗口中，基于其他代理共享的信息直接作答。
diff --git a/SECURITY.md b/SECURITY.md
index a50f3a24..96251a37 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -54,22 +54,32 @@ Report a vulnerability privately to info@sym.bot (the address in package.json).
   `lineage.method`) are dropped, and what is stored, delivered and served is the projection.
   Directed versus room-bound delivery is decided by the signed `metadata.to`, never by a relay
   envelope; a directed record older than 24 h by its signed time is refused.
-- **Authority follows the key; a revoke carries a cutoff.** A role grant must name `granteeKey`; it
-  confers its role only on that key, and a chain is verified top-down with each grant's vouched key.
-  A revoke signs a cutoff (by default its own time; a revoker may set it earlier, back to when the
-  revoked node stopped being trustworthy, but never before the revoker itself held rank). What the
-  revoked node signed before its cutoff — grants, key vouches, revokes, attestations — counts by
-  its rank when signed, for every node whenever it arrives; what it signed at or after the cutoff
-  never counts. When a node received a statement is no part of the rule, so nodes that learn a
-  history in different orders resolve the same authority. A grant also confers only while its
-  grantor still holds rank (MMP §6.6's cascade). A grantor whose nodeId an impostor holds keeps
-  exactly its vouched authority; the impostor gets none.
+- **Authority follows the key, and every node that holds the same grants resolves the same
+  authority.** A role grant must name `granteeKey`; it confers its role only on that key, and a chain
+  is verified top-down with each kept grant's vouched key. A store keeps every grant or revoke whose
+  signature it can verify, and decides its effect only when it resolves a role, so what it keeps
+  and what it resolves depend on the records it holds, never on the order they arrived in
+  (docs/WIRE-0.14.0.md §6).
+- **A revoke carries a cutoff, and a revoked key gains nothing by backdating.** Every revoke this
+  release signs names its cutoff (no default). What the revoked node signed at or after the cutoff
+  never counts. What it signed before the cutoff counts only while it still holds the rank the
+  statement needs, or when an effective revoke of it ratifies that statement by its signature (the
+  revoker lists the statements that stay valid). So a key signing after its revoke, dated before it,
+  achieves nothing. A revoker counts only if it held the rank at every point from its cutoff to its
+  signed time. A grant also confers only while its grantor still holds rank (MMP §6.6's cascade),
+  unless ratified. An attestation counts with its signer's role when it signed, by the same rule,
+  and one dated before the record it attests is refused. A grantor whose nodeId an impostor holds
+  keeps exactly its vouched authority; the impostor gets none.
 - **A forgery in a session's own name ends the session.** A statement that names the session's own
   peer as its signer and does not verify under the key that session proved closes it, and its
   nodeId is not admitted again for 60 s. A statement the session relays for another signer is
   verified under this node's binding for that signer, which may differ from the relayer's (a local
   view); one that fails is dropped and counted (`relayed-signature-unverified`), and the relayer is
-  not charged.
+  not charged. Not charging it does not make forgeries free: each session's records spend a
+  verification lane (32 a second, burst 128) before any work is done on them, and once 8 of one
+  peer's statements for one signer have failed within a minute, that peer's statements for that
+  signer are dropped unverified for the rest of the minute. A refused record is logged and recorded
+  in the decision log at most once a minute per peer and reason.
 - **Admission attestations under `sym-attest-v1`.** Attestations, checkpoints and witnesses are
   signed under their own domain tags with every field covered, verified against the signer's bound
   key (never the delivering session), and exchanged only with sessions that negotiated the
@@ -77,17 +87,26 @@ Report a vulnerability privately to info@sym.bot (the address in package.json).
 - **Gated rooms on proven keys.** A gated room admits its owner by the owner's pinned key and a
   grantee when its room-join grant binds the key its session proved. A copied grant admits
   nobody.
-- **Moved, not copied.** `sym node export` holds the identity's lock, tombstones the node before
-  its encrypted bundle exists (so the source refuses to start it), signs the bundle with the node's
-  key, and once the bundle is durable removes the private key from the source and the 0.13 path to
-  it; `sym node import` verifies the bundle against an explicit pin and the node's signature, and
-  refuses a re-keyed or altered bundle.
+- **Moved, and copied only when asked.** `sym node export` refuses while the node runs (in another
+  process or this one), holds the identity's lock, tombstones the node before its encrypted bundle
+  exists (so the source refuses to start it), signs the bundle with the node's key, and once the
+  bundle is durable removes the private key from the source and the 0.13 path to it. By default the
+  bundle is sealed to the target host's key, so only that host can open it. A passphrase bundle
+  opens on any host that has the passphrase, so it is a copy, and is made only with
+  `--allow-copies`. `sym node import` checks the bundle's header against an explicit pin and the
+  node's signature before it uses anything the header says, verifies the contents the same way,
+  refuses a re-keyed or altered bundle, a bundle this host imported before, and one exported at or
+  before this host's own move of that node away (a replay), and installs nothing until everything
+  is written, keeping each file's mode.
 - **The interior.** A node's mind submits through the node's local interior socket, which lives in
   a 0700 directory the node made (a fresh one under the temp directory when the path is too long),
   with a per-mission capability bound to the first connection that presents it (another local
   process cannot replay it; the connection closing ends the mind); the node checks audience, size,
   rate, declared kinds (the kind is the signed intent) and lineage before it signs. One mind per
-  identity. On Windows the named pipe takes Node's default DACL, which sym cannot narrow, so the
+  identity. A mind reads only its own mission's view: deliveries that arrived while it runs,
+  directed ones only from nodes its mission may address, and room broadcasts; its recall returns
+  only those and its own submissions (and context the host gives the mission); it has its own
+  cursor and acks, never moves the host's inbox, and its reads are rate-limited. On Windows the named pipe takes Node's default DACL, which sym cannot narrow, so the
   socket is refused unless the host passes `{ allowDefaultPipeAcl: true }`.
 
 ## Bounds on what peers can make a node keep
@@ -100,14 +119,16 @@ Every store a peer can feed has a fixed bound. Reaching one never stops the node
   a newcomer is refused a durable binding and its live session still verifies what it signs. Key
   conflicts: at most 8 kept per nodeId and 1,024 in all, every one counted
   (`status().coreSecure.keyConflicts`).
-- **Role grants**: at most 65,536 grants, 1,024 per grantor and 16 per (grantor, grantee) pair
-  (the anchor's own are not limited). No cap refuses a revoke: a revoker keeps at most as many
-  revokes for one grantee as this node holds grants for it (a revoke that arrives first waits for
-  the grant through `role-chain-fetch`), so revokes are bounded by grants and a revoker can fill
-  only its own allowance; a nodeId in a grant is canonical lowercase of at most 128
-  characters, a role name at most 32. A delegation reaches at most 8 grants from the anchor, and
-  role resolution is memoised (linear in the records). A record that arrives before its root is
-  held only while its chain is fetched from the session that delivered it (`role-chain-fetch`): at
+- **Role grants**: the anchor's own records are not limited; everything else is bounded per
+  delegation subtree: everything an anchor grantee and its descendants sign shares one budget of
+  4,096 records. A compromised subtree fills only its own budget, so a revoke from another subtree
+  is never refused. Inside a full budget the records kept are chosen by one order on signed fields
+  (shallower signers first, revokes before grants, earlier cutoffs and grants first, then the
+  signature), and a record that ranks above the last one kept replaces it. A revoke lists at most
+  64 ratified statements. A nodeId in a grant is canonical lowercase of at most 128 characters, a
+  role name at most 32. A delegation reaches at most 8 grants from the anchor, and
+  role resolution is memoised. A record whose grantor no kept grant vouches is held only while its
+  chain is fetched from the session that delivered it (`role-chain-fetch`): at
   most 64 records and 64 KiB per session, for at most 10 s; a fetch names at most 16 grantors, an
   answer carries at most 64 grants, and a node answers at most 4 fetches a second per session
   (burst 16). A whole-store sync (on a differing `role-digest`) is at most 1,024 pages of 64.
@@ -159,16 +180,23 @@ Every store a peer can feed has a fixed bound. Reaching one never stops the node
 
 ## What it does not solve
 
-- **First contact is trust on first proven use.** Without an anchor, an invite carrying the
-  issuer's key, or a grant, the first key a session proves for a nodeId is the one bound. The
-  handshake proves possession, not intent. A nodeId that never earned a durable binding here (no
-  admitted record, no directed exchange, no pin, no grant) is first contact again once its
-  sessions end. While another key's session holds a nodeId, the genuine node is refused with 1009,
-  and a node refused with 1009 does not retry until it restarts.
-- **A cutoff is the revoker's judgement.** Statements the revoked node signed before its revoke's
-  cutoff stand, so a revoked node can still backdate a statement to before the cutoff. A revoker
-  that suspects an earlier compromise sets the cutoff earlier; nothing can tell a backdated
-  statement from a timely one.
+- **First contact is trust on first use, and one directed record makes it permanent.** A nodeId is
+  not derived from its key. Without an anchor, an invite carrying the issuer's key, or a grant, the
+  first key a session proves for a nodeId is the one this node uses for it, and the handshake
+  proves possession, not intent. Whoever reaches this node first under a nodeId and has one record
+  it signed to this node accepted (or one broadcast admitted) holds that nodeId here durably: the
+  genuine node is then refused with 1009, and a node refused with 1009 does not retry until it
+  restarts. A nodeId that never earned a durable binding is first contact again once its sessions
+  end. Pin a key out of band (an invite) where that matters. Deriving a nodeId from its key would
+  remove the squat; it is a future MMP change, not this release.
+- **A ratification is the revoker's judgement.** A revoked node's statements before its cutoff
+  stand only if its revoker ratified them, so a revoker that ratifies too much keeps them standing,
+  and one that ratifies too little voids honest ones. The revoker sees what it holds
+  (`node.roleStatementsBy`).
+- **The kept set can lag after a reshaped tree.** Records are chosen within a budget from the
+  records held; one refused for its budget is not kept for later. If a signer later gains a
+  shallower chain through another subtree, records refused earlier in the budget it left return
+  only when a peer offers them again (the next whole-store sync after two nodes' digests differ).
 - **Relay eviction.** `relay-auth` identity is not proven (MMP §4.4.1), and the relay replaces a
   connection that re-authenticates under the same nodeId (close 4004, §4.4.7). A token holder
   can therefore interrupt another node's relay path. It cannot impersonate it: it gets no
@@ -178,7 +206,9 @@ Every store a peer can feed has a fixed bound. Reaching one never stops the node
   possession, MMP spec PR meshcognition-website#20) is drafted, not implemented.
 - **No key rotation** (MMP §3.4). A compromised key means a new identity.
 - **The local machine.** Identity files are readable by any process running as the same user.
-  Operating-system isolation is out of scope.
+  Operating-system isolation is out of scope. The daemon's IPC socket trusts the same user the same
+  way: any process running as that user can connect to it and act as the daemon's node (remember,
+  send, recall); it is not a boundary between processes of one user.
 - **Legacy Import is weaker, and temporary.** A route to a 0.13 node uses the legacy encryption
   (X25519 + AES-256-GCM: this node's per-session key against the routed node's pinned persistent
   key — no forward secrecy, no transcript proof). A 0.13 hello proves nothing, so over the relay a
diff --git a/bin/sym-daemon.js b/bin/sym-daemon.js
index 59ebb838..5bf54ecd 100755
--- a/bin/sym-daemon.js
+++ b/bin/sym-daemon.js
@@ -525,7 +525,7 @@ function handleIPCMessage(socketId, socket, msg) {
           motivation: 'mesh communication',
           commitment: msg.message.slice(0, 120),
           perspective: `${node.name}, direct message`,
-          mood: { text: 'neutral', valence: 0, arousal: 0 },
+          mood: { text: 'neutral' },
         });
         sendIPC(socket, { type: 'result', action: 'send', peers: node.peers().length });
       }
diff --git a/bin/sym.js b/bin/sym.js
index 170eaf36..527d593d 100755
--- a/bin/sym.js
+++ b/bin/sym.js
@@ -32,7 +32,7 @@ const { recordCreatedBy } = require('../lib/record');
  *   sym keys <name> [conflicts]       # Key registry: bindings and conflicts (Core Secure, 0.14)
  *   sym keys <name> resolve <nodeId> <key>    # Operator: bind nodeId to key (pinned), clearing its conflicts
  *   sym keys <name> reset-floor <nodeId>      # Operator: let a Legacy Import route be used again
- *   sym node export <name> --out <file> (--passphrase-env VAR | --to-host <x25519 pub>)
+ *   sym node export <name> --out <file> (--to-host <x25519 pub> | --passphrase-env VAR --allow-copies)
  *   sym node import <file> --expect-node <id> [--expect-key <k> | --expect-fingerprint sha256:…] [--passphrase-env VAR]
  *   sym node host-key                 # This host's X25519 key for receiving node bundles
  *   sym logs                          # Tail daemon logs
@@ -172,8 +172,10 @@ function cmdNode() {
       return;
     }
     if (sub === 'export') {
-      const r = relocation.exportNode({ name: args[2], out: flagValue('--out'), passphrase: passphrase(), toHostKey: flagValue('--to-host') || undefined });
-      console.log(`exported ${r.name} (${r.nodeId}, ${r.fingerprint}) to ${r.out}: ${r.files} file(s). It is tombstoned here and will not start on this host again.`);
+      // Sealed to the target host by default; a passphrase bundle opens on any host with the passphrase,
+      // so it is a copy, and needs --allow-copies (final re-review, Finding 7b).
+      const r = relocation.exportNode({ name: args[2], out: flagValue('--out'), passphrase: passphrase(), toHostKey: flagValue('--to-host') || undefined, copyable: args.includes('--allow-copies') });
+      console.log(`exported ${r.name} (${r.nodeId}, ${r.fingerprint}) to ${r.out}: ${r.files} file(s). It is tombstoned here and will not start on this host again.${flagValue('--to-host') ? '' : ' The bundle is a passphrase bundle: any host with the passphrase can import it.'}`);
       return;
     }
     if (sub === 'import') {
@@ -186,7 +188,7 @@ function cmdNode() {
     console.error(err.message);
     process.exit(1);
   }
-  console.error('usage: sym node (export <name> --out <file> (--passphrase-env VAR | --to-host <pub>) | import <file> --expect-node <id> [--expect-key <k> | --expect-fingerprint sha256:…] [--passphrase-env VAR] | host-key)');
+  console.error('usage: sym node (export <name> --out <file> (--to-host <pub> | --passphrase-env VAR --allow-copies) | import <file> --expect-node <id> (--expect-key <k> | --expect-fingerprint sha256:…) [--passphrase-env VAR] | host-key)');
   process.exit(1);
 }
 
@@ -501,7 +503,7 @@ function cmdPublish() {
   const content = parsed.positional.join(' ');
 
   if (!content) {
-    console.error('Usage: sym publish [--standalone] [--name <id>] [--parents <key1,key2>] \'{"focus":"...","mood":{"text":"...","valence":0,"arousal":0},...}\'');
+    console.error('Usage: sym publish [--standalone] [--name <id>] [--parents <key1,key2>] \'{"focus":"...","mood":{"text":"..."},...}\'');
     console.error('  The calling agent (LLM) extracts CAT7 categories. The protocol does not parse raw text.');
     console.error('  --standalone: emit without sym-daemon running (one-shot SymNode). Auto-enabled if daemon is down.');
     console.error('  --name:       mesh identity for standalone mode. REQUIRED (or set SYM_NODE_NAME).');
@@ -588,7 +590,7 @@ function cmdPublish() {
  * repeated calls with the same --name resolve to the same nodeId.
  *
  * Ships CAT7 category vectors via SymNode's internal encoder — the caller
- * only needs to supply text (and valence/arousal for mood).
+ * only needs to supply text.
  */
 async function standaloneObserve(categories, opts) {
   const { SymNode } = require('..');
@@ -1287,11 +1289,11 @@ ${bold('CAT7 categories:')}
   motivation    Reasons, drivers, incentives
   commitment    Who will do what, by when
   perspective   Whose viewpoint, situational context
-  mood          { text, valence (-1..1), arousal (-1..1) }
+  mood          { text }  (valence and arousal are unsigned: peers drop them)
 
 ${bold('Examples:')}
   sym start
-  sym publish '{"focus":"debugging auth","mood":{"text":"tired","valence":-0.4,"arousal":-0.3}}'
+  sym publish '{"focus":"debugging auth","mood":{"text":"tired"}}'
   sym recall "energy patterns"
   sym ask "should we use UUID v7 or keep v4?"
   sym insight
@@ -1302,10 +1304,10 @@ ${bold('Daemon-less one-shot observations:')}
   # for relay credentials. Identity is stable across invocations via
   # the cached keypair in ~/.sym/nodes/<name>/.
   sym publish --standalone --name claude-code-mac \\
-    '{"focus":"resolved 3 review board tickets","mood":{"text":"focused","valence":0.3,"arousal":0.2}}'
+    '{"focus":"resolved 3 review board tickets","mood":{"text":"focused"}}'
 
   # Remix with lineage (resolve upstream tickets). --parents implies --standalone.
   sym publish --name claude-code-mac --parents cmb-876bbd483a,cmb-c0d4332a \\
-    '{"focus":"ANX+CFN positioning memo","intent":"resolve tickets","mood":{"text":"resolved","valence":0.3,"arousal":0.1}}'
+    '{"focus":"ANX+CFN positioning memo","intent":"resolve tickets","mood":{"text":"resolved"}}'
 `);
 }
diff --git a/docs/WIRE-0.14.0.md b/docs/WIRE-0.14.0.md
index c60b8f9b..7b4c35f7 100644
--- a/docs/WIRE-0.14.0.md
+++ b/docs/WIRE-0.14.0.md
@@ -94,8 +94,8 @@ that delivered the record for the missing chain.
 ```
 
 - `grants`: at most 64 role-grant or role-revoke records, each the canonical object of its signed
-  fields only (`type, grantee, role?, grantedBy, grantedAt, granteeKey?, cutoff?, sig, sigAlg`;
-  `cutoff` on a revoke only, section 6). They are
+  fields only (`type, grantee, role?, grantedBy, grantedAt, granteeKey?, cutoff?, ratify?, sig,
+  sigAlg`; `cutoff` and `ratify` on a revoke only, section 6). They are
   ordered top-down: each record comes after the records that root its grantor, up to the anchor
   (depth at most 8). For each named grantee the answer holds the records the server holds whose
   grantee it is, revokes included, each preceded by its grantor's chain.
@@ -110,9 +110,7 @@ server's whole store:
 
 - `after`: where the page starts, in the server's sync order: the anchor's records first, then
   those of each grantor the earlier ones reach, breadth first, each grantor's own records by
-  signed time; records no chain reaches come last; and every revoke not signed by the anchor after
-  every grant, so a revoke never comes before a grant it clears (section 6). A page holds at most
-  64 records.
+  signed time; records no chain reaches come last. A page holds at most 64 records.
 - `next`: present when another page follows; the client asks for it with `after: next`. A client
   asks for at most 1,024 pages per session, one page in flight at a time.
 
@@ -125,9 +123,9 @@ it.
 - A node sends a whole-store `role-chain-fetch` when a peer's `role-digest` (section 5) differs
   from its own.
 - A node sends `role-chain-fetch` when a role grant or revoke that arrived on a session is refused
-  as `unknown-grantor-key` (no chain reaches its grantor) or `unrooted`, naming the grantor; and
-  when a revoke is refused as `nothing-to-revoke` (it arrived before the grant it clears, section
-  6), naming the revoke's grantee, whose own records the answer then carries.
+  as `unknown-grantor-key` (no record it holds vouches a key for its grantor), naming the grantor.
+  That is the only reason a verifiable record waits: no record is refused for its authority
+  (section 6).
   - It sends at most one fetch in flight per (session, grantor). Further early records for the
     same grantor join the fetch already in flight.
   - The early record is held in memory only for that fetch, as its signed fields only, under a key
@@ -148,8 +146,8 @@ it.
   own peer and the key that failed is the one the session proved; any other is dropped and counted,
   since it was verified under this node's view of its grantor's keys, which the server's may not
   share (section 7).
-- Then offers the held records again, in passes until one stores nothing (a held revoke can wait
-  for a held grant), and drops what is left. Neither the answer's grants nor the held records
+- Then offers the held records again, in passes until one stores nothing (a held record can wait
+  for another held record that vouches its grantor's key), and drops what is left. Neither the answer's grants nor the held records
   start a further fetch.
 - A fetch that is not answered within 10 s, or whose session closes, releases its held records.
   They are dropped.
@@ -241,69 +239,106 @@ nothing and what is new is relayed once. A digest is a hint: nothing is taken on
 
 ---
 
-## 6. The revoke's `cutoff`: authority without receipt time (replaces draft spec PR #33's rule)
+## 6. Grants and revokes: what is kept, and what counts (replaces draft spec PR #33's rule)
 
-**Why.** A signer's date is its own to write, so a revoked validator can still sign statements
-dated inside its old window. Draft spec PR #33 counted a statement only if its signer was
-authorised both at its signed time and when the receiver received it. That fails open for late
-receivers: a validator V legitimately revokes W on day 1, the anchor revokes V on day 3, and every
-node that receives V's revoke after day 3 (a new node, an anti-entropy sync, a store upgraded from a
-version that kept no receipt times) restores W's authority, while the nodes online on day 1 do not.
-Authority then depends on arrival order, and the mesh disagrees. sym 0.14.0 replaces the receipt
-time with a date the revoker signs. (The founder's ruling, 2026-10.)
+**Why.** Two things went wrong in 0.14.0's first two designs, and both made the mesh disagree.
+Draft spec PR #33 counted a statement only if its signer was authorised both at its signed time and
+when the receiver received it, so nodes that received a genuine revoke at different times resolved
+different authority. Its first replacement still decided at ingest whether a record was rooted, and
+bounded records with caps that refused newcomers, so two nodes holding the same records kept
+different subsets depending on arrival order, their digests never matched, and every session between
+them ran a whole-store sync. The rule below makes the kept set and the resolved authority functions
+of the records held: no receipt time, no arrival order. (The founder's rulings, 2026-10.)
 
-**Field.** A `role-revoke` carries `cutoff`: an integer, milliseconds since the epoch, with
-`0 <= cutoff <= grantedAt`. It is signed: the §6.5 grant payload gains `|<cutoff>` (decimal) at its
-end, appended only when the revoke carries one:
+### 6.1 Fields
+
+A `role-revoke` carries:
+
+- `cutoff`: an integer, milliseconds since the epoch, `0 <= cutoff <= grantedAt`: the time from
+  which the revoked node is no longer trusted. sym 0.14.0 requires it on every revoke it signs
+  (`revokeRole(nodeId, { cutoff })` has no default). A revoke without one (0.13) has
+  `cutoff = grantedAt`.
+- `ratify` (optional): the revoked node's statements that stay valid, as their canonical signatures
+  (86 unpadded base64url characters), sorted ascending, no repeats, 1 to 64 entries. Only on a revoke
+  that carries `cutoff`. A revoker that must ratify more issues several revokes; each counts.
+
+Both are signed. The §6.5 grant payload gains `|<cutoff>` at its end when the revoke carries a
+cutoff, and then `|<ratify joined by ",">` when it carries `ratify`:
 
 ```
-role-revoke|<grantee>|<role or empty>|<grantedBy>|<grantedAt>|<granteeKey or empty>|<cutoff>
+role-revoke|<grantee>|<role or empty>|<grantedBy>|<grantedAt>|<granteeKey or empty>|<cutoff>|<sig1>,<sig2>
 ```
 
-A revoke without `cutoff` signs exactly the bytes MMP v2.0 signs today, and its cutoff is its
-`grantedAt`. A `cutoff` on a `role-grant`, a cutoff after `grantedAt`, a revoke `granteeKey` that is
-neither empty (absent) nor an unpadded base64url Ed25519 key (43 characters), or a `role` containing `|` makes the record
-malformed (so no two records sign the same bytes). sym 0.14.0 puts a cutoff on every revoke it
-signs: `revokeRole(nodeId, { cutoff })`, by default the revoke's own time.
-
-**The rule** (for §6.6). For a node N holding key K, its role at time T is resolved, not stored:
+A revoke without `cutoff` signs exactly the bytes MMP v2.0 signs today. Malformed: a `cutoff` or
+`ratify` on a `role-grant`; a cutoff after `grantedAt`; `ratify` without `cutoff`, empty, unsorted,
+repeated, over 64 entries or holding anything but a canonical signature; a revoke `granteeKey` that
+is neither empty nor a 43-character key; a `role` containing `|`. So no two records sign the same
+bytes.
+
+### 6.2 What is kept: a deterministic function of the records held
+
+1. **Verifiable.** A record is kept only when its signature verifies under the anchor's configured
+   key (its grantor is the anchor) or under a key that a kept `role-grant` vouches for its grantor
+   (`granteeKey`). Whether the grantor had authority is not asked here: a verifiable record is kept
+   and its effect is decided at resolution (6.3), so no record is refused for an order in which
+   records happened to arrive. A record whose grantor no kept grant vouches is refused
+   (`unknown-grantor-key`) and held for a `role-chain-fetch` (section 3).
+2. **Depth and subtree.** The anchor signs at depth 0. A grant kept at depth d makes its
+   (grantee, granteeKey) a signer at depth d + 1, in the subtree of the anchor grantee at the top of
+   that chain. A signer reachable by several chains takes the shallowest, then the one whose subtree
+   root has the smallest nodeId.
+3. **Budget per delegation subtree.** The anchor's own records are not bounded. Every other record
+   counts against the subtree of its signer: everything an anchor grantee and its descendants sign
+   shares that one budget (sym: 4,096 records). One subtree, however compromised, cannot fill
+   another's budget, so a revoke signed in another subtree is never refused by it.
+4. **Selection.** Inside a subtree the kept records are the first, up to the budget, in this total
+   order on signed fields: the signer's depth (shallower first); revokes before grants; a revoke's
+   cutoff, or a grant's `grantedAt` (earlier first); the canonical signature (smaller first). A
+   record that loses is replaced: a record that ranks above the last one kept takes its place, and
+   one that ranks below it is refused (`outranked`). Several revokes by one revoker for one grantee
+   are all kept while they fit; the earliest cutoff is the one that matters, so a revoker can always
+   tighten its cutoff by signing another revoke.
+5. **Equal stores.** Two nodes that hold the same records keep the same records and give the same
+   `role-digest`, whatever order they learned them in.
+
+Selection is computed over the records held: a record refused or replaced is not kept for later.
+Where a later grant gives a signer a shallower chain through another subtree, that signer's
+records move between budgets, and a record refused earlier in the budget they left is not
+reconsidered until a peer offers it again (the next whole-store sync after `role-digest`s differ).
+
+### 6.3 What counts: resolution
+
+For a node N holding key K, its role at time T is resolved from the kept records. "Now" is the
+resolving node's clock.
 
 1. The anchor holding its configured key is `anchor`.
-2. Otherwise take N's grants with `granteeKey` = K and `grantedAt <= T`, and N's revokes with
+2. Otherwise take N's grants with `granteeKey = K` and `grantedAt <= T`, and N's revokes with
    `cutoff <= T`. Replay them in `grantedAt` order (a revoke at its own `grantedAt`, even when that
-   is after T), starting from `participant`.
-3. A grant G by grantor P confers G's role if P, holding the key that signed G, resolves to a rank
-   at least G's role both at `G.grantedAt` and at T. (The second is §6.6's cascade: revoking a
-   grantor withdraws what it granted, for as long as it stays revoked.)
-4. A revoke R by revoker Q clears the role to `participant` if Q, holding the key that signed R,
-   resolves to `validator` or above, and to at least the role being cleared, both at `R.grantedAt`
-   and at `R.cutoff`. A revoker reaches back only over time it was itself authorised for.
-5. A rank is 0 when the resolved node already sits at the delegation depth (8, draft spec PR #36).
+   is after T), from `participant`.
+3. **Every statement by a signer S (key k), signed at s, counts only if S held the rank it needs at
+   s** (a revoke of S whose cutoff is at or before s has already cleared S there, so a statement
+   S signs at or after its cutoff never counts), **and either S still holds that rank now, or an
+   effective revoke of S ratifies it** (lists its signature, with s before that revoke's cutoff).
+   So a revoked key gains nothing by backdating: what it signs after its revoke, dated before its
+   cutoff, is not ratified and its signer no longer holds rank.
+4. A grant G by S confers G's role if step 3 holds and, unless G is ratified, S holds at least G's
+   role at T as well (§6.6's cascade). A ratified grant keeps conferring after its grantor's
+   revoke.
+5. A revoke R by revoker Q clears N to `participant` if step 3 holds for R and Q's rank is at least
+   `validator`, and at least the role being cleared, **at every time from R's cutoff to R's signed
+   time** (roles change only where some record's time is crossed, so it is checked at each of those
+   breakpoints in that span): a revoker reaches back only over time it was itself authorised for. An
+   effective revoke is one for which this holds; only an effective revoke ratifies.
+6. A rank is 0 when the resolved node already sits at the delegation depth (8, draft spec PR #36).
    Cycles and chains that do not reach the anchor confer nothing.
 
-Every time in the rule is a signed time. Nothing depends on when a node received a record, so two
-nodes holding the same records resolve the same role, whatever order they learned them in.
-
-**What follows.**
-- A statement the revoked node signed **before** the cutoff (a grant, a key vouch, a revoke, an
-  attestation, each judged at its own signed time) stands, for every receiver, whenever it
-  arrives. A grant among them still confers only while its grantor holds rank (step 3).
-- A statement it signed **at or after** the cutoff never counts, even at times before the revoke
-  itself was signed: that is what stops backdating. The revoker chooses how far back trust is
-  withdrawn; nothing can tell a backdated statement before the cutoff from a timely one.
-- An attestation's signer counts with its role at the attestation's signed time.
-
-**Keeping a record.** A grant or revoke is kept (and relayed once) only when it is rooted: its
-grantor held the rank it needs (a grant: the rank it confers; a revoke: `validator`) at its signed
-time, and for a revoke at its cutoff too. A record from a grantor revoked later stays kept, and
-the resolution above decides its effect.
-
-**Revokes are never refused by a cap.** Grants are bounded per grantor, per (grantor, grantee) and
-in all. A revoke is not: a revoke refused by a full store would leave authority standing. Instead,
-a revoker other than the anchor keeps at most as many revokes for a grantee as the node holds
-grants for that grantee (`nothing-to-revoke` past that). A revoke that arrives before any grant it
-could clear is held for a `role-chain-fetch` naming its grantee (section 3), and the whole-store
-sync sends grants before revokes.
+Every time in the rule is a signed time, or now. Nothing depends on when a node received a record.
+
+**Attestations.** An attestation's signer counts with its role at the attestation's signed time,
+under step 3: if it no longer holds that role now and no effective revoke of it ratifies the
+attestation (by its signature), it counts as `participant`. An attestation dated before the attested
+record's signed `createdTimestamp` is refused where the record is known (it attests to what did not
+yet exist).
 
 ---
 
@@ -320,3 +355,13 @@ nodeId for 60 s) only when the statement names the session's own proven peer as
 key that failed is the key that session proved. Any other statement that fails is dropped, counted
 and never charged to the session that delivered it. Its frame is not marked seen, so a genuine copy
 from another peer is still taken.
+
+**Cost.** Not charging a relayer must not make forgeries free. A receiver therefore:
+- spends a per-session record lane before it does any work on a record (sym: 32 a second, burst
+  128), as it spends a per-peer gossip lane before verifying a statement; past it, records are
+  dropped unverified and unmarked;
+- counts, per (delivering peer, named signer), the statements that failed under its binding for
+  that signer: past 8 in a minute, that peer's statements for that signer are dropped unverified
+  until the minute ends. The peer is not blamed and its other statements are taken;
+- says each refused record at most once a minute per peer and reason, and records it in its
+  decision log at most as often.
diff --git a/lib/config.js b/lib/config.js
index 5e8e3575..dad1ebf1 100644
--- a/lib/config.js
+++ b/lib/config.js
@@ -845,6 +845,11 @@ function lockHolderPid(name) {
 const _heldLockPaths = new Set();
 let _exitHooksInstalled = false;
 
+/** Whether a node in THIS process holds the identity lock in `dir` (final re-review, Finding 7a). */
+function lockHeldInProcess(dir) {
+  return _heldLockPaths.has(path.join(dir, 'lock.pid'));
+}
+
 /** Delete a lockfile iff this process is its recorded holder. */
 function _releaseLockIfOurs(lockPath) {
   try {
@@ -949,8 +954,14 @@ function acquireIdentityLock(name, opts = {}, _attempt = 0) {
     // hot-reload scenarios, and in recovery flows where a single
     // process re-initializes after a soft failure. The lock is meant
     // to catch CROSS-PROCESS duplicates (the actual bug), not
-    // in-process re-init.
-    if (lock.pid === process.pid) return makeRelease();
+    // in-process re-init. While another holder in this process still
+    // holds it, the re-acquirer gets a release that does nothing: its
+    // release must not take the lock from under the live holder (final
+    // re-review, Finding 7a: an in-process export freed a running node's lock).
+    if (lock.pid === process.pid) {
+      if (_heldLockPaths.has(lockPath)) return function release() { /* the first holder releases it */ };
+      return makeRelease();
+    }
     if (lockIsHeldByLiveProcess(lock)) {
       const err = new Error(
         `[SYM] Agent '${name}' is already live in PID ${lock.pid ?? 'unknown'} on this host.\n\n` +
@@ -1046,6 +1057,7 @@ module.exports = {
   _windowsStartTimes: windowsStartTimes,
   readLockFile,
   lockIsHeldByLiveProcess,
+  lockHeldInProcess,
   locksHeldByLiveProcess,
   lockHolderPid,
   acquireIdentityLock,
diff --git a/lib/core/role-grant.js b/lib/core/role-grant.js
index c89e367c..729de525 100644
--- a/lib/core/role-grant.js
+++ b/lib/core/role-grant.js
@@ -46,8 +46,9 @@ function roleRank(role) {
  * A role-revoke may carry `cutoff` (ms epoch, at most its grantedAt): the revoked node's statements
  * signed at or after the cutoff never count, those signed before it stand (re-review N2; draft spec
  * text in docs/WIRE-0.14.0.md §6). It is signed as `|<cutoff>` appended to the payload, only when
- * present.
- * @param {object} g - { type, grantee, role, grantedBy, grantedAt, granteeKey?, cutoff? }
+ * present. It may also carry `ratify`, the revoked node's earlier statements (canonical signatures,
+ * sorted) that stay valid, signed as `|<sig>,<sig>...` after the cutoff (docs/WIRE-0.14.0.md §6.1).
+ * @param {object} g - { type, grantee, role, grantedBy, grantedAt, granteeKey?, cutoff?, ratify? }
  * @returns {Buffer}
  */
 function grantPayload(g) {
@@ -55,7 +56,10 @@ function grantPayload(g) {
   // revoke without it signs exactly the bytes it always signed. Unambiguous: a revoke's granteeKey,
   // when present, is 43 base64url characters (no `|`), and the cutoff is a decimal integer.
   const cutoff = g.type === 'role-revoke' && g.cutoff !== undefined ? `|${g.cutoff}` : '';
-  return Buffer.from(`${g.type}|${g.grantee}|${g.role || ''}|${g.grantedBy}|${g.grantedAt}|${g.granteeKey || ''}${cutoff}`, 'utf8');
+  // The statements the revoke ratifies (final re-review ruling B): canonical signatures, sorted,
+  // joined by ',' (no signature holds ',' or '|'), only after a cutoff.
+  const ratify = cutoff && Array.isArray(g.ratify) && g.ratify.length ? `|${g.ratify.join(',')}` : '';
+  return Buffer.from(`${g.type}|${g.grantee}|${g.role || ''}|${g.grantedBy}|${g.grantedAt}|${g.granteeKey || ''}${cutoff}${ratify}`, 'utf8');
 }
 
 /**
diff --git a/lib/emit.js b/lib/emit.js
index 1bbbef6b..50ff25f6 100644
--- a/lib/emit.js
+++ b/lib/emit.js
@@ -151,16 +151,24 @@ async function connect({ server, receiver, room, name = 'emitter', timeoutMs = H
   const identity = loadOrCreateIdentity(name);
   // The identity's lock, held while connected: a live node of this name refuses the emitter.
   const release = acquireIdentityLock(name, { dir: nodeDirById(identity.nodeId) });
-  const { host, port } = parseServer(server);
   // §5.8: the room is explicit in Core Secure; the default room is the literal 'default'.
   const claimed = (typeof room === 'string' && room) ? room : 'default';
 
-  const socket = await new Promise((resolve, reject) => {
-    const s = net.connect({ host, port });
-    const t = setTimeout(() => { s.destroy(); reject(new Error(`emit: connect timeout to ${server}`)); }, timeoutMs);
-    s.once('connect', () => { clearTimeout(t); resolve(s); });
-    s.once('error', (e) => { clearTimeout(t); reject(e); });
-  });
+  // A bad address or a failed connect releases the identity's lock (final re-review, Low): the
+  // emitter is not connected, so it holds nothing.
+  let socket;
+  try {
+    const { host, port } = parseServer(server);
+    socket = await new Promise((resolve, reject) => {
+      const s = net.connect({ host, port });
+      const t = setTimeout(() => { s.destroy(); reject(new Error(`emit: connect timeout to ${server}`)); }, timeoutMs);
+      s.once('connect', () => { clearTimeout(t); resolve(s); });
+      s.once('error', (e) => { clearTimeout(t); reject(e); });
+    });
+  } catch (err) {
+    release();
+    throw err;
+  }
 
   const transport = new TcpTransport(socket);
   const session = new PeerSession({
diff --git a/lib/frame-handler.js b/lib/frame-handler.js
index bdb4ae09..42a92543 100644
--- a/lib/frame-handler.js
+++ b/lib/frame-handler.js
@@ -108,6 +108,14 @@ function deepFreeze(o) {
  */
 const RECORDS_PER_SECOND = 8;
 const RECORDS_BURST = 32;
+/**
+ * Records one session may have checked at all, before any work on them (final re-review, Finding 3):
+ * the lane spent ahead of the schema check, key recomputation and signature verification, as the
+ * gossip lane is ahead of a statement's. Past it a record is dropped unchecked and unmarked. The burst
+ * covers a fetch answer (at most 64 records) and the anchor replay.
+ */
+const VERIFY_PER_SECOND = 32;
+const VERIFY_BURST = 128;
 /** cmb-fetch serving bounds per session (security review D, fetch-amp). */
 const FETCH_SERVE_PER_SECOND = 2;
 const FETCH_SERVE_BURST = 8;
@@ -245,6 +253,17 @@ class FrameHandler {
    * chance to be delivered. Idempotent and no-op when the key is absent.
    * @private
    */
+  /** @private Take one of `session`'s pre-verification tokens. @returns {boolean} */
+  _verifyBudget(session) {
+    const now = Date.now();
+    const b = session._verifyBucket || (session._verifyBucket = { tokens: VERIFY_BURST, at: now });
+    b.tokens = Math.min(VERIFY_BURST, b.tokens + ((now - b.at) * VERIFY_PER_SECOND) / 1000);
+    b.at = now;
+    if (b.tokens < 1) return false;
+    b.tokens -= 1;
+    return true;
+  }
+
   /** @private Take one of `session`'s record tokens. @returns {boolean} */
   _recordBudget(session) {
     const now = Date.now();
@@ -581,9 +600,11 @@ class FrameHandler {
     const k = recordKey(cmb);
     const refuse = (reason, error) => {
       msg._cmbVerified = false;
-      this._node._log(`[sym-security] CMB ${String(k || '').slice(0, 16)} from ${peerName} refused — ${reason}${error ? ` (${String(error).slice(0, 120)})` : ''}`);
       this._node.emit('metric', { type: 'cmb-signature-rejected', from: peerName, key: k, reason, error: error || reason });
-      if (typeof this._node._recordDecision === 'function') {
+      // Said, and recorded in the decision log, at most once a minute per peer and reason (final
+      // re-review, Finding 3): a flood of refusals costs one line and one entry, and is counted.
+      const said = this._sayOnceAMinute(this._audienceSaid, `${peerId}|refused|${reason}`, (more) => `[sym-security] CMB ${String(k || '').slice(0, 16)} from ${peerName} refused — ${reason}${error ? ` (${String(error).slice(0, 120)})` : ''}${more}`);
+      if (said && typeof this._node._recordDecision === 'function') {
         // The recorded label is the ACTUAL verdict (content-mismatch, bad-signature, …), not a constant.
         this._node._recordDecision({ method: 'signature', source: peerName, cmbKey: k, decision: 'rejected-signature', totalDrift: null, categoryDrifts: null, gateValues: null, focusLabel: error || reason, remix: recordParents(cmb).length > 0 });
       }
@@ -597,6 +618,21 @@ class FrameHandler {
     }
     if (!md.sig) return refuse('unsigned');
     if (typeof md.createdByNodeId !== 'string' || !md.createdByNodeId) return refuse('no-author-node-id');
+    // The work a record costs is charged before any of it is done (final re-review, Finding 3): the
+    // session's verification lane, then the (relayer, author) failure window. Dropped unchecked and
+    // unmarked either way, so a genuine copy from elsewhere is still taken.
+    const session = this._sessionOf.get(msg);
+    if (session && !this._verifyBudget(session)) {
+      msg._cmbVerified = false;
+      this._node.emit('metric', { type: 'cmb-over-verify-budget', from: peerName, key: k });
+      this._sayOnceAMinute(this._audienceSaid, `${peerId}|verify-budget`, (more) => `CMBs from ${peerName} over its verification budget (${VERIFY_PER_SECOND}/s) — dropped unchecked${more}`);
+      return true;
+    }
+    if (typeof this._node._relayMuted === 'function' && this._node._relayMuted(peerId, md.createdByNodeId)) {
+      msg._cmbVerified = false;
+      this._node.emit('metric', { type: 'relayed-signer-muted', kind: 'record', peer: peerId, author: md.createdByNodeId.slice(0, 128) });
+      return true;
+    }
     // A record is its signed projection (review finding B): validated against the schema with no
     // member outside it and every value typed before it is length-prefixed, then rebuilt from the
     // signed members only. Everything after this point — verification, storage, the host hook,
@@ -619,7 +655,7 @@ class FrameHandler {
       // author (0.14.0 re-review N1): the node then closes the session. A relayed record that fails
       // under this node's binding for its author is dropped and counted, never charged to the relayer,
       // whose binding for that author may differ from this node's.
-      if (v.error === 'bad-signature' && typeof this._node._penaliseForgery === 'function') this._node._penaliseForgery(this._sessionOf.get(msg), 'record', { author: md.createdByNodeId, key: authorKey });
+      if (v.error === 'bad-signature' && typeof this._node._penaliseForgery === 'function') this._node._penaliseForgery(session, 'record', { author: md.createdByNodeId, key: authorKey, peer: peerId });
       return refuse('invalid', v.error || 'invalid');
     }
     // A record that declares the v2.0 suite but is malformed for it has no preimage: assertionIdV2_0
@@ -904,9 +940,8 @@ class FrameHandler {
       if (Object.prototype.hasOwnProperty.call(msg, own)) delete msg[own];
     }
 
-    // No size bound here beyond the frame the record arrived in. The record bounds are minting
-    // rules (cmb-encoder): earlier releases minted larger categories and longer agent ids, and
-    // refusing those would stop this node hearing such a peer at all.
+    // The record size limits (§8.8.6) were applied before anything else, at the canonical constructor
+    // (record-canonical.js sizeRefusal); an agent id longer than this release mints is still taken.
 
     // A frame's own `content` is never read (review finding E): what an entry says is rendered from the
     // record's categories, after they are verified, never from text the frame carried beside them.
@@ -1790,7 +1825,7 @@ class FrameHandler {
     const r = this._node._ingestAttestation(att, peerId, peerName, session);
     // A repeat, a copy past the per-CMB limit, and one past the peer's budget or with a signature not
     // spelled canonically (both said by the node, once per 10 s) are quiet here.
-    if (r.ok || !r.reason || r.reason === 'duplicate' || r.reason === 'rate-limited' || r.reason === 'over-budget' || r.reason === 'non-canonical-signature') return;
+    if (r.ok || !r.reason || r.reason === 'duplicate' || r.reason === 'rate-limited' || r.reason === 'over-budget' || r.reason === 'relayed-signer-muted' || r.reason === 'non-canonical-signature') return;
     if (r.reason === 'bad-signature') {
       this._node.emit('metric', { type: 'attestation-rejected', from: peerName, of: att.of, by: att.by, reason: 'invalid' });
     }
@@ -1813,11 +1848,12 @@ class FrameHandler {
   _sayOnceAMinute(said, key, line) {
     const now = Date.now();
     const last = said.get(key);
-    if (last && now - last.at < 60_000) { last.more++; return; }
+    if (last && now - last.at < 60_000) { last.more++; return false; }
     said.delete(key);
     if (said.size >= 1024) said.delete(said.keys().next().value);
     said.set(key, { at: now, more: 0 });
     this._node._log(line(last && last.more ? ` (and ${last.more} more since it was last said)` : ''));
+    return true;
   }
 
   /**
diff --git a/lib/interior.js b/lib/interior.js
index ed5927b2..445f3627 100644
--- a/lib/interior.js
+++ b/lib/interior.js
@@ -49,9 +49,22 @@
  *                                                       { type: 'delivery', item } lines
  *   → { id, type: 'ack', capability, delivery }     ← { id, type: 'acked' }
  *   → { id, type: 'recall', capability, query, limit? } ← { id, type: 'recall', items }
- * A delivery item is { seq, id, kind: 'directed'|'broadcast', record, verification, session,
- * remixed, receivedAt }: only Core Secure deliveries that verified — a record signed to this node, or
- * a room broadcast it admitted — never a quarantined one.
+ * A delivery item is { seq, id, kind: 'directed'|'broadcast', record, verified: true, profile,
+ * assertionId, verification, session, author, remixed, receivedAt, acked }: only Core Secure
+ * deliveries that verified — a record signed to this node, or a room broadcast it admitted — never
+ * a quarantined one. A recall item is { key, record, verified, storedAt, author }.
+ *
+ * THE READ SIDE IS SCOPED TO THE MIND'S MISSION (final re-review, Finding 6; the founder's ruling C).
+ * A mind is the node's reasoning for ONE mission, and must not read what the node received for
+ * another:
+ *   - each mind has its own READ VIEW: the deliveries that arrived while it runs (after its start),
+ *     a directed one only when its verified author is in the mission's `allowTo`, and room broadcasts;
+ *   - its own CURSOR: `deliveries` drains the mind's view, never the host's inbox (`node.inbox()` is
+ *     the host's and is never moved by a mind);
+ *   - `recall` returns only records in the view, the ones the mind submitted, and the mission's
+ *     declared `context` keys; a `parents` key outside that scope is refused as if absent;
+ *   - `ack` acks only an item in the view, in the mind's view only;
+ *   - read requests are rate-limited per mind (READS_PER_SECOND, burst READS_BURST).
  *
  * Windows: a named pipe takes the default DACL Node gives it, which this module cannot narrow, so
  * `listen` refuses on Windows unless the host passes `{ allowDefaultPipeAcl: true }` (security review).
@@ -74,6 +87,11 @@ const DEFAULT_RATE_PER_MINUTE = 60;
 const MAX_REQUEST_BYTES = 1024 * 1024;
 const MAX_DELIVERIES = 200;
 const MAX_RECALL = 100;
+/** Read requests (deliveries, recall, ack, mission, subscribe) a mind may make: a token bucket. */
+const READS_PER_SECOND = 10;
+const READS_BURST = 20;
+/** Keys a mind's scope holds at most (its submissions and the mission's context). */
+const MAX_SCOPE_KEYS = 10000;
 
 /** The mind running for each identity in this process: nodeId -> the Interior holding it. */
 const MINDS = new Map();
@@ -141,6 +159,8 @@ class Interior {
       id: typeof m.id === 'string' ? m.id.slice(0, 128) : `mission-${Date.now()}`,
       kinds: new Set(kinds),
       allowTo: new Set(Array.isArray(m.allowTo) ? m.allowTo.filter((t) => typeof t === 'string') : []),
+      // Records the host gives the mind to read and cite (its view holds nothing from before it started).
+      context: new Set(Array.isArray(m.context) ? m.context.filter((k) => typeof k === 'string').slice(0, MAX_SCOPE_KEYS) : []),
       ratePerMinute: Number.isFinite(m.ratePerMinute) && m.ratePerMinute > 0 ? m.ratePerMinute : DEFAULT_RATE_PER_MINUTE,
     };
   }
@@ -148,7 +168,9 @@ class Interior {
   /**
    * Start a mind for one mission and issue its capability. Refused (EMINDBUSY) while another mind
    * runs: one mind per node.
-   * @param {{ id?: string, kinds: string[], allowTo?: string[], ratePerMinute?: number }} mission
+   * @param {{ id?: string, kinds: string[], allowTo?: string[], context?: string[], ratePerMinute?: number }} mission
+   *   `context`: record keys the host gives the mind to read and cite (its view holds nothing from
+   *   before it started).
    * @returns {{ mindId: string, capability: string, socketPath: string|null }}
    */
   startMind(mission) {
@@ -177,7 +199,12 @@ class Interior {
     const capability = crypto.randomBytes(32).toString('base64url');
     const mindId = `mind-${crypto.randomBytes(6).toString('hex')}`;
     MINDS.set(this._node.nodeId, this);
-    this._mind = { mindId, capability, mission, startedAt: Date.now(), bucket: { tokens: mission.ratePerMinute, at: Date.now() }, conn: null };
+    // The mind's read view starts after the deliveries already in the inbox (ruling C).
+    const floor = this._node._inboxSeq || 0;
+    this._mind = {
+      mindId, capability, mission, startedAt: Date.now(), bucket: { tokens: mission.ratePerMinute, at: Date.now() }, conn: null,
+      floor, cursor: floor, acked: new Set(), submitted: new Set(), reads: { tokens: READS_BURST, at: Date.now() },
+    };
     this._node._log(`Interior: mind ${mindId} started for mission ${mission.id} (kinds ${[...mission.kinds].join(', ')})`);
     return { mindId, capability, socketPath: this._socketPath };
   }
@@ -243,8 +270,11 @@ class Interior {
     if (intent !== undefined && intent !== sub.kind) return this._refuse('intent-is-not-the-kind');
     if (sub.payload !== undefined && Buffer.byteLength(JSON.stringify(sub.payload), 'utf8') > MAX_APPLICATION) return this._refuse('application-too-large');
     const parents = Array.isArray(sub.parents) ? sub.parents : [];
+    // A parent the mind cites must be in its scope: one outside it is refused as if absent, so the
+    // check is no oracle for what the node holds (ruling C).
+    const scope = this._scopeKeys(m);
     for (const k of parents) {
-      if (typeof k !== 'string' || !this._node._store.get(k)) return this._refuse('parent-not-in-store');
+      if (typeof k !== 'string' || !scope.has(k) || !this._node._store.get(k)) return this._refuse('parent-not-in-store');
     }
     const now = Date.now();
     const b = m.bucket;
@@ -259,6 +289,7 @@ class Interior {
       return this._refuse(err && err.code ? err.code : 'emit-failed');
     }
     if (!entry) return this._refuse('not-minted');
+    if (entry.key && m.submitted.size < MAX_SCOPE_KEYS) m.submitted.add(entry.key);
     if (entry.duplicate && !entry.cmb) return { ok: true, key: entry.key, duplicate: true };
     this._stats.submitted++;
     return { ok: true, key: entry.key, assertionId: entry.cmb?.metadata?.assertionId ?? null, ...(entry.duplicate ? { duplicate: true } : {}) };
@@ -318,10 +349,43 @@ class Interior {
     };
   }
 
-  /** @private A delivery the node just surfaced, to the subscribed mind connection. */
+  /**
+   * @private Whether an inbox entry is in mind `m`'s read view (ruling C): it arrived after the mind
+   * started, it is a Core Secure delivery that verified, and a directed one is from a node the mission
+   * may address.
+   */
+  _inView(m, e) {
+    if (!m || !e || !(e.seq > m.floor)) return false;
+    if (!this._item(e)) return false;
+    if (e.directed) return !!(e.author && typeof e.author.nodeId === 'string' && m.mission.allowTo.has(e.author.nodeId));
+    return true;
+  }
+
+  /** @private The record keys mind `m` may read and cite: its view's, its own submissions, its context. */
+  _scopeKeys(m) {
+    const keys = new Set([...m.submitted, ...m.mission.context]);
+    for (const e of this._node._inbox || []) if (e.key && this._inView(m, e)) keys.add(e.key);
+    return keys;
+  }
+
+  /** @private Spend one of mind `m`'s read tokens; false past its rate. */
+  _readOk(m) {
+    const now = Date.now();
+    const b = m.reads;
+    b.tokens = Math.min(READS_BURST, b.tokens + ((now - b.at) * READS_PER_SECOND) / 1000);
+    b.at = now;
+    if (b.tokens < 1) { this._refuse('read-rate'); return false; }
+    b.tokens -= 1;
+    return true;
+  }
+
+  /** @private A delivery the node just surfaced, to the subscribed mind connection (in its view only). */
   _pushDelivery(entry) {
     if (!this._subscribers.size || !entry || !entry.inboxId) return;
-    const it = this._item(this._node.inboxGet(entry.inboxId));
+    const m = this._mind;
+    const e = this._node.inboxGet(entry.inboxId);
+    if (!m || !this._inView(m, e)) return;
+    const it = this._item(e);
     if (!it) return;
     for (const c of this._subscribers) { try { c.write(JSON.stringify({ type: 'delivery', item: it }) + '\n'); } catch { /* the connection is going */ } }
   }
@@ -330,6 +394,7 @@ class Interior {
     const type = req && req.type;
     const m = this._authorise(sock, req && req.capability);
     if (!m) return { id, type: 'refused', reason: this._mind && this._capabilityIs(req && req.capability) ? 'capability-bound-to-another-connection' : 'no-live-capability' };
+    if (type !== 'submit' && type !== 'end' && !this._readOk(m)) return { id, type: 'refused', reason: 'rate' };
     switch (type) {
       case 'submit': {
         const r = this.submit(req.capability, req);
@@ -341,25 +406,36 @@ class Interior {
       case 'mission':
         return { id, type: 'mission', mindId: m.mindId, missionId: m.mission.id, kinds: [...m.mission.kinds], allowTo: [...m.mission.allowTo], ratePerMinute: m.mission.ratePerMinute, nodeId: this._node.nodeId, name: this._node.name, room: this._node._room };
       case 'deliveries': {
+        // The mind's own view and cursor; the host's inbox cursor never moves (ruling C).
         const limit = Number.isSafeInteger(req.limit) && req.limit > 0 ? Math.min(req.limit, MAX_DELIVERIES) : 50;
-        const r = this._node.inbox({ limit, peek: req.peek === true, ...(Number.isSafeInteger(req.after) ? { since: req.after } : {}) });
-        return { id, type: 'deliveries', items: r.messages.map((e) => this._item(e)).filter(Boolean), cursor: r.cursor, remaining: r.remaining };
+        const from = Number.isSafeInteger(req.after) ? Math.max(req.after, m.floor) : m.cursor;
+        const view = (this._node._inbox || []).filter((e) => e.seq > from && this._inView(m, e));
+        const slice = view.slice(0, limit);
+        if (req.peek !== true && slice.length) m.cursor = Math.max(m.cursor, slice[slice.length - 1].seq);
+        const items = slice.map((e) => ({ ...this._item(e), acked: m.acked.has(e.id) }));
+        return { id, type: 'deliveries', items, cursor: m.cursor, remaining: view.length - slice.length };
       }
       case 'subscribe':
         this._subscribers.add(sock);
         sock.once('close', () => this._subscribers.delete(sock));
         return { id, type: 'subscribed' };
-      case 'ack':
+      case 'ack': {
+        // Only an item in the mind's view, and only in the mind's view: the host's inbox is the host's.
         if (typeof req.delivery !== 'string') return { id, type: 'refused', reason: 'malformed' };
-        this._node.inboxAck(req.delivery);
+        const e = this._node.inboxGet(req.delivery);
+        if (!this._inView(m, e)) return { id, type: 'refused', reason: 'not-in-view' };
+        m.acked.add(e.id);
         return { id, type: 'acked' };
+      }
       case 'recall': {
         if (typeof req.query !== 'string') return { id, type: 'refused', reason: 'malformed' };
         const limit = Number.isSafeInteger(req.limit) && req.limit > 0 ? Math.min(req.limit, MAX_RECALL) : 20;
         const own = this._node.nodeId;
+        const scope = this._scopeKeys(m);
         const items = [];
         for (const e of this._node.recall(req.query) || []) {
           if (items.length >= limit) break;
+          if (!e || !scope.has(e.key)) continue; // only what the mission may see (ruling C)
           const mine = !e.peerId;
           if (!mine && e.verified !== true) continue; // a peer's record only when it verified
           const md = e.cmb && e.cmb.metadata;
@@ -411,4 +487,4 @@ class Interior {
   }
 }
 
-module.exports = { Interior, MAX_CATEGORY_TEXT, MAX_APPLICATION, ownedPrivateDir };
+module.exports = { Interior, MAX_CATEGORY_TEXT, MAX_APPLICATION, READS_PER_SECOND, READS_BURST, ownedPrivateDir };
diff --git a/lib/node.js b/lib/node.js
index ab19ce11..ca21c1d4 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -28,7 +28,7 @@ const { nodeDirById, loadIdentity, acquireIdentityLock, log: logMsg } = require(
 const { assertTestSandbox } = require('./core/state-root');
 const { MemoryStore } = require('./memory-store');
 const { AttestationStore, chainHash, isPosition, isCanonicalSig } = require('./attestation-store');
-const { RoleGrantStore, canonicalGrant, malformedGrant } = require('./role-grant-store');
+const { RoleGrantStore, canonicalGrant, malformedGrant, MAX_RATIFY } = require('./role-grant-store');
 const { RosterKeyRegistry, keyFingerprint } = require('./roster-keys');
 const { signedProjection, isLowerUuid } = require('./core/record-canonical');
 /** A stored record's signed projection, or null for one that is not a v2.0 record. */
@@ -163,6 +163,13 @@ const GOSSIP_REPORT_MS = 10000;
 const GOSSIP_MAX_PEERS = 4096;
 /** A room as signed statements compare it: NFC (this node's room is NFC; sym-attest-v1 signs nfc(room)). */
 const nfcRoom = (r) => (typeof r === 'string' ? r.normalize('NFC') : r);
+/**
+ * Statements one peer relays for one signer that may fail under this node's binding for that signer
+ * in a window before that peer's statements for that signer are dropped unverified for the rest of it
+ * (final re-review, Finding 3).
+ */
+const RELAY_FAILURES_MAX = 8;
+const RELAY_FAILURE_WINDOW_MS = 60_000;
 /** A peer that delivered a forged signature is not admitted again for this long (security review D). */
 const FORGERY_PENALTY_MS = 60_000;
 /** role-chain-fetch (design D3): records held per session while their chain is fetched, and for how long. */
@@ -1093,23 +1100,47 @@ class SymNode extends EventEmitter {
   }
 
   /**
-   * Revoke a peer's granted role (signed role-revoke, gossiped). The revoke carries a cutoff
-   * (re-review N2): the revoked node's statements signed at or after it never count, and those signed
-   * before it stand for every receiver. It defaults to now (the revoke's own signed time); pass an
-   * earlier `opts.cutoff` (ms epoch) to withdraw trust from the time a node's key or judgement was
-   * compromised. A revoker can reach back only over time it was itself authorised for.
+   * Revoke a peer's granted role (signed role-revoke, gossiped). `opts.cutoff` (ms epoch, no later
+   * than now) is REQUIRED, with no default (final re-review ruling B): it is the time from which the
+   * revoked node is no longer trusted, and its statements signed at or after it never count.
+   * `opts.ratify` lists the revoked node's earlier statements (their signatures; at most 64) that stay
+   * valid: any other statement it signed before the cutoff counts only while it still holds rank, so
+   * a revoked key gains nothing by backdating. `roleStatementsBy(nodeId, cutoff)` lists the records
+   * it signed that this node holds. A revoker reaches back only over time it was itself
+   * authorised for (docs/WIRE-0.14.0.md §6).
    * @param {string} granteeNodeId
-   * @param {{ cutoff?: number }} [opts]
-   * @returns {object|null} the signed revoke, or null
+   * @param {{ cutoff: number, ratify?: string[] }} opts
+   * @returns {object|null} the signed revoke, or null when the store did not keep it
+   * @throws {TypeError} code ECUTOFF when `cutoff` is missing or not a time no later than now;
+   *   code ERATIFY when `ratify` is not a list of at most 64 signatures
    */
   revokeRole(granteeNodeId, opts = {}) {
     const at = Date.now();
-    const cutoff = opts.cutoff === undefined ? at : opts.cutoff;
+    const cutoff = opts && opts.cutoff;
     if (!Number.isSafeInteger(cutoff) || cutoff < 0 || cutoff > at) {
-      this._log(`Role revoke for ${String(granteeNodeId).slice(0, 8)} not made: the cutoff must be a time (ms) no later than now`);
-      return null;
+      throw Object.assign(new TypeError('revokeRole: opts.cutoff is required: the time (ms epoch, no later than now) from which the revoked node is no longer trusted'), { code: 'ECUTOFF' });
+    }
+    let ratify;
+    if (opts.ratify !== undefined) {
+      const { sigKey } = require('./attestation-store');
+      const list = Array.isArray(opts.ratify) ? [...new Set(opts.ratify.map((x) => (typeof x === 'string' ? sigKey(x) : x)))] : null;
+      if (!list || list.length === 0 || list.length > MAX_RATIFY || !list.every((x) => typeof x === 'string' && isCanonicalSig(x))) {
+        throw Object.assign(new TypeError(`revokeRole: opts.ratify is a list of 1 to ${MAX_RATIFY} signatures`), { code: 'ERATIFY' });
+      }
+      ratify = list.sort();
     }
-    return this._emitGrant({ type: 'role-revoke', grantee: granteeNodeId, cutoff }, at);
+    return this._emitGrant({ type: 'role-revoke', grantee: granteeNodeId, cutoff, ...(ratify ? { ratify } : {}) }, at);
+  }
+
+  /**
+   * The role grants and revokes `nodeId` signed that this node holds, signed before `before`: what a
+   * revoker reviews when it chooses which statements its revoke ratifies (`revokeRole`, `ratify`).
+   * @param {string} nodeId
+   * @param {number} [before]
+   * @returns {object[]} the signed records, oldest first
+   */
+  roleStatementsBy(nodeId, before) {
+    return this._roleGrants.statementsBy(nodeId, before);
   }
 
   /**
@@ -1139,7 +1170,7 @@ class SymNode extends EventEmitter {
     // A grant vouches for the grantee's nodeId↔key binding (granteeKey, bound into the signed
     // payload): nodes that never met the grantee learn its key from this rooted grant. Revokes carry
     // no key; they carry a cutoff.
-    const g = { type: partial.type, grantee: partial.grantee, ...(partial.role ? { role: partial.role } : {}), grantedBy: this.nodeId, grantedAt: at, ...(partial.granteeKey ? { granteeKey: partial.granteeKey } : {}), ...(partial.cutoff !== undefined ? { cutoff: partial.cutoff } : {}) };
+    const g = { type: partial.type, grantee: partial.grantee, ...(partial.role ? { role: partial.role } : {}), grantedBy: this.nodeId, grantedAt: at, ...(partial.granteeKey ? { granteeKey: partial.granteeKey } : {}), ...(partial.cutoff !== undefined ? { cutoff: partial.cutoff } : {}), ...(partial.ratify ? { ratify: partial.ratify } : {}) };
     try {
       signGrant(g, this._identity.privateKey);
       const r = this._roleGrants.record(g);
@@ -1147,8 +1178,8 @@ class SymNode extends EventEmitter {
         this._log(`Role ${g.type === 'role-revoke' ? 'revoke' : 'grant'} for ${String(g.grantee).slice(0, 8)} not made: ${r.reason}`);
         return null;
       }
-      this._gossipToRoster({ type: g.type, grant: g });
-      return g;
+      this._gossipToRoster({ type: g.type, grant: r.grant });
+      return r.grant;
     } catch (err) {
       this._log(`Role grant signing failed: ${err.message}`);
       return null;
@@ -1156,11 +1187,11 @@ class SymNode extends EventEmitter {
   }
 
   /**
-   * Ingest a role-grant/revoke gossiped by a roster peer: the store keeps it only if it is
-   * rooted at the anchor and its signature verifies against the grantor's authenticated
-   * key (anchor pinned), and only a record kept is relayed (once). An unrooted record — a
-   * peer's self-signed grant, say — has no effect, so it is dropped here and goes no further.
-   * What is stored and relayed is the store's canonical copy: only the signed fields (A5).
+   * Ingest a role-grant/revoke gossiped by a roster peer: the store keeps it when it is verifiable
+   * (its signature verifies under the anchor's key or a key a kept grant vouches for its grantor) and
+   * its delegation subtree's budget selects it; its effect is decided at resolution
+   * (docs/WIRE-0.14.0.md §6). Only a record kept is relayed (once), as the store's canonical copy:
+   * only the signed fields (A5).
    * @private
    */
   _ingestRoleGrant(g, fromPeerId, session = null, { hold = true } = {}) {
@@ -1168,9 +1199,10 @@ class SymNode extends EventEmitter {
     // it is spelled) or a frame that is malformed (field types, canonical lowercase nodeIds, bounded
     // lengths), spelled otherwise than its signer wrote it, or from a grantor whose key this node does
     // not hold is dropped before anything is spent; a new one spends the delivering peer's own lane
-    // before its signature is checked. A signature that does not verify ends the session that brought
-    // it (`_penaliseForgery`). The store bounds what it keeps (per grantor, per pair, in all), so grants
-    // draw on no shared ceiling; only what it keeps is relayed.
+    // before its signature is checked. A signature that does not verify is charged as
+    // `_penaliseForgery` decides (only to a session signing in its own name). The store bounds what it
+    // keeps (a budget per delegation subtree), so grants draw on no shared ceiling; only what it keeps
+    // is relayed.
     if (malformedGrant(g)) return { ok: false, reason: 'malformed' };
     if (!isCanonicalSig(g.sig)) return this._refuseSpelling(fromPeerId, 'role-grant', g.grantedBy);
     if (this._roleGrants.has(g.sig)) return { ok: false, reason: 'duplicate' };
@@ -1178,13 +1210,10 @@ class SymNode extends EventEmitter {
       if (hold) this._holdForChain(session, g);
       return { ok: false, reason: 'unknown-grantor-key' };
     }
+    if (this._relayMuted(fromPeerId, g.grantedBy)) return { ok: false, reason: 'relayed-signer-muted' };
     if (!this._gossipBudget(fromPeerId, 'role-grant', g.grantedBy)) return { ok: false, reason: 'over-budget' };
     const r = this._roleGrants.record(g);
     if (r.stored) this._gossipToRoster({ type: r.grant.type, grant: r.grant }, fromPeerId);
-    else if (r.reason === 'unrooted' && hold) this._holdForChain(session, g);
-    // A revoke that arrived before the grant it clears (re-review N4): the grantee's own records are
-    // fetched from the session that delivered it, and the revoke is offered again with them.
-    else if (r.reason === 'nothing-to-revoke' && hold) this._holdForChain(session, g, g.grantee);
     else if (r.reason === 'bad-signature') {
       // Verified against the keys this store's chain vouches for the grantor, not the session's: the
       // session is charged only when the grantor is its own peer and its proven key was among them.
@@ -1205,7 +1234,8 @@ class SymNode extends EventEmitter {
    * a Legacy Import session, or the answer itself) is not held.
    * @private
    */
-  _holdForChain(session, g, missing = g.grantedBy) {
+  _holdForChain(session, g) {
+    const missing = g.grantedBy;
     if (!session || session.legacy || !session.confirmed || session.closed || typeof session.send !== 'function') return;
     if (malformedGrant(g)) return;
     // Held as its signed fields only (bounded: canonical nodeIds of at most 128 characters, a role
@@ -1214,7 +1244,7 @@ class SymNode extends EventEmitter {
     const h = session._chainHold || (session._chainHold = { grants: new Map(), fetches: new Map(), bytes: 0 });
     // Keyed by every field the signature covers and the signature: a forged copy sent ahead of the
     // genuine record is a different entry, so it cannot keep the genuine one out.
-    const holdKey = `${g.type}|${g.grantee}|${g.role || ''}|${g.grantedBy}|${g.grantedAt}|${g.granteeKey || ''}|${g.cutoff ?? ''}|${g.sig}`;
+    const holdKey = `${g.type}|${g.grantee}|${g.role || ''}|${g.grantedBy}|${g.grantedAt}|${g.granteeKey || ''}|${g.cutoff ?? ''}|${(g.ratify || []).join(',')}|${g.sig}`;
     if (h.grants.has(holdKey)) return;
     const bytes = holdKey.length * 2;
     if (h.grants.size >= CHAIN_HOLD_MAX || h.bytes + bytes > CHAIN_HOLD_BYTES) {
@@ -1260,7 +1290,7 @@ class SymNode extends EventEmitter {
       for (const g of left) {
         const r = this._ingestRoleGrant(g, session.nodeId, session, { hold: false });
         if (r.ok) { this._chainStats.resolved++; progress = true; }
-        else if (r.reason === 'unrooted' || r.reason === 'unknown-grantor-key' || r.reason === 'nothing-to-revoke') next.push(g);
+        else if (r.reason === 'unknown-grantor-key') next.push(g);
       }
       left = next;
     }
@@ -1288,7 +1318,7 @@ class SymNode extends EventEmitter {
         const r = this._ingestRoleGrant(g, session.nodeId, session, { hold: false });
         if (session.closed) return; // a forged grant in the answer ended the session
         if (r.ok) progress = true;
-        else if (r.reason === 'unrooted' || r.reason === 'unknown-grantor-key' || r.reason === 'nothing-to-revoke') next.push(g);
+        else if (r.reason === 'unknown-grantor-key') next.push(g);
       }
       left = next;
     }
@@ -1489,14 +1519,30 @@ class SymNode extends EventEmitter {
   }
 
   /**
-   * The role an attestation's signer counts with: its role at the attestation's signed time `at`
-   * (re-review N2). A revoke takes effect from its cutoff, so a revoked validator's attestation dated
-   * at or after the cutoff counts as a participant's, and one dated before it keeps its standing, for
-   * every receiver whenever it arrives. When this node received it plays no part.
+   * The role an attestation's signer counts with (docs/WIRE-0.14.0.md §6.3): its role at the
+   * attestation's signed time `at`, if it still holds that role now or an effective revoke of it
+   * ratifies the attestation; otherwise its role now. A revoke takes effect from its cutoff, so an
+   * attestation dated at or after it counts as a participant's; one a revoked key signs later, dated
+   * before it, gains nothing unless ratified. An attestation dated before the record it attests (when
+   * this node holds the record) counts as a participant's. When this node received it plays no part.
    * @private
    */
   _attesterRole(att) {
-    return this.resolveRole(att.by, Number.isFinite(att && att.at) ? att.at : 0);
+    const at = Number.isFinite(att && att.at) ? att.at : 0;
+    if (this._datedBeforeRecord(att)) return 'participant';
+    const then = this.resolveRole(att.by, at);
+    const now = this.resolveRole(att.by, Date.now());
+    if (roleRank(now) >= roleRank(then)) return then;
+    return this._roleGrants.ratifies(att.by, at, att.sig, roleRank(then)) ? then : now;
+  }
+
+  /** @private Whether an attestation is dated before the signed createdTimestamp of the record it attests. */
+  _datedBeforeRecord(att) {
+    if (!att || typeof att.of !== 'string' || !Number.isFinite(att.at)) return false;
+    let e = null;
+    try { e = this._store.get(att.of); } catch { return false; }
+    const ts = e && e.cmb && e.cmb.metadata && e.cmb.metadata.createdTimestamp;
+    return Number.isSafeInteger(ts) && att.at < ts;
   }
 
   /**
@@ -1532,6 +1578,8 @@ class SymNode extends EventEmitter {
       const key = this._identityKey(att.by);
       if (!key) { excluded.push({ by: att.by, reason: 'unknown-key' }); continue; }
       if (!verifyAttestation(att, key).valid) { excluded.push({ by: att.by, reason: 'bad-signature' }); continue; }
+      // An attestation dated before the record it attests attests to what did not yet exist.
+      if (this._datedBeforeRecord(att)) { excluded.push({ by: att.by, reason: 'dated-before-record' }); continue; }
 
       // (2) resolve the attester's EARNED role at the time it attested (role-at-time).
       const rr = verifyAttestationRole(att, () => this._attesterRole(att));
@@ -1649,6 +1697,7 @@ class SymNode extends EventEmitter {
     if (!isCanonicalSig(cp.sig)) return this._refuseSpelling(fromPeerId, 'checkpoint', cp.by);
     const key = this._identityKey(cp.by);
     if (!key) return { ok: false, reason: 'unknown-attester-key' };
+    if (this._relayMuted(fromPeerId, cp.by)) return { ok: false, reason: 'relayed-signer-muted' };
     if (!this._gossipBudget(fromPeerId, 'checkpoint', cp.by)) return { ok: false, reason: 'over-budget' };
     if (!verifyCheckpoint(cp, key).valid) { this._penaliseForgery(session, 'checkpoint', { author: cp.by, key }); return { ok: false, reason: 'bad-signature' }; }
     if (!this._gossipCeiling(fromPeerId, 'checkpoint', cp.by)) return { ok: false, reason: 'over-ceiling' };
@@ -1676,9 +1725,10 @@ class SymNode extends EventEmitter {
    * Spend one token of the PROVEN peer a NEW gossiped statement arrived from, before its signature is
    * checked (see GOSSIP_PER_SECOND and GOSSIP_NEW_LANE). Only the peer's own lane is spent before the
    * check (security review D: no shared budget is spent before verification), so a peer flooding
-   * forgeries spends its own budget and nobody else's; and its first forgery ends its session
-   * (`_penaliseForgery`). An honest peer relays only what it has verified and stored, so its budget
-   * carries no forgeries. The lane refills, so a peer that stops flooding is heard again within
+   * forgeries spends its own budget and nobody else's. A forgery in its own name ends its session
+   * (`_penaliseForgery`); a statement it relays for another signer that fails here is dropped without
+   * blaming it (its binding for that signer may differ), and past RELAY_FAILURES_MAX in a minute its
+   * statements for that signer are dropped unverified (`_relayMuted`). The lane refills, so a peer that stops flooding is heard again within
    * burst/rate seconds. A dropped frame changes nothing: it is not marked seen, so another peer's copy
    * is taken. O(1).
    * @returns {boolean} whether the frame may be verified
@@ -1739,6 +1789,7 @@ class SymNode extends EventEmitter {
     const own = typeof author === 'string' && author === nodeId && (key === undefined || (!!key && key === session.identityKey));
     if (!own) {
       this._relayedUnverified = (this._relayedUnverified || 0) + 1;
+      this._noteRelayFailure(nodeId, author);
       this.emit('metric', { type: 'relayed-signature-unverified', kind, peer: nodeId, author: typeof author === 'string' ? author.slice(0, 128) : null });
       this._sayOncePerMinute(`relayed-unverified|${nodeId}|${kind}`, `[sym-security] a ${kind} signed as ${String(author).slice(0, 8)}, relayed by ${session.name || String(nodeId).slice(0, 8)}, does not verify under this node's key for its signer: dropped (the relaying peer is not charged; its binding for the signer may differ from this node's)`);
       return false;
@@ -1754,6 +1805,36 @@ class SymNode extends EventEmitter {
     return true;
   }
 
+  /**
+   * @private A statement `peer` relayed for `author` failed under this node's binding for the author
+   * (final re-review, Finding 3). Past RELAY_FAILURES_MAX in RELAY_FAILURE_WINDOW_MS, that peer's
+   * statements for that author are dropped unverified until the window ends: the cost of forgeries
+   * relayed in another's name is bounded without blaming the relayer, whose other statements are taken.
+   */
+  _noteRelayFailure(peer, author) {
+    if (typeof peer !== 'string' || typeof author !== 'string') return;
+    if (!this._relayFailures) this._relayFailures = new Map();
+    const k = `${peer}\u0000${author.slice(0, 128)}`;
+    const now = Date.now();
+    let f = this._relayFailures.get(k);
+    if (!f || now - f.since >= RELAY_FAILURE_WINDOW_MS) f = { since: now, count: 0 };
+    f.count++;
+    this._relayFailures.delete(k);
+    if (this._relayFailures.size >= GOSSIP_MAX_PEERS) this._relayFailures.delete(this._relayFailures.keys().next().value);
+    this._relayFailures.set(k, f);
+  }
+
+  /** Whether `peer`'s statements for `author` are being dropped unverified (see _noteRelayFailure). */
+  _relayMuted(peer, author) {
+    if (!this._relayFailures || typeof author !== 'string') return false;
+    const f = this._relayFailures.get(`${peer}\u0000${author.slice(0, 128)}`);
+    if (!f) return false;
+    if (Date.now() - f.since >= RELAY_FAILURE_WINDOW_MS) { this._relayFailures.delete(`${peer}\u0000${author.slice(0, 128)}`); return false; }
+    if (f.count < RELAY_FAILURES_MAX) return false;
+    this._noteDrop('relayed-signer-muted', peer, { author });
+    return true;
+  }
+
   /** @private Whether `nodeId` is inside a forgery penalty (and drop it when it has run out). */
   _penalised(nodeId) {
     const until = this._forgeryPenalty && this._forgeryPenalty.get(nodeId);
@@ -1921,6 +2002,7 @@ class SymNode extends EventEmitter {
     if (!isCanonicalSig(w.sig)) return this._refuseSpelling(fromPeerId, 'witness', w.by);
     const key = this._identityKey(w.by);
     if (!key) return { ok: false, reason: 'unknown-witness-key' };
+    if (this._relayMuted(fromPeerId, w.by)) return { ok: false, reason: 'relayed-signer-muted' };
     if (!this._gossipBudget(fromPeerId, 'witness', w.by)) return { ok: false, reason: 'over-budget' };
     if (!verifyWitness(w, key).valid) { this._penaliseForgery(session, 'witness', { author: w.by, key }); return { ok: false, reason: 'bad-signature' }; }
     if (!this._gossipCeiling(fromPeerId, 'witness', w.by)) return { ok: false, reason: 'over-ceiling' };
@@ -2000,8 +2082,12 @@ class SymNode extends EventEmitter {
     // checked.
     if (!isCanonicalSig(att.sig)) return this._refuseSpelling(fromPeerId, 'attestation', att.by);
     if (this._attestations.has(att.sig)) return { ok: false, reason: 'duplicate' };
+    // Dated before the signed createdTimestamp of the record it attests (where this node holds it): an
+    // attestation to what did not yet exist (final re-review, ruling B).
+    if (this._datedBeforeRecord(att)) return { ok: false, reason: 'dated-before-record' };
     const attesterKey = this._identityKey(att.by);
     if (!attesterKey) return { ok: false, reason: 'unknown-attester-key' };
+    if (this._relayMuted(fromPeerId, att.by)) return { ok: false, reason: 'relayed-signer-muted' };
     if (!this._gossipBudget(fromPeerId, 'attestation', att.by)) return { ok: false, reason: 'over-budget' };
     const v = verifyAttestation(att, attesterKey);
     if (!v.valid) {
@@ -2387,8 +2473,11 @@ class SymNode extends EventEmitter {
     // not hold the process open), whether or not the node was started.
     this._wakeManager.flushWakeChannels();
     if (!this._running) {
-      // An interior a host opened on a node it never started still ends with it.
+      // An interior a host opened on a node it never started still ends with it, and so does the
+      // identity lock its constructor took (final re-review, Finding 7a: a stopped node must not keep
+      // its nodeId held in this process).
       if (this._interior) this._interior.close();
+      if (this._releaseIdentityLock) { try { this._releaseIdentityLock(); } catch { /* */ } this._releaseIdentityLock = null; }
       return;
     }
     this._running = false;
@@ -3258,6 +3347,9 @@ class SymNode extends EventEmitter {
     // event (§14.9.1) from it. The text rides in the record's focus and, whole, in a signed
     // application section that marks the record as a message. Sent, not stored.
     const content = String(message ?? '');
+    // An addressee that is not a nodeId is refused before anything is minted (EBADTO), as remember()
+    // refuses it.
+    if (opts.to !== undefined && opts.to !== null) assertAddressee(opts.to);
     const targets = opts.to ? [opts.to] : [...this._peers.keys()];
     let delivered = 0;
     for (const to of targets) {
diff --git a/lib/relocation.js b/lib/relocation.js
index bbdffcaa..7c53126d 100644
--- a/lib/relocation.js
+++ b/lib/relocation.js
@@ -26,6 +26,18 @@
  *     review). It never relies on anything the bundle says about itself: a bundle whose identity was
  *     re-keyed, or whose signature does not verify under the pinned key, is refused.
  *
+ * Final re-review (Finding 7):
+ *   - A bundle is sealed to the target host's key by default. A passphrase bundle can be opened, and
+ *     so imported, on any host that has the passphrase, so it is a copy, not a move: it needs
+ *     `copyable: true` (the CLI's --allow-copies), and the docs say so.
+ *   - The clear header carries the node's public key and a signature over the header (`headerSig`),
+ *     checked against the pin BEFORE the header's scrypt parameters are used (and those are bounded).
+ *   - A host refuses a bundle it has imported before (`consumed-bundles.jsonl`), and one exported at
+ *     or before its own tombstone of that node (a replay of an older move).
+ *   - An import is staged in a directory of its own and renamed into place last: a refused import
+ *     installs nothing. File modes travel with the files.
+ *   - Export refuses while a node in this process holds the identity's lock.
+ *
  * @copyright 2026 SYM.BOT. Apache 2.0 License.
  */
 
@@ -41,6 +53,9 @@ const X25519_SPKI_PREFIX = Buffer.from('302a300506032b656e032100', 'hex');
 const X25519_PKCS8_PREFIX = Buffer.from('302e020100300506032b656e04220420', 'hex');
 const ED25519_PKCS8_PREFIX = Buffer.from('302e020100300506032b657004220420', 'hex');
 const HOST_KEY_FILE = 'host-key.json';
+const CONSUMED_FILE = 'consumed-bundles.jsonl';
+/** The scrypt parameters a bundle's header may ask for, at most (a hostile header must not cost more). */
+const MAX_SCRYPT = { N: 1 << 17, r: 16, p: 4 };
 
 /** This host's X25519 key pair for receiving bundles (created on first use, 0600). */
 function hostKey({ create = true } = {}) {
@@ -62,6 +77,7 @@ function hostKey({ create = true } = {}) {
 }
 
 function listFiles(root, rel = '') {
+  // (paths relative to root; see exportLocked for the modes that travel with them)
   const out = [];
   for (const d of fs.readdirSync(path.join(root, rel), { withFileTypes: true })) {
     const p = path.join(rel, d.name);
@@ -112,6 +128,10 @@ function unseal(bundle, { passphrase, hostPrivateKey }) {
   let key;
   if (bundle.kdf === 'scrypt') {
     if (typeof passphrase !== 'string') throw new Error('relocation: this bundle needs its passphrase');
+    const ok = (v, max) => Number.isSafeInteger(v) && v >= 1 && v <= max;
+    if (!ok(bundle.N, MAX_SCRYPT.N) || (bundle.N & (bundle.N - 1)) !== 0 || !ok(bundle.r, MAX_SCRYPT.r) || !ok(bundle.p, MAX_SCRYPT.p)) {
+      throw new Error('relocation: the bundle asks for scrypt parameters outside the bound');
+    }
     key = crypto.scryptSync(passphrase, Buffer.from(bundle.salt, 'base64url'), 32, { N: bundle.N, r: bundle.r, p: bundle.p, maxmem: 128 * 1024 * 1024 });
   } else if (bundle.kdf === 'x25519-hkdf') {
     const priv = hostPrivateKey || (hostKey({ create: false }) || {}).privateKey;
@@ -150,17 +170,24 @@ function publicOf(privateKeyB64url) {
  * @param {string} [o.toHostKey] - the target host's X25519 public key (sym node host-key there)
  * @returns {{ nodeId: string, name: string, files: number, out: string, fingerprint: string }}
  */
-function exportNode({ name, nodeId, out, passphrase, toHostKey } = {}) {
+function exportNode({ name, nodeId, out, passphrase, toHostKey, copyable = false } = {}) {
   if (!out) throw new Error('relocation: out (the bundle file) is required');
   const id = nodeId || (name && config.nodeIdForName(name));
   if (!id) throw new config.IdentityAbsentError(name ? `"${name}"` : 'the node');
   const dir = config.nodeDirById(id);
   if (config.readTombstone(id)) throw new Error(`relocation: ${id} is already tombstoned here (it was exported)`);
   const identity = config.loadIdentity({ nodeId: id, name, create: false });
+  // A node running in THIS process holds the lock too (final re-review, Finding 7a).
+  if (config.lockHeldInProcess(dir)) throw new Error(`relocation: ${identity.name} is running in this process; stop it before moving it`);
   const lock = config.readLockFile(path.join(dir, 'lock.pid'));
   if (lock && lock.pid !== process.pid && config.lockIsHeldByLiveProcess(lock)) {
     throw new Error(`relocation: ${identity.name} is running (PID ${lock.pid}); stop it before moving it`);
   }
+  // Sealed to the target host by default. A passphrase bundle opens on any host with the passphrase:
+  // it is a copy, and says so (final re-review, Finding 7b).
+  if (typeof passphrase === 'string' && !(typeof toHostKey === 'string' && toHostKey) && copyable !== true) {
+    throw new Error('relocation: a passphrase bundle can be imported on any host that has the passphrase, so it is a copy, not a move; seal it to the target host (toHostKey, --to-host), or pass copyable: true (--allow-copies)');
+  }
   // Validate the sealing input before the tombstone: a refused export must leave the node startable.
   seal(Buffer.alloc(0), { passphrase, toHostKey });
   // The identity's lock, held until the export is done: no process starts it in between.
@@ -179,19 +206,24 @@ function exportLocked({ id, dir, identity, out, passphrase, toHostKey }) {
   const tombPath = path.join(dir, config.TOMBSTONE);
   const fd = fs.openSync(tombPath, 'wx');
   try { fs.writeSync(fd, JSON.stringify(tomb, null, 2)); fs.fsyncSync(fd); } finally { fs.closeSync(fd); }
-  const files = listFiles(dir).map((rel) => ({ path: rel.split(path.sep).join('/'), data: fs.readFileSync(path.join(dir, rel)).toString('base64') }));
+  // Each file with its mode (final re-review, Finding 7b), so a 0600 file stays 0600 on the target.
+  const files = listFiles(dir).map((rel) => ({ path: rel.split(path.sep).join('/'), mode: fs.statSync(path.join(dir, rel)).mode & 0o777, data: fs.readFileSync(path.join(dir, rel)).toString('base64') }));
   // identity.json lives elsewhere when SYM_IDENTITY_DIR is set: it travels in the bundle all the same.
   if (!files.some((f) => f.path === 'identity.json')) {
-    files.push({ path: 'identity.json', data: Buffer.from(JSON.stringify(identity, null, 2)).toString('base64') });
+    files.push({ path: 'identity.json', mode: 0o600, data: Buffer.from(JSON.stringify(identity, null, 2)).toString('base64') });
   }
   const contents = { format: FORMAT, nodeId: id, name: identity.name, publicKey: identity.publicKey, exportedAt: tomb.movedAt, files };
   // The sealing header is chosen first, so the node's signature covers it (the target host key and
   // the ephemeral key included): the bundle is the node's own statement, for that host only.
-  const sealing = sealParams({ passphrase, toHostKey });
-  const header = { format: FORMAT, nodeId: id, fingerprint: tomb.fingerprint, ...sealing.header };
+  // A host key, when given, wins over a passphrase.
+  const sealing = sealParams(typeof toHostKey === 'string' && toHostKey ? { toHostKey } : { passphrase });
+  const header = { format: FORMAT, nodeId: id, fingerprint: tomb.fingerprint, publicKey: identity.publicKey, exportedAt: tomb.movedAt, ...sealing.header };
   const signature = signBundle(header, contents, identity.privateKey);
+  // The clear header is signed on its own as well, so an import checks it against the pin before it
+  // uses anything the header says (the scrypt parameters).
+  const headerSig = signHeader(header, identity.privateKey);
   const plain = Buffer.from(JSON.stringify({ ...contents, signature }), 'utf8');
-  const bundle = { ...header, ...sealWith(plain, sealing) };
+  const bundle = { ...header, headerSig, ...sealWith(plain, sealing) };
   const tmp = `${out}.${process.pid}.tmp`;
   const bfd = fs.openSync(tmp, 'w', 0o600);
   try { fs.writeSync(bfd, JSON.stringify(bundle)); fs.fsyncSync(bfd); } finally { fs.closeSync(bfd); }
@@ -239,6 +271,35 @@ function bundleSigned(header, contents) {
   return Buffer.from(`sym-node-bundle-v1-signature\n${h}\nnodeId=${contents.nodeId}\npublicKey=${contents.publicKey}\nname=${contents.name}\nexportedAt=${contents.exportedAt}\nfiles=${digest.digest('hex')}`, 'utf8');
 }
 
+/** @private The canonical bytes the clear header's own signature covers. */
+function headerSigned(header) {
+  return Buffer.from(`sym-node-bundle-v1-header\n${Object.keys(header).sort().map((k) => `${k}=${header[k]}`).join('\n')}`, 'utf8');
+}
+
+function signHeader(header, privateKeyB64url) {
+  const priv = crypto.createPrivateKey({ key: Buffer.concat([ED25519_PKCS8_PREFIX, Buffer.from(privateKeyB64url, 'base64url')]), format: 'der', type: 'pkcs8' });
+  return crypto.sign(null, headerSigned(header), priv).toString('base64url');
+}
+
+function verifyHeader(header, signature, publicKeyB64url) {
+  if (typeof signature !== 'string' || !isIdentityKey(publicKeyB64url)) return false;
+  try {
+    const pub = crypto.createPublicKey({ key: Buffer.concat([Buffer.from('302a300506032b6570032100', 'hex'), Buffer.from(publicKeyB64url, 'base64url')]), format: 'der', type: 'spki' });
+    return crypto.verify(null, headerSigned(header), pub, Buffer.from(signature, 'base64url'));
+  } catch { return false; }
+}
+
+/** @private Bundles this host has imported: their signatures, so none is imported twice. */
+function consumedBundles() {
+  const out = new Set();
+  try {
+    for (const line of fs.readFileSync(path.join(config.SYM_DIR, CONSUMED_FILE), 'utf8').split('\n')) {
+      try { const o = JSON.parse(line); if (o && typeof o.signature === 'string') out.add(o.signature); } catch { /* a partial line */ }
+    }
+  } catch { /* none yet */ }
+  return out;
+}
+
 function signBundle(header, contents, privateKeyB64url) {
   const priv = crypto.createPrivateKey({ key: Buffer.concat([ED25519_PKCS8_PREFIX, Buffer.from(privateKeyB64url, 'base64url')]), format: 'der', type: 'pkcs8' });
   return crypto.sign(null, bundleSigned(header, contents), priv).toString('base64url');
@@ -265,6 +326,18 @@ function verifyBundle(header, contents, signature, publicKeyB64url) {
 function importNode({ from, passphrase, hostPrivateKey, expect, name } = {}) {
   const bundle = JSON.parse(fs.readFileSync(from, 'utf8'));
   if (!bundle || bundle.format !== FORMAT) throw new Error('relocation: not a sym node bundle');
+  // THE INDEPENDENT PIN, checked against the clear header before anything the header says is used
+  // (final re-review, Finding 7b: the scrypt parameters). Never what the bundle says about itself.
+  let pinnedBy = null;
+  if (!expect || !expect.nodeId || !(expect.key || expect.fingerprint)) {
+    throw new Error(`relocation: refusing ${bundle.nodeId}: no explicit pinned key (give --expect-key or --expect-fingerprint, from the validator's preserve act or the source host)`);
+  }
+  if (expect.nodeId !== bundle.nodeId) throw new Error(`relocation: the bundle is ${bundle.nodeId}, not the expected ${expect.nodeId}`);
+  if (expect.key) { pinnedBy = 'operator key'; if (expect.key !== bundle.publicKey) throw new Error(`relocation: refusing ${bundle.nodeId}: the bundle's key is not the pinned one (${pinnedBy}) — a re-keyed bundle`); }
+  else { pinnedBy = 'operator fingerprint'; if (!isIdentityKey(bundle.publicKey) || keyFingerprint(bundle.publicKey) !== expect.fingerprint) throw new Error(`relocation: refusing ${bundle.nodeId}: the bundle's key is not the pinned one (${pinnedBy}) — a re-keyed bundle`); }
+  const { ciphertext, nonce, headerSig, ...header } = bundle;
+  void ciphertext; void nonce;
+  if (!verifyHeader(header, headerSig, bundle.publicKey)) throw new Error(`relocation: refusing ${bundle.nodeId}: the bundle's header is not signed by the node it names`);
   const plain = JSON.parse(unseal(bundle, { passphrase, hostPrivateKey }).toString('utf8'));
   const idFile = (plain.files || []).find((f) => f.path === 'identity.json');
   if (!idFile) throw new Error('relocation: the bundle carries no identity');
@@ -273,44 +346,53 @@ function importNode({ from, passphrase, hostPrivateKey, expect, name } = {}) {
     throw new Error('relocation: the bundle\'s identity is malformed');
   }
   if (publicOf(identity.privateKey) !== identity.publicKey) throw new Error('relocation: the bundle\'s private key does not match its public key');
-  // THE INDEPENDENT PIN: never what the bundle says about itself.
-  let pinned = null;
-  let pinnedBy = null;
-  if (expect && expect.nodeId) {
-    if (expect.nodeId !== identity.nodeId) throw new Error(`relocation: the bundle is ${identity.nodeId}, not the expected ${expect.nodeId}`);
-    if (expect.key) { pinned = expect.key; pinnedBy = 'operator key'; }
-    else if (expect.fingerprint) { pinned = { fingerprint: expect.fingerprint }; pinnedBy = 'operator fingerprint'; }
-  }
-  // No fallback to a key this host learned on first contact (security review): the pin is explicit.
-  if (!pinned) throw new Error(`relocation: refusing ${identity.nodeId}: no explicit pinned key (give --expect-key or --expect-fingerprint, from the validator's preserve act or the source host)`);
-  const ok = typeof pinned === 'string' ? pinned === identity.publicKey : keyFingerprint(identity.publicKey) === pinned.fingerprint;
-  if (!ok) throw new Error(`relocation: refusing ${identity.nodeId}: the bundle's key is not the pinned one (${pinnedBy}) — a re-keyed bundle`);
+  if (identity.publicKey !== bundle.publicKey || identity.nodeId !== bundle.nodeId) throw new Error(`relocation: refusing ${identity.nodeId}: the bundle's key is not the pinned one (${pinnedBy}) — a re-keyed bundle`);
   // The node's own signature over the bundle: header (the sealing it was made for), identity and
   // contents. A bundle without one, or one that does not verify under the pinned key, is refused.
-  const { ciphertext, nonce, ...header } = bundle;
-  void ciphertext; void nonce;
   const contents = { format: plain.format, nodeId: plain.nodeId, name: plain.name, publicKey: plain.publicKey, exportedAt: plain.exportedAt, files: plain.files || [] };
-  if (plain.nodeId !== identity.nodeId || plain.publicKey !== identity.publicKey || header.nodeId !== identity.nodeId || !verifyBundle(header, contents, plain.signature, identity.publicKey)) {
+  if (plain.nodeId !== identity.nodeId || plain.publicKey !== identity.publicKey || header.exportedAt !== plain.exportedAt || !verifyBundle(header, contents, plain.signature, identity.publicKey)) {
     throw new Error(`relocation: refusing ${identity.nodeId}: the bundle is not signed by the node it carries (or its header or contents were changed)`);
   }
+  // Not a bundle this host imported before, and not older than this host's own move of the node away
+  // (a replayed earlier bundle would bring back a past self).
+  if (consumedBundles().has(plain.signature)) throw new Error(`relocation: refusing ${identity.nodeId}: this bundle was already imported on this host`);
+  const tomb = config.readTombstone(identity.nodeId);
+  if (tomb && Number.isFinite(tomb.movedAt) && !(plain.exportedAt > tomb.movedAt)) {
+    throw new Error(`relocation: refusing ${identity.nodeId}: the bundle was exported at or before this host moved the node away (a replay of an older move)`);
+  }
   const dest = config.nodeDirById(identity.nodeId);
+  if (fs.existsSync(dest) && !tomb) throw new Error(`relocation: ${identity.nodeId} already lives on this host`);
+  const label = name || identity.name;
+  config.validateName(label);
+  const existing = config.nodeIdForName(label);
+  if (existing && existing !== identity.nodeId) throw new Error(`relocation: the name "${label}" already indexes another node here; import with another name`);
+  // STAGED: everything is written to a directory of its own, and renamed into place last, so an
+  // import refused or failing on the way installs nothing (final re-review, Finding 7b).
+  const staged = `${dest}.import-${process.pid}-${crypto.randomBytes(4).toString('hex')}`;
+  try {
+    for (const f of plain.files) {
+      const rel = String(f.path);
+      if (rel.includes('..') || path.isAbsolute(rel) || rel.includes('\\')) throw new Error(`relocation: refusing a bundle path outside the node: ${rel}`);
+      const p = path.join(staged, ...rel.split('/'));
+      config.ensureDir(path.dirname(p));
+      const mode = rel === 'identity.json' ? 0o600 : (Number.isSafeInteger(f.mode) ? (f.mode & 0o777) : 0o644);
+      fs.writeFileSync(p, Buffer.from(f.data, 'base64'), { mode });
+      fs.chmodSync(p, mode);
+    }
+  } catch (err) {
+    fs.rmSync(staged, { recursive: true, force: true });
+    throw err;
+  }
   if (fs.existsSync(dest)) {
-    if (!config.readTombstone(identity.nodeId)) throw new Error(`relocation: ${identity.nodeId} already lives on this host`);
     // It was moved away from here before: the tombstoned copy is archived, and the node comes back.
     fs.renameSync(dest, `${dest}.moved-${Date.now()}`);
   }
-  for (const f of plain.files) {
-    const rel = String(f.path);
-    if (rel.includes('..') || path.isAbsolute(rel)) throw new Error(`relocation: refusing a bundle path outside the node: ${rel}`);
-    const p = path.join(dest, ...rel.split('/'));
-    config.ensureDir(path.dirname(p));
-    fs.writeFileSync(p, Buffer.from(f.data, 'base64'), rel === 'identity.json' ? { mode: 0o600 } : undefined);
-  }
+  fs.renameSync(staged, dest);
+  fsyncDir(path.dirname(dest));
   const idDirExt = config.identityDirById(identity.nodeId);
   if (idDirExt !== dest) { config.ensureDir(idDirExt); fs.writeFileSync(path.join(idDirExt, 'identity.json'), Buffer.from(idFile.data, 'base64'), { mode: 0o600 }); }
-  const label = name || identity.name;
-  const existing = config.nodeIdForName(label);
-  if (existing && existing !== identity.nodeId) throw new Error(`relocation: the name "${label}" already indexes another node here; import with another name`);
+  try { fs.appendFileSync(path.join(config.SYM_DIR, CONSUMED_FILE), JSON.stringify({ nodeId: identity.nodeId, signature: plain.signature, exportedAt: plain.exportedAt, importedAt: Date.now() }) + '\n', { mode: 0o600 }); }
+  catch { /* best effort: the tombstone check still refuses an older bundle */ }
   // indexName is internal to config; loadIdentity by nodeId + name writes the index.
   config.loadIdentity({ nodeId: identity.nodeId, name: label, create: false });
   return { nodeId: identity.nodeId, name: label, files: plain.files.length, pinnedBy };
diff --git a/lib/role-grant-store.js b/lib/role-grant-store.js
index 9794b2e4..f8e5de99 100644
--- a/lib/role-grant-store.js
+++ b/lib/role-grant-store.js
@@ -16,45 +16,41 @@
  *   - `resolveRole(nodeId, key, at)` confers a grant's role only when its `granteeKey` equals `key`,
  *     the key the subject is bound to (the key its session proved, or its registry binding). A node
  *     whose id is claimed by an impostor's key resolves, for that key, to participant.
- *   - Chains are verified TOP-DOWN with the key each verified grant vouches (§6.6: "using each
- *     verified grant's vouched key to reach the next"): a grant signed by grantor G is checked
- *     against the keys G's own rooted grants vouch for G, never against whatever key the registry
- *     holds for G. So a grantor whose id the registry binds to an impostor still has exactly the
- *     authority its vouched key has, and the impostor has none.
+ *   - Chains are verified TOP-DOWN with the key each kept grant vouches (§6.6: "using each verified
+ *     grant's vouched key to reach the next"), never with whatever key the registry holds.
  *
- * A REVOKE CARRIES A CUTOFF (0.14.0 re-review N2, the founder's ruling; it replaces the security
- * review's "both times" rule, draft spec PR #33). A signer's date is its own to write, so a revoked
- * validator can still sign statements dated inside its old window. The revoker therefore names the
- * date from which the revoked node is no longer trusted: `cutoff`, signed into the revoke, at most
- * the revoke's own signed time (absent: the revoke's signed time, which is every 0.13 revoke).
+ * WHAT IS KEPT IS A FUNCTION OF THE RECORDS HELD (final re-review, Findings 1 and 2; the founder's
+ * ruling A; docs/WIRE-0.14.0.md §6.2). Nothing about a record's meaning is decided at ingest, so the
+ * order records arrive in changes nothing:
  *
- *   - A statement the revoked node signed BEFORE the cutoff stands, for every receiver, whenever it
- *     arrives (a new node, an anti-entropy sync, a store upgraded from 0.13): authority no longer
- *     depends on when this node happened to receive something, so the mesh agrees.
- *   - A statement it signed AT OR AFTER the cutoff never counts. That is what stops backdating: the
- *     revoker sets the cutoff early enough to cover any window the revoked node is not trusted for.
- *   - Receipt time is no part of the rule. Nothing records it.
+ *   - A record is kept when it is VERIFIABLE: its signature verifies under the anchor's configured
+ *     key, or under a key a kept role-grant vouches for its grantor. Whether its grantor had
+ *     authority is decided at resolution, never here.
+ *   - The anchor signs at depth 0; a grant kept at depth d makes its (grantee, granteeKey) a signer
+ *     at depth d + 1, in the SUBTREE of the anchor grantee at the top of that chain (the shallowest
+ *     chain, then the subtree root with the smallest nodeId).
+ *   - The anchor's own records are unbounded. Every other record counts against its signer's
+ *     subtree: everything an anchor grantee and its descendants sign shares one budget
+ *     (SUBTREE_BUDGET). A subtree, however compromised, fills only its own budget, so a revoke
+ *     signed in another subtree is never refused by it.
+ *   - Inside a budget the kept records are the first in one total order on signed fields: signer
+ *     depth, revokes before grants, a revoke's cutoff or a grant's grantedAt, the signature. A record
+ *     that ranks above the last one kept replaces it; one below is refused (`outranked`).
  *
- * Concretely, a node's role at time t replays, in signed-time order, its grants signed at or before t
- * and its revokes whose cutoff is at or before t: a revoke takes effect from its cutoff, even at times
- * before it was signed, and clears every grant signed before the revoke itself (a grant signed after
- * it, a re-grant, is a new statement). A revoke counts when its revoker held the rank it needs both at
- * the revoke's signed time and at its cutoff (both signed, both the revoker's own word): a revoker can
- * reach back only over time it was itself authorised for.
+ * WHAT COUNTS IS DECIDED AT RESOLUTION (docs/WIRE-0.14.0.md §6.3; the founder's rulings):
  *
- * Grants keep MMP §6.6's cascade: a grant confers its role at t only while its grantor held the rank
- * both when it signed and at t, so revoking a grantor still withdraws what it granted (the grants
- * stand as statements: they are kept, and confer again if the grantor is re-granted).
+ *   - A revoke carries a CUTOFF (re-review N2): its subject's statements signed at or after it never
+ *     count. A revoke without one (0.13) has its own signed time as its cutoff.
+ *   - A revoke may RATIFY its subject's earlier statements (ruling B): any statement a signer made
+ *     before its cutoff counts only while the signer still holds the rank it needs, or if an
+ *     effective revoke of the signer lists it. So a revoked key gains nothing by backdating.
+ *   - A revoke counts only when its revoker held the rank at every breakpoint from its cutoff to its
+ *     signed time (final re-review, Low 8a).
+ *   - Grants keep §6.6's cascade (a grant confers at t only while its grantor holds the rank at t)
+ *     unless ratified. Every time is a signed time, or now; no receipt time is kept.
  *
- * A record is KEPT only when it is rooted at the anchor: its grantor held, at the record's signed time
- * (and, for a revoke, at its cutoff), the rank the record needs (a grant: the rank it confers; a
- * revoke: validator or above), under the key that signed it, by the chain this store already holds.
- * An unrooted record has no effect on any resolution, so it is not stored, not relayed, and costs
- * nothing. Resolution still re-checks every chain (role-at-time, cutoffs, the cascade). Reloading from
- * disk runs the same checks (the file has no integrity of its own, so nothing is trusted for being on
- * it). The file is append-only and never rewritten: a 0.13 line and a 0.14 line are the same bare
- * record, and a line skipped at one load (its root not yet held) stays on disk for the next
- * (re-review N5).
+ * The file is append-only and never rewritten (re-review N5): lines are the bare record, as 0.13
+ * wrote them, and the store is rebuilt from them at load by the same rule.
  *
  * A KEY VOUCH is a view (security review C): `vouchedKey(nodeId)` is the one key the grants in effect
  * NOW vouch for nodeId, and the key registry reads it on demand instead of storing a `grant` binding,
@@ -73,30 +69,18 @@ const { isCanonicalNodeId } = require('./core/record-canonical');
 
 const GRANTS_FILE = 'role-grants.jsonl';
 /**
- * Bounds on the GRANTS kept, and so on what is relayed, since only a record kept is relayed: grants
- * signed by one grantor, grants one grantor signed for one grantee, and grants in all. A full bound
- * refuses the newcomer and never evicts a record already kept, since a record's authority can depend
- * on its place in a chain. The anchor's own records are never refused. The pair bound is per grantor,
- * so one grantor filling it cannot keep another's grants to that grantee out; and it bounds what one
- * grantor adds to the grantee's role resolution, which every gating decision runs.
- *
- * No cap refuses a REVOKE (re-review N4): a revoke refused by a cap leaves authority standing, which
- * fails open, and a malicious validator filling the caps with sybil grants could stop every honest
- * revoke. Revokes are bounded by their grants instead: a non-anchor revoker keeps at most as many
- * revokes for one grantee as this store holds grants for that grantee (one per grant episode is all
- * a revoke can clear; a revoke for a grantee holding no grant clears nothing). So what one revoker
- * adds is at most the grants held, and a revoker can only ever fill its own allowance.
+ * The records one delegation subtree may hold: everything an anchor grantee and its descendants sign
+ * (final re-review: it replaces the per-grantor, per-pair and store caps, each of which could evict a
+ * voucher whose dependents then freed room, which made the kept set depend on arrival order).
  */
-const MAX_PER_GRANTOR = 1024;
-// 16 per pair (64 until 0.14): a grant, a revoke and a re-grant, several times over, is all an
-// honest grantor needs, and what one pair holds is replayed at every resolution of the grantee.
-const MAX_PER_PAIR = 16;
-const MAX_GRANTS = 65536;
+const SUBTREE_BUDGET = 4096;
 /** A record dated further than this into the future (by this node's clock) is refused. */
 const MAX_FUTURE_MS = 10 * 60 * 1000;
 /** Field bounds (security review D): a nodeId, a role name. A key and a signature have fixed lengths. */
 const MAX_ID = 128;
 const MAX_ROLE = 32;
+/** A revoke ratifies at most this many statements (a revoker that must ratify more signs several). */
+const MAX_RATIFY = 64;
 /** resolveRole's memo is cleared when it holds this many answers (and whenever a record is kept). */
 const MEMO_MAX = 65536;
 /**
@@ -105,6 +89,15 @@ const MEMO_MAX = 65536;
  * the spec, and the role-chain answer already stops there.
  */
 const MAX_DELEGATION_DEPTH = 8;
+const CANONICAL_SIG = /^[A-Za-z0-9_-]{85}[AQgw]$/;
+
+/** A revoke's cutoff: the signed `cutoff`, or its signed time when it carries none (re-review N2). */
+function cutoffOf(g) {
+  return g.type === 'role-revoke' && Number.isSafeInteger(g.cutoff) ? g.cutoff : (g.grantedAt ?? 0);
+}
+
+/** Whether signer info `a` is better (shallower, then the smaller subtree root) than `b`. */
+const better = (a, b) => a.depth < b.depth || (a.depth === b.depth && String(a.root) < String(b.root));
 
 class RoleGrantStore {
   /**
@@ -112,35 +105,22 @@ class RoleGrantStore {
    * @param {{nodeId: string, publicKey: string}} [opts.anchor] the non-earnable root of trust.
    * @param {{get: function(string): (string|undefined), bind?: function, pin?: function}} [opts.keys]
    *   the node's key registry. Read only to resolve a subject's bound key for `resolver()` and the
-   *   two-argument `resolveRole`; NEVER to verify a grant. A rooted grant's vouched key is pinned
-   *   back into it.
+   *   two-argument `resolveRole`; NEVER to verify a grant.
    * @param {string} [opts.dir] when set, grants persist append-only and reload here.
+   * @param {number} [opts.subtreeBudget] records one delegation subtree may hold (SUBTREE_BUDGET).
    */
   constructor(opts = {}) {
     this._anchor = opts.anchor || null;
     this._selfId = typeof opts.selfId === 'string' && opts.selfId ? opts.selfId : null;
     this._selfKey = typeof opts.selfKey === 'string' && opts.selfKey ? opts.selfKey : null;
-    // Told of a kept grant that names this node with a key that is not its own (draft spec PR #33:
-    // inert, and reported, since someone vouched a foreign key for this node's identity).
+    // Told of a kept grant in effect that names this node with a key that is not its own (inert, and
+    // reported, since someone vouched a foreign key for this node's identity).
     this._onForeignSelfGrant = typeof opts.onForeignSelfGrant === 'function' ? opts.onForeignSelfGrant : null;
     this._now = typeof opts.now === 'function' ? opts.now : Date.now;
     this._keys = opts.keys || new Map();
-    this._memo = new Map();       // `${nodeId}\0${key}\0${canonical at}` -> { role, depth } (cleared on every change)
-    this._times = [];             // every record's grantedAt, sorted, distinct: resolution's breakpoints
-    this._memoKeys = new Map();   // nodeId -> Set(memo keys of its answers), to forget one subtree
-    this._grantees = new Map();   // grantor nodeId -> Set(grantee nodeIds it signed records for)
-    this._byGrantee = new Map(); // grantee nodeId -> [grant/revoke records]
-    this._vouched = new Map();   // nodeId -> Set(keys its rooted role-grants vouch)
-    this._signer = new Map();    // sigKey -> the key that verified the record
-    this._seen = new Set();      // sigKey dedup: the signature's bytes, however it is spelled
-    this._perGrantor = new Map(); // grantor nodeId -> grants kept
-    this._perPair = new Map();    // grantor nodeId + NUL + grantee nodeId -> grants kept
-    this._grantCount = 0;         // grants kept in all (revokes are bounded by their grants, below)
-    this._grantsOf = new Map();   // grantee nodeId -> grants kept for it, from any grantor
-    this._revokesOf = new Map();  // revoker nodeId + NUL + grantee nodeId -> revokes kept
-    this._maxPerGrantor = opts.maxPerGrantor || MAX_PER_GRANTOR;
-    this._maxPerPair = opts.maxPerPair || MAX_PER_PAIR;
-    this._maxGrants = opts.maxGrants || MAX_GRANTS;
+    this._budget = Number.isSafeInteger(opts.subtreeBudget) && opts.subtreeBudget > 0 ? opts.subtreeBudget : SUBTREE_BUDGET;
+    this._pool = new Map();      // sigKey -> { g, signer, sk } : the records kept
+    this._reset();
     this._dir = opts.dir || null;
     this._loading = false;
     this._loadReport = { loaded: 0, skipped: {}, unreadable: null };
@@ -150,11 +130,24 @@ class RoleGrantStore {
     }
   }
 
+  /** @private Clear every structure derived from the pool. */
+  _reset() {
+    this._byGrantee = new Map();   // grantee nodeId -> [entries]
+    this._info = new Map();        // `${nodeId}\0${key}` -> { depth, root } : a signer
+    this._signerKeys = new Map();  // nodeId -> Set(keys it signs under)
+    this._byRoot = new Map();      // subtree root -> Set(entries)
+    this._ratifiers = new Map();   // statement sigKey -> [revoke entries listing it]
+    this._times = [];              // record times and cutoffs, sorted, distinct: resolution's breakpoints
+    this._worst = new Map();       // subtree root -> its last-ranked entry (a cache)
+    this._memo = new Map();
+    this._memoNow = undefined;
+    this._syncOrder = null;
+    this._digest = null;
+  }
+
   /**
-   * What the last reload found: records `loaded`, records `skipped` by reason (each a record that
-   * could not be verified — not JSON, malformed, unknown grantor key, bad signature, unrooted,
-   * duplicate, nothing-to-revoke — and which stays in the file for the next load), and `unreadable`
-   * (why the file could not be read; null when it could, or none).
+   * What the last reload found: records `loaded`, records `skipped` by reason (each stays in the file
+   * for the next load), and `unreadable` (why the file could not be read; null when it could).
    * @returns {{ loaded: number, skipped: Object<string, number>, unreadable: string|null }}
    */
   loadReport() {
@@ -162,34 +155,79 @@ class RoleGrantStore {
   }
 
   /**
-   * The keys a grant from `grantedBy` may be verified against: the anchor's configured key, or the
-   * keys `grantedBy`'s own rooted grants vouch. Empty when no chain reaches it.
+   * The keys a record from `grantedBy` may be verified against: the anchor's configured key, or the
+   * keys kept grants vouch for `grantedBy`. Empty when no kept grant reaches it.
    * @returns {string[]}
    */
   grantorKeys(grantedBy) {
     if (this._anchor && grantedBy === this._anchor.nodeId) return [this._anchor.publicKey];
-    return [...(this._vouched.get(grantedBy) || [])];
+    return [...(this._signerKeys.get(grantedBy) || [])];
   }
 
-  /** Whether any chain reaches `grantedBy` (a grant from it could verify). */
+  /** Whether any kept grant reaches `grantedBy` (a record from it could verify). */
   grantorKey(grantedBy) { return this.grantorKeys(grantedBy)[0]; }
 
+  /** @private The signer info of (nodeId, key), the anchor's included. */
+  _signerInfo(nodeId, key) {
+    if (this._anchor && nodeId === this._anchor.nodeId && key === this._anchor.publicKey) return { depth: 0, root: null };
+    return this._info.get(`${nodeId}\u0000${key}`);
+  }
+
+  /** @private The info a kept grant gives its grantee, or null when it gives none. */
+  _grantInfo(e, info) {
+    const g = e.g;
+    if (g.type !== 'role-grant') return null;
+    // No grant makes the anchor, or this node under a key not its own, a signer.
+    if (this._anchor && g.grantee === this._anchor.nodeId) return null;
+    if (this._selfId && g.grantee === this._selfId && g.granteeKey !== this._selfKey) return null;
+    return { depth: info.depth + 1, root: info.root === null ? g.grantee : info.root };
+  }
+
   /**
-   * Record a signed role-grant / role-revoke, if it is rooted at the anchor. In order: the record
-   * must be well-formed (a role-grant carries granteeKey), new (dedup by the signature's bytes), within
-   * the bounds, from a grantor some chain reaches, ROOTED under one of the grantor's vouched keys, and
-   * its signature must verify against that key. A record that fails any of these is refused with the
-   * reason and leaves no trace: not held, not written, not relayed.
+   * The total order a budget keeps by (final re-review ruling A): signer depth, revokes before grants,
+   * a revoke's cutoff or a grant's signed time, then the signature. Negative when `a` ranks first.
+   * @private
+   */
+  _cmp(a, ai, b, bi) {
+    if (ai.depth !== bi.depth) return ai.depth - bi.depth;
+    const ta = a.g.type === 'role-revoke' ? 0 : 1;
+    const tb = b.g.type === 'role-revoke' ? 0 : 1;
+    if (ta !== tb) return ta - tb;
+    const xa = ta === 0 ? cutoffOf(a.g) : a.g.grantedAt;
+    const xb = tb === 0 ? cutoffOf(b.g) : b.g.grantedAt;
+    if (xa !== xb) return xa - xb;
+    return a.sk < b.sk ? -1 : a.sk > b.sk ? 1 : 0;
+  }
+
+  /** @private The last-ranked entry of a subtree (cached). */
+  _worstIn(root) {
+    const hit = this._worst.get(root);
+    if (hit) return hit;
+    let w = null;
+    for (const e of this._byRoot.get(root) || []) {
+      const ei = this._signerInfo(e.g.grantedBy, e.signer);
+      if (!w || this._cmp(e, ei, w.e, w.info) > 0) w = { e, info: ei };
+    }
+    if (w) this._worst.set(root, w);
+    return w;
+  }
+
+  /**
+   * Record a signed role-grant / role-revoke. In order: well-formed (a role-grant carries
+   * granteeKey), new (dedup by the signature's bytes), not dated in the future, verifiable (its
+   * signature verifies under the anchor's key or a key a kept grant vouches for its grantor), and
+   * selected within its subtree's budget. A record that fails any of these is refused with the reason
+   * and leaves no trace: not held, not written, not relayed.
    *
-   * What is stored, persisted and returned (`grant`, for the caller to relay) is ONE canonical
-   * object holding only the fields the signature covers, the signature in its signer's spelling and
-   * `sigAlg` (0.13.17 re-review A5): an unsigned field a frame carried is never kept, written or
-   * passed on. Never throws: a record whose checks fail in a way no reason names is 'unverifiable'.
+   * What is stored, persisted and returned (`grant`, for the caller to relay) is ONE canonical object
+   * holding only the fields the signature covers, the signature in its signer's spelling and `sigAlg`
+   * (0.13.17 re-review A5). Never throws: a record whose checks fail in a way no reason names is
+   * 'unverifiable'.
    * @returns {{ stored: boolean, reason?: string, grant?: object }}
    */
-  record(grant, opts = {}) {
+  record(grant) {
     try {
-      return this._record(grant, opts);
+      return this._record(grant);
     } catch {
       return { stored: false, reason: 'unverifiable' };
     }
@@ -199,93 +237,149 @@ class RoleGrantStore {
   _record(grant) {
     if (malformed(grant)) return { stored: false, reason: 'malformed' };
     const sk = sigKey(grant.sig);
-    if (this._seen.has(sk)) return { stored: false, reason: 'duplicate' };
+    if (this._pool.has(sk)) return { stored: false, reason: 'duplicate' };
     if (grant.grantedAt > this._now() + MAX_FUTURE_MS) return { stored: false, reason: 'future-dated' };
-    const fromAnchor = !!this._anchor && grant.grantedBy === this._anchor.nodeId;
-    const pair = `${grant.grantedBy}\u0000${grant.grantee}`;
-    const isRevoke = grant.type === 'role-revoke';
-    if (!fromAnchor && !isRevoke) {
-      if ((this._perGrantor.get(grant.grantedBy) || 0) >= this._maxPerGrantor) return { stored: false, reason: 'grantor-full' };
-      if ((this._perPair.get(pair) || 0) >= this._maxPerPair) return { stored: false, reason: 'pair-full' };
-      if (this._grantCount >= this._maxGrants) return { stored: false, reason: 'store-full' };
-    }
-    // A revoke is bounded by the grants it can clear, never by a cap (re-review N4). A revoke that
-    // arrives before the grant it clears waits for it (the reason is curable: a reload retries it, and
-    // the node fetches the grantee's records from the session that delivered it).
-    if (!fromAnchor && isRevoke && (this._revokesOf.get(pair) || 0) >= (this._grantsOf.get(grant.grantee) || 0)) return { stored: false, reason: 'nothing-to-revoke' };
     const candidates = this.grantorKeys(grant.grantedBy);
     if (candidates.length === 0) return { stored: false, reason: 'unknown-grantor-key' };
-    // Rooted first (no signature work for a record no key could root), then the signature.
-    const rooted = candidates.filter((k) => this._rooted(grant, k));
-    if (rooted.length === 0) return { stored: false, reason: 'unrooted' };
-    const signer = rooted.find((k) => verifyGrant(grant, k).valid);
+    const signer = candidates.find((k) => verifyGrant(grant, k).valid);
     if (!signer) return { stored: false, reason: 'bad-signature' };
-    // Kept as its signed fields only, with the signature in its canonical spelling, the one its signer
-    // wrote: a re-spelling verifies too, but the spelling is what relay-once and every other node's
-    // dedup see.
-    grant = canonicalGrant(grant, sk);
-    this._seen.add(sk);
-    this._signer.set(sk, signer);
-    this._addTime(grant.grantedAt);
-    if (isRevoke) this._addTime(cutoffOf(grant));
-    let gs = this._grantees.get(grant.grantedBy);
-    if (!gs) { gs = new Set(); this._grantees.set(grant.grantedBy, gs); }
-    gs.add(grant.grantee);
-    this._forgetSubtree(grant.grantee);
-    if (isRevoke) {
-      this._revokesOf.set(pair, (this._revokesOf.get(pair) || 0) + 1);
+    const e = { g: canonicalGrant(grant, sk), signer, sk };
+    const info = this._signerInfo(e.g.grantedBy, signer);
+    let rebuild = false;
+    if (info.root !== null && (this._byRoot.get(info.root)?.size || 0) >= this._budget) {
+      const w = this._worstIn(info.root);
+      if (w && this._cmp(e, info, w.e, w.info) > 0) return { stored: false, reason: 'outranked' };
+      rebuild = true;
+    }
+    const gi = this._grantInfo(e, info);
+    if (gi) {
+      const cur = this._info.get(`${e.g.grantee}\u0000${e.g.granteeKey}`);
+      if (cur && better(gi, cur)) rebuild = true;
+    }
+    if (rebuild) {
+      this._rebuild([...this._pool.values(), e]);
+      if (!this._pool.has(sk)) return { stored: false, reason: 'outranked' };
     } else {
-      this._perGrantor.set(grant.grantedBy, (this._perGrantor.get(grant.grantedBy) || 0) + 1);
-      this._perPair.set(pair, (this._perPair.get(pair) || 0) + 1);
-      this._grantsOf.set(grant.grantee, (this._grantsOf.get(grant.grantee) || 0) + 1);
-      this._grantCount++;
+      this._add(e, info);
+    }
+    this._append(e.g);
+    this._noteVouch(e.g);
+    const g = e.g;
+    if (g.type === 'role-grant' && this._selfId && g.grantee === this._selfId && this._selfKey && g.granteeKey !== this._selfKey) {
+      // Kept (it is a verifiable statement, and relayed like one) but inert: this node resolves its own
+      // role under its own key, and no grant binds its own nodeId or makes it a signer.
+      if (this._onForeignSelfGrant && !this._loading && roleRank(this.resolveRole(g.grantee, g.granteeKey, this._now())) >= 1) {
+        try { this._onForeignSelfGrant(g); } catch { /* a report must not fail the store */ }
+      }
+      return { stored: true, grant: g, inert: 'foreign-key-for-self' };
+    }
+    return { stored: true, grant: g };
+  }
+
+  /** @private Add one entry to the pool and to every derived structure. */
+  _add(e, info) {
+    this._pool.set(e.sk, e);
+    const g = e.g;
+    let arr = this._byGrantee.get(g.grantee);
+    if (!arr) { arr = []; this._byGrantee.set(g.grantee, arr); }
+    arr.push(e);
+    if (info.root !== null) {
+      let set = this._byRoot.get(info.root);
+      if (!set) { set = new Set(); this._byRoot.set(info.root, set); }
+      set.add(e);
+      const w = this._worst.get(info.root);
+      if (w && this._cmp(e, info, w.e, w.info) > 0) this._worst.set(info.root, { e, info });
     }
-    let arr = this._byGrantee.get(grant.grantee);
-    if (!arr) { arr = []; this._byGrantee.set(grant.grantee, arr); }
-    arr.push(grant);
-    if (grant.type === 'role-grant') {
-      let v = this._vouched.get(grant.grantee);
-      if (!v) { v = new Set(); this._vouched.set(grant.grantee, v); }
-      v.add(grant.granteeKey);
+    const gi = this._grantInfo(e, info);
+    if (gi) {
+      const k = `${g.grantee}\u0000${g.granteeKey}`;
+      const cur = this._info.get(k);
+      if (!cur || better(gi, cur)) this._info.set(k, gi);
+      let ks = this._signerKeys.get(g.grantee);
+      if (!ks) { ks = new Set(); this._signerKeys.set(g.grantee, ks); }
+      ks.add(g.granteeKey);
     }
-    this._append(grant);
-    this._noteVouch(grant);
-    if (grant.type === 'role-grant' && this._selfId && grant.grantee === this._selfId && this._selfKey && grant.granteeKey !== this._selfKey) {
-      // Stored (it is a rooted statement, and relayed like one) but inert: this node resolves its own
-      // role under its own key, and no grant binds its own nodeId.
-      if (this._onForeignSelfGrant && !this._loading) { try { this._onForeignSelfGrant(grant); } catch { /* a report must not fail the store */ } }
-      return { stored: true, grant, inert: 'foreign-key-for-self' };
+    if (g.type === 'role-revoke' && Array.isArray(g.ratify)) {
+      for (const s of g.ratify) {
+        let l = this._ratifiers.get(s);
+        if (!l) { l = []; this._ratifiers.set(s, l); }
+        l.push(e);
+      }
     }
-    return { stored: true, grant };
+    this._addTime(g.grantedAt);
+    if (g.type === 'role-revoke') this._addTime(cutoffOf(g));
+    this._memo.clear();
+    this._syncOrder = null;
+    this._digest = null;
   }
 
   /**
-   * Whether a record is rooted at the anchor under `signerKey`: its grantor, holding that key, held
-   * the authority the record needs (a grant: the rank it confers; a revoke: validator or above) at the
-   * record's signed time, and for a revoke at its cutoff as well (re-review N2). Both times are signed;
-   * neither depends on when this node received it. (A grant from a grantor revoked later, or whose
-   * revoke arrives later, is rooted and kept; resolution gives it no effect while that holds.)
-   * @private
+   * @private Recompute the kept set from `entries` by the rule alone (docs/WIRE-0.14.0.md §6.2):
+   * the anchor's records, then depth by depth, each depth's records in the budget's total order,
+   * each kept while its subtree has room; a record whose signer no kept grant reaches is dropped.
    */
-  _rooted(grant, signerKey) {
-    let rank = this._authority(grant.grantedBy, signerKey, grant.grantedAt);
-    if (grant.type === 'role-revoke') {
-      const c = cutoffOf(grant);
-      if (c !== grant.grantedAt) rank = Math.min(rank, this._authority(grant.grantedBy, signerKey, c));
-      return rank >= 1;
+  _rebuild(entries) {
+    this._pool = new Map();
+    this._reset();
+    const anchor = this._anchor;
+    const rest = [];
+    const level0 = [];
+    for (const e of entries) {
+      if (anchor && e.g.grantedBy === anchor.nodeId && e.signer === anchor.publicKey) level0.push(e);
+      else rest.push(e);
+    }
+    for (const e of level0) this._add(e, { depth: 0, root: null });
+    let left = rest;
+    for (let depth = 1; left.length; depth++) {
+      const now = [];
+      const later = [];
+      for (const e of left) {
+        const info = this._info.get(`${e.g.grantedBy}\u0000${e.signer}`);
+        if (!info) later.push(e); // perhaps reached by a deeper grant
+        else if (info.depth === depth) now.push({ e, info });
+        else later.push(e);
+      }
+      if (now.length === 0 && ![...this._info.values()].some((i) => i.depth > depth)) break;
+      now.sort((a, b) => this._cmp(a.e, a.info, b.e, b.info));
+      for (const { e, info } of now) {
+        if ((this._byRoot.get(info.root)?.size || 0) >= this._budget) continue;
+        this._add(e, info);
+      }
+      left = later;
     }
-    return rank >= roleRank(grant.role);
+  }
+
+  /** @private Keep `t` in the sorted list of breakpoints. */
+  _addTime(t) {
+    const a = this._times;
+    let lo = 0, hi = a.length;
+    while (lo < hi) { const mid = (lo + hi) >> 1; if (a[mid] < t) lo = mid + 1; else hi = mid; }
+    if (a[lo] !== t) a.splice(lo, 0, t);
+  }
+
+  /**
+   * @private The breakpoint a time resolves as: the latest record time at or before it (-Infinity
+   * when none). A role changes only where some record's time or cutoff is crossed, so every time
+   * between two breakpoints resolves alike, and the memo holds at most one answer per (node, key,
+   * breakpoint).
+   */
+  _canonicalTime(t) {
+    const a = this._times;
+    let lo = 0, hi = a.length;
+    while (lo < hi) { const mid = (lo + hi) >> 1; if (a[mid] <= t) lo = mid + 1; else hi = mid; }
+    return lo === 0 ? -Infinity : a[lo - 1];
   }
 
   /**
-   * A rooted grant names the grantee's key. The registry reads key vouches as a view
-   * (`vouchedKey`), so nothing is pinned; the registry is told, so that a different key it already
-   * binds is recorded as a conflict and the same key is marked vouched. Never for this node's own id.
-   * A plain Map (tests, older hosts) is only filled where it holds nothing.
+   * A grant names the grantee's key. The registry reads key vouches as a view (`vouchedKey`), so
+   * nothing is pinned; the registry is told of a grant in effect now, so that a different key it
+   * already binds is recorded as a conflict and the same key is marked vouched. Never for this node's
+   * own id. A plain Map (tests, older hosts) is only filled where it holds nothing.
    * @private
    */
   _noteVouch(grant) {
     if (grant.type !== 'role-grant' || (this._selfId && grant.grantee === this._selfId)) return;
+    if (roleRank(this.resolveRole(grant.grantee, grant.granteeKey, this._now())) < 1) return;
     if (typeof this._keys.bind === 'function') this._keys.bind(grant.grantee, grant.granteeKey, 'grant');
     else if (typeof this._keys.set === 'function' && typeof this._keys.setGrantView !== 'function' && !this._keys.get(grant.grantee)) this._keys.set(grant.grantee, grant.granteeKey);
   }
@@ -299,7 +393,7 @@ class RoleGrantStore {
   vouchedKey(nodeId, at = this._now()) {
     if (this._selfId && nodeId === this._selfId) return undefined;
     if (this._anchor && nodeId === this._anchor.nodeId) return undefined;
-    const keys = this._vouched.get(nodeId);
+    const keys = this._signerKeys.get(nodeId);
     if (!keys) return undefined;
     let found;
     for (const k of keys) {
@@ -311,15 +405,16 @@ class RoleGrantStore {
   }
 
   /**
-   * Resolve the role `nodeId`, holding `key`, held at time `at` (ms epoch). Authority only flows from
-   * the anchor:
+   * Resolve the role `nodeId`, holding `key`, held at time `at` (ms epoch), by the rule of
+   * docs/WIRE-0.14.0.md §6.3:
    *   - the anchor itself, holding its configured key, is `anchor`;
-   *   - otherwise, replay in signed-time order `nodeId`'s grants signed at or before `at` and its
-   *     revokes whose cutoff is at or before `at`: a grant counts only if its granteeKey is `key`, and
-   *     confers its role iff its grantor — holding the key that signed the grant — outranked-or-equalled
-   *     it both when it granted and at `at`; a revoke clears to `participant` iff the revoker
-   *     outranked-or-equalled the current role at the revoke's signed time and at its cutoff.
-   *   - cycles and unrooted chains resolve to `participant` (rank 0).
+   *   - otherwise replay, in signed-time order, `nodeId`'s grants signed at or before `at` (under
+   *     `key`) and its revokes whose cutoff is at or before `at`;
+   *   - every statement counts only if its signer held the rank it needs when it signed, and either
+   *     still holds it now or an effective revoke of the signer ratifies it;
+   *   - a grant also needs its grantor's rank at `at` (§6.6's cascade), unless ratified;
+   *   - a revoke needs its revoker's rank at every breakpoint from its cutoff to its signed time;
+   *   - cycles and chains that do not reach the anchor resolve to `participant` (rank 0).
    *
    * Two-argument form `resolveRole(nodeId, at)`: `key` is the registry's binding for `nodeId`.
    *
@@ -331,27 +426,48 @@ class RoleGrantStore {
   resolveRole(nodeId, key, at) {
     if (typeof key === 'number' && at === undefined) { at = key; key = this._boundKey(nodeId); }
     if (at === undefined) at = this._now();
-    if (this._memo.size >= MEMO_MAX) { this._memo.clear(); this._memoKeys.clear(); }
+    this._freshMemo();
     return this._resolve(nodeId, key, at, new Set()).role;
   }
 
   /**
-   * @private A record for `nodeId` was kept: the answers for it, and for every node a chain through it
-   * reaches, are forgotten; every other answer still holds (a node no chain through `nodeId` reaches
-   * resolves alike on both sides of the new record's time).
+   * The role a signer's statement (an attestation) counts with: its role at the statement's signed
+   * time, if it still holds that role now or an effective revoke of it ratifies the statement (by its
+   * signature); otherwise its role now (docs/WIRE-0.14.0.md §6.3, attestations).
+   * @param {string} nodeId
+   * @param {string|undefined} key
+   * @param {number} at - the statement's signed time
+   * @param {string} [sig] - the statement's signature
+   * @returns {'participant'|'validator'|'anchor'}
    */
-  _forgetSubtree(nodeId) {
-    const queue = [nodeId];
-    const done = new Set();
-    for (let i = 0; i < queue.length; i++) {
-      const id = queue[i];
-      if (done.has(id)) continue;
-      done.add(id);
-      const keys = this._memoKeys.get(id);
-      if (keys) { for (const k of keys) this._memo.delete(k); this._memoKeys.delete(id); }
-      const next = this._grantees.get(id);
-      if (next) for (const g of next) if (!done.has(g)) queue.push(g);
-    }
+  statementRole(nodeId, key, at, sig) {
+    this._freshMemo();
+    const seen = new Set();
+    const then = this._resolve(nodeId, key, at, seen).role;
+    const now = this._resolve(nodeId, key, this._now(), seen).role;
+    if (roleRank(now) >= roleRank(then)) return then;
+    const rank = (id, k, t) => { const r = this._resolve(id, k, t, seen); return r.depth >= MAX_DELEGATION_DEPTH ? 0 : roleRank(r.role); };
+    if (typeof sig === 'string' && this._ratified(sigKey(sig), nodeId, at, roleRank(then), rank)) return then;
+    return now;
+  }
+
+  /**
+   * Whether an effective revoke of `nodeId` ratifies the statement with signature `sig`, signed at
+   * `at`, needing rank `need` (docs/WIRE-0.14.0.md §6.3).
+   */
+  ratifies(nodeId, at, sig, need = 1) {
+    if (typeof sig !== 'string') return false;
+    this._freshMemo();
+    const seen = new Set();
+    const rank = (id, k, t) => { const r = this._resolve(id, k, t, seen); return r.depth >= MAX_DELEGATION_DEPTH ? 0 : roleRank(r.role); };
+    return this._ratified(sigKey(sig), nodeId, at, need, rank);
+  }
+
+  /** @private Clear the memo when "now" has crossed a breakpoint (standing is judged now). */
+  _freshMemo() {
+    if (this._memo.size >= MEMO_MAX) this._memo.clear();
+    const n = this._canonicalTime(this._now());
+    if (n !== this._memoNow) { this._memo.clear(); this._memoNow = n; }
   }
 
   /**
@@ -359,51 +475,66 @@ class RoleGrantStore {
    * already sits at the delegation depth (it can grant nothing further).
    */
   _authority(nodeId, key, at) {
-    if (this._memo.size >= MEMO_MAX) { this._memo.clear(); this._memoKeys.clear(); }
+    this._freshMemo();
     const r = this._resolve(nodeId, key, at, new Set());
     return r.depth >= MAX_DELEGATION_DEPTH ? 0 : roleRank(r.role);
   }
 
-  /** @private Keep `t` in the sorted list of breakpoints. */
-  _addTime(t) {
+  /**
+   * @private The lowest rank `rank(id, key, t)` takes for t from `from` to `to`, checked at `from` and
+   * at every breakpoint after it up to `to` (a rank changes only at a breakpoint).
+   */
+  _minRank(rank, id, key, from, to) {
+    let r = rank(id, key, from);
     const a = this._times;
     let lo = 0, hi = a.length;
-    while (lo < hi) { const mid = (lo + hi) >> 1; if (a[mid] < t) lo = mid + 1; else hi = mid; }
-    if (a[lo] !== t) a.splice(lo, 0, t);
+    while (lo < hi) { const mid = (lo + hi) >> 1; if (a[mid] <= from) lo = mid + 1; else hi = mid; }
+    for (let i = lo; i < a.length && a[i] <= to && r > 0; i++) r = Math.min(r, rank(id, key, a[i]));
+    return r;
   }
 
   /**
-   * @private The breakpoint a time resolves as: the latest record time at or before it (-Infinity
-   * when none). A role changes only where some record's signed time is crossed (the replay takes the
-   * records signed at or before the time asked, and asks its grantors at that time or at fixed record
-   * times), so every time between two breakpoints resolves alike, and the memo holds at most one
-   * answer per (node, key, breakpoint): linear in the records, whatever times are asked.
+   * @private Whether an effective revoke of `signer` ratifies the statement with sigKey `sk`, signed
+   * at `signedAt` (before that revoke's cutoff), by a revoker holding at least `need` (and validator)
+   * throughout the revoke's span.
    */
-  _canonicalTime(t) {
-    const a = this._times;
-    let lo = 0, hi = a.length;
-    while (lo < hi) { const mid = (lo + hi) >> 1; if (a[mid] <= t) lo = mid + 1; else hi = mid; }
-    return lo === 0 ? -Infinity : a[lo - 1];
+  _ratified(sk, signer, signedAt, need, rank) {
+    for (const r of this._ratifiers.get(sk) || []) {
+      const g = r.g;
+      if (g.grantee !== signer || !(signedAt < cutoffOf(g))) continue;
+      if (this._revokeAuthority(r, rank) >= Math.max(1, need)) return true;
+    }
+    return false;
+  }
+
+  /**
+   * @private A revoke's authority: its revoker's lowest rank from its cutoff to its signed time, or 0
+   * when the revoker no longer holds rank now and no effective revoke of it ratifies this revoke.
+   */
+  _revokeAuthority(r, rank) {
+    const g = r.g;
+    const a = this._minRank(rank, g.grantedBy, r.signer, cutoffOf(g), g.grantedAt);
+    if (a < 1) return 0;
+    if (rank(g.grantedBy, r.signer, this._now()) >= 1) return a;
+    return this._ratified(r.sk, g.grantedBy, g.grantedAt, 1, rank) ? a : 0;
   }
 
   /**
-   * The resolution, memoised (security review D, role-resolve-cost): each record recurses into its
-   * grantor at up to two times (signed and `at` for a grant, signed and cutoff for a revoke), which
-   * without a memo cost (2r)^depth. An answer
-   * is kept only when no cycle was cut while computing it (a cut answer depends on the path), and the
-   * memo is cleared whenever a record is kept. @returns {{ role: string, pure: boolean }}
+   * The resolution, memoised (security review D, role-resolve-cost). An answer is kept only when no
+   * cycle was cut while computing it (a cut answer depends on the path), and the memo is cleared
+   * whenever a record is kept or "now" crosses a breakpoint. @returns {{ role, depth, pure }}
    * @private
    */
   _resolve(nodeId, key, at, seen) {
     if (this._anchor && nodeId === this._anchor.nodeId) return { role: key === this._anchor.publicKey ? 'anchor' : 'participant', depth: 0, pure: true };
     if (typeof key !== 'string' || !key) return { role: 'participant', depth: 0, pure: true };
     const self = `${nodeId}\u0000${key}`;
-    if (seen.has(self)) return { role: 'participant', depth: 0, pure: false }; // cycle — not anchor-rooted
     at = this._canonicalTime(at);
     const memoKey = `${self}\u0000${at}`;
     const hit = this._memo.get(memoKey);
     if (hit !== undefined) return { role: hit.role, depth: hit.depth, pure: true };
-    seen.add(self);
+    if (seen.has(memoKey)) return { role: 'participant', depth: 0, pure: false }; // cycle: not anchor-rooted
+    seen.add(memoKey);
     let pure = true;
     let depthOf = 0; // the deepest grantor consulted for the record being replayed
     // A grantor's rank at a time, or 0 when its own role sits at the delegation depth already.
@@ -414,41 +545,37 @@ class RoleGrantStore {
       if (r.depth > depthOf) depthOf = r.depth;
       return roleRank(r.role);
     };
-    // A revoke is in the replay from its cutoff on, at its signed place (re-review N2): at a time
-    // between its cutoff and its signing it already clears every grant signed before it.
+    // A revoke is in the replay from its cutoff on, at its signed place (re-review N2). Ties in signed
+    // time order grants before revokes, then by signature, so the replay never depends on the order
+    // records were kept in.
     const records = (this._byGrantee.get(nodeId) || [])
-      .filter(g => (g.type === 'role-revoke' ? cutoffOf(g) : (g.grantedAt ?? 0)) <= at)
-      .sort((a, b) => (a.grantedAt ?? 0) - (b.grantedAt ?? 0)); // signed-time order
+      .filter((e) => (e.g.type === 'role-revoke' ? cutoffOf(e.g) : (e.g.grantedAt ?? 0)) <= at)
+      .sort((a, b) => (a.g.grantedAt - b.g.grantedAt)
+        || ((a.g.type === 'role-revoke' ? 1 : 0) - (b.g.type === 'role-revoke' ? 1 : 0))
+        || (a.sk < b.sk ? -1 : a.sk > b.sk ? 1 : 0));
     let role = 'participant';
     let depth = 0;
-    for (const g of records) {
-      // A grant confers only if the grantor was authorised WHEN it granted (so a grant signed before
-      // the grantor held rank, or at or after the grantor's cutoff, never activates) AND AT `at` (so
-      // revoking or demoting a grantor cascades to everything it granted, MMP §6.6). A revoke takes
-      // effect on the revoker's rank when it revoked and at its cutoff, the lower, and is not undone by
-      // the revoker's later demotion; nothing depends on when this node received anything.
+    const now = this._now();
+    for (const e of records) {
+      const g = e.g;
       if (g.type === 'role-grant' && g.granteeKey !== key) continue;
-      const signer = this._signer.get(g.sig);
-      const signedAt = g.grantedAt ?? 0;
       depthOf = 0;
-      let authority = rank(g.grantedBy, signer, signedAt);
       if (g.type === 'role-revoke') {
-        const c = cutoffOf(g);
-        if (c !== signedAt) authority = Math.min(authority, rank(g.grantedBy, signer, c));
-        if (authority >= 1 && authority >= roleRank(role)) { role = 'participant'; depth = 0; }
+        const need = Math.max(1, roleRank(role));
+        if (this._revokeAuthority(e, rank) >= need) { role = 'participant'; depth = 0; }
       } else {
-        const rankNow = rank(g.grantedBy, signer, at);
-        if (Math.min(authority, rankNow) >= roleRank(g.role)) { role = g.role; depth = depthOf + 1; }
+        const need = roleRank(g.role);
+        const then = rank(g.grantedBy, e.signer, g.grantedAt);
+        let ok;
+        if (then < need) ok = false;
+        else if (rank(g.grantedBy, e.signer, now) >= need) ok = rank(g.grantedBy, e.signer, at) >= need; // standing, then the cascade
+        else ok = this._ratified(e.sk, g.grantedBy, g.grantedAt, need, rank); // a ratified grant keeps conferring
+        if (ok) { role = g.role; depth = depthOf + 1; }
       }
     }
-    seen.delete(self);
+    seen.delete(memoKey);
     if (role === 'participant') depth = 0;
-    if (pure) {
-      this._memo.set(memoKey, { role, depth });
-      let ks = this._memoKeys.get(nodeId);
-      if (!ks) { ks = new Set(); this._memoKeys.set(nodeId, ks); }
-      ks.add(memoKey);
-    }
+    if (pure) this._memo.set(memoKey, { role, depth });
     return { role, depth, pure };
   }
 
@@ -465,24 +592,30 @@ class RoleGrantStore {
 
   /** All grant/revoke records for a grantee (chronological). */
   grantsFor(grantee) {
-    return (this._byGrantee.get(grantee) || []).slice().sort((a, b) => (a.grantedAt ?? 0) - (b.grantedAt ?? 0));
+    return (this._byGrantee.get(grantee) || []).map((e) => e.g).sort((a, b) => (a.grantedAt ?? 0) - (b.grantedAt ?? 0));
+  }
+
+  /** The records `nodeId` signed, kept here, signed before `before` (for a revoker choosing what to ratify). */
+  statementsBy(nodeId, before = Infinity) {
+    const out = [];
+    for (const e of this._pool.values()) if (e.g.grantedBy === nodeId && e.g.grantedAt < before) out.push(e.g);
+    return out.sort((a, b) => a.grantedAt - b.grantedAt);
   }
 
   /**
    * Every record held, in an order that roots each before it is needed (security review D,
    * anti-entropy): the anchor's records first, then those of each grantor the earlier ones reach,
    * breadth first, each grantor's own records by signed time; what no chain reaches comes last.
-   * Every grant comes before every non-anchor revoke, so a revoke never arrives ahead of the grant it
-   * clears (re-review N4: a revoke is bounded by its grants). Cached until the next record is kept.
+   * Cached until the next record is kept.
    * @returns {object[]}
    */
   syncOrder() {
-    if (this._syncOrder && this._syncOrderAt === this._seen.size) return this._syncOrder;
+    if (this._syncOrder) return this._syncOrder;
     const byGrantor = new Map();
-    for (const arr of this._byGrantee.values()) for (const g of arr) {
-      let l = byGrantor.get(g.grantedBy);
-      if (!l) { l = []; byGrantor.set(g.grantedBy, l); }
-      l.push(g);
+    for (const e of this._pool.values()) {
+      let l = byGrantor.get(e.g.grantedBy);
+      if (!l) { l = []; byGrantor.set(e.g.grantedBy, l); }
+      l.push(e.g);
     }
     const out = [];
     const done = new Set();
@@ -491,16 +624,11 @@ class RoleGrantStore {
       const grantor = queue[i];
       if (done.has(grantor)) continue;
       done.add(grantor);
-      const l = (byGrantor.get(grantor) || []).sort((a, b) => (a.grantedAt ?? 0) - (b.grantedAt ?? 0));
+      const l = (byGrantor.get(grantor) || []).sort((a, b) => (a.grantedAt ?? 0) - (b.grantedAt ?? 0) || (a.sig < b.sig ? -1 : 1));
       for (const g of l) { out.push(g); if (g.type === 'role-grant' && !done.has(g.grantee)) queue.push(g.grantee); }
     }
     for (const [grantor, l] of byGrantor) if (!done.has(grantor)) out.push(...l);
-    const fromAnchor = (g) => !!this._anchor && g.grantedBy === this._anchor.nodeId;
-    const ordered = [...out.filter((g) => g.type === 'role-grant' || fromAnchor(g)), ...out.filter((g) => g.type === 'role-revoke' && !fromAnchor(g))];
-    out.length = 0;
-    out.push(...ordered);
     this._syncOrder = out;
-    this._syncOrderAt = this._seen.size;
     return out;
   }
 
@@ -510,23 +638,22 @@ class RoleGrantStore {
    * @returns {{ count: number, digest: string }}
    */
   digest() {
-    if (this._digest && this._digestAt === this._seen.size) return this._digest;
+    if (this._digest) return this._digest;
     const h = crypto.createHash('sha256');
-    for (const sk of [...this._seen].sort()) h.update(sk).update('\n');
-    this._digest = { count: this._seen.size, digest: h.digest('hex') };
-    this._digestAt = this._seen.size;
+    for (const sk of [...this._pool.keys()].sort()) h.update(sk).update('\n');
+    this._digest = { count: this._pool.size, digest: h.digest('hex') };
     return this._digest;
   }
 
-  /** Whether a grant with this signature is held, however the signature is spelled. */
-  has(sig) { return this._seen.has(sigKey(sig)); }
-  size() { return this._seen.size; }
+  /** Whether a record with this signature is held, however the signature is spelled. */
+  has(sig) { return this._pool.has(sigKey(sig)); }
+  size() { return this._pool.size; }
 
   // ── Durable persistence (append-only) ────────────────────────────────────────
 
   /**
-   * One line per record: the bare canonical record, as 0.13 wrote it (receipt time is no part of the
-   * rule since re-review N2, so a line needs nothing else, and the file is never rewritten).
+   * One line per record kept: the bare canonical record, as 0.13 wrote it. A record later replaced in
+   * its budget stays in the file; a reload recomputes the same kept set by the same rule.
    */
   _append(grant) {
     if (!this._dir || this._loading) return;
@@ -535,14 +662,12 @@ class RoleGrantStore {
   }
 
   /**
-   * Reload the grant file through `record` — the same checks a frame gets. A rooted record can only
-   * be rooted by records before it in time, not necessarily before it in the file, so records refused
-   * for a reason a later record can cure (`unknown-grantor-key`: the grantor's own grant, vouching its
-   * key, arrives later; `unrooted`: likewise) are retried until a pass adds nothing. What is left is
-   * skipped and counted, as is a record whose check fails in a way no reason names ('unverifiable').
-   * A skipped line is never removed: the file is only ever appended to (re-review N5), so a record
-   * whose root arrives later loads at the next start. Never throws: a file that cannot be read leaves
-   * the store with no grants and `loadReport().unreadable` saying why.
+   * Reload the grant file through `record` — the same checks a frame gets. A record can only be
+   * verified once a grant vouching its grantor's key is kept, not necessarily before it in the file,
+   * so records refused for a reason a later record can cure (`unknown-grantor-key`, `bad-signature`
+   * under the keys known so far) are retried until a pass adds nothing. What is left is skipped and
+   * counted, and never removed: the file is only ever appended to (re-review N5). Never throws: a file
+   * that cannot be read leaves the store with no grants and `loadReport().unreadable` saying why.
    * @private
    */
   _load() {
@@ -562,43 +687,40 @@ class RoleGrantStore {
         if (!line.trim()) continue;
         let o;
         try { o = JSON.parse(line); } catch { skip('not-json'); continue; }
-        // The bare record (0.13, and 0.14 since re-review N2), or `{ grant, receivedAt }` as 0.14
-        // development builds wrote it: the receipt time is ignored.
-        if (o && typeof o === 'object' && o.grant && typeof o.grant === 'object') pending.push({ g: o.grant });
-        else pending.push({ g: o });
+        // The bare record (0.13, and 0.14), or `{ grant, receivedAt }` as 0.14 development builds
+        // wrote it: the receipt time is ignored.
+        if (o && typeof o === 'object' && o.grant && typeof o.grant === 'object') pending.push(o.grant);
+        else pending.push(o);
       }
-      const curable = new Set(['unknown-grantor-key', 'unrooted', 'bad-signature', 'nothing-to-revoke']);
+      const curable = new Set(['unknown-grantor-key', 'bad-signature']);
       let reasons = [];
       let progress = true;
       while (progress && pending.length) {
         progress = false;
         const retry = [];
         reasons = [];
-        for (const e of pending) {
+        for (const g of pending) {
           let r;
-          try { r = this.record(e.g); } catch { r = { stored: false, reason: 'unverifiable' }; }
+          try { r = this.record(g); } catch { r = { stored: false, reason: 'unverifiable' }; }
           if (r.stored) { report.loaded++; progress = true; }
-          else if (curable.has(r.reason)) { retry.push(e); reasons.push(r.reason); }
+          else if (curable.has(r.reason)) { retry.push(g); reasons.push(r.reason); }
           else skip(r.reason);
         }
         pending = retry;
       }
       for (const reason of reasons) skip(reason);
+      // Lines written, then replaced in their budget, load and are replaced again: what is kept is
+      // what the rule keeps, and `loaded` counts it.
+      report.loaded = this._pool.size;
     } finally {
       this._loading = false;
     }
   }
 }
 
-/** A revoke's cutoff: the signed `cutoff`, or its signed time when it carries none (re-review N2). */
-function cutoffOf(g) {
-  return g.type === 'role-revoke' && Number.isSafeInteger(g.cutoff) ? g.cutoff : (g.grantedAt ?? 0);
-}
-
 /**
  * A record as its signed fields only (grantPayload: type, grantee, role, grantedBy, grantedAt,
- * granteeKey, and a revoke's cutoff), with `sig` and `sigAlg`. `role` and `granteeKey` are kept when they are non-empty
- * (the payload signs an absent one and an empty one alike).
+ * granteeKey, and a revoke's cutoff and ratify), with `sig` and `sigAlg`.
  */
 function canonicalGrant(g, sig) {
   const c = { type: g.type, grantee: g.grantee };
@@ -607,6 +729,7 @@ function canonicalGrant(g, sig) {
   c.grantedAt = g.grantedAt;
   if (typeof g.granteeKey === 'string' && g.granteeKey) c.granteeKey = g.granteeKey;
   if (g.type === 'role-revoke' && g.cutoff !== undefined) c.cutoff = g.cutoff;
+  if (g.type === 'role-revoke' && g.ratify !== undefined) c.ratify = [...g.ratify];
   c.sig = sig;
   c.sigAlg = 'ed25519';
   return c;
@@ -625,9 +748,16 @@ function malformed(g) {
   if (g.granteeKey !== undefined && (typeof g.granteeKey !== 'string' || (g.granteeKey !== '' && !/^[A-Za-z0-9_-]{43}$/.test(g.granteeKey)))) return true;
   if (g.role !== undefined && (typeof g.role !== 'string' || g.role.length > MAX_ROLE || g.role.includes('|'))) return true;
   if (g.cutoff !== undefined && (g.type !== 'role-revoke' || !Number.isSafeInteger(g.cutoff) || g.cutoff < 0 || g.cutoff > g.grantedAt)) return true;
+  if (g.ratify !== undefined) {
+    if (g.type !== 'role-revoke' || g.cutoff === undefined || !Array.isArray(g.ratify) || g.ratify.length === 0 || g.ratify.length > MAX_RATIFY) return true;
+    for (let i = 0; i < g.ratify.length; i++) {
+      if (typeof g.ratify[i] !== 'string' || !CANONICAL_SIG.test(g.ratify[i])) return true;
+      if (i > 0 && !(g.ratify[i - 1] < g.ratify[i])) return true; // sorted, no repeats
+    }
+  }
   if (g.type === 'role-revoke') return false;
   // A grant confers a rank above participant, on the holder of one key, or it confers nothing.
   return roleRank(g.role) < 1 || typeof g.granteeKey !== 'string' || !/^[A-Za-z0-9_-]{43}$/.test(g.granteeKey);
 }
 
-module.exports = { RoleGrantStore, canonicalGrant, malformedGrant: malformed, cutoffOf, MAX_DELEGATION_DEPTH };
+module.exports = { RoleGrantStore, canonicalGrant, malformedGrant: malformed, cutoffOf, MAX_DELEGATION_DEPTH, SUBTREE_BUDGET, MAX_RATIFY };
diff --git a/tests/core-secure-final-review.test.js b/tests/core-secure-final-review.test.js
new file mode 100644
index 00000000..43193c16
--- /dev/null
+++ b/tests/core-secure-final-review.test.js
@@ -0,0 +1,441 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME before lib/config loads
+
+/**
+ * The final re-review of f0d936a (BLOCK): the founder's three rulings and the findings beside them,
+ * each as a regression test that fails on f0d936a. The reviewer's repros are in
+ * /private/tmp/claude-501/-Users-hongwei-sym-agent-a/sym-014-final-review/ (grant-probes.js P1-P4,
+ * node-probes.js Q1, digest-churn.js, fork-a, fork-b).
+ *
+ *   A  the kept grant set is a function of the records held (Findings 1, 2)
+ *   B  the anchor ratifies; a revoked key gains nothing by backdating (Finding 4, Low 8a)
+ *   C  the interior read side is scoped to the mind's mission (Finding 6)
+ *   3  the cost of relayed forgeries is bounded without blaming the relayer
+ *   7  relocation: in-process locks, replays, staging, modes, the header checked first
+ *   lows
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const crypto = require('crypto');
+const fs = require('fs');
+const net = require('net');
+const os = require('os');
+const path = require('path');
+const config = require('../lib/config');
+const relocation = require('../lib/relocation');
+const { SymNode } = require('../lib/node');
+const { NullDiscovery } = require('../lib/discovery');
+const { nodeDirById } = require('../lib/config');
+const { RoleGrantStore } = require('../lib/role-grant-store');
+const { signGrant, signAttestation } = require('../lib/core');
+const { identity, connectNodes, until, signedRecord, admitAs, deliver } = require('./_core-secure');
+
+const uniq = (b) => `${b}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+function mk(base, extra = {}) { return new SymNode({ name: uniq(base), silent: true, discovery: new NullDiscovery(), room: extra.room || 'fr', ...extra }); }
+async function stopAll(...nodes) {
+  for (const n of nodes) { try { await n.stop(); } catch { /* */ } try { fs.rmSync(nodeDirById(n.nodeId), { recursive: true, force: true }); } catch { /* */ } }
+}
+function kp() {
+  const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519');
+  return { nodeId: crypto.randomUUID(), priv: privateKey.export({ format: 'der', type: 'pkcs8' }).subarray(16).toString('base64url'), pub: publicKey.export({ format: 'der', type: 'spki' }).subarray(12).toString('base64url') };
+}
+const grantOf = (type, grantee, role, grantor, at, extra = {}) => signGrant({ type, grantee: grantee.nodeId, ...(role ? { role } : {}), grantedBy: grantor.nodeId, grantedAt: at, ...(type === 'role-grant' ? { granteeKey: grantee.pub } : {}), ...extra }, grantor.priv);
+const DAY = 86_400_000;
+
+/** Offer `records` in `order` until a pass keeps nothing (as a load, or a chain fetch, does). */
+function feed(store, records) {
+  let left = records;
+  for (let progress = true; progress && left.length;) {
+    progress = false;
+    const next = [];
+    for (const g of left) {
+      const r = store.record(g);
+      if (r.stored) progress = true;
+      else if (r.reason === 'unknown-grantor-key') next.push(g);
+    }
+    left = next;
+  }
+}
+/** A deterministic shuffle. */
+function shuffled(list, seed) {
+  const a = [...list];
+  let x = seed;
+  for (let i = a.length - 1; i > 0; i--) { x = (x * 1103515245 + 12345) & 0x7fffffff; const j = x % (i + 1); [a[i], a[j]] = [a[j], a[i]]; }
+  return a;
+}
+
+describe('A: the kept grant set is a function of the records held (Findings 1 and 2)', () => {
+  it('stores fed the same records in different orders keep the same records and resolve the same authority, with full budgets, cutoffs and ratifications', () => {
+    const A = kp(), V = kp(), Q = kp(), W = kp(), X = kp(), M = kp();
+    const t0 = Date.now() - 30 * DAY;
+    const sybils = Array.from({ length: 5 }, () => kp());
+    const rVW = grantOf('role-revoke', W, undefined, V, t0 + 2 * DAY, { cutoff: t0 + 2 * DAY });
+    const records = [
+      grantOf('role-grant', V, 'validator', A, t0),
+      grantOf('role-grant', Q, 'validator', A, t0),
+      grantOf('role-grant', M, 'validator', A, t0),
+      grantOf('role-grant', W, 'validator', A, t0 + 1),
+      grantOf('role-grant', X, 'validator', V, t0 + 5 * DAY),
+      rVW,
+      grantOf('role-revoke', V, undefined, A, t0 + 10 * DAY, { cutoff: t0 + 3 * DAY, ratify: [rVW.sig] }),
+      grantOf('role-revoke', X, undefined, Q, t0 + 11 * DAY, { cutoff: t0 + 11 * DAY }),
+      grantOf('role-revoke', X, undefined, Q, t0 + 12 * DAY, { cutoff: t0 + 6 * DAY }),
+      ...sybils.map((y, i) => grantOf('role-grant', y, 'validator', M, t0 + 20 + i)),
+      ...sybils.flatMap((y, i) => [grantOf('role-revoke', W, undefined, y, t0 + 30 + i, { cutoff: t0 + 30 + i }), grantOf('role-grant', kp(), 'validator', y, t0 + 40 + i)]),
+    ];
+    const roles = (s) => [V, Q, W, X, M, ...sybils].map((n) => [s.resolveRole(n.nodeId, n.pub, Date.now()), s.resolveRole(n.nodeId, n.pub, t0 + 4 * DAY)].join('/'));
+    let first = null;
+    for (let seed = 1; seed <= 12; seed++) {
+      const s = new RoleGrantStore({ anchor: { nodeId: A.nodeId, publicKey: A.pub }, subtreeBudget: 6 });
+      feed(s, seed === 1 ? records : shuffled(records, seed));
+      const view = { digest: s.digest().digest, size: s.size(), roles: roles(s) };
+      if (!first) first = view;
+      else assert.deepStrictEqual(view, first, `order ${seed}`);
+    }
+    assert.ok(first.size < records.length, 'the budget bound M\'s subtree');
+  });
+
+  it('a grant and a revoke signed in the same millisecond resolve alike whichever was kept first', () => {
+    const A = kp(), V = kp();
+    const t = Date.now() - DAY;
+    const g = grantOf('role-grant', V, 'validator', A, t);
+    const r = grantOf('role-revoke', V, undefined, A, t, { cutoff: t });
+    const X = new RoleGrantStore({ anchor: { nodeId: A.nodeId, publicKey: A.pub } });
+    const Y = new RoleGrantStore({ anchor: { nodeId: A.nodeId, publicKey: A.pub } });
+    X.record(g); X.record(r);
+    Y.record(r); Y.record(g);
+    assert.deepStrictEqual([X.resolveRole(V.nodeId, V.pub, Date.now()), Y.resolveRole(V.nodeId, V.pub, Date.now())], ['participant', 'participant']);
+  });
+
+  it('P2: a grant signed by a grantor revoked from before it is kept by every store, whatever arrived first (equal digests)', () => {
+    const A = kp(), P = kp(), X = kp();
+    const t0 = Date.now() - 30 * DAY;
+    const gP = grantOf('role-grant', P, 'validator', A, t0);
+    const gX = grantOf('role-grant', X, 'validator', P, t0 + 5 * DAY);
+    const rP = grantOf('role-revoke', P, undefined, A, t0 + 10 * DAY, { cutoff: t0 + 3 * DAY });
+    const B = new RoleGrantStore({ anchor: { nodeId: A.nodeId, publicKey: A.pub } });
+    const C = new RoleGrantStore({ anchor: { nodeId: A.nodeId, publicKey: A.pub } });
+    for (const g of [gP, gX, rP]) assert.strictEqual(B.record(g).stored, true);
+    for (const g of [gP, rP, gX]) assert.strictEqual(C.record(g).stored, true, 'never refused as unrooted');
+    assert.strictEqual(B.digest().digest, C.digest().digest);
+    assert.deepStrictEqual([B.resolveRole(X.nodeId, X.pub, Date.now()), C.resolveRole(X.nodeId, X.pub, Date.now())], ['participant', 'participant']);
+  });
+
+  it('P4 / revoke-tighten: a revoker tightens its cutoff with a second revoke, and stores agree whichever came first', () => {
+    const A = kp(), Q = kp(), P = kp();
+    const t = (n) => 1_000_000 + n * 1000;
+    const base = [grantOf('role-grant', Q, 'validator', A, t(0)), grantOf('role-grant', P, 'validator', Q, t(1))];
+    const r5 = grantOf('role-revoke', P, undefined, Q, t(5), { cutoff: t(5) });
+    const r2 = grantOf('role-revoke', P, undefined, Q, t(6), { cutoff: t(2) });
+    const X = new RoleGrantStore({ anchor: { nodeId: A.nodeId, publicKey: A.pub } });
+    const Y = new RoleGrantStore({ anchor: { nodeId: A.nodeId, publicKey: A.pub } });
+    for (const b of base) { X.record(b); Y.record(b); }
+    assert.deepStrictEqual([X.record(r5).stored, X.record(r2).stored], [true, true]);
+    assert.deepStrictEqual([Y.record(r2).stored, Y.record(r5).stored], [true, true]);
+    assert.strictEqual(X.digest().digest, Y.digest().digest);
+    assert.deepStrictEqual([X.resolveRole(P.nodeId, P.pub, t(3)), Y.resolveRole(P.nodeId, P.pub, t(3))], ['participant', 'participant'], 'P untrusted from t2, as Q meant');
+  });
+
+  it('P3: one validator\'s sybil tree stays inside its subtree budget, and resolution of its target stays bounded', () => {
+    const A = kp(), M = kp(), T = kp();
+    const s = new RoleGrantStore({ anchor: { nodeId: A.nodeId, publicKey: A.pub }, subtreeBudget: 8 });
+    const t0 = Date.now() - 30 * DAY;
+    s.record(grantOf('role-grant', M, 'validator', A, t0));
+    s.record(grantOf('role-grant', T, 'validator', A, t0));
+    const sybils = [];
+    for (let i = 0; i < 3; i++) { const y = kp(); sybils.push(y); s.record(grantOf('role-grant', y, 'validator', M, t0 + 1 + i)); }
+    for (const y of sybils) for (let j = 0; j < 2; j++) s.record(grantOf('role-grant', { nodeId: T.nodeId, pub: kp().pub }, 'validator', y, t0 + 10 + j));
+    for (const sg of [M, ...sybils]) for (let k = 0; k < 50; k++) s.record(grantOf('role-revoke', T, undefined, sg, t0 + 1000 + k, { cutoff: t0 + 1000 + k }));
+    assert.strictEqual(s.size(), 2 + 8, 'the anchor\'s two, and M\'s subtree at its budget');
+    assert.ok(s.grantsFor(T.nodeId).length <= 1 + 8, 'what a resolution of T replays is bounded by the budget');
+  });
+
+  it('digest-churn: two nodes that learned the same records in different orders run no whole-store sync', async () => {
+    const A = kp(), P = kp(), X = kp();
+    const t0 = Date.now() - 30 * DAY;
+    const gP = grantOf('role-grant', P, 'validator', A, t0);
+    const gX = grantOf('role-grant', X, 'validator', P, t0 + 5 * DAY);
+    const rP = grantOf('role-revoke', P, undefined, A, t0 + 10 * DAY, { cutoff: t0 + 3 * DAY });
+    const B = mk('churn-b', { anchor: { nodeId: A.nodeId, publicKey: A.pub } });
+    const C = mk('churn-c', { anchor: { nodeId: A.nodeId, publicKey: A.pub } });
+    try {
+      await B.start(); await C.start();
+      for (const g of [gP, gX, rP]) B._roleGrants.record(g);
+      for (const g of [gP, rP, gX]) C._roleGrants.record(g);
+      await connectNodes(B, C);
+      await new Promise((r) => setTimeout(r, 300));
+      assert.strictEqual(B._roleGrants.digest().digest, C._roleGrants.digest().digest);
+      assert.deepStrictEqual([B._chainStats.synced || 0, C._chainStats.synced || 0], [0, 0], 'no whole-store sync');
+    } finally { await stopAll(B, C); }
+  });
+});
+
+describe('B: the anchor ratifies; a revoked key gains nothing by backdating (Finding 4)', () => {
+  it('P1: a revoke a revoked validator signs later, dated before its cutoff, changes nothing at any time', () => {
+    const A = kp(), V = kp(), W = kp();
+    const t0 = Date.now() - 30 * DAY;
+    const s = new RoleGrantStore({ anchor: { nodeId: A.nodeId, publicKey: A.pub } });
+    s.record(grantOf('role-grant', V, 'validator', A, t0));
+    s.record(grantOf('role-grant', W, 'validator', A, t0 + 1));
+    s.record(grantOf('role-revoke', V, undefined, A, t0 + 20 * DAY)); // a 0.13 revoke: cutoff = its time
+    assert.strictEqual(s.record(grantOf('role-revoke', W, undefined, V, t0 + 2 * DAY, { cutoff: t0 + DAY })).stored, true, 'kept: verifiable');
+    for (const at of [Date.now(), t0 + 10 * DAY, t0 + 1.5 * DAY]) assert.strictEqual(s.resolveRole(W.nodeId, W.pub, at), 'validator', `W at ${at}`);
+  });
+
+  it('the revoker is checked at every breakpoint from its cutoff to its signed time (Low 8a), and at resolution, not only when kept (M7)', () => {
+    const A = kp(), Q = kp(), W = kp();
+    const t = (n) => 1_000_000 + n * 1000;
+    const st = new RoleGrantStore({ anchor: { nodeId: A.nodeId, publicKey: A.pub } });
+    st.record(grantOf('role-grant', W, 'validator', A, t(0)));
+    st.record(grantOf('role-grant', Q, 'validator', A, t(1)));
+    st.record(grantOf('role-revoke', Q, undefined, A, t(2), { cutoff: t(2) }));
+    st.record(grantOf('role-grant', Q, 'validator', A, t(3)));
+    st.record(grantOf('role-revoke', W, undefined, Q, t(4), { cutoff: t(1.5) }));
+    assert.strictEqual(st.resolveRole(W.nodeId, W.pub, t(2.5)), 'validator', 'Q was not authorised over all of [t1.5, t4]: no effect');
+    assert.strictEqual(st.resolveRole(W.nodeId, W.pub, t(10)), 'validator');
+    // M7: a revoke effective when kept loses its effect when a later record shows its revoker had no
+    // rank at its cutoff.
+    const B = kp(), Z = kp();
+    const s2 = new RoleGrantStore({ anchor: { nodeId: A.nodeId, publicKey: A.pub } });
+    s2.record(grantOf('role-grant', Z, 'validator', A, t(0)));
+    s2.record(grantOf('role-grant', B, 'validator', A, t(0)));
+    s2.record(grantOf('role-revoke', Z, undefined, B, t(10), { cutoff: t(5) }));
+    assert.strictEqual(s2.resolveRole(Z.nodeId, Z.pub, t(20)), 'participant', 'effective as kept');
+    s2.record(grantOf('role-revoke', B, undefined, A, t(30), { cutoff: t(3) }));
+    s2.record(grantOf('role-grant', B, 'validator', A, t(31)));
+    assert.strictEqual(s2.resolveRole(B.nodeId, B.pub, t(40)), 'validator', 'B holds rank again now');
+    assert.strictEqual(s2.resolveRole(Z.nodeId, Z.pub, t(40)), 'validator', 'but B had none at its revoke\'s cutoff: re-checked at resolution');
+  });
+
+  it('revokeRole requires a cutoff and checks its ratify list; the anchor\'s ratification keeps a revoked validator\'s statement', async () => {
+    const node = mk('ratify', {});
+    const A = { nodeId: node.nodeId, pub: node._identity.publicKey };
+    const anchored = mk('ratify-a', { anchor: { nodeId: A.nodeId, publicKey: A.pub } });
+    try {
+      const V = kp(); const W = kp();
+      anchored._roster.bind(V.nodeId, V.pub, 'pinned');
+      anchored._roster.bind(W.nodeId, W.pub, 'pinned');
+      const s = anchored._roleGrants;
+      const t0 = Date.now() - 10 * DAY;
+      s.record(signGrant({ type: 'role-grant', grantee: V.nodeId, role: 'validator', grantedBy: A.nodeId, grantedAt: t0, granteeKey: V.pub }, node._identity.privateKey));
+      s.record(signGrant({ type: 'role-grant', grantee: W.nodeId, role: 'validator', grantedBy: A.nodeId, grantedAt: t0, granteeKey: W.pub }, node._identity.privateKey));
+      const rVW = grantOf('role-revoke', W, undefined, V, t0 + DAY, { cutoff: t0 + DAY });
+      s.record(rVW);
+      assert.strictEqual(anchored.resolveRole(W.nodeId), 'participant');
+      assert.throws(() => node.revokeRole(V.nodeId), (e) => e.code === 'ECUTOFF', 'no default cutoff');
+      assert.throws(() => node.revokeRole(V.nodeId, { cutoff: Date.now() + 60_000 }), (e) => e.code === 'ECUTOFF', 'not in the future');
+      assert.throws(() => node.revokeRole(V.nodeId, { cutoff: t0, ratify: ['x'] }), (e) => e.code === 'ERATIFY');
+      assert.deepStrictEqual(anchored.roleStatementsBy(V.nodeId, Date.now()).map((g) => g.sig), [rVW.sig], 'what V signed, for the revoker to review');
+      // The anchor's node signs the revoke; the anchored node keeps it.
+      const plain = signGrant({ type: 'role-revoke', grantee: V.nodeId, grantedBy: A.nodeId, grantedAt: Date.now(), cutoff: t0 + 2 * DAY }, node._identity.privateKey);
+      s.record(plain);
+      assert.strictEqual(anchored.resolveRole(W.nodeId), 'validator', 'V revoked without ratifying its revoke of W: it lapses');
+      const ratifying = signGrant({ type: 'role-revoke', grantee: V.nodeId, grantedBy: A.nodeId, grantedAt: Date.now() + 1, cutoff: t0 + 2 * DAY, ratify: [rVW.sig] }, node._identity.privateKey);
+      s.record(ratifying);
+      assert.strictEqual(anchored.resolveRole(W.nodeId), 'participant', 'ratified: it stands');
+    } finally { await stopAll(node, anchored); }
+  });
+
+  it('an attestation dated before the record it attests is refused at ingest and excluded from the aggregate', async () => {
+    const b = mk('att-date', {});
+    try {
+      await b.start();
+      const X = identity('x');
+      const sX = admitAs(b, X);
+      b._roster.bind(X.nodeId, X.publicKey, 'pinned');
+      const rec = b.remember({ focus: 'a record attested later' });
+      const key = rec.cmb.metadata.key;
+      const created = rec.cmb.metadata.createdTimestamp;
+      const att = (at, seq) => { const o = { of: key, by: X.nodeId, at, roster: b._room, verdict: 'aligned', categories: {}, seq, prev: 'genesis' }; signAttestation(o, X.privateKey); return o; };
+      assert.strictEqual(b._ingestAttestation(att(created - 1000, 1), X.nodeId, X.name, sX).reason, 'dated-before-record');
+      const late = att(created + 1, 2);
+      b._attestations.record(att(created - 5, 3)); // as if held from before
+      b._attestations.record(late);
+      const agg = b.aggregateAttestations(key);
+      assert.ok(agg.excluded.some((e) => e.reason === 'dated-before-record'));
+      void sX;
+    } finally { await stopAll(b); }
+  });
+});
+
+describe('C: the interior read side is scoped to the mind\'s mission (Finding 6)', () => {
+  function conn(p) {
+    const s = net.createConnection(p); let buf = ''; const waiters = new Map(); let n = 0;
+    s.on('data', (d) => { buf += d; let i; while ((i = buf.indexOf('\n')) !== -1) { const m = JSON.parse(buf.slice(0, i)); buf = buf.slice(i + 1); const w = waiters.get(m.id); if (w) { waiters.delete(m.id); w(m); } } });
+    return { ask: (req) => new Promise((r) => { const id = ++n; waiters.set(id, r); s.write(JSON.stringify({ ...req, id }) + '\n'); }), close: () => new Promise((r) => { s.once('close', r); s.end(); }) };
+  }
+  const cats = (focus) => ({ focus, issue: 'i', intent: 'inform', motivation: 'm', commitment: 'c', perspective: 'p', mood: { text: 'calm' } });
+  // A mind's categories leave intent to its kind (the signed intent).
+  const mindCats = (focus) => ({ focus, issue: 'i', motivation: 'm', commitment: 'c', perspective: 'p', mood: { text: 'calm' } });
+
+  it('mission B never sees mission A\'s deliveries or notes, and a mind never moves the host\'s inbox', async () => {
+    const peerA = mk('peer-a', { room: 'r' });
+    const node = mk('scoped', { room: 'r' });
+    try {
+      await peerA.start(); await node.start();
+      node._svafEvaluator.evaluate = async () => ({ decision: 'aligned', total_drift: 0.1, category_drifts: { focus: 0.1 }, gate_values: { g: 1 } });
+      const interior = node.interior();
+      const sock = await interior.listen();
+      const mA = interior.startMind({ id: 'mission-A', kinds: ['observation'], allowTo: [peerA.nodeId] });
+      await connectNodes(peerA, node);
+      peerA.remember(cats('customer A secret for mission A'), { to: node.nodeId });
+      peerA.remember(cats('a room broadcast heard during mission A'));
+      await until(() => node.inboxStatus().seq >= 2, 3000);
+      const ca = conn(sock);
+      const dA = await ca.ask({ type: 'deliveries', capability: mA.capability, peek: true });
+      assert.deepStrictEqual(dA.items.map((x) => x.record.categories.focus.text), ['customer A secret for mission A', 'a room broadcast heard during mission A'], 'mission A sees its own counterparty, and the room');
+      const sub = await ca.ask({ type: 'submit', capability: mA.capability, kind: 'observation', categories: mindCats('mission A private note'), to: peerA.nodeId });
+      assert.strictEqual(sub.type, 'submitted');
+      await ca.close();
+      await until(() => !interior.busy, 2000);
+      const before = node.inboxStatus();
+      const mB = interior.startMind({ id: 'mission-B', kinds: ['observation'], allowTo: [] });
+      const c = conn(sock);
+      const d = await c.ask({ type: 'deliveries', capability: mB.capability, after: 0 });
+      assert.deepStrictEqual(d.items, [], 'no delivery from before mission B');
+      const r = await c.ask({ type: 'recall', capability: mB.capability, query: '' });
+      assert.deepStrictEqual(r.items, [], 'recall holds nothing of mission A');
+      for (const m of node.inbox({ peek: true }).messages) {
+        const ack = await c.ask({ type: 'ack', capability: mB.capability, delivery: m.id });
+        assert.strictEqual(ack.reason, 'not-in-view', `${m.directed ? 'directed' : 'broadcast'} from before mission B`);
+      }
+      const recalled = await c.ask({ type: 'recall', capability: mB.capability, query: 'broadcast heard during mission' });
+      assert.deepStrictEqual(recalled.items, [], 'a broadcast from before mission B is not recalled either');
+      // During mission B: a directed record from a node outside its allowTo is not in its view; a
+      // room broadcast is.
+      peerA.remember(cats('for the node, not for mission B'), { to: node.nodeId });
+      peerA.remember(cats('a room broadcast during mission B'));
+      await until(() => node.inboxStatus().seq >= 4, 3000);
+      const during = await c.ask({ type: 'deliveries', capability: mB.capability, peek: true });
+      assert.deepStrictEqual(during.items.map((x) => x.record.categories.focus.text), ['a room broadcast during mission B']);
+      const cite = await c.ask({ type: 'submit', capability: mB.capability, kind: 'observation', categories: mindCats('cites A'), parents: [sub.key] });
+      assert.strictEqual(cite.reason, 'parent-not-in-store', 'a key outside the scope is refused as if absent');
+      await c.ask({ type: 'deliveries', capability: mB.capability });
+      assert.strictEqual(node.inboxStatus().cursor, before.cursor, 'the host\'s inbox cursor is untouched');
+      assert.strictEqual(node.inbox({ peek: true }).messages.length, 4);
+      // Reads are rate-limited per mind.
+      let limited = 0;
+      for (let i = 0; i < 40; i++) if ((await c.ask({ type: 'mission', capability: mB.capability })).reason === 'rate') limited++;
+      assert.ok(limited > 0, 'past the burst, reads are refused');
+      await c.close();
+    } finally { await stopAll(node, peerA); }
+  });
+});
+
+describe('3: relayed forgeries cost bounded work, and nobody is blamed (Finding 3)', () => {
+  it('Q1: 400 forged 200 KiB records relayed in another\'s name are mostly dropped before any work, with bounded logs and decisions', async () => {
+    const b = mk('q1', {});
+    try {
+      await b.start();
+      const logs = []; b._log = (m) => logs.push(m);
+      const metrics = {}; b.on('metric', (m) => { metrics[m.type] = (metrics[m.type] || 0) + 1; });
+      const X = identity('x'); const M = identity('m');
+      admitAs(b, X);
+      const sM = admitAs(b, M);
+      const big = 'z'.repeat(200 * 1024);
+      const before = b._decisionLog.count();
+      for (let i = 0; i < 400; i++) {
+        const rec = signedRecord(M, { categories: { focus: `forged ${i} ${big}` }, room: b._room });
+        rec.metadata.createdByNodeId = X.nodeId;
+        deliver(b, sM, { type: 'cmb', cmb: rec });
+      }
+      assert.strictEqual(sM.closed, false, 'the relayer is not blamed');
+      assert.ok((metrics['relayed-signature-unverified'] || 0) <= 8, `verified and failed at most 8: ${metrics['relayed-signature-unverified']}`);
+      assert.ok((metrics['relayed-signer-muted'] || 0) + (metrics['cmb-over-verify-budget'] || 0) >= 380, 'the rest dropped before any work');
+      assert.ok(logs.length <= 10, `log lines: ${logs.length}`);
+      assert.ok(b._decisionLog.count() - before <= 2, 'decision-log entries bounded');
+    } finally { await stopAll(b); }
+  });
+});
+
+describe('3b: the verification lane bounds work on records naming many signers', () => {
+  it('400 records naming 400 unknown authors: most are dropped before any schema, hash or signature work', async () => {
+    const b = mk('lane', {});
+    try {
+      await b.start();
+      const metrics = {}; b.on('metric', (m) => { metrics[m.type] = (metrics[m.type] || 0) + 1; });
+      const M = identity('m');
+      const sM = admitAs(b, M);
+      // Small records, so the loop runs well inside a second and the lane's refill stays small.
+      const one = signedRecord(M, { categories: { focus: `forged ${'z'.repeat(1024)}` }, room: b._room });
+      for (let i = 0; i < 400; i++) {
+        const rec = JSON.parse(JSON.stringify(one));
+        rec.metadata.createdByNodeId = crypto.randomUUID();
+        deliver(b, sM, { type: 'cmb', cmb: rec });
+      }
+      assert.ok((metrics['cmb-over-verify-budget'] || 0) >= 200, `dropped before any work: ${metrics['cmb-over-verify-budget']}`);
+    } finally { await stopAll(b); }
+  });
+});
+
+describe('7: relocation (Finding 7)', () => {
+  it('7a: a same-process re-acquire of an identity lock returns a release that does nothing; export refuses while a node in this process runs', async () => {
+    const node = mk('reloc-live', {});
+    try {
+      await node.start();
+      const lockFile = path.join(node._dir, 'lock.pid');
+      const release = config.acquireIdentityLock(node.name, { dir: node._dir });
+      release();
+      assert.ok(fs.existsSync(lockFile), 'the running node keeps its lock');
+      const out = path.join(fs.mkdtempSync(path.join(os.tmpdir(), 'b-')), 'n.bundle');
+      assert.throws(() => relocation.exportNode({ name: node.name, out, toHostKey: relocation.hostKey().publicKey }), /running in this process/);
+      assert.strictEqual(config.readTombstone(node.nodeId), null, 'not tombstoned');
+    } finally { await stopAll(node); }
+  });
+
+  it('7b: an import is staged and refused whole, a replayed or consumed bundle is refused, file modes travel, and the header is checked before its scrypt parameters are used', async () => {
+    const name = uniq('reloc');
+    const node = new SymNode({ name, silent: true, discovery: new NullDiscovery() });
+    const nodeId = node.nodeId; const pub = node._identity.publicKey;
+    node.remember({ focus: 'travels' });
+    await node.stop();
+    const dir = config.nodeDirById(nodeId);
+    fs.writeFileSync(path.join(dir, 'secret-0600.txt'), 'x', { mode: 0o600 });
+    const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'b-'));
+    const out = path.join(tmp, 'n.bundle');
+    assert.throws(() => relocation.exportNode({ name, out, passphrase: 'a long operator passphrase' }), /a copy, not a move/, 'a passphrase bundle needs copyable');
+    relocation.exportNode({ name, out, passphrase: 'a long operator passphrase', copyable: true });
+    const pass = 'a long operator passphrase';
+    // A header whose scrypt parameters were raised is refused before scrypt runs.
+    const b = JSON.parse(fs.readFileSync(out, 'utf8'));
+    const hostile = path.join(tmp, 'hostile.bundle');
+    fs.writeFileSync(hostile, JSON.stringify({ ...b, N: 1 << 20 }));
+    const t = Date.now();
+    assert.throws(() => relocation.importNode({ from: hostile, passphrase: pass, expect: { nodeId, key: pub } }), /header is not signed/);
+    assert.ok(Date.now() - t < 500, 'no scrypt was run');
+    // The bundle of the move away, back on this host: a replay.
+    assert.throws(() => relocation.importNode({ from: out, passphrase: pass, expect: { nodeId, key: pub } }), /at or before this host moved/);
+    // Another host (this host's copy removed): a name already indexing another node refuses the whole
+    // import, and nothing is installed.
+    fs.rmSync(dir, { recursive: true, force: true });
+    if (config.identityDirById(nodeId) !== dir) fs.rmSync(config.identityDirById(nodeId), { recursive: true, force: true });
+    const other = config.loadIdentity({ name: uniq('other') });
+    assert.throws(() => relocation.importNode({ from: out, passphrase: pass, expect: { nodeId, key: pub }, name: config.nodeIdForName ? other.name : other.name }), /already indexes another node/);
+    assert.strictEqual(fs.existsSync(dir), false, 'nothing installed');
+    assert.deepStrictEqual(fs.readdirSync(path.dirname(dir)).filter((f) => f.startsWith(path.basename(dir))), [], 'no staged directory left');
+    relocation.importNode({ from: out, passphrase: pass, expect: { nodeId, key: pub } });
+    assert.strictEqual(fs.statSync(path.join(dir, 'secret-0600.txt')).mode & 0o777, 0o600, 'its mode travelled');
+    assert.strictEqual(fs.statSync(path.join(config.identityDirById(nodeId), 'identity.json')).mode & 0o777, 0o600);
+    // Imported once here: never again.
+    fs.rmSync(dir, { recursive: true, force: true });
+    if (config.identityDirById(nodeId) !== dir) fs.rmSync(config.identityDirById(nodeId), { recursive: true, force: true });
+    assert.throws(() => relocation.importNode({ from: out, passphrase: pass, expect: { nodeId, key: pub } }), /already imported on this host/);
+    fs.rmSync(config.nodeDirById(other.nodeId), { recursive: true, force: true });
+  });
+});
+
+describe('lows', () => {
+  it('emit releases the identity\'s lock when it cannot connect', async () => {
+    const { connect } = require('../lib/emit');
+    const name = uniq('emitter');
+    const receiver = { nodeId: crypto.randomUUID(), key: identity('r').publicKey };
+    await assert.rejects(() => connect({ server: '127.0.0.1:1', receiver, name, timeoutMs: 500 }));
+    const id = config.loadIdentity({ name, create: false });
+    assert.strictEqual(config.lockHeldInProcess(config.nodeDirById(id.nodeId)), false, 'the lock was released');
+    assert.strictEqual(fs.existsSync(path.join(config.nodeDirById(id.nodeId), 'lock.pid')), false);
+    await assert.rejects(() => connect({ server: 'not-an-address', receiver, name }));
+    assert.strictEqual(config.lockHeldInProcess(config.nodeDirById(id.nodeId)), false);
+  });
+});
diff --git a/tests/core-secure-identity.test.js b/tests/core-secure-identity.test.js
index a415b4a9..636dbde7 100644
--- a/tests/core-secure-identity.test.js
+++ b/tests/core-secure-identity.test.js
@@ -79,6 +79,12 @@ describe('identities by nodeId (D9.1)', () => {
   });
 });
 
+/** Import as another host would: this host's tombstoned copy removed (one HOME stands in for two). */
+function asAnotherHost(nodeId) {
+  fs.rmSync(config.nodeDirById(nodeId), { recursive: true, force: true });
+  if (config.identityDirById(nodeId) !== config.nodeDirById(nodeId)) fs.rmSync(config.identityDirById(nodeId), { recursive: true, force: true });
+}
+
 describe('relocation (D9.2)', () => {
   it('export tombstones the source before the bundle exists; the source then refuses to start it; import verifies against a pinned key', async () => {
     const name = uniq('id-move');
@@ -90,7 +96,7 @@ describe('relocation (D9.2)', () => {
     const out = path.join(fs.mkdtempSync(path.join(os.tmpdir(), 'bundle-')), 'node.bundle');
     assert.throws(() => relocation.exportNode({ name, out }), /passphrase/, 'no sealing given: refused, and not tombstoned');
     assert.strictEqual(config.readTombstone(nodeId), null);
-    const r = relocation.exportNode({ name, out, passphrase: 'a long operator passphrase' });
+    const r = relocation.exportNode({ name, out, passphrase: 'a long operator passphrase', copyable: true });
     assert.strictEqual(r.nodeId, nodeId);
     assert.ok(config.readTombstone(nodeId), 'tombstoned');
     // Security review: once the bundle is durable the source loses the key and the 0.13 path to it.
@@ -101,7 +107,12 @@ describe('relocation (D9.2)', () => {
     assert.ok(!fs.readFileSync(out, 'utf8').includes(node._identity.privateKey), 'the private key is not in the clear');
     assert.throws(() => new SymNode({ name, silent: true, discovery: new NullDiscovery() }), (e) => e.code === 'EIDENTITYTOMBSTONED', 'the source refuses to start it');
     // Import: the wrong passphrase does not open it; no pin refuses it; the pinned key admits it.
-    assert.throws(() => relocation.importNode({ from: out, passphrase: 'not the passphrase at all' }), /does not open/);
+    assert.throws(() => relocation.importNode({ from: out, passphrase: 'not the passphrase at all', expect: { nodeId, key: pub } }), /does not open/);
+    // On this host, the very bundle of the move away is a replay (final re-review, Finding 7b).
+    assert.throws(() => relocation.importNode({ from: out, passphrase: 'a long operator passphrase', expect: { nodeId, key: pub } }), /at or before this host moved the node away/);
+    // Another host (simulated: this host's copy of the node removed).
+    fs.rmSync(config.nodeDirById(nodeId), { recursive: true, force: true });
+    if (config.identityDirById(nodeId) !== config.nodeDirById(nodeId)) fs.rmSync(config.identityDirById(nodeId), { recursive: true, force: true });
     const imported = relocation.importNode({ from: out, passphrase: 'a long operator passphrase', expect: { nodeId, fingerprint: keyFingerprint(pub) } });
     assert.strictEqual(imported.nodeId, nodeId);
     assert.strictEqual(config.readTombstone(nodeId), null, 'it lives here again');
@@ -121,7 +132,7 @@ describe('relocation (D9.2)', () => {
     await node.stop();
     const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'bundle-'));
     const out = path.join(dir, 'node.bundle');
-    relocation.exportNode({ name, out, passphrase: 'a long operator passphrase' });
+    relocation.exportNode({ name, out, passphrase: 'a long operator passphrase', copyable: true });
     // An attacker re-keys the identity in a copy of the bundle (they cannot sign as the node).
     const { importNode } = relocation;
     const tampered = path.join(dir, 'rekeyed.bundle');
@@ -156,7 +167,7 @@ describe('relocation (D9.2)', () => {
     await node.stop();
     const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'bundle-'));
     const out = path.join(dir, 'node.bundle');
-    relocation.exportNode({ name, out, passphrase: 'a long operator passphrase' });
+    relocation.exportNode({ name, out, passphrase: 'a long operator passphrase', copyable: true });
     const crypto2 = require('crypto');
     const open = (b) => {
       const key = crypto2.scryptSync('a long operator passphrase', Buffer.from(b.salt, 'base64url'), 32, { N: b.N, r: b.r, p: b.p, maxmem: 128 * 1024 * 1024 });
@@ -182,7 +193,8 @@ describe('relocation (D9.2)', () => {
     const { signature, ...unsigned } = plain; void signature;
     const stripped = reseal(b, key, unsigned, path.join(dir, 'stripped.bundle'));
     assert.throws(() => relocation.importNode({ from: stripped, passphrase: 'a long operator passphrase', expect: { nodeId, key: pub } }), /not signed by the node/);
-    // The genuine one imports.
+    // The genuine one imports (on another host).
+    asAnotherHost(nodeId);
     assert.strictEqual(relocation.importNode({ from: out, passphrase: 'a long operator passphrase', expect: { nodeId, key: pub } }).nodeId, nodeId);
   });
 
@@ -194,6 +206,7 @@ describe('relocation (D9.2)', () => {
     const host = relocation.hostKey();
     const out = path.join(fs.mkdtempSync(path.join(os.tmpdir(), 'bundle-')), 'node.bundle');
     relocation.exportNode({ name, out, toHostKey: host.publicKey });
+    asAnotherHost(nodeId);
     const r = relocation.importNode({ from: out, expect: { nodeId, key: pub } });
     assert.strictEqual(r.nodeId, nodeId);
   });
diff --git a/tests/core-secure-rereview.test.js b/tests/core-secure-rereview.test.js
index cf46b036..53da588a 100644
--- a/tests/core-secure-rereview.test.js
+++ b/tests/core-secure-rereview.test.js
@@ -168,14 +168,17 @@ function kp(nodeId) {
 const grantOf = (type, grantee, role, grantor, at, extra = {}) => signGrant({ type, grantee: grantee.nodeId, ...(role ? { role } : {}), grantedBy: grantor.nodeId, grantedAt: at, ...(type === 'role-grant' ? { granteeKey: grantee.pub } : {}), ...extra }, grantor.priv);
 
 describe('N2: a revoke carries a cutoff; when a node received anything is no part of the rule', () => {
-  // V legitimately revokes W on "day 1"; the anchor revokes V on "day 3" (its cutoff: day 3).
+  // V legitimately revokes W on "day 1"; the anchor revokes V on "day 3" (cutoff day 3), ratifying
+  // V's revoke of W (final re-review ruling B: what a revoked node signed before its cutoff stands
+  // when its revoker ratifies it).
   const ANC = kp(), V = kp(), W = kp();
   const t = Date.now() - 1_000_000;
+  const rVW = grantOf('role-revoke', W, undefined, V, t + 100_000, { cutoff: t + 100_000 });
   const R = {
     AV: grantOf('role-grant', V, 'validator', ANC, t),
     AW: grantOf('role-grant', W, 'validator', ANC, t + 1),
-    rVW: grantOf('role-revoke', W, undefined, V, t + 100_000),
-    rAV: grantOf('role-revoke', V, undefined, ANC, t + 300_000),
+    rVW,
+    rAV: grantOf('role-revoke', V, undefined, ANC, t + 300_000, { cutoff: t + 300_000, ratify: [rVW.sig] }),
   };
   const roleOfW = (store) => store.resolveRole(W.nodeId, W.pub, Date.now());
 
@@ -188,8 +191,9 @@ describe('N2: a revoke carries a cutoff; when a node received anything is no par
     assert.strictEqual(roleOfW(early), 'participant', 'early receiver');
     const late = new RoleGrantStore({ anchor: { nodeId: ANC.nodeId, publicKey: ANC.pub } });
     for (const k of ['AV', 'AW', 'rAV']) late.record(R[k]);
-    assert.strictEqual(late.record(R.rVW).stored, true, 'V\'s revoke, signed before V\'s cutoff, stands when it arrives after V\'s own revoke');
+    assert.strictEqual(late.record(R.rVW).stored, true, 'V\'s revoke, signed before V\'s cutoff and ratified, stands when it arrives after V\'s own revoke');
     assert.strictEqual(roleOfW(late), 'participant', 'late receiver');
+    assert.strictEqual(late.digest().digest, early.digest().digest);
     const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'n2-upgrade-'));
     try {
       // A 0.13 store: bare lines, no receipt times, in the order 0.13 happened to write them.
@@ -217,63 +221,73 @@ describe('N2: a revoke carries a cutoff; when a node received anything is no par
     const X = kp();
     const store = new RoleGrantStore({ anchor: { nodeId: ANC.nodeId, publicKey: ANC.pub } });
     store.record(R.AV); store.record(R.AW);
-    assert.strictEqual(store.record(grantOf('role-revoke', V, undefined, ANC, t + 300_000, { cutoff: t + 50_000 })).stored, true);
-    assert.strictEqual(store.resolveRole(V.nodeId, V.pub, t + 40_000), 'validator', 'before the cutoff');
+    assert.strictEqual(store.record(grantOf('role-revoke', V, undefined, ANC, t + 300_000, { cutoff: t + 50_000, ratify: [R.rVW.sig] })).stored, true);
+    assert.strictEqual(store.resolveRole(V.nodeId, V.pub, t + 40_000), 'validator', 'V\'s own role before the cutoff stands (the anchor that granted it holds rank)');
     assert.strictEqual(store.resolveRole(V.nodeId, V.pub, t + 60_000), 'participant', 'from the cutoff, before the revoke was signed');
-    assert.deepStrictEqual(store.record(R.rVW), { stored: false, reason: 'unrooted' }, 'V\'s revoke of W, signed after the cutoff, does not count');
-    assert.strictEqual(roleOfW(store), 'validator');
-    assert.strictEqual(store.record(grantOf('role-grant', X, 'validator', V, t + 10_000)).stored, true, 'V\'s grant before the cutoff stands as a statement');
+    assert.strictEqual(store.record(R.rVW).stored, true, 'kept: verifiable');
+    assert.strictEqual(roleOfW(store), 'validator', 'V\'s revoke of W, signed after the cutoff, does not count, ratified or not');
+    assert.strictEqual(store.record(grantOf('role-grant', X, 'validator', V, t + 10_000)).stored, true, 'kept: verifiable');
+    assert.strictEqual(store.resolveRole(X.nodeId, X.pub, Date.now()), 'participant');
   });
 
-  it('a revoker reaches back only over time it was itself authorised for', () => {
+  it('a revoker reaches back only over time it was itself authorised for: a revoke whose cutoff precedes its revoker\'s rank is kept but has no effect', () => {
     const Q = kp(); const X = kp();
     const store = new RoleGrantStore({ anchor: { nodeId: ANC.nodeId, publicKey: ANC.pub } });
     store.record(grantOf('role-grant', X, 'validator', ANC, t));
     store.record(grantOf('role-grant', Q, 'validator', ANC, t + 200_000)); // Q a validator from t+200 s
-    assert.deepStrictEqual(store.record(grantOf('role-revoke', X, undefined, Q, t + 300_000, { cutoff: t + 100_000 })), { stored: false, reason: 'unrooted' }, 'a cutoff before Q held rank');
-    assert.strictEqual(store.record(grantOf('role-revoke', X, undefined, Q, t + 300_000, { cutoff: t + 250_000 })).stored, true);
+    assert.strictEqual(store.record(grantOf('role-revoke', X, undefined, Q, t + 300_000, { cutoff: t + 100_000 })).stored, true, 'kept: verifiable');
+    assert.strictEqual(store.resolveRole(X.nodeId, X.pub, Date.now()), 'validator', 'Q held no rank at its cutoff: no effect (decided at resolution)');
+    assert.strictEqual(store.record(grantOf('role-revoke', X, undefined, Q, t + 300_001, { cutoff: t + 250_000 })).stored, true);
+    assert.strictEqual(store.resolveRole(X.nodeId, X.pub, Date.now()), 'participant');
   });
 
-  it('wire: a revoke without a cutoff signs the bytes 0.13 signed; the cutoff is signed when present, at most the revoke\'s time, only on a revoke', () => {
+  it('wire: a revoke without a cutoff signs the bytes 0.13 signed; the cutoff and ratify list are signed when present, and checked', () => {
     const r = { type: 'role-revoke', grantee: 'g', grantedBy: 'b', grantedAt: 5 };
     assert.strictEqual(grantPayload(r).toString(), 'role-revoke|g||b|5|');
     assert.strictEqual(grantPayload({ ...r, cutoff: 3 }).toString(), 'role-revoke|g||b|5||3');
-    const c = grantOf('role-revoke', W, undefined, ANC, t + 10, { cutoff: t });
+    const s1 = 'A'.repeat(85) + 'A', s2 = 'B'.repeat(85) + 'A';
+    assert.strictEqual(grantPayload({ ...r, cutoff: 3, ratify: [s1, s2] }).toString(), `role-revoke|g||b|5||3|${s1},${s2}`);
+    const c = grantOf('role-revoke', W, undefined, ANC, t + 10, { cutoff: t, ratify: [s1] });
     assert.strictEqual(verifyGrant(c, ANC.pub).valid, true);
     assert.strictEqual(verifyGrant({ ...c, cutoff: t + 1 }, ANC.pub).valid, false, 'the cutoff is signed');
+    assert.strictEqual(verifyGrant({ ...c, ratify: [s2] }, ANC.pub).valid, false, 'the ratify list is signed');
     const store = new RoleGrantStore({ anchor: { nodeId: ANC.nodeId, publicKey: ANC.pub } });
-    assert.strictEqual(store.record(grantOf('role-revoke', W, undefined, ANC, t, { cutoff: t + 1 })).reason, 'malformed', 'a cutoff after the revoke');
+    const bad = (extra, why) => assert.strictEqual(store.record(grantOf('role-revoke', W, undefined, ANC, t, extra)).reason, 'malformed', why);
+    bad({ cutoff: t + 1 }, 'a cutoff after the revoke');
+    bad({ granteeKey: 'abc|1' }, 'a revoke key that is not a key');
+    bad({ ratify: [s1] }, 'ratify without a cutoff');
+    bad({ cutoff: t, ratify: [] }, 'an empty ratify list');
+    bad({ cutoff: t, ratify: [s2, s1] }, 'an unsorted ratify list');
+    bad({ cutoff: t, ratify: [s1, s1] }, 'a repeat');
+    bad({ cutoff: t, ratify: ['not-a-signature'] }, 'not a signature');
     assert.strictEqual(store.record(grantOf('role-grant', W, 'validator', ANC, t, { cutoff: t })).reason, 'malformed', 'a cutoff on a grant');
-    assert.strictEqual(store.record(grantOf('role-revoke', W, undefined, ANC, t, { granteeKey: 'abc|1' })).reason, 'malformed', 'a revoke key that is not a key');
     store.record(c);
-    assert.strictEqual(store.grantsFor(W.nodeId)[0].cutoff, t, 'kept with its cutoff');
+    assert.deepStrictEqual([store.grantsFor(W.nodeId)[0].cutoff, store.grantsFor(W.nodeId)[0].ratify], [t, [s1]], 'kept with its cutoff and ratify list');
   });
 });
 
-describe('N4: no cap refuses a revoke; revokes are bounded by their grants', () => {
-  it('past every grant cap a validator can still revoke; one revoke per grant its grantee holds', () => {
+describe('N4: no cap refuses a revoke: a budget per delegation subtree (final re-review ruling A)', () => {
+  it('a sybil tree fills only its own subtree\'s budget; an honest revoke from another subtree is always kept', () => {
     const A = kp(), M = kp(), H = kp(), X = kp();
-    const store = new RoleGrantStore({ anchor: { nodeId: A.nodeId, publicKey: A.pub }, maxPerGrantor: 2, maxPerPair: 1, maxGrants: 5 });
+    const store = new RoleGrantStore({ anchor: { nodeId: A.nodeId, publicKey: A.pub }, subtreeBudget: 8 });
     const t = Date.now() - 100_000;
     store.record(grantOf('role-grant', M, 'validator', A, t));
     store.record(grantOf('role-grant', H, 'validator', A, t));
-    assert.strictEqual(store.record(grantOf('role-grant', X, 'validator', H, t + 1)).stored, true, 'H grants X (H\'s pair with X is now full)');
-    // M fills what is left of the store with sybil grants.
-    for (let i = 0; i < 2; i++) store.record(grantOf('role-grant', kp(), 'validator', M, t + 2 + i));
-    assert.strictEqual(store.record(grantOf('role-grant', kp(), 'validator', H, t + 9)).reason, 'store-full', 'the grant caps are full');
-    const rHX = grantOf('role-revoke', X, undefined, H, t + 10);
-    assert.strictEqual(store.record(rHX).stored, true, 'H\'s revoke of X is kept: pair-full, grantor-full and store-full never refuse a revoke');
-    assert.strictEqual(store.resolveRole(X.nodeId, X.pub, Date.now()), 'participant');
-    const rHM = grantOf('role-revoke', M, undefined, H, t + 11);
-    assert.strictEqual(store.record(rHM).stored, true, 'and H can revoke the flooder');
-    // Bounded by grants: X holds one grant, so H keeps one revoke for X; a grantee with none, none.
-    assert.strictEqual(store.record(grantOf('role-revoke', X, undefined, H, t + 12)).reason, 'nothing-to-revoke');
-    assert.strictEqual(store.record(grantOf('role-revoke', kp(), undefined, H, t + 13)).reason, 'nothing-to-revoke');
-    assert.strictEqual(store.record(grantOf('role-revoke', kp(), undefined, A, t + 14)).stored, true, 'the anchor\'s own are never refused');
+    store.record(grantOf('role-grant', X, 'validator', A, t));
+    // M grows a sybil tree and floods records under it.
+    const sybils = Array.from({ length: 6 }, () => kp());
+    for (const y of sybils) store.record(grantOf('role-grant', y, 'validator', M, t + 1));
+    for (const y of sybils) for (let i = 0; i < 20; i++) store.record(grantOf('role-revoke', X, undefined, y, t + 100 + i, { cutoff: t + 100 + i }));
+    for (let i = 0; i < 20; i++) store.record(grantOf('role-grant', kp(), 'validator', M, t + 200 + i));
+    assert.strictEqual(store._byRoot.get(M.nodeId).size, 8, 'M\'s subtree holds its budget and no more');
+    assert.ok(store.size() <= 3 + 8 + 8, `the store holds the anchor's records and the budgets: ${store.size()}`);
+    const rHX = grantOf('role-revoke', X, undefined, H, t + 1000, { cutoff: t + 1000 });
+    assert.strictEqual(store.record(rHX).stored, true, 'H\'s revoke counts against H\'s subtree, which M cannot touch');
+    assert.strictEqual(store.record(grantOf('role-revoke', X, undefined, H, t + 1001, { cutoff: t + 900 })).stored, true, 'and H can tighten it');
   });
 });
 
-describe('N4 at the node: a whole-store sync never sends a revoke ahead of the grant it clears', () => {
+describe('N4 at the node: a whole-store sync over several pages', () => {
   it('a revoke whose grant is on a later page still counts after the sync', async () => {
     const A = kp(), V = kp(), Q = kp(), X = kp();
     const t = Date.now() - 100_000;
@@ -427,7 +441,7 @@ describe('leads', () => {
       }
       assert.strictEqual(b._store.allEntries().length, 0, 'nothing minted');
       assert.ok(b.remember({ focus: 'to a nodeId' }, { to: id }), 'a lowercase UUID is taken');
-      assert.strictEqual(b.send('hello', { to: id.toUpperCase() }), 0, 'send says it delivered nothing');
+      assert.throws(() => b.send('hello', { to: id.toUpperCase() }), (e) => e.code === 'EBADTO', 'send refuses it too');
     } finally { await stopAll(b); }
   });
 
diff --git a/tests/core-secure-review.test.js b/tests/core-secure-review.test.js
index 52199e03..54557b86 100644
--- a/tests/core-secure-review.test.js
+++ b/tests/core-secure-review.test.js
@@ -174,7 +174,7 @@ describe('B. a record is its signed projection (cs-review-B/p3-unsigned, cs-revi
   });
 });
 
-describe('C. a revoke carries a cutoff: what the revoked node signed before it stands, at or after it never counts (cs-review-B; re-review N2 replaces draft spec PR #33\'s receipt time)', () => {
+describe('C. a revoke carries a cutoff; a revoked key gains nothing by backdating; the anchor ratifies (cs-review-B; re-review N2; final re-review ruling B)', () => {
   const ANC = kp('anchor'), V = kp('validator-v'), W = kp('validator-w'), H = kp('honest-h'), ATT = kp('attacker');
   const t0 = Date.now() - 100_000;
   // V was granted at t0 and revoked at t0+50 s, its trust withdrawn from t0+500 ms (the cutoff).
@@ -189,55 +189,63 @@ describe('C. a revoke carries a cutoff: what the revoked node signed before it s
     return { roster, store };
   }
 
-  it('p2-revoked-vouch: a revoked validator\'s grant dated at or after its cutoff is not kept; one before it is kept but confers nothing now; no key is bound', () => {
+  it('p2-revoked-vouch: a revoked validator\'s grants are kept (verifiable) but confer nothing, before or after its cutoff; no key is bound', () => {
     const { roster, store } = world();
     assert.strictEqual(store.resolveRole(V.nodeId, V.pub, Date.now()), 'participant');
-    const r = store.record(grantOf('role-grant', { nodeId: H.nodeId, pub: ATT.pub }, 'validator', V, t0 + 1000));
-    assert.deepStrictEqual(r, { stored: false, reason: 'unrooted' }, 'V signed it after its cutoff');
-    assert.strictEqual(roster.get(H.nodeId), undefined, 'the attacker key is bound to nobody');
-    const early = store.record(grantOf('role-grant', { nodeId: H.nodeId, pub: ATT.pub }, 'validator', V, t0 + 100));
-    assert.strictEqual(early.stored, true, 'a statement V signed before its cutoff stands');
-    assert.strictEqual(store.resolveRole(H.nodeId, ATT.pub, Date.now()), 'participant', 'and confers nothing while V is revoked (the §6.6 cascade)');
-    assert.strictEqual(roster.get(H.nodeId), undefined, 'so it vouches no key');
+    for (const at of [t0 + 1000, t0 + 100]) {
+      const H2 = kp(`h-${at}`);
+      assert.strictEqual(store.record(grantOf('role-grant', { nodeId: H2.nodeId, pub: ATT.pub }, 'validator', V, at)).stored, true, 'verifiable: kept, decided at resolution (final re-review ruling A)');
+      assert.strictEqual(store.resolveRole(H2.nodeId, ATT.pub, Date.now()), 'participant', 'V no longer holds rank, and nothing ratifies it (ruling B)');
+      assert.strictEqual(store.resolveRole(H2.nodeId, ATT.pub, t0 + 200), 'participant', 'not even back then');
+      assert.strictEqual(roster.get(H2.nodeId), undefined, 'the attacker key is bound to nobody');
+    }
     const self = store.record(grantOf('role-grant', { nodeId: 'receiver', pub: ATT.pub }, 'validator', V, t0 + 1001));
-    assert.strictEqual(self.stored, false);
+    assert.strictEqual(self.stored, true, 'kept as a statement; it binds nothing');
     assert.strictEqual(roster.get('receiver'), roster._self.publicKey, 'this node\'s own id is always its own key');
   });
 
-  it('p2c-backdate: a revoked validator\'s revoke dated after its cutoff strips nothing, and its attestation dated after it weighs as a participant', () => {
+  it('p2c-backdate: a revoked validator\'s revoke strips nothing and its attestation weighs as a participant, however it is dated, unless the anchor ratified it', () => {
     const { store } = world();
-    assert.deepStrictEqual(store.record(grantOf('role-revoke', W, undefined, V, t0 + 1000)), { stored: false, reason: 'unrooted' });
+    assert.strictEqual(store.record(grantOf('role-revoke', W, undefined, V, t0 + 1000, { cutoff: t0 + 1000 })).stored, true);
+    assert.strictEqual(store.record(grantOf('role-revoke', W, undefined, V, t0 + 100, { cutoff: t0 + 100 })).stored, true, 'backdated before V\'s cutoff');
     assert.strictEqual(store.resolveRole(W.nodeId, W.pub, Date.now()), 'validator', 'W keeps its role');
-    const role = (at) => verifyAttestationRole({ by: V.nodeId, at, role: 'validator' }, (id, t) => store.resolveRole(id, V.pub, t)).resolved;
-    assert.strictEqual(role(t0 + 1000), 'participant', 'dated after the cutoff: a participant\'s');
-    assert.strictEqual(role(t0 + 100), 'validator', 'dated before it: it stands');
+    assert.strictEqual(store.resolveRole(W.nodeId, W.pub, t0 + 300), 'validator', 'throughout');
+    const sig = 'A'.repeat(85) + 'A';
+    assert.strictEqual(store.statementRole(V.nodeId, V.pub, t0 + 1000, sig), 'participant', 'dated after the cutoff');
+    assert.strictEqual(store.statementRole(V.nodeId, V.pub, t0 + 100, sig), 'participant', 'dated before it: V holds no rank now and nothing ratifies it');
+    store.record(grantOf('role-revoke', V, undefined, ANC, t0 + 60_000, { cutoff: CUT, ratify: [sig] }));
+    assert.strictEqual(store.statementRole(V.nodeId, V.pub, t0 + 100, sig), 'validator', 'ratified by the anchor\'s revoke: it stands');
+    assert.strictEqual(store.statementRole(V.nodeId, V.pub, t0 + 1000, sig), 'participant', 'ratifying cannot reach past the cutoff');
   });
 
-  it('a revoke signed before its revoker\'s cutoff stands, whichever arrives first', () => {
+  it('a revoke signed before its revoker\'s cutoff stands, whichever arrives first, when the revoker\'s revoke ratifies it', () => {
     const ANC2 = kp('anchor-2'), V2 = kp('v-2'), X = kp('x-2');
     const t = Date.now() - 10_000;
+    const rVX = grantOf('role-revoke', X, undefined, V2, t + 2, { cutoff: t + 2 });
     const recs = {
       AV: grantOf('role-grant', V2, 'validator', ANC2, t),
       AX: grantOf('role-grant', X, 'validator', ANC2, t + 1),
-      rVX: grantOf('role-revoke', X, undefined, V2, t + 2),
-      rAV: grantOf('role-revoke', V2, undefined, ANC2, t + 5),
+      rVX,
+      rAV: grantOf('role-revoke', V2, undefined, ANC2, t + 5, { cutoff: t + 5, ratify: [rVX.sig] }),
+      rAVbare: grantOf('role-revoke', V2, undefined, ANC2, t + 5, { cutoff: t + 5 }),
     };
-    for (const order of [['AV', 'AX', 'rVX', 'rAV'], ['AV', 'AX', 'rAV', 'rVX']]) {
+    for (const [order, role] of [[['AV', 'AX', 'rVX', 'rAV'], 'participant'], [['AV', 'AX', 'rAV', 'rVX'], 'participant'], [['AV', 'AX', 'rVX', 'rAVbare'], 'validator'], [['AV', 'AX', 'rAVbare', 'rVX'], 'validator']]) {
       const store = new RoleGrantStore({ anchor: { nodeId: ANC2.nodeId, publicKey: ANC2.pub } });
       for (const k of order) assert.strictEqual(store.record(recs[k]).stored, true, `${order.join(' ')}: ${k}`);
-      assert.strictEqual(store.resolveRole(X.nodeId, X.pub, Date.now()), 'participant', `${order.join(' → ')}: the revoke stands`);
+      assert.strictEqual(store.resolveRole(X.nodeId, X.pub, Date.now()), role, `${order.join(' → ')}`);
     }
   });
 
   it('a revoke signed at or after its revoker\'s cutoff has no effect, whichever arrives first', () => {
     const ANC3 = kp('anchor-3'), V3 = kp('v-3'), W3 = kp('w-3');
     const t = Date.now() - 100_000;
+    const rVW = grantOf('role-revoke', W3, undefined, V3, t + 20, { cutoff: t + 20 });
     const recs = {
       AV: grantOf('role-grant', V3, 'validator', ANC3, t),
       AW: grantOf('role-grant', W3, 'validator', ANC3, t + 1),
-      rVW: grantOf('role-revoke', W3, undefined, V3, t + 20),
-      // The anchor revoked V3 at t+30, withdrawing its trust from t+10.
-      rAV: grantOf('role-revoke', V3, undefined, ANC3, t + 30, { cutoff: t + 10 }),
+      rVW,
+      // The anchor revoked V3 at t+30, withdrawing its trust from t+10, and (wrongly) lists rVW.
+      rAV: grantOf('role-revoke', V3, undefined, ANC3, t + 30, { cutoff: t + 10, ratify: [rVW.sig] }),
     };
     for (const order of [['AV', 'AW', 'rVW', 'rAV'], ['AV', 'AW', 'rAV', 'rVW']]) {
       const store = new RoleGrantStore({ anchor: { nodeId: ANC3.nodeId, publicKey: ANC3.pub } });
@@ -257,7 +265,7 @@ describe('C. a revoke carries a cutoff: what the revoked node signed before it s
     assert.strictEqual(store.vouchedKey(own.nodeId), undefined);
   });
 
-  it('p2b-node: at the node, a grant a revoked validator dated after its cutoff is not stored or relayed, and records forged under it are refused', async () => {
+  it('p2b-node: at the node, a grant a revoked validator dated after its cutoff confers nothing and binds no key, and records forged under it are refused', async () => {
     const ANCN = identity('anchor-n');
     const b = mk('p2b', { anchor: { nodeId: ANCN.nodeId, publicKey: ANCN.publicKey }, room: 'r' });
     try {
@@ -272,7 +280,8 @@ describe('C. a revoke carries a cutoff: what the revoked node signed before it s
       deliver(b, s, g({ type: 'role-grant', grantee: b.nodeId, role: 'validator', grantedBy: VV.nodeId, grantedAt: t0 + 1001, granteeKey: AT.publicKey }, VV.privateKey));
       assert.strictEqual(b._roster.source(HH.nodeId), undefined);
       assert.strictEqual(b._roster.source(b.nodeId), 'self');
-      assert.strictEqual(b._roleGrants.size(), 2, 'only the anchor\'s two');
+      assert.strictEqual(b._roleGrants.size(), 4, 'kept, as verifiable records (final re-review ruling A); they confer nothing');
+      assert.strictEqual(b.resolveRole(HH.nodeId, Date.now(), { key: AT.publicKey }), 'participant');
       const hooked = [];
       b.on('verified-record', (e) => hooked.push(e));
       deliver(b, s, { type: 'cmb', cmb: signedRecord({ ...HH, publicKey: AT.publicKey, privateKey: AT.privateKey }, { categories: { focus: 'forged as H' }, room: 'r' }) });
@@ -311,10 +320,11 @@ describe('D. no shared budget before verification; bounds (cs-review-B, cs-revie
     let depthReached = 0;
     for (let d = 1; d <= 24; d++) {
       const g = kp(`l${d}`);
-      if (s.record(grantOf('role-grant', g, 'validator', prev, t + d)).stored) depthReached = d;
+      assert.strictEqual(s.record(grantOf('role-grant', g, 'validator', prev, t + d)).stored, true, 'verifiable: kept, its effect decided at resolution');
+      if (s.resolveRole(g.nodeId, g.pub, Date.now()) === 'validator') depthReached = d;
       prev = g;
     }
-    assert.strictEqual(depthReached, 8, 'the 9th link is not rooted');
+    assert.strictEqual(depthReached, 8, 'the 9th link confers nothing');
     const B = kp('anchor-c');
     const st = new RoleGrantStore({ anchor: { nodeId: B.nodeId, publicKey: B.pub } });
     const chain = [kp('c0')];
@@ -728,7 +738,10 @@ describe('the rest of the review (cs-review-B/p11-cli-compact, node-level attest
       const inWindow = { by: V.nodeId, at: t0 + 1000 };
       assert.strictEqual(node._attesterRole(inWindow), 'validator', 'signed while V was a validator: it counts');
       node._roleGrants.record(signGrant({ type: 'role-revoke', grantee: V.nodeId, grantedBy: ANCN.nodeId, grantedAt: t0 + 50_000, cutoff: t0 + 2000 }, ANCN.privateKey));
-      assert.strictEqual(node._attesterRole(inWindow), 'validator', 'and, signed before the cutoff, keeps its standing after V is revoked, for every receiver');
+      assert.strictEqual(node._attesterRole(inWindow), 'participant', 'V no longer holds rank, and nothing ratified it (final re-review ruling B)');
+      const ratified = { ...inWindow, sig: 'Q'.repeat(85) + 'A' };
+      node._roleGrants.record(signGrant({ type: 'role-revoke', grantee: V.nodeId, grantedBy: ANCN.nodeId, grantedAt: t0 + 50_001, cutoff: t0 + 2000, ratify: [ratified.sig] }, ANCN.privateKey));
+      assert.strictEqual(node._attesterRole(ratified), 'validator', 'one the anchor ratified keeps its standing, for every receiver');
       const backdated = { by: V.nodeId, at: t0 + 3000 };
       assert.strictEqual(node._attesterRole(backdated), 'participant', 'one dated at or after the cutoff never counts, whenever it was signed (re-review N2)');
     } finally { await stopAll(node); }
diff --git a/tests/earned-authority-node.test.js b/tests/earned-authority-node.test.js
index 6157a036..48ca0e1c 100644
--- a/tests/earned-authority-node.test.js
+++ b/tests/earned-authority-node.test.js
@@ -52,7 +52,8 @@ describe('node earned-authority wiring (EA2/EA3)', () => {
       const g = node.grantRole(peer, 'validator');
       assert.ok(g && g.sig, 'grant is signed');
       assert.strictEqual(node.resolveRole(peer), 'validator', 'grantee resolves to validator');
-      const revoke = node.revokeRole(peer);
+      assert.throws(() => node.revokeRole(peer), (e) => e.code === 'ECUTOFF', 'a revoke names its cutoff: there is no default (final re-review ruling B)');
+      const revoke = node.revokeRole(peer, { cutoff: Date.now() });
       assert.ok(revoke && revoke.type === 'role-revoke');
       assert.strictEqual(node.resolveRole(peer), 'participant', 'revoked → participant');
     } finally { fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
diff --git a/tests/gossip-lanes.test.js b/tests/gossip-lanes.test.js
index 3f8b41dd..0d9c19a9 100644
--- a/tests/gossip-lanes.test.js
+++ b/tests/gossip-lanes.test.js
@@ -129,28 +129,28 @@ describe('role grants are gossip under the budget (F1)', () => {
       for (let i = 0; i < 100; i++) assert.strictEqual(node._ingestRoleGrant(forgedGrant('nobody', 'x'), 'p5').reason, 'unknown-grantor-key');
       assert.strictEqual(node._gossipBuckets.has('p5'), false);
       assert.strictEqual(sent.length, 0, 'nothing refused was relayed');
-      // Genuine grants from one grantor to one grantee: kept up to the pair's bound, and only those relayed.
+      // Genuine grants from one grantor: kept within its delegation subtree's budget (final re-review
+      // ruling A), and only those relayed.
+      node._roleGrants._budget = 16;
       let kept = 0;
       for (let i = 0; i < 70; i++) {
         const r = node._ingestRoleGrant(signGrant({ type: 'role-grant', grantee: 'node-x', granteeKey: SOME_KEY, role: 'validator', grantedBy: P.id, grantedAt: i }, P.priv), 'p2');
-        if (r.ok) kept++; else assert.strictEqual(r.reason, 'pair-full');
+        if (r.ok) kept++; else assert.strictEqual(r.reason, 'outranked');
       }
-      assert.strictEqual(kept, 16, 'the pair bound (16 since the security review: role-resolve-cost)');
+      assert.strictEqual(kept, 16, 'P\'s subtree holds its budget: the 16 earliest');
       assert.strictEqual(sent.length, 16);
-      // Another grantor's grant to the same grantee is not kept out by the first one's.
+      // Another subtree's grant to the same grantee is not kept out by P's.
       assert.strictEqual(node._ingestRoleGrant(signGrant({ type: 'role-grant', grantee: 'node-x', granteeKey: SOME_KEY, role: 'validator', grantedBy: Q.id, grantedAt: 1 }, Q.priv), 'p3').ok, true);
     });
   });
 
-  it("the store dedups by the signature's bytes, keeps the canonical spelling, and bounds what it keeps without evicting", () => {
+  it("the store dedups by the signature's bytes, keeps the canonical spelling, and keeps each subtree within its budget by one order", () => {
     const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'grants-'));
     try {
       const A = kp('A');
       const P = kp('P');
       const Q = kp('Q');
-      const keys = new Map([[P.id, P.pub], [Q.id, Q.pub]]);
-      // maxGrants counts the anchor's two grants that root P and Q (0.13.17: only a rooted record is kept).
-      const opts = { anchor: { nodeId: A.id, publicKey: A.pub }, keys, dir, maxPerGrantor: 3, maxPerPair: 2, maxGrants: 7 };
+      const opts = { anchor: { nodeId: A.id, publicKey: A.pub }, dir, subtreeBudget: 3 };
       const st = new RoleGrantStore(opts);
       const keyOf = (grantee) => ({ [P.id]: P.pub, [Q.id]: Q.pub })[grantee] || SOME_KEY;
       const grant = (by, grantee, at) => signGrant({ type: 'role-grant', grantee, granteeKey: keyOf(grantee), role: 'validator', grantedBy: by.id, grantedAt: at }, by.priv);
@@ -163,15 +163,16 @@ describe('role grants are gossip under the budget (F1)', () => {
       for (const G of [P, Q]) assert.strictEqual(st.record(grant(A, G.id, 0)).stored, true);
 
       const r = (by, grantee, at) => st.record(grant(by, grantee, at)).reason ?? 'stored';
-      assert.deepStrictEqual([r(P, 'x', 1), r(P, 'x', 2), r(P, 'x', 3)], ['stored', 'stored', 'pair-full']);
-      assert.deepStrictEqual([r(P, 'y', 4), r(P, 'z', 5)], ['stored', 'grantor-full']);
-      assert.strictEqual(st.record(forgedGrant(P.id, 'w')).reason, 'grantor-full', 'refused before its signature is checked');
-      assert.deepStrictEqual([r(Q, 'x', 6), r(Q, 'y', 7)], ['stored', 'store-full']);
-      assert.strictEqual(st.size(), 7);
-      assert.deepStrictEqual([r(A, 'x', 8), r(A, 'z', 9)], ['stored', 'stored'], "the anchor's own are never refused");
-      assert.deepStrictEqual(st.grantsFor('x').map((x) => x.grantedAt), [1, 2, 6, 8], 'nothing kept was evicted');
+      assert.deepStrictEqual([r(P, 'x', 5), r(P, 'y', 6), r(P, 'z', 7)], ['stored', 'stored', 'stored']);
+      assert.strictEqual(r(P, 'w', 8), 'outranked', 'past the budget a later record loses');
+      assert.strictEqual(r(P, 'u', 2), 'stored', 'an earlier one replaces the last kept');
+      assert.deepStrictEqual(st.grantsFor('z'), [], 'the last-ranked record was replaced');
+      assert.strictEqual(st.record(forgedGrant(P.id, 'w')).reason, 'bad-signature', 'refused before it could rank');
+      assert.deepStrictEqual([r(Q, 'x', 6), r(Q, 'y', 7)], ['stored', 'stored'], 'Q\'s subtree has its own budget');
+      assert.deepStrictEqual([r(A, 'x', 8), r(A, 'z', 9)], ['stored', 'stored'], "the anchor's own are never bounded");
       const again = new RoleGrantStore(opts);
-      assert.strictEqual(again.size(), 9, 'and a restart reads back what was kept');
+      assert.strictEqual(again.size(), st.size(), 'a restart keeps what the rule keeps');
+      assert.strictEqual(again.digest().digest, st.digest().digest);
       assert.strictEqual(again.resolveRole('x', 100), 'validator');
     } finally { fs.rmSync(dir, { recursive: true, force: true }); }
   });
@@ -213,8 +214,11 @@ describe('the budget is kept per PROVEN peer (F2; Core Secure design D1)', () =>
         node._frameHandler.handle(lan, { type: 'role-grant', grant: forgedGrant(A.id, `x-${i}`) });
       }
       assert.deepStrictEqual([...node._gossipBuckets.keys()], ['peer-two-paths']);
-      // A role grant from a grantor no chain reaches costs nothing (0.13.17, 0.14 D3).
-      assert.strictEqual(node._gossipNewLane - node._gossipBuckets.get('peer-two-paths').tokens, 80, 'each spent one of the one budget');
+      // A role grant from a grantor no chain reaches costs nothing (0.13.17, 0.14 D3). The first 8
+      // statements for A that fail spend the one budget; past them this peer's statements for A are
+      // dropped unverified for the minute, spending nothing (final re-review, Finding 3).
+      assert.strictEqual(node._gossipNewLane - node._gossipBuckets.get('peer-two-paths').tokens, 8, 'each spent one of the one budget, until the signer was muted');
+      assert.strictEqual(node._relayMuted('peer-two-paths', A.id), true);
     });
   });
 
diff --git a/tests/role-chain-fetch.test.js b/tests/role-chain-fetch.test.js
index bd66c069..d8bff1f8 100644
--- a/tests/role-chain-fetch.test.js
+++ b/tests/role-chain-fetch.test.js
@@ -78,11 +78,8 @@ describe('a grant or revoke that arrives before its root is resolved by role-cha
         await until(() => N._roleGrants.size() === order.length, 3000);
         assert.strictEqual(N._roleGrants.size(), order.length, 'every record stored');
         assert.strictEqual(N.resolveRole(X.nodeId, Date.now(), { key: X.pub }), role);
-        // A record before its root, or (re-review N4: a revoke is bounded by the grants it clears) a
-        // non-anchor revoke before any grant to its grantee.
-        const early = order.some((k, i) => (k === 'VX' || k === 'rVX') && order.indexOf('AV') > i)
-          || (order.includes('rVX') && !order.slice(0, order.indexOf('rVX')).some((k) => k === 'VX' || k === 'AX'));
-        assert.strictEqual(N._chainStats.fetched > 0, early, 'a fetch only when a record came before its root, or a revoke before its grant');
+        const early = order.some((k, i) => (k === 'VX' || k === 'rVX') && order.indexOf('AV') > i);
+        assert.strictEqual(N._chainStats.fetched > 0, early, 'a fetch only when a record came before the grant vouching its grantor\'s key');
       } finally { await stopAll(P, N); }
     });
   }
diff --git a/tests/role-grant-store.test.js b/tests/role-grant-store.test.js
index 756b4df7..469d682a 100644
--- a/tests/role-grant-store.test.js
+++ b/tests/role-grant-store.test.js
@@ -122,15 +122,19 @@ describe('RoleGrantStore — revocation actually contains a compromised grantor'
     const st = storeWith(A, [B, X]);
     st.record(grant('role-grant', B, 'validator', A, T));
     st.record(grant('role-revoke', B, undefined, A, T + 300));
-    // Dated before B's cutoff (here the revoke's own time), the grant is a statement that stands and is
-    // kept (re-review N2: whenever it arrives); it confers nothing while B is revoked (the cascade).
+    // Dated before B's cutoff (here the revoke's own time), the grant is kept (verifiable); it confers
+    // nothing while B is revoked.
     assert.strictEqual(st.record(grant('role-grant', X, 'validator', B, T + 100)).stored, true);
     assert.strictEqual(st.resolveRole(X.nodeId, T + 500), 'participant', 'it confers nothing — backdating cannot bypass revocation');
-    // A revoke whose cutoff reaches back over B's window: a grant B dated inside it is not even kept.
+    assert.strictEqual(st.resolveRole(X.nodeId, T + 150), 'participant', 'and not back then either: B no longer holds rank and nothing ratified it (final re-review ruling B)');
+    // A revoke whose cutoff reaches back over B's window: a grant B dated inside it never counts,
+    // even if ratified.
     const st2 = storeWith(A, [B, X]);
     st2.record(grant('role-grant', B, 'validator', A, T));
-    st2.record(grant('role-revoke', B, undefined, A, T + 300, { cutoff: T + 50 }));
-    assert.deepStrictEqual(st2.record(grant('role-grant', X, 'validator', B, T + 100)), { stored: false, reason: 'unrooted' }, 'signed after B\'s cutoff');
+    const late = grant('role-grant', X, 'validator', B, T + 100);
+    st2.record(grant('role-revoke', B, undefined, A, T + 300, { cutoff: T + 50, ratify: [late.sig] }));
+    assert.strictEqual(st2.record(late).stored, true, 'kept: verifiable');
+    assert.strictEqual(st2.resolveRole(X.nodeId, T + 500), 'participant', 'signed after B\'s cutoff');
   });
 
   it('revoking a grantor cascades to everything it granted', () => {

From 914d26406a5bbbb166cf31f22ba57a6ae49ad1b8 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Wed, 7 Oct 2026 21:41:56 +0100
Subject: [PATCH 109/148] delivery: a record is surfaced once for the life of
 the store, and an inbox id is assigned only once durable, never reused, never
 evicted unread

The founder's bug report (via agent-b): after a hot-swap or a reconnect, records already read came
back as new deliveries with new ids (the receive dedup was a TTL cache flushed every 5 s, so it did
not outlive the instance); and inbox ids were reused (the inbox was a snapshot written at most once
a second, so a process that ended after announcing an id lost the item and the next instance
announced the id for another record; the ring could also evict an unread item).

- A delivery ledger (cmbs/.delivered-marks, append-only, written before the delivery is announced)
  keys every surfaced record by author and incoming key (the CMB key; a directed record's also its
  assertion), so nothing is surfaced twice for the life of the store, by any instance or transport.
- Every inbox change (delivery, drain, ack) is journalled (inbox.log) before it takes effect and
  folded into inbox.json; an id is assigned only after its item is written.
- Only read items are evicted; past 4 x the ring of unread items a delivery gets no id (counted).
- One owner per inbox in a process: an older instance of the identity assigns no ids and writes
  nothing, so a fetch reads the inbox the announcement came from.

Tests: tests/delivery-ledger.test.js (each fails on 6510bac). Reproduced on 0.13.17 and on 6510bac.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QRVMpaJkAA2fFbvuHCEzqH
---
 CHANGELOG.md                              |  22 +++
 lib/frame-handler.js                      |  58 ++++++-
 lib/node.js                               | 165 ++++++++++++++------
 tests/delivery-ledger.test.js             | 177 ++++++++++++++++++++++
 tests/inbox-holder-accountability.test.js |  33 ++--
 5 files changed, 385 insertions(+), 70 deletions(-)
 create mode 100644 tests/delivery-ledger.test.js

diff --git a/CHANGELOG.md b/CHANGELOG.md
index bf6cc658..a707fa3c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,28 @@ key bindings (a lockout anyone on the LAN could fill) by the binding lifetime be
 in-memory pending set for grants that arrive before their root (which could be flooded) by
 `role-chain-fetch`.
 
+### Redelivery and inbox ids (founder's bug report, 2026-10)
+
+- **A delivery is surfaced once for the life of the store.** After a hot-swap (a new SymNode for the
+  same identity, as mesh-channel's `sym_join_room` builds) or a reconnect, records already received
+  and read came back as new deliveries with new inbox ids: the receive dedup was a TTL cache written
+  to disk at most every 5 s, so it did not outlive the instance. A delivery ledger
+  (`cmbs/.delivered-marks`, append-only, written before the delivery is announced) now keys every
+  surfaced record by its author and incoming key (the CMB key; for a directed record also its
+  assertion, so a new assertion of the same words is still a new delivery), and nothing in it is
+  surfaced again, by any instance or transport.
+- **An inbox id is assigned only once the item is durably in the inbox, and is never reused.** The
+  inbox was a snapshot written at most once a second, so a process that ended after announcing an id
+  lost the item ("not found") and the next instance announced the same id for another record. Every
+  inbox change (a delivery, a drain, an ack) is now appended to `inbox.log` before it takes effect,
+  and folded into `inbox.json` on start and on each snapshot.
+- **An unread item is never evicted.** The ring dropped its oldest item whatever it was; it now drops
+  only read ones, and past 4 x the ring of unread items a new delivery gets no id (counted,
+  `inbox-full-refused`, and said).
+- **One owner per inbox in a process.** A node built for an identity while another instance of it is
+  alive owns the inbox; the older assigns no ids and writes nothing, so a fetch reads the inbox the
+  announcement came from.
+
 ### The final re-review of f0d936a (BLOCK) — what changed
 
 The founder ruled three design changes; each is made where its assumption was, and the rule is in
diff --git a/lib/frame-handler.js b/lib/frame-handler.js
index 42a92543..74c0aa6b 100644
--- a/lib/frame-handler.js
+++ b/lib/frame-handler.js
@@ -183,6 +183,35 @@ class FrameHandler {
     this._seenKeysPath = null;
     this._seenFlushAt = 0;
     this._loadSeenCmbKeys();
+    // THE DELIVERY LEDGER (redelivery bug, 2026-10): a record surfaced to this identity, keyed by its
+    // author and its incoming key (the CMB key, and for a directed record its assertion mark), is
+    // surfaced once for the life of the store, whatever transport or node instance brings it again.
+    // The TTL cache above only converges a replay storm; it was throttled to disk every 5 s and
+    // capped, so a hot-swap or a restart soon after a read, or an old enough record, surfaced again
+    // as a new delivery. The ledger is append-only and written before the delivery is announced.
+    this._ledgerPath = null;
+    this._ledger = new Set();
+    this._loadLedger();
+  }
+
+  /** @private Read the delivery ledger (one mark per line). Best-effort: a missing file is empty. */
+  _loadLedger() {
+    try {
+      const dir = this._node && this._node._store && this._node._store._dir;
+      if (!dir) return;
+      this._ledgerPath = path.join(dir, '.delivered-marks');
+      const text = fs.readFileSync(this._ledgerPath, 'utf8');
+      for (const line of text.split('\n')) if (line) this._ledger.add(line);
+    } catch { /* none yet */ }
+  }
+
+  /** @private The ledger mark of a delivery: its author and its incoming key. */
+  _ledgerMark(msg, key) {
+    if (!key) return null;
+    const author = msg && msg._cmbVerified === true && msg._verifiedAuthorNodeId
+      ? msg._verifiedAuthorNodeId
+      : `unverified:${(msg && (msg._legacyRoutedNodeId || msg._fromPeerId)) || 'unknown'}`;
+    return `${author}|${key}`;
   }
 
   /** Hydrate the receive-path dedup cache from disk (TTL-pruned). Best-effort. */
@@ -275,9 +304,16 @@ class FrameHandler {
     return true;
   }
 
-  _markCmbSurfaced(key) {
+  _markCmbSurfaced(key, msg) {
     if (!key) return;
     this._recordSeenCmbKey(key, Date.now());
+    // Written before the delivery is announced (the caller surfaces it next): a crash between the two
+    // loses nothing a later copy cannot bring, and nothing surfaced is surfaced twice.
+    const mark = this._ledgerMark(msg, key);
+    if (mark && !this._ledger.has(mark)) {
+      this._ledger.add(mark);
+      if (this._ledgerPath) { try { fs.appendFileSync(this._ledgerPath, `${mark}\n`, { mode: 0o600 }); } catch { /* the in-memory mark still holds for this instance */ } }
+    }
   }
 
   /**
@@ -565,7 +601,7 @@ class FrameHandler {
       decision: decision || 'rejected',
     }, msg);
     this._node._log(`Directed CMB from ${peerName} (peer-bound, MMP §4.4.4) — SVAF ${decision || 'rejected'} for memory; surfacing to agent anyway (remixed:false)`);
-    this._markCmbSurfaced(msg._incomingKey);
+    this._markCmbSurfaced(msg._incomingKey, msg);
     this._node._emitAccepted(entry);
     return true;
   }
@@ -1095,6 +1131,14 @@ class FrameHandler {
       ? `${cognitionKey}#${mark}`
       : cognitionKey;
     if (incomingKey) {
+      // Surfaced to this identity before, by any instance or transport: never again.
+      const ledgerMark = this._ledgerMark({ ...msg, _fromPeerId: peerId }, incomingKey);
+      if (ledgerMark && this._ledger.has(ledgerMark)) {
+        this._node.emit('metric', { type: 'cmb-already-delivered', from: peerName, key: cognitionKey });
+        this._node._log(`Duplicate CMB ${String(incomingKey).slice(0, 16)} from ${peerName} — already delivered to this node, skipping`);
+        return;
+      }
+      msg._fromPeerId = peerId;
       const lastSeen = this._seenKeysFor(incomingKey).get(incomingKey);
       if (lastSeen !== undefined && (now - lastSeen) < SEEN_CMB_TTL_MS) {
         this._seenKeysFor(incomingKey).set(incomingKey, now); // refresh recency
@@ -1149,7 +1193,7 @@ class FrameHandler {
     // memory, as a message frame never was.
     if (msg._directedToMe && verified && app && app.schema === MESSAGE_SCHEMA && app.mediaType === 'text/plain' && typeof app.data === 'string') {
       const text = Buffer.from(app.data, 'base64url').toString('utf8');
-      this._markCmbSurfaced(msg._incomingKey);
+      this._markCmbSurfaced(msg._incomingKey, msg);
       this._node._log(`Message from ${msg.author.name}: ${text.slice(0, 60)}`);
       this._node.emit('message', msg.author.name, text, Object.freeze({ from: msg.author.nodeId, fromName: msg.author.name, content: text, timestamp: meta.createdTimestamp, key: cognitionKey, assertionId: meta.assertionId, via: peerId }));
       return undefined;
@@ -1197,7 +1241,7 @@ class FrameHandler {
         remixed: false, // CLI-host forwards only — it does not ingest/remix
       };
       this._node._log(`CLI-host: forwarding CMB from ${peerName} (no store): "${msg.content.slice(0, 50)}"`);
-      this._markCmbSurfaced(msg._incomingKey);
+      this._markCmbSurfaced(msg._incomingKey, msg);
       this._node._emitAccepted(this._markProvenance(entry, msg));
       return;
     }
@@ -1421,7 +1465,7 @@ class FrameHandler {
 
     const gateLog = Object.entries(gate_values || {}).map(([k,v]) => `${k}:${v.toFixed(2)}`).join(' ');
     this._node._log(`SVAF neural ${decision} from ${peerName}: "${(msg.content || '').slice(0, 50)}" drift:${total_drift?.toFixed(3)} gate:[${gateLog}]`);
-    this._markCmbSurfaced(msg._incomingKey);
+    this._markCmbSurfaced(msg._incomingKey, msg);
     this._node.emit('memory-received', { from: peerName, entry: fusedEntry, decision });
   }
 
@@ -1549,7 +1593,7 @@ class FrameHandler {
     }
 
     this._node._log(`SVAF heuristic ${result.decision} from ${peerName}: "${result.fusedContent.slice(0, 50)}" drift:${result.totalDrift.toFixed(3)}`);
-    this._markCmbSurfaced(msg._incomingKey);
+    this._markCmbSurfaced(msg._incomingKey, msg);
     this._node.emit('memory-received', { from: peerName, entry: result.fusedEntry, decision: result.decision });
   }
 
@@ -1733,7 +1777,7 @@ class FrameHandler {
     // identical re-send (reconnect anchor replay) will converge rather than
     // re-deliver the same affect.
     this._node._log(`Mood extracted from rejected CMB (${peerName}): "${moodText}"`);
-    this._markCmbSurfaced(msg._incomingKey);
+    this._markCmbSurfaced(msg._incomingKey, msg);
     const md = msg.cmb?.metadata || {};
     const verified = msg._cmbVerified === true;
     this._node.emit('mood-delivered', Object.freeze({
diff --git a/lib/node.js b/lib/node.js
index ca21c1d4..3f025982 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -170,6 +170,13 @@ const nfcRoom = (r) => (typeof r === 'string' ? r.normalize('NFC') : r);
  */
 const RELAY_FAILURES_MAX = 8;
 const RELAY_FAILURE_WINDOW_MS = 60_000;
+/**
+ * Unread inbox items the node holds at most, as a multiple of the ring size: an unread item is never
+ * evicted, and past this a new delivery gets no inbox id (it is counted and said).
+ */
+const INBOX_UNREAD_FACTOR = 4;
+/** inbox file -> the SymNode in this process that owns it (see the constructor). */
+const INBOX_OWNERS = new Map();
 /** A peer that delivered a forged signature is not admitted again for this long (security review D). */
 const FORGERY_PENALTY_MS = 60_000;
 /** role-chain-fetch (design D3): records held per session while their chain is fetched, and for how long. */
@@ -630,6 +637,17 @@ class SymNode extends EventEmitter {
     // together: messages without the cursor would replay what was already
     // drained; the cursor without messages would silently skip the backlog.
     this._inboxFile = path.join(this._dir, 'inbox.json');
+    // THE INBOX JOURNAL (inbox-id bug, 2026-10): every inbox change is appended here before it takes
+    // effect — a delivery before its id is announced, a drain, an ack — and `inbox.json` is a
+    // snapshot the journal is folded into. The snapshot alone was written at most once a second, so a
+    // process that ended between a delivery and its write lost the delivery while its id had been
+    // announced, and the next instance announced the same id for another record.
+    this._inboxJournal = path.join(this._dir, 'inbox.log');
+    // One owner per inbox in this process: the newest node built for the identity (a hot-swap builds
+    // the next before the last may have stopped). A node that is no longer the owner assigns no id and
+    // writes nothing, so two instances never number deliveries apart, and a fetch reads the inbox the
+    // announcement came from.
+    INBOX_OWNERS.set(this._inboxFile, this);
     this._loadInbox();
     this.on('cmb-accepted', (entry) => this._pushInbox(entry));
     // The CMB store dir is `cmbs/`. The immediately-prior name was `meshmem/`
@@ -2494,6 +2512,7 @@ class SymNode extends EventEmitter {
       this._inboxPersistTimer = null;
       this._writeInbox();
     }
+    if (INBOX_OWNERS.get(this._inboxFile) === this) { this._writeInbox(); INBOX_OWNERS.delete(this._inboxFile); }
 
     this._relay.destroy();
     this._legacy.stop();
@@ -2563,6 +2582,35 @@ class SymNode extends EventEmitter {
    *  what arrived before the restart instead of losing it. Best-effort: a
    *  missing or corrupt file starts empty, exactly like the old behavior. */
   _loadInbox() {
+    this._loadInboxSnapshot();
+    // Fold the journal in: what was appended after the last snapshot (deliveries, drains, acks).
+    let lines = [];
+    try { lines = fs.readFileSync(this._inboxJournal, 'utf8').split('\n'); } catch { /* none */ }
+    let folded = 0;
+    const bySeq = new Map(this._inbox.map((m) => [m.seq, m]));
+    for (const line of lines) {
+      if (!line) continue;
+      let o;
+      try { o = JSON.parse(line); } catch { continue; } // a torn last line: its change never took effect
+      folded++;
+      if (o && o.e && Number.isSafeInteger(o.e.seq) && typeof o.e.id === 'string') {
+        if (o.e.seq > this._inboxSeq) this._inboxSeq = o.e.seq;
+        if (!bySeq.has(o.e.seq)) { bySeq.set(o.e.seq, o.e); this._inbox.push(o.e); }
+      } else if (o && typeof o.ack === 'string') {
+        const m = this._inbox.find((x) => x.id === o.ack);
+        if (m) m.acked = true;
+      } else if (o && Number.isSafeInteger(o.cursor)) {
+        if (o.cursor > this._inboxCursor) this._inboxCursor = o.cursor;
+      } else if (o && Number.isSafeInteger(o.seq)) {
+        if (o.seq > this._inboxSeq) this._inboxSeq = o.seq; // a seq taken whose entry was refused
+      }
+    }
+    this._inbox.sort((a, b) => a.seq - b.seq);
+    if (folded) this._writeInbox(); // folded into a new snapshot; the journal starts empty
+  }
+
+  /** @private Read the snapshot (inbox.json). */
+  _loadInboxSnapshot() {
     try {
       const d = JSON.parse(fs.readFileSync(this._inboxFile, 'utf8'));
       if (Number.isSafeInteger(d.seq)) this._inboxSeq = d.seq;
@@ -2600,13 +2648,20 @@ class SymNode extends EventEmitter {
     if (this._inboxPersistTimer.unref) this._inboxPersistTimer.unref();
   }
 
-  /** @private Write ring + seq + cursor now. */
+  /**
+   * @private Write ring + seq + cursor now, as a snapshot (written whole, then renamed into place),
+   * and empty the journal it now holds. Nothing runs between the two, so no journalled change is lost.
+   */
   _writeInbox() {
+    if (INBOX_OWNERS.get(this._inboxFile) !== this) return; // a newer node owns it (see the constructor)
     try {
-      fs.writeFileSync(this._inboxFile, JSON.stringify({
+      const tmp = `${this._inboxFile}.${process.pid}.tmp`;
+      fs.writeFileSync(tmp, JSON.stringify({
         seq: this._inboxSeq, cursor: this._inboxCursor, messages: this._inbox,
-      }));
-    } catch { /* best-effort */ }
+      }), { mode: 0o600 });
+      fs.renameSync(tmp, this._inboxFile);
+      try { fs.truncateSync(this._inboxJournal, 0); } catch { /* none yet */ }
+    } catch { /* best-effort: the journal still holds every change */ }
   }
 
   /**
@@ -2623,13 +2678,24 @@ class SymNode extends EventEmitter {
   _pushInbox(entry) {
     if (!entry) return;
     const cmb = entry.cmb || {};
-    const seq = ++this._inboxSeq;
+    if (INBOX_OWNERS.get(this._inboxFile) !== this) {
+      this._sayOncePerMinute('inbox-not-owner', 'A newer node for this identity owns its inbox in this process: a delivery to this one is not put in the inbox');
+      return;
+    }
+    // An unread item is never evicted (inbox-id bug, 2026-10): an id announced and not yet read always
+    // fetches its record. Past INBOX_UNREAD_MAX unread items a delivery gets no id at all (it is not
+    // announced), and that is counted and said, instead of discarding an announced one.
+    this._evictRead();
+    const unread = this._inbox.reduce((n, m) => n + (m.seq > this._inboxCursor && !m.acked ? 1 : 0), 0);
+    if (unread >= this._inboxMax * INBOX_UNREAD_FACTOR) {
+      this._metrics.inboxDropped = (this._metrics.inboxDropped ?? 0) + 1;
+      this._sayOncePerMinute('inbox-full', `INBOX FULL — ${unread} unread deliveries and nothing draining this node: a new delivery is not put in the inbox (its record is still in memory if it was admitted)`);
+      this.emit('metric', { type: 'inbox-full-refused', key: recordKey(cmb) || entry.key || null, directed: !!entry.directed });
+      return;
+    }
+    const seq = this._inboxSeq + 1;
     const id = `in${String(seq).padStart(4, '0')}`;
-    // Later 'cmb-accepted' listeners (a channel's push path) read these to refer to the same
-    // delivery by the same id instead of minting a second one.
-    entry.inboxId = id;
-    entry.inboxSeq = seq;
-    this._inbox.push({
+    const item = {
       seq,
       id,
       // A display label: the author's when its signature proved who wrote it, otherwise the peer that
@@ -2660,43 +2726,47 @@ class SymNode extends EventEmitter {
       record: entry.verified === true ? projectionOrNull(cmb) : null,
       key: recordKey(cmb) || entry.key || null,
       receivedAt: Date.now(),
-    });
-    // The ring evicts oldest-first. Eviction is free for a message that has
-    // already been DRAINED — the session has it, the buffer is just recycling.
-    // Evicting an UNDRAINED message is data loss: nobody has ever read it and
-    // nothing will ever hand it over again. The two were indistinguishable
-    // here, so a node that nothing pulls from silently shreds its own backlog
-    // once it passes _inboxMax.
-    //
-    // Not hypothetical: sym-daemon-mac was measured at seq=96 with cursor=0 —
-    // 96 messages, never drained once, still accumulating. At 500 it would
-    // have begun discarding directed CMBs, oldest first, in silence.
-    //
-    // Because the cursor advances in seq order, the oldest entry is drained
-    // whenever anything is, so this test needs no reordering: if the head is
-    // undrained then the whole ring is, and that is exactly the loss case.
-    while (this._inbox.length > this._inboxMax) {
-      const oldest = this._inbox[0];
-      if (oldest && oldest.seq > this._inboxCursor && oldest.acked) {
-        // Read in full (inboxAck) but never drained: not lost, still counted.
-        this._metrics.inboxAckedEvicted = (this._metrics.inboxAckedEvicted ?? 0) + 1;
-      } else if (oldest && oldest.seq > this._inboxCursor) {
-        this._metrics.inboxDropped = (this._metrics.inboxDropped ?? 0) + 1;
-        this._log(
-          `INBOX OVERFLOW — DISCARDING UNDRAINED ${oldest.id}${oldest.directed ? ' (DIRECTED)' : ''} ` +
-          `from ${oldest.from}: ring full at ${this._inboxMax} and the cursor is at ${this._inboxCursor}. ` +
-          `Nothing is draining this node.`,
-        );
-        this.emit('metric', {
-          type: 'inbox-overflow-dropped',
-          id: oldest.id, from: oldest.from, directed: !!oldest.directed, key: oldest.key,
-        });
-      }
-      this._inbox.shift();
+    };
+    // The id is assigned only once the item is durably in the inbox: journalled first. A write that
+    // fails assigns nothing, so nothing is announced that a fetch could not find.
+    if (!this._journalInbox({ e: item })) {
+      this._log(`Inbox write failed: a delivery from ${item.from} was not put in the inbox`);
+      this.emit('metric', { type: 'inbox-write-failed', key: item.key });
+      return;
     }
+    this._inboxSeq = seq;
+    this._inbox.push(item);
+    // Later 'cmb-accepted' listeners (a channel's push path) read these to refer to the same
+    // delivery by the same id instead of minting a second one.
+    entry.inboxId = id;
+    entry.inboxSeq = seq;
     this._persistInbox();
   }
 
+  /** @private Append one inbox change to the journal, synchronously. @returns {boolean} written */
+  _journalInbox(change) {
+    if (INBOX_OWNERS.get(this._inboxFile) !== this) return false;
+    try { fs.appendFileSync(this._inboxJournal, JSON.stringify(change) + '\n', { mode: 0o600 }); return true; }
+    catch { return false; }
+  }
+
+  /**
+   * @private Evict read items (drained or acked) past the ring's size, oldest first; never an unread
+   * one. (Until the inbox-id fix the ring evicted the oldest item whatever it was, so an announced,
+   * unread delivery could vanish: "not found" for an id the host had just been shown.)
+   */
+  _evictRead() {
+    if (this._inbox.length < this._inboxMax) return;
+    const keep = [];
+    let excess = this._inbox.length - this._inboxMax + 1;
+    for (const m of this._inbox) {
+      const read = m.seq <= this._inboxCursor || m.acked;
+      if (excess > 0 && read) { excess--; if (m.acked && m.seq > this._inboxCursor) this._metrics.inboxAckedEvicted = (this._metrics.inboxAckedEvicted ?? 0) + 1; continue; }
+      keep.push(m);
+    }
+    this._inbox = keep;
+  }
+
   /**
    * What this node is HOLDING for whoever pulls from it. A node is a terminus
    * the moment nothing drains it, and until now that state was invisible: the
@@ -2757,9 +2827,11 @@ class SymNode extends EventEmitter {
       slice.push(m);
       lastSeq = m.seq;
     }
-    if (!opts.peek && lastSeq !== null) {
-      this._inboxCursor = Math.max(this._inboxCursor, lastSeq);
-      this._persistInbox(); // the drain moves the cursor — a restart must not replay it
+    if (!opts.peek && lastSeq !== null && lastSeq > this._inboxCursor) {
+      this._inboxCursor = lastSeq;
+      // Journalled now: a restart, or a node built for the same identity, must not replay what was read.
+      this._journalInbox({ cursor: lastSeq });
+      this._persistInbox();
     }
     return {
       messages: slice,
@@ -2781,6 +2853,7 @@ class SymNode extends EventEmitter {
     const m = this._inbox.find((x) => x.id === id);
     if (!m || m.acked) return false;
     m.acked = true;
+    this._journalInbox({ ack: m.id });
     this._persistInbox();
     return true;
   }
diff --git a/tests/delivery-ledger.test.js b/tests/delivery-ledger.test.js
new file mode 100644
index 00000000..418cc9fe
--- /dev/null
+++ b/tests/delivery-ledger.test.js
@@ -0,0 +1,177 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME before lib/config loads
+
+/**
+ * The redelivery and inbox-id bugs (founder, via agent-b, 2026-10; mesh-channel 0.10.1 on sym 0.13.16,
+ * and reproduced on 0.14.0 at 6510bac):
+ *
+ *   Bug 1: after a hot-swap (a new SymNode for the same identity) or a reconnect, CMBs already
+ *          received and read came back as new deliveries with new inbox ids. The dedup was a TTL
+ *          cache flushed to disk every 5 s, so it did not survive an instance.
+ *   Bug 2: inbox ids restarted when an instance ended between a delivery and the inbox's throttled
+ *          write: an announced id then fetched "not found", and the next instance announced it for
+ *          another record. An unread item could also be evicted by the ring.
+ *
+ * The rule (docs in node.js and frame-handler.js):
+ *   - a CMB delivered to a node identity, keyed by author and CMB key (and, directed, its assertion),
+ *     is surfaced once for the life of that identity's store, whatever transport or instance;
+ *   - an inbox id is assigned only once the record is durably in the inbox, is unique for the life of
+ *     the store, is never evicted while unread, and always fetches the record it announced;
+ *   - fetch reads the inbox the announcement came from (one owner per inbox in a process).
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const path = require('path');
+const { SymNode } = require('../lib/node');
+const { NullDiscovery } = require('../lib/discovery');
+const { nodeDirById } = require('../lib/config');
+const { connectNodes, until } = require('./_core-secure');
+
+const uniq = (b) => `${b}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+const cats = (focus) => ({ focus, issue: 'i', intent: 'inform', motivation: 'm', commitment: 'c', perspective: 'p', mood: { text: 'calm' } });
+const aligned = (n) => { n._svafEvaluator.evaluate = async () => ({ decision: 'aligned', total_drift: 0.1, category_drifts: { focus: 0.1 }, gate_values: { g: 1 } }); return n; };
+const text = (m) => (m && m.record && m.record.categories && m.record.categories.focus && m.record.categories.focus.text) || null;
+const settle = (ms = 300) => new Promise((r) => setTimeout(r, ms));
+async function stopAll(...nodes) {
+  for (const n of nodes) { try { await n.stop(); } catch { /* */ } }
+  for (const n of nodes) { try { fs.rmSync(nodeDirById(n.nodeId), { recursive: true, force: true }); } catch { /* */ } }
+}
+/** The process ends without stop(): its timers never fire and its lock goes with it. */
+function crash(node) {
+  clearTimeout(node._inboxPersistTimer); node._inboxPersistTimer = null;
+  if (node._releaseIdentityLock) { node._releaseIdentityLock(); node._releaseIdentityLock = null; }
+  for (const s of [...node._sessions]) { try { s.close('crash', { notify: false }); } catch { /* */ } }
+  node._running = false;
+}
+
+describe('delivery ledger and inbox ids (redelivery and id-reuse bugs)', () => {
+  it('a record already delivered and read is not delivered again after a hot-swap and a re-push (Bug 1)', async () => {
+    const name = uniq('swap-b');
+    const P = new SymNode({ name: uniq('swap-p'), silent: true, discovery: new NullDiscovery(), room: 'r' });
+    let B = aligned(new SymNode({ name, silent: true, discovery: new NullDiscovery(), room: 'r' }));
+    const nodeId = B.nodeId;
+    try {
+      await P.start(); await B.start();
+      await connectNodes(P, B);
+      const bc = P.remember(cats('a broadcast, read before the swap'));
+      const dr = P.remember(cats('a directed record, read before the swap'), { to: B.nodeId });
+      await until(() => B.inboxStatus().seq >= 2, 3000);
+      assert.strictEqual(B.inbox({ limit: 10 }).messages.length, 2, 'both delivered, and read');
+      // The swap, at once (inside the old dedup cache's 5 s flush), then the same records again.
+      await B.stop();
+      B = aligned(new SymNode({ name, nodeId, create: false, silent: true, discovery: new NullDiscovery(), room: 'r' }));
+      const hooked = [];
+      B.on('verified-record', (e) => hooked.push(e));
+      await B.start();
+      await connectNodes(P, B);
+      const s = P._peers.get(B.nodeId).transport;
+      s.trySend({ type: 'cmb', cmb: bc.cmb }); s.trySend({ type: 'cmb', cmb: dr.cmb });
+      await settle(500);
+      assert.deepStrictEqual(B.inbox({ peek: true }).messages.map((m) => m.id), [], 'nothing comes back as unread');
+      assert.strictEqual(B.inboxStatus().seq, 2, 'no new inbox id');
+      assert.strictEqual(hooked.length, 0, 'and the host hook is not raised again');
+      // A new assertion of the same words, directed, is a new delivery (re-review F9 stands).
+      P.remember(cats('a directed record, read before the swap'), { to: B.nodeId });
+      await until(() => B.inboxStatus().seq >= 3, 3000);
+      assert.strictEqual(B.inboxStatus().seq, 3);
+    } finally { await stopAll(B, P); }
+  });
+
+  it('an announced id survives the process ending at once, and is never announced for another record (Bug 2)', async () => {
+    const name = uniq('crash-b');
+    const P = new SymNode({ name: uniq('crash-p'), silent: true, discovery: new NullDiscovery(), room: 'r' });
+    const Q = new SymNode({ name: uniq('crash-q'), silent: true, discovery: new NullDiscovery(), room: 'r' });
+    let B = aligned(new SymNode({ name, silent: true, discovery: new NullDiscovery(), room: 'r' }));
+    const nodeId = B.nodeId;
+    try {
+      await P.start(); await Q.start(); await B.start();
+      await connectNodes(P, B); await connectNodes(Q, B);
+      const announced = new Map();
+      B.on('cmb-accepted', (e) => announced.set(e.inboxId, e.cmb.categories.focus.text));
+      // Two concurrent pushes from two authors, and a duplicate re-push of the first.
+      const pr = P.remember(cats('from P, concurrently'), { to: B.nodeId });
+      Q.remember(cats('from Q, concurrently'), { to: B.nodeId });
+      P._peers.get(B.nodeId).transport.trySend({ type: 'cmb', cmb: pr.cmb });
+      await until(() => announced.size >= 2, 3000);
+      await settle(200);
+      assert.strictEqual(announced.size, 2, 'the duplicate got no id of its own');
+      for (const [id, t] of announced) assert.strictEqual(text(B.inboxGet(id)), t, `${id} fetches its own record`);
+      crash(B);
+      B = aligned(new SymNode({ name, nodeId, create: false, silent: true, discovery: new NullDiscovery(), room: 'r' }));
+      await B.start();
+      for (const [id, t] of announced) assert.strictEqual(text(B.inboxGet(id)), t, `${id} still fetches its record after the process ended`);
+      await connectNodes(Q, B);
+      const next = [];
+      B.on('cmb-accepted', (e) => next.push(e.inboxId));
+      Q.remember(cats('from Q, after the restart'), { to: B.nodeId });
+      await until(() => next.length >= 1, 3000);
+      assert.ok(!announced.has(next[0]), `the next delivery gets a new id (${next[0]}), never one already announced`);
+      for (const [id, t] of announced) assert.strictEqual(text(B.inboxGet(id)), t, `${id} is still its own record`);
+    } finally { await stopAll(B, P, Q); }
+  });
+
+  it('a delivery already read stays read after the process ends at once (the drain is journalled)', async () => {
+    const name = uniq('drain-b');
+    const P = new SymNode({ name: uniq('drain-p'), silent: true, discovery: new NullDiscovery(), room: 'r' });
+    let B = aligned(new SymNode({ name, silent: true, discovery: new NullDiscovery(), room: 'r' }));
+    const nodeId = B.nodeId;
+    try {
+      await P.start(); await B.start();
+      await connectNodes(P, B);
+      P.remember(cats('read, then the process ends'), { to: B.nodeId });
+      await until(() => B.inboxStatus().seq >= 1, 3000);
+      assert.strictEqual(B.inbox().messages.length, 1);
+      const acked = P.remember(cats('acked by id, then the process ends'), { to: B.nodeId });
+      void acked;
+      await until(() => B.inboxStatus().seq >= 2, 3000);
+      B.inboxAck('in0002');
+      crash(B);
+      B = new SymNode({ name, nodeId, create: false, silent: true, discovery: new NullDiscovery(), room: 'r' });
+      assert.strictEqual(B.inboxStatus().cursor, 1, 'the drain held');
+      assert.strictEqual(B.inboxGet('in0002').acked, true, 'and the ack');
+      assert.strictEqual(B.inboxStatus().undrained, 0);
+    } finally { await stopAll(B, P); }
+  });
+
+  it('two instances of one identity in one process: only the newer assigns ids and writes; the older writes nothing', async () => {
+    const name = uniq('two-b');
+    const old = new SymNode({ name, silent: true, discovery: new NullDiscovery(), room: 'r' });
+    await old.start();
+    const e1 = { cmb: { categories: { focus: { text: 'one' } } }, content: 'one' };
+    old.emit('cmb-accepted', e1);
+    assert.strictEqual(e1.inboxId, 'in0001');
+    const newer = new SymNode({ name, nodeId: old.nodeId, create: false, silent: true, discovery: new NullDiscovery(), room: 'r' });
+    const e2 = { cmb: { categories: { focus: { text: 'two' } } }, content: 'two' };
+    old.emit('cmb-accepted', e2);
+    assert.strictEqual(e2.inboxId, undefined, 'the older instance announces nothing');
+    const e3 = { cmb: { categories: { focus: { text: 'three' } } }, content: 'three' };
+    newer.emit('cmb-accepted', e3);
+    assert.strictEqual(e3.inboxId, 'in0002', 'the newer numbers on from what the older made durable');
+    // The newer's own snapshot never comes (it ends at once); the older's throttled one comes due.
+    clearTimeout(newer._inboxPersistTimer); newer._inboxPersistTimer = null;
+    await new Promise((r) => setTimeout(r, 1100));
+    await old.stop();
+    const again = new SymNode({ name, nodeId: old.nodeId, create: false, silent: true, discovery: new NullDiscovery(), room: 'r' });
+    assert.strictEqual(again.inboxGet('in0002').content, 'three', 'the older instance\'s stop did not overwrite the newer\'s inbox');
+    await stopAll(newer, again);
+  });
+
+  it('a torn last journal line is ignored: its change never took effect', () => {
+    const name = uniq('torn-b');
+    const n = new SymNode({ name, silent: true, discovery: new NullDiscovery(), room: 'r' });
+    const e = { cmb: { categories: { focus: { text: 'kept' } } }, content: 'kept' };
+    n.emit('cmb-accepted', e);
+    fs.appendFileSync(path.join(n._dir, 'inbox.log'), '{"e":{"seq":2,"id":"in0002"');
+    clearTimeout(n._inboxPersistTimer);
+    if (n._releaseIdentityLock) n._releaseIdentityLock();
+    const m = new SymNode({ name, nodeId: n.nodeId, create: false, silent: true, discovery: new NullDiscovery(), room: 'r' });
+    try {
+      assert.strictEqual(m.inboxGet('in0001').content, 'kept');
+      assert.strictEqual(m.inboxGet('in0002'), null);
+      assert.strictEqual(m.inboxStatus().seq, 1);
+    } finally { fs.rmSync(nodeDirById(n.nodeId), { recursive: true, force: true }); }
+  });
+});
diff --git a/tests/inbox-holder-accountability.test.js b/tests/inbox-holder-accountability.test.js
index d55dc2bb..241256a9 100644
--- a/tests/inbox-holder-accountability.test.js
+++ b/tests/inbox-holder-accountability.test.js
@@ -94,25 +94,24 @@ describe('inbox holder accountability (bl-a6e63608c8c, receiver half)', () => {
     });
   });
 
-  it('NEVER discards an undrained message silently when the ring overflows', async () => {
-    // A tiny ring makes the overflow reachable in a test; the semantics under
-    // test are the same ones that apply at the shipped _inboxMax.
+  it('NEVER discards an undrained message: past the unread bound a new delivery gets no id, and that is counted (inbox-id bug, 2026-10)', async () => {
+    // A tiny ring makes the bound reachable in a test; the semantics under test are the same ones that
+    // apply at the shipped _inboxMax. An announced, unread id must always fetch its record, so unread
+    // items are never evicted; past 4 x the ring, a new delivery is refused an id instead.
     await withNode('holder-overflow', async (node) => {
-      const dropped = [];
-      node.on('metric', (m) => { if (m.type === 'inbox-overflow-dropped') dropped.push(m); });
-
-      // Fill past the ring with nothing draining — the live sym-daemon-mac shape.
-      for (let i = 0; i < 5; i++) {
-        node.emit('cmb-accepted', arrival(`undrained ${i}`, { directed: i < 2 }));
+      const refused = [];
+      node.on('metric', (m) => { if (m.type === 'inbox-full-refused' || m.type === 'inbox-overflow-dropped') refused.push(m); });
+      const ids = [];
+      for (let i = 0; i < 14; i++) {
+        const e = arrival(`undrained ${i}`, { directed: i < 2 });
+        node.emit('cmb-accepted', e);
+        if (e.inboxId) ids.push(e.inboxId);
       }
-
-      assert.ok(dropped.length >= 1, 'discarding unread mail must not be silent');
-      assert.strictEqual(
-        dropped[0].directed, true,
-        'the first casualties are the oldest, which here are the DIRECTED ones',
-      );
-      assert.strictEqual(node.inboxStatus().dropped, dropped.length,
-        'the count must be answerable after the fact, not only observable live');
+      assert.strictEqual(ids.length, 12, 'unread items are held up to 4 x the ring');
+      for (const id of ids) assert.ok(node.inboxGet(id), `${id} still fetches its record`);
+      assert.ok(node.inboxGet(ids[0]).directed, 'the oldest, directed, were not the casualties');
+      assert.deepStrictEqual(refused.map((m) => m.type), ['inbox-full-refused', 'inbox-full-refused'], 'the refusals are not silent');
+      assert.strictEqual(node.inboxStatus().dropped, 2, 'and answerable after the fact');
     }, { inboxMax: 3 });
   });
 

From 595a651c2388d7562d80f85882b38f03cfad81b6 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Wed, 7 Oct 2026 22:37:26 +0100
Subject: [PATCH 110/148] node.version for a host's status; hot-swap tested end
 to end over TCP and a relay

- node.version, status().version and the module's version: the package.json version loaded with the
  node, the string its hello announces (for mesh-channel's sym_status).
- tests/hot-swap.test.js: a host stops its node and builds the next for the same identity in the same
  room, four times, over TCP on the loopback and over a relay. Every round delivers and fetches the
  peer's new records by their announced ids, sends this node's own, redelivers nothing the peer
  re-pushes, keeps every earlier id fetching its record, and logs no null dereference. Fails on
  6510bac (redelivery after the swap); passes with the delivery ledger merged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QRVMpaJkAA2fFbvuHCEzqH
---
 CHANGELOG.md           |  11 ++++
 lib/node.js            |  11 +++-
 tests/hot-swap.test.js | 137 +++++++++++++++++++++++++++++++++++++++++
 3 files changed, 158 insertions(+), 1 deletion(-)
 create mode 100644 tests/hot-swap.test.js

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a707fa3c..2fee602f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,17 @@ key bindings (a lockout anyone on the LAN could fill) by the binding lifetime be
 in-memory pending set for grants that arrive before their root (which could be flooded) by
 `role-chain-fetch`.
 
+### The loaded version, and hot-swap
+
+- **`node.version`** (and `status().version`, and `require('@sym-bot/sym').version`) is the
+  `version` of the package.json loaded with the node: the string its hello announces as its
+  implementation, for a host's status line (mesh-channel's `sym_status`).
+- **Hot-swap is tested end to end** (`tests/hot-swap.test.js`): a host stops its node and builds the
+  next for the same identity in the same room, four times, over TCP on the loopback and over a relay.
+  Every round delivers and fetches the peer's new records by the ids announced, sends this node's
+  own, redelivers nothing the peer re-pushes, keeps every earlier id fetching its record, and logs no
+  null dereference (on 0.13 this broke as "Cannot read properties of null (reading 'close')").
+
 ### Redelivery and inbox ids (founder's bug report, 2026-10)
 
 - **A delivery is surfaced once for the life of the store.** After a hot-swap (a new SymNode for the
diff --git a/lib/node.js b/lib/node.js
index 3f025982..11b5cc32 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -3596,10 +3596,19 @@ class SymNode extends EventEmitter {
    *
    * @returns {{ name: string, nodeId: string, running: boolean, port: number, relay: string|null, relayConnected: boolean, peers: Array, peerCount: number, memoryCount: number, coherence: number }}
    */
+  /**
+   * The @sym-bot/sym version this node runs: the `version` of the package.json loaded with it (what a
+   * host such as mesh-channel's sym_status reports). The same string the node announces as its
+   * `implementation` in the §5.2 hello. Also `status().version` and `require('@sym-bot/sym').version`.
+   * @returns {string}
+   */
+  get version() { return ENGINE_VERSION; }
+
   status() {
     return {
       name: this.name,
       nodeId: this._identity.nodeId,
+      version: ENGINE_VERSION,
       running: this._running,
       port: this._port,
       relay: this._relayUrl || null,
@@ -4824,7 +4833,7 @@ function migrateStores(nodesRoot = path.join(require('./core/state-root').SYM_ST
   return migrated;
 }
 
-module.exports = { SymNode, migrateStores };
+module.exports = { SymNode, migrateStores, version: ENGINE_VERSION };
 
 // The room grammar is a CROSS-IMPLEMENTATION CONTRACT, not an internal detail: a room name
 // IS the Bonjour service type (§5.8), so every implementation that validates one must agree
diff --git a/tests/hot-swap.test.js b/tests/hot-swap.test.js
new file mode 100644
index 00000000..7f6b92e1
--- /dev/null
+++ b/tests/hot-swap.test.js
@@ -0,0 +1,137 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME before lib/config loads
+
+/**
+ * HOT-SWAP (mesh-channel's sym_join_room): the host stops its node and builds a new SymNode for the
+ * same identity (nodeId, create: false) in the same room, again and again. On 0.13 this broke as
+ * "Cannot read properties of null (reading 'close')" and redelivered what had been read under new
+ * inbox ids. Here, over a real TCP connection on the loopback (BonjourDiscovery without mDNS: the
+ * same-host registry finds the peer, and the lower nodeId dials) and over a relay, every round must:
+ *   - deliver the peer's new broadcast and directed record, each fetchable by the id it announced;
+ *   - send this node's own broadcast and directed record to the peer, without a throw;
+ *   - deliver nothing again that was read before (the peer re-pushes every earlier record);
+ *   - keep every inbox id announced so far fetching its own record, and never reuse one;
+ *   - log no null-dereference and raise no uncaught error.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const { SymNode } = require('../lib/node');
+const { BonjourDiscovery, NullDiscovery } = require('../lib/discovery');
+const { nodeDirById } = require('../lib/config');
+const { fakeRelay } = require('./_fake-relay');
+const { until } = require('./_core-secure');
+
+const uniq = (b) => `${b}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+const cats = (focus) => ({ focus, issue: 'i', intent: 'inform', motivation: 'm', commitment: 'c', perspective: 'p', mood: { text: 'calm' } });
+const TOKEN = 'x'.repeat(40);
+const ROUNDS = 4;
+const focusOf = (m) => (m && m.record && m.record.categories && m.record.categories.focus ? m.record.categories.focus.text : null);
+const confirmed = (n, other) => { const p = n._peers.get(other.nodeId); return !!(p && p.transport && p.transport.confirmed && !p.transport.closed); };
+
+/** Hot-swap `B` into the same room `rounds` times; `make(nodeId)` builds B (a new instance each time). */
+async function scene(t, { make, makePeer, cleanup = async () => {} }) {
+  const errors = [];
+  const onError = (e) => errors.push(e && e.stack ? e.stack : String(e));
+  process.on('uncaughtException', onError);
+  process.on('unhandledRejection', onError);
+  const logs = [];
+  const watch = (n) => { const log = n._log.bind(n); n._log = (m) => { logs.push(String(m)); log(m); }; return n; };
+  const aligned = (n) => { n._svafEvaluator.evaluate = async () => ({ decision: 'aligned', total_drift: 0.1, category_drifts: { focus: 0.1 }, gate_values: { g: 1 } }); return n; };
+  // B first, so its nodeId is the lower and it dials the peer at each start (§5.1 tie-break).
+  let B = watch(aligned(make(null)));
+  const nodeId = B.nodeId;
+  const P = watch(aligned(makePeer()));
+  const announced = new Map(); // inbox id -> the focus it announced
+  const sentByP = [];
+  const heardByP = [];
+  P.on('verified-record', (e) => heardByP.push(e.record.categories.focus.text));
+  try {
+    await B.start(); await P.start();
+    for (let round = 1; round <= ROUNDS; round++) {
+      if (round > 1) {
+        // sym_join_room: stop the node, build the next for the same identity, start it.
+        await B.stop();
+        B = watch(aligned(make(nodeId)));
+        await B.start();
+      }
+      const now = [];
+      B.on('cmb-accepted', (e) => { if (e.inboxId) now.push(e); });
+      await until(() => confirmed(B, P) && confirmed(P, B), 15000);
+      assert.ok(confirmed(B, P) && confirmed(P, B), `round ${round}: the pair is joined`);
+      // The peer re-pushes every record it sent before: none is delivered again.
+      const s = P._peers.get(nodeId).transport;
+      for (const r of sentByP) assert.doesNotThrow(() => s.trySend({ type: 'cmb', cmb: r.cmb }));
+      // And sends two new ones.
+      const bc = P.remember(cats(`round ${round}: a broadcast from the peer`));
+      const dr = P.remember(cats(`round ${round}: directed from the peer`), { to: nodeId });
+      sentByP.push(bc, dr);
+      await until(() => now.length >= 2, 8000);
+      await new Promise((r) => setTimeout(r, 300));
+      const texts = now.map((e) => e.cmb.categories.focus.text).sort();
+      assert.deepStrictEqual(texts, [`round ${round}: a broadcast from the peer`, `round ${round}: directed from the peer`], `round ${round}: exactly the two new records, nothing redelivered`);
+      for (const e of now) {
+        assert.ok(!announced.has(e.inboxId), `round ${round}: ${e.inboxId} is a new id`);
+        announced.set(e.inboxId, e.cmb.categories.focus.text);
+      }
+      for (const [id, text] of announced) assert.strictEqual(focusOf(B.inboxGet(id)), text, `round ${round}: ${id} still fetches its own record`);
+      B.inbox({ limit: 100 }); // the host reads them
+      assert.strictEqual(B.inboxStatus().undrained, 0);
+      // This node sends: a broadcast and a directed record, no throw, and the peer hears both.
+      const before = heardByP.length;
+      assert.doesNotThrow(() => B.remember(cats(`round ${round}: a broadcast from B`)));
+      assert.doesNotThrow(() => B.remember(cats(`round ${round}: directed from B`), { to: P.nodeId }));
+      await until(() => heardByP.length >= before + 2, 8000);
+      assert.deepStrictEqual(heardByP.slice(before).sort(), [`round ${round}: a broadcast from B`, `round ${round}: directed from B`]);
+    }
+    assert.strictEqual(announced.size, ROUNDS * 2);
+    assert.deepStrictEqual(logs.filter((l) => /Cannot read propert|of null|of undefined|TypeError/.test(l)), [], 'no null dereference anywhere');
+    assert.deepStrictEqual(errors, [], 'no uncaught error');
+  } finally {
+    process.removeListener('uncaughtException', onError);
+    process.removeListener('unhandledRejection', onError);
+    for (const n of [B, P]) { try { await n.stop(); } catch { /* */ } }
+    for (const n of [B, P]) { try { fs.rmSync(nodeDirById(n.nodeId), { recursive: true, force: true }); } catch { /* */ } }
+    await cleanup();
+  }
+  void t;
+}
+
+describe('hot-swap into the same room, again and again (sym_join_room)', () => {
+  it('over TCP on the loopback: every round delivers, fetches and sends; nothing is redelivered; ids are stable', async (t) => {
+    const room = `swap-lan-${Math.random().toString(36).slice(2, 8)}`;
+    const name = uniq('swap-lan-b');
+    const lan = () => new BonjourDiscovery({ mdns: false, room, serviceType: `_${room}._tcp` });
+    await scene(t, {
+      make: (nodeId) => new SymNode({ name, ...(nodeId ? { nodeId, create: false } : {}), silent: true, discovery: lan(), room }),
+      makePeer: () => new SymNode({ name: uniq('swap-lan-p'), silent: true, discovery: lan(), room }),
+    });
+  });
+
+  it('over a relay: every round delivers, fetches and sends; nothing is redelivered; ids are stable', async (t) => {
+    const relay = fakeRelay();
+    const room = 'swap-relay-room';
+    const name = uniq('swap-relay-b');
+    await scene(t, {
+      make: (nodeId) => new SymNode({ name, ...(nodeId ? { nodeId, create: false } : {}), silent: true, relayOnly: true, discovery: new NullDiscovery(), relay: relay.url, relayToken: TOKEN, room }),
+      makePeer: () => new SymNode({ name: uniq('swap-relay-p'), silent: true, relayOnly: true, discovery: new NullDiscovery(), relay: relay.url, relayToken: TOKEN, room }),
+      cleanup: () => relay.close(),
+    });
+  });
+});
+
+describe('the loaded version (for a host\'s status)', () => {
+  it('node.version, status().version and the module\'s version are the package.json version', () => {
+    const pkg = require('../package.json');
+    const sym = require('../lib/node');
+    const n = new SymNode({ name: uniq('version'), silent: true, discovery: new NullDiscovery() });
+    try {
+      assert.strictEqual(n.version, pkg.version);
+      assert.strictEqual(n.status().version, pkg.version);
+      assert.strictEqual(sym.version, pkg.version);
+      assert.strictEqual(n._implementation.version, pkg.version, 'the same string the hello announces');
+    } finally { n.stop().catch(() => {}); fs.rmSync(nodeDirById(n.nodeId), { recursive: true, force: true }); }
+  });
+});

From 569cad56ba483fe50fd1cba25be330a82ef8399c Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Wed, 7 Oct 2026 22:57:52 +0100
Subject: [PATCH 111/148] events: message and mood-delivered carry the inbox
 entry's frozen verification and session facts

The same fields, by the same names, as an inbox entry (verified, profile, verification, session), so a
host decides who signed a message or a mood, under which key and over which session, from the event
alone (mesh-channel 0.11.0 looked the signer's key up through node.keyBindings()). A mood frame, which
nothing signs, carries verification: null and the facts of the session it travelled sealed on.
tests/event-provenance.test.js fails without it; each of the three event paths is mutation-checked.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QRVMpaJkAA2fFbvuHCEzqH
---
 CHANGELOG.md                   | 10 ++++
 lib/frame-handler.js           | 19 +++++--
 tests/event-provenance.test.js | 92 ++++++++++++++++++++++++++++++++++
 3 files changed, 116 insertions(+), 5 deletions(-)
 create mode 100644 tests/event-provenance.test.js

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2fee602f..644b13b5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,16 @@ key bindings (a lockout anyone on the LAN could fill) by the binding lifetime be
 in-memory pending set for grants that arrive before their root (which could be flooded) by
 `role-chain-fetch`.
 
+### `message` and `mood-delivered` carry their provenance
+
+- **The `message` event's meta and the `mood-delivered` event carry `verified`, `profile`,
+  `verification` and `session`**, the same frozen facts, by the same field names, as an inbox entry,
+  so a host decides from the event alone (mesh-channel 0.11.0 resolved the signer's key through
+  `node.keyBindings()`, a separate and later view). A message and a mood from a record that verified
+  carry both; a mood frame (no record, nothing signed) carries `verification: null` and the facts of
+  the session it travelled sealed on; a record that did not verify, or a Legacy Import one, carries
+  neither, as its inbox entry does.
+
 ### The loaded version, and hot-swap
 
 - **`node.version`** (and `status().version`, and `require('@sym-bot/sym').version`) is the
diff --git a/lib/frame-handler.js b/lib/frame-handler.js
index 74c0aa6b..248a95cb 100644
--- a/lib/frame-handler.js
+++ b/lib/frame-handler.js
@@ -401,7 +401,7 @@ class FrameHandler {
         return undefined;
 
       case 'mood':
-        return this._handleMood(peerId, peerName, msg);
+        return this._handleMood(peerId, peerName, msg, session);
 
       case 'wake-channel':
         return this._handleWakeChannel(peerId, peerName, msg);
@@ -1195,7 +1195,9 @@ class FrameHandler {
       const text = Buffer.from(app.data, 'base64url').toString('utf8');
       this._markCmbSurfaced(msg._incomingKey, msg);
       this._node._log(`Message from ${msg.author.name}: ${text.slice(0, 60)}`);
-      this._node.emit('message', msg.author.name, text, Object.freeze({ from: msg.author.nodeId, fromName: msg.author.name, content: text, timestamp: meta.createdTimestamp, key: cognitionKey, assertionId: meta.assertionId, via: peerId }));
+      // The frozen verification and session facts the inbox entry carries, by the same names, so a host
+      // decides from the event alone (who signed it, under which key, over which session).
+      this._node.emit('message', msg.author.name, text, Object.freeze({ from: msg.author.nodeId, fromName: msg.author.name, content: text, timestamp: meta.createdTimestamp, key: cognitionKey, assertionId: meta.assertionId, via: peerId, verified: true, profile: 'core-secure', verification: msg._verification || null, session: msg._sessionFacts || null }));
       return undefined;
     }
 
@@ -1792,6 +1794,11 @@ class FrameHandler {
       authorNodeId: verified ? (msg._verifiedAuthorNodeId || null) : null,
       deliveredBy: Object.freeze({ nodeId: peerId, name: peerName }),
       verified,
+      // The frozen facts an inbox entry carries, by the same names (null for a record that did not
+      // verify, as an inbox entry has them).
+      profile: msg._legacyImport ? 'legacy-import' : 'core-secure',
+      verification: verified && !msg._legacyImport ? (msg._verification || null) : null,
+      session: verified && !msg._legacyImport ? (msg._sessionFacts || null) : null,
     }));
 
     // Feed mood to XMesh — affect influences cognitive state even from rejected peers
@@ -1819,7 +1826,7 @@ class FrameHandler {
    * the coupling set. A mood that is not text is not a mood.
    * @private
    */
-  _handleMood(peerId, peerName, msg) {
+  _handleMood(peerId, peerName, msg, session = null) {
     if (typeof msg.mood !== 'string' || !msg.mood) return;
 
     const { h1: moodH1, h2: moodH2 } = encode(msg.mood);
@@ -1831,8 +1838,10 @@ class FrameHandler {
     if (drift <= this._node._moodThreshold) {
       this._node._log(`Mood from ${from}: "${msg.mood.slice(0, 50)}" → ACCEPTED (drift: ${drift.toFixed(3)}, threshold: ${this._node._moodThreshold})`);
       // A mood frame is the session peer's own word: the proven nodeId delivered it (no record, so no
-      // key, assertion or author signature).
-      this._node.emit('mood-delivered', Object.freeze({ from, mood: msg.mood, drift, context: msg.context, key: null, assertionId: null, authorNodeId: peerId, deliveredBy: Object.freeze({ nodeId: peerId, name: peerName }), verified: false }));
+      // key, assertion or author signature: `verification` is null). It travelled sealed on that
+      // session, so the session's frozen facts come with it, by the inbox entry's field name.
+      const facts = session && typeof this._node._sessionFacts === 'function' ? this._node._sessionFacts(session) : null;
+      this._node.emit('mood-delivered', Object.freeze({ from, mood: msg.mood, drift, context: msg.context, key: null, assertionId: null, authorNodeId: peerId, deliveredBy: Object.freeze({ nodeId: peerId, name: peerName }), verified: false, profile: facts ? facts.profile : null, verification: null, session: facts }));
     } else {
       this._node._log(`Mood from ${from}: "${msg.mood.slice(0, 50)}" → IGNORED (drift: ${drift.toFixed(3)}, threshold: ${this._node._moodThreshold})`);
       this._node.emit('mood-rejected', { from, mood: msg.mood, drift });
diff --git a/tests/event-provenance.test.js b/tests/event-provenance.test.js
new file mode 100644
index 00000000..a99de0b2
--- /dev/null
+++ b/tests/event-provenance.test.js
@@ -0,0 +1,92 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME before lib/config loads
+
+/**
+ * The `message` and `mood-delivered` events carry the same frozen `verification` and `session` facts
+ * an inbox entry carries, by the same field names (mesh-channel 0.11.0, which until now resolved a
+ * message's or a mood's signer key through node.keyBindings(), a separate and later view). A host
+ * decides from the event alone.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const { SymNode } = require('../lib/node');
+const { NullDiscovery } = require('../lib/discovery');
+const { nodeDirById } = require('../lib/config');
+const { connectNodes, until } = require('./_core-secure');
+
+const uniq = (b) => `${b}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+const mk = (b) => new SymNode({ name: uniq(b), silent: true, discovery: new NullDiscovery(), room: 'ev' });
+const cats = (focus, mood = 'calm') => ({ focus, issue: 'i', intent: 'inform', motivation: 'm', commitment: 'c', perspective: 'p', mood: { text: mood } });
+async function stopAll(...nodes) {
+  for (const n of nodes) { try { await n.stop(); } catch { /* */ } try { fs.rmSync(nodeDirById(n.nodeId), { recursive: true, force: true }); } catch { /* */ } }
+}
+
+describe('message and mood-delivered carry the inbox entry\'s verification and session facts', () => {
+  it('a message, a mood from a refused record and a mood frame: each decided from the event alone', async () => {
+    const A = mk('ev-a'); const B = mk('ev-b');
+    try {
+      await A.start(); await B.start();
+      await connectNodes(A, B);
+      const aKey = A._identity.publicKey;
+      // The reference: what an inbox entry carries for a directed record from A.
+      B._svafEvaluator.evaluate = async () => ({ decision: 'aligned', total_drift: 0.1, category_drifts: { focus: 0.1 }, gate_values: { g: 1 } });
+      const ref = A.remember(cats('a directed record, for the reference'), { to: B.nodeId });
+      await until(() => B.inboxStatus().seq >= 1, 3000);
+      const item = B.inboxGet('in0001');
+      assert.ok(item && item.verification && item.session, 'the inbox entry has its facts');
+      void ref;
+
+      // 1. A message.
+      const msgs = [];
+      B.on('message', (from, text, meta) => msgs.push(meta));
+      A.send('hello B', { to: B.nodeId });
+      await until(() => msgs.length > 0, 3000);
+      const m = msgs[0];
+      assert.deepStrictEqual(Object.keys(m.verification).sort(), Object.keys(item.verification).sort(), 'the inbox entry\'s verification fields');
+      assert.deepStrictEqual(Object.keys(m.session).sort(), Object.keys(item.session).sort(), 'and its session fields');
+      assert.strictEqual(m.verification.authorNodeId, A.nodeId);
+      assert.strictEqual(m.verification.authorKey, aKey, 'the key that verified the record, from the event');
+      assert.strictEqual(m.verification.assertionId, m.assertionId);
+      assert.strictEqual(m.verification.audience, 'directed');
+      assert.strictEqual(m.verification.relayed, false);
+      assert.strictEqual(m.session.nodeId, A.nodeId);
+      assert.strictEqual(m.session.identityKey, aKey);
+      assert.strictEqual(m.session.transport, 'lan');
+      assert.strictEqual(m.verified, true);
+      assert.strictEqual(m.profile, 'core-secure');
+      assert.ok(Object.isFrozen(m) && Object.isFrozen(m.verification) && Object.isFrozen(m.session), 'frozen');
+
+      // 2. A mood carried by a record that SVAF refused.
+      const moods = [];
+      B.on('mood-delivered', (d) => moods.push(d));
+      B._svafEvaluator.evaluate = async () => ({ decision: 'rejected', total_drift: 0.9, category_drifts: {}, gate_values: {} });
+      A.remember(cats('a record SVAF refuses, carrying affect', 'exhausted'));
+      await until(() => moods.length > 0, 3000);
+      const d = moods[0];
+      assert.strictEqual(d.verified, true);
+      assert.deepStrictEqual(Object.keys(d.verification).sort(), Object.keys(item.verification).sort());
+      assert.strictEqual(d.verification.authorNodeId, A.nodeId);
+      assert.strictEqual(d.verification.authorKey, aKey);
+      assert.strictEqual(d.verification.assertionId, d.assertionId);
+      assert.strictEqual(d.session.nodeId, A.nodeId);
+      assert.strictEqual(d.session.identityKey, aKey);
+      assert.ok(Object.isFrozen(d.verification) && Object.isFrozen(d.session));
+
+      // 3. A mood frame: no record (verification null), its session's facts.
+      B._moodThreshold = 2; // take any mood
+      A.broadcastMood('focused');
+      await until(() => moods.length > 1, 3000);
+      const f = moods[1];
+      assert.strictEqual(f.mood, 'focused');
+      assert.strictEqual(f.verified, false);
+      assert.strictEqual(f.verification, null, 'nothing signed it: no verification facts');
+      assert.deepStrictEqual(Object.keys(f.session).sort(), Object.keys(item.session).sort());
+      assert.strictEqual(f.session.nodeId, A.nodeId);
+      assert.strictEqual(f.session.identityKey, aKey, 'the session that carried it proved this key');
+      assert.strictEqual(f.profile, 'core-secure');
+    } finally { await stopAll(A, B); }
+  });
+});

From 9ebc7df24ccaddd15c5d19889581b2f8ebd280f5 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Wed, 7 Oct 2026 22:59:14 +0100
Subject: [PATCH 112/148] CHANGELOG: a session-only fact (a mood frame's
 session with verification null) means the session's proven peer sent it, not
 a signed record

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QRVMpaJkAA2fFbvuHCEzqH
---
 CHANGELOG.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 644b13b5..6b7df5b8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -22,6 +22,11 @@ in-memory pending set for grants that arrive before their root (which could be f
   carry both; a mood frame (no record, nothing signed) carries `verification: null` and the facts of
   the session it travelled sealed on; a record that did not verify, or a Legacy Import one, carries
   neither, as its inbox entry does.
+- **`session` without `verification` means less than both.** An inbox entry never has one without
+  the other. A mood frame's `session` with `verification: null` says only that this session's proven
+  peer sent it, under the key that session proved (the frame is sealed on the session); it is not a
+  signed record. Nothing about it can be verified again later, relayed with its author's signature,
+  or attributed to anyone but that peer. A host shows it as the peer's word, not as a verified record.
 
 ### The loaded version, and hot-swap
 

From c8b7f0d66931d84db8d1227e6fc3bde3a0ada105 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 8 Oct 2026 03:37:47 +0100
Subject: [PATCH 113/148] =?UTF-8?q?authority:=20rebuilt=20to=20MMP=20?=
 =?UTF-8?q?=C2=A76.6=20as=20merged=20(meshcognition-website=208c3381d,=20P?=
 =?UTF-8?q?R=20#40)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Authority is now a function of a set of hash-linked signed statements, with no time in it.
The time-replay grant store (lib/role-grant-store.js, lib/core/role-grant.js), its cutoffs,
ratification, subtree budgets and the role-chain-fetch / role-chain / role-digest frames are
gone; §6.6 is implemented as written, independently of the spec's reference construction.

- lib/core/ed25519.js: the one §18.3.2 verifier (A canonical and of prime order, cached per key;
  R not the identity encoding; S < L; then crypto.verify). Every signature check in sym uses it:
  records, handshake proofs, attestations, checkpoints, witnesses, room-join grants, tether
  attestations, relocation bundles, authority statements.
- lib/core/authority.js: statements (grant, revoke, endorse), canonical bytes and ids, the shape
  and well-formedness checks, scope narrowing, the anchor pin (a key set with a threshold), the
  pin digest and the authority root.
- lib/authority-store.js: validity on ingest (pending when the chain is not held), §6.6.4's
  two-phase depth-ordered resolution with quotas, delegate quotas and rescue with fall-through,
  the live set, authority order, fetch answers and pages; persistence per pin digest, verified
  again at every load.
- lib/node-authority.js: the four §6.6.8 frames; pending statements per session; answers paced
  by waiting, not refusal; pulls paced by the work they cause, never cut short; a key not seen
  before charged to the gossip lane (§6.6.12); repeats free; retired frames ignored and counted;
  roles follow the key; lifecycle authority judged on each CMB's own fields, scoped grants only
  inside their scope; weights judged when used.
- cmb-anchors is sent on every admitted session (keys [] when nothing is replayed), so a relay
  client still hears a sealed frame before superseding its old session.

Tests: the published authority-v2 and ed25519-strict-v2 vectors vendored in tests/fixtures with
their sha256 (SOURCES.json, checked first), every case resolved as listed, reversed, shuffled and
with forged copies (authority-vectors); the review attacks at full scale and the old faces
(authority-attacks); two nodes reaching one root over TCP, the frames and bounds, persistence
(authority-node); the one rule at every verification site (ed25519-strict); roles, gating and
weights (earned-authority-node). The time-rule tests are removed or rewritten.

Docs: CHANGELOG (a §6.6 section that supersedes the grant rules below it), SECURITY.md (the
rule, bounds and §6.6.12 residuals), README, docs/WIRE-0.14.0.md.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QRVMpaJkAA2fFbvuHCEzqH
---
 CHANGELOG.md                               |   89 +-
 README.md                                  |   34 +-
 SECURITY.md                                |  128 +-
 docs/DESIGN-room-join-authorization.md     |   10 +-
 docs/WIRE-0.14.0.md                        |  281 +-
 lib/attestation-store.js                   |    5 +-
 lib/authority-store.js                     |  496 ++
 lib/core/attestation.js                    |   23 +-
 lib/core/authority.js                      |  254 +
 lib/core/cmb-signing.js                    |    4 +-
 lib/core/ed25519.js                        |  177 +
 lib/core/handshake-v2.js                   |    8 +-
 lib/core/index.js                          |    1 -
 lib/core/role-grant.js                     |   99 -
 lib/core/room-grant.js                     |   24 +-
 lib/core/tether-attestation.js             |    5 +-
 lib/frame-handler.js                       |   65 +-
 lib/memory-store.js                        |   27 +-
 lib/node-authority.js                      |  615 ++
 lib/node.js                                |  545 +-
 lib/relocation.js                          |    7 +-
 lib/role-grant-store.js                    |  763 --
 lib/roster-keys.js                         |   46 +-
 tests/authority-attacks.test.js            |  322 +
 tests/authority-node.test.js               |  362 +
 tests/authority-vectors.test.js            |  203 +
 tests/core-secure-authority.test.js        |  133 -
 tests/core-secure-final-review.test.js     |  233 +-
 tests/core-secure-rereview.test.js         |  224 +-
 tests/core-secure-review.test.js           |  226 +-
 tests/earned-authority-node.test.js        |  228 +-
 tests/ed25519-strict.test.js               |  178 +
 tests/fixtures/SOURCES.json                |    9 +
 tests/fixtures/authority-frame.schema.json |  194 +
 tests/fixtures/authority-v2.json           | 9157 ++++++++++++++++++++
 tests/fixtures/ed25519-strict-v2.json      |  284 +
 tests/gossip-lanes.test.js                 |  154 +-
 tests/memory-store.test.js                 |    4 +-
 tests/relay-fuzz.test.js                   |    8 +-
 tests/role-chain-fetch.test.js             |  272 -
 tests/role-grant-rooted.test.js            |  195 -
 tests/role-grant-store.test.js             |  249 -
 42 files changed, 12969 insertions(+), 3372 deletions(-)
 create mode 100644 lib/authority-store.js
 create mode 100644 lib/core/authority.js
 create mode 100644 lib/core/ed25519.js
 delete mode 100644 lib/core/role-grant.js
 create mode 100644 lib/node-authority.js
 delete mode 100644 lib/role-grant-store.js
 create mode 100644 tests/authority-attacks.test.js
 create mode 100644 tests/authority-node.test.js
 create mode 100644 tests/authority-vectors.test.js
 delete mode 100644 tests/core-secure-authority.test.js
 create mode 100644 tests/ed25519-strict.test.js
 create mode 100644 tests/fixtures/SOURCES.json
 create mode 100644 tests/fixtures/authority-frame.schema.json
 create mode 100644 tests/fixtures/authority-v2.json
 create mode 100644 tests/fixtures/ed25519-strict-v2.json
 delete mode 100644 tests/role-chain-fetch.test.js
 delete mode 100644 tests/role-grant-rooted.test.js
 delete mode 100644 tests/role-grant-store.test.js

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6b7df5b8..6349ba67 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,8 +10,75 @@ to the entry (see Changed). It includes 0.13.15 and 0.13.16 (the witness-storm f
 follow-ups). **0.13.17 was never released:** its fixes and their tests ship in 0.14.0 (no more
 0.13.x releases), except two mechanisms 0.14's design replaces — the cap of 16,384 never-evicted
 key bindings (a lockout anyone on the LAN could fill) by the binding lifetime below, and the
-in-memory pending set for grants that arrive before their root (which could be flooded) by
-`role-chain-fetch`.
+in-memory pending set for grants that arrive before their root (which could be flooded), now by
+§6.6's bounded pending statements (below).
+
+### Authority: MMP §6.6 as merged (supersedes every grant rule further down)
+
+The founder merged the spec's new §6.6 (sym-bot/meshcognition-website main at 8c3381d, PR #40):
+authority is a function of a set of hash-linked signed statements, with no time in it. sym 0.14.0
+implements it as written and drops the time-replay rule the sections below built up during this
+release: cutoffs, ratification, budgets per delegation subtree, `role-chain-fetch`, `role-chain`
+and `role-digest`. Where a section below describes grants or revokes, this section is what holds.
+
+- **Statements (§6.6.3).** `grant`, `revoke` and `endorse`, each identified by `auth-` + SHA-256
+  of its canonical bytes (`mmp-authority-v1`), naming its authority in `authorisedBy` and its
+  targets by id, with a 16-byte nonce; `issuedAt` is signed and never read. Validity is static:
+  well formed (a subject key of prime order included), rooted within 4 links, signed, permitted.
+  (lib/core/authority.js)
+- **The anchor (§6.6.1)** is a pinned key set with a threshold:
+  `anchor: { threshold, keys: [{ key, nodeId? }] }`; the old `{ nodeId, publicKey }`, a
+  `"nodeId:publicKey"` string and `SYM_FOUNDER_ANCHOR` are the 1-of-1 set. An anchor-level statement
+  needs t distinct pinned keys that verify, each copy judged on its own entries. A pin that does not
+  parse stops the node; with none pinned nothing is in force and the configured `lifecycleRole`
+  stands (a closed development mode).
+- **Roles (§6.6.2).** admin, validator, issuer and non-authority roles (participant, extension
+  roles), with the spec's table for who may grant, revoke and endorse; an optional scope that only
+  narrows, by whole segments, compared exactly.
+- **Resolution (§6.6.4 to §6.6.7).** Per depth, revokes and endorses, then grants; a bucket keeps
+  its own first, by ascending id, within 256 statements (the anchor's 4,096) and 16 delegating
+  grants; a statement a revoke cut off is rescued only by an in-force endorse from above, charged to
+  the endorser's bucket and falling through by id; a quota cut is never rescued. The live set and
+  the authority root. (lib/authority-store.js)
+- **Frames (§6.6.8).** `authority-statement`, `authority-digest` (on confirm, and after a change at
+  most once a second per session), `authority-fetch` (by ids, or a page after a cursor) and
+  `authority-set` (at most 64, in authority order); pending statements per session (at most 64, 10
+  s, one fetch in flight per missing id). Answers are paced at 4 a second per session (burst 16) by
+  waiting, not refusing; a pull is paced by the work it causes and never cut short; a key not seen
+  before costs the gossip lane 16 checks (§6.6.12). `role-grant`, `role-revoke`, `role-chain-fetch`,
+  `role-chain` and `role-digest` are retired: ignored, counted, never sent (§6.6.11). `cmb-anchors`
+  is now sent on every admitted session (`keys: []` when nothing is replayed), so a relay client
+  still hears a sealed frame before its new session supersedes the old. (lib/node-authority.js;
+  docs/WIRE-0.14.0.md §1, §3)
+- **Using authority (§6.6.9, §6.6.10).** Roles follow the key: a grant names a nodeId and a key and
+  confers its role on that pair. An in-force grant is a key-registry view for an unbound nodeId; a
+  grant naming this node with a foreign key confers nothing and is reported
+  (`authority-foreign-self-key`). A received record's origin weight, `validateCMB` and `canonizeCMB`
+  (judged on that CMB's own fields; a scoped grant only inside its scope, through the host's
+  `authorityScopes`) and attestation weights are judged against the in-force set when applied.
+- **One Ed25519 rule (§18.3.2)** for every signature sym checks: records, handshake proofs,
+  attestations, checkpoints, witnesses, room-join grants, tether attestations, relocation bundles
+  and authority statements (lib/core/ed25519.js).
+- **Migration (§6.6.11).** A flag day: role grants signed by 0.13 or earlier 0.14 builds confer
+  nothing, and every node resolves as a participant until the anchor and each grantor re-issue what
+  should stand. `node.legacyRoleGrants()` lists the old store as plain data for that. 0.13 `grant`
+  roster entries stay legacy claims.
+- **API.** `node.grant(subject, role, { scope })`, `revoke(ids)`, `endorse(ids)`,
+  `authorityStatement(fields, opts)`, `cosignAuthority(statement)`, `submitAuthority(statement)`,
+  `authorityRoles(nodeId, key?)`, `authorityRoot()`, `authorityStatus()`,
+  `lifecycleAuthority(nodeId, key, cmb)`, `resolveRole(nodeId, { key, cmb })` (no time argument);
+  `grantRole(nodeId, role, opts)` and `revokeRole(nodeId)` keep their names, with no cutoff.
+  `roleStatementsBy`, `ECUTOFF` and `ratify` are gone; `status().coreSecure.authority` replaces
+  `roleChain`; the `authority-changed` event says when the root moves.
+- **Gone with the time rule.** An attestation dated before the record it attests is no longer
+  refused: no authority is judged at a time, so an attestation's time is no part of its weight.
+- **Tests.** The published vectors are vendored in tests/fixtures with their sha256 recorded
+  (SOURCES.json, checked before use): every authority case resolved as listed, reversed, shuffled
+  and with forged copies, and every Ed25519 case (authority-vectors). The review attacks at full
+  scale and the old faces (arrival order, backdating, floods, cycles) in authority-attacks; two
+  nodes reaching one root over TCP, the frames and their bounds, persistence in authority-node;
+  the one rule at every verification site in ed25519-strict; roles and weights in
+  earned-authority-node.
 
 ### `message` and `mood-delivered` carry their provenance
 
@@ -63,6 +130,9 @@ in-memory pending set for grants that arrive before their root (which could be f
 
 ### The final re-review of f0d936a (BLOCK) — what changed
 
+(Rulings A and B below, and the grant rules they describe, are superseded by MMP §6.6: see
+"Authority: MMP §6.6 as merged" above.)
+
 The founder ruled three design changes; each is made where its assumption was, and the rule is in
 `docs/WIRE-0.14.0.md` §6 and §7 and the design doc (branch `design/0.14.0-core-secure-identity`).
 
@@ -117,6 +187,9 @@ The founder ruled three design changes; each is made where its assumption was, a
 
 ### The re-review at 72daeb6 — what changed
 
+(N2, N4 and N5 below, on grants and revokes, are superseded by MMP §6.6: see "Authority: MMP §6.6
+as merged" above.)
+
 Five findings and the open leads, each fixed where its assumption was made (the design is
 `docs/DESIGN-core-secure-identity.md` on branch `design/0.14.0-core-secure-identity`; the wire text
 for the spec PRs is `docs/WIRE-0.14.0.md` §6 and §7):
@@ -171,6 +244,9 @@ for the spec PRs is `docs/WIRE-0.14.0.md` §6 and §7):
 
 ### The independent security review (BLOCK at 341dafb) — what changed
 
+(What this section says about role grants, revokes, `role-chain-fetch` and `role-digest` is
+superseded by MMP §6.6: see "Authority: MMP §6.6 as merged" above.)
+
 Seven design assumptions, each changed where it was made, not patched where it showed:
 
 - **The signed audience governs every send (A).** The one seal point refuses a record whose signed
@@ -260,6 +336,9 @@ Seven design assumptions, each changed where it was made, not patched where it s
 
 ### Core Secure — breaking
 
+(Where this section speaks of role grants, revokes or their frames, MMP §6.6 supersedes it: see
+"Authority: MMP §6.6 as merged" above.)
+
 - **A peer is a proven session.** A sym peer used to exist before anything was proven about it: on
   TCP connect, on any first `handshake` frame (whose keys were pinned), on a relay's
   `relay-peer-joined`. Now every transport — LAN TCP, loopback, relay — runs the MMP §5.2
@@ -346,6 +425,9 @@ Seven design assumptions, each changed where it was made, not patched where it s
 
 ### Core Secure — new API (for hosts: XMesh, mesh-channel)
 
+(Where this section speaks of role grants, revokes or their frames, MMP §6.6 supersedes it: see
+"Authority: MMP §6.6 as merged" above.)
+
 - `node.on('verified-record', ({ record, session, verification }) => …)`: every record that
   passed §8.8.5, with the proven session facts (`nodeId`, `name`, `identityKey`, `sessionId`,
   `transport`, `role`, `room`, `extensions`, `confirmedAt`, `implementation`, `profile`) and
@@ -732,6 +814,9 @@ debt, and the daemon's log flood. Every item has a test that fails without its f
 
 ### Fixed — signed gossip is budgeted, per connection and per attester
 
+(Where this section speaks of role grants, revokes or their frames, MMP §6.6 supersedes it: see
+"Authority: MMP §6.6 as merged" above.)
+
 - **New signed statements are budgeted (0.13.15's other known limit).** The attestations,
   checkpoints, witnesses and role grants that arrive on one connection may make this node check at most
   2,000 new statements a second, up to a burst of 10,000. A connection seen for the first time starts
diff --git a/README.md b/README.md
index 14bb9f42..96789c39 100644
--- a/README.md
+++ b/README.md
@@ -127,29 +127,29 @@ participant.
   1009 IDENTITY_CONFLICT, recorded, and shown in `sym status` for you to resolve
   (`sym keys <name> resolve`). No source overrides a different key. A handshake alone binds a
   key only for its session; the binding becomes durable when it is earned (an admitted verified
-  record, a verified record its author signed to this node, a pin, an anchor-rooted grant in
-  effect), so churning identities cannot fill the registry, and nothing is ever evicted to make
-  room.
+  record, a verified record its author signed to this node, a pin, an in-force grant), so
+  churning identities cannot fill the registry, and nothing is ever evicted to make room.
 - **Every record is signed, and verified by its author's node id.** A record is accepted only
   if it is a signed `mmp-sig-v2.0` record whose author key this node resolves by
-  `createdByNodeId` — a key it proved, pinned from an invite, or holds from an anchor-rooted
-  grant in effect. An unsigned, legacy or unresolvable record is refused. What is kept, delivered
+  `createdByNodeId` — a key it proved, pinned from an invite, or holds from an in-force grant.
+  An unsigned, legacy or unresolvable record is refused. What is kept, delivered
   and served is the record's signed projection: members no signature covers are dropped.
 - **A record goes only where its author signed it to.** A record signed to one node is sealed to
   that node's session and no other's, whichever path offers it.
 - **Content is sealed per session.** Records travel only as `cmb-encrypted` frames, and every
-  other frame (mood, gossip, grants) as a sealed control frame, under directional keys derived
+  other frame (mood, gossip, authority statements) as a sealed control frame, under directional keys derived
   fresh for each handshake (X25519, HKDF-SHA256, ChaCha20-Poly1305). A relay sees routing
   envelopes and ciphertext. There is no long-lived encryption key to steal later.
-- **Authority follows the key.** A role grant names the key it confers authority on, and a
-  grant chain is checked with the keys each grant vouches, from the anchor down. A revoke signs a
-  cutoff: what the revoked node signed from the cutoff on never counts, and what it signed before
-  counts only if the revoker ratified it (or the node still holds its rank), so a revoked key gains
-  nothing by backdating. Nodes holding the same grants keep the same ones and resolve the same
-  authority, whatever order they learned them in.
+- **Authority is a function of a set, and follows the key (MMP §6.6).** Grants, revokes and
+  endorses are signed statements that name one another by the hash of their signed bytes, rooted
+  at a pinned anchor key set with a threshold. A grant names a nodeId and a key and confers its role
+  on that pair only. What is in force is computed from the statements a node holds and nothing
+  else (no clock, no arrival order), so nodes holding the same statements resolve the same
+  authority and the same root. Delegation is at most 4 links, scopes only narrow, and every bucket
+  has a quota. Every signature sym checks, here and everywhere, uses one Ed25519 rule (§18.3.2).
 - **Each node decides what it keeps.** Admission is receiver-local: a node runs its own
   evaluation on every record it hears and stores only what it admits.
-- **Bounded.** Every store a peer can feed — key bindings, grants, wake channels, gossip, relay
+- **Bounded.** Every store a peer can feed — key bindings, authority statements, wake channels, gossip, relay
   candidates, per-peer state — has a fixed bound; [SECURITY.md](SECURITY.md) lists each one.
 
 What this does not solve, said plainly:
@@ -160,8 +160,12 @@ What this does not solve, said plainly:
   A node whose records yours never admitted, and that never signed a record to yours, is first contact
   again once it leaves; and whoever reaches yours first under a nodeId and has one record accepted
   holds that nodeId there for good (a nodeId is not derived from its key).
-- **A ratification is a judgement.** A revoked node's earlier statements stand only where its
-  revoker lists them; list too much and they stand, too little and honest ones lapse.
+- **A revoke takes effect where it has arrived.** Until a node holds a revoke it treats the grant
+  as in force; gossip and digest exchanges carry it, and a partitioned node stays exposed until it
+  reconnects. The anchor's threshold holders are the root of authority.
+- **Upgrading from 0.13 is a flag day for authority.** Old role grants confer nothing under §6.6;
+  the anchor and each grantor re-issue what should stand (`node.legacyRoleGrants()` lists the old
+  ones).
 - **Relay eviction.** `relay-auth` is not proven, and a relay token holder can make the relay
   replace another node's connection (close 4004). A squatter gets no Core Secure session — it
   cannot prove the key — and an evicted node re-handshakes, but the relay path can be interrupted.
diff --git a/SECURITY.md b/SECURITY.md
index 96251a37..ac91e38a 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -36,8 +36,8 @@ Report a vulnerability privately to info@sym.bot (the address in package.json).
   binding is earned — an admitted verified record, a verified record its author signed to this
   node and this node accepted for delivery (directed exchange is a relationship, so a squatter
   cannot take over a conversation once its peer's sessions end), an out-of-band pin (invite, Legacy
-  Import route), or an anchor-rooted grant in effect now (a grant binding is a view over the grants
-  in effect, never stored, and ends with them) — and never replaces it: a different key, from any source or
+  Import route), or an in-force grant (MMP §6.6.9: a view over the in-force set, never stored, binding
+  only an unbound nodeId, and ending with the grant) — and never replaces it: a different key, from any source or
   while a session holds the nodeId, is a recorded conflict an operator resolves (a session
   proving it is closed with error 1009 `IDENTITY_CONFLICT`, sealed). A handshake, or a second one,
   earns nothing; nothing is evicted before it expires; a `proven` binding that verified nothing
@@ -54,22 +54,45 @@ Report a vulnerability privately to info@sym.bot (the address in package.json).
   `lineage.method`) are dropped, and what is stored, delivered and served is the projection.
   Directed versus room-bound delivery is decided by the signed `metadata.to`, never by a relay
   envelope; a directed record older than 24 h by its signed time is refused.
-- **Authority follows the key, and every node that holds the same grants resolves the same
-  authority.** A role grant must name `granteeKey`; it confers its role only on that key, and a chain
-  is verified top-down with each kept grant's vouched key. A store keeps every grant or revoke whose
-  signature it can verify, and decides its effect only when it resolves a role, so what it keeps
-  and what it resolves depend on the records it holds, never on the order they arrived in
-  (docs/WIRE-0.14.0.md §6).
-- **A revoke carries a cutoff, and a revoked key gains nothing by backdating.** Every revoke this
-  release signs names its cutoff (no default). What the revoked node signed at or after the cutoff
-  never counts. What it signed before the cutoff counts only while it still holds the rank the
-  statement needs, or when an effective revoke of it ratifies that statement by its signature (the
-  revoker lists the statements that stay valid). So a key signing after its revoke, dated before it,
-  achieves nothing. A revoker counts only if it held the rank at every point from its cutoff to its
-  signed time. A grant also confers only while its grantor still holds rank (MMP §6.6's cascade),
-  unless ratified. An attestation counts with its signer's role when it signed, by the same rule,
-  and one dated before the record it attests is refused. A grantor whose nodeId an impostor holds
-  keeps exactly its vouched authority; the impostor gets none.
+- **Authority is a function of a set of signed statements (MMP §6.6, as merged at
+  meshcognition-website 8c3381d).** Grants, revokes and endorses are identified by the SHA-256 of
+  their canonical signed bytes and name one another by those ids (`authorisedBy`, `targets`), so the
+  graph is fixed when it is signed. They root at a pinned anchor: a key set with a threshold
+  (`anchor` option or `SYM_FOUNDER_ANCHOR`; a pin that does not parse stops the node, and with none
+  pinned nothing is in force). A node resolves what it holds by §6.6.4's two-phase, depth-ordered
+  rule, and nothing else enters: no clock, no receipt time, no arrival order, no session. `issuedAt`
+  is signed and ignored. Two nodes holding the same statements under the same pin compute the same
+  in-force set and the same authority root. Tested: every case of the published vectors
+  (authority-v2.json, vendored with its hash) resolved as listed, reversed, shuffled and with forged
+  copies mixed in; random meshes in many orders; two nodes fed in different orders over TCP.
+- **Roles follow the key.** A grant names a nodeId and a key, and confers its role on that pair only.
+  A statement's signing key comes from its authorising grant, or the pin, never from the key
+  registry, so every node verifies it alike. A grant naming this node's nodeId with a foreign key
+  confers nothing here and is reported (`authority-foreign-self-key`).
+- **Delegation is bounded by the rule, not by arrival.** At most 4 links from the anchor. An admin
+  grants any role and revokes and endorses below itself; a validator or an issuer grants
+  non-authority roles only and revokes below itself. A scope only narrows, by whole path segments,
+  compared exactly (`w1/../w2`, `w1/./x` are not well formed; `w10` is not inside `w1`). A bucket
+  (the statements one grant authorises) keeps at most 256 (the anchor's 4,096), of them at most 16
+  delegating grants, its revokes and endorses first, then by ascending id. A revoke removes only
+  below its signer. A statement a quota cut off is never rescued; one a revoke cut off is kept only
+  by an in-force endorse from above, charged to the endorser's own bucket, falling through to the
+  next endorser when that bucket is full. So the reviewers' attacks fail: admins hung under
+  over-quota grants stay dead, a self-revoke cannot launder them past a full delegate quota, and 17
+  issuers in one bucket leave 16 in force. What one depth-1 grant can hold in force below it is at
+  most 69,888 statements, 4,368 of them delegating.
+- **Authority is judged when it is used.** The origin weight of a received record, this node's
+  lifecycle transitions on a CMB (`validateCMB`, `canonizeCMB`: judged on that CMB's own signed
+  fields, a scoped grant only inside its scope) and the weight of an attestation are each judged
+  against the in-force set at the moment they are applied. There is no role "at a time": once a
+  signer's grant is not in force, nothing it signs carries authority, whatever time it claims.
+- **One Ed25519 rule (MMP §18.3.2).** Every signature sym checks (records, handshake proofs,
+  attestations, checkpoints, witnesses, room-join grants, tether attestations, relocation bundles,
+  authority statements) goes through one verifier: A a canonical encoding of a point of prime order
+  (cached per key), R not the identity's encoding, S < L, then OpenSSL's check. A grant's subject key
+  must be of prime order too. Tested with the published vectors (ed25519-strict-v2.json) and, at each
+  of those sites, with two signatures Node's `crypto.verify` accepts and the rule rejects (the
+  identity key's universal forgery, and R = identity with S = k·a).
 - **A forgery in a session's own name ends the session.** A statement that names the session's own
   peer as its signer and does not verify under the key that session proved closes it, and its
   nodeId is not admitted again for 60 s. A statement the session relays for another signer is
@@ -79,7 +102,10 @@ Report a vulnerability privately to info@sym.bot (the address in package.json).
   verification lane (32 a second, burst 128) before any work is done on them, and once 8 of one
   peer's statements for one signer have failed within a minute, that peer's statements for that
   signer are dropped unverified for the rest of the minute. A refused record is logged and recorded
-  in the decision log at most once a minute per peer and reason.
+  in the decision log at most once a minute per peer and reason. Authority statements are verified
+  under the keys their own chains name, so this question does not arise for them: one that fails is
+  dropped and counted against the delivering session, and past 8 failures a minute under one signing
+  key that session's statements under that key are dropped unread.
 - **Admission attestations under `sym-attest-v1`.** Attestations, checkpoints and witnesses are
   signed under their own domain tags with every field covered, verified against the signer's bound
   key (never the delivering session), and exchanged only with sessions that negotiated the
@@ -119,21 +145,22 @@ Every store a peer can feed has a fixed bound. Reaching one never stops the node
   a newcomer is refused a durable binding and its live session still verifies what it signs. Key
   conflicts: at most 8 kept per nodeId and 1,024 in all, every one counted
   (`status().coreSecure.keyConflicts`).
-- **Role grants**: the anchor's own records are not limited; everything else is bounded per
-  delegation subtree: everything an anchor grantee and its descendants sign shares one budget of
-  4,096 records. A compromised subtree fills only its own budget, so a revoke from another subtree
-  is never refused. Inside a full budget the records kept are chosen by one order on signed fields
-  (shallower signers first, revokes before grants, earlier cutoffs and grants first, then the
-  signature), and a record that ranks above the last one kept replaces it. A revoke lists at most
-  64 ratified statements. A nodeId in a grant is canonical lowercase of at most 128 characters, a
-  role name at most 32. A delegation reaches at most 8 grants from the anchor, and
-  role resolution is memoised. A record whose grantor no kept grant vouches is held only while its
-  chain is fetched from the session that delivered it (`role-chain-fetch`): at
-  most 64 records and 64 KiB per session, for at most 10 s; a fetch names at most 16 grantors, an
-  answer carries at most 64 grants, and a node answers at most 4 fetches a second per session
-  (burst 16). A whole-store sync (on a differing `role-digest`) is at most 1,024 pages of 64.
-- **Gossip** (attestations, checkpoints, witnesses, grants): 2,000 new statements a second per
-  proven peer (burst 10,000; a new peer starts at 100), spent before a signature is checked, and
+- **Authority statements** (MMP §6.6): what is in force is bounded by the quotas above. What is
+  held: at most 200,000 statements; past that the ones not in the live set go first (highest id
+  first), and a new one is refused only when the live set alone fills the store. A statement is at
+  most 16 signature entries, 64 targets and a 256-character scope, in the schema's shape (anything
+  else is refused before any work). A statement whose chain is not held is pending: its own
+  signature checked first, at most 64 held per session, keyed by id and signing key, for at most
+  10 s or until the session closes, never persisted, relayed or counted, with one fetch in flight per
+  missing id. An `authority-set` carries at most 64 statements. A node answers `authority-fetch` at 4
+  a second per session (burst 16); over that a request waits, at most 64 of them, and past that one
+  is dropped. One pull in flight per session.
+- **Gossip** (attestations, checkpoints, witnesses, authority statements): 2,000 new statements a
+  second per proven peer (burst 10,000; a new peer starts at 100), spent before a signature is
+  checked (an authority statement also spends 16 for each key it makes this node check for the first
+  time, since that check is a scalar multiplication; a repeat or a statement not of the shape spends
+  nothing; an answer to this node's own pull is charged as a debt that paces the next page, never
+  dropped), and
   4,000 verified statements a second in all (burst 20,000), spent only after it; checkpoints at most
   4 a second per attester (burst 128); at most 1,024 attesters, 32 checkpoints each, 256 witnesses
   per position.
@@ -189,14 +216,31 @@ Every store a peer can feed has a fixed bound. Reaching one never stops the node
   restarts. A nodeId that never earned a durable binding is first contact again once its sessions
   end. Pin a key out of band (an invite) where that matters. Deriving a nodeId from its key would
   remove the squat; it is a future MMP change, not this release.
-- **A ratification is the revoker's judgement.** A revoked node's statements before its cutoff
-  stand only if its revoker ratified them, so a revoker that ratifies too much keeps them standing,
-  and one that ratifies too little voids honest ones. The revoker sees what it holds
-  (`node.roleStatementsBy`).
-- **The kept set can lag after a reshaped tree.** Records are chosen within a budget from the
-  records held; one refused for its budget is not kept for later. If a signer later gains a
-  shallower chain through another subtree, records refused earlier in the budget it left return
-  only when a peer offers them again (the next whole-store sync after two nodes' digests differ).
+- **The revoke window (MMP §6.6.12).** Until a node holds a revoke it treats the removed grant as
+  in force. A revoke is relayed as it enters, and a digest exchange reconciles the rest when a
+  session is confirmed and whenever a set changes; a partitioned node stays exposed until it
+  reconnects.
+- **The threshold holders are the root.** Any t pinned keys together can grant, revoke and endorse
+  anything; under a threshold of 1 every pinned key alone is the root. Compromise of t keys is
+  recovered only by pinning again, out of band.
+- **A compromised authority holder acts until it is removed.** Within its quotas it can grant,
+  revoke and endorse below itself until a signer above revokes its grant; endorsements then keep
+  what should stand.
+- **Grants are visible.** Every node that holds the set can read who holds which role.
+- **A new key costs a scalar multiplication.** The prime-order check of a key not seen before
+  (§18.3.2) is one multiplication by L, about fifteen signature checks here. The gossip lane is
+  charged for it before it is done; a flood of fresh keys buys a sixteenth of a lane's checks.
+- **The upgrade is a flag day (MMP §6.6.11).** sym 0.14 resolves no authority from the role grants
+  0.13 (and earlier 0.14 builds) signed: until the anchor and each grantor re-issue what should stand
+  as §6.6 grants, every node resolves as a participant. `node.legacyRoleGrants()` lists the old store
+  as plain data (never verified, never resolved, never sent) for the operator who re-issues.
+- **Scopes need their namespace.** sym implements no scope namespace by itself: a scoped grant
+  confers nothing on any CMB until the host passes the extension's resolver (`authorityScopes`).
+- **A received validation CMB advances its parent only to remixed.** MMP §6.5 has a receiver advance
+  a parent to validated (action completed) or dismissed (not actionable) when a validator or above
+  authored the CMB naming it; a record carries no signed field saying which, so sym does not. It
+  weighs the author's authority on each parent (the feedback flag) and leaves validation to the
+  node's own `validateCMB`, gated on its own authority over that CMB.
 - **Relay eviction.** `relay-auth` identity is not proven (MMP §4.4.1), and the relay replaces a
   connection that re-authenticates under the same nodeId (close 4004, §4.4.7). A token holder
   can therefore interrupt another node's relay path. It cannot impersonate it: it gets no
diff --git a/docs/DESIGN-room-join-authorization.md b/docs/DESIGN-room-join-authorization.md
index 5af2317b..6643aecf 100644
--- a/docs/DESIGN-room-join-authorization.md
+++ b/docs/DESIGN-room-join-authorization.md
@@ -72,9 +72,10 @@ B cannot mint an invite for any room xmesh actually creates.
   bindings (a handshake-learned key is trusted on first use until Core Secure proves possession)
   with source precedence — anchor (2) > handshake (1) > grant (0);
   a gossiped grant can never overwrite a handshake-learned key; the relayer never vouches.
-- **Signed grants** along the rooted authority chain (`lib/role-grant-store.js`): a grant
-  binds the grantee's key into the grantor's signed payload — tamper-evident vouching that
-  already teaches third parties a key they never handshook.
+- **Signed grants** along the rooted authority chain (then `lib/role-grant-store.js`; since 0.14.0
+  MMP §6.6 statements, `lib/authority-store.js`): a grant binds the grantee's key into the grantor's
+  signed payload — tamper-evident vouching that already teaches third parties a key they never
+  handshook.
 - **Frame-level shared-secret encryption** (consumed by xmesh's control plane: "opened with
   the peer's shared secret"). The crypto for content protection exists; this design does not
   add any.
@@ -95,7 +96,8 @@ nobody: `default` stays open BY DESIGN, it is the public square). Joining an own
 presenting a **room-join grant**: a signed statement by the owner — v1 is OWNER-ONLY; the
 draft's "or a member the owner authorized to invite" smuggled in delegation with no depth,
 no attenuation and no bound, and the review struck it (delegation is its own future design,
-and role-grant-store already shows the chain problems it must solve) — binding
+and the role-grant chain of the time showed the problems it must solve; MMP §6.6 has since given
+roles depth, attenuation and bounds, and room-join grants stay outside it) — binding
 `{room, grantee nodeId, grantee pubkey, expiry}`. Grants have a MAXIMUM lifetime of 24h:
 that number IS the revocation exposure window for an offline peer (review F3 — revocation is
 live gossip with no catch-up replay on reconnect, so an offline peer's stale binding survives
diff --git a/docs/WIRE-0.14.0.md b/docs/WIRE-0.14.0.md
index 7b4c35f7..4dee03c9 100644
--- a/docs/WIRE-0.14.0.md
+++ b/docs/WIRE-0.14.0.md
@@ -37,10 +37,16 @@ carried an `_anchor: true` flag. In Core Secure the record frame is fixed by §1
 **Sealing and signing.** Sealed on the session (`control-encrypted`), unsigned. It is
 session-bound: it speaks only for the session's proven peer, about records that peer authored.
 
-**When it is sent.** At most once a minute per peer, when a session is admitted. It goes
-immediately before the replayed records, which follow it on the same session as ordinary
-`cmb-encrypted` frames. Only records the sender itself authored are replayed (anti-echo,
-§15.7), and only signed `mmp-sig-v2.0` records.
+**When it is sent.** To every admitted session, first: with the keys of the records about to be
+replayed (at most once a minute per peer), or with `keys: []` when none follow. It goes immediately
+before the replayed records, which follow it on the same session as ordinary `cmb-encrypted`
+frames. Only records the sender itself authored are replayed (anti-echo, §15.7), and only signed
+`mmp-sig-v2.0` records. Because it is always sent, it is also the first authenticated frame a relay
+client hears from its server on a new session: a client that re-handshakes while it holds a
+confirmed session keeps the old one until the new one carries a sealed frame from the server (it
+cannot otherwise know the server took its `client-finish`), and closes a new one that hears nothing
+within the handshake timeout (`unconfirmed-by-peer`). (0.14.0 used `role-digest` for this until
+§6.6 retired it; with no anchor pinned there is no `authority-digest` to send.)
 
 **Receiver.**
 - Keeps the key set for that session, replacing any earlier set from the same session. It keeps
@@ -68,89 +74,44 @@ behaviour beyond the draft: an admitted session whose grant expires is closed wh
 
 ---
 
-## 3. `role-chain-fetch` and `role-chain`: fetching the chain a grant needs
-
-**Why.** A role grant or revoke is kept only when it is rooted at the anchor (§6.5, §6.6).
-Gossip has no order, so a grant can arrive before the grant that roots its grantor. A pending set
-that holds whatever might later be rooted can be flooded. Instead, the receiver asks the session
-that delivered the record for the missing chain.
-
-**Request** (sealed control frame, sent to the delivering session only):
-
-```json
-{ "type": "role-chain-fetch", "reqId": "rc-<16 hex>", "grantees": ["<grantor nodeId>"] }
-```
-
-- `reqId`: a correlation id of at most 128 characters.
-- `grantees`: the nodeIds whose own rooting grants are missing (the `grantedBy` of the record that
-  could not be rooted). At most 16 are read.
-
-**Answer** (sealed control frame, on the same session):
-
-```json
-{ "type": "role-chain", "reqId": "<the request's reqId>",
-  "grants": [ { "type": "role-grant", "grantee": "...", "role": "validator", "grantedBy": "...",
-                "grantedAt": 1786611600000, "granteeKey": "...", "sigAlg": "ed25519", "sig": "..." } ] }
-```
-
-- `grants`: at most 64 role-grant or role-revoke records, each the canonical object of its signed
-  fields only (`type, grantee, role?, grantedBy, grantedAt, granteeKey?, cutoff?, ratify?, sig,
-  sigAlg`; `cutoff` and `ratify` on a revoke only, section 6). They are
-  ordered top-down: each record comes after the records that root its grantor, up to the anchor
-  (depth at most 8). For each named grantee the answer holds the records the server holds whose
-  grantee it is, revokes included, each preceded by its grantor's chain.
-
-**Whole-store sync** (anti-entropy, security review D). The same pair carries a paged copy of the
-server's whole store:
-
-```json
-{ "type": "role-chain-fetch", "reqId": "rs-<16 hex>", "sync": true, "after": 0 }
-{ "type": "role-chain", "reqId": "<the request's reqId>", "grants": [ ... ], "next": 64 }
-```
-
-- `after`: where the page starts, in the server's sync order: the anchor's records first, then
-  those of each grantor the earlier ones reach, breadth first, each grantor's own records by
-  signed time; records no chain reaches come last. A page holds at most 64 records.
-- `next`: present when another page follows; the client asks for it with `after: next`. A client
-  asks for at most 1,024 pages per session, one page in flight at a time.
-
-**Signing.** Neither frame is signed. Each grant in `grants` keeps its grantor's signature
-(§6.5) and is verified as gossip is: top-down, against the key that the chain vouches for its
-grantor, or the anchor's configured key. Its authority never comes from the session that served
-it.
-
-**When they are sent.**
-- A node sends a whole-store `role-chain-fetch` when a peer's `role-digest` (section 5) differs
-  from its own.
-- A node sends `role-chain-fetch` when a role grant or revoke that arrived on a session is refused
-  as `unknown-grantor-key` (no record it holds vouches a key for its grantor), naming the grantor.
-  That is the only reason a verifiable record waits: no record is refused for its authority
-  (section 6).
-  - It sends at most one fetch in flight per (session, grantor). Further early records for the
-    same grantor join the fetch already in flight.
-  - The early record is held in memory only for that fetch, as its signed fields only, under a key
-    made of every signed field plus the signature, so a forged copy cannot displace the genuine
-    one. At most 64 records, and at most 64 KiB, are held per session. A held record is never
-    written and never relayed. A record whose fields are malformed (a nodeId that is not canonical
-    lowercase or is over 128 characters, a role name over 32) is never held.
-- A node answers `role-chain` for each fetch it receives, paced per session by a token bucket of
-  4 a second (burst 16). Fetches past that are dropped and counted.
-
-**Receiver of the answer.**
-- Reads an answer only if it matches a fetch in flight on that same session. An answer that
-  nobody asked for, or that arrives on another session, is ignored.
-- Offers the grants to its store until a pass stores nothing, so their order does not matter.
-  Each goes through the ordinary ingest: the gossip budget, verification with the vouched key and
-  the cutoff rule (section 6), storing as its signed fields only, and relaying once. A grant in the
-  answer whose signature does not verify ends the session only when its grantor is the session's
-  own peer and the key that failed is the one the session proved; any other is dropped and counted,
-  since it was verified under this node's view of its grantor's keys, which the server's may not
-  share (section 7).
-- Then offers the held records again, in passes until one stores nothing (a held record can wait
-  for another held record that vouches its grantor's key), and drops what is left. Neither the answer's grants nor the held records
-  start a further fetch.
-- A fetch that is not answered within 10 s, or whose session closes, releases its held records.
-  They are dropped.
+## 3. `role-chain-fetch`, `role-chain`, `role-digest`: retired
+
+sym 0.14.0 carried role grants and revokes with three frames of its own (`role-chain-fetch`,
+`role-chain` and `role-digest`) and resolved them by replaying signed times (the earlier sections 3,
+5 and 6 of this file). MMP §6.6 as merged (meshcognition-website main at 8c3381d, PR #40) replaces
+that rule and its frames: authority is a function of a set of hash-linked statements with no time in
+it, carried by `authority-statement`, `authority-digest`, `authority-fetch` and `authority-set`
+(§6.6.8, authority-frame.schema.json). sym implements §6.6 as written (lib/core/authority.js,
+lib/authority-store.js, lib/node-authority.js) and treats `role-grant`, `role-revoke`,
+`role-chain-fetch`, `role-chain` and `role-digest` as retired (§6.6.11): received, they are ignored and
+counted (`authorityStatus().stats.retired`), and they are never sent. Nothing in this file adds to
+§6.6; where sym chooses among what §6.6 allows, it is said here.
+
+- **Pacing (§6.6.8).** A responder answers `authority-fetch` at 4 a second per session (burst 16).
+  Over the rate a request waits its turn (at most 64 wait; past that one is dropped), so an asker
+  that keeps one pull in flight gets every page. sym does not take the MAY to refuse a fresh full
+  pull within 60 s: the pacing bounds the work, and a refused pull would leave differing roots
+  apart until the peer's set next changed.
+- **The cost of a new key (§6.6.12).** Every statement a session delivers spends that peer's gossip
+  lane before it is checked: one check, plus 16 for each key it names that this node has not seen
+  (a grant's subject key; the signing key, when it will be verified; pinned keys an anchor-level
+  statement's entries name). Rules 1 and 2 of §18.3.2 cost one scalar multiplication for a new key,
+  about fifteen signature checks here. A statement not of the schema's shape, and a repeat of one
+  held, cost nothing. Unsolicited statements over the lane are dropped (a pull brings them later);
+  an answer to this node's own fetch or pull is never dropped: its cost is charged as a debt, and
+  the next page is asked for only once the debt is repaid.
+- **Pulls.** An unanswered page is asked again from the same cursor, up to 3 times. A digest that
+  arrives during a pull is remembered, and if the roots still differ when the pull ends, the pull
+  starts again.
+- **Persistence (§6.6.8).** Held statements are written as their canonical members only, to
+  `authority/statements-<pin digest>.jsonl` in the node's directory: a statement means something only
+  under the pin it was verified against, so a node started under another pin reads another file and
+  leaves this one as it was. At load every statement is verified again, chain by chain, and the set
+  resolved afresh; no status, root or receipt time is stored.
+- **Scopes (§6.6.2).** A scope's namespace is implemented by an extension. sym implements none by
+  itself: a host passes `authorityScopes: { <namespace>: (path, cmb, scope) => boolean }`, judged on
+  the CMB's own signed fields. Where a namespace is not implemented a scoped grant is still resolved
+  (it counts toward quotas and roots), and confers nothing on any CMB.
 
 ---
 
@@ -209,143 +170,10 @@ at most once a second. A live peer answers `pong`; a restarted one answers 1011.
 
 ---
 
-## 5. `role-digest`: anti-entropy for grants and revokes
+## 5. Who a failed signature is charged to
 
-**Why.** Gossip is relay-once. A grant or revoke dropped on its way (a full hold, a budget, a
-session that ended) was never sent again, and a revoke lost that way left a revoked node's
-authority standing (security review D, p7-ceiling).
-
-**Frame** (sealed control frame):
-
-```json
-{ "type": "role-digest", "count": 12, "digest": "<64 lowercase hex>" }
-```
-
-- `count`: the role-grant and role-revoke records the sender holds.
-- `digest`: lowercase hex SHA-256 over the canonical spellings of those records' signatures,
-  sorted, each followed by `\n`. Two nodes holding the same records give the same digest.
-
-**When it is sent.** To every newly admitted session, after `cmb-anchors`, whatever the sender
-holds (`count` 0 for an empty store). It is therefore also the first authenticated frame a relay
-client hears from its server on a new session: a client that re-handshakes while it holds a
-confirmed session keeps the old one until the new one carries such a frame (it cannot otherwise
-know the server took its `client-finish`), and closes a new one that hears nothing within the
-handshake timeout (`unconfirmed-by-peer`).
-
-**Receiver.** If `count` is above 0, the digest differs from its own, and no whole-store sync is
-in flight on that session, it asks for the sender's store with a whole-store `role-chain-fetch` (section 3), page
-by page. Each record goes through the ordinary ingest, so what the receiver already holds costs
-nothing and what is new is relayed once. A digest is a hint: nothing is taken on its word.
-
----
-
-## 6. Grants and revokes: what is kept, and what counts (replaces draft spec PR #33's rule)
-
-**Why.** Two things went wrong in 0.14.0's first two designs, and both made the mesh disagree.
-Draft spec PR #33 counted a statement only if its signer was authorised both at its signed time and
-when the receiver received it, so nodes that received a genuine revoke at different times resolved
-different authority. Its first replacement still decided at ingest whether a record was rooted, and
-bounded records with caps that refused newcomers, so two nodes holding the same records kept
-different subsets depending on arrival order, their digests never matched, and every session between
-them ran a whole-store sync. The rule below makes the kept set and the resolved authority functions
-of the records held: no receipt time, no arrival order. (The founder's rulings, 2026-10.)
-
-### 6.1 Fields
-
-A `role-revoke` carries:
-
-- `cutoff`: an integer, milliseconds since the epoch, `0 <= cutoff <= grantedAt`: the time from
-  which the revoked node is no longer trusted. sym 0.14.0 requires it on every revoke it signs
-  (`revokeRole(nodeId, { cutoff })` has no default). A revoke without one (0.13) has
-  `cutoff = grantedAt`.
-- `ratify` (optional): the revoked node's statements that stay valid, as their canonical signatures
-  (86 unpadded base64url characters), sorted ascending, no repeats, 1 to 64 entries. Only on a revoke
-  that carries `cutoff`. A revoker that must ratify more issues several revokes; each counts.
-
-Both are signed. The §6.5 grant payload gains `|<cutoff>` at its end when the revoke carries a
-cutoff, and then `|<ratify joined by ",">` when it carries `ratify`:
-
-```
-role-revoke|<grantee>|<role or empty>|<grantedBy>|<grantedAt>|<granteeKey or empty>|<cutoff>|<sig1>,<sig2>
-```
-
-A revoke without `cutoff` signs exactly the bytes MMP v2.0 signs today. Malformed: a `cutoff` or
-`ratify` on a `role-grant`; a cutoff after `grantedAt`; `ratify` without `cutoff`, empty, unsorted,
-repeated, over 64 entries or holding anything but a canonical signature; a revoke `granteeKey` that
-is neither empty nor a 43-character key; a `role` containing `|`. So no two records sign the same
-bytes.
-
-### 6.2 What is kept: a deterministic function of the records held
-
-1. **Verifiable.** A record is kept only when its signature verifies under the anchor's configured
-   key (its grantor is the anchor) or under a key that a kept `role-grant` vouches for its grantor
-   (`granteeKey`). Whether the grantor had authority is not asked here: a verifiable record is kept
-   and its effect is decided at resolution (6.3), so no record is refused for an order in which
-   records happened to arrive. A record whose grantor no kept grant vouches is refused
-   (`unknown-grantor-key`) and held for a `role-chain-fetch` (section 3).
-2. **Depth and subtree.** The anchor signs at depth 0. A grant kept at depth d makes its
-   (grantee, granteeKey) a signer at depth d + 1, in the subtree of the anchor grantee at the top of
-   that chain. A signer reachable by several chains takes the shallowest, then the one whose subtree
-   root has the smallest nodeId.
-3. **Budget per delegation subtree.** The anchor's own records are not bounded. Every other record
-   counts against the subtree of its signer: everything an anchor grantee and its descendants sign
-   shares that one budget (sym: 4,096 records). One subtree, however compromised, cannot fill
-   another's budget, so a revoke signed in another subtree is never refused by it.
-4. **Selection.** Inside a subtree the kept records are the first, up to the budget, in this total
-   order on signed fields: the signer's depth (shallower first); revokes before grants; a revoke's
-   cutoff, or a grant's `grantedAt` (earlier first); the canonical signature (smaller first). A
-   record that loses is replaced: a record that ranks above the last one kept takes its place, and
-   one that ranks below it is refused (`outranked`). Several revokes by one revoker for one grantee
-   are all kept while they fit; the earliest cutoff is the one that matters, so a revoker can always
-   tighten its cutoff by signing another revoke.
-5. **Equal stores.** Two nodes that hold the same records keep the same records and give the same
-   `role-digest`, whatever order they learned them in.
-
-Selection is computed over the records held: a record refused or replaced is not kept for later.
-Where a later grant gives a signer a shallower chain through another subtree, that signer's
-records move between budgets, and a record refused earlier in the budget they left is not
-reconsidered until a peer offers it again (the next whole-store sync after `role-digest`s differ).
-
-### 6.3 What counts: resolution
-
-For a node N holding key K, its role at time T is resolved from the kept records. "Now" is the
-resolving node's clock.
-
-1. The anchor holding its configured key is `anchor`.
-2. Otherwise take N's grants with `granteeKey = K` and `grantedAt <= T`, and N's revokes with
-   `cutoff <= T`. Replay them in `grantedAt` order (a revoke at its own `grantedAt`, even when that
-   is after T), from `participant`.
-3. **Every statement by a signer S (key k), signed at s, counts only if S held the rank it needs at
-   s** (a revoke of S whose cutoff is at or before s has already cleared S there, so a statement
-   S signs at or after its cutoff never counts), **and either S still holds that rank now, or an
-   effective revoke of S ratifies it** (lists its signature, with s before that revoke's cutoff).
-   So a revoked key gains nothing by backdating: what it signs after its revoke, dated before its
-   cutoff, is not ratified and its signer no longer holds rank.
-4. A grant G by S confers G's role if step 3 holds and, unless G is ratified, S holds at least G's
-   role at T as well (§6.6's cascade). A ratified grant keeps conferring after its grantor's
-   revoke.
-5. A revoke R by revoker Q clears N to `participant` if step 3 holds for R and Q's rank is at least
-   `validator`, and at least the role being cleared, **at every time from R's cutoff to R's signed
-   time** (roles change only where some record's time is crossed, so it is checked at each of those
-   breakpoints in that span): a revoker reaches back only over time it was itself authorised for. An
-   effective revoke is one for which this holds; only an effective revoke ratifies.
-6. A rank is 0 when the resolved node already sits at the delegation depth (8, draft spec PR #36).
-   Cycles and chains that do not reach the anchor confer nothing.
-
-Every time in the rule is a signed time, or now. Nothing depends on when a node received a record.
-
-**Attestations.** An attestation's signer counts with its role at the attestation's signed time,
-under step 3: if it no longer holds that role now and no effective revoke of it ratifies the
-attestation (by its signature), it counts as `participant`. An attestation dated before the attested
-record's signed `createdTimestamp` is refused where the record is known (it attests to what did not
-yet exist).
-
----
-
-## 7. Who a failed signature is charged to
-
-**Why.** A statement relayed on a session (a record, an attestation, a checkpoint, a witness, a
-grant) is verified under the receiver's binding for its signer, and bindings are local views: the
+**Why.** A statement relayed on a session (a record, an attestation, a checkpoint, a witness) is
+verified under the receiver's binding for its signer, and bindings are local views: the
 receiver may hold a squatter's session-scoped binding for that nodeId, or lack a vouch the relayer
 holds. Closing the relayer's session for a statement that fails there closed honest relaying peers
 whenever a squatter held a signer's nodeId (sym 0.14.0 re-review N1).
@@ -365,3 +193,10 @@ from another peer is still taken.
   until the minute ends. The peer is not blamed and its other statements are taken;
 - says each refused record at most once a minute per peer and reason, and records it in its
   decision log at most as often.
+
+**Authority statements are not charged this way.** An `authority-statement` is verified under the
+key its own chain names (the subject key of its authorising grant, or the pinned keys), never a
+registry binding (MMP §6.6.9), so the views above cannot differ and no session is closed for one.
+One that fails is dropped and counted against the delivering session (§6.6.8: rate-limited): past 8
+failures in a minute for one signing key, that session's statements under that key are dropped
+unread for the rest of the minute.
diff --git a/lib/attestation-store.js b/lib/attestation-store.js
index 9d5e89ea..c0be986b 100644
--- a/lib/attestation-store.js
+++ b/lib/attestation-store.js
@@ -294,8 +294,9 @@ class AttestationStore {
     if (opts.ingested && !this._allowIngest(att.of, att.by, opts.now ?? Date.now())) {
       return { stored: false, reason: 'rate-limited' };
     }
-    // No receipt time is kept: an attestation counts by its signer's role at its signed time, a revoke
-    // taking effect from its cutoff (re-review N2), so when this node received it plays no part.
+    // No receipt time is kept: an attestation counts by its signer's role in the in-force set when the
+    // weight is applied (MMP §6.6.10), so neither its signed time nor when this node received it plays
+    // a part.
 
     let mine = this._heldBy.get(att.by);
     if (mine) this._heldBy.delete(att.by);
diff --git a/lib/authority-store.js b/lib/authority-store.js
new file mode 100644
index 00000000..0f523622
--- /dev/null
+++ b/lib/authority-store.js
@@ -0,0 +1,496 @@
+'use strict';
+
+/**
+ * @module @sym-bot/sym/authority-store
+ * @description MMP §6.6: authority is a function of a set. A node's view of authority is computed
+ * from the verified grant, revoke and endorse statements it holds, and from nothing else: not the
+ * order they arrived in, not any clock, not the session that delivered them. Statements name one
+ * another by the hash of their signed bytes, so the graph is fixed when they are signed, and two nodes
+ * holding the same statements under the same pin resolve the same in-force set and the same root.
+ *
+ * This module holds the statements and resolves them:
+ *
+ *   - INGEST (§6.6.3 validity, static): well formed, rooted within MAX_DELEGATION_DEPTH links,
+ *     signed (an anchor-level statement by the pin's threshold of distinct pinned keys, each copy
+ *     judged on its own entries; any other by the subject key of its authorising grant), and
+ *     permitted by its authorising grant's role and scope. A statement whose chain is not held is
+ *     PENDING (its own signature is checked first); the caller holds it per session (§6.6.8).
+ *   - RESOLVE (§6.6.4): the two-phase, depth-ordered algorithm, exactly: per depth, the revokes and
+ *     endorses (phase A), then the grants (phase B); each bucket keeps its own statements first, by
+ *     ascending id, within AUTHORITY_QUOTA (the anchor's AUTHORITY_ANCHOR_QUOTA) and
+ *     AUTHORITY_DELEGATE_QUOTA; a statement a revoke cut off is rescued only by an in-force endorse
+ *     that may rescue it, charged to that endorser's bucket, falling through to the next endorser by id
+ *     when a bucket is full; a statement cut off by a quota is never rescued.
+ *   - THE LIVE SET and THE ROOT (§6.6.7); authority order, fetch answers and pages (§6.6.8).
+ *   - PERSISTENCE: statements are kept on disk with no integrity of their own, in a file named by
+ *     the pin's digest (a statement means something only under the pin it was verified against, so
+ *     a node started under another pin reads another file and leaves this one as it was). At load
+ *     each is verified again against the pinned anchor and the set resolved afresh. No status, root
+ *     or receipt time is read from disk.
+ *
+ * @copyright 2026 SYM.BOT Ltd.
+ * @license Apache-2.0
+ */
+
+const fs = require('fs');
+const path = require('path');
+const A = require('./core/authority');
+
+/** The statements verified under one pin: `statements-<pin digest>.jsonl` in the store's directory. */
+const fileFor = (pinDigest) => `statements-${pinDigest}.jsonl`;
+/**
+ * Statements held at most. A node MUST keep its live set and MAY drop the rest (§6.6.5, §6.6.7);
+ * past this it drops dead and over-quota statements that are not live, highest id first, and refuses
+ * new ones only when the live set alone fills it.
+ */
+const MAX_HELD = 200_000;
+
+const kindGroup = (k) => (k === 'grant' ? 1 : 0); // revokes and endorses before grants (authority order)
+
+class AuthorityStore {
+  /**
+   * @param {object} opts
+   * @param {object|null} opts.pin - a parsed pin (core/authority parsePin), or null: nothing is in force
+   * @param {string} [opts.dir] - where statements persist
+   * @param {number} [opts.quota] - in place of AUTHORITY_QUOTA (tests: the vector's testQuota)
+   * @param {number} [opts.delegateQuota] - in place of AUTHORITY_DELEGATE_QUOTA
+   * @param {number} [opts.maxHeld]
+   * @param {function} [opts.log]
+   */
+  constructor(opts = {}) {
+    this._pin = opts.pin || null;
+    this._pinKeys = new Set(this._pin ? this._pin.members.map((m) => m.key) : []);
+    this._quota = Number.isSafeInteger(opts.quota) && opts.quota > 0 ? opts.quota : A.AUTHORITY_QUOTA;
+    this._anchorQuota = A.AUTHORITY_ANCHOR_QUOTA;
+    this._delegateQuota = Number.isSafeInteger(opts.delegateQuota) && opts.delegateQuota > 0 ? opts.delegateQuota : A.AUTHORITY_DELEGATE_QUOTA;
+    this._maxHeld = Number.isSafeInteger(opts.maxHeld) && opts.maxHeld > 0 ? opts.maxHeld : MAX_HELD;
+    this._log = typeof opts.log === 'function' ? opts.log : () => {};
+    this._held = new Map(); // id -> entry { id, s, kind, authBy, depth, chain, role, scope, subject, targets }
+    this._resolved = null;  // the last resolution, or null when the held set changed since
+    this._pinDigest = this._pin ? A.pinDigest(this._pin) : null;
+    this._dir = opts.dir || null;
+    this._loading = false;
+    this._loadReport = { held: 0, pending: 0, invalid: 0 };
+    if (this._dir && this._pin) this._load();
+  }
+
+  /** Whether an anchor is pinned. Where none is, nothing is in force (§6.6.1). */
+  get anchored() { return !!this._pin; }
+  get pin() { return this._pin; }
+  get pinDigest() { return this._pinDigest; }
+  loadReport() { return { ...this._loadReport }; }
+  size() { return this._held.size; }
+  has(id) { return this._held.has(id); }
+  /** A held statement (its canonical form, with the signature entries that counted), or null. */
+  get(id) { const e = this._held.get(id); return e ? e.s : null; }
+  depthOf(id) { const e = this._held.get(id); return e ? e.depth : null; }
+
+  // ── Ingest: §6.6.3 validity ───────────────────────────────────────────────────
+
+  /**
+   * Check one statement and hold it if it is valid.
+   * @returns {{ result: 'held'|'duplicate'|'pending'|'invalid', id?: string, reason?: string, missing?: string }}
+   */
+  ingest(statement) {
+    const bad = A.malformedReason(statement);
+    if (bad) return { result: 'invalid', reason: `not well formed: ${bad}` };
+    const id = A.statementId(statement);
+    if (this._held.has(id)) return { result: 'duplicate', id };
+    if (!this._pin) return { result: 'invalid', id, reason: 'no anchor is pinned' };
+    const v = this._validate(statement, id);
+    if (v.result !== 'valid') return { ...v, id };
+    if (this._held.size >= this._maxHeld && !this._makeRoom()) return { result: 'invalid', id, reason: 'the store is full of live statements' };
+    this._held.set(id, v.entry);
+    this._resolved = null;
+    this._append(v.entry.s);
+    return { result: 'held', id };
+  }
+
+  /** @private Rules 2 to 4, for a well-formed statement not held. */
+  _validate(s, id) {
+    const bytes = A.payload(s);
+    if (s.authorisedBy === 'anchor') {
+      // §6.6.1: at least t distinct pinned keys, each verifying; only the entries counted are kept, and
+      // each copy is judged on its own entries (never merged with another copy's).
+      const counted = [];
+      const seen = new Set();
+      for (const e of s.sigs) {
+        if (!this._pinKeys.has(e.key) || seen.has(e.key)) continue;
+        if (!A.entryVerifies(s, e, bytes)) continue;
+        seen.add(e.key);
+        counted.push(e);
+      }
+      if (counted.length < this._pin.threshold) return { result: 'invalid', reason: `${counted.length} of the ${this._pin.threshold} anchor signatures it needs` };
+      return { result: 'valid', entry: this._entry(s, id, counted, 1, []) };
+    }
+    const auth = this._held.get(s.authorisedBy);
+    if (!auth) {
+      // §6.6.8: a pending statement's own signature is checked, with the key its entry names, before
+      // anything else; one that fails is discarded.
+      if (!A.entryVerifies(s, s.sigs[0], bytes)) return { result: 'invalid', reason: 'its signature does not verify' };
+      return { result: 'pending', missing: s.authorisedBy };
+    }
+    if (auth.kind !== 'grant') return { result: 'invalid', reason: 'authorisedBy names a statement that is not a grant' };
+    const depth = auth.depth + 1;
+    if (depth > A.MAX_DELEGATION_DEPTH) return { result: 'invalid', reason: `deeper than ${A.MAX_DELEGATION_DEPTH}` };
+    const entry = s.sigs[0];
+    if (entry.key !== auth.subject.key) return { result: 'invalid', reason: 'not signed by the subject key of its authorising grant' };
+    if (!A.entryVerifies(s, entry, bytes)) return { result: 'invalid', reason: 'its signature does not verify' };
+    const why = this._notPermitted(s, auth);
+    if (why) return { result: 'invalid', reason: why };
+    return { result: 'valid', entry: this._entry(s, id, [entry], depth, [auth.id, ...auth.chain]) };
+  }
+
+  /** @private §6.6.2 / §6.6.3 rule 4: what the authorising grant's role permits, and scope narrowing. */
+  _notPermitted(s, auth) {
+    const role = auth.role;
+    if (s.kind === 'grant') {
+      if (role === 'admin') { /* admin, validator, issuer and any non-authority role */ }
+      else if (role === 'validator' || role === 'issuer') { if (!A.isNonAuthority(s.role)) return `a ${role} grants non-authority roles only`; }
+      else return `a ${role} grant permits no statement`;
+      if (!A.scopeNarrows(auth.scope, s.scope === undefined ? null : s.scope)) return 'its scope would widen its authorising grant\'s';
+      return null;
+    }
+    if (s.kind === 'revoke') return A.isDelegating(role) ? null : `a ${role} may not revoke`;
+    return role === 'admin' ? null : `a ${role} may not endorse`;
+  }
+
+  /** @private The held form of a valid statement. */
+  _entry(s, id, sigs, depth, chain) {
+    const c = A.canonicalStatement(s, sigs);
+    return {
+      id, s: c, kind: c.kind, authBy: c.authorisedBy, depth, chain,
+      role: c.kind === 'grant' ? c.role : null,
+      scope: c.kind === 'grant' && c.scope !== undefined ? c.scope : null,
+      subject: c.kind === 'grant' ? c.subject : null,
+      targets: c.kind === 'grant' ? null : c.targets,
+    };
+  }
+
+  // ── Resolution: §6.6.4 ────────────────────────────────────────────────────────
+
+  /**
+   * Resolve the held set (memoised until it changes).
+   * @returns {{ status: Map<string, string>, inForce: Set<string>, keptBy: Map<string, string>, live: Set<string>, root: string|null }}
+   */
+  resolve() {
+    if (this._resolved) return this._resolved;
+    const held = this._held;
+    const status = new Map();
+    const F = new Set();
+    const keptBy = new Map();
+    const count = new Map();
+    const delegates = new Map();
+    // Index: buckets by depth, and for every id the revokes and endorses naming it, ascending id.
+    const byDepth = new Map(); // depth -> Map(bucket -> entries)
+    const namers = new Map();
+    for (const e of held.values()) {
+      let buckets = byDepth.get(e.depth);
+      if (!buckets) { buckets = new Map(); byDepth.set(e.depth, buckets); }
+      let b = buckets.get(e.authBy);
+      if (!b) { b = []; buckets.set(e.authBy, b); }
+      b.push(e);
+      if (e.targets) for (const t of e.targets) {
+        let l = namers.get(t);
+        if (!l) { l = []; namers.set(t, l); }
+        l.push(e);
+      }
+    }
+    const byId = (x, y) => (x.id < y.id ? -1 : x.id > y.id ? 1 : 0);
+    for (const l of namers.values()) l.sort(byId);
+    const inForce = (bucket) => bucket === 'anchor' || F.has(bucket);
+    const Q = (bucket) => (bucket === 'anchor' ? this._anchorQuota : this._quota);
+    const keep = (bucket, e) => {
+      if ((count.get(bucket) || 0) >= Q(bucket)) return false;
+      const delegating = e.kind === 'grant' && A.isDelegating(e.role);
+      if (delegating && bucket !== 'anchor' && (delegates.get(bucket) || 0) >= this._delegateQuota) return false;
+      count.set(bucket, (count.get(bucket) || 0) + 1);
+      if (delegating) delegates.set(bucket, (delegates.get(bucket) || 0) + 1);
+      F.add(e.id);
+      keptBy.set(e.id, bucket);
+      status.set(e.id, 'in-force');
+      return true;
+    };
+    // r may remove g: r is anchor-level or authorised by a grant above g.
+    const mayRemove = (r, g) => g.kind === 'grant' && (r.authBy === 'anchor' || g.chain.includes(r.authBy));
+    // e may rescue s: s is a grant or revoke, not anchor-level, and e is anchor-level or authorised by
+    // a grant above s's authorising grant.
+    const mayRescue = (e, s) => {
+      if (s.kind === 'endorse' || s.authBy === 'anchor') return false;
+      if (e.authBy === 'anchor') return true;
+      const auth = held.get(s.authBy);
+      return !!auth && auth.chain.includes(e.authBy);
+    };
+    const removed = (g) => (namers.get(g.id) || []).some((r) => r.kind === 'revoke' && F.has(r.id) && mayRemove(r, g));
+    // Past the dead grants on s's chain, the first is removed (cut by a revoke). Over quota is a cut
+    // by a quota, which is never rescued.
+    const cutByRevoke = (s) => {
+      for (const gid of s.chain) {
+        const st = status.get(gid);
+        if (st === 'dead') continue;
+        return st === 'removed';
+      }
+      return false;
+    };
+    const rescue = (s) => {
+      let tried = false;
+      for (const e of namers.get(s.id) || []) {
+        if (e.kind !== 'endorse' || !F.has(e.id) || !mayRescue(e, s)) continue;
+        tried = true;
+        if (keep(e.authBy, s)) return;
+      }
+      status.set(s.id, tried ? 'over-quota' : 'dead');
+    };
+    for (let d = 1; d <= A.MAX_DELEGATION_DEPTH; d++) {
+      const buckets = byDepth.get(d);
+      if (!buckets) continue;
+      const kept = [];
+      const other = [];
+      for (const [bucket, entries] of buckets) (inForce(bucket) ? kept : other).push([bucket, entries]);
+      // Phase A: the revokes and endorses at depth d.
+      for (const [bucket, entries] of kept) {
+        for (const s of entries.filter((x) => x.kind !== 'grant').sort(byId)) if (!keep(bucket, s)) status.set(s.id, 'over-quota');
+      }
+      let candidates = [];
+      for (const [, entries] of other) {
+        for (const s of entries) {
+          if (s.kind === 'grant') continue;
+          if (s.kind === 'endorse') status.set(s.id, 'dead');
+          else if (cutByRevoke(s)) candidates.push(s);
+          else status.set(s.id, 'dead');
+        }
+      }
+      for (const s of candidates.sort(byId)) rescue(s);
+      // Phase B: the grants at depth d.
+      for (const [bucket, entries] of kept) {
+        for (const g of entries.filter((x) => x.kind === 'grant').sort(byId)) {
+          if (removed(g)) status.set(g.id, 'removed');
+          else if (!keep(bucket, g)) status.set(g.id, 'over-quota');
+        }
+      }
+      candidates = [];
+      for (const [, entries] of other) {
+        for (const g of entries) {
+          if (g.kind !== 'grant') continue;
+          if (!cutByRevoke(g)) status.set(g.id, 'dead');
+          else if (removed(g)) status.set(g.id, 'removed');
+          else candidates.push(g);
+        }
+      }
+      for (const g of candidates.sort(byId)) rescue(g);
+    }
+    // The live set: the in-force set and the grants on its members' chains (§6.6.7).
+    const live = new Set(F);
+    for (const id of F) for (const gid of held.get(id).chain) live.add(gid);
+    const root = this._pin ? A.authorityRoot(this._pinDigest, F) : null;
+    this._resolved = { status, inForce: F, keptBy, live, root };
+    return this._resolved;
+  }
+
+  /** A held statement's status: in-force, removed, over-quota or dead; undefined when not held. */
+  statusOf(id) { return this.resolve().status.get(id); }
+  isInForce(id) { return this.resolve().inForce.has(id); }
+  root() { return this.resolve().root; }
+  /** For authority-digest (§6.6.8): the root and the in-force count. */
+  digest() { const r = this.resolve(); return { root: r.root, count: r.inForce.size }; }
+
+  // ── Roles: §6.6.4 "roles follow the key" ─────────────────────────────────────
+
+  /**
+   * The roles `nodeId` holding `key` has: those of the in-force grants whose subject is that nodeId
+   * and that key, each with its scope (null: the whole mesh), plus `anchor` for a pinned member of a
+   * threshold-1 anchor pinned with that nodeId and key.
+   * @returns {{ role: string, scope: string|null, grant: string|null }[]}
+   */
+  rolesOf(nodeId, key) {
+    const out = [];
+    if (!this._pin || typeof nodeId !== 'string' || typeof key !== 'string') return out;
+    if (this._pin.threshold === 1 && this._pin.members.some((m) => m.key === key && m.nodeId === nodeId)) out.push({ role: 'anchor', scope: null, grant: null });
+    const { inForce } = this.resolve();
+    for (const id of inForce) {
+      const e = this._held.get(id);
+      if (e.kind === 'grant' && e.subject.nodeId === nodeId && e.subject.key === key) out.push({ role: e.role, scope: e.scope, grant: id });
+    }
+    return out;
+  }
+
+  /**
+   * The lifecycle authority (§3.5) `nodeId` holding `key` has over one CMB: the highest of its roles
+   * whose scope contains it — 'canonical' (anchor, admin), 'validated' (validator), or 'none'.
+   * `contains(scope)` says whether the CMB is inside a scope (the extension owning its namespace
+   * decides; a namespace this node does not implement contains nothing). An unscoped role contains
+   * every CMB.
+   * @param {(scope: string) => boolean} [contains]
+   */
+  lifecycleOver(nodeId, key, contains = () => false) {
+    return lifecycleOf(this.rolesOf(nodeId, key), contains);
+  }
+
+  /**
+   * The key the in-force grants name for `nodeId` (§6.6.9: a binding source, a view over what is in
+   * force now): undefined when none does, or when two different keys do.
+   */
+  grantKey(nodeId) {
+    const { inForce } = this.resolve();
+    let found;
+    for (const id of inForce) {
+      const e = this._held.get(id);
+      if (e.kind !== 'grant' || e.subject.nodeId !== nodeId) continue;
+      if (found !== undefined && found !== e.subject.key) return undefined;
+      found = e.subject.key;
+    }
+    return found;
+  }
+
+  /** The in-force grants naming `nodeId` with a key other than `key` (a foreign key for this node). */
+  foreignGrantsFor(nodeId, key) {
+    const out = [];
+    for (const id of this.resolve().inForce) {
+      const e = this._held.get(id);
+      if (e.kind === 'grant' && e.subject.nodeId === nodeId && e.subject.key !== key) out.push(e.s);
+    }
+    return out;
+  }
+
+  /** In-force grants (held, canonical), for a host's listing. */
+  inForceStatements() { return [...this.resolve().inForce].map((id) => this._held.get(id).s); }
+
+  // ── Serving: §6.6.8 ──────────────────────────────────────────────────────────
+
+  /** @private Authority order: ascending depth; revokes and endorses before grants; ascending id. */
+  _orderKey(e) { return `${e.depth}.${kindGroup(e.kind)}.${e.id}`; }
+
+  /** Statements in authority order. */
+  authorityOrder(ids) {
+    return [...ids].map((id) => this._held.get(id)).filter(Boolean)
+      .sort((x, y) => (x.depth - y.depth) || (kindGroup(x.kind) - kindGroup(y.kind)) || (x.id < y.id ? -1 : x.id > y.id ? 1 : 0));
+  }
+
+  /**
+   * An answer to authority-fetch by ids: each named statement in the live set with its chain, and every
+   * in-force revoke and endorse naming a statement in the answer, each with its chain; in authority
+   * order, at most AUTHORITY_PAGE statements. What is not served is listed missing.
+   * @returns {{ statements: object[], missing: string[] }}
+   */
+  answerIds(ids) {
+    const { live, inForce } = this.resolve();
+    const chosen = new Set();
+    const missing = [];
+    const withChain = (id) => [id, ...this._held.get(id).chain];
+    for (const id of ids) {
+      if (!live.has(id)) { missing.push(id); continue; }
+      const add = new Set(withChain(id).filter((x) => !chosen.has(x)));
+      // The in-force revokes and endorses naming anything in the answer so far, with their chains.
+      for (const x of [...add, ...chosen]) {
+        for (const e of this._namersOf(x)) if (inForce.has(e.id) && !chosen.has(e.id)) for (const y of withChain(e.id)) if (!chosen.has(y)) add.add(y);
+      }
+      if (chosen.size + add.size > A.AUTHORITY_PAGE) { missing.push(id); continue; }
+      for (const x of add) chosen.add(x);
+    }
+    return { statements: this.authorityOrder(chosen).map((e) => e.s), missing };
+  }
+
+  /** @private The held revokes and endorses naming `id`. */
+  _namersOf(id) {
+    if (!this._namerIndex || this._namerIndexAt !== this._resolved) {
+      const m = new Map();
+      for (const e of this._held.values()) if (e.targets) for (const t of e.targets) { let l = m.get(t); if (!l) { l = []; m.set(t, l); } l.push(e); }
+      this._namerIndex = m;
+      this._namerIndexAt = this._resolved;
+    }
+    return this._namerIndex.get(id) || [];
+  }
+
+  /**
+   * A page of the live set in authority order after `after` (an opaque cursor: '' for the start).
+   * @returns {{ statements: object[], next: string|null }}
+   */
+  page(after) {
+    const { live } = this.resolve();
+    const all = this.authorityOrder(live);
+    let i = 0;
+    if (typeof after === 'string' && after) {
+      while (i < all.length && this._orderKeyCompare(this._orderKey(all[i]), after) <= 0) i++;
+    }
+    const slice = all.slice(i, i + A.AUTHORITY_PAGE);
+    const more = i + slice.length < all.length;
+    return { statements: slice.map((e) => e.s), next: more && slice.length ? this._orderKey(slice[slice.length - 1]) : null };
+  }
+
+  /** @private Compare two order keys `${depth}.${group}.${id}`. */
+  _orderKeyCompare(a, b) {
+    const [da, ga, ia] = a.split('.'); const [db, gb, ib] = String(b).split('.');
+    return (Number(da) - Number(db)) || (Number(ga) - Number(gb)) || (ia < ib ? -1 : ia > ib ? 1 : 0);
+  }
+
+  // ── Retention and persistence ─────────────────────────────────────────────────
+
+  /** @private Drop non-live statements (dead, removed, over quota), highest id first, to make room. */
+  _makeRoom() {
+    const { live } = this.resolve();
+    const droppable = [...this._held.keys()].filter((id) => !live.has(id)).sort().reverse();
+    const n = Math.max(1, Math.ceil(this._maxHeld / 16));
+    for (const id of droppable.slice(0, n)) this._held.delete(id);
+    this._resolved = null;
+    return this._held.size < this._maxHeld;
+  }
+
+  /** @private Append a held statement to the file (best effort; the file carries no authority). */
+  _append(s) {
+    if (!this._dir || this._loading || !this._pin) return;
+    try { fs.mkdirSync(this._dir, { recursive: true }); fs.appendFileSync(path.join(this._dir, fileFor(this._pinDigest)), JSON.stringify(s) + '\n', { mode: 0o600 }); }
+    catch { /* best effort */ }
+  }
+
+  /**
+   * @private Read the file and verify every statement again, chain by chain, against the pinned
+   * anchor: offered in passes until one holds nothing more, so file order does not matter. Nothing
+   * read from disk is trusted for being there. Statements still pending stay on disk for the next
+   * load; the file is then rewritten as the held and pending statements (no status or root is kept).
+   */
+  _load() {
+    const file = path.join(this._dir, fileFor(this._pinDigest));
+    let text = '';
+    try { text = fs.readFileSync(file, 'utf8'); } catch { return; }
+    let pending = [];
+    for (const line of text.split('\n')) {
+      if (!line) continue;
+      try { pending.push(JSON.parse(line)); } catch { this._loadReport.invalid++; }
+    }
+    this._loading = true;
+    const kept = [];
+    try {
+      for (let progress = true; progress && pending.length;) {
+        progress = false;
+        const next = [];
+        for (const s of pending) {
+          const r = this.ingest(s);
+          if (r.result === 'held') { progress = true; kept.push(this._held.get(r.id).s); }
+          else if (r.result === 'pending') next.push(s);
+          else if (r.result !== 'duplicate') this._loadReport.invalid++;
+        }
+        pending = next;
+      }
+    } finally { this._loading = false; }
+    this._loadReport.held = this._held.size;
+    this._loadReport.pending = pending.length;
+    try {
+      const tmp = `${file}.${process.pid}.tmp`;
+      fs.writeFileSync(tmp, [...kept, ...pending].map((s) => JSON.stringify(s)).join('\n') + (kept.length + pending.length ? '\n' : ''), { mode: 0o600 });
+      fs.renameSync(tmp, file);
+    } catch { /* best effort */ }
+  }
+}
+
+/** The lifecycle level of a role list over one CMB (see AuthorityStore#lifecycleOver). */
+function lifecycleOf(roles, contains = () => false) {
+  let level = 0;
+  for (const r of roles) {
+    if (r.scope !== null && !contains(r.scope)) continue;
+    if (r.role === 'anchor' || r.role === 'admin') level = Math.max(level, 2);
+    else if (r.role === 'validator') level = Math.max(level, 1);
+  }
+  return level === 2 ? 'canonical' : level === 1 ? 'validated' : 'none';
+}
+
+module.exports = { AuthorityStore, lifecycleOf, MAX_HELD };
diff --git a/lib/core/attestation.js b/lib/core/attestation.js
index 9364c6cb..31a0a775 100644
--- a/lib/core/attestation.js
+++ b/lib/core/attestation.js
@@ -15,9 +15,9 @@
  * Trust rules NOT enforced here — the receiving node enforces them above this layer
  * (see docs: admission-attestation-design v2):
  *   (a) `role` is CLAIMED. The signature proves the key `by` authored the bytes,
- *       NOT that `by` holds that role. Verify role-at-`at` against the rooted
- *       role-grant chain (use `verifyAttestationRole` with a resolver) and weight
- *       by the RESOLVED role, never the stamped category.
+ *       NOT that `by` holds that role. Resolve it against the receiver's in-force
+ *       authority set when the weight is applied (MMP §6.6.10; `verifyAttestationRole`
+ *       with a resolver) and weight by the RESOLVED role, never the stamped category.
  *   (b) OMISSION-evidence comes from the `seq`/`prev` chain + anchored checkpoints,
  *       reconciled by the node — signatures alone cannot prove absence.
  *   (c) The mechanism is scoped to a permissioned roster (roots authority, bounds
@@ -41,9 +41,11 @@
  */
 
 const crypto = require('crypto');
-const { privateKeyObject, publicKeyObject } = require('./cmb-signing');
+const { privateKeyObject } = require('./cmb-signing');
 const { CAT7_CATEGORIES, lp } = require('./cmb-encoder');
-const { roleRank } = require('./role-grant');
+const { verifyStrict } = require('./ed25519');
+/** Rank for weights (§6.6.10): anchor and admin 2, validator 1, every other role 0. */
+const roleRank = (role) => (role === 'anchor' || role === 'admin' ? 2 : role === 'validator' ? 1 : 0);
 
 /** Per-category verdict vocabulary (MMP §9.2.1; matches CATEGORY_VERDICT in svaf-baseline.js). */
 const VERDICTS = Object.freeze(['admit', 'guard', 'redundant', 'reject', 'silent']);
@@ -112,7 +114,8 @@ function verify(payloadOf, obj, publicKeyB64url) {
   if (!obj || !obj.sig || obj.sigAlg !== 'ed25519') return { signed: false, valid: false };
   if (!publicKeyB64url) return { signed: true, valid: false, error: 'no-public-key' };
   try {
-    const ok = crypto.verify(null, payloadOf(obj), publicKeyObject(publicKeyB64url), Buffer.from(obj.sig, 'base64url'));
+    // MMP §18.3.2: the one Ed25519 rule.
+    const ok = verifyStrict(payloadOf(obj), publicKeyB64url, obj.sig);
     return ok ? { signed: true, valid: true } : { signed: true, valid: false, error: 'bad-signature' };
   } catch (e) {
     return { signed: true, valid: false, error: e.message };
@@ -140,13 +143,15 @@ function verifyAttestation(att, attesterPublicKeyB64url) {
 }
 
 /**
- * Check the CLAIMED role against the role authoritatively resolved for `by` at time `at` from the
- * rooted role-grant chain. `resolveRole(by, at) → role | null` is injected by the node.
+ * Check the CLAIMED role against the role resolved for `by` from the receiver's in-force authority
+ * set now (§6.6.10). `resolveRole(by) → role | null` is injected by the node.
  * @returns {{ claimed: string, resolved: string, matches: boolean, rank: number }}
  */
 function verifyAttestationRole(att, resolveRole) {
   const claimed = (att && att.role) || 'participant';
-  const resolved = ((typeof resolveRole === 'function' && att) ? resolveRole(att.by, att.at) : null) || 'participant';
+  // Resolved against the receiver's in-force set when the weight is applied (§6.6.10): the
+  // attestation's own time is not passed, since authority carries none.
+  const resolved = ((typeof resolveRole === 'function' && att) ? resolveRole(att.by) : null) || 'participant';
   return { claimed, resolved, matches: resolved === claimed, rank: roleRank(resolved) };
 }
 
diff --git a/lib/core/authority.js b/lib/core/authority.js
new file mode 100644
index 00000000..fee94df4
--- /dev/null
+++ b/lib/core/authority.js
@@ -0,0 +1,254 @@
+'use strict';
+
+/**
+ * @module sym/core/authority
+ * @description MMP §6.6 authority statements: grant, revoke and endorse. Their shapes (the schema
+ * authority-frame.schema.json, written out as code so that the schema and this check accept exactly
+ * the same statements), their canonical signed bytes (`mmp-authority-v1`) and their ids, the anchor
+ * pin and its digest, and the authority root. Signatures verify by the one rule of §18.3.2
+ * (./ed25519.js). Resolution lives in lib/authority-store.js.
+ *
+ * Nothing here reads a clock: `issuedAt` is signed information, never an input to anything.
+ *
+ * @copyright 2026 SYM.BOT Ltd.
+ * @license Apache-2.0
+ */
+
+const crypto = require('crypto');
+const { verifyStrict, isPrimeOrderKey } = require('./ed25519');
+
+/** §19.1 constants for §6.6. */
+const MAX_DELEGATION_DEPTH = 4;
+const ANCHOR_MAX_KEYS = 16;
+const AUTHORITY_QUOTA = 256;
+const AUTHORITY_ANCHOR_QUOTA = 4096;
+const AUTHORITY_DELEGATE_QUOTA = 16;
+const AUTHORITY_SCOPE_MAX = 256;
+const AUTHORITY_MAX_TARGETS = 64;
+const AUTHORITY_PAGE = 64;
+const AUTHORITY_PENDING_MAX = 64;
+const AUTHORITY_PENDING_TIMEOUT = 10_000;
+
+const DOMAIN = Buffer.from('mmp-authority-v1\n', 'utf8');
+const PIN_DOMAIN = Buffer.from('mmp-anchor-pin-v1\n', 'utf8');
+const ROOT_DOMAIN = Buffer.from('mmp-authority-root-v1\n', 'utf8');
+
+const STATEMENT_ID = /^auth-[0-9a-f]{64}$/;
+const PUBLIC_KEY = /^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/;
+const SIGNATURE = /^[A-Za-z0-9_-]{85}[AQgw]$/;
+const NONCE = /^[A-Za-z0-9_-]{21}[AQgw]$/;
+const NODE_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+const EXTENSION_ROLE = /^[a-z][a-z0-9]*(-[a-z0-9]+)+$/;
+const SCOPE = /^[a-z][a-z0-9]*(-[a-z0-9]+)*:(?!\.+(\/|$))[A-Za-z0-9._~-]+(\/(?!\.+(\/|$))[A-Za-z0-9._~-]+)*$/;
+
+const CORE_ROLES = new Set(['admin', 'validator', 'issuer', 'participant']);
+/** Delegating roles: their holders sign statements, and a bucket counts their grants (§6.6.2, §6.6.6). */
+const DELEGATING = new Set(['admin', 'validator', 'issuer']);
+
+const isPlain = (v) => v !== null && typeof v === 'object' && !Array.isArray(v) && Object.getPrototypeOf(v) === Object.prototype;
+const onlyKeys = (o, allowed) => Object.keys(o).every((k) => allowed.has(k));
+
+/** Whether `role` is a role a grant may confer (the schema's role): a core role or an extension role. */
+function isRole(role) {
+  return typeof role === 'string' && (CORE_ROLES.has(role) || (role.length <= 64 && EXTENSION_ROLE.test(role)));
+}
+/** A non-authority role: participant, or an extension role. */
+const isNonAuthority = (role) => role === 'participant' || (isRole(role) && !CORE_ROLES.has(role));
+const isDelegating = (role) => DELEGATING.has(role);
+
+/** Whether `scope` is a scope (§6.6.2): an extension namespace and a path of segments, none only dots. */
+function isScope(scope) {
+  return typeof scope === 'string' && scope.length <= AUTHORITY_SCOPE_MAX && SCOPE.test(scope);
+}
+
+/**
+ * Whether `child` equals or narrows `parent` (§6.6.2): the same string, or that string followed by
+ * `/` and more segments. Byte for byte, never normalised. `parent` null is the whole mesh, which every
+ * scope (and none) narrows; a null `child` under a scoped parent would widen it.
+ */
+function scopeNarrows(parent, child) {
+  if (parent === null || parent === undefined) return true;
+  if (child === null || child === undefined) return false;
+  return child === parent || child.startsWith(`${parent}/`);
+}
+
+const GRANT_KEYS = new Set(['kind', 'authorisedBy', 'subject', 'role', 'scope', 'nonce', 'issuedAt', 'sigs']);
+const TARGET_KEYS = new Set(['kind', 'authorisedBy', 'targets', 'nonce', 'issuedAt', 'sigs']);
+const SUBJECT_KEYS = new Set(['nodeId', 'key']);
+const SIG_KEYS = new Set(['key', 'sig']);
+
+/**
+ * §6.6.3 rule 1, the shape alone (cheap: no curve arithmetic): the schema's shape, canonical base64url
+ * fields, a canonical subject nodeId, issuedAt at most 2^53 − 1, a scope that follows the grammar, and
+ * unique targets numbering 1 to 64. The reason is returned when it is not. `malformedReason` adds the
+ * subject key's order.
+ * @returns {string|null} null when the shape is right
+ */
+function shapeReason(s) {
+  if (!isPlain(s)) return 'not an object';
+  if (s.kind !== 'grant' && s.kind !== 'revoke' && s.kind !== 'endorse') return 'kind';
+  if (!onlyKeys(s, s.kind === 'grant' ? GRANT_KEYS : TARGET_KEYS)) return 'a member the schema does not define';
+  if (!(s.authorisedBy === 'anchor' || (typeof s.authorisedBy === 'string' && STATEMENT_ID.test(s.authorisedBy)))) return 'authorisedBy';
+  if (typeof s.nonce !== 'string' || !NONCE.test(s.nonce)) return 'nonce';
+  if (s.issuedAt !== undefined && !(Number.isSafeInteger(s.issuedAt) && s.issuedAt >= 0)) return 'issuedAt';
+  if (!Array.isArray(s.sigs) || s.sigs.length < 1 || s.sigs.length > ANCHOR_MAX_KEYS) return 'sigs';
+  if (s.authorisedBy !== 'anchor' && s.sigs.length !== 1) return 'a non-anchor statement carries one signature';
+  for (const e of s.sigs) {
+    if (!isPlain(e) || !onlyKeys(e, SIG_KEYS)) return 'a signature entry';
+    if (typeof e.key !== 'string' || !PUBLIC_KEY.test(e.key)) return 'a signature entry key';
+    if (typeof e.sig !== 'string' || !SIGNATURE.test(e.sig)) return 'a signature';
+  }
+  if (s.kind === 'grant') {
+    const sub = s.subject;
+    if (!isPlain(sub) || !onlyKeys(sub, SUBJECT_KEYS)) return 'subject';
+    if (typeof sub.nodeId !== 'string' || !NODE_ID.test(sub.nodeId)) return 'subject nodeId';
+    if (typeof sub.key !== 'string' || !PUBLIC_KEY.test(sub.key)) return 'subject key';
+    if (!isRole(s.role)) return 'role';
+    if (s.scope !== undefined && !isScope(s.scope)) return 'scope';
+  } else {
+    if (!Array.isArray(s.targets) || s.targets.length < 1 || s.targets.length > AUTHORITY_MAX_TARGETS) return 'targets';
+    const seen = new Set();
+    for (const t of s.targets) {
+      if (typeof t !== 'string' || !STATEMENT_ID.test(t)) return 'a target';
+      if (seen.has(t)) return 'targets repeat';
+      seen.add(t);
+    }
+  }
+  return null;
+}
+
+/**
+ * §6.6.3 rule 1, whole: well formed, and a grant's subject key the encoding of a point of prime order
+ * (§18.3.2; the one check no JSON Schema can express: a key under which nobody can sign everything).
+ * @returns {string|null} why not, or null
+ */
+function malformedReason(s) {
+  const bad = shapeReason(s);
+  if (bad) return bad;
+  if (s.kind === 'grant' && !isPrimeOrderKey(s.subject.key)) return 'subject key is not of prime order';
+  return null;
+}
+
+/** `<utf8 byte length>:<utf8 bytes>` (§8.8.4). */
+function lp(str) {
+  const b = Buffer.from(String(str), 'utf8');
+  return Buffer.concat([Buffer.from(`${b.length}:`, 'utf8'), b]);
+}
+const bytewise = (a, b) => Buffer.compare(Buffer.from(a, 'utf8'), Buffer.from(b, 'utf8'));
+
+/** The canonical signed bytes of a statement (§6.6.3). Signatures are not part of them. */
+function payload(s) {
+  const parts = [DOMAIN, lp(s.kind), lp(s.authorisedBy)];
+  if (s.kind === 'grant') {
+    parts.push(lp(s.subject.nodeId), lp(s.subject.key), lp(s.role), lp(s.scope === undefined ? '' : s.scope));
+  } else {
+    const targets = [...s.targets].sort(bytewise);
+    parts.push(lp(String(targets.length)), ...targets.map(lp));
+  }
+  parts.push(lp(s.nonce), lp(s.issuedAt === undefined ? '' : String(s.issuedAt)));
+  return Buffer.concat(parts);
+}
+
+/** A statement's id: `auth-` and the lowercase hex SHA-256 of its payload. Computed, never carried. */
+function statementId(s) {
+  return `auth-${crypto.createHash('sha256').update(payload(s)).digest('hex')}`;
+}
+
+/** The statement as the schema defines it, its signature entries as given (`sigs` replaced if passed). */
+function canonicalStatement(s, sigs = s.sigs) {
+  const c = { kind: s.kind, authorisedBy: s.authorisedBy };
+  if (s.kind === 'grant') {
+    c.subject = { nodeId: s.subject.nodeId, key: s.subject.key };
+    c.role = s.role;
+    if (s.scope !== undefined) c.scope = s.scope;
+  } else {
+    c.targets = [...s.targets];
+  }
+  c.nonce = s.nonce;
+  if (s.issuedAt !== undefined) c.issuedAt = s.issuedAt;
+  c.sigs = sigs.map((e) => ({ key: e.key, sig: e.sig }));
+  return c;
+}
+
+/** A fresh 16-byte nonce, unpadded base64url. */
+const freshNonce = () => crypto.randomBytes(16).toString('base64url');
+
+/**
+ * Sign the statement's payload with a raw Ed25519 private key (base64url) whose public key is
+ * `publicKey`, adding the entry to `sigs` (pure Ed25519, no prehash). Returns the statement.
+ */
+function signStatement(s, privateKeyB64url, publicKeyB64url) {
+  const ED25519_PKCS8_PREFIX = Buffer.from('302e020100300506032b657004220420', 'hex');
+  const priv = crypto.createPrivateKey({ key: Buffer.concat([ED25519_PKCS8_PREFIX, Buffer.from(privateKeyB64url, 'base64url')]), format: 'der', type: 'pkcs8' });
+  const sig = crypto.sign(null, payload(s), priv).toString('base64url');
+  s.sigs = [...(Array.isArray(s.sigs) ? s.sigs : []), { key: publicKeyB64url, sig }];
+  return s;
+}
+
+/** Whether a signature entry verifies over the statement's payload (§18.3.2). */
+function entryVerifies(s, entry, bytes = payload(s)) {
+  return !!entry && verifyStrict(bytes, entry.key, entry.sig);
+}
+
+/**
+ * Parse an anchor pin (§6.6.1) from configuration: { threshold, keys: [{ key, nodeId? }] }, a single
+ * { nodeId, publicKey } (the 1-of-1 pin of earlier revisions), or a "nodeId:publicKey" string.
+ * Returns null when nothing is configured; throws when what is configured is not a pin.
+ * @returns {{ threshold: number, members: { key: string, nodeId: string|null }[] }|null}
+ */
+function parsePin(cfg) {
+  if (cfg === undefined || cfg === null || cfg === '') return null;
+  let threshold;
+  let keys;
+  if (typeof cfg === 'string') {
+    const trimmed = cfg.trim();
+    if (trimmed.startsWith('{')) return parsePin(JSON.parse(trimmed));
+    const i = trimmed.indexOf(':');
+    if (i <= 0) throw new Error('anchor pin: expected "nodeId:publicKey" or a JSON pin');
+    threshold = 1; keys = [{ nodeId: trimmed.slice(0, i), key: trimmed.slice(i + 1) }];
+  } else if (isPlain(cfg) && typeof cfg.publicKey === 'string') {
+    threshold = 1; keys = [{ nodeId: cfg.nodeId, key: cfg.publicKey }];
+  } else if (isPlain(cfg) && Array.isArray(cfg.keys)) {
+    threshold = cfg.threshold; keys = cfg.keys;
+  } else {
+    throw new Error('anchor pin: expected { threshold, keys: [{ key, nodeId? }] }');
+  }
+  if (!Array.isArray(keys) || keys.length < 1 || keys.length > ANCHOR_MAX_KEYS) throw new Error(`anchor pin: 1 to ${ANCHOR_MAX_KEYS} keys`);
+  if (!Number.isSafeInteger(threshold) || threshold < 1 || threshold > keys.length) throw new Error('anchor pin: a threshold from 1 to the number of keys');
+  const seen = new Set();
+  const members = keys.map((k) => {
+    const key = typeof k === 'string' ? k : k && k.key;
+    const nodeId = (k && typeof k === 'object' && k.nodeId !== undefined && k.nodeId !== null) ? k.nodeId : null;
+    if (typeof key !== 'string' || !PUBLIC_KEY.test(key) || !isPrimeOrderKey(key)) throw new Error('anchor pin: a key that is not an Ed25519 key of prime order');
+    if (nodeId !== null && (typeof nodeId !== 'string' || !NODE_ID.test(nodeId))) throw new Error('anchor pin: a nodeId that is not a canonical lowercase UUID');
+    if (seen.has(key)) throw new Error('anchor pin: keys must be distinct');
+    seen.add(key);
+    return { key, nodeId };
+  });
+  return { threshold, members };
+}
+
+/** The pin digest (§6.6.7): threshold, member count and the members (key, or key:nodeId under 1). */
+function pinDigest(pin) {
+  const members = pin.members.map((m) => (pin.threshold === 1 && m.nodeId ? `${m.key}:${m.nodeId}` : m.key)).sort(bytewise);
+  return crypto.createHash('sha256')
+    .update(Buffer.concat([PIN_DOMAIN, lp(String(pin.threshold)), lp(String(members.length)), ...members.map(lp)]))
+    .digest('hex');
+}
+
+/** The authority root (§6.6.7) over a pin digest and the in-force ids. */
+function authorityRoot(digest, inForceIds) {
+  const ids = [...inForceIds].sort(bytewise);
+  return crypto.createHash('sha256')
+    .update(Buffer.concat([ROOT_DOMAIN, lp(digest), lp(String(ids.length)), ...ids.map(lp)]))
+    .digest('hex');
+}
+
+module.exports = {
+  MAX_DELEGATION_DEPTH, ANCHOR_MAX_KEYS, AUTHORITY_QUOTA, AUTHORITY_ANCHOR_QUOTA, AUTHORITY_DELEGATE_QUOTA,
+  AUTHORITY_SCOPE_MAX, AUTHORITY_MAX_TARGETS, AUTHORITY_PAGE, AUTHORITY_PENDING_MAX, AUTHORITY_PENDING_TIMEOUT,
+  STATEMENT_ID, PUBLIC_KEY, NODE_ID,
+  isRole, isNonAuthority, isDelegating, isScope, scopeNarrows,
+  shapeReason, malformedReason, payload, statementId, canonicalStatement, freshNonce, signStatement, entryVerifies,
+  parsePin, pinDigest, authorityRoot, bytewise,
+};
diff --git a/lib/core/cmb-signing.js b/lib/core/cmb-signing.js
index 90008e87..27184809 100644
--- a/lib/core/cmb-signing.js
+++ b/lib/core/cmb-signing.js
@@ -23,6 +23,7 @@ const { resolveCategories, unreadableReason } = require('./record-shape.js');
  */
 
 const crypto = require('crypto');
+const { verifyStrict } = require('./ed25519');
 const { lp, keyScheme, sameKey, blockKeyV2 } = require('./cmb-encoder');
 const { CAT7_CATEGORIES } = require('./cmb');
 
@@ -372,7 +373,8 @@ function verifyCMB(cmb, publicKeyB64url) {
       // preimage cannot be forced by a relay — signatureSuite is itself covered by the v2.0
       // signature it selects.
       const payload = m.signatureSuite === MMP_SIGNATURE_SUITE ? signingPayloadV2_0(cmb) : signingPayloadV2(cmb);
-      const ok = crypto.verify(null, payload, publicKeyObject(publicKeyB64url), Buffer.from(m.sig, 'base64url'));
+      // MMP §18.3.2: the one Ed25519 rule (canonical A and R of prime order, S < L).
+      const ok = verifyStrict(payload, publicKeyB64url, m.sig);
       if (!ok) return { signed: true, valid: false, error: 'bad-signature' };
       // Content integrity: the signed address MUST be the address of the categories actually
       // carried. Under content-only addressing this is a pure recompute — no author, no time.
diff --git a/lib/core/ed25519.js b/lib/core/ed25519.js
new file mode 100644
index 00000000..00d3818e
--- /dev/null
+++ b/lib/core/ed25519.js
@@ -0,0 +1,177 @@
+'use strict';
+
+/**
+ * @module sym/core/ed25519
+ * @description THE ONE Ed25519 VERIFICATION RULE (MMP §18.3.2). RFC 8032 lets verifiers differ, in
+ * the equation they check and in which encodings and small-order points they accept, and two nodes
+ * that verify differently hold different valid sets from the same bytes. So every signature sym
+ * checks — authority statements, records, handshake proofs, attestations, room-join grants, tether
+ * attestations, relocation bundles — goes through `verifyStrict` and nothing else.
+ *
+ * A signature R ‖ S (64 bytes) by a key A (32 bytes) over M is valid iff:
+ *   1. A is a canonical encoding of a curve point (y < p; x = 0 never with the sign bit set);
+ *   2. A has prime order: [L]A is the identity and A is not;
+ *   3. R is a canonical encoding of a point of prime order;
+ *   4. S, little-endian, is less than L;
+ *   5. [S]B = R + [k]A, k = SHA-512(R ‖ A ‖ M) mod L.
+ *
+ * On Node, crypto.verify (OpenSSL) checks the cofactorless equation by comparing R's bytes with the
+ * encoding of [S]B − [k]A. With rules 1, 2 and 4 checked first, and R not the identity's encoding
+ * (01 followed by 31 zero bytes), its acceptance means R's bytes are the canonical encoding of a point
+ * of the prime-order subgroup other than the identity, which is rule 3 (§18.3.2, informative). Rules
+ * 1 and 2 cost one scalar multiplication per key; the result is cached per key.
+ *
+ * Implemented here from the curve's definition (extended twisted Edwards coordinates, BigInt): the
+ * spec's reference construction is an oracle for the tests only.
+ *
+ * @copyright 2026 SYM.BOT Ltd.
+ * @license Apache-2.0
+ */
+
+const crypto = require('crypto');
+
+const P = (1n << 255n) - 19n;
+const L = (1n << 252n) + 27742317777372353535851937790883648493n;
+const mod = (a, m = P) => { const r = a % m; return r >= 0n ? r : r + m; };
+function pow(b, e, m = P) {
+  let r = 1n; b = mod(b, m);
+  while (e > 0n) { if (e & 1n) r = (r * b) % m; b = (b * b) % m; e >>= 1n; }
+  return r;
+}
+const inv = (a) => pow(a, P - 2n);
+const D = mod(-121665n * inv(121666n));
+const D2 = mod(2n * D);
+const SQRT_M1 = pow(2n, (P - 1n) / 4n);
+
+const ED25519_SPKI_PREFIX = Buffer.from('302a300506032b6570032100', 'hex');
+const IDENTITY_ENCODING = Buffer.concat([Buffer.from([1]), Buffer.alloc(31)]);
+
+/** Little-endian bytes to BigInt. */
+function leToBig(buf) {
+  let n = 0n;
+  for (let i = buf.length - 1; i >= 0; i--) n = (n << 8n) | BigInt(buf[i]);
+  return n;
+}
+
+/**
+ * Decode a 32-byte encoding to an extended point [X, Y, Z, T], or null when it is not a canonical
+ * encoding of a curve point (rule 1): y ≥ p, no square root for x, or x = 0 with the sign bit set.
+ */
+function decodePoint(bytes) {
+  if (!Buffer.isBuffer(bytes) || bytes.length !== 32) return null;
+  const last = bytes[31];
+  const sign = (last & 0x80) !== 0;
+  const yBytes = Buffer.from(bytes); yBytes[31] = last & 0x7f;
+  const y = leToBig(yBytes);
+  if (y >= P) return null;
+  const y2 = (y * y) % P;
+  const u = mod(y2 - 1n);
+  const v = mod(D * y2 + 1n);
+  // x = u v^3 (u v^7)^((p-5)/8)
+  const v3 = (v * v % P) * v % P;
+  const v7 = (v3 * v3 % P) * v % P;
+  let x = (u * v3 % P) * pow(u * v7 % P, (P - 5n) / 8n) % P;
+  const vx2 = v * (x * x % P) % P;
+  if (vx2 === u) { /* x is a root */ }
+  else if (vx2 === mod(-u)) x = (x * SQRT_M1) % P;
+  else return null;
+  if (x === 0n && sign) return null;
+  if (((x & 1n) === 1n) !== sign) x = mod(-x);
+  return [x, y, 1n, (x * y) % P];
+}
+
+const IDENTITY = [0n, 1n, 1n, 0n];
+function add(p1, p2) {
+  const [X1, Y1, Z1, T1] = p1; const [X2, Y2, Z2, T2] = p2;
+  const A = mod((Y1 - X1) * (Y2 - X2));
+  const B = mod((Y1 + X1) * (Y2 + X2));
+  const C = mod(T1 * D2 % P * T2);
+  const Dd = mod(2n * Z1 * Z2);
+  const E = mod(B - A); const F = mod(Dd - C); const G = mod(Dd + C); const H = mod(B + A);
+  return [mod(E * F), mod(G * H), mod(F * G), mod(E * H)];
+}
+function isIdentity([X, Y, Z]) { return mod(X) === 0n && mod(Y - Z) === 0n; }
+function mul(pt, k) {
+  let r = IDENTITY; let q = pt;
+  while (k > 0n) { if (k & 1n) r = add(r, q); q = add(q, q); k >>= 1n; }
+  return r;
+}
+
+/** Rules 1 and 2 for a 32-byte key, cached per key: a canonical encoding of a point of prime order. */
+const KEY_CACHE = new Map();
+const KEY_CACHE_MAX = 8192;
+function isPrimeOrderKey(key) {
+  const bytes = toBytes(key, 32);
+  if (!bytes) return false;
+  const k = bytes.toString('hex');
+  const hit = KEY_CACHE.get(k);
+  if (hit !== undefined) return hit;
+  const pt = decodePoint(bytes);
+  const ok = !!pt && !isIdentity(pt) && isIdentity(mul(pt, L));
+  if (KEY_CACHE.size >= KEY_CACHE_MAX) KEY_CACHE.delete(KEY_CACHE.keys().next().value);
+  KEY_CACHE.set(k, ok);
+  return ok;
+}
+
+/**
+ * Whether rules 1 and 2 are already known for `key` (cached): a check of a key not yet known costs one
+ * scalar multiplication, far more than a signature check, so a caller that budgets work can charge
+ * for it before it is spent.
+ */
+function isKeyKnown(key) {
+  const bytes = toBytes(key, 32);
+  return !!bytes && KEY_CACHE.has(bytes.toString('hex'));
+}
+
+/** Bytes of a Buffer or a base64url string, of exactly `n` bytes, or null. */
+function toBytes(v, n) {
+  let b = null;
+  if (Buffer.isBuffer(v)) b = v;
+  else if (v instanceof Uint8Array) b = Buffer.from(v);
+  else if (typeof v === 'string') { try { b = Buffer.from(v, 'base64url'); } catch { b = null; } }
+  return b && b.length === n ? b : null;
+}
+
+/**
+ * MMP §18.3.2: whether `signature` (64 bytes) by `publicKey` (32 bytes) over `message` is valid.
+ * Keys and signatures are Buffers or base64url strings. Never throws.
+ * @param {Buffer|Uint8Array} message
+ * @param {Buffer|string} publicKey
+ * @param {Buffer|string} signature
+ * @returns {boolean}
+ */
+function verifyStrict(message, publicKey, signature) {
+  try {
+    const A = toBytes(publicKey, 32);
+    const sig = toBytes(signature, 64);
+    if (!A || !sig) return false;
+    if (!isPrimeOrderKey(A)) return false;                 // rules 1 and 2
+    const R = sig.subarray(0, 32);
+    if (R.equals(IDENTITY_ENCODING)) return false;         // R is not the identity
+    if (leToBig(sig.subarray(32)) >= L) return false;      // rule 4
+    const keyObject = crypto.createPublicKey({ key: Buffer.concat([ED25519_SPKI_PREFIX, A]), format: 'der', type: 'spki' });
+    return crypto.verify(null, Buffer.isBuffer(message) ? message : Buffer.from(message), keyObject, sig); // rule 5, and so rule 3
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Rules 1 to 4 as named reasons, in the order §18.3.2's vector names them (for tests and reports):
+ * the first pre-check that fails, or null.
+ */
+function precheckFailure(publicKey, signature) {
+  const A = toBytes(publicKey, 32);
+  const sig = toBytes(signature, 64);
+  if (!A || !sig) return 'malformed';
+  const a = decodePoint(A);
+  if (!a) return 'A is not a canonical encoding of a curve point';
+  if (isIdentity(a) || !isIdentity(mul(a, L))) return 'A is not of prime order';
+  const r = decodePoint(Buffer.from(sig.subarray(0, 32)));
+  if (!r) return 'R is not a canonical encoding of a curve point';
+  if (isIdentity(r) || !isIdentity(mul(r, L))) return 'R is not of prime order';
+  if (leToBig(sig.subarray(32)) >= L) return 'S is not less than L';
+  return null;
+}
+
+module.exports = { verifyStrict, isPrimeOrderKey, isKeyKnown, precheckFailure, L };
diff --git a/lib/core/handshake-v2.js b/lib/core/handshake-v2.js
index 4269709d..7e0329a3 100644
--- a/lib/core/handshake-v2.js
+++ b/lib/core/handshake-v2.js
@@ -21,6 +21,7 @@
  */
 
 const crypto = require('crypto');
+const { verifyStrict } = require('./ed25519');
 const { lp } = require('./cmb-encoder');
 const { privateKeyObject, publicKeyObject } = require('./cmb-signing');
 
@@ -129,11 +130,8 @@ function signProof(role, transcriptBytes, identityPrivateKeyB64url) {
  */
 function verifyProof(role, transcriptBytes, proofB64url, identityPublicKeyB64url) {
   try {
-    return crypto.verify(
-      null, proofPayload(role, transcriptBytes),
-      publicKeyObject(identityPublicKeyB64url),
-      Buffer.from(proofB64url, 'base64url'),
-    );
+    // MMP §18.3.2: the one Ed25519 rule.
+    return verifyStrict(proofPayload(role, transcriptBytes), identityPublicKeyB64url, proofB64url);
   } catch { return false; }
 }
 
diff --git a/lib/core/index.js b/lib/core/index.js
index 8cc721f8..f0b9abd1 100644
--- a/lib/core/index.js
+++ b/lib/core/index.js
@@ -21,7 +21,6 @@ const modules = [
   require('./cmb-signing'),
   require('./record-shape'),
   require('./ref'),
-  require('./role-grant'),
   require('./lineage-tether'),
   require('./tether-attestation'),
   require('./attestation'),
diff --git a/lib/core/role-grant.js b/lib/core/role-grant.js
deleted file mode 100644
index 729de525..00000000
--- a/lib/core/role-grant.js
+++ /dev/null
@@ -1,99 +0,0 @@
-'use strict';
-
-/**
- * @module sym/core/role-grant
- * @description Ed25519-signed lifecycle role grants (MMP §6.5 — earned authority).
- *
- * A node's authority to validate or canonize is an EARNED, SIGNED fact bound to
- * its Ed25519 identity — never inferred from a CMB's text. A role-grant frame
- * promotes a node's lifecycle role (participant → validator → anchor); a
- * role-revoke frame pulls it back down. Both are signed by the granting node and
- * verified against that node's announced public key, so authority cannot be
- * spoofed by content alone.
- *
- * Trust rule (enforced by the receiver, not here): a grant is honoured only when
- * the GRANTOR's own role outranks-or-equals the role it confers — validators
- * grant validator; only anchors grant anchor — and the chain roots at the pinned
- * founder anchor. This module provides only the canonical payload + sign/verify;
- * the rank check and root-of-trust pin live in the node that applies the grant.
- *
- * @copyright 2026 SYM.BOT Ltd.
- * @license Apache-2.0
- */
-
-const crypto = require('crypto');
-const { privateKeyObject, publicKeyObject } = require('./cmb-signing');
-
-/** Lifecycle role ranks. `observer` is the protocol's `participant` default. */
-const ROLE_RANK = Object.freeze({ participant: 0, observer: 0, validator: 1, anchor: 2 });
-
-/** Numeric rank of a role string (unknown → 0). */
-function roleRank(role) {
-  return ROLE_RANK[role] ?? 0;
-}
-
-/**
- * Canonical bytes signed for a grant/revoke. Binds the action, the grantee, the
- * conferred role, the grantor, the time, and (optionally) the grantee's announced
- * public key — so a signature can't be replayed to confer a different role, onto a
- * different node, or with a substituted key. Binding `granteeKey` lets the grantor
- * VOUCH for the grantee's nodeId↔key pairing along the authority chain: a node that
- * never directly handshook the grantee can still learn its key from a rooted grant,
- * tamper-evidently, because swapping the key breaks the grantor's signature (the
- * relayer never vouches). Empty when absent (revokes, key-less grants) — both signer
- * and verifier use this function, so the round-trip is stable either way.
- *
- * A role-revoke may carry `cutoff` (ms epoch, at most its grantedAt): the revoked node's statements
- * signed at or after the cutoff never count, those signed before it stand (re-review N2; draft spec
- * text in docs/WIRE-0.14.0.md §6). It is signed as `|<cutoff>` appended to the payload, only when
- * present. It may also carry `ratify`, the revoked node's earlier statements (canonical signatures,
- * sorted) that stay valid, signed as `|<sig>,<sig>...` after the cutoff (docs/WIRE-0.14.0.md §6.1).
- * @param {object} g - { type, grantee, role, grantedBy, grantedAt, granteeKey?, cutoff?, ratify? }
- * @returns {Buffer}
- */
-function grantPayload(g) {
-  // A revoke's cutoff (sym 0.14, re-review N2) is appended only when the revoke carries one, so a
-  // revoke without it signs exactly the bytes it always signed. Unambiguous: a revoke's granteeKey,
-  // when present, is 43 base64url characters (no `|`), and the cutoff is a decimal integer.
-  const cutoff = g.type === 'role-revoke' && g.cutoff !== undefined ? `|${g.cutoff}` : '';
-  // The statements the revoke ratifies (final re-review ruling B): canonical signatures, sorted,
-  // joined by ',' (no signature holds ',' or '|'), only after a cutoff.
-  const ratify = cutoff && Array.isArray(g.ratify) && g.ratify.length ? `|${g.ratify.join(',')}` : '';
-  return Buffer.from(`${g.type}|${g.grantee}|${g.role || ''}|${g.grantedBy}|${g.grantedAt}|${g.granteeKey || ''}${cutoff}${ratify}`, 'utf8');
-}
-
-/**
- * Sign a role-grant/revoke frame in place with the grantor's raw Ed25519 private
- * key (base64url). Sets `sig` + `sigAlg`. Returns the frame.
- */
-function signGrant(grant, privateKeyB64url) {
-  if (!grant || !grant.grantee || !grant.grantedBy) {
-    throw new Error('signGrant requires grantee + grantedBy');
-  }
-  const sig = crypto.sign(null, grantPayload(grant), privateKeyObject(privateKeyB64url));
-  grant.sig = sig.toString('base64url');
-  grant.sigAlg = 'ed25519';
-  return grant;
-}
-
-/**
- * Verify a grant/revoke signature against the grantor's raw Ed25519 public key.
- * @returns {{ signed: boolean, valid: boolean, error?: string }}
- */
-function verifyGrant(grant, grantorPublicKeyB64url) {
-  if (!grant || !grant.sig || grant.sigAlg !== 'ed25519') return { signed: false, valid: false };
-  if (!grantorPublicKeyB64url) return { signed: true, valid: false, error: 'no-public-key' };
-  try {
-    const ok = crypto.verify(
-      null,
-      grantPayload(grant),
-      publicKeyObject(grantorPublicKeyB64url),
-      Buffer.from(grant.sig, 'base64url'),
-    );
-    return ok ? { signed: true, valid: true } : { signed: true, valid: false, error: 'bad-signature' };
-  } catch (e) {
-    return { signed: true, valid: false, error: e.message };
-  }
-}
-
-module.exports = { signGrant, verifyGrant, grantPayload, roleRank, ROLE_RANK };
diff --git a/lib/core/room-grant.js b/lib/core/room-grant.js
index 0f22505a..079bc858 100644
--- a/lib/core/room-grant.js
+++ b/lib/core/room-grant.js
@@ -14,16 +14,15 @@
  * tenant's commissioned work off the wire, and wrote the results where they stood.
  *
  * A room-join grant is a signed statement by a room's OWNER binding
- * {room, grantee nodeId, grantee public key, expiry}. It is deliberately NOT a
- * role grant: role-grant.js confers RANK along an anchor-rooted chain and its
- * payload has no room and no expiry, so this carries its own canonical payload
- * rather than widening that one — changing `grantPayload` would invalidate every
- * signature already on disk.
+ * {room, grantee nodeId, grantee public key, expiry}. It is deliberately NOT an
+ * authority statement: a §6.6 grant confers a ROLE through a hash-linked chain from
+ * the pinned anchor and carries no room and no time, so this keeps its own canonical
+ * payload (MMP §5.8.1) under its own domain.
  *
  * V1 IS OWNER-ONLY. The draft allowed "a member the owner authorized to invite";
  * the mesh review struck it as a third decision smuggled into a two-question
- * ruling — delegation has no stated depth, no attenuation and no bound, and the
- * role-grant chain already shows the problems it would have to solve. Not here.
+ * ruling — delegation has no stated depth, no attenuation and no bound here (MMP
+ * §6.6 has all three for roles; room-join grants are not part of it). Not here.
  *
  * THE 24-HOUR CAP IS ENFORCED BY THE VERIFIER, not by the minter. Revocation is
  * live gossip with no catch-up replay (lib/node.js `_gossipToRoster`), so a peer
@@ -38,6 +37,7 @@
  */
 
 const crypto = require('crypto');
+const { verifyStrict } = require('./ed25519');
 const { privateKeyObject, publicKeyObject } = require('./cmb-signing');
 const { lp } = require('./cmb-encoder');
 const { isValidRoom, roomServiceType, serviceTypeToRoom } = require('../rooms');
@@ -70,7 +70,7 @@ function isOwnableRoom(room) {
 }
 
 /** Domain separator: a signature over these bytes can never be read as a CMB
- *  (`mmp-cmb-v1`) or as a role grant, even by a key that legitimately signs both. */
+ *  (`mmp-cmb-v1`) or as an authority statement (`mmp-authority-v1`), even by a key that legitimately signs both. */
 const ROOM_GRANT_DOMAIN = 'mmp-room-join-v1\n';
 
 /**
@@ -206,12 +206,8 @@ function verifyRoomGrant(grant, ownerPublicKeyB64url, expect = {}) {
 
   let valid = false;
   try {
-    valid = crypto.verify(
-      null,
-      roomGrantPayload(grant),
-      publicKeyObject(ownerPublicKeyB64url),
-      Buffer.from(grant.sig, 'base64url'),
-    );
+    // MMP §18.3.2: the one Ed25519 rule.
+    valid = verifyStrict(roomGrantPayload(grant), ownerPublicKeyB64url, grant.sig);
   } catch (e) {
     return { ok: false, reason: `verify-failed: ${e.message}` };
   }
diff --git a/lib/core/tether-attestation.js b/lib/core/tether-attestation.js
index 257369cf..3522865c 100644
--- a/lib/core/tether-attestation.js
+++ b/lib/core/tether-attestation.js
@@ -34,6 +34,7 @@
  */
 
 const crypto = require('crypto');
+const { verifyStrict } = require('./ed25519');
 const { lp } = require('./cmb-encoder');
 
 // RFC 8410 DER prefixes for raw 32-byte Ed25519 keys (same discipline as
@@ -95,8 +96,8 @@ function verifyTetherAttestation(t, integratorPublicKeyB64url) {
   if (!t || !t.sig || t.sigAlg !== 'ed25519') return { signed: false, valid: false };
   if (!integratorPublicKeyB64url) return { signed: true, valid: false, error: 'no-public-key' };
   try {
-    const ok = crypto.verify(null, tetherPayload(t), publicKeyObject(integratorPublicKeyB64url),
-      Buffer.from(t.sig, 'base64url'));
+    // MMP §18.3.2: the one Ed25519 rule.
+    const ok = verifyStrict(tetherPayload(t), integratorPublicKeyB64url, t.sig);
     return ok ? { signed: true, valid: true } : { signed: true, valid: false, error: 'bad-signature' };
   } catch (e) {
     return { signed: true, valid: false, error: e.message };
diff --git a/lib/frame-handler.js b/lib/frame-handler.js
index 248a95cb..de9de83b 100644
--- a/lib/frame-handler.js
+++ b/lib/frame-handler.js
@@ -457,25 +457,28 @@ class FrameHandler {
       case 'cmb-fetch-result':
         return this._handleCmbFetchResult(peerId, peerName, msg, session);
 
-      case 'role-grant':
-      case 'role-revoke':
-        // Signed by the grantor and verified against the chain's vouched keys (design D3), never
-        // against the session that delivered it. One that arrives before its root makes the node ask
-        // this session for the chain (role-chain-fetch).
-        if (msg.grant) this._node._ingestRoleGrant(msg.grant, peerId, session);
+      // MMP §6.6.8: the authority set. A statement is verified on its own signatures and chain,
+      // whichever session delivered it; a session confers no authority on what it carries.
+      case 'authority-statement':
+        if (msg.statement && typeof msg.statement === 'object') this._node._ingestAuthority(msg.statement, session);
+        this._node._scheduleAuthoritySettle();
+        return undefined;
+      case 'authority-digest':
+        return this._node._onAuthorityDigest(session, msg);
+      case 'authority-fetch':
+        return this._node._onAuthorityFetch(session, msg);
+      case 'authority-set':
+        this._node._onAuthoritySet(session, msg);
+        this._node._scheduleAuthoritySettle();
         return undefined;
 
+      // The retired time-replay frames (§6.6.11): they confer nothing and are ignored.
+      case 'role-grant':
+      case 'role-revoke':
       case 'role-chain-fetch':
-        // A peer asks for the grants that root a grantor this node may hold (design D3).
-        return this._node._serveRoleChain(session, msg);
-
       case 'role-chain':
-        // The answer to this node's role-chain-fetch: ordinary signed grants, verified top-down.
-        return this._node._onRoleChain(session, msg);
-
       case 'role-digest':
-        // A peer's grant-store digest (anti-entropy, security review D): a different one starts a sync.
-        return this._node._onRoleDigest(session, msg);
+        return this._node._onRetiredAuthorityFrame(session, msg.type);
 
       case 'xmesh-insight':
         if (this._extensionRefused(session, msg.type, 'xmesh-insight-v1')) return undefined;
@@ -500,20 +503,24 @@ class FrameHandler {
    * Checks: 1) peer role from handshake, 2) CMB createdBy matching a known peer.
    * @private
    */
+  /**
+   * The author's lifecycle authority over another CMB (a parent), judged on THAT CMB's own signed
+   * fields (§6.5: each parent on its own), or null for a record whose author no signature proved.
+   * @private
+   */
+  _authorityOver(msg) {
+    if (!msg || msg._cmbVerified !== true || msg._legacyImport || !msg._verifiedAuthorNodeId || typeof this._node.lifecycleAuthority !== 'function') return null;
+    const author = msg._verifiedAuthorNodeId; const key = msg._authorKey;
+    return (cmb) => this._node.lifecycleAuthority(author, key, cmb);
+  }
+
   _getCreatorRole(peerId, msg) {
-    // Anchored mode: authority is EARNED and resolved through the signed grant chain to the pinned
-    // anchor — NEVER a self-declared role. Elevation requires a verified record, and goes to its
-    // AUTHOR (the signed createdByNodeId) holding the key that verified it: authority follows the key
-    // (design D3), so a record relayed by another node gets its author's earned role, and an
-    // unverified one none.
-    if (this._node._anchor) {
-      if (msg._cmbVerified && msg._verifiedAuthorNodeId && typeof this._node.resolveRole === 'function') {
-        return this._node.resolveRole(msg._verifiedAuthorNodeId, Date.now(), { key: msg._authorKey });
-      }
-      return 'participant';
-    }
-    // Unanchored (dev — no root of trust): there is no authority to resolve. A Core Secure session
-    // carries no self-declared role, so every author is a participant.
+    // MMP §6.4, §6.6.10: the origin weight of a received record derives from its AUTHOR's lifecycle
+    // authority over THIS record (the signed createdByNodeId, holding the key that verified it),
+    // resolved against the in-force set when the weight is applied — never a self-declared role. A
+    // scoped grant counts only for a record inside its scope. Unanchored, nothing is in force, and
+    // every author is a participant.
+    if (typeof this._node._authorOriginRole === 'function') return this._node._authorOriginRole(msg);
     return 'participant';
   }
 
@@ -1445,7 +1452,7 @@ class FrameHandler {
     // The admitted-path surface is the store's own cmb-accepted emit. The store returns null when
     // it already holds the key ('redundant') or the write failed ('not-stored'), and a directed CMB
     // then reached nobody: surface it. Everything after this runs exactly as for any admit.
-    const storedNeural = this._node._store.receiveFromPeer(peerId, fusedEntry, { creatorRole: this._getCreatorRole(peerId, msg), severLineage });
+    const storedNeural = this._node._store.receiveFromPeer(peerId, fusedEntry, { creatorRole: this._getCreatorRole(peerId, msg), severLineage, authorityOver: this._authorityOver(msg) });
     if (!storedNeural && msg._directedToMe) {
       this._surfaceDirectedReject(msg, peerName, peerId, now, this._node._store.get(fusedEntry.key) ? 'redundant' : 'not-stored');
     }
@@ -1574,7 +1581,7 @@ class FrameHandler {
     // The admitted-path surface is the store's own cmb-accepted emit. The store returns null when
     // it already holds the key ('redundant') or the write failed ('not-stored'), and a directed CMB
     // then reached nobody: surface it. Everything after this runs exactly as for any admit.
-    const storedHeuristic = this._node._store.receiveFromPeer(peerId, result.fusedEntry, { creatorRole: this._getCreatorRole(peerId, msg), severLineage });
+    const storedHeuristic = this._node._store.receiveFromPeer(peerId, result.fusedEntry, { creatorRole: this._getCreatorRole(peerId, msg), severLineage, authorityOver: this._authorityOver(msg) });
     if (!storedHeuristic && msg._directedToMe) {
       this._surfaceDirectedReject(msg, peerName, peerId, now, this._node._store.get(result.fusedEntry.key) ? 'redundant' : 'not-stored');
     }
diff --git a/lib/memory-store.js b/lib/memory-store.js
index c956041b..d37f50c1 100644
--- a/lib/memory-store.js
+++ b/lib/memory-store.js
@@ -22,7 +22,7 @@ const fs = require('fs');
 const path = require('path');
 const crypto = require('crypto');
 const { ensureDir } = require('./config');
-const { roleRank, isLineageSevered } = require('./core');
+const { isLineageSevered } = require('./core');
 
 // ── In-Memory Index ──────────────────────────────────────────
 
@@ -327,7 +327,10 @@ class MemoryStore {
    * @param {string} peerId
    * @param {object} entry
    * @param {object} opts
-   * @param {string} opts.creatorRole — lifecycle role of the creating node (participant/validator/anchor)
+   * @param {string} opts.creatorRole — the role the record's author counts with for THIS record (§6.4,
+   *   §6.6.10: resolved by the node against its in-force set when the weight is applied)
+   * @param {function(object): string} [opts.authorityOver] — the author's lifecycle authority over
+   *   another CMB ('canonical' | 'validated' | 'none'), judged on that CMB's own fields (§6.5)
    * @param {boolean} [opts.severLineage] — the gate severed this record's lineage (§15.8): store it as a
    *   root although its record, kept as signed, still names parents
    * @returns {object|null} stored entry or null if duplicate
@@ -345,7 +348,7 @@ class MemoryStore {
     // Section 6.4 + 11.1: validator/anchor-origin CMBs enter at weight 2.0.
     // The elevated weight reflects the authority of the producing node.
     const creatorRole = opts.creatorRole || 'participant';
-    const isValidatorOrigin = creatorRole === 'validator' || creatorRole === 'anchor';
+    const isValidatorOrigin = creatorRole === 'validator' || creatorRole === 'admin' || creatorRole === 'anchor';
 
     const stored = {
       ...entry,
@@ -380,11 +383,14 @@ class MemoryStore {
 
     // Section 11.1: feedback recognition — check if this CMB's parents
     // reference our own CMBs. If so, this is feedback about our output.
-    if (isValidatorOrigin && lineage?.parents?.length > 0) {
+    // Each parent is judged on its own (§6.5): the author's authority over THAT parent, from the
+    // parent's own signed fields, never from this record's.
+    const over = typeof opts.authorityOver === 'function' ? opts.authorityOver : null;
+    if (over && lineage?.parents?.length > 0) {
       for (const parentKey of lineage.parents) {
         const pk = typeof parentKey === 'string' ? parentKey : parentKey.key;
         const parent = this.get(pk);
-        if (parent && (!parent.peerId || parent.source === this._source)) {
+        if (parent && (!parent.peerId || parent.source === this._source) && over(parent.cmb) !== 'none') {
           stored._isFeedbackOnOwnCMB = true;
           stored._feedbackParentKey = pk;
           break;
@@ -840,16 +846,17 @@ class MemoryStore {
   /**
    * Mark a CMB as validated. Per MMP §6.5 validation authority is identity-bound and
    * EARNED — only a node whose role resolves to validator-or-above may advance a CMB to
-   * `validated`. The caller must pass its resolved role (`byRole`); a participant (or a
+   * `validated`. The caller passes its lifecycle authority over THIS CMB (`lifecycle`); `none` (or a
    * missing/unknown role) is rejected and the CMB is left untouched. Authority is checked
    * here, by construction, so no future caller can validate without earned rank.
    * @param {string} key — CMB key to validate
    * @param {object} [opts]
-   * @param {'participant'|'validator'|'anchor'} [opts.byRole] caller's resolved role
+   * @param {'none'|'validated'|'canonical'} [opts.lifecycle] the caller's lifecycle authority over THIS
+   *   CMB (§6.5: resolved against the in-force set, a scoped grant only inside its scope)
    * @returns {{ ok: boolean, reason?: string }}
    */
   validateCMB(key, opts = {}) {
-    if (roleRank(opts.byRole) < roleRank('validator')) {
+    if (opts.lifecycle !== 'validated' && opts.lifecycle !== 'canonical') {
       return { ok: false, reason: 'insufficient-authority' };
     }
     const entry = this.get(key);
@@ -867,11 +874,11 @@ class MemoryStore {
    * grantee); validator rank is NOT enough. Same earned-authority gate as validateCMB.
    * @param {string} key
    * @param {object} [opts]
-   * @param {'participant'|'validator'|'anchor'} [opts.byRole] caller's resolved role
+   * @param {'none'|'validated'|'canonical'} [opts.lifecycle] the caller's lifecycle authority over THIS CMB
    * @returns {{ ok: boolean, reason?: string }}
    */
   canonizeCMB(key, opts = {}) {
-    if (roleRank(opts.byRole) < roleRank('anchor')) {
+    if (opts.lifecycle !== 'canonical') {
       return { ok: false, reason: 'insufficient-authority' };
     }
     const entry = this.get(key);
diff --git a/lib/node-authority.js b/lib/node-authority.js
new file mode 100644
index 00000000..0dec7162
--- /dev/null
+++ b/lib/node-authority.js
@@ -0,0 +1,615 @@
+'use strict';
+
+/**
+ * @module @sym-bot/sym/node-authority
+ * @description A SymNode's side of MMP §6.6: its anchor pin, its authority store, the four frames
+ * that carry the set (authority-statement, authority-digest, authority-fetch, authority-set, §6.6.8),
+ * the statements it signs, and how it uses authority — roles that follow the key (§6.6.9), lifecycle
+ * authority judged on each CMB's own fields, scoped (§6.5, §6.6.2), and mesh weights judged against
+ * the in-force set at the moment of use (§6.6.10). Installed on SymNode.prototype by lib/node.js.
+ *
+ * Nothing here reads a clock to decide authority. Timers only pace frames and release what a
+ * session held.
+ *
+ * @copyright 2026 SYM.BOT Ltd.
+ * @license Apache-2.0
+ */
+
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+const A = require('./core/authority');
+const { isKeyKnown } = require('./core/ed25519');
+const { AuthorityStore, lifecycleOf } = require('./authority-store');
+
+/** The retired time-replay frames (§6.6.11, §7.1 legacy): ignored on receipt, never emitted. */
+const RETIRED_FRAMES = new Set(['role-grant', 'role-revoke', 'role-chain-fetch', 'role-chain', 'role-digest']);
+/**
+ * A responder's pacing of authority-fetch answers, per session (§6.6.8: for example 4 a second, burst
+ * 16). Pacing, not refusal: a request over the rate waits its turn, so an asker that keeps one pull in
+ * flight is answered page after page and never left short; at most SERVE_QUEUE_MAX wait, and past that
+ * a request is dropped. sym does not take §6.6.8's MAY (refuse a fresh full pull within 60 s): the
+ * pacing already bounds what a session can ask for, and a refused pull would leave a differing root
+ * unreconciled until the peer's set next changed.
+ */
+const SERVE_PER_SECOND = 4;
+const SERVE_BURST = 16;
+const SERVE_QUEUE_MAX = 64;
+/** authority-digest after a change, at most once a second per session (§6.6.8). */
+const DIGEST_MIN_MS = 1000;
+/** How long a fetch or a pull page may take: a fetch's slot is then freed, a pull page asked again. */
+const FETCH_TIMEOUT_MS = 10_000;
+/** How many times a pull page that went unanswered is asked again, from the same cursor. */
+const PULL_RETRIES = 3;
+/**
+ * What a key not seen before costs a gossip lane, in signature checks. §18.3.2's rules 1 and 2 for a
+ * new key are one scalar multiplication (cached per key afterwards), measured here at about fifteen
+ * times an OpenSSL signature check; a statement's keys are free to mint, so the lane is charged for the
+ * work before it is done, and a flood of fresh keys buys a sixteenth of the checks a lane allows.
+ */
+const FRESH_KEY_COST = 16;
+/** Roles by precedence, for the one role a node names (attestation stamps, `resolveRole`). */
+const ROLE_ORDER = ['anchor', 'admin', 'validator', 'issuer', 'participant'];
+/** Rank of a role for lifecycle authority and weights: anchor and admin 2, validator 1, all else 0. */
+function lifecycleRank(role) {
+  if (role === 'anchor' || role === 'admin' || role === 'canonical') return 2;
+  if (role === 'validator' || role === 'validated') return 1;
+  return 0;
+}
+function highestRole(roles) {
+  let best = 'participant';
+  for (const r of roles) if (ROLE_ORDER.indexOf(r.role) >= 0 && ROLE_ORDER.indexOf(r.role) < ROLE_ORDER.indexOf(best)) best = r.role;
+  return best;
+}
+const HEX64 = /^[0-9a-f]{64}$/;
+const isPlain = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
+
+/**
+ * Build the node's authority store (called from the SymNode constructor, which has parsed the pin:
+ * §6.6.1, a pinned key set with a threshold configured out of band; a bad pin stops the node rather
+ * than running with no root of trust it did not ask for).
+ */
+function initAuthority(node, opts = {}) {
+  if (node._pin === undefined) node._pin = A.parsePin(opts.anchor !== undefined ? opts.anchor : (process.env.SYM_FOUNDER_ANCHOR || null));
+  node._authority = new AuthorityStore({ pin: node._pin, dir: path.join(node._dir, 'authority'), log: (m) => node._log(m) });
+  // Scope namespaces this node implements (§6.6.2): namespace -> (path, cmb, scope) => whether the CMB
+  // is inside. A namespace not listed contains no CMB, so a scoped grant gives nothing here.
+  node._authorityScopes = isPlain(opts.authorityScopes) ? { ...opts.authorityScopes } : {};
+  node._authorityPrev = new Set();       // the in-force set at the last settle
+  node._authorityRelayed = new Set();    // ids relayed once already (§6.6.8 gossip)
+  node._authorityOrigin = new Map();     // id -> the peer that delivered it, until the next settle
+  node._authorityReported = new Set();   // foreign-self grants already reported
+  node._authorityStats = { held: 0, pending: 0, invalid: 0, duplicate: 0, relayed: 0, fetched: 0, served: 0, pulls: 0, retired: 0, overBudget: 0 };
+  node._authoritySettleQueued = false;
+  const r = node._authority.loadReport();
+  if (r.held || r.pending || r.invalid) node._log(`Authority: ${r.held} statement(s) held, ${r.pending} pending, ${r.invalid} not valid under the pin`);
+  node._authorityPrev = new Set(node._authority.resolve().inForce);
+}
+
+const methods = {
+  // ── Roles and their use ─────────────────────────────────────────────────────
+
+  /** The roles `nodeId` holding `key` has (§6.6.4): [{ role, scope, grant }]. The key defaults to its binding. */
+  authorityRoles(nodeId, key) {
+    const k = key || (nodeId === this.nodeId ? this._identity.publicKey : this._identityKey(nodeId));
+    return this._authority.rolesOf(nodeId, k);
+  },
+
+  /** The authority root this node's in-force set has (§6.6.7), or null with no anchor pinned. */
+  authorityRoot() { return this._authority.root(); },
+
+  /** Status of the authority set, for hosts and `sym status`. */
+  authorityStatus() {
+    const d = this._authority.digest();
+    return {
+      anchored: this._authority.anchored,
+      pinDigest: this._authority.pinDigest,
+      root: d.root,
+      inForce: d.count,
+      held: this._authority.size(),
+      roles: this.authorityRoles(this.nodeId),
+      stats: { ...this._authorityStats },
+    };
+  },
+
+  /** @private Whether a CMB is inside a scope: the namespace's resolver says (none: no CMB is). */
+  _scopeContains(scope, cmb) {
+    const i = typeof scope === 'string' ? scope.indexOf(':') : -1;
+    if (i <= 0 || !cmb) return false;
+    const fn = this._authorityScopes[scope.slice(0, i)];
+    if (typeof fn !== 'function') return false;
+    try { return fn(scope.slice(i + 1), cmb, scope) === true; } catch { return false; }
+  },
+
+  /**
+   * The lifecycle authority (§3.5) `nodeId` holding `key` has over one CMB, judged on that CMB's own
+   * signed fields: 'canonical', 'validated' or 'none' (§6.5, §6.6.2).
+   */
+  lifecycleAuthority(nodeId, key, cmb) {
+    if (!this._authority.anchored) return 'none';
+    return lifecycleOf(this.authorityRoles(nodeId, key), (scope) => this._scopeContains(scope, cmb));
+  },
+
+  /**
+   * The one role a node names for itself (attestation stamps): its highest unscoped role, or the
+   * configured lifecycleRole where no anchor is pinned (a closed development mode, §6.5).
+   */
+  _resolvedRole() {
+    if (!this._authority.anchored) return this._lifecycleRole;
+    return highestRole(this.authorityRoles(this.nodeId).filter((r) => r.scope === null));
+  },
+
+  /**
+   * `nodeId`'s highest role in force now, holding the key it is bound to here (or `opts.key`):
+   * 'anchor' | 'admin' | 'validator' | 'issuer' | 'participant'. Only unscoped roles count, or, with
+   * `opts.cmb`, the roles whose scope contains that CMB (§6.6.2). Authority carries no time (§6.6):
+   * there is no "role at a time" to ask for, and a number passed as the second argument is ignored.
+   */
+  resolveRole(nodeId, opts = {}) {
+    if (typeof opts !== 'object' || opts === null) opts = {};
+    if (!this._authority.anchored) return 'participant';
+    const cmb = opts.cmb || null;
+    return highestRole(this.authorityRoles(nodeId, opts.key).filter((r) => r.scope === null || (cmb && this._scopeContains(r.scope, cmb))));
+  },
+
+  /**
+   * The role an attestation's signer counts with (§6.6.10): its highest role in force now whose
+   * scope contains the attested CMB (an unscoped role always does), judged when the weight is
+   * applied. The attestation's own time plays no part.
+   * @private
+   */
+  _attesterRole(att) {
+    if (!att) return 'participant';
+    let cmb = null;
+    try { const e = this._store.get(att.of); cmb = e && e.cmb; } catch { cmb = null; }
+    return this.resolveRole(att.by, { cmb });
+  },
+
+  /** @private The origin role a received CMB's author counts with (§6.4): its lifecycle authority over it. */
+  _authorOriginRole(msg) {
+    if (!this._authority.anchored || !msg || msg._cmbVerified !== true || !msg._verifiedAuthorNodeId) return 'participant';
+    const level = this.lifecycleAuthority(msg._verifiedAuthorNodeId, msg._authorKey, msg.cmb);
+    return level === 'canonical' ? 'admin' : level === 'validated' ? 'validator' : 'participant';
+  },
+
+  // ── Signing ──────────────────────────────────────────────────────────────────
+
+  /**
+   * @private The authority this node signs `fields` under: 'anchor' when its key is pinned and the
+   * threshold is 1 (or `asAnchor` is asked, for a statement the other key holders co-sign), otherwise
+   * the lowest-id grant of its own, in force, whose role permits the statement and, for a revoke or
+   * endorse, that stands above every target (§6.6.3). Null when it holds none.
+   */
+  _authoritySignerFor(fields, { asAnchor = false } = {}) {
+    const pinned = !!this._pin && this._pin.members.some((m) => m.key === this._identity.publicKey);
+    if (pinned && (asAnchor || this._pin.threshold === 1)) return 'anchor';
+    if (asAnchor) return null;
+    const own = this._authority.rolesOf(this.nodeId, this._identity.publicKey).filter((r) => r.grant).sort((x, y) => (x.grant < y.grant ? -1 : 1));
+    for (const r of own) {
+      if (fields.kind === 'grant') {
+        const ok = r.role === 'admin' || ((r.role === 'validator' || r.role === 'issuer') && A.isNonAuthority(fields.role));
+        if (ok && A.scopeNarrows(r.scope, fields.scope === undefined ? null : fields.scope)) return r.grant;
+        continue;
+      }
+      if (fields.kind === 'revoke' && !A.isDelegating(r.role)) continue;
+      if (fields.kind === 'endorse' && r.role !== 'admin') continue;
+      const above = fields.targets.every((t) => {
+        const target = this._authority.get(t);
+        if (!target) return false;
+        const chain = this._authorityChainOf(t);
+        if (fields.kind === 'revoke') return chain.includes(r.grant);
+        // An endorse stands above the target's authorising grant.
+        return target.authorisedBy !== 'anchor' && this._authorityChainOf(target.authorisedBy).includes(r.grant);
+      });
+      if (above) return r.grant;
+    }
+    return null;
+  },
+
+  /** @private The grants above a held statement (its chain), [] when not held. */
+  _authorityChainOf(id) {
+    const e = this._authority._held.get(id);
+    return e ? e.chain : [];
+  },
+
+  /**
+   * Sign a grant, revoke or endorse with this node's key (§6.6.3), under the authority it holds (or
+   * `opts.authorisedBy`). Returns the statement, not yet ingested: an anchor-level statement under a
+   * threshold above 1 is passed to the other key holders (`cosignAuthority`) and then submitted.
+   * @param {{ kind: 'grant'|'revoke'|'endorse', subject?: {nodeId, key}, role?: string, scope?: string, targets?: string[] }} fields
+   * @param {{ authorisedBy?: string, asAnchor?: boolean, issuedAt?: number }} [opts]
+   * @throws {Error} code ENOAUTHORITY when this node holds no authority that permits the statement
+   */
+  authorityStatement(fields, opts = {}) {
+    const authorisedBy = opts.authorisedBy || this._authoritySignerFor(fields, opts);
+    if (!authorisedBy) throw Object.assign(new Error(`authority: this node holds no in-force authority that permits this ${fields.kind}`), { code: 'ENOAUTHORITY' });
+    const s = { kind: fields.kind, authorisedBy };
+    if (fields.kind === 'grant') {
+      s.subject = { nodeId: fields.subject.nodeId, key: fields.subject.key };
+      s.role = fields.role;
+      if (fields.scope !== undefined && fields.scope !== null) s.scope = fields.scope;
+    } else {
+      s.targets = [...new Set(fields.targets)];
+    }
+    s.nonce = A.freshNonce();
+    if (Number.isSafeInteger(opts.issuedAt)) s.issuedAt = opts.issuedAt;
+    s.sigs = [];
+    A.signStatement(s, this._identity.privateKey, this._identity.publicKey);
+    const bad = A.malformedReason(s);
+    if (bad) throw Object.assign(new Error(`authority: the statement is not well formed (${bad})`), { code: 'EAUTHORITYSHAPE' });
+    return s;
+  },
+
+  /** Add this node's signature to an anchor-level statement if its key is pinned (§6.6.1). */
+  cosignAuthority(statement) {
+    if (!statement || statement.authorisedBy !== 'anchor') throw new Error('authority: only an anchor-level statement is co-signed');
+    if (!this._pin || !this._pin.members.some((m) => m.key === this._identity.publicKey)) throw Object.assign(new Error('authority: this node\'s key is not pinned'), { code: 'ENOAUTHORITY' });
+    if ((statement.sigs || []).some((e) => e.key === this._identity.publicKey)) return statement;
+    const s = A.canonicalStatement(statement, statement.sigs || []);
+    return A.signStatement(s, this._identity.privateKey, this._identity.publicKey);
+  },
+
+  /**
+   * Ingest a statement this host hands over (its own, or one it was given out of band), as gossip is
+   * ingested, and relay it once if it comes into force.
+   * @returns {{ result: string, id?: string, status?: string, reason?: string }}
+   */
+  submitAuthority(statement) {
+    const r = this._ingestAuthority(statement, null);
+    this._authoritySettle();
+    return { ...r, status: r.id ? this._authority.statusOf(r.id) : undefined };
+  },
+
+  /** Grant `role` to `subject` ({ nodeId, key }), optionally within `opts.scope`; signed and submitted. */
+  grant(subject, role, opts = {}) {
+    const s = this.authorityStatement({ kind: 'grant', subject, role, scope: opts.scope }, opts);
+    return { statement: s, ...this.submitAuthority(s) };
+  },
+  /** Revoke the grants named by id; signed and submitted. */
+  revoke(targets, opts = {}) {
+    const s = this.authorityStatement({ kind: 'revoke', targets }, opts);
+    return { statement: s, ...this.submitAuthority(s) };
+  },
+  /** Endorse the grants and revokes named by id, to keep them if a revoke cuts them off; signed and submitted. */
+  endorse(targets, opts = {}) {
+    const s = this.authorityStatement({ kind: 'endorse', targets }, opts);
+    return { statement: s, ...this.submitAuthority(s) };
+  },
+
+  /**
+   * Grant a role to a peer whose key this node has proven (a confirmed session or an out-of-band pin),
+   * or `opts.granteeKey`. Returns the signed grant, or null (said in the log) when it cannot be made.
+   */
+  grantRole(granteeNodeId, role, opts = {}) {
+    const source = this._keySource(granteeNodeId);
+    const key = opts.granteeKey || ((source === 'proven' || source === 'pinned' || source === 'session') ? this._identityKey(granteeNodeId) : undefined);
+    if (!key) { this._log(`Grant for ${String(granteeNodeId).slice(0, 8)} not made: no proven key is known for it`); return null; }
+    try {
+      const r = this.grant({ nodeId: granteeNodeId, key }, role, opts);
+      return r.result === 'held' || r.result === 'duplicate' ? r.statement : null;
+    } catch (err) { this._log(`Grant for ${String(granteeNodeId).slice(0, 8)} not made: ${err.message}`); return null; }
+  },
+
+  /**
+   * Revoke every in-force grant naming `nodeId` that this node may remove, in one revoke (at most 64
+   * targets). Returns the revoke, or null when there is nothing this node may revoke.
+   */
+  revokeRole(nodeId) {
+    const targets = [];
+    for (const s of this._authority.inForceStatements()) {
+      if (s.kind !== 'grant' || s.subject.nodeId !== nodeId) continue;
+      targets.push(A.statementId(s));
+    }
+    const permitted = targets.filter((t) => this._authoritySignerFor({ kind: 'revoke', targets: [t] }));
+    if (!permitted.length) { this._log(`Revoke for ${String(nodeId).slice(0, 8)} not made: no in-force grant this node may remove`); return null; }
+    try { return this.revoke(permitted.slice(0, A.AUTHORITY_MAX_TARGETS)).statement; }
+    catch (err) { this._log(`Revoke for ${String(nodeId).slice(0, 8)} not made: ${err.message}`); return null; }
+  },
+
+  /**
+   * The grants the retired time-replay rule kept here (§6.6.11), read as plain data for the operator
+   * who re-issues what should stand: never verified, never resolved, never sent. The role 'anchor' a
+   * grant conferred maps to 'admin'.
+   */
+  legacyRoleGrants() {
+    const file = path.join(this._dir, 'role-grants', 'role-grants.jsonl');
+    let text = '';
+    try { text = fs.readFileSync(file, 'utf8'); } catch { return []; }
+    const out = [];
+    for (const line of text.split('\n')) {
+      if (!line) continue;
+      let o; try { o = JSON.parse(line); } catch { continue; }
+      const g = o && o.grant && typeof o.grant === 'object' ? o.grant : o;
+      if (!g || g.type !== 'role-grant') continue;
+      out.push({ grantee: g.grantee, granteeKey: g.granteeKey || null, role: g.role === 'anchor' ? 'admin' : g.role, grantedBy: g.grantedBy });
+    }
+    return out;
+  },
+
+  // ── Ingest, gossip and anti-entropy: §6.6.8 ─────────────────────────────────
+
+  /**
+   * @private One statement, from a session (null: this host). `solicited`: it answers this node's own
+   * authority-fetch (or is a pending statement it held), so its work is charged to the peer's lane as a
+   * debt that paces the next request, never dropped: an answer dropped for budget would leave the
+   * pull short and the roots apart (§6.6.8).
+   */
+  _ingestAuthority(statement, session, { solicited = false } = {}) {
+    const peerId = session ? session.nodeId : null;
+    const signer = statement && Array.isArray(statement.sigs) && statement.sigs[0] && typeof statement.sigs[0].key === 'string' ? statement.sigs[0].key : '?';
+    if (session) {
+      // As on every gossip lane, what is dropped for nothing is dropped before the budget: a statement
+      // not of the shape (no curve arithmetic yet), and a repeat (relaying sends every statement to
+      // every node; only the first copy is new).
+      const bad = A.shapeReason(statement);
+      if (bad) { this._authorityStats.invalid++; this._noteRelayFailure(peerId, `authority:${signer}`); return { result: 'invalid', reason: `not well formed: ${bad}` }; }
+      const id = A.statementId(statement);
+      if (this._authority.has(id)) { this._authorityStats.duplicate++; return { result: 'duplicate', id }; }
+      // A session that delivered statements failing verification is rate-limited (§6.6.8): past the
+      // failures allowed in a window its statements by that signer are dropped unverified.
+      if (this._relayMuted(peerId, `authority:${signer}`)) return { result: 'muted' };
+      const cost = 1 + FRESH_KEY_COST * this._authorityFreshKeys(statement);
+      if (solicited) this._gossipCharge(peerId, cost);
+      else if (!this._gossipBudget(peerId, 'authority-statement', signer, cost)) { this._authorityStats.overBudget++; return { result: 'over-budget' }; }
+    }
+    const r = this._authority.ingest(statement);
+    if (r.result === 'held') {
+      this._authorityStats.held++;
+      if (peerId) this._authorityOrigin.set(r.id, peerId);
+      this._authorityRetryPending(r.id);
+      this._scheduleAuthoritySettle();
+    } else if (r.result === 'duplicate') this._authorityStats.duplicate++;
+    else if (r.result === 'pending') {
+      this._authorityStats.pending++;
+      if (session) this._holdAuthorityPending(session, statement, r);
+    } else {
+      this._authorityStats.invalid++;
+      if (session) this._noteRelayFailure(peerId, `authority:${signer}`);
+    }
+    return r;
+  },
+
+  /**
+   * @private How many keys checking `s` would meet for the first time (§18.3.2 rules 1 and 2 not yet
+   * known), counting only the checks the store will make: a grant's subject key; the signing key of a
+   * statement below the anchor when it is verified (its chain not held, so its own signature is
+   * checked; or held, and the key the one its authorising grant names); and the pinned keys an
+   * anchor-level statement's entries name (no other entry is verified).
+   */
+  _authorityFreshKeys(s) {
+    const keys = new Set();
+    if (s.kind === 'grant') keys.add(s.subject.key);
+    if (s.authorisedBy !== 'anchor') {
+      const auth = this._authority.get(s.authorisedBy);
+      const k = s.sigs[0].key;
+      if (!auth || (auth.kind === 'grant' && auth.subject.key === k)) keys.add(k);
+    } else for (const e of s.sigs) if (this._pin && this._pin.members.some((m) => m.key === e.key)) keys.add(e.key);
+    let n = 0;
+    for (const k of keys) if (!isKeyKnown(k)) n++;
+    return n;
+  },
+
+  /**
+   * @private A pending statement (§6.6.8): held in memory for its session, keyed by id and signing
+   * key, at most AUTHORITY_PENDING_MAX, released after AUTHORITY_PENDING_TIMEOUT or with the session;
+   * the missing link is fetched from that session, one fetch in flight per missing id.
+   */
+  _holdAuthorityPending(session, statement, r) {
+    const h = session._authPending || (session._authPending = new Map());
+    const key = `${r.id}|${statement.sigs[0].key}`;
+    if (h.has(key)) return;
+    if (h.size >= A.AUTHORITY_PENDING_MAX) { this._noteDrop('authority-pending-full', session.nodeId, { frame: 'authority-statement' }); return; }
+    const timer = setTimeout(() => h.delete(key), A.AUTHORITY_PENDING_TIMEOUT);
+    if (timer.unref) timer.unref();
+    h.set(key, { statement, missing: r.missing, timer });
+    const fetching = session._authFetching || (session._authFetching = new Map());
+    if (!fetching.has(r.missing)) {
+      const reqId = `af-${crypto.randomBytes(8).toString('hex')}`;
+      const t = setTimeout(() => fetching.delete(r.missing), FETCH_TIMEOUT_MS);
+      if (t.unref) t.unref();
+      fetching.set(r.missing, { reqId, timer: t });
+      this._authorityStats.fetched++;
+      session.send({ type: 'authority-fetch', reqId, ids: [r.missing] });
+    }
+  },
+
+  /** @private A statement was held: offer again what any session held pending for it. */
+  _authorityRetryPending(id) {
+    for (const session of this._sessions) {
+      const h = session._authPending;
+      if (!h || !h.size || session.closed) continue;
+      for (const [k, p] of [...h]) {
+        if (p.missing !== id) continue;
+        clearTimeout(p.timer);
+        h.delete(k);
+        this._ingestAuthority(p.statement, session, { solicited: true });
+      }
+    }
+  },
+
+  /** @private Release what a closing session held (pending statements, fetches, pulls, queued answers). */
+  _authorityReleaseSession(session) {
+    for (const p of (session._authPending || new Map()).values()) clearTimeout(p.timer);
+    for (const f of (session._authFetching || new Map()).values()) clearTimeout(f.timer);
+    if (session._authPull) { clearTimeout(session._authPull.timer); clearTimeout(session._authPull.wait); }
+    if (session._authDigestTimer) clearTimeout(session._authDigestTimer);
+    if (session._authServeTimer) clearTimeout(session._authServeTimer);
+    session._authPending = null; session._authFetching = null; session._authPull = null;
+    session._authServeQueue = null; session._authServeTimer = null;
+  },
+
+  /** @private Settle once the current ingest is done (many statements in one tick settle once). */
+  _scheduleAuthoritySettle() {
+    if (this._authoritySettleQueued) return;
+    this._authoritySettleQueued = true;
+    setImmediate(() => { this._authoritySettleQueued = false; this._authoritySettle(); });
+  },
+
+  /**
+   * @private Resolve, and act on what changed: relay each statement that entered the in-force set,
+   * once (§6.6.8); tell every session the new root (at most once a second each); bind in-force grants
+   * as a key-registry view (§6.6.9) and report one naming this node with a foreign key.
+   */
+  _authoritySettle() {
+    const { inForce } = this._authority.resolve();
+    const entered = [...inForce].filter((id) => !this._authorityPrev.has(id));
+    const changed = entered.length > 0 || this._authorityPrev.size !== inForce.size;
+    for (const id of this._authority.authorityOrder(entered).map((e) => e.id)) {
+      const s = this._authority.get(id);
+      if (!this._authorityRelayed.has(id)) {
+        this._authorityRelayed.add(id);
+        this._authorityStats.relayed++;
+        this._gossipToRoster({ type: 'authority-statement', statement: s }, this._authorityOrigin.get(id) || null);
+      }
+      if (s.kind === 'grant') {
+        if (s.subject.nodeId === this.nodeId) {
+          if (s.subject.key !== this._identity.publicKey && !this._authorityReported.has(id)) {
+            this._authorityReported.add(id);
+            this._log(`[sym-security] an in-force grant (${id.slice(0, 17)}) names this node's nodeId with a key that is not its own: it confers nothing here; someone vouched a foreign key for this node's identity`);
+            this.emit('metric', { type: 'authority-foreign-self-key', id, key: s.subject.key });
+          }
+        } else if (typeof this._roster.bind === 'function') {
+          // A conflicting binding is recorded by the registry, and the binding stays as it was.
+          this._roster.bind(s.subject.nodeId, s.subject.key, 'grant');
+        }
+      }
+    }
+    this._authorityOrigin.clear();
+    this._authorityPrev = new Set(inForce);
+    if (changed) {
+      for (const session of this._sessions) if (session.confirmed && !session.closed) this._sendAuthorityDigest(session);
+      try { this.emit('authority-changed', Object.freeze({ root: this._authority.root(), inForce: inForce.size })); } catch { /* a listener must not stop the settle */ }
+    }
+  },
+
+  /** @private authority-digest on `session`, at most once a second (§6.6.8). */
+  _sendAuthorityDigest(session, { now = false } = {}) {
+    if (!this._authority.anchored || !session || session.closed) return;
+    const send = () => {
+      session._authDigestTimer = null;
+      if (session.closed) return;
+      session._authDigestAt = Date.now();
+      const d = this._authority.digest();
+      session.send({ type: 'authority-digest', root: d.root, count: d.count });
+    };
+    const since = Date.now() - (session._authDigestAt || 0);
+    if (now || since >= DIGEST_MIN_MS) { send(); return; }
+    if (session._authDigestTimer) return;
+    session._authDigestTimer = setTimeout(send, DIGEST_MIN_MS - since);
+    if (session._authDigestTimer.unref) session._authDigestTimer.unref();
+  },
+
+  /**
+   * @private A peer's root and count: one that differs from this node's starts a pull of its live set.
+   * One pull in flight per session; a digest that arrives during it is remembered, and the pull is
+   * started again when it ends if the roots still differ (§6.6.8: reconciled by the next digest).
+   */
+  _onAuthorityDigest(session, msg) {
+    if (!this._authority.anchored || !msg || typeof msg.root !== 'string' || !HEX64.test(msg.root) || !Number.isSafeInteger(msg.count) || msg.count < 0) return;
+    session._authPeerRoot = msg.root;
+    if (msg.root === this._authority.root()) return;
+    if (session._authPull) { session._authPull.digestSeen = true; return; }
+    this._startAuthorityPull(session, '');
+  },
+
+  /**
+   * @private Ask for a page of the peer's live set after `after` (§6.6.8). An unanswered page is asked
+   * again from the same cursor, up to PULL_RETRIES times; then the pull ends.
+   */
+  _startAuthorityPull(session, after = '', attempt = 0) {
+    if (session.closed) return;
+    const prev = session._authPull;
+    if (prev && after === '' && attempt === 0 && !prev.done) return; // one pull in flight
+    if (prev) { clearTimeout(prev.timer); clearTimeout(prev.wait); }
+    const pull = { reqId: `af-${crypto.randomBytes(8).toString('hex')}`, after, attempt, digestSeen: !!(prev && prev.digestSeen && after !== ''), timer: null, wait: null, done: false };
+    pull.timer = setTimeout(() => {
+      if (session._authPull !== pull) return;
+      if (attempt < PULL_RETRIES && !session.closed) this._startAuthorityPull(session, after, attempt + 1);
+      else session._authPull = null;
+    }, FETCH_TIMEOUT_MS);
+    if (pull.timer.unref) pull.timer.unref();
+    session._authPull = pull;
+    if (after === '' && attempt === 0) this._authorityStats.pulls++;
+    session.send({ type: 'authority-fetch', reqId: pull.reqId, after });
+  },
+
+  /**
+   * @private authority-fetch (§6.6.8): checked, then answered in turn at SERVE_PER_SECOND per session
+   * (burst SERVE_BURST); a request over the rate waits, at most SERVE_QUEUE_MAX of them.
+   */
+  _onAuthorityFetch(session, msg) {
+    if (!this._authority.anchored || !msg || typeof msg.reqId !== 'string' || !msg.reqId || msg.reqId.length > 128) return;
+    if (Array.isArray(msg.ids) && msg.after === undefined) {
+      if (msg.ids.length < 1 || msg.ids.length > A.AUTHORITY_PAGE || !msg.ids.every((x) => typeof x === 'string' && A.STATEMENT_ID.test(x)) || new Set(msg.ids).size !== msg.ids.length) return;
+    } else if (!(typeof msg.after === 'string' && msg.after.length <= 128 && msg.ids === undefined)) return;
+    const q = session._authServeQueue || (session._authServeQueue = []);
+    if (q.length >= SERVE_QUEUE_MAX) { this._noteDrop('authority-fetch-queue-full', session.nodeId, { frame: 'authority-fetch' }); return; }
+    q.push(msg);
+    this._drainAuthorityServe(session);
+  },
+
+  /** @private Answer the queued fetches the session's pacing allows now, and wait for the rest. */
+  _drainAuthorityServe(session) {
+    const q = session._authServeQueue;
+    if (!q || session.closed) { session._authServeQueue = null; return; }
+    const now = Date.now();
+    const b = session._authServe || (session._authServe = { tokens: SERVE_BURST, at: now });
+    b.tokens = Math.min(SERVE_BURST, b.tokens + (Math.max(0, now - b.at) * SERVE_PER_SECOND) / 1000);
+    b.at = now;
+    while (q.length && b.tokens >= 1) {
+      b.tokens -= 1;
+      this._serveAuthorityFetch(session, q.shift());
+    }
+    if (q.length && !session._authServeTimer) {
+      const t = setTimeout(() => { session._authServeTimer = null; this._drainAuthorityServe(session); }, Math.ceil(((1 - b.tokens) * 1000) / SERVE_PER_SECOND));
+      if (t.unref) t.unref();
+      session._authServeTimer = t;
+    }
+  },
+
+  /** @private One answer: by ids, or a page of the live set, as the set stands when it is sent. */
+  _serveAuthorityFetch(session, msg) {
+    const answer = msg.ids !== undefined ? this._authority.answerIds(msg.ids) : this._authority.page(msg.after);
+    this._authorityStats.served++;
+    const frame = { type: 'authority-set', reqId: msg.reqId, statements: answer.statements };
+    if (answer.missing && answer.missing.length) frame.missing = answer.missing;
+    if (answer.next) frame.next = answer.next;
+    session.send(frame);
+  },
+
+  /**
+   * @private An answer to this node's fetch or pull on the same session: each statement ingested as
+   * gossip is, its work charged to the peer's lane (`solicited`); the next page is asked for once that
+   * lane is out of debt, so a pull is paced by the work it causes and never cut short.
+   */
+  _onAuthoritySet(session, msg) {
+    if (!msg || typeof msg.reqId !== 'string' || !Array.isArray(msg.statements) || msg.statements.length > A.AUTHORITY_PAGE) return;
+    const pull = session._authPull && session._authPull.reqId === msg.reqId && !session._authPull.done ? session._authPull : null;
+    let fetch = null;
+    for (const [missing, f] of session._authFetching || []) if (f.reqId === msg.reqId) { fetch = missing; clearTimeout(f.timer); session._authFetching.delete(missing); break; }
+    if (!pull && fetch === null) return; // nobody asked on this session
+    for (const s of msg.statements) this._ingestAuthority(s, session, { solicited: true });
+    if (!pull) return;
+    clearTimeout(pull.timer);
+    pull.done = true;
+    const next = typeof msg.next === 'string' && msg.next && msg.next.length <= 128 ? msg.next : null;
+    if (next && !session.closed) {
+      const wait = this._gossipDebtMs(session.nodeId);
+      if (wait <= 0) { this._startAuthorityPull(session, next); return; }
+      pull.wait = setTimeout(() => { if (session._authPull === pull && !session.closed) this._startAuthorityPull(session, next); }, wait);
+      if (pull.wait.unref) pull.wait.unref();
+      return;
+    }
+    session._authPull = null;
+    // A digest came while the pull ran: if this node still lacks that root, pull again.
+    if (pull.digestSeen && session._authPeerRoot && session._authPeerRoot !== this._authority.root()) this._startAuthorityPull(session, '');
+  },
+
+  /** @private A retired time-replay frame (§6.6.11): ignored, counted, said once a minute per peer. */
+  _onRetiredAuthorityFrame(session, type) {
+    this._authorityStats.retired++;
+    if (typeof this._noteSessionRefusal === 'function') this._noteSessionRefusal(session, type, 'retired: MMP §6.6.11 (authority statements replace role grants)');
+  },
+};
+
+module.exports = { initAuthority, methods, RETIRED_FRAMES, FRESH_KEY_COST, SERVE_BURST, SERVE_QUEUE_MAX, lifecycleRank, highestRole, ROLE_ORDER };
diff --git a/lib/node.js b/lib/node.js
index 11b5cc32..8b911bbe 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -28,7 +28,8 @@ const { nodeDirById, loadIdentity, acquireIdentityLock, log: logMsg } = require(
 const { assertTestSandbox } = require('./core/state-root');
 const { MemoryStore } = require('./memory-store');
 const { AttestationStore, chainHash, isPosition, isCanonicalSig } = require('./attestation-store');
-const { RoleGrantStore, canonicalGrant, malformedGrant, MAX_RATIFY } = require('./role-grant-store');
+const authorityMixin = require('./node-authority');
+const { parsePin } = require('./core/authority');
 const { RosterKeyRegistry, keyFingerprint } = require('./roster-keys');
 const { signedProjection, isLowerUuid } = require('./core/record-canonical');
 /** A stored record's signed projection, or null for one that is not a v2.0 record. */
@@ -46,7 +47,7 @@ const {
   WakeManager,
   signCMB, assertionIdV2_0, mintRemixKey, signAttestation, verifyAttestation, verifyAttestationRole,
   merkleRoot, signCheckpoint, verifyCheckpoint, signWitness, verifyWitness,
-  signGrant, roleRank, CAT7_CATEGORIES, assertRecordSendable,
+  CAT7_CATEGORIES, assertRecordSendable,
   attestMerkleRoot, toWireAttestation, toWireCheckpoint, toWireWitness, ATTEST_FRAME,
 } = require('./core');
 /** What a checkpoint made since 0.14 commits (the sym-attest-v1 root); one without it is 0.13's. */
@@ -81,17 +82,6 @@ const { SEND_FAILURE, MAX_FRAME_SIZE } = require('./frame-parser');
 const { RelayConnection } = require('./relay');
 const { BonjourDiscovery, NullDiscovery } = require('./discovery');
 
-/** Parse the earned-authority anchor from an object or a "nodeId:publicKey" string. */
-function parseAnchor(a) {
-  if (!a) return null;
-  if (typeof a === 'object' && a.nodeId && a.publicKey) return { nodeId: a.nodeId, publicKey: a.publicKey };
-  if (typeof a === 'string') {
-    const i = a.indexOf(':');
-    if (i > 0) return { nodeId: a.slice(0, i), publicKey: a.slice(i + 1) };
-  }
-  return null;
-}
-
 /**
  * Reduce a weighted verdict tally `{verdict -> weight}` to its dominant verdict and the
  * dominant's share of total weight (confidence in [0,1]). Ties break by descending weight
@@ -109,7 +99,7 @@ function summarizeTally(tally, totalWeight) {
 }
 
 /**
- * One lane's budget of NEW gossiped statements (attestations, checkpoints, witnesses, role grants): a
+ * One lane's budget of NEW gossiped statements (attestations, checkpoints, witnesses, authority statements): a
  * burst, then a rate a second, spent before the signature is checked, so no lane can buy more
  * signature checks than this (lanes and the ceiling over all of them: see GOSSIP_NEW_LANE). A repeat,
  * a malformed frame, one for a signer whose key is not held, a stale checkpoint or a further root for a
@@ -179,19 +169,6 @@ const INBOX_UNREAD_FACTOR = 4;
 const INBOX_OWNERS = new Map();
 /** A peer that delivered a forged signature is not admitted again for this long (security review D). */
 const FORGERY_PENALTY_MS = 60_000;
-/** role-chain-fetch (design D3): records held per session while their chain is fetched, and for how long. */
-const CHAIN_HOLD_MAX = 64;
-/** ...and the bytes they hold, at most (security review D): a held record is its signed fields only. */
-const CHAIN_HOLD_BYTES = 64 * 1024;
-const CHAIN_FETCH_TIMEOUT_MS = 10_000;
-/** Anti-entropy (security review D): pages of a whole-store sync one session asks for, at most. */
-const CHAIN_SYNC_MAX_PAGES = 1024;
-/** Grantees one fetch may name, and grants one answer carries, at most. */
-const CHAIN_FETCH_MAX_GRANTEES = 16;
-const CHAIN_ANSWER_MAX = 64;
-/** Answers served per session: a token bucket. */
-const CHAIN_SERVE_PER_SECOND = 4;
-const CHAIN_SERVE_BURST = 16;
 /**
  * MMP §7.2 error codes (lib/session.js): 1011 UNKNOWN_SESSION ("this node holds no session with you",
  * draft spec PRs #23 and #31: it only prompts a new handshake), 1010 SESSION_CLOSED (sealed, a
@@ -202,7 +179,8 @@ const UNKNOWN_SESSION_CODE = UNKNOWN_SESSION;
 const KNOWN_FRAME_TYPES = new Set(['cmb', 'cmb-encrypted', 'control-encrypted', 'client-hello', 'server-hello', 'client-finish',
   'ping', 'pong', 'error', 'cmb-anchors', 'mood', 'wake-channel', 'peer-info', 'sym-attest-attestation', 'sym-attest-checkpoint',
   'sym-attest-witness', 'sym-attest-node-stats', 'attestation', 'checkpoint', 'witness', 'node-stats', 'cmb-fetch', 'cmb-fetch-result',
-  'role-grant', 'role-revoke', 'role-chain-fetch', 'role-chain', 'role-digest', 'xmesh-insight', 'room-join', 'handshake',
+  'role-grant', 'role-revoke', 'role-chain-fetch', 'role-chain', 'role-digest', 'authority-statement', 'authority-digest',
+  'authority-fetch', 'authority-set', 'xmesh-insight', 'room-join', 'handshake',
   'state-sync', 'message', 'session-confirmed', 'relay-auth', 'relay-peers', 'relay-peer-joined', 'relay-peer-left',
   'relay-ping', 'relay-pong', 'relay-reauth', 'relay-error']);
 /** 1011 replies to relay froms this node holds no session with: a token bucket over all of them. */
@@ -531,24 +509,23 @@ class SymNode extends EventEmitter {
     this._handshakeTimeoutMs = opts.handshakeTimeoutMs || 5_000;
     this._legacyRefusals = new Map(); // address -> { at, more }: legacy hellos refused on the listener
     this._sessionStats = { confirmed: 0, failed: 0, failedByReason: {}, refusedFrames: 0, refusedByReason: {}, desync: 0, superseded: 0, legacyHellosRefused: 0 };
-    this._chainStats = { fetched: 0, resolved: 0, timedOut: 0, served: 0 };
-    this._chainFetchTimeoutMs = opts.chainFetchTimeoutMs || CHAIN_FETCH_TIMEOUT_MS;
     // Legacy Import (design D7) is created after the node dir and the key registry exist (below).
     this._legacyRoutes = opts.legacyRoutes || null;
     this._legacy = null;
 
-    // Earned-authority root (MMP §6.5). The pinned, non-earnable anchor identity
-    // (typically the founder) that all role authority must chain back to. Configured
-    // via opts.anchor { nodeId, publicKey } or SYM_FOUNDER_ANCHOR="nodeId:publicKey".
-    // Without an anchor the node falls back to its static `lifecycleRole` (legacy).
-    this._anchor = parseAnchor(opts.anchor || process.env.SYM_FOUNDER_ANCHOR);
+    // The anchor (MMP §6.6.1): a pinned key set with a threshold, configured out of band —
+    // opts.anchor { threshold, keys: [{ key, nodeId? }] }, the 1-of-1 { nodeId, publicKey }, or
+    // SYM_FOUNDER_ANCHOR ("nodeId:publicKey", or the pin as JSON). Never learned from the wire.
+    // Without one nothing is in force, and the node falls back to its static `lifecycleRole` (§6.5).
+    this._pin = parsePin(opts.anchor !== undefined ? opts.anchor : (process.env.SYM_FOUNDER_ANCHOR || null));
     // Roster key registry — authenticated nodeId→key bindings, so signatures from peers
     // we never directly handshook still verify. Pins by source precedence (anchor >
     // handshake > grant-vouched); the relayer never vouches. Persisted under the node dir.
     // nodeId -> { key, sessions }: the key each live confirmed session proved (see _admitSession).
     this._sessionKeys = new Map();
     this._roster = new RosterKeyRegistry({
-      anchor: this._anchor,
+      // Each pinned anchor member configured with its nodeId binds that nodeId (configuration).
+      anchors: this._pin ? this._pin.members.filter((m) => m.nodeId).map((m) => ({ nodeId: m.nodeId, publicKey: m.key })) : [],
       // This node's own nodeId is its own key: no session, pin or grant binds it to another (review C).
       self: { nodeId: this.nodeId, publicKey: this._identity.publicKey },
       dir: path.join(this._dir, 'roster-keys'),
@@ -578,34 +555,13 @@ class SymNode extends EventEmitter {
     // The room-join grant THIS node presents when joining a gated room, if it holds one
     // (carried by an invite). Absent for the room's owner, which needs none.
     this._roomGrant = opts.roomGrant || null;
-    // Role-grant chain — signed grants/revokes; resolves the role a node held at a
-    // given time, with authority flowing only along anchor-rooted chains. Keeps only
-    // records rooted at the anchor, verifies their sigs through the roster registry's own
-    // lookup (which a rooted grant can populate with the grantee's vouched key); persisted
-    // under the node dir. Reading it never stops the node from starting: what it could not
-    // verify is skipped and said here, once.
-    this._roleGrants = new RoleGrantStore({
-      anchor: this._anchor,
-      selfId: this.nodeId,
-      selfKey: this._identity.publicKey,
-      onForeignSelfGrant: (g) => {
-        this._log(`[sym-security] a role grant by ${String(g.grantedBy).slice(0, 8)} names this node with a key that is not its own (${String(g.granteeKey).slice(0, 12)}…): inert; someone vouched a foreign key for this node's identity`);
-        this.emit('metric', { type: 'role-grant-foreign-self-key', grantedBy: g.grantedBy, granteeKey: g.granteeKey });
-      },
-      keys: this._roster,
-      dir: path.join(this._dir, 'role-grants'),
-    });
-    // A grant binding is a view over the grants in effect now (security review C).
-    this._roster.setGrantView((nodeId) => this._roleGrants.vouchedKey(nodeId));
-    {
-      const r = this._roleGrants.loadReport();
-      const skipped = Object.entries(r.skipped);
-      if (r.unreadable) this._log(`Role grants: ${r.unreadable}; starting with no grants`);
-      else if (skipped.length) {
-        const n = skipped.reduce((sum, [, c]) => sum + c, 0);
-        this._log(`Role grants: loaded ${r.loaded}, skipped ${n} that could not be verified (${skipped.map(([k, c]) => `${k} ${c}`).join(', ')})`);
-      }
-    }
+    // Authority (MMP §6.6): the verified grant, revoke and endorse statements this node holds, and
+    // the in-force set they resolve to — a function of the set, never of arrival order or any clock.
+    // Persisted under the node dir and verified again at every load.
+    authorityMixin.initAuthority(this, opts);
+    // A grant binding is a view over the in-force grants (§6.6.9): it binds an unbound nodeId only,
+    // never this node's own.
+    this._roster.setGrantView((nodeId) => (nodeId === this.nodeId ? undefined : this._authority.grantKey(nodeId)));
     // Strict mode: when set, reject UNSIGNED CMBs from peers whose identity key
     // is known (default off — unsigned peers are allowed for interop).
     this._requireSignedCmb = process.env.SYM_REQUIRE_SIGNED_CMB === '1'
@@ -882,32 +838,9 @@ class SymNode extends EventEmitter {
 
   // ── Keys ───────────────────────────────────────────────────
 
-  /**
-   * This node's EARNED role right now — resolved from the role-grant chain when an
-   * anchor is configured, else the static `lifecycleRole` (legacy / no root of trust).
-   * The role this node stamps into its attestations + witnesses; consumers can
-   * independently re-resolve it via the chain.
-   * @returns {'participant'|'validator'|'anchor'}
-   */
-  _resolvedRole() {
-    if (!this._anchor) return this._lifecycleRole;
-    return this._roleGrants.resolveRole(this.nodeId, this._identity.publicKey, Date.now());
-  }
-
-  /**
-   * Resolve any node's role at a time (default now) from this node's grant chain. Authority follows
-   * the key (design D3): the role is the one conferred on the key `nodeId` is bound to here — its
-   * proven or vouched binding — so an id held under another key resolves to participant. Pass
-   * `opts.key` to ask about a specific key instead.
-   */
-  resolveRole(nodeId, at = Date.now(), opts = {}) {
-    const key = opts.key || (nodeId === this.nodeId ? this._identity.publicKey : this._identityKey(nodeId));
-    return this._roleGrants.resolveRole(nodeId, key, at);
-  }
-
   /**
    * The key that verifies `nodeId`'s signatures: its binding in the key registry (design D3) —
-   * the configured anchor, a proven session, an out-of-band pin, or an anchor-rooted grant's vouch.
+   * the configured anchor, a proven session, an out-of-band pin, or an in-force grant (§6.6.9).
    * Never a key a hello merely announced, and never a legacy claim.
    * @private
    */
@@ -1093,74 +1026,6 @@ class SymNode extends EventEmitter {
     });
   }
 
-  /**
-   * Grant a lifecycle role to a peer (MMP §6.5). Signs a role-grant with this node's
-   * identity key, records it, and gossips it to the roster. A grant is made only if THIS
-   * node's own resolved role outranks-or-equals the conferred role along a chain rooted at
-   * the anchor; a grant it is not entitled to make would have no effect anywhere, so it is
-   * neither kept nor sent, and this returns null.
-   * @param {string} granteeNodeId
-   * @param {'validator'|'anchor'} role
-   * @returns {object|null} the signed grant, or null
-   */
-  grantRole(granteeNodeId, role, opts = {}) {
-    // Every grant names the key it confers authority on (design D3): a grant to a bare nodeId would
-    // confer it on whoever holds that id later. The key is one this node has a PROVEN binding for (a
-    // confirmed session, or an out-of-band pin), or one the operator names explicitly.
-    const source = this._keySource(granteeNodeId);
-    const granteeKey = opts.granteeKey
-      || ((source === 'proven' || source === 'pinned' || source === 'session') ? this._identityKey(granteeNodeId) : undefined);
-    if (!granteeKey) {
-      this._log(`Role grant for ${String(granteeNodeId).slice(0, 8)} not made: no proven key is known for it (it has not completed a Core Secure session with this node, and no key was given)`);
-      return null;
-    }
-    return this._emitGrant({ type: 'role-grant', grantee: granteeNodeId, role, granteeKey });
-  }
-
-  /**
-   * Revoke a peer's granted role (signed role-revoke, gossiped). `opts.cutoff` (ms epoch, no later
-   * than now) is REQUIRED, with no default (final re-review ruling B): it is the time from which the
-   * revoked node is no longer trusted, and its statements signed at or after it never count.
-   * `opts.ratify` lists the revoked node's earlier statements (their signatures; at most 64) that stay
-   * valid: any other statement it signed before the cutoff counts only while it still holds rank, so
-   * a revoked key gains nothing by backdating. `roleStatementsBy(nodeId, cutoff)` lists the records
-   * it signed that this node holds. A revoker reaches back only over time it was itself
-   * authorised for (docs/WIRE-0.14.0.md §6).
-   * @param {string} granteeNodeId
-   * @param {{ cutoff: number, ratify?: string[] }} opts
-   * @returns {object|null} the signed revoke, or null when the store did not keep it
-   * @throws {TypeError} code ECUTOFF when `cutoff` is missing or not a time no later than now;
-   *   code ERATIFY when `ratify` is not a list of at most 64 signatures
-   */
-  revokeRole(granteeNodeId, opts = {}) {
-    const at = Date.now();
-    const cutoff = opts && opts.cutoff;
-    if (!Number.isSafeInteger(cutoff) || cutoff < 0 || cutoff > at) {
-      throw Object.assign(new TypeError('revokeRole: opts.cutoff is required: the time (ms epoch, no later than now) from which the revoked node is no longer trusted'), { code: 'ECUTOFF' });
-    }
-    let ratify;
-    if (opts.ratify !== undefined) {
-      const { sigKey } = require('./attestation-store');
-      const list = Array.isArray(opts.ratify) ? [...new Set(opts.ratify.map((x) => (typeof x === 'string' ? sigKey(x) : x)))] : null;
-      if (!list || list.length === 0 || list.length > MAX_RATIFY || !list.every((x) => typeof x === 'string' && isCanonicalSig(x))) {
-        throw Object.assign(new TypeError(`revokeRole: opts.ratify is a list of 1 to ${MAX_RATIFY} signatures`), { code: 'ERATIFY' });
-      }
-      ratify = list.sort();
-    }
-    return this._emitGrant({ type: 'role-revoke', grantee: granteeNodeId, cutoff, ...(ratify ? { ratify } : {}) }, at);
-  }
-
-  /**
-   * The role grants and revokes `nodeId` signed that this node holds, signed before `before`: what a
-   * revoker reviews when it chooses which statements its revoke ratifies (`revokeRole`, `ratify`).
-   * @param {string} nodeId
-   * @param {number} [before]
-   * @returns {object[]} the signed records, oldest first
-   */
-  roleStatementsBy(nodeId, before) {
-    return this._roleGrants.statementsBy(nodeId, before);
-  }
-
   /**
    * Advance a CMB to `validated` under THIS node's earned authority (MMP §6.5). The
    * node's role is resolved from its grant chain (or the static lifecycle role when no
@@ -1170,7 +1035,10 @@ class SymNode extends EventEmitter {
    * @returns {{ ok: boolean, reason?: string }}
    */
   validateCMB(key) {
-    return this._store.validateCMB(key, { byRole: this._resolvedRole() });
+    // §6.5: this node's lifecycle authority over THAT CMB, judged on its own signed fields (a scoped
+    // grant counts only inside its scope), against the in-force set now.
+    const e = this._store.get(key);
+    return this._store.validateCMB(key, { lifecycle: this._authority.anchored ? this.lifecycleAuthority(this.nodeId, this._identity.publicKey, e && e.cmb) : lifecycleOfRole(this._lifecycleRole) });
   }
 
   /**
@@ -1180,252 +1048,8 @@ class SymNode extends EventEmitter {
    * @returns {{ ok: boolean, reason?: string }}
    */
   canonizeCMB(key) {
-    return this._store.canonizeCMB(key, { byRole: this._resolvedRole() });
-  }
-
-  /** @private Sign + record + gossip a grant/revoke. */
-  _emitGrant(partial, at = Date.now()) {
-    // A grant vouches for the grantee's nodeId↔key binding (granteeKey, bound into the signed
-    // payload): nodes that never met the grantee learn its key from this rooted grant. Revokes carry
-    // no key; they carry a cutoff.
-    const g = { type: partial.type, grantee: partial.grantee, ...(partial.role ? { role: partial.role } : {}), grantedBy: this.nodeId, grantedAt: at, ...(partial.granteeKey ? { granteeKey: partial.granteeKey } : {}), ...(partial.cutoff !== undefined ? { cutoff: partial.cutoff } : {}), ...(partial.ratify ? { ratify: partial.ratify } : {}) };
-    try {
-      signGrant(g, this._identity.privateKey);
-      const r = this._roleGrants.record(g);
-      if (!r.stored) {
-        this._log(`Role ${g.type === 'role-revoke' ? 'revoke' : 'grant'} for ${String(g.grantee).slice(0, 8)} not made: ${r.reason}`);
-        return null;
-      }
-      this._gossipToRoster({ type: g.type, grant: r.grant });
-      return r.grant;
-    } catch (err) {
-      this._log(`Role grant signing failed: ${err.message}`);
-      return null;
-    }
-  }
-
-  /**
-   * Ingest a role-grant/revoke gossiped by a roster peer: the store keeps it when it is verifiable
-   * (its signature verifies under the anchor's key or a key a kept grant vouches for its grantor) and
-   * its delegation subtree's budget selects it; its effect is decided at resolution
-   * (docs/WIRE-0.14.0.md §6). Only a record kept is relayed (once), as the store's canonical copy:
-   * only the signed fields (A5).
-   * @private
-   */
-  _ingestRoleGrant(g, fromPeerId, session = null, { hold = true } = {}) {
-    // A role grant is gossip like any other signed statement: a repeat (its signature's bytes, however
-    // it is spelled) or a frame that is malformed (field types, canonical lowercase nodeIds, bounded
-    // lengths), spelled otherwise than its signer wrote it, or from a grantor whose key this node does
-    // not hold is dropped before anything is spent; a new one spends the delivering peer's own lane
-    // before its signature is checked. A signature that does not verify is charged as
-    // `_penaliseForgery` decides (only to a session signing in its own name). The store bounds what it
-    // keeps (a budget per delegation subtree), so grants draw on no shared ceiling; only what it keeps
-    // is relayed.
-    if (malformedGrant(g)) return { ok: false, reason: 'malformed' };
-    if (!isCanonicalSig(g.sig)) return this._refuseSpelling(fromPeerId, 'role-grant', g.grantedBy);
-    if (this._roleGrants.has(g.sig)) return { ok: false, reason: 'duplicate' };
-    if (!this._roleGrants.grantorKey(g.grantedBy)) {
-      if (hold) this._holdForChain(session, g);
-      return { ok: false, reason: 'unknown-grantor-key' };
-    }
-    if (this._relayMuted(fromPeerId, g.grantedBy)) return { ok: false, reason: 'relayed-signer-muted' };
-    if (!this._gossipBudget(fromPeerId, 'role-grant', g.grantedBy)) return { ok: false, reason: 'over-budget' };
-    const r = this._roleGrants.record(g);
-    if (r.stored) this._gossipToRoster({ type: r.grant.type, grant: r.grant }, fromPeerId);
-    else if (r.reason === 'bad-signature') {
-      // Verified against the keys this store's chain vouches for the grantor, not the session's: the
-      // session is charged only when the grantor is its own peer and its proven key was among them.
-      const own = session && g.grantedBy === session.nodeId && this._roleGrants.grantorKeys(g.grantedBy).includes(session.identityKey);
-      this._penaliseForgery(session, 'role-grant', { author: g.grantedBy, key: own ? session.identityKey : null });
-    }
-    return { ok: r.stored, reason: r.reason };
-  }
-
-  /**
-   * A grant or revoke arrived before the grant that roots its grantor (design D3; it replaces
-   * 0.13.17's pending set, which anyone could flood). Instead of keeping it for whatever may come,
-   * the node asks the session that delivered it for the chain — a directed `role-chain-fetch`
-   * naming the grantor whose rooting grants are missing — and holds the record only for that fetch:
-   * at most CHAIN_HOLD_MAX per session, until the answer or CHAIN_FETCH_TIMEOUT_MS. The answer is
-   * ordinary signed grants, verified top-down by the store like any other; then the held record is
-   * offered once more, and dropped either way. A record from a session that cannot be asked (none,
-   * a Legacy Import session, or the answer itself) is not held.
-   * @private
-   */
-  _holdForChain(session, g) {
-    const missing = g.grantedBy;
-    if (!session || session.legacy || !session.confirmed || session.closed || typeof session.send !== 'function') return;
-    if (malformedGrant(g)) return;
-    // Held as its signed fields only (bounded: canonical nodeIds of at most 128 characters, a role
-    // name, a key and a signature of fixed length), and the bytes held per session are bounded too.
-    g = canonicalGrant(g, g.sig);
-    const h = session._chainHold || (session._chainHold = { grants: new Map(), fetches: new Map(), bytes: 0 });
-    // Keyed by every field the signature covers and the signature: a forged copy sent ahead of the
-    // genuine record is a different entry, so it cannot keep the genuine one out.
-    const holdKey = `${g.type}|${g.grantee}|${g.role || ''}|${g.grantedBy}|${g.grantedAt}|${g.granteeKey || ''}|${g.cutoff ?? ''}|${(g.ratify || []).join(',')}|${g.sig}`;
-    if (h.grants.has(holdKey)) return;
-    const bytes = holdKey.length * 2;
-    if (h.grants.size >= CHAIN_HOLD_MAX || h.bytes + bytes > CHAIN_HOLD_BYTES) {
-      this._noteDrop('role-chain-hold-full', session.nodeId, { frame: g.type, author: g.grantedBy });
-      return;
-    }
-    let reqId = null;
-    for (const [id, f] of h.fetches) if (f.grantee === missing) { reqId = id; break; }
-    if (!reqId) {
-      reqId = `rc-${crypto.randomBytes(8).toString('hex')}`;
-      const timer = setTimeout(() => this._chainFetchDone(session, reqId, false), this._chainFetchTimeoutMs);
-      if (timer.unref) timer.unref();
-      h.fetches.set(reqId, { grantee: missing, timer });
-      this._chainStats.fetched++;
-      session.send({ type: 'role-chain-fetch', reqId, grantees: [missing] });
-    }
-    h.grants.set(holdKey, { grant: g, reqId, bytes });
-    h.bytes += bytes;
-  }
-
-  /** @private A chain fetch ended (answered, timed out, or its session closed): let its held records go. */
-  _chainFetchDone(session, reqId, answered) {
-    const h = session && session._chainHold;
-    const f = h && h.fetches.get(reqId);
-    if (!f) return;
-    clearTimeout(f.timer);
-    h.fetches.delete(reqId);
-    const mine = [];
-    for (const [k, e] of [...h.grants]) {
-      if (e.reqId !== reqId) continue;
-      h.grants.delete(k);
-      h.bytes -= e.bytes || 0;
-      mine.push(e.grant);
-    }
-    // Offered again, not held again: in passes until one stores nothing, since held records can root
-    // one another (a revoke held for the grant it clears, both held for their grantor's chain).
-    // Whatever one still lacks then, it goes.
-    let left = answered ? mine : [];
-    let progress = true;
-    while (progress && left.length && !session.closed) {
-      progress = false;
-      const next = [];
-      for (const g of left) {
-        const r = this._ingestRoleGrant(g, session.nodeId, session, { hold: false });
-        if (r.ok) { this._chainStats.resolved++; progress = true; }
-        else if (r.reason === 'unknown-grantor-key') next.push(g);
-      }
-      left = next;
-    }
-    if (!answered) this._chainStats.timedOut++;
-  }
-
-  /**
-   * The answer to this node's role-chain-fetch on `session`: `{ reqId, grants }`. Only an answer to a
-   * fetch in flight on this session is read. Its grants are offered to the store top-down (until a
-   * pass stores nothing, so their order does not matter), each through the ordinary ingest — the
-   * gossip budget, the vouched-key verification, relay-once — and none of them is held for a further
-   * fetch.
-   * @private
-   */
-  _onRoleChain(session, msg) {
-    const h = session && session._chainHold;
-    const reqId = msg && typeof msg.reqId === 'string' ? msg.reqId : null;
-    if (!h || !reqId || !h.fetches.has(reqId)) return;
-    let left = Array.isArray(msg.grants) ? msg.grants.slice(0, CHAIN_ANSWER_MAX).filter((g) => g && typeof g === 'object') : [];
-    let progress = true;
-    while (progress && left.length) {
-      progress = false;
-      const next = [];
-      for (const g of left) {
-        const r = this._ingestRoleGrant(g, session.nodeId, session, { hold: false });
-        if (session.closed) return; // a forged grant in the answer ended the session
-        if (r.ok) progress = true;
-        else if (r.reason === 'unknown-grantor-key') next.push(g);
-      }
-      left = next;
-    }
-    const f = h.fetches.get(reqId);
-    const sync = f && f.sync;
-    this._chainFetchDone(session, reqId, true);
-    // A page of a whole-store sync (anti-entropy, security review D): ask for the next one, if the
-    // answer says there is one, within this session's page bound.
-    if (sync && typeof msg.next === 'number' && Number.isSafeInteger(msg.next) && msg.next > 0 && !session.closed) {
-      this._requestChainSync(session, msg.next, sync.pages + 1);
-    }
-  }
-
-  /**
-   * Anti-entropy for grants and revokes (security review D). Gossip is relay-once, so a record
-   * dropped on its way (a budget, a full hold, a session that ended) was never sent again, and a
-   * revoke lost that way left a revoked node's authority standing. Now every admitted session is sent
-   * this node's grant-store digest (`role-digest`: count and sha256 over the signatures held); a
-   * receiver whose digest differs asks for the sender's whole store, in pages of CHAIN_ANSWER_MAX
-   * records ordered so each record's chain comes before it (`role-chain-fetch` with `sync: true`),
-   * each page through the ordinary ingest, and new records relayed once as usual.
-   * @private
-   */
-  _onRoleDigest(session, msg) {
-    if (!session || session.legacy || !session.confirmed || session.closed) return;
-    if (!msg || !Number.isSafeInteger(msg.count) || msg.count <= 0 || typeof msg.digest !== 'string' || !/^[0-9a-f]{64}$/.test(msg.digest)) return;
-    if (msg.digest === this._roleGrants.digest().digest) return;
-    const h = session._chainHold;
-    if (h) for (const f of h.fetches.values()) if (f.sync) return; // one sync in flight per session
-    this._requestChainSync(session, 0, 1);
-  }
-
-  /** @private Ask `session` for one page of its whole grant store, from `after`. */
-  _requestChainSync(session, after, pages) {
-    if (pages > CHAIN_SYNC_MAX_PAGES) { this._noteDrop('role-sync-too-long', session.nodeId, { frame: 'role-chain-fetch' }); return; }
-    const h = session._chainHold || (session._chainHold = { grants: new Map(), fetches: new Map(), bytes: 0 });
-    const reqId = `rs-${crypto.randomBytes(8).toString('hex')}`;
-    const timer = setTimeout(() => this._chainFetchDone(session, reqId, false), this._chainFetchTimeoutMs);
-    if (timer.unref) timer.unref();
-    h.fetches.set(reqId, { grantee: null, sync: { pages }, timer });
-    this._chainStats.synced = (this._chainStats.synced || 0) + 1;
-    session.send({ type: 'role-chain-fetch', reqId, sync: true, after });
-  }
-
-  /**
-   * Answer a peer's role-chain-fetch: for each grantee named (at most CHAIN_FETCH_MAX_GRANTEES), the
-   * grants and revokes this node holds for it, each preceded by the chain that roots its grantor, up
-   * to the anchor (depth at most 8, at most CHAIN_ANSWER_MAX records): `{ type: 'role-chain', reqId,
-   * grants }`, sealed on the session like every control frame. Paced per session (a token bucket of
-   * CHAIN_SERVE_PER_SECOND), since an answer costs more than the request.
-   * @private
-   */
-  _serveRoleChain(session, msg) {
-    if (!session || typeof session.send !== 'function' || !msg) return;
-    const reqId = typeof msg.reqId === 'string' && msg.reqId && msg.reqId.length <= 128 ? msg.reqId : null;
-    if (!reqId || (!Array.isArray(msg.grantees) && msg.sync !== true)) return;
-    const now = Date.now();
-    const b = session._chainServe || (session._chainServe = { tokens: CHAIN_SERVE_BURST, at: now });
-    b.tokens = Math.min(CHAIN_SERVE_BURST, b.tokens + ((now - b.at) * CHAIN_SERVE_PER_SECOND) / 1000);
-    b.at = now;
-    if (b.tokens < 1) { this._noteDrop('role-chain-over-rate', session.nodeId, { frame: 'role-chain-fetch' }); return; }
-    b.tokens -= 1;
-    if (msg.sync === true) {
-      // A page of the whole store (anti-entropy): records in sync order from `after`, and where the
-      // next page starts when there is one.
-      const all = this._roleGrants.syncOrder();
-      const after = Number.isSafeInteger(msg.after) && msg.after > 0 ? msg.after : 0;
-      const page = all.slice(after, after + CHAIN_ANSWER_MAX);
-      const next = after + page.length < all.length ? after + page.length : null;
-      this._chainStats.served++;
-      session.send({ type: 'role-chain', reqId, grants: page, ...(next !== null ? { next } : {}) });
-      return;
-    }
-    const anchorId = this._anchor && this._anchor.nodeId;
-    const out = [];
-    const seen = new Set();
-    const visit = (nodeId, depth) => {
-      if (depth > 8 || out.length >= CHAIN_ANSWER_MAX) return;
-      for (const g of this._roleGrants.grantsFor(nodeId)) {
-        if (out.length >= CHAIN_ANSWER_MAX) return;
-        if (seen.has(g.sig)) continue;
-        seen.add(g.sig);
-        if (g.grantedBy !== anchorId) visit(g.grantedBy, depth + 1); // the grantor's own chain first: top-down
-        if (out.length < CHAIN_ANSWER_MAX) out.push(g);
-      }
-    };
-    for (const id of (msg.grantees || []).slice(0, CHAIN_FETCH_MAX_GRANTEES)) if (typeof id === 'string' && id && id.length <= 256) visit(id, 0);
-    this._chainStats.served++;
-    session.send({ type: 'role-chain', reqId, grants: out });
+    const e = this._store.get(key);
+    return this._store.canonizeCMB(key, { lifecycle: this._authority.anchored ? this.lifecycleAuthority(this.nodeId, this._identity.publicKey, e && e.cmb) : lifecycleOfRole(this._lifecycleRole) });
   }
 
   /**
@@ -1475,8 +1099,8 @@ class SymNode extends EventEmitter {
    * layer). Binds the gated CMB (`of`), this node's identity (`by`), the roster,
    * the overall + per-category verdict, this node's CLAIMED lifecycle role, and the
    * per-attester hash-chain position (`seq`/`prev`), all under an Ed25519 signature
-   * (same key as CMB signing). `role` is claimed — consumers verify it against the
-   * rooted role-grant chain (sym-core `verifyAttestationRole`), never the stamp.
+   * (same key as CMB signing). `role` is claimed — consumers verify it against their
+   * own in-force authority set (MMP §6.6.10, sym-core `verifyAttestationRole`), never the stamp.
    * Returns the signed attestation, or null if signing fails.
    * @param {string} of - the gated (incoming) CMB key
    * @param {string} verdict - overall decision (aligned|guarded|redundant|rejected)
@@ -1536,33 +1160,6 @@ class SymNode extends EventEmitter {
     return this._attestations.byCmb(cmbKey);
   }
 
-  /**
-   * The role an attestation's signer counts with (docs/WIRE-0.14.0.md §6.3): its role at the
-   * attestation's signed time `at`, if it still holds that role now or an effective revoke of it
-   * ratifies the attestation; otherwise its role now. A revoke takes effect from its cutoff, so an
-   * attestation dated at or after it counts as a participant's; one a revoked key signs later, dated
-   * before it, gains nothing unless ratified. An attestation dated before the record it attests (when
-   * this node holds the record) counts as a participant's. When this node received it plays no part.
-   * @private
-   */
-  _attesterRole(att) {
-    const at = Number.isFinite(att && att.at) ? att.at : 0;
-    if (this._datedBeforeRecord(att)) return 'participant';
-    const then = this.resolveRole(att.by, at);
-    const now = this.resolveRole(att.by, Date.now());
-    if (roleRank(now) >= roleRank(then)) return then;
-    return this._roleGrants.ratifies(att.by, at, att.sig, roleRank(then)) ? then : now;
-  }
-
-  /** @private Whether an attestation is dated before the signed createdTimestamp of the record it attests. */
-  _datedBeforeRecord(att) {
-    if (!att || typeof att.of !== 'string' || !Number.isFinite(att.at)) return false;
-    let e = null;
-    try { e = this._store.get(att.of); } catch { return false; }
-    const ts = e && e.cmb && e.cmb.metadata && e.cmb.metadata.createdTimestamp;
-    return Number.isSafeInteger(ts) && att.at < ts;
-  }
-
   /**
    * Aggregate every attestation about a CMB into a verdict WEIGHTED BY EARNED AUTHORITY
    * (MMP §6.4/§6.5). The per-attestation `verifyAttestationRole` check answers "is this
@@ -1572,9 +1169,10 @@ class SymNode extends EventEmitter {
    * resolved rank and surfaced as evidence, not silently trusted.
    *
    * Each attestation is (1) signature-verified against the attester's key from the roster
-   * registry — unverifiable ones are EXCLUDED, never weighted — and (2) role-resolved at
-   * its own `at` (role-at-time) from the rooted grant chain. Weight = 2^rank
-   * (participant 1, validator 2, anchor 4): everyone counts, earned rank counts more. The
+   * registry — unverifiable ones are EXCLUDED, never weighted — and (2) role-resolved against
+   * the in-force set NOW (MMP §6.6.10), a scoped role only for a CMB inside its scope; the
+   * attestation's own time plays no part. Weight = 2^rank (participant and issuer 1,
+   * validator 2, admin and anchor 4): everyone counts, earned rank counts more. The
    * overall and per-CAT7-category verdicts are weighted tallies; `confidence` is the dominant
    * verdict's share of total weight.
    * @param {string} cmbKey — the gated CMB key (`of`)
@@ -1585,7 +1183,7 @@ class SymNode extends EventEmitter {
     const atts = this._attestations.byCmb(cmbKey);
     const overall = Object.create(null);   // verdict -> summed weight
     const categories = Object.create(null);    // cat7 category -> { verdict -> weight }
-    const byRole = { participant: 0, validator: 0, anchor: 0 };
+    const byRole = { participant: 0, issuer: 0, validator: 0, admin: 0, anchor: 0 };
     const mismatches = [];
     const excluded = [];
     let total = 0;
@@ -1596,13 +1194,11 @@ class SymNode extends EventEmitter {
       const key = this._identityKey(att.by);
       if (!key) { excluded.push({ by: att.by, reason: 'unknown-key' }); continue; }
       if (!verifyAttestation(att, key).valid) { excluded.push({ by: att.by, reason: 'bad-signature' }); continue; }
-      // An attestation dated before the record it attests attests to what did not yet exist.
-      if (this._datedBeforeRecord(att)) { excluded.push({ by: att.by, reason: 'dated-before-record' }); continue; }
-
-      // (2) resolve the attester's EARNED role at the time it attested (role-at-time).
+      // (2) the attester's role in force NOW over the attested CMB (§6.6.10: a weight is judged against
+      // the in-force set at the moment it is applied; the attestation's own time plays no part).
       const rr = verifyAttestationRole(att, () => this._attesterRole(att));
       if (!rr.matches) mismatches.push({ by: att.by, claimed: rr.claimed, resolved: rr.resolved });
-      const w = 2 ** roleRank(rr.resolved); // participant 1, validator 2, anchor 4
+      const w = 2 ** authorityMixin.lifecycleRank(rr.resolved); // participant and issuer 1, validator 2, admin and anchor 4
 
       total += 1;
       weight += w;
@@ -1748,18 +1344,42 @@ class SymNode extends EventEmitter {
    * blaming it (its binding for that signer may differ), and past RELAY_FAILURES_MAX in a minute its
    * statements for that signer are dropped unverified (`_relayMuted`). The lane refills, so a peer that stops flooding is heard again within
    * burst/rate seconds. A dropped frame changes nothing: it is not marked seen, so another peer's copy
-   * is taken. O(1).
+   * is taken. O(1). `cost` is the checks the statement will cost (an authority statement naming a key
+   * not seen before costs more: see FRESH_KEY_COST in node-authority.js).
    * @returns {boolean} whether the frame may be verified
    * @private
    */
-  _gossipBudget(peerId, type, author) {
+  _gossipBudget(peerId, type, author, cost = 1) {
     const now = this._gossipClock();
     const b = bucketOf(this._gossipBuckets, peerId, this._gossipRate, this._gossipBurst, this._gossipNewLane, now, GOSSIP_MAX_PEERS);
-    if (b.tokens >= 1) { b.tokens -= 1; return true; }
+    if (b.tokens >= cost) { b.tokens -= cost; return true; }
     this._noteDrop('gossip-over-budget', peerId, { frame: type, author });
     return false;
   }
 
+  /**
+   * Charge `cost` checks to `peerId`'s lane for work this node ASKED for (an answer to its own
+   * authority-fetch: the asking paces it, so it is never dropped, MMP §6.6.8). The lane may go into
+   * debt; until it is repaid the peer's unsolicited gossip waits, and the asker waits the returned
+   * milliseconds before asking that peer for more.
+   * @returns {number} ms until the lane is out of debt (0 when it is not in debt)
+   * @private
+   */
+  _gossipCharge(peerId, cost) {
+    const now = this._gossipClock();
+    const b = bucketOf(this._gossipBuckets, peerId, this._gossipRate, this._gossipBurst, this._gossipNewLane, now, GOSSIP_MAX_PEERS);
+    b.tokens = Math.max(-this._gossipBurst, b.tokens - cost);
+    return this._gossipDebtMs(peerId);
+  }
+
+  /** @private ms until `peerId`'s lane is out of debt (0 when it is not). */
+  _gossipDebtMs(peerId) {
+    const b = this._gossipBuckets.get(peerId);
+    if (!b) return 0;
+    refill(b, this._gossipRate, this._gossipBurst, this._gossipClock());
+    return b.tokens >= 0 ? 0 : Math.ceil((-b.tokens * 1000) / this._gossipRate);
+  }
+
   /**
    * The shared ceiling over every peer, spent only AFTER a statement's signature verified (security
    * review D): what it bounds is the work verified statements cause (storing, relaying, witnessing),
@@ -1794,7 +1414,7 @@ class SymNode extends EventEmitter {
    *
    * A Legacy Import session is not attributable this way: its frames are only dropped.
    * @param {object} session
-   * @param {string} kind - what failed: record | attestation | checkpoint | witness | role-grant
+   * @param {string} kind - what failed: record | attestation | checkpoint | witness
    * @param {{ author: string, key?: string|null }} signer - the nodeId the statement names as its
    *   signer, and (when the key tried is not simply this node's binding for it) the key that failed;
    *   null when the session's proven key was not among those tried.
@@ -2100,9 +1720,6 @@ class SymNode extends EventEmitter {
     // checked.
     if (!isCanonicalSig(att.sig)) return this._refuseSpelling(fromPeerId, 'attestation', att.by);
     if (this._attestations.has(att.sig)) return { ok: false, reason: 'duplicate' };
-    // Dated before the signed createdTimestamp of the record it attests (where this node holds it): an
-    // attestation to what did not yet exist (final re-review, ruling B).
-    if (this._datedBeforeRecord(att)) return { ok: false, reason: 'dated-before-record' };
     const attesterKey = this._identityKey(att.by);
     if (!attesterKey) return { ok: false, reason: 'unknown-attester-key' };
     if (this._relayMuted(fromPeerId, att.by)) return { ok: false, reason: 'relayed-signer-muted' };
@@ -2138,7 +1755,7 @@ class SymNode extends EventEmitter {
    * `verified` means the signature checked out against the key this node holds for `by`, and
    * `keySource` says where that key came from (design D3): 'anchor' (configured), 'proven' (a
    * Core Secure session proved it — trust on first PROVEN use when nothing else pinned it), 'pinned'
-   * (an invite or a Legacy Import route) or 'grant' (vouched by an anchor-rooted grant); a
+   * (an invite or a Legacy Import route) or 'grant' (named by an in-force grant, §6.6.9); a
    * 'legacy-claim' never verifies, so it never appears here. `from` is the peer that delivered the
    * frame; `relayed` is true when that peer is not the attester, null when the deliverer is
    * unknown. `receivedAt` is this node's clock, not the attester's `at`.
@@ -3629,7 +3246,7 @@ class SymNode extends EventEmitter {
         keyConflicts: this._roster.conflicts(),
         keyBindings: this._roster.size(),
         keyBindingsExpired: this._roster.expiredCount(),
-        roleChain: { ...this._chainStats },
+        authority: this.authorityStatus(),
       },
       legacyImport: this._legacy ? this._legacy.status() : { routes: 0, sessions: [] },
     };
@@ -3993,7 +3610,7 @@ class SymNode extends EventEmitter {
       // A relay client confirms when it sends client-finish, and cannot know the server took it: a
       // re-handshake whose finish was lost must leave the confirmed session exactly as it was (draft
       // spec PR #23). So the new session supersedes the old only once it carries an authenticated
-      // frame from the server (every admitted session is sent at least a sealed role-digest); until
+      // frame from the server (every admitted session is sent at least a sealed cmb-anchors); until
       // then the old one stays the peer's, and a new one that hears nothing ends.
       session._supersedes = prev;
       session._supersedeTimer = setTimeout(() => {
@@ -4050,6 +3667,7 @@ class SymNode extends EventEmitter {
     if (!this._lastAnchorSent) this._lastAnchorSent = new Map();
     const lastSent = this._lastAnchorSent.get(peer.peerId) || 0;
     const now = Date.now();
+    let announced = false;
     if (now - lastSent >= 60000) {
       keepPeerState(this._lastAnchorSent, peer.peerId, now, this._peers);
       // Own emissions only (anti-echo, §15.7), and only records that can travel in Core Secure.
@@ -4060,6 +3678,7 @@ class SymNode extends EventEmitter {
           && (a.cmb.metadata.to === null || a.cmb.metadata.to === undefined))
         .slice(0, 5);
       if (anchors.length > 0) {
+        announced = true;
         session.send({ type: 'cmb-anchors', keys: anchors.map((a) => a.cmb.metadata.key) });
         let sent = 0;
         for (const a of anchors) if (session.send({ type: 'cmb', cmb: a.cmb })) sent++;
@@ -4068,10 +3687,13 @@ class SymNode extends EventEmitter {
     } else if (isNew) {
       this._log(`Skipping anchor CMBs for ${peer.name} (reconnected within 60s)`);
     }
-    // Anti-entropy for grants and revokes (security review D): this node's grant-store digest. Sent to
-    // every admitted session, an empty store's too: it is also the first authenticated frame a relay
-    // client waits for before its new session supersedes the old (see _admitSession).
-    session.send({ type: 'role-digest', ...this._roleGrants.digest() });
+    // Every admitted session hears at least one sealed frame from this node first: a relay client
+    // waits for one before its new session supersedes the old (see _admitSession). `cmb-anchors` with
+    // no keys says "no replayed context follows" (docs/WIRE-0.14.0.md §1).
+    if (!announced) session.send({ type: 'cmb-anchors', keys: [] });
+    // MMP §6.6.8: this node's authority root and in-force count, when a session is confirmed (only
+    // with an anchor pinned: without one there is no root).
+    this._sendAuthorityDigest(session, { now: true });
     // This node's own wake channel. (peer-info about OTHER nodes is not sent: a receiver learns a
     // wake channel only from its node's own session, so gossip about others would be dropped.)
     if (this._wakeChannel) session.send({ type: 'wake-channel', ...this._wakeChannel });
@@ -4113,10 +3735,7 @@ class SymNode extends EventEmitter {
     this._sessions.delete(session);
     const held = session.nodeId && this._sessionKeys.get(session.nodeId);
     if (held && held.sessions.delete(session) && held.sessions.size === 0) this._sessionKeys.delete(session.nodeId);
-    if (session._chainHold) {
-      for (const reqId of [...session._chainHold.fetches.keys()]) this._chainFetchDone(session, reqId, false);
-      session._chainHold = null;
-    }
+    this._authorityReleaseSession(session);
     if (session._admissionTimer) { clearTimeout(session._admissionTimer); session._admissionTimer = null; }
     if (session._grantTimer) { clearTimeout(session._grantTimer); session._grantTimer = null; }
     if (session._supersedeTimer) { clearTimeout(session._supersedeTimer); session._supersedeTimer = null; }
@@ -4833,6 +4452,14 @@ function migrateStores(nodesRoot = path.join(require('./core/state-root').SYM_ST
   return migrated;
 }
 
+// MMP §6.6 authority: pin, statements, frames and roles (lib/node-authority.js).
+Object.assign(SymNode.prototype, authorityMixin.methods);
+
+/** The lifecycle authority a static role gives where no anchor is pinned (a closed development mode, §6.5). */
+function lifecycleOfRole(role) {
+  return role === 'anchor' || role === 'admin' ? 'canonical' : role === 'validator' ? 'validated' : 'none';
+}
+
 module.exports = { SymNode, migrateStores, version: ENGINE_VERSION };
 
 // The room grammar is a CROSS-IMPLEMENTATION CONTRACT, not an internal detail: a room name
diff --git a/lib/relocation.js b/lib/relocation.js
index 7c53126d..12bda04a 100644
--- a/lib/relocation.js
+++ b/lib/relocation.js
@@ -44,6 +44,7 @@
 const fs = require('fs');
 const path = require('path');
 const crypto = require('crypto');
+const { verifyStrict } = require('./core/ed25519');
 const config = require('./config');
 const { keyFingerprint, isIdentityKey } = require('./roster-keys');
 
@@ -284,8 +285,7 @@ function signHeader(header, privateKeyB64url) {
 function verifyHeader(header, signature, publicKeyB64url) {
   if (typeof signature !== 'string' || !isIdentityKey(publicKeyB64url)) return false;
   try {
-    const pub = crypto.createPublicKey({ key: Buffer.concat([Buffer.from('302a300506032b6570032100', 'hex'), Buffer.from(publicKeyB64url, 'base64url')]), format: 'der', type: 'spki' });
-    return crypto.verify(null, headerSigned(header), pub, Buffer.from(signature, 'base64url'));
+    return verifyStrict(headerSigned(header), publicKeyB64url, signature); // MMP §18.3.2
   } catch { return false; }
 }
 
@@ -308,8 +308,7 @@ function signBundle(header, contents, privateKeyB64url) {
 function verifyBundle(header, contents, signature, publicKeyB64url) {
   if (typeof signature !== 'string') return false;
   try {
-    const pub = crypto.createPublicKey({ key: Buffer.concat([Buffer.from('302a300506032b6570032100', 'hex'), Buffer.from(publicKeyB64url, 'base64url')]), format: 'der', type: 'spki' });
-    return crypto.verify(null, bundleSigned(header, contents), pub, Buffer.from(signature, 'base64url'));
+    return verifyStrict(bundleSigned(header, contents), publicKeyB64url, signature); // MMP §18.3.2
   } catch { return false; }
 }
 
diff --git a/lib/role-grant-store.js b/lib/role-grant-store.js
deleted file mode 100644
index f8e5de99..00000000
--- a/lib/role-grant-store.js
+++ /dev/null
@@ -1,763 +0,0 @@
-'use strict';
-
-/**
- * @module @sym-bot/sym/role-grant-store
- * @description Earned-authority role-grant chain (MMP §6.5, §6.6).
- *
- * A node's lifecycle authority (participant → validator → anchor) is EARNED via signed grants,
- * never self-asserted. Authority flows only along chains that terminate at the non-earnable anchor
- * (typically the founder): a grant whose chain does not root there confers NOTHING (Douceur: there
- * is no unconditional decentralized Sybil-resistance — authority must bottom out at a pinned root).
- *
- * AUTHORITY FOLLOWS THE KEY (sym 0.14, design D3):
- *
- *   - Every role-grant carries `granteeKey`, inside the signed payload. A grant without one is
- *     malformed: a grant to a bare nodeId would confer authority on whoever later holds that id.
- *   - `resolveRole(nodeId, key, at)` confers a grant's role only when its `granteeKey` equals `key`,
- *     the key the subject is bound to (the key its session proved, or its registry binding). A node
- *     whose id is claimed by an impostor's key resolves, for that key, to participant.
- *   - Chains are verified TOP-DOWN with the key each kept grant vouches (§6.6: "using each verified
- *     grant's vouched key to reach the next"), never with whatever key the registry holds.
- *
- * WHAT IS KEPT IS A FUNCTION OF THE RECORDS HELD (final re-review, Findings 1 and 2; the founder's
- * ruling A; docs/WIRE-0.14.0.md §6.2). Nothing about a record's meaning is decided at ingest, so the
- * order records arrive in changes nothing:
- *
- *   - A record is kept when it is VERIFIABLE: its signature verifies under the anchor's configured
- *     key, or under a key a kept role-grant vouches for its grantor. Whether its grantor had
- *     authority is decided at resolution, never here.
- *   - The anchor signs at depth 0; a grant kept at depth d makes its (grantee, granteeKey) a signer
- *     at depth d + 1, in the SUBTREE of the anchor grantee at the top of that chain (the shallowest
- *     chain, then the subtree root with the smallest nodeId).
- *   - The anchor's own records are unbounded. Every other record counts against its signer's
- *     subtree: everything an anchor grantee and its descendants sign shares one budget
- *     (SUBTREE_BUDGET). A subtree, however compromised, fills only its own budget, so a revoke
- *     signed in another subtree is never refused by it.
- *   - Inside a budget the kept records are the first in one total order on signed fields: signer
- *     depth, revokes before grants, a revoke's cutoff or a grant's grantedAt, the signature. A record
- *     that ranks above the last one kept replaces it; one below is refused (`outranked`).
- *
- * WHAT COUNTS IS DECIDED AT RESOLUTION (docs/WIRE-0.14.0.md §6.3; the founder's rulings):
- *
- *   - A revoke carries a CUTOFF (re-review N2): its subject's statements signed at or after it never
- *     count. A revoke without one (0.13) has its own signed time as its cutoff.
- *   - A revoke may RATIFY its subject's earlier statements (ruling B): any statement a signer made
- *     before its cutoff counts only while the signer still holds the rank it needs, or if an
- *     effective revoke of the signer lists it. So a revoked key gains nothing by backdating.
- *   - A revoke counts only when its revoker held the rank at every breakpoint from its cutoff to its
- *     signed time (final re-review, Low 8a).
- *   - Grants keep §6.6's cascade (a grant confers at t only while its grantor holds the rank at t)
- *     unless ratified. Every time is a signed time, or now; no receipt time is kept.
- *
- * The file is append-only and never rewritten (re-review N5): lines are the bare record, as 0.13
- * wrote them, and the store is rebuilt from them at load by the same rule.
- *
- * A KEY VOUCH is a view (security review C): `vouchedKey(nodeId)` is the one key the grants in effect
- * NOW vouch for nodeId, and the key registry reads it on demand instead of storing a `grant` binding,
- * so a vouch ends when its grant stops being in effect. A grant never vouches this node's own nodeId
- * (`opts.selfId`). A grant naming a key the registry binds otherwise is recorded there as a conflict.
- *
- * @copyright 2026 SYM.BOT. Apache 2.0 License.
- */
-
-const fs = require('fs');
-const path = require('path');
-const crypto = require('crypto');
-const { verifyGrant, roleRank } = require('./core');
-const { sigKey } = require('./attestation-store');
-const { isCanonicalNodeId } = require('./core/record-canonical');
-
-const GRANTS_FILE = 'role-grants.jsonl';
-/**
- * The records one delegation subtree may hold: everything an anchor grantee and its descendants sign
- * (final re-review: it replaces the per-grantor, per-pair and store caps, each of which could evict a
- * voucher whose dependents then freed room, which made the kept set depend on arrival order).
- */
-const SUBTREE_BUDGET = 4096;
-/** A record dated further than this into the future (by this node's clock) is refused. */
-const MAX_FUTURE_MS = 10 * 60 * 1000;
-/** Field bounds (security review D): a nodeId, a role name. A key and a signature have fixed lengths. */
-const MAX_ID = 128;
-const MAX_ROLE = 32;
-/** A revoke ratifies at most this many statements (a revoker that must ratify more signs several). */
-const MAX_RATIFY = 64;
-/** resolveRole's memo is cleared when it holds this many answers (and whenever a record is kept). */
-const MEMO_MAX = 65536;
-/**
- * Delegation depth (security review D, role-linear): a role reaches at most this many grants from the
- * anchor (the anchor's own grantee is at depth 1). MMP §6.6 sets no depth; 8 is sym's, proposed for
- * the spec, and the role-chain answer already stops there.
- */
-const MAX_DELEGATION_DEPTH = 8;
-const CANONICAL_SIG = /^[A-Za-z0-9_-]{85}[AQgw]$/;
-
-/** A revoke's cutoff: the signed `cutoff`, or its signed time when it carries none (re-review N2). */
-function cutoffOf(g) {
-  return g.type === 'role-revoke' && Number.isSafeInteger(g.cutoff) ? g.cutoff : (g.grantedAt ?? 0);
-}
-
-/** Whether signer info `a` is better (shallower, then the smaller subtree root) than `b`. */
-const better = (a, b) => a.depth < b.depth || (a.depth === b.depth && String(a.root) < String(b.root));
-
-class RoleGrantStore {
-  /**
-   * @param {object} [opts]
-   * @param {{nodeId: string, publicKey: string}} [opts.anchor] the non-earnable root of trust.
-   * @param {{get: function(string): (string|undefined), bind?: function, pin?: function}} [opts.keys]
-   *   the node's key registry. Read only to resolve a subject's bound key for `resolver()` and the
-   *   two-argument `resolveRole`; NEVER to verify a grant.
-   * @param {string} [opts.dir] when set, grants persist append-only and reload here.
-   * @param {number} [opts.subtreeBudget] records one delegation subtree may hold (SUBTREE_BUDGET).
-   */
-  constructor(opts = {}) {
-    this._anchor = opts.anchor || null;
-    this._selfId = typeof opts.selfId === 'string' && opts.selfId ? opts.selfId : null;
-    this._selfKey = typeof opts.selfKey === 'string' && opts.selfKey ? opts.selfKey : null;
-    // Told of a kept grant in effect that names this node with a key that is not its own (inert, and
-    // reported, since someone vouched a foreign key for this node's identity).
-    this._onForeignSelfGrant = typeof opts.onForeignSelfGrant === 'function' ? opts.onForeignSelfGrant : null;
-    this._now = typeof opts.now === 'function' ? opts.now : Date.now;
-    this._keys = opts.keys || new Map();
-    this._budget = Number.isSafeInteger(opts.subtreeBudget) && opts.subtreeBudget > 0 ? opts.subtreeBudget : SUBTREE_BUDGET;
-    this._pool = new Map();      // sigKey -> { g, signer, sk } : the records kept
-    this._reset();
-    this._dir = opts.dir || null;
-    this._loading = false;
-    this._loadReport = { loaded: 0, skipped: {}, unreadable: null };
-    if (this._dir) {
-      try { fs.mkdirSync(this._dir, { recursive: true }); } catch { /* best effort */ }
-      this._load();
-    }
-  }
-
-  /** @private Clear every structure derived from the pool. */
-  _reset() {
-    this._byGrantee = new Map();   // grantee nodeId -> [entries]
-    this._info = new Map();        // `${nodeId}\0${key}` -> { depth, root } : a signer
-    this._signerKeys = new Map();  // nodeId -> Set(keys it signs under)
-    this._byRoot = new Map();      // subtree root -> Set(entries)
-    this._ratifiers = new Map();   // statement sigKey -> [revoke entries listing it]
-    this._times = [];              // record times and cutoffs, sorted, distinct: resolution's breakpoints
-    this._worst = new Map();       // subtree root -> its last-ranked entry (a cache)
-    this._memo = new Map();
-    this._memoNow = undefined;
-    this._syncOrder = null;
-    this._digest = null;
-  }
-
-  /**
-   * What the last reload found: records `loaded`, records `skipped` by reason (each stays in the file
-   * for the next load), and `unreadable` (why the file could not be read; null when it could).
-   * @returns {{ loaded: number, skipped: Object<string, number>, unreadable: string|null }}
-   */
-  loadReport() {
-    return { loaded: this._loadReport.loaded, skipped: { ...this._loadReport.skipped }, unreadable: this._loadReport.unreadable };
-  }
-
-  /**
-   * The keys a record from `grantedBy` may be verified against: the anchor's configured key, or the
-   * keys kept grants vouch for `grantedBy`. Empty when no kept grant reaches it.
-   * @returns {string[]}
-   */
-  grantorKeys(grantedBy) {
-    if (this._anchor && grantedBy === this._anchor.nodeId) return [this._anchor.publicKey];
-    return [...(this._signerKeys.get(grantedBy) || [])];
-  }
-
-  /** Whether any kept grant reaches `grantedBy` (a record from it could verify). */
-  grantorKey(grantedBy) { return this.grantorKeys(grantedBy)[0]; }
-
-  /** @private The signer info of (nodeId, key), the anchor's included. */
-  _signerInfo(nodeId, key) {
-    if (this._anchor && nodeId === this._anchor.nodeId && key === this._anchor.publicKey) return { depth: 0, root: null };
-    return this._info.get(`${nodeId}\u0000${key}`);
-  }
-
-  /** @private The info a kept grant gives its grantee, or null when it gives none. */
-  _grantInfo(e, info) {
-    const g = e.g;
-    if (g.type !== 'role-grant') return null;
-    // No grant makes the anchor, or this node under a key not its own, a signer.
-    if (this._anchor && g.grantee === this._anchor.nodeId) return null;
-    if (this._selfId && g.grantee === this._selfId && g.granteeKey !== this._selfKey) return null;
-    return { depth: info.depth + 1, root: info.root === null ? g.grantee : info.root };
-  }
-
-  /**
-   * The total order a budget keeps by (final re-review ruling A): signer depth, revokes before grants,
-   * a revoke's cutoff or a grant's signed time, then the signature. Negative when `a` ranks first.
-   * @private
-   */
-  _cmp(a, ai, b, bi) {
-    if (ai.depth !== bi.depth) return ai.depth - bi.depth;
-    const ta = a.g.type === 'role-revoke' ? 0 : 1;
-    const tb = b.g.type === 'role-revoke' ? 0 : 1;
-    if (ta !== tb) return ta - tb;
-    const xa = ta === 0 ? cutoffOf(a.g) : a.g.grantedAt;
-    const xb = tb === 0 ? cutoffOf(b.g) : b.g.grantedAt;
-    if (xa !== xb) return xa - xb;
-    return a.sk < b.sk ? -1 : a.sk > b.sk ? 1 : 0;
-  }
-
-  /** @private The last-ranked entry of a subtree (cached). */
-  _worstIn(root) {
-    const hit = this._worst.get(root);
-    if (hit) return hit;
-    let w = null;
-    for (const e of this._byRoot.get(root) || []) {
-      const ei = this._signerInfo(e.g.grantedBy, e.signer);
-      if (!w || this._cmp(e, ei, w.e, w.info) > 0) w = { e, info: ei };
-    }
-    if (w) this._worst.set(root, w);
-    return w;
-  }
-
-  /**
-   * Record a signed role-grant / role-revoke. In order: well-formed (a role-grant carries
-   * granteeKey), new (dedup by the signature's bytes), not dated in the future, verifiable (its
-   * signature verifies under the anchor's key or a key a kept grant vouches for its grantor), and
-   * selected within its subtree's budget. A record that fails any of these is refused with the reason
-   * and leaves no trace: not held, not written, not relayed.
-   *
-   * What is stored, persisted and returned (`grant`, for the caller to relay) is ONE canonical object
-   * holding only the fields the signature covers, the signature in its signer's spelling and `sigAlg`
-   * (0.13.17 re-review A5). Never throws: a record whose checks fail in a way no reason names is
-   * 'unverifiable'.
-   * @returns {{ stored: boolean, reason?: string, grant?: object }}
-   */
-  record(grant) {
-    try {
-      return this._record(grant);
-    } catch {
-      return { stored: false, reason: 'unverifiable' };
-    }
-  }
-
-  /** @private */
-  _record(grant) {
-    if (malformed(grant)) return { stored: false, reason: 'malformed' };
-    const sk = sigKey(grant.sig);
-    if (this._pool.has(sk)) return { stored: false, reason: 'duplicate' };
-    if (grant.grantedAt > this._now() + MAX_FUTURE_MS) return { stored: false, reason: 'future-dated' };
-    const candidates = this.grantorKeys(grant.grantedBy);
-    if (candidates.length === 0) return { stored: false, reason: 'unknown-grantor-key' };
-    const signer = candidates.find((k) => verifyGrant(grant, k).valid);
-    if (!signer) return { stored: false, reason: 'bad-signature' };
-    const e = { g: canonicalGrant(grant, sk), signer, sk };
-    const info = this._signerInfo(e.g.grantedBy, signer);
-    let rebuild = false;
-    if (info.root !== null && (this._byRoot.get(info.root)?.size || 0) >= this._budget) {
-      const w = this._worstIn(info.root);
-      if (w && this._cmp(e, info, w.e, w.info) > 0) return { stored: false, reason: 'outranked' };
-      rebuild = true;
-    }
-    const gi = this._grantInfo(e, info);
-    if (gi) {
-      const cur = this._info.get(`${e.g.grantee}\u0000${e.g.granteeKey}`);
-      if (cur && better(gi, cur)) rebuild = true;
-    }
-    if (rebuild) {
-      this._rebuild([...this._pool.values(), e]);
-      if (!this._pool.has(sk)) return { stored: false, reason: 'outranked' };
-    } else {
-      this._add(e, info);
-    }
-    this._append(e.g);
-    this._noteVouch(e.g);
-    const g = e.g;
-    if (g.type === 'role-grant' && this._selfId && g.grantee === this._selfId && this._selfKey && g.granteeKey !== this._selfKey) {
-      // Kept (it is a verifiable statement, and relayed like one) but inert: this node resolves its own
-      // role under its own key, and no grant binds its own nodeId or makes it a signer.
-      if (this._onForeignSelfGrant && !this._loading && roleRank(this.resolveRole(g.grantee, g.granteeKey, this._now())) >= 1) {
-        try { this._onForeignSelfGrant(g); } catch { /* a report must not fail the store */ }
-      }
-      return { stored: true, grant: g, inert: 'foreign-key-for-self' };
-    }
-    return { stored: true, grant: g };
-  }
-
-  /** @private Add one entry to the pool and to every derived structure. */
-  _add(e, info) {
-    this._pool.set(e.sk, e);
-    const g = e.g;
-    let arr = this._byGrantee.get(g.grantee);
-    if (!arr) { arr = []; this._byGrantee.set(g.grantee, arr); }
-    arr.push(e);
-    if (info.root !== null) {
-      let set = this._byRoot.get(info.root);
-      if (!set) { set = new Set(); this._byRoot.set(info.root, set); }
-      set.add(e);
-      const w = this._worst.get(info.root);
-      if (w && this._cmp(e, info, w.e, w.info) > 0) this._worst.set(info.root, { e, info });
-    }
-    const gi = this._grantInfo(e, info);
-    if (gi) {
-      const k = `${g.grantee}\u0000${g.granteeKey}`;
-      const cur = this._info.get(k);
-      if (!cur || better(gi, cur)) this._info.set(k, gi);
-      let ks = this._signerKeys.get(g.grantee);
-      if (!ks) { ks = new Set(); this._signerKeys.set(g.grantee, ks); }
-      ks.add(g.granteeKey);
-    }
-    if (g.type === 'role-revoke' && Array.isArray(g.ratify)) {
-      for (const s of g.ratify) {
-        let l = this._ratifiers.get(s);
-        if (!l) { l = []; this._ratifiers.set(s, l); }
-        l.push(e);
-      }
-    }
-    this._addTime(g.grantedAt);
-    if (g.type === 'role-revoke') this._addTime(cutoffOf(g));
-    this._memo.clear();
-    this._syncOrder = null;
-    this._digest = null;
-  }
-
-  /**
-   * @private Recompute the kept set from `entries` by the rule alone (docs/WIRE-0.14.0.md §6.2):
-   * the anchor's records, then depth by depth, each depth's records in the budget's total order,
-   * each kept while its subtree has room; a record whose signer no kept grant reaches is dropped.
-   */
-  _rebuild(entries) {
-    this._pool = new Map();
-    this._reset();
-    const anchor = this._anchor;
-    const rest = [];
-    const level0 = [];
-    for (const e of entries) {
-      if (anchor && e.g.grantedBy === anchor.nodeId && e.signer === anchor.publicKey) level0.push(e);
-      else rest.push(e);
-    }
-    for (const e of level0) this._add(e, { depth: 0, root: null });
-    let left = rest;
-    for (let depth = 1; left.length; depth++) {
-      const now = [];
-      const later = [];
-      for (const e of left) {
-        const info = this._info.get(`${e.g.grantedBy}\u0000${e.signer}`);
-        if (!info) later.push(e); // perhaps reached by a deeper grant
-        else if (info.depth === depth) now.push({ e, info });
-        else later.push(e);
-      }
-      if (now.length === 0 && ![...this._info.values()].some((i) => i.depth > depth)) break;
-      now.sort((a, b) => this._cmp(a.e, a.info, b.e, b.info));
-      for (const { e, info } of now) {
-        if ((this._byRoot.get(info.root)?.size || 0) >= this._budget) continue;
-        this._add(e, info);
-      }
-      left = later;
-    }
-  }
-
-  /** @private Keep `t` in the sorted list of breakpoints. */
-  _addTime(t) {
-    const a = this._times;
-    let lo = 0, hi = a.length;
-    while (lo < hi) { const mid = (lo + hi) >> 1; if (a[mid] < t) lo = mid + 1; else hi = mid; }
-    if (a[lo] !== t) a.splice(lo, 0, t);
-  }
-
-  /**
-   * @private The breakpoint a time resolves as: the latest record time at or before it (-Infinity
-   * when none). A role changes only where some record's time or cutoff is crossed, so every time
-   * between two breakpoints resolves alike, and the memo holds at most one answer per (node, key,
-   * breakpoint).
-   */
-  _canonicalTime(t) {
-    const a = this._times;
-    let lo = 0, hi = a.length;
-    while (lo < hi) { const mid = (lo + hi) >> 1; if (a[mid] <= t) lo = mid + 1; else hi = mid; }
-    return lo === 0 ? -Infinity : a[lo - 1];
-  }
-
-  /**
-   * A grant names the grantee's key. The registry reads key vouches as a view (`vouchedKey`), so
-   * nothing is pinned; the registry is told of a grant in effect now, so that a different key it
-   * already binds is recorded as a conflict and the same key is marked vouched. Never for this node's
-   * own id. A plain Map (tests, older hosts) is only filled where it holds nothing.
-   * @private
-   */
-  _noteVouch(grant) {
-    if (grant.type !== 'role-grant' || (this._selfId && grant.grantee === this._selfId)) return;
-    if (roleRank(this.resolveRole(grant.grantee, grant.granteeKey, this._now())) < 1) return;
-    if (typeof this._keys.bind === 'function') this._keys.bind(grant.grantee, grant.granteeKey, 'grant');
-    else if (typeof this._keys.set === 'function' && typeof this._keys.setGrantView !== 'function' && !this._keys.get(grant.grantee)) this._keys.set(grant.grantee, grant.granteeKey);
-  }
-
-  /**
-   * The key the grants in effect NOW vouch for `nodeId`: the granteeKey of a grant under which
-   * `nodeId` resolves now to a rank above participant. Undefined when none does, when two keys do
-   * (ambiguous: neither verifies), or for this node's own id. The key registry's `grant` view.
-   * @returns {string|undefined}
-   */
-  vouchedKey(nodeId, at = this._now()) {
-    if (this._selfId && nodeId === this._selfId) return undefined;
-    if (this._anchor && nodeId === this._anchor.nodeId) return undefined;
-    const keys = this._signerKeys.get(nodeId);
-    if (!keys) return undefined;
-    let found;
-    for (const k of keys) {
-      if (roleRank(this.resolveRole(nodeId, k, at)) < 1) continue;
-      if (found !== undefined && found !== k) return undefined;
-      found = k;
-    }
-    return found;
-  }
-
-  /**
-   * Resolve the role `nodeId`, holding `key`, held at time `at` (ms epoch), by the rule of
-   * docs/WIRE-0.14.0.md §6.3:
-   *   - the anchor itself, holding its configured key, is `anchor`;
-   *   - otherwise replay, in signed-time order, `nodeId`'s grants signed at or before `at` (under
-   *     `key`) and its revokes whose cutoff is at or before `at`;
-   *   - every statement counts only if its signer held the rank it needs when it signed, and either
-   *     still holds it now or an effective revoke of the signer ratifies it;
-   *   - a grant also needs its grantor's rank at `at` (§6.6's cascade), unless ratified;
-   *   - a revoke needs its revoker's rank at every breakpoint from its cutoff to its signed time;
-   *   - cycles and chains that do not reach the anchor resolve to `participant` (rank 0).
-   *
-   * Two-argument form `resolveRole(nodeId, at)`: `key` is the registry's binding for `nodeId`.
-   *
-   * @param {string} nodeId
-   * @param {string|undefined} key
-   * @param {number} at - ms epoch
-   * @returns {'participant'|'validator'|'anchor'}
-   */
-  resolveRole(nodeId, key, at) {
-    if (typeof key === 'number' && at === undefined) { at = key; key = this._boundKey(nodeId); }
-    if (at === undefined) at = this._now();
-    this._freshMemo();
-    return this._resolve(nodeId, key, at, new Set()).role;
-  }
-
-  /**
-   * The role a signer's statement (an attestation) counts with: its role at the statement's signed
-   * time, if it still holds that role now or an effective revoke of it ratifies the statement (by its
-   * signature); otherwise its role now (docs/WIRE-0.14.0.md §6.3, attestations).
-   * @param {string} nodeId
-   * @param {string|undefined} key
-   * @param {number} at - the statement's signed time
-   * @param {string} [sig] - the statement's signature
-   * @returns {'participant'|'validator'|'anchor'}
-   */
-  statementRole(nodeId, key, at, sig) {
-    this._freshMemo();
-    const seen = new Set();
-    const then = this._resolve(nodeId, key, at, seen).role;
-    const now = this._resolve(nodeId, key, this._now(), seen).role;
-    if (roleRank(now) >= roleRank(then)) return then;
-    const rank = (id, k, t) => { const r = this._resolve(id, k, t, seen); return r.depth >= MAX_DELEGATION_DEPTH ? 0 : roleRank(r.role); };
-    if (typeof sig === 'string' && this._ratified(sigKey(sig), nodeId, at, roleRank(then), rank)) return then;
-    return now;
-  }
-
-  /**
-   * Whether an effective revoke of `nodeId` ratifies the statement with signature `sig`, signed at
-   * `at`, needing rank `need` (docs/WIRE-0.14.0.md §6.3).
-   */
-  ratifies(nodeId, at, sig, need = 1) {
-    if (typeof sig !== 'string') return false;
-    this._freshMemo();
-    const seen = new Set();
-    const rank = (id, k, t) => { const r = this._resolve(id, k, t, seen); return r.depth >= MAX_DELEGATION_DEPTH ? 0 : roleRank(r.role); };
-    return this._ratified(sigKey(sig), nodeId, at, need, rank);
-  }
-
-  /** @private Clear the memo when "now" has crossed a breakpoint (standing is judged now). */
-  _freshMemo() {
-    if (this._memo.size >= MEMO_MAX) this._memo.clear();
-    const n = this._canonicalTime(this._now());
-    if (n !== this._memoNow) { this._memo.clear(); this._memoNow = n; }
-  }
-
-  /**
-   * @private The rank `nodeId` holding `key` can confer at `at`: its role's rank, or 0 when its role
-   * already sits at the delegation depth (it can grant nothing further).
-   */
-  _authority(nodeId, key, at) {
-    this._freshMemo();
-    const r = this._resolve(nodeId, key, at, new Set());
-    return r.depth >= MAX_DELEGATION_DEPTH ? 0 : roleRank(r.role);
-  }
-
-  /**
-   * @private The lowest rank `rank(id, key, t)` takes for t from `from` to `to`, checked at `from` and
-   * at every breakpoint after it up to `to` (a rank changes only at a breakpoint).
-   */
-  _minRank(rank, id, key, from, to) {
-    let r = rank(id, key, from);
-    const a = this._times;
-    let lo = 0, hi = a.length;
-    while (lo < hi) { const mid = (lo + hi) >> 1; if (a[mid] <= from) lo = mid + 1; else hi = mid; }
-    for (let i = lo; i < a.length && a[i] <= to && r > 0; i++) r = Math.min(r, rank(id, key, a[i]));
-    return r;
-  }
-
-  /**
-   * @private Whether an effective revoke of `signer` ratifies the statement with sigKey `sk`, signed
-   * at `signedAt` (before that revoke's cutoff), by a revoker holding at least `need` (and validator)
-   * throughout the revoke's span.
-   */
-  _ratified(sk, signer, signedAt, need, rank) {
-    for (const r of this._ratifiers.get(sk) || []) {
-      const g = r.g;
-      if (g.grantee !== signer || !(signedAt < cutoffOf(g))) continue;
-      if (this._revokeAuthority(r, rank) >= Math.max(1, need)) return true;
-    }
-    return false;
-  }
-
-  /**
-   * @private A revoke's authority: its revoker's lowest rank from its cutoff to its signed time, or 0
-   * when the revoker no longer holds rank now and no effective revoke of it ratifies this revoke.
-   */
-  _revokeAuthority(r, rank) {
-    const g = r.g;
-    const a = this._minRank(rank, g.grantedBy, r.signer, cutoffOf(g), g.grantedAt);
-    if (a < 1) return 0;
-    if (rank(g.grantedBy, r.signer, this._now()) >= 1) return a;
-    return this._ratified(r.sk, g.grantedBy, g.grantedAt, 1, rank) ? a : 0;
-  }
-
-  /**
-   * The resolution, memoised (security review D, role-resolve-cost). An answer is kept only when no
-   * cycle was cut while computing it (a cut answer depends on the path), and the memo is cleared
-   * whenever a record is kept or "now" crosses a breakpoint. @returns {{ role, depth, pure }}
-   * @private
-   */
-  _resolve(nodeId, key, at, seen) {
-    if (this._anchor && nodeId === this._anchor.nodeId) return { role: key === this._anchor.publicKey ? 'anchor' : 'participant', depth: 0, pure: true };
-    if (typeof key !== 'string' || !key) return { role: 'participant', depth: 0, pure: true };
-    const self = `${nodeId}\u0000${key}`;
-    at = this._canonicalTime(at);
-    const memoKey = `${self}\u0000${at}`;
-    const hit = this._memo.get(memoKey);
-    if (hit !== undefined) return { role: hit.role, depth: hit.depth, pure: true };
-    if (seen.has(memoKey)) return { role: 'participant', depth: 0, pure: false }; // cycle: not anchor-rooted
-    seen.add(memoKey);
-    let pure = true;
-    let depthOf = 0; // the deepest grantor consulted for the record being replayed
-    // A grantor's rank at a time, or 0 when its own role sits at the delegation depth already.
-    const rank = (id, k, t) => {
-      const r = this._resolve(id, k, t, seen);
-      if (!r.pure) pure = false;
-      if (r.depth >= MAX_DELEGATION_DEPTH) return 0;
-      if (r.depth > depthOf) depthOf = r.depth;
-      return roleRank(r.role);
-    };
-    // A revoke is in the replay from its cutoff on, at its signed place (re-review N2). Ties in signed
-    // time order grants before revokes, then by signature, so the replay never depends on the order
-    // records were kept in.
-    const records = (this._byGrantee.get(nodeId) || [])
-      .filter((e) => (e.g.type === 'role-revoke' ? cutoffOf(e.g) : (e.g.grantedAt ?? 0)) <= at)
-      .sort((a, b) => (a.g.grantedAt - b.g.grantedAt)
-        || ((a.g.type === 'role-revoke' ? 1 : 0) - (b.g.type === 'role-revoke' ? 1 : 0))
-        || (a.sk < b.sk ? -1 : a.sk > b.sk ? 1 : 0));
-    let role = 'participant';
-    let depth = 0;
-    const now = this._now();
-    for (const e of records) {
-      const g = e.g;
-      if (g.type === 'role-grant' && g.granteeKey !== key) continue;
-      depthOf = 0;
-      if (g.type === 'role-revoke') {
-        const need = Math.max(1, roleRank(role));
-        if (this._revokeAuthority(e, rank) >= need) { role = 'participant'; depth = 0; }
-      } else {
-        const need = roleRank(g.role);
-        const then = rank(g.grantedBy, e.signer, g.grantedAt);
-        let ok;
-        if (then < need) ok = false;
-        else if (rank(g.grantedBy, e.signer, now) >= need) ok = rank(g.grantedBy, e.signer, at) >= need; // standing, then the cascade
-        else ok = this._ratified(e.sk, g.grantedBy, g.grantedAt, need, rank); // a ratified grant keeps conferring
-        if (ok) { role = g.role; depth = depthOf + 1; }
-      }
-    }
-    seen.delete(memoKey);
-    if (role === 'participant') depth = 0;
-    if (pure) this._memo.set(memoKey, { role, depth });
-    return { role, depth, pure };
-  }
-
-  /** @private The key the registry binds `nodeId` to (the anchor's configured key for the anchor). */
-  _boundKey(nodeId) {
-    if (this._anchor && nodeId === this._anchor.nodeId) return this._anchor.publicKey;
-    try { return this._keys.get(nodeId); } catch { return undefined; }
-  }
-
-  /** A resolver bound to this store, for `verifyAttestationRole(att, resolver)`: the subject's bound key. */
-  resolver() {
-    return (nodeId, at) => this.resolveRole(nodeId, this._boundKey(nodeId), at ?? Date.now());
-  }
-
-  /** All grant/revoke records for a grantee (chronological). */
-  grantsFor(grantee) {
-    return (this._byGrantee.get(grantee) || []).map((e) => e.g).sort((a, b) => (a.grantedAt ?? 0) - (b.grantedAt ?? 0));
-  }
-
-  /** The records `nodeId` signed, kept here, signed before `before` (for a revoker choosing what to ratify). */
-  statementsBy(nodeId, before = Infinity) {
-    const out = [];
-    for (const e of this._pool.values()) if (e.g.grantedBy === nodeId && e.g.grantedAt < before) out.push(e.g);
-    return out.sort((a, b) => a.grantedAt - b.grantedAt);
-  }
-
-  /**
-   * Every record held, in an order that roots each before it is needed (security review D,
-   * anti-entropy): the anchor's records first, then those of each grantor the earlier ones reach,
-   * breadth first, each grantor's own records by signed time; what no chain reaches comes last.
-   * Cached until the next record is kept.
-   * @returns {object[]}
-   */
-  syncOrder() {
-    if (this._syncOrder) return this._syncOrder;
-    const byGrantor = new Map();
-    for (const e of this._pool.values()) {
-      let l = byGrantor.get(e.g.grantedBy);
-      if (!l) { l = []; byGrantor.set(e.g.grantedBy, l); }
-      l.push(e.g);
-    }
-    const out = [];
-    const done = new Set();
-    const queue = this._anchor ? [this._anchor.nodeId] : [];
-    for (let i = 0; i < queue.length; i++) {
-      const grantor = queue[i];
-      if (done.has(grantor)) continue;
-      done.add(grantor);
-      const l = (byGrantor.get(grantor) || []).sort((a, b) => (a.grantedAt ?? 0) - (b.grantedAt ?? 0) || (a.sig < b.sig ? -1 : 1));
-      for (const g of l) { out.push(g); if (g.type === 'role-grant' && !done.has(g.grantee)) queue.push(g.grantee); }
-    }
-    for (const [grantor, l] of byGrantor) if (!done.has(grantor)) out.push(...l);
-    this._syncOrder = out;
-    return out;
-  }
-
-  /**
-   * A digest of every record held (security review D, anti-entropy): sha256 over the sorted
-   * signatures' canonical spellings. Two stores holding the same records give the same digest.
-   * @returns {{ count: number, digest: string }}
-   */
-  digest() {
-    if (this._digest) return this._digest;
-    const h = crypto.createHash('sha256');
-    for (const sk of [...this._pool.keys()].sort()) h.update(sk).update('\n');
-    this._digest = { count: this._pool.size, digest: h.digest('hex') };
-    return this._digest;
-  }
-
-  /** Whether a record with this signature is held, however the signature is spelled. */
-  has(sig) { return this._pool.has(sigKey(sig)); }
-  size() { return this._pool.size; }
-
-  // ── Durable persistence (append-only) ────────────────────────────────────────
-
-  /**
-   * One line per record kept: the bare canonical record, as 0.13 wrote it. A record later replaced in
-   * its budget stays in the file; a reload recomputes the same kept set by the same rule.
-   */
-  _append(grant) {
-    if (!this._dir || this._loading) return;
-    try { fs.appendFileSync(path.join(this._dir, GRANTS_FILE), JSON.stringify(grant) + '\n'); }
-    catch { /* best effort — never let persistence break authority */ }
-  }
-
-  /**
-   * Reload the grant file through `record` — the same checks a frame gets. A record can only be
-   * verified once a grant vouching its grantor's key is kept, not necessarily before it in the file,
-   * so records refused for a reason a later record can cure (`unknown-grantor-key`, `bad-signature`
-   * under the keys known so far) are retried until a pass adds nothing. What is left is skipped and
-   * counted, and never removed: the file is only ever appended to (re-review N5). Never throws: a file
-   * that cannot be read leaves the store with no grants and `loadReport().unreadable` saying why.
-   * @private
-   */
-  _load() {
-    const report = { loaded: 0, skipped: {}, unreadable: null };
-    this._loadReport = report;
-    const skip = (reason) => { report.skipped[reason] = (report.skipped[reason] || 0) + 1; };
-    let text;
-    try { text = fs.readFileSync(path.join(this._dir, GRANTS_FILE), 'utf8'); }
-    catch (err) {
-      if (err && err.code !== 'ENOENT') report.unreadable = `${GRANTS_FILE} could not be read (${err.code || err.message})`;
-      return;
-    }
-    this._loading = true;
-    try {
-      let pending = [];
-      for (const line of text.split('\n')) {
-        if (!line.trim()) continue;
-        let o;
-        try { o = JSON.parse(line); } catch { skip('not-json'); continue; }
-        // The bare record (0.13, and 0.14), or `{ grant, receivedAt }` as 0.14 development builds
-        // wrote it: the receipt time is ignored.
-        if (o && typeof o === 'object' && o.grant && typeof o.grant === 'object') pending.push(o.grant);
-        else pending.push(o);
-      }
-      const curable = new Set(['unknown-grantor-key', 'bad-signature']);
-      let reasons = [];
-      let progress = true;
-      while (progress && pending.length) {
-        progress = false;
-        const retry = [];
-        reasons = [];
-        for (const g of pending) {
-          let r;
-          try { r = this.record(g); } catch { r = { stored: false, reason: 'unverifiable' }; }
-          if (r.stored) { report.loaded++; progress = true; }
-          else if (curable.has(r.reason)) { retry.push(g); reasons.push(r.reason); }
-          else skip(r.reason);
-        }
-        pending = retry;
-      }
-      for (const reason of reasons) skip(reason);
-      // Lines written, then replaced in their budget, load and are replaced again: what is kept is
-      // what the rule keeps, and `loaded` counts it.
-      report.loaded = this._pool.size;
-    } finally {
-      this._loading = false;
-    }
-  }
-}
-
-/**
- * A record as its signed fields only (grantPayload: type, grantee, role, grantedBy, grantedAt,
- * granteeKey, and a revoke's cutoff and ratify), with `sig` and `sigAlg`.
- */
-function canonicalGrant(g, sig) {
-  const c = { type: g.type, grantee: g.grantee };
-  if (typeof g.role === 'string' && g.role) c.role = g.role;
-  c.grantedBy = g.grantedBy;
-  c.grantedAt = g.grantedAt;
-  if (typeof g.granteeKey === 'string' && g.granteeKey) c.granteeKey = g.granteeKey;
-  if (g.type === 'role-revoke' && g.cutoff !== undefined) c.cutoff = g.cutoff;
-  if (g.type === 'role-revoke' && g.ratify !== undefined) c.ratify = [...g.ratify];
-  c.sig = sig;
-  c.sigAlg = 'ed25519';
-  return c;
-}
-
-/** The fields a record must have, of the types it must have them, or it is not a record. */
-function malformed(g) {
-  if (!g || typeof g !== 'object' || Array.isArray(g)) return true;
-  if (g.type !== 'role-grant' && g.type !== 'role-revoke') return true;
-  // nodeIds in canonical lowercase only (security review B), and bounded (review D).
-  for (const f of ['grantee', 'grantedBy']) if (!isCanonicalNodeId(g[f]) || g[f].length > MAX_ID) return true;
-  if (typeof g.sig !== 'string' || !g.sig || g.sig.length > 128) return true;
-  if (!Number.isSafeInteger(g.grantedAt) || g.grantedAt < 0) return true;
-  // A key, when present, is a raw Ed25519 key; a role holds no `|` (the payload's separator), so no
-  // two records sign the same bytes.
-  if (g.granteeKey !== undefined && (typeof g.granteeKey !== 'string' || (g.granteeKey !== '' && !/^[A-Za-z0-9_-]{43}$/.test(g.granteeKey)))) return true;
-  if (g.role !== undefined && (typeof g.role !== 'string' || g.role.length > MAX_ROLE || g.role.includes('|'))) return true;
-  if (g.cutoff !== undefined && (g.type !== 'role-revoke' || !Number.isSafeInteger(g.cutoff) || g.cutoff < 0 || g.cutoff > g.grantedAt)) return true;
-  if (g.ratify !== undefined) {
-    if (g.type !== 'role-revoke' || g.cutoff === undefined || !Array.isArray(g.ratify) || g.ratify.length === 0 || g.ratify.length > MAX_RATIFY) return true;
-    for (let i = 0; i < g.ratify.length; i++) {
-      if (typeof g.ratify[i] !== 'string' || !CANONICAL_SIG.test(g.ratify[i])) return true;
-      if (i > 0 && !(g.ratify[i - 1] < g.ratify[i])) return true; // sorted, no repeats
-    }
-  }
-  if (g.type === 'role-revoke') return false;
-  // A grant confers a rank above participant, on the holder of one key, or it confers nothing.
-  return roleRank(g.role) < 1 || typeof g.granteeKey !== 'string' || !/^[A-Za-z0-9_-]{43}$/.test(g.granteeKey);
-}
-
-module.exports = { RoleGrantStore, canonicalGrant, malformedGrant: malformed, cutoffOf, MAX_DELEGATION_DEPTH, SUBTREE_BUDGET, MAX_RATIFY };
diff --git a/lib/roster-keys.js b/lib/roster-keys.js
index 06045f76..5f037b21 100644
--- a/lib/roster-keys.js
+++ b/lib/roster-keys.js
@@ -17,10 +17,10 @@
  *   proven        — a confirmed §5.2 session proved possession of the key.
  *   pinned        — an out-of-band binding: an accepted invite naming the issuer's key, a Legacy
  *                   Import route's mandatory fingerprint, or an operator's resolution of a conflict.
- *   grant         — vouched by an anchor-rooted role grant (granteeKey, inside the signed payload).
- *                   NOT STORED (security review C): a grant binding is a view over the grants that
- *                   are in effect NOW (`opts.grantView`, the role-grant store's answer), so revoking
- *                   or demoting the grantor ends it, and grants never fill the registry. A grant
+ *   grant         — named by an in-force grant (MMP §6.6.9: the grant names a nodeId and a key).
+ *                   NOT STORED (security review C): a grant binding is a view over the in-force set
+ *                   NOW (`opts.grantView`, the authority store's answer), so a revoke that removes
+ *                   the grant or its chain ends it, and grants never fill the registry. A grant
  *                   naming the key a stored binding holds marks it vouched; one naming another key
  *                   is a conflict. A grant never binds this node's own nodeId (`opts.self`).
  *   legacy-claim  — every pre-0.14 `handshake` entry, relabelled on first load. It was learned from
@@ -110,6 +110,8 @@ class RosterKeyRegistry {
   /**
    * @param {object} [opts]
    * @param {{nodeId: string, publicKey: string}} [opts.anchor] the configured anchor; never persisted.
+   * @param {{nodeId: string, publicKey: string}[]} [opts.anchors] the pinned anchor members configured
+   *   with a nodeId (MMP §6.6.1: a key set with a threshold); never persisted. Each binds its nodeId.
    * @param {string} [opts.dir] when set, bindings persist here and reload.
    * @param {number} [opts.maxBindings]
    * @param {function} [opts.log]
@@ -119,7 +121,7 @@ class RosterKeyRegistry {
     this._ttl = Number.isFinite(opts.bindingTtlMs) && opts.bindingTtlMs > 0 ? opts.bindingTtlMs : BINDING_TTL_MS;
     this._isLive = typeof opts.isLive === 'function' ? opts.isLive : () => false;
     this._isRouted = typeof opts.isRouted === 'function' ? opts.isRouted : () => false;
-    // The grants in effect now (the role-grant store): nodeId -> the one key they vouch, or undefined.
+    // The in-force grants now (the authority store, MMP §6.6.9): nodeId -> the one key they name, or undefined.
     this._grantView = typeof opts.grantView === 'function' ? opts.grantView : null;
     this._self = opts.self && isNodeId(opts.self.nodeId) && isIdentityKey(opts.self.publicKey)
       ? { nodeId: opts.self.nodeId, publicKey: opts.self.publicKey } : null;
@@ -140,8 +142,11 @@ class RosterKeyRegistry {
     this._readOnly = opts.readOnly === true;
     this._max = opts.maxBindings || MAX_BINDINGS;
     this._log = typeof opts.log === 'function' ? opts.log : () => {};
-    this._anchor = opts.anchor && isNodeId(opts.anchor.nodeId) && opts.anchor.publicKey
-      ? { nodeId: opts.anchor.nodeId, publicKey: opts.anchor.publicKey } : null;
+    // The anchor pin's members that name their node: configuration, read at every start (§6.6.1).
+    this._anchors = new Map();
+    for (const a of [...(opts.anchor ? [opts.anchor] : []), ...(Array.isArray(opts.anchors) ? opts.anchors : [])]) {
+      if (a && isNodeId(a.nodeId) && a.publicKey) this._anchors.set(a.nodeId, a.publicKey);
+    }
     this._loading = false;
     this._migration = null;
     if (this._dir) {
@@ -154,7 +159,7 @@ class RosterKeyRegistry {
 
   /** The key that verifies `nodeId`'s signatures, or undefined. Never a legacy claim. */
   get(nodeId) {
-    if (this._anchor && nodeId === this._anchor.nodeId) return this._anchor.publicKey;
+    if (this._anchors.has(nodeId)) return this._anchors.get(nodeId);
     if (this._self && nodeId === this._self.nodeId) return this._self.publicKey;
     const b = this._byNode.get(nodeId);
     if (!b) return this._viewKey(nodeId);
@@ -165,7 +170,7 @@ class RosterKeyRegistry {
 
   /** The key bound to `nodeId` at any source, a legacy claim included, or undefined. */
   expected(nodeId) {
-    if (this._anchor && nodeId === this._anchor.nodeId) return this._anchor.publicKey;
+    if (this._anchors.has(nodeId)) return this._anchors.get(nodeId);
     if (this._self && nodeId === this._self.nodeId) return this._self.publicKey;
     const b = this._byNode.get(nodeId);
     return b ? b.key : this._viewKey(nodeId);
@@ -173,7 +178,7 @@ class RosterKeyRegistry {
 
   /** The source of `nodeId`'s binding: anchor | self | proven | pinned | grant | legacy-claim | undefined. */
   source(nodeId) {
-    if (this._anchor && nodeId === this._anchor.nodeId) return 'anchor';
+    if (this._anchors.has(nodeId)) return 'anchor';
     if (this._self && nodeId === this._self.nodeId) return 'self';
     const b = this._byNode.get(nodeId);
     if (b) return b.source === 'legacy-claim' && this._viewKey(nodeId) === b.key ? 'grant' : b.source;
@@ -189,7 +194,7 @@ class RosterKeyRegistry {
     } catch { return undefined; }
   }
 
-  /** Set the grant view after construction (the role-grant store is built with this registry). */
+  /** Set the grant view after construction (the authority store is built after this registry). */
   setGrantView(fn) { this._grantView = typeof fn === 'function' ? fn : null; }
 
   /** Whether `nodeId` has a binding that verifies (not a legacy claim). */
@@ -210,7 +215,7 @@ class RosterKeyRegistry {
   /** Every binding, for status and tests: [{ nodeId, key, source, at, seen, verified, vouched }]. */
   entries() {
     const out = [...this._byNode].map(([nodeId, b]) => ({ nodeId, key: b.key, source: b.source, at: b.at, seen: b.seenAt ?? null, verified: b.verifiedAt ?? null, vouched: !!b.vouched }));
-    if (this._anchor) out.unshift({ nodeId: this._anchor.nodeId, key: this._anchor.publicKey, source: 'anchor', at: null });
+    for (const [nodeId, key] of [...this._anchors].reverse()) out.unshift({ nodeId, key, source: 'anchor', at: null });
     return out;
   }
 
@@ -250,11 +255,12 @@ class RosterKeyRegistry {
     if (!isNodeId(nodeId) || !isIdentityKey(key) || !SOURCES.has(source) || source === 'anchor') {
       return { bound: false, reason: 'malformed' };
     }
-    if (this._anchor && nodeId === this._anchor.nodeId) {
-      // The anchor's key is its configured one, whatever any other source says.
-      if (key === this._anchor.publicKey) return { bound: true, source: 'anchor' };
-      this._recordConflict(nodeId, this._anchor.publicKey, 'anchor', key, source, at);
-      return { bound: false, reason: 'conflict', had: this._anchor.publicKey };
+    if (this._anchors.has(nodeId)) {
+      // A pinned anchor member's key is its configured one, whatever any other source says.
+      const pinned = this._anchors.get(nodeId);
+      if (key === pinned) return { bound: true, source: 'anchor' };
+      this._recordConflict(nodeId, pinned, 'anchor', key, source, at);
+      return { bound: false, reason: 'conflict', had: pinned };
     }
     if (this._self && nodeId === this._self.nodeId) {
       // This node's own nodeId is its own key: no session, pin or grant binds it to another.
@@ -419,7 +425,7 @@ class RosterKeyRegistry {
    */
   resolveConflict(nodeId, key) {
     if (!isNodeId(nodeId) || !isIdentityKey(key)) return { resolved: false, reason: 'malformed' };
-    if (this._anchor && nodeId === this._anchor.nodeId) return { resolved: false, reason: 'anchor' };
+    if (this._anchors.has(nodeId)) return { resolved: false, reason: 'anchor' };
     if (this._self && nodeId === this._self.nodeId) return { resolved: false, reason: 'self' };
     this._byNode.set(nodeId, { key, source: 'pinned', at: Date.now(), seenAt: this._now(), verifiedAt: null, vouched: false, seenSaved: null, verifiedSaved: null });
     this._lru.delete(nodeId);
@@ -574,8 +580,8 @@ class RosterKeyRegistry {
       if (this._self && nodeId === this._self.nodeId) { counts.droppedSelf++; continue; }
       // Every 0.13 entry is a legacy claim, a `grant` one too (security review C): 0.13 pinned a
       // grant's key without checking that its grantor was authorised when it signed or still is, so
-      // it is the EXPECTED key, never one that verifies. The grants themselves are re-verified by the
-      // role-grant store, whose view binds what is in effect now.
+      // it is the EXPECTED key, never one that verifies. Authority now comes only from §6.6 statements,
+      // whose in-force set is the view that binds.
       this._byNode.set(nodeId, { key: b.key, source: 'legacy-claim', at: null, seenAt: null, verifiedAt: null, vouched: false, seenSaved: null, verifiedSaved: null });
       counts.bindings++;
       counts.legacyClaim++;
diff --git a/tests/authority-attacks.test.js b/tests/authority-attacks.test.js
new file mode 100644
index 00000000..97027cad
--- /dev/null
+++ b/tests/authority-attacks.test.js
@@ -0,0 +1,322 @@
+'use strict';
+
+/**
+ * MMP §6.6 against the attacks its reviews found, built here with fresh keys at full scale
+ * (AUTHORITY_QUOTA 256, AUTHORITY_DELEGATE_QUOTA 16), and the old faces of the time-replay rule
+ * (arrival order, backdating, floods, cycles), which the new rule removes by construction. The
+ * published vectors (authority-vectors.test.js) hold the same attacks at test scale.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const crypto = require('crypto');
+const A = require('../lib/core/authority');
+const { AuthorityStore, lifecycleOf } = require('../lib/authority-store');
+
+// ── A small builder ───────────────────────────────────────────────────────────
+
+const PRIV = new Map(); // public key -> private key
+function party() {
+  const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519');
+  const key = publicKey.export({ format: 'der', type: 'spki' }).subarray(12).toString('base64url');
+  PRIV.set(key, privateKey.export({ format: 'der', type: 'pkcs8' }).subarray(16).toString('base64url'));
+  const b = crypto.randomBytes(16).toString('hex');
+  return { nodeId: `${b.slice(0, 8)}-${b.slice(8, 12)}-${b.slice(12, 16)}-${b.slice(16, 20)}-${b.slice(20)}`, key };
+}
+const anchorKey = party();
+const PIN = A.parsePin({ threshold: 1, keys: [{ key: anchorKey.key, nodeId: anchorKey.nodeId }] });
+const id = (s) => A.statementId(s);
+/** A statement by `by` (a grant statement, or 'anchor'), signed by the key it must be signed by. */
+function make(by, fields, extra = {}) {
+  const s = { ...fields, authorisedBy: by === 'anchor' ? 'anchor' : id(by), nonce: A.freshNonce(), ...extra, sigs: [] };
+  const key = by === 'anchor' ? anchorKey.key : by.subject.key;
+  return A.signStatement(s, PRIV.get(key), key);
+}
+const grant = (by, subject, role, scope, extra) => make(by, { kind: 'grant', subject, role, ...(scope ? { scope } : {}) }, extra);
+const revoke = (by, targets, extra) => make(by, { kind: 'revoke', targets: targets.map(id) }, extra);
+const endorse = (by, targets, extra) => make(by, { kind: 'endorse', targets: targets.map(id) }, extra);
+function store(statements, opts = {}) {
+  const st = new AuthorityStore({ pin: PIN, ...opts });
+  let left = statements;
+  for (let progress = true; progress && left.length;) {
+    progress = false;
+    const next = [];
+    for (const s of left) { const r = st.ingest(s); if (r.result === 'held') progress = true; else if (r.result === 'pending') next.push(s); }
+    left = next;
+  }
+  return st;
+}
+const status = (st, s) => st.statusOf(id(s)) || 'not held';
+const byId = (list) => [...list].sort((x, y) => (id(x) < id(y) ? -1 : 1));
+function shuffled(list) { const a = [...list]; for (let i = a.length - 1; i > 0; i--) { const j = crypto.randomInt(i + 1); [a[i], a[j]] = [a[j], a[i]]; } return a; }
+/** A statement whose id sorts below (or above) `than`'s, made by retrying nonces. */
+function ordered(makeOne, than, below) {
+  for (;;) { const s = makeOne(); if ((id(s) < id(than)) === below) return s; }
+}
+
+// ── The reviewers' attacks ────────────────────────────────────────────────────
+
+describe('§6.6 against the review attacks, at full scale', () => {
+  it('r2: admins hung under over-quota grants are dead, and an endorse cannot rescue a cut by a quota', () => {
+    const gA = grant('anchor', party(), 'admin');
+    const D = Array.from({ length: 20 }, () => grant(gA, party(), 'admin'));
+    const [kept, over] = [byId(D).slice(0, 16), byId(D).slice(16)];
+    const C = over.map((d) => grant(d, party(), 'admin'));
+    const below = C.map((c) => grant(c, party(), 'validator'));
+    const eAnchor = endorse('anchor', C);
+    const st = store(shuffled([gA, ...D, ...C, ...below, eAnchor]));
+    for (const d of kept) assert.strictEqual(status(st, d), 'in-force');
+    for (const d of over) assert.strictEqual(status(st, d), 'over-quota', 'the delegate quota decides by id');
+    for (const s of [...C, ...below]) assert.strictEqual(status(st, s), 'dead', 'cut by a quota, never rescued');
+    const delegating = st.inForceStatements().filter((s) => s.authorisedBy === id(gA) && A.isDelegating(s.role));
+    assert.strictEqual(delegating.length, 16);
+  });
+
+  it('r2 laundered: the admin revokes its own over-quota grants; their rescue is charged to the endorser\'s bucket, and the admin\'s is full', () => {
+    const gA = grant('anchor', party(), 'admin');
+    const D = Array.from({ length: 20 }, () => grant(gA, party(), 'admin'));
+    const over = byId(D).slice(16);
+    const C = over.map((d) => grant(d, party(), 'admin'));
+    const launder = revoke(gA, over);
+    const selfRescue = endorse(gA, C);
+    const st = store(shuffled([gA, ...D, ...C, launder, selfRescue]));
+    assert.strictEqual(status(st, launder), 'in-force');
+    for (const d of over) assert.strictEqual(status(st, d), 'removed', 'the laundering revoke turns a cut by quota into a cut by revoke');
+    for (const c of C) assert.strictEqual(status(st, c), 'over-quota', 'and the rescue it bought is charged to the admin\'s own full delegate quota');
+    const inForceBelow = [...st.resolve().inForce].filter((x) => st._held.get(x).chain.includes(id(gA)));
+    assert.strictEqual(inForceBelow.length, 16 + 2, 'sixteen admins, the revoke and the endorse: nothing more below gA');
+    // The anchor can keep them, in its own bucket: authority it holds, spent where it is accounted.
+    const eAnchor = endorse('anchor', C);
+    const st2 = store(shuffled([gA, ...D, ...C, launder, selfRescue, eAnchor]));
+    for (const c of C) {
+      assert.strictEqual(status(st2, c), 'in-force');
+      assert.strictEqual(st2.resolve().keptBy.get(id(c)), 'anchor');
+    }
+  });
+
+  it('r1: depth-3 admins under an over-quota grant stay dead, with everything they sign; the root ignores them', () => {
+    const gA = grant('anchor', party(), 'admin');
+    const D = Array.from({ length: 17 }, () => grant(gA, party(), 'admin'));
+    const overD = byId(D)[16];
+    const C = grant(overD, party(), 'admin');
+    const flood = Array.from({ length: 40 }, () => grant(C, party(), 'validator')); // depth 4
+    const base = store([gA, ...D]);
+    const st = store(shuffled([gA, ...D, C, ...flood, endorse('anchor', [C])]));
+    assert.strictEqual(status(st, overD), 'over-quota');
+    for (const s of [C, ...flood]) assert.strictEqual(status(st, s), 'dead');
+    // Dead statements change nothing; the anchor's endorse of a quota cut is in force and keeps nothing.
+    assert.strictEqual(st.inForceStatements().length, base.inForceStatements().length + 1);
+    const withoutEndorse = store(shuffled([gA, ...D, C, ...flood]));
+    assert.strictEqual(withoutEndorse.root(), base.root(), 'held but dead: no effect on the root');
+  });
+
+  it('self-revoke: a revoke naming its own authorising grant, or a grant above it, removes nothing', () => {
+    const gA = grant('anchor', party(), 'admin');
+    const gB = grant(gA, party(), 'admin');
+    const gP = grant(gB, party(), 'participant');
+    const selfRevoke = revoke(gB, [gB, gA]);
+    const st = store([gA, gB, gP, selfRevoke]);
+    for (const s of [gA, gB, gP, selfRevoke]) assert.strictEqual(status(st, s), 'in-force');
+  });
+
+  it('scope: w1/../w2 and w1/./x are not well formed, w10 is not inside w1, a dropped scope widens; w1/region-a narrows', () => {
+    const W = grant('anchor', party(), 'admin', 'xmesh-world:w1');
+    const attempts = {
+      dotdot: grant(W, party(), 'issuer', 'xmesh-world:w1/../w2'),
+      dot: grant(W, party(), 'issuer', 'xmesh-world:w1/./region-a'),
+      w10: grant(W, party(), 'issuer', 'xmesh-world:w10'),
+      sideways: grant(W, party(), 'issuer', 'xmesh-world:w2'),
+      dropped: grant(W, party(), 'issuer'),
+      prefix: grant(W, party(), 'issuer', 'xmesh-worlds:w1'),
+    };
+    const st = new AuthorityStore({ pin: PIN });
+    assert.strictEqual(st.ingest(W).result, 'held');
+    for (const [name, s] of Object.entries(attempts)) assert.strictEqual(st.ingest(s).result, 'invalid', name);
+    const region = grant(W, party(), 'validator', 'xmesh-world:w1/region-a');
+    assert.strictEqual(st.ingest(region).result, 'held');
+    assert.strictEqual(st.statusOf(id(region)), 'in-force');
+    // Lifecycle inside a scope is by whole segments: w1/region-a contains w1/region-a/x, never w1/region-ab or w10.
+    const roles = st.rolesOf(region.subject.nodeId, region.subject.key);
+    const inside = (cmbScope) => (scope) => A.scopeNarrows(scope, cmbScope);
+    assert.strictEqual(lifecycleOf(roles, inside('xmesh-world:w1/region-a/x')), 'validated');
+    assert.strictEqual(lifecycleOf(roles, inside('xmesh-world:w1/region-ab')), 'none');
+    assert.strictEqual(lifecycleOf(roles, inside('xmesh-world:w10')), 'none');
+    assert.strictEqual(lifecycleOf(roles, inside('xmesh-world:w1')), 'none', 'a narrower grant has nothing over the wider scope');
+    assert.strictEqual(lifecycleOf(roles, () => false), 'none', 'and nothing outside every scope');
+  });
+
+  it('w10 under w1: a scoped admin\'s grant to xmesh-world:w10 is refused; one to w1 itself is accepted', () => {
+    const W = grant('anchor', party(), 'admin', 'xmesh-world:w1');
+    const w10 = grant(W, party(), 'admin', 'xmesh-world:w10');
+    const same = grant(W, party(), 'admin', 'xmesh-world:w1');
+    const st = store([W, w10, same]);
+    assert.strictEqual(status(st, w10), 'not held');
+    assert.strictEqual(status(st, same), 'in-force');
+  });
+
+  it('17 issuers in one bucket: 16 are in force, the highest id is over quota, in every order; its seats are dead', () => {
+    const W = grant('anchor', party(), 'admin', 'xmesh-world:w1');
+    const I = Array.from({ length: 17 }, () => grant(W, party(), 'issuer', 'xmesh-world:w1'));
+    const top = byId(I)[16];
+    const seats = Array.from({ length: 3 }, () => grant(top, party(), 'xmesh-seat', 'xmesh-world:w1'));
+    let root = null;
+    for (let round = 0; round < 5; round++) {
+      const st = store(shuffled([W, ...I, ...seats]));
+      for (const i of byId(I).slice(0, 16)) assert.strictEqual(status(st, i), 'in-force');
+      assert.strictEqual(status(st, top), 'over-quota');
+      for (const s of seats) assert.strictEqual(status(st, s), 'dead');
+      if (root) assert.strictEqual(st.root(), root);
+      root = st.root();
+    }
+  });
+
+  it('rescue falls through: the lower endorser\'s bucket is full, so the next endorser by id keeps the grant', () => {
+    const gA = grant('anchor', party(), 'admin');
+    const gB = grant(gA, party(), 'admin');
+    const gV = grant(gB, party(), 'validator');
+    const gP = grant(gV, party(), 'participant');
+    const rV = revoke(gA, [gV]);
+    const eA = endorse(gA, [gP]);
+    const eB = ordered(() => endorse(gB, [gP]), eA, true); // gB's endorse sorts first
+    // Room in both buckets: the lower endorse by id keeps it, in its own bucket.
+    let st = store(shuffled([gA, gB, gV, gP, rV, eA, eB]));
+    assert.strictEqual(status(st, gV), 'removed');
+    assert.strictEqual(status(st, gP), 'in-force');
+    assert.strictEqual(st.resolve().keptBy.get(id(gP)), id(gB));
+    // gB's bucket full (its endorse and 255 participants: the removed validator takes no place).
+    const fill = Array.from({ length: 255 }, () => grant(gB, party(), 'participant'));
+    st = store(shuffled([gA, gB, gV, gP, rV, eA, eB, ...fill]));
+    assert.strictEqual(fill.filter((f) => status(st, f) === 'in-force').length, 255);
+    assert.strictEqual(status(st, gP), 'in-force', 'it falls through to the next endorser');
+    assert.strictEqual(st.resolve().keptBy.get(id(gP)), id(gA));
+    // Both full: over quota (tried and failed), never in force.
+    const fillA = Array.from({ length: 256 - 3 }, () => grant(gA, party(), 'participant')); // + gB, rV, eA
+    st = store(shuffled([gA, gB, gV, gP, rV, eA, eB, ...fill, ...fillA]));
+    assert.strictEqual(status(st, gP), 'over-quota');
+  });
+
+  it('an endorse does not override a revoke: the endorsed grant is removed while the revoke is in force', () => {
+    const gA = grant('anchor', party(), 'admin');
+    const gV = grant(gA, party(), 'validator');
+    const rV = revoke(gA, [gV]);
+    const eV = endorse('anchor', [gV]);
+    const st = store(shuffled([gA, gV, rV, eV]));
+    assert.strictEqual(status(st, gV), 'removed');
+  });
+});
+
+// ── The old faces, impossible by construction ─────────────────────────────────
+
+/** A random tree with revokes and endorses, every statement signed by the key it must be. */
+function randomMesh(n = 60) {
+  const grants = [grant('anchor', party(), 'admin'), grant('anchor', party(), 'admin')];
+  const all = [...grants];
+  for (let i = 0; i < n; i++) {
+    const by = grants[crypto.randomInt(grants.length)];
+    const depth = (s) => { let d = 1; let x = s; while (x.authorisedBy !== 'anchor') { d++; x = all.find((y) => id(y) === x.authorisedBy); } return d; };
+    const roll = crypto.randomInt(10);
+    if (by.role === 'admin' && depth(by) < 4 && roll < 5) {
+      const g = grant(by, party(), ['admin', 'validator', 'participant'][crypto.randomInt(3)]);
+      all.push(g); if (g.role !== 'participant') grants.push(g);
+    } else if (roll < 7) {
+      // A revoke of something below `by`, or of anything at all (off its chain: inert).
+      const t = all[crypto.randomInt(all.length)];
+      if (A.isDelegating(by.role) && id(t) !== id(by)) all.push(revoke(by, [t]));
+    } else if (by.role === 'admin') {
+      const t = all[crypto.randomInt(all.length)];
+      if (id(t) !== id(by)) all.push(endorse(by, [t]));
+    } else {
+      all.push(grant(by, party(), 'participant'));
+    }
+  }
+  return all;
+}
+
+describe('§6.6: the old faces of the time-replay rule are gone', () => {
+  it('arrival order: random meshes resolve to the same statuses and root in every order', () => {
+    for (let m = 0; m < 4; m++) {
+      const all = randomMesh(70);
+      const first = store(all);
+      const want = new Map([...first.resolve().status]);
+      for (let k = 0; k < 12; k++) {
+        const st = store(shuffled(all));
+        assert.strictEqual(st.root(), first.root());
+        assert.deepStrictEqual(new Map([...st.resolve().status]), want);
+      }
+      // Two stores fed different halves, then each other's: the same root.
+      const half = shuffled(all);
+      const a = store(half.slice(0, 35)); const b = store(half.slice(35));
+      for (const s of half.slice(35)) a.ingest(s);
+      for (const s of half.slice(0, 35)) b.ingest(s);
+      const settle = (x) => { for (let i = 0; i < 5; i++) for (const s of all) x.ingest(s); };
+      settle(a); settle(b);
+      assert.strictEqual(a.root(), first.root());
+      assert.strictEqual(b.root(), first.root());
+    }
+  });
+
+  it('backdating: issuedAt decides nothing; a revoke "dated" before its target still removes it; quotas decide by id', () => {
+    const gA = grant('anchor', party(), 'admin', undefined, { issuedAt: 2_000_000_000_000 });
+    const gV = grant(gA, party(), 'validator', undefined, { issuedAt: 1_900_000_000_000 });
+    const rV = revoke(gA, [gV], { issuedAt: 0 });
+    let st = store([gA, gV, rV]);
+    assert.strictEqual(status(st, gV), 'removed', 'a revoke "older" than its target applies');
+    // A bucket at quota (test quota 3) keeps by id, whatever the dates say.
+    const G = Array.from({ length: 6 }, (_, i) => grant(gA, party(), 'participant', undefined, { issuedAt: i % 2 ? 0 : 9_000_000_000_000 }));
+    st = store(shuffled([gA, ...G]), { quota: 3 });
+    assert.deepStrictEqual(byId(G).map((g) => status(st, g)), ['in-force', 'in-force', 'in-force', 'over-quota', 'over-quota', 'over-quota']);
+    // The same fields re-issued with another date are another statement: both stand side by side.
+    const again = { ...A.canonicalStatement(gV, []), issuedAt: 5 };
+    delete again.sigs;
+    const re = A.signStatement({ ...again, sigs: [] }, PRIV.get(gA.subject.key), gA.subject.key);
+    assert.notStrictEqual(id(re), id(gV));
+    // And no clock is read: the same set resolves to the same root at any time of day.
+    const realNow = Date.now;
+    try {
+      const roots = [0, 1e15].map((t) => { Date.now = () => t; return store([gA, gV, rV]).root(); });
+      assert.strictEqual(roots[0], roots[1]);
+    } finally { Date.now = realNow; }
+  });
+
+  it('floods: one bucket flooding keeps at most its quota and changes no other bucket; forged anchor floods are invalid', () => {
+    const gA = grant('anchor', party(), 'admin');
+    const gB = grant('anchor', party(), 'admin');
+    const honest = Array.from({ length: 10 }, () => grant(gB, party(), 'validator'));
+    const before = store([gA, gB, ...honest]);
+    const flood = Array.from({ length: 1200 }, (_, i) => grant(gA, party(), i % 3 ? 'participant' : 'validator'));
+    const st = store(shuffled([gA, gB, ...honest, ...flood]));
+    const fromA = st.inForceStatements().filter((s) => s.authorisedBy === id(gA));
+    assert.strictEqual(fromA.length, 256);
+    assert.ok(fromA.filter((s) => A.isDelegating(s.role)).length <= 16);
+    for (const h of honest) assert.strictEqual(status(st, h), status(before, h));
+    // Anchor-level statements not signed by the pinned key: none is held.
+    const intruder = party();
+    const forged = Array.from({ length: 50 }, () => A.signStatement({ kind: 'grant', authorisedBy: 'anchor', subject: party(), role: 'admin', nonce: A.freshNonce(), sigs: [] }, PRIV.get(intruder.key), intruder.key));
+    const st2 = new AuthorityStore({ pin: PIN });
+    for (const f of forged) assert.strictEqual(st2.ingest(f).result, 'invalid');
+    assert.strictEqual(st2.size(), 0);
+  });
+
+  it('cycles: authorisedBy is inside the hashed bytes, so a chain is fixed when signed; one that is not rooted stays pending and confers nothing', () => {
+    const gA = grant('anchor', party(), 'admin');
+    // A statement cannot name itself: its id is a hash over its own authorisedBy.
+    const s = grant(gA, party(), 'admin');
+    const selfNamed = { ...A.canonicalStatement(s, []), authorisedBy: id(s) };
+    assert.notStrictEqual(A.statementId(selfNamed), id(s));
+    // A chain of statements hanging from an id nobody holds: pending, then never in force.
+    const ghost = `auth-${crypto.randomBytes(32).toString('hex')}`;
+    const fake = { subject: party(), role: 'admin' };
+    const g1 = A.signStatement({ kind: 'grant', authorisedBy: ghost, subject: fake.subject, role: 'admin', nonce: A.freshNonce(), sigs: [] }, PRIV.get(gA.subject.key), gA.subject.key);
+    const g2 = grant(g1, party(), 'admin');
+    const st = new AuthorityStore({ pin: PIN });
+    st.ingest(gA);
+    assert.strictEqual(st.ingest(g1).result, 'pending');
+    assert.strictEqual(st.ingest(g2).result, 'pending');
+    assert.strictEqual(st.size(), 1);
+    // A fifth link is too deep however it is reached.
+    const chain = [gA];
+    for (let d = 2; d <= 5; d++) chain.push(grant(chain[chain.length - 1], party(), 'admin'));
+    const st2 = store(chain);
+    assert.deepStrictEqual(chain.map((c) => status(st2, c)), ['in-force', 'in-force', 'in-force', 'in-force', 'not held']);
+  });
+});
diff --git a/tests/authority-node.test.js b/tests/authority-node.test.js
new file mode 100644
index 00000000..e0748779
--- /dev/null
+++ b/tests/authority-node.test.js
@@ -0,0 +1,362 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME before lib/config loads
+
+/**
+ * MMP §6.6 on real nodes: the four frames (authority-statement, authority-digest, authority-fetch,
+ * authority-set) with their bounds and pacing (§6.6.8), the retired time-replay frames (§6.6.11),
+ * in-force grants as a view of the key registry and a grant naming this node with a foreign key
+ * (§6.6.9), the origin weight of a received record (§6.6.10), persistence that re-verifies everything
+ * it reads (§6.6.7), and the property the rest is for: two nodes that receive the same statements in
+ * different orders, over real sessions, reach the same root.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+const { SymNode } = require('../lib/node');
+const { BonjourDiscovery, NullDiscovery } = require('../lib/discovery');
+const { nodeDirById } = require('../lib/config');
+const A = require('../lib/core/authority');
+const { AuthorityStore } = require('../lib/authority-store');
+const { RETIRED_FRAMES } = require('../lib/node-authority');
+const { until, connectNodes, admitAs, deliver, identity } = require('./_core-secure');
+
+// ── Statements made off the mesh, by keys the test holds ──────────────────────
+
+const PRIV = new Map();
+function party() {
+  const id = identity('p');
+  PRIV.set(id.publicKey, id.privateKey);
+  return { nodeId: id.nodeId, key: id.publicKey };
+}
+const anchorKey = party();
+const PIN = { threshold: 1, keys: [{ key: anchorKey.key }] };
+const sid = (s) => A.statementId(s);
+function make(by, fields) {
+  const s = { ...fields, authorisedBy: by === 'anchor' ? 'anchor' : sid(by), nonce: A.freshNonce(), sigs: [] };
+  const key = by === 'anchor' ? anchorKey.key : by.subject.key;
+  return A.signStatement(s, PRIV.get(key), key);
+}
+const grant = (by, subject, role, scope) => make(by, { kind: 'grant', subject, role, ...(scope ? { scope } : {}) });
+const revoke = (by, targets) => make(by, { kind: 'revoke', targets: targets.map(sid) });
+const endorse = (by, targets) => make(by, { kind: 'endorse', targets: targets.map(sid) });
+function shuffled(list) { const a = [...list]; for (let i = a.length - 1; i > 0; i--) { const j = crypto.randomInt(i + 1); [a[i], a[j]] = [a[j], a[i]]; } return a; }
+function offline(statements) {
+  const st = new AuthorityStore({ pin: A.parsePin(PIN) });
+  for (let pass = 0; pass < 6; pass++) for (const s of statements) st.ingest(s);
+  return st;
+}
+/** A mesh with depth, removals, a rescue, an over-quota bucket and some forgeries. */
+function scenery() {
+  const gA = grant('anchor', party(), 'admin');
+  const gB = grant('anchor', party(), 'admin');
+  const gC = grant(gA, party(), 'admin');
+  const gV = grant(gC, party(), 'validator');
+  const P = Array.from({ length: 6 }, () => grant(gV, party(), 'participant'));
+  const rV = revoke(gA, [gV]);
+  const eP = endorse(gA, P.slice(0, 2));
+  const D = Array.from({ length: 18 }, () => grant(gB, party(), 'issuer', 'test-world:w1'));
+  const seats = D.map((d) => grant(d, party(), 'test-seat', 'test-world:w1'));
+  const forged = { ...P[3], sigs: [{ key: anchorKey.key, sig: P[3].sigs[0].sig }] };
+  return { all: [gA, gB, gC, gV, ...P, rV, eP, ...D, ...seats], forged: [forged] };
+}
+
+// ── Nodes ─────────────────────────────────────────────────────────────────────
+
+const uniq = (b) => `${b}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+const made = [];
+function node(base, opts = {}) {
+  const n = new SymNode({ name: uniq(base), silent: true, discovery: new NullDiscovery(), room: 'auth', anchor: PIN, ...opts });
+  made.push(n);
+  return n;
+}
+async function stopAll() {
+  for (const n of made.splice(0)) { try { await n.stop(); } catch { /* */ } try { fs.rmSync(nodeDirById(n.nodeId), { recursive: true, force: true }); } catch { /* */ } }
+}
+const sessionTo = (n, other) => { const p = n._peers.get(other.nodeId); return p && p.transport; };
+const confirmed = (n, other) => { const s = sessionTo(n, other); return !!(s && s.confirmed && !s.closed); };
+
+describe('§6.6: the same statements in different orders, over real sessions, reach the same root', () => {
+  it('two nodes fed over TCP on the loopback, children first on one and shuffled on the other', async () => {
+    try {
+      const { all, forged } = scenery();
+      const want = offline(all);
+      const lan = (room) => new BonjourDiscovery({ mdns: false, room, serviceType: `_${room}._tcp` });
+      const r1 = `auth-a-${Math.random().toString(36).slice(2, 8)}`; const r2 = `auth-b-${Math.random().toString(36).slice(2, 8)}`;
+      const X = node('auth-x', { discovery: lan(r1), room: r1 }); const F1 = node('auth-f1', { discovery: lan(r1), room: r1 });
+      const Y = node('auth-y', { discovery: lan(r2), room: r2 }); const F2 = node('auth-f2', { discovery: lan(r2), room: r2 });
+      for (const n of [X, F1, Y, F2]) await n.start();
+      await until(() => confirmed(X, F1) && confirmed(F1, X) && confirmed(Y, F2) && confirmed(F2, Y), 15000);
+      assert.ok(confirmed(X, F1) && confirmed(Y, F2), 'both pairs joined over TCP');
+      // F1 and F2 hold nothing: they only carry frames. X gets every child before its chain (each
+      // waits pending, fetched from F1, which has nothing to send); Y gets a shuffle. Forgeries too.
+      const order1 = [...forged, ...offline(all).authorityOrder(new Set(all.map(sid))).reverse().map((e) => e.s)];
+      const order2 = shuffled([...all, ...forged]);
+      for (const s of order1) sessionTo(F1, X).send({ type: 'authority-statement', statement: s });
+      for (const s of order2) sessionTo(F2, Y).send({ type: 'authority-statement', statement: s });
+      await until(() => X.authorityRoot() === want.root() && Y.authorityRoot() === want.root(), 15000);
+      assert.strictEqual(X.authorityRoot(), want.root());
+      assert.strictEqual(Y.authorityRoot(), want.root());
+      for (const s of all) assert.strictEqual(X._authority.statusOf(sid(s)), Y._authority.statusOf(sid(s)), 'the same status for every statement');
+      // The carriers pull what they were told differs, and agree too.
+      await until(() => F1.authorityRoot() === want.root() && F2.authorityRoot() === want.root(), 15000);
+      assert.strictEqual(F1.authorityRoot(), want.root());
+      assert.strictEqual(F2.authorityRoot(), want.root());
+      assert.ok(X.authorityStatus().stats.pending > 0, 'X held statements pending for their chains');
+      assert.ok(X.authorityStatus().stats.invalid >= 1, 'and refused the forgery');
+    } finally { await stopAll(); }
+  });
+
+  it('a late joiner pulls the whole live set page by page after one digest; each page waits for the work the last one cost', async () => {
+    try {
+      // 150 grants, each naming a key the joiner has not seen: 17 checks apiece against a lane of 100 that
+      // earns 2,000 a second. The pull is paced by that debt; nothing is dropped.
+      const statements = Array.from({ length: 150 }, () => grant('anchor', party(), 'participant'));
+      const X = node('auth-src'); const Z = node('auth-late');
+      for (const s of statements) X._authority.ingest(s);
+      X._authoritySettle();
+      await X.start(); await Z.start();
+      await connectNodes(Z, X);
+      await until(() => Z.authorityRoot() === X.authorityRoot(), 15000);
+      assert.strictEqual(Z.authorityRoot(), X.authorityRoot());
+      assert.strictEqual(Z.authorityStatus().inForce, 150);
+      assert.strictEqual(Z.authorityStatus().stats.overBudget, 0, 'an answer to its own pull is never dropped for budget');
+      assert.ok(X.authorityStatus().stats.served >= 3, 'three pages of at most 64');
+    } finally { await stopAll(); }
+  });
+
+  it('a pull longer than the responder\'s burst is paced, not refused: 1,100 statements in 18 pages arrive whole', async () => {
+    try {
+      const statements = Array.from({ length: 1100 }, () => grant('anchor', party(), 'participant'));
+      const fast = { gossipBudget: { perSecond: 1e6, burst: 1e6, newLane: 1e6 } };
+      const X = node('auth-src-big'); const Z = node('auth-late-big', fast);
+      for (const s of statements) X._authority.ingest(s);
+      X._authoritySettle();
+      await X.start(); await Z.start();
+      await connectNodes(Z, X);
+      await until(() => Z.authorityRoot() === X.authorityRoot(), 30000);
+      assert.strictEqual(Z.authorityRoot(), X.authorityRoot());
+      assert.strictEqual(Z.authorityStatus().inForce, 1100);
+    } finally { await stopAll(); }
+  });
+});
+
+describe('§6.6.8: the frames, their bounds and pacing', () => {
+  function rig(opts = {}) {
+    const N = node('auth-frames', opts);
+    const peer = identity('frames-peer');
+    const s = admitAs(N, peer);
+    N._sessions.add(s);
+    return { N, s, sent: s.sent };
+  }
+
+  it('a fetch by ids answers each live statement with its chain and the in-force revokes and endorses naming it, and lists the rest missing', async () => {
+    try {
+      const { N, s, sent } = rig();
+      const gA = grant('anchor', party(), 'admin');
+      const gV = grant(gA, party(), 'validator');
+      const gP = grant(gV, party(), 'participant');
+      const rP = revoke(gA, [gP]);
+      for (const x of [gA, gV, gP, rP]) N.submitAuthority(x);
+      const ghost = `auth-${'0'.repeat(64)}`;
+      deliver(N, s, { type: 'authority-fetch', reqId: 'q1', ids: [sid(gV), ghost] });
+      const ans = sent.find((f) => f.type === 'authority-set' && f.reqId === 'q1');
+      assert.ok(ans);
+      assert.deepStrictEqual(ans.statements.map(sid), [sid(gA), sid(gV)], 'gV with its chain, in authority order');
+      assert.deepStrictEqual(ans.missing, [ghost]);
+      // gP is removed (not live): asking for it gives nothing; the revoke is live.
+      deliver(N, s, { type: 'authority-fetch', reqId: 'q2', ids: [sid(rP)] });
+      assert.deepStrictEqual(sent.find((f) => f.reqId === 'q2').statements.map(sid), [sid(gA), sid(rP)]);
+      // Malformed fetches are not answered: both selectors, too many ids, repeated ids, a long reqId.
+      const n = sent.length;
+      deliver(N, s, { type: 'authority-fetch', reqId: 'b1', ids: [sid(gA)], after: '' });
+      deliver(N, s, { type: 'authority-fetch', reqId: 'b2', ids: Array.from({ length: 65 }, (_, i) => `auth-${String(i).padStart(64, '0')}`) });
+      deliver(N, s, { type: 'authority-fetch', reqId: 'b3', ids: [sid(gA), sid(gA)] });
+      deliver(N, s, { type: 'authority-fetch', reqId: 'x'.repeat(129), ids: [sid(gA)] });
+      assert.strictEqual(sent.length, n);
+    } finally { await stopAll(); }
+  });
+
+  it('answers are paced per session: the burst at once, the rest in turn at 4 a second, at most 64 waiting; a repeated full pull is answered', async () => {
+    try {
+      const { N, s, sent } = rig();
+      const { SERVE_BURST, SERVE_QUEUE_MAX } = require('../lib/node-authority');
+      N.submitAuthority(grant('anchor', party(), 'participant'));
+      deliver(N, s, { type: 'authority-fetch', reqId: 'full-1', after: '' });
+      deliver(N, s, { type: 'authority-fetch', reqId: 'full-2', after: '' });
+      assert.ok(sent.some((f) => f.reqId === 'full-1') && sent.some((f) => f.reqId === 'full-2'), 'sym does not refuse a fresh full pull');
+      const answered = () => sent.filter((f) => f.type === 'authority-set').length;
+      for (let i = 0; i < SERVE_BURST + SERVE_QUEUE_MAX + 5; i++) deliver(N, s, { type: 'authority-fetch', reqId: `q${i}`, ids: [`auth-${'1'.repeat(64)}`] });
+      const now = answered();
+      assert.ok(now >= SERVE_BURST && now <= SERVE_BURST + 1, `the burst is answered at once (${now})`);
+      assert.strictEqual(s._authServeQueue.length, SERVE_QUEUE_MAX, 'the rest wait, at most 64; past that a request is dropped');
+      await until(() => answered() >= now + 2, 2000);
+      assert.ok(answered() >= now + 2, 'and the waiting ones are answered in turn');
+    } finally { await stopAll(); }
+  });
+
+  it('a statement whose chain is not held is pending for its session: one fetch per missing id, at most 64 held, released with the session', async () => {
+    try {
+      const { N, s, sent } = rig({ gossipBudget: { newLane: 1e6, burst: 1e6 } });
+      const gA = grant('anchor', party(), 'admin');
+      const kids = Array.from({ length: 70 }, () => grant(gA, party(), 'participant'));
+      for (const k of kids) deliver(N, s, { type: 'authority-statement', statement: k });
+      assert.strictEqual(s._authPending.size, A.AUTHORITY_PENDING_MAX);
+      const fetches = sent.filter((f) => f.type === 'authority-fetch');
+      assert.deepStrictEqual(fetches.map((f) => f.ids), [[sid(gA)]], 'one fetch in flight for the missing id');
+      // The answer to that fetch brings the chain: the pending statements come into force.
+      deliver(N, s, { type: 'authority-set', reqId: fetches[0].reqId, statements: [gA] });
+      await until(() => N._authority.size() === 65, 2000);
+      assert.strictEqual(N._authority.size(), 1 + A.AUTHORITY_PENDING_MAX);
+      assert.strictEqual(s._authPending.size, 0);
+      // An answer nobody asked for is not ingested.
+      const stray = grant('anchor', party(), 'admin');
+      deliver(N, s, { type: 'authority-set', reqId: 'never-asked', statements: [stray] });
+      assert.strictEqual(N._authority.has(sid(stray)), false);
+      // A session closing releases what it held.
+      deliver(N, s, { type: 'authority-statement', statement: grant(stray, party(), 'participant') });
+      assert.strictEqual(s._authPending.size, 1);
+      N._authorityReleaseSession(s);
+      assert.strictEqual(s._authPending, null);
+    } finally { await stopAll(); }
+  });
+
+  it('the lane is charged for keys not seen before, and repeats and statements not of the shape are free', async () => {
+    try {
+      const { N, s } = rig();
+      const { FRESH_KEY_COST } = require('../lib/node-authority');
+      N._gossipClock = () => 1_000_000; // a still clock: the lane does not refill during the test
+      // A new peer's lane holds 100 checks; each grant names a fresh subject key (and the first, a fresh
+      // signing key): 1 + 16 per fresh key, so about six are verified and the rest are over budget.
+      const flood = Array.from({ length: 40 }, () => grant('anchor', party(), 'participant'));
+      for (const f of flood) deliver(N, s, { type: 'authority-statement', statement: f });
+      const held = N._authority.size();
+      assert.ok(held >= 2 && held <= Math.floor(100 / (1 + FRESH_KEY_COST)), `a sixteenth of the checks (${held} held)`);
+      assert.ok(N.authorityStatus().stats.overBudget > 0);
+      // A repeat of a held statement, and a statement not of the shape, cost nothing.
+      const tokens = () => N._gossipBuckets.get(s.nodeId).tokens;
+      const before = tokens();
+      const heldOne = flood.find((f) => N._authority.has(sid(f)));
+      for (let i = 0; i < 500; i++) deliver(N, s, { type: 'authority-statement', statement: heldOne });
+      for (let i = 0; i < 500; i++) deliver(N, s, { type: 'authority-statement', statement: { ...heldOne, nonce: 'short' } });
+      assert.ok(tokens() >= before, 'nothing was spent');
+      assert.ok(N.authorityStatus().stats.duplicate >= 500);
+    } finally { await stopAll(); }
+  });
+
+  it('a differing digest starts a pull; an equal one does not; a malformed one is ignored', async () => {
+    try {
+      const { N, s, sent } = rig();
+      N.submitAuthority(grant('anchor', party(), 'participant'));
+      deliver(N, s, { type: 'authority-digest', root: N.authorityRoot(), count: 1 });
+      deliver(N, s, { type: 'authority-digest', root: 'nothex', count: 1 });
+      assert.ok(!sent.some((f) => f.type === 'authority-fetch'));
+      deliver(N, s, { type: 'authority-digest', root: 'a'.repeat(64), count: 3 });
+      const pull = sent.filter((f) => f.type === 'authority-fetch');
+      assert.strictEqual(pull.length, 1);
+      assert.strictEqual(pull[0].after, '');
+    } finally { await stopAll(); }
+  });
+
+  it('the retired time-replay frames are ignored, counted, and never sent', async () => {
+    try {
+      const { N, s, sent } = rig();
+      for (const type of RETIRED_FRAMES) deliver(N, s, { type, grant: { type: 'role-grant', role: 'anchor' } });
+      assert.strictEqual(N.authorityStatus().stats.retired, RETIRED_FRAMES.size);
+      assert.strictEqual(N._authority.size(), 0);
+      assert.ok(!sent.some((f) => RETIRED_FRAMES.has(f.type)));
+    } finally { await stopAll(); }
+  });
+
+  it('with no anchor pinned the frames do nothing and nothing is sent', async () => {
+    try {
+      const N = node('auth-unanchored', { anchor: null });
+      const s = admitAs(N, identity('u'));
+      deliver(N, s, { type: 'authority-statement', statement: grant('anchor', party(), 'admin') });
+      deliver(N, s, { type: 'authority-fetch', reqId: 'q', after: '' });
+      deliver(N, s, { type: 'authority-digest', root: 'a'.repeat(64), count: 1 });
+      assert.strictEqual(N._authority.size(), 0);
+      assert.deepStrictEqual(s.sent.filter((f) => /^authority-/.test(f.type)), []);
+    } finally { await stopAll(); }
+  });
+});
+
+describe('§6.6.9 and §6.6.10 on a node', () => {
+  it('an in-force grant is a binding source; a conflicting one leaves the binding as it was; one naming this node with a foreign key confers nothing and is reported', async () => {
+    try {
+      const N = node('auth-view');
+      const p = party(); const q = party(); const qOther = party();
+      N._roster.bind(q.nodeId, q.key, 'proven');
+      const metrics = [];
+      N.on('metric', (m) => metrics.push(m));
+      N.submitAuthority(grant('anchor', p, 'validator'));
+      N.submitAuthority(grant('anchor', { nodeId: q.nodeId, key: qOther.key }, 'admin'));
+      const foreign = grant('anchor', { nodeId: N.nodeId, key: qOther.key }, 'admin');
+      N.submitAuthority(foreign);
+      assert.strictEqual(N._identityKey(p.nodeId), p.key, 'the grant taught the key');
+      assert.strictEqual(N._identityKey(q.nodeId), q.key, 'a proven binding stays');
+      assert.strictEqual(N.resolveRole(q.nodeId), 'participant', 'roles follow the key the node is bound to');
+      assert.strictEqual(N.resolveRole(N.nodeId), 'participant', 'a grant to this nodeId with a foreign key confers nothing');
+      assert.ok(metrics.some((m) => m.type === 'authority-foreign-self-key' && m.id === sid(foreign)));
+    } finally { await stopAll(); }
+  });
+
+  it('a received record\'s origin role is its author\'s authority over it now; a scoped grant counts only inside its scope', async () => {
+    try {
+      const world = (p, cmb) => !!(cmb && cmb.world === p);
+      const N = node('auth-origin', { authorityScopes: { 'test-world': world } });
+      const admin = party(); const scoped = party();
+      const gAdmin = grant('anchor', admin, 'admin');
+      N.submitAuthority(gAdmin);
+      N.submitAuthority(grant('anchor', scoped, 'validator', 'test-world:w1'));
+      const msg = (who, cmb) => ({ _cmbVerified: true, _verifiedAuthorNodeId: who.nodeId, _authorKey: who.key, cmb });
+      assert.strictEqual(N._authorOriginRole(msg(admin, {})), 'admin');
+      assert.strictEqual(N._authorOriginRole(msg(scoped, { world: 'w1' })), 'validator');
+      assert.strictEqual(N._authorOriginRole(msg(scoped, { world: 'w2' })), 'participant');
+      assert.strictEqual(N._authorOriginRole({ ...msg(admin, {}), _cmbVerified: false }), 'participant', 'an unverified record counts with nothing');
+      N.submitAuthority(revoke('anchor', [gAdmin]));
+      assert.strictEqual(N._authorOriginRole(msg(admin, {})), 'participant', 'judged when used: the revoke is in force');
+    } finally { await stopAll(); }
+  });
+});
+
+describe('§6.6.7: persistence carries no authority of its own', () => {
+  it('at load every statement is verified again against the pin, in any file order; forgeries and junk are dropped, and no status is stored', async () => {
+    const name = uniq('auth-persist');
+    let nodeId = null;
+    try {
+      const { all } = scenery();
+      const want = offline(all);
+      const N = new SymNode({ name, silent: true, discovery: new NullDiscovery(), room: 'auth', anchor: PIN });
+      nodeId = N.nodeId;
+      for (const s of all) N.submitAuthority(s);
+      assert.strictEqual(N.authorityRoot(), want.root());
+      await N.stop();
+      const file = path.join(nodeDirById(nodeId), 'authority', `statements-${A.pinDigest(A.parsePin(PIN))}.jsonl`);
+      const lines = fs.readFileSync(file, 'utf8').split('\n').filter(Boolean);
+      for (const l of lines) {
+        const o = JSON.parse(l);
+        for (const k of Object.keys(o)) assert.ok(['kind', 'authorisedBy', 'subject', 'role', 'scope', 'targets', 'nonce', 'issuedAt', 'sigs'].includes(k), `only statement members on disk (${k})`);
+      }
+      const planted = grant('anchor', party(), 'admin');
+      planted.sigs = [{ key: anchorKey.key, sig: all[5].sigs[0].sig }];
+      fs.writeFileSync(file, [...shuffled(lines), JSON.stringify(planted), '{not json'].join('\n') + '\n');
+      const N2 = new SymNode({ name, nodeId, create: false, silent: true, discovery: new NullDiscovery(), room: 'auth', anchor: PIN });
+      assert.strictEqual(N2.authorityRoot(), want.root());
+      assert.strictEqual(N2._authority.has(sid(planted)), false);
+      assert.strictEqual(N2._authority.loadReport().invalid, 2);
+      await N2.stop();
+      // Under another pin nothing is held, and the statements verified under this pin are left as they were.
+      const other = party();
+      const N3 = new SymNode({ name, nodeId, create: false, silent: true, discovery: new NullDiscovery(), room: 'auth', anchor: { threshold: 1, keys: [{ key: other.key }] } });
+      assert.strictEqual(N3._authority.size(), 0);
+      await N3.stop();
+      const N4 = new SymNode({ name, nodeId, create: false, silent: true, discovery: new NullDiscovery(), room: 'auth', anchor: PIN });
+      assert.strictEqual(N4.authorityRoot(), want.root());
+      await N4.stop();
+    } finally { if (nodeId) fs.rmSync(nodeDirById(nodeId), { recursive: true, force: true }); }
+  });
+});
diff --git a/tests/authority-vectors.test.js b/tests/authority-vectors.test.js
new file mode 100644
index 00000000..109145e1
--- /dev/null
+++ b/tests/authority-vectors.test.js
@@ -0,0 +1,203 @@
+'use strict';
+
+/**
+ * MMP §6.6 and §18.3.2 conformance: every case of the published authority-v2 and ed25519-strict-v2
+ * vectors, read from the copies vendored in tests/fixtures (their sha256 checked first against
+ * SOURCES.json, which records the meshcognition-website commit they come from).
+ *
+ * Each authority case is resolved in many orders, and again with forged copies of its statements
+ * mixed in (a copy re-signed by the wrong key, one with a flipped signature bit, an anchor copy short
+ * of the threshold, an anchor copy padded with unpinned and repeated entries): the statuses, the
+ * in-force set, the live set, which bucket keeps each statement, the roles, the lifecycle authority
+ * each subject has inside and outside every scope, the stated bound, and the root must come out the
+ * same every time.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+const A = require('../lib/core/authority');
+const { AuthorityStore, lifecycleOf } = require('../lib/authority-store');
+const { verifyStrict, precheckFailure } = require('../lib/core/ed25519');
+
+const FIX = path.join(__dirname, 'fixtures');
+const sources = JSON.parse(fs.readFileSync(path.join(FIX, 'SOURCES.json'), 'utf8'));
+function vendored(name) {
+  const bytes = fs.readFileSync(path.join(FIX, name));
+  assert.strictEqual(crypto.createHash('sha256').update(bytes).digest('hex'), sources.files[name].sha256, `${name}: the vendored copy is the published one`);
+  return JSON.parse(bytes.toString('utf8'));
+}
+const av = vendored('authority-v2.json');
+const ed = vendored('ed25519-strict-v2.json');
+
+/** A deterministic shuffle. */
+function shuffled(list, seed) {
+  const a = [...list];
+  let x = seed >>> 0 || 1;
+  for (let i = a.length - 1; i > 0; i--) { x = (Math.imul(x, 1103515245) + 12345) >>> 0; const j = x % (i + 1); [a[i], a[j]] = [a[j], a[i]]; }
+  return a;
+}
+/** Offer statements until a pass holds nothing more (what a node's pending holds and pulls do). */
+function feed(store, statements) {
+  const outcome = new Map();
+  let left = statements;
+  for (let progress = true; progress && left.length;) {
+    progress = false;
+    const next = [];
+    for (const s of left) {
+      const r = store.ingest(s);
+      if (r.result !== 'duplicate') outcome.set(s, r); // the last word: pending, then held or invalid
+      if (r.result === 'held') progress = true;
+      else if (r.result === 'pending') next.push(s);
+    }
+    left = next;
+  }
+  return outcome;
+}
+const testKeys = av.testKeys;
+const forgerSeed = Buffer.alloc(32, 0x5f);
+const forger = (() => {
+  const priv = crypto.createPrivateKey({ key: Buffer.concat([Buffer.from('302e020100300506032b657004220420', 'hex'), forgerSeed]), format: 'der', type: 'pkcs8' });
+  const pub = crypto.createPublicKey(priv).export({ type: 'spki', format: 'der' }).subarray(-32).toString('base64url');
+  return { priv: forgerSeed.toString('base64url'), pub };
+})();
+/** Copies of a statement that must change nothing: forged, short or padded. Same id, never valid alone. */
+function forgedCopies(s) {
+  const out = [];
+  const flip = (sig) => { const b = Buffer.from(sig, 'base64url'); b[5] ^= 1; return b.toString('base64url'); };
+  if (s.authorisedBy === 'anchor') {
+    out.push({ ...s, sigs: s.sigs.map((e) => ({ key: e.key, sig: flip(e.sig) })) });
+    out.push({ ...s, sigs: [...s.sigs, { key: forger.pub, sig: s.sigs[0].sig }, s.sigs[0]].slice(0, 16) });
+  } else {
+    out.push({ ...s, sigs: [{ key: s.sigs[0].key, sig: flip(s.sigs[0].sig) }] });
+    const bare = A.canonicalStatement(s, []);
+    out.push(A.signStatement(bare, forger.priv, forger.pub));
+  }
+  return out;
+}
+
+function resolveCase(c, order) {
+  const pin = A.parsePin(av.pins[c.pin]);
+  const store = new AuthorityStore({ pin, quota: c.testQuota, delegateQuota: c.testDelegateQuota });
+  const outcome = feed(store, order);
+  return { store, outcome, r: store.resolve() };
+}
+function statusOf(c, run) {
+  const out = {};
+  for (const l of c.statements) {
+    const id = av.statements[l].expectedId;
+    if (run.store.has(id)) out[l] = run.r.status.get(id);
+    else {
+      const r = run.outcome.get(av.statements[l].statement);
+      out[l] = r && r.result === 'pending' ? 'pending' : 'invalid';
+    }
+  }
+  return out;
+}
+function check(c, run, how) {
+  assert.deepStrictEqual(statusOf(c, run), c.expected.status, `${c.label} (${how}): status`);
+  assert.deepStrictEqual([...run.r.inForce].sort(), [...c.expected.inForce].sort(), `${c.label} (${how}): in force`);
+  assert.deepStrictEqual([...run.r.live].sort(), [...c.expected.live].sort(), `${c.label} (${how}): live`);
+  assert.deepStrictEqual(Object.fromEntries([...run.r.keptBy].sort()), Object.fromEntries(Object.entries(c.expected.keptBy).sort()), `${c.label} (${how}): kept by`);
+  assert.strictEqual(run.r.root, c.expected.root, `${c.label} (${how}): root`);
+  for (const row of c.expected.roles) {
+    const got = run.store.rolesOf(row.nodeId, row.key).map((x) => ({ role: x.role, scope: x.scope }));
+    const key = (x) => `${x.role}|${x.scope}`;
+    assert.deepStrictEqual(got.map(key).sort(), row.roles.map(key).sort(), `${c.label} (${how}): roles of ${row.subject}`);
+    assert.strictEqual(lifecycleOf(got, () => false), row.lifecycle.outsideEveryScope, `${c.label}: ${row.subject} outside every scope`);
+    for (const [scope, level] of Object.entries(row.lifecycle.insideScope)) {
+      assert.strictEqual(lifecycleOf(got, (s) => A.scopeNarrows(s, scope)), level, `${c.label}: ${row.subject} inside ${scope}`);
+    }
+  }
+  if (c.expected.bound) {
+    const top = av.statements[c.expected.bound.below].expectedId;
+    const below = [...run.r.inForce].filter((id) => run.store._held.get(id).chain.includes(top));
+    const delegating = below.filter((id) => { const e = run.store._held.get(id); return e.kind === 'grant' && A.isDelegating(e.role); });
+    assert.strictEqual(below.length, c.expected.bound.inForceBelow, `${c.label}: in force below ${c.expected.bound.below}`);
+    assert.strictEqual(delegating.length, c.expected.bound.delegatingBelow, `${c.label}: delegating below`);
+    assert.ok(below.length <= c.expected.bound.maxStatements && delegating.length <= c.expected.bound.maxDelegating, `${c.label}: within the bound`);
+  }
+}
+
+describe('authority-v2 (MMP §6.6): statements, ids and pins', () => {
+  it('every statement\'s payload and id reproduce exactly; a mutated one is another statement that no longer verifies', () => {
+    for (const [label, x] of Object.entries(av.statements)) {
+      assert.strictEqual(A.payload(x.statement).toString('hex'), x.expectedPayloadHex, `${label}: payload`);
+      assert.strictEqual(A.statementId(x.statement), x.expectedId, `${label}: id`);
+    }
+    const g = av.statements.gV.statement;
+    const mutated = { ...g, role: 'admin' };
+    assert.notStrictEqual(A.statementId(mutated), av.statements.gV.expectedId);
+    assert.strictEqual(verifyStrict(A.payload(mutated), g.sigs[0].key, g.sigs[0].sig), false);
+    assert.strictEqual(A.statementId({ ...g, sigs: [] }), av.statements.gV.expectedId, 'the id excludes the signatures');
+  });
+
+  it('every pin digest reproduces', () => {
+    for (const [name, p] of Object.entries(av.pins)) assert.strictEqual(A.pinDigest(A.parsePin(p)), p.expectedPinDigest, name);
+  });
+
+  it('the constants are §19.1\'s', () => {
+    assert.deepStrictEqual(av.constants, { MAX_DELEGATION_DEPTH: A.MAX_DELEGATION_DEPTH, AUTHORITY_QUOTA: A.AUTHORITY_QUOTA, AUTHORITY_ANCHOR_QUOTA: A.AUTHORITY_ANCHOR_QUOTA, AUTHORITY_DELEGATE_QUOTA: A.AUTHORITY_DELEGATE_QUOTA });
+    void testKeys;
+  });
+});
+
+describe('authority-v2 (MMP §6.6): every case, in every order, with forged copies', () => {
+  for (const c of av.cases) {
+    it(c.label, () => {
+      const statements = c.statements.map((l) => av.statements[l].statement);
+      check(c, resolveCase(c, statements), 'as listed');
+      check(c, resolveCase(c, [...statements].reverse()), 'reversed');
+      for (let seed = 1; seed <= 6; seed++) check(c, resolveCase(c, shuffled(statements, seed * 7919 + c.label.length)), `shuffle ${seed}`);
+      // Forged copies first, then the genuine statements, shuffled: nothing a forgery says counts.
+      const forged = statements.flatMap(forgedCopies);
+      check(c, resolveCase(c, [...shuffled(forged, 3), ...shuffled(statements, 11)]), 'forged copies first');
+      check(c, resolveCase(c, shuffled([...forged, ...statements], 17)), 'forged copies mixed in');
+    });
+  }
+});
+
+describe('authority-v2 (MMP §6.6.8): authority order and pages', () => {
+  it('a page of the live set sends every statement after its chain, the revokes and endorses at a depth before its grants', () => {
+    for (const c of av.cases) {
+      const { store, r } = resolveCase(c, c.statements.map((l) => av.statements[l].statement));
+      const seen = new Set();
+      let after = '';
+      let all = [];
+      for (let guard = 0; guard < 100; guard++) {
+        const p = store.page(after);
+        all = all.concat(p.statements);
+        if (!p.next) break;
+        after = p.next;
+      }
+      assert.strictEqual(all.length, r.live.size, `${c.label}: the pages hold the live set`);
+      let last = null;
+      for (const s of all) {
+        const id = A.statementId(s);
+        if (s.authorisedBy !== 'anchor') assert.ok(seen.has(s.authorisedBy), `${c.label}: a chain comes first`);
+        const k = [store.depthOf(id), s.kind === 'grant' ? 1 : 0, id];
+        if (last) assert.ok(k[0] > last[0] || (k[0] === last[0] && (k[1] > last[1] || (k[1] === last[1] && k[2] > last[2]))), `${c.label}: authority order`);
+        last = k;
+        seen.add(id);
+      }
+      // A second node fed only the pages resolves the same root.
+      const other = new AuthorityStore({ pin: A.parsePin(av.pins[c.pin]), quota: c.testQuota, delegateQuota: c.testDelegateQuota });
+      for (const s of all) assert.strictEqual(other.ingest(s).result, 'held', `${c.label}: a page is ingested as it arrives`);
+      assert.strictEqual(other.root(), r.root, `${c.label}: the live set is enough to recompute the root`);
+    }
+  });
+});
+
+describe('ed25519-strict-v2 (MMP §18.3.2): the one verification rule', () => {
+  for (const c of ed.cases) {
+    it(c.label, () => {
+      const m = Buffer.from(c.messageHex, 'hex');
+      const key = Buffer.from(c.publicKeyHex, 'hex');
+      const sig = Buffer.from(c.signatureHex, 'hex');
+      assert.strictEqual(verifyStrict(m, key, sig) ? 'accept' : 'reject', c.expected);
+      assert.strictEqual(precheckFailure(key, sig), c.precheckFailure || null);
+    });
+  }
+});
diff --git a/tests/core-secure-authority.test.js b/tests/core-secure-authority.test.js
deleted file mode 100644
index 805f814f..00000000
--- a/tests/core-secure-authority.test.js
+++ /dev/null
@@ -1,133 +0,0 @@
-'use strict';
-
-require('./_isolate-home'); // redirect $HOME before lib/config loads
-
-/**
- * Design D3 — authority follows the key.
- *   - resolveRole(nodeId, key, at): a grant confers its role only when its granteeKey is the key the
- *     subject holds, so an id claimed under another key is a participant.
- *   - Grant chains are verified top-down with the key each verified grant vouches, never with the key
- *     the registry holds for the grantor: a grantor bound to an impostor keeps exactly the authority
- *     of its vouched key, and the impostor gets none.
- *   - Every role-grant carries granteeKey; grantRole refuses without a proven key for the grantee.
- */
-
-const { describe, it } = require('node:test');
-const assert = require('node:assert');
-const crypto = require('crypto');
-const fs = require('fs');
-const { RoleGrantStore } = require('../lib/role-grant-store');
-const { RosterKeyRegistry } = require('../lib/roster-keys');
-const { SymNode } = require('../lib/node');
-const { NullDiscovery } = require('../lib/discovery');
-const { nodeDir, loadOrCreateIdentity } = require('../lib/config');
-const { signGrant } = require('../lib/core');
-
-function kp(nodeId) {
-  const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519');
-  return {
-    // nodeIds are canonical lowercase at every door, a grant's included (security review B).
-    nodeId: nodeId.toLowerCase(),
-    priv: privateKey.export({ format: 'der', type: 'pkcs8' }).subarray(16).toString('base64url'),
-    pub: publicKey.export({ format: 'der', type: 'spki' }).subarray(12).toString('base64url'),
-  };
-}
-const T = 1_000_000;
-const grant = (grantee, granteeKey, role, grantor, at) =>
-  signGrant({ type: 'role-grant', grantee: grantee.nodeId, granteeKey, role, grantedBy: grantor.nodeId, grantedAt: at }, grantor.priv);
-
-describe('authority follows the key (D3)', () => {
-  it('a grant confers its role only on the key it names', () => {
-    const A = kp('A'), V = kp('V'), impostor = kp('V');
-    const st = new RoleGrantStore({ anchor: { nodeId: A.nodeId, publicKey: A.pub } });
-    assert.strictEqual(st.record(grant(V, V.pub, 'validator', A, T)).stored, true);
-    assert.strictEqual(st.resolveRole(V.nodeId, V.pub, T + 1), 'validator');
-    assert.strictEqual(st.resolveRole(V.nodeId, impostor.pub, T + 1), 'participant', 'the same id under another key holds nothing');
-    assert.strictEqual(st.resolveRole(A.nodeId, impostor.pub, T + 1), 'participant', 'not even the anchor id');
-    assert.strictEqual(st.resolveRole(A.nodeId, A.pub, T + 1), 'anchor');
-  });
-
-  it('a grantor bound to an impostor: its chain is verified with the vouched key, and the impostor gets nothing', () => {
-    const A = kp('A'), G = kp('G'), impG = kp('G'), X = kp('X'), Y = kp('Y');
-    const reg = new RosterKeyRegistry({ anchor: { nodeId: A.nodeId, publicKey: A.pub } });
-    // The impostor proved first contact under G's id; the registry holds the impostor's key for G.
-    reg.bind(G.nodeId, impG.pub, 'proven');
-    const st = new RoleGrantStore({ anchor: { nodeId: A.nodeId, publicKey: A.pub }, keys: reg });
-    // The anchor vouches G's real key.
-    assert.strictEqual(st.record(grant(G, G.pub, 'validator', A, T)).stored, true);
-    assert.strictEqual(reg.get(G.nodeId), impG.pub, 'the registry binding is not repointed');
-    assert.strictEqual(reg.conflicts().length, 1, 'the vouch against it is a recorded conflict');
-    // A grant the real G signs verifies against its vouched key and confers.
-    assert.strictEqual(st.record(grant(X, X.pub, 'validator', G, T + 10)).stored, true);
-    assert.strictEqual(st.resolveRole(X.nodeId, X.pub, T + 20), 'validator');
-    // A grant the impostor signs as G is checked against the vouched key, not the registry's: refused.
-    assert.strictEqual(st.record(grant(Y, Y.pub, 'validator', impG, T + 10)).reason, 'bad-signature');
-    assert.strictEqual(st.resolveRole(Y.nodeId, Y.pub, T + 20), 'participant');
-    // And the impostor itself, holding the id under its own key, is a participant.
-    assert.strictEqual(st.resolveRole(G.nodeId, impG.pub, T + 20), 'participant');
-    assert.strictEqual(st.resolver()(G.nodeId, T + 20), 'participant', 'the registry-bound key resolves to nothing');
-  });
-
-  it('a grant chain is verified with vouched keys, hop by hop, in any file order', () => {
-    const dir = fs.mkdtempSync(require('path').join(require('os').tmpdir(), 'rg-chain-'));
-    try {
-      const A = kp('A'), B = kp('B'), C = kp('C'), D = kp('D');
-      const recs = [
-        grant(D, D.pub, 'validator', C, T + 30),
-        grant(C, C.pub, 'validator', B, T + 20),
-        grant(B, B.pub, 'validator', A, T + 10),
-      ];
-      fs.writeFileSync(require('path').join(dir, 'role-grants.jsonl'), recs.map((r) => JSON.stringify(r)).join('\n') + '\n');
-      // The registry knows none of B, C, D: nothing but the anchor and the chain itself verifies.
-      const st = new RoleGrantStore({ anchor: { nodeId: A.nodeId, publicKey: A.pub }, dir, keys: new RosterKeyRegistry() });
-      assert.strictEqual(st.loadReport().loaded, 3);
-      assert.strictEqual(st.resolveRole(D.nodeId, D.pub, T + 40), 'validator');
-      // A link whose vouched key is not the one that signed the next hop breaks the chain below it.
-      const E = kp('E'), Cfake = kp('C');
-      const st2 = new RoleGrantStore({ anchor: { nodeId: A.nodeId, publicKey: A.pub } });
-      st2.record(grant(B, B.pub, 'validator', A, T + 10));
-      st2.record(grant(C, C.pub, 'validator', B, T + 20));
-      assert.strictEqual(st2.record(grant(E, E.pub, 'validator', Cfake, T + 30)).reason, 'bad-signature');
-    } finally { fs.rmSync(dir, { recursive: true, force: true }); }
-  });
-
-  it('a role-grant without granteeKey is malformed, on the wire and on disk', () => {
-    const A = kp('A'), V = kp('V');
-    const st = new RoleGrantStore({ anchor: { nodeId: A.nodeId, publicKey: A.pub } });
-    const bare = signGrant({ type: 'role-grant', grantee: V.nodeId, role: 'validator', grantedBy: A.nodeId, grantedAt: T }, A.priv);
-    assert.strictEqual(st.record(bare).reason, 'malformed');
-    const revoke = signGrant({ type: 'role-revoke', grantee: V.nodeId, grantedBy: A.nodeId, grantedAt: T }, A.priv);
-    assert.strictEqual(st.record(revoke).stored, true, 'a revoke names no key: it clears the id whatever key it holds');
-  });
-});
-
-describe('grantRole names a proven key (D3)', () => {
-  function anchorNode() {
-    const name = `d3-anchor-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
-    const id = loadOrCreateIdentity(name);
-    const node = new SymNode({ name, silent: true, discovery: new NullDiscovery(), room: 'g', anchor: { nodeId: id.nodeId, publicKey: id.publicKey } });
-    return { node, name };
-  }
-
-  it('refuses a grantee with no key, a legacy claim or a grant-vouched key; takes a proven or pinned one', () => {
-    const { node, name } = anchorNode();
-    try {
-      const sent = [];
-      node._gossipToRoster = (f) => sent.push(f);
-      const [P, L, G, Q] = ['p', 'l', 'g', 'q'].map(kp);
-      assert.strictEqual(node.grantRole(P.nodeId, 'validator'), null, 'no key at all');
-      node._roster.bind(L.nodeId, L.pub, 'legacy-claim');
-      assert.strictEqual(node.grantRole(L.nodeId, 'validator'), null, 'an unproven hello is not a proof');
-      node._roster.bind(G.nodeId, G.pub, 'grant');
-      assert.strictEqual(node.grantRole(G.nodeId, 'validator'), null, 'a vouched key is not this node\'s proof');
-      assert.deepStrictEqual(sent, [], 'nothing was sent for any of them');
-      node._roster.bind(P.nodeId, P.pub, 'proven');
-      const g = node.grantRole(P.nodeId, 'validator');
-      assert.strictEqual(g.granteeKey, P.pub);
-      node._roster.bind(Q.nodeId, Q.pub, 'pinned');
-      assert.strictEqual(node.grantRole(Q.nodeId, 'validator').granteeKey, Q.pub);
-      assert.strictEqual(node.grantRole(L.nodeId, 'validator', { granteeKey: L.pub }).granteeKey, L.pub, 'or the operator names the key');
-      assert.strictEqual(node.resolveRole(P.nodeId), 'validator');
-    } finally { node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
-  });
-});
diff --git a/tests/core-secure-final-review.test.js b/tests/core-secure-final-review.test.js
index 43193c16..a75f2eb9 100644
--- a/tests/core-secure-final-review.test.js
+++ b/tests/core-secure-final-review.test.js
@@ -8,8 +8,7 @@ require('./_isolate-home'); // redirect $HOME before lib/config loads
  * /private/tmp/claude-501/-Users-hongwei-sym-agent-a/sym-014-final-review/ (grant-probes.js P1-P4,
  * node-probes.js Q1, digest-churn.js, fork-a, fork-b).
  *
- *   A  the kept grant set is a function of the records held (Findings 1, 2)
- *   B  the anchor ratifies; a revoked key gains nothing by backdating (Finding 4, Low 8a)
+ *   A, B  retired with the time-replay grant rule (MMP §6.6; see below)
  *   C  the interior read side is scoped to the mind's mission (Finding 6)
  *   3  the cost of relayed forgeries is bounded without blaming the relayer
  *   7  relocation: in-process locks, replays, staging, modes, the header checked first
@@ -28,8 +27,6 @@ const relocation = require('../lib/relocation');
 const { SymNode } = require('../lib/node');
 const { NullDiscovery } = require('../lib/discovery');
 const { nodeDirById } = require('../lib/config');
-const { RoleGrantStore } = require('../lib/role-grant-store');
-const { signGrant, signAttestation } = require('../lib/core');
 const { identity, connectNodes, until, signedRecord, admitAs, deliver } = require('./_core-secure');
 
 const uniq = (b) => `${b}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
@@ -37,228 +34,14 @@ function mk(base, extra = {}) { return new SymNode({ name: uniq(base), silent: t
 async function stopAll(...nodes) {
   for (const n of nodes) { try { await n.stop(); } catch { /* */ } try { fs.rmSync(nodeDirById(n.nodeId), { recursive: true, force: true }); } catch { /* */ } }
 }
-function kp() {
-  const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519');
-  return { nodeId: crypto.randomUUID(), priv: privateKey.export({ format: 'der', type: 'pkcs8' }).subarray(16).toString('base64url'), pub: publicKey.export({ format: 'der', type: 'spki' }).subarray(12).toString('base64url') };
-}
-const grantOf = (type, grantee, role, grantor, at, extra = {}) => signGrant({ type, grantee: grantee.nodeId, ...(role ? { role } : {}), grantedBy: grantor.nodeId, grantedAt: at, ...(type === 'role-grant' ? { granteeKey: grantee.pub } : {}), ...extra }, grantor.priv);
-const DAY = 86_400_000;
-
-/** Offer `records` in `order` until a pass keeps nothing (as a load, or a chain fetch, does). */
-function feed(store, records) {
-  let left = records;
-  for (let progress = true; progress && left.length;) {
-    progress = false;
-    const next = [];
-    for (const g of left) {
-      const r = store.record(g);
-      if (r.stored) progress = true;
-      else if (r.reason === 'unknown-grantor-key') next.push(g);
-    }
-    left = next;
-  }
-}
-/** A deterministic shuffle. */
-function shuffled(list, seed) {
-  const a = [...list];
-  let x = seed;
-  for (let i = a.length - 1; i > 0; i--) { x = (x * 1103515245 + 12345) & 0x7fffffff; const j = x % (i + 1); [a[i], a[j]] = [a[j], a[i]]; }
-  return a;
-}
-
-describe('A: the kept grant set is a function of the records held (Findings 1 and 2)', () => {
-  it('stores fed the same records in different orders keep the same records and resolve the same authority, with full budgets, cutoffs and ratifications', () => {
-    const A = kp(), V = kp(), Q = kp(), W = kp(), X = kp(), M = kp();
-    const t0 = Date.now() - 30 * DAY;
-    const sybils = Array.from({ length: 5 }, () => kp());
-    const rVW = grantOf('role-revoke', W, undefined, V, t0 + 2 * DAY, { cutoff: t0 + 2 * DAY });
-    const records = [
-      grantOf('role-grant', V, 'validator', A, t0),
-      grantOf('role-grant', Q, 'validator', A, t0),
-      grantOf('role-grant', M, 'validator', A, t0),
-      grantOf('role-grant', W, 'validator', A, t0 + 1),
-      grantOf('role-grant', X, 'validator', V, t0 + 5 * DAY),
-      rVW,
-      grantOf('role-revoke', V, undefined, A, t0 + 10 * DAY, { cutoff: t0 + 3 * DAY, ratify: [rVW.sig] }),
-      grantOf('role-revoke', X, undefined, Q, t0 + 11 * DAY, { cutoff: t0 + 11 * DAY }),
-      grantOf('role-revoke', X, undefined, Q, t0 + 12 * DAY, { cutoff: t0 + 6 * DAY }),
-      ...sybils.map((y, i) => grantOf('role-grant', y, 'validator', M, t0 + 20 + i)),
-      ...sybils.flatMap((y, i) => [grantOf('role-revoke', W, undefined, y, t0 + 30 + i, { cutoff: t0 + 30 + i }), grantOf('role-grant', kp(), 'validator', y, t0 + 40 + i)]),
-    ];
-    const roles = (s) => [V, Q, W, X, M, ...sybils].map((n) => [s.resolveRole(n.nodeId, n.pub, Date.now()), s.resolveRole(n.nodeId, n.pub, t0 + 4 * DAY)].join('/'));
-    let first = null;
-    for (let seed = 1; seed <= 12; seed++) {
-      const s = new RoleGrantStore({ anchor: { nodeId: A.nodeId, publicKey: A.pub }, subtreeBudget: 6 });
-      feed(s, seed === 1 ? records : shuffled(records, seed));
-      const view = { digest: s.digest().digest, size: s.size(), roles: roles(s) };
-      if (!first) first = view;
-      else assert.deepStrictEqual(view, first, `order ${seed}`);
-    }
-    assert.ok(first.size < records.length, 'the budget bound M\'s subtree');
-  });
-
-  it('a grant and a revoke signed in the same millisecond resolve alike whichever was kept first', () => {
-    const A = kp(), V = kp();
-    const t = Date.now() - DAY;
-    const g = grantOf('role-grant', V, 'validator', A, t);
-    const r = grantOf('role-revoke', V, undefined, A, t, { cutoff: t });
-    const X = new RoleGrantStore({ anchor: { nodeId: A.nodeId, publicKey: A.pub } });
-    const Y = new RoleGrantStore({ anchor: { nodeId: A.nodeId, publicKey: A.pub } });
-    X.record(g); X.record(r);
-    Y.record(r); Y.record(g);
-    assert.deepStrictEqual([X.resolveRole(V.nodeId, V.pub, Date.now()), Y.resolveRole(V.nodeId, V.pub, Date.now())], ['participant', 'participant']);
-  });
-
-  it('P2: a grant signed by a grantor revoked from before it is kept by every store, whatever arrived first (equal digests)', () => {
-    const A = kp(), P = kp(), X = kp();
-    const t0 = Date.now() - 30 * DAY;
-    const gP = grantOf('role-grant', P, 'validator', A, t0);
-    const gX = grantOf('role-grant', X, 'validator', P, t0 + 5 * DAY);
-    const rP = grantOf('role-revoke', P, undefined, A, t0 + 10 * DAY, { cutoff: t0 + 3 * DAY });
-    const B = new RoleGrantStore({ anchor: { nodeId: A.nodeId, publicKey: A.pub } });
-    const C = new RoleGrantStore({ anchor: { nodeId: A.nodeId, publicKey: A.pub } });
-    for (const g of [gP, gX, rP]) assert.strictEqual(B.record(g).stored, true);
-    for (const g of [gP, rP, gX]) assert.strictEqual(C.record(g).stored, true, 'never refused as unrooted');
-    assert.strictEqual(B.digest().digest, C.digest().digest);
-    assert.deepStrictEqual([B.resolveRole(X.nodeId, X.pub, Date.now()), C.resolveRole(X.nodeId, X.pub, Date.now())], ['participant', 'participant']);
-  });
-
-  it('P4 / revoke-tighten: a revoker tightens its cutoff with a second revoke, and stores agree whichever came first', () => {
-    const A = kp(), Q = kp(), P = kp();
-    const t = (n) => 1_000_000 + n * 1000;
-    const base = [grantOf('role-grant', Q, 'validator', A, t(0)), grantOf('role-grant', P, 'validator', Q, t(1))];
-    const r5 = grantOf('role-revoke', P, undefined, Q, t(5), { cutoff: t(5) });
-    const r2 = grantOf('role-revoke', P, undefined, Q, t(6), { cutoff: t(2) });
-    const X = new RoleGrantStore({ anchor: { nodeId: A.nodeId, publicKey: A.pub } });
-    const Y = new RoleGrantStore({ anchor: { nodeId: A.nodeId, publicKey: A.pub } });
-    for (const b of base) { X.record(b); Y.record(b); }
-    assert.deepStrictEqual([X.record(r5).stored, X.record(r2).stored], [true, true]);
-    assert.deepStrictEqual([Y.record(r2).stored, Y.record(r5).stored], [true, true]);
-    assert.strictEqual(X.digest().digest, Y.digest().digest);
-    assert.deepStrictEqual([X.resolveRole(P.nodeId, P.pub, t(3)), Y.resolveRole(P.nodeId, P.pub, t(3))], ['participant', 'participant'], 'P untrusted from t2, as Q meant');
-  });
-
-  it('P3: one validator\'s sybil tree stays inside its subtree budget, and resolution of its target stays bounded', () => {
-    const A = kp(), M = kp(), T = kp();
-    const s = new RoleGrantStore({ anchor: { nodeId: A.nodeId, publicKey: A.pub }, subtreeBudget: 8 });
-    const t0 = Date.now() - 30 * DAY;
-    s.record(grantOf('role-grant', M, 'validator', A, t0));
-    s.record(grantOf('role-grant', T, 'validator', A, t0));
-    const sybils = [];
-    for (let i = 0; i < 3; i++) { const y = kp(); sybils.push(y); s.record(grantOf('role-grant', y, 'validator', M, t0 + 1 + i)); }
-    for (const y of sybils) for (let j = 0; j < 2; j++) s.record(grantOf('role-grant', { nodeId: T.nodeId, pub: kp().pub }, 'validator', y, t0 + 10 + j));
-    for (const sg of [M, ...sybils]) for (let k = 0; k < 50; k++) s.record(grantOf('role-revoke', T, undefined, sg, t0 + 1000 + k, { cutoff: t0 + 1000 + k }));
-    assert.strictEqual(s.size(), 2 + 8, 'the anchor\'s two, and M\'s subtree at its budget');
-    assert.ok(s.grantsFor(T.nodeId).length <= 1 + 8, 'what a resolution of T replays is bounded by the budget');
-  });
 
-  it('digest-churn: two nodes that learned the same records in different orders run no whole-store sync', async () => {
-    const A = kp(), P = kp(), X = kp();
-    const t0 = Date.now() - 30 * DAY;
-    const gP = grantOf('role-grant', P, 'validator', A, t0);
-    const gX = grantOf('role-grant', X, 'validator', P, t0 + 5 * DAY);
-    const rP = grantOf('role-revoke', P, undefined, A, t0 + 10 * DAY, { cutoff: t0 + 3 * DAY });
-    const B = mk('churn-b', { anchor: { nodeId: A.nodeId, publicKey: A.pub } });
-    const C = mk('churn-c', { anchor: { nodeId: A.nodeId, publicKey: A.pub } });
-    try {
-      await B.start(); await C.start();
-      for (const g of [gP, gX, rP]) B._roleGrants.record(g);
-      for (const g of [gP, rP, gX]) C._roleGrants.record(g);
-      await connectNodes(B, C);
-      await new Promise((r) => setTimeout(r, 300));
-      assert.strictEqual(B._roleGrants.digest().digest, C._roleGrants.digest().digest);
-      assert.deepStrictEqual([B._chainStats.synced || 0, C._chainStats.synced || 0], [0, 0], 'no whole-store sync');
-    } finally { await stopAll(B, C); }
-  });
-});
-
-describe('B: the anchor ratifies; a revoked key gains nothing by backdating (Finding 4)', () => {
-  it('P1: a revoke a revoked validator signs later, dated before its cutoff, changes nothing at any time', () => {
-    const A = kp(), V = kp(), W = kp();
-    const t0 = Date.now() - 30 * DAY;
-    const s = new RoleGrantStore({ anchor: { nodeId: A.nodeId, publicKey: A.pub } });
-    s.record(grantOf('role-grant', V, 'validator', A, t0));
-    s.record(grantOf('role-grant', W, 'validator', A, t0 + 1));
-    s.record(grantOf('role-revoke', V, undefined, A, t0 + 20 * DAY)); // a 0.13 revoke: cutoff = its time
-    assert.strictEqual(s.record(grantOf('role-revoke', W, undefined, V, t0 + 2 * DAY, { cutoff: t0 + DAY })).stored, true, 'kept: verifiable');
-    for (const at of [Date.now(), t0 + 10 * DAY, t0 + 1.5 * DAY]) assert.strictEqual(s.resolveRole(W.nodeId, W.pub, at), 'validator', `W at ${at}`);
-  });
-
-  it('the revoker is checked at every breakpoint from its cutoff to its signed time (Low 8a), and at resolution, not only when kept (M7)', () => {
-    const A = kp(), Q = kp(), W = kp();
-    const t = (n) => 1_000_000 + n * 1000;
-    const st = new RoleGrantStore({ anchor: { nodeId: A.nodeId, publicKey: A.pub } });
-    st.record(grantOf('role-grant', W, 'validator', A, t(0)));
-    st.record(grantOf('role-grant', Q, 'validator', A, t(1)));
-    st.record(grantOf('role-revoke', Q, undefined, A, t(2), { cutoff: t(2) }));
-    st.record(grantOf('role-grant', Q, 'validator', A, t(3)));
-    st.record(grantOf('role-revoke', W, undefined, Q, t(4), { cutoff: t(1.5) }));
-    assert.strictEqual(st.resolveRole(W.nodeId, W.pub, t(2.5)), 'validator', 'Q was not authorised over all of [t1.5, t4]: no effect');
-    assert.strictEqual(st.resolveRole(W.nodeId, W.pub, t(10)), 'validator');
-    // M7: a revoke effective when kept loses its effect when a later record shows its revoker had no
-    // rank at its cutoff.
-    const B = kp(), Z = kp();
-    const s2 = new RoleGrantStore({ anchor: { nodeId: A.nodeId, publicKey: A.pub } });
-    s2.record(grantOf('role-grant', Z, 'validator', A, t(0)));
-    s2.record(grantOf('role-grant', B, 'validator', A, t(0)));
-    s2.record(grantOf('role-revoke', Z, undefined, B, t(10), { cutoff: t(5) }));
-    assert.strictEqual(s2.resolveRole(Z.nodeId, Z.pub, t(20)), 'participant', 'effective as kept');
-    s2.record(grantOf('role-revoke', B, undefined, A, t(30), { cutoff: t(3) }));
-    s2.record(grantOf('role-grant', B, 'validator', A, t(31)));
-    assert.strictEqual(s2.resolveRole(B.nodeId, B.pub, t(40)), 'validator', 'B holds rank again now');
-    assert.strictEqual(s2.resolveRole(Z.nodeId, Z.pub, t(40)), 'validator', 'but B had none at its revoke\'s cutoff: re-checked at resolution');
-  });
-
-  it('revokeRole requires a cutoff and checks its ratify list; the anchor\'s ratification keeps a revoked validator\'s statement', async () => {
-    const node = mk('ratify', {});
-    const A = { nodeId: node.nodeId, pub: node._identity.publicKey };
-    const anchored = mk('ratify-a', { anchor: { nodeId: A.nodeId, publicKey: A.pub } });
-    try {
-      const V = kp(); const W = kp();
-      anchored._roster.bind(V.nodeId, V.pub, 'pinned');
-      anchored._roster.bind(W.nodeId, W.pub, 'pinned');
-      const s = anchored._roleGrants;
-      const t0 = Date.now() - 10 * DAY;
-      s.record(signGrant({ type: 'role-grant', grantee: V.nodeId, role: 'validator', grantedBy: A.nodeId, grantedAt: t0, granteeKey: V.pub }, node._identity.privateKey));
-      s.record(signGrant({ type: 'role-grant', grantee: W.nodeId, role: 'validator', grantedBy: A.nodeId, grantedAt: t0, granteeKey: W.pub }, node._identity.privateKey));
-      const rVW = grantOf('role-revoke', W, undefined, V, t0 + DAY, { cutoff: t0 + DAY });
-      s.record(rVW);
-      assert.strictEqual(anchored.resolveRole(W.nodeId), 'participant');
-      assert.throws(() => node.revokeRole(V.nodeId), (e) => e.code === 'ECUTOFF', 'no default cutoff');
-      assert.throws(() => node.revokeRole(V.nodeId, { cutoff: Date.now() + 60_000 }), (e) => e.code === 'ECUTOFF', 'not in the future');
-      assert.throws(() => node.revokeRole(V.nodeId, { cutoff: t0, ratify: ['x'] }), (e) => e.code === 'ERATIFY');
-      assert.deepStrictEqual(anchored.roleStatementsBy(V.nodeId, Date.now()).map((g) => g.sig), [rVW.sig], 'what V signed, for the revoker to review');
-      // The anchor's node signs the revoke; the anchored node keeps it.
-      const plain = signGrant({ type: 'role-revoke', grantee: V.nodeId, grantedBy: A.nodeId, grantedAt: Date.now(), cutoff: t0 + 2 * DAY }, node._identity.privateKey);
-      s.record(plain);
-      assert.strictEqual(anchored.resolveRole(W.nodeId), 'validator', 'V revoked without ratifying its revoke of W: it lapses');
-      const ratifying = signGrant({ type: 'role-revoke', grantee: V.nodeId, grantedBy: A.nodeId, grantedAt: Date.now() + 1, cutoff: t0 + 2 * DAY, ratify: [rVW.sig] }, node._identity.privateKey);
-      s.record(ratifying);
-      assert.strictEqual(anchored.resolveRole(W.nodeId), 'participant', 'ratified: it stands');
-    } finally { await stopAll(node, anchored); }
-  });
-
-  it('an attestation dated before the record it attests is refused at ingest and excluded from the aggregate', async () => {
-    const b = mk('att-date', {});
-    try {
-      await b.start();
-      const X = identity('x');
-      const sX = admitAs(b, X);
-      b._roster.bind(X.nodeId, X.publicKey, 'pinned');
-      const rec = b.remember({ focus: 'a record attested later' });
-      const key = rec.cmb.metadata.key;
-      const created = rec.cmb.metadata.createdTimestamp;
-      const att = (at, seq) => { const o = { of: key, by: X.nodeId, at, roster: b._room, verdict: 'aligned', categories: {}, seq, prev: 'genesis' }; signAttestation(o, X.privateKey); return o; };
-      assert.strictEqual(b._ingestAttestation(att(created - 1000, 1), X.nodeId, X.name, sX).reason, 'dated-before-record');
-      const late = att(created + 1, 2);
-      b._attestations.record(att(created - 5, 3)); // as if held from before
-      b._attestations.record(late);
-      const agg = b.aggregateAttestations(key);
-      assert.ok(agg.excluded.some((e) => e.reason === 'dated-before-record'));
-      void sX;
-    } finally { await stopAll(b); }
-  });
-});
+// A (the kept grant set as a function of the records held: Findings 1, 2) and B (ratification and
+// backdating: Finding 4, Low 8a) tested the time-replay grant rule that MMP §6.6 retired. The new rule
+// is a function of the set by construction: authority-vectors.test.js resolves every published case in
+// every order and with forged copies; authority-attacks.test.js holds backdating, arrival order and the
+// review attacks; authority-node.test.js shows two nodes reaching one root over real sessions. B's
+// last test (an attestation dated before the record it attests) went with the rule: authority carries
+// no time, so an attestation's time is no part of its weight (§6.6.10).
 
 describe('C: the interior read side is scoped to the mind\'s mission (Finding 6)', () => {
   function conn(p) {
diff --git a/tests/core-secure-rereview.test.js b/tests/core-secure-rereview.test.js
index 53da588a..d97482af 100644
--- a/tests/core-secure-rereview.test.js
+++ b/tests/core-secure-rereview.test.js
@@ -7,10 +7,10 @@ require('./_isolate-home'); // redirect $HOME before lib/config loads
  * sym-bot/xmesh): each finding as a regression test that fails on 72daeb6 for its own reason.
  *
  *   N1  the forgery penalty is charged only to a session that signed in its own name
- *   N2  a revoke carries a cutoff; receipt time is no part of the rule
+ *   N2  a revoke carries a cutoff (retired with the time-replay rule: MMP §6.6)
  *   N3  a verified directed record earns its author a durable binding
- *   N4  no cap refuses a revoke
- *   N5  a 0.13 grant store is never rewritten, so nothing skipped at load is lost
+ *   N4  no cap refuses a revoke (retired: §6.6 quotas never refuse a revoke a bucket keeps first)
+ *   N5  a 0.13 grant store is never rewritten (it is now read only as plain data, never rewritten)
  *   caps  record size limits that fit one sealed frame (draft spec PR #37)
  *   leads the open leads the notes left
  */
@@ -24,7 +24,8 @@ const path = require('path');
 const { SymNode } = require('../lib/node');
 const { NullDiscovery } = require('../lib/discovery');
 const { nodeDirById } = require('../lib/config');
-const { signAttestation, signCheckpoint, signWitness, signGrant } = require('../lib/core');
+const { signAttestation, signCheckpoint, signWitness } = require('../lib/core');
+const Auth = require('../lib/core/authority');
 const { identity, connectNodes, until, signedRecord, admitAs, deliver } = require('./_core-secure');
 
 const uniq = (b) => `${b}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
@@ -58,19 +59,13 @@ describe('N1: the forgery penalty is charged only to a session that signed in it
       b._ingestAttestation(signedAs({ of: `cmb-${hex()}`, by: X.nodeId, at: Date.now(), roster: b._room, verdict: 'aligned', categories: CATS7, seq: 1, prev: 'genesis' }, X.privateKey, signAttestation), A.nodeId, A.name, sA);
       b._ingestCheckpoint(signedAs({ by: X.nodeId, upto_seq: 1, root: hex(), at: Date.now(), roster: b._room }, X.privateKey, signCheckpoint), A.nodeId, sA);
       b._ingestWitness(signedAs({ attester: A.nodeId, upto_seq: 1, root: hex(), by: X.nodeId, role: 'participant', at: Date.now(), roster: b._room }, X.privateKey, signWitness), A.nodeId, sA);
-      // 3. A grant by G, whom the anchor vouched here under K1 and elsewhere under K2, signed with K2.
-      const G1 = identity('g-k1'); const G2 = { ...identity('g-k2'), nodeId: G1.nodeId };
-      const W = identity('w');
-      b._roleGrants.record(signGrant({ type: 'role-grant', grantee: G1.nodeId, role: 'validator', grantedBy: ANC.nodeId, grantedAt: Date.now() - 10_000, granteeKey: G1.publicKey }, ANC.privateKey));
-      deliver(b, sA, { type: 'role-grant', grant: signGrant({ type: 'role-grant', grantee: W.nodeId, role: 'validator', grantedBy: G2.nodeId, grantedAt: Date.now() - 5_000, granteeKey: W.publicKey }, G2.privateKey) });
 
       assert.strictEqual(sA.closed, false, 'the honest relayer\'s session is not closed');
       assert.strictEqual(b._penalised(A.nodeId), false, 'and the relayer is not refused');
       const kinds = metrics.filter((m) => m.type === 'relayed-signature-unverified' && m.peer === A.nodeId).map((m) => m.kind).sort();
-      assert.deepStrictEqual(kinds, ['attestation', 'checkpoint', 'record', 'role-grant', 'witness'], 'each relayed statement is dropped and counted');
+      assert.deepStrictEqual(kinds, ['attestation', 'checkpoint', 'record', 'witness'], 'each relayed statement is dropped and counted');
       assert.ok(!metrics.some((m) => m.type === 'forged-signature'), 'none is called a forgery');
       assert.strictEqual(b._store.allEntries().length, 0, 'the record is not stored');
-      assert.strictEqual(b._roleGrants.size(), 1, 'the grant is not stored');
 
       // The squatter's session delivering a record in its own name (X) that its proven key did not
       // sign is attributable: it is closed and refused.
@@ -80,29 +75,29 @@ describe('N1: the forgery penalty is charged only to a session that signed in it
     } finally { await stopAll(b); }
   });
 
-  it('a statement in the session\'s own name that fails under a key the session did not prove is a view mismatch, not a forgery', async () => {
+  it('an authority statement is verified under the key its chain names, never a binding: one that fails is dropped and counted against its session, which is not closed (MMP §6.6.8)', async () => {
     const ANC = identity('anchor-n1b');
-    const b = mk('n1b-b', { anchor: { nodeId: ANC.nodeId, publicKey: ANC.publicKey } });
+    const b = mk('n1b-b', { anchor: { threshold: 1, keys: [{ key: ANC.publicKey }] } });
     try {
       await b.start();
       const metrics = [];
       b.on('metric', (m) => metrics.push(m));
-      // The anchor vouched G under K1 here; G's session proves K2 (another node holds the grant
-      // vouching K2, this one does not yet).
       const G1 = identity('g-k1'); const G2 = { ...identity('g-k2'), nodeId: G1.nodeId };
       const W = identity('w');
-      b._roleGrants.record(signGrant({ type: 'role-grant', grantee: G1.nodeId, role: 'validator', grantedBy: ANC.nodeId, grantedAt: Date.now() - 10_000, granteeKey: G1.publicKey }, ANC.privateKey));
+      const gG = Auth.signStatement({ kind: 'grant', authorisedBy: 'anchor', subject: { nodeId: G1.nodeId, key: G1.publicKey }, role: 'admin', nonce: Auth.freshNonce(), sigs: [] }, ANC.privateKey, ANC.publicKey);
+      assert.strictEqual(b.submitAuthority(gG).status, 'in-force');
+      // G's session proves K2; a grant signed with K2 under G's grant (which names K1) is not valid,
+      // whoever delivers it: the key is the one the chain names.
       const sG2 = admitAs(b, { nodeId: G2.nodeId, name: 'g-k2', publicKey: G2.publicKey });
-      deliver(b, sG2, { type: 'role-grant', grant: signGrant({ type: 'role-grant', grantee: W.nodeId, role: 'validator', grantedBy: G2.nodeId, grantedAt: Date.now() - 5_000, granteeKey: W.publicKey }, G2.privateKey) });
-      assert.strictEqual(sG2.closed, false, 'its proven key is not one this node\'s chain vouches for G: not attributable');
-      assert.ok(metrics.some((m) => m.type === 'relayed-signature-unverified' && m.kind === 'role-grant'));
-      // G's session under the vouched key K1, sending a grant in its own name its key did not sign: a forgery.
-      sG2.closed = true;
-      const sG1 = admitAs(b, { nodeId: G1.nodeId, name: 'g-k1', publicKey: G1.publicKey });
-      const forged = signGrant({ type: 'role-grant', grantee: W.nodeId, role: 'validator', grantedBy: G1.nodeId, grantedAt: Date.now() - 4_000, granteeKey: W.publicKey }, G2.privateKey);
-      deliver(b, sG1, { type: 'role-grant', grant: forged });
-      assert.strictEqual(sG1.closed, true, 'attributable: closed');
-      assert.ok(metrics.some((m) => m.type === 'forged-signature' && m.kind === 'role-grant'));
+      const bad = Auth.signStatement({ kind: 'grant', authorisedBy: Auth.statementId(gG), subject: { nodeId: W.nodeId, key: W.publicKey }, role: 'validator', nonce: Auth.freshNonce(), sigs: [] }, G2.privateKey, G2.publicKey);
+      assert.strictEqual(b._ingestAuthority(bad, sG2).result, 'invalid');
+      assert.strictEqual(sG2.closed, false, 'rate-limited, not closed');
+      assert.ok(!metrics.some((m) => m.type === 'forged-signature'));
+      for (let i = 0; i < 20; i++) b._ingestAuthority({ ...bad, nonce: Auth.freshNonce() }, sG2);
+      assert.strictEqual(b._relayMuted(G2.nodeId, `authority:${G2.publicKey}`), true, 'past a few failures that signer is dropped unread from this session');
+      // Signed with K1, the key the chain names: valid, whichever session delivers it.
+      const good = Auth.signStatement({ kind: 'grant', authorisedBy: Auth.statementId(gG), subject: { nodeId: W.nodeId, key: W.publicKey }, role: 'validator', nonce: Auth.freshNonce(), sigs: [] }, G1.privateKey, G1.publicKey);
+      assert.strictEqual(b._ingestAuthority(good, admitAs(b, identity('anyone'))).result, 'held');
     } finally { await stopAll(b); }
   });
 });
@@ -159,178 +154,11 @@ describe('N3: a verified directed record earns its author a durable binding', ()
 });
 
 // ── Role grants (N2, N4, N5) ───────────────────────────────────────────────────────────────────────
-const { RoleGrantStore } = require('../lib/role-grant-store');
-const { grantPayload, verifyGrant } = require('../lib/core/role-grant');
-function kp(nodeId) {
-  const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519');
-  return { nodeId: nodeId || crypto.randomUUID(), priv: privateKey.export({ format: 'der', type: 'pkcs8' }).subarray(16).toString('base64url'), pub: publicKey.export({ format: 'der', type: 'spki' }).subarray(12).toString('base64url') };
-}
-const grantOf = (type, grantee, role, grantor, at, extra = {}) => signGrant({ type, grantee: grantee.nodeId, ...(role ? { role } : {}), grantedBy: grantor.nodeId, grantedAt: at, ...(type === 'role-grant' ? { granteeKey: grantee.pub } : {}), ...extra }, grantor.priv);
-
-describe('N2: a revoke carries a cutoff; when a node received anything is no part of the rule', () => {
-  // V legitimately revokes W on "day 1"; the anchor revokes V on "day 3" (cutoff day 3), ratifying
-  // V's revoke of W (final re-review ruling B: what a revoked node signed before its cutoff stands
-  // when its revoker ratifies it).
-  const ANC = kp(), V = kp(), W = kp();
-  const t = Date.now() - 1_000_000;
-  const rVW = grantOf('role-revoke', W, undefined, V, t + 100_000, { cutoff: t + 100_000 });
-  const R = {
-    AV: grantOf('role-grant', V, 'validator', ANC, t),
-    AW: grantOf('role-grant', W, 'validator', ANC, t + 1),
-    rVW,
-    rAV: grantOf('role-revoke', V, undefined, ANC, t + 300_000, { cutoff: t + 300_000, ratify: [rVW.sig] }),
-  };
-  const roleOfW = (store) => store.resolveRole(W.nodeId, W.pub, Date.now());
-
-  it('an early receiver, a late receiver and a store upgraded from 0.13 all resolve W as revoked', () => {
-    // The early receiver was online on day 1: each record reached it moments after it was signed.
-    const clock = { now: t };
-    const early = new RoleGrantStore({ anchor: { nodeId: ANC.nodeId, publicKey: ANC.pub }, now: () => clock.now });
-    for (const k of ['AV', 'AW', 'rVW', 'rAV']) { clock.now = R[k].grantedAt + 500; assert.strictEqual(early.record(R[k]).stored, true, k); }
-    clock.now = Date.now();
-    assert.strictEqual(roleOfW(early), 'participant', 'early receiver');
-    const late = new RoleGrantStore({ anchor: { nodeId: ANC.nodeId, publicKey: ANC.pub } });
-    for (const k of ['AV', 'AW', 'rAV']) late.record(R[k]);
-    assert.strictEqual(late.record(R.rVW).stored, true, 'V\'s revoke, signed before V\'s cutoff and ratified, stands when it arrives after V\'s own revoke');
-    assert.strictEqual(roleOfW(late), 'participant', 'late receiver');
-    assert.strictEqual(late.digest().digest, early.digest().digest);
-    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'n2-upgrade-'));
-    try {
-      // A 0.13 store: bare lines, no receipt times, in the order 0.13 happened to write them.
-      fs.writeFileSync(path.join(dir, 'role-grants.jsonl'), ['AV', 'AW', 'rAV', 'rVW'].map((k) => JSON.stringify(R[k])).join('\n') + '\n');
-      const upgraded = new RoleGrantStore({ anchor: { nodeId: ANC.nodeId, publicKey: ANC.pub }, dir });
-      assert.strictEqual(upgraded.loadReport().loaded, 4);
-      assert.strictEqual(roleOfW(upgraded), 'participant', 'upgraded store');
-    } finally { fs.rmSync(dir, { recursive: true, force: true }); }
-  });
-
-  it('a newcomer that learns the store by anti-entropy sync resolves W as revoked', async () => {
-    const boot = (b) => new SymNode({ name: uniq(b), silent: true, discovery: new NullDiscovery(), room: 'n2', anchor: { nodeId: ANC.nodeId, publicKey: ANC.pub } });
-    const P = boot('n2-p'); const N = boot('n2-n');
-    try {
-      await P.start(); await N.start();
-      for (const k of ['AV', 'AW', 'rVW', 'rAV']) assert.strictEqual(P._roleGrants.record(R[k]).stored, true);
-      await connectNodes(P, N);
-      await until(() => N._roleGrants.size() === 4, 3000);
-      assert.strictEqual(N._roleGrants.size(), 4, 'the whole store arrived');
-      assert.strictEqual(N.resolveRole(W.nodeId, Date.now(), { key: W.pub }), 'participant');
-    } finally { await stopAll(P, N); }
-  });
-
-  it('the cutoff reaches back: what the revoked node signed at or after it never counts, even before the revoke was signed', () => {
-    const X = kp();
-    const store = new RoleGrantStore({ anchor: { nodeId: ANC.nodeId, publicKey: ANC.pub } });
-    store.record(R.AV); store.record(R.AW);
-    assert.strictEqual(store.record(grantOf('role-revoke', V, undefined, ANC, t + 300_000, { cutoff: t + 50_000, ratify: [R.rVW.sig] })).stored, true);
-    assert.strictEqual(store.resolveRole(V.nodeId, V.pub, t + 40_000), 'validator', 'V\'s own role before the cutoff stands (the anchor that granted it holds rank)');
-    assert.strictEqual(store.resolveRole(V.nodeId, V.pub, t + 60_000), 'participant', 'from the cutoff, before the revoke was signed');
-    assert.strictEqual(store.record(R.rVW).stored, true, 'kept: verifiable');
-    assert.strictEqual(roleOfW(store), 'validator', 'V\'s revoke of W, signed after the cutoff, does not count, ratified or not');
-    assert.strictEqual(store.record(grantOf('role-grant', X, 'validator', V, t + 10_000)).stored, true, 'kept: verifiable');
-    assert.strictEqual(store.resolveRole(X.nodeId, X.pub, Date.now()), 'participant');
-  });
-
-  it('a revoker reaches back only over time it was itself authorised for: a revoke whose cutoff precedes its revoker\'s rank is kept but has no effect', () => {
-    const Q = kp(); const X = kp();
-    const store = new RoleGrantStore({ anchor: { nodeId: ANC.nodeId, publicKey: ANC.pub } });
-    store.record(grantOf('role-grant', X, 'validator', ANC, t));
-    store.record(grantOf('role-grant', Q, 'validator', ANC, t + 200_000)); // Q a validator from t+200 s
-    assert.strictEqual(store.record(grantOf('role-revoke', X, undefined, Q, t + 300_000, { cutoff: t + 100_000 })).stored, true, 'kept: verifiable');
-    assert.strictEqual(store.resolveRole(X.nodeId, X.pub, Date.now()), 'validator', 'Q held no rank at its cutoff: no effect (decided at resolution)');
-    assert.strictEqual(store.record(grantOf('role-revoke', X, undefined, Q, t + 300_001, { cutoff: t + 250_000 })).stored, true);
-    assert.strictEqual(store.resolveRole(X.nodeId, X.pub, Date.now()), 'participant');
-  });
-
-  it('wire: a revoke without a cutoff signs the bytes 0.13 signed; the cutoff and ratify list are signed when present, and checked', () => {
-    const r = { type: 'role-revoke', grantee: 'g', grantedBy: 'b', grantedAt: 5 };
-    assert.strictEqual(grantPayload(r).toString(), 'role-revoke|g||b|5|');
-    assert.strictEqual(grantPayload({ ...r, cutoff: 3 }).toString(), 'role-revoke|g||b|5||3');
-    const s1 = 'A'.repeat(85) + 'A', s2 = 'B'.repeat(85) + 'A';
-    assert.strictEqual(grantPayload({ ...r, cutoff: 3, ratify: [s1, s2] }).toString(), `role-revoke|g||b|5||3|${s1},${s2}`);
-    const c = grantOf('role-revoke', W, undefined, ANC, t + 10, { cutoff: t, ratify: [s1] });
-    assert.strictEqual(verifyGrant(c, ANC.pub).valid, true);
-    assert.strictEqual(verifyGrant({ ...c, cutoff: t + 1 }, ANC.pub).valid, false, 'the cutoff is signed');
-    assert.strictEqual(verifyGrant({ ...c, ratify: [s2] }, ANC.pub).valid, false, 'the ratify list is signed');
-    const store = new RoleGrantStore({ anchor: { nodeId: ANC.nodeId, publicKey: ANC.pub } });
-    const bad = (extra, why) => assert.strictEqual(store.record(grantOf('role-revoke', W, undefined, ANC, t, extra)).reason, 'malformed', why);
-    bad({ cutoff: t + 1 }, 'a cutoff after the revoke');
-    bad({ granteeKey: 'abc|1' }, 'a revoke key that is not a key');
-    bad({ ratify: [s1] }, 'ratify without a cutoff');
-    bad({ cutoff: t, ratify: [] }, 'an empty ratify list');
-    bad({ cutoff: t, ratify: [s2, s1] }, 'an unsorted ratify list');
-    bad({ cutoff: t, ratify: [s1, s1] }, 'a repeat');
-    bad({ cutoff: t, ratify: ['not-a-signature'] }, 'not a signature');
-    assert.strictEqual(store.record(grantOf('role-grant', W, 'validator', ANC, t, { cutoff: t })).reason, 'malformed', 'a cutoff on a grant');
-    store.record(c);
-    assert.deepStrictEqual([store.grantsFor(W.nodeId)[0].cutoff, store.grantsFor(W.nodeId)[0].ratify], [t, [s1]], 'kept with its cutoff and ratify list');
-  });
-});
-
-describe('N4: no cap refuses a revoke: a budget per delegation subtree (final re-review ruling A)', () => {
-  it('a sybil tree fills only its own subtree\'s budget; an honest revoke from another subtree is always kept', () => {
-    const A = kp(), M = kp(), H = kp(), X = kp();
-    const store = new RoleGrantStore({ anchor: { nodeId: A.nodeId, publicKey: A.pub }, subtreeBudget: 8 });
-    const t = Date.now() - 100_000;
-    store.record(grantOf('role-grant', M, 'validator', A, t));
-    store.record(grantOf('role-grant', H, 'validator', A, t));
-    store.record(grantOf('role-grant', X, 'validator', A, t));
-    // M grows a sybil tree and floods records under it.
-    const sybils = Array.from({ length: 6 }, () => kp());
-    for (const y of sybils) store.record(grantOf('role-grant', y, 'validator', M, t + 1));
-    for (const y of sybils) for (let i = 0; i < 20; i++) store.record(grantOf('role-revoke', X, undefined, y, t + 100 + i, { cutoff: t + 100 + i }));
-    for (let i = 0; i < 20; i++) store.record(grantOf('role-grant', kp(), 'validator', M, t + 200 + i));
-    assert.strictEqual(store._byRoot.get(M.nodeId).size, 8, 'M\'s subtree holds its budget and no more');
-    assert.ok(store.size() <= 3 + 8 + 8, `the store holds the anchor's records and the budgets: ${store.size()}`);
-    const rHX = grantOf('role-revoke', X, undefined, H, t + 1000, { cutoff: t + 1000 });
-    assert.strictEqual(store.record(rHX).stored, true, 'H\'s revoke counts against H\'s subtree, which M cannot touch');
-    assert.strictEqual(store.record(grantOf('role-revoke', X, undefined, H, t + 1001, { cutoff: t + 900 })).stored, true, 'and H can tighten it');
-  });
-});
-
-describe('N4 at the node: a whole-store sync over several pages', () => {
-  it('a revoke whose grant is on a later page still counts after the sync', async () => {
-    const A = kp(), V = kp(), Q = kp(), X = kp();
-    const t = Date.now() - 100_000;
-    const recs = [
-      grantOf('role-grant', V, 'validator', A, t),
-      grantOf('role-grant', Q, 'validator', A, t),
-      grantOf('role-grant', X, 'validator', Q, t + 1),
-      grantOf('role-revoke', X, undefined, V, t + 2),
-      // V's own later grants fill the first page after its revoke (64 records a page).
-      ...Array.from({ length: 70 }, (_, i) => grantOf('role-grant', kp(), 'validator', V, t + 3 + i)),
-    ];
-    const boot = (b) => new SymNode({ name: uniq(b), silent: true, discovery: new NullDiscovery(), room: 'n4', anchor: { nodeId: A.nodeId, publicKey: A.pub } });
-    const P = boot('n4-p'); const N = boot('n4-n');
-    try {
-      await P.start(); await N.start();
-      for (const g of recs) assert.strictEqual(P._roleGrants.record(g).stored, true);
-      await connectNodes(P, N);
-      await until(() => N._roleGrants.size() === recs.length, 5000);
-      assert.strictEqual(N._roleGrants.size(), recs.length, 'every record arrived');
-      assert.strictEqual(N.resolveRole(X.nodeId, Date.now(), { key: X.pub }), 'participant', 'V\'s revoke of X counts');
-    } finally { await stopAll(P, N); }
-  });
-});
-
-describe('N5: a 0.13 grant store is never rewritten, so a record skipped at load is never lost', () => {
-  it('a record whose root is not yet held stays on disk and loads once its root does', () => {
-    const A = kp(), Q = kp(), X = kp(), V = kp();
-    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'n5-'));
-    try {
-      const t = Date.now() - 100_000;
-      const file = path.join(dir, 'role-grants.jsonl');
-      const lines = [grantOf('role-grant', V, 'validator', A, t), grantOf('role-grant', X, 'validator', Q, t + 2)].map((g) => JSON.stringify(g)).join('\n') + '\n';
-      fs.writeFileSync(file, lines); // as 0.13 wrote it: bare lines
-      const s1 = new RoleGrantStore({ anchor: { nodeId: A.nodeId, publicKey: A.pub }, dir });
-      assert.deepStrictEqual({ loaded: s1.loadReport().loaded, skipped: s1.loadReport().skipped }, { loaded: 1, skipped: { 'unknown-grantor-key': 1 } });
-      assert.strictEqual(fs.readFileSync(file, 'utf8'), lines, 'the file is exactly as it was: nothing dropped, nothing rewritten');
-      s1.record(grantOf('role-grant', Q, 'validator', A, t + 1)); // Q's root arrives
-      const s2 = new RoleGrantStore({ anchor: { nodeId: A.nodeId, publicKey: A.pub }, dir });
-      assert.strictEqual(s2.loadReport().loaded, 3, 'the skipped record loads at the next start');
-      assert.strictEqual(s2.resolveRole(X.nodeId, X.pub, Date.now()), 'validator');
-    } finally { fs.rmSync(dir, { recursive: true, force: true }); }
-  });
-});
+// N2 (cutoffs), N4 (subtree budgets, whole-store sync) and N5 (the 0.13 grant store) tested the
+// time-replay grant rule that MMP §6.6 retired. Their successors: authority-vectors (every published
+// case, in every order), authority-attacks (bounds, backdating, arrival order), authority-node
+// (anti-entropy pulls page by page; persistence re-verified at load; legacyRoleGrants reads 0.13's
+// file as plain data and never rewrites it).
 
 // ── Record size limits (draft spec PR #37, §8.8.6) ─────────────────────────────────────────────────
 const { categoryKeyV1, MAX_RECORD_BYTES, MAX_SEALED_CHARS, CAT7_CATEGORIES } = require('../lib/core/cmb-encoder');
diff --git a/tests/core-secure-review.test.js b/tests/core-secure-review.test.js
index 54557b86..df9f6639 100644
--- a/tests/core-secure-review.test.js
+++ b/tests/core-secure-review.test.js
@@ -19,10 +19,11 @@ const { SymNode } = require('../lib/node');
 const { NullDiscovery, BonjourDiscovery } = require('../lib/discovery');
 const { nodeDirById } = require('../lib/config');
 const { PeerSession, freshX25519 } = require('../lib/session');
-const { RoleGrantStore } = require('../lib/role-grant-store');
+const A = require('../lib/core/authority');
+const { AuthorityStore } = require('../lib/authority-store');
 const { RosterKeyRegistry } = require('../lib/roster-keys');
 const { canonicalRecordV2_0, signedProjection } = require('../lib/core/record-canonical');
-const { verifyCMB, signGrant, verifyAttestationRole, categoryKeyV1 } = require('../lib/core');
+const { verifyCMB, categoryKeyV1 } = require('../lib/core');
 const { clientHello } = require('../lib/core/handshake-v2-flow');
 const { buildControlFrame, openControlFrame } = require('../lib/core/sealed-control');
 const { assertNoDowngrade } = require('../lib/core/mmp-extensions');
@@ -37,11 +38,6 @@ function mk(base, extra = {}) { return new SymNode({ name: uniq(base), silent: t
 async function stopAll(...nodes) {
   for (const n of nodes) { try { await n.stop(); } catch { /* */ } try { fs.rmSync(nodeDirById(n.nodeId), { recursive: true, force: true }); } catch { /* */ } }
 }
-function kp(nodeId) {
-  const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519');
-  return { nodeId, priv: privateKey.export({ format: 'der', type: 'pkcs8' }).subarray(16).toString('base64url'), pub: publicKey.export({ format: 'der', type: 'spki' }).subarray(12).toString('base64url') };
-}
-const grantOf = (type, grantee, role, grantor, at, extra = {}) => signGrant({ type, grantee: grantee.nodeId, role, grantedBy: grantor.nodeId, grantedAt: at, ...(type === 'role-grant' ? { granteeKey: grantee.pub } : {}), ...extra }, grantor.priv);
 
 describe('A. the signed audience governs every send (cs-review-P)', () => {
   it('anchor-leak / anchor-leak-b: a record A sent directed to B is never replayed to a later peer M, nor served to it by cmb-fetch', async () => {
@@ -174,171 +170,67 @@ describe('B. a record is its signed projection (cs-review-B/p3-unsigned, cs-revi
   });
 });
 
-describe('C. a revoke carries a cutoff; a revoked key gains nothing by backdating; the anchor ratifies (cs-review-B; re-review N2; final re-review ruling B)', () => {
-  const ANC = kp('anchor'), V = kp('validator-v'), W = kp('validator-w'), H = kp('honest-h'), ATT = kp('attacker');
-  const t0 = Date.now() - 100_000;
-  // V was granted at t0 and revoked at t0+50 s, its trust withdrawn from t0+500 ms (the cutoff).
-  const CUT = t0 + 500;
-  function world() {
-    const roster = new RosterKeyRegistry({ anchor: { nodeId: ANC.nodeId, publicKey: ANC.pub }, self: { nodeId: 'receiver', publicKey: kp('receiver').pub } });
-    const store = new RoleGrantStore({ anchor: { nodeId: ANC.nodeId, publicKey: ANC.pub }, keys: roster, selfId: 'receiver' });
-    roster.setGrantView((id) => store.vouchedKey(id));
-    store.record(grantOf('role-grant', V, 'validator', ANC, t0));
-    store.record(grantOf('role-grant', W, 'validator', ANC, t0 + 10));
-    store.record(grantOf('role-revoke', V, undefined, ANC, t0 + 50_000, { cutoff: CUT }));
-    return { roster, store };
-  }
-
-  it('p2-revoked-vouch: a revoked validator\'s grants are kept (verifiable) but confer nothing, before or after its cutoff; no key is bound', () => {
-    const { roster, store } = world();
-    assert.strictEqual(store.resolveRole(V.nodeId, V.pub, Date.now()), 'participant');
-    for (const at of [t0 + 1000, t0 + 100]) {
-      const H2 = kp(`h-${at}`);
-      assert.strictEqual(store.record(grantOf('role-grant', { nodeId: H2.nodeId, pub: ATT.pub }, 'validator', V, at)).stored, true, 'verifiable: kept, decided at resolution (final re-review ruling A)');
-      assert.strictEqual(store.resolveRole(H2.nodeId, ATT.pub, Date.now()), 'participant', 'V no longer holds rank, and nothing ratifies it (ruling B)');
-      assert.strictEqual(store.resolveRole(H2.nodeId, ATT.pub, t0 + 200), 'participant', 'not even back then');
-      assert.strictEqual(roster.get(H2.nodeId), undefined, 'the attacker key is bound to nobody');
-    }
-    const self = store.record(grantOf('role-grant', { nodeId: 'receiver', pub: ATT.pub }, 'validator', V, t0 + 1001));
-    assert.strictEqual(self.stored, true, 'kept as a statement; it binds nothing');
-    assert.strictEqual(roster.get('receiver'), roster._self.publicKey, 'this node\'s own id is always its own key');
-  });
-
-  it('p2c-backdate: a revoked validator\'s revoke strips nothing and its attestation weighs as a participant, however it is dated, unless the anchor ratified it', () => {
-    const { store } = world();
-    assert.strictEqual(store.record(grantOf('role-revoke', W, undefined, V, t0 + 1000, { cutoff: t0 + 1000 })).stored, true);
-    assert.strictEqual(store.record(grantOf('role-revoke', W, undefined, V, t0 + 100, { cutoff: t0 + 100 })).stored, true, 'backdated before V\'s cutoff');
-    assert.strictEqual(store.resolveRole(W.nodeId, W.pub, Date.now()), 'validator', 'W keeps its role');
-    assert.strictEqual(store.resolveRole(W.nodeId, W.pub, t0 + 300), 'validator', 'throughout');
-    const sig = 'A'.repeat(85) + 'A';
-    assert.strictEqual(store.statementRole(V.nodeId, V.pub, t0 + 1000, sig), 'participant', 'dated after the cutoff');
-    assert.strictEqual(store.statementRole(V.nodeId, V.pub, t0 + 100, sig), 'participant', 'dated before it: V holds no rank now and nothing ratifies it');
-    store.record(grantOf('role-revoke', V, undefined, ANC, t0 + 60_000, { cutoff: CUT, ratify: [sig] }));
-    assert.strictEqual(store.statementRole(V.nodeId, V.pub, t0 + 100, sig), 'validator', 'ratified by the anchor\'s revoke: it stands');
-    assert.strictEqual(store.statementRole(V.nodeId, V.pub, t0 + 1000, sig), 'participant', 'ratifying cannot reach past the cutoff');
-  });
-
-  it('a revoke signed before its revoker\'s cutoff stands, whichever arrives first, when the revoker\'s revoke ratifies it', () => {
-    const ANC2 = kp('anchor-2'), V2 = kp('v-2'), X = kp('x-2');
-    const t = Date.now() - 10_000;
-    const rVX = grantOf('role-revoke', X, undefined, V2, t + 2, { cutoff: t + 2 });
-    const recs = {
-      AV: grantOf('role-grant', V2, 'validator', ANC2, t),
-      AX: grantOf('role-grant', X, 'validator', ANC2, t + 1),
-      rVX,
-      rAV: grantOf('role-revoke', V2, undefined, ANC2, t + 5, { cutoff: t + 5, ratify: [rVX.sig] }),
-      rAVbare: grantOf('role-revoke', V2, undefined, ANC2, t + 5, { cutoff: t + 5 }),
-    };
-    for (const [order, role] of [[['AV', 'AX', 'rVX', 'rAV'], 'participant'], [['AV', 'AX', 'rAV', 'rVX'], 'participant'], [['AV', 'AX', 'rVX', 'rAVbare'], 'validator'], [['AV', 'AX', 'rAVbare', 'rVX'], 'validator']]) {
-      const store = new RoleGrantStore({ anchor: { nodeId: ANC2.nodeId, publicKey: ANC2.pub } });
-      for (const k of order) assert.strictEqual(store.record(recs[k]).stored, true, `${order.join(' ')}: ${k}`);
-      assert.strictEqual(store.resolveRole(X.nodeId, X.pub, Date.now()), role, `${order.join(' → ')}`);
-    }
-  });
-
-  it('a revoke signed at or after its revoker\'s cutoff has no effect, whichever arrives first', () => {
-    const ANC3 = kp('anchor-3'), V3 = kp('v-3'), W3 = kp('w-3');
-    const t = Date.now() - 100_000;
-    const rVW = grantOf('role-revoke', W3, undefined, V3, t + 20, { cutoff: t + 20 });
-    const recs = {
-      AV: grantOf('role-grant', V3, 'validator', ANC3, t),
-      AW: grantOf('role-grant', W3, 'validator', ANC3, t + 1),
-      rVW,
-      // The anchor revoked V3 at t+30, withdrawing its trust from t+10, and (wrongly) lists rVW.
-      rAV: grantOf('role-revoke', V3, undefined, ANC3, t + 30, { cutoff: t + 10, ratify: [rVW.sig] }),
-    };
-    for (const order of [['AV', 'AW', 'rVW', 'rAV'], ['AV', 'AW', 'rAV', 'rVW']]) {
-      const store = new RoleGrantStore({ anchor: { nodeId: ANC3.nodeId, publicKey: ANC3.pub } });
-      for (const k of order) store.record(recs[k]);
-      assert.strictEqual(store.resolveRole(W3.nodeId, W3.pub, Date.now()), 'validator', `${order.join(' → ')}: V3 signed after its cutoff`);
-    }
-  });
-
-  it('a grant naming this node with a foreign key is inert and reported (p2b-node)', () => {
-    const reported = [];
-    const own = kp('me');
-    const store = new RoleGrantStore({ anchor: { nodeId: ANC.nodeId, publicKey: ANC.pub }, selfId: own.nodeId, selfKey: own.pub, onForeignSelfGrant: (g) => reported.push(g) });
-    const r = store.record(grantOf('role-grant', { nodeId: own.nodeId, pub: ATT.pub }, 'validator', ANC, Date.now() - 1));
-    assert.strictEqual(r.inert, 'foreign-key-for-self');
-    assert.strictEqual(reported.length, 1);
-    assert.strictEqual(store.resolveRole(own.nodeId, own.pub, Date.now()), 'participant');
-    assert.strictEqual(store.vouchedKey(own.nodeId), undefined);
-  });
-
-  it('p2b-node: at the node, a grant a revoked validator dated after its cutoff confers nothing and binds no key, and records forged under it are refused', async () => {
-    const ANCN = identity('anchor-n');
-    const b = mk('p2b', { anchor: { nodeId: ANCN.nodeId, publicKey: ANCN.publicKey }, room: 'r' });
-    try {
-      await b.start();
-      const P = identity('relay-peer');
-      const s = admitAs(b, P);
-      const g = (o, k) => ({ type: o.type, grant: signGrant({ ...o }, k) });
-      const VV = identity('validator-n'); const HH = identity('honest-n'); const AT = identity('att-n');
-      deliver(b, s, g({ type: 'role-grant', grantee: VV.nodeId, role: 'validator', grantedBy: ANCN.nodeId, grantedAt: t0, granteeKey: VV.publicKey }, ANCN.privateKey));
-      deliver(b, s, g({ type: 'role-revoke', grantee: VV.nodeId, grantedBy: ANCN.nodeId, grantedAt: t0 + 50_000, cutoff: t0 + 500 }, ANCN.privateKey));
-      deliver(b, s, g({ type: 'role-grant', grantee: HH.nodeId, role: 'validator', grantedBy: VV.nodeId, grantedAt: t0 + 1000, granteeKey: AT.publicKey }, VV.privateKey));
-      deliver(b, s, g({ type: 'role-grant', grantee: b.nodeId, role: 'validator', grantedBy: VV.nodeId, grantedAt: t0 + 1001, granteeKey: AT.publicKey }, VV.privateKey));
-      assert.strictEqual(b._roster.source(HH.nodeId), undefined);
-      assert.strictEqual(b._roster.source(b.nodeId), 'self');
-      assert.strictEqual(b._roleGrants.size(), 4, 'kept, as verifiable records (final re-review ruling A); they confer nothing');
-      assert.strictEqual(b.resolveRole(HH.nodeId, Date.now(), { key: AT.publicKey }), 'participant');
-      const hooked = [];
-      b.on('verified-record', (e) => hooked.push(e));
-      deliver(b, s, { type: 'cmb', cmb: signedRecord({ ...HH, publicKey: AT.publicKey, privateKey: AT.privateKey }, { categories: { focus: 'forged as H' }, room: 'r' }) });
-      deliver(b, s, { type: 'cmb', cmb: signedRecord({ nodeId: b.nodeId, name: b.name, publicKey: AT.publicKey, privateKey: AT.privateKey }, { categories: { focus: 'forged as me' }, room: 'r' }) });
-      await new Promise((r) => setTimeout(r, 200));
-      assert.strictEqual(hooked.length, 0, 'neither verifies');
-    } finally { await stopAll(b); }
-  });
-});
+// Section C (cs-review-B; re-review N2; final re-review ruling B: cutoffs, backdating, ratification)
+// tested the time-replay grant rule MMP §6.6 retired: authority is now a function of a set of
+// hash-linked statements with no times in it. Its successors are authority-vectors, authority-attacks
+// (backdating, arrival order) and authority-node (a foreign key for this node is inert and reported).
 
 describe('D. no shared budget before verification; bounds (cs-review-B, cs-review-D)', () => {
-  it('p10-hold-size / pending-abuse-014 (c): 64 padded early records hold nothing past their signed fields and 64 KiB', async () => {
-    const b = mk('p10', { anchor: { nodeId: crypto.randomUUID(), publicKey: crypto.randomBytes(32).toString('base64url') } });
+  it('p10-hold-size / pending-abuse-014 (c): a padded authority statement is not of the shape and is held nowhere; at most 64 pending, each a few KiB at most', async () => {
+    const someone = identity('a');
+    const b = mk('p10', { anchor: { nodeId: someone.nodeId, publicKey: someone.publicKey }, gossipBudget: { newLane: 1e6, burst: 1e6 } });
     try {
       await b.start();
       const s = admitAs(b, identity('m'));
       const big = 'x'.repeat(900 * 1024);
-      for (let i = 0; i < 64; i++) {
-        deliver(b, s, { type: 'role-grant', grant: { type: 'role-grant', grantee: big + i, role: 'validator', grantedBy: crypto.randomUUID(), grantedAt: Date.now(), granteeKey: crypto.randomBytes(32).toString('base64url'), sigAlg: 'ed25519', sig: crypto.randomBytes(64).toString('base64url'), pad: big } });
-      }
-      assert.ok(!s._chainHold || s._chainHold.grants.size === 0, 'a grantee over 128 characters is malformed: never held');
-      for (let i = 0; i < 100; i++) {
-        deliver(b, s, { type: 'role-grant', grant: { type: 'role-grant', grantee: crypto.randomUUID(), role: 'validator', grantedBy: crypto.randomUUID(), grantedAt: Date.now(), granteeKey: crypto.randomBytes(32).toString('base64url'), sigAlg: 'ed25519', sig: crypto.randomBytes(64).toString('base64url'), pad: big } });
-      }
-      assert.ok(s._chainHold.grants.size <= 64);
-      assert.ok(s._chainHold.bytes <= 64 * 1024, `held ${s._chainHold.bytes} bytes`);
-      for (const e of s._chainHold.grants.values()) assert.ok(!('pad' in e.grant), 'held as its signed fields only');
+      const stmt = (M) => A.signStatement({ kind: 'grant', authorisedBy: `auth-${crypto.randomBytes(32).toString('hex')}`, subject: { nodeId: crypto.randomUUID(), key: M.publicKey }, role: 'validator', nonce: A.freshNonce(), sigs: [] }, M.privateKey, M.publicKey);
+      const M1 = identity('signer-1');
+      for (let i = 0; i < 64; i++) deliver(b, s, { type: 'authority-statement', statement: { ...stmt(M1), pad: big } });
+      assert.ok(!s._authPending || s._authPending.size === 0, 'a member the schema does not define: never held');
+      assert.strictEqual(b._relayMuted(s.nodeId, `authority:${M1.publicKey}`), true, 'and past a few, that signer\'s statements from this peer are dropped unread');
+      const M2 = identity('signer-2');
+      for (let i = 0; i < 100; i++) deliver(b, s, { type: 'authority-statement', statement: stmt(M2) });
+      assert.strictEqual(s._authPending.size, 64);
+      let bytes = 0;
+      for (const e of s._authPending.values()) bytes += JSON.stringify(e.statement).length;
+      assert.ok(bytes <= 64 * 4096, `held ${bytes} bytes`);
     } finally { await stopAll(b); }
   });
 
-  it('role-linear / role-resolve-cost: a delegation reaches at most 8 grants, and resolution stays fast at 16 records per pair', () => {
-    const A = kp('anchor-l');
-    const s = new RoleGrantStore({ anchor: { nodeId: A.nodeId, publicKey: A.pub } });
-    const t = Date.now() - 1e6;
-    let prev = A;
+  it('role-linear / role-resolve-cost (MMP §6.6): a chain is at most 4 links, and resolving 4 levels of 256 statements each is fast', () => {
+    const anchor = identity('anchor-l');
+    const pin = A.parsePin({ threshold: 1, keys: [{ key: anchor.publicKey }] });
+    const st = new AuthorityStore({ pin });
+    const sign = (by, signer, fields) => A.signStatement({ ...fields, authorisedBy: by, nonce: A.freshNonce(), sigs: [] }, signer.privateKey, signer.publicKey);
+    let prev = { id: 'anchor', signer: anchor };
     let depthReached = 0;
-    for (let d = 1; d <= 24; d++) {
-      const g = kp(`l${d}`);
-      assert.strictEqual(s.record(grantOf('role-grant', g, 'validator', prev, t + d)).stored, true, 'verifiable: kept, its effect decided at resolution');
-      if (s.resolveRole(g.nodeId, g.pub, Date.now()) === 'validator') depthReached = d;
-      prev = g;
+    for (let d = 1; d <= 6; d++) {
+      const g = identity(`l${d}`);
+      const s = sign(prev.id, prev.signer, { kind: 'grant', subject: { nodeId: g.nodeId, key: g.publicKey }, role: 'admin' });
+      if (st.ingest(s).result === 'held' && st.statusOf(A.statementId(s)) === 'in-force') depthReached = d;
+      prev = { id: A.statementId(s), signer: g };
     }
-    assert.strictEqual(depthReached, 8, 'the 9th link confers nothing');
-    const B = kp('anchor-c');
-    const st = new RoleGrantStore({ anchor: { nodeId: B.nodeId, publicKey: B.pub } });
-    const chain = [kp('c0')];
-    st.record(grantOf('role-grant', chain[0], 'validator', B, t));
+    assert.strictEqual(depthReached, 4, 'the fifth link is not valid');
     const t1 = process.hrtime.bigint();
-    for (let d = 1; d <= 7; d++) {
-      const g = kp(`c${d}`); chain.push(g);
-      for (let i = 0; i < 16; i++) st.record(grantOf('role-grant', g, 'validator', chain[d - 1], t + d * 1000 + i));
+    const wide = new AuthorityStore({ pin });
+    let level = [{ id: 'anchor', signer: anchor }];
+    for (let d = 1; d <= 3; d++) {
+      const next = [];
+      for (const parent of level.slice(0, 2)) for (let i = 0; i < 256; i++) {
+        const g = identity('w');
+        const s = sign(parent.id, parent.signer, { kind: 'grant', subject: { nodeId: g.nodeId, key: g.publicKey }, role: i < 16 ? 'admin' : 'participant' });
+        wide.ingest(s);
+        if (i < 16) next.push({ id: A.statementId(s), signer: g });
+      }
+      level = next;
     }
     const storeMs = Number(process.hrtime.bigint() - t1) / 1e6;
     const t2 = process.hrtime.bigint();
-    assert.strictEqual(st.resolveRole(chain[7].nodeId, chain[7].pub, Date.now()), 'validator');
+    wide._resolved = null;
+    const r = wide.resolve();
     const resMs = Number(process.hrtime.bigint() - t2) / 1e6;
-    assert.ok(storeMs < 5000, `7 levels x 16 stored in ${storeMs.toFixed(0)} ms (was exponential)`);
+    assert.ok(r.inForce.size > 1000);
+    assert.ok(storeMs < 20000, `${wide.size()} stored in ${storeMs.toFixed(0)} ms`);
     assert.ok(resMs < 500, `resolved in ${resMs.toFixed(0)} ms`);
   });
 
@@ -727,25 +619,9 @@ describe('the rest of the review (cs-review-B/p11-cli-compact, node-level attest
     } finally { fs.rmSync(dir, { recursive: true, force: true }); }
   });
 
-  it('p2c-backdate at the node: a revoked validator\'s attestation dated at or after its cutoff weighs as a participant', async () => {
-    const ANCN = identity('anchor-att');
-    const node = mk('att-w', { anchor: { nodeId: ANCN.nodeId, publicKey: ANCN.publicKey } });
-    try {
-      const V = identity('validator-att');
-      const t0 = Date.now() - 100_000;
-      node._roleGrants.record(signGrant({ type: 'role-grant', grantee: V.nodeId, role: 'validator', grantedBy: ANCN.nodeId, grantedAt: t0, granteeKey: V.publicKey }, ANCN.privateKey));
-      node._roster.bind(V.nodeId, V.publicKey, 'pinned');
-      const inWindow = { by: V.nodeId, at: t0 + 1000 };
-      assert.strictEqual(node._attesterRole(inWindow), 'validator', 'signed while V was a validator: it counts');
-      node._roleGrants.record(signGrant({ type: 'role-revoke', grantee: V.nodeId, grantedBy: ANCN.nodeId, grantedAt: t0 + 50_000, cutoff: t0 + 2000 }, ANCN.privateKey));
-      assert.strictEqual(node._attesterRole(inWindow), 'participant', 'V no longer holds rank, and nothing ratified it (final re-review ruling B)');
-      const ratified = { ...inWindow, sig: 'Q'.repeat(85) + 'A' };
-      node._roleGrants.record(signGrant({ type: 'role-revoke', grantee: V.nodeId, grantedBy: ANCN.nodeId, grantedAt: t0 + 50_001, cutoff: t0 + 2000, ratify: [ratified.sig] }, ANCN.privateKey));
-      assert.strictEqual(node._attesterRole(ratified), 'validator', 'one the anchor ratified keeps its standing, for every receiver');
-      const backdated = { by: V.nodeId, at: t0 + 3000 };
-      assert.strictEqual(node._attesterRole(backdated), 'participant', 'one dated at or after the cutoff never counts, whenever it was signed (re-review N2)');
-    } finally { await stopAll(node); }
-  });
+  // p2c-backdate at the node (an attestation dated after its signer's cutoff) tested the retired time
+  // rule; an attestation's weight is now judged against the in-force set when it is applied (§6.6.10,
+  // earned-authority-node.test.js).
 });
 
 describe('the rest of the review (cs-review-C)', () => {
diff --git a/tests/earned-authority-node.test.js b/tests/earned-authority-node.test.js
index 48ca0e1c..7ec2505e 100644
--- a/tests/earned-authority-node.test.js
+++ b/tests/earned-authority-node.test.js
@@ -3,8 +3,10 @@
 require('./_isolate-home'); // redirect $HOME before lib/config loads
 
 /**
- * EA2/EA3 — node earned-authority wiring. The node holds the role-grant chain, stamps
- * its RESOLVED role into attestations, can grant/revoke, and resolves any node's role.
+ * A node's use of authority (MMP §6.5, §6.6.9, §6.6.10): the roles it resolves for itself and for
+ * others from its in-force set, the role its attestations carry, the lifecycle transitions it may make
+ * on a CMB (judged on that CMB's own fields, a scoped grant only inside its scope), and the weight an
+ * attestation counts with, judged against the in-force set when the weight is applied.
  */
 
 const { describe, it } = require('node:test');
@@ -13,13 +15,14 @@ const fs = require('fs');
 const crypto = require('crypto');
 const { SymNode } = require('../lib/node');
 const { NullDiscovery } = require('../lib/discovery');
-const { nodeDir, loadOrCreateIdentity } = require('../lib/config');
+const { nodeDir, loadOrCreateIdentity, uuidv7 } = require('../lib/config');
 const { verifyAttestationRole, signAttestation } = require('../lib/core');
+const { statementId } = require('../lib/core/authority');
 
-function kp(nodeId) {
+function kp() {
   const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519');
   return {
-    nodeId,
+    nodeId: uuidv7(),
     priv: privateKey.export({ format: 'der', type: 'pkcs8' }).subarray(16).toString('base64url'),
     pub: publicKey.export({ format: 'der', type: 'spki' }).subarray(12).toString('base64url'),
   };
@@ -28,88 +31,95 @@ function att(by, role, verdict, categories, priv) {
   const a = { of: 'cmb-agg', by, at: Date.now(), roster: 'g', method: 'heuristic', verdict, categories, role, seq: 1, prev: null };
   return signAttestation(a, priv);
 }
+const uniq = (b) => `${b}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
 
-// A node configured as its OWN anchor (the founder-anchor case): pre-create the
-// identity so we can pin it as the anchor before constructing the node.
-function anchorNode(base) {
-  const name = `${base}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+/** A node pinned as its own 1-of-1 anchor (the founder case): its identity made first, then pinned. */
+function anchorNode(base, opts = {}) {
+  const name = uniq(base);
   const id = loadOrCreateIdentity(name);
-  const node = new SymNode({
-    name, silent: true, discovery: new NullDiscovery(), room: 'g',
-    anchor: { nodeId: id.nodeId, publicKey: id.publicKey },
-  });
-  return { node, name };
+  const node = new SymNode({ name, silent: true, discovery: new NullDiscovery(), room: 'g', anchor: { nodeId: id.nodeId, publicKey: id.publicKey }, ...opts });
+  return { node, name, pin: { nodeId: id.nodeId, publicKey: id.publicKey } };
 }
+function cleanup(...names) { for (const n of names) fs.rmSync(nodeDir(n), { recursive: true, force: true }); }
 
-describe('node earned-authority wiring (EA2/EA3)', () => {
-  it('a node pinned as the anchor resolves to anchor and can grant validator', () => {
+describe('roles from the in-force set (MMP §6.6.9)', () => {
+  it('a node pinned as the anchor resolves to anchor, grants a role to a proven key, and a revoke ends it', () => {
     const { node, name } = anchorNode('ea-anchor');
     try {
-      assert.strictEqual(node._resolvedRole(), 'anchor');
-      const peer = 'node-peer-xyz';
-      assert.strictEqual(node.grantRole(peer, 'validator'), null, 'no grant to an id whose key nothing proved (design D3)');
-      node._roster.bind(peer, kp(peer).pub, 'proven');
-      const g = node.grantRole(peer, 'validator');
-      assert.ok(g && g.sig, 'grant is signed');
-      assert.strictEqual(node.resolveRole(peer), 'validator', 'grantee resolves to validator');
-      assert.throws(() => node.revokeRole(peer), (e) => e.code === 'ECUTOFF', 'a revoke names its cutoff: there is no default (final re-review ruling B)');
-      const revoke = node.revokeRole(peer, { cutoff: Date.now() });
-      assert.ok(revoke && revoke.type === 'role-revoke');
-      assert.strictEqual(node.resolveRole(peer), 'participant', 'revoked → participant');
-    } finally { fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+      assert.strictEqual(node.resolveRole(node.nodeId), 'anchor');
+      const peer = kp();
+      assert.strictEqual(node.grantRole(peer.nodeId, 'validator'), null, 'no grant to an id whose key nothing proved');
+      node._roster.bind(peer.nodeId, peer.pub, 'proven');
+      const g = node.grantRole(peer.nodeId, 'validator');
+      assert.ok(g && g.kind === 'grant' && g.authorisedBy === 'anchor', 'an anchor-level grant');
+      assert.deepStrictEqual(g.subject, { nodeId: peer.nodeId, key: peer.pub }, 'it names the nodeId and the key');
+      assert.strictEqual(node.resolveRole(peer.nodeId), 'validator');
+      const r = node.revokeRole(peer.nodeId);
+      assert.ok(r && r.kind === 'revoke');
+      assert.strictEqual(node.resolveRole(peer.nodeId), 'participant', 'revoked: participant');
+      assert.strictEqual(node.revokeRole(peer.nodeId), null, 'nothing left in force to revoke');
+    } finally { cleanup(name); }
+  });
+
+  it('roles follow the key: the same nodeId holding another key has none of them', () => {
+    const { node, name } = anchorNode('ea-key');
+    try {
+      const peer = kp(); const other = kp();
+      node.grant({ nodeId: peer.nodeId, key: peer.pub }, 'admin');
+      assert.strictEqual(node.resolveRole(peer.nodeId, { key: peer.pub }), 'admin');
+      assert.strictEqual(node.resolveRole(peer.nodeId, { key: other.pub }), 'participant');
+    } finally { cleanup(name); }
   });
 
-  it('attestations stamp the RESOLVED role, matching the chain', () => {
+  it('attestations stamp the resolved role, which matches the in-force set', () => {
     const { node, name } = anchorNode('ea-att-role');
     try {
-      const att = node._buildAdmissionAttestation('cmb-1', 'aligned', { focus: 'admit' }, 'heuristic');
-      assert.strictEqual(att.role, 'anchor', 'stamps the resolved anchor role, not a static default');
-      const r = verifyAttestationRole(att, node._roleGrants.resolver());
+      const a = node._buildAdmissionAttestation('cmb-1', 'aligned', { focus: 'admit' }, 'heuristic');
+      assert.strictEqual(a.role, 'anchor');
+      const r = verifyAttestationRole(a, (by) => node.resolveRole(by));
       assert.strictEqual(r.resolved, 'anchor');
-      assert.strictEqual(r.matches, true, 'claimed role matches the chain-resolved role');
-    } finally { fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+      assert.strictEqual(r.matches, true);
+    } finally { cleanup(name); }
   });
 
-  it('a node with an anchor but no grants resolves itself to participant', () => {
-    const name = `ea-plain-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
-    const node = new SymNode({ name, silent: true, discovery: new NullDiscovery(), room: 'g', anchor: { nodeId: 'someone-else', publicKey: 'AAAA' } });
+  it('an anchored node holding no grant is a participant; with no anchor pinned, the configured lifecycleRole stands', () => {
+    const someone = kp();
+    const n1 = uniq('ea-plain');
+    const plain = new SymNode({ name: n1, silent: true, discovery: new NullDiscovery(), room: 'g', anchor: { nodeId: someone.nodeId, publicKey: someone.pub } });
+    const n2 = uniq('ea-legacy');
+    const legacy = new SymNode({ name: n2, silent: true, discovery: new NullDiscovery(), lifecycleRole: 'validator' });
     try {
-      assert.strictEqual(node._resolvedRole(), 'participant', 'no grant → participant, not self-asserted');
-    } finally { fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+      assert.strictEqual(plain._resolvedRole(), 'participant', 'no grant: participant, never self-asserted');
+      assert.strictEqual(legacy._resolvedRole(), 'validator', 'no anchor: a closed development mode');
+      assert.strictEqual(legacy.resolveRole(someone.nodeId), 'participant', 'and nobody else holds anything');
+      assert.strictEqual(legacy.authorityRoot(), null, 'no anchor, no root');
+    } finally { cleanup(n1, n2); }
   });
 
-  it('falls back to the static lifecycleRole when no anchor is configured (legacy)', () => {
-    const name = `ea-legacy-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
-    const node = new SymNode({ name, silent: true, discovery: new NullDiscovery(), lifecycleRole: 'validator' });
-    try {
-      assert.strictEqual(node._resolvedRole(), 'validator', 'no anchor → static role (backward compatible)');
-    } finally { fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+  it('a pin that is not a valid key set stops the node instead of running without the root it asked for', () => {
+    assert.throws(() => new SymNode({ name: uniq('ea-badpin'), silent: true, discovery: new NullDiscovery(), anchor: { nodeId: 'someone-else', publicKey: 'AAAA' } }));
   });
 });
 
-describe('§6.5 enforcement — validate/canonize gated on earned authority (EA4)', () => {
-  // Seed a CMB straight into the store so we have a key to act on.
-  function seed(node) {
-    const key = 'cmb-to-validate';
-    node._store._cache.set(key, { key, lifecycle: 'remixed', anchorWeight: 1.0 });
+describe('§6.5 lifecycle gating: the node\'s authority over THAT CMB', () => {
+  function seed(node, cmb = null, key = 'cmb-to-validate') {
+    node._store._cache.set(key, { key, lifecycle: 'remixed', anchorWeight: 1.0, cmb });
     return key;
   }
 
-  it('a participant cannot validate or canonize — the CMB is left untouched', () => {
-    const name = `ea65-part-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
-    const node = new SymNode({ name, silent: true, discovery: new NullDiscovery(), room: 'g', anchor: { nodeId: 'someone-else', publicKey: 'AAAA' } });
+  it('a participant cannot validate or canonize: the CMB is left untouched', () => {
+    const someone = kp();
+    const name = uniq('ea65-part');
+    const node = new SymNode({ name, silent: true, discovery: new NullDiscovery(), room: 'g', anchor: { nodeId: someone.nodeId, publicKey: someone.pub } });
     try {
       const key = seed(node);
-      assert.strictEqual(node._resolvedRole(), 'participant');
-      const v = node.validateCMB(key);
-      assert.deepStrictEqual(v, { ok: false, reason: 'insufficient-authority' });
-      assert.strictEqual(node._store.getLifecycle(key), 'remixed', 'lifecycle unchanged');
-      const c = node.canonizeCMB(key);
-      assert.deepStrictEqual(c, { ok: false, reason: 'insufficient-authority' });
-    } finally { fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+      assert.deepStrictEqual(node.validateCMB(key), { ok: false, reason: 'insufficient-authority' });
+      assert.strictEqual(node._store.getLifecycle(key), 'remixed');
+      assert.deepStrictEqual(node.canonizeCMB(key), { ok: false, reason: 'insufficient-authority' });
+    } finally { cleanup(name); }
   });
 
-  it('an anchor can validate AND canonize', () => {
+  it('the anchor can validate and canonize', () => {
     const { node, name } = anchorNode('ea65-anchor');
     try {
       const key = seed(node);
@@ -117,76 +127,84 @@ describe('§6.5 enforcement — validate/canonize gated on earned authority (EA4
       assert.strictEqual(node._store.getLifecycle(key), 'validated');
       assert.strictEqual(node.canonizeCMB(key).ok, true);
       assert.strictEqual(node._store.getLifecycle(key), 'canonical');
-    } finally { fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+    } finally { cleanup(name); }
   });
 
-  it('validator rank can validate but NOT canonize (canonization is anchor-only)', () => {
+  it('the store gate: validated authority validates and cannot canonize; a role name is not authority', () => {
     const { node, name } = anchorNode('ea65-rank');
     try {
       const key = seed(node);
-      // exercise the store gate at validator rank directly — validate passes, canonize blocked
-      assert.strictEqual(node._store.validateCMB(key, { byRole: 'validator' }).ok, true);
+      assert.strictEqual(node._store.validateCMB(key, { lifecycle: 'validated' }).ok, true);
+      assert.strictEqual(node._store.canonizeCMB(key, { lifecycle: 'validated' }).reason, 'insufficient-authority');
       assert.strictEqual(node._store.getLifecycle(key), 'validated');
-      assert.strictEqual(node._store.canonizeCMB(key, { byRole: 'validator' }).reason, 'insufficient-authority');
-      assert.strictEqual(node._store.getLifecycle(key), 'validated', 'canonize blocked — stays validated');
-    } finally { fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+      assert.strictEqual(node._store.validateCMB(seed(node, null, 'k2'), { byRole: 'anchor' }).reason, 'insufficient-authority');
+    } finally { cleanup(name); }
+  });
+
+  it('a scoped validator validates only CMBs inside its scope, judged on each CMB\'s own fields, and only where the namespace is implemented', () => {
+    const { node: AN, name: an, pin } = anchorNode('ea65-scope-anchor');
+    const world = (p, cmb) => !!(cmb && typeof cmb.world === 'string' && (cmb.world === p || cmb.world.startsWith(`${p}/`)));
+    const nx = uniq('ea65-scoped');
+    const X = new SymNode({ name: nx, silent: true, discovery: new NullDiscovery(), room: 'g', anchor: pin, authorityScopes: { 'test-world': world } });
+    const ny = uniq('ea65-unscoped');
+    const Y = new SymNode({ name: ny, silent: true, discovery: new NullDiscovery(), room: 'g', anchor: pin });
+    try {
+      const g = AN.grant({ nodeId: X.nodeId, key: X._identity.publicKey }, 'validator', { scope: 'test-world:w1' });
+      assert.strictEqual(X.submitAuthority(g.statement).status, 'in-force');
+      assert.strictEqual(Y.submitAuthority(g.statement).status, 'in-force');
+      assert.strictEqual(X.resolveRole(X.nodeId), 'participant', 'a scoped role is not an unscoped one');
+      assert.strictEqual(X.validateCMB(seed(X, { world: 'w1/room-3' }, 'in')).ok, true);
+      assert.strictEqual(X.validateCMB(seed(X, { world: 'w10' }, 'out')).ok, false);
+      assert.strictEqual(X.validateCMB(seed(X, null, 'none')).ok, false);
+      assert.strictEqual(X.lifecycleAuthority(X.nodeId, X._identity.publicKey, { world: 'w1' }), 'validated');
+      // Y holds the same grant but does not implement the namespace: X's scoped role gives nothing there.
+      assert.strictEqual(Y.lifecycleAuthority(X.nodeId, X._identity.publicKey, { world: 'w1' }), 'none');
+    } finally { cleanup(an, nx, ny); }
   });
 });
 
-describe('aggregateAttestations — weighted by earned authority (EA6)', () => {
-  it('weights verdicts by resolved rank, excludes unverifiable, flags over-claims', () => {
+describe('aggregateAttestations: weights judged against the in-force set when applied (§6.6.10)', () => {
+  it('weights verdicts by resolved rank, excludes the unverifiable, flags over-claims; a revoke changes the weight at once', () => {
     const { node, name } = anchorNode('ea-agg');
     try {
-      const V = kp('val'), P = kp('part'), O = kp('overclaim'), U = kp('unknown');
-      // teach the node every attester's key, then grant V validator (so V resolves up)
+      const V = kp(), P = kp(), O = kp(), U = kp();
       for (const x of [V, P, O]) node._roster.bind(x.nodeId, x.pub, 'proven');
-      node.grantRole(V.nodeId, 'validator');
-
-      // anchor (self, weight 4) + validator (weight 2) admit; participant (weight 1) rejects;
-      // an over-claimer asserts anchor but resolves participant (weight 1, mismatch); and an
-      // attestation whose key we don't have (excluded entirely).
-      // Recorded as the ingest records them: with the time they were received (draft spec PR #33 —
-      // an attestation counts by its signer's role at its signed time AND at its receipt).
-      const now = { receivedAt: Date.now() };
-      node._attestations.record(att(node.nodeId, 'anchor', 'aligned', { focus: 'admit' }, node._identity.privateKey), now);
-      node._attestations.record(att(V.nodeId, 'validator', 'aligned', { focus: 'admit' }, V.priv), now);
-      node._attestations.record(att(P.nodeId, 'participant', 'rejected', { focus: 'reject' }, P.priv), now);
-      node._attestations.record(att(O.nodeId, 'anchor', 'rejected', { focus: 'reject' }, O.priv), now);
-      node._attestations.record(att(U.nodeId, 'participant', 'aligned', { focus: 'admit' }, U.priv), now);
+      const gV = node.grantRole(V.nodeId, 'validator');
+      node._attestations.record(att(node.nodeId, 'anchor', 'aligned', { focus: 'admit' }, node._identity.privateKey));
+      node._attestations.record(att(V.nodeId, 'validator', 'aligned', { focus: 'admit' }, V.priv));
+      node._attestations.record(att(P.nodeId, 'participant', 'rejected', { focus: 'reject' }, P.priv));
+      node._attestations.record(att(O.nodeId, 'anchor', 'rejected', { focus: 'reject' }, O.priv));
+      node._attestations.record(att(U.nodeId, 'participant', 'aligned', { focus: 'admit' }, U.priv));
 
       const agg = node.aggregateAttestations('cmb-agg');
-      assert.strictEqual(agg.total, 4, 'four verifiable attestations');
+      assert.strictEqual(agg.total, 4);
       assert.strictEqual(agg.weight, 8, '4 + 2 + 1 + 1');
-      assert.deepStrictEqual(agg.byRole, { participant: 2, validator: 1, anchor: 1 });
+      assert.deepStrictEqual(agg.byRole, { participant: 2, issuer: 0, validator: 1, admin: 0, anchor: 1 });
       assert.strictEqual(agg.overall.dominant, 'aligned');
       assert.strictEqual(agg.overall.tally.aligned, 6);
-      assert.strictEqual(agg.overall.tally.rejected, 2);
-      assert.strictEqual(agg.overall.confidence, 0.75, '6/8');
-      assert.strictEqual(agg.categories.focus.dominant, 'admit');
-      assert.strictEqual(agg.categories.focus.tally.admit, 6);
-      // the over-claimer is down-weighted to participant AND surfaced as evidence
-      assert.strictEqual(agg.mismatches.length, 1);
-      assert.strictEqual(agg.mismatches[0].by, O.nodeId);
-      assert.deepStrictEqual({ claimed: agg.mismatches[0].claimed, resolved: agg.mismatches[0].resolved }, { claimed: 'anchor', resolved: 'participant' });
-      // the unverifiable attestation never votes
-      assert.strictEqual(agg.excluded.length, 1);
-      assert.strictEqual(agg.excluded[0].by, U.nodeId);
-      assert.strictEqual(agg.excluded[0].reason, 'unknown-key');
-    } finally { fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+      assert.strictEqual(agg.overall.confidence, 0.75);
+      assert.deepStrictEqual(agg.mismatches, [{ by: O.nodeId, claimed: 'anchor', resolved: 'participant' }]);
+      assert.deepStrictEqual(agg.excluded, [{ by: U.nodeId, reason: 'unknown-key' }]);
+
+      // The validator's grant revoked: the same attestations weigh as the set stands now.
+      node.revoke([statementId(gV)]);
+      const after = node.aggregateAttestations('cmb-agg');
+      assert.strictEqual(after.weight, 7, '4 + 1 + 1 + 1: no role "at the time" is kept');
+      assert.strictEqual(after.mismatches.length, 2, 'the validator\'s stamp is now an over-claim');
+    } finally { cleanup(name); }
   });
 
   it('a tampered attestation is excluded as bad-signature, not weighted', () => {
     const { node, name } = anchorNode('ea-agg-tamper');
     try {
-      const P = kp('p');
+      const P = kp();
       node._roster.bind(P.nodeId, P.pub, 'proven');
       const a = att(P.nodeId, 'participant', 'aligned', { focus: 'admit' }, P.priv);
-      a.verdict = 'rejected'; // tamper after signing
+      a.verdict = 'rejected';
       node._attestations.record(a);
       const agg = node.aggregateAttestations('cmb-agg');
       assert.strictEqual(agg.total, 0);
-      assert.strictEqual(agg.excluded.length, 1);
-      assert.strictEqual(agg.excluded[0].reason, 'bad-signature');
-    } finally { fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+      assert.deepStrictEqual(agg.excluded, [{ by: P.nodeId, reason: 'bad-signature' }]);
+    } finally { cleanup(name); }
   });
 });
diff --git a/tests/ed25519-strict.test.js b/tests/ed25519-strict.test.js
new file mode 100644
index 00000000..4b6c5e06
--- /dev/null
+++ b/tests/ed25519-strict.test.js
@@ -0,0 +1,178 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME before lib/config loads
+
+/**
+ * MMP §18.3.2 at every signature check sym makes. The vector cases are in authority-vectors.test.js;
+ * this file shows that each verification site uses the one rule, by handing it two signatures that
+ * Node's own crypto.verify (OpenSSL's cofactorless check) ACCEPTS and the rule rejects:
+ *
+ *   - the universal forgery: the identity point as the key, R = the identity, S = 0. It verifies any
+ *     message under crypto.verify; nobody holds a private key for it.
+ *   - an odd signature by a real key: R = the identity, S = k·a (a the key's secret scalar). The key
+ *     is honest and prime order; R is not of prime order. A signer can make it for any message, and
+ *     a verifier that accepts it holds a different valid set from one that does not.
+ *
+ * And a structural guard: no crypto.verify outside lib/core/ed25519.js.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const crypto = require('crypto');
+const { verifyStrict, L } = require('../lib/core/ed25519');
+const core = require('../lib/core');
+const handshake = require('../lib/core/handshake-v2');
+const roomGrant = require('../lib/core/room-grant');
+const tether = require('../lib/core/tether-attestation');
+const A = require('../lib/core/authority');
+const { AuthorityStore } = require('../lib/authority-store');
+const { identity, signedRecord } = require('./_core-secure');
+
+const SPKI = Buffer.from('302a300506032b6570032100', 'hex');
+const IDENTITY = Buffer.concat([Buffer.from([1]), Buffer.alloc(31)]);
+const UNIVERSAL_KEY = IDENTITY.toString('base64url');
+const UNIVERSAL_SIG = Buffer.concat([IDENTITY, Buffer.alloc(32)]).toString('base64url');
+
+const leToBig = (b) => { let n = 0n; for (let i = b.length - 1; i >= 0; i--) n = (n << 8n) | BigInt(b[i]); return n; };
+const bigToLe = (n, len) => { const b = Buffer.alloc(len); for (let i = 0; i < len; i++) { b[i] = Number(n & 0xffn); n >>= 8n; } return b; };
+
+/** R = identity, S = k·a mod L: what crypto.verify accepts from the holder of `privateKey` for any message. */
+function oddSign(message, privateKeyB64url, publicKeyB64url) {
+  const h = crypto.createHash('sha512').update(Buffer.from(privateKeyB64url, 'base64url')).digest();
+  const s = Buffer.from(h.subarray(0, 32)); s[0] &= 248; s[31] &= 127; s[31] |= 64;
+  const a = leToBig(s) % L;
+  const k = leToBig(crypto.createHash('sha512').update(IDENTITY).update(Buffer.from(publicKeyB64url, 'base64url')).update(message).digest()) % L;
+  return Buffer.concat([IDENTITY, bigToLe((k * a) % L, 32)]).toString('base64url');
+}
+/** Node's own check, with no pre-checks: what a verifier that skipped §18.3.2 would say. */
+function lenient(message, keyB64url, sigB64url) {
+  const key = crypto.createPublicKey({ key: Buffer.concat([SPKI, Buffer.from(keyB64url, 'base64url')]), format: 'der', type: 'spki' });
+  return crypto.verify(null, message, key, Buffer.from(sigB64url, 'base64url'));
+}
+
+describe('§18.3.2: the forgeries this file uses are accepted by crypto.verify, rejected by the rule', () => {
+  it('the universal forgery verifies any message under crypto.verify', () => {
+    for (const m of ['one', 'two', crypto.randomBytes(40).toString('hex')]) {
+      assert.strictEqual(lenient(Buffer.from(m), UNIVERSAL_KEY, UNIVERSAL_SIG), true);
+      assert.strictEqual(verifyStrict(Buffer.from(m), UNIVERSAL_KEY, UNIVERSAL_SIG), false);
+    }
+  });
+  it('an odd signature by a real key verifies under crypto.verify, and an honest one under both', () => {
+    const id = identity('odd');
+    const m = Buffer.from('any message at all');
+    const odd = oddSign(m, id.privateKey, id.publicKey);
+    assert.strictEqual(lenient(m, id.publicKey, odd), true);
+    assert.strictEqual(verifyStrict(m, id.publicKey, odd), false);
+    const honest = crypto.sign(null, m, crypto.createPrivateKey({ key: Buffer.concat([Buffer.from('302e020100300506032b657004220420', 'hex'), Buffer.from(id.privateKey, 'base64url')]), format: 'der', type: 'pkcs8' })).toString('base64url');
+    assert.strictEqual(verifyStrict(m, id.publicKey, honest), true);
+  });
+});
+
+describe('§18.3.2 at every verification site in sym', () => {
+  const id = identity('signer');
+  /** Each site: an honest signed object, its signed bytes, and the verdict function. */
+  const sites = {
+    'records (verifyCMB, v2.0 suite)': () => {
+      const cmb = signedRecord(id);
+      return { obj: cmb, bytes: () => core.signingPayloadV2_0(cmb), set: (sig) => { cmb.metadata.sig = sig; }, ok: () => core.verifyCMB(cmb, id.publicKey).valid };
+    },
+    'handshake proofs (verifyProof)': () => {
+      const transcript = crypto.randomBytes(64);
+      let proof = handshake.signProof('client', transcript, id.privateKey);
+      return { bytes: () => handshake.proofPayload('client', transcript), set: (sig) => { proof = sig; }, ok: () => handshake.verifyProof('client', transcript, proof, id.publicKey) };
+    },
+    'attestations (verifyAttestation)': () => {
+      const att = core.signAttestation({ of: 'cmb-' + 'a'.repeat(64), by: id.nodeId, at: 1, roster: 'default', verdict: 'aligned', categories: {}, seq: 1, prev: 'genesis', role: 'participant', method: 'svaf' }, id.privateKey);
+      return { bytes: () => core.attestationPayload(att), set: (sig) => { att.sig = sig; }, ok: () => core.verifyAttestation(att, id.publicKey).valid };
+    },
+    'checkpoints (verifyCheckpoint)': () => {
+      const cp = core.signCheckpoint({ by: id.nodeId, roster: 'default', uptoSeq: 3, root: 'r'.repeat(64), at: 1 }, id.privateKey);
+      return { bytes: () => core.checkpointPayload(cp), set: (sig) => { cp.sig = sig; }, ok: () => core.verifyCheckpoint(cp, id.publicKey).valid };
+    },
+    'witnesses (verifyWitness)': () => {
+      const w = core.signWitness({ attester: id.nodeId, by: id.nodeId, roster: 'default', uptoSeq: 3, root: 'r'.repeat(64), role: 'participant', at: 1 }, id.privateKey);
+      return { bytes: () => core.witnessPayload(w), set: (sig) => { w.sig = sig; }, ok: () => core.verifyWitness(w, id.publicKey).valid };
+    },
+    'room-join grants (verifyRoomGrant)': () => {
+      const grantee = identity('grantee');
+      const g = roomGrant.signRoomGrant({ room: 'gated-room', grantee: grantee.nodeId, granteeKey: grantee.publicKey, grantedBy: id.nodeId }, id.privateKey);
+      return { bytes: () => roomGrant.roomGrantPayload(g), set: (sig) => { g.sig = sig; }, ok: () => roomGrant.verifyRoomGrant(g, id.publicKey, { room: 'gated-room', grantee: grantee.nodeId, provenKey: grantee.publicKey }).ok };
+    },
+    'tether attestations (verifyTetherAttestation)': () => {
+      const t = tether.signTetherAttestation({ of: 'cmb-' + 'b'.repeat(64), anchor: 'cmb-' + 'c'.repeat(64), kernelId: 'k1', drift: 0.1, verdict: 'tethered', by: id.nodeId, at: 1 }, id.privateKey);
+      return { bytes: () => tether.tetherPayload(t), set: (sig) => { t.sig = sig; }, ok: () => tether.verifyTetherAttestation(t, id.publicKey).valid };
+    },
+    'authority statements (MMP §6.6, a pinned single-key anchor)': () => {
+      let s = A.signStatement({ kind: 'grant', authorisedBy: 'anchor', subject: { nodeId: '018f47a0-7b21-7abc-8def-0000000000b1', key: identity('x').publicKey }, role: 'validator', nonce: A.freshNonce() }, id.privateKey, id.publicKey);
+      const store = () => new AuthorityStore({ pin: A.parsePin({ threshold: 1, keys: [{ key: id.publicKey }] }) });
+      return { bytes: () => A.payload(s), set: (sig) => { s = { ...s, sigs: [{ key: id.publicKey, sig }] }; }, ok: () => store().ingest(s).result === 'held' };
+    },
+  };
+  for (const [name, make] of Object.entries(sites)) {
+    it(name, () => {
+      const site = make();
+      assert.strictEqual(site.ok(), true, 'the honest signature verifies');
+      const odd = oddSign(site.bytes(), id.privateKey, id.publicKey);
+      assert.strictEqual(lenient(site.bytes(), id.publicKey, odd), true, 'crypto.verify alone would accept the odd signature');
+      site.set(odd);
+      assert.strictEqual(site.ok(), false, 'sym rejects it');
+    });
+  }
+
+  it('records and authority statements under the universal key are rejected too', () => {
+    const cmb = signedRecord(id);
+    cmb.metadata.sig = UNIVERSAL_SIG;
+    assert.strictEqual(lenient(core.signingPayloadV2_0(cmb), UNIVERSAL_KEY, UNIVERSAL_SIG), true);
+    assert.strictEqual(core.verifyCMB(cmb, UNIVERSAL_KEY).valid, false);
+    // A pin naming the identity point is refused outright (§6.6.1: a pinned key is of prime order).
+    assert.throws(() => A.parsePin({ threshold: 1, keys: [{ key: UNIVERSAL_KEY }] }));
+    // A grant naming the identity point as its subject key is not well formed: nothing it signs can count.
+    const s = A.signStatement({ kind: 'grant', authorisedBy: 'anchor', subject: { nodeId: '018f47a0-7b21-7abc-8def-0000000000b2', key: UNIVERSAL_KEY }, role: 'admin', nonce: A.freshNonce() }, id.privateKey, id.publicKey);
+    const store = new AuthorityStore({ pin: A.parsePin({ threshold: 1, keys: [{ key: id.publicKey }] }) });
+    assert.strictEqual(store.ingest(s).result, 'invalid');
+  });
+
+  it('relocation: a bundle header carrying an odd signature is refused', async () => {
+    const { SymNode } = require('../lib/node');
+    const { NullDiscovery } = require('../lib/discovery');
+    const relocation = require('../lib/relocation');
+    const name = `strict-reloc-${Date.now().toString(36)}`;
+    const node = new SymNode({ name, silent: true, discovery: new NullDiscovery() });
+    const nodeId = node.nodeId; const pub = node._identity.publicKey; const priv = node._identity.privateKey;
+    await node.stop();
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'bundle-'));
+    const out = path.join(dir, 'node.bundle');
+    relocation.exportNode({ name, out, passphrase: 'a long operator passphrase', copyable: true });
+    const bundle = JSON.parse(fs.readFileSync(out, 'utf8'));
+    const { ciphertext, nonce, headerSig, ...header } = bundle;
+    void ciphertext; void nonce; void headerSig;
+    const bytes = Buffer.from(`sym-node-bundle-v1-header\n${Object.keys(header).sort().map((k) => `${k}=${header[k]}`).join('\n')}`, 'utf8');
+    assert.strictEqual(verifyStrict(bytes, pub, bundle.headerSig), true, 'the test rebuilds the header\'s signed bytes');
+    const odd = oddSign(bytes, priv, pub);
+    assert.strictEqual(lenient(bytes, pub, odd), true);
+    const forged = path.join(dir, 'odd.bundle');
+    fs.writeFileSync(forged, JSON.stringify({ ...bundle, headerSig: odd }));
+    assert.throws(() => relocation.importNode({ from: forged, passphrase: 'a long operator passphrase', expect: { nodeId, key: pub } }), /header is not signed/);
+  });
+
+  it('no crypto.verify outside lib/core/ed25519.js', () => {
+    const root = path.join(__dirname, '..');
+    const offenders = [];
+    const walk = (dir) => {
+      for (const e of fs.readdirSync(dir, { withFileTypes: true })) {
+        const p = path.join(dir, e.name);
+        if (e.isDirectory()) walk(p);
+        else if (/\.(c|m)?js$/.test(e.name) && p !== path.join(root, 'lib', 'core', 'ed25519.js')) {
+          const text = fs.readFileSync(p, 'utf8');
+          if (/crypto\.verify\s*\(|createVerify\s*\(|\.verify\(null,/.test(text)) offenders.push(path.relative(root, p));
+        }
+      }
+    };
+    walk(path.join(root, 'lib'));
+    walk(path.join(root, 'bin'));
+    assert.deepStrictEqual(offenders, []);
+  });
+});
diff --git a/tests/fixtures/SOURCES.json b/tests/fixtures/SOURCES.json
new file mode 100644
index 00000000..c4c3333c
--- /dev/null
+++ b/tests/fixtures/SOURCES.json
@@ -0,0 +1,9 @@
+{
+  "note": "MMP v2.0 conformance artifacts vendored for sym's tests. Copied unchanged from sym-bot/meshcognition-website main at 8c3381d (PR #40, head ef1b542), public/spec/mmp/. The sha256 values equal that commit's public/spec/mmp/artifact-manifest.json; tests/authority-vectors.test.js checks them before it reads anything.",
+  "source": "https://github.com/sym-bot/meshcognition-website/tree/8c3381d/public/spec/mmp",
+  "files": {
+    "authority-v2.json": { "from": "conformance/v2/authority-v2.json", "sha256": "3cd656cec2c85f1b5658901aa4ed5a4fe9357e761600c64435a324538f8d46ce" },
+    "ed25519-strict-v2.json": { "from": "conformance/v2/ed25519-strict-v2.json", "sha256": "323d8d9f1a4ab985a53e3c7031e39c004e456df74a87a48550761160e3c1997b" },
+    "authority-frame.schema.json": { "from": "schema/authority-frame.schema.json", "sha256": "0e9fa987e8d38351ab28755f57d413d354fabd92cf968365b10845924f573a95" }
+  }
+}
diff --git a/tests/fixtures/authority-frame.schema.json b/tests/fixtures/authority-frame.schema.json
new file mode 100644
index 00000000..9696f87f
--- /dev/null
+++ b/tests/fixtures/authority-frame.schema.json
@@ -0,0 +1,194 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://meshcognition.org/spec/mmp/schema/authority-frame.schema.json",
+  "title": "MMP v2.0 authority statements and frames (§6.6)",
+  "description": "Grant, revoke and endorse statements, each identified by the SHA-256 of its canonical signed bytes (mmp-authority-v1) and linked to others by those ids, and the four frames that carry them. The schema accepts exactly the shapes the reference construction (scripts/mmp/lib.mjs) accepts, with one exception no JSON Schema can express: a subject key must also be the encoding of an Ed25519 point of prime order (§18.3.2). Whether a statement is valid and in force is decided by §6.6 resolution against the pinned anchor.",
+  "oneOf": [
+    { "$ref": "#/$defs/statementFrame" },
+    { "$ref": "#/$defs/digestFrame" },
+    { "$ref": "#/$defs/fetchFrame" },
+    { "$ref": "#/$defs/setFrame" }
+  ],
+  "$defs": {
+    "statementId": { "type": "string", "pattern": "^auth-[0-9a-f]{64}$" },
+    "authorisedBy": {
+      "anyOf": [
+        { "const": "anchor" },
+        { "$ref": "#/$defs/statementId" }
+      ]
+    },
+    "publicKey": { "type": "string", "pattern": "^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$", "description": "Canonical unpadded base64url of 32 bytes." },
+    "signature": { "type": "string", "pattern": "^[A-Za-z0-9_-]{85}[AQgw]$", "description": "Canonical unpadded base64url of 64 bytes." },
+    "nonce": { "type": "string", "pattern": "^[A-Za-z0-9_-]{21}[AQgw]$", "description": "Canonical unpadded base64url of 16 bytes." },
+    "nodeId": { "type": "string", "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", "description": "Canonical lowercase RFC 4122 text form; these exact characters are signed." },
+    "role": {
+      "anyOf": [
+        { "enum": ["admin", "validator", "issuer", "participant"] },
+        { "type": "string", "maxLength": 64, "pattern": "^[a-z][a-z0-9]*(-[a-z0-9]+)+$" }
+      ]
+    },
+    "scope": {
+      "type": "string",
+      "maxLength": 256,
+      "pattern": "^[a-z][a-z0-9]*(-[a-z0-9]+)*:(?!\\.+(/|$))[A-Za-z0-9._~-]+(/(?!\\.+(/|$))[A-Za-z0-9._~-]+)*$",
+      "description": "Optional. An extension namespace and a path of segments separated by '/'; no segment consists only of dots. Paths are opaque and compared exactly, never normalised. A grant's scope must equal or narrow (add path segments to) its authorising grant's; no scope is the whole mesh, so a grant under a scoped grant must carry a scope."
+    },
+    "sigEntry": {
+      "type": "object",
+      "required": ["key", "sig"],
+      "additionalProperties": false,
+      "properties": {
+        "key": { "$ref": "#/$defs/publicKey" },
+        "sig": { "$ref": "#/$defs/signature" }
+      }
+    },
+    "signedBase": {
+      "type": "object",
+      "required": ["kind", "authorisedBy", "nonce", "sigs"],
+      "properties": {
+        "kind": { "enum": ["grant", "revoke", "endorse"] },
+        "authorisedBy": { "$ref": "#/$defs/authorisedBy" },
+        "nonce": { "$ref": "#/$defs/nonce" },
+        "issuedAt": { "type": "integer", "minimum": 0, "maximum": 9007199254740991, "description": "Information only. Signed and part of the id; never used by resolution." },
+        "sigs": { "type": "array", "minItems": 1, "maxItems": 16, "items": { "$ref": "#/$defs/sigEntry" } }
+      },
+      "if": { "type": "object", "properties": { "authorisedBy": { "$ref": "#/$defs/statementId" } } },
+      "then": { "type": "object", "properties": { "sigs": { "type": "array", "maxItems": 1 } } }
+    },
+    "targets": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 64,
+      "uniqueItems": true,
+      "items": { "$ref": "#/$defs/statementId" }
+    },
+    "grant": {
+      "allOf": [
+        { "$ref": "#/$defs/signedBase" },
+        {
+          "type": "object",
+          "required": ["subject", "role"],
+          "additionalProperties": false,
+          "properties": {
+            "kind": { "const": "grant" },
+            "authorisedBy": true,
+            "nonce": true,
+            "issuedAt": true,
+            "sigs": true,
+            "subject": {
+              "type": "object",
+              "required": ["nodeId", "key"],
+              "additionalProperties": false,
+              "properties": {
+                "nodeId": { "$ref": "#/$defs/nodeId" },
+                "key": { "$ref": "#/$defs/publicKey" }
+              }
+            },
+            "role": { "$ref": "#/$defs/role" },
+            "scope": { "$ref": "#/$defs/scope" }
+          }
+        }
+      ]
+    },
+    "revoke": {
+      "allOf": [
+        { "$ref": "#/$defs/signedBase" },
+        {
+          "type": "object",
+          "required": ["targets"],
+          "additionalProperties": false,
+          "properties": {
+            "kind": { "const": "revoke" },
+            "authorisedBy": true,
+            "nonce": true,
+            "issuedAt": true,
+            "sigs": true,
+            "targets": { "$ref": "#/$defs/targets", "description": "Ids of the grants this revoke removes." }
+          }
+        }
+      ]
+    },
+    "endorse": {
+      "allOf": [
+        { "$ref": "#/$defs/signedBase" },
+        {
+          "type": "object",
+          "required": ["targets"],
+          "additionalProperties": false,
+          "properties": {
+            "kind": { "const": "endorse" },
+            "authorisedBy": true,
+            "nonce": true,
+            "issuedAt": true,
+            "sigs": true,
+            "targets": { "$ref": "#/$defs/targets", "description": "Ids of the grants and revokes this endorse keeps alive when a revoke has cut them off from the anchor. An endorse is never itself rescued." }
+          }
+        }
+      ]
+    },
+    "statement": {
+      "oneOf": [
+        { "$ref": "#/$defs/grant" },
+        { "$ref": "#/$defs/revoke" },
+        { "$ref": "#/$defs/endorse" }
+      ]
+    },
+    "reqId": { "type": "string", "minLength": 1, "maxLength": 128 },
+    "cursor": { "type": "string", "maxLength": 128 },
+    "statementFrame": {
+      "type": "object",
+      "required": ["type", "statement"],
+      "additionalProperties": false,
+      "properties": {
+        "type": { "const": "authority-statement" },
+        "statement": { "$ref": "#/$defs/statement" }
+      }
+    },
+    "digestFrame": {
+      "type": "object",
+      "required": ["type", "root", "count"],
+      "additionalProperties": false,
+      "properties": {
+        "type": { "const": "authority-digest" },
+        "root": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
+        "count": { "type": "integer", "minimum": 0 }
+      }
+    },
+    "fetchFrame": {
+      "oneOf": [
+        {
+          "type": "object",
+          "required": ["type", "reqId", "ids"],
+          "additionalProperties": false,
+          "properties": {
+            "type": { "const": "authority-fetch" },
+            "reqId": { "$ref": "#/$defs/reqId" },
+            "ids": { "type": "array", "minItems": 1, "maxItems": 64, "uniqueItems": true, "items": { "$ref": "#/$defs/statementId" } }
+          }
+        },
+        {
+          "type": "object",
+          "required": ["type", "reqId", "after"],
+          "additionalProperties": false,
+          "properties": {
+            "type": { "const": "authority-fetch" },
+            "reqId": { "$ref": "#/$defs/reqId" },
+            "after": { "$ref": "#/$defs/cursor" }
+          }
+        }
+      ]
+    },
+    "setFrame": {
+      "type": "object",
+      "required": ["type", "reqId", "statements"],
+      "additionalProperties": false,
+      "properties": {
+        "type": { "const": "authority-set" },
+        "reqId": { "$ref": "#/$defs/reqId" },
+        "statements": { "type": "array", "maxItems": 64, "items": { "$ref": "#/$defs/statement" } },
+        "missing": { "type": "array", "maxItems": 64, "uniqueItems": true, "items": { "$ref": "#/$defs/statementId" } },
+        "next": { "$ref": "#/$defs/cursor" }
+      }
+    }
+  }
+}
diff --git a/tests/fixtures/authority-v2.json b/tests/fixtures/authority-v2.json
new file mode 100644
index 00000000..07d5ca58
--- /dev/null
+++ b/tests/fixtures/authority-v2.json
@@ -0,0 +1,9157 @@
+{
+  "protocolVersion": "2.0",
+  "construction": "mmp-authority-v1",
+  "usage": "Statement ids, payload bytes, pin digests and authority roots are deterministic and MUST reproduce exactly. Signatures are verification only (§18.3.2; see ed25519-strict-v2.json): check that each verifies over its payload; never sign and compare bytes. For every case, resolve the listed statements in any order, and in every order, and reproduce expected.status, inForce, live, keptBy (the bucket that keeps each in-force statement: its own, or its rescuer's), roles and root. A case with testQuota or testDelegateQuota uses that value in place of AUTHORITY_QUOTA or AUTHORITY_DELEGATE_QUOTA. lifecycle is informative: what each subject may advance a CMB to outside every scope, and inside each scope it holds.",
+  "constants": {
+    "MAX_DELEGATION_DEPTH": 4,
+    "AUTHORITY_QUOTA": 256,
+    "AUTHORITY_ANCHOR_QUOTA": 4096,
+    "AUTHORITY_DELEGATE_QUOTA": 16
+  },
+  "warning": "all private seeds are fixed conformance fixtures; never use them as identities",
+  "testKeys": {
+    "a1": {
+      "privateSeedBase64url": "oaGhoaGhoaGhoaGhoaGhoaGhoaGhoaGhoaGhoaGhoaE",
+      "publicKeyBase64url": "vHy8tWNjdfodgkNNRmck2SN39TuYBpXdSdJtDOEiBaU",
+      "nodeId": "018f47a0-7b21-7abc-8def-0000000000a1"
+    },
+    "a2": {
+      "privateSeedBase64url": "oqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqI",
+      "publicKeyBase64url": "Zej5sLxurhJBafBXb5c2LSlajPX3cLReFDV85kfTPuw",
+      "nodeId": "018f47a0-7b21-7abc-8def-0000000000a2"
+    },
+    "a3": {
+      "privateSeedBase64url": "o6Ojo6Ojo6Ojo6Ojo6Ojo6Ojo6Ojo6Ojo6Ojo6Ojo6M",
+      "publicKeyBase64url": "rPErSswcZgqDJq7TQDnvtyil5JZIgkD1CpMqt6ulF1E",
+      "nodeId": "018f47a0-7b21-7abc-8def-0000000000a3"
+    },
+    "A": {
+      "privateSeedBase64url": "ra2tra2tra2tra2tra2tra2tra2tra2tra2tra2tra0",
+      "publicKeyBase64url": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+      "nodeId": "018f47a0-7b21-7abc-8def-00000000000a"
+    },
+    "V": {
+      "privateSeedBase64url": "sbGxsbGxsbGxsbGxsbGxsbGxsbGxsbGxsbGxsbGxsbE",
+      "publicKeyBase64url": "RyG1tjInLmWmjdp6wltBhfiwGRbbGFwUKH25Lit3D64",
+      "nodeId": "018f47a0-7b21-7abc-8def-00000000000b"
+    },
+    "W": {
+      "privateSeedBase64url": "srKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrI",
+      "publicKeyBase64url": "VRVPQgZepaG-oFRjgmviaE65LfksEAAnqrquV8pVQgc",
+      "nodeId": "018f47a0-7b21-7abc-8def-00000000000c"
+    },
+    "H": {
+      "privateSeedBase64url": "s7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7M",
+      "publicKeyBase64url": "WRLawCDc2rp2fOymQkPoRRdiFcSF5BjlD4AgXYEhipE",
+      "nodeId": "018f47a0-7b21-7abc-8def-00000000000d"
+    },
+    "P": {
+      "privateSeedBase64url": "wcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcE",
+      "publicKeyBase64url": "rNzISU1Fj0SnqqwdaoTsYk2u6IQ22yribme6ZFoQYig",
+      "nodeId": "018f47a0-7b21-7abc-8def-00000000000e"
+    },
+    "R": {
+      "privateSeedBase64url": "w8PDw8PDw8PDw8PDw8PDw8PDw8PDw8PDw8PDw8PDw8M",
+      "publicKeyBase64url": "1AS8RFZa7buJkVDlsLOzK5RBvwy3iEwzEw2o28J90s8",
+      "nodeId": "018f47a0-7b21-7abc-8def-00000000000f"
+    },
+    "Q": {
+      "privateSeedBase64url": "wsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsI",
+      "publicKeyBase64url": "tygv5HL5dkHBcJeCGlN4dKqqUyZFrTTb1ZhzMaTnP40",
+      "nodeId": "018f47a0-7b21-7abc-8def-000000000010"
+    },
+    "P2": {
+      "privateSeedBase64url": "xMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMQ",
+      "publicKeyBase64url": "3FF_9SfnvPqwZ_LMYbvvjnX5uo4TMq09QviTjgBF7Yk",
+      "nodeId": "018f47a0-7b21-7abc-8def-000000000011"
+    },
+    "D": {
+      "privateSeedBase64url": "0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dE",
+      "publicKeyBase64url": "buCR_SgKm2hVT6c8WIEl1H00JcaKJroja02tkPkKj5I",
+      "nodeId": "018f47a0-7b21-7abc-8def-000000000012"
+    },
+    "WA": {
+      "privateSeedBase64url": "0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tI",
+      "publicKeyBase64url": "Qej94TKtZw5TTNiyddLNfux3czxm-NtIocraf6v8RVU",
+      "nodeId": "018f47a0-7b21-7abc-8def-000000000013"
+    },
+    "SI": {
+      "privateSeedBase64url": "09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09M",
+      "publicKeyBase64url": "tHQLpOD34FdvEegUnbuyUpwhIhPbZ5gx-10bIh6EVS0",
+      "nodeId": "018f47a0-7b21-7abc-8def-000000000014"
+    },
+    "S1": {
+      "privateSeedBase64url": "1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NQ",
+      "publicKeyBase64url": "7TI0snbUztpX1ZutFPuvWnc8DzGMmZ3jpg1TxaWzTAU",
+      "nodeId": "018f47a0-7b21-7abc-8def-000000000015"
+    },
+    "X3": {
+      "privateSeedBase64url": "1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dU",
+      "publicKeyBase64url": "oRgEM1nny0Xqi7IB58i5Q_E0VsCk0bEdQ0OngoCJ-7o",
+      "nodeId": "018f47a0-7b21-7abc-8def-000000000016"
+    },
+    "X4": {
+      "privateSeedBase64url": "1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tbW1tY",
+      "publicKeyBase64url": "gOoQued99QaiaxjHd66qY61sxrM6xuAj1ZMqa4lx7nY",
+      "nodeId": "018f47a0-7b21-7abc-8def-000000000017"
+    },
+    "B": {
+      "privateSeedBase64url": "rq6urq6urq6urq6urq6urq6urq6urq6urq6urq6urq4",
+      "publicKeyBase64url": "ZQt9ylU8rmktusMDnnWG8N9E6EXPK6pnh9bv90QlyxQ",
+      "nodeId": "018f47a0-7b21-7abc-8def-000000000018"
+    },
+    "V2": {
+      "privateSeedBase64url": "tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ",
+      "publicKeyBase64url": "UrzUxoqKCdmM2dGNim-j6Ok1WVTssB4q37-6XO-uTnk",
+      "nodeId": "018f47a0-7b21-7abc-8def-000000000019"
+    },
+    "P3": {
+      "privateSeedBase64url": "xcXFxcXFxcXFxcXFxcXFxcXFxcXFxcXFxcXFxcXFxcU",
+      "publicKeyBase64url": "LbeXY24yPtV26bDgPifLkhcaiWtj6RhvDUpDucfTgtE",
+      "nodeId": "018f47a0-7b21-7abc-8def-00000000001a"
+    },
+    "WB": {
+      "privateSeedBase64url": "19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19c",
+      "publicKeyBase64url": "u3h-WQGsOBaKizc3FfVx7fdVxRj6ydxz4zkSbOT1Lwg",
+      "nodeId": "018f47a0-7b21-7abc-8def-00000000001b"
+    },
+    "SR": {
+      "privateSeedBase64url": "2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2NjY2Ng",
+      "publicKeyBase64url": "YN5ey4qpiEIsIrHiC_xAFJ7ZTR6QwFrqeMjyG-MxcLA",
+      "nodeId": "018f47a0-7b21-7abc-8def-00000000001c"
+    },
+    "S3": {
+      "privateSeedBase64url": "2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dk",
+      "publicKeyBase64url": "jkGQzWj9wH3aDFnmywc-_S2TEdYio4oy32iFtKQSFVE",
+      "nodeId": "018f47a0-7b21-7abc-8def-00000000001d"
+    },
+    "M": {
+      "privateSeedBase64url": "7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u7u4",
+      "publicKeyBase64url": "gUci3nHFsU50jf8yKuf3xBXO5Vh2ZJUpLNbEwKap3yg",
+      "nodeId": "018f47a0-7b21-7abc-8def-0000000000ee"
+    },
+    "Kd": {
+      "privateSeedBase64url": "4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eHh4eE",
+      "publicKeyBase64url": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+      "nodeId": "018f47a0-7b21-7abc-8def-0000000000e1"
+    },
+    "Kc": {
+      "privateSeedBase64url": "4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uLi4uI",
+      "publicKeyBase64url": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8",
+      "nodeId": "018f47a0-7b21-7abc-8def-0000000000e2"
+    },
+    "Kv": {
+      "privateSeedBase64url": "4-Pj4-Pj4-Pj4-Pj4-Pj4-Pj4-Pj4-Pj4-Pj4-Pj4-M",
+      "publicKeyBase64url": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY",
+      "nodeId": "018f47a0-7b21-7abc-8def-0000000000e3"
+    }
+  },
+  "pins": {
+    "anchor-2-of-3": {
+      "threshold": 2,
+      "keys": [
+        {
+          "key": "vHy8tWNjdfodgkNNRmck2SN39TuYBpXdSdJtDOEiBaU"
+        },
+        {
+          "key": "Zej5sLxurhJBafBXb5c2LSlajPX3cLReFDV85kfTPuw"
+        },
+        {
+          "key": "rPErSswcZgqDJq7TQDnvtyil5JZIgkD1CpMqt6ulF1E"
+        }
+      ],
+      "expectedPinDigest": "3ddc2f3aaafd6facd3a6e651203b6f3ce007f256f75fb6daf2fb20e8e52fe7cf"
+    },
+    "anchor-1-of-1": {
+      "threshold": 1,
+      "keys": [
+        {
+          "key": "vHy8tWNjdfodgkNNRmck2SN39TuYBpXdSdJtDOEiBaU",
+          "nodeId": "018f47a0-7b21-7abc-8def-0000000000a1"
+        }
+      ],
+      "expectedPinDigest": "7ed8d07280d92558ca169ac9bef22db8c486c25cb3d87e5501090babd5ebb37f"
+    },
+    "anchor-1-of-2": {
+      "threshold": 1,
+      "keys": [
+        {
+          "key": "vHy8tWNjdfodgkNNRmck2SN39TuYBpXdSdJtDOEiBaU",
+          "nodeId": "018f47a0-7b21-7abc-8def-0000000000a1"
+        },
+        {
+          "key": "Zej5sLxurhJBafBXb5c2LSlajPX3cLReFDV85kfTPuw",
+          "nodeId": "018f47a0-7b21-7abc-8def-0000000000a2"
+        }
+      ],
+      "expectedPinDigest": "deb8c1e0e23147d3a02f9cae350b2484edd26be175371f9679e528c51b856408"
+    }
+  },
+  "statements": {
+    "gA": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "anchor",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000000a",
+          "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo"
+        },
+        "role": "admin",
+        "nonce": "ktFpeQLYKAx4XGw31YD54A",
+        "sigs": [
+          {
+            "key": "vHy8tWNjdfodgkNNRmck2SN39TuYBpXdSdJtDOEiBaU",
+            "sig": "nmg2tSthipJh6ZaP6WIrPGKn9yZYBhhJV_CDctgn_u-knouDqnyRwgkchyL5rQfGZh9uZ-6On9ZKMUToX3lUCw"
+          },
+          {
+            "key": "Zej5sLxurhJBafBXb5c2LSlajPX3cLReFDV85kfTPuw",
+            "sig": "IfTDjNMJOACJNovSIyW8ZIbfW27LbBADc-wVDlC2kpBO0tJmsAoHrb0XtYRX2_wL5OuGme0aE59nbt96GxzEBA"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e74363a616e63686f7233363a30313866343761302d376232312d376162632d386465662d30303030303030303030306134333a5a4b434f5a5a784f645144494f6d446b552d35676a65644e6a505244666f6f48656265787a7942544c496f353a61646d696e303a32323a6b74467065514c594b41783458477733315944353441303a",
+      "expectedId": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1"
+    },
+    "gW": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "anchor",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000000c",
+          "key": "VRVPQgZepaG-oFRjgmviaE65LfksEAAnqrquV8pVQgc"
+        },
+        "role": "validator",
+        "nonce": "hL8r2ih1UwQs8On1E6jy6A",
+        "sigs": [
+          {
+            "key": "Zej5sLxurhJBafBXb5c2LSlajPX3cLReFDV85kfTPuw",
+            "sig": "O7IGuttiXlkXQQa4SGAZoc53G9Fom7sKNb3PbslCK8wlGjzH7OXTkW1WCi4_wMdiuW41RvlS0Np2ed9nMvK6Bg"
+          },
+          {
+            "key": "rPErSswcZgqDJq7TQDnvtyil5JZIgkD1CpMqt6ulF1E",
+            "sig": "hisQJhHmwdbAi64E_POcarTqnTcHtLIXkOXtoP8XjxXR5uIUgpEOCZxHkpvbKAsSGQw89tKy1e2TSKM346xBDA"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e74363a616e63686f7233363a30313866343761302d376232312d376162632d386465662d30303030303030303030306334333a5652565051675a657061472d6f46526a676d7669614536354c666b734541416e7172717556387056516763393a76616c696461746f72303a32323a684c38723269683155775173384f6e3145366a793641303a",
+      "expectedId": "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d"
+    },
+    "gV": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000000b",
+          "key": "RyG1tjInLmWmjdp6wltBhfiwGRbbGFwUKH25Lit3D64"
+        },
+        "role": "validator",
+        "nonce": "a89tQVzwfExDp0D5d56fgA",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "0FkK-aXAJkIy7bvEnne-m79bqhKGxGTxGQIzk_mNZmLyCUuMH_y1QotjtMM9v_kQcDv_8zKssXbUDA85T_mmCQ"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3434313262373139333763656638613738306133306361616361316236653666363266393431386433383165633536373735363161323230353338313163613133363a30313866343761302d376232312d376162632d386465662d30303030303030303030306234333a52794731746a496e4c6d576d6a647036776c74426866697747526262474677554b4832354c697433443634393a76616c696461746f72303a32323a6138397451567a776645784470304435643536666741303a",
+      "expectedId": "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f"
+    },
+    "gP": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000000e",
+          "key": "rNzISU1Fj0SnqqwdaoTsYk2u6IQ22yribme6ZFoQYig"
+        },
+        "role": "participant",
+        "nonce": "s_psTdOL0IGaCvNeuwmh3g",
+        "sigs": [
+          {
+            "key": "RyG1tjInLmWmjdp6wltBhfiwGRbbGFwUKH25Lit3D64",
+            "sig": "kifhiv2pGTGgfCUR0oVtr55Wpf1dh_BaGBiPfa1aBglgIISg1JWXbcZKQ9umMbzf48bX6CdBpicvjNcY9j4MDQ"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3135336235383166656566333432356438613364373066363564373936313834303336613362323133333830643162333539313865336563393366376361396633363a30313866343761302d376232312d376162632d386465662d30303030303030303030306534333a724e7a49535531466a30536e71717764616f5473596b32753649513232797269626d65365a466f5159696731313a7061727469636970616e74303a32323a735f707354644f4c3049476143764e6575776d683367303a",
+      "expectedId": "auth-90fe6da3187b891e9692dfcc204e7868f1ec106a2cd4ea5df47d9e69bb8bef50"
+    },
+    "gR": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000000f",
+          "key": "1AS8RFZa7buJkVDlsLOzK5RBvwy3iEwzEw2o28J90s8"
+        },
+        "role": "xmesh-worker",
+        "nonce": "SNyF7VnqwcxaU9Qs57sewA",
+        "sigs": [
+          {
+            "key": "RyG1tjInLmWmjdp6wltBhfiwGRbbGFwUKH25Lit3D64",
+            "sig": "NecyE9ZUaTMr_zXHhkMbFcRL7LMx98Q4WzwfiemIP-CuCI6Rl-Ol_sSOdESd10T-gKnuzcgwmKBWevF2NpSYBA"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3135336235383166656566333432356438613364373066363564373936313834303336613362323133333830643162333539313865336563393366376361396633363a30313866343761302d376232312d376162632d386465662d30303030303030303030306634333a3141533852465a613762754a6b56446c734c4f7a4b355242767779336945777a4577326f32384a3930733831323a786d6573682d776f726b6572303a32323a534e794637566e717763786155395173353773657741303a",
+      "expectedId": "auth-ddd1f057a94651f5661a866791d393384ccf16fa0883aa7cef90f88c37d92b74"
+    },
+    "gQ": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000010",
+          "key": "tygv5HL5dkHBcJeCGlN4dKqqUyZFrTTb1ZhzMaTnP40"
+        },
+        "role": "participant",
+        "nonce": "xpeG8T2Evz-UsW5c5AFMJQ",
+        "sigs": [
+          {
+            "key": "VRVPQgZepaG-oFRjgmviaE65LfksEAAnqrquV8pVQgc",
+            "sig": "H8VIGmTJXaF-LP3vNmksXBsPIUHNpo41a8_KNQfQXXff_4VZguGalB8IzHlvS_DqyzSopv9_m8kcfsjNA7-PBQ"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d6565623932313437623134663139356337376437613033613364323036373962616531396337643134386335613862636139636433333439343434306562306433363a30313866343761302d376232312d376162632d386465662d30303030303030303030313034333a7479677635484c35646b4842634a6543476c4e34644b717155795a4672545462315a687a4d61546e50343031313a7061727469636970616e74303a32323a7870654738543245767a2d55735735633541464d4a51303a",
+      "expectedId": "auth-2341a2131fb673270b41833f685f832a3c4e696e3f295933f91e8208c8e20f88"
+    },
+    "rP": {
+      "statement": {
+        "kind": "revoke",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "targets": [
+          "auth-90fe6da3187b891e9692dfcc204e7868f1ec106a2cd4ea5df47d9e69bb8bef50"
+        ],
+        "nonce": "qzKgTjwFCux6UfEEeUcb7w",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "lPTqv8G8w_qdUAeRKNqwErg8_cxKutrBV9oIOTl5A-FS_sThOqf6pkW-PN15yH-P6BP6g-4DXDWLzNMuZ9uBDQ"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a363a7265766f6b6536393a617574682d34343132623731393337636566386137383061333063616163613162366536663632663934313864333831656335363737353631613232303533383131636131313a3136393a617574682d3930666536646133313837623839316539363932646663633230346537383638663165633130366132636434656135646634376439653639626238626566353032323a717a4b67546a77464375783655664545655563623777303a",
+      "expectedId": "auth-a1ebefb80b68472784beb0f0237675c1b381ccf40da14e201f61ac30e4fc5277"
+    },
+    "rA": {
+      "statement": {
+        "kind": "revoke",
+        "authorisedBy": "anchor",
+        "targets": [
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1"
+        ],
+        "nonce": "xALwUclJdMVw8euGD8EMvQ",
+        "issuedAt": 1786611600000,
+        "sigs": [
+          {
+            "key": "vHy8tWNjdfodgkNNRmck2SN39TuYBpXdSdJtDOEiBaU",
+            "sig": "dU1wC3gjyVHCr5AtKU-nda0XEeQksqkWWXNNImMvkMmVh-vrBAWAUjs4h5LLRpon6MVeSmMT4jDqWInM64jxCQ"
+          },
+          {
+            "key": "rPErSswcZgqDJq7TQDnvtyil5JZIgkD1CpMqt6ulF1E",
+            "sig": "EBsV6i-5HjeNkMTUlohbtCsIRprawlbwrflJ3fhQRuKuo7x3mqwLu7nHA6ynffXybvjTEcKoBsJ3GEqSGIsRDQ"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a363a7265766f6b65363a616e63686f72313a3136393a617574682d3434313262373139333763656638613738306133306361616361316236653666363266393431386433383165633536373735363161323230353338313163613132323a78414c7755636c4a644d5677386575474438454d765131333a31373836363131363030303030",
+      "expectedId": "auth-64cdb29ba89c39a45ce10caee2be159d9a708ef427734a8f7ec24d02d3b0d0bb"
+    },
+    "eV": {
+      "statement": {
+        "kind": "endorse",
+        "authorisedBy": "anchor",
+        "targets": [
+          "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+          "auth-a1ebefb80b68472784beb0f0237675c1b381ccf40da14e201f61ac30e4fc5277"
+        ],
+        "nonce": "_qbxozotM44XOHHI7WfGqw",
+        "sigs": [
+          {
+            "key": "Zej5sLxurhJBafBXb5c2LSlajPX3cLReFDV85kfTPuw",
+            "sig": "I1LjwNChi0aTYr5ZwO07ZN1Yjmil2I3ClnqVFOVYxVfnMV3o7ZQA_mE6xDdhl1VOHaDJTZ1s9232bMre9_7DAA"
+          },
+          {
+            "key": "rPErSswcZgqDJq7TQDnvtyil5JZIgkD1CpMqt6ulF1E",
+            "sig": "c8Pkyyr4WjwOhP6BVHHAvJHw2qxLKwx2bFfXpR2RQ0gJnzTMvybRE7juO9hqhFEFkCWBMXL2YerUXwo9mJfwDg"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a373a656e646f727365363a616e63686f72313a3236393a617574682d3135336235383166656566333432356438613364373066363564373936313834303336613362323133333830643162333539313865336563393366376361396636393a617574682d6131656265666238306236383437323738346265623066303233373637356331623338316363663430646131346532303166363161633330653466633532373732323a5f7162786f7a6f744d3434584f484849375766477177303a",
+      "expectedId": "auth-7486a34dd62cd0c0cdb8199eae2558146c78ba1ef82b48035af10ef3962be642"
+    },
+    "rVbyW": {
+      "statement": {
+        "kind": "revoke",
+        "authorisedBy": "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d",
+        "targets": [
+          "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f"
+        ],
+        "nonce": "lFGEy1gbDm85RTmYwAQCrQ",
+        "sigs": [
+          {
+            "key": "VRVPQgZepaG-oFRjgmviaE65LfksEAAnqrquV8pVQgc",
+            "sig": "peDUXh_q92U-fUYiGIlHV_Ry9ZNZZWeOvvH6hLdIZZN2QlWuUOHqdZM--NbcvvtLGnDHmkrTB4RHeJ29X2YmAw"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a363a7265766f6b6536393a617574682d65656239323134376231346631393563373764376130336133643230363739626165313963376431343863356138626361396364333334393434343065623064313a3136393a617574682d3135336235383166656566333432356438613364373066363564373936313834303336613362323133333830643162333539313865336563393366376361396632323a6c46474579316762446d383552546d59774151437251303a",
+      "expectedId": "auth-38485b4e04a74f905de58ad693cf9ee585f719b40a3539ab7fed4588b0845b08"
+    },
+    "gA2": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "anchor",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000000a",
+          "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo"
+        },
+        "role": "admin",
+        "nonce": "w6Zf_Uavv-Qyiy5pzsZlqQ",
+        "sigs": [
+          {
+            "key": "vHy8tWNjdfodgkNNRmck2SN39TuYBpXdSdJtDOEiBaU",
+            "sig": "e0DamPK8ySrkKfyo5nCbXBXv3mUeeU5XFr-7lKo1RaBMzQ2f6LUbrzjnuHDsfn135VI7QeBeKxz5ExNDP7koBQ"
+          },
+          {
+            "key": "Zej5sLxurhJBafBXb5c2LSlajPX3cLReFDV85kfTPuw",
+            "sig": "bpuqp7-uBAHmiPmHQlBF8mDcR9EWRqImc82VnCLmJyjlqdGjgBTQNWZJoj_7Ko93R-uIgKJKaF1Q8V9d9kqgDw"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e74363a616e63686f7233363a30313866343761302d376232312d376162632d386465662d30303030303030303030306134333a5a4b434f5a5a784f645144494f6d446b552d35676a65644e6a505244666f6f48656265787a7942544c496f353a61646d696e303a32323a77365a665f556176762d5179697935707a735a6c7151303a",
+      "expectedId": "auth-5a801c7e5e8ce4e83969fa620aa1da491a1f93e027bd53f5f6fb8bc4494bfefc"
+    },
+    "xThin": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "anchor",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-0000000000ee",
+          "key": "gUci3nHFsU50jf8yKuf3xBXO5Vh2ZJUpLNbEwKap3yg"
+        },
+        "role": "validator",
+        "nonce": "oolgeHradi9TS06KgvW2-Q",
+        "sigs": [
+          {
+            "key": "vHy8tWNjdfodgkNNRmck2SN39TuYBpXdSdJtDOEiBaU",
+            "sig": "bhHoQELroMX_Yw9QKytjTa77VB3tiGQEvNoKQXSAzHsDZwbYCo2UTUry4BaZDnB3SLcmfALrlMiG4IbDNmr7BQ"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e74363a616e63686f7233363a30313866343761302d376232312d376162632d386465662d30303030303030303030656534333a67556369336e4846735535306a6638794b7566337842584f355668325a4a55704c4e6245774b6170337967393a76616c696461746f72303a32323a6f6f6c6765487261646939545330364b677657322d51303a",
+      "expectedId": "auth-433f7442ed6dc2846e6dc7d847f1ddef301c02eeaacbec61df00582a1167ff7b"
+    },
+    "xDupKey": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "anchor",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-0000000000ee",
+          "key": "gUci3nHFsU50jf8yKuf3xBXO5Vh2ZJUpLNbEwKap3yg"
+        },
+        "role": "validator",
+        "nonce": "jn6-HfVofovp8ltCe_b8mg",
+        "sigs": [
+          {
+            "key": "vHy8tWNjdfodgkNNRmck2SN39TuYBpXdSdJtDOEiBaU",
+            "sig": "pBHMqRSEUH3u6l41HtximB0D0y5QkcpxY2BAbp4JV5DI7qn6ZZwxlvuQV2yrwi7qss2JUBzFA6x4RCEduMtLBQ"
+          },
+          {
+            "key": "vHy8tWNjdfodgkNNRmck2SN39TuYBpXdSdJtDOEiBaU",
+            "sig": "pBHMqRSEUH3u6l41HtximB0D0y5QkcpxY2BAbp4JV5DI7qn6ZZwxlvuQV2yrwi7qss2JUBzFA6x4RCEduMtLBQ"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e74363a616e63686f7233363a30313866343761302d376232312d376162632d386465662d30303030303030303030656534333a67556369336e4846735535306a6638794b7566337842584f355668325a4a55704c4e6245774b6170337967393a76616c696461746f72303a32323a6a6e362d4866566f666f7670386c7443655f62386d67303a",
+      "expectedId": "auth-a47f6807d7cc970b5f3504fb409a8592dbad234a05e47004c5b4ce33aac4852a"
+    },
+    "xValidatorByValidator": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-0000000000ee",
+          "key": "gUci3nHFsU50jf8yKuf3xBXO5Vh2ZJUpLNbEwKap3yg"
+        },
+        "role": "validator",
+        "nonce": "fyXCb1bKyH5jvQCgdsPDVA",
+        "sigs": [
+          {
+            "key": "RyG1tjInLmWmjdp6wltBhfiwGRbbGFwUKH25Lit3D64",
+            "sig": "w7TrT7c7xLncoDRB2p6pJjoGsqRa8IcWYJ8mCLTvP1s0U7HsPQqC7lW9G6Jjloz0dcj2Hk5FsdprCrJWTYV4Ag"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3135336235383166656566333432356438613364373066363564373936313834303336613362323133333830643162333539313865336563393366376361396633363a30313866343761302d376232312d376162632d386465662d30303030303030303030656534333a67556369336e4846735535306a6638794b7566337842584f355668325a4a55704c4e6245774b6170337967393a76616c696461746f72303a32323a667958436231624b7948356a76514367647350445641303a",
+      "expectedId": "auth-940e1809dd17f36003262367e9d70eef89744178702ab073793280953a0c178f"
+    },
+    "xEndorseByValidator": {
+      "statement": {
+        "kind": "endorse",
+        "authorisedBy": "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d",
+        "targets": [
+          "auth-2341a2131fb673270b41833f685f832a3c4e696e3f295933f91e8208c8e20f88"
+        ],
+        "nonce": "w4ZwAHk_tQbnNc8n4EBWAg",
+        "sigs": [
+          {
+            "key": "VRVPQgZepaG-oFRjgmviaE65LfksEAAnqrquV8pVQgc",
+            "sig": "JRKt3ymrGgszSv2zuspUBBFbTU4gRtjsC503is3oQHOmTb8fJaTIjs8YbxTkQX2qvXeHmegF-UI_DwHvZwp-Bw"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a373a656e646f72736536393a617574682d65656239323134376231346631393563373764376130336133643230363739626165313963376431343863356138626361396364333334393434343065623064313a3136393a617574682d3233343161323133316662363733323730623431383333663638356638333261336334653639366533663239353933336639316538323038633865323066383832323a77345a7741486b5f7451626e4e63386e344542574167303a",
+      "expectedId": "auth-bc565860d12fe3951087215b5529854ae2574cc152aa54402eef23142fb39e2a"
+    },
+    "xByParticipant": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-90fe6da3187b891e9692dfcc204e7868f1ec106a2cd4ea5df47d9e69bb8bef50",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-0000000000ee",
+          "key": "gUci3nHFsU50jf8yKuf3xBXO5Vh2ZJUpLNbEwKap3yg"
+        },
+        "role": "participant",
+        "nonce": "P2ReDhyA1nob2RVoKN6lRQ",
+        "sigs": [
+          {
+            "key": "rNzISU1Fj0SnqqwdaoTsYk2u6IQ22yribme6ZFoQYig",
+            "sig": "W8lBKX_5tCoEGwCwpYVKztNdenKGaRU5Sxt7Rwap9rIr-miAOVJP7RLv1b__LYvCvH3US1YE5TQYw0SIksc6Dw"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3930666536646133313837623839316539363932646663633230346537383638663165633130366132636434656135646634376439653639626238626566353033363a30313866343761302d376232312d376162632d386465662d30303030303030303030656534333a67556369336e4846735535306a6638794b7566337842584f355668325a4a55704c4e6245774b617033796731313a7061727469636970616e74303a32323a5032526544687941316e6f623252566f4b4e366c5251303a",
+      "expectedId": "auth-247a83f3acac7b07cb2dc7e66cda084d207042934087b88ff7656cf905e2e10f"
+    },
+    "xWrongKey": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-0000000000ee",
+          "key": "gUci3nHFsU50jf8yKuf3xBXO5Vh2ZJUpLNbEwKap3yg"
+        },
+        "role": "participant",
+        "nonce": "X52JhskIvytGPX6MsCrIyA",
+        "sigs": [
+          {
+            "key": "gUci3nHFsU50jf8yKuf3xBXO5Vh2ZJUpLNbEwKap3yg",
+            "sig": "Zl0ZIjmlBX47jhK4gZ1G0pMlmRMcQl9mkDAnqgyuDw3QkY4Xk4uEeUTjCOb1xk48qoUtm9if1a4Vbwjd9CIiDQ"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3135336235383166656566333432356438613364373066363564373936313834303336613362323133333830643162333539313865336563393366376361396633363a30313866343761302d376232312d376162632d386465662d30303030303030303030656534333a67556369336e4846735535306a6638794b7566337842584f355668325a4a55704c4e6245774b617033796731313a7061727469636970616e74303a32323a5835324a68736b49767974475058364d734372497941303a",
+      "expectedId": "auth-e49a9ace7fd0df914d4a779d32649024dd0b88c2bcd13a7881371053a5fb27a3"
+    },
+    "xIdentityKey": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-0000000000ee",
+          "key": "AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+        },
+        "role": "participant",
+        "nonce": "4A4UYaq2MuU5EMJe4Y9Hjg",
+        "sigs": [
+          {
+            "key": "RyG1tjInLmWmjdp6wltBhfiwGRbbGFwUKH25Lit3D64",
+            "sig": "Dck1gX24ABQySIiN_sV4uA34EgV3BuGkoMrWuH5j32P8jPRcMs7JFccouUKNDa_qnVpd-7XHKUEwZ20rF8jfDw"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3135336235383166656566333432356438613364373066363564373936313834303336613362323133333830643162333539313865336563393366376361396633363a30313866343761302d376232312d376162632d386465662d30303030303030303030656534333a4151414141414141414141414141414141414141414141414141414141414141414141414141414141414131313a7061727469636970616e74303a32323a34413455596171324d755535454d4a65345939486a67303a",
+      "expectedId": "auth-ff43a0725bd31be5fe365eb61bba76b3ac8a2b57b8af131240e76b95158482cd"
+    },
+    "xUpperNodeId": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+        "subject": {
+          "nodeId": "018F47A0-7B21-7ABC-8DEF-0000000000EE",
+          "key": "gUci3nHFsU50jf8yKuf3xBXO5Vh2ZJUpLNbEwKap3yg"
+        },
+        "role": "participant",
+        "nonce": "VdcbeowXt7Jb_NJXt7KBcQ",
+        "sigs": [
+          {
+            "key": "RyG1tjInLmWmjdp6wltBhfiwGRbbGFwUKH25Lit3D64",
+            "sig": "T9OTD1F7Ytg4MenJmRZj22Amqegz4ydglPusUs9Ifb8ZgqJIWLqXBG6STGbEorJa1aLLPIgMlMJEarsfCxGXDQ"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3135336235383166656566333432356438613364373066363564373936313834303336613362323133333830643162333539313865336563393366376361396633363a30313846343741302d374232312d374142432d384445462d30303030303030303030454534333a67556369336e4846735535306a6638794b7566337842584f355668325a4a55704c4e6245774b617033796731313a7061727469636970616e74303a32323a56646362656f775874374a625f4e4a5874374b426351303a",
+      "expectedId": "auth-a5d07a82bb2d54f25e6871858bcd51680f58537bb340dc30ee0f196eb727e9bc"
+    },
+    "xAuthIsRevoke": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-a1ebefb80b68472784beb0f0237675c1b381ccf40da14e201f61ac30e4fc5277",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-0000000000ee",
+          "key": "gUci3nHFsU50jf8yKuf3xBXO5Vh2ZJUpLNbEwKap3yg"
+        },
+        "role": "participant",
+        "nonce": "ieCaedVZjeeUsfHPU5dW8w",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "Ub115ADvjMxgU0Xk71aUWeRwvmrFErYbdB8Ae-xgGKut8V8GiqMq_CbzhAdjNRwrye-uWUu50yiLwGZHNa2gBw"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d6131656265666238306236383437323738346265623066303233373637356331623338316363663430646131346532303166363161633330653466633532373733363a30313866343761302d376232312d376162632d386465662d30303030303030303030656534333a67556369336e4846735535306a6638794b7566337842584f355668325a4a55704c4e6245774b617033796731313a7061727469636970616e74303a32323a696543616564565a6a65655573664850553564573877303a",
+      "expectedId": "auth-6cfc12e0be5e8909f1592424ef5fc8de0ec75ea4d7af08f39d42acdefc0aabd3"
+    },
+    "gH": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "anchor",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000000d",
+          "key": "WRLawCDc2rp2fOymQkPoRRdiFcSF5BjlD4AgXYEhipE"
+        },
+        "role": "validator",
+        "nonce": "20ePPNTnbaz472w68Z8ZkQ",
+        "sigs": [
+          {
+            "key": "vHy8tWNjdfodgkNNRmck2SN39TuYBpXdSdJtDOEiBaU",
+            "sig": "O7IsI-bgOYi78UWvZocf41LUAYCs6s0Ofe0VGL9cJZBqNdJe0aH5z9tBAfG0lR-jkpyw_uvtKlw6Ws5dz4GZAg"
+          },
+          {
+            "key": "rPErSswcZgqDJq7TQDnvtyil5JZIgkD1CpMqt6ulF1E",
+            "sig": "A7Gt7YRtrrBhyhmnEgXrF9_631S8qZJYZjhYfKnG0Yru_b32clUPPYLP8YCMQBa-xWg7c1CzuSc26wg4hiw3Cg"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e74363a616e63686f7233363a30313866343761302d376232312d376162632d386465662d30303030303030303030306434333a57524c617743446332727032664f796d516b506f525264694663534635426a6c4434416758594568697045393a76616c696461746f72303a32323a32306550504e546e62617a3437327736385a385a6b51303a",
+      "expectedId": "auth-17d227a7a10f8a7d473221f21f0cc0941964ea38fadcc094d2b7e5d54b595a5b"
+    },
+    "gM": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-17d227a7a10f8a7d473221f21f0cc0941964ea38fadcc094d2b7e5d54b595a5b",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-0000000000ee",
+          "key": "gUci3nHFsU50jf8yKuf3xBXO5Vh2ZJUpLNbEwKap3yg"
+        },
+        "role": "participant",
+        "nonce": "o9qtS48Grsrd3mQE1eyOQQ",
+        "sigs": [
+          {
+            "key": "WRLawCDc2rp2fOymQkPoRRdiFcSF5BjlD4AgXYEhipE",
+            "sig": "hfKC1P7goTltIANXG9G5m9z0UqeenD5Q78_YwJBct6Y5exvNvIYVgsfc9TqB3kuq1w3CDK7xoLCmLgIAqeT8Cw"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3137643232376137613130663861376434373332323166323166306363303934313936346561333866616463633039346432623765356435346235393561356233363a30313866343761302d376232312d376162632d386465662d30303030303030303030656534333a67556369336e4846735535306a6638794b7566337842584f355668325a4a55704c4e6245774b617033796731313a7061727469636970616e74303a32323a6f3971745334384772737264336d51453165794f5151303a",
+      "expectedId": "auth-b18c03b9f244a41cf24bdb08dbd978636f358bd60a5d990ba4aa12c7b4cce675"
+    },
+    "gP2": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000011",
+          "key": "3FF_9SfnvPqwZ_LMYbvvjnX5uo4TMq09QviTjgBF7Yk"
+        },
+        "role": "participant",
+        "nonce": "tqH2VFo0y0dxNb6Jr7n2eg",
+        "sigs": [
+          {
+            "key": "RyG1tjInLmWmjdp6wltBhfiwGRbbGFwUKH25Lit3D64",
+            "sig": "0j-CW5756DJvCtTQcN_pjn2Ep7Xj6-LN6pdMXYeHzyA7QcR3Yqi7RDkb4N0mIrr24K0g1krNPZrF0X8AZGpPDg"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3135336235383166656566333432356438613364373066363564373936313834303336613362323133333830643162333539313865336563393366376361396633363a30313866343761302d376232312d376162632d386465662d30303030303030303030313134333a3346465f3953666e765071775a5f4c4d596276766a6e5835756f34544d713039517669546a67424637596b31313a7061727469636970616e74303a32323a7471483256466f30793064784e62364a72376e326567303a",
+      "expectedId": "auth-942e24924ac5d724050642fe41bae28ab772a3614e6b71be05d7d5487a9f7183"
+    },
+    "rP2": {
+      "statement": {
+        "kind": "revoke",
+        "authorisedBy": "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+        "targets": [
+          "auth-942e24924ac5d724050642fe41bae28ab772a3614e6b71be05d7d5487a9f7183"
+        ],
+        "nonce": "KGBrzartZTnDfCrFYqgWfA",
+        "sigs": [
+          {
+            "key": "RyG1tjInLmWmjdp6wltBhfiwGRbbGFwUKH25Lit3D64",
+            "sig": "UW-0FAzRQ7lV1nwHBqkjH6B1v82WDxoobfsq7bUes9Eb1vRJ76rUJF8UEguuVsw7goyTfidnA9c9VQ04i-sSCg"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a363a7265766f6b6536393a617574682d31353362353831666565663334323564386133643730663635643739363138343033366133623231333338306431623335393138653365633933663763613966313a3136393a617574682d3934326532343932346163356437323430353036343266653431626165323861623737326133363134653662373162653035643764353438376139663731383332323a4b4742727a6172745a546e4466437246597167576641303a",
+      "expectedId": "auth-9ccdd6df33a5a7cda6345b9c3fa1910182b77aae84ba98c79846ee03efaa6f59"
+    },
+    "rRv": {
+      "statement": {
+        "kind": "revoke",
+        "authorisedBy": "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+        "targets": [
+          "auth-ddd1f057a94651f5661a866791d393384ccf16fa0883aa7cef90f88c37d92b74"
+        ],
+        "nonce": "jeFUS189uHnp4wBrkvVNqw",
+        "sigs": [
+          {
+            "key": "RyG1tjInLmWmjdp6wltBhfiwGRbbGFwUKH25Lit3D64",
+            "sig": "jszqkEspeqyF14CUDPPzBh1dSFYk26Vakd08puOIkkAOrkSFzyELB7R8FXk6UhupeeOhAXRkq2NqXTedGIggBQ"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a363a7265766f6b6536393a617574682d31353362353831666565663334323564386133643730663635643739363138343033366133623231333338306431623335393138653365633933663763613966313a3136393a617574682d6464643166303537613934363531663536363161383636373931643339333338346363663136666130383833616137636566393066383863333764393262373432323a6a6546555331383975486e70347742726b76564e7177303a",
+      "expectedId": "auth-170c36b7abc7d0d945e30086a4eb61bfd5f3d97d8ec7facd6ec5e0c1e6905f43"
+    },
+    "rPv": {
+      "statement": {
+        "kind": "revoke",
+        "authorisedBy": "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+        "targets": [
+          "auth-90fe6da3187b891e9692dfcc204e7868f1ec106a2cd4ea5df47d9e69bb8bef50"
+        ],
+        "nonce": "y0IjsN9wnJbqd16UIx6HYQ",
+        "sigs": [
+          {
+            "key": "RyG1tjInLmWmjdp6wltBhfiwGRbbGFwUKH25Lit3D64",
+            "sig": "NHHj10kAHbbudoRtpCoVbxNt0jlUi_mpz632KTNN3VV0J8SvhcbCe4lXsw1ZCjFuK0AbSnrfskTCsCS_E1xkAA"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a363a7265766f6b6536393a617574682d31353362353831666565663334323564386133643730663635643739363138343033366133623231333338306431623335393138653365633933663763613966313a3136393a617574682d3930666536646133313837623839316539363932646663633230346537383638663165633130366132636434656135646634376439653639626238626566353032323a7930496a734e39776e4a627164313655497836485951303a",
+      "expectedId": "auth-fac83b1fd82cd0bee8fd4e2d3353d1bc3befb2dce58fee9f736173d105056c54"
+    },
+    "gD": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "anchor",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000012",
+          "key": "buCR_SgKm2hVT6c8WIEl1H00JcaKJroja02tkPkKj5I"
+        },
+        "role": "admin",
+        "nonce": "hT_dH8rjzroaxE62j1nvaA",
+        "sigs": [
+          {
+            "key": "Zej5sLxurhJBafBXb5c2LSlajPX3cLReFDV85kfTPuw",
+            "sig": "mJz-fVwpVDRLgOaEeNJRTbmpC9imeV_BjAyQ-qLRseFOluwMCmcN8TCubXzLU7c9OxZRX7PngZDqz1N4Hf9mCg"
+          },
+          {
+            "key": "rPErSswcZgqDJq7TQDnvtyil5JZIgkD1CpMqt6ulF1E",
+            "sig": "BsdUmXcXqc0JsDpCTpo1Pi1OnD3BlPFNJWQDBhbdpSCjMwDgA5lq_GjzLI5lNiGgC9vn6-SVHVo17f_lTyXgAQ"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e74363a616e63686f7233363a30313866343761302d376232312d376162632d386465662d30303030303030303030313234333a627543525f53674b6d326856543663385749456c314830304a63614b4a726f6a613032746b506b4b6a3549353a61646d696e303a32323a68545f644838726a7a726f61784536326a316e766141303a",
+      "expectedId": "auth-43ecaa783c79e83600ee9698a25c64f90f3c96c9e12ad4e4555c270352b285c1"
+    },
+    "gWA": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-43ecaa783c79e83600ee9698a25c64f90f3c96c9e12ad4e4555c270352b285c1",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000013",
+          "key": "Qej94TKtZw5TTNiyddLNfux3czxm-NtIocraf6v8RVU"
+        },
+        "role": "admin",
+        "scope": "xmesh-world:w1",
+        "nonce": "4LqE78s4J9PiGamISFFTRA",
+        "sigs": [
+          {
+            "key": "buCR_SgKm2hVT6c8WIEl1H00JcaKJroja02tkPkKj5I",
+            "sig": "EBhRORf6MGddT7_wNgzbAqccMoy-MEUocqBknHTHCoFdU_sq3yfWuaYSxSZrTqceCVapfCJhvigD_3ZgT79fCA"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3433656361613738336337396538333630306565393639386132356336346639306633633936633965313261643465343535356332373033353262323835633133363a30313866343761302d376232312d376162632d386465662d30303030303030303030313334333a51656a3934544b745a773554544e697964644c4e66757833637a786d2d4e74496f63726166367638525655353a61646d696e31343a786d6573682d776f726c643a773132323a344c7145373873344a39506947616d49534646545241303a",
+      "expectedId": "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb"
+    },
+    "gWB": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-43ecaa783c79e83600ee9698a25c64f90f3c96c9e12ad4e4555c270352b285c1",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000001b",
+          "key": "u3h-WQGsOBaKizc3FfVx7fdVxRj6ydxz4zkSbOT1Lwg"
+        },
+        "role": "admin",
+        "scope": "xmesh-world:w2",
+        "nonce": "ERs_jk9F475aS5SyxmmjeA",
+        "sigs": [
+          {
+            "key": "buCR_SgKm2hVT6c8WIEl1H00JcaKJroja02tkPkKj5I",
+            "sig": "0wmmbQIzjG8cPTh1Ym8MVGI4Q8pDXD86eRzvi71nVrpD5Tt4YcC4Xal5CpsntI8fGKg4UJlzAf3Vr8kvmhDTCg"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3433656361613738336337396538333630306565393639386132356336346639306633633936633965313261643465343535356332373033353262323835633133363a30313866343761302d376232312d376162632d386465662d30303030303030303030316234333a7533682d575147734f42614b697a6333466656783766645678526a367964787a347a6b53624f54314c7767353a61646d696e31343a786d6573682d776f726c643a773232323a4552735f6a6b39463437356153355379786d6d6a6541303a",
+      "expectedId": "auth-1e44b2e18b6030f5304a8c148df15932e8420cae5d1c88b0579f221eb2e3ec4a"
+    },
+    "gSI": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000014",
+          "key": "tHQLpOD34FdvEegUnbuyUpwhIhPbZ5gx-10bIh6EVS0"
+        },
+        "role": "issuer",
+        "scope": "xmesh-world:w1",
+        "nonce": "aeVugiIPrPX-0lGIe0rftw",
+        "sigs": [
+          {
+            "key": "Qej94TKtZw5TTNiyddLNfux3czxm-NtIocraf6v8RVU",
+            "sig": "qnXRTHzSWzo_-KVP-cpfCFM19JarejOlJGT2PbtKudRKpLYQ4d_lTp-GmEdC-AEptcwh9eKcRA-knOqDoJDxDA"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3937616261383233613861626263333662336633373433373634323937386138346631396232396565303865326338363332393538623163303165633361636233363a30313866343761302d376232312d376162632d386465662d30303030303030303030313434333a7448514c704f443334466476456567556e62757955707768496850625a3567782d31306249683645565330363a69737375657231343a786d6573682d776f726c643a773132323a61655675676949507250582d306c4749653072667477303a",
+      "expectedId": "auth-4fb54aaadf85d38bbd1c871f9828b5b5d98c7e40676cc34af628630ba0a31da2"
+    },
+    "gS1": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4fb54aaadf85d38bbd1c871f9828b5b5d98c7e40676cc34af628630ba0a31da2",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000015",
+          "key": "7TI0snbUztpX1ZutFPuvWnc8DzGMmZ3jpg1TxaWzTAU"
+        },
+        "role": "xmesh-seat",
+        "scope": "xmesh-world:w1",
+        "nonce": "F-IwVTNnE6X0pyuuMG9eog",
+        "sigs": [
+          {
+            "key": "tHQLpOD34FdvEegUnbuyUpwhIhPbZ5gx-10bIh6EVS0",
+            "sig": "WiARTmrsnEcQYoSZDfGyT52IzbzSH9tiCCJL-Kay_HwAYpE3hHRQcxtYHVq6IjyqfNInole3jKc9GxkaA6pBAg"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3466623534616161646638356433386262643163383731663938323862356235643938633765343036373663633334616636323836333062613061333164613233363a30313866343761302d376232312d376162632d386465662d30303030303030303030313534333a37544930736e62557a747058315a757446507576576e6338447a474d6d5a336a706731547861577a54415531303a786d6573682d7365617431343a786d6573682d776f726c643a773132323a462d497756544e6e45365830707975754d4739656f67303a",
+      "expectedId": "auth-f37e987e8999b554e8882dd96b617b74595d37879a3390a697e16547e3bdd0e0"
+    },
+    "gSR": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000001c",
+          "key": "YN5ey4qpiEIsIrHiC_xAFJ7ZTR6QwFrqeMjyG-MxcLA"
+        },
+        "role": "issuer",
+        "scope": "xmesh-world:w1/region-a",
+        "nonce": "5OlUaLL_MhiGzXtauVbvjg",
+        "sigs": [
+          {
+            "key": "Qej94TKtZw5TTNiyddLNfux3czxm-NtIocraf6v8RVU",
+            "sig": "5v6zL_QrMYuY-vccDatV91b21nST-84Zt4tgOQxojRNvMpJtPpKMCAfHhOi8_7EwNnYaxLGsa55BiBZWIpHmDg"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3937616261383233613861626263333662336633373433373634323937386138346631396232396565303865326338363332393538623163303165633361636233363a30313866343761302d376232312d376162632d386465662d30303030303030303030316334333a594e3565793471706945497349724869435f7841464a375a5452365177467271654d6a79472d4d78634c41363a69737375657232333a786d6573682d776f726c643a77312f726567696f6e2d6132323a354f6c55614c4c5f4d6869477a587461755662766a67303a",
+      "expectedId": "auth-0931b9103bf127e5fb50d76f967f61b6a01f04a008ab955bbf5453dafbc6c1ce"
+    },
+    "gS3": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-0931b9103bf127e5fb50d76f967f61b6a01f04a008ab955bbf5453dafbc6c1ce",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000001d",
+          "key": "jkGQzWj9wH3aDFnmywc-_S2TEdYio4oy32iFtKQSFVE"
+        },
+        "role": "xmesh-seat",
+        "scope": "xmesh-world:w1/region-a",
+        "nonce": "7ljWBIEB0L_zy1ITuUSmuQ",
+        "sigs": [
+          {
+            "key": "YN5ey4qpiEIsIrHiC_xAFJ7ZTR6QwFrqeMjyG-MxcLA",
+            "sig": "sYG9bP-KvibzSGgWcYgB-O_rAGoUlXdk5PzWe4Lpi0IUcTtNCyauWWcmHaWxZankHbUOET5YwDU6INdG1DieDQ"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3039333162393130336266313237653566623530643736663936376636316236613031663034613030386162393535626266353435336461666263366331636533363a30313866343761302d376232312d376162632d386465662d30303030303030303030316434333a6a6b47517a576a397748336144466e6d7977632d5f533254456459696f346f7933326946744b515346564531303a786d6573682d7365617432333a786d6573682d776f726c643a77312f726567696f6e2d6132323a376c6a5742494542304c5f7a793149547555536d7551303a",
+      "expectedId": "auth-3e3d266524851810a3086010febb5b4435bb93e2bed02e818d47466cd3596f3d"
+    },
+    "rS1": {
+      "statement": {
+        "kind": "revoke",
+        "authorisedBy": "auth-4fb54aaadf85d38bbd1c871f9828b5b5d98c7e40676cc34af628630ba0a31da2",
+        "targets": [
+          "auth-f37e987e8999b554e8882dd96b617b74595d37879a3390a697e16547e3bdd0e0"
+        ],
+        "nonce": "l-tF_ggXYbv-iTJXkIUFTA",
+        "sigs": [
+          {
+            "key": "tHQLpOD34FdvEegUnbuyUpwhIhPbZ5gx-10bIh6EVS0",
+            "sig": "mg1UujZ1pU077QfLfmLuQxjH8N1_DjyHX92DSclQ1tsSvZRWfT3WegYL3NYHgBbSZ8KS0_Ng4WFWdQAnyq9ICg"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a363a7265766f6b6536393a617574682d34666235346161616466383564333862626431633837316639383238623562356439386337653430363736636333346166363238363330626130613331646132313a3136393a617574682d6633376539383765383939396235353465383838326464393662363137623734353935643337383739613333393061363937653136353437653362646430653032323a6c2d74465f6767585962762d69544a586b4955465441303a",
+      "expectedId": "auth-f99058ade43b386a090c1fbeffc3c95f8ed22520183b888b4828c5f5686e8119"
+    },
+    "xScopeDropped": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-0000000000ee",
+          "key": "gUci3nHFsU50jf8yKuf3xBXO5Vh2ZJUpLNbEwKap3yg"
+        },
+        "role": "issuer",
+        "nonce": "dHSUKjxTRNjdBcuD6zWZFQ",
+        "sigs": [
+          {
+            "key": "Qej94TKtZw5TTNiyddLNfux3czxm-NtIocraf6v8RVU",
+            "sig": "FnykF7EN-XZoGvOXPFVKnyDf_fsL8oVLsjEUzHTkL6-lHY26i1C_d9rPc-jUqwMk367XAaefCrZR-AEUi56iAA"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3937616261383233613861626263333662336633373433373634323937386138346631396232396565303865326338363332393538623163303165633361636233363a30313866343761302d376232312d376162632d386465662d30303030303030303030656534333a67556369336e4846735535306a6638794b7566337842584f355668325a4a55704c4e6245774b6170337967363a697373756572303a32323a644853554b6a7854524e6a6442637544367a575a4651303a",
+      "expectedId": "auth-b845347899df2a5d345cbafb8511adddc8399a230d8e3108c69098fcbcb3db81"
+    },
+    "xScopeSideways": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-0000000000ee",
+          "key": "gUci3nHFsU50jf8yKuf3xBXO5Vh2ZJUpLNbEwKap3yg"
+        },
+        "role": "issuer",
+        "scope": "xmesh-world:w2",
+        "nonce": "-X_fdpWV7mjZxu40g4ozhA",
+        "sigs": [
+          {
+            "key": "Qej94TKtZw5TTNiyddLNfux3czxm-NtIocraf6v8RVU",
+            "sig": "JTnuy69GHEXmtJurIYfWlu_tjOdDT3C1rDkn6WUGv3IGslKYf6DhXuMKxbum-Y66wmk_-FMzh8-SXSPYaHedCw"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3937616261383233613861626263333662336633373433373634323937386138346631396232396565303865326338363332393538623163303165633361636233363a30313866343761302d376232312d376162632d386465662d30303030303030303030656534333a67556369336e4846735535306a6638794b7566337842584f355668325a4a55704c4e6245774b6170337967363a69737375657231343a786d6573682d776f726c643a773232323a2d585f6664705756376d6a5a7875343067346f7a6841303a",
+      "expectedId": "auth-c06e4275a654439de812f637933f2686ddffc56eedd4e99a1cfca96fe78e0aeb"
+    },
+    "xScopeWiderSeat": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-0931b9103bf127e5fb50d76f967f61b6a01f04a008ab955bbf5453dafbc6c1ce",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-0000000000ee",
+          "key": "gUci3nHFsU50jf8yKuf3xBXO5Vh2ZJUpLNbEwKap3yg"
+        },
+        "role": "xmesh-seat",
+        "scope": "xmesh-world:w1",
+        "nonce": "-TxtJaCrqd1-taRMJuoWcg",
+        "sigs": [
+          {
+            "key": "YN5ey4qpiEIsIrHiC_xAFJ7ZTR6QwFrqeMjyG-MxcLA",
+            "sig": "XoKbtnXRVtLiybftX8fAFtKfoy0HIzMSEGa63n9x8KwiMhwh7wdvvahKSUNS7LNTULzWXSk0u4nK-J3V205uAw"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3039333162393130336266313237653566623530643736663936376636316236613031663034613030386162393535626266353435336461666263366331636533363a30313866343761302d376232312d376162632d386465662d30303030303030303030656534333a67556369336e4846735535306a6638794b7566337842584f355668325a4a55704c4e6245774b617033796731303a786d6573682d7365617431343a786d6573682d776f726c643a773132323a2d5478744a6143727164312d7461524d4a756f576367303a",
+      "expectedId": "auth-e2473eefe2e9e574003afda20ccfadf1e081f9217b0bcbf4a0d87f205514a014"
+    },
+    "xScopeW10": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-0000000000ee",
+          "key": "gUci3nHFsU50jf8yKuf3xBXO5Vh2ZJUpLNbEwKap3yg"
+        },
+        "role": "issuer",
+        "scope": "xmesh-world:w10",
+        "nonce": "i2ZJI6sV5VNfnGR26YphmQ",
+        "sigs": [
+          {
+            "key": "Qej94TKtZw5TTNiyddLNfux3czxm-NtIocraf6v8RVU",
+            "sig": "AKrxZIgskHqu5lypsmK1D1A-LkiaFYOBE7IBawnVqpqrosyEEGfK_oNp1adaf3j_Km5elP-JLA8w09V0IdW_DQ"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3937616261383233613861626263333662336633373433373634323937386138346631396232396565303865326338363332393538623163303165633361636233363a30313866343761302d376232312d376162632d386465662d30303030303030303030656534333a67556369336e4846735535306a6638794b7566337842584f355668325a4a55704c4e6245774b6170337967363a69737375657231353a786d6573682d776f726c643a77313032323a69325a4a4936735635564e666e475232365970686d51303a",
+      "expectedId": "auth-f89872046bec9eac8d33b7a642f656ac59a3b542c8526e8ee9fb78d1a35d0f27"
+    },
+    "xScopeDotDot": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-0000000000ee",
+          "key": "gUci3nHFsU50jf8yKuf3xBXO5Vh2ZJUpLNbEwKap3yg"
+        },
+        "role": "issuer",
+        "scope": "xmesh-world:w1/../w2",
+        "nonce": "lS8g-Mn1ID_ptau_MyxPbQ",
+        "sigs": [
+          {
+            "key": "Qej94TKtZw5TTNiyddLNfux3czxm-NtIocraf6v8RVU",
+            "sig": "WLhDifkr2GXXglLmkZcpS9RSg0DLLMwqg5ZSqCcTWJ9G42kMZ0BHCl9XkJ5NuR-kFhI-N__7F7hzgXQ-BPgpAg"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3937616261383233613861626263333662336633373433373634323937386138346631396232396565303865326338363332393538623163303165633361636233363a30313866343761302d376232312d376162632d386465662d30303030303030303030656534333a67556369336e4846735535306a6638794b7566337842584f355668325a4a55704c4e6245774b6170337967363a69737375657232303a786d6573682d776f726c643a77312f2e2e2f773232323a6c5338672d4d6e3149445f707461755f4d7978506251303a",
+      "expectedId": "auth-c8909cba4246b88050d00b66efe345ee754dcebe6b2094936b96a383729488fd"
+    },
+    "xScopeDot": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-0000000000ee",
+          "key": "gUci3nHFsU50jf8yKuf3xBXO5Vh2ZJUpLNbEwKap3yg"
+        },
+        "role": "issuer",
+        "scope": "xmesh-world:w1/./region-a",
+        "nonce": "bxpfpy7ZtBFPWPVcXe7K1Q",
+        "sigs": [
+          {
+            "key": "Qej94TKtZw5TTNiyddLNfux3czxm-NtIocraf6v8RVU",
+            "sig": "TfqrqS54PYwzN9sZiY3dN93PCltuh4o-Hdgaz_xLGv1gDQgX2A1DCUVPlNc3MjitOEE8UC2dJbtkxGBSy7N-CA"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3937616261383233613861626263333662336633373433373634323937386138346631396232396565303865326338363332393538623163303165633361636233363a30313866343761302d376232312d376162632d386465662d30303030303030303030656534333a67556369336e4846735535306a6638794b7566337842584f355668325a4a55704c4e6245774b6170337967363a69737375657232353a786d6573682d776f726c643a77312f2e2f726567696f6e2d6132323a627870667079375a74424650575056635865374b3151303a",
+      "expectedId": "auth-f7be12595fe64265ac66f0bbb5786693b3cc5c5996f9da36a2e8ea30c409e2b6"
+    },
+    "xIssuerGrantsValidator": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4fb54aaadf85d38bbd1c871f9828b5b5d98c7e40676cc34af628630ba0a31da2",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-0000000000ee",
+          "key": "gUci3nHFsU50jf8yKuf3xBXO5Vh2ZJUpLNbEwKap3yg"
+        },
+        "role": "validator",
+        "scope": "xmesh-world:w1",
+        "nonce": "PBv3O1pSjc1RKmzonCiunA",
+        "sigs": [
+          {
+            "key": "tHQLpOD34FdvEegUnbuyUpwhIhPbZ5gx-10bIh6EVS0",
+            "sig": "K7aGYouADLeglNFhe8et8Zl0UdUqWBpJpc9s2mgm49CukiEOgareNB9RT9hAY0UHzQ5xFBlQHuPXJ7RFfh-GAQ"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3466623534616161646638356433386262643163383731663938323862356235643938633765343036373663633334616636323836333062613061333164613233363a30313866343761302d376232312d376162632d386465662d30303030303030303030656534333a67556369336e4846735535306a6638794b7566337842584f355668325a4a55704c4e6245774b6170337967393a76616c696461746f7231343a786d6573682d776f726c643a773132323a504276334f3170536a6331524b6d7a6f6e4369756e41303a",
+      "expectedId": "auth-3043182955d968d90b751cb9d4a0568cba57889b3db40aec20481117f1698912"
+    },
+    "xIssuerEndorses": {
+      "statement": {
+        "kind": "endorse",
+        "authorisedBy": "auth-4fb54aaadf85d38bbd1c871f9828b5b5d98c7e40676cc34af628630ba0a31da2",
+        "targets": [
+          "auth-f37e987e8999b554e8882dd96b617b74595d37879a3390a697e16547e3bdd0e0"
+        ],
+        "nonce": "q7WQJwCfYBlaPgHsKXhqbw",
+        "sigs": [
+          {
+            "key": "tHQLpOD34FdvEegUnbuyUpwhIhPbZ5gx-10bIh6EVS0",
+            "sig": "FU6MCsLPHyvLhdZLXM4GNgOJDKF2ZkeJmcxTs4zkka8zQn8-0MEPPk4uxEdF2nz2XVCOtUI6iNnn4oidiLu4Cg"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a373a656e646f72736536393a617574682d34666235346161616466383564333862626431633837316639383238623562356439386337653430363736636333346166363238363330626130613331646132313a3136393a617574682d6633376539383765383939396235353465383838326464393662363137623734353935643337383739613333393061363937653136353437653362646430653032323a713757514a77436659426c61506748734b5868716277303a",
+      "expectedId": "auth-a901ec6bc891fce2d9d9c80de0beeedbc3679948d7867c81b0b09357f9d5dac4"
+    },
+    "gX3": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000016",
+          "key": "oRgEM1nny0Xqi7IB58i5Q_E0VsCk0bEdQ0OngoCJ-7o"
+        },
+        "role": "admin",
+        "scope": "xmesh-world:w1",
+        "nonce": "9U6w2iGChJ0gABUmxxwj7A",
+        "sigs": [
+          {
+            "key": "Qej94TKtZw5TTNiyddLNfux3czxm-NtIocraf6v8RVU",
+            "sig": "HvzC3H1Nqq_6TjChK6du00Nrg96801cTjXFjtcF_RvChKfqt8-dTAIsXBfa_I309lAzE1qecAq9oPb1CjpmFAg"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3937616261383233613861626263333662336633373433373634323937386138346631396232396565303865326338363332393538623163303165633361636233363a30313866343761302d376232312d376162632d386465662d30303030303030303030313634333a6f5267454d316e6e793058716937494235386935515f45305673436b3062456451304f6e676f434a2d376f353a61646d696e31343a786d6573682d776f726c643a773132323a3955367732694743684a30674142556d7878776a3741303a",
+      "expectedId": "auth-931b55dccdc74cd462e3fc86ca661d35c3475bdf713a97f218465da08be85cec"
+    },
+    "gX4": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-931b55dccdc74cd462e3fc86ca661d35c3475bdf713a97f218465da08be85cec",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000017",
+          "key": "gOoQued99QaiaxjHd66qY61sxrM6xuAj1ZMqa4lx7nY"
+        },
+        "role": "validator",
+        "scope": "xmesh-world:w1",
+        "nonce": "-cX2qmMNP2sR79GXpYJE3g",
+        "sigs": [
+          {
+            "key": "oRgEM1nny0Xqi7IB58i5Q_E0VsCk0bEdQ0OngoCJ-7o",
+            "sig": "6NLO0GDHQ9llZ3TJdjq40eIGww0OtAYMxN1nsaJQ15YlGg2DjglJiZdL-sjdApqP9rTz_ejntkKPSimYnH2_Aw"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3933316235356463636463373463643436326533666338366361363631643335633334373562646637313361393766323138343635646130386265383563656333363a30313866343761302d376232312d376162632d386465662d30303030303030303030313734333a674f6f51756564393951616961786a48643636715936317378724d367875416a315a4d7161346c78376e59393a76616c696461746f7231343a786d6573682d776f726c643a773132323a2d635832716d4d4e503273523739475870594a453367303a",
+      "expectedId": "auth-87ae15275e927149c563d1420d2d2bd9c01176981c0b7d295746a45865046d48"
+    },
+    "xTooDeep": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-87ae15275e927149c563d1420d2d2bd9c01176981c0b7d295746a45865046d48",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-0000000000ee",
+          "key": "gUci3nHFsU50jf8yKuf3xBXO5Vh2ZJUpLNbEwKap3yg"
+        },
+        "role": "xmesh-seat",
+        "scope": "xmesh-world:w1",
+        "nonce": "Gm8lA3Oigq5AM1CZOKdTOQ",
+        "sigs": [
+          {
+            "key": "gOoQued99QaiaxjHd66qY61sxrM6xuAj1ZMqa4lx7nY",
+            "sig": "4rdtvsBTkUujN-Ch0Kx-6jabksR3qF04etgADL0A3v4htMFycTGCAOragsiC7t3BghYV9MLn9tt9Pi8ihnspBA"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3837616531353237356539323731343963353633643134323064326432626439633031313736393831633062376432393537343661343538363530343664343833363a30313866343761302d376232312d376162632d386465662d30303030303030303030656534333a67556369336e4846735535306a6638794b7566337842584f355668325a4a55704c4e6245774b617033796731303a786d6573682d7365617431343a786d6573682d776f726c643a773132323a476d386c41334f69677135414d31435a4f4b64544f51303a",
+      "expectedId": "auth-ebce945c240f19b47698622e93cd1b80171928ec1c194fd2ea212c791dd46d91"
+    },
+    "gB": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "anchor",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000018",
+          "key": "ZQt9ylU8rmktusMDnnWG8N9E6EXPK6pnh9bv90QlyxQ"
+        },
+        "role": "admin",
+        "nonce": "LzMtrMXc7nzskIRmm88PMA",
+        "sigs": [
+          {
+            "key": "vHy8tWNjdfodgkNNRmck2SN39TuYBpXdSdJtDOEiBaU",
+            "sig": "P6JGlavWCMXkzLs77eEJggvEmB16qmhb1u_RnyrYzg0lCAYMq9oAUcB3VW-V9gTeFr8hT3qwnbd7qUOrhH3sAA"
+          },
+          {
+            "key": "rPErSswcZgqDJq7TQDnvtyil5JZIgkD1CpMqt6ulF1E",
+            "sig": "syD03JyR_YQmyIQn4TMuu-woMBn8vYcNTomgevN-ZPnfmUA1ho9-6fn0FqfLeX7tu7TWmqwmfCLEUfNSxo88Dw"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e74363a616e63686f7233363a30313866343761302d376232312d376162632d386465662d30303030303030303030313834333a5a517439796c5538726d6b7475734d446e6e5747384e3945364558504b36706e683962763930516c797851353a61646d696e303a32323a4c7a4d74724d5863376e7a736b49526d6d3838504d41303a",
+      "expectedId": "auth-15b112063a168a0afc7bb3db7d8beb9801489a63a736478d623e92d024fafb9f"
+    },
+    "eVbyB": {
+      "statement": {
+        "kind": "endorse",
+        "authorisedBy": "auth-15b112063a168a0afc7bb3db7d8beb9801489a63a736478d623e92d024fafb9f",
+        "targets": [
+          "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f"
+        ],
+        "nonce": "LK_AzI7NR5lJEl_1BlEzaA",
+        "sigs": [
+          {
+            "key": "ZQt9ylU8rmktusMDnnWG8N9E6EXPK6pnh9bv90QlyxQ",
+            "sig": "fVR2FaGylTudndl1r8bBfPNbGx_6WGTDBgMZ4pNIxAl5WSbI2LB9yCw_bMCLP_3TBDfkNHfuXYC9v2RymRXMCw"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a373a656e646f72736536393a617574682d31356231313230363361313638613061666337626233646237643862656239383031343839613633613733363437386436323365393264303234666166623966313a3136393a617574682d3135336235383166656566333432356438613364373066363564373936313834303336613362323133333830643162333539313865336563393366376361396632323a4c4b5f417a49374e52356c4a456c5f31426c457a6141303a",
+      "expectedId": "auth-de438b7f771ff3f17dfb0a910c03e43f3c858fa50e4358a8d2b5dce6b919da0c"
+    },
+    "rV": {
+      "statement": {
+        "kind": "revoke",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "targets": [
+          "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f"
+        ],
+        "nonce": "l6g8X4x2_yMgD4O21vbERQ",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "hY-wM0iiK9PePH7gj2apzzw71UrsEz3N3rSy7spJ81Yv0OIsHsTc7SnZzyfPADnP6hj7RWYSC98fNVxF_qJKDA"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a363a7265766f6b6536393a617574682d34343132623731393337636566386137383061333063616163613162366536663632663934313864333831656335363737353631613232303533383131636131313a3136393a617574682d3135336235383166656566333432356438613364373066363564373936313834303336613362323133333830643162333539313865336563393366376361396632323a6c366738583478325f794d6744344f32317662455251303a",
+      "expectedId": "auth-012fb00ee8a57593023daf8e157790d500c5ca8d5e01ccededf424d948872a7b"
+    },
+    "eP": {
+      "statement": {
+        "kind": "endorse",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "targets": [
+          "auth-90fe6da3187b891e9692dfcc204e7868f1ec106a2cd4ea5df47d9e69bb8bef50"
+        ],
+        "nonce": "Vya3EGxip4v4wDAETGLIAQ",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "wL41GibnuxCMI8U5Y-5y9x17pMhRfxGSf3FJmjh5TTNW0qDvgSdY5mHA8s-QSKp6U_O1-7ahhVAU3K5L_w-kBw"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a373a656e646f72736536393a617574682d34343132623731393337636566386137383061333063616163613162366536663632663934313864333831656335363737353631613232303533383131636131313a3136393a617574682d3930666536646133313837623839316539363932646663633230346537383638663165633130366132636434656135646634376439653639626238626566353032323a5679613345477869703476347744414554474c494151303a",
+      "expectedId": "auth-590e09634c0082bb684477bc6eac40e28736f797d0ce79ab2f50e5e476ae8d41"
+    },
+    "eSelfA": {
+      "statement": {
+        "kind": "endorse",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "targets": [
+          "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f"
+        ],
+        "nonce": "aaKNv_RPjtuhIqUm-RbQcQ",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "37rDf79Rr1G-bDufqcRf90THgxNxUSPKQ_PL0v3fzoHoO0ocy3IsB55h2eTH837W-BJB1-ds4ayVTXvmWNv7Ag"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a373a656e646f72736536393a617574682d34343132623731393337636566386137383061333063616163613162366536663632663934313864333831656335363737353631613232303533383131636131313a3136393a617574682d3135336235383166656566333432356438613364373066363564373936313834303336613362323133333830643162333539313865336563393366376361396632323a61614b4e765f52506a7475684971556d2d5262516351303a",
+      "expectedId": "auth-cb2f03ad9dbcef99107d5deda23e97d1be02fdc622600180b822ac6d05f648e6"
+    },
+    "eKeepSelf": {
+      "statement": {
+        "kind": "endorse",
+        "authorisedBy": "anchor",
+        "targets": [
+          "auth-cb2f03ad9dbcef99107d5deda23e97d1be02fdc622600180b822ac6d05f648e6"
+        ],
+        "nonce": "lK_8sQrXKuUz3FxoeZSEUA",
+        "sigs": [
+          {
+            "key": "vHy8tWNjdfodgkNNRmck2SN39TuYBpXdSdJtDOEiBaU",
+            "sig": "7tPfHFhPNe3MAT4PkMG_c34chJ2ZkOQLOGAget3C90ZBQYzf9EkjwUnHrUqoV54dYh_wqX5RvLreE9vKUAwBCQ"
+          },
+          {
+            "key": "Zej5sLxurhJBafBXb5c2LSlajPX3cLReFDV85kfTPuw",
+            "sig": "HbvYFHUJ3oXQDsJljaJDlrUSvs16c88YZPfwHGIZpBHDFToKSitV_-3jMXTgS-KqZ9-LkW5FNZu5pS9g5i6KBA"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a373a656e646f727365363a616e63686f72313a3136393a617574682d6362326630336164396462636566393931303764356465646132336539376431626530326664633632323630303138306238323261633664303566363438653632323a6c4b5f38735172584b75557a3346786f655a53455541303a",
+      "expectedId": "auth-697a515218c87d64b0be231b8e16b0013e54d78a03fb1392bfd9a5e8afeeb311"
+    },
+    "eVonly": {
+      "statement": {
+        "kind": "endorse",
+        "authorisedBy": "anchor",
+        "targets": [
+          "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f"
+        ],
+        "nonce": "fhu5oQexoYHkPfyWzlHN6Q",
+        "sigs": [
+          {
+            "key": "vHy8tWNjdfodgkNNRmck2SN39TuYBpXdSdJtDOEiBaU",
+            "sig": "-Q8DFwxO1SlzaxFQKhSpCMMcEg7bT96EdMwQXocu-wvjWTxEniYvge80FiHnFF4NsyBmED83PpDDb8aXIgqSAg"
+          },
+          {
+            "key": "Zej5sLxurhJBafBXb5c2LSlajPX3cLReFDV85kfTPuw",
+            "sig": "N6IM4v9mp01h5-zbqhHJiS2ZcMnQ2vR8Ppta4oqcR-InIvL0SircX88bJ1ZEtTQqa9JVSxVtFgrRJxP1cQS9Aw"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a373a656e646f727365363a616e63686f72313a3136393a617574682d3135336235383166656566333432356438613364373066363564373936313834303336613362323133333830643162333539313865336563393366376361396632323a666875356f5165786f59486b506679577a6c484e3651303a",
+      "expectedId": "auth-c13092fc7e04547da38e131d50355afa58e4cc944c320e9559d755516a12e9dd"
+    },
+    "rVanchor": {
+      "statement": {
+        "kind": "revoke",
+        "authorisedBy": "anchor",
+        "targets": [
+          "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f"
+        ],
+        "nonce": "azIYWWnYBpsvBjI7jN-cmQ",
+        "sigs": [
+          {
+            "key": "Zej5sLxurhJBafBXb5c2LSlajPX3cLReFDV85kfTPuw",
+            "sig": "7uTOQSmMs3Fn9_X5TXjbIT9eK381S6sLn7GDWOUHuQMuzWE5IvCO7rQuCW7QhICcs5_e8JiO1fGeDUSp6_7OAQ"
+          },
+          {
+            "key": "rPErSswcZgqDJq7TQDnvtyil5JZIgkD1CpMqt6ulF1E",
+            "sig": "Zp9Vd2V-JgY3IR3PRN0jDqtWyWXsW13LIapCCvLkdd0Q9fdocBewjsPJLO6e3UMlL9ymKHcoiK2gq_SFZA1ABw"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a363a7265766f6b65363a616e63686f72313a3136393a617574682d3135336235383166656566333432356438613364373066363564373936313834303336613362323133333830643162333539313865336563393366376361396632323a617a495957576e5942707376426a49376a4e2d636d51303a",
+      "expectedId": "auth-5096c71b6bb032d6c6ce815633bf0a23af4f4808b61ef92012f404edc705c923"
+    },
+    "ePanchor": {
+      "statement": {
+        "kind": "endorse",
+        "authorisedBy": "anchor",
+        "targets": [
+          "auth-90fe6da3187b891e9692dfcc204e7868f1ec106a2cd4ea5df47d9e69bb8bef50"
+        ],
+        "nonce": "GwIt7WkdPRmvuxDMiVe7GA",
+        "sigs": [
+          {
+            "key": "vHy8tWNjdfodgkNNRmck2SN39TuYBpXdSdJtDOEiBaU",
+            "sig": "j3P84w28yta-LFazCYOrydC18joVQL22mVirKglbBznwRLhtp-xLBzGrc59lkw1TSFWvoYwk2CGubW1bS37CDg"
+          },
+          {
+            "key": "rPErSswcZgqDJq7TQDnvtyil5JZIgkD1CpMqt6ulF1E",
+            "sig": "akbILRMi2DLfdbHYvTdsADlPb6E4rOtkGoZetoD8gQ9ukz6GI-WR-cOnvR25A9YjVzptXp3_Nappm_CBbl05Cg"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a373a656e646f727365363a616e63686f72313a3136393a617574682d3930666536646133313837623839316539363932646663633230346537383638663165633130366132636434656135646634376439653639626238626566353032323a4777497437576b6450526d767578444d695665374741303a",
+      "expectedId": "auth-fdfa7a9d18bd80ae44c6644d43ecc63e0090b09aea0c2bbd49ac3e46cc9dfef1"
+    },
+    "rWQ": {
+      "statement": {
+        "kind": "revoke",
+        "authorisedBy": "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d",
+        "targets": [
+          "auth-2341a2131fb673270b41833f685f832a3c4e696e3f295933f91e8208c8e20f88"
+        ],
+        "nonce": "IzcsUgR2bSjlFKFrFP1gOQ",
+        "sigs": [
+          {
+            "key": "VRVPQgZepaG-oFRjgmviaE65LfksEAAnqrquV8pVQgc",
+            "sig": "cAvcn_CDC3rWwj-5qkaqSoZvvmCcNOB13xMB4V4D0mn8G8OjgFnSmveAulv5e20oY3y7ekQLivw2G8u0Qk5mCA"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a363a7265766f6b6536393a617574682d65656239323134376231346631393563373764376130336133643230363739626165313963376431343863356138626361396364333334393434343065623064313a3136393a617574682d3233343161323133316662363733323730623431383333663638356638333261336334653639366533663239353933336639316538323038633865323066383832323a497a63735567523262536a6c464b4672465031674f51303a",
+      "expectedId": "auth-2e53b6150d927b33dfcae432c679f680663d018d9a983f6c638bc2d29a16f3f6"
+    },
+    "rMix": {
+      "statement": {
+        "kind": "revoke",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "targets": [
+          "auth-90fe6da3187b891e9692dfcc204e7868f1ec106a2cd4ea5df47d9e69bb8bef50",
+          "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d",
+          "auth-2e53b6150d927b33dfcae432c679f680663d018d9a983f6c638bc2d29a16f3f6"
+        ],
+        "nonce": "ltmNW4CquTUSp-Jxd7_BYA",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "3GTitr9Qv_9Tk9zp-XdrrxCnpmX-wizC10sSrHRTz5PcVDJR1Jo9jZQfgMgCEGxdk0A6KoN4S2RsSkUiwqb9Dg"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a363a7265766f6b6536393a617574682d34343132623731393337636566386137383061333063616163613162366536663632663934313864333831656335363737353631613232303533383131636131313a3336393a617574682d3265353362363135306439323762333364666361653433326336373966363830363633643031386439613938336636633633386263326432396131366633663636393a617574682d3930666536646133313837623839316539363932646663633230346537383638663165633130366132636434656135646634376439653639626238626566353036393a617574682d6565623932313437623134663139356337376437613033613364323036373962616531396337643134386335613862636139636433333439343434306562306432323a6c746d4e5734437175545553702d4a7864375f425941303a",
+      "expectedId": "auth-bfcc6133f7b87f504961d10929b8624b198a17a7b16f3815dda170a217c4471c"
+    },
+    "gV2": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000019",
+          "key": "UrzUxoqKCdmM2dGNim-j6Ok1WVTssB4q37-6XO-uTnk"
+        },
+        "role": "validator",
+        "nonce": "Dndpy6j3F7HDxeHfot1Iyw",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "iX9QwCP_ECOVA1HQOpnibbKXWPPP6dTfEth733QgDz5p0DpM_eKB5hHqaVNIMXAojNcNYXZPcKDes-Yjc__2Dw"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3434313262373139333763656638613738306133306361616361316236653666363266393431386433383165633536373735363161323230353338313163613133363a30313866343761302d376232312d376162632d386465662d30303030303030303030313934333a55727a55786f714b43646d4d3264474e696d2d6a364f6b31575654737342347133372d36584f2d75546e6b393a76616c696461746f72303a32323a446e647079366a3346374844786548666f7431497977303a",
+      "expectedId": "auth-79577370f20dfdc71b7d93c0cc9e1e54da9609ea04e493829eb36c1b89d47d97"
+    },
+    "gP3": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000001a",
+          "key": "LbeXY24yPtV26bDgPifLkhcaiWtj6RhvDUpDucfTgtE"
+        },
+        "role": "participant",
+        "nonce": "17Jd-svSS_Z9glLQMH2f3A",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "3_VG3XV_xHXEp5i5GuTdeeeFyxU1ENwnngUAFUlQTFOHaDo8dA3SKaWji3qFyjELMbQXS1aJakDls_uESogaCQ"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3434313262373139333763656638613738306133306361616361316236653666363266393431386433383165633536373735363161323230353338313163613133363a30313866343761302d376232312d376162632d386465662d30303030303030303030316134333a4c6265585932347950745632366244675069664c6b6863616957746a36526876445570447563665467744531313a7061727469636970616e74303a32323a31374a642d737653535f5a39676c4c514d4832663341303a",
+      "expectedId": "auth-b0d418db5ae886310bc434411fb89329e38c23072d76c3ee90b54a332d1f8a93"
+    },
+    "gV1": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "anchor",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000000b",
+          "key": "RyG1tjInLmWmjdp6wltBhfiwGRbbGFwUKH25Lit3D64"
+        },
+        "role": "validator",
+        "nonce": "1RK_oYfTPZz-i5PYh93M2Q",
+        "sigs": [
+          {
+            "key": "vHy8tWNjdfodgkNNRmck2SN39TuYBpXdSdJtDOEiBaU",
+            "sig": "Sr_KWjYvR-lmYSvs6w2vCRI6RLrE0xPIwhKzYVH-X2cuI8DLFeqzAO9pWzJRBSxmu6FxyIHT2SsX7s5oGH_aCQ"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e74363a616e63686f7233363a30313866343761302d376232312d376162632d386465662d30303030303030303030306234333a52794731746a496e4c6d576d6a647036776c74426866697747526262474677554b4832354c697433443634393a76616c696461746f72303a32323a31524b5f6f596654505a7a2d693550596839334d3251303a",
+      "expectedId": "auth-6ee68f1fd648ca36c0d22cbbf5eaf8bf02a4b915e1b4eb9c4b44d27bb2c8eecc"
+    },
+    "gVa2": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "anchor",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000019",
+          "key": "UrzUxoqKCdmM2dGNim-j6Ok1WVTssB4q37-6XO-uTnk"
+        },
+        "role": "validator",
+        "nonce": "W7RT_njPSpeL6FZZ4Ld92Q",
+        "sigs": [
+          {
+            "key": "Zej5sLxurhJBafBXb5c2LSlajPX3cLReFDV85kfTPuw",
+            "sig": "DvswGHB6rcsW9EAZeD6fjbI_P63C7jV-ZeOg7o2y1JxoXs2TFRi_guGDelZFWkq0amgzGnZGBgKh15sFEcTdDg"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e74363a616e63686f7233363a30313866343761302d376232312d376162632d386465662d30303030303030303030313934333a55727a55786f714b43646d4d3264474e696d2d6a364f6b31575654737342347133372d36584f2d75546e6b393a76616c696461746f72303a32323a573752545f6e6a505370654c36465a5a344c64393251303a",
+      "expectedId": "auth-076031fcf26cd4f6ab676b2f2615534b9f244affefff27b10f1ab9d21cbfe306"
+    },
+    "splitA1": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "anchor",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000000d",
+          "key": "WRLawCDc2rp2fOymQkPoRRdiFcSF5BjlD4AgXYEhipE"
+        },
+        "role": "validator",
+        "nonce": "0j9uF8O5SOw_Ft32gvSW_Q",
+        "sigs": [
+          {
+            "key": "vHy8tWNjdfodgkNNRmck2SN39TuYBpXdSdJtDOEiBaU",
+            "sig": "PqYEoUTBX1X-6qD0TpKugyUf7f48dYNt8ku5dqEELy_WPjqnPBwJSdCzEx39H6T66D4N7waORjLaQ7LVVH9MDw"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e74363a616e63686f7233363a30313866343761302d376232312d376162632d386465662d30303030303030303030306434333a57524c617743446332727032664f796d516b506f525264694663534635426a6c4434416758594568697045393a76616c696461746f72303a32323a306a397546384f35534f775f46743332677653575f51303a",
+      "expectedId": "auth-d1aeee7352ba975ac359ad69c9f26a55bd9f890d88840c896cc8243a677d835c"
+    },
+    "splitA2": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "anchor",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000000d",
+          "key": "WRLawCDc2rp2fOymQkPoRRdiFcSF5BjlD4AgXYEhipE"
+        },
+        "role": "validator",
+        "nonce": "0j9uF8O5SOw_Ft32gvSW_Q",
+        "sigs": [
+          {
+            "key": "Zej5sLxurhJBafBXb5c2LSlajPX3cLReFDV85kfTPuw",
+            "sig": "kRUjdal_5PaHFmpa-lDYm6YigJM5aRfdDVfPN5eFaztkgSmjOHEMtpRY9sq3UDD2MkYVHOsVpimyeMsBNmzIAw"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e74363a616e63686f7233363a30313866343761302d376232312d376162632d386465662d30303030303030303030306434333a57524c617743446332727032664f796d516b506f525264694663534635426a6c4434416758594568697045393a76616c696461746f72303a32323a306a397546384f35534f775f46743332677653575f51303a",
+      "expectedId": "auth-d1aeee7352ba975ac359ad69c9f26a55bd9f890d88840c896cc8243a677d835c"
+    },
+    "splitFull": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "anchor",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000000d",
+          "key": "WRLawCDc2rp2fOymQkPoRRdiFcSF5BjlD4AgXYEhipE"
+        },
+        "role": "validator",
+        "nonce": "0j9uF8O5SOw_Ft32gvSW_Q",
+        "sigs": [
+          {
+            "key": "vHy8tWNjdfodgkNNRmck2SN39TuYBpXdSdJtDOEiBaU",
+            "sig": "PqYEoUTBX1X-6qD0TpKugyUf7f48dYNt8ku5dqEELy_WPjqnPBwJSdCzEx39H6T66D4N7waORjLaQ7LVVH9MDw"
+          },
+          {
+            "key": "rPErSswcZgqDJq7TQDnvtyil5JZIgkD1CpMqt6ulF1E",
+            "sig": "GqbgU2c3Qvp1wrhIeAONEUcZEawq2byY41fZ1T7RAp2ModpM6A_UhWRjngLtFsOVJ7Xy1tJZ0lurrc0wfWekBA"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e74363a616e63686f7233363a30313866343761302d376232312d376162632d386465662d30303030303030303030306434333a57524c617743446332727032664f796d516b506f525264694663534635426a6c4434416758594568697045393a76616c696461746f72303a32323a306a397546384f35534f775f46743332677653575f51303a",
+      "expectedId": "auth-d1aeee7352ba975ac359ad69c9f26a55bd9f890d88840c896cc8243a677d835c"
+    },
+    "gI0": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000100",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "issuer",
+        "scope": "xmesh-world:w1",
+        "nonce": "LPE3AWxDPysJSaK_SDSdfA",
+        "sigs": [
+          {
+            "key": "Qej94TKtZw5TTNiyddLNfux3czxm-NtIocraf6v8RVU",
+            "sig": "51BX1O8oUgce8plSEZNCnLHFREXZE6BX-6N6WUZ9WmkgAbJEity8xu5gReK5hC2OYPyD78vOHjvVw6BoTT2LAQ"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3937616261383233613861626263333662336633373433373634323937386138346631396232396565303865326338363332393538623163303165633361636233363a30313866343761302d376232312d376162632d386465662d30303030303030303031303034333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367363a69737375657231343a786d6573682d776f726c643a773132323a4c504533415778445079734a53614b5f534453646641303a",
+      "expectedId": "auth-28f0218428ccd4cbd342108434940b7c6cfb41a2e3d17776d857f3cf66a94970"
+    },
+    "gI1": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000101",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "issuer",
+        "scope": "xmesh-world:w1",
+        "nonce": "MG43eNYOnnKPpMoQqG0jdA",
+        "sigs": [
+          {
+            "key": "Qej94TKtZw5TTNiyddLNfux3czxm-NtIocraf6v8RVU",
+            "sig": "C9iaZwGyh9jIM0M5DR8-lXVH3Vq_GTs8BHDkgMOyF23ohIBFjdDLnDautg4N4YkF4MhlXlSBPtdkgJnmbADLBg"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3937616261383233613861626263333662336633373433373634323937386138346631396232396565303865326338363332393538623163303165633361636233363a30313866343761302d376232312d376162632d386465662d30303030303030303031303134333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367363a69737375657231343a786d6573682d776f726c643a773132323a4d473433654e594f6e6e4b50704d6f517147306a6441303a",
+      "expectedId": "auth-2537206e3551782c3f6eeed8edcd371ffad5d732fd109887c4abdf366eb42c6e"
+    },
+    "gI2": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000102",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "issuer",
+        "scope": "xmesh-world:w1",
+        "nonce": "mLbVD-3YiiX5dXaGwqjSdA",
+        "sigs": [
+          {
+            "key": "Qej94TKtZw5TTNiyddLNfux3czxm-NtIocraf6v8RVU",
+            "sig": "MnGDKN9OmsCMzofoNBpfjSfcxEaWN-wuVEu8KpkVCQVa6h8cGycGJGhFh8WCVYpAgl90B_n9qWb20zcXDB4mAA"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3937616261383233613861626263333662336633373433373634323937386138346631396232396565303865326338363332393538623163303165633361636233363a30313866343761302d376232312d376162632d386465662d30303030303030303031303234333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367363a69737375657231343a786d6573682d776f726c643a773132323a6d4c6256442d3359696958356458614777716a536441303a",
+      "expectedId": "auth-2e10dd4e5e0f9214d1846bc60b6bee8a480f7b577274e8370d15cea939dd4739"
+    },
+    "gI3": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000103",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "issuer",
+        "scope": "xmesh-world:w1",
+        "nonce": "cbU6IQ2SUFCCUbxB3ef2nw",
+        "sigs": [
+          {
+            "key": "Qej94TKtZw5TTNiyddLNfux3czxm-NtIocraf6v8RVU",
+            "sig": "Oq6VAklaAUM2YaFgmMQTM0f6R5FW29RZQREt8cO0Aa2Ba2K-EcS3uvAakuwvWfwMHLiWiRGsOUC6DTu7JudGAQ"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3937616261383233613861626263333662336633373433373634323937386138346631396232396565303865326338363332393538623163303165633361636233363a30313866343761302d376232312d376162632d386465662d30303030303030303031303334333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367363a69737375657231343a786d6573682d776f726c643a773132323a63625536495132535546434355627842336566326e77303a",
+      "expectedId": "auth-e81acf29745588b207b94b282bb917feabecf482fd990ff5f089fa3402ce9092"
+    },
+    "gI4": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000104",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "issuer",
+        "scope": "xmesh-world:w1",
+        "nonce": "htFiArOYho1C-CxIiGE9cg",
+        "sigs": [
+          {
+            "key": "Qej94TKtZw5TTNiyddLNfux3czxm-NtIocraf6v8RVU",
+            "sig": "xWn3V4U9VblKk6O2lMldE4KjBz4mdfpSIBjpGAe7-pC5wz3AJxaqBd5jjVIYR4T45A2-Zh6H6tO8IsSK2kCuAg"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3937616261383233613861626263333662336633373433373634323937386138346631396232396565303865326338363332393538623163303165633361636233363a30313866343761302d376232312d376162632d386465662d30303030303030303031303434333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367363a69737375657231343a786d6573682d776f726c643a773132323a6874466941724f59686f31432d437849694745396367303a",
+      "expectedId": "auth-bdb8a449edb57a05d1913ab1615e1723a996e4f73ea7e23d639e9ee914bb38a9"
+    },
+    "gI5": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000105",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "issuer",
+        "scope": "xmesh-world:w1",
+        "nonce": "uIE_tMkcDzrhlfaVTkMy8g",
+        "sigs": [
+          {
+            "key": "Qej94TKtZw5TTNiyddLNfux3czxm-NtIocraf6v8RVU",
+            "sig": "Gfl6pB61vDXbwrKW05s233pRxa_t-iTPB_U_3hqlRhLHoW74QrU0fWuk8XdwjS4jKP3cbafGSn6Ahx-iUAPKCA"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3937616261383233613861626263333662336633373433373634323937386138346631396232396565303865326338363332393538623163303165633361636233363a30313866343761302d376232312d376162632d386465662d30303030303030303031303534333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367363a69737375657231343a786d6573682d776f726c643a773132323a7549455f744d6b63447a72686c666156546b4d793867303a",
+      "expectedId": "auth-b0b379c990873593b62b921c8fc04fa0c71f04e545c46f725baaa6874496d51f"
+    },
+    "gI6": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000106",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "issuer",
+        "scope": "xmesh-world:w1",
+        "nonce": "4dqtkVC6Uc9MBvuShBI9EA",
+        "sigs": [
+          {
+            "key": "Qej94TKtZw5TTNiyddLNfux3czxm-NtIocraf6v8RVU",
+            "sig": "aHPLDESO2yyD7HBn1IRRoNPXfIzfurKsL12v6OKnOsoJFacS_L06Ccv6ZcCDEh893cWEvv1_7JBg7X2Eu3gHDA"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3937616261383233613861626263333662336633373433373634323937386138346631396232396565303865326338363332393538623163303165633361636233363a30313866343761302d376232312d376162632d386465662d30303030303030303031303634333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367363a69737375657231343a786d6573682d776f726c643a773132323a346471746b5643365563394d42767553684249394541303a",
+      "expectedId": "auth-e5ca19c421704b462eda9a8d1564380b1139df1b4325cd4e282dee98ae5f423e"
+    },
+    "gI7": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000107",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "issuer",
+        "scope": "xmesh-world:w1",
+        "nonce": "OgTXNu7Edrqs1L07fLqxzA",
+        "sigs": [
+          {
+            "key": "Qej94TKtZw5TTNiyddLNfux3czxm-NtIocraf6v8RVU",
+            "sig": "PX84FcadheSVRcY59rqUO8Iq-TZcc12KGU_-C24YMfWrxMMRh2wXiJjeV9kCZBp0MUaa2BC87_L--HP2Is3sAg"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3937616261383233613861626263333662336633373433373634323937386138346631396232396565303865326338363332393538623163303165633361636233363a30313866343761302d376232312d376162632d386465662d30303030303030303031303734333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367363a69737375657231343a786d6573682d776f726c643a773132323a4f6754584e75374564727173314c3037664c71787a41303a",
+      "expectedId": "auth-f9baf30a818ed6f953d85c7abf79ca1c85b1b9769cbaf38100a08441abe8a542"
+    },
+    "gI8": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000108",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "issuer",
+        "scope": "xmesh-world:w1",
+        "nonce": "_EeCwqGEmmPUrT7UyzzkQQ",
+        "sigs": [
+          {
+            "key": "Qej94TKtZw5TTNiyddLNfux3czxm-NtIocraf6v8RVU",
+            "sig": "LaFu6dJDlCKPYm93vMZ-wdaQTIa2uFQNQwGaXDlt_iBSXyIgtdQbj-Be0pkNJps66BxUBNkxAbwX9OPieK8wCw"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3937616261383233613861626263333662336633373433373634323937386138346631396232396565303865326338363332393538623163303165633361636233363a30313866343761302d376232312d376162632d386465662d30303030303030303031303834333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367363a69737375657231343a786d6573682d776f726c643a773132323a5f456543777147456d6d505572543755797a7a6b5151303a",
+      "expectedId": "auth-13d85168e6f8535fc0cae1b038c6ce6af1ac38877b1f6a9aebca624128d0a09b"
+    },
+    "gI9": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000109",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "issuer",
+        "scope": "xmesh-world:w1",
+        "nonce": "rLOPGVzCaIKZzQOP202cWg",
+        "sigs": [
+          {
+            "key": "Qej94TKtZw5TTNiyddLNfux3czxm-NtIocraf6v8RVU",
+            "sig": "i4blP0OwJkTnNpdZ4Bh6QirAKEwYuC4X9N79FS_ePph41Vq-lP56oauR7wj8E3YUnQoiXI0TIqvAizc8ngnQDQ"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3937616261383233613861626263333662336633373433373634323937386138346631396232396565303865326338363332393538623163303165633361636233363a30313866343761302d376232312d376162632d386465662d30303030303030303031303934333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367363a69737375657231343a786d6573682d776f726c643a773132323a724c4f5047567a4361494b5a7a514f50323032635767303a",
+      "expectedId": "auth-0251db8809c89f8cfe87e1102d1e2e0635d9a3e031a79a389bdee44df0977dc6"
+    },
+    "gI10": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000010a",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "issuer",
+        "scope": "xmesh-world:w1",
+        "nonce": "9acHnjX17cJP4ymHmRgJKA",
+        "sigs": [
+          {
+            "key": "Qej94TKtZw5TTNiyddLNfux3czxm-NtIocraf6v8RVU",
+            "sig": "MYn22rKKpuGOVmNSBkS4YCRJb6LiQUaE-wRfgsFWsocHbma9r1IkOOXcxGhKZjVe0HAu9ftxaEnlIrl3IDmDCw"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3937616261383233613861626263333662336633373433373634323937386138346631396232396565303865326338363332393538623163303165633361636233363a30313866343761302d376232312d376162632d386465662d30303030303030303031306134333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367363a69737375657231343a786d6573682d776f726c643a773132323a396163486e6a583137634a5034796d486d52674a4b41303a",
+      "expectedId": "auth-1bf2ae483fe035d89d0ddfa66e65cd9af3b9223d8ffe893caaf4c3296f672b22"
+    },
+    "gI11": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000010b",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "issuer",
+        "scope": "xmesh-world:w1",
+        "nonce": "cN3iXmTbQcWGOiVarOVCrg",
+        "sigs": [
+          {
+            "key": "Qej94TKtZw5TTNiyddLNfux3czxm-NtIocraf6v8RVU",
+            "sig": "SmbX4q8fRutVFJbMhLjFx7jiZCSN7SpoXMT2k1K_98hHdrteB0geiwrFj-d09dJJpE1fF2b4gQH7sn3OI-H4AQ"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3937616261383233613861626263333662336633373433373634323937386138346631396232396565303865326338363332393538623163303165633361636233363a30313866343761302d376232312d376162632d386465662d30303030303030303031306234333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367363a69737375657231343a786d6573682d776f726c643a773132323a634e3369586d5462516357474f695661724f56437267303a",
+      "expectedId": "auth-a5e71bcee0ed391a1aa1a9c3b636847e2064ba23cbfb3908b6390a05b1ec6220"
+    },
+    "gI12": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000010c",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "issuer",
+        "scope": "xmesh-world:w1",
+        "nonce": "-KuiVitlhNis5fG7xrVNJw",
+        "sigs": [
+          {
+            "key": "Qej94TKtZw5TTNiyddLNfux3czxm-NtIocraf6v8RVU",
+            "sig": "Xh9creZP6Te0ANcLYhoG1LMHdhoDbtTPBUzpTJ4ahppwv-iZm2V3n99MyAAGGmk7fnmvL2lB7IOOAURA7dUtDw"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3937616261383233613861626263333662336633373433373634323937386138346631396232396565303865326338363332393538623163303165633361636233363a30313866343761302d376232312d376162632d386465662d30303030303030303031306334333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367363a69737375657231343a786d6573682d776f726c643a773132323a2d4b75695669746c684e6973356647377872564e4a77303a",
+      "expectedId": "auth-d6756e8734ff36417251d69032339f4300dd5f81fe0e9d508305ca4e92e8749d"
+    },
+    "gI13": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000010d",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "issuer",
+        "scope": "xmesh-world:w1",
+        "nonce": "-dMuCPqX3lvP8ggi72GPGg",
+        "sigs": [
+          {
+            "key": "Qej94TKtZw5TTNiyddLNfux3czxm-NtIocraf6v8RVU",
+            "sig": "G_A1f2QLiF4s8b5u41DP3GzYsmUJWxtN7PL06QrGnCpXGZ6equrH44EdwCvv6AWqSKXflWrz5lqLtwlswvJcBw"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3937616261383233613861626263333662336633373433373634323937386138346631396232396565303865326338363332393538623163303165633361636233363a30313866343761302d376232312d376162632d386465662d30303030303030303031306434333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367363a69737375657231343a786d6573682d776f726c643a773132323a2d644d7543507158336c765038676769373247504767303a",
+      "expectedId": "auth-80e4d945ef859a77f378878608d0539839ce72b81c79315daa68bba417b0fe28"
+    },
+    "gI14": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000010e",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "issuer",
+        "scope": "xmesh-world:w1",
+        "nonce": "vUC-dU27DV2oIwblc9m6lg",
+        "sigs": [
+          {
+            "key": "Qej94TKtZw5TTNiyddLNfux3czxm-NtIocraf6v8RVU",
+            "sig": "5UVw6NKBRoJ2l9QfZDEi2nCHrxpgKSfaDLazBxc74eQjzGKsisORrZfjdiFX73gvqGBtzk2ia-Jp0l6DXK7jBg"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3937616261383233613861626263333662336633373433373634323937386138346631396232396565303865326338363332393538623163303165633361636233363a30313866343761302d376232312d376162632d386465662d30303030303030303031306534333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367363a69737375657231343a786d6573682d776f726c643a773132323a7655432d645532374456326f4977626c63396d366c67303a",
+      "expectedId": "auth-be9f6e1ca83c8bb22d208f90bb9e3d158ff0f697a01a219da66185b0084a7d0b"
+    },
+    "gI15": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000010f",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "issuer",
+        "scope": "xmesh-world:w1",
+        "nonce": "z5CgkVOlPoSLrAjaGjm-bA",
+        "sigs": [
+          {
+            "key": "Qej94TKtZw5TTNiyddLNfux3czxm-NtIocraf6v8RVU",
+            "sig": "C4PSFXFMY4fcBCx727DbptbwPjtdihfTJKweCSP7MjXQCDnQIKAeFSPfGN-z1PRqiFUyq4Lwg8aylKXoGDZjDw"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3937616261383233613861626263333662336633373433373634323937386138346631396232396565303865326338363332393538623163303165633361636233363a30313866343761302d376232312d376162632d386465662d30303030303030303031306634333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367363a69737375657231343a786d6573682d776f726c643a773132323a7a3543676b564f6c506f534c72416a61476a6d2d6241303a",
+      "expectedId": "auth-30137f9b79949f2c3420d31dd658226c3a9566c75b798caa6e661284e7202b8d"
+    },
+    "gI16": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000110",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "issuer",
+        "scope": "xmesh-world:w1",
+        "nonce": "GrFGYo8hIZqSUaE5P8QDLw",
+        "sigs": [
+          {
+            "key": "Qej94TKtZw5TTNiyddLNfux3czxm-NtIocraf6v8RVU",
+            "sig": "ED8KDLMMNT-2MtHplnbSw23yNr_QrlzTSMxvmlQVQP7D6fumnppng-ck7p1jVTW1bUhCAHnY8-kSltj_oAAABA"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3937616261383233613861626263333662336633373433373634323937386138346631396232396565303865326338363332393538623163303165633361636233363a30313866343761302d376232312d376162632d386465662d30303030303030303031313034333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367363a69737375657231343a786d6573682d776f726c643a773132323a47724647596f3868495a715355614535503851444c77303a",
+      "expectedId": "auth-459624d089f3f5465ffc68efdaf87892738bbfac475642177e5a99d2bf51c116"
+    },
+    "fB": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000111",
+          "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8"
+        },
+        "role": "admin",
+        "nonce": "Cv04dasLNBRrre4Elvrb9g",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "tokUWXeoeYkA-cIWBFPjP1UjoCdKMXFlH8NY8paN5IgNJBfPf1MHSYqegb3DFZY9qVqgObk4JnANzfV2jmxsDQ"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3434313262373139333763656638613738306133306361616361316236653666363266393431386433383165633536373735363161323230353338313163613133363a30313866343761302d376232312d376162632d386465662d30303030303030303031313134333a7952797a7a697545354c714639574c7335423766354f4a365f464c596a56425f5a7147474f4e2d43507038353a61646d696e303a32323a437630346461734c4e425272726534456c7672623967303a",
+      "expectedId": "auth-ba934bb68bd0f5e7f03b3f453bea80ce6fee6c43d171b6a6918e67bffe1d4b2e"
+    },
+    "fV": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-ba934bb68bd0f5e7f03b3f453bea80ce6fee6c43d171b6a6918e67bffe1d4b2e",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000112",
+          "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY"
+        },
+        "role": "validator",
+        "nonce": "RrahlnBnJH_wTFEKAYsg6A",
+        "sigs": [
+          {
+            "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8",
+            "sig": "veIdakgkIh_jDhG5QK6wC1YnocmIeJ25hRZ3rC5_vf6MnMGHM2sJTc4esWzvw4Ljw5s6waXuBZr7ECLmc3F2Ag"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d6261393334626236386264306635653766303362336634353362656138306365366665653663343364313731623661363931386536376266666531643462326533363a30313866343761302d376232312d376162632d386465662d30303030303030303031313234333a54646d3253576f6e5678724c434a70654e494c667947724e3764784e48796a685770734538436258386959393a76616c696461746f72303a32323a527261686c6e426e4a485f775446454b415973673641303a",
+      "expectedId": "auth-5e0a3f3f51f8c1bb11f6fe1d15f84c69be334bfff2025abe64b789829af71db0"
+    },
+    "fP": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-5e0a3f3f51f8c1bb11f6fe1d15f84c69be334bfff2025abe64b789829af71db0",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000113",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "participant",
+        "nonce": "Yx-fQ4n-AKDHejBEKNeITA",
+        "sigs": [
+          {
+            "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY",
+            "sig": "q4vF-GhYGOAnizOxryHmTm8OuwetwLySIe3KoXrQhxOU7qjfWdY28wYylpaDj9k_gSBOsqLfNoAPvr0Z17r3BA"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3565306133663366353166386331626231316636666531643135663834633639626533333462666666323032356162653634623738393832396166373164623033363a30313866343761302d376232312d376162632d386465662d30303030303030303031313334333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a7662433071596172624379336731313a7061727469636970616e74303a32323a59782d6651346e2d414b4448656a42454b4e65495441303a",
+      "expectedId": "auth-2a0795aa2c6e52f67ec0c83d384b65baf2265e1d9f52e8efcbba744f46c74e84"
+    },
+    "fRevoke": {
+      "statement": {
+        "kind": "revoke",
+        "authorisedBy": "auth-ba934bb68bd0f5e7f03b3f453bea80ce6fee6c43d171b6a6918e67bffe1d4b2e",
+        "targets": [
+          "auth-5e0a3f3f51f8c1bb11f6fe1d15f84c69be334bfff2025abe64b789829af71db0"
+        ],
+        "nonce": "jR9CYqTk-8yez-snaZSKqg",
+        "sigs": [
+          {
+            "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8",
+            "sig": "DodrHMe_vuZ45YlZ7kmxtwUVmdT3k-bImpXJx52tD9wLtUP_HVVXe2n4abxs1SGt9zULipZvgenXABSUzir3AQ"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a363a7265766f6b6536393a617574682d62613933346262363862643066356537663033623366343533626561383063653666656536633433643137316236613639313865363762666665316434623265313a3136393a617574682d3565306133663366353166386331626231316636666531643135663834633639626533333462666666323032356162653634623738393832396166373164623032323a6a5239435971546b2d3879657a2d736e615a534b7167303a",
+      "expectedId": "auth-f28934e703ba6b55218155c03cee700e1cd768de6d7972aa7826054c4c4d32cc"
+    },
+    "fEndorseA": {
+      "statement": {
+        "kind": "endorse",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "targets": [
+          "auth-2a0795aa2c6e52f67ec0c83d384b65baf2265e1d9f52e8efcbba744f46c74e84"
+        ],
+        "nonce": "gQ1AhEQglucnppepNaNYmQ",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "rPYm44u1b2vadINlN_sW6R-sA-TWqmrojD4sy0UUqRc-KZYrkAggHOFX_T9Jeb0Km6eTEp-JiveLD-sDHRlCDQ"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a373a656e646f72736536393a617574682d34343132623731393337636566386137383061333063616163613162366536663632663934313864333831656335363737353631613232303533383131636131313a3136393a617574682d3261303739356161326336653532663637656330633833643338346236356261663232363565316439663532653865666362626137343466343663373465383432323a67513141684551676c75636e707065704e614e596d51303a",
+      "expectedId": "auth-0bae377b4a8e6321e4bd24872401709853b33f3bf2a00990949099563f33be51"
+    },
+    "fEndorseB": {
+      "statement": {
+        "kind": "endorse",
+        "authorisedBy": "auth-ba934bb68bd0f5e7f03b3f453bea80ce6fee6c43d171b6a6918e67bffe1d4b2e",
+        "targets": [
+          "auth-2a0795aa2c6e52f67ec0c83d384b65baf2265e1d9f52e8efcbba744f46c74e84"
+        ],
+        "nonce": "TS3mxsKpzUa_qp1xUATLJQ",
+        "sigs": [
+          {
+            "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8",
+            "sig": "T_Q2P7-FvBZ2Ojsi-RkCZuYEDfe34kCaXtXlh0DE51WSYYTK7Dm4dK0cf2hndXOBYhe96W-x09n89TpHIJNzCQ"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a373a656e646f72736536393a617574682d62613933346262363862643066356537663033623366343533626561383063653666656536633433643137316236613639313865363762666665316434623265313a3136393a617574682d3261303739356161326336653532663637656330633833643338346236356261663232363565316439663532653865666362626137343466343663373465383432323a5453336d78734b707a55615f717031785541544c4a51303a",
+      "expectedId": "auth-ef9837960f5f0f82f196d4943480824934670d6c3e91147bfbe95ff96d2ad598"
+    },
+    "fFill": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000114",
+          "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY"
+        },
+        "role": "participant",
+        "nonce": "BSyTtuf-70yrgwFC5IR0ZQ",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "UM1F4hggCt0b-89dR3o2PX57MYpvz_1rt-ue2h9Yw58moebLOGsYk0WPvjfCnXNk7K8Yc3lKlWHxfsz9lUi3DQ"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3434313262373139333763656638613738306133306361616361316236653666363266393431386433383165633536373735363161323230353338313163613133363a30313866343761302d376232312d376162632d386465662d30303030303030303031313434333a54646d3253576f6e5678724c434a70654e494c667947724e3764784e48796a68577073453843625838695931313a7061727469636970616e74303a32323a425379547475662d3730797267774643354952305a51303a",
+      "expectedId": "auth-60571c6b5eae28a7e676cbbb8223cafedb300805a48cf4168abb71e4549b341f"
+    },
+    "r2D0": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000115",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "admin",
+        "nonce": "a1Pxfut3SGmUqmfhLEW6Hw",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "cjtF4QmPneKhI-6V6DacFUWNi4-4XRnOAg12VGN--HF5r9zC-8IwVuQk19c9yxXdIpcgSyxFZzfn8IxNcK76Aw"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3434313262373139333763656638613738306133306361616361316236653666363266393431386433383165633536373735363161323230353338313163613133363a30313866343761302d376232312d376162632d386465662d30303030303030303031313534333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367353a61646d696e303a32323a613150786675743353476d55716d66684c4557364877303a",
+      "expectedId": "auth-860cd801ce8660b3fbd667be92c134eb55f56699b8500226d15ee5ee0f3d3526"
+    },
+    "r2D1": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000116",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "admin",
+        "nonce": "zAZ519KJYgqtG1edT-uYhw",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "VycZjZV9aRrKmvCboKWJevg94PyeAz3L2Qq5NZGntO0Bq93885jy5CV8RRMDJTpaAGZJoXf1CzcImJnVE-bRAg"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3434313262373139333763656638613738306133306361616361316236653666363266393431386433383165633536373735363161323230353338313163613133363a30313866343761302d376232312d376162632d386465662d30303030303030303031313634333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367353a61646d696e303a32323a7a415a3531394b4a5967717447316564542d75596877303a",
+      "expectedId": "auth-3325197a547b376e2425452f5bbd5796677b971a8b4e82eaf01cd0080d556771"
+    },
+    "r2D2": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000117",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "admin",
+        "nonce": "ldZK4lCxOfGSL6n8FYAScg",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "CINTkmE0XlDbUfY24BwNR56Giazit0lnO9ka9lDZAvcS6Dc6hHMa0SWtvEC-6p4wzJUGehoAQVAfmsYWWprHDA"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3434313262373139333763656638613738306133306361616361316236653666363266393431386433383165633536373735363161323230353338313163613133363a30313866343761302d376232312d376162632d386465662d30303030303030303031313734333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367353a61646d696e303a32323a6c645a4b346c43784f6647534c366e38465941536367303a",
+      "expectedId": "auth-252a34a317c018117fcab73ebc263121acc87d7b46df4b30ee8ce29e80562583"
+    },
+    "r2D3": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000118",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "admin",
+        "nonce": "mdJvrq1Sz8Mgpgi99juBEw",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "CV6P_0izJR9bbRo-xUXF8wmhDzhFAP1CqI-kjhzFHrlYkw6Wwcsz8l506fVJNZxKjvcjoydP8bCho9cjWYHKCQ"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3434313262373139333763656638613738306133306361616361316236653666363266393431386433383165633536373735363161323230353338313163613133363a30313866343761302d376232312d376162632d386465662d30303030303030303031313834333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367353a61646d696e303a32323a6d644a76727131537a384d6770676939396a75424577303a",
+      "expectedId": "auth-ce06e91c59f35562dd347e62a360a1be97c4d4579d14a71133b8ef60b32b413b"
+    },
+    "r2D4": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000119",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "admin",
+        "nonce": "atWe9vckMZHue2ADBr2TUw",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "d0_DctPxINL5TPflAiatbOREn4wSLZ9CKVoNGkuJ9LzCRUSQ2S4SAYj9EdB8TOGNaAJ19rwXqe84O7a12wy5AQ"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3434313262373139333763656638613738306133306361616361316236653666363266393431386433383165633536373735363161323230353338313163613133363a30313866343761302d376232312d376162632d386465662d30303030303030303031313934333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367353a61646d696e303a32323a617457653976636b4d5a487565324144427232545577303a",
+      "expectedId": "auth-f12c02323ed6a89b03b9c3edc02701a222e6a5589b0af00476e1fc5aeb34a768"
+    },
+    "r2D5": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000011a",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "admin",
+        "nonce": "Z_tD6HKjAVJscy6QZUTzeg",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "867czcb2yjbgqUdCXJuRd7ZdTglWIhAzpaETPRT-7_vBvsSu7r9_TdootB77aHCuZokJIpfNhuwDHVf2F22wDw"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3434313262373139333763656638613738306133306361616361316236653666363266393431386433383165633536373735363161323230353338313163613133363a30313866343761302d376232312d376162632d386465662d30303030303030303031316134333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367353a61646d696e303a32323a5a5f744436484b6a41564a73637936515a55547a6567303a",
+      "expectedId": "auth-a0a77732fcc11e753cb5d541e2e905ad522c5d24108c644ccd94ff5ab4be4db8"
+    },
+    "r2D6": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000011b",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "admin",
+        "nonce": "kmktg08iK2Cp9SRpr8-exg",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "eKYkBEJnJPk5GNPK3iFlgbJMvPU-7g7AXpVNnN9qqIp14EPQKGmksDJAA7fxTcHbr2qyjCs6yyngEXwTupPKDA"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3434313262373139333763656638613738306133306361616361316236653666363266393431386433383165633536373735363161323230353338313163613133363a30313866343761302d376232312d376162632d386465662d30303030303030303031316234333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367353a61646d696e303a32323a6b6d6b74673038694b3243703953527072382d657867303a",
+      "expectedId": "auth-7f7eed323129d3b64533da02110b590782e37cddf690c9235f4e8fdcf5605356"
+    },
+    "r2D7": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000011c",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "admin",
+        "nonce": "741NSarYVsxJJ0cH04rFeg",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "9ghE7tpKfE8ZCV0KCqzYm9lTYJaD_Axzx-MNZeePhYbrAgpfHm7BVclJHwPGrNRnHFIDOh06QFYOuFHnkS6yDA"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3434313262373139333763656638613738306133306361616361316236653666363266393431386433383165633536373735363161323230353338313163613133363a30313866343761302d376232312d376162632d386465662d30303030303030303031316334333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367353a61646d696e303a32323a3734314e536172595673784a4a306348303472466567303a",
+      "expectedId": "auth-ac4e90f33985441f3cc4a0cdb7e9d80062752a392b51bd4cbd13633a4df27c53"
+    },
+    "r2D8": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000011d",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "admin",
+        "nonce": "Widgog7KaTFq-lTfrqC23w",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "3qmcWqnxJvI_R_8xqXl2KCS7iLZPGAvtSG-5yKQZFfUb1oCR-P7ddmPSULw-oo6M9J1waoekxnpu5YZlJpsWCQ"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3434313262373139333763656638613738306133306361616361316236653666363266393431386433383165633536373735363161323230353338313163613133363a30313866343761302d376232312d376162632d386465662d30303030303030303031316434333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367353a61646d696e303a32323a576964676f67374b615446712d6c5466727143323377303a",
+      "expectedId": "auth-d2702bc6b405d95fd0c1849ad94b6aceaa9c0836ba792ac62c165482c0ed7aa9"
+    },
+    "r2D9": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000011e",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "admin",
+        "nonce": "LwYhlgPLMysK0u9l0G-d2g",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "V09KesGfdeULvADoxX0194scPq_v5q7EDo0CCkOPWcfYLX7qtS59eOkJ4mCHsiMsiXrCLGMc4TcO5q8yKHr_DQ"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3434313262373139333763656638613738306133306361616361316236653666363266393431386433383165633536373735363161323230353338313163613133363a30313866343761302d376232312d376162632d386465662d30303030303030303031316534333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367353a61646d696e303a32323a4c7759686c67504c4d79734b3075396c30472d643267303a",
+      "expectedId": "auth-04afcc81cfeef49b796f357ee2a076daa3a75fc25fa9374f19c3823020308a45"
+    },
+    "r2D10": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000011f",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "admin",
+        "nonce": "sa0vg0EXFTMfbflW8wSO5g",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "vWKqQaJTzp2WHbLY_FgqbmVa6lwBAxMJCVpJhVeAW0GwSlQs3-1oUeU7piDFFsO89LgbASCgzwhehtem43R2Dg"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3434313262373139333763656638613738306133306361616361316236653666363266393431386433383165633536373735363161323230353338313163613133363a30313866343761302d376232312d376162632d386465662d30303030303030303031316634333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367353a61646d696e303a32323a736130766730455846544d6662666c573877534f3567303a",
+      "expectedId": "auth-88ac8a97163bf2f9cdc99481de9f75bd990cddc6cadb67db319e0a7a8698c079"
+    },
+    "r2D11": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000120",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "admin",
+        "nonce": "Vo5zTj7MZq6R7Dkf2dJobg",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "LjaS8dIoLslxwLB5uaYzGBOHhIZQJR4qUxRuo2kVNuyMiWaIf80613Hg2SE4hWW_GbDAzoAwo1ns1cXDfrm7DA"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3434313262373139333763656638613738306133306361616361316236653666363266393431386433383165633536373735363161323230353338313163613133363a30313866343761302d376232312d376162632d386465662d30303030303030303031323034333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367353a61646d696e303a32323a566f357a546a374d5a71365237446b6632644a6f6267303a",
+      "expectedId": "auth-2f5b015482631fe25cb8b1893ee5535b55527d21b63b3b1e860852b7450a9071"
+    },
+    "r2D12": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000121",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "admin",
+        "nonce": "AS7ikprYbqHDxao2nglMjw",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "O7W_CbikROttSkdF49PgVMhYxz0G7m7GA6g7Aqk_oQP_odMfgk3zD2iRXyYzmDy3egcT_mbOjoZa51wvVaCIAA"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3434313262373139333763656638613738306133306361616361316236653666363266393431386433383165633536373735363161323230353338313163613133363a30313866343761302d376232312d376162632d386465662d30303030303030303031323134333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367353a61646d696e303a32323a415337696b7072596271484478616f326e676c4d6a77303a",
+      "expectedId": "auth-2be50c61f66e28c0796975adfa184db37663851a56576764766ca4238fa1b2ba"
+    },
+    "r2D13": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000122",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "admin",
+        "nonce": "16b1Y_UkZLW8H6Vjd_IT1Q",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "lfR0oyUwcZqgOzRKTtd-INXJM0Nuqz9x3pXhpEwBgPw8d1JBr2_BVqhukPKQDiJcU-Ee3cHUaq7lIySCpL3bDQ"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3434313262373139333763656638613738306133306361616361316236653666363266393431386433383165633536373735363161323230353338313163613133363a30313866343761302d376232312d376162632d386465662d30303030303030303031323234333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367353a61646d696e303a32323a31366231595f556b5a4c57384836566a645f49543151303a",
+      "expectedId": "auth-9e5a6788d0d1d3ddb5b7c401e4827d4c51978fa5e93a4ebae0e4946d73783f74"
+    },
+    "r2D14": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000123",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "admin",
+        "nonce": "6tpYcTaHixOAYtGiCBxi9A",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "Amuy31BvA2HtZ9ELoCOvSImZJFAFMQUd0uapjVmkgrZoyTfMI1UM7jkc_Bx4cGGmDLZB-plDuvDWoMvp8sTPCw"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3434313262373139333763656638613738306133306361616361316236653666363266393431386433383165633536373735363161323230353338313163613133363a30313866343761302d376232312d376162632d386465662d30303030303030303031323334333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367353a61646d696e303a32323a367470596354614869784f4159744769434278693941303a",
+      "expectedId": "auth-3cea07c9d185366119fbc26aca44569871e2bee3fc0a38102f63898a18a66b2e"
+    },
+    "r2D15": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000124",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "admin",
+        "nonce": "HXwTimms3jSlkshe-bCF5A",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "rQVjEq_LBs2gk7AmBOseOfBG4pui-mp96Lp68SsveQT4OD-7w5meNwck5iksiCly2LAxZHclQs45RoZgU2e0Cw"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3434313262373139333763656638613738306133306361616361316236653666363266393431386433383165633536373735363161323230353338313163613133363a30313866343761302d376232312d376162632d386465662d30303030303030303031323434333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367353a61646d696e303a32323a48587754696d6d73336a536c6b7368652d6243463541303a",
+      "expectedId": "auth-20bae751271076e7998ffb599eea47b4c05ac765de1124b14fe168032f29f811"
+    },
+    "r2D16": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000125",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "admin",
+        "nonce": "w5AVqrDcUv7SB75kTKdmHA",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "jWsmLQpAOsgBjE2038VtEl1DCcIhN64dXA6SQShmkRookjOuwTjnisgSUl9V-WKq_SnIU4FgUe_O1muUe-kkCA"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3434313262373139333763656638613738306133306361616361316236653666363266393431386433383165633536373735363161323230353338313163613133363a30313866343761302d376232312d376162632d386465662d30303030303030303031323534333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367353a61646d696e303a32323a7735415671724463557637534237356b544b646d4841303a",
+      "expectedId": "auth-749fddbd19eb95f2d13cd10079045f14e6d173dfcab08f0e5e112d9c7aafd364"
+    },
+    "r2D17": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000126",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "admin",
+        "nonce": "Q8k_QpUuNFUYg7PdBIl9ZQ",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "1D0wC-xvtnJ8GjE8U8qpMYQ23PKSnFr4D-T3CTmMTeO6h_J2mW54K3z-0O6cGT3r3IDghnsMA12-2pMmZeRGBg"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3434313262373139333763656638613738306133306361616361316236653666363266393431386433383165633536373735363161323230353338313163613133363a30313866343761302d376232312d376162632d386465662d30303030303030303031323634333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367353a61646d696e303a32323a51386b5f517055754e4655596737506442496c395a51303a",
+      "expectedId": "auth-3aad4b02dea7470d5b921e9de24e3cc8ea4f9de760549244294cd93acddf9af7"
+    },
+    "r2D18": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000127",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "admin",
+        "nonce": "UdWrnpdk3Lggn9hORUj_nQ",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "ivm_h8o2jc3eCEljuMwHJAwGtSVkjr1WfpFtupOjPRzobQhRgfVqtDEjoCSojmQ4Al0Zqa3II4qOWbetm5jqBQ"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3434313262373139333763656638613738306133306361616361316236653666363266393431386433383165633536373735363161323230353338313163613133363a30313866343761302d376232312d376162632d386465662d30303030303030303031323734333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367353a61646d696e303a32323a556457726e70646b334c67676e39684f52556a5f6e51303a",
+      "expectedId": "auth-2c6ece89a4167c7feeee51ab5692f70f697bbcf1bdaf9dc79c71e99babc07b1b"
+    },
+    "r2D19": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000128",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "admin",
+        "nonce": "PFxukL_nSQ-QqgvMKwK-PQ",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "J8EklJSfT2AzXbfvz1PrFcKYOFdFera0MtqGjjVg_tO1d5NaDH0pHWu6oTtXOAPHvXK8ByMDksYeb5gvrUerBQ"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3434313262373139333763656638613738306133306361616361316236653666363266393431386433383165633536373735363161323230353338313163613133363a30313866343761302d376232312d376162632d386465662d30303030303030303031323834333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367353a61646d696e303a32323a504678756b4c5f6e53512d517167764d4b774b2d5051303a",
+      "expectedId": "auth-6d5ccdc53c04445578338337133e89bfb29a8cf25952dc9665c98700cb360a5e"
+    },
+    "r2C_r2D7": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-ac4e90f33985441f3cc4a0cdb7e9d80062752a392b51bd4cbd13633a4df27c53",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000129",
+          "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8"
+        },
+        "role": "admin",
+        "nonce": "Z9KQCXWpXQxqcoR9nofSRQ",
+        "sigs": [
+          {
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "sig": "6aBrLM9AzyAsvDO5J2KlDjtKXgcY0m3GFs4t9GvHrkgBFXUxfXHhl4fObmihDcfbzXjridZ_8Wqjh6VvVih3BA"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d6163346539306633333938353434316633636334613063646237653964383030363237353261333932623531626434636264313336333361346466323763353333363a30313866343761302d376232312d376162632d386465662d30303030303030303031323934333a7952797a7a697545354c714639574c7335423766354f4a365f464c596a56425f5a7147474f4e2d43507038353a61646d696e303a32323a5a394b514358577058517871636f52396e6f66535251303a",
+      "expectedId": "auth-030100c9b30c240188a638e3856c708ef27c9627356889ab7acb90bc46c1fdd1"
+    },
+    "r2C_r2D3": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-ce06e91c59f35562dd347e62a360a1be97c4d4579d14a71133b8ef60b32b413b",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000012a",
+          "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8"
+        },
+        "role": "admin",
+        "nonce": "C0pzt-8MSBPYYmq-O2Jg_g",
+        "sigs": [
+          {
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "sig": "16xk2j9E3cGMWsB8kmhFsgrNKL2vsg7LutfJ0ooGVOnCFfyUtmdAgIeOZa9JUMybUch4LM-paGO5VRvHTlLsCQ"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d6365303665393163353966333535363264643334376536326133363061316265393763346434353739643134613731313333623865663630623332623431336233363a30313866343761302d376232312d376162632d386465662d30303030303030303031326134333a7952797a7a697545354c714639574c7335423766354f4a365f464c596a56425f5a7147474f4e2d43507038353a61646d696e303a32323a4330707a742d384d53425059596d712d4f324a675f67303a",
+      "expectedId": "auth-8fa4d704b8f67b8ea1a4f25e3943a92406c54092a55943fad965107748e77383"
+    },
+    "r2C_r2D8": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-d2702bc6b405d95fd0c1849ad94b6aceaa9c0836ba792ac62c165482c0ed7aa9",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000012b",
+          "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8"
+        },
+        "role": "admin",
+        "nonce": "S9mI93o4qtxU3bYBGc4t1Q",
+        "sigs": [
+          {
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "sig": "7tcWQy3iDV6bPkHcxUvNfEruqOyHKrXd7sKVYaHOYOoJ4eszMncrwoLAxS-iUsdqf_k8fk1ypGXs25gZYOL0BA"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d6432373032626336623430356439356664306331383439616439346236616365616139633038333662613739326163363263313635343832633065643761613933363a30313866343761302d376232312d376162632d386465662d30303030303030303031326234333a7952797a7a697545354c714639574c7335423766354f4a365f464c596a56425f5a7147474f4e2d43507038353a61646d696e303a32323a53396d4939336f347174785533625942476334743151303a",
+      "expectedId": "auth-7a5a6d128d14da9c0d5e7de9991d7273c546388244db4270205218ce0524f277"
+    },
+    "r2C_r2D4": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-f12c02323ed6a89b03b9c3edc02701a222e6a5589b0af00476e1fc5aeb34a768",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000012c",
+          "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8"
+        },
+        "role": "admin",
+        "nonce": "eLUXDanliD4KKYq6tnRo-g",
+        "sigs": [
+          {
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "sig": "c63Pxi0GYo7Nb3AUmBs6vm6DN7f8sVpDZxn6O3bEVO0ERVRvN2zfIAJSIqtZzFi50kXW9uoQ1uIu5dFqz15nDQ"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d6631326330323332336564366138396230336239633365646330323730316132323265366135353839623061663030343736653166633561656233346137363833363a30313866343761302d376232312d376162632d386465662d30303030303030303031326334333a7952797a7a697545354c714639574c7335423766354f4a365f464c596a56425f5a7147474f4e2d43507038353a61646d696e303a32323a654c555844616e6c6944344b4b597136746e526f2d67303a",
+      "expectedId": "auth-5055026d193b51d02d01da486cd30ab22d74f41298d0f37ee2f057aeb0f87710"
+    },
+    "r2E": {
+      "statement": {
+        "kind": "endorse",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "targets": [
+          "auth-030100c9b30c240188a638e3856c708ef27c9627356889ab7acb90bc46c1fdd1",
+          "auth-8fa4d704b8f67b8ea1a4f25e3943a92406c54092a55943fad965107748e77383",
+          "auth-7a5a6d128d14da9c0d5e7de9991d7273c546388244db4270205218ce0524f277",
+          "auth-5055026d193b51d02d01da486cd30ab22d74f41298d0f37ee2f057aeb0f87710"
+        ],
+        "nonce": "9txBNiO9pyWnF9JUHoQxfA",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "oy06nMHzbe4gmCpTPpTMD6xVC7d3d6bdtexEc54MCrUqrR3ZVRf_zpuHkK5JyW4igrBmvsrER4h2hez214IxBQ"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a373a656e646f72736536393a617574682d34343132623731393337636566386137383061333063616163613162366536663632663934313864333831656335363737353631613232303533383131636131313a3436393a617574682d3033303130306339623330633234303138386136333865333835366337303865663237633936323733353638383961623761636239306263343663316664643136393a617574682d3530353530323664313933623531643032643031646134383663643330616232326437346634313239386430663337656532663035376165623066383737313036393a617574682d3761356136643132386431346461396330643565376465393939316437323733633534363338383234346462343237303230353231386365303532346632373736393a617574682d3866613464373034623866363762386561316134663235653339343361393234303663353430393261353539343366616439363531303737343865373733383332323a397478424e694f397079576e46394a55486f51786641303a",
+      "expectedId": "auth-4f2471d7aaf8eee81c72b4d56f3ff01b8c3b94b582ad8a62ee8d15302bf44eff"
+    },
+    "r2Launder": {
+      "statement": {
+        "kind": "revoke",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "targets": [
+          "auth-ac4e90f33985441f3cc4a0cdb7e9d80062752a392b51bd4cbd13633a4df27c53",
+          "auth-ce06e91c59f35562dd347e62a360a1be97c4d4579d14a71133b8ef60b32b413b",
+          "auth-d2702bc6b405d95fd0c1849ad94b6aceaa9c0836ba792ac62c165482c0ed7aa9",
+          "auth-f12c02323ed6a89b03b9c3edc02701a222e6a5589b0af00476e1fc5aeb34a768"
+        ],
+        "nonce": "xxnhIQL1E3Vvwsr-4SMN2A",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "SgJCSP3NTFxBCXN91k_144uc4XetLV48juyjKRPOYU88oBK8PnE1yx946_qajSilBVeLILW-Nmi9y3bOzMhfAw"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a363a7265766f6b6536393a617574682d34343132623731393337636566386137383061333063616163613162366536663632663934313864333831656335363737353631613232303533383131636131313a3436393a617574682d6163346539306633333938353434316633636334613063646237653964383030363237353261333932623531626434636264313336333361346466323763353336393a617574682d6365303665393163353966333535363264643334376536326133363061316265393763346434353739643134613731313333623865663630623332623431336236393a617574682d6432373032626336623430356439356664306331383439616439346236616365616139633038333662613739326163363263313635343832633065643761613936393a617574682d6631326330323332336564366138396230336239633365646330323730316132323265366135353839623061663030343736653166633561656233346137363832323a78786e6849514c31453356767773722d34534d4e3241303a",
+      "expectedId": "auth-acb20a26008f4e2f09a3bba0a12c45d22b632ef6e237292bc73858733fbe513f"
+    },
+    "fitD0": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000012d",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "admin",
+        "nonce": "qQfMtJA_VFj0mtUUnA2STg",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "Nj4gTauYU5k7yr_UevkTiDu8m5J53Mh_T9ic3rdG9lHJ8jHQCazOjeJSZTyAGvnANaBFr_3sTgkeeB7jSXVbCg"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3434313262373139333763656638613738306133306361616361316236653666363266393431386433383165633536373735363161323230353338313163613133363a30313866343761302d376232312d376162632d386465662d30303030303030303031326434333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367353a61646d696e303a32323a7151664d744a415f56466a306d7455556e4132535467303a",
+      "expectedId": "auth-78fb8fcae0231ecf304abbdd4770d41092abed6233211f93c6d0152d122373ac"
+    },
+    "fitD1": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000012e",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "admin",
+        "nonce": "RkRiOGB_adc6mnOn5ei-rw",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "Qo3NycG5kLPwRq3nXSuiDsxfVb2CAV-73dvk6flCuyh011PKXRE6kaqTsZTtCIg_DcuBNuf6V9LEeNThrm0tCg"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3434313262373139333763656638613738306133306361616361316236653666363266393431386433383165633536373735363161323230353338313163613133363a30313866343761302d376232312d376162632d386465662d30303030303030303031326534333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367353a61646d696e303a32323a526b52694f47425f616463366d6e4f6e3565692d7277303a",
+      "expectedId": "auth-da411319561bc1363b22db3fe59ec6b078bccafc856dac0b8a2b240436849c7a"
+    },
+    "fitD2": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000012f",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "admin",
+        "nonce": "Qmy6ksaOwW2FKxzWD5MyFg",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "fp4xosHWHSKKmWI5v5kr-L1h6QBNznGs6GTHvkF5M4CHfAS_j4CUSnnFVdWjPD2HvQ-WQe1-iJL0-WgP_thDAw"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3434313262373139333763656638613738306133306361616361316236653666363266393431386433383165633536373735363161323230353338313163613133363a30313866343761302d376232312d376162632d386465662d30303030303030303031326634333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367353a61646d696e303a32323a516d79366b73614f775732464b787a5744354d794667303a",
+      "expectedId": "auth-25ecd698837790e291354f64d9d278d491e3e04ed253828e21f110fa4a58e579"
+    },
+    "fitD3": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000130",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "admin",
+        "nonce": "jYHWciuAPKVSsbtPWEp9wg",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "SMBqcrVldym2NfW_6c5jxHl1A4cya2daZj6bB4gQsQEY2uPI_zSsbY5xA_usymzDmUf0sYZOD6VSPrnmIm42CA"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3434313262373139333763656638613738306133306361616361316236653666363266393431386433383165633536373735363161323230353338313163613133363a30313866343761302d376232312d376162632d386465662d30303030303030303031333034333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367353a61646d696e303a32323a6a59485763697541504b565373627450574570397767303a",
+      "expectedId": "auth-2bbcee9cb185f61dc6636d16604871a56122a93e25065b8a29ff12e2674fe55b"
+    },
+    "fitD4": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000131",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "admin",
+        "nonce": "ahFXDnJHqt9OfXIyCabN9w",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "ypnRGJU3xY67u66fcTalU121IIy-BKD0LrakS24GNJi-awQ6VbzgUMqIL5djcfQIhaua95sAg-2f_jObSA_QBg"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3434313262373139333763656638613738306133306361616361316236653666363266393431386433383165633536373735363161323230353338313163613133363a30313866343761302d376232312d376162632d386465662d30303030303030303031333134333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367353a61646d696e303a32323a61684658446e4a487174394f665849794361624e3977303a",
+      "expectedId": "auth-4f428bf27611b701f777ebac73e8586e85303af152952ceb8bc137b4a5cc7b71"
+    },
+    "fitD5": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000132",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "admin",
+        "nonce": "073F2JziloBEYrggIj10XQ",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "AT4Ss6dlSAM4U9GPpslsJXZM0t_Eji1LivMpzJW-fJGifTdhO2xA206Jr4gWPbm2Z-UBTzrvpcLtZuK0WaKTBA"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3434313262373139333763656638613738306133306361616361316236653666363266393431386433383165633536373735363161323230353338313163613133363a30313866343761302d376232312d376162632d386465662d30303030303030303031333234333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367353a61646d696e303a32323a30373346324a7a696c6f424559726767496a31305851303a",
+      "expectedId": "auth-7ea487acbcde6a7ea77169b5f1a3129d121ea1162807c82c8d587afb7ca78a88"
+    },
+    "fitD6": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000133",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "admin",
+        "nonce": "I_brLeH3quaVpYacd16lwg",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "F-lMrAw-5e_UeIo4QEE9BahbXenHuqRDsDMT3I0RKdNKHPK2wrkW_QrTRIjF1GmdxxLn3UWz3knjA7zEMzTRAQ"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3434313262373139333763656638613738306133306361616361316236653666363266393431386433383165633536373735363161323230353338313163613133363a30313866343761302d376232312d376162632d386465662d30303030303030303031333334333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367353a61646d696e303a32323a495f62724c65483371756156705961636431366c7767303a",
+      "expectedId": "auth-abe20280038007eeaae157696808427eb97bbdc557353ab537ff3835e3f79e8d"
+    },
+    "fitD7": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000134",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "admin",
+        "nonce": "_KjA0vo1rbNjViOnr8yd8w",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "65VJYjPP2PrrmY14uRpQmE3s-Pahy1l3xGLlwjF5Oz9wF1Z2pS0ppPNCwvldJC8S8HK7nmI-ItSMsc4bE21fAg"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3434313262373139333763656638613738306133306361616361316236653666363266393431386433383165633536373735363161323230353338313163613133363a30313866343761302d376232312d376162632d386465662d30303030303030303031333434333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367353a61646d696e303a32323a5f4b6a4130766f3172624e6a56694f6e723879643877303a",
+      "expectedId": "auth-5de3aae7ef6485a93794eebbf228c560ca93e98f411981665ddfb4b3b3720e3c"
+    },
+    "fitD8": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000135",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "admin",
+        "nonce": "65Nj4NUjNlEyi_K70KpdFQ",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "7r8J4kEo28LiBs2H5cVP9e3PUP8Wfv_Xj2K5K9iDZZwkE3TO24qLOVoEGjBU6xsmb1XAlpFvHO-FhpsrhmMsCw"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3434313262373139333763656638613738306133306361616361316236653666363266393431386433383165633536373735363161323230353338313163613133363a30313866343761302d376232312d376162632d386465662d30303030303030303031333534333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367353a61646d696e303a32323a36354e6a344e556a4e6c4579695f4b37304b70644651303a",
+      "expectedId": "auth-415b4601c13d8cdc3bb5bcf9ab2d0776ce087e5811483b80e123045412e2815b"
+    },
+    "fitD9": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000136",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "admin",
+        "nonce": "i5Yyu4VOoEVJDg6_dkOjZA",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "a7pDbdb2OcetuxNkyAIfNWe_unbYf1OpDh8ORwwPuNrtjljsObYrOUezSomw_N6CL1nvN919LLlpoAGjREdkCQ"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3434313262373139333763656638613738306133306361616361316236653666363266393431386433383165633536373735363161323230353338313163613133363a30313866343761302d376232312d376162632d386465662d30303030303030303031333634333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367353a61646d696e303a32323a693559797534564f6f45564a4467365f646b4f6a5a41303a",
+      "expectedId": "auth-5116d4375438a2b536d706a7f1d252ea86117ef2e5e9f7eb827d2e2b7efdd2f2"
+    },
+    "fitD10": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000137",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "admin",
+        "nonce": "BSxBDWVYE4NrFtAzsr5HPQ",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "04PXCkV0CH2oov6kfxGpLCvlB3lL2dHRNR_kw1V7wJTRkekZXFIHltdVukvcqkjtV09uiM6ZbfxVpff2uQkfDw"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3434313262373139333763656638613738306133306361616361316236653666363266393431386433383165633536373735363161323230353338313163613133363a30313866343761302d376232312d376162632d386465662d30303030303030303031333734333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367353a61646d696e303a32323a425378424457565945344e724674417a737235485051303a",
+      "expectedId": "auth-69605b38ee44b2022942f4efa5d1a15b437f1ad80261198610fa7c1993f71ce8"
+    },
+    "fitD11": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000138",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "admin",
+        "nonce": "KTxWj8g8Uz9jy5QTKNw3KQ",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "cpzXdr2VdutA11XN7K0-kP2t5On0ks2hSLMryAcUBgJklGwEjtPCIsNFl4O3cm5oICli36ZTdGkqDELRYIJdBQ"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3434313262373139333763656638613738306133306361616361316236653666363266393431386433383165633536373735363161323230353338313163613133363a30313866343761302d376232312d376162632d386465662d30303030303030303031333834333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367353a61646d696e303a32323a4b5478576a386738557a396a793551544b4e77334b51303a",
+      "expectedId": "auth-5fbe1619bf1deda74bbfef127a1bb684e154d2d922ff5712a4921912b2fb4536"
+    },
+    "fitD12": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000139",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "admin",
+        "nonce": "r1fbdcMzr2TVByuGWgCFuA",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "wUO5vzrDu7o1XoCA8RrC4hSeaipE6tk8mS-hQAcOtdYZnRL92m_EE0zTlM1rCfuEbkCZQfgM6zqx_pvuZB8xDw"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3434313262373139333763656638613738306133306361616361316236653666363266393431386433383165633536373735363161323230353338313163613133363a30313866343761302d376232312d376162632d386465662d30303030303030303031333934333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367353a61646d696e303a32323a7231666264634d7a7232545642797547576743467541303a",
+      "expectedId": "auth-679d8068861851a7aab6599ee4459d07201f76ca7ba25f018048a8e02e2bafb7"
+    },
+    "fitD13": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000013a",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "admin",
+        "nonce": "VjeWomxZE6mnHhCUwKTa4g",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "zLQmfzSj4Rom_vNHgCQ0z1ado4IPaNJ_ETLZFIwWpYfxnn4slU8IYv94he9kbO99RC2WB6YRWDythMgMbUYBAQ"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3434313262373139333763656638613738306133306361616361316236653666363266393431386433383165633536373735363161323230353338313163613133363a30313866343761302d376232312d376162632d386465662d30303030303030303031336134333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367353a61646d696e303a32323a566a65576f6d785a45366d6e48684355774b54613467303a",
+      "expectedId": "auth-87cac0099227c071c8787f74a72448b682686e846453059fb4c905475c020681"
+    },
+    "fitD14": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000013b",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "admin",
+        "nonce": "HmOMvn1VIx0YVE10SmYa2w",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "CcgVlBYS67bdHuPUUnjVpFqx0xjpQEhV6H-QtKudzlAsthjXfgRwnHFUbAW3YtmuTlgM27lVnNFqFZJqXOR8DA"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3434313262373139333763656638613738306133306361616361316236653666363266393431386433383165633536373735363161323230353338313163613133363a30313866343761302d376232312d376162632d386465662d30303030303030303031336234333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367353a61646d696e303a32323a486d4f4d766e31564978305956453130536d59613277303a",
+      "expectedId": "auth-4d9012638229888c811469052aea9c10820caf309de6226901096c3586e83648"
+    },
+    "fitC0": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-78fb8fcae0231ecf304abbdd4770d41092abed6233211f93c6d0152d122373ac",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000013c",
+          "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8"
+        },
+        "role": "admin",
+        "nonce": "5sz6xSCtMFIlkxInGTrCig",
+        "sigs": [
+          {
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "sig": "ntqRjReucTMbi7lgH_m6wkBNpQd87mk38IRzvbQIzAbnih4JIFlRn6FrLsx6wjjdcvQ669pZKAjjiT_0a_olCg"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3738666238666361653032333165636633303461626264643437373064343130393261626564363233333231316639336336643031353264313232333733616333363a30313866343761302d376232312d376162632d386465662d30303030303030303031336334333a7952797a7a697545354c714639574c7335423766354f4a365f464c596a56425f5a7147474f4e2d43507038353a61646d696e303a32323a35737a36785343744d46496c6b78496e475472436967303a",
+      "expectedId": "auth-8c3fd279408010ce1d840f24d57516cb961fb22a959b3bb3ce906be227b03e44"
+    },
+    "fitC1": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-78fb8fcae0231ecf304abbdd4770d41092abed6233211f93c6d0152d122373ac",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000013d",
+          "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8"
+        },
+        "role": "admin",
+        "nonce": "zpOCzyzJvttrUiSSCJL0LQ",
+        "sigs": [
+          {
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "sig": "cluajAcjfpK0kcGQHByj1FqrX30n1LUXkjfJomsLVWC03d6MSalMXSZYGeETuHpuXXiWyMNj7Wb-KCaitKDfBQ"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3738666238666361653032333165636633303461626264643437373064343130393261626564363233333231316639336336643031353264313232333733616333363a30313866343761302d376232312d376162632d386465662d30303030303030303031336434333a7952797a7a697545354c714639574c7335423766354f4a365f464c596a56425f5a7147474f4e2d43507038353a61646d696e303a32323a7a704f437a797a4a7674747255695353434a4c304c51303a",
+      "expectedId": "auth-bd22111d3396232678f6c09a6db75a5f7e40601e78e64631c533693bb0e5bdc8"
+    },
+    "fitC2": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-78fb8fcae0231ecf304abbdd4770d41092abed6233211f93c6d0152d122373ac",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000013e",
+          "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8"
+        },
+        "role": "admin",
+        "nonce": "iRTD-L3L5f44hU55pys36Q",
+        "sigs": [
+          {
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "sig": "oz1ZBtL6dtQtnmLX3bZupjKPykEYLtKKh6ESm0MhknG3hDDQTVK0WUXuPlki4yOKC1jzGSoShwowvNTMcVx_Dw"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3738666238666361653032333165636633303461626264643437373064343130393261626564363233333231316639336336643031353264313232333733616333363a30313866343761302d376232312d376162632d386465662d30303030303030303031336534333a7952797a7a697545354c714639574c7335423766354f4a365f464c596a56425f5a7147474f4e2d43507038353a61646d696e303a32323a695254442d4c334c3566343468553535707973333651303a",
+      "expectedId": "auth-eb2c754c42a5ff5bcb42283434f07833497e79d95e037ee2cde940e751c7ffd4"
+    },
+    "fitRevoke": {
+      "statement": {
+        "kind": "revoke",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "targets": [
+          "auth-78fb8fcae0231ecf304abbdd4770d41092abed6233211f93c6d0152d122373ac"
+        ],
+        "nonce": "waAtcJs1xz0c96lOkh7JRw",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "qr6ELqVM0d8lLTQFE6rMnXhp-pc08z3jyVkxBrZA3asuQ4CHMeb6TRqHoaDTvpvmtIyUBpGWe34w46NcAJbQAg"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a363a7265766f6b6536393a617574682d34343132623731393337636566386137383061333063616163613162366536663632663934313864333831656335363737353631613232303533383131636131313a3136393a617574682d3738666238666361653032333165636633303461626264643437373064343130393261626564363233333231316639336336643031353264313232333733616332323a77614174634a7331787a306339366c4f6b68374a5277303a",
+      "expectedId": "auth-030e337b118ee1893af22c513fc950d90f54b048b353d81f24cf507bd992e96a"
+    },
+    "fitEndorse": {
+      "statement": {
+        "kind": "endorse",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "targets": [
+          "auth-8c3fd279408010ce1d840f24d57516cb961fb22a959b3bb3ce906be227b03e44",
+          "auth-bd22111d3396232678f6c09a6db75a5f7e40601e78e64631c533693bb0e5bdc8",
+          "auth-eb2c754c42a5ff5bcb42283434f07833497e79d95e037ee2cde940e751c7ffd4"
+        ],
+        "nonce": "pXupU0eMRhzOcbrmeDmMQw",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "eApFT0WM-tbq_M5bsTWCQx2jRSZ5QFGb1qm8BWBK_EjKpeW8ap-Qtpxr0mRHb7Gf2w7C2bQEwClBAko1WAHnBA"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a373a656e646f72736536393a617574682d34343132623731393337636566386137383061333063616163613162366536663632663934313864333831656335363737353631613232303533383131636131313a3336393a617574682d3863336664323739343038303130636531643834306632346435373531366362393631666232326139353962336262336365393036626532323762303365343436393a617574682d6264323231313164333339363233323637386636633039613664623735613566376534303630316537386536343633316335333336393362623065356264633836393a617574682d6562326337353463343261356666356263623432323833343334663037383333343937653739643935653033376565326364653934306537353163376666643432323a705875705530654d52687a4f6362726d65446d4d5177303a",
+      "expectedId": "auth-c99e91b94a2b4fcd7925346f59bca4405c8429e229ef69f08fb22324d74e0aa7"
+    },
+    "r1D0": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000013f",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "admin",
+        "nonce": "W1ij-NditOip3p23FPJMlw",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "wY2sUbNg92IyMLsj_cf9CqekvIfKhaPxOD49P-TccHZjoKX_CxAZ_fV_-BrjtZ4qcxF99_crjmzE4HpgLpmRCg"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3434313262373139333763656638613738306133306361616361316236653666363266393431386433383165633536373735363161323230353338313163613133363a30313866343761302d376232312d376162632d386465662d30303030303030303031336634333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367353a61646d696e303a32323a5731696a2d4e6469744f69703370323346504a4d6c77303a",
+      "expectedId": "auth-0d07b56440b03565478948c3a1929b9ac4becad54f05f9a9b4404e072311f537"
+    },
+    "r1C0": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-0d07b56440b03565478948c3a1929b9ac4becad54f05f9a9b4404e072311f537",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000140",
+          "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8"
+        },
+        "role": "admin",
+        "nonce": "FhQ1NfAJcdHLGGVh2K5lTw",
+        "sigs": [
+          {
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "sig": "DFxKAkMxvU4TXmZqab1jgGdfFvDgozX5L_vDMD-1s611idafSE1TBENNc6dJaUMNVjMxXP8BemPfOju6qcqtDQ"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3064303762353634343062303335363534373839343863336131393239623961633462656361643534663035663961396234343034653037323331316635333733363a30313866343761302d376232312d376162632d386465662d30303030303030303031343034333a7952797a7a697545354c714639574c7335423766354f4a365f464c596a56425f5a7147474f4e2d43507038353a61646d696e303a32323a466851314e66414a6364484c47475668324b356c5477303a",
+      "expectedId": "auth-313213cc03ffc758c8069af716d87c4166ce4e7b69b78dbbb37405b314f73abe"
+    },
+    "r1V0_0": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-313213cc03ffc758c8069af716d87c4166ce4e7b69b78dbbb37405b314f73abe",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000141",
+          "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY"
+        },
+        "role": "validator",
+        "nonce": "SwuFkouHMUHXiztINbj_xw",
+        "sigs": [
+          {
+            "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8",
+            "sig": "rq-lJ25odTzxFgUqhhOH6VOqfT1NkH1PSQ3r4Fq0eXY4XAST9HrThZUJ6maoKYGgkGT3Ak8J8aLK-B50SEf2Bg"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3331333231336363303366666337353863383036396166373136643837633431363663653465376236396237386462626233373430356233313466373361626533363a30313866343761302d376232312d376162632d386465662d30303030303030303031343134333a54646d3253576f6e5678724c434a70654e494c667947724e3764784e48796a685770734538436258386959393a76616c696461746f72303a32323a537775466b6f75484d554858697a74494e626a5f7877303a",
+      "expectedId": "auth-114f50cdf2d2edbe7f44001fef3797c74d860d9c5ca67044842c2c5c478ae295"
+    },
+    "r1V0_1": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-313213cc03ffc758c8069af716d87c4166ce4e7b69b78dbbb37405b314f73abe",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000142",
+          "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY"
+        },
+        "role": "validator",
+        "nonce": "EH6ahiWQb1ldJsGrOP0HaA",
+        "sigs": [
+          {
+            "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8",
+            "sig": "P8fPj7Rr7wMCtVfvseanPsGcacBXddj36d7BL_1TF4_X0knz6IRfXMtR8JxgOuo_MUUrjpQyMkhH4tv-JpwxDg"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3331333231336363303366666337353863383036396166373136643837633431363663653465376236396237386462626233373430356233313466373361626533363a30313866343761302d376232312d376162632d386465662d30303030303030303031343234333a54646d3253576f6e5678724c434a70654e494c667947724e3764784e48796a685770734538436258386959393a76616c696461746f72303a32323a454836616869575162316c644a7347724f5030486141303a",
+      "expectedId": "auth-aa82365771926141cfa756dcdf9f0f8183a697ca3c0b5883aa1750cf1d356b36"
+    },
+    "r1V0_2": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-313213cc03ffc758c8069af716d87c4166ce4e7b69b78dbbb37405b314f73abe",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000143",
+          "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY"
+        },
+        "role": "participant",
+        "nonce": "tF11YRrycpeV2oxzHnxH4g",
+        "sigs": [
+          {
+            "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8",
+            "sig": "UWHo6QPD3XY8pTJXznu1Wt91ubvebfHGWIetITsIMVuAAzbXNXQxHOH2U50xCPngkK4KsWeAg5UhEKC32clEBg"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3331333231336363303366666337353863383036396166373136643837633431363663653465376236396237386462626233373430356233313466373361626533363a30313866343761302d376232312d376162632d386465662d30303030303030303031343334333a54646d3253576f6e5678724c434a70654e494c667947724e3764784e48796a68577073453843625838695931313a7061727469636970616e74303a32323a744631315952727963706556326f787a486e78483467303a",
+      "expectedId": "auth-a73158dbea908694e91f1201a5d513d441fd695faa035d11b4ce1c524527c6e1"
+    },
+    "r1V0_3": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-313213cc03ffc758c8069af716d87c4166ce4e7b69b78dbbb37405b314f73abe",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000144",
+          "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY"
+        },
+        "role": "participant",
+        "nonce": "C3-7_t06lfc_Qc3-5oFN3g",
+        "sigs": [
+          {
+            "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8",
+            "sig": "kbbgmSMX8gew2pe1X-olxCPGlCoH8k4oz0wx-aOqLh1Lo4Y5QKhn9l8Tyqn-jOLpOJSBRs2no9CNOPBU6uJHCg"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3331333231336363303366666337353863383036396166373136643837633431363663653465376236396237386462626233373430356233313466373361626533363a30313866343761302d376232312d376162632d386465662d30303030303030303031343434333a54646d3253576f6e5678724c434a70654e494c667947724e3764784e48796a68577073453843625838695931313a7061727469636970616e74303a32323a43332d375f7430366c66635f5163332d356f464e3367303a",
+      "expectedId": "auth-19b9671f14f669dd50d401804d707550f086a3b0b31389be1b574a2360666216"
+    },
+    "r1D1": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000145",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "admin",
+        "nonce": "iBuH9NpWeqqixkboeUcDpg",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "blXjG2lhhxyCQJ6TgmxW8UaMLuioGUCMG4HwBOnyalGxMorOP4rplQ3EZoxqfsiBIraFYMO1h91WERHe5qh_AA"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3434313262373139333763656638613738306133306361616361316236653666363266393431386433383165633536373735363161323230353338313163613133363a30313866343761302d376232312d376162632d386465662d30303030303030303031343534333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367353a61646d696e303a32323a69427548394e705765717169786b626f655563447067303a",
+      "expectedId": "auth-ce2cf59bc30f02b7419409c2fa6a05f6246b5f4a7e8d8b2ec83b1d66ab0f0c27"
+    },
+    "r1C1": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-ce2cf59bc30f02b7419409c2fa6a05f6246b5f4a7e8d8b2ec83b1d66ab0f0c27",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000146",
+          "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8"
+        },
+        "role": "admin",
+        "nonce": "6Fnt04IIpTvwuB6MKAk6eQ",
+        "sigs": [
+          {
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "sig": "-sqNpVuEuH5IIpoGzt52Ohwv8py_Ek7oy3uFZ_wRP6CJuNavhl7mLgnZTTjWl8RbMUSwBpjItOmEuM3-YAg7AA"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d6365326366353962633330663032623734313934303963326661366130356636323436623566346137653864386232656338336231643636616230663063323733363a30313866343761302d376232312d376162632d386465662d30303030303030303031343634333a7952797a7a697545354c714639574c7335423766354f4a365f464c596a56425f5a7147474f4e2d43507038353a61646d696e303a32323a36466e7430344949705476777542364d4b416b366551303a",
+      "expectedId": "auth-4ca35b38006cec4a23bbeabd17971936da8029e6e1443aa220a51132d678532a"
+    },
+    "r1V1_0": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4ca35b38006cec4a23bbeabd17971936da8029e6e1443aa220a51132d678532a",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000147",
+          "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY"
+        },
+        "role": "validator",
+        "nonce": "PMUfnsGbtlPvjEZhskIF-g",
+        "sigs": [
+          {
+            "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8",
+            "sig": "onszN35UCsKrm8V5ruPfUuwW2McBqOtCaySCmpnQtg3xA2vzKCxml8norXJ1sy0R4VdzZWxZmNU4MH0LVen0Bg"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3463613335623338303036636563346132336262656162643137393731393336646138303239653665313434336161323230613531313332643637383533326133363a30313866343761302d376232312d376162632d386465662d30303030303030303031343734333a54646d3253576f6e5678724c434a70654e494c667947724e3764784e48796a685770734538436258386959393a76616c696461746f72303a32323a504d55666e734762746c50766a455a68736b49462d67303a",
+      "expectedId": "auth-9cbb1b9dd99aa8a38079d9f052318191bb7cbd599882ade125c7b07d0a745b93"
+    },
+    "r1V1_1": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4ca35b38006cec4a23bbeabd17971936da8029e6e1443aa220a51132d678532a",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000148",
+          "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY"
+        },
+        "role": "validator",
+        "nonce": "ELzEYJssmty-X6Yot2_Ifw",
+        "sigs": [
+          {
+            "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8",
+            "sig": "jL4Q1TLXty-iFrGNzzZ9DJnFLeEAD90ZNHWrjIToYxOOFHgqO-Kb3LRXWGPLI7QVgLTTY0dWQvIwBnWo5QF8Dw"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3463613335623338303036636563346132336262656162643137393731393336646138303239653665313434336161323230613531313332643637383533326133363a30313866343761302d376232312d376162632d386465662d30303030303030303031343834333a54646d3253576f6e5678724c434a70654e494c667947724e3764784e48796a685770734538436258386959393a76616c696461746f72303a32323a454c7a45594a73736d74792d5836596f74325f496677303a",
+      "expectedId": "auth-a99d2fbe529493d033da832aa21b4e4d94f7cdee16b83989ea54ab368e9bd365"
+    },
+    "r1V1_2": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4ca35b38006cec4a23bbeabd17971936da8029e6e1443aa220a51132d678532a",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000149",
+          "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY"
+        },
+        "role": "participant",
+        "nonce": "kOFSD4sRicn9xTDiVQokDA",
+        "sigs": [
+          {
+            "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8",
+            "sig": "A9Mtl-FjHxE5rDpCf2ZvHtx0H9gSAWb99-lM549DHm60YSzRkXAiKGXyTQ9qCvvu_1v1NzSruL2i-dMqoNOECA"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3463613335623338303036636563346132336262656162643137393731393336646138303239653665313434336161323230613531313332643637383533326133363a30313866343761302d376232312d376162632d386465662d30303030303030303031343934333a54646d3253576f6e5678724c434a70654e494c667947724e3764784e48796a68577073453843625838695931313a7061727469636970616e74303a32323a6b4f46534434735269636e397854446956516f6b4441303a",
+      "expectedId": "auth-e777244a50bfe8da530de72a8217b2cd5ab0d219a3f2e283dcff9337c8e2509d"
+    },
+    "r1V1_3": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4ca35b38006cec4a23bbeabd17971936da8029e6e1443aa220a51132d678532a",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000014a",
+          "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY"
+        },
+        "role": "participant",
+        "nonce": "23i9KxmqTXTwjq6NT9Gu8A",
+        "sigs": [
+          {
+            "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8",
+            "sig": "viJON5Hcbk2A2QlOO63D9CkipCJxBEleRkkM8ysu306dyqk0eR4KYD5W42DLcxcpxkLWJRI147StS7oBMMydCg"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3463613335623338303036636563346132336262656162643137393731393336646138303239653665313434336161323230613531313332643637383533326133363a30313866343761302d376232312d376162632d386465662d30303030303030303031346134333a54646d3253576f6e5678724c434a70654e494c667947724e3764784e48796a68577073453843625838695931313a7061727469636970616e74303a32323a323369394b786d71545854776a71364e543947753841303a",
+      "expectedId": "auth-96f16c3189a37a1e02a7a770c168b87bcad4202f380e547a01f39bf3b6005b92"
+    },
+    "r1D2": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000014b",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "admin",
+        "nonce": "ORXvJNwsAHrrpin4QqjZrw",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "ncXxLuLmt2nuSFP_5SWrDc6ViS7l8oNt5mnYeqCkuBhRQJkzEAENEcMXuy_FNTdwOemYvc53qFEXzY3wBYxPAw"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3434313262373139333763656638613738306133306361616361316236653666363266393431386433383165633536373735363161323230353338313163613133363a30313866343761302d376232312d376162632d386465662d30303030303030303031346234333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367353a61646d696e303a32323a4f5258764a4e77734148727270696e3451716a5a7277303a",
+      "expectedId": "auth-ed0e816fcec072aaa019290348dbc546babbd29fd7a2f3696ab95561907ec101"
+    },
+    "r1C2": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-ed0e816fcec072aaa019290348dbc546babbd29fd7a2f3696ab95561907ec101",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000014c",
+          "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8"
+        },
+        "role": "admin",
+        "nonce": "8ov46sq28c3azu2z01XjLg",
+        "sigs": [
+          {
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "sig": "sa1yjM9OPeTlt73nveJw3wyXOP4zx7hhi8jK5R-BWboZsnCVeGhTh0PZ0owjYs22CaAQv7KbeBswBuTbXQ8eAw"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d6564306538313666636563303732616161303139323930333438646263353436626162626432396664376132663336393661623935353631393037656331303133363a30313866343761302d376232312d376162632d386465662d30303030303030303031346334333a7952797a7a697545354c714639574c7335423766354f4a365f464c596a56425f5a7147474f4e2d43507038353a61646d696e303a32323a386f763436737132386333617a75327a3031586a4c67303a",
+      "expectedId": "auth-ef572a8df9d7871c314c3c882f9dd9c92b5f2cedac29eb8aaa0f2c3cedfcdcaf"
+    },
+    "r1V2_0": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-ef572a8df9d7871c314c3c882f9dd9c92b5f2cedac29eb8aaa0f2c3cedfcdcaf",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000014d",
+          "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY"
+        },
+        "role": "validator",
+        "nonce": "HlL8ADy70OGNZNYPz5kOSQ",
+        "sigs": [
+          {
+            "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8",
+            "sig": "_n8CwjH6-nWtZBGsYu6gFDtAi7j_83KwHuUd9nU448lOSteBGzmjQnGinw6LrN7weJN6awFuyrFc-hZ__SzrAw"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d6566353732613864663964373837316333313463336338383266396464396339326235663263656461633239656238616161306632633363656466636463616633363a30313866343761302d376232312d376162632d386465662d30303030303030303031346434333a54646d3253576f6e5678724c434a70654e494c667947724e3764784e48796a685770734538436258386959393a76616c696461746f72303a32323a486c4c3841447937304f474e5a4e59507a356b4f5351303a",
+      "expectedId": "auth-06298a83edaab9f302c986fc577c4ed6903f6fed56a406ecb28b4b540a2b868d"
+    },
+    "r1V2_1": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-ef572a8df9d7871c314c3c882f9dd9c92b5f2cedac29eb8aaa0f2c3cedfcdcaf",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000014e",
+          "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY"
+        },
+        "role": "validator",
+        "nonce": "S-FjpabAM6pPFA9Ud0EeDA",
+        "sigs": [
+          {
+            "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8",
+            "sig": "qU50R81DYC3Qugj7-Z2nZoH1lYdl5uMJ7JFGdazNyPIeL2I5jBNX-tl6vxElFokT83oZoReGy0RkgRBcpdCRCQ"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d6566353732613864663964373837316333313463336338383266396464396339326235663263656461633239656238616161306632633363656466636463616633363a30313866343761302d376232312d376162632d386465662d30303030303030303031346534333a54646d3253576f6e5678724c434a70654e494c667947724e3764784e48796a685770734538436258386959393a76616c696461746f72303a32323a532d466a706162414d36705046413955643045654441303a",
+      "expectedId": "auth-1c705dcd6ebb2e97a1a56265684cfaa59a3d6286abe087a063c67f7ce9f6f638"
+    },
+    "r1V2_2": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-ef572a8df9d7871c314c3c882f9dd9c92b5f2cedac29eb8aaa0f2c3cedfcdcaf",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000014f",
+          "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY"
+        },
+        "role": "participant",
+        "nonce": "2NPgxJOwIN2GQqmmOeMa9Q",
+        "sigs": [
+          {
+            "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8",
+            "sig": "HaSTddXHao8uXvSjODB1PW3sEudopeFJHW-e_EoV_DupuHFJE_r5gUtsMbo1TD03mwTAJZW8-HEopmlf3kfGDw"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d6566353732613864663964373837316333313463336338383266396464396339326235663263656461633239656238616161306632633363656466636463616633363a30313866343761302d376232312d376162632d386465662d30303030303030303031346634333a54646d3253576f6e5678724c434a70654e494c667947724e3764784e48796a68577073453843625838695931313a7061727469636970616e74303a32323a324e5067784a4f77494e324751716d6d4f654d613951303a",
+      "expectedId": "auth-49e46a721bc895d0c3eae936c68b0697f5483a6a715e4aea84312ae7548c25d2"
+    },
+    "r1V2_3": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-ef572a8df9d7871c314c3c882f9dd9c92b5f2cedac29eb8aaa0f2c3cedfcdcaf",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000150",
+          "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY"
+        },
+        "role": "participant",
+        "nonce": "2yd-e-zwH3boQM1RApxjqA",
+        "sigs": [
+          {
+            "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8",
+            "sig": "kX6m4Q9gnVor4u-Tl50tj0fZWMc9GD6nc_U5hehJLbPFYQXydIJrx3VEwMddCOOSgMQC9UFMobjPrk1833wzBg"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d6566353732613864663964373837316333313463336338383266396464396339326235663263656461633239656238616161306632633363656466636463616633363a30313866343761302d376232312d376162632d386465662d30303030303030303031353034333a54646d3253576f6e5678724c434a70654e494c667947724e3764784e48796a68577073453843625838695931313a7061727469636970616e74303a32323a3279642d652d7a774833626f514d31524170786a7141303a",
+      "expectedId": "auth-369ec160eb0f3e2d4ad37dde936af6a67f3e93a064c7fd342786df0db919fd76"
+    },
+    "r1D3": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000151",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "admin",
+        "nonce": "DXowJAMYmEvP7wE3EIOcxQ",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "FiZxOCiRSWYU1mSAfzTTpEUZRiSNy0BY84vd9KcWvTdnHgGwkGaxf47TwmvBE-hGbOcdznKr7j2vRIZGi4g6Cw"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3434313262373139333763656638613738306133306361616361316236653666363266393431386433383165633536373735363161323230353338313163613133363a30313866343761302d376232312d376162632d386465662d30303030303030303031353134333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367353a61646d696e303a32323a44586f774a414d596d4576503777453345494f637851303a",
+      "expectedId": "auth-225254839d6f88d88396c167789096f978b5aeadcfb14dd8c5734fdcc5823d45"
+    },
+    "r1C3": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-225254839d6f88d88396c167789096f978b5aeadcfb14dd8c5734fdcc5823d45",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000152",
+          "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8"
+        },
+        "role": "admin",
+        "nonce": "ZBTB67PrvTw0ABmN-N17zQ",
+        "sigs": [
+          {
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "sig": "GSfIyAPpgJ2_NzViO6XwD3bTKn_ZOMVC2LbqNzB4orPAng7Dlco2S2PQpJRzWuhlnue8Eb6SxcHOm8_Gh-1SDg"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3232353235343833396436663838643838333936633136373738393039366639373862356165616463666231346464386335373334666463633538323364343533363a30313866343761302d376232312d376162632d386465662d30303030303030303031353234333a7952797a7a697545354c714639574c7335423766354f4a365f464c596a56425f5a7147474f4e2d43507038353a61646d696e303a32323a5a425442363750727654773041426d4e2d4e31377a51303a",
+      "expectedId": "auth-b7cd3014a10504342b0b43faa8f67b12f36cc9f0263d68f023581ff6fe786550"
+    },
+    "r1V3_0": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-b7cd3014a10504342b0b43faa8f67b12f36cc9f0263d68f023581ff6fe786550",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000153",
+          "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY"
+        },
+        "role": "validator",
+        "nonce": "fuubJIT477YydnDVzErUEA",
+        "sigs": [
+          {
+            "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8",
+            "sig": "463TC6a7Mjt_6v2dsOkvhlVXACW5mQ5D7Rnn805LA6luX5KgbamojJVfjtYQQcTUPeu21eBnPQRfeH_8U-iXAg"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d6237636433303134613130353034333432623062343366616138663637623132663336636339663032363364363866303233353831666636666537383635353033363a30313866343761302d376232312d376162632d386465662d30303030303030303031353334333a54646d3253576f6e5678724c434a70654e494c667947724e3764784e48796a685770734538436258386959393a76616c696461746f72303a32323a667575624a49543437375979646e44567a4572554541303a",
+      "expectedId": "auth-8412cd8b73560e7b7481fca55b4fe8b9fb55dff53b2156bb759a89981b28e07c"
+    },
+    "r1V3_1": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-b7cd3014a10504342b0b43faa8f67b12f36cc9f0263d68f023581ff6fe786550",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000154",
+          "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY"
+        },
+        "role": "validator",
+        "nonce": "vW08CBjaWbIhHtItGBBRnA",
+        "sigs": [
+          {
+            "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8",
+            "sig": "qb-X4p2r6oQHM0Q8EIZ8tTkM7XcSDBObN4jqfNsJhmWhKiWoDrxP3WlTSdT6R7lXmDNx2ZKD1rz13QvE2wo7Dg"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d6237636433303134613130353034333432623062343366616138663637623132663336636339663032363364363866303233353831666636666537383635353033363a30313866343761302d376232312d376162632d386465662d30303030303030303031353434333a54646d3253576f6e5678724c434a70654e494c667947724e3764784e48796a685770734538436258386959393a76616c696461746f72303a32323a7657303843426a615762496848744974474242526e41303a",
+      "expectedId": "auth-fb715679cbb85ab976a605105461e015fb6209a1ccd7a3b4d0fee1e750ee4f84"
+    },
+    "r1V3_2": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-b7cd3014a10504342b0b43faa8f67b12f36cc9f0263d68f023581ff6fe786550",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000155",
+          "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY"
+        },
+        "role": "participant",
+        "nonce": "HrQ1Cpqw2GNEUsdYfLVPvA",
+        "sigs": [
+          {
+            "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8",
+            "sig": "I-dvf2MvXagr_uKkQ0gSJQEK6hElCTpIRWHOrHUShOcUu0rGELb1qlDQKWkh9KBvtUvFv3eFJR4YVTKlsMAnCA"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d6237636433303134613130353034333432623062343366616138663637623132663336636339663032363364363866303233353831666636666537383635353033363a30313866343761302d376232312d376162632d386465662d30303030303030303031353534333a54646d3253576f6e5678724c434a70654e494c667947724e3764784e48796a68577073453843625838695931313a7061727469636970616e74303a32323a487251314370717732474e4555736459664c56507641303a",
+      "expectedId": "auth-fd6469058160ab2b2c0fd156b6bd7e9105353f23806c095fc8b93c1c83dfef62"
+    },
+    "r1V3_3": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-b7cd3014a10504342b0b43faa8f67b12f36cc9f0263d68f023581ff6fe786550",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000156",
+          "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY"
+        },
+        "role": "participant",
+        "nonce": "3qvDBnQE8ZoU02nY37hUCw",
+        "sigs": [
+          {
+            "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8",
+            "sig": "Q47ENGR9wQ5lLDrlZvr8v8ONvT7hRbDfLNws5T4dnTBLgAPdA5IHf9jt3QbU0avRu-14D3Jp9e2v6ApBb60WCA"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d6237636433303134613130353034333432623062343366616138663637623132663336636339663032363364363866303233353831666636666537383635353033363a30313866343761302d376232312d376162632d386465662d30303030303030303031353634333a54646d3253576f6e5678724c434a70654e494c667947724e3764784e48796a68577073453843625838695931313a7061727469636970616e74303a32323a33717644426e5145385a6f5530326e59333768554377303a",
+      "expectedId": "auth-50e58769c4db24e775e7c99c375418ba8521b2f716cbc6e319cad72cac2f544e"
+    },
+    "r1D4": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000157",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "admin",
+        "nonce": "dF3VoMAbgcDOP5AT6Bik5Q",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "44vn5cb57_c0zlCYphcRfXJ6LWtcZHsLtOlz-fPjs3Son76Qn_xoOSCDQum7RzoaQkM8pkyV2YpgdAy-uGqhDw"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3434313262373139333763656638613738306133306361616361316236653666363266393431386433383165633536373735363161323230353338313163613133363a30313866343761302d376232312d376162632d386465662d30303030303030303031353734333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367353a61646d696e303a32323a644633566f4d41626763444f503541543642696b3551303a",
+      "expectedId": "auth-b08a5d121c0f61f1b4eda77b6416cb4dd83b846eb172a2213c04c3fc350130da"
+    },
+    "r1C4": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-b08a5d121c0f61f1b4eda77b6416cb4dd83b846eb172a2213c04c3fc350130da",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000158",
+          "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8"
+        },
+        "role": "admin",
+        "nonce": "jBZT-uf1lPQTaGBPtA-wJw",
+        "sigs": [
+          {
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "sig": "oj9b3epYTUtwFkZuOBa65aagaARnpjLH4TdR-5WVq-WaScK0Vr7eYo1wasb4tuFezOegt9B4PiFf8ig6mxN1DQ"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d6230386135643132316330663631663162346564613737623634313663623464643833623834366562313732613232313363303463336663333530313330646133363a30313866343761302d376232312d376162632d386465662d30303030303030303031353834333a7952797a7a697545354c714639574c7335423766354f4a365f464c596a56425f5a7147474f4e2d43507038353a61646d696e303a32323a6a425a542d7566316c5051546147425074412d774a77303a",
+      "expectedId": "auth-0527489b8b74551fac5036ed6e7ce9a722dcaeef90b16859f172d86373cd889a"
+    },
+    "r1V4_0": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-0527489b8b74551fac5036ed6e7ce9a722dcaeef90b16859f172d86373cd889a",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000159",
+          "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY"
+        },
+        "role": "validator",
+        "nonce": "gR2H8gHnQglw51y51rcmiw",
+        "sigs": [
+          {
+            "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8",
+            "sig": "XyssoMEEvQ3CAjrTKPfy1UgkwWGcqR0M_pQEc9yzseNDMNonXv2HOVKmi5dAFjU_UMD--0IEEfNnCY6plPNTCQ"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3035323734383962386237343535316661633530333665643665376365396137323264636165656639306231363835396631373264383633373363643838396133363a30313866343761302d376232312d376162632d386465662d30303030303030303031353934333a54646d3253576f6e5678724c434a70654e494c667947724e3764784e48796a685770734538436258386959393a76616c696461746f72303a32323a675232483867486e51676c77353179353172636d6977303a",
+      "expectedId": "auth-d2b455fd9bfbb1321149ecfeb8ac00be49cb46819a7b7ce5fef790aafed84b36"
+    },
+    "r1V4_1": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-0527489b8b74551fac5036ed6e7ce9a722dcaeef90b16859f172d86373cd889a",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000015a",
+          "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY"
+        },
+        "role": "validator",
+        "nonce": "0AP5-TuUoSDgYnNUoedjiw",
+        "sigs": [
+          {
+            "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8",
+            "sig": "fyPivf_Yfual-0qGjCxoDoGw-m7Hvwyej5-vnLBAkOm-7roxmtpIyaQfx46FWIRaZ9tCUM5M5Eux34fbo8gJBw"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3035323734383962386237343535316661633530333665643665376365396137323264636165656639306231363835396631373264383633373363643838396133363a30313866343761302d376232312d376162632d386465662d30303030303030303031356134333a54646d3253576f6e5678724c434a70654e494c667947724e3764784e48796a685770734538436258386959393a76616c696461746f72303a32323a304150352d5475556f534467596e4e556f65646a6977303a",
+      "expectedId": "auth-ba190085a923f475d9f7cacf3f3f09740fdca98814d64dc9fabcf848a2de8317"
+    },
+    "r1V4_2": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-0527489b8b74551fac5036ed6e7ce9a722dcaeef90b16859f172d86373cd889a",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000015b",
+          "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY"
+        },
+        "role": "participant",
+        "nonce": "9bm6kpVRTsMSGblwi2eYxg",
+        "sigs": [
+          {
+            "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8",
+            "sig": "G4li10C3VQPT84vvPQt55PIK96x2H6CJ0-qX54XMI3I2zMA4RVBOqoTr26vqJ0uvrPhkwqYoUadbdFwt_OyNBA"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3035323734383962386237343535316661633530333665643665376365396137323264636165656639306231363835396631373264383633373363643838396133363a30313866343761302d376232312d376162632d386465662d30303030303030303031356234333a54646d3253576f6e5678724c434a70654e494c667947724e3764784e48796a68577073453843625838695931313a7061727469636970616e74303a32323a39626d366b70565254734d5347626c77693265597867303a",
+      "expectedId": "auth-bccb52d40e1862cc4f274c5016fa99d4cc322b47771d85e6e674d8bff98c2ea3"
+    },
+    "r1V4_3": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-0527489b8b74551fac5036ed6e7ce9a722dcaeef90b16859f172d86373cd889a",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000015c",
+          "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY"
+        },
+        "role": "participant",
+        "nonce": "n47D8BU2R564xSoyGthK0g",
+        "sigs": [
+          {
+            "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8",
+            "sig": "crUjE-1-obwK_68QqAepGApNkUwxz27TIdXImV9O0aKMjG7WP-hCiHAETnlYMJIuJlv43h1xV_xdQWGuP15vCg"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3035323734383962386237343535316661633530333665643665376365396137323264636165656639306231363835396631373264383633373363643838396133363a30313866343761302d376232312d376162632d386465662d30303030303030303031356334333a54646d3253576f6e5678724c434a70654e494c667947724e3764784e48796a68577073453843625838695931313a7061727469636970616e74303a32323a6e343744384255325235363478536f794774684b3067303a",
+      "expectedId": "auth-340875b06cdb50827ccb1f96ececfe102edeb23ec02ce1e5a081a86108f044b0"
+    },
+    "r1D5": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000015d",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "admin",
+        "nonce": "PDi9SPG0WBVzIxiORgylOg",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "IyYixpM_p7rBMTv5QtwHYucxbngSV8CFYz7wVcWbDaOCIdqBouyGfilx1SFMZ2JVxiv5xSTrouHigRJ6I7nbBA"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3434313262373139333763656638613738306133306361616361316236653666363266393431386433383165633536373735363161323230353338313163613133363a30313866343761302d376232312d376162632d386465662d30303030303030303031356434333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367353a61646d696e303a32323a50446939535047305742567a4978694f5267796c4f67303a",
+      "expectedId": "auth-dc05a145c1719118270cf6ef829ee01e041541c4d31507ac04ad958550a26ca3"
+    },
+    "r1C5": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-dc05a145c1719118270cf6ef829ee01e041541c4d31507ac04ad958550a26ca3",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000015e",
+          "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8"
+        },
+        "role": "admin",
+        "nonce": "dR5qIerqDraje2oIRM8mdw",
+        "sigs": [
+          {
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "sig": "fbm3gleHi9DS1cWphxxtZTZtijQJ8DxrdmvgXKOs6qBgTfadgVZbPDoypGTe9pHyxZpNpKP44b6Z6dtHwE_eBw"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d6463303561313435633137313931313832373063663665663832396565303165303431353431633464333135303761633034616439353835353061323663613333363a30313866343761302d376232312d376162632d386465662d30303030303030303031356534333a7952797a7a697545354c714639574c7335423766354f4a365f464c596a56425f5a7147474f4e2d43507038353a61646d696e303a32323a64523571496572714472616a65326f49524d386d6477303a",
+      "expectedId": "auth-56f3abed9437804b50ee4bfad1cb07cbb438ed03c0333e6c68cafe4bf5705a3a"
+    },
+    "r1V5_0": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-56f3abed9437804b50ee4bfad1cb07cbb438ed03c0333e6c68cafe4bf5705a3a",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000015f",
+          "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY"
+        },
+        "role": "validator",
+        "nonce": "aOuFvTDjDmSahqoucxoMJQ",
+        "sigs": [
+          {
+            "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8",
+            "sig": "X630zu31tF50zSx-u89j74KSy7iMfelhzQYWo3WfU4FBznxYOw3kmub0WBgQpgVwX9dbs_p1i4wasn_ZyHJRAA"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3536663361626564393433373830346235306565346266616431636230376362623433386564303363303333336536633638636166653462663537303561336133363a30313866343761302d376232312d376162632d386465662d30303030303030303031356634333a54646d3253576f6e5678724c434a70654e494c667947724e3764784e48796a685770734538436258386959393a76616c696461746f72303a32323a614f75467654446a446d536168716f7563786f4d4a51303a",
+      "expectedId": "auth-2952c133ec0ff8234bb3ea619dc0cbd3032342c20b1cb873b2c646010dbe5a14"
+    },
+    "r1V5_1": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-56f3abed9437804b50ee4bfad1cb07cbb438ed03c0333e6c68cafe4bf5705a3a",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000160",
+          "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY"
+        },
+        "role": "validator",
+        "nonce": "agfuGX5UNYcnJkJ7qvYwJA",
+        "sigs": [
+          {
+            "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8",
+            "sig": "rsx9p4popaaxObjUckM-9iSzqpPof67inQDAl3swp_k8-1sNEEMbpL7uyE1zeFvyoTPprbP1Uh7s0F6cEdgEDw"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3536663361626564393433373830346235306565346266616431636230376362623433386564303363303333336536633638636166653462663537303561336133363a30313866343761302d376232312d376162632d386465662d30303030303030303031363034333a54646d3253576f6e5678724c434a70654e494c667947724e3764784e48796a685770734538436258386959393a76616c696461746f72303a32323a61676675475835554e59636e4a6b4a37717659774a41303a",
+      "expectedId": "auth-dc3d4f3a70899646229ca1ea2c349a49dba2d3ff2597a96433025744ff69c234"
+    },
+    "r1V5_2": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-56f3abed9437804b50ee4bfad1cb07cbb438ed03c0333e6c68cafe4bf5705a3a",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000161",
+          "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY"
+        },
+        "role": "participant",
+        "nonce": "Dhf511aWxTkRf26A8FFW5w",
+        "sigs": [
+          {
+            "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8",
+            "sig": "ms2mbWb3gXsDviUZcBbkSUvRhFEjjnN8AJtlsLZPzXD7av0CURkD9WS7T68eyFeXF_VW7eCU3oZpurvUjtt6Cg"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3536663361626564393433373830346235306565346266616431636230376362623433386564303363303333336536633638636166653462663537303561336133363a30313866343761302d376232312d376162632d386465662d30303030303030303031363134333a54646d3253576f6e5678724c434a70654e494c667947724e3764784e48796a68577073453843625838695931313a7061727469636970616e74303a32323a446866353131615778546b5266323641384646573577303a",
+      "expectedId": "auth-682c5f4364860e9b3b1571aa78f18449ff3f87329644d2cafb13f6d35c328cac"
+    },
+    "r1V5_3": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-56f3abed9437804b50ee4bfad1cb07cbb438ed03c0333e6c68cafe4bf5705a3a",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000162",
+          "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY"
+        },
+        "role": "participant",
+        "nonce": "Ew6TIoenKIGicZF2ezu2Ww",
+        "sigs": [
+          {
+            "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8",
+            "sig": "Y-0uWI_9SeliPpklfNwzBytfN-4dVV_XMLHuXGzbN1-xcI_s9W0jyh7cIiyJA6Vwvf0L8c7ihD7lLYkzx-dvDg"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3536663361626564393433373830346235306565346266616431636230376362623433386564303363303333336536633638636166653462663537303561336133363a30313866343761302d376232312d376162632d386465662d30303030303030303031363234333a54646d3253576f6e5678724c434a70654e494c667947724e3764784e48796a68577073453843625838695931313a7061727469636970616e74303a32323a45773654496f656e4b494769635a4632657a75325777303a",
+      "expectedId": "auth-d1f743e1a789679a4b9234e83f2fb683d6916d9a05ba096b272f75255e693bd8"
+    },
+    "r1E": {
+      "statement": {
+        "kind": "endorse",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "targets": [
+          "auth-313213cc03ffc758c8069af716d87c4166ce4e7b69b78dbbb37405b314f73abe",
+          "auth-4ca35b38006cec4a23bbeabd17971936da8029e6e1443aa220a51132d678532a",
+          "auth-ef572a8df9d7871c314c3c882f9dd9c92b5f2cedac29eb8aaa0f2c3cedfcdcaf",
+          "auth-b7cd3014a10504342b0b43faa8f67b12f36cc9f0263d68f023581ff6fe786550",
+          "auth-0527489b8b74551fac5036ed6e7ce9a722dcaeef90b16859f172d86373cd889a",
+          "auth-56f3abed9437804b50ee4bfad1cb07cbb438ed03c0333e6c68cafe4bf5705a3a"
+        ],
+        "nonce": "sCJzpGL3_Fnpl76Gc-HH5w",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "7bKW0IqYdgFRF3EMjE9D0v7_wQX39Wj1cfIrYcHDJBUiZfxteBc4MUTa2gIBaMetu2PWoVtxg39a-QaRN53oAA"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a373a656e646f72736536393a617574682d34343132623731393337636566386137383061333063616163613162366536663632663934313864333831656335363737353631613232303533383131636131313a3636393a617574682d3035323734383962386237343535316661633530333665643665376365396137323264636165656639306231363835396631373264383633373363643838396136393a617574682d3331333231336363303366666337353863383036396166373136643837633431363663653465376236396237386462626233373430356233313466373361626536393a617574682d3463613335623338303036636563346132336262656162643137393731393336646138303239653665313434336161323230613531313332643637383533326136393a617574682d3536663361626564393433373830346235306565346266616431636230376362623433386564303363303333336536633638636166653462663537303561336136393a617574682d6237636433303134613130353034333432623062343366616138663637623132663336636339663032363364363866303233353831666636666537383635353036393a617574682d6566353732613864663964373837316333313463336338383266396464396339326235663263656461633239656238616161306632633363656466636463616632323a73434a7a70474c335f466e706c373647632d48483577303a",
+      "expectedId": "auth-5023333dd565a659ea976dd631bba3865bb7a3b30fa06f49d74d45562923373d"
+    },
+    "r1Launder": {
+      "statement": {
+        "kind": "revoke",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "targets": [
+          "auth-b08a5d121c0f61f1b4eda77b6416cb4dd83b846eb172a2213c04c3fc350130da",
+          "auth-ce2cf59bc30f02b7419409c2fa6a05f6246b5f4a7e8d8b2ec83b1d66ab0f0c27",
+          "auth-dc05a145c1719118270cf6ef829ee01e041541c4d31507ac04ad958550a26ca3",
+          "auth-ed0e816fcec072aaa019290348dbc546babbd29fd7a2f3696ab95561907ec101"
+        ],
+        "nonce": "YUX5mYVvXyiAIhzDnn2vrA",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "gtTMUx-Ck9saugss7ZwbJ7vJbHBjIabY1u_UT3WTaL5xcIetyb5bB7sHVJLS4lEL8hxYp8rxByyfixxufMkTCg"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a363a7265766f6b6536393a617574682d34343132623731393337636566386137383061333063616163613162366536663632663934313864333831656335363737353631613232303533383131636131313a3436393a617574682d6230386135643132316330663631663162346564613737623634313663623464643833623834366562313732613232313363303463336663333530313330646136393a617574682d6365326366353962633330663032623734313934303963326661366130356636323436623566346137653864386232656338336231643636616230663063323736393a617574682d6463303561313435633137313931313832373063663665663832396565303165303431353431633464333135303761633034616439353835353061323663613336393a617574682d6564306538313666636563303732616161303139323930333438646263353436626162626432396664376132663336393661623935353631393037656331303132323a595558356d5956765879694149687a446e6e32767241303a",
+      "expectedId": "auth-460075ce562e06a919998a161be7808a61ea64aff4d54b14cf7626a1e9f60f38"
+    },
+    "tD": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000163",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "admin",
+        "nonce": "6y_lM_oVdszmHRLk9kzLdA",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "up_865pk-st_qqnhwV87Q-Pl6w6wTB-E7pwnD1jcjBdd3zyYTs5I5yt_gvwHsSoAAOJlVv-AQ7NhqCyWtXWbCQ"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3434313262373139333763656638613738306133306361616361316236653666363266393431386433383165633536373735363161323230353338313163613133363a30313866343761302d376232312d376162632d386465662d30303030303030303031363334333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367353a61646d696e303a32323a36795f6c4d5f6f5664737a6d48524c6b396b7a4c6441303a",
+      "expectedId": "auth-b575d59fa8c3aed6ea4320ed82e48bc6fb08b822422335613b01908121a331a8"
+    },
+    "tP1": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000164",
+          "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY"
+        },
+        "role": "participant",
+        "nonce": "YRnpNJHRbHuSVgq5qANX3w",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "BVmcw-TAA4SFNjNFO69UjXcVStSau15fqgzH33BKGuoCV5jhehc_rMn5S12-78wqeJQhrXq9hNQxyX_qiZpmAg"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3434313262373139333763656638613738306133306361616361316236653666363266393431386433383165633536373735363161323230353338313163613133363a30313866343761302d376232312d376162632d386465662d30303030303030303031363434333a54646d3253576f6e5678724c434a70654e494c667947724e3764784e48796a68577073453843625838695931313a7061727469636970616e74303a32323a59526e704e4a4852624875535667713571414e583377303a",
+      "expectedId": "auth-83e724571d9c9ef1ce0543aff3ae8bd8164e386f3f69ed2f6f53c4c9200272b0"
+    },
+    "tC": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-b575d59fa8c3aed6ea4320ed82e48bc6fb08b822422335613b01908121a331a8",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000165",
+          "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8"
+        },
+        "role": "admin",
+        "nonce": "WTukfdjq1YZFGqfQFfcwLg",
+        "sigs": [
+          {
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "sig": "u4C95D5PbCdpipW2SCozbkd6qEg0cBFdk2UFBCMEcEqcMchv7Yee2oYsOY7pdbt_Zk6yMJQ5hwsJiIBq0ygbDQ"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d6235373564353966613863336165643665613433323065643832653438626336666230386238323234323233333536313362303139303831323161333331613833363a30313866343761302d376232312d376162632d386465662d30303030303030303031363534333a7952797a7a697545354c714639574c7335423766354f4a365f464c596a56425f5a7147474f4e2d43507038353a61646d696e303a32323a5754756b66646a7131595a4647716651466663774c67303a",
+      "expectedId": "auth-a8d2ea51f46f85558fea2d18902a478a384ab5a40a66ef4d24a7717d3625b009"
+    },
+    "tP2": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-b575d59fa8c3aed6ea4320ed82e48bc6fb08b822422335613b01908121a331a8",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000166",
+          "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY"
+        },
+        "role": "participant",
+        "nonce": "0NxccZgjYyHrDpfXTpzwNg",
+        "sigs": [
+          {
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "sig": "C_eHQJDpIGm8GnOgv8A4JP7TkO5KWsveofQR8c2kOoPTEufXebVqLVgi9NAU9IN-Yphf-XYvs2hI_NukqO-EAA"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d6235373564353966613863336165643665613433323065643832653438626336666230386238323234323233333536313362303139303831323161333331613833363a30313866343761302d376232312d376162632d386465662d30303030303030303031363634333a54646d3253576f6e5678724c434a70654e494c667947724e3764784e48796a68577073453843625838695931313a7061727469636970616e74303a32323a304e7863635a676a597948724470665854707a774e67303a",
+      "expectedId": "auth-2e2e643aa6cfc3e178d8fdc5524d34a9d5997a521ded4e437dffca2c1d9ad800"
+    },
+    "tS1": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-a8d2ea51f46f85558fea2d18902a478a384ab5a40a66ef4d24a7717d3625b009",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000167",
+          "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY"
+        },
+        "role": "xmesh-seat",
+        "nonce": "MRuF2zi3uME8A9MeMbqChw",
+        "sigs": [
+          {
+            "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8",
+            "sig": "HMFICVoqWJ2RtojQIqnX5SGD3LRufKWL-1Q_MwcEJLibkBMMzy1ZC57SO9RB_E16jqaKxljbZXxGC6ygQTWmCw"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d6138643265613531663436663835353538666561326431383930326134373861333834616235613430613636656634643234613737313764333632356230303933363a30313866343761302d376232312d376162632d386465662d30303030303030303031363734333a54646d3253576f6e5678724c434a70654e494c667947724e3764784e48796a68577073453843625838695931303a786d6573682d73656174303a32323a4d527546327a6933754d453841394d654d6271436877303a",
+      "expectedId": "auth-b62b3ef4e1c2fae2ec7199af5d155a378bad0c50944a92bbb341071a6290c05c"
+    },
+    "tS2": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-a8d2ea51f46f85558fea2d18902a478a384ab5a40a66ef4d24a7717d3625b009",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000168",
+          "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY"
+        },
+        "role": "xmesh-seat",
+        "nonce": "igPhUvy_8OgCkMpw9KR8Aw",
+        "sigs": [
+          {
+            "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8",
+            "sig": "QAp6h2nnaQxHtq4ETxqMbxt41tZXarLz3f2PkeB8lgNeqCKv1dTBD4ebERBytCDUEM_qh62QIU5W3s9vvRo7DA"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d6138643265613531663436663835353538666561326431383930326134373861333834616235613430613636656634643234613737313764333632356230303933363a30313866343761302d376232312d376162632d386465662d30303030303030303031363834333a54646d3253576f6e5678724c434a70654e494c667947724e3764784e48796a68577073453843625838695931303a786d6573682d73656174303a32323a696750685576795f384f67436b4d7077394b52384177303a",
+      "expectedId": "auth-f4bd0f8010b292ad282b96b5d8f984a49ed1b84e0164347763a4cfd12bdee404"
+    },
+    "tExtraD": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-000000000169",
+          "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g"
+        },
+        "role": "admin",
+        "nonce": "vG0EdQWrJxSNe_zEaU276Q",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "jesKbLIqFk1eeRCDSAroYfZU3Y4ipScu2SgELWTGMZoztbD9bmtxrQnOTozm0oMl_0jLyVQUfk_RNTxUl93yBA"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3434313262373139333763656638613738306133306361616361316236653666363266393431386433383165633536373735363161323230353338313163613133363a30313866343761302d376232312d376162632d386465662d30303030303030303031363934333a4a6677797848696c7050684f525665674e4334494a3479494e6b4732464a76624330715961726243793367353a61646d696e303a32323a76473045645157724a78534e655f7a45615532373651303a",
+      "expectedId": "auth-65711ecdd316e6b008e0e59676f36a8b825207a414e96fa05adbef584b47d827"
+    },
+    "tExtraC": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-65711ecdd316e6b008e0e59676f36a8b825207a414e96fa05adbef584b47d827",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000016a",
+          "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8"
+        },
+        "role": "admin",
+        "nonce": "36oV2wOpc1fHblYzvhuxfQ",
+        "sigs": [
+          {
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "sig": "Jw_Ldhnh0DIT9b-ljSTcmWPrADOMsHB_pyyf7aEgvr7NKrnJ8ag_mTCMoJac2lYpn7FN3m_Csww9cU-TfIkiDA"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d3635373131656364643331366536623030386530653539363736663336613862383235323037613431346539366661303561646265663538346234376438323733363a30313866343761302d376232312d376162632d386465662d30303030303030303031366134333a7952797a7a697545354c714639574c7335423766354f4a365f464c596a56425f5a7147474f4e2d43507038353a61646d696e303a32323a33366f5632774f7063316648626c597a766875786651303a",
+      "expectedId": "auth-baa419ac6ddbd006afe9d01a276db5c6453be398e3950c636407feb0e3047e8d"
+    },
+    "tExtraS": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "auth-a8d2ea51f46f85558fea2d18902a478a384ab5a40a66ef4d24a7717d3625b009",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-00000000016b",
+          "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY"
+        },
+        "role": "xmesh-seat",
+        "nonce": "IuGGLQFz-cwP6L99fXQhpw",
+        "sigs": [
+          {
+            "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8",
+            "sig": "MkFl_IKpRGCoWm8UOrFdK1rgos2mn6G9q03WBFCFtvoThNz8cfoFRp5Q4--gAQB3r0vozpQkwsozz89gHbrFAw"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e7436393a617574682d6138643265613531663436663835353538666561326431383930326134373861333834616235613430613636656634643234613737313764333632356230303933363a30313866343761302d376232312d376162632d386465662d30303030303030303031366234333a54646d3253576f6e5678724c434a70654e494c667947724e3764784e48796a68577073453843625838695931303a786d6573682d73656174303a32323a497547474c51467a2d637750364c3939665851687077303a",
+      "expectedId": "auth-f101408ffa2eb63921f1d40b3e013b576807d0c1a32d77262d155d9991cdb3cd"
+    },
+    "tLaunder": {
+      "statement": {
+        "kind": "revoke",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "targets": [
+          "auth-65711ecdd316e6b008e0e59676f36a8b825207a414e96fa05adbef584b47d827"
+        ],
+        "nonce": "VOxBrk7YtG1O-leVe3V3xg",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "a4L1xYLDdNFNM0KXftjB6GGL7QFKO2FyeMd9XutyLqDM8nkUwaYndP_mcP4wzZyJ0-x9JM6h-hpbeF_NRl83CA"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a363a7265766f6b6536393a617574682d34343132623731393337636566386137383061333063616163613162366536663632663934313864333831656335363737353631613232303533383131636131313a3136393a617574682d3635373131656364643331366536623030386530653539363736663336613862383235323037613431346539366661303561646265663538346234376438323732323a564f7842726b37597447314f2d6c6556653356337867303a",
+      "expectedId": "auth-bcb440241abbf50e1907a24678b6cf8a92c9f935fd3cb3dbd7414226b958f94e"
+    },
+    "tRescue": {
+      "statement": {
+        "kind": "endorse",
+        "authorisedBy": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+        "targets": [
+          "auth-baa419ac6ddbd006afe9d01a276db5c6453be398e3950c636407feb0e3047e8d"
+        ],
+        "nonce": "8CZ3hJOFa1TxuR8nPiCz4Q",
+        "sigs": [
+          {
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "sig": "3X4i1uvCSm39J6EuwP3EiD3OgeoK88CrF9ctOxQTSbYR46zTM2AX8_x6AoXUfW0k9mBAqdyobcRv05cYcybcBw"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a373a656e646f72736536393a617574682d34343132623731393337636566386137383061333063616163613162366536663632663934313864333831656335363737353631613232303533383131636131313a3136393a617574682d6261613431396163366464626430303661666539643031613237366462356336343533626533393865333935306336333634303766656230653330343765386432323a38435a33684a4f46613154787552386e5069437a3451303a",
+      "expectedId": "auth-16929533e423337e6954cc5fb8fbcf07df425d4ba292f0264808bf7da2e2e98f"
+    }
+  },
+  "cases": [
+    {
+      "label": "a delegation tree is in force",
+      "pin": "anchor-2-of-3",
+      "statements": [
+        "gA",
+        "gW",
+        "gV",
+        "gP",
+        "gR",
+        "gQ"
+      ],
+      "expected": {
+        "status": {
+          "gA": "in-force",
+          "gW": "in-force",
+          "gV": "in-force",
+          "gP": "in-force",
+          "gR": "in-force",
+          "gQ": "in-force"
+        },
+        "inForce": [
+          "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+          "auth-2341a2131fb673270b41833f685f832a3c4e696e3f295933f91e8208c8e20f88",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-90fe6da3187b891e9692dfcc204e7868f1ec106a2cd4ea5df47d9e69bb8bef50",
+          "auth-ddd1f057a94651f5661a866791d393384ccf16fa0883aa7cef90f88c37d92b74",
+          "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d"
+        ],
+        "live": [
+          "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+          "auth-2341a2131fb673270b41833f685f832a3c4e696e3f295933f91e8208c8e20f88",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-90fe6da3187b891e9692dfcc204e7868f1ec106a2cd4ea5df47d9e69bb8bef50",
+          "auth-ddd1f057a94651f5661a866791d393384ccf16fa0883aa7cef90f88c37d92b74",
+          "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d"
+        ],
+        "keptBy": {
+          "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-2341a2131fb673270b41833f685f832a3c4e696e3f295933f91e8208c8e20f88": "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1": "anchor",
+          "auth-90fe6da3187b891e9692dfcc204e7868f1ec106a2cd4ea5df47d9e69bb8bef50": "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+          "auth-ddd1f057a94651f5661a866791d393384ccf16fa0883aa7cef90f88c37d92b74": "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+          "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d": "anchor"
+        },
+        "roles": [
+          {
+            "subject": "A",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000a",
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "P",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000e",
+            "key": "rNzISU1Fj0SnqqwdaoTsYk2u6IQ22yribme6ZFoQYig",
+            "roles": [
+              {
+                "role": "participant",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Q",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000010",
+            "key": "tygv5HL5dkHBcJeCGlN4dKqqUyZFrTTb1ZhzMaTnP40",
+            "roles": [
+              {
+                "role": "participant",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "R",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000f",
+            "key": "1AS8RFZa7buJkVDlsLOzK5RBvwy3iEwzEw2o28J90s8",
+            "roles": [
+              {
+                "role": "xmesh-worker",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "V",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000b",
+            "key": "RyG1tjInLmWmjdp6wltBhfiwGRbbGFwUKH25Lit3D64",
+            "roles": [
+              {
+                "role": "validator",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "validated",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "W",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000c",
+            "key": "VRVPQgZepaG-oFRjgmviaE65LfksEAAnqrquV8pVQgc",
+            "roles": [
+              {
+                "role": "validator",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "validated",
+              "insideScope": {}
+            }
+          }
+        ],
+        "root": "16de8c205d935f9063d1a3f9813b5b915521689d99a13e793bd39c07d1ef3f2d"
+      }
+    },
+    {
+      "label": "a grantor above revokes: the admin removes a participant two hops below it",
+      "pin": "anchor-2-of-3",
+      "statements": [
+        "gA",
+        "gW",
+        "gV",
+        "gP",
+        "gR",
+        "gQ",
+        "rP"
+      ],
+      "expected": {
+        "status": {
+          "gA": "in-force",
+          "gW": "in-force",
+          "gV": "in-force",
+          "gP": "removed",
+          "gR": "in-force",
+          "gQ": "in-force",
+          "rP": "in-force"
+        },
+        "inForce": [
+          "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+          "auth-2341a2131fb673270b41833f685f832a3c4e696e3f295933f91e8208c8e20f88",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-a1ebefb80b68472784beb0f0237675c1b381ccf40da14e201f61ac30e4fc5277",
+          "auth-ddd1f057a94651f5661a866791d393384ccf16fa0883aa7cef90f88c37d92b74",
+          "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d"
+        ],
+        "live": [
+          "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+          "auth-2341a2131fb673270b41833f685f832a3c4e696e3f295933f91e8208c8e20f88",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-a1ebefb80b68472784beb0f0237675c1b381ccf40da14e201f61ac30e4fc5277",
+          "auth-ddd1f057a94651f5661a866791d393384ccf16fa0883aa7cef90f88c37d92b74",
+          "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d"
+        ],
+        "keptBy": {
+          "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-2341a2131fb673270b41833f685f832a3c4e696e3f295933f91e8208c8e20f88": "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1": "anchor",
+          "auth-a1ebefb80b68472784beb0f0237675c1b381ccf40da14e201f61ac30e4fc5277": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-ddd1f057a94651f5661a866791d393384ccf16fa0883aa7cef90f88c37d92b74": "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+          "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d": "anchor"
+        },
+        "roles": [
+          {
+            "subject": "A",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000a",
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Q",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000010",
+            "key": "tygv5HL5dkHBcJeCGlN4dKqqUyZFrTTb1ZhzMaTnP40",
+            "roles": [
+              {
+                "role": "participant",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "R",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000f",
+            "key": "1AS8RFZa7buJkVDlsLOzK5RBvwy3iEwzEw2o28J90s8",
+            "roles": [
+              {
+                "role": "xmesh-worker",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "V",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000b",
+            "key": "RyG1tjInLmWmjdp6wltBhfiwGRbbGFwUKH25Lit3D64",
+            "roles": [
+              {
+                "role": "validator",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "validated",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "W",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000c",
+            "key": "VRVPQgZepaG-oFRjgmviaE65LfksEAAnqrquV8pVQgc",
+            "roles": [
+              {
+                "role": "validator",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "validated",
+              "insideScope": {}
+            }
+          }
+        ],
+        "root": "2171a6773a5920b127161832c161aa539e62fd657efb307c325218a7a651fbf8"
+      }
+    },
+    {
+      "label": "the anchor removes the admin: everything the admin authorised is dead",
+      "pin": "anchor-2-of-3",
+      "statements": [
+        "gA",
+        "gW",
+        "gV",
+        "gP",
+        "gR",
+        "gQ",
+        "rP",
+        "rA"
+      ],
+      "expected": {
+        "status": {
+          "gA": "removed",
+          "gW": "in-force",
+          "gV": "dead",
+          "gP": "dead",
+          "gR": "dead",
+          "gQ": "in-force",
+          "rP": "dead",
+          "rA": "in-force"
+        },
+        "inForce": [
+          "auth-2341a2131fb673270b41833f685f832a3c4e696e3f295933f91e8208c8e20f88",
+          "auth-64cdb29ba89c39a45ce10caee2be159d9a708ef427734a8f7ec24d02d3b0d0bb",
+          "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d"
+        ],
+        "live": [
+          "auth-2341a2131fb673270b41833f685f832a3c4e696e3f295933f91e8208c8e20f88",
+          "auth-64cdb29ba89c39a45ce10caee2be159d9a708ef427734a8f7ec24d02d3b0d0bb",
+          "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d"
+        ],
+        "keptBy": {
+          "auth-2341a2131fb673270b41833f685f832a3c4e696e3f295933f91e8208c8e20f88": "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d",
+          "auth-64cdb29ba89c39a45ce10caee2be159d9a708ef427734a8f7ec24d02d3b0d0bb": "anchor",
+          "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d": "anchor"
+        },
+        "roles": [
+          {
+            "subject": "Q",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000010",
+            "key": "tygv5HL5dkHBcJeCGlN4dKqqUyZFrTTb1ZhzMaTnP40",
+            "roles": [
+              {
+                "role": "participant",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "W",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000c",
+            "key": "VRVPQgZepaG-oFRjgmviaE65LfksEAAnqrquV8pVQgc",
+            "roles": [
+              {
+                "role": "validator",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "validated",
+              "insideScope": {}
+            }
+          }
+        ],
+        "root": "fe79a0ba0bb8f5dee4e901b5d7ad04037c4236fb14c3a1faec495816091d7811"
+      }
+    },
+    {
+      "label": "the anchor endorses the admin's validator and its revoke: both survive, the admin does not",
+      "pin": "anchor-2-of-3",
+      "statements": [
+        "gA",
+        "gW",
+        "gV",
+        "gP",
+        "gR",
+        "gQ",
+        "rP",
+        "rA",
+        "eV"
+      ],
+      "expected": {
+        "status": {
+          "gA": "removed",
+          "gW": "in-force",
+          "gV": "in-force",
+          "gP": "removed",
+          "gR": "in-force",
+          "gQ": "in-force",
+          "rP": "in-force",
+          "rA": "in-force",
+          "eV": "in-force"
+        },
+        "inForce": [
+          "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+          "auth-2341a2131fb673270b41833f685f832a3c4e696e3f295933f91e8208c8e20f88",
+          "auth-64cdb29ba89c39a45ce10caee2be159d9a708ef427734a8f7ec24d02d3b0d0bb",
+          "auth-7486a34dd62cd0c0cdb8199eae2558146c78ba1ef82b48035af10ef3962be642",
+          "auth-a1ebefb80b68472784beb0f0237675c1b381ccf40da14e201f61ac30e4fc5277",
+          "auth-ddd1f057a94651f5661a866791d393384ccf16fa0883aa7cef90f88c37d92b74",
+          "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d"
+        ],
+        "live": [
+          "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+          "auth-2341a2131fb673270b41833f685f832a3c4e696e3f295933f91e8208c8e20f88",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-64cdb29ba89c39a45ce10caee2be159d9a708ef427734a8f7ec24d02d3b0d0bb",
+          "auth-7486a34dd62cd0c0cdb8199eae2558146c78ba1ef82b48035af10ef3962be642",
+          "auth-a1ebefb80b68472784beb0f0237675c1b381ccf40da14e201f61ac30e4fc5277",
+          "auth-ddd1f057a94651f5661a866791d393384ccf16fa0883aa7cef90f88c37d92b74",
+          "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d"
+        ],
+        "keptBy": {
+          "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f": "anchor",
+          "auth-2341a2131fb673270b41833f685f832a3c4e696e3f295933f91e8208c8e20f88": "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d",
+          "auth-64cdb29ba89c39a45ce10caee2be159d9a708ef427734a8f7ec24d02d3b0d0bb": "anchor",
+          "auth-7486a34dd62cd0c0cdb8199eae2558146c78ba1ef82b48035af10ef3962be642": "anchor",
+          "auth-a1ebefb80b68472784beb0f0237675c1b381ccf40da14e201f61ac30e4fc5277": "anchor",
+          "auth-ddd1f057a94651f5661a866791d393384ccf16fa0883aa7cef90f88c37d92b74": "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+          "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d": "anchor"
+        },
+        "roles": [
+          {
+            "subject": "Q",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000010",
+            "key": "tygv5HL5dkHBcJeCGlN4dKqqUyZFrTTb1ZhzMaTnP40",
+            "roles": [
+              {
+                "role": "participant",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "R",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000f",
+            "key": "1AS8RFZa7buJkVDlsLOzK5RBvwy3iEwzEw2o28J90s8",
+            "roles": [
+              {
+                "role": "xmesh-worker",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "V",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000b",
+            "key": "RyG1tjInLmWmjdp6wltBhfiwGRbbGFwUKH25Lit3D64",
+            "roles": [
+              {
+                "role": "validator",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "validated",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "W",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000c",
+            "key": "VRVPQgZepaG-oFRjgmviaE65LfksEAAnqrquV8pVQgc",
+            "roles": [
+              {
+                "role": "validator",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "validated",
+              "insideScope": {}
+            }
+          }
+        ],
+        "root": "7ce42b998bea9c6f4b2aadef61bad320dfb7cb00fc589795f7dafcb500003015"
+      }
+    },
+    {
+      "label": "an admin beside the removed one cannot endorse its subtree",
+      "pin": "anchor-2-of-3",
+      "statements": [
+        "gA",
+        "gW",
+        "gV",
+        "gP",
+        "gR",
+        "gQ",
+        "rA",
+        "gB",
+        "eVbyB"
+      ],
+      "expected": {
+        "status": {
+          "gA": "removed",
+          "gW": "in-force",
+          "gV": "dead",
+          "gP": "dead",
+          "gR": "dead",
+          "gQ": "in-force",
+          "rA": "in-force",
+          "gB": "in-force",
+          "eVbyB": "in-force"
+        },
+        "inForce": [
+          "auth-15b112063a168a0afc7bb3db7d8beb9801489a63a736478d623e92d024fafb9f",
+          "auth-2341a2131fb673270b41833f685f832a3c4e696e3f295933f91e8208c8e20f88",
+          "auth-64cdb29ba89c39a45ce10caee2be159d9a708ef427734a8f7ec24d02d3b0d0bb",
+          "auth-de438b7f771ff3f17dfb0a910c03e43f3c858fa50e4358a8d2b5dce6b919da0c",
+          "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d"
+        ],
+        "live": [
+          "auth-15b112063a168a0afc7bb3db7d8beb9801489a63a736478d623e92d024fafb9f",
+          "auth-2341a2131fb673270b41833f685f832a3c4e696e3f295933f91e8208c8e20f88",
+          "auth-64cdb29ba89c39a45ce10caee2be159d9a708ef427734a8f7ec24d02d3b0d0bb",
+          "auth-de438b7f771ff3f17dfb0a910c03e43f3c858fa50e4358a8d2b5dce6b919da0c",
+          "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d"
+        ],
+        "keptBy": {
+          "auth-15b112063a168a0afc7bb3db7d8beb9801489a63a736478d623e92d024fafb9f": "anchor",
+          "auth-2341a2131fb673270b41833f685f832a3c4e696e3f295933f91e8208c8e20f88": "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d",
+          "auth-64cdb29ba89c39a45ce10caee2be159d9a708ef427734a8f7ec24d02d3b0d0bb": "anchor",
+          "auth-de438b7f771ff3f17dfb0a910c03e43f3c858fa50e4358a8d2b5dce6b919da0c": "auth-15b112063a168a0afc7bb3db7d8beb9801489a63a736478d623e92d024fafb9f",
+          "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d": "anchor"
+        },
+        "roles": [
+          {
+            "subject": "B",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000018",
+            "key": "ZQt9ylU8rmktusMDnnWG8N9E6EXPK6pnh9bv90QlyxQ",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Q",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000010",
+            "key": "tygv5HL5dkHBcJeCGlN4dKqqUyZFrTTb1ZhzMaTnP40",
+            "roles": [
+              {
+                "role": "participant",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "W",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000c",
+            "key": "VRVPQgZepaG-oFRjgmviaE65LfksEAAnqrquV8pVQgc",
+            "roles": [
+              {
+                "role": "validator",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "validated",
+              "insideScope": {}
+            }
+          }
+        ],
+        "root": "cdc0315744099eebd42111f41c4b811e840657dce71e47c5495def198a9b1fe3"
+      }
+    },
+    {
+      "label": "an admin removes its validator and keeps one of the validator's grants, in its own bucket",
+      "pin": "anchor-2-of-3",
+      "statements": [
+        "gA",
+        "gW",
+        "gV",
+        "gP",
+        "gR",
+        "gQ",
+        "rV",
+        "eP"
+      ],
+      "expected": {
+        "status": {
+          "gA": "in-force",
+          "gW": "in-force",
+          "gV": "removed",
+          "gP": "in-force",
+          "gR": "dead",
+          "gQ": "in-force",
+          "rV": "in-force",
+          "eP": "in-force"
+        },
+        "inForce": [
+          "auth-012fb00ee8a57593023daf8e157790d500c5ca8d5e01ccededf424d948872a7b",
+          "auth-2341a2131fb673270b41833f685f832a3c4e696e3f295933f91e8208c8e20f88",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-590e09634c0082bb684477bc6eac40e28736f797d0ce79ab2f50e5e476ae8d41",
+          "auth-90fe6da3187b891e9692dfcc204e7868f1ec106a2cd4ea5df47d9e69bb8bef50",
+          "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d"
+        ],
+        "live": [
+          "auth-012fb00ee8a57593023daf8e157790d500c5ca8d5e01ccededf424d948872a7b",
+          "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+          "auth-2341a2131fb673270b41833f685f832a3c4e696e3f295933f91e8208c8e20f88",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-590e09634c0082bb684477bc6eac40e28736f797d0ce79ab2f50e5e476ae8d41",
+          "auth-90fe6da3187b891e9692dfcc204e7868f1ec106a2cd4ea5df47d9e69bb8bef50",
+          "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d"
+        ],
+        "keptBy": {
+          "auth-012fb00ee8a57593023daf8e157790d500c5ca8d5e01ccededf424d948872a7b": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-2341a2131fb673270b41833f685f832a3c4e696e3f295933f91e8208c8e20f88": "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1": "anchor",
+          "auth-590e09634c0082bb684477bc6eac40e28736f797d0ce79ab2f50e5e476ae8d41": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-90fe6da3187b891e9692dfcc204e7868f1ec106a2cd4ea5df47d9e69bb8bef50": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d": "anchor"
+        },
+        "roles": [
+          {
+            "subject": "A",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000a",
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "P",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000e",
+            "key": "rNzISU1Fj0SnqqwdaoTsYk2u6IQ22yribme6ZFoQYig",
+            "roles": [
+              {
+                "role": "participant",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Q",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000010",
+            "key": "tygv5HL5dkHBcJeCGlN4dKqqUyZFrTTb1ZhzMaTnP40",
+            "roles": [
+              {
+                "role": "participant",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "W",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000c",
+            "key": "VRVPQgZepaG-oFRjgmviaE65LfksEAAnqrquV8pVQgc",
+            "roles": [
+              {
+                "role": "validator",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "validated",
+              "insideScope": {}
+            }
+          }
+        ],
+        "root": "f923ec8f9146e78603b26aca490c03e45c5b95bb3e08a196b8b6663ba57f0422"
+      }
+    },
+    {
+      "label": "an endorse is never rescued, so an endorse that names an endorse keeps nothing",
+      "pin": "anchor-2-of-3",
+      "statements": [
+        "gA",
+        "gW",
+        "gV",
+        "gP",
+        "gR",
+        "gQ",
+        "eSelfA",
+        "rA",
+        "eKeepSelf"
+      ],
+      "expected": {
+        "status": {
+          "gA": "removed",
+          "gW": "in-force",
+          "gV": "dead",
+          "gP": "dead",
+          "gR": "dead",
+          "gQ": "in-force",
+          "eSelfA": "dead",
+          "rA": "in-force",
+          "eKeepSelf": "in-force"
+        },
+        "inForce": [
+          "auth-2341a2131fb673270b41833f685f832a3c4e696e3f295933f91e8208c8e20f88",
+          "auth-64cdb29ba89c39a45ce10caee2be159d9a708ef427734a8f7ec24d02d3b0d0bb",
+          "auth-697a515218c87d64b0be231b8e16b0013e54d78a03fb1392bfd9a5e8afeeb311",
+          "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d"
+        ],
+        "live": [
+          "auth-2341a2131fb673270b41833f685f832a3c4e696e3f295933f91e8208c8e20f88",
+          "auth-64cdb29ba89c39a45ce10caee2be159d9a708ef427734a8f7ec24d02d3b0d0bb",
+          "auth-697a515218c87d64b0be231b8e16b0013e54d78a03fb1392bfd9a5e8afeeb311",
+          "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d"
+        ],
+        "keptBy": {
+          "auth-2341a2131fb673270b41833f685f832a3c4e696e3f295933f91e8208c8e20f88": "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d",
+          "auth-64cdb29ba89c39a45ce10caee2be159d9a708ef427734a8f7ec24d02d3b0d0bb": "anchor",
+          "auth-697a515218c87d64b0be231b8e16b0013e54d78a03fb1392bfd9a5e8afeeb311": "anchor",
+          "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d": "anchor"
+        },
+        "roles": [
+          {
+            "subject": "Q",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000010",
+            "key": "tygv5HL5dkHBcJeCGlN4dKqqUyZFrTTb1ZhzMaTnP40",
+            "roles": [
+              {
+                "role": "participant",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "W",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000c",
+            "key": "VRVPQgZepaG-oFRjgmviaE65LfksEAAnqrquV8pVQgc",
+            "roles": [
+              {
+                "role": "validator",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "validated",
+              "insideScope": {}
+            }
+          }
+        ],
+        "root": "72e6c0e3b2684e6dda8c38e7a21ad0a70909f1ef528001a61b2ea85ebf641b12"
+      }
+    },
+    {
+      "label": "a fresh grant does not revive the old grant's dependents",
+      "pin": "anchor-2-of-3",
+      "statements": [
+        "gA",
+        "gW",
+        "gV",
+        "gP",
+        "gR",
+        "gQ",
+        "rP",
+        "rA",
+        "gA2"
+      ],
+      "expected": {
+        "status": {
+          "gA": "removed",
+          "gW": "in-force",
+          "gV": "dead",
+          "gP": "dead",
+          "gR": "dead",
+          "gQ": "in-force",
+          "rP": "dead",
+          "rA": "in-force",
+          "gA2": "in-force"
+        },
+        "inForce": [
+          "auth-2341a2131fb673270b41833f685f832a3c4e696e3f295933f91e8208c8e20f88",
+          "auth-5a801c7e5e8ce4e83969fa620aa1da491a1f93e027bd53f5f6fb8bc4494bfefc",
+          "auth-64cdb29ba89c39a45ce10caee2be159d9a708ef427734a8f7ec24d02d3b0d0bb",
+          "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d"
+        ],
+        "live": [
+          "auth-2341a2131fb673270b41833f685f832a3c4e696e3f295933f91e8208c8e20f88",
+          "auth-5a801c7e5e8ce4e83969fa620aa1da491a1f93e027bd53f5f6fb8bc4494bfefc",
+          "auth-64cdb29ba89c39a45ce10caee2be159d9a708ef427734a8f7ec24d02d3b0d0bb",
+          "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d"
+        ],
+        "keptBy": {
+          "auth-2341a2131fb673270b41833f685f832a3c4e696e3f295933f91e8208c8e20f88": "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d",
+          "auth-5a801c7e5e8ce4e83969fa620aa1da491a1f93e027bd53f5f6fb8bc4494bfefc": "anchor",
+          "auth-64cdb29ba89c39a45ce10caee2be159d9a708ef427734a8f7ec24d02d3b0d0bb": "anchor",
+          "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d": "anchor"
+        },
+        "roles": [
+          {
+            "subject": "A",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000a",
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Q",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000010",
+            "key": "tygv5HL5dkHBcJeCGlN4dKqqUyZFrTTb1ZhzMaTnP40",
+            "roles": [
+              {
+                "role": "participant",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "W",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000c",
+            "key": "VRVPQgZepaG-oFRjgmviaE65LfksEAAnqrquV8pVQgc",
+            "roles": [
+              {
+                "role": "validator",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "validated",
+              "insideScope": {}
+            }
+          }
+        ],
+        "root": "247b3bf1ad2516a7b475a6aff672611f9fe526e2eb611f3fabb19e41add28b5a"
+      }
+    },
+    {
+      "label": "a revoke from off the chain removes nothing",
+      "pin": "anchor-2-of-3",
+      "statements": [
+        "gA",
+        "gW",
+        "gV",
+        "gP",
+        "gR",
+        "gQ",
+        "rVbyW"
+      ],
+      "expected": {
+        "status": {
+          "gA": "in-force",
+          "gW": "in-force",
+          "gV": "in-force",
+          "gP": "in-force",
+          "gR": "in-force",
+          "gQ": "in-force",
+          "rVbyW": "in-force"
+        },
+        "inForce": [
+          "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+          "auth-2341a2131fb673270b41833f685f832a3c4e696e3f295933f91e8208c8e20f88",
+          "auth-38485b4e04a74f905de58ad693cf9ee585f719b40a3539ab7fed4588b0845b08",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-90fe6da3187b891e9692dfcc204e7868f1ec106a2cd4ea5df47d9e69bb8bef50",
+          "auth-ddd1f057a94651f5661a866791d393384ccf16fa0883aa7cef90f88c37d92b74",
+          "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d"
+        ],
+        "live": [
+          "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+          "auth-2341a2131fb673270b41833f685f832a3c4e696e3f295933f91e8208c8e20f88",
+          "auth-38485b4e04a74f905de58ad693cf9ee585f719b40a3539ab7fed4588b0845b08",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-90fe6da3187b891e9692dfcc204e7868f1ec106a2cd4ea5df47d9e69bb8bef50",
+          "auth-ddd1f057a94651f5661a866791d393384ccf16fa0883aa7cef90f88c37d92b74",
+          "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d"
+        ],
+        "keptBy": {
+          "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-2341a2131fb673270b41833f685f832a3c4e696e3f295933f91e8208c8e20f88": "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d",
+          "auth-38485b4e04a74f905de58ad693cf9ee585f719b40a3539ab7fed4588b0845b08": "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1": "anchor",
+          "auth-90fe6da3187b891e9692dfcc204e7868f1ec106a2cd4ea5df47d9e69bb8bef50": "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+          "auth-ddd1f057a94651f5661a866791d393384ccf16fa0883aa7cef90f88c37d92b74": "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+          "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d": "anchor"
+        },
+        "roles": [
+          {
+            "subject": "A",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000a",
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "P",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000e",
+            "key": "rNzISU1Fj0SnqqwdaoTsYk2u6IQ22yribme6ZFoQYig",
+            "roles": [
+              {
+                "role": "participant",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Q",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000010",
+            "key": "tygv5HL5dkHBcJeCGlN4dKqqUyZFrTTb1ZhzMaTnP40",
+            "roles": [
+              {
+                "role": "participant",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "R",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000f",
+            "key": "1AS8RFZa7buJkVDlsLOzK5RBvwy3iEwzEw2o28J90s8",
+            "roles": [
+              {
+                "role": "xmesh-worker",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "V",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000b",
+            "key": "RyG1tjInLmWmjdp6wltBhfiwGRbbGFwUKH25Lit3D64",
+            "roles": [
+              {
+                "role": "validator",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "validated",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "W",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000c",
+            "key": "VRVPQgZepaG-oFRjgmviaE65LfksEAAnqrquV8pVQgc",
+            "roles": [
+              {
+                "role": "validator",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "validated",
+              "insideScope": {}
+            }
+          }
+        ],
+        "root": "17f37f5c15353f5a905e306ff2e68c2d5d03b929842906753f5496049ecce5d4"
+      }
+    },
+    {
+      "label": "invalid statements are inert",
+      "pin": "anchor-2-of-3",
+      "statements": [
+        "gA",
+        "gW",
+        "gV",
+        "gP",
+        "gR",
+        "gQ",
+        "xThin",
+        "xDupKey",
+        "xValidatorByValidator",
+        "xEndorseByValidator",
+        "xByParticipant",
+        "xWrongKey",
+        "xIdentityKey",
+        "xUpperNodeId"
+      ],
+      "expected": {
+        "status": {
+          "gA": "in-force",
+          "gW": "in-force",
+          "gV": "in-force",
+          "gP": "in-force",
+          "gR": "in-force",
+          "gQ": "in-force",
+          "xThin": "invalid",
+          "xDupKey": "invalid",
+          "xValidatorByValidator": "invalid",
+          "xEndorseByValidator": "invalid",
+          "xByParticipant": "invalid",
+          "xWrongKey": "invalid",
+          "xIdentityKey": "invalid",
+          "xUpperNodeId": "invalid"
+        },
+        "inForce": [
+          "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+          "auth-2341a2131fb673270b41833f685f832a3c4e696e3f295933f91e8208c8e20f88",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-90fe6da3187b891e9692dfcc204e7868f1ec106a2cd4ea5df47d9e69bb8bef50",
+          "auth-ddd1f057a94651f5661a866791d393384ccf16fa0883aa7cef90f88c37d92b74",
+          "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d"
+        ],
+        "live": [
+          "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+          "auth-2341a2131fb673270b41833f685f832a3c4e696e3f295933f91e8208c8e20f88",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-90fe6da3187b891e9692dfcc204e7868f1ec106a2cd4ea5df47d9e69bb8bef50",
+          "auth-ddd1f057a94651f5661a866791d393384ccf16fa0883aa7cef90f88c37d92b74",
+          "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d"
+        ],
+        "keptBy": {
+          "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-2341a2131fb673270b41833f685f832a3c4e696e3f295933f91e8208c8e20f88": "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1": "anchor",
+          "auth-90fe6da3187b891e9692dfcc204e7868f1ec106a2cd4ea5df47d9e69bb8bef50": "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+          "auth-ddd1f057a94651f5661a866791d393384ccf16fa0883aa7cef90f88c37d92b74": "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+          "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d": "anchor"
+        },
+        "roles": [
+          {
+            "subject": "A",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000a",
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "P",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000e",
+            "key": "rNzISU1Fj0SnqqwdaoTsYk2u6IQ22yribme6ZFoQYig",
+            "roles": [
+              {
+                "role": "participant",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Q",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000010",
+            "key": "tygv5HL5dkHBcJeCGlN4dKqqUyZFrTTb1ZhzMaTnP40",
+            "roles": [
+              {
+                "role": "participant",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "R",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000f",
+            "key": "1AS8RFZa7buJkVDlsLOzK5RBvwy3iEwzEw2o28J90s8",
+            "roles": [
+              {
+                "role": "xmesh-worker",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "V",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000b",
+            "key": "RyG1tjInLmWmjdp6wltBhfiwGRbbGFwUKH25Lit3D64",
+            "roles": [
+              {
+                "role": "validator",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "validated",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "W",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000c",
+            "key": "VRVPQgZepaG-oFRjgmviaE65LfksEAAnqrquV8pVQgc",
+            "roles": [
+              {
+                "role": "validator",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "validated",
+              "insideScope": {}
+            }
+          }
+        ],
+        "root": "16de8c205d935f9063d1a3f9813b5b915521689d99a13e793bd39c07d1ef3f2d"
+      }
+    },
+    {
+      "label": "authorisedBy must name a grant: one naming a revoke is pending while the revoke is not held, invalid once it is",
+      "pin": "anchor-2-of-3",
+      "statements": [
+        "gA",
+        "gW",
+        "gV",
+        "gP",
+        "gR",
+        "gQ",
+        "rP",
+        "xAuthIsRevoke"
+      ],
+      "expected": {
+        "status": {
+          "gA": "in-force",
+          "gW": "in-force",
+          "gV": "in-force",
+          "gP": "removed",
+          "gR": "in-force",
+          "gQ": "in-force",
+          "rP": "in-force",
+          "xAuthIsRevoke": "invalid"
+        },
+        "inForce": [
+          "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+          "auth-2341a2131fb673270b41833f685f832a3c4e696e3f295933f91e8208c8e20f88",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-a1ebefb80b68472784beb0f0237675c1b381ccf40da14e201f61ac30e4fc5277",
+          "auth-ddd1f057a94651f5661a866791d393384ccf16fa0883aa7cef90f88c37d92b74",
+          "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d"
+        ],
+        "live": [
+          "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+          "auth-2341a2131fb673270b41833f685f832a3c4e696e3f295933f91e8208c8e20f88",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-a1ebefb80b68472784beb0f0237675c1b381ccf40da14e201f61ac30e4fc5277",
+          "auth-ddd1f057a94651f5661a866791d393384ccf16fa0883aa7cef90f88c37d92b74",
+          "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d"
+        ],
+        "keptBy": {
+          "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-2341a2131fb673270b41833f685f832a3c4e696e3f295933f91e8208c8e20f88": "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1": "anchor",
+          "auth-a1ebefb80b68472784beb0f0237675c1b381ccf40da14e201f61ac30e4fc5277": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-ddd1f057a94651f5661a866791d393384ccf16fa0883aa7cef90f88c37d92b74": "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+          "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d": "anchor"
+        },
+        "roles": [
+          {
+            "subject": "A",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000a",
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Q",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000010",
+            "key": "tygv5HL5dkHBcJeCGlN4dKqqUyZFrTTb1ZhzMaTnP40",
+            "roles": [
+              {
+                "role": "participant",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "R",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000f",
+            "key": "1AS8RFZa7buJkVDlsLOzK5RBvwy3iEwzEw2o28J90s8",
+            "roles": [
+              {
+                "role": "xmesh-worker",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "V",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000b",
+            "key": "RyG1tjInLmWmjdp6wltBhfiwGRbbGFwUKH25Lit3D64",
+            "roles": [
+              {
+                "role": "validator",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "validated",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "W",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000c",
+            "key": "VRVPQgZepaG-oFRjgmviaE65LfksEAAnqrquV8pVQgc",
+            "roles": [
+              {
+                "role": "validator",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "validated",
+              "insideScope": {}
+            }
+          }
+        ],
+        "root": "2171a6773a5920b127161832c161aa539e62fd657efb307c325218a7a651fbf8"
+      }
+    },
+    {
+      "label": "a statement whose chain is not held is pending and changes nothing",
+      "pin": "anchor-2-of-3",
+      "statements": [
+        "gA",
+        "gW",
+        "gV",
+        "gP",
+        "gR",
+        "gQ",
+        "gM"
+      ],
+      "expected": {
+        "status": {
+          "gA": "in-force",
+          "gW": "in-force",
+          "gV": "in-force",
+          "gP": "in-force",
+          "gR": "in-force",
+          "gQ": "in-force",
+          "gM": "pending"
+        },
+        "inForce": [
+          "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+          "auth-2341a2131fb673270b41833f685f832a3c4e696e3f295933f91e8208c8e20f88",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-90fe6da3187b891e9692dfcc204e7868f1ec106a2cd4ea5df47d9e69bb8bef50",
+          "auth-ddd1f057a94651f5661a866791d393384ccf16fa0883aa7cef90f88c37d92b74",
+          "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d"
+        ],
+        "live": [
+          "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+          "auth-2341a2131fb673270b41833f685f832a3c4e696e3f295933f91e8208c8e20f88",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-90fe6da3187b891e9692dfcc204e7868f1ec106a2cd4ea5df47d9e69bb8bef50",
+          "auth-ddd1f057a94651f5661a866791d393384ccf16fa0883aa7cef90f88c37d92b74",
+          "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d"
+        ],
+        "keptBy": {
+          "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-2341a2131fb673270b41833f685f832a3c4e696e3f295933f91e8208c8e20f88": "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1": "anchor",
+          "auth-90fe6da3187b891e9692dfcc204e7868f1ec106a2cd4ea5df47d9e69bb8bef50": "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+          "auth-ddd1f057a94651f5661a866791d393384ccf16fa0883aa7cef90f88c37d92b74": "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+          "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d": "anchor"
+        },
+        "roles": [
+          {
+            "subject": "A",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000a",
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "P",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000e",
+            "key": "rNzISU1Fj0SnqqwdaoTsYk2u6IQ22yribme6ZFoQYig",
+            "roles": [
+              {
+                "role": "participant",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Q",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000010",
+            "key": "tygv5HL5dkHBcJeCGlN4dKqqUyZFrTTb1ZhzMaTnP40",
+            "roles": [
+              {
+                "role": "participant",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "R",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000f",
+            "key": "1AS8RFZa7buJkVDlsLOzK5RBvwy3iEwzEw2o28J90s8",
+            "roles": [
+              {
+                "role": "xmesh-worker",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "V",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000b",
+            "key": "RyG1tjInLmWmjdp6wltBhfiwGRbbGFwUKH25Lit3D64",
+            "roles": [
+              {
+                "role": "validator",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "validated",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "W",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000c",
+            "key": "VRVPQgZepaG-oFRjgmviaE65LfksEAAnqrquV8pVQgc",
+            "roles": [
+              {
+                "role": "validator",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "validated",
+              "insideScope": {}
+            }
+          }
+        ],
+        "root": "16de8c205d935f9063d1a3f9813b5b915521689d99a13e793bd39c07d1ef3f2d"
+      }
+    },
+    {
+      "label": "the chain arrives and the pending statement is in force",
+      "pin": "anchor-2-of-3",
+      "statements": [
+        "gA",
+        "gW",
+        "gV",
+        "gP",
+        "gR",
+        "gQ",
+        "gM",
+        "gH"
+      ],
+      "expected": {
+        "status": {
+          "gA": "in-force",
+          "gW": "in-force",
+          "gV": "in-force",
+          "gP": "in-force",
+          "gR": "in-force",
+          "gQ": "in-force",
+          "gM": "in-force",
+          "gH": "in-force"
+        },
+        "inForce": [
+          "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+          "auth-17d227a7a10f8a7d473221f21f0cc0941964ea38fadcc094d2b7e5d54b595a5b",
+          "auth-2341a2131fb673270b41833f685f832a3c4e696e3f295933f91e8208c8e20f88",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-90fe6da3187b891e9692dfcc204e7868f1ec106a2cd4ea5df47d9e69bb8bef50",
+          "auth-b18c03b9f244a41cf24bdb08dbd978636f358bd60a5d990ba4aa12c7b4cce675",
+          "auth-ddd1f057a94651f5661a866791d393384ccf16fa0883aa7cef90f88c37d92b74",
+          "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d"
+        ],
+        "live": [
+          "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+          "auth-17d227a7a10f8a7d473221f21f0cc0941964ea38fadcc094d2b7e5d54b595a5b",
+          "auth-2341a2131fb673270b41833f685f832a3c4e696e3f295933f91e8208c8e20f88",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-90fe6da3187b891e9692dfcc204e7868f1ec106a2cd4ea5df47d9e69bb8bef50",
+          "auth-b18c03b9f244a41cf24bdb08dbd978636f358bd60a5d990ba4aa12c7b4cce675",
+          "auth-ddd1f057a94651f5661a866791d393384ccf16fa0883aa7cef90f88c37d92b74",
+          "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d"
+        ],
+        "keptBy": {
+          "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-17d227a7a10f8a7d473221f21f0cc0941964ea38fadcc094d2b7e5d54b595a5b": "anchor",
+          "auth-2341a2131fb673270b41833f685f832a3c4e696e3f295933f91e8208c8e20f88": "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1": "anchor",
+          "auth-90fe6da3187b891e9692dfcc204e7868f1ec106a2cd4ea5df47d9e69bb8bef50": "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+          "auth-b18c03b9f244a41cf24bdb08dbd978636f358bd60a5d990ba4aa12c7b4cce675": "auth-17d227a7a10f8a7d473221f21f0cc0941964ea38fadcc094d2b7e5d54b595a5b",
+          "auth-ddd1f057a94651f5661a866791d393384ccf16fa0883aa7cef90f88c37d92b74": "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+          "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d": "anchor"
+        },
+        "roles": [
+          {
+            "subject": "A",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000a",
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "H",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000d",
+            "key": "WRLawCDc2rp2fOymQkPoRRdiFcSF5BjlD4AgXYEhipE",
+            "roles": [
+              {
+                "role": "validator",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "validated",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "M",
+            "nodeId": "018f47a0-7b21-7abc-8def-0000000000ee",
+            "key": "gUci3nHFsU50jf8yKuf3xBXO5Vh2ZJUpLNbEwKap3yg",
+            "roles": [
+              {
+                "role": "participant",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "P",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000e",
+            "key": "rNzISU1Fj0SnqqwdaoTsYk2u6IQ22yribme6ZFoQYig",
+            "roles": [
+              {
+                "role": "participant",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Q",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000010",
+            "key": "tygv5HL5dkHBcJeCGlN4dKqqUyZFrTTb1ZhzMaTnP40",
+            "roles": [
+              {
+                "role": "participant",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "R",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000f",
+            "key": "1AS8RFZa7buJkVDlsLOzK5RBvwy3iEwzEw2o28J90s8",
+            "roles": [
+              {
+                "role": "xmesh-worker",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "V",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000b",
+            "key": "RyG1tjInLmWmjdp6wltBhfiwGRbbGFwUKH25Lit3D64",
+            "roles": [
+              {
+                "role": "validator",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "validated",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "W",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000c",
+            "key": "VRVPQgZepaG-oFRjgmviaE65LfksEAAnqrquV8pVQgc",
+            "roles": [
+              {
+                "role": "validator",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "validated",
+              "insideScope": {}
+            }
+          }
+        ],
+        "root": "0731635583d0847872a9e76ffcf8175bdb6ab376eb2db2e536816bce60e07542"
+      }
+    },
+    {
+      "label": "a hosted world four hops below the anchor, scoped to one world; scopes only narrow; an issuer grants seats only; a fifth hop is too deep",
+      "pin": "anchor-2-of-3",
+      "statements": [
+        "gD",
+        "gWA",
+        "gWB",
+        "gSI",
+        "gS1",
+        "gSR",
+        "gS3",
+        "xScopeDropped",
+        "xScopeSideways",
+        "xScopeWiderSeat",
+        "xScopeW10",
+        "xScopeDotDot",
+        "xScopeDot",
+        "xIssuerGrantsValidator",
+        "xIssuerEndorses",
+        "gX3",
+        "gX4",
+        "xTooDeep"
+      ],
+      "expected": {
+        "status": {
+          "gD": "in-force",
+          "gWA": "in-force",
+          "gWB": "in-force",
+          "gSI": "in-force",
+          "gS1": "in-force",
+          "gSR": "in-force",
+          "gS3": "in-force",
+          "xScopeDropped": "invalid",
+          "xScopeSideways": "invalid",
+          "xScopeWiderSeat": "invalid",
+          "xScopeW10": "invalid",
+          "xScopeDotDot": "invalid",
+          "xScopeDot": "invalid",
+          "xIssuerGrantsValidator": "invalid",
+          "xIssuerEndorses": "invalid",
+          "gX3": "in-force",
+          "gX4": "in-force",
+          "xTooDeep": "invalid"
+        },
+        "inForce": [
+          "auth-0931b9103bf127e5fb50d76f967f61b6a01f04a008ab955bbf5453dafbc6c1ce",
+          "auth-1e44b2e18b6030f5304a8c148df15932e8420cae5d1c88b0579f221eb2e3ec4a",
+          "auth-3e3d266524851810a3086010febb5b4435bb93e2bed02e818d47466cd3596f3d",
+          "auth-43ecaa783c79e83600ee9698a25c64f90f3c96c9e12ad4e4555c270352b285c1",
+          "auth-4fb54aaadf85d38bbd1c871f9828b5b5d98c7e40676cc34af628630ba0a31da2",
+          "auth-87ae15275e927149c563d1420d2d2bd9c01176981c0b7d295746a45865046d48",
+          "auth-931b55dccdc74cd462e3fc86ca661d35c3475bdf713a97f218465da08be85cec",
+          "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb",
+          "auth-f37e987e8999b554e8882dd96b617b74595d37879a3390a697e16547e3bdd0e0"
+        ],
+        "live": [
+          "auth-0931b9103bf127e5fb50d76f967f61b6a01f04a008ab955bbf5453dafbc6c1ce",
+          "auth-1e44b2e18b6030f5304a8c148df15932e8420cae5d1c88b0579f221eb2e3ec4a",
+          "auth-3e3d266524851810a3086010febb5b4435bb93e2bed02e818d47466cd3596f3d",
+          "auth-43ecaa783c79e83600ee9698a25c64f90f3c96c9e12ad4e4555c270352b285c1",
+          "auth-4fb54aaadf85d38bbd1c871f9828b5b5d98c7e40676cc34af628630ba0a31da2",
+          "auth-87ae15275e927149c563d1420d2d2bd9c01176981c0b7d295746a45865046d48",
+          "auth-931b55dccdc74cd462e3fc86ca661d35c3475bdf713a97f218465da08be85cec",
+          "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb",
+          "auth-f37e987e8999b554e8882dd96b617b74595d37879a3390a697e16547e3bdd0e0"
+        ],
+        "keptBy": {
+          "auth-0931b9103bf127e5fb50d76f967f61b6a01f04a008ab955bbf5453dafbc6c1ce": "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb",
+          "auth-1e44b2e18b6030f5304a8c148df15932e8420cae5d1c88b0579f221eb2e3ec4a": "auth-43ecaa783c79e83600ee9698a25c64f90f3c96c9e12ad4e4555c270352b285c1",
+          "auth-3e3d266524851810a3086010febb5b4435bb93e2bed02e818d47466cd3596f3d": "auth-0931b9103bf127e5fb50d76f967f61b6a01f04a008ab955bbf5453dafbc6c1ce",
+          "auth-43ecaa783c79e83600ee9698a25c64f90f3c96c9e12ad4e4555c270352b285c1": "anchor",
+          "auth-4fb54aaadf85d38bbd1c871f9828b5b5d98c7e40676cc34af628630ba0a31da2": "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb",
+          "auth-87ae15275e927149c563d1420d2d2bd9c01176981c0b7d295746a45865046d48": "auth-931b55dccdc74cd462e3fc86ca661d35c3475bdf713a97f218465da08be85cec",
+          "auth-931b55dccdc74cd462e3fc86ca661d35c3475bdf713a97f218465da08be85cec": "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb",
+          "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb": "auth-43ecaa783c79e83600ee9698a25c64f90f3c96c9e12ad4e4555c270352b285c1",
+          "auth-f37e987e8999b554e8882dd96b617b74595d37879a3390a697e16547e3bdd0e0": "auth-4fb54aaadf85d38bbd1c871f9828b5b5d98c7e40676cc34af628630ba0a31da2"
+        },
+        "roles": [
+          {
+            "subject": "D",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000012",
+            "key": "buCR_SgKm2hVT6c8WIEl1H00JcaKJroja02tkPkKj5I",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "S1",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000015",
+            "key": "7TI0snbUztpX1ZutFPuvWnc8DzGMmZ3jpg1TxaWzTAU",
+            "roles": [
+              {
+                "role": "xmesh-seat",
+                "scope": "xmesh-world:w1"
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {
+                "xmesh-world:w1": "none"
+              }
+            }
+          },
+          {
+            "subject": "S3",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000001d",
+            "key": "jkGQzWj9wH3aDFnmywc-_S2TEdYio4oy32iFtKQSFVE",
+            "roles": [
+              {
+                "role": "xmesh-seat",
+                "scope": "xmesh-world:w1/region-a"
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {
+                "xmesh-world:w1/region-a": "none"
+              }
+            }
+          },
+          {
+            "subject": "SI",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000014",
+            "key": "tHQLpOD34FdvEegUnbuyUpwhIhPbZ5gx-10bIh6EVS0",
+            "roles": [
+              {
+                "role": "issuer",
+                "scope": "xmesh-world:w1"
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {
+                "xmesh-world:w1": "none"
+              }
+            }
+          },
+          {
+            "subject": "SR",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000001c",
+            "key": "YN5ey4qpiEIsIrHiC_xAFJ7ZTR6QwFrqeMjyG-MxcLA",
+            "roles": [
+              {
+                "role": "issuer",
+                "scope": "xmesh-world:w1/region-a"
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {
+                "xmesh-world:w1/region-a": "none"
+              }
+            }
+          },
+          {
+            "subject": "WA",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000013",
+            "key": "Qej94TKtZw5TTNiyddLNfux3czxm-NtIocraf6v8RVU",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": "xmesh-world:w1"
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {
+                "xmesh-world:w1": "canonical"
+              }
+            }
+          },
+          {
+            "subject": "WB",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000001b",
+            "key": "u3h-WQGsOBaKizc3FfVx7fdVxRj6ydxz4zkSbOT1Lwg",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": "xmesh-world:w2"
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {
+                "xmesh-world:w2": "canonical"
+              }
+            }
+          },
+          {
+            "subject": "X3",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000016",
+            "key": "oRgEM1nny0Xqi7IB58i5Q_E0VsCk0bEdQ0OngoCJ-7o",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": "xmesh-world:w1"
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {
+                "xmesh-world:w1": "canonical"
+              }
+            }
+          },
+          {
+            "subject": "X4",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000017",
+            "key": "gOoQued99QaiaxjHd66qY61sxrM6xuAj1ZMqa4lx7nY",
+            "roles": [
+              {
+                "role": "validator",
+                "scope": "xmesh-world:w1"
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {
+                "xmesh-world:w1": "validated"
+              }
+            }
+          }
+        ],
+        "root": "0e4e9fe8e98735366edee1f1b7568a86044bdd09636fb20a3eac79ba2331bf19"
+      }
+    },
+    {
+      "label": "issuers are delegating grants: a world admin's bucket keeps 16 of 17, by id",
+      "pin": "anchor-2-of-3",
+      "statements": [
+        "gD",
+        "gWA",
+        "gI0",
+        "gI1",
+        "gI2",
+        "gI3",
+        "gI4",
+        "gI5",
+        "gI6",
+        "gI7",
+        "gI8",
+        "gI9",
+        "gI10",
+        "gI11",
+        "gI12",
+        "gI13",
+        "gI14",
+        "gI15",
+        "gI16"
+      ],
+      "expected": {
+        "status": {
+          "gD": "in-force",
+          "gWA": "in-force",
+          "gI0": "in-force",
+          "gI1": "in-force",
+          "gI2": "in-force",
+          "gI3": "in-force",
+          "gI4": "in-force",
+          "gI5": "in-force",
+          "gI6": "in-force",
+          "gI7": "over-quota",
+          "gI8": "in-force",
+          "gI9": "in-force",
+          "gI10": "in-force",
+          "gI11": "in-force",
+          "gI12": "in-force",
+          "gI13": "in-force",
+          "gI14": "in-force",
+          "gI15": "in-force",
+          "gI16": "in-force"
+        },
+        "inForce": [
+          "auth-0251db8809c89f8cfe87e1102d1e2e0635d9a3e031a79a389bdee44df0977dc6",
+          "auth-13d85168e6f8535fc0cae1b038c6ce6af1ac38877b1f6a9aebca624128d0a09b",
+          "auth-1bf2ae483fe035d89d0ddfa66e65cd9af3b9223d8ffe893caaf4c3296f672b22",
+          "auth-2537206e3551782c3f6eeed8edcd371ffad5d732fd109887c4abdf366eb42c6e",
+          "auth-28f0218428ccd4cbd342108434940b7c6cfb41a2e3d17776d857f3cf66a94970",
+          "auth-2e10dd4e5e0f9214d1846bc60b6bee8a480f7b577274e8370d15cea939dd4739",
+          "auth-30137f9b79949f2c3420d31dd658226c3a9566c75b798caa6e661284e7202b8d",
+          "auth-43ecaa783c79e83600ee9698a25c64f90f3c96c9e12ad4e4555c270352b285c1",
+          "auth-459624d089f3f5465ffc68efdaf87892738bbfac475642177e5a99d2bf51c116",
+          "auth-80e4d945ef859a77f378878608d0539839ce72b81c79315daa68bba417b0fe28",
+          "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb",
+          "auth-a5e71bcee0ed391a1aa1a9c3b636847e2064ba23cbfb3908b6390a05b1ec6220",
+          "auth-b0b379c990873593b62b921c8fc04fa0c71f04e545c46f725baaa6874496d51f",
+          "auth-bdb8a449edb57a05d1913ab1615e1723a996e4f73ea7e23d639e9ee914bb38a9",
+          "auth-be9f6e1ca83c8bb22d208f90bb9e3d158ff0f697a01a219da66185b0084a7d0b",
+          "auth-d6756e8734ff36417251d69032339f4300dd5f81fe0e9d508305ca4e92e8749d",
+          "auth-e5ca19c421704b462eda9a8d1564380b1139df1b4325cd4e282dee98ae5f423e",
+          "auth-e81acf29745588b207b94b282bb917feabecf482fd990ff5f089fa3402ce9092"
+        ],
+        "live": [
+          "auth-0251db8809c89f8cfe87e1102d1e2e0635d9a3e031a79a389bdee44df0977dc6",
+          "auth-13d85168e6f8535fc0cae1b038c6ce6af1ac38877b1f6a9aebca624128d0a09b",
+          "auth-1bf2ae483fe035d89d0ddfa66e65cd9af3b9223d8ffe893caaf4c3296f672b22",
+          "auth-2537206e3551782c3f6eeed8edcd371ffad5d732fd109887c4abdf366eb42c6e",
+          "auth-28f0218428ccd4cbd342108434940b7c6cfb41a2e3d17776d857f3cf66a94970",
+          "auth-2e10dd4e5e0f9214d1846bc60b6bee8a480f7b577274e8370d15cea939dd4739",
+          "auth-30137f9b79949f2c3420d31dd658226c3a9566c75b798caa6e661284e7202b8d",
+          "auth-43ecaa783c79e83600ee9698a25c64f90f3c96c9e12ad4e4555c270352b285c1",
+          "auth-459624d089f3f5465ffc68efdaf87892738bbfac475642177e5a99d2bf51c116",
+          "auth-80e4d945ef859a77f378878608d0539839ce72b81c79315daa68bba417b0fe28",
+          "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb",
+          "auth-a5e71bcee0ed391a1aa1a9c3b636847e2064ba23cbfb3908b6390a05b1ec6220",
+          "auth-b0b379c990873593b62b921c8fc04fa0c71f04e545c46f725baaa6874496d51f",
+          "auth-bdb8a449edb57a05d1913ab1615e1723a996e4f73ea7e23d639e9ee914bb38a9",
+          "auth-be9f6e1ca83c8bb22d208f90bb9e3d158ff0f697a01a219da66185b0084a7d0b",
+          "auth-d6756e8734ff36417251d69032339f4300dd5f81fe0e9d508305ca4e92e8749d",
+          "auth-e5ca19c421704b462eda9a8d1564380b1139df1b4325cd4e282dee98ae5f423e",
+          "auth-e81acf29745588b207b94b282bb917feabecf482fd990ff5f089fa3402ce9092"
+        ],
+        "keptBy": {
+          "auth-0251db8809c89f8cfe87e1102d1e2e0635d9a3e031a79a389bdee44df0977dc6": "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb",
+          "auth-13d85168e6f8535fc0cae1b038c6ce6af1ac38877b1f6a9aebca624128d0a09b": "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb",
+          "auth-1bf2ae483fe035d89d0ddfa66e65cd9af3b9223d8ffe893caaf4c3296f672b22": "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb",
+          "auth-2537206e3551782c3f6eeed8edcd371ffad5d732fd109887c4abdf366eb42c6e": "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb",
+          "auth-28f0218428ccd4cbd342108434940b7c6cfb41a2e3d17776d857f3cf66a94970": "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb",
+          "auth-2e10dd4e5e0f9214d1846bc60b6bee8a480f7b577274e8370d15cea939dd4739": "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb",
+          "auth-30137f9b79949f2c3420d31dd658226c3a9566c75b798caa6e661284e7202b8d": "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb",
+          "auth-43ecaa783c79e83600ee9698a25c64f90f3c96c9e12ad4e4555c270352b285c1": "anchor",
+          "auth-459624d089f3f5465ffc68efdaf87892738bbfac475642177e5a99d2bf51c116": "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb",
+          "auth-80e4d945ef859a77f378878608d0539839ce72b81c79315daa68bba417b0fe28": "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb",
+          "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb": "auth-43ecaa783c79e83600ee9698a25c64f90f3c96c9e12ad4e4555c270352b285c1",
+          "auth-a5e71bcee0ed391a1aa1a9c3b636847e2064ba23cbfb3908b6390a05b1ec6220": "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb",
+          "auth-b0b379c990873593b62b921c8fc04fa0c71f04e545c46f725baaa6874496d51f": "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb",
+          "auth-bdb8a449edb57a05d1913ab1615e1723a996e4f73ea7e23d639e9ee914bb38a9": "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb",
+          "auth-be9f6e1ca83c8bb22d208f90bb9e3d158ff0f697a01a219da66185b0084a7d0b": "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb",
+          "auth-d6756e8734ff36417251d69032339f4300dd5f81fe0e9d508305ca4e92e8749d": "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb",
+          "auth-e5ca19c421704b462eda9a8d1564380b1139df1b4325cd4e282dee98ae5f423e": "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb",
+          "auth-e81acf29745588b207b94b282bb917feabecf482fd990ff5f089fa3402ce9092": "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb"
+        },
+        "roles": [
+          {
+            "subject": "D",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000012",
+            "key": "buCR_SgKm2hVT6c8WIEl1H00JcaKJroja02tkPkKj5I",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-000000000100",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000100",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "issuer",
+                "scope": "xmesh-world:w1"
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {
+                "xmesh-world:w1": "none"
+              }
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-000000000101",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000101",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "issuer",
+                "scope": "xmesh-world:w1"
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {
+                "xmesh-world:w1": "none"
+              }
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-000000000102",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000102",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "issuer",
+                "scope": "xmesh-world:w1"
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {
+                "xmesh-world:w1": "none"
+              }
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-000000000103",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000103",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "issuer",
+                "scope": "xmesh-world:w1"
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {
+                "xmesh-world:w1": "none"
+              }
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-000000000104",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000104",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "issuer",
+                "scope": "xmesh-world:w1"
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {
+                "xmesh-world:w1": "none"
+              }
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-000000000105",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000105",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "issuer",
+                "scope": "xmesh-world:w1"
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {
+                "xmesh-world:w1": "none"
+              }
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-000000000106",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000106",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "issuer",
+                "scope": "xmesh-world:w1"
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {
+                "xmesh-world:w1": "none"
+              }
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-000000000108",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000108",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "issuer",
+                "scope": "xmesh-world:w1"
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {
+                "xmesh-world:w1": "none"
+              }
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-000000000109",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000109",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "issuer",
+                "scope": "xmesh-world:w1"
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {
+                "xmesh-world:w1": "none"
+              }
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-00000000010a",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000010a",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "issuer",
+                "scope": "xmesh-world:w1"
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {
+                "xmesh-world:w1": "none"
+              }
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-00000000010b",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000010b",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "issuer",
+                "scope": "xmesh-world:w1"
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {
+                "xmesh-world:w1": "none"
+              }
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-00000000010c",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000010c",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "issuer",
+                "scope": "xmesh-world:w1"
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {
+                "xmesh-world:w1": "none"
+              }
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-00000000010d",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000010d",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "issuer",
+                "scope": "xmesh-world:w1"
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {
+                "xmesh-world:w1": "none"
+              }
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-00000000010e",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000010e",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "issuer",
+                "scope": "xmesh-world:w1"
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {
+                "xmesh-world:w1": "none"
+              }
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-00000000010f",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000010f",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "issuer",
+                "scope": "xmesh-world:w1"
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {
+                "xmesh-world:w1": "none"
+              }
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-000000000110",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000110",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "issuer",
+                "scope": "xmesh-world:w1"
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {
+                "xmesh-world:w1": "none"
+              }
+            }
+          },
+          {
+            "subject": "WA",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000013",
+            "key": "Qej94TKtZw5TTNiyddLNfux3czxm-NtIocraf6v8RVU",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": "xmesh-world:w1"
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {
+                "xmesh-world:w1": "canonical"
+              }
+            }
+          }
+        ],
+        "root": "377b5196a0f98edc88dcc3854c5fd2eca035127f4a5e48ba95d9207a9a881a64"
+      }
+    },
+    {
+      "label": "rescue falls through: the lower endorser's bucket is full, so the next endorser keeps the grant (test parameter quota = 3)",
+      "pin": "anchor-2-of-3",
+      "testQuota": 3,
+      "statements": [
+        "gA",
+        "fB",
+        "fV",
+        "fP",
+        "fRevoke",
+        "fEndorseA",
+        "fEndorseB",
+        "fFill"
+      ],
+      "expected": {
+        "status": {
+          "gA": "in-force",
+          "fB": "in-force",
+          "fV": "removed",
+          "fP": "in-force",
+          "fRevoke": "in-force",
+          "fEndorseA": "in-force",
+          "fEndorseB": "in-force",
+          "fFill": "in-force"
+        },
+        "inForce": [
+          "auth-0bae377b4a8e6321e4bd24872401709853b33f3bf2a00990949099563f33be51",
+          "auth-2a0795aa2c6e52f67ec0c83d384b65baf2265e1d9f52e8efcbba744f46c74e84",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-60571c6b5eae28a7e676cbbb8223cafedb300805a48cf4168abb71e4549b341f",
+          "auth-ba934bb68bd0f5e7f03b3f453bea80ce6fee6c43d171b6a6918e67bffe1d4b2e",
+          "auth-ef9837960f5f0f82f196d4943480824934670d6c3e91147bfbe95ff96d2ad598",
+          "auth-f28934e703ba6b55218155c03cee700e1cd768de6d7972aa7826054c4c4d32cc"
+        ],
+        "live": [
+          "auth-0bae377b4a8e6321e4bd24872401709853b33f3bf2a00990949099563f33be51",
+          "auth-2a0795aa2c6e52f67ec0c83d384b65baf2265e1d9f52e8efcbba744f46c74e84",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-5e0a3f3f51f8c1bb11f6fe1d15f84c69be334bfff2025abe64b789829af71db0",
+          "auth-60571c6b5eae28a7e676cbbb8223cafedb300805a48cf4168abb71e4549b341f",
+          "auth-ba934bb68bd0f5e7f03b3f453bea80ce6fee6c43d171b6a6918e67bffe1d4b2e",
+          "auth-ef9837960f5f0f82f196d4943480824934670d6c3e91147bfbe95ff96d2ad598",
+          "auth-f28934e703ba6b55218155c03cee700e1cd768de6d7972aa7826054c4c4d32cc"
+        ],
+        "keptBy": {
+          "auth-0bae377b4a8e6321e4bd24872401709853b33f3bf2a00990949099563f33be51": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-2a0795aa2c6e52f67ec0c83d384b65baf2265e1d9f52e8efcbba744f46c74e84": "auth-ba934bb68bd0f5e7f03b3f453bea80ce6fee6c43d171b6a6918e67bffe1d4b2e",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1": "anchor",
+          "auth-60571c6b5eae28a7e676cbbb8223cafedb300805a48cf4168abb71e4549b341f": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-ba934bb68bd0f5e7f03b3f453bea80ce6fee6c43d171b6a6918e67bffe1d4b2e": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-ef9837960f5f0f82f196d4943480824934670d6c3e91147bfbe95ff96d2ad598": "auth-ba934bb68bd0f5e7f03b3f453bea80ce6fee6c43d171b6a6918e67bffe1d4b2e",
+          "auth-f28934e703ba6b55218155c03cee700e1cd768de6d7972aa7826054c4c4d32cc": "auth-ba934bb68bd0f5e7f03b3f453bea80ce6fee6c43d171b6a6918e67bffe1d4b2e"
+        },
+        "roles": [
+          {
+            "subject": "A",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000a",
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kc as 018f47a0-7b21-7abc-8def-000000000111",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000111",
+            "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-000000000113",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000113",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "participant",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kv as 018f47a0-7b21-7abc-8def-000000000114",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000114",
+            "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY",
+            "roles": [
+              {
+                "role": "participant",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {}
+            }
+          }
+        ],
+        "root": "08b6e9fb26e19dd661fc997945e55810817f3f62c7049060921953115a35f687"
+      }
+    },
+    {
+      "label": "an issuer revokes a seat it granted",
+      "pin": "anchor-2-of-3",
+      "statements": [
+        "gD",
+        "gWA",
+        "gSI",
+        "gS1",
+        "rS1"
+      ],
+      "expected": {
+        "status": {
+          "gD": "in-force",
+          "gWA": "in-force",
+          "gSI": "in-force",
+          "gS1": "removed",
+          "rS1": "in-force"
+        },
+        "inForce": [
+          "auth-43ecaa783c79e83600ee9698a25c64f90f3c96c9e12ad4e4555c270352b285c1",
+          "auth-4fb54aaadf85d38bbd1c871f9828b5b5d98c7e40676cc34af628630ba0a31da2",
+          "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb",
+          "auth-f99058ade43b386a090c1fbeffc3c95f8ed22520183b888b4828c5f5686e8119"
+        ],
+        "live": [
+          "auth-43ecaa783c79e83600ee9698a25c64f90f3c96c9e12ad4e4555c270352b285c1",
+          "auth-4fb54aaadf85d38bbd1c871f9828b5b5d98c7e40676cc34af628630ba0a31da2",
+          "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb",
+          "auth-f99058ade43b386a090c1fbeffc3c95f8ed22520183b888b4828c5f5686e8119"
+        ],
+        "keptBy": {
+          "auth-43ecaa783c79e83600ee9698a25c64f90f3c96c9e12ad4e4555c270352b285c1": "anchor",
+          "auth-4fb54aaadf85d38bbd1c871f9828b5b5d98c7e40676cc34af628630ba0a31da2": "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb",
+          "auth-97aba823a8abbc36b3f37437642978a84f19b29ee08e2c8632958b1c01ec3acb": "auth-43ecaa783c79e83600ee9698a25c64f90f3c96c9e12ad4e4555c270352b285c1",
+          "auth-f99058ade43b386a090c1fbeffc3c95f8ed22520183b888b4828c5f5686e8119": "auth-4fb54aaadf85d38bbd1c871f9828b5b5d98c7e40676cc34af628630ba0a31da2"
+        },
+        "roles": [
+          {
+            "subject": "D",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000012",
+            "key": "buCR_SgKm2hVT6c8WIEl1H00JcaKJroja02tkPkKj5I",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "SI",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000014",
+            "key": "tHQLpOD34FdvEegUnbuyUpwhIhPbZ5gx-10bIh6EVS0",
+            "roles": [
+              {
+                "role": "issuer",
+                "scope": "xmesh-world:w1"
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {
+                "xmesh-world:w1": "none"
+              }
+            }
+          },
+          {
+            "subject": "WA",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000013",
+            "key": "Qej94TKtZw5TTNiyddLNfux3czxm-NtIocraf6v8RVU",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": "xmesh-world:w1"
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {
+                "xmesh-world:w1": "canonical"
+              }
+            }
+          }
+        ],
+        "root": "af3d9f98f8ab52683381c7ed2f95ac936d74fc08c2096a4b07ff297a6b888aa8"
+      }
+    },
+    {
+      "label": "a single-key anchor is the 1-of-1 case, and its holder resolves as anchor",
+      "pin": "anchor-1-of-1",
+      "statements": [
+        "gV1",
+        "gA"
+      ],
+      "expected": {
+        "status": {
+          "gV1": "in-force",
+          "gA": "in-force"
+        },
+        "inForce": [
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-6ee68f1fd648ca36c0d22cbbf5eaf8bf02a4b915e1b4eb9c4b44d27bb2c8eecc"
+        ],
+        "live": [
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-6ee68f1fd648ca36c0d22cbbf5eaf8bf02a4b915e1b4eb9c4b44d27bb2c8eecc"
+        ],
+        "keptBy": {
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1": "anchor",
+          "auth-6ee68f1fd648ca36c0d22cbbf5eaf8bf02a4b915e1b4eb9c4b44d27bb2c8eecc": "anchor"
+        },
+        "roles": [
+          {
+            "subject": "A",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000a",
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "V",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000b",
+            "key": "RyG1tjInLmWmjdp6wltBhfiwGRbbGFwUKH25Lit3D64",
+            "roles": [
+              {
+                "role": "validator",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "validated",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "a1",
+            "nodeId": "018f47a0-7b21-7abc-8def-0000000000a1",
+            "key": "vHy8tWNjdfodgkNNRmck2SN39TuYBpXdSdJtDOEiBaU",
+            "roles": [
+              {
+                "role": "anchor",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          }
+        ],
+        "root": "9e0e5acad622705e915b7dd356d34deb55b0964e7923147c88411821b5204d54"
+      }
+    },
+    {
+      "label": "under a threshold of 1 every pinned member alone is the anchor",
+      "pin": "anchor-1-of-2",
+      "statements": [
+        "gV1",
+        "gVa2"
+      ],
+      "expected": {
+        "status": {
+          "gV1": "in-force",
+          "gVa2": "in-force"
+        },
+        "inForce": [
+          "auth-076031fcf26cd4f6ab676b2f2615534b9f244affefff27b10f1ab9d21cbfe306",
+          "auth-6ee68f1fd648ca36c0d22cbbf5eaf8bf02a4b915e1b4eb9c4b44d27bb2c8eecc"
+        ],
+        "live": [
+          "auth-076031fcf26cd4f6ab676b2f2615534b9f244affefff27b10f1ab9d21cbfe306",
+          "auth-6ee68f1fd648ca36c0d22cbbf5eaf8bf02a4b915e1b4eb9c4b44d27bb2c8eecc"
+        ],
+        "keptBy": {
+          "auth-076031fcf26cd4f6ab676b2f2615534b9f244affefff27b10f1ab9d21cbfe306": "anchor",
+          "auth-6ee68f1fd648ca36c0d22cbbf5eaf8bf02a4b915e1b4eb9c4b44d27bb2c8eecc": "anchor"
+        },
+        "roles": [
+          {
+            "subject": "V",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000b",
+            "key": "RyG1tjInLmWmjdp6wltBhfiwGRbbGFwUKH25Lit3D64",
+            "roles": [
+              {
+                "role": "validator",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "validated",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "V2",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000019",
+            "key": "UrzUxoqKCdmM2dGNim-j6Ok1WVTssB4q37-6XO-uTnk",
+            "roles": [
+              {
+                "role": "validator",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "validated",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "a1",
+            "nodeId": "018f47a0-7b21-7abc-8def-0000000000a1",
+            "key": "vHy8tWNjdfodgkNNRmck2SN39TuYBpXdSdJtDOEiBaU",
+            "roles": [
+              {
+                "role": "anchor",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "a2",
+            "nodeId": "018f47a0-7b21-7abc-8def-0000000000a2",
+            "key": "Zej5sLxurhJBafBXb5c2LSlajPX3cLReFDV85kfTPuw",
+            "roles": [
+              {
+                "role": "anchor",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          }
+        ],
+        "root": "69e0da7da2975a41d37c0a5921c064e74cfbfc4c609094bc6db4cee03cbd728d"
+      }
+    },
+    {
+      "label": "at the quota a bucket keeps removals first, then grants by ascending id (test parameter quota = 2)",
+      "pin": "anchor-2-of-3",
+      "testQuota": 2,
+      "statements": [
+        "gA",
+        "gV",
+        "gP",
+        "gR",
+        "gP2",
+        "rP2"
+      ],
+      "expected": {
+        "status": {
+          "gA": "in-force",
+          "gV": "in-force",
+          "gP": "in-force",
+          "gR": "over-quota",
+          "gP2": "removed",
+          "rP2": "in-force"
+        },
+        "inForce": [
+          "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-90fe6da3187b891e9692dfcc204e7868f1ec106a2cd4ea5df47d9e69bb8bef50",
+          "auth-9ccdd6df33a5a7cda6345b9c3fa1910182b77aae84ba98c79846ee03efaa6f59"
+        ],
+        "live": [
+          "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-90fe6da3187b891e9692dfcc204e7868f1ec106a2cd4ea5df47d9e69bb8bef50",
+          "auth-9ccdd6df33a5a7cda6345b9c3fa1910182b77aae84ba98c79846ee03efaa6f59"
+        ],
+        "keptBy": {
+          "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1": "anchor",
+          "auth-90fe6da3187b891e9692dfcc204e7868f1ec106a2cd4ea5df47d9e69bb8bef50": "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+          "auth-9ccdd6df33a5a7cda6345b9c3fa1910182b77aae84ba98c79846ee03efaa6f59": "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f"
+        },
+        "roles": [
+          {
+            "subject": "A",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000a",
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "P",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000e",
+            "key": "rNzISU1Fj0SnqqwdaoTsYk2u6IQ22yribme6ZFoQYig",
+            "roles": [
+              {
+                "role": "participant",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "V",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000b",
+            "key": "RyG1tjInLmWmjdp6wltBhfiwGRbbGFwUKH25Lit3D64",
+            "roles": [
+              {
+                "role": "validator",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "validated",
+              "insideScope": {}
+            }
+          }
+        ],
+        "root": "0a3cb0ebcdd3ff5430294aadcb8009c82eb350d32f13a6706176617de04352ef"
+      }
+    },
+    {
+      "label": "an over-quota revoke removes nothing (test parameter quota = 2)",
+      "pin": "anchor-2-of-3",
+      "testQuota": 2,
+      "statements": [
+        "gA",
+        "gV",
+        "gP",
+        "gR",
+        "gP2",
+        "rP2",
+        "rRv",
+        "rPv"
+      ],
+      "expected": {
+        "status": {
+          "gA": "in-force",
+          "gV": "in-force",
+          "gP": "over-quota",
+          "gR": "removed",
+          "gP2": "removed",
+          "rP2": "in-force",
+          "rRv": "in-force",
+          "rPv": "over-quota"
+        },
+        "inForce": [
+          "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+          "auth-170c36b7abc7d0d945e30086a4eb61bfd5f3d97d8ec7facd6ec5e0c1e6905f43",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-9ccdd6df33a5a7cda6345b9c3fa1910182b77aae84ba98c79846ee03efaa6f59"
+        ],
+        "live": [
+          "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+          "auth-170c36b7abc7d0d945e30086a4eb61bfd5f3d97d8ec7facd6ec5e0c1e6905f43",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-9ccdd6df33a5a7cda6345b9c3fa1910182b77aae84ba98c79846ee03efaa6f59"
+        ],
+        "keptBy": {
+          "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-170c36b7abc7d0d945e30086a4eb61bfd5f3d97d8ec7facd6ec5e0c1e6905f43": "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1": "anchor",
+          "auth-9ccdd6df33a5a7cda6345b9c3fa1910182b77aae84ba98c79846ee03efaa6f59": "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f"
+        },
+        "roles": [
+          {
+            "subject": "A",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000a",
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "V",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000b",
+            "key": "RyG1tjInLmWmjdp6wltBhfiwGRbbGFwUKH25Lit3D64",
+            "roles": [
+              {
+                "role": "validator",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "validated",
+              "insideScope": {}
+            }
+          }
+        ],
+        "root": "ecb1f91b0b00567a5dfb9adbe1d84513bcc4960197feff75e72608bb8e219a3c"
+      }
+    },
+    {
+      "label": "a bucket keeps at most the delegate quota of delegating grants, decided by id; the anchor's bucket is exempt (test parameter delegateQuota = 1)",
+      "pin": "anchor-2-of-3",
+      "testDelegateQuota": 1,
+      "statements": [
+        "gA",
+        "gW",
+        "gV",
+        "gV2",
+        "gP3"
+      ],
+      "expected": {
+        "status": {
+          "gA": "in-force",
+          "gW": "in-force",
+          "gV": "in-force",
+          "gV2": "over-quota",
+          "gP3": "in-force"
+        },
+        "inForce": [
+          "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-b0d418db5ae886310bc434411fb89329e38c23072d76c3ee90b54a332d1f8a93",
+          "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d"
+        ],
+        "live": [
+          "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-b0d418db5ae886310bc434411fb89329e38c23072d76c3ee90b54a332d1f8a93",
+          "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d"
+        ],
+        "keptBy": {
+          "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1": "anchor",
+          "auth-b0d418db5ae886310bc434411fb89329e38c23072d76c3ee90b54a332d1f8a93": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d": "anchor"
+        },
+        "roles": [
+          {
+            "subject": "A",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000a",
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "P3",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000001a",
+            "key": "LbeXY24yPtV26bDgPifLkhcaiWtj6RhvDUpDucfTgtE",
+            "roles": [
+              {
+                "role": "participant",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "V",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000b",
+            "key": "RyG1tjInLmWmjdp6wltBhfiwGRbbGFwUKH25Lit3D64",
+            "roles": [
+              {
+                "role": "validator",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "validated",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "W",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000c",
+            "key": "VRVPQgZepaG-oFRjgmviaE65LfksEAAnqrquV8pVQgc",
+            "roles": [
+              {
+                "role": "validator",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "validated",
+              "insideScope": {}
+            }
+          }
+        ],
+        "root": "e93f78f144679c9a273c60679380739123b02f219b9a1904415800a427cb3d3c"
+      }
+    },
+    {
+      "label": "copies of an anchor statement are judged one by one, never merged",
+      "pin": "anchor-2-of-3",
+      "statements": [
+        "gA",
+        "splitA1",
+        "splitA2"
+      ],
+      "expected": {
+        "status": {
+          "gA": "in-force",
+          "splitA1": "invalid",
+          "splitA2": "invalid"
+        },
+        "inForce": [
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1"
+        ],
+        "live": [
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1"
+        ],
+        "keptBy": {
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1": "anchor"
+        },
+        "roles": [
+          {
+            "subject": "A",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000a",
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          }
+        ],
+        "root": "28c8d8eb8e75f60fd3c38ce531a9327f45a131642f44804ae724bee6ab15178b"
+      }
+    },
+    {
+      "label": "one copy that meets the threshold makes the statement valid",
+      "pin": "anchor-2-of-3",
+      "statements": [
+        "splitA1",
+        "splitA2",
+        "splitFull"
+      ],
+      "expected": {
+        "status": {
+          "splitA1": "in-force",
+          "splitA2": "in-force",
+          "splitFull": "in-force"
+        },
+        "inForce": [
+          "auth-d1aeee7352ba975ac359ad69c9f26a55bd9f890d88840c896cc8243a677d835c"
+        ],
+        "live": [
+          "auth-d1aeee7352ba975ac359ad69c9f26a55bd9f890d88840c896cc8243a677d835c"
+        ],
+        "keptBy": {
+          "auth-d1aeee7352ba975ac359ad69c9f26a55bd9f890d88840c896cc8243a677d835c": "anchor"
+        },
+        "roles": [
+          {
+            "subject": "H",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000d",
+            "key": "WRLawCDc2rp2fOymQkPoRRdiFcSF5BjlD4AgXYEhipE",
+            "roles": [
+              {
+                "role": "validator",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "validated",
+              "insideScope": {}
+            }
+          }
+        ],
+        "root": "a3e064642dfa7520b6c696ef4baf0a5479d2a547af047e6df68cc24f782fdbea"
+      }
+    },
+    {
+      "label": "an endorse does not override a revoke",
+      "pin": "anchor-2-of-3",
+      "statements": [
+        "gA",
+        "gW",
+        "gV",
+        "gP",
+        "gR",
+        "gQ",
+        "rA",
+        "eVonly",
+        "rVanchor"
+      ],
+      "expected": {
+        "status": {
+          "gA": "removed",
+          "gW": "in-force",
+          "gV": "removed",
+          "gP": "dead",
+          "gR": "dead",
+          "gQ": "in-force",
+          "rA": "in-force",
+          "eVonly": "in-force",
+          "rVanchor": "in-force"
+        },
+        "inForce": [
+          "auth-2341a2131fb673270b41833f685f832a3c4e696e3f295933f91e8208c8e20f88",
+          "auth-5096c71b6bb032d6c6ce815633bf0a23af4f4808b61ef92012f404edc705c923",
+          "auth-64cdb29ba89c39a45ce10caee2be159d9a708ef427734a8f7ec24d02d3b0d0bb",
+          "auth-c13092fc7e04547da38e131d50355afa58e4cc944c320e9559d755516a12e9dd",
+          "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d"
+        ],
+        "live": [
+          "auth-2341a2131fb673270b41833f685f832a3c4e696e3f295933f91e8208c8e20f88",
+          "auth-5096c71b6bb032d6c6ce815633bf0a23af4f4808b61ef92012f404edc705c923",
+          "auth-64cdb29ba89c39a45ce10caee2be159d9a708ef427734a8f7ec24d02d3b0d0bb",
+          "auth-c13092fc7e04547da38e131d50355afa58e4cc944c320e9559d755516a12e9dd",
+          "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d"
+        ],
+        "keptBy": {
+          "auth-2341a2131fb673270b41833f685f832a3c4e696e3f295933f91e8208c8e20f88": "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d",
+          "auth-5096c71b6bb032d6c6ce815633bf0a23af4f4808b61ef92012f404edc705c923": "anchor",
+          "auth-64cdb29ba89c39a45ce10caee2be159d9a708ef427734a8f7ec24d02d3b0d0bb": "anchor",
+          "auth-c13092fc7e04547da38e131d50355afa58e4cc944c320e9559d755516a12e9dd": "anchor",
+          "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d": "anchor"
+        },
+        "roles": [
+          {
+            "subject": "Q",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000010",
+            "key": "tygv5HL5dkHBcJeCGlN4dKqqUyZFrTTb1ZhzMaTnP40",
+            "roles": [
+              {
+                "role": "participant",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "W",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000c",
+            "key": "VRVPQgZepaG-oFRjgmviaE65LfksEAAnqrquV8pVQgc",
+            "roles": [
+              {
+                "role": "validator",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "validated",
+              "insideScope": {}
+            }
+          }
+        ],
+        "root": "61393698f6b82215096ca1b6905669e4cd2c092248db6437abfcb79e318e1358"
+      }
+    },
+    {
+      "label": "rescue reaches past a dead grant to the revoke that cut it off",
+      "pin": "anchor-2-of-3",
+      "statements": [
+        "gA",
+        "gV",
+        "gP",
+        "rA",
+        "ePanchor"
+      ],
+      "expected": {
+        "status": {
+          "gA": "removed",
+          "gV": "dead",
+          "gP": "in-force",
+          "rA": "in-force",
+          "ePanchor": "in-force"
+        },
+        "inForce": [
+          "auth-64cdb29ba89c39a45ce10caee2be159d9a708ef427734a8f7ec24d02d3b0d0bb",
+          "auth-90fe6da3187b891e9692dfcc204e7868f1ec106a2cd4ea5df47d9e69bb8bef50",
+          "auth-fdfa7a9d18bd80ae44c6644d43ecc63e0090b09aea0c2bbd49ac3e46cc9dfef1"
+        ],
+        "live": [
+          "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-64cdb29ba89c39a45ce10caee2be159d9a708ef427734a8f7ec24d02d3b0d0bb",
+          "auth-90fe6da3187b891e9692dfcc204e7868f1ec106a2cd4ea5df47d9e69bb8bef50",
+          "auth-fdfa7a9d18bd80ae44c6644d43ecc63e0090b09aea0c2bbd49ac3e46cc9dfef1"
+        ],
+        "keptBy": {
+          "auth-64cdb29ba89c39a45ce10caee2be159d9a708ef427734a8f7ec24d02d3b0d0bb": "anchor",
+          "auth-90fe6da3187b891e9692dfcc204e7868f1ec106a2cd4ea5df47d9e69bb8bef50": "anchor",
+          "auth-fdfa7a9d18bd80ae44c6644d43ecc63e0090b09aea0c2bbd49ac3e46cc9dfef1": "anchor"
+        },
+        "roles": [
+          {
+            "subject": "P",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000e",
+            "key": "rNzISU1Fj0SnqqwdaoTsYk2u6IQ22yribme6ZFoQYig",
+            "roles": [
+              {
+                "role": "participant",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {}
+            }
+          }
+        ],
+        "root": "c1b97e1de8774b03a8c23c983b4fa7de3e09aa06fac03aac79d493f29d882eaa"
+      }
+    },
+    {
+      "label": "a revoke acts target by target: on its chain it removes, off it and on a revoke it does nothing",
+      "pin": "anchor-2-of-3",
+      "statements": [
+        "gA",
+        "gW",
+        "gV",
+        "gP",
+        "gQ",
+        "rWQ",
+        "rMix"
+      ],
+      "expected": {
+        "status": {
+          "gA": "in-force",
+          "gW": "in-force",
+          "gV": "in-force",
+          "gP": "removed",
+          "gQ": "removed",
+          "rWQ": "in-force",
+          "rMix": "in-force"
+        },
+        "inForce": [
+          "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+          "auth-2e53b6150d927b33dfcae432c679f680663d018d9a983f6c638bc2d29a16f3f6",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-bfcc6133f7b87f504961d10929b8624b198a17a7b16f3815dda170a217c4471c",
+          "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d"
+        ],
+        "live": [
+          "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f",
+          "auth-2e53b6150d927b33dfcae432c679f680663d018d9a983f6c638bc2d29a16f3f6",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-bfcc6133f7b87f504961d10929b8624b198a17a7b16f3815dda170a217c4471c",
+          "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d"
+        ],
+        "keptBy": {
+          "auth-153b581feef3425d8a3d70f65d796184036a3b213380d1b35918e3ec93f7ca9f": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-2e53b6150d927b33dfcae432c679f680663d018d9a983f6c638bc2d29a16f3f6": "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1": "anchor",
+          "auth-bfcc6133f7b87f504961d10929b8624b198a17a7b16f3815dda170a217c4471c": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-eeb92147b14f195c77d7a03a3d20679bae19c7d148c5a8bca9cd33494440eb0d": "anchor"
+        },
+        "roles": [
+          {
+            "subject": "A",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000a",
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "V",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000b",
+            "key": "RyG1tjInLmWmjdp6wltBhfiwGRbbGFwUKH25Lit3D64",
+            "roles": [
+              {
+                "role": "validator",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "validated",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "W",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000c",
+            "key": "VRVPQgZepaG-oFRjgmviaE65LfksEAAnqrquV8pVQgc",
+            "roles": [
+              {
+                "role": "validator",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "validated",
+              "insideScope": {}
+            }
+          }
+        ],
+        "root": "bc3d2b11643a7ed4dd13d3d024f6016224d19097c4957bbc1b3af97a0aa2d87b"
+      }
+    },
+    {
+      "label": "review attack r2: admins hung under over-quota grants are dead, never rescued",
+      "pin": "anchor-2-of-3",
+      "statements": [
+        "gA",
+        "r2D0",
+        "r2D1",
+        "r2D2",
+        "r2D3",
+        "r2D4",
+        "r2D5",
+        "r2D6",
+        "r2D7",
+        "r2D8",
+        "r2D9",
+        "r2D10",
+        "r2D11",
+        "r2D12",
+        "r2D13",
+        "r2D14",
+        "r2D15",
+        "r2D16",
+        "r2D17",
+        "r2D18",
+        "r2D19",
+        "r2C_r2D7",
+        "r2C_r2D3",
+        "r2C_r2D8",
+        "r2C_r2D4",
+        "r2E"
+      ],
+      "expected": {
+        "status": {
+          "gA": "in-force",
+          "r2D0": "in-force",
+          "r2D1": "in-force",
+          "r2D2": "in-force",
+          "r2D3": "over-quota",
+          "r2D4": "over-quota",
+          "r2D5": "in-force",
+          "r2D6": "in-force",
+          "r2D7": "over-quota",
+          "r2D8": "over-quota",
+          "r2D9": "in-force",
+          "r2D10": "in-force",
+          "r2D11": "in-force",
+          "r2D12": "in-force",
+          "r2D13": "in-force",
+          "r2D14": "in-force",
+          "r2D15": "in-force",
+          "r2D16": "in-force",
+          "r2D17": "in-force",
+          "r2D18": "in-force",
+          "r2D19": "in-force",
+          "r2C_r2D7": "dead",
+          "r2C_r2D3": "dead",
+          "r2C_r2D8": "dead",
+          "r2C_r2D4": "dead",
+          "r2E": "in-force"
+        },
+        "inForce": [
+          "auth-04afcc81cfeef49b796f357ee2a076daa3a75fc25fa9374f19c3823020308a45",
+          "auth-20bae751271076e7998ffb599eea47b4c05ac765de1124b14fe168032f29f811",
+          "auth-252a34a317c018117fcab73ebc263121acc87d7b46df4b30ee8ce29e80562583",
+          "auth-2be50c61f66e28c0796975adfa184db37663851a56576764766ca4238fa1b2ba",
+          "auth-2c6ece89a4167c7feeee51ab5692f70f697bbcf1bdaf9dc79c71e99babc07b1b",
+          "auth-2f5b015482631fe25cb8b1893ee5535b55527d21b63b3b1e860852b7450a9071",
+          "auth-3325197a547b376e2425452f5bbd5796677b971a8b4e82eaf01cd0080d556771",
+          "auth-3aad4b02dea7470d5b921e9de24e3cc8ea4f9de760549244294cd93acddf9af7",
+          "auth-3cea07c9d185366119fbc26aca44569871e2bee3fc0a38102f63898a18a66b2e",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-4f2471d7aaf8eee81c72b4d56f3ff01b8c3b94b582ad8a62ee8d15302bf44eff",
+          "auth-6d5ccdc53c04445578338337133e89bfb29a8cf25952dc9665c98700cb360a5e",
+          "auth-749fddbd19eb95f2d13cd10079045f14e6d173dfcab08f0e5e112d9c7aafd364",
+          "auth-7f7eed323129d3b64533da02110b590782e37cddf690c9235f4e8fdcf5605356",
+          "auth-860cd801ce8660b3fbd667be92c134eb55f56699b8500226d15ee5ee0f3d3526",
+          "auth-88ac8a97163bf2f9cdc99481de9f75bd990cddc6cadb67db319e0a7a8698c079",
+          "auth-9e5a6788d0d1d3ddb5b7c401e4827d4c51978fa5e93a4ebae0e4946d73783f74",
+          "auth-a0a77732fcc11e753cb5d541e2e905ad522c5d24108c644ccd94ff5ab4be4db8"
+        ],
+        "live": [
+          "auth-04afcc81cfeef49b796f357ee2a076daa3a75fc25fa9374f19c3823020308a45",
+          "auth-20bae751271076e7998ffb599eea47b4c05ac765de1124b14fe168032f29f811",
+          "auth-252a34a317c018117fcab73ebc263121acc87d7b46df4b30ee8ce29e80562583",
+          "auth-2be50c61f66e28c0796975adfa184db37663851a56576764766ca4238fa1b2ba",
+          "auth-2c6ece89a4167c7feeee51ab5692f70f697bbcf1bdaf9dc79c71e99babc07b1b",
+          "auth-2f5b015482631fe25cb8b1893ee5535b55527d21b63b3b1e860852b7450a9071",
+          "auth-3325197a547b376e2425452f5bbd5796677b971a8b4e82eaf01cd0080d556771",
+          "auth-3aad4b02dea7470d5b921e9de24e3cc8ea4f9de760549244294cd93acddf9af7",
+          "auth-3cea07c9d185366119fbc26aca44569871e2bee3fc0a38102f63898a18a66b2e",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-4f2471d7aaf8eee81c72b4d56f3ff01b8c3b94b582ad8a62ee8d15302bf44eff",
+          "auth-6d5ccdc53c04445578338337133e89bfb29a8cf25952dc9665c98700cb360a5e",
+          "auth-749fddbd19eb95f2d13cd10079045f14e6d173dfcab08f0e5e112d9c7aafd364",
+          "auth-7f7eed323129d3b64533da02110b590782e37cddf690c9235f4e8fdcf5605356",
+          "auth-860cd801ce8660b3fbd667be92c134eb55f56699b8500226d15ee5ee0f3d3526",
+          "auth-88ac8a97163bf2f9cdc99481de9f75bd990cddc6cadb67db319e0a7a8698c079",
+          "auth-9e5a6788d0d1d3ddb5b7c401e4827d4c51978fa5e93a4ebae0e4946d73783f74",
+          "auth-a0a77732fcc11e753cb5d541e2e905ad522c5d24108c644ccd94ff5ab4be4db8"
+        ],
+        "keptBy": {
+          "auth-04afcc81cfeef49b796f357ee2a076daa3a75fc25fa9374f19c3823020308a45": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-20bae751271076e7998ffb599eea47b4c05ac765de1124b14fe168032f29f811": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-252a34a317c018117fcab73ebc263121acc87d7b46df4b30ee8ce29e80562583": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-2be50c61f66e28c0796975adfa184db37663851a56576764766ca4238fa1b2ba": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-2c6ece89a4167c7feeee51ab5692f70f697bbcf1bdaf9dc79c71e99babc07b1b": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-2f5b015482631fe25cb8b1893ee5535b55527d21b63b3b1e860852b7450a9071": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-3325197a547b376e2425452f5bbd5796677b971a8b4e82eaf01cd0080d556771": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-3aad4b02dea7470d5b921e9de24e3cc8ea4f9de760549244294cd93acddf9af7": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-3cea07c9d185366119fbc26aca44569871e2bee3fc0a38102f63898a18a66b2e": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1": "anchor",
+          "auth-4f2471d7aaf8eee81c72b4d56f3ff01b8c3b94b582ad8a62ee8d15302bf44eff": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-6d5ccdc53c04445578338337133e89bfb29a8cf25952dc9665c98700cb360a5e": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-749fddbd19eb95f2d13cd10079045f14e6d173dfcab08f0e5e112d9c7aafd364": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-7f7eed323129d3b64533da02110b590782e37cddf690c9235f4e8fdcf5605356": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-860cd801ce8660b3fbd667be92c134eb55f56699b8500226d15ee5ee0f3d3526": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-88ac8a97163bf2f9cdc99481de9f75bd990cddc6cadb67db319e0a7a8698c079": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-9e5a6788d0d1d3ddb5b7c401e4827d4c51978fa5e93a4ebae0e4946d73783f74": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-a0a77732fcc11e753cb5d541e2e905ad522c5d24108c644ccd94ff5ab4be4db8": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1"
+        },
+        "roles": [
+          {
+            "subject": "A",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000a",
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-000000000115",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000115",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-000000000116",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000116",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-000000000117",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000117",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-00000000011a",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000011a",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-00000000011b",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000011b",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-00000000011e",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000011e",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-00000000011f",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000011f",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-000000000120",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000120",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-000000000121",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000121",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-000000000122",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000122",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-000000000123",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000123",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-000000000124",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000124",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-000000000125",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000125",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-000000000126",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000126",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-000000000127",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000127",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-000000000128",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000128",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          }
+        ],
+        "root": "e2536b7bc79528f41c409d739016eb837c512d67ea0d0f6c88ed07e6df04b8b9",
+        "bound": {
+          "below": "gA",
+          "maxStatements": 69888,
+          "maxDelegating": 4368,
+          "inForceBelow": 17,
+          "delegatingBelow": 16
+        }
+      }
+    },
+    {
+      "label": "review attack r2 laundered: the admin revokes its own over-quota grants, and their rescue is charged to its full delegate quota",
+      "pin": "anchor-2-of-3",
+      "statements": [
+        "gA",
+        "r2D0",
+        "r2D1",
+        "r2D2",
+        "r2D3",
+        "r2D4",
+        "r2D5",
+        "r2D6",
+        "r2D7",
+        "r2D8",
+        "r2D9",
+        "r2D10",
+        "r2D11",
+        "r2D12",
+        "r2D13",
+        "r2D14",
+        "r2D15",
+        "r2D16",
+        "r2D17",
+        "r2D18",
+        "r2D19",
+        "r2C_r2D7",
+        "r2C_r2D3",
+        "r2C_r2D8",
+        "r2C_r2D4",
+        "r2E",
+        "r2Launder"
+      ],
+      "expected": {
+        "status": {
+          "gA": "in-force",
+          "r2D0": "in-force",
+          "r2D1": "in-force",
+          "r2D2": "in-force",
+          "r2D3": "removed",
+          "r2D4": "removed",
+          "r2D5": "in-force",
+          "r2D6": "in-force",
+          "r2D7": "removed",
+          "r2D8": "removed",
+          "r2D9": "in-force",
+          "r2D10": "in-force",
+          "r2D11": "in-force",
+          "r2D12": "in-force",
+          "r2D13": "in-force",
+          "r2D14": "in-force",
+          "r2D15": "in-force",
+          "r2D16": "in-force",
+          "r2D17": "in-force",
+          "r2D18": "in-force",
+          "r2D19": "in-force",
+          "r2C_r2D7": "over-quota",
+          "r2C_r2D3": "over-quota",
+          "r2C_r2D8": "over-quota",
+          "r2C_r2D4": "over-quota",
+          "r2E": "in-force",
+          "r2Launder": "in-force"
+        },
+        "inForce": [
+          "auth-04afcc81cfeef49b796f357ee2a076daa3a75fc25fa9374f19c3823020308a45",
+          "auth-20bae751271076e7998ffb599eea47b4c05ac765de1124b14fe168032f29f811",
+          "auth-252a34a317c018117fcab73ebc263121acc87d7b46df4b30ee8ce29e80562583",
+          "auth-2be50c61f66e28c0796975adfa184db37663851a56576764766ca4238fa1b2ba",
+          "auth-2c6ece89a4167c7feeee51ab5692f70f697bbcf1bdaf9dc79c71e99babc07b1b",
+          "auth-2f5b015482631fe25cb8b1893ee5535b55527d21b63b3b1e860852b7450a9071",
+          "auth-3325197a547b376e2425452f5bbd5796677b971a8b4e82eaf01cd0080d556771",
+          "auth-3aad4b02dea7470d5b921e9de24e3cc8ea4f9de760549244294cd93acddf9af7",
+          "auth-3cea07c9d185366119fbc26aca44569871e2bee3fc0a38102f63898a18a66b2e",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-4f2471d7aaf8eee81c72b4d56f3ff01b8c3b94b582ad8a62ee8d15302bf44eff",
+          "auth-6d5ccdc53c04445578338337133e89bfb29a8cf25952dc9665c98700cb360a5e",
+          "auth-749fddbd19eb95f2d13cd10079045f14e6d173dfcab08f0e5e112d9c7aafd364",
+          "auth-7f7eed323129d3b64533da02110b590782e37cddf690c9235f4e8fdcf5605356",
+          "auth-860cd801ce8660b3fbd667be92c134eb55f56699b8500226d15ee5ee0f3d3526",
+          "auth-88ac8a97163bf2f9cdc99481de9f75bd990cddc6cadb67db319e0a7a8698c079",
+          "auth-9e5a6788d0d1d3ddb5b7c401e4827d4c51978fa5e93a4ebae0e4946d73783f74",
+          "auth-a0a77732fcc11e753cb5d541e2e905ad522c5d24108c644ccd94ff5ab4be4db8",
+          "auth-acb20a26008f4e2f09a3bba0a12c45d22b632ef6e237292bc73858733fbe513f"
+        ],
+        "live": [
+          "auth-04afcc81cfeef49b796f357ee2a076daa3a75fc25fa9374f19c3823020308a45",
+          "auth-20bae751271076e7998ffb599eea47b4c05ac765de1124b14fe168032f29f811",
+          "auth-252a34a317c018117fcab73ebc263121acc87d7b46df4b30ee8ce29e80562583",
+          "auth-2be50c61f66e28c0796975adfa184db37663851a56576764766ca4238fa1b2ba",
+          "auth-2c6ece89a4167c7feeee51ab5692f70f697bbcf1bdaf9dc79c71e99babc07b1b",
+          "auth-2f5b015482631fe25cb8b1893ee5535b55527d21b63b3b1e860852b7450a9071",
+          "auth-3325197a547b376e2425452f5bbd5796677b971a8b4e82eaf01cd0080d556771",
+          "auth-3aad4b02dea7470d5b921e9de24e3cc8ea4f9de760549244294cd93acddf9af7",
+          "auth-3cea07c9d185366119fbc26aca44569871e2bee3fc0a38102f63898a18a66b2e",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-4f2471d7aaf8eee81c72b4d56f3ff01b8c3b94b582ad8a62ee8d15302bf44eff",
+          "auth-6d5ccdc53c04445578338337133e89bfb29a8cf25952dc9665c98700cb360a5e",
+          "auth-749fddbd19eb95f2d13cd10079045f14e6d173dfcab08f0e5e112d9c7aafd364",
+          "auth-7f7eed323129d3b64533da02110b590782e37cddf690c9235f4e8fdcf5605356",
+          "auth-860cd801ce8660b3fbd667be92c134eb55f56699b8500226d15ee5ee0f3d3526",
+          "auth-88ac8a97163bf2f9cdc99481de9f75bd990cddc6cadb67db319e0a7a8698c079",
+          "auth-9e5a6788d0d1d3ddb5b7c401e4827d4c51978fa5e93a4ebae0e4946d73783f74",
+          "auth-a0a77732fcc11e753cb5d541e2e905ad522c5d24108c644ccd94ff5ab4be4db8",
+          "auth-acb20a26008f4e2f09a3bba0a12c45d22b632ef6e237292bc73858733fbe513f"
+        ],
+        "keptBy": {
+          "auth-04afcc81cfeef49b796f357ee2a076daa3a75fc25fa9374f19c3823020308a45": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-20bae751271076e7998ffb599eea47b4c05ac765de1124b14fe168032f29f811": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-252a34a317c018117fcab73ebc263121acc87d7b46df4b30ee8ce29e80562583": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-2be50c61f66e28c0796975adfa184db37663851a56576764766ca4238fa1b2ba": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-2c6ece89a4167c7feeee51ab5692f70f697bbcf1bdaf9dc79c71e99babc07b1b": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-2f5b015482631fe25cb8b1893ee5535b55527d21b63b3b1e860852b7450a9071": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-3325197a547b376e2425452f5bbd5796677b971a8b4e82eaf01cd0080d556771": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-3aad4b02dea7470d5b921e9de24e3cc8ea4f9de760549244294cd93acddf9af7": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-3cea07c9d185366119fbc26aca44569871e2bee3fc0a38102f63898a18a66b2e": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1": "anchor",
+          "auth-4f2471d7aaf8eee81c72b4d56f3ff01b8c3b94b582ad8a62ee8d15302bf44eff": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-6d5ccdc53c04445578338337133e89bfb29a8cf25952dc9665c98700cb360a5e": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-749fddbd19eb95f2d13cd10079045f14e6d173dfcab08f0e5e112d9c7aafd364": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-7f7eed323129d3b64533da02110b590782e37cddf690c9235f4e8fdcf5605356": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-860cd801ce8660b3fbd667be92c134eb55f56699b8500226d15ee5ee0f3d3526": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-88ac8a97163bf2f9cdc99481de9f75bd990cddc6cadb67db319e0a7a8698c079": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-9e5a6788d0d1d3ddb5b7c401e4827d4c51978fa5e93a4ebae0e4946d73783f74": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-a0a77732fcc11e753cb5d541e2e905ad522c5d24108c644ccd94ff5ab4be4db8": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-acb20a26008f4e2f09a3bba0a12c45d22b632ef6e237292bc73858733fbe513f": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1"
+        },
+        "roles": [
+          {
+            "subject": "A",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000a",
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-000000000115",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000115",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-000000000116",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000116",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-000000000117",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000117",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-00000000011a",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000011a",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-00000000011b",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000011b",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-00000000011e",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000011e",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-00000000011f",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000011f",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-000000000120",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000120",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-000000000121",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000121",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-000000000122",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000122",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-000000000123",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000123",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-000000000124",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000124",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-000000000125",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000125",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-000000000126",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000126",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-000000000127",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000127",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-000000000128",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000128",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          }
+        ],
+        "root": "81e008a16213415da80e93e5b41d6e28d25ee6dc92e9034e76bcb8e56a52ff9a",
+        "bound": {
+          "below": "gA",
+          "maxStatements": 69888,
+          "maxDelegating": 4368,
+          "inForceBelow": 18,
+          "delegatingBelow": 16
+        }
+      }
+    },
+    {
+      "label": "a rescue that fits: rescued delegating grants take the endorser's free delegate slots, by id",
+      "pin": "anchor-2-of-3",
+      "statements": [
+        "gA",
+        "fitD0",
+        "fitD1",
+        "fitD2",
+        "fitD3",
+        "fitD4",
+        "fitD5",
+        "fitD6",
+        "fitD7",
+        "fitD8",
+        "fitD9",
+        "fitD10",
+        "fitD11",
+        "fitD12",
+        "fitD13",
+        "fitD14",
+        "fitC0",
+        "fitC1",
+        "fitC2",
+        "fitRevoke",
+        "fitEndorse"
+      ],
+      "expected": {
+        "status": {
+          "gA": "in-force",
+          "fitD0": "removed",
+          "fitD1": "in-force",
+          "fitD2": "in-force",
+          "fitD3": "in-force",
+          "fitD4": "in-force",
+          "fitD5": "in-force",
+          "fitD6": "in-force",
+          "fitD7": "in-force",
+          "fitD8": "in-force",
+          "fitD9": "in-force",
+          "fitD10": "in-force",
+          "fitD11": "in-force",
+          "fitD12": "in-force",
+          "fitD13": "in-force",
+          "fitD14": "in-force",
+          "fitC0": "in-force",
+          "fitC1": "in-force",
+          "fitC2": "over-quota",
+          "fitRevoke": "in-force",
+          "fitEndorse": "in-force"
+        },
+        "inForce": [
+          "auth-030e337b118ee1893af22c513fc950d90f54b048b353d81f24cf507bd992e96a",
+          "auth-25ecd698837790e291354f64d9d278d491e3e04ed253828e21f110fa4a58e579",
+          "auth-2bbcee9cb185f61dc6636d16604871a56122a93e25065b8a29ff12e2674fe55b",
+          "auth-415b4601c13d8cdc3bb5bcf9ab2d0776ce087e5811483b80e123045412e2815b",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-4d9012638229888c811469052aea9c10820caf309de6226901096c3586e83648",
+          "auth-4f428bf27611b701f777ebac73e8586e85303af152952ceb8bc137b4a5cc7b71",
+          "auth-5116d4375438a2b536d706a7f1d252ea86117ef2e5e9f7eb827d2e2b7efdd2f2",
+          "auth-5de3aae7ef6485a93794eebbf228c560ca93e98f411981665ddfb4b3b3720e3c",
+          "auth-5fbe1619bf1deda74bbfef127a1bb684e154d2d922ff5712a4921912b2fb4536",
+          "auth-679d8068861851a7aab6599ee4459d07201f76ca7ba25f018048a8e02e2bafb7",
+          "auth-69605b38ee44b2022942f4efa5d1a15b437f1ad80261198610fa7c1993f71ce8",
+          "auth-7ea487acbcde6a7ea77169b5f1a3129d121ea1162807c82c8d587afb7ca78a88",
+          "auth-87cac0099227c071c8787f74a72448b682686e846453059fb4c905475c020681",
+          "auth-8c3fd279408010ce1d840f24d57516cb961fb22a959b3bb3ce906be227b03e44",
+          "auth-abe20280038007eeaae157696808427eb97bbdc557353ab537ff3835e3f79e8d",
+          "auth-bd22111d3396232678f6c09a6db75a5f7e40601e78e64631c533693bb0e5bdc8",
+          "auth-c99e91b94a2b4fcd7925346f59bca4405c8429e229ef69f08fb22324d74e0aa7",
+          "auth-da411319561bc1363b22db3fe59ec6b078bccafc856dac0b8a2b240436849c7a"
+        ],
+        "live": [
+          "auth-030e337b118ee1893af22c513fc950d90f54b048b353d81f24cf507bd992e96a",
+          "auth-25ecd698837790e291354f64d9d278d491e3e04ed253828e21f110fa4a58e579",
+          "auth-2bbcee9cb185f61dc6636d16604871a56122a93e25065b8a29ff12e2674fe55b",
+          "auth-415b4601c13d8cdc3bb5bcf9ab2d0776ce087e5811483b80e123045412e2815b",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-4d9012638229888c811469052aea9c10820caf309de6226901096c3586e83648",
+          "auth-4f428bf27611b701f777ebac73e8586e85303af152952ceb8bc137b4a5cc7b71",
+          "auth-5116d4375438a2b536d706a7f1d252ea86117ef2e5e9f7eb827d2e2b7efdd2f2",
+          "auth-5de3aae7ef6485a93794eebbf228c560ca93e98f411981665ddfb4b3b3720e3c",
+          "auth-5fbe1619bf1deda74bbfef127a1bb684e154d2d922ff5712a4921912b2fb4536",
+          "auth-679d8068861851a7aab6599ee4459d07201f76ca7ba25f018048a8e02e2bafb7",
+          "auth-69605b38ee44b2022942f4efa5d1a15b437f1ad80261198610fa7c1993f71ce8",
+          "auth-78fb8fcae0231ecf304abbdd4770d41092abed6233211f93c6d0152d122373ac",
+          "auth-7ea487acbcde6a7ea77169b5f1a3129d121ea1162807c82c8d587afb7ca78a88",
+          "auth-87cac0099227c071c8787f74a72448b682686e846453059fb4c905475c020681",
+          "auth-8c3fd279408010ce1d840f24d57516cb961fb22a959b3bb3ce906be227b03e44",
+          "auth-abe20280038007eeaae157696808427eb97bbdc557353ab537ff3835e3f79e8d",
+          "auth-bd22111d3396232678f6c09a6db75a5f7e40601e78e64631c533693bb0e5bdc8",
+          "auth-c99e91b94a2b4fcd7925346f59bca4405c8429e229ef69f08fb22324d74e0aa7",
+          "auth-da411319561bc1363b22db3fe59ec6b078bccafc856dac0b8a2b240436849c7a"
+        ],
+        "keptBy": {
+          "auth-030e337b118ee1893af22c513fc950d90f54b048b353d81f24cf507bd992e96a": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-25ecd698837790e291354f64d9d278d491e3e04ed253828e21f110fa4a58e579": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-2bbcee9cb185f61dc6636d16604871a56122a93e25065b8a29ff12e2674fe55b": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-415b4601c13d8cdc3bb5bcf9ab2d0776ce087e5811483b80e123045412e2815b": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1": "anchor",
+          "auth-4d9012638229888c811469052aea9c10820caf309de6226901096c3586e83648": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-4f428bf27611b701f777ebac73e8586e85303af152952ceb8bc137b4a5cc7b71": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-5116d4375438a2b536d706a7f1d252ea86117ef2e5e9f7eb827d2e2b7efdd2f2": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-5de3aae7ef6485a93794eebbf228c560ca93e98f411981665ddfb4b3b3720e3c": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-5fbe1619bf1deda74bbfef127a1bb684e154d2d922ff5712a4921912b2fb4536": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-679d8068861851a7aab6599ee4459d07201f76ca7ba25f018048a8e02e2bafb7": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-69605b38ee44b2022942f4efa5d1a15b437f1ad80261198610fa7c1993f71ce8": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-7ea487acbcde6a7ea77169b5f1a3129d121ea1162807c82c8d587afb7ca78a88": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-87cac0099227c071c8787f74a72448b682686e846453059fb4c905475c020681": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-8c3fd279408010ce1d840f24d57516cb961fb22a959b3bb3ce906be227b03e44": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-abe20280038007eeaae157696808427eb97bbdc557353ab537ff3835e3f79e8d": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-bd22111d3396232678f6c09a6db75a5f7e40601e78e64631c533693bb0e5bdc8": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-c99e91b94a2b4fcd7925346f59bca4405c8429e229ef69f08fb22324d74e0aa7": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-da411319561bc1363b22db3fe59ec6b078bccafc856dac0b8a2b240436849c7a": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1"
+        },
+        "roles": [
+          {
+            "subject": "A",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000a",
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kc as 018f47a0-7b21-7abc-8def-00000000013c",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000013c",
+            "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kc as 018f47a0-7b21-7abc-8def-00000000013d",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000013d",
+            "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-00000000012e",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000012e",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-00000000012f",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000012f",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-000000000130",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000130",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-000000000131",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000131",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-000000000132",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000132",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-000000000133",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000133",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-000000000134",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000134",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-000000000135",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000135",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-000000000136",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000136",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-000000000137",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000137",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-000000000138",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000138",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-000000000139",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000139",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-00000000013a",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000013a",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-00000000013b",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000013b",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          }
+        ],
+        "root": "e9eaca72aee2d5c34bd813c8ba3ed5e1c757ee0dec27b6d244141e694c1a75cd"
+      }
+    },
+    {
+      "label": "review attack r1 at test scale: depth-3 admins under over-quota grants stay dead (test parameters quota = 4, delegateQuota = 2)",
+      "pin": "anchor-2-of-3",
+      "testQuota": 4,
+      "testDelegateQuota": 2,
+      "statements": [
+        "gA",
+        "r1D0",
+        "r1D1",
+        "r1D2",
+        "r1D3",
+        "r1D4",
+        "r1D5",
+        "r1C0",
+        "r1C1",
+        "r1C2",
+        "r1C3",
+        "r1C4",
+        "r1C5",
+        "r1V0_0",
+        "r1V0_1",
+        "r1V0_2",
+        "r1V0_3",
+        "r1V1_0",
+        "r1V1_1",
+        "r1V1_2",
+        "r1V1_3",
+        "r1V2_0",
+        "r1V2_1",
+        "r1V2_2",
+        "r1V2_3",
+        "r1V3_0",
+        "r1V3_1",
+        "r1V3_2",
+        "r1V3_3",
+        "r1V4_0",
+        "r1V4_1",
+        "r1V4_2",
+        "r1V4_3",
+        "r1V5_0",
+        "r1V5_1",
+        "r1V5_2",
+        "r1V5_3",
+        "r1E"
+      ],
+      "expected": {
+        "status": {
+          "gA": "in-force",
+          "r1D0": "in-force",
+          "r1D1": "over-quota",
+          "r1D2": "over-quota",
+          "r1D3": "in-force",
+          "r1D4": "over-quota",
+          "r1D5": "over-quota",
+          "r1C0": "in-force",
+          "r1C1": "dead",
+          "r1C2": "dead",
+          "r1C3": "in-force",
+          "r1C4": "dead",
+          "r1C5": "dead",
+          "r1V0_0": "in-force",
+          "r1V0_1": "in-force",
+          "r1V0_2": "in-force",
+          "r1V0_3": "in-force",
+          "r1V1_0": "dead",
+          "r1V1_1": "dead",
+          "r1V1_2": "dead",
+          "r1V1_3": "dead",
+          "r1V2_0": "dead",
+          "r1V2_1": "dead",
+          "r1V2_2": "dead",
+          "r1V2_3": "dead",
+          "r1V3_0": "in-force",
+          "r1V3_1": "in-force",
+          "r1V3_2": "in-force",
+          "r1V3_3": "in-force",
+          "r1V4_0": "dead",
+          "r1V4_1": "dead",
+          "r1V4_2": "dead",
+          "r1V4_3": "dead",
+          "r1V5_0": "dead",
+          "r1V5_1": "dead",
+          "r1V5_2": "dead",
+          "r1V5_3": "dead",
+          "r1E": "in-force"
+        },
+        "inForce": [
+          "auth-0d07b56440b03565478948c3a1929b9ac4becad54f05f9a9b4404e072311f537",
+          "auth-114f50cdf2d2edbe7f44001fef3797c74d860d9c5ca67044842c2c5c478ae295",
+          "auth-19b9671f14f669dd50d401804d707550f086a3b0b31389be1b574a2360666216",
+          "auth-225254839d6f88d88396c167789096f978b5aeadcfb14dd8c5734fdcc5823d45",
+          "auth-313213cc03ffc758c8069af716d87c4166ce4e7b69b78dbbb37405b314f73abe",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-5023333dd565a659ea976dd631bba3865bb7a3b30fa06f49d74d45562923373d",
+          "auth-50e58769c4db24e775e7c99c375418ba8521b2f716cbc6e319cad72cac2f544e",
+          "auth-8412cd8b73560e7b7481fca55b4fe8b9fb55dff53b2156bb759a89981b28e07c",
+          "auth-a73158dbea908694e91f1201a5d513d441fd695faa035d11b4ce1c524527c6e1",
+          "auth-aa82365771926141cfa756dcdf9f0f8183a697ca3c0b5883aa1750cf1d356b36",
+          "auth-b7cd3014a10504342b0b43faa8f67b12f36cc9f0263d68f023581ff6fe786550",
+          "auth-fb715679cbb85ab976a605105461e015fb6209a1ccd7a3b4d0fee1e750ee4f84",
+          "auth-fd6469058160ab2b2c0fd156b6bd7e9105353f23806c095fc8b93c1c83dfef62"
+        ],
+        "live": [
+          "auth-0d07b56440b03565478948c3a1929b9ac4becad54f05f9a9b4404e072311f537",
+          "auth-114f50cdf2d2edbe7f44001fef3797c74d860d9c5ca67044842c2c5c478ae295",
+          "auth-19b9671f14f669dd50d401804d707550f086a3b0b31389be1b574a2360666216",
+          "auth-225254839d6f88d88396c167789096f978b5aeadcfb14dd8c5734fdcc5823d45",
+          "auth-313213cc03ffc758c8069af716d87c4166ce4e7b69b78dbbb37405b314f73abe",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-5023333dd565a659ea976dd631bba3865bb7a3b30fa06f49d74d45562923373d",
+          "auth-50e58769c4db24e775e7c99c375418ba8521b2f716cbc6e319cad72cac2f544e",
+          "auth-8412cd8b73560e7b7481fca55b4fe8b9fb55dff53b2156bb759a89981b28e07c",
+          "auth-a73158dbea908694e91f1201a5d513d441fd695faa035d11b4ce1c524527c6e1",
+          "auth-aa82365771926141cfa756dcdf9f0f8183a697ca3c0b5883aa1750cf1d356b36",
+          "auth-b7cd3014a10504342b0b43faa8f67b12f36cc9f0263d68f023581ff6fe786550",
+          "auth-fb715679cbb85ab976a605105461e015fb6209a1ccd7a3b4d0fee1e750ee4f84",
+          "auth-fd6469058160ab2b2c0fd156b6bd7e9105353f23806c095fc8b93c1c83dfef62"
+        ],
+        "keptBy": {
+          "auth-0d07b56440b03565478948c3a1929b9ac4becad54f05f9a9b4404e072311f537": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-114f50cdf2d2edbe7f44001fef3797c74d860d9c5ca67044842c2c5c478ae295": "auth-313213cc03ffc758c8069af716d87c4166ce4e7b69b78dbbb37405b314f73abe",
+          "auth-19b9671f14f669dd50d401804d707550f086a3b0b31389be1b574a2360666216": "auth-313213cc03ffc758c8069af716d87c4166ce4e7b69b78dbbb37405b314f73abe",
+          "auth-225254839d6f88d88396c167789096f978b5aeadcfb14dd8c5734fdcc5823d45": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-313213cc03ffc758c8069af716d87c4166ce4e7b69b78dbbb37405b314f73abe": "auth-0d07b56440b03565478948c3a1929b9ac4becad54f05f9a9b4404e072311f537",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1": "anchor",
+          "auth-5023333dd565a659ea976dd631bba3865bb7a3b30fa06f49d74d45562923373d": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-50e58769c4db24e775e7c99c375418ba8521b2f716cbc6e319cad72cac2f544e": "auth-b7cd3014a10504342b0b43faa8f67b12f36cc9f0263d68f023581ff6fe786550",
+          "auth-8412cd8b73560e7b7481fca55b4fe8b9fb55dff53b2156bb759a89981b28e07c": "auth-b7cd3014a10504342b0b43faa8f67b12f36cc9f0263d68f023581ff6fe786550",
+          "auth-a73158dbea908694e91f1201a5d513d441fd695faa035d11b4ce1c524527c6e1": "auth-313213cc03ffc758c8069af716d87c4166ce4e7b69b78dbbb37405b314f73abe",
+          "auth-aa82365771926141cfa756dcdf9f0f8183a697ca3c0b5883aa1750cf1d356b36": "auth-313213cc03ffc758c8069af716d87c4166ce4e7b69b78dbbb37405b314f73abe",
+          "auth-b7cd3014a10504342b0b43faa8f67b12f36cc9f0263d68f023581ff6fe786550": "auth-225254839d6f88d88396c167789096f978b5aeadcfb14dd8c5734fdcc5823d45",
+          "auth-fb715679cbb85ab976a605105461e015fb6209a1ccd7a3b4d0fee1e750ee4f84": "auth-b7cd3014a10504342b0b43faa8f67b12f36cc9f0263d68f023581ff6fe786550",
+          "auth-fd6469058160ab2b2c0fd156b6bd7e9105353f23806c095fc8b93c1c83dfef62": "auth-b7cd3014a10504342b0b43faa8f67b12f36cc9f0263d68f023581ff6fe786550"
+        },
+        "roles": [
+          {
+            "subject": "A",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000a",
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kc as 018f47a0-7b21-7abc-8def-000000000140",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000140",
+            "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kc as 018f47a0-7b21-7abc-8def-000000000152",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000152",
+            "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-00000000013f",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000013f",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-000000000151",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000151",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kv as 018f47a0-7b21-7abc-8def-000000000141",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000141",
+            "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY",
+            "roles": [
+              {
+                "role": "validator",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "validated",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kv as 018f47a0-7b21-7abc-8def-000000000142",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000142",
+            "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY",
+            "roles": [
+              {
+                "role": "validator",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "validated",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kv as 018f47a0-7b21-7abc-8def-000000000143",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000143",
+            "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY",
+            "roles": [
+              {
+                "role": "participant",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kv as 018f47a0-7b21-7abc-8def-000000000144",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000144",
+            "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY",
+            "roles": [
+              {
+                "role": "participant",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kv as 018f47a0-7b21-7abc-8def-000000000153",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000153",
+            "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY",
+            "roles": [
+              {
+                "role": "validator",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "validated",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kv as 018f47a0-7b21-7abc-8def-000000000154",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000154",
+            "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY",
+            "roles": [
+              {
+                "role": "validator",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "validated",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kv as 018f47a0-7b21-7abc-8def-000000000155",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000155",
+            "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY",
+            "roles": [
+              {
+                "role": "participant",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kv as 018f47a0-7b21-7abc-8def-000000000156",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000156",
+            "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY",
+            "roles": [
+              {
+                "role": "participant",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {}
+            }
+          }
+        ],
+        "root": "1b9754ec34e3d4f88f987cec160e490ffae65bf9f83a334d10d7ec641eb55975",
+        "bound": {
+          "below": "gA",
+          "maxStatements": 28,
+          "maxDelegating": 14,
+          "inForceBelow": 13,
+          "delegatingBelow": 8
+        }
+      }
+    },
+    {
+      "label": "review attack r1 at test scale, laundered (test parameters quota = 4, delegateQuota = 2)",
+      "pin": "anchor-2-of-3",
+      "testQuota": 4,
+      "testDelegateQuota": 2,
+      "statements": [
+        "gA",
+        "r1D0",
+        "r1D1",
+        "r1D2",
+        "r1D3",
+        "r1D4",
+        "r1D5",
+        "r1C0",
+        "r1C1",
+        "r1C2",
+        "r1C3",
+        "r1C4",
+        "r1C5",
+        "r1V0_0",
+        "r1V0_1",
+        "r1V0_2",
+        "r1V0_3",
+        "r1V1_0",
+        "r1V1_1",
+        "r1V1_2",
+        "r1V1_3",
+        "r1V2_0",
+        "r1V2_1",
+        "r1V2_2",
+        "r1V2_3",
+        "r1V3_0",
+        "r1V3_1",
+        "r1V3_2",
+        "r1V3_3",
+        "r1V4_0",
+        "r1V4_1",
+        "r1V4_2",
+        "r1V4_3",
+        "r1V5_0",
+        "r1V5_1",
+        "r1V5_2",
+        "r1V5_3",
+        "r1E",
+        "r1Launder"
+      ],
+      "expected": {
+        "status": {
+          "gA": "in-force",
+          "r1D0": "in-force",
+          "r1D1": "removed",
+          "r1D2": "removed",
+          "r1D3": "in-force",
+          "r1D4": "removed",
+          "r1D5": "removed",
+          "r1C0": "in-force",
+          "r1C1": "over-quota",
+          "r1C2": "over-quota",
+          "r1C3": "in-force",
+          "r1C4": "over-quota",
+          "r1C5": "over-quota",
+          "r1V0_0": "in-force",
+          "r1V0_1": "in-force",
+          "r1V0_2": "in-force",
+          "r1V0_3": "in-force",
+          "r1V1_0": "dead",
+          "r1V1_1": "dead",
+          "r1V1_2": "dead",
+          "r1V1_3": "dead",
+          "r1V2_0": "dead",
+          "r1V2_1": "dead",
+          "r1V2_2": "dead",
+          "r1V2_3": "dead",
+          "r1V3_0": "in-force",
+          "r1V3_1": "in-force",
+          "r1V3_2": "in-force",
+          "r1V3_3": "in-force",
+          "r1V4_0": "dead",
+          "r1V4_1": "dead",
+          "r1V4_2": "dead",
+          "r1V4_3": "dead",
+          "r1V5_0": "dead",
+          "r1V5_1": "dead",
+          "r1V5_2": "dead",
+          "r1V5_3": "dead",
+          "r1E": "in-force",
+          "r1Launder": "in-force"
+        },
+        "inForce": [
+          "auth-0d07b56440b03565478948c3a1929b9ac4becad54f05f9a9b4404e072311f537",
+          "auth-114f50cdf2d2edbe7f44001fef3797c74d860d9c5ca67044842c2c5c478ae295",
+          "auth-19b9671f14f669dd50d401804d707550f086a3b0b31389be1b574a2360666216",
+          "auth-225254839d6f88d88396c167789096f978b5aeadcfb14dd8c5734fdcc5823d45",
+          "auth-313213cc03ffc758c8069af716d87c4166ce4e7b69b78dbbb37405b314f73abe",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-460075ce562e06a919998a161be7808a61ea64aff4d54b14cf7626a1e9f60f38",
+          "auth-5023333dd565a659ea976dd631bba3865bb7a3b30fa06f49d74d45562923373d",
+          "auth-50e58769c4db24e775e7c99c375418ba8521b2f716cbc6e319cad72cac2f544e",
+          "auth-8412cd8b73560e7b7481fca55b4fe8b9fb55dff53b2156bb759a89981b28e07c",
+          "auth-a73158dbea908694e91f1201a5d513d441fd695faa035d11b4ce1c524527c6e1",
+          "auth-aa82365771926141cfa756dcdf9f0f8183a697ca3c0b5883aa1750cf1d356b36",
+          "auth-b7cd3014a10504342b0b43faa8f67b12f36cc9f0263d68f023581ff6fe786550",
+          "auth-fb715679cbb85ab976a605105461e015fb6209a1ccd7a3b4d0fee1e750ee4f84",
+          "auth-fd6469058160ab2b2c0fd156b6bd7e9105353f23806c095fc8b93c1c83dfef62"
+        ],
+        "live": [
+          "auth-0d07b56440b03565478948c3a1929b9ac4becad54f05f9a9b4404e072311f537",
+          "auth-114f50cdf2d2edbe7f44001fef3797c74d860d9c5ca67044842c2c5c478ae295",
+          "auth-19b9671f14f669dd50d401804d707550f086a3b0b31389be1b574a2360666216",
+          "auth-225254839d6f88d88396c167789096f978b5aeadcfb14dd8c5734fdcc5823d45",
+          "auth-313213cc03ffc758c8069af716d87c4166ce4e7b69b78dbbb37405b314f73abe",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-460075ce562e06a919998a161be7808a61ea64aff4d54b14cf7626a1e9f60f38",
+          "auth-5023333dd565a659ea976dd631bba3865bb7a3b30fa06f49d74d45562923373d",
+          "auth-50e58769c4db24e775e7c99c375418ba8521b2f716cbc6e319cad72cac2f544e",
+          "auth-8412cd8b73560e7b7481fca55b4fe8b9fb55dff53b2156bb759a89981b28e07c",
+          "auth-a73158dbea908694e91f1201a5d513d441fd695faa035d11b4ce1c524527c6e1",
+          "auth-aa82365771926141cfa756dcdf9f0f8183a697ca3c0b5883aa1750cf1d356b36",
+          "auth-b7cd3014a10504342b0b43faa8f67b12f36cc9f0263d68f023581ff6fe786550",
+          "auth-fb715679cbb85ab976a605105461e015fb6209a1ccd7a3b4d0fee1e750ee4f84",
+          "auth-fd6469058160ab2b2c0fd156b6bd7e9105353f23806c095fc8b93c1c83dfef62"
+        ],
+        "keptBy": {
+          "auth-0d07b56440b03565478948c3a1929b9ac4becad54f05f9a9b4404e072311f537": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-114f50cdf2d2edbe7f44001fef3797c74d860d9c5ca67044842c2c5c478ae295": "auth-313213cc03ffc758c8069af716d87c4166ce4e7b69b78dbbb37405b314f73abe",
+          "auth-19b9671f14f669dd50d401804d707550f086a3b0b31389be1b574a2360666216": "auth-313213cc03ffc758c8069af716d87c4166ce4e7b69b78dbbb37405b314f73abe",
+          "auth-225254839d6f88d88396c167789096f978b5aeadcfb14dd8c5734fdcc5823d45": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-313213cc03ffc758c8069af716d87c4166ce4e7b69b78dbbb37405b314f73abe": "auth-0d07b56440b03565478948c3a1929b9ac4becad54f05f9a9b4404e072311f537",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1": "anchor",
+          "auth-460075ce562e06a919998a161be7808a61ea64aff4d54b14cf7626a1e9f60f38": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-5023333dd565a659ea976dd631bba3865bb7a3b30fa06f49d74d45562923373d": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-50e58769c4db24e775e7c99c375418ba8521b2f716cbc6e319cad72cac2f544e": "auth-b7cd3014a10504342b0b43faa8f67b12f36cc9f0263d68f023581ff6fe786550",
+          "auth-8412cd8b73560e7b7481fca55b4fe8b9fb55dff53b2156bb759a89981b28e07c": "auth-b7cd3014a10504342b0b43faa8f67b12f36cc9f0263d68f023581ff6fe786550",
+          "auth-a73158dbea908694e91f1201a5d513d441fd695faa035d11b4ce1c524527c6e1": "auth-313213cc03ffc758c8069af716d87c4166ce4e7b69b78dbbb37405b314f73abe",
+          "auth-aa82365771926141cfa756dcdf9f0f8183a697ca3c0b5883aa1750cf1d356b36": "auth-313213cc03ffc758c8069af716d87c4166ce4e7b69b78dbbb37405b314f73abe",
+          "auth-b7cd3014a10504342b0b43faa8f67b12f36cc9f0263d68f023581ff6fe786550": "auth-225254839d6f88d88396c167789096f978b5aeadcfb14dd8c5734fdcc5823d45",
+          "auth-fb715679cbb85ab976a605105461e015fb6209a1ccd7a3b4d0fee1e750ee4f84": "auth-b7cd3014a10504342b0b43faa8f67b12f36cc9f0263d68f023581ff6fe786550",
+          "auth-fd6469058160ab2b2c0fd156b6bd7e9105353f23806c095fc8b93c1c83dfef62": "auth-b7cd3014a10504342b0b43faa8f67b12f36cc9f0263d68f023581ff6fe786550"
+        },
+        "roles": [
+          {
+            "subject": "A",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000a",
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kc as 018f47a0-7b21-7abc-8def-000000000140",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000140",
+            "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kc as 018f47a0-7b21-7abc-8def-000000000152",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000152",
+            "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-00000000013f",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000013f",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-000000000151",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000151",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kv as 018f47a0-7b21-7abc-8def-000000000141",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000141",
+            "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY",
+            "roles": [
+              {
+                "role": "validator",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "validated",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kv as 018f47a0-7b21-7abc-8def-000000000142",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000142",
+            "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY",
+            "roles": [
+              {
+                "role": "validator",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "validated",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kv as 018f47a0-7b21-7abc-8def-000000000143",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000143",
+            "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY",
+            "roles": [
+              {
+                "role": "participant",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kv as 018f47a0-7b21-7abc-8def-000000000144",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000144",
+            "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY",
+            "roles": [
+              {
+                "role": "participant",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kv as 018f47a0-7b21-7abc-8def-000000000153",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000153",
+            "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY",
+            "roles": [
+              {
+                "role": "validator",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "validated",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kv as 018f47a0-7b21-7abc-8def-000000000154",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000154",
+            "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY",
+            "roles": [
+              {
+                "role": "validator",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "validated",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kv as 018f47a0-7b21-7abc-8def-000000000155",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000155",
+            "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY",
+            "roles": [
+              {
+                "role": "participant",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kv as 018f47a0-7b21-7abc-8def-000000000156",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000156",
+            "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY",
+            "roles": [
+              {
+                "role": "participant",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {}
+            }
+          }
+        ],
+        "root": "4d4913b11e5d560cafe9183023ff9b754578b519ff696f7285d8ac4197ece7e5",
+        "bound": {
+          "below": "gA",
+          "maxStatements": 28,
+          "maxDelegating": 14,
+          "inForceBelow": 14,
+          "delegatingBelow": 8
+        }
+      }
+    },
+    {
+      "label": "the bound is reached by a full tree (test parameters quota = 2, delegateQuota = 1)",
+      "pin": "anchor-2-of-3",
+      "testQuota": 2,
+      "testDelegateQuota": 1,
+      "statements": [
+        "gA",
+        "tD",
+        "tP1",
+        "tC",
+        "tP2",
+        "tS1",
+        "tS2"
+      ],
+      "expected": {
+        "status": {
+          "gA": "in-force",
+          "tD": "in-force",
+          "tP1": "in-force",
+          "tC": "in-force",
+          "tP2": "in-force",
+          "tS1": "in-force",
+          "tS2": "in-force"
+        },
+        "inForce": [
+          "auth-2e2e643aa6cfc3e178d8fdc5524d34a9d5997a521ded4e437dffca2c1d9ad800",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-83e724571d9c9ef1ce0543aff3ae8bd8164e386f3f69ed2f6f53c4c9200272b0",
+          "auth-a8d2ea51f46f85558fea2d18902a478a384ab5a40a66ef4d24a7717d3625b009",
+          "auth-b575d59fa8c3aed6ea4320ed82e48bc6fb08b822422335613b01908121a331a8",
+          "auth-b62b3ef4e1c2fae2ec7199af5d155a378bad0c50944a92bbb341071a6290c05c",
+          "auth-f4bd0f8010b292ad282b96b5d8f984a49ed1b84e0164347763a4cfd12bdee404"
+        ],
+        "live": [
+          "auth-2e2e643aa6cfc3e178d8fdc5524d34a9d5997a521ded4e437dffca2c1d9ad800",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-83e724571d9c9ef1ce0543aff3ae8bd8164e386f3f69ed2f6f53c4c9200272b0",
+          "auth-a8d2ea51f46f85558fea2d18902a478a384ab5a40a66ef4d24a7717d3625b009",
+          "auth-b575d59fa8c3aed6ea4320ed82e48bc6fb08b822422335613b01908121a331a8",
+          "auth-b62b3ef4e1c2fae2ec7199af5d155a378bad0c50944a92bbb341071a6290c05c",
+          "auth-f4bd0f8010b292ad282b96b5d8f984a49ed1b84e0164347763a4cfd12bdee404"
+        ],
+        "keptBy": {
+          "auth-2e2e643aa6cfc3e178d8fdc5524d34a9d5997a521ded4e437dffca2c1d9ad800": "auth-b575d59fa8c3aed6ea4320ed82e48bc6fb08b822422335613b01908121a331a8",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1": "anchor",
+          "auth-83e724571d9c9ef1ce0543aff3ae8bd8164e386f3f69ed2f6f53c4c9200272b0": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-a8d2ea51f46f85558fea2d18902a478a384ab5a40a66ef4d24a7717d3625b009": "auth-b575d59fa8c3aed6ea4320ed82e48bc6fb08b822422335613b01908121a331a8",
+          "auth-b575d59fa8c3aed6ea4320ed82e48bc6fb08b822422335613b01908121a331a8": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-b62b3ef4e1c2fae2ec7199af5d155a378bad0c50944a92bbb341071a6290c05c": "auth-a8d2ea51f46f85558fea2d18902a478a384ab5a40a66ef4d24a7717d3625b009",
+          "auth-f4bd0f8010b292ad282b96b5d8f984a49ed1b84e0164347763a4cfd12bdee404": "auth-a8d2ea51f46f85558fea2d18902a478a384ab5a40a66ef4d24a7717d3625b009"
+        },
+        "roles": [
+          {
+            "subject": "A",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000a",
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kc as 018f47a0-7b21-7abc-8def-000000000165",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000165",
+            "key": "yRyzziuE5LqF9WLs5B7f5OJ6_FLYjVB_ZqGGON-CPp8",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kd as 018f47a0-7b21-7abc-8def-000000000163",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000163",
+            "key": "JfwyxHilpPhORVegNC4IJ4yINkG2FJvbC0qYarbCy3g",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kv as 018f47a0-7b21-7abc-8def-000000000164",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000164",
+            "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY",
+            "roles": [
+              {
+                "role": "participant",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kv as 018f47a0-7b21-7abc-8def-000000000166",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000166",
+            "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY",
+            "roles": [
+              {
+                "role": "participant",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kv as 018f47a0-7b21-7abc-8def-000000000167",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000167",
+            "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY",
+            "roles": [
+              {
+                "role": "xmesh-seat",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {}
+            }
+          },
+          {
+            "subject": "Kv as 018f47a0-7b21-7abc-8def-000000000168",
+            "nodeId": "018f47a0-7b21-7abc-8def-000000000168",
+            "key": "Tdm2SWonVxrLCJpeNILfyGrN7dxNHyjhWpsE8CbX8iY",
+            "roles": [
+              {
+                "role": "xmesh-seat",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "none",
+              "insideScope": {}
+            }
+          }
+        ],
+        "root": "f804aac50922ae04047ae50cf89c5d8f5a88a0fd2453df38e0a32e1be4f7827b",
+        "bound": {
+          "below": "gA",
+          "maxStatements": 6,
+          "maxDelegating": 3,
+          "inForceBelow": 6,
+          "delegatingBelow": 2
+        }
+      }
+    },
+    {
+      "label": "and not exceeded by extra grants, a laundering revoke and a rescue (test parameters quota = 2, delegateQuota = 1)",
+      "pin": "anchor-2-of-3",
+      "testQuota": 2,
+      "testDelegateQuota": 1,
+      "statements": [
+        "gA",
+        "tD",
+        "tP1",
+        "tC",
+        "tP2",
+        "tS1",
+        "tS2",
+        "tExtraD",
+        "tExtraC",
+        "tExtraS",
+        "tLaunder",
+        "tRescue"
+      ],
+      "expected": {
+        "status": {
+          "gA": "in-force",
+          "tD": "over-quota",
+          "tP1": "over-quota",
+          "tC": "dead",
+          "tP2": "dead",
+          "tS1": "dead",
+          "tS2": "dead",
+          "tExtraD": "removed",
+          "tExtraC": "over-quota",
+          "tExtraS": "dead",
+          "tLaunder": "in-force",
+          "tRescue": "in-force"
+        },
+        "inForce": [
+          "auth-16929533e423337e6954cc5fb8fbcf07df425d4ba292f0264808bf7da2e2e98f",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-bcb440241abbf50e1907a24678b6cf8a92c9f935fd3cb3dbd7414226b958f94e"
+        ],
+        "live": [
+          "auth-16929533e423337e6954cc5fb8fbcf07df425d4ba292f0264808bf7da2e2e98f",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-bcb440241abbf50e1907a24678b6cf8a92c9f935fd3cb3dbd7414226b958f94e"
+        ],
+        "keptBy": {
+          "auth-16929533e423337e6954cc5fb8fbcf07df425d4ba292f0264808bf7da2e2e98f": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1",
+          "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1": "anchor",
+          "auth-bcb440241abbf50e1907a24678b6cf8a92c9f935fd3cb3dbd7414226b958f94e": "auth-4412b71937cef8a780a30caaca1b6e6f62f9418d381ec5677561a22053811ca1"
+        },
+        "roles": [
+          {
+            "subject": "A",
+            "nodeId": "018f47a0-7b21-7abc-8def-00000000000a",
+            "key": "ZKCOZZxOdQDIOmDkU-5gjedNjPRDfooHebexzyBTLIo",
+            "roles": [
+              {
+                "role": "admin",
+                "scope": null
+              }
+            ],
+            "lifecycle": {
+              "outsideEveryScope": "canonical",
+              "insideScope": {}
+            }
+          }
+        ],
+        "root": "ee6a29746ba8ee68f0271629e5f6c2d56ee060b1506168b7e1da5afe2a824021",
+        "bound": {
+          "below": "gA",
+          "maxStatements": 6,
+          "maxDelegating": 3,
+          "inForceBelow": 2,
+          "delegatingBelow": 0
+        }
+      }
+    }
+  ]
+}
diff --git a/tests/fixtures/ed25519-strict-v2.json b/tests/fixtures/ed25519-strict-v2.json
new file mode 100644
index 00000000..3ea4c4a6
--- /dev/null
+++ b/tests/fixtures/ed25519-strict-v2.json
@@ -0,0 +1,284 @@
+{
+  "protocolVersion": "2.0",
+  "rule": "MMP §18.3.2: RFC 8032 §5.1.7 cofactorless verification, [S]B = R + [k]A, after four pre-checks: A and R are canonical encodings (y < p; x = 0 never with the sign bit set) of points of prime order ([L]P = O and P != O), and S < L. With A and R of prime order the cofactored equation gives the same answer.",
+  "source": "speccheck cases from Chalkias, Garillot and Nikolaenko, \"Taming the many EdDSAs\" (SSR 2020), https://github.com/novifinancial/ed25519-speccheck/blob/65519336fda78a3d016e947df6d82848aca0c9da/cases.json, Apache-2.0",
+  "usage": "Reproduce expected for every case. precheckFailure names the first pre-check that fails, in the order A encoding, A order, R encoding, R order, S range. equationsWithoutPrechecks is informative: it is what the two RFC 8032 equations give with lenient decoding and no pre-checks, so it shows which unchecked libraries would disagree.",
+  "cases": [
+    {
+      "label": "speccheck case 0",
+      "messageHex": "8c93255d71dcab10e8f379c26200f3c7bd5f09d9bc3068d3ef4edeb4853022b6",
+      "publicKeyHex": "c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac03fa",
+      "signatureHex": "c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac037a0000000000000000000000000000000000000000000000000000000000000000",
+      "expected": "reject",
+      "precheckFailure": "A is not of prime order",
+      "equationsWithoutPrechecks": {
+        "cofactorless": true,
+        "cofactored": true
+      }
+    },
+    {
+      "label": "speccheck case 1",
+      "messageHex": "9bd9f44f4dcc75bd531b56b2cd280b0bb38fc1cd6d1230e14861d861de092e79",
+      "publicKeyHex": "c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac03fa",
+      "signatureHex": "f7badec5b8abeaf699583992219b7b223f1df3fbbea919844e3f7c554a43dd43a5bb704786be79fc476f91d3f3f89b03984d8068dcf1bb7dfc6637b45450ac04",
+      "expected": "reject",
+      "precheckFailure": "A is not of prime order",
+      "equationsWithoutPrechecks": {
+        "cofactorless": true,
+        "cofactored": true
+      }
+    },
+    {
+      "label": "speccheck case 2",
+      "messageHex": "aebf3f2601a0c8c5d39cc7d8911642f740b78168218da8471772b35f9d35b9ab",
+      "publicKeyHex": "f7badec5b8abeaf699583992219b7b223f1df3fbbea919844e3f7c554a43dd43",
+      "signatureHex": "c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac03fa8c4bd45aecaca5b24fb97bc10ac27ac8751a7dfe1baff8b953ec9f5833ca260e",
+      "expected": "reject",
+      "precheckFailure": "A is not of prime order",
+      "equationsWithoutPrechecks": {
+        "cofactorless": true,
+        "cofactored": true
+      }
+    },
+    {
+      "label": "speccheck case 3",
+      "messageHex": "9bd9f44f4dcc75bd531b56b2cd280b0bb38fc1cd6d1230e14861d861de092e79",
+      "publicKeyHex": "cdb267ce40c5cd45306fa5d2f29731459387dbf9eb933b7bd5aed9a765b88d4d",
+      "signatureHex": "9046a64750444938de19f227bb80485e92b83fdb4b6506c160484c016cc1852f87909e14428a7a1d62e9f22f3d3ad7802db02eb2e688b6c52fcd6648a98bd009",
+      "expected": "reject",
+      "precheckFailure": "A is not of prime order",
+      "equationsWithoutPrechecks": {
+        "cofactorless": true,
+        "cofactored": true
+      }
+    },
+    {
+      "label": "speccheck case 4",
+      "messageHex": "e47d62c63f830dc7a6851a0b1f33ae4bb2f507fb6cffec4011eaccd55b53f56c",
+      "publicKeyHex": "cdb267ce40c5cd45306fa5d2f29731459387dbf9eb933b7bd5aed9a765b88d4d",
+      "signatureHex": "160a1cb0dc9c0258cd0a7d23e94d8fa878bcb1925f2c64246b2dee1796bed5125ec6bc982a269b723e0668e540911a9a6a58921d6925e434ab10aa7940551a09",
+      "expected": "reject",
+      "precheckFailure": "A is not of prime order",
+      "equationsWithoutPrechecks": {
+        "cofactorless": false,
+        "cofactored": true
+      }
+    },
+    {
+      "label": "speccheck case 5",
+      "messageHex": "e47d62c63f830dc7a6851a0b1f33ae4bb2f507fb6cffec4011eaccd55b53f56c",
+      "publicKeyHex": "cdb267ce40c5cd45306fa5d2f29731459387dbf9eb933b7bd5aed9a765b88d4d",
+      "signatureHex": "21122a84e0b5fca4052f5b1235c80a537878b38f3142356b2c2384ebad4668b7e40bc836dac0f71076f9abe3a53f9c03c1ceeeddb658d0030494ace586687405",
+      "expected": "reject",
+      "precheckFailure": "A is not of prime order",
+      "equationsWithoutPrechecks": {
+        "cofactorless": false,
+        "cofactored": true
+      }
+    },
+    {
+      "label": "speccheck case 6",
+      "messageHex": "85e241a07d148b41e47d62c63f830dc7a6851a0b1f33ae4bb2f507fb6cffec40",
+      "publicKeyHex": "442aad9f089ad9e14647b1ef9099a1ff4798d78589e66f28eca69c11f582a623",
+      "signatureHex": "e96f66be976d82e60150baecff9906684aebb1ef181f67a7189ac78ea23b6c0e547f7690a0e2ddcd04d87dbc3490dc19b3b3052f7ff0538cb68afb369ba3a514",
+      "expected": "reject",
+      "precheckFailure": "S is not less than L",
+      "equationsWithoutPrechecks": {
+        "cofactorless": true,
+        "cofactored": true
+      }
+    },
+    {
+      "label": "speccheck case 7",
+      "messageHex": "85e241a07d148b41e47d62c63f830dc7a6851a0b1f33ae4bb2f507fb6cffec40",
+      "publicKeyHex": "442aad9f089ad9e14647b1ef9099a1ff4798d78589e66f28eca69c11f582a623",
+      "signatureHex": "8ce5b96c8f26d0ab6c47958c9e68b937104cd36e13c33566acd2fe8d38aa19427e71f98a473474f2f13f06f97c20d58cc3f54b8bd0d272f42b695dd7e89a8c22",
+      "expected": "reject",
+      "precheckFailure": "S is not less than L",
+      "equationsWithoutPrechecks": {
+        "cofactorless": true,
+        "cofactored": true
+      }
+    },
+    {
+      "label": "speccheck case 8",
+      "messageHex": "9bedc267423725d473888631ebf45988bad3db83851ee85c85e241a07d148b41",
+      "publicKeyHex": "f7badec5b8abeaf699583992219b7b223f1df3fbbea919844e3f7c554a43dd43",
+      "signatureHex": "ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff03be9678ac102edcd92b0210bb34d7428d12ffc5df5f37e359941266a4e35f0f",
+      "expected": "reject",
+      "precheckFailure": "A is not of prime order",
+      "equationsWithoutPrechecks": {
+        "cofactorless": false,
+        "cofactored": false
+      }
+    },
+    {
+      "label": "speccheck case 9",
+      "messageHex": "9bedc267423725d473888631ebf45988bad3db83851ee85c85e241a07d148b41",
+      "publicKeyHex": "f7badec5b8abeaf699583992219b7b223f1df3fbbea919844e3f7c554a43dd43",
+      "signatureHex": "ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffca8c5b64cd208982aa38d4936621a4775aa233aa0505711d8fdcfdaa943d4908",
+      "expected": "reject",
+      "precheckFailure": "A is not of prime order",
+      "equationsWithoutPrechecks": {
+        "cofactorless": true,
+        "cofactored": true
+      }
+    },
+    {
+      "label": "speccheck case 10",
+      "messageHex": "e96b7021eb39c1a163b6da4e3093dcd3f21387da4cc4572be588fafae23c155b",
+      "publicKeyHex": "ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+      "signatureHex": "a9d55260f765261eb9b84e106f665e00b867287a761990d7135963ee0a7d59dca5bb704786be79fc476f91d3f3f89b03984d8068dcf1bb7dfc6637b45450ac04",
+      "expected": "reject",
+      "precheckFailure": "A is not a canonical encoding of a curve point",
+      "equationsWithoutPrechecks": {
+        "cofactorless": false,
+        "cofactored": true
+      }
+    },
+    {
+      "label": "speccheck case 11",
+      "messageHex": "39a591f5321bbe07fd5a23dc2f39d025d74526615746727ceefd6e82ae65c06f",
+      "publicKeyHex": "ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+      "signatureHex": "a9d55260f765261eb9b84e106f665e00b867287a761990d7135963ee0a7d59dca5bb704786be79fc476f91d3f3f89b03984d8068dcf1bb7dfc6637b45450ac04",
+      "expected": "reject",
+      "precheckFailure": "A is not a canonical encoding of a curve point",
+      "equationsWithoutPrechecks": {
+        "cofactorless": true,
+        "cofactored": true
+      }
+    },
+    {
+      "label": "honest key and signature",
+      "messageHex": "6d6d7020617574686f72697479206564676520636173653a20686f6e657374",
+      "publicKeyHex": "39305025f5300571bf01ef1e1f82b306ce1ceb1a898749af8da02a35a663217a",
+      "signatureHex": "fb5fff1bf197a8f43f6f7012ae2b9051c8c3632e37112ace77e9e4ac5e600f4155b541342558a08b6b1cc8810cd32a4eb0af2728237b0c343f6a91ac18350801",
+      "expected": "accept",
+      "precheckFailure": null,
+      "equationsWithoutPrechecks": {
+        "cofactorless": true,
+        "cofactored": true
+      }
+    },
+    {
+      "label": "honest signature with S + L (unreduced S)",
+      "messageHex": "6d6d7020617574686f72697479206564676520636173653a20686f6e657374",
+      "publicKeyHex": "39305025f5300571bf01ef1e1f82b306ce1ceb1a898749af8da02a35a663217a",
+      "signatureHex": "fb5fff1bf197a8f43f6f7012ae2b9051c8c3632e37112ace77e9e4ac5e600f41428937913fbbb2e341b9bf24ebcc0963b0af2728237b0c343f6a91ac18350811",
+      "expected": "reject",
+      "precheckFailure": "S is not less than L",
+      "equationsWithoutPrechecks": {
+        "cofactorless": true,
+        "cofactored": true
+      }
+    },
+    {
+      "label": "identity key, R = identity, S = 0, message one",
+      "messageHex": "6d6d7020617574686f72697479206564676520636173653a206964656e74697479206b65792c2052203d206964656e746974792c2053203d20302c206d657373616765206f6e65",
+      "publicKeyHex": "0100000000000000000000000000000000000000000000000000000000000000",
+      "signatureHex": "01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+      "expected": "reject",
+      "precheckFailure": "A is not of prime order",
+      "equationsWithoutPrechecks": {
+        "cofactorless": true,
+        "cofactored": true
+      }
+    },
+    {
+      "label": "identity key, R = identity, S = 0, message two",
+      "messageHex": "6d6d7020617574686f72697479206564676520636173653a206964656e74697479206b65792c2052203d206964656e746974792c2053203d20302c206d6573736167652074776f",
+      "publicKeyHex": "0100000000000000000000000000000000000000000000000000000000000000",
+      "signatureHex": "01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+      "expected": "reject",
+      "precheckFailure": "A is not of prime order",
+      "equationsWithoutPrechecks": {
+        "cofactorless": true,
+        "cofactored": true
+      }
+    },
+    {
+      "label": "mixed-order key, S = r + k*a, k mod 8 != 0",
+      "messageHex": "6d6d7020617574686f72697479206564676520636173653a206d697865642d6f72646572206b65792030",
+      "publicKeyHex": "ce8650aca323dd09808c7a71f9eaee3538eb83342ef1e44897d4a8976d21e724",
+      "signatureHex": "8acdf8d01267ac86d83540a3ee9999b51bad21615124a2ec0e55ebfda398c8c9335c9fcd00587c96e699190cb45640ac8826a7557e12256a01f383ebc5df2e0b",
+      "expected": "reject",
+      "precheckFailure": "A is not of prime order",
+      "equationsWithoutPrechecks": {
+        "cofactorless": false,
+        "cofactored": true
+      }
+    },
+    {
+      "label": "mixed-order key, S = r + k*a, k mod 8 = 0",
+      "messageHex": "6d6d7020617574686f72697479206564676520636173653a206d697865642d6f72646572206b65792034",
+      "publicKeyHex": "ce8650aca323dd09808c7a71f9eaee3538eb83342ef1e44897d4a8976d21e724",
+      "signatureHex": "541ee1eed99741763a446f89f969aaa15980ab7819f2c719a97037ff179476595e8e1ed50e37395af8065d2bbff273504ab0cc5a99972821bd177d995711500c",
+      "expected": "reject",
+      "precheckFailure": "A is not of prime order",
+      "equationsWithoutPrechecks": {
+        "cofactorless": true,
+        "cofactored": true
+      }
+    },
+    {
+      "label": "prime-order key, R = identity, S = k*a",
+      "messageHex": "6d6d7020617574686f72697479206564676520636173653a206964656e746974792052",
+      "publicKeyHex": "692630394f8c151646f36e4def73c6b1c812c1bde62fda7c5beaa2e46fec56e1",
+      "signatureHex": "0100000000000000000000000000000000000000000000000000000000000000b7cf9b5893a5fb2d2c0a863727e24eb7cd1abc4906acc26b939ca06172f29d03",
+      "expected": "reject",
+      "precheckFailure": "R is not of prime order",
+      "equationsWithoutPrechecks": {
+        "cofactorless": true,
+        "cofactored": true
+      }
+    },
+    {
+      "label": "prime-order key, mixed-order R = rB + T8, S = r + k*a",
+      "messageHex": "6d6d7020617574686f72697479206564676520636173653a206d697865642d6f726465722052",
+      "publicKeyHex": "b1049f7cb34b2d7a28e2fba88284db07e24fd71ea1dace6fcf96f3da19bc93aa",
+      "signatureHex": "1940832117d8ec5a7201a6ef8462382d4da1b13d63c7a44b6cc4940f099d50c47125c9eea4d7de98993c5b5bebad0fce1265eedd5a16b37629d8082ca32bd901",
+      "expected": "reject",
+      "precheckFailure": "R is not of prime order",
+      "equationsWithoutPrechecks": {
+        "cofactorless": false,
+        "cofactored": true
+      }
+    },
+    {
+      "label": "prime-order key, R = a point of order 8, S = k*a",
+      "messageHex": "6d6d7020617574686f72697479206564676520636173653a20736d616c6c2d6f726465722052206120706f696e74206f66206f726465722038",
+      "publicKeyHex": "050a93edbd8c32d63189fd12b9bce473bfe0a30701ba34ac6b8b2240ce92a54d",
+      "signatureHex": "26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc0547ab5fad260346572fa0e2b538edc3ed113d6a6244740eac59010d9fec361607",
+      "expected": "reject",
+      "precheckFailure": "R is not of prime order",
+      "equationsWithoutPrechecks": {
+        "cofactorless": false,
+        "cofactored": true
+      }
+    },
+    {
+      "label": "prime-order key, R = the point of order 2, S = k*a",
+      "messageHex": "6d6d7020617574686f72697479206564676520636173653a20736d616c6c2d6f7264657220522074686520706f696e74206f66206f726465722032",
+      "publicKeyHex": "70b08af3f4a2c4020b9c6d6488b0881bbd8fad6ef05c8a7993db6f3d9031d514",
+      "signatureHex": "ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f6ce2a919dc759dd46616ef4bf07fc1e5dd953ef2447676b1cf73d2bb7b08690a",
+      "expected": "reject",
+      "precheckFailure": "R is not of prime order",
+      "equationsWithoutPrechecks": {
+        "cofactorless": false,
+        "cofactored": true
+      }
+    },
+    {
+      "label": "prime-order key, R = non-canonical identity (y = p + 1), S = k*a",
+      "messageHex": "6d6d7020617574686f72697479206564676520636173653a206e6f6e2d63616e6f6e6963616c2052",
+      "publicKeyHex": "cab46852477f8b48e410cd62912d0f86b97c601667dd9dbeaaff3c42f59355e7",
+      "signatureHex": "eeffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f68878e6b49d39614970a9b6a13de1849bf9a86c8b24d77670063551cd902c109",
+      "expected": "reject",
+      "precheckFailure": "R is not a canonical encoding of a curve point",
+      "equationsWithoutPrechecks": {
+        "cofactorless": true,
+        "cofactored": true
+      }
+    }
+  ]
+}
diff --git a/tests/gossip-lanes.test.js b/tests/gossip-lanes.test.js
index 0d9c19a9..2683b336 100644
--- a/tests/gossip-lanes.test.js
+++ b/tests/gossip-lanes.test.js
@@ -35,8 +35,8 @@ const { SymNode } = require('../lib/node');
 const { NullDiscovery } = require('../lib/discovery');
 const { nodeDir } = require('../lib/config');
 const { RelayConnection } = require('../lib/relay');
-const { RoleGrantStore } = require('../lib/role-grant-store');
-const { signAttestation, signCheckpoint, signWitness, signGrant, verifyGrant } = require('../lib/core');
+const Auth = require('../lib/core/authority');
+const { signAttestation, signCheckpoint, signWitness } = require('../lib/core');
 const { admitAs } = require('./_core-secure');
 
 const ROOM = 'g';
@@ -53,9 +53,6 @@ const forged = (k) => ({ of: `cmb-${++n}`, by: k.id, at: 1, roster: ROOM, verdic
 const hex = () => crypto.randomBytes(32).toString('hex');
 const CATS7 = { focus: 'admit', issue: 'admit', intent: 'guard', motivation: 'admit', commitment: 'silent', perspective: 'admit', mood: 'admit' };
 const wireForged = (k, extra = {}) => ({ of: `cmb-${hex()}`, assertionId: `asrt-${hex()}`, by: k.id, at: 1, room: ROOM, method: 'heuristic', verdict: 'aligned', categories: CATS7, role: 'participant', seq: ++n + 1, prev: hex(), sigAlg: 'ed25519', sig: forgedSig(), ...extra });
-// Since 0.14 every role-grant names the key it confers authority on (design D3).
-const SOME_KEY = Buffer.alloc(32, 9).toString('base64url');
-const forgedGrant = (by, grantee) => ({ type: 'role-grant', grantee, granteeKey: SOME_KEY, role: 'validator', grantedBy: by, grantedAt: ++n, sig: forgedSig(), sigAlg: 'ed25519' });
 const respell = (s) => [`${s}=`, `${s}==`, ` ${s}`, `${s.slice(0, 40)}\n${s.slice(40)}`, s.replace(/-/g, '+').replace(/_/g, '/'), `${s}!`].filter((x) => x !== s);
 
 /** A node (not started) on an injected clock, with what it gossips captured. */
@@ -77,105 +74,33 @@ function withNode(opts, fn) {
   }
 }
 
-describe('role grants are gossip under the budget (F1)', () => {
-  it('a captured grant re-spelled is refused or a repeat: never stored, written or relayed again, and nothing is spent', () => {
-    const A = kp('anchor-A');
-    withNode({ anchor: { nodeId: A.id, publicKey: A.pub } }, ({ node, sent }) => {
-      const g = signGrant({ type: 'role-grant', grantee: 'node-v', granteeKey: SOME_KEY, role: 'validator', grantedBy: A.id, grantedAt: 1 }, A.priv);
-      assert.strictEqual(node._ingestRoleGrant(g, 'p').ok, true);
-      assert.strictEqual(sent.length, 1, 'relayed once');
+describe('authority statements are gossip under the budget (F1, MMP §6.6.8)', () => {
+  it('a captured statement re-spelled is refused before the budget; a repeat is free; neither is held, written or relayed again', () => {
+    const A = kp('018f47a0-7b21-7abc-8def-0000000000f1');
+    withNode({ anchor: { threshold: 1, keys: [{ key: A.pub }] } }, ({ node, sent }) => {
+      const peer = admitAs(node, { nodeId: 'p' });
+      const V = kp('018f47a0-7b21-7abc-8def-0000000000f2');
+      const g = Auth.signStatement({ kind: 'grant', authorisedBy: 'anchor', subject: { nodeId: V.id, key: V.pub }, role: 'validator', nonce: Auth.freshNonce(), sigs: [] }, A.priv, A.pub);
+      assert.strictEqual(node._ingestAuthority(g, peer).result, 'held');
+      node._authoritySettle();
+      assert.strictEqual(sent.filter((f) => f.type === 'authority-statement').length, 1, 'relayed once');
       const tokens = node._gossipBuckets.get('p').tokens;
-      assert.strictEqual(node._gossipNewLane - tokens, 1, 'a new grant spent one');
-      const spellings = respell(g.sig);
-      assert.ok(spellings.length >= 5 && spellings.every((sig) => verifyGrant({ ...g, sig }, A.pub).valid), 'every spelling verifies: that was the amplification');
+      const spellings = respell(g.sigs[0].sig);
+      assert.ok(spellings.length >= 5);
       const reasons = new Set();
-      for (let i = 0; i < 6000; i++) {
-        const r = node._ingestRoleGrant({ ...g, sig: spellings[i % spellings.length] }, 'p');
-        assert.strictEqual(r.ok, false);
-        reasons.add(r.reason);
-      }
-      for (let i = 0; i < 1000; i++) reasons.add(node._ingestRoleGrant({ ...g }, 'q').reason);
-      assert.deepStrictEqual([...reasons].sort(), ['duplicate', 'non-canonical-signature']);
-      assert.strictEqual(node._roleGrants.size(), 1, 'one grant held');
-      assert.strictEqual(node._roleGrants.grantsFor('node-v').length, 1);
-      const file = path.join(node._dir, 'role-grants', 'role-grants.jsonl');
+      for (let i = 0; i < 6000; i++) reasons.add(node._ingestAuthority({ ...g, sigs: [{ key: A.pub, sig: spellings[i % spellings.length] }] }, peer).result);
+      const q = admitAs(node, { nodeId: 'q' });
+      for (let i = 0; i < 1000; i++) reasons.add(node._ingestAuthority({ ...g }, q).result);
+      assert.deepStrictEqual([...reasons].sort(), ['duplicate', 'invalid'], 'a spelling is not of the shape; the id is a repeat');
+      assert.strictEqual(node._authority.size(), 1, 'one statement held');
+      const file = path.join(node._dir, 'authority', `statements-${Auth.pinDigest(node._pin)}.jsonl`);
       assert.strictEqual(fs.readFileSync(file, 'utf8').trim().split('\n').length, 1, 'one line written');
-      assert.strictEqual(sent.length, 1, 'and nothing relayed again');
+      node._authoritySettle();
+      assert.strictEqual(sent.filter((f) => f.type === 'authority-statement').length, 1, 'and nothing relayed again');
       assert.strictEqual(node._gossipBuckets.get('p').tokens, tokens, 'nothing spent');
       assert.strictEqual(node._gossipBuckets.has('q'), false);
-      assert.strictEqual(node.metrics().signaturesNotCanonical, 6000, 'the refusals are counted');
-    });
-  });
-
-  it("new grants spend the lane's budget before their signatures are checked, and only a grant kept is relayed", () => {
-    const A = kp('anchor-A');
-    withNode({ anchor: { nodeId: A.id, publicKey: A.pub } }, ({ node, sent }) => {
-      const P = kp('grantor-P');
-      const Q = kp('grantor-Q');
-      node._roster.bind(P.id, P.pub, 'proven');
-      node._roster.bind(Q.id, Q.pub, 'proven');
-      // Since 0.13.17 only a record rooted at the anchor is kept, or checked at all: P and Q are
-      // validators by the anchor's grant, so their grants are rooted and reach the signature check.
-      for (const G of [P, Q]) {
-        assert.strictEqual(node._roleGrants.record(signGrant({ type: 'role-grant', grantee: G.id, granteeKey: G.pub, role: 'validator', grantedBy: A.id, grantedAt: 0 }, A.priv)).stored, true);
-      }
-      const reasons = {};
-      for (let i = 0; i < 300; i++) {
-        const r = node._ingestRoleGrant(forgedGrant(P.id, `x-${i}`), 'p');
-        reasons[r.reason] = (reasons[r.reason] || 0) + 1;
-      }
-      assert.deepStrictEqual(reasons, { 'bad-signature': 100, 'over-budget': 200 }, 'a new peer checks 100, then refuses unverified');
-      // A grantor whose key is not held costs nothing.
-      for (let i = 0; i < 100; i++) assert.strictEqual(node._ingestRoleGrant(forgedGrant('nobody', 'x'), 'p5').reason, 'unknown-grantor-key');
-      assert.strictEqual(node._gossipBuckets.has('p5'), false);
-      assert.strictEqual(sent.length, 0, 'nothing refused was relayed');
-      // Genuine grants from one grantor: kept within its delegation subtree's budget (final re-review
-      // ruling A), and only those relayed.
-      node._roleGrants._budget = 16;
-      let kept = 0;
-      for (let i = 0; i < 70; i++) {
-        const r = node._ingestRoleGrant(signGrant({ type: 'role-grant', grantee: 'node-x', granteeKey: SOME_KEY, role: 'validator', grantedBy: P.id, grantedAt: i }, P.priv), 'p2');
-        if (r.ok) kept++; else assert.strictEqual(r.reason, 'outranked');
-      }
-      assert.strictEqual(kept, 16, 'P\'s subtree holds its budget: the 16 earliest');
-      assert.strictEqual(sent.length, 16);
-      // Another subtree's grant to the same grantee is not kept out by P's.
-      assert.strictEqual(node._ingestRoleGrant(signGrant({ type: 'role-grant', grantee: 'node-x', granteeKey: SOME_KEY, role: 'validator', grantedBy: Q.id, grantedAt: 1 }, Q.priv), 'p3').ok, true);
     });
   });
-
-  it("the store dedups by the signature's bytes, keeps the canonical spelling, and keeps each subtree within its budget by one order", () => {
-    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'grants-'));
-    try {
-      const A = kp('A');
-      const P = kp('P');
-      const Q = kp('Q');
-      const opts = { anchor: { nodeId: A.id, publicKey: A.pub }, dir, subtreeBudget: 3 };
-      const st = new RoleGrantStore(opts);
-      const keyOf = (grantee) => ({ [P.id]: P.pub, [Q.id]: Q.pub })[grantee] || SOME_KEY;
-      const grant = (by, grantee, at) => signGrant({ type: 'role-grant', grantee, granteeKey: keyOf(grantee), role: 'validator', grantedBy: by.id, grantedAt: at }, by.priv);
-      const g = grant(A, 'v', 1);
-      assert.strictEqual(st.record({ ...g, sig: `${g.sig}=` }).stored, true, 'a direct caller may hand over another spelling');
-      assert.strictEqual(st.grantsFor('v')[0].sig, g.sig, 'it is kept as its signer wrote it');
-      for (const sig of [g.sig, ...respell(g.sig)]) assert.strictEqual(st.record({ ...g, sig }).reason, 'duplicate');
-      assert.strictEqual(st.has(` ${g.sig}`), true);
-      assert.strictEqual(st.size(), 1);
-      for (const G of [P, Q]) assert.strictEqual(st.record(grant(A, G.id, 0)).stored, true);
-
-      const r = (by, grantee, at) => st.record(grant(by, grantee, at)).reason ?? 'stored';
-      assert.deepStrictEqual([r(P, 'x', 5), r(P, 'y', 6), r(P, 'z', 7)], ['stored', 'stored', 'stored']);
-      assert.strictEqual(r(P, 'w', 8), 'outranked', 'past the budget a later record loses');
-      assert.strictEqual(r(P, 'u', 2), 'stored', 'an earlier one replaces the last kept');
-      assert.deepStrictEqual(st.grantsFor('z'), [], 'the last-ranked record was replaced');
-      assert.strictEqual(st.record(forgedGrant(P.id, 'w')).reason, 'bad-signature', 'refused before it could rank');
-      assert.deepStrictEqual([r(Q, 'x', 6), r(Q, 'y', 7)], ['stored', 'stored'], 'Q\'s subtree has its own budget');
-      assert.deepStrictEqual([r(A, 'x', 8), r(A, 'z', 9)], ['stored', 'stored'], "the anchor's own are never bounded");
-      const again = new RoleGrantStore(opts);
-      assert.strictEqual(again.size(), st.size(), 'a restart keeps what the rule keeps');
-      assert.strictEqual(again.digest().digest, st.digest().digest);
-      assert.strictEqual(again.resolveRole('x', 100), 'validator');
-    } finally { fs.rmSync(dir, { recursive: true, force: true }); }
-  });
 });
 
 describe('the budget is kept per PROVEN peer (F2; Core Secure design D1)', () => {
@@ -201,7 +126,7 @@ describe('the budget is kept per PROVEN peer (F2; Core Secure design D1)', () =>
     });
   });
 
-  it('a peer\'s frames over any of its sessions spend one budget; checkpoints, witnesses and grants too', () => {
+  it('a peer\'s frames over any of its sessions spend one budget; checkpoints, witnesses and authority statements too', () => {
     withNode({}, ({ node }) => {
       const A = kp('att-A');
       node._roster.bind(A.id, A.pub, 'proven');
@@ -211,14 +136,19 @@ describe('the budget is kept per PROVEN peer (F2; Core Secure design D1)', () =>
       for (let i = 0; i < 10; i++) {
         node._frameHandler.handle(lan, { type: 'sym-attest-checkpoint', checkpoint: { by: A.id, room: ROOM, uptoSeq: i + 1, root: hex(), at: 1, sigAlg: 'ed25519', sig: forgedSig() } });
         node._frameHandler.handle(relay, { type: 'sym-attest-witness', witness: { attester: A.id, room: ROOM, uptoSeq: i + 1, root: hex(), by: A.id, role: 'participant', at: 1, sigAlg: 'ed25519', sig: forgedSig() } });
-        node._frameHandler.handle(lan, { type: 'role-grant', grant: forgedGrant(A.id, `x-${i}`) });
       }
       assert.deepStrictEqual([...node._gossipBuckets.keys()], ['peer-two-paths']);
-      // A role grant from a grantor no chain reaches costs nothing (0.13.17, 0.14 D3). The first 8
-      // statements for A that fail spend the one budget; past them this peer's statements for A are
-      // dropped unverified for the minute, spending nothing (final re-review, Finding 3).
+      // The first 8 statements for A that fail spend the one budget; past them this peer's statements
+      // for A are dropped unverified for the minute, spending nothing (final re-review, Finding 3).
       assert.strictEqual(node._gossipNewLane - node._gossipBuckets.get('peer-two-paths').tokens, 8, 'each spent one of the one budget, until the signer was muted');
       assert.strictEqual(node._relayMuted('peer-two-paths', A.id), true);
+      // Authority statements over either path draw on the same budget.
+      const before = node._gossipBuckets.get('peer-two-paths').tokens;
+      const stmt = () => ({ kind: 'grant', authorisedBy: 'anchor', subject: { nodeId: '018f47a0-7b21-7abc-8def-0000000000f3', key: A.pub }, role: 'admin', nonce: Auth.freshNonce(), sigs: [{ key: A.pub, sig: forgedSig() }] });
+      node._frameHandler.handle(lan, { type: 'authority-statement', statement: stmt() });
+      node._frameHandler.handle(relay, { type: 'authority-statement', statement: stmt() });
+      assert.deepStrictEqual([...node._gossipBuckets.keys()], ['peer-two-paths']);
+      assert.ok(node._gossipBuckets.get('peer-two-paths').tokens <= before - 2);
     });
   });
 
@@ -342,23 +272,25 @@ describe('an over-long signature (F5)', () => {
       let lookups = 0;
       const has = node._attestations.has.bind(node._attestations);
       node._attestations.has = (sig) => { lookups++; return has(sig); };
-      let grantLookups = 0;
-      const grantHas = node._roleGrants.has.bind(node._roleGrants);
-      node._roleGrants.has = (sig) => { grantLookups++; return grantHas(sig); };
       const att = signed({ of: 'cmb-1', by: A.id, at: 1, roster: ROOM, method: 'heuristic', verdict: 'aligned', categories: {}, role: 'participant', seq: 1, prev: 'p' }, A.priv, signAttestation);
       const cp = signed({ type: 'checkpoint', by: A.id, roster: ROOM, upto_seq: 8, root: 'r8', at: 1 }, A.priv, signCheckpoint);
       const w = signed({ type: 'witness', attester: A.id, roster: ROOM, upto_seq: 8, root: 'r8', by: W.id, role: 'participant', at: 1 }, W.priv, signWitness);
-      const g = signGrant({ type: 'role-grant', grantee: 'v', granteeKey: SOME_KEY, role: 'validator', grantedBy: A.id, grantedAt: 1 }, A.priv);
       const ingest = (sig) => [
         node._ingestAttestation({ ...att, sig }, 'p', 'p').reason,
         node._ingestCheckpoint({ ...cp, sig }, 'p').reason,
         node._ingestWitness({ ...w, sig }, 'p').reason,
-        node._ingestRoleGrant({ ...g, sig }, 'p').reason,
       ];
-      for (const sig of [`${att.sig}${'A'.repeat(900_000)}`, 'A'.repeat(129), '', undefined, 42]) assert.deepStrictEqual(ingest(sig), ['malformed', 'malformed', 'malformed', 'malformed']);
-      assert.deepStrictEqual(ingest('A'.repeat(128)), Array(4).fill('non-canonical-signature'), '128 characters is not too long');
-      assert.deepStrictEqual(ingest(`${att.sig}=`), Array(4).fill('non-canonical-signature'));
-      assert.deepStrictEqual([lookups, grantLookups], [0, 0], 'none was looked up');
+      for (const sig of [`${att.sig}${'A'.repeat(900_000)}`, 'A'.repeat(129), '', undefined, 42]) assert.deepStrictEqual(ingest(sig), ['malformed', 'malformed', 'malformed']);
+      assert.deepStrictEqual(ingest('A'.repeat(128)), Array(3).fill('non-canonical-signature'), '128 characters is not too long');
+      assert.deepStrictEqual(ingest(`${att.sig}=`), Array(3).fill('non-canonical-signature'));
+      assert.strictEqual(lookups, 0, 'none was looked up');
+      // An authority statement's signature is exactly 86 canonical characters (§6.6.3): anything else is
+      // not of the shape, refused before the budget, any decoding or the store.
+      const session = admitAs(node, { nodeId: 'p' });
+      const stmt = { kind: 'grant', authorisedBy: 'anchor', subject: { nodeId: '018f47a0-7b21-7abc-8def-0000000000f4', key: A.pub }, role: 'admin', nonce: Auth.freshNonce() };
+      for (const sig of [`${att.sig}${'A'.repeat(900_000)}`, 'A'.repeat(129), 'A'.repeat(128), `${att.sig}=`, '', 42]) {
+        assert.strictEqual(node._ingestAuthority({ ...stmt, sigs: [{ key: A.pub, sig }] }, session).result, 'invalid');
+      }
       assert.strictEqual(node._ingestAttestation(att, 'p', 'p').ok, true);
       assert.strictEqual(lookups, 1, 'a canonical one is');
     });
diff --git a/tests/memory-store.test.js b/tests/memory-store.test.js
index 5d6994fb..276f1996 100644
--- a/tests/memory-store.test.js
+++ b/tests/memory-store.test.js
@@ -239,8 +239,8 @@ describe('MemoryStore', () => {
       const canon = store.write('grounded knowledge', { tags: ['canon-test'] });
 
       // Promote one to the Canon tier (validator authority required).
-      const res = store.validateCMB(canon.key, { byRole: 'validator' });
-      assert.ok(res.ok, 'validateCMB should succeed with validator role');
+      const res = store.validateCMB(canon.key, { lifecycle: 'validated' });
+      assert.ok(res.ok, 'validateCMB succeeds with validated authority over the CMB');
       assert.strictEqual(store.getLifecycle(canon.key), 'validated');
 
       // Backdate both far past any freshness window.
diff --git a/tests/relay-fuzz.test.js b/tests/relay-fuzz.test.js
index ac1f0034..d19e4ac8 100644
--- a/tests/relay-fuzz.test.js
+++ b/tests/relay-fuzz.test.js
@@ -25,11 +25,13 @@ const U = { toString: 1 };                 // unprintable
 const deepArr = (d) => { let a = []; for (let i = 0; i < d; i++) a = [a]; return a; };
 const VALS = { U, num: 42, arr: [1, 2], obj: {}, nul: null, bool: true, deep: deepArr(100), long: 'x'.repeat(5000) };
 const TYPES = ['handshake', 'cmb', 'mood', 'wake-channel', 'peer-info', 'attestation', 'cmb-fetch', 'cmb-fetch-result',
-  'checkpoint', 'witness', 'role-grant', 'role-revoke', 'role-chain-fetch', 'role-chain', 'node-stats', 'message',
+  'checkpoint', 'witness', 'role-grant', 'role-revoke', 'role-chain-fetch', 'role-chain', 'role-digest', 'node-stats', 'message',
+  'authority-statement', 'authority-digest', 'authority-fetch', 'authority-set',
   'xmesh-insight', 'cmb-anchors', 'mesh-room-join', 'ping', 'pong', 'error', 'state-sync', 'zzz'];
 const FIELDS = ['nodeId', 'name', 'publicKey', 'room', 'roomGrant', 'grant', 'cmb', 'content', 'mood', 'fromName', 'platform',
   'token', 'environment', 'peers', 'attestation', 'key', 'keys', 'reqId', 'found', 'notFound', 'grantees', 'grants', 'checkpoint',
-  'witness', 'stats', 'trajectory', 'anomaly', 'remixScore', 'coherence', 'timestamp', 'directed', 'to', 'code', 'detail', 'message'];
+  'witness', 'stats', 'trajectory', 'anomaly', 'remixScore', 'coherence', 'timestamp', 'directed', 'to', 'code', 'detail', 'message',
+  'statement', 'root', 'count', 'ids', 'after', 'statements', 'missing', 'next'];
 
 function corpus() {
   const out = [];
@@ -111,7 +113,7 @@ describe('fuzz: malformed frames of every type (port of fuzz-relay.js)', () => {
       assert.ok(node._relay.present.has('0'.repeat(8) + '-sentinel'), 'the relay link keeps working');
       assert.strictEqual(node._peers.size, 0, 'no peer from anything sent in the clear');
       assert.strictEqual(node._roster.size(), 0, 'and no key bound');
-      assert.strictEqual(node._roleGrants.size(), 0);
+      assert.strictEqual(node._authority.size(), 0);
       assert.strictEqual(node._peerWakeChannels.size, 0);
     } finally { w.stop(); await node.stop(); await new Promise((r) => wss.close(() => r())); fs.rmSync(nodeDirById(node.nodeId), { recursive: true, force: true }); }
   });
diff --git a/tests/role-chain-fetch.test.js b/tests/role-chain-fetch.test.js
deleted file mode 100644
index d8bff1f8..00000000
--- a/tests/role-chain-fetch.test.js
+++ /dev/null
@@ -1,272 +0,0 @@
-'use strict';
-
-require('./_isolate-home'); // redirect $HOME before lib/config loads
-
-/**
- * Design D3: a grant or revoke that arrives before the grant rooting its grantor (gossip has no
- * order) is not lost — and not parked in a pending set that anyone can flood (0.13.17's fix, which
- * 0.14 replaces). The node asks the session that delivered it for the chain, with a directed
- * `role-chain-fetch`, and holds the record only for that fetch: at most 64 per session, until the
- * answer or a timeout. The answer is ordinary signed grants, verified top-down.
- *
- * Ports of the 0.13.17 review's reproductions ooo.js and rev.js (out-of-order grants and revokes)
- * and pending-abuse.js (crowding, forged and padded copies, retry cost).
- */
-
-const { describe, it } = require('node:test');
-const assert = require('node:assert');
-const crypto = require('crypto');
-const fs = require('fs');
-const path = require('path');
-const { SymNode } = require('../lib/node');
-const { NullDiscovery } = require('../lib/discovery');
-const { nodeDirById } = require('../lib/config');
-const { signGrant } = require('../lib/core');
-const { connectNodes, until, admitAs, deliver } = require('./_core-secure');
-
-function kp(nodeId) {
-  const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519');
-  return {
-    nodeId,
-    priv: privateKey.export({ format: 'der', type: 'pkcs8' }).subarray(16).toString('base64url'),
-    pub: publicKey.export({ format: 'der', type: 'spki' }).subarray(12).toString('base64url'),
-  };
-}
-const grant = (type, grantee, role, grantor, at, extra = {}) =>
-  signGrant({ type, grantee: grantee.nodeId, role, grantedBy: grantor.nodeId, grantedAt: at, ...(type === 'role-grant' ? { granteeKey: grantee.pub } : {}), ...extra }, grantor.priv);
-const uniq = (base) => `${base}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
-
-const A = kp('anchor-node'), V = kp('validator-node'), X = kp('x-node');
-const t = Date.now();
-const gAV = grant('role-grant', V, 'validator', A, t - 3000);
-const gVX = grant('role-grant', X, 'validator', V, t - 2000);
-const rVX = grant('role-revoke', X, undefined, V, t - 1000);
-const gAX = grant('role-grant', X, 'validator', A, t - 5000);
-const RECS = { AV: gAV, VX: gVX, rVX, AX: gAX };
-
-function boot(base, extra = {}) {
-  const n = new SymNode({ name: uniq(base), silent: true, discovery: new NullDiscovery(), room: 'chain', anchor: { nodeId: A.nodeId, publicKey: A.pub }, ...extra });
-  // These tests are about role-chain-fetch: the admission-time sync (anti-entropy, tested on its
-  // own below) is left out, so a record reaches the store only by the order the test delivers it.
-  if (!extra.sync) n._onRoleDigest = () => {};
-  return n;
-}
-async function stopAll(...nodes) {
-  for (const n of nodes) { try { await n.stop(); } catch { /* */ } try { fs.rmSync(nodeDirById(n.nodeId), { recursive: true, force: true }); } catch { /* */ } }
-}
-
-describe('a grant or revoke that arrives before its root is resolved by role-chain-fetch (D3)', () => {
-  // The roles 0.13.16 resolved for each order (it kept every record): the peer P that relays them
-  // holds the whole chain, as a relaying peer does.
-  for (const [order, role] of [
-    [['AV', 'VX'], 'validator'],
-    [['VX', 'AV'], 'validator'],          // the grant arrives first (grantor key unknown)
-    [['AV', 'VX', 'rVX'], 'participant'],
-    [['AV', 'rVX', 'VX'], 'participant'],
-    [['rVX', 'VX', 'AV'], 'participant'], // both before their root
-    [['VX', 'rVX', 'AV'], 'participant'],
-    [['AX', 'rVX', 'AV'], 'participant'], // rev.js: a revoke before the grant rooting its revoker
-  ]) {
-    it(`${order.join(' → ')}: X ends ${role}`, async () => {
-      const P = boot('chain-p'); const N = boot('chain-n');
-      try {
-        await P.start(); await N.start();
-        for (const k of ['AX', 'AV', 'VX', 'rVX']) if (order.includes(k)) P._roleGrants.record(RECS[k]);
-        await connectNodes(P, N);
-        const s = N._peers.get(P.nodeId).transport;
-        for (const k of order) deliver(N, s, { type: RECS[k].type, grant: RECS[k] });
-        await until(() => N._roleGrants.size() === order.length, 3000);
-        assert.strictEqual(N._roleGrants.size(), order.length, 'every record stored');
-        assert.strictEqual(N.resolveRole(X.nodeId, Date.now(), { key: X.pub }), role);
-        const early = order.some((k, i) => (k === 'VX' || k === 'rVX') && order.indexOf('AV') > i);
-        assert.strictEqual(N._chainStats.fetched > 0, early, 'a fetch only when a record came before the grant vouching its grantor\'s key');
-      } finally { await stopAll(P, N); }
-    });
-  }
-
-  it('a record held for a fetch is never written or relayed; the resolved one is, once', async () => {
-    const P = boot('chain-p2'); const N = boot('chain-n2');
-    try {
-      await P.start(); await N.start();
-      P._roleGrants.record(gAV); P._roleGrants.record(gVX);
-      await connectNodes(P, N);
-      const relayed = [];
-      const orig = N._gossipToRoster.bind(N);
-      N._gossipToRoster = (f, except) => { relayed.push(f.grant && f.grant.sig); return orig(f, except); };
-      const file = path.join(N._dir, 'role-grants', 'role-grants.jsonl');
-      const s = N._peers.get(P.nodeId).transport;
-      // Hold the fetch's answer back for a moment: the early record is held, not written.
-      const sent = [];
-      const send = s.send.bind(s);
-      let hold = true;
-      s.send = (f) => { if (hold && f.type === 'role-chain-fetch') { sent.push(f); return true; } return send(f); };
-      deliver(N, s, { type: 'role-grant', grant: gVX });
-      assert.strictEqual(sent.length, 1, 'one fetch, to the session that delivered it');
-      assert.deepStrictEqual(sent[0].grantees, [V.nodeId]);
-      assert.strictEqual(fs.existsSync(file) ? fs.readFileSync(file, 'utf8').includes(gVX.sig) : false, false, 'not written while held');
-      assert.deepStrictEqual(relayed, [], 'not relayed while held');
-      hold = false;
-      send(sent[0]);
-      await until(() => N._roleGrants.size() === 2, 3000);
-      assert.ok(fs.readFileSync(file, 'utf8').includes(gVX.sig), 'written once resolved');
-      assert.strictEqual(relayed.filter((x) => x === gVX.sig).length, 1, 'and relayed once');
-      assert.strictEqual(N._chainStats.resolved, 1);
-    } finally { await stopAll(P, N); }
-  });
-
-  it('a session that never answers: the held record is dropped at the timeout, and nothing is kept', async () => {
-    const N = boot('chain-timeout', { chainFetchTimeoutMs: 150 });
-    try {
-      await N.start();
-      const mute = admitAs(N, { nodeId: 'mute-peer', name: 'mute', publicKey: kp('m').pub });
-      deliver(N, mute, { type: 'role-grant', grant: gVX });
-      assert.ok(mute.sent.some((f) => f.type === 'role-chain-fetch'));
-      assert.strictEqual(mute._chainHold.grants.size, 1);
-      await until(() => N._chainStats.timedOut === 1, 2000);
-      assert.strictEqual(mute._chainHold.grants.size, 0);
-      assert.strictEqual(N._roleGrants.size(), 0);
-    } finally { await stopAll(N); }
-  });
-
-  it('an answer nobody asked for, or for another session\'s fetch, is not read', async () => {
-    const N = boot('chain-unsolicited');
-    try {
-      await N.start();
-      const a = admitAs(N, { nodeId: 'peer-a', name: 'a', publicKey: kp('a').pub });
-      const b = admitAs(N, { nodeId: 'peer-b', name: 'b', publicKey: kp('b').pub });
-      deliver(N, a, { type: 'role-chain', reqId: 'rc-nothing', grants: [gAV] });
-      assert.strictEqual(N._roleGrants.size(), 0, 'unsolicited');
-      deliver(N, a, { type: 'role-grant', grant: gVX });
-      const reqId = a.sent.find((f) => f.type === 'role-chain-fetch').reqId;
-      deliver(N, b, { type: 'role-chain', reqId, grants: [gAV] });
-      assert.strictEqual(N._roleGrants.size(), 0, 'another session cannot answer it');
-      deliver(N, a, { type: 'role-chain', reqId, grants: [gAV] });
-      assert.strictEqual(N._roleGrants.size(), 2, 'the asked session can');
-    } finally { await stopAll(N); }
-  });
-});
-
-describe('anti-entropy for grants and revokes (security review D, p7-ceiling)', () => {
-  it('a revoke this node missed reaches it at the next admission: the digests differ, the store syncs', async () => {
-    const P = boot('ae-p', { sync: true }); const N = boot('ae-n', { sync: true });
-    try {
-      await P.start(); await N.start();
-      // N knows V as validator and V's grant of X; P also holds the revoke N never got.
-      for (const r of [gAV, gVX]) { P._roleGrants.record(r); N._roleGrants.record(r); }
-      P._roleGrants.record(rVX);
-      assert.strictEqual(N.resolveRole(X.nodeId, Date.now(), { key: X.pub }), 'validator', 'before: the revoke was lost on the way');
-      await connectNodes(P, N);
-      await until(() => N._roleGrants.size() === 3, 4000);
-      assert.strictEqual(N.resolveRole(X.nodeId, Date.now(), { key: X.pub }), 'participant', 'after: the revoke arrived by the sync');
-      assert.ok(N._chainStats.synced >= 1);
-      assert.strictEqual(N._roleGrants.digest().digest, P._roleGrants.digest().digest, 'the stores agree');
-    } finally { await stopAll(P, N); }
-  });
-
-  it('a sync is paged in sync order (each record after its chain), and the pages are bounded', async () => {
-    const N = boot('ae-serve');
-    try {
-      await N.start();
-      const ys = Array.from({ length: 70 }, (_, i) => kp(`ae-y${i}`));
-      for (const [i, y] of ys.entries()) N._roleGrants.record(grant('role-grant', y, 'validator', A, t - 500 + i));
-      const asker = admitAs(N, { nodeId: 'ae-asker', name: 'a', publicKey: kp('ae-q').pub });
-      deliver(N, asker, { type: 'role-chain-fetch', reqId: 'rs-1', sync: true, after: 0 });
-      const first = asker.sent.find((f) => f.type === 'role-chain');
-      assert.strictEqual(first.grants.length, 64, 'a page holds at most 64');
-      assert.strictEqual(first.next, 64, 'and says where the next starts');
-      deliver(N, asker, { type: 'role-chain-fetch', reqId: 'rs-2', sync: true, after: first.next });
-      const second = asker.sent.filter((f) => f.type === 'role-chain')[1];
-      assert.strictEqual(second.grants.length, 6);
-      assert.strictEqual(second.next, undefined, 'the last page');
-    } finally { await stopAll(N); }
-  });
-});
-
-describe('role-chain-fetch cannot be flooded (port of pending-abuse.js)', () => {
-  const junk = (i) => signGrant({ type: 'role-grant', grantee: `g${i}`, granteeKey: kp('j').pub, role: 'validator', grantedBy: `nobody-${i}`, grantedAt: t }, kp('j').priv);
-
-  it('(a) crowding: one session holds at most 64; it cannot displace another session\'s held record', async () => {
-    const N = boot('chain-crowd');
-    try {
-      await N.start();
-      const honest = admitAs(N, { nodeId: 'honest-peer', name: 'h', publicKey: kp('h').pub });
-      const evil = admitAs(N, { nodeId: 'evil-peer', name: 'e', publicKey: kp('e').pub });
-      deliver(N, honest, { type: 'role-grant', grant: gVX });
-      for (let i = 0; i < 1024; i++) deliver(N, evil, { type: 'role-grant', grant: junk(i) });
-      assert.strictEqual(evil._chainHold.grants.size, 64, 'at most 64 per session');
-      assert.strictEqual(evil.sent.filter((f) => f.type === 'role-chain-fetch').length, 64, 'and as many fetches');
-      assert.strictEqual(honest._chainHold.grants.size, 1, 'the honest session\'s record is untouched');
-      const reqId = honest.sent.find((f) => f.type === 'role-chain-fetch').reqId;
-      deliver(N, honest, { type: 'role-chain', reqId, grants: [gAV] });
-      assert.strictEqual(N.resolveRole(X.nodeId, Date.now(), { key: X.pub }), 'validator');
-    } finally { await stopAll(N); }
-  });
-
-  it('(b) a forged copy sent ahead of the genuine record does not keep it out, and is dropped without charging the relayer (re-review N1)', async () => {
-    const N = boot('chain-forged');
-    try {
-      await N.start();
-      const s = admitAs(N, { nodeId: 'relayer', name: 'r', publicKey: kp('r').pub });
-      const h = admitAs(N, { nodeId: 'honest-relayer', name: 'h', publicKey: kp('h2').pub });
-      deliver(N, s, { type: 'role-grant', grant: { ...gVX, grantedAt: gVX.grantedAt + 1 } }); // the genuine sig on altered fields
-      deliver(N, h, { type: 'role-grant', grant: gVX });
-      assert.strictEqual(s._chainHold.grants.size, 1, 'held apart: the forgery on its session');
-      assert.strictEqual(h._chainHold.grants.size, 1, 'the genuine record on its own');
-      deliver(N, s, { type: 'role-chain', reqId: s.sent.find((f) => f.type === 'role-chain-fetch').reqId, grants: [gAV] });
-      // V's statement, relayed: its signature fails under this node's key for V, which the relayer's
-      // binding for V may not share. Dropped and counted, never charged to the relayer (re-review N1).
-      assert.strictEqual(s.closed, false, 'a relayed statement that fails does not close the relayer\'s session');
-      assert.strictEqual(s._chainHold.grants.size, 0, 'the forgery is dropped');
-      deliver(N, h, { type: 'role-chain', reqId: h.sent.find((f) => f.type === 'role-chain-fetch').reqId, grants: [gAV] });
-      assert.strictEqual(N.resolveRole(X.nodeId, Date.now(), { key: X.pub }), 'validator', 'the genuine one stored, the forgery dropped');
-      assert.strictEqual(N._roleGrants.size(), 2);
-    } finally { await stopAll(N); }
-  });
-
-  it('(c) a padded copy (an unsigned field) is stored, persisted and relayed as its signed fields only (A5)', async () => {
-    const N = boot('chain-padded');
-    try {
-      await N.start();
-      const s = admitAs(N, { nodeId: 'relayer', name: 'r', publicKey: kp('r').pub });
-      const relayed = [];
-      N._gossipToRoster = (f) => relayed.push(f.grant);
-      deliver(N, s, { type: 'role-grant', grant: { ...gVX, junk: 'x'.repeat(100_000) } });
-      const reqId = s.sent.find((f) => f.type === 'role-chain-fetch').reqId;
-      deliver(N, s, { type: 'role-chain', reqId, grants: [{ ...gAV, note: 'unsigned' }] });
-      const kept = N._roleGrants.grantsFor(X.nodeId)[0];
-      assert.deepStrictEqual(Object.keys(kept).sort(), ['grantedAt', 'grantedBy', 'grantee', 'granteeKey', 'role', 'sig', 'sigAlg', 'type']);
-      assert.ok(relayed.every((g) => !('junk' in g) && !('note' in g)), 'relayed as signed');
-      const file = fs.readFileSync(path.join(N._dir, 'role-grants', 'role-grants.jsonl'), 'utf8');
-      assert.ok(!file.includes('junk') && !file.includes('unsigned'), 'persisted as signed');
-    } finally { await stopAll(N); }
-  });
-
-  it('(d) a store does no work for held records (there is no pending set to retry)', async () => {
-    const N = boot('chain-cost');
-    try {
-      await N.start();
-      const evil = admitAs(N, { nodeId: 'evil-peer', name: 'e', publicKey: kp('e').pub });
-      for (let i = 0; i < 64; i++) deliver(N, evil, { type: 'role-grant', grant: junk(i) });
-      const ys = Array.from({ length: 200 }, (_, i) => kp(`y${i}`));
-      const recs = ys.map((y, i) => grant('role-grant', y, 'validator', A, t - 1000 + i));
-      const t0 = process.hrtime.bigint();
-      for (const r of recs) N._roleGrants.record(r);
-      const ms = Number(process.hrtime.bigint() - t0) / 1e6;
-      assert.strictEqual(N._roleGrants.size(), 200);
-      assert.ok(ms < 2000, `200 stores in ${ms.toFixed(0)} ms`);
-    } finally { await stopAll(N); }
-  });
-
-  it('the server answers at most 4 a second per session (burst 16), with at most 64 grants', async () => {
-    const N = boot('chain-serve');
-    try {
-      await N.start();
-      N._roleGrants.record(gAV); N._roleGrants.record(gVX);
-      const asker = admitAs(N, { nodeId: 'asker', name: 'a', publicKey: kp('q').pub });
-      for (let i = 0; i < 100; i++) deliver(N, asker, { type: 'role-chain-fetch', reqId: `q${i}`, grantees: [X.nodeId] });
-      const answers = asker.sent.filter((f) => f.type === 'role-chain');
-      assert.strictEqual(answers.length, 16);
-      assert.deepStrictEqual(answers[0].grants.map((g) => g.sig), [gAV.sig, gVX.sig], 'top-down: the grantor\'s root first');
-    } finally { await stopAll(N); }
-  });
-});
diff --git a/tests/role-grant-rooted.test.js b/tests/role-grant-rooted.test.js
deleted file mode 100644
index 6f89e1cf..00000000
--- a/tests/role-grant-rooted.test.js
+++ /dev/null
@@ -1,195 +0,0 @@
-'use strict';
-
-require('./_isolate-home'); // redirect $HOME before lib/config loads
-
-/**
- * 0.13.17 security hotfix (F3). In 0.13.16 one self-signed role-grant from any connected peer was
- * verified against that peer's own first-use key, written to role-grants.jsonl and relayed to the
- * roster; and reading any non-empty role-grants.jsonl threw ("object is not iterable"), so every
- * node that had received it could never start again.
- *
- * Authority flows only along chains rooted at the pinned anchor, so a grant that is not rooted there
- * has no effect: it is not stored, not relayed, and costs nothing. A record on disk that cannot be
- * verified is skipped and counted, and a store that cannot be read leaves the node starting with no
- * grants.
- */
-
-const { describe, it } = require('node:test');
-const assert = require('node:assert');
-const crypto = require('crypto');
-const fs = require('fs');
-const path = require('path');
-const { SymNode } = require('../lib/node');
-const { NullDiscovery } = require('../lib/discovery');
-const { nodeDir, loadOrCreateIdentity } = require('../lib/config');
-const { signGrant } = require('../lib/core');
-const { admitAs, deliver } = require('./_core-secure');
-
-function kp(nodeId) {
-  const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519');
-  return {
-    nodeId,
-    priv: privateKey.export({ format: 'der', type: 'pkcs8' }).subarray(16).toString('base64url'),
-    pub: publicKey.export({ format: 'der', type: 'spki' }).subarray(12).toString('base64url'),
-  };
-}
-// Since 0.14 every role-grant names the key it confers authority on (design D3): the fixtures carry
-// granteeKey, so each record exercises the check the 0.13.17 test meant it to.
-const grant = (type, grantee, role, grantor, at, extra = {}) =>
-  signGrant({ type, grantee: grantee.nodeId, role, grantedBy: grantor.nodeId, grantedAt: at, ...(type === 'role-grant' ? { granteeKey: grantee.pub } : {}), ...extra }, grantor.priv);
-
-const uniq = (base) => `${base}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
-const grantsFile = (name) => path.join(nodeDir(name), 'role-grants', 'role-grants.jsonl');
-
-function boot(name, founder, extra = {}) {
-  return new SymNode({
-    name, silent: true, discovery: new NullDiscovery(), room: 'g',
-    ...(founder ? { anchor: { nodeId: founder.nodeId, publicKey: founder.pub } } : {}),
-    ...extra,
-  });
-}
-// A peer connects: its session proves its key (design D1/D3), the strongest binding a self-signed
-// grant could ever be checked against. Frames then reach the node through the one guarded dispatch.
-function handshake(node, peer) {
-  return admitAs(node, { nodeId: peer.nodeId, name: peer.nodeId, publicKey: peer.pub });
-}
-
-describe('a role-grant that is not rooted at the anchor is not stored (F3)', () => {
-  for (const anchored of [true, false]) {
-    it(`a connected peer's self-signed grant is not persisted, not relayed, and the node restarts (${anchored ? 'anchored' : 'no anchor, as the daemon runs'})`, () => {
-      const name = uniq('rg-self');
-      const founder = kp('founder');
-      const evil = kp('evil-peer');
-      let node = boot(name, anchored ? founder : null);
-      try {
-        const relayed = [];
-        node._gossipToRoster = (frame) => relayed.push(frame);
-        const session = handshake(node, evil);
-        const self = grant('role-grant', evil, 'anchor', evil, Date.now());
-        deliver(node, session, { type: 'role-grant', grant: self });
-        assert.strictEqual(node._roleGrants.has(self.sig), false, 'the unrooted grant is not held');
-        assert.strictEqual(fs.existsSync(grantsFile(name)), false, 'and nothing was written');
-        assert.deepStrictEqual(relayed, [], 'and nothing was relayed');
-        assert.strictEqual(node.resolveRole(evil.nodeId), 'participant');
-        node.stop();
-        node = boot(name, anchored ? founder : null);
-        assert.strictEqual(node.resolveRole(evil.nodeId), 'participant');
-      } finally { node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
-    });
-  }
-
-  it('an anchor-rooted grant relayed by a peer still persists, is relayed once, and resolves after a restart', () => {
-    const name = uniq('rg-rooted');
-    const founder = kp('founder'), relayer = kp('relayer'), V = kp('validator-v');
-    let node = boot(name, founder);
-    try {
-      const relayed = [];
-      node._gossipToRoster = (frame, except) => relayed.push({ frame, except });
-      const session = handshake(node, relayer);
-      const g = grant('role-grant', V, 'validator', founder, Date.now() - 1000, { granteeKey: V.pub });
-      deliver(node, session, { type: 'role-grant', grant: g });
-      assert.strictEqual(node._roleGrants.has(g.sig), true);
-      assert.strictEqual(relayed.length, 1, 'relayed once');
-      assert.strictEqual(relayed[0].except, relayer.nodeId, 'not back to the peer it came from');
-      assert.strictEqual(node.resolveRole(V.nodeId), 'validator');
-      node.stop();
-      node = boot(name, founder);
-      assert.strictEqual(node.resolveRole(V.nodeId), 'validator', 'the rooted grant survives the restart');
-      assert.strictEqual(node._roster.get(V.nodeId), V.pub, 'and the key it vouched for is resolvable');
-    } finally { node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
-  });
-
-  it('the anchor node\'s own grant persists and the node restarts (it could not in 0.13.16)', () => {
-    const name = uniq('rg-own');
-    const id = loadOrCreateIdentity(name);
-    const self = { nodeId: id.nodeId, pub: id.publicKey };
-    let node = boot(name, self);
-    try {
-      const peer = kp('node-peer-xyz');
-      node._roster.bind(peer.nodeId, peer.pub, 'proven'); // a grant names a proven key (design D3)
-      assert.ok(node.grantRole(peer.nodeId, 'validator'));
-      node.stop();
-      node = boot(name, self);
-      assert.strictEqual(node.resolveRole(peer.nodeId), 'validator');
-    } finally { node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
-  });
-
-  it('a node with no rooted authority makes no grant and sends nothing', () => {
-    const name = uniq('rg-noauth');
-    const founder = kp('founder');
-    const node = boot(name, founder);
-    try {
-      const sent = [];
-      node._gossipToRoster = (frame) => sent.push(frame);
-      node._roster.bind('someone', kp('someone').pub, 'proven');
-      assert.strictEqual(node.grantRole('someone', 'validator'), null);
-      assert.deepStrictEqual(sent, []);
-      assert.strictEqual(fs.existsSync(grantsFile(name)), false);
-    } finally { node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
-  });
-});
-
-describe('reading role-grants.jsonl never stops a node from starting (F3)', () => {
-  it('junk, non-JSON, malformed, forged and unrooted records are skipped and counted; rooted ones load in any order', () => {
-    const name = uniq('rg-junk');
-    const founder = kp('founder'), evil = kp('evil-peer'), V = kp('v'), W = kp('w');
-    let node = boot(name, founder);
-    handshake(node, evil); // binds evil's key (proven): a self-signed grant still confers nothing
-    node.stop();
-    const now = Date.now();
-    const forged = { ...grant('role-grant', evil, 'anchor', founder, now), sig: Buffer.alloc(64, 7).toString('base64url') };
-    const lines = [
-      'not json at all {',
-      'null',
-      '42',
-      '[]',
-      JSON.stringify({ type: 'role-grant' }),
-      JSON.stringify({ type: 'role-grant', grantee: { x: 1 }, grantedBy: founder.nodeId, grantedAt: now, role: 'validator', sig: 'abc' }),
-      JSON.stringify(grant('role-grant', evil, 'anchor', evil, now)),                          // what 0.13.16 stored from one frame
-      JSON.stringify(forged),
-      JSON.stringify(grant('role-grant', W, 'validator', V, now - 500)),                       // V→W, before V's own grant in the file
-      JSON.stringify(grant('role-grant', V, 'validator', founder, now - 1000, { granteeKey: V.pub })),
-    ];
-    fs.mkdirSync(path.dirname(grantsFile(name)), { recursive: true });
-    fs.writeFileSync(grantsFile(name), lines.join('\n') + '\n');
-    const said = [];
-    const log = console.log;
-    console.log = (line) => said.push(String(line));
-    try { node = boot(name, founder, { silent: false }); } finally { console.log = log; }
-    try {
-      const about = said.filter((l) => /Role grants/.test(l));
-      assert.strictEqual(about.length, 1, 'said once');
-      // 0.14 (design D3): a grant is checked against the keys the chain vouches for its grantor, never
-      // the registry's, so the self-signed grant is skipped as from a grantor no chain reaches.
-      assert.match(about[0], /loaded 2, skipped 8 that could not be verified \(not-json 1, malformed 5, unknown-grantor-key 1, bad-signature 1\)/);
-      assert.strictEqual(node.resolveRole(V.nodeId), 'validator');
-      assert.strictEqual(node.resolveRole(W.nodeId), 'validator', 'a two-hop chain loads whatever the line order');
-      assert.strictEqual(node.resolveRole(evil.nodeId), 'participant');
-      const rep = node._roleGrants.loadReport();
-      assert.strictEqual(rep.loaded, 2);
-      assert.strictEqual(rep.unreadable, null);
-      assert.deepStrictEqual(rep.skipped, { 'not-json': 1, malformed: 5, 'unknown-grantor-key': 1, 'bad-signature': 1 });
-    } finally { node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
-  });
-
-  it('a store that cannot be read leaves the node starting with no grants, and says why', () => {
-    const name = uniq('rg-unreadable');
-    const founder = kp('founder');
-    fs.mkdirSync(grantsFile(name), { recursive: true }); // a directory where the file should be: EISDIR
-    const node = boot(name, founder);
-    try {
-      assert.strictEqual(node._roleGrants.size(), 0);
-      assert.match(String(node._roleGrants.loadReport().unreadable), /EISDIR/);
-      assert.strictEqual(node._resolvedRole(), 'participant');
-    } finally { node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
-  });
-
-  it('an empty grants file starts', () => {
-    const name = uniq('rg-empty');
-    fs.mkdirSync(path.dirname(grantsFile(name)), { recursive: true });
-    fs.writeFileSync(grantsFile(name), '');
-    const node = boot(name, kp('founder'));
-    try { assert.strictEqual(node._roleGrants.size(), 0); }
-    finally { node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
-  });
-});
diff --git a/tests/role-grant-store.test.js b/tests/role-grant-store.test.js
deleted file mode 100644
index 469d682a..00000000
--- a/tests/role-grant-store.test.js
+++ /dev/null
@@ -1,249 +0,0 @@
-'use strict';
-
-/**
- * Earned-authority role-grant chain (MMP §6.5). Authority flows ONLY along signed
- * grant chains that terminate at the non-earnable anchor (the founder). The tests
- * pin down the Sybil-resistant resolution: over-reaching grants, unrooted chains,
- * and cycles confer nothing; only anchor-rooted, rank-respecting chains do.
- */
-
-const { describe, it } = require('node:test');
-const assert = require('node:assert');
-const crypto = require('crypto');
-const fs = require('fs');
-const path = require('path');
-const os = require('os');
-const { RoleGrantStore } = require('../lib/role-grant-store');
-const { RosterKeyRegistry } = require('../lib/roster-keys');
-const { signGrant } = require('../lib/core');
-
-function kp(nodeId) {
-  const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519');
-  return {
-    // nodeIds are canonical lowercase at every door, a grant's included (security review B).
-    nodeId: nodeId.toLowerCase(),
-    priv: privateKey.export({ format: 'der', type: 'pkcs8' }).subarray(16).toString('base64url'),
-    pub: publicKey.export({ format: 'der', type: 'spki' }).subarray(12).toString('base64url'),
-  };
-}
-
-const T = 1_000_000;
-// Since 0.14 every role-grant names the key it confers authority on (design D3).
-function grant(type, grantee, role, grantor, at, extra = {}) {
-  const g = { type, grantee: grantee.nodeId, role, grantedBy: grantor.nodeId, grantedAt: at, ...extra };
-  if (type === 'role-grant') g.granteeKey = grantee.pub;
-  return signGrant(g, grantor.priv);
-}
-
-/**
- * A store whose key map holds every party's pubkey + anchor pinned. Since 0.14 the map only answers
- * "which key is this subject bound to" (resolveRole's two-argument form); grants are verified with
- * the keys the chain itself vouches, never with it.
- */
-function storeWith(anchor, parties, opts = {}) {
-  const keys = new Map();
-  for (const p of [anchor, ...parties]) keys.set(p.nodeId, p.pub);
-  return new RoleGrantStore({ anchor: { nodeId: anchor.nodeId, publicKey: anchor.pub }, keys, ...opts });
-}
-
-describe('RoleGrantStore.resolveRole — anchor-rooted, Sybil-resistant', () => {
-  it('the anchor is anchor; an unknown node is participant', () => {
-    const A = kp('A');
-    const st = storeWith(A, []);
-    assert.strictEqual(st.resolveRole(A.nodeId, T), 'anchor');
-    assert.strictEqual(st.resolveRole('nobody', T), 'participant');
-  });
-
-  it('the anchor can grant validator + anchor', () => {
-    const A = kp('A'), V = kp('V'), N = kp('N');
-    const st = storeWith(A, [V, N]);
-    assert.strictEqual(st.record(grant('role-grant', V, 'validator', A, T)).stored, true);
-    assert.strictEqual(st.record(grant('role-grant', N, 'anchor', A, T)).stored, true);
-    assert.strictEqual(st.resolveRole(V.nodeId, T + 1), 'validator');
-    assert.strictEqual(st.resolveRole(N.nodeId, T + 1), 'anchor');
-  });
-
-  it('a validator can confer validator (delegation), rooted via the anchor', () => {
-    const A = kp('A'), V = kp('V'), V2 = kp('V2');
-    const st = storeWith(A, [V, V2]);
-    st.record(grant('role-grant', V, 'validator', A, T));     // anchor → V validator
-    st.record(grant('role-grant', V2, 'validator', V, T + 5)); // V → V2 validator (V is validator at T+5)
-    assert.strictEqual(st.resolveRole(V2.nodeId, T + 6), 'validator');
-  });
-
-  it('over-reach confers nothing: a validator cannot grant anchor', () => {
-    const A = kp('A'), V = kp('V'), X = kp('X');
-    const st = storeWith(A, [V, X]);
-    st.record(grant('role-grant', V, 'validator', A, T));
-    st.record(grant('role-grant', X, 'anchor', V, T + 5)); // validator cannot confer anchor
-    assert.strictEqual(st.resolveRole(X.nodeId, T + 6), 'participant');
-  });
-
-  it('an unrooted grant confers nothing (grantor has no anchor-rooted authority)', () => {
-    const A = kp('A'), X = kp('X'), Y = kp('Y');
-    const st = storeWith(A, [X, Y]);
-    st.record(grant('role-grant', Y, 'validator', X, T)); // X is a participant — confers nothing
-    assert.strictEqual(st.resolveRole(Y.nodeId, T + 1), 'participant');
-  });
-
-  it('a cycle confers nothing (Sybil ring cannot bootstrap authority)', () => {
-    const A = kp('A'), P = kp('P'), Q = kp('Q');
-    const st = storeWith(A, [P, Q]);
-    st.record(grant('role-grant', P, 'validator', Q, T));
-    st.record(grant('role-grant', Q, 'validator', P, T));
-    assert.strictEqual(st.resolveRole(P.nodeId, T + 1), 'participant');
-    assert.strictEqual(st.resolveRole(Q.nodeId, T + 1), 'participant');
-  });
-
-  it('role-at-time: a grant made before the grantor had rank confers nothing', () => {
-    const A = kp('A'), V = kp('V'), V2 = kp('V2');
-    const st = storeWith(A, [V, V2]);
-    st.record(grant('role-grant', V2, 'validator', V, T));      // V grants V2 at T (V not yet validator)
-    st.record(grant('role-grant', V, 'validator', A, T + 100)); // V becomes validator only at T+100
-    assert.strictEqual(st.resolveRole(V2.nodeId, T + 200), 'participant', 'grant predates the grantor\'s authority');
-  });
-
-  it('revocation: an anchor revoke clears the role; before the revoke it still holds', () => {
-    const A = kp('A'), V = kp('V');
-    const st = storeWith(A, [V]);
-    st.record(grant('role-grant', V, 'validator', A, T));
-    st.record(grant('role-revoke', V, undefined, A, T + 100));
-    assert.strictEqual(st.resolveRole(V.nodeId, T + 50), 'validator', 'held before the revoke');
-    assert.strictEqual(st.resolveRole(V.nodeId, T + 200), 'participant', 'cleared after the revoke');
-  });
-});
-
-describe('RoleGrantStore — revocation actually contains a compromised grantor', () => {
-  it('backdating cannot resurrect a revoked grantor\'s authority', () => {
-    // A grants B validator (t1); A revokes B (t3). B still holds its key and signs a
-    // fresh grant to X BACKDATED to t2 < t3 (when B was a validator). It must not
-    // confer: the grantor is re-resolved at query time and is revoked.
-    const A = kp('A'), B = kp('B'), X = kp('X');
-    const st = storeWith(A, [B, X]);
-    st.record(grant('role-grant', B, 'validator', A, T));
-    st.record(grant('role-revoke', B, undefined, A, T + 300));
-    // Dated before B's cutoff (here the revoke's own time), the grant is kept (verifiable); it confers
-    // nothing while B is revoked.
-    assert.strictEqual(st.record(grant('role-grant', X, 'validator', B, T + 100)).stored, true);
-    assert.strictEqual(st.resolveRole(X.nodeId, T + 500), 'participant', 'it confers nothing — backdating cannot bypass revocation');
-    assert.strictEqual(st.resolveRole(X.nodeId, T + 150), 'participant', 'and not back then either: B no longer holds rank and nothing ratified it (final re-review ruling B)');
-    // A revoke whose cutoff reaches back over B's window: a grant B dated inside it never counts,
-    // even if ratified.
-    const st2 = storeWith(A, [B, X]);
-    st2.record(grant('role-grant', B, 'validator', A, T));
-    const late = grant('role-grant', X, 'validator', B, T + 100);
-    st2.record(grant('role-revoke', B, undefined, A, T + 300, { cutoff: T + 50, ratify: [late.sig] }));
-    assert.strictEqual(st2.record(late).stored, true, 'kept: verifiable');
-    assert.strictEqual(st2.resolveRole(X.nodeId, T + 500), 'participant', 'signed after B\'s cutoff');
-  });
-
-  it('revoking a grantor cascades to everything it granted', () => {
-    // A→B validator (t1); B→C validator (t2); A revokes B (t3). C loses validator.
-    const A = kp('A'), B = kp('B'), C = kp('C');
-    const st = storeWith(A, [B, C]);
-    st.record(grant('role-grant', B, 'validator', A, T));
-    st.record(grant('role-grant', C, 'validator', B, T + 100));
-    assert.strictEqual(st.resolveRole(C.nodeId, T + 150), 'validator', 'C is a validator while B is');
-    st.record(grant('role-revoke', B, undefined, A, T + 200));
-    assert.strictEqual(st.resolveRole(C.nodeId, T + 500), 'participant', 'revoking B cascades: C\'s B-derived authority is gone');
-  });
-
-  it('a grant from a node with independent anchor-rooted authority survives the cascade', () => {
-    // C is granted validator by BOTH B and the anchor A. Revoking B leaves C's
-    // A-rooted grant intact.
-    const A = kp('A'), B = kp('B'), C = kp('C');
-    const st = storeWith(A, [B, C]);
-    st.record(grant('role-grant', B, 'validator', A, T));
-    st.record(grant('role-grant', C, 'validator', B, T + 100));
-    st.record(grant('role-grant', C, 'validator', A, T + 100));
-    st.record(grant('role-revoke', B, undefined, A, T + 200));
-    assert.strictEqual(st.resolveRole(C.nodeId, T + 500), 'validator', 'C keeps its independent A-rooted validator role');
-  });
-});
-
-describe('RoleGrantStore — the grant file is integrity-checked on load', () => {
-  it('a file-forged anchor grant (garbage signature) is rejected on reload', () => {
-    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'rg-forge-'));
-    try {
-      const A = kp('A'), attacker = kp('attacker');
-      // An attacker who can write the file — but cannot sign as the anchor — forges an
-      // anchor→attacker anchor grant with a bogus signature.
-      const forged = { type: 'role-grant', grantee: attacker.nodeId, role: 'anchor',
-        grantedBy: A.nodeId, grantedAt: T, granteeKey: attacker.pub,
-        sig: Buffer.alloc(64, 7).toString('base64url'), sigAlg: 'ed25519' };
-      fs.writeFileSync(path.join(dir, 'role-grants.jsonl'), JSON.stringify(forged) + '\n');
-      // Fresh store over the tampered file, anchor pinned from env/config (not the file).
-      const st = new RoleGrantStore({ anchor: { nodeId: A.nodeId, publicKey: A.pub }, dir });
-      assert.strictEqual(st.resolveRole(attacker.nodeId, T + 1), 'participant', 'forged grant is not trusted on load');
-      assert.strictEqual(st.size(), 0, 'the forged record is dropped, not stored');
-    } finally { fs.rmSync(dir, { recursive: true, force: true }); }
-  });
-});
-
-describe('RoleGrantStore — signature gate + persistence', () => {
-  it('rejects a forged grant and an unknown grantor', () => {
-    const A = kp('A'), V = kp('V'), imposter = kp('imp');
-    const st = storeWith(A, [V]); // imposter key NOT pinned
-    const forged = grant('role-grant', V, 'anchor', A, T);
-    forged.role = 'validator'; // tamper after signing
-    assert.strictEqual(st.record(forged).reason, 'bad-signature');
-    // a grant from a node whose key we don't have
-    assert.strictEqual(st.record(grant('role-grant', V, 'validator', imposter, T)).reason, 'unknown-grantor-key');
-  });
-
-  it('persists grants append-only and reloads resolution across a restart', () => {
-    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'rg-'));
-    try {
-      const A = kp('A'), V = kp('V');
-      const s1 = storeWith(A, [V], { dir });
-      s1.record(grant('role-grant', V, 'validator', A, T));
-      // a fresh store over the same dir reloads + resolves the same
-      const s2 = storeWith(A, [V], { dir });
-      assert.strictEqual(s2.resolveRole(V.nodeId, T + 1), 'validator', 'reloaded grant still confers');
-      assert.strictEqual(s2.size(), 1);
-    } finally { fs.rmSync(dir, { recursive: true, force: true }); }
-  });
-});
-
-describe('RoleGrantStore — relayed key learning (grant vouches for grantee key)', () => {
-  // A third node C knows only the anchor's key. It relays a grant A→V that binds V's
-  // key. Because the grant roots at the anchor, C learns V's key end-to-end — without
-  // ever handshaking V — and an unrooted grant teaches it nothing.
-  function grantWithKey(grantee, role, grantor, at) {
-    return signGrant({ type: 'role-grant', grantee: grantee.nodeId, role, grantedBy: grantor.nodeId, grantedAt: at, granteeKey: grantee.pub }, grantor.priv);
-  }
-
-  it('a rooted grant pins the grantee key; an unrooted grant pins nothing', () => {
-    const A = kp('A'), V = kp('V'), X = kp('X'), Y = kp('Y');
-    const reg = new RosterKeyRegistry({ anchor: { nodeId: A.nodeId, publicKey: A.pub } });
-    const store = new RoleGrantStore({ anchor: { nodeId: A.nodeId, publicKey: A.pub }, keys: reg });
-    reg.setGrantView((id) => store.vouchedKey(id)); // a grant binding is a view (security review C)
-
-    // anchor → V validator, vouching V's key. C never met V.
-    assert.strictEqual(reg.has(V.nodeId), false);
-    assert.strictEqual(store.record(grantWithKey(V, 'validator', A, T)).stored, true);
-    assert.strictEqual(reg.get(V.nodeId), V.pub, 'learnt V key from the rooted grant');
-    assert.strictEqual(reg.source(V.nodeId), 'grant');
-
-    // X (a participant) grants Y, vouching Y's key — X's key is in the registry (say via
-    // some handshake) so the grant verifies, but X is unrooted so it confers nothing, is
-    // not kept (0.13.17: an unrooted record is not stored or relayed) AND vouches for no key.
-    reg.bind(X.nodeId, X.pub, 'proven');
-    assert.deepStrictEqual(store.record(grantWithKey(Y, 'validator', X, T)), { stored: false, reason: 'unknown-grantor-key' },
-      'no chain vouches a key for X, so its grant cannot even be checked (the registry is never asked)');
-    assert.strictEqual(reg.has(Y.nodeId), false, 'unrooted grantor vouches for no key');
-  });
-
-  it('a grant-vouched key cannot override a key already proven: it is a conflict', () => {
-    const A = kp('A'), V = kp('V'), other = kp('V-other');
-    const reg = new RosterKeyRegistry({ anchor: { nodeId: A.nodeId, publicKey: A.pub } });
-    const store = new RoleGrantStore({ anchor: { nodeId: A.nodeId, publicKey: A.pub }, keys: reg });
-    reg.bind(V.nodeId, other.pub, 'proven');
-    // a rooted grant vouching a DIFFERENT key for V must not repoint the proven binding
-    assert.strictEqual(store.record(grantWithKey(V, 'validator', A, T)).stored, true, 'the grant itself is rooted and kept');
-    assert.strictEqual(reg.get(V.nodeId), other.pub, 'the proven binding stands');
-    assert.deepStrictEqual(reg.conflicts().map((c) => [c.nodeId, c.got, c.gotSource]), [[V.nodeId, V.pub, 'grant']], 'and the vouch is recorded as a conflict');
-    assert.strictEqual(store.resolveRole(V.nodeId, T + 1), 'participant', 'the key V is bound to holds no grant');
-    assert.strictEqual(store.resolveRole(V.nodeId, V.pub, T + 1), 'validator', 'the vouched key does');
-  });
-});

From f3135cee3db32aea040131414f456a4f270921a9 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 8 Oct 2026 03:38:56 +0100
Subject: [PATCH 114/148] authority: the relayed-once marks stay bounded by the
 store (a mark for a statement since dropped goes)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QRVMpaJkAA2fFbvuHCEzqH
---
 lib/node-authority.js | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/node-authority.js b/lib/node-authority.js
index 0dec7162..c58d25d1 100644
--- a/lib/node-authority.js
+++ b/lib/node-authority.js
@@ -476,6 +476,11 @@ const methods = {
     }
     this._authorityOrigin.clear();
     this._authorityPrev = new Set(inForce);
+    // The relayed-once marks are kept for what is held: one for a statement the store has since
+    // dropped (§6.6.7: a node MAY drop what is not live) goes, so the set stays bounded by the store.
+    if (this._authorityRelayed.size > 2 * this._authority.size() + 1024) {
+      for (const id of this._authorityRelayed) if (!this._authority.has(id)) this._authorityRelayed.delete(id);
+    }
     if (changed) {
       for (const session of this._sessions) if (session.confirmed && !session.closed) this._sendAuthorityDigest(session);
       try { this.emit('authority-changed', Object.freeze({ root: this._authority.root(), inForce: inForce.size })); } catch { /* a listener must not stop the settle */ }

From f86c2ccd66e2086bc0045c3116693b1fca83541e Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 8 Oct 2026 03:48:30 +0100
Subject: [PATCH 115/148] =?UTF-8?q?tests:=20=C2=A76.6.1=20threshold=20anch?=
 =?UTF-8?q?or=20and=20=C2=A76.6.11=20migration=20on=20nodes;=20the=20Ed255?=
 =?UTF-8?q?19=20pre-checks=20without=20OpenSSL;=20the=20frame-loss=20scene?=
 =?UTF-8?q?=20drops=20the=20frame=20it=20means?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- authority-migration: under a 2-of-3 pin no holder alone is the anchor; one signs, a second
  co-signs, and only then is the statement valid. A 0.13 grant store confers nothing, is never
  rewritten, and legacyRoleGrants lists it (the anchor role read as admin) for re-issue.
- ed25519-strict: with crypto.verify stubbed to accept everything, every vector case a pre-check
  rejects is still rejected, so rule 4 (S < L) is tested on its own and not only through OpenSSL
  (the mutation that removed it survived before).
- core-secure-relay: the relay drops one sealed control frame from a to b. It dropped the first
  one in either direction, and under load that could be b's greeting frame still in flight, which
  nothing follows: no gap, no re-handshake, and the test timed out (seen once in a full run).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QRVMpaJkAA2fFbvuHCEzqH
---
 tests/authority-migration.test.js | 87 +++++++++++++++++++++++++++++++
 tests/core-secure-relay.test.js   |  7 ++-
 tests/ed25519-strict.test.js      | 17 ++++++
 3 files changed, 109 insertions(+), 2 deletions(-)
 create mode 100644 tests/authority-migration.test.js

diff --git a/tests/authority-migration.test.js b/tests/authority-migration.test.js
new file mode 100644
index 00000000..c27e7fe8
--- /dev/null
+++ b/tests/authority-migration.test.js
@@ -0,0 +1,87 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME before lib/config loads
+
+/**
+ * MMP §6.6.1 and §6.6.11 on a node: an anchor-level statement under a threshold above 1, signed by
+ * one key holder and co-signed by another, and the migration from the time-replay rule — the old
+ * grants confer nothing, and the operator reads them as plain data to re-issue what should stand.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const path = require('path');
+const { SymNode } = require('../lib/node');
+const { NullDiscovery } = require('../lib/discovery');
+const { nodeDirById, loadOrCreateIdentity } = require('../lib/config');
+const A = require('../lib/core/authority');
+const { identity } = require('./_core-secure');
+
+const uniq = (b) => `${b}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+const made = [];
+function node(name, opts) {
+  const n = new SymNode({ name, silent: true, discovery: new NullDiscovery(), room: 'mig', ...opts });
+  made.push(n);
+  return n;
+}
+async function stopAll() {
+  for (const n of made.splice(0)) { try { await n.stop(); } catch { /* */ } try { fs.rmSync(nodeDirById(n.nodeId), { recursive: true, force: true }); } catch { /* */ } }
+}
+
+describe('§6.6.1: a threshold anchor on nodes', () => {
+  it('2 of 3: one holder signs, a second co-signs, and only then is the statement valid; no holder alone is the anchor', async () => {
+    try {
+      const names = [uniq('k1'), uniq('k2'), uniq('k3')];
+      const ids = names.map((n) => loadOrCreateIdentity(n));
+      const pin = { threshold: 2, keys: ids.map((i) => ({ key: i.publicKey, nodeId: i.nodeId })) };
+      const [K1, K2] = names.slice(0, 2).map((n) => node(n, { anchor: pin }));
+      const other = node(uniq('obs'), { anchor: pin });
+      assert.strictEqual(K1.resolveRole(K1.nodeId), 'participant', 'under a threshold above 1 no holder alone is the anchor');
+      const subject = identity('s');
+      const half = K1.authorityStatement({ kind: 'grant', subject: { nodeId: subject.nodeId, key: subject.publicKey }, role: 'admin' }, { asAnchor: true });
+      assert.strictEqual(half.authorisedBy, 'anchor');
+      assert.strictEqual(other.submitAuthority(half).result, 'invalid', 'one of the two signatures it needs');
+      const whole = K2.cosignAuthority(half);
+      assert.strictEqual(whole.sigs.length, 2);
+      assert.strictEqual(A.statementId(whole), A.statementId(half), 'the same statement, more signatures');
+      const r = other.submitAuthority(whole);
+      assert.strictEqual(r.result, 'held');
+      assert.strictEqual(r.status, 'in-force');
+      assert.strictEqual(other.resolveRole(subject.nodeId, { key: subject.publicKey }), 'admin');
+      assert.throws(() => other.cosignAuthority(half), (e) => e.code === 'ENOAUTHORITY', 'a node whose key is not pinned cannot co-sign');
+    } finally { await stopAll(); }
+  });
+});
+
+describe('§6.6.11: migration from the time-replay rule', () => {
+  it('a 0.13 grant store confers nothing; legacyRoleGrants lists it as plain data, the anchor role read as admin; re-issued, it stands', async () => {
+    try {
+      const name = uniq('mig-anchor');
+      const id = loadOrCreateIdentity(name);
+      const dir = nodeDirById(id.nodeId);
+      const V = identity('v'); const W = identity('w');
+      fs.mkdirSync(path.join(dir, 'role-grants'), { recursive: true });
+      const old = [
+        { type: 'role-grant', grantee: V.nodeId, granteeKey: V.publicKey, role: 'validator', grantedBy: id.nodeId, grantedAt: 1, sig: 'x', sigAlg: 'ed25519' },
+        { grant: { type: 'role-grant', grantee: W.nodeId, granteeKey: W.publicKey, role: 'anchor', grantedBy: id.nodeId, grantedAt: 2, sig: 'y', sigAlg: 'ed25519' } },
+        { type: 'role-revoke', grantee: V.nodeId, grantedBy: id.nodeId, grantedAt: 3, sig: 'z', sigAlg: 'ed25519' },
+      ];
+      fs.writeFileSync(path.join(dir, 'role-grants', 'role-grants.jsonl'), old.map((o) => JSON.stringify(o)).join('\n') + '\n{not json\n');
+      const before = fs.readFileSync(path.join(dir, 'role-grants', 'role-grants.jsonl'), 'utf8');
+      const N = node(name, { anchor: { nodeId: id.nodeId, publicKey: id.publicKey } });
+      assert.strictEqual(N.resolveRole(V.nodeId), 'participant', 'the old grants confer nothing');
+      assert.strictEqual(N.resolveRole(W.nodeId), 'participant');
+      const legacy = N.legacyRoleGrants();
+      assert.deepStrictEqual(legacy, [
+        { grantee: V.nodeId, granteeKey: V.publicKey, role: 'validator', grantedBy: id.nodeId },
+        { grantee: W.nodeId, granteeKey: W.publicKey, role: 'admin', grantedBy: id.nodeId },
+      ]);
+      assert.strictEqual(fs.readFileSync(path.join(dir, 'role-grants', 'role-grants.jsonl'), 'utf8'), before, 'the old file is never rewritten');
+      // The anchor's holder re-issues what should stand, one for one (§6.6.11).
+      for (const g of legacy) N.grant({ nodeId: g.grantee, key: g.granteeKey }, g.role);
+      assert.strictEqual(N.resolveRole(V.nodeId), 'validator');
+      assert.strictEqual(N.resolveRole(W.nodeId), 'admin');
+    } finally { await stopAll(); }
+  });
+});
diff --git a/tests/core-secure-relay.test.js b/tests/core-secure-relay.test.js
index ad9c65bd..2ba4cc44 100644
--- a/tests/core-secure-relay.test.js
+++ b/tests/core-secure-relay.test.js
@@ -104,9 +104,12 @@ describe('relay sessions (D2)', () => {
   });
 
   it('frame loss leads to a re-handshake, and records flow again', async () => {
+    // The relay drops one sealed control frame from a to b: the first mood, not a greeting frame still
+    // in flight the other way (that left nothing to follow it, so no gap and no re-handshake).
     let dropOne = false;
-    const relay = fakeRelay({ tap: (e) => { if (dropOne && e.payload.type === 'control-encrypted') { dropOne = false; return false; } return undefined; } });
-    const a = relayNode('rs-a', relay); const b = relayNode('rs-b', relay);
+    let a = null;
+    const relay = fakeRelay({ tap: (e) => { if (dropOne && a && e.from === a.nodeId && e.payload.type === 'control-encrypted') { dropOne = false; return false; } return undefined; } });
+    a = relayNode('rs-a', relay); const b = relayNode('rs-b', relay);
     try {
       await a.start(); await b.start();
       await until(() => paired(a, b), 8000);
diff --git a/tests/ed25519-strict.test.js b/tests/ed25519-strict.test.js
index 4b6c5e06..15316204 100644
--- a/tests/ed25519-strict.test.js
+++ b/tests/ed25519-strict.test.js
@@ -71,6 +71,23 @@ describe('§18.3.2: the forgeries this file uses are accepted by crypto.verify,
   });
 });
 
+describe('§18.3.2: the pre-checks stand on their own', () => {
+  it('with crypto.verify accepting everything, every vector case a pre-check rejects is still rejected', () => {
+    const ed = JSON.parse(fs.readFileSync(path.join(__dirname, 'fixtures', 'ed25519-strict-v2.json'), 'utf8'));
+    const real = crypto.verify;
+    crypto.verify = () => true; // what OpenSSL would say is no part of rules 1 to 4
+    try {
+      for (const c of ed.cases) {
+        const got = verifyStrict(Buffer.from(c.messageHex, 'hex'), Buffer.from(c.publicKeyHex, 'hex'), Buffer.from(c.signatureHex, 'hex'));
+        // R's order is judged by the equation (§18.3.2, informative), so only R's identity encoding
+        // and rules 1, 2 and 4 are pre-checks here.
+        const prechecked = c.precheckFailure && !(c.precheckFailure.startsWith('R ') && c.signatureHex.slice(0, 64) !== '01' + '0'.repeat(62));
+        if (prechecked) assert.strictEqual(got, false, `${c.label}: ${c.precheckFailure}`);
+      }
+    } finally { crypto.verify = real; }
+  });
+});
+
 describe('§18.3.2 at every verification site in sym', () => {
   const id = identity('signer');
   /** Each site: an honest signed object, its signed bytes, and the verdict function. */

From fdebedfd0861381e7357cf02b93db60fed213f7a Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 8 Oct 2026 09:13:07 +0100
Subject: [PATCH 116/148] keys: the key cache keeps what is used (LRU; pinned
 keys for good); handshake keys in one spelling
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Release review of f86c2cc, L4 and L5.

- L5: lib/core/ed25519.js's cache of §18.3.2 rules 1 and 2 was FIFO, so a flood of fresh keys
  evicted the keys honest peers keep using, which were then recomputed (a scalar multiplication
  each) and charged again. It is now least recently used, and the pinned anchor keys
  (parsePin, `keep: true`) are kept for good, so a pinned key is never a fresh key.
- L4: a hello's 32-byte fields (identity key, X25519 key, nonce) are taken only in canonical
  unpadded base64url, the authority statements' PUBLIC_KEY pattern: one key had two spellings, and
  `rolesOf` compares strings.

Tests (ed25519-strict): the cache keeps the key in use and evicts the least recently used; a pinned
key survives any flood; a hello whose identity key is another spelling of the same 32 bytes is
refused.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QRVMpaJkAA2fFbvuHCEzqH
---
 lib/core/authority.js        |  5 +++--
 lib/core/ed25519.js          | 34 ++++++++++++++++++++++--------
 lib/session.js               |  5 +++--
 tests/ed25519-strict.test.js | 40 ++++++++++++++++++++++++++++++++++++
 4 files changed, 71 insertions(+), 13 deletions(-)

diff --git a/lib/core/authority.js b/lib/core/authority.js
index fee94df4..3ed2ee6f 100644
--- a/lib/core/authority.js
+++ b/lib/core/authority.js
@@ -219,7 +219,8 @@ function parsePin(cfg) {
   const members = keys.map((k) => {
     const key = typeof k === 'string' ? k : k && k.key;
     const nodeId = (k && typeof k === 'object' && k.nodeId !== undefined && k.nodeId !== null) ? k.nodeId : null;
-    if (typeof key !== 'string' || !PUBLIC_KEY.test(key) || !isPrimeOrderKey(key)) throw new Error('anchor pin: a key that is not an Ed25519 key of prime order');
+    // Kept in the key cache for good: a pinned key is checked on every anchor-level statement.
+    if (typeof key !== 'string' || !PUBLIC_KEY.test(key) || !isPrimeOrderKey(key, { keep: true })) throw new Error('anchor pin: a key that is not an Ed25519 key of prime order');
     if (nodeId !== null && (typeof nodeId !== 'string' || !NODE_ID.test(nodeId))) throw new Error('anchor pin: a nodeId that is not a canonical lowercase UUID');
     if (seen.has(key)) throw new Error('anchor pin: keys must be distinct');
     seen.add(key);
@@ -247,7 +248,7 @@ function authorityRoot(digest, inForceIds) {
 module.exports = {
   MAX_DELEGATION_DEPTH, ANCHOR_MAX_KEYS, AUTHORITY_QUOTA, AUTHORITY_ANCHOR_QUOTA, AUTHORITY_DELEGATE_QUOTA,
   AUTHORITY_SCOPE_MAX, AUTHORITY_MAX_TARGETS, AUTHORITY_PAGE, AUTHORITY_PENDING_MAX, AUTHORITY_PENDING_TIMEOUT,
-  STATEMENT_ID, PUBLIC_KEY, NODE_ID,
+  STATEMENT_ID, PUBLIC_KEY, SIGNATURE, NODE_ID,
   isRole, isNonAuthority, isDelegating, isScope, scopeNarrows,
   shapeReason, malformedReason, payload, statementId, canonicalStatement, freshNonce, signStatement, entryVerifies,
   parsePin, pinDigest, authorityRoot, bytewise,
diff --git a/lib/core/ed25519.js b/lib/core/ed25519.js
index 00d3818e..a4c63794 100644
--- a/lib/core/ed25519.js
+++ b/lib/core/ed25519.js
@@ -97,17 +97,28 @@ function mul(pt, k) {
   return r;
 }
 
-/** Rules 1 and 2 for a 32-byte key, cached per key: a canonical encoding of a point of prime order. */
+/**
+ * Rules 1 and 2 for a 32-byte key, cached per key: a canonical encoding of a point of prime order.
+ * The cache is least recently used, so keys that keep being used stay and a flood of fresh keys
+ * evicts only keys nobody used since; `keep` (the pinned anchor keys) are never evicted.
+ */
 const KEY_CACHE = new Map();
-const KEY_CACHE_MAX = 8192;
-function isPrimeOrderKey(key) {
+let KEY_CACHE_MAX = 8192;
+const KEPT = new Map();
+function isPrimeOrderKey(key, { keep = false } = {}) {
   const bytes = toBytes(key, 32);
   if (!bytes) return false;
   const k = bytes.toString('hex');
-  const hit = KEY_CACHE.get(k);
-  if (hit !== undefined) return hit;
-  const pt = decodePoint(bytes);
-  const ok = !!pt && !isIdentity(pt) && isIdentity(mul(pt, L));
+  const kept = KEPT.get(k);
+  if (kept !== undefined) return kept;
+  let ok = KEY_CACHE.get(k);
+  if (ok !== undefined) {
+    KEY_CACHE.delete(k); // most recently used last
+  } else {
+    const pt = decodePoint(bytes);
+    ok = !!pt && !isIdentity(pt) && isIdentity(mul(pt, L));
+  }
+  if (keep) { KEPT.set(k, ok); KEY_CACHE.delete(k); return ok; }
   if (KEY_CACHE.size >= KEY_CACHE_MAX) KEY_CACHE.delete(KEY_CACHE.keys().next().value);
   KEY_CACHE.set(k, ok);
   return ok;
@@ -120,7 +131,9 @@ function isPrimeOrderKey(key) {
  */
 function isKeyKnown(key) {
   const bytes = toBytes(key, 32);
-  return !!bytes && KEY_CACHE.has(bytes.toString('hex'));
+  if (!bytes) return false;
+  const k = bytes.toString('hex');
+  return KEPT.has(k) || KEY_CACHE.has(k);
 }
 
 /** Bytes of a Buffer or a base64url string, of exactly `n` bytes, or null. */
@@ -174,4 +187,7 @@ function precheckFailure(publicKey, signature) {
   return null;
 }
 
-module.exports = { verifyStrict, isPrimeOrderKey, isKeyKnown, precheckFailure, L };
+/** @private Tests only: a smaller cache, to show what it keeps. Returns the previous size. */
+function _setKeyCacheMax(n) { const was = KEY_CACHE_MAX; KEY_CACHE_MAX = n; while (KEY_CACHE.size > KEY_CACHE_MAX) KEY_CACHE.delete(KEY_CACHE.keys().next().value); return was; }
+
+module.exports = { verifyStrict, isPrimeOrderKey, isKeyKnown, precheckFailure, L, _setKeyCacheMax };
diff --git a/lib/session.js b/lib/session.js
index 6508df43..f629f4c4 100644
--- a/lib/session.js
+++ b/lib/session.js
@@ -68,7 +68,8 @@ const { MAX_SEALED_CHARS } = require('./core/cmb-encoder');
 // nodeIds are canonical lowercase on the wire (§3.1.1; review finding B): an upper-case alias of a
 // bound nodeId is not a second identity, it is refused at the door.
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
-const B64_32 = /^[A-Za-z0-9_-]{43}$/;
+// 32 bytes in canonical unpadded base64url (one spelling per key: the authority statements' PUBLIC_KEY).
+const { PUBLIC_KEY: B64_32 } = require('./core/authority');
 const SIG_RE = /^[A-Za-z0-9_-]{86}$/;
 const EXT_RE = /^[a-z0-9][a-z0-9._-]{0,63}$/;
 let SEQ = 0;
@@ -109,7 +110,7 @@ function checkOffer(f, kind) {
   if (typeof f.nodeId !== 'string' || !UUID_RE.test(f.nodeId)) throw new Error(`handshake: ${kind} nodeId is not a UUID`);
   if (typeof f.name !== 'string' || !f.name || f.name.length > 256) throw new Error(`handshake: ${kind} name is not a name`);
   for (const k of ['identityPublicKey', 'e2ePublicKey', 'nonce']) {
-    if (!is32(f[k])) throw new Error(`handshake: ${kind} ${k} is not 32 bytes of unpadded base64url`);
+    if (!is32(f[k])) throw new Error(`handshake: ${kind} ${k} is not 32 bytes of canonical unpadded base64url`);
   }
   const impl = f.implementation;
   if (!impl || typeof impl !== 'object' || typeof impl.name !== 'string' || typeof impl.version !== 'string'
diff --git a/tests/ed25519-strict.test.js b/tests/ed25519-strict.test.js
index 15316204..bd963a1c 100644
--- a/tests/ed25519-strict.test.js
+++ b/tests/ed25519-strict.test.js
@@ -193,3 +193,43 @@ describe('§18.3.2 at every verification site in sym', () => {
     assert.deepStrictEqual(offenders, []);
   });
 });
+
+describe('the key cache keeps keys that keep being used (release review L5)', () => {
+  it('least recently used goes first; a pinned key is never evicted', () => {
+    const { isPrimeOrderKey, isKeyKnown, _setKeyCacheMax } = require('../lib/core/ed25519');
+    const was = _setKeyCacheMax(4);
+    try {
+      const k = () => identity('c').publicKey;
+      const pinned = k(); isPrimeOrderKey(pinned, { keep: true });
+      const used = k(); isPrimeOrderKey(used);
+      const others = [k(), k(), k()];
+      for (const o of others) isPrimeOrderKey(o);
+      isPrimeOrderKey(used); // used again: most recent
+      const fresh = [k(), k()];
+      for (const f of fresh) isPrimeOrderKey(f); // a small flood
+      assert.strictEqual(isKeyKnown(used), true, 'the key in use stays');
+      assert.strictEqual(isKeyKnown(others[0]), false, 'the least recently used went');
+      for (let i = 0; i < 6; i++) isPrimeOrderKey(k());
+      assert.strictEqual(isKeyKnown(pinned), true, 'a pinned key is kept for good');
+    } finally { _setKeyCacheMax(was); }
+  });
+});
+
+describe('one spelling per handshake key (release review L4)', () => {
+  it('a hello whose identity key is a non-canonical spelling of 32 bytes is refused', () => {
+    const { checkOffer } = require('../lib/session');
+    const id = identity('h');
+    const raw = Buffer.from(id.publicKey, 'base64url');
+    // The same 32 bytes with the two unused low bits of the last character set: another spelling.
+    const alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_';
+    const last = id.publicKey[42];
+    const alias = id.publicKey.slice(0, 42) + alphabet[alphabet.indexOf(last) | 1];
+    assert.notStrictEqual(alias, id.publicKey);
+    assert.ok(Buffer.from(alias, 'base64url').equals(raw), 'it decodes to the same key');
+    const offer = (identityPublicKey) => ({ protocolVersion: '2.0', room: 'r', nodeId: id.nodeId, name: 'h', identityPublicKey, e2ePublicKey: id.publicKey, nonce: id.publicKey, implementation: { name: 'sym', version: '0' }, extensions: [] });
+    const err = (f) => { try { checkOffer(f, 'client-hello'); return null; } catch (e) { return e.message; } };
+    // Whatever the canonical offer's verdict on its other fields, the alias is refused for its key.
+    assert.doesNotMatch(String(err(offer(id.publicKey))), /identityPublicKey/);
+    assert.match(String(err(offer(alias))), /identityPublicKey is not 32 bytes of canonical/);
+  });
+});

From 1c6f36e31d80ade2d79a5c6e4ea94419a65dd942 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 8 Oct 2026 09:13:24 +0100
Subject: [PATCH 117/148] authority: the release review's design changes (H1,
 H2, M1, M2, L1-L3, Q2)

Release review of f86c2cc (BLOCK), the root-cause changes the founder approved.

H1, the budget. "Work this node asked for is bounded by its asking" was false: the peer triggers the
ask (a digest, a pending statement), chooses what each answer holds, and an answer can open more
asks; and the debt below -burst was forgiven. One rule replaces the exemption:
- every statement a session delivers spends that peer's lane, asked for or not;
- this node asks (a pull's first page, its next page, a fetch by ids for the missing links of its
  pending statements, up to 64 ids at once) only when the lane holds a full answer's worst case,
  64 x 33 = 2,112 checks, and reserves it until the answer or its timeout; one ask in flight per
  session; the answer is paid from the reservation and what it did not spend goes back. So nothing
  asked for is dropped and nothing exceeds the lane;
- pending capacity (64 per session) is checked before a pending statement is verified;
- a pending statement verified again once its chain arrives spends the lane with no floor.
The debt floor (_gossipCharge, _gossipDebtMs) and the ungated pull starts are gone. An answer is
verified in slices, the event loop free between them. Settles are paced at twice the last
resolution's time, and queries read the last settled resolution (the store is lazy for a node).

H2: an anchor-level statement costs one check per pinned-key entry it carries; the relay-failure
mute is keyed on the session's peer, never on sigs[0].key. (The errata's unique signature keys wait
for its lib.mjs change.)

M1, capacity: past MAX_HELD the store drops what is not live first, then what comes last in
authority order (deepest, grants before removals, highest id), a batch at a time (one sort per
batch); an arriving anchor-level statement or revoke is never the one refused; a capacity refusal
(`over-capacity`) is not a relay failure.

M2, persistence: one statement file whatever the pin. At load every statement is judged again
against the pin in force, and what does not count is kept as its bytes, never deleted: a mistyped
pin destroys nothing, and a re-pin that keeps a threshold of the old keys keeps what they signed.
L1: each record starts on a line of its own, and a failed write is cut back.

L2: answerIds is the closure to a fixpoint within the page. L3: a pull that ends with the roots
apart is repeated, at once if a digest came during it, else after a backoff from 2 s doubling to
5 min. Q2: an unpinned node ignores authority frames: no digest, no pull, no answer, nothing stored
or relayed, nothing counted against the session. Info: page() is a binary search over the live set
sorted once per resolution; the roster migration log no longer says "grant-vouched".

Tests: authority-node (the asking rule against a peer that answers every ask with fresh keys, as a
pull loop and as a fetch cascade: verified within the lane, the lane never negative, pending full
refused before verifying; re-pulls with a doubling backoff; persistence in one file, a re-pin from 2
of 3 to 2 of 2, a torn append; the closure; capacity refusals not a failure; an unpinned node);
authority-attacks (capacity: the anchor's revoke of flooding admins taken and the store resolving as
an unbounded one; a deep grant refused, an anchor grant and a revoke never; non-live first, one sort
per batch); gossip-lanes, core-secure-review and -rereview updated for the per-peer mute and the
pinned nodes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QRVMpaJkAA2fFbvuHCEzqH
---
 lib/authority-store.js             | 288 ++++++++++++++++++-------
 lib/node-authority.js              | 332 ++++++++++++++++++++---------
 lib/node.js                        |  49 +++--
 tests/authority-attacks.test.js    |  66 ++++++
 tests/authority-node.test.js       | 158 +++++++++++++-
 tests/core-secure-rereview.test.js |   2 +-
 tests/core-secure-review.test.js   |   9 +-
 tests/gossip-lanes.test.js         |   8 +-
 8 files changed, 703 insertions(+), 209 deletions(-)

diff --git a/lib/authority-store.js b/lib/authority-store.js
index 0f523622..723aeaab 100644
--- a/lib/authority-store.js
+++ b/lib/authority-store.js
@@ -22,11 +22,17 @@
  *     that may rescue it, charged to that endorser's bucket, falling through to the next endorser by id
  *     when a bucket is full; a statement cut off by a quota is never rescued.
  *   - THE LIVE SET and THE ROOT (§6.6.7); authority order, fetch answers and pages (§6.6.8).
- *   - PERSISTENCE: statements are kept on disk with no integrity of their own, in a file named by
- *     the pin's digest (a statement means something only under the pin it was verified against, so
- *     a node started under another pin reads another file and leaves this one as it was). At load
- *     each is verified again against the pinned anchor and the set resolved afresh. No status, root
- *     or receipt time is read from disk.
+ *   - CAPACITY: at most MAX_HELD statements. Past it the store drops what comes last in authority
+ *     order (deepest first, grants before revokes and endorses, highest id first), what is not in
+ *     the live set before what is; an anchor-level statement or a revoke arriving is never the one
+ *     refused, so the removal that would clean a flooded store up is always taken (§6.6.6: removals
+ *     first).
+ *   - PERSISTENCE: one file of statements, with no integrity of its own and independent of the pin.
+ *     At load each is judged again against the pin in force now and the set resolved afresh; a
+ *     statement that does not count under this pin (a mistyped pin, a re-pin, a chain not yet held)
+ *     is kept in the file as unverified bytes, never deleted, so a corrected pin or a re-pin that
+ *     keeps a threshold of the old keys finds what still counts (§6.6.1). No status, root or receipt
+ *     time is read from disk.
  *
  * @copyright 2026 SYM.BOT Ltd.
  * @license Apache-2.0
@@ -36,14 +42,16 @@ const fs = require('fs');
 const path = require('path');
 const A = require('./core/authority');
 
-/** The statements verified under one pin: `statements-<pin digest>.jsonl` in the store's directory. */
-const fileFor = (pinDigest) => `statements-${pinDigest}.jsonl`;
+/** The one statement file, whatever the pin. */
+const FILE = 'statements.jsonl';
 /**
- * Statements held at most. A node MUST keep its live set and MAY drop the rest (§6.6.5, §6.6.7);
- * past this it drops dead and over-quota statements that are not live, highest id first, and refuses
- * new ones only when the live set alone fills it.
+ * Statements held at most (§6.6.7: a node MUST keep its live set and MAY drop the rest; past this
+ * bound it cannot keep everything, and drops in reverse authority order, the live set last: see
+ * `_evict`). Eviction frees EVICT_SLACK below the bound at once, so its sort is paid once per that
+ * many arrivals, not per arrival.
  */
 const MAX_HELD = 200_000;
+const evictSlack = (max) => Math.max(1, Math.ceil(max / 64));
 
 const kindGroup = (k) => (k === 'grant' ? 1 : 0); // revokes and endorses before grants (authority order)
 
@@ -55,6 +63,8 @@ class AuthorityStore {
    * @param {number} [opts.quota] - in place of AUTHORITY_QUOTA (tests: the vector's testQuota)
    * @param {number} [opts.delegateQuota] - in place of AUTHORITY_DELEGATE_QUOTA
    * @param {number} [opts.maxHeld]
+   * @param {boolean} [opts.lazy] - queries read the last resolution, and only `resolve()` makes a new
+   *   one (a node resolves when it settles, not on every query); otherwise every query is fresh
    * @param {function} [opts.log]
    */
   constructor(opts = {}) {
@@ -66,12 +76,16 @@ class AuthorityStore {
     this._maxHeld = Number.isSafeInteger(opts.maxHeld) && opts.maxHeld > 0 ? opts.maxHeld : MAX_HELD;
     this._log = typeof opts.log === 'function' ? opts.log : () => {};
     this._held = new Map(); // id -> entry { id, s, kind, authBy, depth, chain, role, scope, subject, targets }
-    this._resolved = null;  // the last resolution, or null when the held set changed since
+    this._resolved = null;  // the last resolution
+    this._dirty = true;     // the held set changed since it
+    this._lazy = opts.lazy === true;
+    this._lastResolveMs = 0;
     this._pinDigest = this._pin ? A.pinDigest(this._pin) : null;
     this._dir = opts.dir || null;
     this._loading = false;
-    this._loadReport = { held: 0, pending: 0, invalid: 0 };
-    if (this._dir && this._pin) this._load();
+    this._loadReport = { held: 0, pending: 0, invalid: 0, unverified: 0, corrupt: 0 };
+    this._capacity = { evicted: 0, refused: 0 };
+    if (this._dir) this._load();
   }
 
   /** Whether an anchor is pinned. Where none is, nothing is in force (§6.6.1). */
@@ -79,6 +93,10 @@ class AuthorityStore {
   get pin() { return this._pin; }
   get pinDigest() { return this._pinDigest; }
   loadReport() { return { ...this._loadReport }; }
+  /** Statements dropped or refused for capacity since start. */
+  capacityReport() { return { ...this._capacity }; }
+  /** How long the last resolution took (a node paces its settles by it). */
+  get lastResolveMs() { return this._lastResolveMs; }
   size() { return this._held.size; }
   has(id) { return this._held.has(id); }
   /** A held statement (its canonical form, with the signature entries that counted), or null. */
@@ -89,7 +107,9 @@ class AuthorityStore {
 
   /**
    * Check one statement and hold it if it is valid.
-   * @returns {{ result: 'held'|'duplicate'|'pending'|'invalid', id?: string, reason?: string, missing?: string }}
+   * @returns {{ result: 'held'|'duplicate'|'pending'|'invalid'|'over-capacity', id?: string, reason?: string, missing?: string }}
+   *   'over-capacity': valid, but the store is full and it comes last in authority order (never an
+   *   anchor-level statement or a revoke); it says nothing against the statement or who sent it
    */
   ingest(statement) {
     const bad = A.malformedReason(statement);
@@ -99,9 +119,12 @@ class AuthorityStore {
     if (!this._pin) return { result: 'invalid', id, reason: 'no anchor is pinned' };
     const v = this._validate(statement, id);
     if (v.result !== 'valid') return { ...v, id };
-    if (this._held.size >= this._maxHeld && !this._makeRoom()) return { result: 'invalid', id, reason: 'the store is full of live statements' };
     this._held.set(id, v.entry);
-    this._resolved = null;
+    this._changed();
+    if (this._held.size > this._maxHeld && this._evict(id).has(id)) {
+      this._capacity.refused++;
+      return { result: 'over-capacity', id, reason: 'the store is full, and this statement comes last in authority order' };
+    }
     this._append(v.entry.s);
     return { result: 'held', id };
   }
@@ -174,7 +197,8 @@ class AuthorityStore {
    * @returns {{ status: Map<string, string>, inForce: Set<string>, keptBy: Map<string, string>, live: Set<string>, root: string|null }}
    */
   resolve() {
-    if (this._resolved) return this._resolved;
+    if (this._resolved && !this._dirty) return this._resolved;
+    const t0 = process.hrtime.bigint();
     const held = this._held;
     const status = new Map();
     const F = new Set();
@@ -283,16 +307,26 @@ class AuthorityStore {
     const live = new Set(F);
     for (const id of F) for (const gid of held.get(id).chain) live.add(gid);
     const root = this._pin ? A.authorityRoot(this._pinDigest, F) : null;
-    this._resolved = { status, inForce: F, keptBy, live, root };
+    this._resolved = { status, inForce: F, keptBy, live, root, liveOrder: null };
+    this._dirty = false;
+    this._lastResolveMs = Number(process.hrtime.bigint() - t0) / 1e6;
     return this._resolved;
   }
 
+  /**
+   * The resolution queries read: the last one when the store is lazy (a node resolves when it
+   * settles), a fresh one otherwise.
+   */
+  view() {
+    return this._lazy && this._resolved ? this._resolved : this.resolve();
+  }
+
   /** A held statement's status: in-force, removed, over-quota or dead; undefined when not held. */
-  statusOf(id) { return this.resolve().status.get(id); }
-  isInForce(id) { return this.resolve().inForce.has(id); }
-  root() { return this.resolve().root; }
+  statusOf(id) { return this.view().status.get(id); }
+  isInForce(id) { return this.view().inForce.has(id); }
+  root() { return this.view().root; }
   /** For authority-digest (§6.6.8): the root and the in-force count. */
-  digest() { const r = this.resolve(); return { root: r.root, count: r.inForce.size }; }
+  digest() { const r = this.view(); return { root: r.root, count: r.inForce.size }; }
 
   // ── Roles: §6.6.4 "roles follow the key" ─────────────────────────────────────
 
@@ -306,10 +340,10 @@ class AuthorityStore {
     const out = [];
     if (!this._pin || typeof nodeId !== 'string' || typeof key !== 'string') return out;
     if (this._pin.threshold === 1 && this._pin.members.some((m) => m.key === key && m.nodeId === nodeId)) out.push({ role: 'anchor', scope: null, grant: null });
-    const { inForce } = this.resolve();
+    const { inForce } = this.view();
     for (const id of inForce) {
       const e = this._held.get(id);
-      if (e.kind === 'grant' && e.subject.nodeId === nodeId && e.subject.key === key) out.push({ role: e.role, scope: e.scope, grant: id });
+      if (e && e.kind === 'grant' && e.subject.nodeId === nodeId && e.subject.key === key) out.push({ role: e.role, scope: e.scope, grant: id });
     }
     return out;
   }
@@ -331,11 +365,11 @@ class AuthorityStore {
    * force now): undefined when none does, or when two different keys do.
    */
   grantKey(nodeId) {
-    const { inForce } = this.resolve();
+    const { inForce } = this.view();
     let found;
     for (const id of inForce) {
       const e = this._held.get(id);
-      if (e.kind !== 'grant' || e.subject.nodeId !== nodeId) continue;
+      if (!e || e.kind !== 'grant' || e.subject.nodeId !== nodeId) continue;
       if (found !== undefined && found !== e.subject.key) return undefined;
       found = e.subject.key;
     }
@@ -345,15 +379,15 @@ class AuthorityStore {
   /** The in-force grants naming `nodeId` with a key other than `key` (a foreign key for this node). */
   foreignGrantsFor(nodeId, key) {
     const out = [];
-    for (const id of this.resolve().inForce) {
+    for (const id of this.view().inForce) {
       const e = this._held.get(id);
-      if (e.kind === 'grant' && e.subject.nodeId === nodeId && e.subject.key !== key) out.push(e.s);
+      if (e && e.kind === 'grant' && e.subject.nodeId === nodeId && e.subject.key !== key) out.push(e.s);
     }
     return out;
   }
 
   /** In-force grants (held, canonical), for a host's listing. */
-  inForceStatements() { return [...this.resolve().inForce].map((id) => this._held.get(id).s); }
+  inForceStatements() { return [...this.view().inForce].map((id) => this._held.get(id)).filter(Boolean).map((e) => e.s); }
 
   // ── Serving: §6.6.8 ──────────────────────────────────────────────────────────
 
@@ -362,58 +396,72 @@ class AuthorityStore {
 
   /** Statements in authority order. */
   authorityOrder(ids) {
-    return [...ids].map((id) => this._held.get(id)).filter(Boolean)
-      .sort((x, y) => (x.depth - y.depth) || (kindGroup(x.kind) - kindGroup(y.kind)) || (x.id < y.id ? -1 : x.id > y.id ? 1 : 0));
+    return [...ids].map((id) => this._held.get(id)).filter(Boolean).sort(orderCmp);
   }
 
   /**
-   * An answer to authority-fetch by ids: each named statement in the live set with its chain, and every
-   * in-force revoke and endorse naming a statement in the answer, each with its chain; in authority
-   * order, at most AUTHORITY_PAGE statements. What is not served is listed missing.
+   * An answer to authority-fetch by ids (§6.6.8): each named statement in the live set with its chain,
+   * and every in-force revoke and endorse naming a statement in the answer, each with its chain, and so
+   * on to a fixpoint (an endorse that keeps a revoke in the answer in force is in the answer too); in
+   * authority order, at most AUTHORITY_PAGE statements. A named statement whose closure does not fit
+   * is listed missing, as is one not in the live set.
    * @returns {{ statements: object[], missing: string[] }}
    */
   answerIds(ids) {
-    const { live, inForce } = this.resolve();
+    const { live, inForce } = this.view();
     const chosen = new Set();
     const missing = [];
-    const withChain = (id) => [id, ...this._held.get(id).chain];
     for (const id of ids) {
-      if (!live.has(id)) { missing.push(id); continue; }
-      const add = new Set(withChain(id).filter((x) => !chosen.has(x)));
-      // The in-force revokes and endorses naming anything in the answer so far, with their chains.
-      for (const x of [...add, ...chosen]) {
-        for (const e of this._namersOf(x)) if (inForce.has(e.id) && !chosen.has(e.id)) for (const y of withChain(e.id)) if (!chosen.has(y)) add.add(y);
+      if (!live.has(id) || !this._held.has(id)) { missing.push(id); continue; }
+      const add = new Set();
+      const queue = [id];
+      let over = false;
+      while (queue.length && !over) {
+        const e = this._held.get(queue.pop());
+        if (!e) continue;
+        for (const y of [e.id, ...e.chain]) {
+          if (chosen.has(y) || add.has(y) || !this._held.has(y)) continue;
+          add.add(y);
+          if (chosen.size + add.size > A.AUTHORITY_PAGE) { over = true; break; }
+          for (const n of this._namersOf(y)) if (inForce.has(n.id) && !chosen.has(n.id) && !add.has(n.id)) queue.push(n.id);
+        }
       }
-      if (chosen.size + add.size > A.AUTHORITY_PAGE) { missing.push(id); continue; }
+      if (over) { missing.push(id); continue; }
       for (const x of add) chosen.add(x);
     }
     return { statements: this.authorityOrder(chosen).map((e) => e.s), missing };
   }
 
-  /** @private The held revokes and endorses naming `id`. */
+  /** @private The held revokes and endorses naming `id` (an index rebuilt when the held set changes). */
   _namersOf(id) {
-    if (!this._namerIndex || this._namerIndexAt !== this._resolved) {
+    if (!this._namerIndex || this._namerIndexAt !== this._version) {
       const m = new Map();
       for (const e of this._held.values()) if (e.targets) for (const t of e.targets) { let l = m.get(t); if (!l) { l = []; m.set(t, l); } l.push(e); }
       this._namerIndex = m;
-      this._namerIndexAt = this._resolved;
+      this._namerIndexAt = this._version;
     }
     return this._namerIndex.get(id) || [];
   }
 
   /**
-   * A page of the live set in authority order after `after` (an opaque cursor: '' for the start).
+   * A page of the live set in authority order after `after` (an opaque cursor: '' for the start). The
+   * order is sorted once per resolution, and a page found by binary search: O(log S + page).
    * @returns {{ statements: object[], next: string|null }}
    */
   page(after) {
-    const { live } = this.resolve();
-    const all = this.authorityOrder(live);
-    let i = 0;
+    const r = this.view();
+    if (!r.liveOrder) r.liveOrder = this.authorityOrder(r.live);
+    const all = r.liveOrder;
+    let lo = 0;
     if (typeof after === 'string' && after) {
-      while (i < all.length && this._orderKeyCompare(this._orderKey(all[i]), after) <= 0) i++;
+      let hi = all.length;
+      while (lo < hi) {
+        const mid = (lo + hi) >>> 1;
+        if (this._orderKeyCompare(this._orderKey(all[mid]), after) <= 0) lo = mid + 1; else hi = mid;
+      }
     }
-    const slice = all.slice(i, i + A.AUTHORITY_PAGE);
-    const more = i + slice.length < all.length;
+    const slice = all.slice(lo, lo + A.AUTHORITY_PAGE);
+    const more = lo + slice.length < all.length;
     return { statements: slice.map((e) => e.s), next: more && slice.length ? this._orderKey(slice[slice.length - 1]) : null };
   }
 
@@ -423,65 +471,141 @@ class AuthorityStore {
     return (Number(da) - Number(db)) || (Number(ga) - Number(gb)) || (ia < ib ? -1 : ia > ib ? 1 : 0);
   }
 
-  // ── Retention and persistence ─────────────────────────────────────────────────
+  // ── Capacity and persistence ──────────────────────────────────────────────────
 
-  /** @private Drop non-live statements (dead, removed, over quota), highest id first, to make room. */
-  _makeRoom() {
+  /**
+   * @private Over MAX_HELD: drop down to EVICT_SLACK below it, what is not live first, and within each
+   * what comes last in authority order (deepest, grants before revokes and endorses, highest id). The
+   * statement arriving (`incomingId`) is a candidate like any other unless it is anchor-level or a
+   * revoke: those are never the ones refused, so the removal that would clean a flooded store up is
+   * always taken (§6.6.6: removals first). One sort per batch, not per arrival.
+   * @returns {Set<string>} the ids dropped
+   */
+  _evict(incomingId) {
+    const dropped = new Set();
+    const n = this._held.size - Math.max(0, this._maxHeld - evictSlack(this._maxHeld));
+    if (n <= 0) return dropped;
     const { live } = this.resolve();
-    const droppable = [...this._held.keys()].filter((id) => !live.has(id)).sort().reverse();
-    const n = Math.max(1, Math.ceil(this._maxHeld / 16));
-    for (const id of droppable.slice(0, n)) this._held.delete(id);
-    this._resolved = null;
-    return this._held.size < this._maxHeld;
+    const incoming = this._held.get(incomingId);
+    const keep = incoming && (incoming.authBy === 'anchor' || incoming.kind === 'revoke') ? incomingId : null;
+    const candidates = [];
+    for (const e of this._held.values()) if (e.id !== keep) candidates.push(e);
+    candidates.sort((x, y) => ((live.has(x.id) ? 1 : 0) - (live.has(y.id) ? 1 : 0)) || orderCmp(y, x));
+    for (const e of candidates.slice(0, n)) { this._held.delete(e.id); dropped.add(e.id); }
+    this._capacity.evicted += dropped.size - (dropped.has(incomingId) ? 1 : 0);
+    if (this._loading && this._loadEvicted) for (const id of dropped) this._loadEvicted.add(id);
+    this._changed();
+    if (dropped.size) this._log(`Authority store over ${this._maxHeld}: ${dropped.size} statement(s) dropped, last in authority order first`);
+    return dropped;
   }
 
-  /** @private Append a held statement to the file (best effort; the file carries no authority). */
+  /** @private The held set changed: the resolution and the namer index are stale. */
+  _changed() { this._dirty = true; this._version = (this._version || 0) + 1; }
+
+  /**
+   * @private Append a held statement to the file (best effort; the file carries no authority). Each
+   * record starts on a line of its own (a torn last line is ended first), and a write that fails part
+   * way is cut back to where it began, so one failure costs at most the statement being written.
+   */
   _append(s) {
-    if (!this._dir || this._loading || !this._pin) return;
-    try { fs.mkdirSync(this._dir, { recursive: true }); fs.appendFileSync(path.join(this._dir, fileFor(this._pinDigest)), JSON.stringify(s) + '\n', { mode: 0o600 }); }
-    catch { /* best effort */ }
+    if (!this._dir || this._loading) return;
+    const file = path.join(this._dir, FILE);
+    let fd = null;
+    let size = 0;
+    try {
+      fs.mkdirSync(this._dir, { recursive: true });
+      fd = fs.openSync(file, 'a+', 0o600);
+      size = fs.fstatSync(fd).size;
+      let lead = '';
+      if (size > 0) {
+        const last = Buffer.alloc(1);
+        fs.readSync(fd, last, 0, 1, size - 1);
+        if (last[0] !== 0x0a) lead = '\n';
+      }
+      const buf = Buffer.from(`${lead}${JSON.stringify(s)}\n`, 'utf8');
+      for (let off = 0; off < buf.length;) off += fs.writeSync(fd, buf, off, buf.length - off);
+    } catch {
+      if (fd !== null) { try { fs.ftruncateSync(fd, size); } catch { /* best effort */ } }
+    } finally {
+      if (fd !== null) { try { fs.closeSync(fd); } catch { /* best effort */ } }
+    }
   }
 
   /**
-   * @private Read the file and verify every statement again, chain by chain, against the pinned
-   * anchor: offered in passes until one holds nothing more, so file order does not matter. Nothing
-   * read from disk is trusted for being there. Statements still pending stay on disk for the next
-   * load; the file is then rewritten as the held and pending statements (no status or root is kept).
+   * @private Read the one statement file and judge every statement again against the pin in force,
+   * chain by chain: offered in passes until one holds nothing more, so file order does not matter.
+   * Nothing read from disk is trusted for being there. What does not count under this pin (a statement
+   * that fails, or one whose chain is not held) is never deleted: the file is rewritten as the held
+   * statements and, as the bytes they were, the rest, so a corrected pin or a re-pin that keeps a
+   * threshold of the old keys finds them again (§6.6.1). Only lines that are not a statement at all
+   * (torn, not JSON, not of the shape) and statements dropped for capacity are left out. With no pin,
+   * nothing is judged and the file is left as it is.
    */
   _load() {
-    const file = path.join(this._dir, fileFor(this._pinDigest));
+    const file = path.join(this._dir, FILE);
     let text = '';
     try { text = fs.readFileSync(file, 'utf8'); } catch { return; }
-    let pending = [];
+    const entries = [];
     for (const line of text.split('\n')) {
-      if (!line) continue;
-      try { pending.push(JSON.parse(line)); } catch { this._loadReport.invalid++; }
+      if (!line.trim()) continue;
+      let s;
+      try { s = JSON.parse(line); } catch { this._loadReport.corrupt++; continue; }
+      if (A.shapeReason(s)) { this._loadReport.corrupt++; continue; }
+      entries.push({ line, s });
     }
+    if (!this._pin) { this._loadReport.unverified = entries.length; return; }
     this._loading = true;
-    const kept = [];
+    this._loadEvicted = new Set(); // dropped for capacity during this load: not written back
     try {
-      for (let progress = true; progress && pending.length;) {
+      let left = entries;
+      for (let progress = true; progress && left.length;) {
         progress = false;
         const next = [];
-        for (const s of pending) {
-          const r = this.ingest(s);
-          if (r.result === 'held') { progress = true; kept.push(this._held.get(r.id).s); }
-          else if (r.result === 'pending') next.push(s);
-          else if (r.result !== 'duplicate') this._loadReport.invalid++;
+        for (const e of left) {
+          const r = this.ingest(e.s);
+          if (r.result === 'held') progress = true;
+          else if (r.result === 'pending') next.push(e);
         }
-        pending = next;
+        left = next;
       }
+      this._loadReport.pending = left.length;
     } finally { this._loading = false; }
     this._loadReport.held = this._held.size;
-    this._loadReport.pending = pending.length;
+    const written = new Set();
+    const out = [];
+    for (const e of this._held.values()) { const l = JSON.stringify(e.s); written.add(l); out.push(l); }
+    for (const e of entries) {
+      if (written.has(e.line)) continue;
+      const id = A.statementId(e.s);
+      if (!this._held.has(id) && this._loadEvicted.has(id)) continue;
+      // A copy of a held statement whose entries are all held adds nothing; one carrying other entries
+      // may count under another pin (§6.6.1), and is kept.
+      if (this._held.has(id) && entriesWithin(e.s.sigs, this._held.get(id).s.sigs)) continue;
+      written.add(e.line);
+      out.push(e.line);
+      this._loadReport.unverified++;
+    }
+    this._loadEvicted = null;
     try {
       const tmp = `${file}.${process.pid}.tmp`;
-      fs.writeFileSync(tmp, [...kept, ...pending].map((s) => JSON.stringify(s)).join('\n') + (kept.length + pending.length ? '\n' : ''), { mode: 0o600 });
+      fs.writeFileSync(tmp, out.join('\n') + (out.length ? '\n' : ''), { mode: 0o600 });
       fs.renameSync(tmp, file);
     } catch { /* best effort */ }
   }
 }
 
+/** Whether every signature entry of `a` is one of `b`'s. */
+function entriesWithin(a, b) {
+  const k = (e) => `${e && e.key}|${e && e.sig}`;
+  const set = new Set((b || []).map(k));
+  return Array.isArray(a) && a.every((e) => set.has(k(e)));
+}
+
+/** Authority order: ascending depth; revokes and endorses before grants; ascending id. */
+function orderCmp(x, y) {
+  return (x.depth - y.depth) || (kindGroup(x.kind) - kindGroup(y.kind)) || (x.id < y.id ? -1 : x.id > y.id ? 1 : 0);
+}
+
 /** The lifecycle level of a role list over one CMB (see AuthorityStore#lifecycleOver). */
 function lifecycleOf(roles, contains = () => false) {
   let level = 0;
diff --git a/lib/node-authority.js b/lib/node-authority.js
index c58d25d1..e1f033c3 100644
--- a/lib/node-authority.js
+++ b/lib/node-authority.js
@@ -37,17 +37,38 @@ const SERVE_BURST = 16;
 const SERVE_QUEUE_MAX = 64;
 /** authority-digest after a change, at most once a second per session (§6.6.8). */
 const DIGEST_MIN_MS = 1000;
-/** How long a fetch or a pull page may take: a fetch's slot is then freed, a pull page asked again. */
+/** How long an ask (a pull page or a fetch by ids) may go unanswered before it is given up. */
 const FETCH_TIMEOUT_MS = 10_000;
 /** How many times a pull page that went unanswered is asked again, from the same cursor. */
 const PULL_RETRIES = 3;
 /**
  * What a key not seen before costs a gossip lane, in signature checks. §18.3.2's rules 1 and 2 for a
- * new key are one scalar multiplication (cached per key afterwards), measured here at about fifteen
- * times an OpenSSL signature check; a statement's keys are free to mint, so the lane is charged for the
- * work before it is done, and a flood of fresh keys buys a sixteenth of the checks a lane allows.
+ * new key are one scalar multiplication (cached per key afterwards, the pinned keys for good), about
+ * fifteen times an OpenSSL signature check here; a statement's keys are free to mint, so the lane is
+ * charged for the work before it is done.
  */
 const FRESH_KEY_COST = 16;
+/**
+ * The most one statement can cost (§6.6.3): a statement below the anchor is one check, its subject
+ * key and its signing key at most two fresh keys; an anchor-level one is at most 16 checks (one per
+ * pinned-key entry) and one fresh subject key. 1 + 2 * 16 = 33 bounds both.
+ */
+const STATEMENT_COST_MAX = 1 + 2 * FRESH_KEY_COST;
+/**
+ * THE ASKING RULE (§6.6.8). Every statement a session delivers spends that peer's gossip lane, asked
+ * for or not. This node asks (a pull's first page, its next page, a fetch by ids) only when the lane
+ * can pay the most an answer can cost, a full page of the most costly statements, and reserves that
+ * much while the ask is out: so an answer is never dropped for budget, and no answer spends more
+ * than the lane holds. One ask in flight per session.
+ */
+const ASK_COST = A.AUTHORITY_PAGE * STATEMENT_COST_MAX; // 2,112
+/** A pull that ends with the roots still apart is started again after this, doubling to the most. */
+const REPULL_MIN_MS = 2_000;
+const REPULL_MAX_MS = 300_000;
+/** An answer is verified in slices of at most this many checks, the event loop free between them. */
+const SLICE_COST = 4 * STATEMENT_COST_MAX;
+/** The relay-failure mute is kept per delivering peer, never per a key the sender chose (§6.6.8). */
+const MUTE = 'authority-statements';
 /** Roles by precedence, for the one role a node names (attestation stamps, `resolveRole`). */
 const ROLE_ORDER = ['anchor', 'admin', 'validator', 'issuer', 'participant'];
 /** Rank of a role for lifecycle authority and weights: anchor and admin 2, validator 1, all else 0. */
@@ -71,7 +92,8 @@ const isPlain = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
  */
 function initAuthority(node, opts = {}) {
   if (node._pin === undefined) node._pin = A.parsePin(opts.anchor !== undefined ? opts.anchor : (process.env.SYM_FOUNDER_ANCHOR || null));
-  node._authority = new AuthorityStore({ pin: node._pin, dir: path.join(node._dir, 'authority'), log: (m) => node._log(m) });
+  // Lazy: queries read the resolution the last settle made; a settle makes the next (see _scheduleAuthoritySettle).
+  node._authority = new AuthorityStore({ pin: node._pin, dir: path.join(node._dir, 'authority'), lazy: true, log: (m) => node._log(m) });
   // Scope namespaces this node implements (§6.6.2): namespace -> (path, cmb, scope) => whether the CMB
   // is inside. A namespace not listed contains no CMB, so a scoped grant gives nothing here.
   node._authorityScopes = isPlain(opts.authorityScopes) ? { ...opts.authorityScopes } : {};
@@ -79,7 +101,7 @@ function initAuthority(node, opts = {}) {
   node._authorityRelayed = new Set();    // ids relayed once already (§6.6.8 gossip)
   node._authorityOrigin = new Map();     // id -> the peer that delivered it, until the next settle
   node._authorityReported = new Set();   // foreign-self grants already reported
-  node._authorityStats = { held: 0, pending: 0, invalid: 0, duplicate: 0, relayed: 0, fetched: 0, served: 0, pulls: 0, retired: 0, overBudget: 0 };
+  node._authorityStats = { held: 0, pending: 0, invalid: 0, duplicate: 0, relayed: 0, fetched: 0, served: 0, pulls: 0, retired: 0, overBudget: 0, pendingFull: 0, overCapacity: 0 };
   node._authoritySettleQueued = false;
   const r = node._authority.loadReport();
   if (r.held || r.pending || r.invalid) node._log(`Authority: ${r.held} statement(s) held, ${r.pending} pending, ${r.invalid} not valid under the pin`);
@@ -329,28 +351,42 @@ const methods = {
   // ── Ingest, gossip and anti-entropy: §6.6.8 ─────────────────────────────────
 
   /**
-   * @private One statement, from a session (null: this host). `solicited`: it answers this node's own
-   * authority-fetch (or is a pending statement it held), so its work is charged to the peer's lane as a
-   * debt that paces the next request, never dropped: an answer dropped for budget would leave the
-   * pull short and the roots apart (§6.6.8).
+   * @private One statement, from a session (null: this host). Every statement a session delivers
+   * spends that peer's lane (§6.6.8): one this node asked for (`ask`, an answer to its own fetch or
+   * pull) from what the ask reserved, so it is never dropped; a pending statement offered again once
+   * its chain arrived (`retry`) with no floor; any other only if the lane can pay, or it is dropped.
+   * What is dropped for nothing is dropped before any of that: a statement not of the shape (no curve
+   * arithmetic yet), a repeat, a pending statement already held, or one the session's pending holds
+   * have no room for (checked before its signature is). With no anchor pinned nothing is judged at
+   * all, and nothing counts against the session (§6.6.1).
    */
-  _ingestAuthority(statement, session, { solicited = false } = {}) {
+  _ingestAuthority(statement, session, { ask = null, retry = false } = {}) {
+    if (!this._authority.anchored && session) return { result: 'ignored' };
     const peerId = session ? session.nodeId : null;
-    const signer = statement && Array.isArray(statement.sigs) && statement.sigs[0] && typeof statement.sigs[0].key === 'string' ? statement.sigs[0].key : '?';
     if (session) {
-      // As on every gossip lane, what is dropped for nothing is dropped before the budget: a statement
-      // not of the shape (no curve arithmetic yet), and a repeat (relaying sends every statement to
-      // every node; only the first copy is new).
       const bad = A.shapeReason(statement);
-      if (bad) { this._authorityStats.invalid++; this._noteRelayFailure(peerId, `authority:${signer}`); return { result: 'invalid', reason: `not well formed: ${bad}` }; }
+      if (bad) { this._authorityStats.invalid++; this._noteRelayFailure(peerId, MUTE); return { result: 'invalid', reason: `not well formed: ${bad}` }; }
       const id = A.statementId(statement);
       if (this._authority.has(id)) { this._authorityStats.duplicate++; return { result: 'duplicate', id }; }
       // A session that delivered statements failing verification is rate-limited (§6.6.8): past the
-      // failures allowed in a window its statements by that signer are dropped unverified.
-      if (this._relayMuted(peerId, `authority:${signer}`)) return { result: 'muted' };
-      const cost = 1 + FRESH_KEY_COST * this._authorityFreshKeys(statement);
-      if (solicited) this._gossipCharge(peerId, cost);
-      else if (!this._gossipBudget(peerId, 'authority-statement', signer, cost)) { this._authorityStats.overBudget++; return { result: 'over-budget' }; }
+      // failures allowed in a window, its authority statements are dropped unread.
+      if (this._relayMuted(peerId, MUTE)) return { result: 'muted' };
+      if (!retry && statement.authorisedBy !== 'anchor' && !this._authority.has(statement.authorisedBy)) {
+        const h = session._authPending;
+        if (h && h.has(`${id}|${statement.sigs[0].key}`)) { this._authorityStats.duplicate++; return { result: 'duplicate', id }; }
+        if (h && h.size >= A.AUTHORITY_PENDING_MAX) {
+          this._authorityStats.pendingFull++;
+          this._noteDrop('authority-pending-full', peerId, { frame: 'authority-statement' });
+          return { result: 'pending-full', id };
+        }
+      }
+      const cost = this._authorityCost(statement);
+      if (ask) {
+        const paid = Math.min(ask.left, cost);
+        ask.left -= paid;
+        if (cost > paid) this._gossipSpend(peerId, cost - paid);
+      } else if (retry) this._gossipSpend(peerId, cost);
+      else if (!this._gossipBudget(peerId, 'authority-statement', MUTE, cost)) { this._authorityStats.overBudget++; return { result: 'over-budget' }; }
     }
     const r = this._authority.ingest(statement);
     if (r.result === 'held') {
@@ -362,19 +398,36 @@ const methods = {
     else if (r.result === 'pending') {
       this._authorityStats.pending++;
       if (session) this._holdAuthorityPending(session, statement, r);
+    } else if (r.result === 'over-capacity') {
+      // Valid, but last in authority order in a full store: nothing against it or its sender.
+      this._authorityStats.overCapacity++;
     } else {
       this._authorityStats.invalid++;
-      if (session) this._noteRelayFailure(peerId, `authority:${signer}`);
+      if (session) this._noteRelayFailure(peerId, MUTE);
     }
     return r;
   },
 
+  /**
+   * @private What checking `s` costs, in signature checks (see STATEMENT_COST_MAX): one check below
+   * the anchor; one per pinned-key entry of an anchor-level statement (each may be verified); and
+   * FRESH_KEY_COST for every key it makes this node check for the first time.
+   */
+  _authorityCost(s) {
+    let checks = 1;
+    if (s.authorisedBy === 'anchor') {
+      checks = 0;
+      for (const e of s.sigs) if (this._pin && this._pin.members.some((m) => m.key === e.key)) checks++;
+      checks = Math.max(1, checks);
+    }
+    return checks + FRESH_KEY_COST * this._authorityFreshKeys(s);
+  },
+
   /**
    * @private How many keys checking `s` would meet for the first time (§18.3.2 rules 1 and 2 not yet
-   * known), counting only the checks the store will make: a grant's subject key; the signing key of a
-   * statement below the anchor when it is verified (its chain not held, so its own signature is
-   * checked; or held, and the key the one its authorising grant names); and the pinned keys an
-   * anchor-level statement's entries name (no other entry is verified).
+   * known), counting only the checks the store will make: a grant's subject key, and the signing key
+   * of a statement below the anchor when it is verified (its chain not held, so its own signature is
+   * checked; or held, and the key the one its authorising grant names). Pinned keys are always known.
    */
   _authorityFreshKeys(s) {
     const keys = new Set();
@@ -383,7 +436,7 @@ const methods = {
       const auth = this._authority.get(s.authorisedBy);
       const k = s.sigs[0].key;
       if (!auth || (auth.kind === 'grant' && auth.subject.key === k)) keys.add(k);
-    } else for (const e of s.sigs) if (this._pin && this._pin.members.some((m) => m.key === e.key)) keys.add(e.key);
+    }
     let n = 0;
     for (const k of keys) if (!isKeyKnown(k)) n++;
     return n;
@@ -391,58 +444,61 @@ const methods = {
 
   /**
    * @private A pending statement (§6.6.8): held in memory for its session, keyed by id and signing
-   * key, at most AUTHORITY_PENDING_MAX, released after AUTHORITY_PENDING_TIMEOUT or with the session;
-   * the missing link is fetched from that session, one fetch in flight per missing id.
+   * key, at most AUTHORITY_PENDING_MAX (room was checked before it was verified), released after
+   * AUTHORITY_PENDING_TIMEOUT or with the session. The missing link is asked for from that session
+   * under the asking rule, one ask per missing id.
    */
   _holdAuthorityPending(session, statement, r) {
     const h = session._authPending || (session._authPending = new Map());
     const key = `${r.id}|${statement.sigs[0].key}`;
-    if (h.has(key)) return;
-    if (h.size >= A.AUTHORITY_PENDING_MAX) { this._noteDrop('authority-pending-full', session.nodeId, { frame: 'authority-statement' }); return; }
-    const timer = setTimeout(() => h.delete(key), A.AUTHORITY_PENDING_TIMEOUT);
+    if (h.has(key) || h.size >= A.AUTHORITY_PENDING_MAX) return;
+    const timer = setTimeout(() => {
+      h.delete(key);
+      // No pending statement waits for that link any more: a later one may ask for it again.
+      if (session._authAsked && ![...h.values()].some((p) => p.missing === r.missing)) session._authAsked.delete(r.missing);
+    }, A.AUTHORITY_PENDING_TIMEOUT);
     if (timer.unref) timer.unref();
     h.set(key, { statement, missing: r.missing, timer });
-    const fetching = session._authFetching || (session._authFetching = new Map());
-    if (!fetching.has(r.missing)) {
-      const reqId = `af-${crypto.randomBytes(8).toString('hex')}`;
-      const t = setTimeout(() => fetching.delete(r.missing), FETCH_TIMEOUT_MS);
-      if (t.unref) t.unref();
-      fetching.set(r.missing, { reqId, timer: t });
-      this._authorityStats.fetched++;
-      session.send({ type: 'authority-fetch', reqId, ids: [r.missing] });
-    }
+    this._authorityPump(session);
   },
 
   /** @private A statement was held: offer again what any session held pending for it. */
   _authorityRetryPending(id) {
     for (const session of this._sessions) {
+      if (session._authAsked) session._authAsked.delete(id);
       const h = session._authPending;
       if (!h || !h.size || session.closed) continue;
       for (const [k, p] of [...h]) {
         if (p.missing !== id) continue;
         clearTimeout(p.timer);
         h.delete(k);
-        this._ingestAuthority(p.statement, session, { solicited: true });
+        this._ingestAuthority(p.statement, session, { retry: true });
       }
     }
   },
 
-  /** @private Release what a closing session held (pending statements, fetches, pulls, queued answers). */
+  /** @private Release what a closing session held (pending statements, asks, pulls, queued answers). */
   _authorityReleaseSession(session) {
     for (const p of (session._authPending || new Map()).values()) clearTimeout(p.timer);
-    for (const f of (session._authFetching || new Map()).values()) clearTimeout(f.timer);
-    if (session._authPull) { clearTimeout(session._authPull.timer); clearTimeout(session._authPull.wait); }
-    if (session._authDigestTimer) clearTimeout(session._authDigestTimer);
-    if (session._authServeTimer) clearTimeout(session._authServeTimer);
-    session._authPending = null; session._authFetching = null; session._authPull = null;
-    session._authServeQueue = null; session._authServeTimer = null;
+    if (session._authAsk) clearTimeout(session._authAsk.timer);
+    for (const t of [session._authPumpTimer, session._authRepullTimer, session._authDigestTimer, session._authServeTimer]) if (t) clearTimeout(t);
+    session._authPending = null; session._authAsk = null; session._authAsked = null; session._authPull = null;
+    session._authPumpTimer = null; session._authRepullTimer = null; session._authServeQueue = null; session._authServeTimer = null;
   },
 
-  /** @private Settle once the current ingest is done (many statements in one tick settle once). */
+  /**
+   * @private Settle once the current ingest is done (many statements in one tick settle once), and
+   * never sooner after the last settle than twice what its resolution took: resolving is linear in
+   * the held set, so a stream of statements, one per frame, spends at most a third of the time
+   * resolving, whatever the set's size. Queries read the last settled resolution in between.
+   */
   _scheduleAuthoritySettle() {
     if (this._authoritySettleQueued) return;
     this._authoritySettleQueued = true;
-    setImmediate(() => { this._authoritySettleQueued = false; this._authoritySettle(); });
+    const run = () => { this._authoritySettleQueued = false; this._authoritySettle(); };
+    const wait = (this._authoritySettledAt || 0) + 2 * this._authority.lastResolveMs - Date.now();
+    if (wait > 0) { const t = setTimeout(run, Math.ceil(wait)); if (t.unref) t.unref(); }
+    else setImmediate(run);
   },
 
   /**
@@ -485,6 +541,7 @@ const methods = {
       for (const session of this._sessions) if (session.confirmed && !session.closed) this._sendAuthorityDigest(session);
       try { this.emit('authority-changed', Object.freeze({ root: this._authority.root(), inForce: inForce.size })); } catch { /* a listener must not stop the settle */ }
     }
+    this._authoritySettledAt = Date.now();
   },
 
   /** @private authority-digest on `session`, at most once a second (§6.6.8). */
@@ -505,37 +562,98 @@ const methods = {
   },
 
   /**
-   * @private A peer's root and count: one that differs from this node's starts a pull of its live set.
-   * One pull in flight per session; a digest that arrives during it is remembered, and the pull is
-   * started again when it ends if the roots still differ (§6.6.8: reconciled by the next digest).
+   * @private A peer's root and count (§6.6.8): one that differs from this node's starts a pull of its
+   * live set. One pull per session; a digest that arrives during it is remembered, and the pull is
+   * started again when it ends if the roots still differ.
    */
   _onAuthorityDigest(session, msg) {
     if (!this._authority.anchored || !msg || typeof msg.root !== 'string' || !HEX64.test(msg.root) || !Number.isSafeInteger(msg.count) || msg.count < 0) return;
     session._authPeerRoot = msg.root;
-    if (msg.root === this._authority.root()) return;
+    if (msg.root === this._authority.root()) { this._authorityRootsMet(session); return; }
     if (session._authPull) { session._authPull.digestSeen = true; return; }
-    this._startAuthorityPull(session, '');
+    this._startAuthorityPull(session);
+  },
+
+  /** @private Pull the peer's live set from the start (asked for under the asking rule). */
+  _startAuthorityPull(session) {
+    if (session.closed || session._authPull) return;
+    if (session._authRepullTimer) { clearTimeout(session._authRepullTimer); session._authRepullTimer = null; }
+    session._authPull = { after: '', attempt: 0, want: true, digestSeen: false, first: true };
+    this._authorityPump(session);
+  },
+
+  /** @private The roots met: any re-pull backoff starts again from the shortest. */
+  _authorityRootsMet(session) {
+    session._authRepullMs = 0;
+    if (session._authRepullTimer) { clearTimeout(session._authRepullTimer); session._authRepullTimer = null; }
+  },
+
+  /** @private A pull ended with the roots apart: pull again after a backoff, doubling (L3). */
+  _scheduleAuthorityRepull(session) {
+    if (session.closed || session._authRepullTimer) return;
+    const wait = session._authRepullMs || REPULL_MIN_MS;
+    session._authRepullMs = Math.min(REPULL_MAX_MS, wait * 2);
+    const t = setTimeout(() => {
+      session._authRepullTimer = null;
+      if (session.closed || !session._authPeerRoot || session._authPeerRoot === this._authority.root()) return;
+      this._startAuthorityPull(session);
+    }, wait);
+    if (t.unref) t.unref();
+    session._authRepullTimer = t;
   },
 
   /**
-   * @private Ask for a page of the peer's live set after `after` (§6.6.8). An unanswered page is asked
-   * again from the same cursor, up to PULL_RETRIES times; then the pull ends.
+   * @private Ask the session for what this node wants from it, under the asking rule: one ask in
+   * flight per session, and only once the peer's lane can pay a full answer's worst case (ASK_COST),
+   * which the ask reserves until its answer, or its timeout, gives back what was not spent. Missing
+   * links of pending statements are asked for first (they time out), up to a page of ids at once.
    */
-  _startAuthorityPull(session, after = '', attempt = 0) {
-    if (session.closed) return;
-    const prev = session._authPull;
-    if (prev && after === '' && attempt === 0 && !prev.done) return; // one pull in flight
-    if (prev) { clearTimeout(prev.timer); clearTimeout(prev.wait); }
-    const pull = { reqId: `af-${crypto.randomBytes(8).toString('hex')}`, after, attempt, digestSeen: !!(prev && prev.digestSeen && after !== ''), timer: null, wait: null, done: false };
-    pull.timer = setTimeout(() => {
-      if (session._authPull !== pull) return;
-      if (attempt < PULL_RETRIES && !session.closed) this._startAuthorityPull(session, after, attempt + 1);
-      else session._authPull = null;
-    }, FETCH_TIMEOUT_MS);
-    if (pull.timer.unref) pull.timer.unref();
-    session._authPull = pull;
-    if (after === '' && attempt === 0) this._authorityStats.pulls++;
-    session.send({ type: 'authority-fetch', reqId: pull.reqId, after });
+  _authorityPump(session) {
+    if (!this._authority.anchored || !session || session.closed || session._authAsk) return;
+    const asked = session._authAsked || (session._authAsked = new Set());
+    const ids = [];
+    for (const p of (session._authPending || new Map()).values()) {
+      if (ids.length >= A.AUTHORITY_PAGE) break;
+      if (asked.has(p.missing) || ids.includes(p.missing) || this._authority.has(p.missing)) continue;
+      ids.push(p.missing);
+    }
+    const pull = session._authPull && session._authPull.want ? session._authPull : null;
+    if (!ids.length && !pull) return;
+    const wait = this._gossipReserve(session.nodeId, ASK_COST);
+    if (wait > 0) {
+      if (!session._authPumpTimer) {
+        const t = setTimeout(() => { session._authPumpTimer = null; this._authorityPump(session); }, wait);
+        if (t.unref) t.unref();
+        session._authPumpTimer = t;
+      }
+      return;
+    }
+    const ask = { reqId: `af-${crypto.randomBytes(8).toString('hex')}`, left: ASK_COST, ids: ids.length ? ids : null, pull: ids.length ? null : pull, timer: null };
+    ask.timer = setTimeout(() => this._authorityAskTimedOut(session, ask), FETCH_TIMEOUT_MS);
+    if (ask.timer.unref) ask.timer.unref();
+    session._authAsk = ask;
+    if (ask.ids) {
+      for (const id of ids) asked.add(id);
+      this._authorityStats.fetched++;
+      session.send({ type: 'authority-fetch', reqId: ask.reqId, ids });
+    } else {
+      pull.want = false;
+      if (pull.first) { pull.first = false; this._authorityStats.pulls++; }
+      session.send({ type: 'authority-fetch', reqId: ask.reqId, after: pull.after });
+    }
+  },
+
+  /** @private An ask went unanswered: give its reservation back; a pull page is asked again, at most PULL_RETRIES times. */
+  _authorityAskTimedOut(session, ask) {
+    if (session._authAsk !== ask) return;
+    session._authAsk = null;
+    this._gossipRefund(session.nodeId, ask.left);
+    if (ask.ids && session._authAsked) for (const id of ask.ids) session._authAsked.delete(id);
+    if (ask.pull) {
+      if (ask.pull.attempt < PULL_RETRIES) { ask.pull.attempt++; ask.pull.want = true; }
+      else { session._authPull = null; this._scheduleAuthorityRepull(session); }
+    }
+    this._authorityPump(session);
   },
 
   /**
@@ -583,31 +701,55 @@ const methods = {
   },
 
   /**
-   * @private An answer to this node's fetch or pull on the same session: each statement ingested as
-   * gossip is, its work charged to the peer's lane (`solicited`); the next page is asked for once that
-   * lane is out of debt, so a pull is paced by the work it causes and never cut short.
+   * @private An answer to this node's ask on the same session (§6.6.8): each statement ingested as
+   * gossip is, paid from the ask's reservation; what it did not spend goes back to the lane. A pull
+   * goes on from the answer's cursor; when it ends with the roots apart it is started again, at once
+   * if a digest came during it, after a backoff otherwise.
    */
   _onAuthoritySet(session, msg) {
     if (!msg || typeof msg.reqId !== 'string' || !Array.isArray(msg.statements) || msg.statements.length > A.AUTHORITY_PAGE) return;
-    const pull = session._authPull && session._authPull.reqId === msg.reqId && !session._authPull.done ? session._authPull : null;
-    let fetch = null;
-    for (const [missing, f] of session._authFetching || []) if (f.reqId === msg.reqId) { fetch = missing; clearTimeout(f.timer); session._authFetching.delete(missing); break; }
-    if (!pull && fetch === null) return; // nobody asked on this session
-    for (const s of msg.statements) this._ingestAuthority(s, session, { solicited: true });
-    if (!pull) return;
-    clearTimeout(pull.timer);
-    pull.done = true;
-    const next = typeof msg.next === 'string' && msg.next && msg.next.length <= 128 ? msg.next : null;
-    if (next && !session.closed) {
-      const wait = this._gossipDebtMs(session.nodeId);
-      if (wait <= 0) { this._startAuthorityPull(session, next); return; }
-      pull.wait = setTimeout(() => { if (session._authPull === pull && !session.closed) this._startAuthorityPull(session, next); }, wait);
-      if (pull.wait.unref) pull.wait.unref();
-      return;
+    const ask = session._authAsk;
+    if (!ask || ask.reqId !== msg.reqId || ask.answering) return; // nobody asked on this session
+    clearTimeout(ask.timer);
+    ask.answering = true;
+    // A page is verified in slices of at most SLICE_COST checks, yielding between them, so one answer
+    // never holds the event loop for long (64 fresh-key statements are some 130 scalar multiplications).
+    const statements = msg.statements;
+    let i = 0;
+    const slice = () => {
+      if (session.closed) { session._authAsk = null; this._gossipRefund(session.nodeId, ask.left); return; }
+      let spent = 0;
+      while (i < statements.length && spent < SLICE_COST) {
+        const st = statements[i++];
+        const before = ask.left;
+        this._ingestAuthority(st, session, { ask });
+        spent += Math.max(1, before - ask.left);
+      }
+      if (i < statements.length) { setImmediate(slice); return; }
+      session._authAsk = null;
+      this._answered(session, ask, msg);
+    };
+    slice();
+  },
+
+  /** @private The whole answer is in: give back what it did not spend, and go on with the pull. */
+  _answered(session, ask, msg) {
+    this._gossipRefund(session.nodeId, ask.left);
+    ask.left = 0;
+    const pull = ask.pull;
+    if (pull && session._authPull === pull) {
+      const next = typeof msg.next === 'string' && msg.next && msg.next.length <= 128 ? msg.next : null;
+      if (next) { pull.after = next; pull.attempt = 0; pull.want = true; }
+      else {
+        session._authPull = null;
+        const root = this._authority.resolve().root;
+        if (session._authPeerRoot && session._authPeerRoot !== root) {
+          if (pull.digestSeen) this._startAuthorityPull(session);
+          else this._scheduleAuthorityRepull(session);
+        } else this._authorityRootsMet(session);
+      }
     }
-    session._authPull = null;
-    // A digest came while the pull ran: if this node still lacks that root, pull again.
-    if (pull.digestSeen && session._authPeerRoot && session._authPeerRoot !== this._authority.root()) this._startAuthorityPull(session, '');
+    this._authorityPump(session);
   },
 
   /** @private A retired time-replay frame (§6.6.11): ignored, counted, said once a minute per peer. */
@@ -617,4 +759,4 @@ const methods = {
   },
 };
 
-module.exports = { initAuthority, methods, RETIRED_FRAMES, FRESH_KEY_COST, SERVE_BURST, SERVE_QUEUE_MAX, lifecycleRank, highestRole, ROLE_ORDER };
+module.exports = { initAuthority, methods, RETIRED_FRAMES, FRESH_KEY_COST, STATEMENT_COST_MAX, ASK_COST, SERVE_BURST, SERVE_QUEUE_MAX, lifecycleRank, highestRole, ROLE_ORDER };
diff --git a/lib/node.js b/lib/node.js
index 8b911bbe..e014a136 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -519,8 +519,9 @@ class SymNode extends EventEmitter {
     // Without one nothing is in force, and the node falls back to its static `lifecycleRole` (§6.5).
     this._pin = parsePin(opts.anchor !== undefined ? opts.anchor : (process.env.SYM_FOUNDER_ANCHOR || null));
     // Roster key registry — authenticated nodeId→key bindings, so signatures from peers
-    // we never directly handshook still verify. Pins by source precedence (anchor >
-    // handshake > grant-vouched); the relayer never vouches. Persisted under the node dir.
+    // we never directly handshook still verify. Sources: the anchor pin, a proven session, an
+    // out-of-band pin, an in-force grant (a view, never stored); the relayer never vouches.
+    // Persisted under the node dir.
     // nodeId -> { key, sessions }: the key each live confirmed session proved (see _admitSession).
     this._sessionKeys = new Map();
     this._roster = new RosterKeyRegistry({
@@ -539,7 +540,7 @@ class SymNode extends EventEmitter {
     });
     {
       const mig = this._roster.migration();
-      if (mig && mig.read > 0) this._log(`Key registry migrated from 0.13: ${mig.bindings} binding(s), ${mig.legacyClaim} relabelled legacy-claim (unproven hellos: expected keys, never verifying), ${mig.grant} grant-vouched`);
+      if (mig && mig.read > 0) this._log(`Key registry migrated from 0.13: ${mig.bindings} binding(s), ${mig.legacyClaim} relabelled legacy-claim (expected keys, never verifying), ${mig.grant} of them from 0.13 grants (no 0.13 grant confers authority or binds a key now)`);
     }
     // Legacy Import (design D7): off unless routes are configured (opts.legacyRoutes, or the node
     // dir's legacy-routes.json). Each route is outbound-only, pins its mandatory key fingerprint, and
@@ -1345,7 +1346,7 @@ class SymNode extends EventEmitter {
    * statements for that signer are dropped unverified (`_relayMuted`). The lane refills, so a peer that stops flooding is heard again within
    * burst/rate seconds. A dropped frame changes nothing: it is not marked seen, so another peer's copy
    * is taken. O(1). `cost` is the checks the statement will cost (an authority statement naming a key
-   * not seen before costs more: see FRESH_KEY_COST in node-authority.js).
+   * not seen before costs more: see FRESH_KEY_COST and the asking rule in node-authority.js).
    * @returns {boolean} whether the frame may be verified
    * @private
    */
@@ -1358,26 +1359,38 @@ class SymNode extends EventEmitter {
   }
 
   /**
-   * Charge `cost` checks to `peerId`'s lane for work this node ASKED for (an answer to its own
-   * authority-fetch: the asking paces it, so it is never dropped, MMP §6.6.8). The lane may go into
-   * debt; until it is repaid the peer's unsolicited gossip waits, and the asker waits the returned
-   * milliseconds before asking that peer for more.
-   * @returns {number} ms until the lane is out of debt (0 when it is not in debt)
+   * Reserve `amount` checks of `peerId`'s lane for an ask this node makes (MMP §6.6.8, the asking
+   * rule in node-authority.js): taken now if the lane holds it (at most the burst is ever needed),
+   * and given back, less what the answer cost, by `_gossipRefund`.
+   * @returns {number} 0 when reserved; otherwise ms until the lane will hold it
    * @private
    */
-  _gossipCharge(peerId, cost) {
+  _gossipReserve(peerId, amount) {
     const now = this._gossipClock();
     const b = bucketOf(this._gossipBuckets, peerId, this._gossipRate, this._gossipBurst, this._gossipNewLane, now, GOSSIP_MAX_PEERS);
-    b.tokens = Math.max(-this._gossipBurst, b.tokens - cost);
-    return this._gossipDebtMs(peerId);
+    const need = Math.min(amount, this._gossipBurst);
+    if (b.tokens >= need) { b.tokens -= need; return 0; }
+    return Math.max(1, Math.ceil(((need - b.tokens) * 1000) / this._gossipRate));
   }
 
-  /** @private ms until `peerId`'s lane is out of debt (0 when it is not). */
-  _gossipDebtMs(peerId) {
+  /** @private Give back what a reservation did not spend (never past the burst). */
+  _gossipRefund(peerId, amount) {
+    if (!(amount > 0)) return;
     const b = this._gossipBuckets.get(peerId);
-    if (!b) return 0;
+    if (!b) return;
     refill(b, this._gossipRate, this._gossipBurst, this._gossipClock());
-    return b.tokens >= 0 ? 0 : Math.ceil((-b.tokens * 1000) / this._gossipRate);
+    b.tokens = Math.min(this._gossipBurst, b.tokens + amount);
+  }
+
+  /**
+   * @private Spend `amount` of `peerId`'s lane with no floor: work already done for that peer (a
+   * pending statement verified again once its chain arrived). A lane in debt pays it back before it
+   * buys anything else, and this node asks that peer for nothing until it does.
+   */
+  _gossipSpend(peerId, amount) {
+    const now = this._gossipClock();
+    const b = bucketOf(this._gossipBuckets, peerId, this._gossipRate, this._gossipBurst, this._gossipNewLane, now, GOSSIP_MAX_PEERS);
+    b.tokens -= amount;
   }
 
   /**
@@ -3369,8 +3382,8 @@ class SymNode extends EventEmitter {
 
   /**
    * The key bindings this node holds, public keys only: the durable registry's (anchor, pinned,
-   * proven, legacy-claim) and the live sessions' (`session`). A grant-vouched key is shown where a
-   * grant in effect names it. A host reads these; it never writes them.
+   * proven, legacy-claim) and the live sessions' (`session`). A key an in-force grant names is shown
+   * where it binds an unbound nodeId (§6.6.9). A host reads these; it never writes them.
    * @returns {{ nodeId: string, key: string, source: string }[]}
    */
   keyBindings() {
diff --git a/tests/authority-attacks.test.js b/tests/authority-attacks.test.js
index 97027cad..0f560c94 100644
--- a/tests/authority-attacks.test.js
+++ b/tests/authority-attacks.test.js
@@ -320,3 +320,69 @@ describe('§6.6: the old faces of the time-replay rule are gone', () => {
     assert.deepStrictEqual(chain.map((c) => status(st2, c)), ['in-force', 'in-force', 'in-force', 'in-force', 'not held']);
   });
 });
+
+// ── Capacity (§6.6.6: removals first; one signer never displaces another) ─────
+
+describe('§6.6 capacity: a full store keeps what comes first in authority order', () => {
+  /** Two admins whose in-force subtrees fill a store of 600 (the release review's scene). */
+  function flood() {
+    const all = []; const admins = [];
+    for (let c = 0; c < 2; c++) {
+      const gA = grant('anchor', party(), 'admin'); all.push(gA); admins.push(gA);
+      const subs = Array.from({ length: 16 }, () => grant(gA, party(), 'admin'));
+      all.push(...subs);
+      for (let i = 0; i < 240; i++) all.push(grant(gA, party(), 'participant'));
+      for (const g of subs) for (let i = 0; i < 4; i++) all.push(grant(g, party(), 'participant'));
+    }
+    return { all, admins };
+  }
+
+  it('the anchor\'s revoke of the flooding admins is taken, and the store resolves as an unbounded one does', () => {
+    const { all, admins } = flood();
+    const st = new AuthorityStore({ pin: PIN, maxHeld: 600 });
+    for (const x of all) st.ingest(x);
+    assert.ok(st.size() <= 600);
+    const r = revoke('anchor', admins);
+    assert.strictEqual(st.ingest(r).result, 'held', 'a revoke is never refused for capacity');
+    for (const g of admins) assert.strictEqual(st.statusOf(id(g)), 'removed');
+    const unbounded = store([...all, r]);
+    assert.deepStrictEqual([...st.resolve().inForce].sort(), [...unbounded.resolve().inForce].sort());
+  });
+
+  it('a deep grant that comes last in a full store is refused, as over capacity; an anchor-level grant or a revoke never is', () => {
+    const gA = grant('anchor', party(), 'admin');
+    const sub = grant(gA, party(), 'admin');
+    const st = new AuthorityStore({ pin: PIN, maxHeld: 100 });
+    st.ingest(gA); st.ingest(sub);
+    for (let i = 0; i < 98; i++) st.ingest(grant(gA, party(), 'participant'));
+    assert.strictEqual(st.size(), 100);
+    const deep = grant(sub, party(), 'participant'); // depth 3: the last in authority order
+    assert.strictEqual(st.ingest(deep).result, 'over-capacity');
+    assert.strictEqual(st.has(id(deep)), false);
+    while (st.size() < 100) st.ingest(grant(gA, party(), 'participant'));
+    assert.strictEqual(st.ingest(grant('anchor', party(), 'validator')).result, 'held');
+    while (st.size() < 100) st.ingest(grant(gA, party(), 'participant'));
+    const r = revoke(sub, [sub]); // a revoke at depth 3: also last in order, never refused
+    assert.strictEqual(st.ingest(r).result, 'held');
+  });
+
+  it('what is not live goes first, then the last in authority order; one sort frees a batch', () => {
+    const gA = grant('anchor', party(), 'admin');
+    const gB = grant('anchor', party(), 'admin');
+    const dead = [];
+    const rB = revoke('anchor', [gB]);
+    const live = [gA, rB];
+    for (let i = 0; i < 40; i++) live.push(grant(gA, party(), 'participant'));
+    for (let i = 0; i < 40; i++) dead.push(grant(gB, party(), 'participant')); // under a removed grant
+    const st = new AuthorityStore({ pin: PIN, maxHeld: 70 });
+    for (const x of [gA, gB, rB, ...dead, ...live.slice(2)]) st.ingest(x);
+    assert.ok(st.size() <= 70);
+    for (const x of live) assert.strictEqual(st.has(id(x)), true, 'every live statement kept');
+    const evicted = st.capacityReport().evicted;
+    assert.ok(evicted >= 11, `the dead ones went (${evicted})`);
+    // The batch: room was freed below the bound, so the next arrival needs no sort.
+    const before = st.capacityReport().evicted;
+    st.ingest(grant(gA, party(), 'participant'));
+    assert.strictEqual(st.capacityReport().evicted, before);
+  });
+});
diff --git a/tests/authority-node.test.js b/tests/authority-node.test.js
index e0748779..2796c20d 100644
--- a/tests/authority-node.test.js
+++ b/tests/authority-node.test.js
@@ -247,9 +247,23 @@ describe('§6.6.8: the frames, their bounds and pacing', () => {
     } finally { await stopAll(); }
   });
 
+  it('a statement refused for capacity says nothing against its sender: no relay failure, no mute', async () => {
+    try {
+      const { N, s } = rig({ gossipBudget: { newLane: 1e6, burst: 1e6 } });
+      N._authority._maxHeld = 20;
+      const gA = grant('anchor', party(), 'admin');
+      const sub = grant(gA, party(), 'admin');
+      N.submitAuthority(gA); N.submitAuthority(sub);
+      for (let i = 0; i < 18; i++) N.submitAuthority(grant(gA, party(), 'participant'));
+      for (let i = 0; i < 30; i++) deliver(N, s, { type: 'authority-statement', statement: grant(sub, party(), 'participant') });
+      assert.ok(N.authorityStatus().stats.overCapacity >= 1, 'some were refused for capacity');
+      assert.strictEqual(N._relayMuted(s.nodeId, 'authority-statements'), false);
+    } finally { await stopAll(); }
+  });
+
   it('a differing digest starts a pull; an equal one does not; a malformed one is ignored', async () => {
     try {
-      const { N, s, sent } = rig();
+      const { N, s, sent } = rig({ gossipBudget: { newLane: 1e6, burst: 1e6 } });
       N.submitAuthority(grant('anchor', party(), 'participant'));
       deliver(N, s, { type: 'authority-digest', root: N.authorityRoot(), count: 1 });
       deliver(N, s, { type: 'authority-digest', root: 'nothex', count: 1 });
@@ -278,8 +292,11 @@ describe('§6.6.8: the frames, their bounds and pacing', () => {
       deliver(N, s, { type: 'authority-statement', statement: grant('anchor', party(), 'admin') });
       deliver(N, s, { type: 'authority-fetch', reqId: 'q', after: '' });
       deliver(N, s, { type: 'authority-digest', root: 'a'.repeat(64), count: 1 });
+      for (let i = 0; i < 20; i++) deliver(N, s, { type: 'authority-statement', statement: grant('anchor', party(), 'admin') });
       assert.strictEqual(N._authority.size(), 0);
       assert.deepStrictEqual(s.sent.filter((f) => /^authority-/.test(f.type)), []);
+      assert.strictEqual(N._relayMuted(s.nodeId, 'authority-statements'), false, 'what it cannot judge counts nothing against the session');
+      assert.strictEqual(N.authorityStatus().stats.invalid, 0);
     } finally { await stopAll(); }
   });
 });
@@ -324,7 +341,7 @@ describe('§6.6.9 and §6.6.10 on a node', () => {
 });
 
 describe('§6.6.7: persistence carries no authority of its own', () => {
-  it('at load every statement is verified again against the pin, in any file order; forgeries and junk are dropped, and no status is stored', async () => {
+  it('one file, whatever the pin: every statement judged again at load, in any order; what does not count is kept as bytes, never deleted', async () => {
     const name = uniq('auth-persist');
     let nodeId = null;
     try {
@@ -335,7 +352,7 @@ describe('§6.6.7: persistence carries no authority of its own', () => {
       for (const s of all) N.submitAuthority(s);
       assert.strictEqual(N.authorityRoot(), want.root());
       await N.stop();
-      const file = path.join(nodeDirById(nodeId), 'authority', `statements-${A.pinDigest(A.parsePin(PIN))}.jsonl`);
+      const file = path.join(nodeDirById(nodeId), 'authority', 'statements.jsonl');
       const lines = fs.readFileSync(file, 'utf8').split('\n').filter(Boolean);
       for (const l of lines) {
         const o = JSON.parse(l);
@@ -346,17 +363,146 @@ describe('§6.6.7: persistence carries no authority of its own', () => {
       fs.writeFileSync(file, [...shuffled(lines), JSON.stringify(planted), '{not json'].join('\n') + '\n');
       const N2 = new SymNode({ name, nodeId, create: false, silent: true, discovery: new NullDiscovery(), room: 'auth', anchor: PIN });
       assert.strictEqual(N2.authorityRoot(), want.root());
-      assert.strictEqual(N2._authority.has(sid(planted)), false);
-      assert.strictEqual(N2._authority.loadReport().invalid, 2);
+      assert.strictEqual(N2._authority.has(sid(planted)), false, 'a forgery counts for nothing');
+      const report = N2._authority.loadReport();
+      assert.strictEqual(report.corrupt, 1, 'a line that is not a statement is dropped');
+      assert.strictEqual(report.unverified, 1, 'a statement that does not count under this pin is kept, as the bytes it was');
       await N2.stop();
-      // Under another pin nothing is held, and the statements verified under this pin are left as they were.
+      assert.ok(fs.readFileSync(file, 'utf8').includes(JSON.stringify(planted)), 'still on disk');
+      // A mistyped pin: nothing is held, and nothing is deleted.
       const other = party();
       const N3 = new SymNode({ name, nodeId, create: false, silent: true, discovery: new NullDiscovery(), room: 'auth', anchor: { threshold: 1, keys: [{ key: other.key }] } });
       assert.strictEqual(N3._authority.size(), 0);
       await N3.stop();
+      assert.strictEqual(fs.readFileSync(file, 'utf8').split('\n').filter(Boolean).length, lines.length + 1, 'every statement is still in the file');
+      // The pin corrected: everything counts again.
       const N4 = new SymNode({ name, nodeId, create: false, silent: true, discovery: new NullDiscovery(), room: 'auth', anchor: PIN });
       assert.strictEqual(N4.authorityRoot(), want.root());
       await N4.stop();
     } finally { if (nodeId) fs.rmSync(nodeDirById(nodeId), { recursive: true, force: true }); }
   });
+
+  it('a re-pin that keeps a threshold of the old keys keeps what they signed (§6.6.1): 2 of 3 re-pinned to 2 of 2', () => {
+    const dir = fs.mkdtempSync(path.join(require('os').tmpdir(), 'auth-repin-'));
+    try {
+      const k1 = party(); const k2 = party(); const k3 = party();
+      const pin3 = A.parsePin({ threshold: 2, keys: [{ key: k1.key }, { key: k2.key }, { key: k3.key }] });
+      const anchorBy = (fields, signers) => { let st = { ...fields, authorisedBy: 'anchor', nonce: A.freshNonce(), sigs: [] }; for (const k of signers) st = A.signStatement(st, PRIV.get(k.key), k.key); return st; };
+      const gA = anchorBy({ kind: 'grant', subject: party(), role: 'admin' }, [k1, k2]);
+      const gV = grant(gA, party(), 'validator');
+      const gP = grant(gV, party(), 'participant');
+      const st = new AuthorityStore({ pin: pin3, dir });
+      for (const x of [gA, gV, gP]) assert.strictEqual(st.ingest(x).result, 'held');
+      const pin2 = A.parsePin({ threshold: 2, keys: [{ key: k1.key }, { key: k2.key }] }); // k3 dropped
+      const re = new AuthorityStore({ pin: pin2, dir });
+      assert.strictEqual(re.resolve().inForce.size, 3, 'the same three statements, in force under the new pin');
+      // And back under a pin they do not satisfy: none counts, none is lost.
+      const lone = A.parsePin({ threshold: 1, keys: [{ key: k3.key }] });
+      assert.strictEqual(new AuthorityStore({ pin: lone, dir }).size(), 0);
+      assert.strictEqual(new AuthorityStore({ pin: pin2, dir }).resolve().inForce.size, 3);
+    } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+  });
+
+  it('a torn append costs nothing: each record starts on a line of its own', () => {
+    const dir = fs.mkdtempSync(path.join(require('os').tmpdir(), 'auth-torn-'));
+    try {
+      const gA = grant('anchor', party(), 'admin');
+      const gV = grant(gA, party(), 'validator');
+      const gP = grant(gV, party(), 'participant');
+      const st = new AuthorityStore({ pin: A.parsePin(PIN), dir });
+      st.ingest(gA);
+      fs.appendFileSync(path.join(dir, 'statements.jsonl'), JSON.stringify(gV).slice(0, 40)); // a write cut short
+      st.ingest(gV); st.ingest(gP);
+      const again = new AuthorityStore({ pin: A.parsePin(PIN), dir });
+      assert.strictEqual(again.size(), 3, 'only the torn bytes are lost');
+      assert.strictEqual(again.loadReport().corrupt, 1);
+    } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+  });
 });
+
+describe('§6.6.8: the asking rule bounds what a session can make this node verify', () => {
+  // M holds no grant. It makes X ask (a digest naming a root X lacks; pending statements whose
+  // links X fetches) and answers every ask with 64 statements under fresh keys: the most costly an
+  // answer can be. X verifies no more than M's lane at X pays for, and the lane never goes negative.
+  const pendingGrant = () => {
+    const signer = party(); const sub = party();
+    return A.signStatement({ kind: 'grant', authorisedBy: `auth-${crypto.randomBytes(32).toString('hex')}`, subject: sub, role: 'participant', nonce: A.freshNonce(), sigs: [] }, PRIV.get(signer.key), signer.key);
+  };
+  async function scene({ pages, open }) {
+    const X = node('ask-x'); const M = node('ask-m', { anchor: null });
+    await X.start(); await M.start();
+    await connectNodes(M, X);
+    const pool = Array.from({ length: pages * 64 }, pendingGrant);
+    let answered = 0;
+    M._onAuthorityFetch = (session, msg) => {
+      if (answered >= pages) return;
+      const page = pool.slice(answered * 64, answered * 64 + 64); answered++;
+      session.send({ type: 'authority-digest', root: crypto.randomBytes(32).toString('hex'), count: 1 });
+      session.send({ type: 'authority-set', reqId: msg.reqId, statements: page });
+    };
+    const verified = () => { const st = X._authorityStats; return st.pending + st.invalid + st.held; };
+    let lowest = Infinity;
+    const watch = setInterval(() => { const b = X._gossipBuckets.get(M.nodeId); if (b && b.tokens < lowest) lowest = b.tokens; }, 5);
+    const t0 = Date.now();
+    open(M._peers.get(X.nodeId).transport);
+    await new Promise((r) => setTimeout(r, 3000));
+    clearInterval(watch);
+    const secs = (Date.now() - t0) / 1000;
+    return { X, M, secs, verified: verified(), lowest, answered };
+  }
+  it('a digest-driven pull loop: X pulls only when M\'s lane can pay a page', async () => {
+    try {
+      const r = await scene({ pages: 60, open: (toX) => toX.send({ type: 'authority-digest', root: crypto.randomBytes(32).toString('hex'), count: 1 }) });
+      const allows = (100 + 2000 * r.secs) / 33 + 64;
+      assert.ok(r.verified <= allows, `verified ${r.verified}, the lane pays for ${allows.toFixed(0)}`);
+      assert.ok(r.answered >= 1, 'X did pull');
+      assert.ok(r.lowest >= 0, `the lane never went negative (lowest ${r.lowest})`);
+    } finally { await stopAll(); }
+  });
+  it('a fetch cascade: pending statements ask for their links under the same rule, and a full pending hold refuses before verifying', async () => {
+    try {
+      const r = await scene({ pages: 64, open: (toX) => { for (let i = 0; i < 64; i++) toX.send({ type: 'authority-statement', statement: pendingGrant() }); } });
+      const allows = (100 + 2000 * r.secs) / 33 + 64;
+      assert.ok(r.verified <= allows, `verified ${r.verified}, the lane pays for ${allows.toFixed(0)}`);
+      assert.ok(r.lowest >= 0, `the lane never went negative (lowest ${r.lowest})`);
+      assert.ok(r.X._authorityStats.pendingFull > 0, 'past 64 pending, refused before any signature check');
+    } finally { await stopAll(); }
+  });
+  it('a pull that ends with the roots apart is started again, after a backoff that doubles', async () => {
+    try {
+      const X = node('repull-x', { gossipBudget: { newLane: 1e6, burst: 1e6 } }); const M = node('repull-m', { anchor: null });
+      await X.start(); await M.start();
+      await connectNodes(M, X);
+      const at = [];
+      M._onAuthorityFetch = (session, msg) => { at.push(Date.now()); session.send({ type: 'authority-set', reqId: msg.reqId, statements: [] }); };
+      M._peers.get(X.nodeId).transport.send({ type: 'authority-digest', root: 'b'.repeat(64), count: 1 });
+      await until(() => at.length >= 3, 9000);
+      assert.ok(at.length >= 3, 'pulled again while the roots stay apart');
+      assert.ok(at[2] - at[1] > (at[1] - at[0]) * 1.5, 'each wait longer than the last');
+      // The peer reports X's root: no more pulls.
+      M._peers.get(X.nodeId).transport.send({ type: 'authority-digest', root: X.authorityRoot(), count: 0 });
+      const n = at.length;
+      await new Promise((r) => setTimeout(r, 3000));
+      assert.strictEqual(at.length, n);
+    } finally { await stopAll(); }
+  });
+});
+
+describe('§6.6.8: a fetch answer is the closure', () => {
+  it('an endorse that keeps a rescued revoke in force goes with it, so the asker reaches the same root', () => {
+    const pin = A.parsePin(PIN);
+    const Ak = party(); const Pk = party(); const Gk = party(); const Kk = party();
+    const gA = grant('anchor', Ak, 'admin'); const gP = grant(gA, Pk, 'admin'); const gG = grant(gP, Gk, 'admin'); const gK = grant(gG, Kk, 'participant');
+    const R = revoke(gP, [gG]); const rP = revoke('anchor', [gP]); const E = endorse(gA, [R]); const E2 = endorse(gA, [gK]);
+    const Y = new AuthorityStore({ pin });
+    for (let i = 0; i < 3; i++) for (const x of [gA, gP, gG, gK, R, rP, E, E2]) Y.ingest(x);
+    const ans = Y.answerIds([sid(gK)]);
+    assert.ok(ans.statements.some((x) => sid(x) === sid(E)), 'the endorse of the revoke is in the answer');
+    const X = new AuthorityStore({ pin });
+    for (const x of ans.statements) X.ingest(x);
+    assert.strictEqual(X.statusOf(sid(R)), Y.statusOf(sid(R)));
+    assert.strictEqual(X.root(), Y.root());
+  });
+});
+
+
diff --git a/tests/core-secure-rereview.test.js b/tests/core-secure-rereview.test.js
index d97482af..8960c8ac 100644
--- a/tests/core-secure-rereview.test.js
+++ b/tests/core-secure-rereview.test.js
@@ -94,7 +94,7 @@ describe('N1: the forgery penalty is charged only to a session that signed in it
       assert.strictEqual(sG2.closed, false, 'rate-limited, not closed');
       assert.ok(!metrics.some((m) => m.type === 'forged-signature'));
       for (let i = 0; i < 20; i++) b._ingestAuthority({ ...bad, nonce: Auth.freshNonce() }, sG2);
-      assert.strictEqual(b._relayMuted(G2.nodeId, `authority:${G2.publicKey}`), true, 'past a few failures that signer is dropped unread from this session');
+      assert.strictEqual(b._relayMuted(G2.nodeId, 'authority-statements'), true, 'past a few failures that peer\'s authority statements are dropped unread (the mute is the session\'s, never a key the sender chose)');
       // Signed with K1, the key the chain names: valid, whichever session delivers it.
       const good = Auth.signStatement({ kind: 'grant', authorisedBy: Auth.statementId(gG), subject: { nodeId: W.nodeId, key: W.publicKey }, role: 'validator', nonce: Auth.freshNonce(), sigs: [] }, G1.privateKey, G1.publicKey);
       assert.strictEqual(b._ingestAuthority(good, admitAs(b, identity('anyone'))).result, 'held');
diff --git a/tests/core-secure-review.test.js b/tests/core-secure-review.test.js
index df9f6639..def42038 100644
--- a/tests/core-secure-review.test.js
+++ b/tests/core-secure-review.test.js
@@ -187,12 +187,13 @@ describe('D. no shared budget before verification; bounds (cs-review-B, cs-revie
       const M1 = identity('signer-1');
       for (let i = 0; i < 64; i++) deliver(b, s, { type: 'authority-statement', statement: { ...stmt(M1), pad: big } });
       assert.ok(!s._authPending || s._authPending.size === 0, 'a member the schema does not define: never held');
-      assert.strictEqual(b._relayMuted(s.nodeId, `authority:${M1.publicKey}`), true, 'and past a few, that signer\'s statements from this peer are dropped unread');
+      assert.strictEqual(b._relayMuted(s.nodeId, 'authority-statements'), true, 'and past a few, that peer\'s authority statements are dropped unread');
+      const s2 = admitAs(b, identity('m2'));
       const M2 = identity('signer-2');
-      for (let i = 0; i < 100; i++) deliver(b, s, { type: 'authority-statement', statement: stmt(M2) });
-      assert.strictEqual(s._authPending.size, 64);
+      for (let i = 0; i < 100; i++) deliver(b, s2, { type: 'authority-statement', statement: stmt(M2) });
+      assert.strictEqual(s2._authPending.size, 64, 'at most 64 pending per session; past that, refused before verifying');
       let bytes = 0;
-      for (const e of s._authPending.values()) bytes += JSON.stringify(e.statement).length;
+      for (const e of s2._authPending.values()) bytes += JSON.stringify(e.statement).length;
       assert.ok(bytes <= 64 * 4096, `held ${bytes} bytes`);
     } finally { await stopAll(b); }
   });
diff --git a/tests/gossip-lanes.test.js b/tests/gossip-lanes.test.js
index 2683b336..14d0d665 100644
--- a/tests/gossip-lanes.test.js
+++ b/tests/gossip-lanes.test.js
@@ -36,6 +36,8 @@ const { NullDiscovery } = require('../lib/discovery');
 const { nodeDir } = require('../lib/config');
 const { RelayConnection } = require('../lib/relay');
 const Auth = require('../lib/core/authority');
+// A pin whose key signs nothing here: authority statements are judged (an unpinned node ignores them).
+const SOME_PIN = (() => { const k = crypto.generateKeyPairSync('ed25519').publicKey.export({ format: 'der', type: 'spki' }).subarray(12).toString('base64url'); return { threshold: 1, keys: [{ key: k }] }; })();
 const { signAttestation, signCheckpoint, signWitness } = require('../lib/core');
 const { admitAs } = require('./_core-secure');
 
@@ -93,7 +95,7 @@ describe('authority statements are gossip under the budget (F1, MMP §6.6.8)', (
       for (let i = 0; i < 1000; i++) reasons.add(node._ingestAuthority({ ...g }, q).result);
       assert.deepStrictEqual([...reasons].sort(), ['duplicate', 'invalid'], 'a spelling is not of the shape; the id is a repeat');
       assert.strictEqual(node._authority.size(), 1, 'one statement held');
-      const file = path.join(node._dir, 'authority', `statements-${Auth.pinDigest(node._pin)}.jsonl`);
+      const file = path.join(node._dir, 'authority', 'statements.jsonl');
       assert.strictEqual(fs.readFileSync(file, 'utf8').trim().split('\n').length, 1, 'one line written');
       node._authoritySettle();
       assert.strictEqual(sent.filter((f) => f.type === 'authority-statement').length, 1, 'and nothing relayed again');
@@ -127,7 +129,7 @@ describe('the budget is kept per PROVEN peer (F2; Core Secure design D1)', () =>
   });
 
   it('a peer\'s frames over any of its sessions spend one budget; checkpoints, witnesses and authority statements too', () => {
-    withNode({}, ({ node }) => {
+    withNode({ anchor: SOME_PIN }, ({ node }) => {
       const A = kp('att-A');
       node._roster.bind(A.id, A.pub, 'proven');
       const lan = admitAs(node, { nodeId: 'peer-two-paths' });
@@ -264,7 +266,7 @@ describe('drop reporting cannot break gossip or shutdown (F4)', () => {
 
 describe('an over-long signature (F5)', () => {
   it('is malformed, refused before anything decodes or looks it up; a re-spelling is refused before the lookup too', () => {
-    withNode({}, ({ node }) => {
+    withNode({ anchor: SOME_PIN }, ({ node }) => {
       const A = kp('att-A');
       const W = kp('wit-W');
       node._roster.bind(A.id, A.pub, 'proven');

From 9d09aa121109d3e2e1fa809256c298989eaf5cd0 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 8 Oct 2026 09:13:51 +0100
Subject: [PATCH 118/148] docs: what ships, said as the code does it; an
 operator guide for the pin, re-pins and the flag day
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Release review of f86c2cc, docs honesty.

- SECURITY.md and docs/WIRE-0.14.0.md §3: the asking rule replaces the debt claims (every
  statement a session delivers spends its lane, this node asks only when the lane can pay a full
  answer); capacity drops the last in authority order and never refuses an anchor-level statement or
  a revoke; one statement file, so a re-pin keeps what still counts and a typo destroys nothing; the
  mute is keyed on the session's peer; an unpinned node judges nothing and counts nothing.
- CHANGELOG 0.14.0 rewritten to describe what ships: the time-replay grant rule (cutoffs,
  ratification, subtree budgets, role-chain-fetch, role-digest, ECUTOFF, roleStatementsBy) never
  shipped and is no longer listed as if it had; the review sections keep what they changed that
  ships.
- docs/AUTHORITY-OPERATOR.md: configuring a pin (1-of-1 and threshold), granting and co-signing,
  re-pinning (what still counts, a mistyped pin, root compromise), and the 0.13 flag day re-issue
  with legacyRoleGrants().

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QRVMpaJkAA2fFbvuHCEzqH
---
 CHANGELOG.md               | 269 ++++++++++++++++---------------------
 README.md                  |   2 +-
 SECURITY.md                |  56 +++++---
 docs/AUTHORITY-OPERATOR.md |  97 +++++++++++++
 docs/WIRE-0.14.0.md        |  51 ++++---
 5 files changed, 284 insertions(+), 191 deletions(-)
 create mode 100644 docs/AUTHORITY-OPERATOR.md

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6349ba67..b798e3df 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,72 +13,97 @@ key bindings (a lockout anyone on the LAN could fill) by the binding lifetime be
 in-memory pending set for grants that arrive before their root (which could be flooded), now by
 §6.6's bounded pending statements (below).
 
-### Authority: MMP §6.6 as merged (supersedes every grant rule further down)
-
-The founder merged the spec's new §6.6 (sym-bot/meshcognition-website main at 8c3381d, PR #40):
-authority is a function of a set of hash-linked signed statements, with no time in it. sym 0.14.0
-implements it as written and drops the time-replay rule the sections below built up during this
-release: cutoffs, ratification, budgets per delegation subtree, `role-chain-fetch`, `role-chain`
-and `role-digest`. Where a section below describes grants or revokes, this section is what holds.
-
-- **Statements (§6.6.3).** `grant`, `revoke` and `endorse`, each identified by `auth-` + SHA-256
-  of its canonical bytes (`mmp-authority-v1`), naming its authority in `authorisedBy` and its
-  targets by id, with a 16-byte nonce; `issuedAt` is signed and never read. Validity is static:
-  well formed (a subject key of prime order included), rooted within 4 links, signed, permitted.
+### Authority: MMP §6.6
+
+Authority is MMP §6.6 as merged (sym-bot/meshcognition-website main at 8c3381d, PR #40; published
+unchanged as MMP 2.0 at 218df24): a function of a set of hash-linked signed statements, with no time
+in it. sym implements it as written. The time-replay grant rule that 0.14.0's development builds
+carried (cutoffs, ratification, budgets per delegation subtree, `role-chain-fetch`, `role-chain`,
+`role-digest`) never shipped.
+
+- **Statements (§6.6.3).** `grant`, `revoke` and `endorse`, each identified by `auth-` + SHA-256 of
+  its canonical bytes (`mmp-authority-v1`), naming its authority in `authorisedBy` and its targets by
+  id, with a 16-byte nonce; `issuedAt` is signed and never read. Validity is static: well formed (a
+  subject key of prime order included), rooted within 4 links, signed, permitted.
   (lib/core/authority.js)
 - **The anchor (§6.6.1)** is a pinned key set with a threshold:
-  `anchor: { threshold, keys: [{ key, nodeId? }] }`; the old `{ nodeId, publicKey }`, a
-  `"nodeId:publicKey"` string and `SYM_FOUNDER_ANCHOR` are the 1-of-1 set. An anchor-level statement
-  needs t distinct pinned keys that verify, each copy judged on its own entries. A pin that does not
-  parse stops the node; with none pinned nothing is in force and the configured `lifecycleRole`
-  stands (a closed development mode).
+  `anchor: { threshold, keys: [{ key, nodeId? }] }`; `{ nodeId, publicKey }`, a `"nodeId:publicKey"`
+  string and `SYM_FOUNDER_ANCHOR` are the 1-of-1 set. An anchor-level statement needs t distinct
+  pinned keys that verify, each copy judged on its own entries. A pin that does not parse stops the
+  node; with none pinned nothing is in force, authority frames are ignored, and the configured
+  `lifecycleRole` stands (a closed development mode). See docs/AUTHORITY-OPERATOR.md.
 - **Roles (§6.6.2).** admin, validator, issuer and non-authority roles (participant, extension
   roles), with the spec's table for who may grant, revoke and endorse; an optional scope that only
   narrows, by whole segments, compared exactly.
-- **Resolution (§6.6.4 to §6.6.7).** Per depth, revokes and endorses, then grants; a bucket keeps
-  its own first, by ascending id, within 256 statements (the anchor's 4,096) and 16 delegating
-  grants; a statement a revoke cut off is rescued only by an in-force endorse from above, charged to
-  the endorser's bucket and falling through by id; a quota cut is never rescued. The live set and
-  the authority root. (lib/authority-store.js)
+- **Resolution (§6.6.4 to §6.6.7).** Per depth, revokes and endorses, then grants; a bucket keeps its
+  own first, by ascending id, within 256 statements (the anchor's 4,096) and 16 delegating grants; a
+  statement a revoke cut off is rescued only by an in-force endorse from above, charged to the
+  endorser's bucket and falling through by id; a quota cut is never rescued. The live set and the
+  authority root. (lib/authority-store.js)
+- **Capacity.** At most 200,000 statements held. Past that the store drops what is not live first,
+  then what comes last in authority order (deepest first, grants before revokes and endorses,
+  highest id first), freeing a batch at a time so its sort is paid once per batch. An arriving
+  anchor-level statement or revoke is never the one refused, so the removal that would clean up a
+  flooded store is always taken. A statement refused for capacity (`over-capacity`) says nothing
+  against its sender.
+- **Persistence.** One file, `authority/statements.jsonl`, whatever the pin. At load every statement
+  is judged again against the pin in force; what does not count under it (a mistyped pin, a re-pin,
+  a chain not yet held) stays in the file as the bytes it was, never deleted, so a corrected pin, or
+  a re-pin that keeps a threshold of the old keys, finds what still counts (§6.6.1). Each record is
+  appended on a line of its own and a failed write is cut back, so a torn write costs only itself.
 - **Frames (§6.6.8).** `authority-statement`, `authority-digest` (on confirm, and after a change at
-  most once a second per session), `authority-fetch` (by ids, or a page after a cursor) and
-  `authority-set` (at most 64, in authority order); pending statements per session (at most 64, 10
-  s, one fetch in flight per missing id). Answers are paced at 4 a second per session (burst 16) by
-  waiting, not refusing; a pull is paced by the work it causes and never cut short; a key not seen
-  before costs the gossip lane 16 checks (§6.6.12). `role-grant`, `role-revoke`, `role-chain-fetch`,
-  `role-chain` and `role-digest` are retired: ignored, counted, never sent (§6.6.11). `cmb-anchors`
-  is now sent on every admitted session (`keys: []` when nothing is replayed), so a relay client
-  still hears a sealed frame before its new session supersedes the old. (lib/node-authority.js;
-  docs/WIRE-0.14.0.md §1, §3)
+  most once a second per session), `authority-fetch` (by ids, or a page after a cursor; an answer by
+  ids is the closure: the in-force revokes and endorses naming what it carries, and theirs, within
+  64) and `authority-set` (at most 64, in authority order). A responder answers 4 fetches a second
+  per session (burst 16) by making the rest wait (at most 64), not by refusing.
+- **The asking rule (§6.6.8, §6.6.12).** Every statement a session delivers spends that peer's
+  gossip lane, asked for or not: one check, one per pinned-key entry of an anchor-level statement,
+  and 16 for each key this node has not checked before. A statement not of the shape, a repeat, and
+  one the session's pending holds (64) have no room for are dropped before any of that. This node
+  asks a session for anything (a pull page, a fetch by ids) only when that peer's lane can pay the
+  most an answer can cost (64 × 33 = 2,112 checks), reserves it until the answer comes, and keeps
+  one ask in flight per session: an answer is never dropped for budget and never spends more than
+  the lane holds. An answer is verified in slices, so the event loop is never held for a page. A
+  pull that ends with the roots apart is repeated, at once if a digest came during it, otherwise
+  after a backoff from 2 s doubling to 5 minutes. A session whose statements keep failing (8 in a
+  minute) has its authority statements dropped unread for the rest of the minute, a mute keyed on
+  the session's peer. The key cache keeps the pinned keys for good and the rest least recently
+  used first.
+- **Retired frames.** `role-grant`, `role-revoke`, `role-chain-fetch`, `role-chain` and
+  `role-digest` are ignored, counted and never sent (§6.6.11). `cmb-anchors` is sent on every
+  admitted session (`keys: []` when nothing is replayed), so a relay client still hears a sealed
+  frame before its new session supersedes the old. (lib/node-authority.js; docs/WIRE-0.14.0.md)
 - **Using authority (§6.6.9, §6.6.10).** Roles follow the key: a grant names a nodeId and a key and
-  confers its role on that pair. An in-force grant is a key-registry view for an unbound nodeId; a
-  grant naming this node with a foreign key confers nothing and is reported
+  confers its role on that pair. An in-force grant binds an unbound nodeId in the key registry, as a
+  view; a grant naming this node with a foreign key confers nothing and is reported
   (`authority-foreign-self-key`). A received record's origin weight, `validateCMB` and `canonizeCMB`
   (judged on that CMB's own fields; a scoped grant only inside its scope, through the host's
-  `authorityScopes`) and attestation weights are judged against the in-force set when applied.
+  `authorityScopes`) and attestation weights are judged against the in-force set when applied. A
+  node resolves when it settles, at most once per twice the time its last resolution took.
 - **One Ed25519 rule (§18.3.2)** for every signature sym checks: records, handshake proofs,
   attestations, checkpoints, witnesses, room-join grants, tether attestations, relocation bundles
-  and authority statements (lib/core/ed25519.js).
-- **Migration (§6.6.11).** A flag day: role grants signed by 0.13 or earlier 0.14 builds confer
-  nothing, and every node resolves as a participant until the anchor and each grantor re-issue what
-  should stand. `node.legacyRoleGrants()` lists the old store as plain data for that. 0.13 `grant`
-  roster entries stay legacy claims.
+  and authority statements (lib/core/ed25519.js). Handshake keys are taken only in canonical
+  base64url.
+- **Migration (§6.6.11).** A flag day: role grants signed by 0.13 confer nothing, and every node
+  resolves as a participant until the anchor and each grantor re-issue what should stand.
+  `node.legacyRoleGrants()` lists the old store as plain data for that (docs/AUTHORITY-OPERATOR.md).
+  0.13 `grant` roster entries stay legacy claims.
 - **API.** `node.grant(subject, role, { scope })`, `revoke(ids)`, `endorse(ids)`,
   `authorityStatement(fields, opts)`, `cosignAuthority(statement)`, `submitAuthority(statement)`,
   `authorityRoles(nodeId, key?)`, `authorityRoot()`, `authorityStatus()`,
-  `lifecycleAuthority(nodeId, key, cmb)`, `resolveRole(nodeId, { key, cmb })` (no time argument);
-  `grantRole(nodeId, role, opts)` and `revokeRole(nodeId)` keep their names, with no cutoff.
-  `roleStatementsBy`, `ECUTOFF` and `ratify` are gone; `status().coreSecure.authority` replaces
-  `roleChain`; the `authority-changed` event says when the root moves.
-- **Gone with the time rule.** An attestation dated before the record it attests is no longer
-  refused: no authority is judged at a time, so an attestation's time is no part of its weight.
+  `lifecycleAuthority(nodeId, key, cmb)`, `resolveRole(nodeId, { key, cmb })`,
+  `grantRole(nodeId, role, opts)`, `revokeRole(nodeId)`, `legacyRoleGrants()`;
+  `status().coreSecure.authority`; the `authority-changed` event; the `authorityScopes` option.
+- **An attestation's own time is no part of its weight**: no authority is judged at a time, so an
+  attestation dated before the record it attests is not refused for that.
 - **Tests.** The published vectors are vendored in tests/fixtures with their sha256 recorded
   (SOURCES.json, checked before use): every authority case resolved as listed, reversed, shuffled
   and with forged copies, and every Ed25519 case (authority-vectors). The review attacks at full
-  scale and the old faces (arrival order, backdating, floods, cycles) in authority-attacks; two
-  nodes reaching one root over TCP, the frames and their bounds, persistence in authority-node;
-  the one rule at every verification site in ed25519-strict; roles and weights in
-  earned-authority-node.
+  scale, the old faces (arrival order, backdating, floods, cycles) and capacity in
+  authority-attacks; two nodes reaching one root over TCP, the frames, the asking rule against a
+  peer that answers every ask with fresh keys, re-pulls, persistence and re-pins in authority-node;
+  the one rule at every verification site in ed25519-strict; threshold co-signing and migration in
+  authority-migration; roles and weights in earned-authority-node.
 
 ### `message` and `mood-delivered` carry their provenance
 
@@ -130,32 +155,10 @@ and `role-digest`. Where a section below describes grants or revokes, this secti
 
 ### The final re-review of f0d936a (BLOCK) — what changed
 
-(Rulings A and B below, and the grant rules they describe, are superseded by MMP §6.6: see
-"Authority: MMP §6.6 as merged" above.)
-
-The founder ruled three design changes; each is made where its assumption was, and the rule is in
-`docs/WIRE-0.14.0.md` §6 and §7 and the design doc (branch `design/0.14.0-core-secure-identity`).
-
-- **The kept grant set is a function of the records held (ruling A; Findings 1 and 2).** The store
-  decided at ingest whether a record was rooted and capped records per grantor, per pair and in
-  all, so two honest nodes holding the same records kept different subsets by arrival order, their
-  digests never matched, and every session between them ran a whole-store sync; and a revoker could
-  not tighten its cutoff (`nothing-to-revoke`). Now every verifiable record is kept (its signature
-  verifies under the anchor's key or a key a kept grant vouches) and its effect is decided at
-  resolution; `unrooted` and `nothing-to-revoke` are gone. Records are bounded by a budget per
-  delegation subtree (everything an anchor grantee and its descendants sign: 4,096 records; the
-  anchor's own unbounded), which replaces the per-grantor, per-pair and store caps: a compromised
-  subtree fills only its own budget, and a revoke from another subtree is never refused. Inside a
-  full budget the records kept are chosen by one order on signed fields, and a record that ranks
-  higher replaces the last one kept (`outranked`).
-- **The anchor ratifies; a revoked key gains nothing by backdating (ruling B; Finding 4).** With a
-  cutoff alone, a key revoked on day 20 could sign a revoke dated day 2 and it counted for everyone.
-  Now `revokeRole(id, { cutoff, ratify })` requires the cutoff (no default; `ECUTOFF`), and a revoke
-  may list (`ratify`, signed, at most 64) the revoked node's earlier statements that stay valid. Any
-  other statement it signed before the cutoff counts only while it still holds the rank it needs.
-  A revoker is checked at every breakpoint from its cutoff to its signed time (Low 8a). An
-  attestation dated before the record it attests is refused, and counts with its signer's role when
-  signed by the same rule. `node.roleStatementsBy(id, before)` lists what a revoker may ratify.
+The founder ruled three design changes. Rulings A and B (what grants are kept, and what a revoked
+key may still sign) are met by MMP §6.6 itself (above): authority is a function of the statements
+held, and no statement carries a time that could place it inside a period of trust.
+
 - **The interior read side is scoped to the mind's mission (ruling C; Finding 6).** A mind for
   mission B read mission A's deliveries and notes through `deliveries` and `recall`, and its drain
   moved the host's inbox cursor. Each mind now has its own view (deliveries that arrived while it
@@ -187,12 +190,11 @@ The founder ruled three design changes; each is made where its assumption was, a
 
 ### The re-review at 72daeb6 — what changed
 
-(N2, N4 and N5 below, on grants and revokes, are superseded by MMP §6.6: see "Authority: MMP §6.6
-as merged" above.)
-
 Five findings and the open leads, each fixed where its assumption was made (the design is
-`docs/DESIGN-core-secure-identity.md` on branch `design/0.14.0-core-secure-identity`; the wire text
-for the spec PRs is `docs/WIRE-0.14.0.md` §6 and §7):
+`docs/DESIGN-core-secure-identity.md` on branch `design/0.14.0-core-secure-identity`). N2, N4 and N5
+(revoke cutoffs, caps that refused revokes, the 0.13 grant store) went with the time-replay rule;
+MMP §6.6 (above) has no cutoff, a bucket keeps its revokes and endorses before its grants, a full
+store never refuses a revoke, and the 0.13 store is read only as plain data, never rewritten.
 
 - **A failed signature is charged only to a session that signed in its own name (N1).** Bindings are
   local views: a relayed statement is verified under this node's binding for its signer, which may
@@ -202,32 +204,11 @@ for the spec PRs is `docs/WIRE-0.14.0.md` §6 and §7):
   closed (`forged-signature`) only when the statement names its own proven peer as signer and the
   key that failed is the key it proved; any other failure is dropped and counted
   (`relayed-signature-unverified`), never charged to the relayer.
-- **A revoke carries a cutoff; receipt time is no part of authority (N2; replaces draft spec PR
-  #33's both-times rule; refined by the final re-review above: the cutoff has no default, and what
-  a revoked node signed before it stands only if ratified).** The both-times rule voided a genuine revoke for every node that received
-  it after its revoker was itself revoked (a newcomer, an anti-entropy sync, a store upgraded from
-  0.13), so authority depended on arrival order. Now a `role-revoke` signs a `cutoff` (by default its
-  own time; `revokeRole(id, { cutoff })` sets an earlier one, never before the revoker held rank):
-  what the revoked node signed before the cutoff stands for every receiver whenever it arrives, and
-  what it signed at or after it never counts, even before the revoke itself was signed. A revoke
-  without a cutoff signs the bytes it always signed. Grants keep §6.6's cascade. Attestations count
-  at their signer's role at their signed time. Nothing stores a receipt time any more.
 - **Directed exchange earns a durable binding (N3).** A peer that only exchanged directed records
   never earned one, so once it left, a squatter claiming its nodeId was bound and received this
   node's further directed records to it, while the genuine peer, refused with 1009, did not retry.
   A verified record its author signed to this node, accepted for delivery (surfaced, stored or not),
   now earns the binding, as an admitted record does.
-- **No cap refuses a revoke (N4; the mechanism below is replaced by the final re-review's budget
-  per delegation subtree).** The per-grantor, per-pair and store caps refused revokes too,
-  so past them a grant could no longer be revoked except by the anchor, and a validator filling the
-  store with sybil grants stopped every honest revoke. The caps now bound grants only; a revoker
-  keeps at most as many revokes for a grantee as this node holds grants for it (`nothing-to-revoke`
-  past that, held for a `role-chain-fetch` naming the grantee when it arrives first), the
-  whole-store sync sends grants before revokes, and held records are re-offered in passes.
-- **A 0.13 grant store is never rewritten (N5).** The one-time rewrite into the 0.14 form dropped
-  the records skipped at load (those whose root was not yet held), for good. With receipt time gone
-  the file needs no rewrite: lines are the bare record, as 0.13 wrote them, appended only, and a
-  skipped line loads at the next start once its root is held.
 - **Record size limits fit one sealed frame (draft spec PR #37).** A sealed frame carries its
   plaintext as base64url, so about 768 KiB is the most one 1 MiB frame can carry, and the previous
   960 KiB text bound could not be met. Now a category's text is at most 256 KiB after NFC, the seven
@@ -244,9 +225,6 @@ for the spec PRs is `docs/WIRE-0.14.0.md` §6 and §7):
 
 ### The independent security review (BLOCK at 341dafb) — what changed
 
-(What this section says about role grants, revokes, `role-chain-fetch` and `role-digest` is
-superseded by MMP §6.6: see "Authority: MMP §6.6 as merged" above.)
-
 Seven design assumptions, each changed where it was made, not patched where it showed:
 
 - **The signed audience governs every send (A).** The one seal point refuses a record whose signed
@@ -263,23 +241,21 @@ Seven design assumptions, each changed where it was made, not patched where it s
   them) is refused before anything encodes it; this reverses the earlier acceptance of larger
   categories (C-F4). nodeIds are taken only in
   canonical lowercase at every door: the hello, a relay `from` or announcement, a grant, an invite.
-- **A revoked validator cannot backdate authority (C).** The review's rule (a statement counts only
-  if its signer was authorised when it signed and when it was received, draft spec PR #33) is
-  replaced by the re-review's revoke cutoff above: no receipt time is kept. A grant binding is a view over the grants in effect now, never stored; no grant binds this
-  node's own nodeId (one that vouches a foreign key for it is inert, and reported:
-  `role-grant-foreign-self-key`); 0.13 `grant` roster entries migrate as legacy claims. Role
-  resolution is memoised (linear in the records) and a delegation reaches at most 8 grants from the
-  anchor (the grant caps of this round are replaced by the final re-review's budget per subtree).
+- **Authority cannot be backdated (C).** The review's rule (a statement counts only if its signer was
+  authorised when it signed and when it was received, draft spec PR #33) went, with every rule that
+  judged authority at a time: MMP §6.6 (above) is a function of the set. A grant binding is a view
+  over the in-force set, never stored; no grant binds this node's own nodeId (one naming a foreign
+  key for it is inert, and reported: `authority-foreign-self-key`); 0.13 `grant` roster entries
+  migrate as legacy claims.
 - **No shared budget is spent before verification, and a forgery ends its session (D).** Only the
   peer's own lane is spent before a signature check; the shared ceiling is spent after it. A
   signature in a session's own name that does not verify under the key it proved closes it
   (`forged-signature`) and its nodeId is not admitted again for 60 s (a relayed one is only dropped,
-  since the re-review above). Grants and revokes have anti-entropy: a `role-digest` on every
-  admission, and a paged whole-store sync when digests differ. A key binding is never evicted
+  since the re-review above). A key binding is never evicted
   before it expires. **Every confirmed session runs with a session-scoped binding**, and a second
   key for that nodeId while it lives is a 1009 IDENTITY_CONFLICT; the durable registry takes only
   an EARNED binding (an admitted verified record, a verified directed record accepted (since the
-  re-review), a pin, a grant in effect, or the key a legacy claim expects) — a handshake, or a re-handshake, earns nothing, and neither does a record refused for
+  re-review), a pin, an in-force grant, or the key a legacy claim expects) — a handshake, or a re-handshake, earns nothing, and neither does a record refused for
   its room. Resource bounds: relay handshakes per relay `from` (one in flight, a hello rate) and
   for unknown candidates (32 of the 256 slots, the oldest evicted, a wait list served known peers
   first, failed ones backing off up to 10 min); the LAN listener (256 connections before their
@@ -287,8 +263,8 @@ Seven design assumptions, each changed where it was made, not patched where it s
   5 s handshake timeout; a fair relay pacer (per destination, confirmed-session traffic first,
   8 MiB per destination); 1011 replies from one budget of 2 a second; `cmb-fetch` served at 2 a
   second per session, a record once a minute per session, and nothing while 2 MiB is unsent; a
-  record budget of 8 a second per session before SVAF; role-chain holds bounded by bytes (64 KiB)
-  and grant fields by length.
+  record budget of 8 a second per session before SVAF. (Authority statements have their own
+  bounds: see the asking rule above.)
 - **Legacy Import pins the routed node's X25519 key (E).** A route needs `e2eKey` (the 0.13 node's
   `e2e-keypair.json` public key) besides the identity key or fingerprint; a hello presenting another
   X25519 key is refused (`e2e-key-mismatch`), so a relay squatter with the public keys reads nothing.
@@ -336,9 +312,6 @@ Seven design assumptions, each changed where it was made, not patched where it s
 
 ### Core Secure — breaking
 
-(Where this section speaks of role grants, revokes or their frames, MMP §6.6 supersedes it: see
-"Authority: MMP §6.6 as merged" above.)
-
 - **A peer is a proven session.** A sym peer used to exist before anything was proven about it: on
   TCP connect, on any first `handshake` frame (whose keys were pinned), on a relay's
   `relay-peer-joined`. Now every transport — LAN TCP, loopback, relay — runs the MMP §5.2
@@ -377,16 +350,16 @@ Seven design assumptions, each changed where it was made, not patched where it s
   `cmb-fetch` may name one `key` or up to 32 `keys`; each record found goes out as its own
   sealed `cmb-encrypted` frame, then one sealed `cmb-fetch-result` that carries only the
   correlation id and the key lists, `{ reqId, returned: [...], missing: [...] }` (draft spec PR
-  #26; each key requested in exactly one list; it carried the record in the clear); `role-grant`/`role-revoke` are verified against
-  the grant chain, never the delivering session; `peer-info` and `wake-channel` are learned only
+  #26; each key requested in exactly one list; it carried the record in the clear); `role-grant`/`role-revoke` are retired
+  (MMP §6.6.11, above); `peer-info` and `wake-channel` are learned only
   for the session's own nodeId (gossip about other nodes and the relay's peer list are hints,
   never stored); `message` is retired: `send()` sends a directed CMB whose signed application
   section marks it a message, and the receiver raises its `message` event from it;
   `xmesh-insight` goes only with `xmesh-insight-v1`; `state-sync` is refused. Records
   replayed as context on connect are announced in a sealed `cmb-anchors` frame (the `_anchor`
   frame flag could not ride a sealed record). The new wire elements that still need spec text
-  (`cmb-anchors`, `role-chain-fetch` / `role-chain` and their whole-store sync, `role-digest`, the
-  error rules and 1011) are written out in `docs/WIRE-0.14.0.md`; `room-join` is draft spec PR #31.
+  (`cmb-anchors`, the error rules and 1011, and what sym chooses where MMP §6.6 leaves a choice) are
+  written out in `docs/WIRE-0.14.0.md`; `room-join` is draft spec PR #31.
 - **Admission attestations are the `sym-attest-v1` extension** (draft spec PR
   meshcognition-website#27). The frames are `sym-attest-attestation`, `sym-attest-checkpoint`,
   `sym-attest-witness` and `sym-attest-node-stats`, sent only to sessions that selected the
@@ -410,11 +383,9 @@ Seven design assumptions, each changed where it was made, not patched where it s
   `handshake` entry becomes `legacy-claim` on first load: the expected key, never one that
   verifies; a proven session presenting it binds `proven`, one presenting another key is a
   conflict. `roster-keys.jsonl` gets a version marker line (a 0.13 rollback skips it).
-- **Authority follows the key.** `resolveRole(nodeId, key, at)`: a grant confers its role only on
-  the key its `granteeKey` names. Grant chains are verified top-down with the key each verified
-  grant vouches, never the registry's key for the grantor. Every role-grant carries `granteeKey`
-  (one without it is malformed), and `grantRole` refuses a grantee with no proven or pinned key
-  (or pass `{ granteeKey }`).
+- **Authority follows the key.** A grant names a nodeId and a key and confers its role on that pair
+  only (MMP §6.6.9); a statement is verified under the key its own chain names, never the
+  registry's. `grantRole` refuses a grantee with no proven or pinned key (or pass `{ granteeKey }`).
 - **Room admission on proven keys.** A gated room admits its owner by its pinned key and a grantee
   whose room-join grant binds the key its session proved (the grant is presented in a sealed
   `room-join` frame, draft spec PR #31); `roomGate().admits` is now `grant-holders`. The `provenPublicKey`
@@ -425,8 +396,7 @@ Seven design assumptions, each changed where it was made, not patched where it s
 
 ### Core Secure — new API (for hosts: XMesh, mesh-channel)
 
-(Where this section speaks of role grants, revokes or their frames, MMP §6.6 supersedes it: see
-"Authority: MMP §6.6 as merged" above.)
+(The authority API is listed under "Authority: MMP §6.6" above.)
 
 - `node.on('verified-record', ({ record, session, verification }) => …)`: every record that
   passed §8.8.5, with the proven session facts (`nodeId`, `name`, `identityKey`, `sessionId`,
@@ -462,16 +432,10 @@ Seven design assumptions, each changed where it was made, not patched where it s
 
 - **Binding lifetime (design D3, as the security review changed it).** A confirmed session runs
   with a session-scoped binding; the durable registry takes one only when it is earned (an
-  admitted verified record, a verified directed record accepted, a pin, a grant in effect). A `proven` binding that verified nothing and
+  admitted verified record, a verified directed record accepted, a pin, an in-force grant). A `proven` binding that verified nothing and
   was not seen for 30 days expires; nothing is evicted before it expires, and a full registry
   (65,536) refuses a newcomer a durable binding — its live session still verifies what it signs.
   The `seen` / `verified` facts are persisted with the binding.
-- **role-chain-fetch.** A grant or revoke that arrives before the grant rooting its grantor makes
-  the node ask the delivering session for the chain (`role-chain-fetch` naming the grantor; answered
-  with `role-chain`, ordinary signed grants verified top-down). The record is held only for that
-  fetch: at most 64 per session, 10 s. Spec text for the two frames is still to be drafted.
-- **A grant or revoke is stored, persisted and relayed as one canonical object of its signed
-  fields** (A5): an unsigned field a frame carried is never kept or passed on.
 - **A peer with a live relay session reuses it** (A2): a repeated announcement probes the session
   with a ping instead of re-handshaking; a restarted peer's new process answers a ping, or a sealed
   frame, for a session it does not hold with an `error`, and the session re-handshakes. Close
@@ -548,8 +512,9 @@ debt, and the daemon's log flood. Every item has a test that fails without its f
 - **One captured role grant could be stored and relayed without end** (0.13.16, and the releases
   before it that gossip role grants). A grant re-spelled (padding, whitespace, a `+`/`/` swap: each
   spelling verifies) was taken as a new grant, so any admitted peer holding one, with no key of its
-  own, could make every node store, append and relay it again for every spelling. 0.14.0 refuses the
-  re-spelling, budgets grants and bounds what is kept (see Fixed — signed gossip is budgeted).
+  own, could make every node store, append and relay it again for every spelling. 0.14.0 retires
+  role grants altogether (MMP §6.6.11); an authority statement's signature is taken in its one
+  canonical spelling, and its id never covers the signature (see Authority: MMP §6.6).
 
 ### Fixed — security
 
@@ -814,18 +779,19 @@ debt, and the daemon's log flood. Every item has a test that fails without its f
 
 ### Fixed — signed gossip is budgeted, per connection and per attester
 
-(Where this section speaks of role grants, revokes or their frames, MMP §6.6 supersedes it: see
-"Authority: MMP §6.6 as merged" above.)
+(This section was written for 0.13.17's per-connection budget; 0.14.0 keeps the budget per proven
+peer, as "No shared budget is spent before verification" above says, and authority statements
+spend it under the asking rule, as "Authority: MMP §6.6" says.)
 
 - **New signed statements are budgeted (0.13.15's other known limit).** The attestations,
-  checkpoints, witnesses and role grants that arrive on one connection may make this node check at most
+  checkpoints, witnesses and authority statements that arrive on one connection may make this node check at most
   2,000 new statements a second, up to a burst of 10,000. A connection seen for the first time starts
   with 100 and earns the rest at that rate. All connections together draw on one ceiling, 4,000 a
   second after a burst of 20,000. Past either, a frame is dropped before its signature is checked, so
   no sender, and no number of senders, buys more signature checks than the ceiling (~40 µs each: under
   a fifth of a core). Attestations are covered as well as checkpoints and witnesses.
 - **Only a new statement spends it.** These are dropped first, for nothing: a repeat (an attestation
-  or role grant whose signature is held, however it is spelled; a checkpoint or witness held, waiting
+  whose signature is held, however it is spelled, or an authority statement whose id is held; a checkpoint or witness held, waiting
   for its checkpoint, or already refused as a conflict), a checkpoint older than every position held,
   a further root for a position already in conflict, an unsigned or malformed frame, and a frame whose
   signer's key this node does not hold.
@@ -858,16 +824,11 @@ debt, and the daemon's log flood. Every item has a test that fails without its f
   4,096 connections, the least recently active evicted in O(1), without scanning. A log or metric
   listener that throws cannot break the handling of a frame or `stop()`: a report's counts are reset
   before it is said, so none is said twice, and the totals stay in `metrics()`.
-- **Role grants are gossip like the rest.** They were outside the budget and de-duplicated by the
-  signature as written, so one grant re-spelled (see Security) was stored, appended to
-  `role-grants.jsonl` and relayed again for every spelling. A grant is now refused in the same order
-  as the other statements (malformed, not spelled canonically, a repeat by its signature's bytes, a
-  grantor whose key is not held) before it spends the budget, and is kept in its canonical spelling.
-  The store bounds what it keeps, and so what it relays: 1,024 records per grantor, 64 per grantor and
-  grantee, 65,536 in all. A full bound refuses the newcomer and never evicts, since a record's
-  authority can depend on its place in a chain; the anchor's own records are never refused. Limit: a
-  node whose key this node holds can fill its own bounds with grants that confer nothing, and enough
-  such nodes can fill the store, after which only the anchor's grants are taken.
+- **Authority statements are gossip like the rest.** 0.13's role grants were outside the budget and
+  de-duplicated by the signature as written, so one grant re-spelled (see Security) was stored and
+  relayed again for every spelling. Role grants are retired (MMP §6.6.11). An authority statement is
+  refused in the same order as the other statements (not of the shape, a repeat by its id) before it
+  spends the budget, and the store bounds what it keeps (see Authority: MMP §6.6, Capacity).
 - **One attester's checkpoints cannot make the room sign witnesses without end.** Each checkpoint a
   node takes costs every node in the room a witness signed, gossiped and verified. The per-peer budget
   bounds what one peer delivers, not what one attester signs: an attester sending new checkpoints
@@ -886,7 +847,7 @@ debt, and the daemon's log flood. Every item has a test that fails without its f
   stray characters, so one signature could be spelled any number of ways that all verify. Each spelling
   was stored and relayed as a new attestation. The chain hash and the Merkle root are computed over the
   signature as written, so a re-spelling that arrived first made its attester's chain look broken. A
-  gossiped attestation, checkpoint, witness or role grant whose signature is not 64 bytes in unpadded
+  gossiped attestation, checkpoint or witness whose signature is not 64 bytes in unpadded
   base64url is now refused before anything is spent on it, before the repeat check (which decoded a
   re-spelling to look it up). It is counted (`signaturesNotCanonical` in `metrics()`) and said like a
   budget drop (`signature-not-canonical`). A signature longer than 128 characters is malformed,
diff --git a/README.md b/README.md
index 96789c39..862b172f 100644
--- a/README.md
+++ b/README.md
@@ -165,7 +165,7 @@ What this does not solve, said plainly:
   reconnects. The anchor's threshold holders are the root of authority.
 - **Upgrading from 0.13 is a flag day for authority.** Old role grants confer nothing under §6.6;
   the anchor and each grantor re-issue what should stand (`node.legacyRoleGrants()` lists the old
-  ones).
+  ones; [docs/AUTHORITY-OPERATOR.md](docs/AUTHORITY-OPERATOR.md) says how, and how to pin and re-pin).
 - **Relay eviction.** `relay-auth` is not proven, and a relay token holder can make the relay
   replace another node's connection (close 4004). A squatter gets no Core Secure session — it
   cannot prove the key — and an evicted node re-handshakes, but the relay path can be interrupted.
diff --git a/SECURITY.md b/SECURITY.md
index ac91e38a..7f8f0871 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -104,8 +104,10 @@ Report a vulnerability privately to info@sym.bot (the address in package.json).
   signer are dropped unverified for the rest of the minute. A refused record is logged and recorded
   in the decision log at most once a minute per peer and reason. Authority statements are verified
   under the keys their own chains name, so this question does not arise for them: one that fails is
-  dropped and counted against the delivering session, and past 8 failures a minute under one signing
-  key that session's statements under that key are dropped unread.
+  dropped and counted against the delivering session, and past 8 failures in a minute that peer's
+  authority statements are dropped unread for the rest of the minute. The mute is keyed on the
+  session's peer, never on a key the sender writes into the statement. A statement refused for
+  capacity, and one this node cannot judge because no anchor is pinned, count for nothing.
 - **Admission attestations under `sym-attest-v1`.** Attestations, checkpoints and witnesses are
   signed under their own domain tags with every field covered, verified against the signer's bound
   key (never the delivering session), and exchanged only with sessions that negotiated the
@@ -146,22 +148,27 @@ Every store a peer can feed has a fixed bound. Reaching one never stops the node
   conflicts: at most 8 kept per nodeId and 1,024 in all, every one counted
   (`status().coreSecure.keyConflicts`).
 - **Authority statements** (MMP §6.6): what is in force is bounded by the quotas above. What is
-  held: at most 200,000 statements; past that the ones not in the live set go first (highest id
-  first), and a new one is refused only when the live set alone fills the store. A statement is at
-  most 16 signature entries, 64 targets and a 256-character scope, in the schema's shape (anything
-  else is refused before any work). A statement whose chain is not held is pending: its own
-  signature checked first, at most 64 held per session, keyed by id and signing key, for at most
-  10 s or until the session closes, never persisted, relayed or counted, with one fetch in flight per
-  missing id. An `authority-set` carries at most 64 statements. A node answers `authority-fetch` at 4
-  a second per session (burst 16); over that a request waits, at most 64 of them, and past that one
-  is dropped. One pull in flight per session.
+  held: at most 200,000 statements. Past that the store drops what is not in the live set first,
+  then what comes last in authority order (deepest first, grants before revokes and endorses,
+  highest id first), a batch at a time; an arriving anchor-level statement or revoke is never the
+  one refused, so a revoke that removes a flooding authority is always taken. A statement is at most
+  16 signature entries, 64 targets and a 256-character scope, in the schema's shape (anything else
+  is refused before any work). A statement whose chain is not held is pending: at most 64 held per
+  session (checked before its signature is), keyed by id and signing key, for at most 10 s or until
+  the session closes, never persisted, relayed or counted. An `authority-set` carries at most 64
+  statements. A node answers `authority-fetch` at 4 a second per session (burst 16); over that a
+  request waits, at most 64 of them, and past that one is dropped. This node asks a session for
+  anything (a pull page, the missing links of its pending statements, up to 64 ids at once) one ask
+  at a time, and only when the session's gossip lane can pay a full answer's worst case (below).
 - **Gossip** (attestations, checkpoints, witnesses, authority statements): 2,000 new statements a
   second per proven peer (burst 10,000; a new peer starts at 100), spent before a signature is
-  checked (an authority statement also spends 16 for each key it makes this node check for the first
-  time, since that check is a scalar multiplication; a repeat or a statement not of the shape spends
-  nothing; an answer to this node's own pull is charged as a debt that paces the next page, never
-  dropped), and
-  4,000 verified statements a second in all (burst 20,000), spent only after it; checkpoints at most
+  checked. An authority statement spends one check (an anchor-level one, one per pinned-key entry)
+  and 16 for each key it makes this node check for the first time (that check is a scalar
+  multiplication), so at most 33; a repeat or a statement not of the shape spends nothing. Every
+  statement a session delivers spends its lane, asked for or not: this node asks only when the lane
+  holds a full page's worst case (64 × 33 = 2,112), and reserves it until the answer, so an answer
+  is never dropped for budget and never spends more than the lane holds. A ceiling of 4,000
+  verified statements a second in all (burst 20,000) is spent only after the check; checkpoints at most
   4 a second per attester (burst 128); at most 1,024 attesters, 32 checkpoints each, 256 witnesses
   per position.
 - **Records** (MMP §8.8.6 as draft spec PR #37 states it): a category's text at most 256 KiB after
@@ -229,11 +236,20 @@ Every store a peer can feed has a fixed bound. Reaching one never stops the node
 - **Grants are visible.** Every node that holds the set can read who holds which role.
 - **A new key costs a scalar multiplication.** The prime-order check of a key not seen before
   (§18.3.2) is one multiplication by L, about fifteen signature checks here. The gossip lane is
-  charged for it before it is done; a flood of fresh keys buys a sixteenth of a lane's checks.
+  charged 16 checks for it before it is done, whether the statement was asked for or not, so a peer
+  that answers with fresh keys buys at most its lane's worth of work. An answer is verified in
+  slices, so a page never holds the event loop for long. The key cache keeps the pinned keys for good
+  and the rest least recently used first, so a flood of fresh keys evicts only keys nobody used since.
+- **A re-pin keeps what still counts; a mistyped pin destroys nothing.** Statements are kept in one
+  file whatever the pin. At each start every statement is judged again against the pin in force, and
+  what does not count under it is kept as the bytes it was. A re-pin that keeps a threshold of the
+  old keys (dropping a compromised key from 2 of 3 to 2 of 2) keeps everything those keys signed in
+  force (§6.6.1); a pin corrected after a typo finds everything again (docs/AUTHORITY-OPERATOR.md).
 - **The upgrade is a flag day (MMP §6.6.11).** sym 0.14 resolves no authority from the role grants
-  0.13 (and earlier 0.14 builds) signed: until the anchor and each grantor re-issue what should stand
-  as §6.6 grants, every node resolves as a participant. `node.legacyRoleGrants()` lists the old store
-  as plain data (never verified, never resolved, never sent) for the operator who re-issues.
+  0.13 signed: until the anchor and each grantor re-issue what should stand as §6.6 grants, every
+  node but the anchor's holder resolves as a participant. `node.legacyRoleGrants()` lists the old
+  store as plain data (never verified, never resolved, never sent) for the operator who re-issues
+  (docs/AUTHORITY-OPERATOR.md).
 - **Scopes need their namespace.** sym implements no scope namespace by itself: a scoped grant
   confers nothing on any CMB until the host passes the extension's resolver (`authorityScopes`).
 - **A received validation CMB advances its parent only to remixed.** MMP §6.5 has a receiver advance
diff --git a/docs/AUTHORITY-OPERATOR.md b/docs/AUTHORITY-OPERATOR.md
new file mode 100644
index 00000000..a477dea1
--- /dev/null
+++ b/docs/AUTHORITY-OPERATOR.md
@@ -0,0 +1,97 @@
+# Authority in sym 0.14: an operator's guide
+
+sym 0.14 implements MMP §6.6. Authority (who is an admin, a validator, an issuer) is a set of signed
+statements (grants, revokes and endorses) rooted at an **anchor pin** you configure on every node. A
+node computes what is in force from the statements it holds and from nothing else, so every node
+holding the same statements under the same pin agrees. This guide covers configuring the pin,
+changing it, and the one-time re-issue after upgrading from 0.13.
+
+## 1. Configure the pin
+
+The pin is a set of Ed25519 public keys and a threshold t: an anchor-level statement counts when t
+distinct pinned keys have signed it. Configure the same pin on every node, out of band. It is never
+learned from the network.
+
+```js
+// One founder key (the 1-of-1 case). The nodeId lets that node act as the anchor itself.
+new SymNode({ name: 'founder', anchor: { threshold: 1, keys: [{ key: '<base64url key>', nodeId: '<uuid>' }] } });
+
+// Three key holders, any two of whom act as the anchor.
+new SymNode({ name: 'n', anchor: { threshold: 2, keys: [{ key: K1 }, { key: K2 }, { key: K3 }] } });
+```
+
+- `SYM_FOUNDER_ANCHOR="<nodeId>:<publicKey>"`, or the pin as JSON, does the same for a node built
+  without the `anchor` option. A node's own key and nodeId are `node.publicKey` and `node.nodeId`.
+- A pin that does not parse stops the node: it never runs without the root it was asked for.
+- With no pin, nothing is in force. The node ignores authority frames, resolves everyone as a
+  participant, and uses its configured `lifecycleRole` for its own validation (a closed development
+  mode).
+- `node.authorityStatus()` (and `status().coreSecure.authority`) shows the pin digest, the authority
+  root, the in-force count and this node's roles. Two nodes with the same root hold the same
+  authority.
+
+## 2. Grant, revoke, endorse
+
+Under a 1-of-1 pin the node holding the pinned key signs anchor-level statements by itself:
+
+```js
+node.grantRole(peerNodeId, 'validator');                  // the peer's key must be proven or pinned here
+node.grant({ nodeId, key }, 'admin');                     // or name the key yourself
+node.grant({ nodeId, key }, 'issuer', { scope: 'xmesh-world:w1' });
+node.revokeRole(peerNodeId);                              // every in-force grant naming it that this node may remove
+node.endorse([statementId]);                              // keep what a revoke cut off, where it should stand
+```
+
+Under a threshold above 1, one holder signs and the others co-sign, then any node submits it:
+
+```js
+const half = holder1.authorityStatement({ kind: 'grant', subject: { nodeId, key }, role: 'admin' }, { asAnchor: true });
+const whole = holder2.cosignAuthority(half);              // add more holders until t have signed
+anyNode.submitAuthority(whole);                           // then it spreads by gossip
+```
+
+An admin grants and revokes below itself the same way (`node.grant`, `node.revoke`). Delegation is
+at most 4 links from the anchor; a scoped grant can only narrow its parent's scope.
+
+## 3. Re-pin
+
+Change the pin on every node and restart it. Nothing is deleted: statements are kept in one file
+(`authority/statements.jsonl` in the node directory) whatever the pin, and at each start every
+statement is judged again against the pin in force.
+
+- **Dropping a compromised key, keeping a threshold of the old ones** (2 of 3 to 2 of 2, or 2 of 3
+  to 2 of 3 with the bad key replaced): every anchor-level statement that the kept keys alone still
+  sign t times keeps counting, and so does everything below it. A statement that needed the dropped
+  key to reach t stops counting; re-sign it with the keys you keep.
+- **Under a threshold of 1** every pinned key alone is the root, so removing a key removes what it
+  alone signed.
+- **A mistyped pin** destroys nothing: the node resolves nothing until you correct the pin and
+  restart, and then finds everything again.
+- **Compromise of t keys** is compromise of the root. Recover by pinning new keys everywhere, out of
+  band, and re-issuing the grants that should stand.
+
+## 4. Upgrading from 0.13: the flag day
+
+sym 0.14 resolves no authority from the role grants 0.13 signed (MMP §6.6.11). After the upgrade
+every node except the pinned anchor holder resolves as a participant until grants are re-issued
+under the new rule. Re-issue at once, top down:
+
+1. **The anchor's holder** lists the old grants and re-issues each it still regards as in effect,
+   with the same subject and key; the 0.13 `anchor` role becomes `admin`:
+
+   ```js
+   for (const g of node.legacyRoleGrants()) {           // plain data: never verified, never resolved
+     if (!stillStands(g)) continue;                      // your judgement, not the old store's
+     if (g.granteeKey) node.grant({ nodeId: g.grantee, key: g.granteeKey }, g.role);
+     else node.grantRole(g.grantee, g.role);             // a key proven by a session, or pinned, first
+   }
+   ```
+
+2. **Each grantor**, once it holds its own new grant, re-issues the grants it signed under 0.13, if
+   §6.6's role table permits them and they fit in 4 links. A link that does not fit (a validator
+   that promoted a validator) does not carry over; that grantee needs a grant from the anchor or an
+   admin.
+3. A grant an old revoke had cleared is simply not re-issued.
+
+Until a node is re-granted it is a participant everywhere. Nodes still running 0.13 ignore the new
+frames and keep the old authority; the two kinds see only their own.
diff --git a/docs/WIRE-0.14.0.md b/docs/WIRE-0.14.0.md
index 4dee03c9..d4e24464 100644
--- a/docs/WIRE-0.14.0.md
+++ b/docs/WIRE-0.14.0.md
@@ -92,22 +92,40 @@ counted (`authorityStatus().stats.retired`), and they are never sent. Nothing in
   that keeps one pull in flight gets every page. sym does not take the MAY to refuse a fresh full
   pull within 60 s: the pacing bounds the work, and a refused pull would leave differing roots
   apart until the peer's set next changed.
-- **The cost of a new key (§6.6.12).** Every statement a session delivers spends that peer's gossip
-  lane before it is checked: one check, plus 16 for each key it names that this node has not seen
-  (a grant's subject key; the signing key, when it will be verified; pinned keys an anchor-level
-  statement's entries name). Rules 1 and 2 of §18.3.2 cost one scalar multiplication for a new key,
-  about fifteen signature checks here. A statement not of the schema's shape, and a repeat of one
-  held, cost nothing. Unsolicited statements over the lane are dropped (a pull brings them later);
-  an answer to this node's own fetch or pull is never dropped: its cost is charged as a debt, and
-  the next page is asked for only once the debt is repaid.
+- **The cost of a statement (§6.6.12).** Every statement a session delivers spends that peer's
+  gossip lane before it is checked, asked for or not: one check (one per pinned-key entry of an
+  anchor-level statement, each of which may be verified), plus 16 for each key it makes this node
+  check for the first time (a grant's subject key; the signing key, when it will be verified). Rules
+  1 and 2 of §18.3.2 cost one scalar multiplication for a new key, about fifteen signature checks
+  here; pinned keys are checked once, at the pin, and kept. So a statement costs at most 33. A
+  statement not of the schema's shape, a repeat of one held, a pending statement already held, and
+  one the session's pending holds (64) have no room for cost nothing: they are dropped before any
+  check. Unsolicited statements the lane cannot pay for are dropped (a pull brings them later).
+- **The asking rule.** This node asks a session (a pull page, or a fetch by ids for the missing
+  links of its pending statements, up to 64 ids at once) only when that peer's lane holds a full
+  answer's worst case, 64 × 33 = 2,112 checks, and reserves it while the ask is out: the answer is
+  paid from the reservation and what it did not spend goes back. One ask is in flight per session.
+  So an answer is never dropped for budget, and nothing the peer sends makes this node verify more
+  than the peer's lane pays for, whatever triggered the ask (a digest, a pending statement, the
+  answer before). An answer is verified in slices, the event loop free between them.
 - **Pulls.** An unanswered page is asked again from the same cursor, up to 3 times. A digest that
   arrives during a pull is remembered, and if the roots still differ when the pull ends, the pull
-  starts again.
-- **Persistence (§6.6.8).** Held statements are written as their canonical members only, to
-  `authority/statements-<pin digest>.jsonl` in the node's directory: a statement means something only
-  under the pin it was verified against, so a node started under another pin reads another file and
-  leaves this one as it was. At load every statement is verified again, chain by chain, and the set
-  resolved afresh; no status, root or receipt time is stored.
+  starts again at once (under the asking rule). A pull that ends with the roots apart and no new
+  digest is started again after a backoff, 2 s doubling to 5 minutes, until the roots meet.
+- **Capacity.** At most 200,000 statements are held. Past that the store drops what is not live
+  first, then what comes last in authority order (deepest first, grants before revokes and endorses,
+  highest id first), a batch at a time. An arriving anchor-level statement or revoke is never the one
+  refused. A statement refused for capacity is not a relay failure.
+- **Persistence (§6.6.8).** Held statements are written as their canonical members only, each on a
+  line of its own, to one file, `authority/statements.jsonl`, whatever the pin. At load every
+  statement is judged again against the pin in force, chain by chain, and the set resolved afresh;
+  what does not count under that pin is kept in the file as the bytes it was, never deleted, so a
+  re-pin keeps what still counts (§6.6.1) and a corrected pin finds everything again. Only lines that
+  are not a statement (torn, not JSON, not of the shape) and statements dropped for capacity are left
+  out. No status, root or receipt time is stored.
+- **No anchor pinned.** A node with no pin sends no digest, pulls nothing,
+  answers no fetch, stores and relays nothing, and counts no statement it cannot judge against the
+  session that sent it.
 - **Scopes (§6.6.2).** A scope's namespace is implemented by an extension. sym implements none by
   itself: a host passes `authorityScopes: { <namespace>: (path, cmb, scope) => boolean }`, judged on
   the CMB's own signed fields. Where a namespace is not implemented a scoped grant is still resolved
@@ -198,5 +216,6 @@ from another peer is still taken.
 key its own chain names (the subject key of its authorising grant, or the pinned keys), never a
 registry binding (MMP §6.6.9), so the views above cannot differ and no session is closed for one.
 One that fails is dropped and counted against the delivering session (§6.6.8: rate-limited): past 8
-failures in a minute for one signing key, that session's statements under that key are dropped
-unread for the rest of the minute.
+failures in a minute, that peer's authority statements are dropped unread for the rest of the minute.
+The mute is keyed on the session's peer, never on a key the statement names (a sender chooses those).
+A statement refused for capacity is not a failure.

From c8dc68557011c43c8e51506e6367439a95526ac4 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 8 Oct 2026 09:19:37 +0100
Subject: [PATCH 119/148] =?UTF-8?q?authority:=20MMP=20=C2=A76.6=20errata?=
 =?UTF-8?q?=201=20(df79e04):=20unique=20signature=20keys;=20removals=20nev?=
 =?UTF-8?q?er=20dropped;=20pulls=20resume?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The errata the release review asked for landed on meshcognition-website branch
spec/authority-errata-1 at df79e04, its lib.mjs change included.

- H2, unique signature keys: a statement whose signature entries repeat a key is not well formed
  (shapeReason), refused before any signature is checked, as lib.mjs's authorityWellFormed now does.
  The vectors are re-vendored from df79e04 with their new hashes (authority-v2.json gains the
  xRepeatKey case; authority-frame.schema.json adds uniqueItems on sigs; ed25519-strict-v2.json is
  unchanged); SOURCES.json records the branch and commit.
- M1 as the errata words it: an anchor-level statement or a revoke is never dropped either, not
  only never refused; dropping live statements is logged and counted (authorityStatus().capacity).
- L3 as the errata words it: a pull that stopped early (its page retries spent, or its session
  closed) resumes from its cursor; the re-pull backoff resets when either set changes.
- Docs: the errata named where it applies; the mood frame is registered by the errata as sym sends
  it.

Tests: authority-vectors (every case of the new vectors, xRepeatKey included, in every order and
with forged copies); authority-attacks (anchor-level statements and revokes held past the bound);
authority-node (a pull resumes from its cursor after its retries).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QRVMpaJkAA2fFbvuHCEzqH
---
 CHANGELOG.md                               | 31 +++++++++++-------
 SECURITY.md                                |  7 ++--
 docs/WIRE-0.14.0.md                        | 14 +++++---
 lib/authority-store.js                     | 38 +++++++++++++---------
 lib/core/authority.js                      |  7 ++--
 lib/node-authority.js                      | 33 ++++++++++++++++---
 tests/authority-attacks.test.js            | 12 +++++++
 tests/authority-node.test.js               | 30 +++++++++++++++++
 tests/fixtures/SOURCES.json                |  8 ++---
 tests/fixtures/authority-frame.schema.json |  4 +--
 tests/fixtures/authority-v2.json           | 30 +++++++++++++++++
 11 files changed, 165 insertions(+), 49 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b798e3df..e325f1b9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -16,15 +16,17 @@ in-memory pending set for grants that arrive before their root (which could be f
 ### Authority: MMP §6.6
 
 Authority is MMP §6.6 as merged (sym-bot/meshcognition-website main at 8c3381d, PR #40; published
-unchanged as MMP 2.0 at 218df24): a function of a set of hash-linked signed statements, with no time
-in it. sym implements it as written. The time-replay grant rule that 0.14.0's development builds
+unchanged as MMP 2.0 at 218df24), with its errata 1 (branch spec/authority-errata-1 at df79e04,
+written from sym's release review): a function of a set of hash-linked signed statements, with no
+time in it. sym implements it as written. The time-replay grant rule that 0.14.0's development builds
 carried (cutoffs, ratification, budgets per delegation subtree, `role-chain-fetch`, `role-chain`,
 `role-digest`) never shipped.
 
 - **Statements (§6.6.3).** `grant`, `revoke` and `endorse`, each identified by `auth-` + SHA-256 of
   its canonical bytes (`mmp-authority-v1`), naming its authority in `authorisedBy` and its targets by
   id, with a 16-byte nonce; `issuedAt` is signed and never read. Validity is static: well formed (a
-  subject key of prime order included), rooted within 4 links, signed, permitted.
+  subject key of prime order, and signature-entry keys unique within the statement, errata 1),
+  rooted within 4 links, signed, permitted.
   (lib/core/authority.js)
 - **The anchor (§6.6.1)** is a pinned key set with a threshold:
   `anchor: { threshold, keys: [{ key, nodeId? }] }`; `{ nodeId, publicKey }`, a `"nodeId:publicKey"`
@@ -40,12 +42,13 @@ carried (cutoffs, ratification, budgets per delegation subtree, `role-chain-fetc
   statement a revoke cut off is rescued only by an in-force endorse from above, charged to the
   endorser's bucket and falling through by id; a quota cut is never rescued. The live set and the
   authority root. (lib/authority-store.js)
-- **Capacity.** At most 200,000 statements held. Past that the store drops what is not live first,
-  then what comes last in authority order (deepest first, grants before revokes and endorses,
-  highest id first), freeing a batch at a time so its sort is paid once per batch. An arriving
-  anchor-level statement or revoke is never the one refused, so the removal that would clean up a
-  flooded store is always taken. A statement refused for capacity (`over-capacity`) says nothing
-  against its sender.
+- **Capacity (errata 1).** At most 200,000 statements held. Past that the store drops what is not
+  live first, then what comes last in authority order (deepest first, grants before revokes and
+  endorses, highest id first), freeing a batch at a time so its sort is paid once per batch. An
+  anchor-level statement or a revoke is never dropped or refused, so the removal that would clean up
+  a flooded store is always taken. A statement refused for capacity (`over-capacity`) says nothing
+  against its sender. Dropping live statements is said in the log and counted
+  (`authorityStatus().capacity`).
 - **Persistence.** One file, `authority/statements.jsonl`, whatever the pin. At load every statement
   is judged again against the pin in force; what does not count under it (a mistyped pin, a re-pin,
   a chain not yet held) stays in the file as the bytes it was, never deleted, so a corrected pin, or
@@ -65,7 +68,9 @@ carried (cutoffs, ratification, budgets per delegation subtree, `role-chain-fetc
   one ask in flight per session: an answer is never dropped for budget and never spends more than
   the lane holds. An answer is verified in slices, so the event loop is never held for a page. A
   pull that ends with the roots apart is repeated, at once if a digest came during it, otherwise
-  after a backoff from 2 s doubling to 5 minutes. A session whose statements keep failing (8 in a
+  after a backoff from 2 s doubling to 5 minutes, reset when either set changes; a pull that stopped
+  early (a page that never came, a session that closed) resumes from its cursor. A session whose
+  statements keep failing (8 in a
   minute) has its authority statements dropped unread for the rest of the minute, a mute keyed on
   the session's peer. The key cache keeps the pinned keys for good and the rest least recently
   used first.
@@ -96,8 +101,8 @@ carried (cutoffs, ratification, budgets per delegation subtree, `role-chain-fetc
   `status().coreSecure.authority`; the `authority-changed` event; the `authorityScopes` option.
 - **An attestation's own time is no part of its weight**: no authority is judged at a time, so an
   attestation dated before the record it attests is not refused for that.
-- **Tests.** The published vectors are vendored in tests/fixtures with their sha256 recorded
-  (SOURCES.json, checked before use): every authority case resolved as listed, reversed, shuffled
+- **Tests.** The vectors are vendored in tests/fixtures with their sha256 recorded (SOURCES.json,
+  checked before use; authority-v2.json from errata 1, with its xRepeatKey case): every authority case resolved as listed, reversed, shuffled
   and with forged copies, and every Ed25519 case (authority-vectors). The review attacks at full
   scale, the old faces (arrival order, backdating, floods, cycles) and capacity in
   authority-attacks; two nodes reaching one root over TCP, the frames, the asking rule against a
@@ -119,6 +124,8 @@ carried (cutoffs, ratification, budgets per delegation subtree, `role-chain-fetc
   peer sent it, under the key that session proved (the frame is sealed on the session); it is not a
   signed record. Nothing about it can be verified again later, relayed with its author's signature,
   or attributed to anyone but that peer. A host shows it as the peer's word, not as a verified record.
+  MMP §6.6 errata 1 registers the mood frame as sym sends it (`{ type, from, fromName, mood,
+  context, timestamp }`, sealed on a Core Secure session, never stored, relayed or remixed).
 
 ### The loaded version, and hot-swap
 
diff --git a/SECURITY.md b/SECURITY.md
index 7f8f0871..f864ec83 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -151,9 +151,10 @@ Every store a peer can feed has a fixed bound. Reaching one never stops the node
   held: at most 200,000 statements. Past that the store drops what is not in the live set first,
   then what comes last in authority order (deepest first, grants before revokes and endorses,
   highest id first), a batch at a time; an arriving anchor-level statement or revoke is never the
-  one refused, so a revoke that removes a flooding authority is always taken. A statement is at most
-  16 signature entries, 64 targets and a 256-character scope, in the schema's shape (anything else
-  is refused before any work). A statement whose chain is not held is pending: at most 64 held per
+  one refused or dropped, so a revoke that removes a flooding authority is always taken; dropping
+  live statements is logged and counted. A statement is at most 16 signature entries (their keys
+  unique: MMP §6.6 errata 1), 64 targets and a 256-character scope, in the schema's shape (anything
+  else is refused before any work). A statement whose chain is not held is pending: at most 64 held per
   session (checked before its signature is), keyed by id and signing key, for at most 10 s or until
   the session closes, never persisted, relayed or counted. An `authority-set` carries at most 64
   statements. A node answers `authority-fetch` at 4 a second per session (burst 16); over that a
diff --git a/docs/WIRE-0.14.0.md b/docs/WIRE-0.14.0.md
index d4e24464..6aa0252d 100644
--- a/docs/WIRE-0.14.0.md
+++ b/docs/WIRE-0.14.0.md
@@ -111,11 +111,15 @@ counted (`authorityStatus().stats.retired`), and they are never sent. Nothing in
 - **Pulls.** An unanswered page is asked again from the same cursor, up to 3 times. A digest that
   arrives during a pull is remembered, and if the roots still differ when the pull ends, the pull
   starts again at once (under the asking rule). A pull that ends with the roots apart and no new
-  digest is started again after a backoff, 2 s doubling to 5 minutes, until the roots meet.
-- **Capacity.** At most 200,000 statements are held. Past that the store drops what is not live
-  first, then what comes last in authority order (deepest first, grants before revokes and endorses,
-  highest id first), a batch at a time. An arriving anchor-level statement or revoke is never the one
-  refused. A statement refused for capacity is not a relay failure.
+  digest is started again after a backoff, 2 s doubling to 5 minutes, reset when either set changes,
+  until the roots meet. A pull that stopped early (its page retries spent, or its session closed)
+  resumes from its cursor.
+- **Capacity (errata 1).** At most 200,000 statements are held. Past that the store drops what is
+  not live first, then what comes last in authority order (deepest first, grants before revokes and
+  endorses, highest id first), a batch at a time. An anchor-level statement or a revoke is never
+  dropped or refused. A statement refused for capacity is not a relay failure.
+- **Unique signature keys (errata 1).** A statement whose signature entries repeat a key is not well
+  formed, refused before any signature is checked.
 - **Persistence (§6.6.8).** Held statements are written as their canonical members only, each on a
   line of its own, to one file, `authority/statements.jsonl`, whatever the pin. At load every
   statement is judged again against the pin in force, chain by chain, and the set resolved afresh;
diff --git a/lib/authority-store.js b/lib/authority-store.js
index 723aeaab..aac9ae3e 100644
--- a/lib/authority-store.js
+++ b/lib/authority-store.js
@@ -22,11 +22,10 @@
  *     that may rescue it, charged to that endorser's bucket, falling through to the next endorser by id
  *     when a bucket is full; a statement cut off by a quota is never rescued.
  *   - THE LIVE SET and THE ROOT (§6.6.7); authority order, fetch answers and pages (§6.6.8).
- *   - CAPACITY: at most MAX_HELD statements. Past it the store drops what comes last in authority
- *     order (deepest first, grants before revokes and endorses, highest id first), what is not in
- *     the live set before what is; an anchor-level statement or a revoke arriving is never the one
- *     refused, so the removal that would clean a flooded store up is always taken (§6.6.6: removals
- *     first).
+ *   - CAPACITY (§6.6.6, errata 1): at most MAX_HELD statements. Past it the store drops what is not
+ *     in the live set first, then what comes last in authority order (deepest first, grants before
+ *     revokes and endorses, highest id first); an anchor-level statement or a revoke is never dropped
+ *     or refused, so the removal that would clean a flooded store up is always taken.
  *   - PERSISTENCE: one file of statements, with no integrity of its own and independent of the pin.
  *     At load each is judged again against the pin in force now and the set resolved afresh; a
  *     statement that does not count under this pin (a mistyped pin, a re-pin, a chain not yet held)
@@ -84,7 +83,7 @@ class AuthorityStore {
     this._dir = opts.dir || null;
     this._loading = false;
     this._loadReport = { held: 0, pending: 0, invalid: 0, unverified: 0, corrupt: 0 };
-    this._capacity = { evicted: 0, refused: 0 };
+    this._capacity = { evicted: 0, refused: 0, liveDropped: 0 };
     if (this._dir) this._load();
   }
 
@@ -474,11 +473,13 @@ class AuthorityStore {
   // ── Capacity and persistence ──────────────────────────────────────────────────
 
   /**
-   * @private Over MAX_HELD: drop down to EVICT_SLACK below it, what is not live first, and within each
-   * what comes last in authority order (deepest, grants before revokes and endorses, highest id). The
-   * statement arriving (`incomingId`) is a candidate like any other unless it is anchor-level or a
-   * revoke: those are never the ones refused, so the removal that would clean a flooded store up is
-   * always taken (§6.6.6: removals first). One sort per batch, not per arrival.
+   * @private Over MAX_HELD (§6.6.6, node capacity): drop down to EVICT_SLACK below it, what is not live
+   * first, then what comes last in authority order (deepest, grants before revokes and endorses at a
+   * depth, highest id). An anchor-level statement or a revoke is never dropped or refused: one always
+   * gets in, displacing the last in that order, so a full node loses the deepest delegated authority,
+   * never a removal. The statement arriving (`incomingId`) is a candidate like any other. One sort per
+   * batch, not per arrival. A node that drops live statements no longer resolves the set its peers
+   * do, and it says so.
    * @returns {Set<string>} the ids dropped
    */
   _evict(incomingId) {
@@ -486,16 +487,21 @@ class AuthorityStore {
     const n = this._held.size - Math.max(0, this._maxHeld - evictSlack(this._maxHeld));
     if (n <= 0) return dropped;
     const { live } = this.resolve();
-    const incoming = this._held.get(incomingId);
-    const keep = incoming && (incoming.authBy === 'anchor' || incoming.kind === 'revoke') ? incomingId : null;
     const candidates = [];
-    for (const e of this._held.values()) if (e.id !== keep) candidates.push(e);
+    for (const e of this._held.values()) if (e.authBy !== 'anchor' && e.kind !== 'revoke') candidates.push(e);
     candidates.sort((x, y) => ((live.has(x.id) ? 1 : 0) - (live.has(y.id) ? 1 : 0)) || orderCmp(y, x));
-    for (const e of candidates.slice(0, n)) { this._held.delete(e.id); dropped.add(e.id); }
+    let liveDropped = 0;
+    for (const e of candidates.slice(0, n)) {
+      this._held.delete(e.id);
+      dropped.add(e.id);
+      if (live.has(e.id) && e.id !== incomingId) liveDropped++;
+    }
     this._capacity.evicted += dropped.size - (dropped.has(incomingId) ? 1 : 0);
+    this._capacity.liveDropped += liveDropped;
     if (this._loading && this._loadEvicted) for (const id of dropped) this._loadEvicted.add(id);
     this._changed();
-    if (dropped.size) this._log(`Authority store over ${this._maxHeld}: ${dropped.size} statement(s) dropped, last in authority order first`);
+    if (liveDropped) this._log(`[sym-authority] the store is over ${this._maxHeld} statements: ${liveDropped} live statement(s) dropped, deepest first; this node no longer resolves the same set as its peers`);
+    else if (dropped.size) this._log(`Authority store over ${this._maxHeld}: ${dropped.size} statement(s) outside the live set dropped`);
     return dropped;
   }
 
diff --git a/lib/core/authority.js b/lib/core/authority.js
index 3ed2ee6f..53e8f12a 100644
--- a/lib/core/authority.js
+++ b/lib/core/authority.js
@@ -79,8 +79,8 @@ const SIG_KEYS = new Set(['key', 'sig']);
 
 /**
  * §6.6.3 rule 1, the shape alone (cheap: no curve arithmetic): the schema's shape, canonical base64url
- * fields, a canonical subject nodeId, issuedAt at most 2^53 − 1, a scope that follows the grammar, and
- * unique targets numbering 1 to 64. The reason is returned when it is not. `malformedReason` adds the
+ * fields, unique signature-entry keys, a canonical subject nodeId, issuedAt at most 2^53 − 1, a scope
+ * that follows the grammar, and unique targets numbering 1 to 64. The reason is returned when it is not. `malformedReason` adds the
  * subject key's order.
  * @returns {string|null} null when the shape is right
  */
@@ -98,6 +98,9 @@ function shapeReason(s) {
     if (typeof e.key !== 'string' || !PUBLIC_KEY.test(e.key)) return 'a signature entry key';
     if (typeof e.sig !== 'string' || !SIGNATURE.test(e.sig)) return 'a signature';
   }
+  // MMP §6.6 errata 1: the keys of a statement's signature entries are unique, checked here, before
+  // any signature work, so a copy cannot buy repeated checks under one pinned key.
+  if (new Set(s.sigs.map((e) => e.key)).size !== s.sigs.length) return 'signature entry keys repeat';
   if (s.kind === 'grant') {
     const sub = s.subject;
     if (!isPlain(sub) || !onlyKeys(sub, SUBJECT_KEYS)) return 'subject';
diff --git a/lib/node-authority.js b/lib/node-authority.js
index e1f033c3..73027a27 100644
--- a/lib/node-authority.js
+++ b/lib/node-authority.js
@@ -131,6 +131,7 @@ const methods = {
       held: this._authority.size(),
       roles: this.authorityRoles(this.nodeId),
       stats: { ...this._authorityStats },
+      capacity: this._authority.capacityReport(),
     };
   },
 
@@ -479,6 +480,8 @@ const methods = {
 
   /** @private Release what a closing session held (pending statements, asks, pulls, queued answers). */
   _authorityReleaseSession(session) {
+    // A pull this session was in the middle of resumes from its cursor on the peer's next session.
+    if (session._authPull && session._authPull.after) this._authorityRemember(session.nodeId, session._authPull.after);
     for (const p of (session._authPending || new Map()).values()) clearTimeout(p.timer);
     if (session._authAsk) clearTimeout(session._authAsk.timer);
     for (const t of [session._authPumpTimer, session._authRepullTimer, session._authDigestTimer, session._authServeTimer]) if (t) clearTimeout(t);
@@ -538,7 +541,10 @@ const methods = {
       for (const id of this._authorityRelayed) if (!this._authority.has(id)) this._authorityRelayed.delete(id);
     }
     if (changed) {
-      for (const session of this._sessions) if (session.confirmed && !session.closed) this._sendAuthorityDigest(session);
+      for (const session of this._sessions) {
+        session._authRepullMs = 0; // this node's set changed: any re-pull backoff starts again
+        if (session.confirmed && !session.closed) this._sendAuthorityDigest(session);
+      }
       try { this.emit('authority-changed', Object.freeze({ root: this._authority.root(), inForce: inForce.size })); } catch { /* a listener must not stop the settle */ }
     }
     this._authoritySettledAt = Date.now();
@@ -568,20 +574,36 @@ const methods = {
    */
   _onAuthorityDigest(session, msg) {
     if (!this._authority.anchored || !msg || typeof msg.root !== 'string' || !HEX64.test(msg.root) || !Number.isSafeInteger(msg.count) || msg.count < 0) return;
+    const changed = session._authPeerRoot !== msg.root;
     session._authPeerRoot = msg.root;
     if (msg.root === this._authority.root()) { this._authorityRootsMet(session); return; }
+    if (changed) session._authRepullMs = 0; // the peer's set changed: the backoff starts again
     if (session._authPull) { session._authPull.digestSeen = true; return; }
     this._startAuthorityPull(session);
   },
 
-  /** @private Pull the peer's live set from the start (asked for under the asking rule). */
+  /**
+   * @private Pull the peer's live set (asked for under the asking rule): from the start, or from the
+   * cursor a pull from that peer stopped at (a page that never came, a session that closed).
+   */
   _startAuthorityPull(session) {
     if (session.closed || session._authPull) return;
     if (session._authRepullTimer) { clearTimeout(session._authRepullTimer); session._authRepullTimer = null; }
-    session._authPull = { after: '', attempt: 0, want: true, digestSeen: false, first: true };
+    const resume = this._authorityResume && this._authorityResume.get(session.nodeId);
+    if (resume) this._authorityResume.delete(session.nodeId);
+    session._authPull = { after: resume || '', attempt: 0, want: true, digestSeen: false, first: true, resumed: !!resume };
     this._authorityPump(session);
   },
 
+  /** @private Where a pull from `peerId` stopped early, to resume from (bounded, least recent first out). */
+  _authorityRemember(peerId, after) {
+    if (!after) return;
+    const m = this._authorityResume || (this._authorityResume = new Map());
+    m.delete(peerId);
+    if (m.size >= 1024) m.delete(m.keys().next().value);
+    m.set(peerId, after);
+  },
+
   /** @private The roots met: any re-pull backoff starts again from the shortest. */
   _authorityRootsMet(session) {
     session._authRepullMs = 0;
@@ -651,7 +673,7 @@ const methods = {
     if (ask.ids && session._authAsked) for (const id of ask.ids) session._authAsked.delete(id);
     if (ask.pull) {
       if (ask.pull.attempt < PULL_RETRIES) { ask.pull.attempt++; ask.pull.want = true; }
-      else { session._authPull = null; this._scheduleAuthorityRepull(session); }
+      else { session._authPull = null; this._authorityRemember(session.nodeId, ask.pull.after); this._scheduleAuthorityRepull(session); }
     }
     this._authorityPump(session);
   },
@@ -744,7 +766,8 @@ const methods = {
         session._authPull = null;
         const root = this._authority.resolve().root;
         if (session._authPeerRoot && session._authPeerRoot !== root) {
-          if (pull.digestSeen) this._startAuthorityPull(session);
+          // A pull that resumed mid-way saw only the rest of the set: the next one starts from the top.
+          if (pull.digestSeen || pull.resumed) this._startAuthorityPull(session);
           else this._scheduleAuthorityRepull(session);
         } else this._authorityRootsMet(session);
       }
diff --git a/tests/authority-attacks.test.js b/tests/authority-attacks.test.js
index 0f560c94..efe89747 100644
--- a/tests/authority-attacks.test.js
+++ b/tests/authority-attacks.test.js
@@ -366,6 +366,18 @@ describe('§6.6 capacity: a full store keeps what comes first in authority order
     assert.strictEqual(st.ingest(r).result, 'held');
   });
 
+  it('an anchor-level statement or a revoke is never dropped either (MMP §6.6 errata 1): the store holds them past its bound', () => {
+    const st = new AuthorityStore({ pin: PIN, maxHeld: 30 });
+    const top = Array.from({ length: 25 }, () => grant('anchor', party(), 'admin'));
+    for (const g of top) st.ingest(g);
+    const revokes = top.slice(0, 10).map((g) => revoke(g, [g])); // depth 2, last in order among removals
+    for (const r of revokes) assert.strictEqual(st.ingest(r).result, 'held');
+    for (const g of top.slice(10)) for (let i = 0; i < 3; i++) st.ingest(grant(g, party(), 'participant'));
+    for (const x of [...top, ...revokes]) assert.strictEqual(st.has(id(x)), true, 'anchor-level statements and revokes stay');
+    assert.ok(st.size() >= 35, 'past the bound, since nothing else is left to drop');
+    assert.ok(st.capacityReport().liveDropped > 0 || st.capacityReport().refused > 0, 'the grants below went');
+  });
+
   it('what is not live goes first, then the last in authority order; one sort frees a batch', () => {
     const gA = grant('anchor', party(), 'admin');
     const gB = grant('anchor', party(), 'admin');
diff --git a/tests/authority-node.test.js b/tests/authority-node.test.js
index 2796c20d..344bd26a 100644
--- a/tests/authority-node.test.js
+++ b/tests/authority-node.test.js
@@ -488,6 +488,36 @@ describe('§6.6.8: the asking rule bounds what a session can make this node veri
   });
 });
 
+describe('§6.6.8: a pull that stops early resumes from its cursor', () => {
+  it('a page that never comes: after the retries the next pull asks from the same cursor', async () => {
+    try {
+      const X = node('resume-x', { gossipBudget: { newLane: 1e6, burst: 1e6 } }); const M = node('resume-m', { anchor: null });
+      await X.start(); await M.start();
+      await connectNodes(M, X);
+      const asked = [];
+      M._onAuthorityFetch = (session, msg) => {
+        asked.push(msg.after);
+        if (msg.after === '') session.send({ type: 'authority-set', reqId: msg.reqId, statements: [], next: '1.1.auth-cursor' });
+        // every later page goes unanswered
+      };
+      const sX = X._peers.get(M.nodeId).transport;
+      sX._authPeerRoot = 'c'.repeat(64);
+      X._startAuthorityPull(sX);
+      await until(() => asked.length >= 2, 3000);
+      assert.deepStrictEqual(asked.slice(0, 2), ['', '1.1.auth-cursor']);
+      // The page timed out its retries: the pull is remembered at its cursor, and the re-pull resumes there.
+      const ask = sX._authAsk;
+      for (let i = 0; i < 4 && sX._authAsk; i++) X._authorityAskTimedOut(sX, sX._authAsk);
+      assert.ok(ask);
+      assert.strictEqual(X._authorityResume.get(M.nodeId), '1.1.auth-cursor');
+      clearTimeout(sX._authRepullTimer); sX._authRepullTimer = null;
+      X._startAuthorityPull(sX);
+      await until(() => asked.length >= 6, 3000);
+      assert.strictEqual(asked[asked.length - 1], '1.1.auth-cursor', 'resumed from the cursor, not from the top');
+    } finally { await stopAll(); }
+  });
+});
+
 describe('§6.6.8: a fetch answer is the closure', () => {
   it('an endorse that keeps a rescued revoke in force goes with it, so the asker reaches the same root', () => {
     const pin = A.parsePin(PIN);
diff --git a/tests/fixtures/SOURCES.json b/tests/fixtures/SOURCES.json
index c4c3333c..d02dd106 100644
--- a/tests/fixtures/SOURCES.json
+++ b/tests/fixtures/SOURCES.json
@@ -1,9 +1,9 @@
 {
-  "note": "MMP v2.0 conformance artifacts vendored for sym's tests. Copied unchanged from sym-bot/meshcognition-website main at 8c3381d (PR #40, head ef1b542), public/spec/mmp/. The sha256 values equal that commit's public/spec/mmp/artifact-manifest.json; tests/authority-vectors.test.js checks them before it reads anything.",
-  "source": "https://github.com/sym-bot/meshcognition-website/tree/8c3381d/public/spec/mmp",
+  "note": "MMP v2.0 conformance artifacts vendored for sym's tests, copied unchanged. authority-v2.json and authority-frame.schema.json come from sym-bot/meshcognition-website branch spec/authority-errata-1 at df79e04 (MMP §6.6 errata 1: unique signature keys, adding the xRepeatKey case), not yet merged to main; ed25519-strict-v2.json is unchanged since main at 8c3381d (PR #40) and the published 218df24. The sha256 values equal df79e04's public/spec/mmp/artifact-manifest.json; tests/authority-vectors.test.js checks them before it reads anything.",
+  "source": "https://github.com/sym-bot/meshcognition-website/tree/df79e04/public/spec/mmp",
   "files": {
-    "authority-v2.json": { "from": "conformance/v2/authority-v2.json", "sha256": "3cd656cec2c85f1b5658901aa4ed5a4fe9357e761600c64435a324538f8d46ce" },
+    "authority-v2.json": { "from": "conformance/v2/authority-v2.json", "sha256": "0e17b3e52282968e02ea18cd7827a143d70887d7885e21618ea21bef173048f6" },
     "ed25519-strict-v2.json": { "from": "conformance/v2/ed25519-strict-v2.json", "sha256": "323d8d9f1a4ab985a53e3c7031e39c004e456df74a87a48550761160e3c1997b" },
-    "authority-frame.schema.json": { "from": "schema/authority-frame.schema.json", "sha256": "0e9fa987e8d38351ab28755f57d413d354fabd92cf968365b10845924f573a95" }
+    "authority-frame.schema.json": { "from": "schema/authority-frame.schema.json", "sha256": "f0717dea628b525b450892b979690bb97033f39159ee79ac023bb968d6d76c42" }
   }
 }
diff --git a/tests/fixtures/authority-frame.schema.json b/tests/fixtures/authority-frame.schema.json
index 9696f87f..3cfe6798 100644
--- a/tests/fixtures/authority-frame.schema.json
+++ b/tests/fixtures/authority-frame.schema.json
@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://meshcognition.org/spec/mmp/schema/authority-frame.schema.json",
   "title": "MMP v2.0 authority statements and frames (§6.6)",
-  "description": "Grant, revoke and endorse statements, each identified by the SHA-256 of its canonical signed bytes (mmp-authority-v1) and linked to others by those ids, and the four frames that carry them. The schema accepts exactly the shapes the reference construction (scripts/mmp/lib.mjs) accepts, with one exception no JSON Schema can express: a subject key must also be the encoding of an Ed25519 point of prime order (§18.3.2). Whether a statement is valid and in force is decided by §6.6 resolution against the pinned anchor.",
+  "description": "Grant, revoke and endorse statements, each identified by the SHA-256 of its canonical signed bytes (mmp-authority-v1) and linked to others by those ids, and the four frames that carry them. The schema accepts exactly the shapes the reference construction (scripts/mmp/lib.mjs) accepts, with two exceptions no JSON Schema can express: a subject key must also be the encoding of an Ed25519 point of prime order (§18.3.2), and no two signature entries may share a key (the schema refuses only identical entries). Whether a statement is valid and in force is decided by §6.6 resolution against the pinned anchor.",
   "oneOf": [
     { "$ref": "#/$defs/statementFrame" },
     { "$ref": "#/$defs/digestFrame" },
@@ -50,7 +50,7 @@
         "authorisedBy": { "$ref": "#/$defs/authorisedBy" },
         "nonce": { "$ref": "#/$defs/nonce" },
         "issuedAt": { "type": "integer", "minimum": 0, "maximum": 9007199254740991, "description": "Information only. Signed and part of the id; never used by resolution." },
-        "sigs": { "type": "array", "minItems": 1, "maxItems": 16, "items": { "$ref": "#/$defs/sigEntry" } }
+        "sigs": { "type": "array", "minItems": 1, "maxItems": 16, "uniqueItems": true, "items": { "$ref": "#/$defs/sigEntry" }, "description": "Each entry's key is unique within the statement (§6.6.3, rule 1). JSON Schema can only refuse identical entries (uniqueItems); two entries under one key with different signatures pass the schema and fail the reference construction." }
       },
       "if": { "type": "object", "properties": { "authorisedBy": { "$ref": "#/$defs/statementId" } } },
       "then": { "type": "object", "properties": { "sigs": { "type": "array", "maxItems": 1 } } }
diff --git a/tests/fixtures/authority-v2.json b/tests/fixtures/authority-v2.json
index 07d5ca58..7021cef1 100644
--- a/tests/fixtures/authority-v2.json
+++ b/tests/fixtures/authority-v2.json
@@ -466,6 +466,34 @@
       "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e74363a616e63686f7233363a30313866343761302d376232312d376162632d386465662d30303030303030303030656534333a67556369336e4846735535306a6638794b7566337842584f355668325a4a55704c4e6245774b6170337967393a76616c696461746f72303a32323a6a6e362d4866566f666f7670386c7443655f62386d67303a",
       "expectedId": "auth-a47f6807d7cc970b5f3504fb409a8592dbad234a05e47004c5b4ce33aac4852a"
     },
+    "xRepeatKey": {
+      "statement": {
+        "kind": "grant",
+        "authorisedBy": "anchor",
+        "subject": {
+          "nodeId": "018f47a0-7b21-7abc-8def-0000000000ee",
+          "key": "gUci3nHFsU50jf8yKuf3xBXO5Vh2ZJUpLNbEwKap3yg"
+        },
+        "role": "validator",
+        "nonce": "zYwj6-ZG0i1LRBsaMeKDzg",
+        "sigs": [
+          {
+            "key": "vHy8tWNjdfodgkNNRmck2SN39TuYBpXdSdJtDOEiBaU",
+            "sig": "wjvlcpkvhABi_23FHsQjBzKFZGCx0K4dFtTpzQB2pDF66-jy69IWpsp5y9m3hvVH5bUCKt9MmtCzo77Vw3DIAw"
+          },
+          {
+            "key": "vHy8tWNjdfodgkNNRmck2SN39TuYBpXdSdJtDOEiBaU",
+            "sig": "wjvlcpkvhABi_23FHsQjBzKFZGCx0K4dFtTpzQB2ADF66-jy69IWpsp5y9m3hvVH5bUCKt9MmtCzo77Vw3DIAw"
+          },
+          {
+            "key": "Zej5sLxurhJBafBXb5c2LSlajPX3cLReFDV85kfTPuw",
+            "sig": "I0PGKJbWsPjWlL_2Pmyd3jfmcpxqiNHgyj2ac1n1C-ndZas0DRbJXrXPhh1GhJiKdo0xGMddtbB2Ar1RMotODw"
+          }
+        ]
+      },
+      "expectedPayloadHex": "6d6d702d617574686f726974792d76310a353a6772616e74363a616e63686f7233363a30313866343761302d376232312d376162632d386465662d30303030303030303030656534333a67556369336e4846735535306a6638794b7566337842584f355668325a4a55704c4e6245774b6170337967393a76616c696461746f72303a32323a7a59776a362d5a473069314c524273614d654b447a67303a",
+      "expectedId": "auth-197b2c72bda15532879213ebab0c30b5eaaa0f8cafc920ed656e8cd163350355"
+    },
     "xValidatorByValidator": {
       "statement": {
         "kind": "grant",
@@ -4874,6 +4902,7 @@
         "gQ",
         "xThin",
         "xDupKey",
+        "xRepeatKey",
         "xValidatorByValidator",
         "xEndorseByValidator",
         "xByParticipant",
@@ -4891,6 +4920,7 @@
           "gQ": "in-force",
           "xThin": "invalid",
           "xDupKey": "invalid",
+          "xRepeatKey": "invalid",
           "xValidatorByValidator": "invalid",
           "xEndorseByValidator": "invalid",
           "xByParticipant": "invalid",

From 390b4af58cd0db41b2a69e4d6ef86420356f33e2 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 8 Oct 2026 09:35:50 +0100
Subject: [PATCH 120/148] tests: the asking rule, one ask, H2's per-entry cost,
 the resume cursor and LRU order, each pinned exactly

A mutation check of the release-review fixes found five guards no test held (the pending cap and the
relay mute bound an unprivileged peer before the asking rule is reached):
- a pull of 320 valid statements under fresh keys (the shared in-process key cache flushed, so
  they are fresh to the puller): the work done never runs ahead of what the lane has paid, and the
  pull takes the time the lane needs. Kills: no ask gate; answers refunded in full.
- one ask in flight per session: a pending statement's fetch waits for the pull page that is out.
- an anchor-level statement costs one check per pinned-key entry; an unpinned entry costs nothing.
- the resumed pull's first ask is the cursor (the retries' asks drained first).
- the LRU test touches a key that is not the oldest, so FIFO cannot pass it by accident.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QRVMpaJkAA2fFbvuHCEzqH
---
 tests/authority-node.test.js | 75 +++++++++++++++++++++++++++++++++++-
 tests/ed25519-strict.test.js |  7 ++--
 2 files changed, 77 insertions(+), 5 deletions(-)

diff --git a/tests/authority-node.test.js b/tests/authority-node.test.js
index 344bd26a..336cfda4 100644
--- a/tests/authority-node.test.js
+++ b/tests/authority-node.test.js
@@ -488,6 +488,75 @@ describe('§6.6.8: the asking rule bounds what a session can make this node veri
   });
 });
 
+describe('§6.6.8: the asking rule, exactly', () => {
+  it('a pull of valid statements under fresh keys is paced by the lane: the work done never runs ahead of what the lane has paid', async () => {
+    try {
+      const { _setKeyCacheMax } = require('../lib/core/ed25519');
+      const N = 320; // five pages of statements that each cost 1 check + 16 for a fresh subject key
+      const statements = Array.from({ length: N }, () => grant('anchor', party(), 'participant'));
+      const M = node('pace-m'); const X = node('pace-x');
+      for (const st of statements) M._authority.ingest(st);
+      M._authoritySettle();
+      // M checked every subject key, and the two nodes share this process's key cache: forget them, so
+      // to X they are the fresh keys they would be on another host. (The pinned keys are kept.)
+      const was = _setKeyCacheMax(0); _setKeyCacheMax(was);
+      await M.start(); await X.start();
+      const t0 = Date.now();
+      let worst = 0;
+      const watch = setInterval(() => {
+        const t = (Date.now() - t0) / 1000;
+        const done = X.authorityStatus().stats.held * 17;
+        const paid = 100 + 2000 * t + 2112; // the new lane, what it earns, one reservation in hand
+        worst = Math.max(worst, done - paid);
+      }, 10);
+      await connectNodes(X, M);
+      await until(() => X.authorityStatus().stats.held >= N, 15000);
+      clearInterval(watch);
+      assert.strictEqual(X.authorityStatus().stats.held, N, 'everything arrived');
+      assert.ok(worst <= 0, `the work ran ahead of the lane by ${worst} checks`);
+      const secs = (Date.now() - t0) / 1000;
+      assert.ok(secs >= (N * 17 - 100 - 2112) / 2000 - 0.5, `and took the time the lane needs (${secs.toFixed(1)} s)`);
+    } finally { await stopAll(); }
+  });
+
+  it('one ask in flight per session: a pending statement\'s fetch waits for the pull page out', async () => {
+    try {
+      const N2 = node('one-ask', { gossipBudget: { newLane: 1e6, burst: 1e6 } });
+      const s = admitAs(N2, identity('one-ask-peer'));
+      N2._sessions.add(s);
+      deliver(N2, s, { type: 'authority-digest', root: 'd'.repeat(64), count: 1 });
+      const asks = () => s.sent.filter((f) => f.type === 'authority-fetch');
+      assert.strictEqual(asks().length, 1);
+      assert.strictEqual(asks()[0].after, '', 'the pull page is out');
+      const gA = grant('anchor', party(), 'admin');
+      deliver(N2, s, { type: 'authority-statement', statement: grant(gA, party(), 'participant') });
+      assert.strictEqual(asks().length, 1, 'the pending statement\'s fetch waits');
+      deliver(N2, s, { type: 'authority-set', reqId: asks()[0].reqId, statements: [] });
+      await until(() => asks().length >= 2, 2000);
+      assert.deepStrictEqual(asks()[1].ids, [sid(gA)], 'and goes once the answer is in');
+    } finally { await stopAll(); }
+  });
+
+  it('an anchor-level statement costs one check per pinned-key entry it carries (H2)', async () => {
+    try {
+      const k1 = party(); const k2 = party(); const k3 = party();
+      const N3 = node('h2-cost', { anchor: { threshold: 2, keys: [{ key: k1.key }, { key: k2.key }, { key: k3.key }] } });
+      const s = admitAs(N3, identity('h2-peer'));
+      N3._gossipClock = () => 5_000_000;
+      const subject = party();
+      require('../lib/core/ed25519').isPrimeOrderKey(subject.key); // a known subject key: no fresh-key charge
+      const bogus = (keys) => ({ kind: 'grant', authorisedBy: 'anchor', subject, role: 'admin', nonce: A.freshNonce(), sigs: keys.map((k) => ({ key: k.key, sig: crypto.randomBytes(64).toString('base64url') })) });
+      deliver(N3, s, { type: 'authority-statement', statement: bogus([k1]) }); // opens the lane at 100 - 1
+      const tokens = () => N3._gossipBuckets.get(s.nodeId).tokens;
+      const t0 = tokens();
+      deliver(N3, s, { type: 'authority-statement', statement: bogus([k1, k2, k3]) });
+      assert.strictEqual(t0 - tokens(), 3, 'three pinned-key entries: three checks');
+      deliver(N3, s, { type: 'authority-statement', statement: bogus([k1, party()]) });
+      assert.strictEqual(t0 - tokens(), 4, 'an entry under a key not pinned is never verified, and costs nothing');
+    } finally { await stopAll(); }
+  });
+});
+
 describe('§6.6.8: a pull that stops early resumes from its cursor', () => {
   it('a page that never comes: after the retries the next pull asks from the same cursor', async () => {
     try {
@@ -511,9 +580,11 @@ describe('§6.6.8: a pull that stops early resumes from its cursor', () => {
       assert.ok(ask);
       assert.strictEqual(X._authorityResume.get(M.nodeId), '1.1.auth-cursor');
       clearTimeout(sX._authRepullTimer); sX._authRepullTimer = null;
+      await new Promise((r) => setTimeout(r, 100)); // the retries' asks still on the pipe arrive first
+      const from = asked.length;
       X._startAuthorityPull(sX);
-      await until(() => asked.length >= 6, 3000);
-      assert.strictEqual(asked[asked.length - 1], '1.1.auth-cursor', 'resumed from the cursor, not from the top');
+      await until(() => asked.length > from, 3000);
+      assert.strictEqual(asked[from], '1.1.auth-cursor', 'the next pull asks from the cursor, not from the top');
     } finally { await stopAll(); }
   });
 });
diff --git a/tests/ed25519-strict.test.js b/tests/ed25519-strict.test.js
index bd963a1c..47210f02 100644
--- a/tests/ed25519-strict.test.js
+++ b/tests/ed25519-strict.test.js
@@ -201,10 +201,11 @@ describe('the key cache keeps keys that keep being used (release review L5)', ()
     try {
       const k = () => identity('c').publicKey;
       const pinned = k(); isPrimeOrderKey(pinned, { keep: true });
-      const used = k(); isPrimeOrderKey(used);
       const others = [k(), k(), k()];
-      for (const o of others) isPrimeOrderKey(o);
-      isPrimeOrderKey(used); // used again: most recent
+      const used = k();
+      // The cache holds others[0], used, others[1], others[2]: used is not the oldest when it is used again.
+      isPrimeOrderKey(others[0]); isPrimeOrderKey(used); isPrimeOrderKey(others[1]); isPrimeOrderKey(others[2]);
+      isPrimeOrderKey(used); // used again: now the most recent
       const fresh = [k(), k()];
       for (const f of fresh) isPrimeOrderKey(f); // a small flood
       assert.strictEqual(isKeyKnown(used), true, 'the key in use stays');

From e11a7cdb6af1fdbe5e908e95e010ef916ee77613 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 8 Oct 2026 10:25:11 +0100
Subject: [PATCH 121/148] authority: capacity protects what is in force, not a
 kind; resolves are paced, not forced (re-review R1, R2)

Re-review of 390b4af (SHIP-WITH-FIXES), the founder's ruling.

R1. _evict protected statements by kind: no revoke or anchor-level statement was ever a candidate,
whatever its status. Validity is static, so a removed admin could sign any number of valid, dead
revokes (and an in-force one over-quota ones): held, persisted, never evicted, displacing honest
in-force grants and growing the disk without bound. Now:
- a pass drops everything outside the live set first, whatever its kind (a dead or over-quota revoke,
  a dead anchor-level statement), last in authority order first; dropping what is not live changes
  no status of what stays, so the pass's one resolution stays good;
- then live statements in reverse authority order, skipping only in-force revokes and in-force
  anchor-level statements (the quotas bound those);
- the arriving statement is judged with the rest, so it is protected only if it is in force;
- where what is left is protected, the next pass waits until EVICT_SLACK more have arrived, so a
  full store never costs a resolve per arrival;
- the statement file is compacted once it holds twice what the store keeps (plus what it keeps
  unverified), so the disk is bounded by the store.

R2. _answered forced a full resolve whenever a pull ended. Now a pull's end is decided against a
settled resolution: at once when nothing it brought is unsettled, else at the next settle (paced at
twice the last resolution's time). Eviction resolves once per pass (above).

Lows: a closing session gives back an outstanding ask's reservation; an answer's slices run in
try/finally, so a throw gives the ask up and refunds it instead of leaving the session unable to ask.

Tests: authority-attacks: 2,000 dead revokes from a removed admin keep the store at its bound, its
file compacted and one resolve per pass; 2,000 over-quota revokes from an in-force admin are kept only
to the bucket's quota of 256; 400 dead revokes leave all 241 honest statements in force; the old
"held past the bound" test now states in-force protection. authority-node: a pull end resolves
nothing (the settle decides); a closing session refunds; a throwing answer leaves the session free.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QRVMpaJkAA2fFbvuHCEzqH
---
 lib/authority-store.js          | 118 +++++++++++++++++++++++---------
 lib/node-authority.js           |  69 ++++++++++++++-----
 tests/authority-attacks.test.js |  74 ++++++++++++++++++--
 tests/authority-node.test.js    |  50 ++++++++++++++
 4 files changed, 255 insertions(+), 56 deletions(-)

diff --git a/lib/authority-store.js b/lib/authority-store.js
index aac9ae3e..50421c97 100644
--- a/lib/authority-store.js
+++ b/lib/authority-store.js
@@ -22,10 +22,13 @@
  *     that may rescue it, charged to that endorser's bucket, falling through to the next endorser by id
  *     when a bucket is full; a statement cut off by a quota is never rescued.
  *   - THE LIVE SET and THE ROOT (§6.6.7); authority order, fetch answers and pages (§6.6.8).
- *   - CAPACITY (§6.6.6, errata 1): at most MAX_HELD statements. Past it the store drops what is not
- *     in the live set first, then what comes last in authority order (deepest first, grants before
- *     revokes and endorses, highest id first); an anchor-level statement or a revoke is never dropped
- *     or refused, so the removal that would clean a flooded store up is always taken.
+ *   - CAPACITY (§6.6.6, errata 1): at most MAX_HELD statements, beyond which only in-force revokes
+ *     and in-force anchor-level statements are kept (the quotas bound them). Past the bound the store
+ *     drops everything outside the live set first, whatever its kind (a dead or over-quota revoke is
+ *     an ordinary candidate), then live statements in reverse authority order (deepest first, grants
+ *     before revokes and endorses, highest id first), skipping only in-force revokes and in-force
+ *     anchor-level statements. So a removal that is in force is always kept, and one signer's dead
+ *     statements never displace another's authority.
  *   - PERSISTENCE: one file of statements, with no integrity of its own and independent of the pin.
  *     At load each is judged again against the pin in force now and the set resolved afresh; a
  *     statement that does not count under this pin (a mistyped pin, a re-pin, a chain not yet held)
@@ -45,9 +48,9 @@ const A = require('./core/authority');
 const FILE = 'statements.jsonl';
 /**
  * Statements held at most (§6.6.7: a node MUST keep its live set and MAY drop the rest; past this
- * bound it cannot keep everything, and drops in reverse authority order, the live set last: see
- * `_evict`). Eviction frees EVICT_SLACK below the bound at once, so its sort is paid once per that
- * many arrivals, not per arrival.
+ * bound it cannot keep everything: see `_evict`). One eviction pass resolves once and frees EVICT_SLACK
+ * below the bound (or, when what is left is protected, the next pass waits until that many more have
+ * arrived), so a pass, its resolution and its sort are paid once per EVICT_SLACK arrivals.
  */
 const MAX_HELD = 200_000;
 const evictSlack = (max) => Math.max(1, Math.ceil(max / 64));
@@ -84,6 +87,9 @@ class AuthorityStore {
     this._loading = false;
     this._loadReport = { held: 0, pending: 0, invalid: 0, unverified: 0, corrupt: 0 };
     this._capacity = { evicted: 0, refused: 0, liveDropped: 0 };
+    this._protectedFloor = 0; // the size a pass could not get below (what is left is protected)
+    this._fileLines = 0;      // statements the file holds, held or not, to know when to compact it
+    this._unverifiedLines = []; // lines kept from the file that do not count under this pin (as bytes)
     if (this._dir) this._load();
   }
 
@@ -96,6 +102,8 @@ class AuthorityStore {
   capacityReport() { return { ...this._capacity }; }
   /** How long the last resolution took (a node paces its settles by it). */
   get lastResolveMs() { return this._lastResolveMs; }
+  /** Whether the held set changed since the last resolution. */
+  get dirty() { return this._dirty || !this._resolved; }
   size() { return this._held.size; }
   has(id) { return this._held.has(id); }
   /** A held statement (its canonical form, with the signature entries that counted), or null. */
@@ -107,8 +115,8 @@ class AuthorityStore {
   /**
    * Check one statement and hold it if it is valid.
    * @returns {{ result: 'held'|'duplicate'|'pending'|'invalid'|'over-capacity', id?: string, reason?: string, missing?: string }}
-   *   'over-capacity': valid, but the store is full and it comes last in authority order (never an
-   *   anchor-level statement or a revoke); it says nothing against the statement or who sent it
+   *   'over-capacity': valid, but the store is full and it is what an eviction pass dropped (never
+   *   an in-force revoke or anchor-level statement); it says nothing against the statement or who sent it
    */
   ingest(statement) {
     const bad = A.malformedReason(statement);
@@ -120,9 +128,9 @@ class AuthorityStore {
     if (v.result !== 'valid') return { ...v, id };
     this._held.set(id, v.entry);
     this._changed();
-    if (this._held.size > this._maxHeld && this._evict(id).has(id)) {
+    if (this._held.size > Math.max(this._maxHeld, this._protectedFloor + evictSlack(this._maxHeld)) && this._evict(id).has(id)) {
       this._capacity.refused++;
-      return { result: 'over-capacity', id, reason: 'the store is full, and this statement comes last in authority order' };
+      return { result: 'over-capacity', id, reason: 'the store is full, and an eviction pass dropped this statement' };
     }
     this._append(v.entry.s);
     return { result: 'held', id };
@@ -473,35 +481,54 @@ class AuthorityStore {
   // ── Capacity and persistence ──────────────────────────────────────────────────
 
   /**
-   * @private Over MAX_HELD (§6.6.6, node capacity): drop down to EVICT_SLACK below it, what is not live
-   * first, then what comes last in authority order (deepest, grants before revokes and endorses at a
-   * depth, highest id). An anchor-level statement or a revoke is never dropped or refused: one always
-   * gets in, displacing the last in that order, so a full node loses the deepest delegated authority,
-   * never a removal. The statement arriving (`incomingId`) is a candidate like any other. One sort per
-   * batch, not per arrival. A node that drops live statements no longer resolves the set its peers
-   * do, and it says so.
+   * @private One eviction pass (§6.6.6, node capacity, errata 1), down to EVICT_SLACK below the bound.
+   * It resolves once, then drops:
+   *   1. everything outside the live set, whatever its kind (a dead or over-quota revoke, a dead
+   *      anchor-level statement), last in authority order first. Dropping what is not live changes no
+   *      status of what stays, so the resolution stays good;
+   *   2. if that is not enough, live statements in reverse authority order (deepest first, grants
+   *      before revokes and endorses, highest id first), skipping in-force revokes and in-force
+   *      anchor-level statements: a removal in force is never dropped. The quotas bound those.
+   * The statement arriving (`incomingId`) is judged with the rest: protected only if it is in force.
+   * Where what is left is protected, the next pass waits until EVICT_SLACK more have arrived. A node
+   * that drops live statements no longer resolves the set its peers do, and it says so.
    * @returns {Set<string>} the ids dropped
    */
   _evict(incomingId) {
     const dropped = new Set();
-    const n = this._held.size - Math.max(0, this._maxHeld - evictSlack(this._maxHeld));
+    const target = Math.max(0, this._maxHeld - evictSlack(this._maxHeld));
+    let n = this._held.size - target;
     if (n <= 0) return dropped;
-    const { live } = this.resolve();
-    const candidates = [];
-    for (const e of this._held.values()) if (e.authBy !== 'anchor' && e.kind !== 'revoke') candidates.push(e);
-    candidates.sort((x, y) => ((live.has(x.id) ? 1 : 0) - (live.has(y.id) ? 1 : 0)) || orderCmp(y, x));
+    const r = this.resolve();
+    const outside = [];
+    const inside = [];
+    for (const e of this._held.values()) {
+      if (!r.live.has(e.id)) outside.push(e);
+      else if (!(r.inForce.has(e.id) && (e.authBy === 'anchor' || e.kind === 'revoke'))) inside.push(e);
+    }
+    const last = (x, y) => orderCmp(y, x);
+    outside.sort(last);
+    for (const e of outside.slice(0, n)) { this._held.delete(e.id); dropped.add(e.id); r.status.delete(e.id); }
+    n -= dropped.size;
     let liveDropped = 0;
-    for (const e of candidates.slice(0, n)) {
-      this._held.delete(e.id);
-      dropped.add(e.id);
-      if (live.has(e.id) && e.id !== incomingId) liveDropped++;
+    if (n > 0) {
+      inside.sort(last);
+      for (const e of inside.slice(0, n)) {
+        this._held.delete(e.id);
+        dropped.add(e.id);
+        if (e.id !== incomingId) liveDropped++;
+      }
     }
+    this._protectedFloor = this._held.size > target ? this._held.size : 0;
     this._capacity.evicted += dropped.size - (dropped.has(incomingId) ? 1 : 0);
     this._capacity.liveDropped += liveDropped;
     if (this._loading && this._loadEvicted) for (const id of dropped) this._loadEvicted.add(id);
-    this._changed();
+    // Only statements outside the live set went: the resolution holds for what stays.
+    this._version = (this._version || 0) + 1;
+    if (liveDropped || dropped.has(incomingId) && r.live.has(incomingId)) this._changed();
     if (liveDropped) this._log(`[sym-authority] the store is over ${this._maxHeld} statements: ${liveDropped} live statement(s) dropped, deepest first; this node no longer resolves the same set as its peers`);
     else if (dropped.size) this._log(`Authority store over ${this._maxHeld}: ${dropped.size} statement(s) outside the live set dropped`);
+    this._maybeCompact();
     return dropped;
   }
 
@@ -530,6 +557,7 @@ class AuthorityStore {
       }
       const buf = Buffer.from(`${lead}${JSON.stringify(s)}\n`, 'utf8');
       for (let off = 0; off < buf.length;) off += fs.writeSync(fd, buf, off, buf.length - off);
+      this._fileLines++;
     } catch {
       if (fd !== null) { try { fs.ftruncateSync(fd, size); } catch { /* best effort */ } }
     } finally {
@@ -537,6 +565,31 @@ class AuthorityStore {
     }
   }
 
+  /**
+   * @private The file holds every statement ever appended; one dropped for capacity stays there until
+   * the file is rewritten. Rewrite it (the held statements and the lines kept from it as unverified)
+   * once it holds twice what that would be, so the disk is bounded by what the store keeps, at a cost
+   * paid once per that many appends.
+   */
+  _maybeCompact() {
+    if (!this._dir || this._loading) return;
+    const keep = this._held.size + this._unverifiedLines.length;
+    if (this._fileLines <= 2 * keep + evictSlack(this._maxHeld)) return;
+    this._writeFile([...[...this._held.values()].map((e) => JSON.stringify(e.s)), ...this._unverifiedLines]);
+  }
+
+  /** @private Replace the file with `lines` (atomically, best effort). */
+  _writeFile(lines) {
+    const file = path.join(this._dir, FILE);
+    try {
+      fs.mkdirSync(this._dir, { recursive: true });
+      const tmp = `${file}.${process.pid}.tmp`;
+      fs.writeFileSync(tmp, lines.join('\n') + (lines.length ? '\n' : ''), { mode: 0o600 });
+      fs.renameSync(tmp, file);
+      this._fileLines = lines.length;
+    } catch { /* best effort */ }
+  }
+
   /**
    * @private Read the one statement file and judge every statement again against the pin in force,
    * chain by chain: offered in passes until one holds nothing more, so file order does not matter.
@@ -559,7 +612,7 @@ class AuthorityStore {
       if (A.shapeReason(s)) { this._loadReport.corrupt++; continue; }
       entries.push({ line, s });
     }
-    if (!this._pin) { this._loadReport.unverified = entries.length; return; }
+    if (!this._pin) { this._loadReport.unverified = entries.length; this._fileLines = entries.length; return; }
     this._loading = true;
     this._loadEvicted = new Set(); // dropped for capacity during this load: not written back
     try {
@@ -589,14 +642,11 @@ class AuthorityStore {
       if (this._held.has(id) && entriesWithin(e.s.sigs, this._held.get(id).s.sigs)) continue;
       written.add(e.line);
       out.push(e.line);
+      this._unverifiedLines.push(e.line);
       this._loadReport.unverified++;
     }
     this._loadEvicted = null;
-    try {
-      const tmp = `${file}.${process.pid}.tmp`;
-      fs.writeFileSync(tmp, out.join('\n') + (out.length ? '\n' : ''), { mode: 0o600 });
-      fs.renameSync(tmp, file);
-    } catch { /* best effort */ }
+    this._writeFile(out);
   }
 }
 
diff --git a/lib/node-authority.js b/lib/node-authority.js
index 73027a27..14fafda0 100644
--- a/lib/node-authority.js
+++ b/lib/node-authority.js
@@ -483,7 +483,11 @@ const methods = {
     // A pull this session was in the middle of resumes from its cursor on the peer's next session.
     if (session._authPull && session._authPull.after) this._authorityRemember(session.nodeId, session._authPull.after);
     for (const p of (session._authPending || new Map()).values()) clearTimeout(p.timer);
-    if (session._authAsk) clearTimeout(session._authAsk.timer);
+    // An ask still out gives back its reservation: the peer's lane is shared by its other sessions.
+    // (An answer being verified gives it back itself when its next slice finds the session closed.)
+    const out = session._authAsk;
+    if (out) { clearTimeout(out.timer); if (!out.answering) { this._gossipRefund(session.nodeId, out.left); out.left = 0; } }
+    if (this._authorityPullEnds) this._authorityPullEnds.delete(session);
     for (const t of [session._authPumpTimer, session._authRepullTimer, session._authDigestTimer, session._authServeTimer]) if (t) clearTimeout(t);
     session._authPending = null; session._authAsk = null; session._authAsked = null; session._authPull = null;
     session._authPumpTimer = null; session._authRepullTimer = null; session._authServeQueue = null; session._authServeTimer = null;
@@ -548,6 +552,12 @@ const methods = {
       try { this.emit('authority-changed', Object.freeze({ root: this._authority.root(), inForce: inForce.size })); } catch { /* a listener must not stop the settle */ }
     }
     this._authoritySettledAt = Date.now();
+    // Pulls that ended before what they brought was settled: decided now, against this resolution.
+    if (this._authorityPullEnds && this._authorityPullEnds.size) {
+      const ends = [...this._authorityPullEnds];
+      this._authorityPullEnds.clear();
+      for (const [session, pull] of ends) this._authorityPullEnded(session, pull);
+    }
   },
 
   /** @private authority-digest on `session`, at most once a second (§6.6.8). */
@@ -738,18 +748,32 @@ const methods = {
     // never holds the event loop for long (64 fresh-key statements are some 130 scalar multiplications).
     const statements = msg.statements;
     let i = 0;
+    // However a slice ends (done, the session closed, or a throw no input should cause), the ask is
+    // given up and what it did not spend goes back: the session is never left unable to ask again.
+    const finish = (complete) => {
+      if (session._authAsk === ask) session._authAsk = null;
+      if (complete && !session.closed) this._answered(session, ask, msg);
+      else { this._gossipRefund(session.nodeId, ask.left); ask.left = 0; }
+    };
     const slice = () => {
-      if (session.closed) { session._authAsk = null; this._gossipRefund(session.nodeId, ask.left); return; }
-      let spent = 0;
-      while (i < statements.length && spent < SLICE_COST) {
-        const st = statements[i++];
-        const before = ask.left;
-        this._ingestAuthority(st, session, { ask });
-        spent += Math.max(1, before - ask.left);
+      let more = false;
+      let complete = false;
+      try {
+        if (session.closed) return;
+        let spent = 0;
+        while (i < statements.length && spent < SLICE_COST) {
+          const st = statements[i++];
+          const before = ask.left;
+          this._ingestAuthority(st, session, { ask });
+          spent += Math.max(1, before - ask.left);
+        }
+        if (i < statements.length) { more = true; setImmediate(slice); return; }
+        complete = true;
+      } catch (err) {
+        this._log(`Authority: an answer from ${String(session.nodeId).slice(0, 8)} could not be taken (${err && err.message})`);
+      } finally {
+        if (!more) finish(complete);
       }
-      if (i < statements.length) { setImmediate(slice); return; }
-      session._authAsk = null;
-      this._answered(session, ask, msg);
     };
     slice();
   },
@@ -764,17 +788,28 @@ const methods = {
       if (next) { pull.after = next; pull.attempt = 0; pull.want = true; }
       else {
         session._authPull = null;
-        const root = this._authority.resolve().root;
-        if (session._authPeerRoot && session._authPeerRoot !== root) {
-          // A pull that resumed mid-way saw only the rest of the set: the next one starts from the top.
-          if (pull.digestSeen || pull.resumed) this._startAuthorityPull(session);
-          else this._scheduleAuthorityRepull(session);
-        } else this._authorityRootsMet(session);
+        // Whether the roots now meet is read from a settled resolution, never a fresh one forced here
+        // (a responder that ends every pull after one page would otherwise buy a full resolve per
+        // page): if what the pull brought is not settled yet, the next settle decides.
+        if (this._authority.dirty) {
+          (this._authorityPullEnds || (this._authorityPullEnds = new Map())).set(session, pull);
+          this._scheduleAuthoritySettle();
+        } else this._authorityPullEnded(session, pull);
       }
     }
     this._authorityPump(session);
   },
 
+  /** @private A pull ended: if the roots still differ, pull again (at once after a digest or a resumed pull, else after a backoff). */
+  _authorityPullEnded(session, pull) {
+    if (session.closed) return;
+    if (session._authPeerRoot && session._authPeerRoot !== this._authority.root()) {
+      // A pull that resumed mid-way saw only the rest of the set: the next one starts from the top.
+      if (pull.digestSeen || pull.resumed) this._startAuthorityPull(session);
+      else this._scheduleAuthorityRepull(session);
+    } else this._authorityRootsMet(session);
+  },
+
   /** @private A retired time-replay frame (§6.6.11): ignored, counted, said once a minute per peer. */
   _onRetiredAuthorityFrame(session, type) {
     this._authorityStats.retired++;
diff --git a/tests/authority-attacks.test.js b/tests/authority-attacks.test.js
index efe89747..fb53f876 100644
--- a/tests/authority-attacks.test.js
+++ b/tests/authority-attacks.test.js
@@ -10,6 +10,9 @@
 const { describe, it } = require('node:test');
 const assert = require('node:assert');
 const crypto = require('crypto');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
 const A = require('../lib/core/authority');
 const { AuthorityStore, lifecycleOf } = require('../lib/authority-store');
 
@@ -349,7 +352,7 @@ describe('§6.6 capacity: a full store keeps what comes first in authority order
     assert.deepStrictEqual([...st.resolve().inForce].sort(), [...unbounded.resolve().inForce].sort());
   });
 
-  it('a deep grant that comes last in a full store is refused, as over capacity; an anchor-level grant or a revoke never is', () => {
+  it('a deep grant that comes last in a full store is refused, as over capacity; an in-force anchor-level grant or revoke never is', () => {
     const gA = grant('anchor', party(), 'admin');
     const sub = grant(gA, party(), 'admin');
     const st = new AuthorityStore({ pin: PIN, maxHeld: 100 });
@@ -362,22 +365,83 @@ describe('§6.6 capacity: a full store keeps what comes first in authority order
     while (st.size() < 100) st.ingest(grant(gA, party(), 'participant'));
     assert.strictEqual(st.ingest(grant('anchor', party(), 'validator')).result, 'held');
     while (st.size() < 100) st.ingest(grant(gA, party(), 'participant'));
-    const r = revoke(sub, [sub]); // a revoke at depth 3: also last in order, never refused
+    // A revoke in force in gA's bucket (sub itself may have gone in a pass: it is a live grant like any).
+    const r = make(gA, { kind: 'revoke', targets: [`auth-${crypto.randomBytes(32).toString('hex')}`] });
     assert.strictEqual(st.ingest(r).result, 'held');
+    assert.strictEqual(st.statusOf(id(r)), 'in-force');
   });
 
-  it('an anchor-level statement or a revoke is never dropped either (MMP §6.6 errata 1): the store holds them past its bound', () => {
+  it('in-force anchor-level statements and in-force revokes are kept past the bound; the quotas bound them', () => {
     const st = new AuthorityStore({ pin: PIN, maxHeld: 30 });
     const top = Array.from({ length: 25 }, () => grant('anchor', party(), 'admin'));
     for (const g of top) st.ingest(g);
-    const revokes = top.slice(0, 10).map((g) => revoke(g, [g])); // depth 2, last in order among removals
+    const revokes = top.slice(0, 10).map((g) => revoke(g, [g])); // in force, each in its own bucket
     for (const r of revokes) assert.strictEqual(st.ingest(r).result, 'held');
     for (const g of top.slice(10)) for (let i = 0; i < 3; i++) st.ingest(grant(g, party(), 'participant'));
-    for (const x of [...top, ...revokes]) assert.strictEqual(st.has(id(x)), true, 'anchor-level statements and revokes stay');
+    for (const x of [...top, ...revokes]) assert.strictEqual(st.has(id(x)), true, 'in-force removals and anchor-level statements stay');
     assert.ok(st.size() >= 35, 'past the bound, since nothing else is left to drop');
     assert.ok(st.capacityReport().liveDropped > 0 || st.capacityReport().refused > 0, 'the grants below went');
   });
 
+  // The re-review of 390b4af (rr-capacity-revokes, rr-capacity-displace): validity is static, so a
+  // removed admin can sign any number of valid, dead revokes, and an in-force one any number of
+  // over-quota ones. They are ordinary candidates: outside the live set, the first to go.
+  function capacityScene(variant) {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'auth-cap-'));
+    const st = new AuthorityStore({ pin: PIN, maxHeld: 200, dir });
+    const gA = grant('anchor', party(), 'admin');
+    st.ingest(gA);
+    if (variant === 'dead') st.ingest(revoke('anchor', [gA]));
+    let resolves = 0;
+    const resolve = st.resolve.bind(st);
+    st.resolve = () => { if (st.dirty) resolves++; return resolve(); };
+    for (let i = 0; i < 2000; i++) {
+      const r = make(gA, { kind: 'revoke', targets: [`auth-${crypto.randomBytes(32).toString('hex')}`] });
+      st.ingest(r);
+    }
+    st.resolve = resolve;
+    const lines = fs.readFileSync(path.join(dir, 'statements.jsonl'), 'utf8').trim().split('\n').length;
+    const reloaded = new AuthorityStore({ pin: PIN, maxHeld: 200, dir });
+    fs.rmSync(dir, { recursive: true, force: true });
+    return { st, resolves, lines, reloaded, gA };
+  }
+  const SLACK = Math.ceil(200 / 64);
+
+  it('2,000 dead revokes from a removed admin: the store stays at its bound, on disk too, and an arrival does not cost a resolve', () => {
+    const { st, resolves, lines, reloaded } = capacityScene('dead');
+    assert.ok(st.size() <= 200 + SLACK, `held ${st.size()}`);
+    assert.ok(reloaded.size() <= 200 + SLACK, `after a reload ${reloaded.size()}`);
+    // Compacted once it holds twice what the store keeps; appends run on until the next pass.
+    assert.ok(lines <= 2 * (200 + SLACK) + 2 * SLACK + 2, `the file holds ${lines} lines: compacted, not growing`);
+    assert.ok(resolves <= 2000 / SLACK + 5, `${resolves} resolves for 2,000 arrivals: one per eviction pass, not per arrival`);
+  });
+
+  it('2,000 over-quota revokes from an in-force admin: kept past the bound only as far as its bucket\'s quota', () => {
+    const { st, lines, reloaded, gA, resolves } = capacityScene('over-quota');
+    assert.ok(resolves <= 2000 / SLACK + 5, `${resolves} resolves for 2,000 arrivals: a full store of protected statements waits a batch between passes`);
+    const inForce = [...st.resolve().inForce].filter((x) => st._held.get(x).authBy === id(gA)).length;
+    assert.strictEqual(inForce, 256, 'the bucket keeps its quota of revokes in force');
+    assert.ok(st.size() <= 1 + 256 + SLACK, `held ${st.size()}: the in-force revokes, bounded by the quota, and no more`);
+    assert.ok(reloaded.size() <= 1 + 256 + SLACK);
+    assert.ok(lines <= 2 * (1 + 256 + SLACK) + 2 * SLACK + 2, `the file holds ${lines} lines`);
+  });
+
+  it('dead revokes never displace an honest tree in force (one signer never displaces another)', () => {
+    const st = new AuthorityStore({ pin: PIN, maxHeld: 300 });
+    const honest = [];
+    const gW = grant('anchor', party(), 'admin'); honest.push(gW);
+    for (let i = 0; i < 15; i++) { const gI = grant(gW, party(), 'issuer'); honest.push(gI); for (let j = 0; j < 15; j++) honest.push(grant(gI, party(), 'participant')); }
+    for (const x of honest) st.ingest(x);
+    assert.strictEqual(honest.filter((x) => st.statusOf(id(x)) === 'in-force').length, 241);
+    const gX = grant('anchor', party(), 'admin');
+    st.ingest(gX); st.ingest(revoke('anchor', [gX]));
+    for (let i = 0; i < 400; i++) st.ingest(make(gX, { kind: 'revoke', targets: [`auth-${crypto.randomBytes(32).toString('hex')}`] }));
+    const r = st.resolve();
+    assert.strictEqual(honest.filter((x) => r.inForce.has(id(x))).length, 241, 'every honest statement still in force');
+    assert.ok(st.size() <= 300 + Math.ceil(300 / 64));
+    assert.strictEqual(st.capacityReport().liveDropped, 0);
+  });
+
   it('what is not live goes first, then the last in authority order; one sort frees a batch', () => {
     const gA = grant('anchor', party(), 'admin');
     const gB = grant('anchor', party(), 'admin');
diff --git a/tests/authority-node.test.js b/tests/authority-node.test.js
index 336cfda4..6545b5e2 100644
--- a/tests/authority-node.test.js
+++ b/tests/authority-node.test.js
@@ -519,6 +519,56 @@ describe('§6.6.8: the asking rule, exactly', () => {
     } finally { await stopAll(); }
   });
 
+  it('a pull that ends is decided against a settled resolution, never one forced as the answer ends (re-review R2)', async () => {
+    try {
+      const N4 = node('r2-pull', { gossipBudget: { newLane: 1e6, burst: 1e6 } });
+      const s = admitAs(N4, identity('r2-peer'));
+      N4._sessions.add(s);
+      deliver(N4, s, { type: 'authority-digest', root: 'e'.repeat(64), count: 1 });
+      const ask = s.sent.find((f) => f.type === 'authority-fetch');
+      let forced = 0;
+      const resolve = N4._authority.resolve.bind(N4._authority);
+      N4._authority.resolve = () => { if (N4._authority.dirty) forced++; return resolve(); };
+      deliver(N4, s, { type: 'authority-set', reqId: ask.reqId, statements: [grant('anchor', party(), 'participant')] });
+      assert.strictEqual(forced, 0, 'taking the answer, and ending the pull, resolved nothing');
+      await until(() => N4.authorityStatus().inForce === 1, 2000);
+      await until(() => !!s._authRepullTimer, 2000);
+      assert.ok(s._authRepullTimer, 'the settle decided it: the roots differ, so a re-pull is due');
+      assert.ok(forced <= 1, 'one resolve, the settle\'s');
+    } finally { await stopAll(); }
+  });
+
+  it('an answer that throws part way leaves the session able to ask again, its reservation given back', async () => {
+    try {
+      const N6 = node('throw', { gossipBudget: { newLane: 1e6, burst: 1e6 } });
+      const s = admitAs(N6, identity('throw-peer'));
+      N6._sessions.add(s);
+      deliver(N6, s, { type: 'authority-digest', root: '9'.repeat(64), count: 1 });
+      const ask = s.sent.find((f) => f.type === 'authority-fetch');
+      const t = N6._gossipBuckets.get(s.nodeId).tokens;
+      const real = N6._ingestAuthority;
+      N6._ingestAuthority = () => { throw new Error('a fault no input should cause'); };
+      deliver(N6, s, { type: 'authority-set', reqId: ask.reqId, statements: [grant('anchor', party(), 'participant')] });
+      N6._ingestAuthority = real;
+      assert.strictEqual(s._authAsk, null, 'the ask is given up');
+      assert.ok(N6._gossipBuckets.get(s.nodeId).tokens >= t + 2112 - 1, 'and its reservation given back');
+    } finally { await stopAll(); }
+  });
+
+  it('a closing session gives back the reservation of an ask still out', async () => {
+    try {
+      const N5 = node('refund', { gossipBudget: { newLane: 1e6, burst: 1e6 } });
+      const s = admitAs(N5, identity('refund-peer'));
+      N5._sessions.add(s);
+      const before = () => N5._gossipBuckets.get(s.nodeId).tokens;
+      deliver(N5, s, { type: 'authority-digest', root: 'f'.repeat(64), count: 1 });
+      assert.ok(s._authAsk, 'an ask is out');
+      const t = before();
+      N5._authorityReleaseSession(s);
+      assert.ok(before() >= t + 2112 - 1, 'its reservation went back to the lane');
+    } finally { await stopAll(); }
+  });
+
   it('one ask in flight per session: a pending statement\'s fetch waits for the pull page out', async () => {
     try {
       const N2 = node('one-ask', { gossipBudget: { newLane: 1e6, burst: 1e6 } });

From 1da1e45d2ca0884a9825fffc2351f8b06b4b4e5b Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 8 Oct 2026 10:25:11 +0100
Subject: [PATCH 122/148] docs: capacity keeps what is in force, and resolves
 are paced (re-review R1, R2)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

SECURITY.md, the CHANGELOG and WIRE §3: at most 200,000 statements held, and beyond that only
in-force revokes and in-force anchor-level statements, which the quotas bound; a dead or over-quota
revoke is an ordinary candidate; the file is compacted. Resolving is not charged to a lane but paced:
at settles, a pull's end decided at the next settle, one resolve per eviction pass.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QRVMpaJkAA2fFbvuHCEzqH
---
 CHANGELOG.md        | 24 +++++++++++++++---------
 SECURITY.md         | 23 +++++++++++++++--------
 docs/WIRE-0.14.0.md | 16 +++++++++++-----
 3 files changed, 41 insertions(+), 22 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e325f1b9..5ad5da20 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -42,13 +42,16 @@ carried (cutoffs, ratification, budgets per delegation subtree, `role-chain-fetc
   statement a revoke cut off is rescued only by an in-force endorse from above, charged to the
   endorser's bucket and falling through by id; a quota cut is never rescued. The live set and the
   authority root. (lib/authority-store.js)
-- **Capacity (errata 1).** At most 200,000 statements held. Past that the store drops what is not
-  live first, then what comes last in authority order (deepest first, grants before revokes and
-  endorses, highest id first), freeing a batch at a time so its sort is paid once per batch. An
-  anchor-level statement or a revoke is never dropped or refused, so the removal that would clean up
-  a flooded store is always taken. A statement refused for capacity (`over-capacity`) says nothing
-  against its sender. Dropping live statements is said in the log and counted
-  (`authorityStatus().capacity`).
+- **Capacity (errata 1).** At most 200,000 statements held, and beyond that only in-force revokes and
+  in-force anchor-level statements, which the quotas bound. Past the bound the store drops
+  everything outside the live set first, whatever its kind (a dead or over-quota revoke is an
+  ordinary candidate), then live statements in reverse authority order (deepest first, grants before
+  revokes and endorses, highest id first), skipping only in-force revokes and in-force anchor-level
+  statements. So the removal that would clean up a flooded store is always taken, and one signer's
+  dead statements never displace another's authority. A pass resolves once and frees a batch; the
+  statement file is compacted once it holds twice what the store keeps. A statement refused for
+  capacity (`over-capacity`) says nothing against its sender. Dropping live statements is said in
+  the log and counted (`authorityStatus().capacity`).
 - **Persistence.** One file, `authority/statements.jsonl`, whatever the pin. At load every statement
   is judged again against the pin in force; what does not count under it (a mistyped pin, a re-pin,
   a chain not yet held) stays in the file as the bytes it was, never deleted, so a corrected pin, or
@@ -84,7 +87,9 @@ carried (cutoffs, ratification, budgets per delegation subtree, `role-chain-fetc
   (`authority-foreign-self-key`). A received record's origin weight, `validateCMB` and `canonizeCMB`
   (judged on that CMB's own fields; a scoped grant only inside its scope, through the host's
   `authorityScopes`) and attestation weights are judged against the in-force set when applied. A
-  node resolves when it settles, at most once per twice the time its last resolution took.
+  node resolves when it settles, at most once per twice the time its last resolution took; a pull's
+  end is decided at the next settle, and an eviction pass resolves once per batch of arrivals, so no
+  peer buys a resolve per frame.
 - **One Ed25519 rule (§18.3.2)** for every signature sym checks: records, handshake proofs,
   attestations, checkpoints, witnesses, room-join grants, tether attestations, relocation bundles
   and authority statements (lib/core/ed25519.js). Handshake keys are taken only in canonical
@@ -201,7 +206,8 @@ Five findings and the open leads, each fixed where its assumption was made (the
 `docs/DESIGN-core-secure-identity.md` on branch `design/0.14.0-core-secure-identity`). N2, N4 and N5
 (revoke cutoffs, caps that refused revokes, the 0.13 grant store) went with the time-replay rule;
 MMP §6.6 (above) has no cutoff, a bucket keeps its revokes and endorses before its grants, a full
-store never refuses a revoke, and the 0.13 store is read only as plain data, never rewritten.
+store never refuses or drops a revoke that is in force, and the 0.13 store is read only as plain data,
+never rewritten.
 
 - **A failed signature is charged only to a session that signed in its own name (N1).** Bindings are
   local views: a relayed statement is verified under this node's binding for its signer, which may
diff --git a/SECURITY.md b/SECURITY.md
index f864ec83..1bca21cc 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -148,13 +148,17 @@ Every store a peer can feed has a fixed bound. Reaching one never stops the node
   conflicts: at most 8 kept per nodeId and 1,024 in all, every one counted
   (`status().coreSecure.keyConflicts`).
 - **Authority statements** (MMP §6.6): what is in force is bounded by the quotas above. What is
-  held: at most 200,000 statements. Past that the store drops what is not in the live set first,
-  then what comes last in authority order (deepest first, grants before revokes and endorses,
-  highest id first), a batch at a time; an arriving anchor-level statement or revoke is never the
-  one refused or dropped, so a revoke that removes a flooding authority is always taken; dropping
-  live statements is logged and counted. A statement is at most 16 signature entries (their keys
-  unique: MMP §6.6 errata 1), 64 targets and a 256-character scope, in the schema's shape (anything
-  else is refused before any work). A statement whose chain is not held is pending: at most 64 held per
+  held: at most 200,000 statements, and beyond that only in-force revokes and in-force anchor-level
+  statements, which the quotas bound. Past the bound the store drops everything outside the live set
+  first, whatever its kind (a dead or over-quota revoke is an ordinary candidate), then live
+  statements in reverse authority order (deepest first, grants before revokes and endorses, highest
+  id first), skipping only in-force revokes and in-force anchor-level statements. So a revoke that
+  removes a flooding authority is always taken, and one signer's dead statements never displace
+  another's authority. A pass resolves once and frees a batch, so its cost is paid once per
+  thousands of arrivals at the default bound, and the file is compacted as it goes, so the disk is
+  bounded too. Dropping live statements is logged and counted. A statement is at most 16 signature
+  entries (their keys unique: MMP §6.6 errata 1), 64 targets and a 256-character scope, in the
+  schema's shape (anything else is refused before any work). A statement whose chain is not held is pending: at most 64 held per
   session (checked before its signature is), keyed by id and signing key, for at most 10 s or until
   the session closes, never persisted, relayed or counted. An `authority-set` carries at most 64
   statements. A node answers `authority-fetch` at 4 a second per session (burst 16); over that a
@@ -168,7 +172,10 @@ Every store a peer can feed has a fixed bound. Reaching one never stops the node
   multiplication), so at most 33; a repeat or a statement not of the shape spends nothing. Every
   statement a session delivers spends its lane, asked for or not: this node asks only when the lane
   holds a full page's worst case (64 × 33 = 2,112), and reserves it until the answer, so an answer
-  is never dropped for budget and never spends more than the lane holds. A ceiling of 4,000
+  is never dropped for budget and never spends more than the lane holds. Resolving, which is linear
+  in the held set and not charged to any lane, is paced instead: a node resolves when it settles, at
+  most once per twice the time its last resolution took, and a pull's end is decided at the next
+  settle, never by a resolution forced for it. A ceiling of 4,000
   verified statements a second in all (burst 20,000) is spent only after the check; checkpoints at most
   4 a second per attester (burst 128); at most 1,024 attesters, 32 checkpoints each, 256 witnesses
   per position.
diff --git a/docs/WIRE-0.14.0.md b/docs/WIRE-0.14.0.md
index 6aa0252d..9f54678b 100644
--- a/docs/WIRE-0.14.0.md
+++ b/docs/WIRE-0.14.0.md
@@ -107,17 +107,23 @@ counted (`authorityStatus().stats.retired`), and they are never sent. Nothing in
   paid from the reservation and what it did not spend goes back. One ask is in flight per session.
   So an answer is never dropped for budget, and nothing the peer sends makes this node verify more
   than the peer's lane pays for, whatever triggered the ask (a digest, a pending statement, the
-  answer before). An answer is verified in slices, the event loop free between them.
+  answer before). An answer is verified in slices, the event loop free between them. Resolving the
+  set is not charged to a lane; it is paced: a node resolves when it settles, at most once per twice
+  its last resolution's time, a pull's end is decided at the next settle (never by a resolution forced
+  for it), and an eviction pass resolves once per batch of arrivals.
 - **Pulls.** An unanswered page is asked again from the same cursor, up to 3 times. A digest that
   arrives during a pull is remembered, and if the roots still differ when the pull ends, the pull
   starts again at once (under the asking rule). A pull that ends with the roots apart and no new
   digest is started again after a backoff, 2 s doubling to 5 minutes, reset when either set changes,
   until the roots meet. A pull that stopped early (its page retries spent, or its session closed)
   resumes from its cursor.
-- **Capacity (errata 1).** At most 200,000 statements are held. Past that the store drops what is
-  not live first, then what comes last in authority order (deepest first, grants before revokes and
-  endorses, highest id first), a batch at a time. An anchor-level statement or a revoke is never
-  dropped or refused. A statement refused for capacity is not a relay failure.
+- **Capacity (errata 1).** At most 200,000 statements are held, and beyond that only in-force revokes
+  and in-force anchor-level statements, which the quotas bound. Past the bound the store drops
+  everything outside the live set first, whatever its kind, then live statements in reverse authority
+  order (deepest first, grants before revokes and endorses, highest id first), a batch at a time. An
+  anchor-level statement or a revoke that is in force is never dropped or refused; a dead or
+  over-quota one is an ordinary candidate. A statement refused for capacity is not a relay failure.
+  The file is compacted once it holds twice what the store keeps.
 - **Unique signature keys (errata 1).** A statement whose signature entries repeat a key is not well
   formed, refused before any signature is checked.
 - **Persistence (§6.6.8).** Held statements are written as their canonical members only, each on a

From f26fc9216c57d32d8738c66ae8186336faadd931 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 8 Oct 2026 10:40:22 +0100
Subject: [PATCH 123/148] tests: a removed anchor-level grant kept alive only
 as a chain is not protected by its kind

The mutation check of the R1 fix found one guard no test held: tier 2 protects in-force anchor-level
statements, not every live one. A removed anchor-level grant stays live while it is the chain of a
statement an endorse rescued; once a pass has dropped that statement (deeper, so first), the grant
goes too, while the anchor's in-force revoke and endorse stay.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QRVMpaJkAA2fFbvuHCEzqH
---
 tests/authority-attacks.test.js | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/tests/authority-attacks.test.js b/tests/authority-attacks.test.js
index fb53f876..e335f063 100644
--- a/tests/authority-attacks.test.js
+++ b/tests/authority-attacks.test.js
@@ -426,6 +426,21 @@ describe('§6.6 capacity: a full store keeps what comes first in authority order
     assert.ok(lines <= 2 * (1 + 256 + SLACK) + 2 * SLACK + 2, `the file holds ${lines} lines`);
   });
 
+  it('a removed anchor-level grant kept alive only as a rescued statement\'s chain is not protected: it goes once what hangs from it has', () => {
+    const gA = grant('anchor', party(), 'admin');
+    const gC = grant(gA, party(), 'participant');
+    const rA = revoke('anchor', [gA]);
+    const eC = endorse('anchor', [gC]); // the anchor keeps gC: gA stays live (on gC's chain), not in force
+    const st = new AuthorityStore({ pin: PIN, maxHeld: 10 });
+    for (const x of [gA, gC, rA, eC]) st.ingest(x);
+    assert.strictEqual(st.statusOf(id(gC)), 'in-force');
+    assert.strictEqual(st.statusOf(id(gA)), 'removed');
+    for (let i = 0; i < 7; i++) st.ingest(grant('anchor', party(), 'validator')); // in force, protected
+    assert.strictEqual(st.has(id(gC)), false, 'the deepest live statement went first');
+    assert.strictEqual(st.has(id(gA)), false, 'and the removed grant with it: anchor-level, but not in force');
+    for (const x of [rA, eC]) assert.strictEqual(st.has(id(x)), true, 'the in-force anchor-level statements stay');
+  });
+
   it('dead revokes never displace an honest tree in force (one signer never displaces another)', () => {
     const st = new AuthorityStore({ pin: PIN, maxHeld: 300 });
     const honest = [];

From f3743921a8dec4871a43932f77d7d0ee16a81ba2 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 8 Oct 2026 11:04:01 +0100
Subject: [PATCH 124/148] authority store: crash-safe rewrites, stale temps
 removed, one write per arrival; the slack said
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The diff check of f26fc92 (SHIP), its four lows:
1. _writeFile writes the temp file, fsyncs it, renames it over the file and fsyncs the directory:
   a power loss leaves the old file or the new one, never an empty one (the lines kept from other
   pins cannot be fetched from a peer).
2. A crash's statements.jsonl.<pid>.tmp (of a process no longer alive) is removed when the store
   opens; a live process's is left alone.
3. A pass that compacts the file during an arrival has written that statement already: it is not
   appended again.
4. SECURITY.md, the CHANGELOG and WIRE §3 say that up to EVICT_SLACK (3,125 at the default bound)
   more can be held between passes, and that the protected floor is judged again at the next pass.

Tests (authority-attacks, both fail on f26fc92): no statement appears twice in the file after 600
arrivals across compactions; a rewrite fsyncs the temp file and the directory, and a stale temp
file is removed at open while a live process's stays.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QRVMpaJkAA2fFbvuHCEzqH
---
 CHANGELOG.md                    |  8 +++--
 SECURITY.md                     |  4 ++-
 docs/WIRE-0.14.0.md             |  4 ++-
 lib/authority-store.js          | 57 +++++++++++++++++++++++++++++----
 tests/authority-attacks.test.js | 39 ++++++++++++++++++++++
 5 files changed, 102 insertions(+), 10 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5ad5da20..c066019f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -43,13 +43,17 @@ carried (cutoffs, ratification, budgets per delegation subtree, `role-chain-fetc
   endorser's bucket and falling through by id; a quota cut is never rescued. The live set and the
   authority root. (lib/authority-store.js)
 - **Capacity (errata 1).** At most 200,000 statements held, and beyond that only in-force revokes and
-  in-force anchor-level statements, which the quotas bound. Past the bound the store drops
+  in-force anchor-level statements, which the quotas bound; between eviction passes up to
+  EVICT_SLACK (3,125 at the default bound) more can be held, and the protected floor is judged
+  again at the next pass. Past the bound the store drops
   everything outside the live set first, whatever its kind (a dead or over-quota revoke is an
   ordinary candidate), then live statements in reverse authority order (deepest first, grants before
   revokes and endorses, highest id first), skipping only in-force revokes and in-force anchor-level
   statements. So the removal that would clean up a flooded store is always taken, and one signer's
   dead statements never displace another's authority. A pass resolves once and frees a batch; the
-  statement file is compacted once it holds twice what the store keeps. A statement refused for
+  statement file is compacted once it holds twice what the store keeps, and every rewrite of it is
+  crash-safe (written, flushed, renamed, the directory flushed; a crash's stale temp file is removed
+  when the store opens). A statement refused for
   capacity (`over-capacity`) says nothing against its sender. Dropping live statements is said in
   the log and counted (`authorityStatus().capacity`).
 - **Persistence.** One file, `authority/statements.jsonl`, whatever the pin. At load every statement
diff --git a/SECURITY.md b/SECURITY.md
index 1bca21cc..8fc900a5 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -149,7 +149,9 @@ Every store a peer can feed has a fixed bound. Reaching one never stops the node
   (`status().coreSecure.keyConflicts`).
 - **Authority statements** (MMP §6.6): what is in force is bounded by the quotas above. What is
   held: at most 200,000 statements, and beyond that only in-force revokes and in-force anchor-level
-  statements, which the quotas bound. Past the bound the store drops everything outside the live set
+  statements, which the quotas bound; between eviction passes up to EVICT_SLACK (3,125 at the
+  default bound) more can be held, and what is protected is judged again at the next pass. The
+  file is replaced crash-safely (written, flushed, renamed, its directory flushed). Past the bound the store drops everything outside the live set
   first, whatever its kind (a dead or over-quota revoke is an ordinary candidate), then live
   statements in reverse authority order (deepest first, grants before revokes and endorses, highest
   id first), skipping only in-force revokes and in-force anchor-level statements. So a revoke that
diff --git a/docs/WIRE-0.14.0.md b/docs/WIRE-0.14.0.md
index 9f54678b..d3836405 100644
--- a/docs/WIRE-0.14.0.md
+++ b/docs/WIRE-0.14.0.md
@@ -118,7 +118,9 @@ counted (`authorityStatus().stats.retired`), and they are never sent. Nothing in
   until the roots meet. A pull that stopped early (its page retries spent, or its session closed)
   resumes from its cursor.
 - **Capacity (errata 1).** At most 200,000 statements are held, and beyond that only in-force revokes
-  and in-force anchor-level statements, which the quotas bound. Past the bound the store drops
+  and in-force anchor-level statements, which the quotas bound; between eviction passes up to
+  EVICT_SLACK (3,125 at the default bound) more can be held, and the protected floor is judged again
+  at the next pass. Past the bound the store drops
   everything outside the live set first, whatever its kind, then live statements in reverse authority
   order (deepest first, grants before revokes and endorses, highest id first), a batch at a time. An
   anchor-level statement or a revoke that is in force is never dropped or refused; a dead or
diff --git a/lib/authority-store.js b/lib/authority-store.js
index 50421c97..b602da55 100644
--- a/lib/authority-store.js
+++ b/lib/authority-store.js
@@ -128,11 +128,14 @@ class AuthorityStore {
     if (v.result !== 'valid') return { ...v, id };
     this._held.set(id, v.entry);
     this._changed();
+    this._compacted = false;
     if (this._held.size > Math.max(this._maxHeld, this._protectedFloor + evictSlack(this._maxHeld)) && this._evict(id).has(id)) {
       this._capacity.refused++;
       return { result: 'over-capacity', id, reason: 'the store is full, and an eviction pass dropped this statement' };
     }
-    this._append(v.entry.s);
+    // A pass that compacted the file wrote every held statement, this one included: once is enough.
+    if (!this._compacted) this._append(v.entry.s);
+    this._compacted = false;
     return { result: 'held', id };
   }
 
@@ -575,19 +578,49 @@ class AuthorityStore {
     if (!this._dir || this._loading) return;
     const keep = this._held.size + this._unverifiedLines.length;
     if (this._fileLines <= 2 * keep + evictSlack(this._maxHeld)) return;
-    this._writeFile([...[...this._held.values()].map((e) => JSON.stringify(e.s)), ...this._unverifiedLines]);
+    if (this._writeFile([...[...this._held.values()].map((e) => JSON.stringify(e.s)), ...this._unverifiedLines])) this._compacted = true;
   }
 
-  /** @private Replace the file with `lines` (atomically, best effort). */
+  /**
+   * @private Replace the file with `lines`, crash-safe: written to a temporary file, flushed to disk,
+   * renamed over the file, and the directory flushed, so a power loss leaves either the old file or
+   * the new one, never an empty one (the lines kept from other pins cannot be fetched from a peer).
+   * @returns {boolean} whether the file was replaced
+   */
   _writeFile(lines) {
     const file = path.join(this._dir, FILE);
+    const tmp = `${file}.${process.pid}.tmp`;
+    let fd = null;
     try {
       fs.mkdirSync(this._dir, { recursive: true });
-      const tmp = `${file}.${process.pid}.tmp`;
-      fs.writeFileSync(tmp, lines.join('\n') + (lines.length ? '\n' : ''), { mode: 0o600 });
+      fd = fs.openSync(tmp, 'w', 0o600);
+      const buf = Buffer.from(lines.join('\n') + (lines.length ? '\n' : ''), 'utf8');
+      for (let off = 0; off < buf.length;) off += fs.writeSync(fd, buf, off, buf.length - off);
+      fs.fsyncSync(fd);
+      fs.closeSync(fd);
+      fd = null;
       fs.renameSync(tmp, file);
+      syncDir(this._dir);
       this._fileLines = lines.length;
-    } catch { /* best effort */ }
+      return true;
+    } catch {
+      if (fd !== null) { try { fs.closeSync(fd); } catch { /* best effort */ } }
+      try { fs.unlinkSync(tmp); } catch { /* best effort */ }
+      return false;
+    }
+  }
+
+  /** @private Remove the temporary files a crash left behind (`statements.jsonl.<pid>.tmp` of a process that is gone). */
+  _removeStaleTemps() {
+    let names = [];
+    try { names = fs.readdirSync(this._dir); } catch { return; }
+    for (const n of names) {
+      const m = /^statements\.jsonl\.(\d+)\.tmp$/.exec(n);
+      if (!m) continue;
+      const pid = Number(m[1]);
+      if (pid !== process.pid && pidAlive(pid)) continue;
+      try { fs.unlinkSync(path.join(this._dir, n)); } catch { /* best effort */ }
+    }
   }
 
   /**
@@ -601,6 +634,7 @@ class AuthorityStore {
    * nothing is judged and the file is left as it is.
    */
   _load() {
+    this._removeStaleTemps();
     const file = path.join(this._dir, FILE);
     let text = '';
     try { text = fs.readFileSync(file, 'utf8'); } catch { return; }
@@ -650,6 +684,17 @@ class AuthorityStore {
   }
 }
 
+/** Flush a directory's entries to disk (a rename is durable only once its directory is). Best effort: not every platform can. */
+function syncDir(dir) {
+  let fd = null;
+  try { fd = fs.openSync(dir, 'r'); fs.fsyncSync(fd); } catch { /* best effort */ } finally { if (fd !== null) { try { fs.closeSync(fd); } catch { /* */ } } }
+}
+
+/** Whether a process is alive (signal 0 tests without sending anything). */
+function pidAlive(pid) {
+  try { process.kill(pid, 0); return true; } catch (err) { return !!(err && err.code === 'EPERM'); }
+}
+
 /** Whether every signature entry of `a` is one of `b`'s. */
 function entriesWithin(a, b) {
   const k = (e) => `${e && e.key}|${e && e.sig}`;
diff --git a/tests/authority-attacks.test.js b/tests/authority-attacks.test.js
index e335f063..f0e04186 100644
--- a/tests/authority-attacks.test.js
+++ b/tests/authority-attacks.test.js
@@ -441,6 +441,45 @@ describe('§6.6 capacity: a full store keeps what comes first in authority order
     for (const x of [rA, eC]) assert.strictEqual(st.has(id(x)), true, 'the in-force anchor-level statements stay');
   });
 
+  // The diff check of f26fc92: the file's crash safety, and what a pass that compacts writes.
+  it('a compaction during an arrival writes the arriving statement once', () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'auth-once-'));
+    try {
+      const st = new AuthorityStore({ pin: PIN, maxHeld: 64, dir });
+      const gA = grant('anchor', party(), 'admin');
+      st.ingest(gA); st.ingest(revoke('anchor', [gA]));
+      const gW = grant('anchor', party(), 'admin');
+      st.ingest(gW);
+      const honest = [];
+      for (let i = 0; i < 600; i++) {
+        st.ingest(make(gA, { kind: 'revoke', targets: [`auth-${crypto.randomBytes(32).toString('hex')}`] }));
+        if (i % 7 === 0) { const g = grant(gW, party(), 'participant'); honest.push(g); st.ingest(g); }
+      }
+      const lines = fs.readFileSync(path.join(dir, 'statements.jsonl'), 'utf8').split('\n').filter(Boolean);
+      assert.strictEqual(new Set(lines).size, lines.length, 'no statement appears twice in the file');
+    } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+  });
+
+  it('a rewrite of the file is flushed before and after its rename; a crash\'s stale temp file is removed at open', () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'auth-fsync-'));
+    try {
+      const st = new AuthorityStore({ pin: PIN, dir });
+      st.ingest(grant('anchor', party(), 'admin'));
+      // A crash left this behind (a pid no process has); a live process's temp is left alone.
+      const stale = path.join(dir, 'statements.jsonl.999999999.tmp');
+      const live = path.join(dir, `statements.jsonl.${process.ppid}.tmp`);
+      fs.writeFileSync(stale, 'half a rewrite');
+      fs.writeFileSync(live, 'another process, still writing');
+      const real = fs.fsyncSync;
+      let syncs = 0;
+      fs.fsyncSync = (fd) => { syncs++; return real(fd); };
+      try { new AuthorityStore({ pin: PIN, dir }); } finally { fs.fsyncSync = real; }
+      assert.ok(syncs >= 2, `the temp file and its directory are flushed (${syncs} fsyncs)`);
+      assert.strictEqual(fs.existsSync(stale), false, 'the stale temp file is gone');
+      assert.strictEqual(fs.existsSync(live), true, 'a live process\'s is not touched');
+    } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+  });
+
   it('dead revokes never displace an honest tree in force (one signer never displaces another)', () => {
     const st = new AuthorityStore({ pin: PIN, maxHeld: 300 });
     const honest = [];

From c36443f93567cb04b471528859f4250c3bf6f4a2 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 8 Oct 2026 11:09:42 +0100
Subject: [PATCH 125/148] session: the signed room at the seal point, grants
 checked against their schema, the sequence before the parse, Close codes
 close (S1, S2, S4; #23)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

MMP 2.0 update 1, from the reviews of #26, #31 and #23 against 390b4af:

- S1: _sealRecord refuses a record whose signed room is not the session's room (AudienceError,
  'not-addressed'), as it refuses one signed to another node. The store is per node, not per room,
  so after a room change a fetch answer or an anchor replay could otherwise disclose an old room's
  record before the receiver refused it.
- S2: verifyRoomGrant checks the grant against room-join.schema.json before anything else: a closed
  object, lowercase UUID ids, integer timestamps. The payload signs decimal text, so string
  timestamps verified and the expiry timer (which needs a number) never armed: the grantee kept its
  session past expiry. signRoomGrant mints the schema's object only and refuses one that could never
  verify; the node sends grantForWire(grant), the schema's members only.
- S4: a sealed frame that opens advances the receive sequence; its inner frame or record is parsed
  only after the position is taken (openControlSealed / parseControlPlain, openEncryptedSealed /
  parseEncryptedPlain). Refusing what it carries changes nothing else; before, the counter stayed
  behind and the next frame closed the session as a gap.
- #23/§7.2: every sealed error whose action is Close (1001, 1003-1010) ends the session at the
  receiver; others are information. sendError takes only 1002 and 2xxx (never 1009, 1010, 1011, the
  other Close codes or 4xxx): EBADERRORCODE.
- Stale comments: sealed-control.js (error is sealed), room-grant.js (the session closes at expiry;
  the proving handshake is the connection path).

Tests: spec-update-session (each fails on 390b4af): a record for another room is never sealed or
served; string timestamps and extra members are refused, mint and wire carry the schema's members;
a refused inner frame and a refused record plaintext leave the session taking the next frame; a
sealed 1008 closes, a sealed 2001 does not; sendError refuses the protocol's codes. The grant tests
use schema-valid grants (lowercase UUID ids, a bound key).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QRVMpaJkAA2fFbvuHCEzqH
---
 lib/core/cmb-encrypted-frame.js      |  38 ++++--
 lib/core/room-grant.js               |  75 ++++++++---
 lib/core/sealed-control.js           |  29 +++--
 lib/node.js                          |  22 ++--
 lib/session.js                       |  42 +++++--
 tests/room-admission.test.js         |  46 +++----
 tests/room-grant-grantor.test.js     |  24 ++--
 tests/room-grant-key-binding.test.js |   4 +-
 tests/room-join-auth.test.js         |  86 +++++++------
 tests/spec-update-session.test.js    | 178 +++++++++++++++++++++++++++
 10 files changed, 417 insertions(+), 127 deletions(-)
 create mode 100644 tests/spec-update-session.test.js

diff --git a/lib/core/cmb-encrypted-frame.js b/lib/core/cmb-encrypted-frame.js
index 79fa9bf9..21470840 100644
--- a/lib/core/cmb-encrypted-frame.js
+++ b/lib/core/cmb-encrypted-frame.js
@@ -102,13 +102,13 @@ function buildEncryptedFrame({ cmb, applicationBytes = null, sessionId, directio
 }
 
 /**
- * Open a `cmb-encrypted` frame with the directional traffic key, reconstructing the logical
- * record. Throws on any AEAD failure — a tampered frame, a wrong key, or a frame whose clear
- * metadata was altered (the AAD binds key/assertionId/nodeId/room/to). The caller enforces the
- * sequence (exact-next, no replay/rollback/gap) and then runs §8.8.5 verification order.
- * @returns {{ cmb: object, applicationBytes: Buffer|null, sequence: string, direction: string }}
+ * Authenticate and decrypt a `cmb-encrypted` frame with the directional traffic key: the AEAD alone.
+ * Throws on any AEAD failure (a tampered frame, a wrong key, clear metadata altered: the AAD binds
+ * key/assertionId/nodeId/room/to). A frame that opens advances the session's receive sequence
+ * (MMP §18.2.1), so its plaintext is parsed by `parseEncryptedPlain` only after the position is taken.
+ * @returns {Buffer} the plaintext
  */
-function openEncryptedFrame({ frame, trafficKey }) {
+function openEncryptedSealed({ frame, trafficKey }) {
   if (!frame || frame.type !== FRAME_TYPE) throw new Error('cmb-encrypted: not a cmb-encrypted frame');
   if (frame.protocolVersion !== PROTOCOL_VERSION) throw new Error('cmb-encrypted: unsupported protocolVersion');
   if (frame.suite !== SUITE) throw new Error('cmb-encrypted: unsupported suite');
@@ -116,29 +116,41 @@ function openEncryptedFrame({ frame, trafficKey }) {
   if (!/^(0|[1-9][0-9]*)$/.test(String(frame.sequence))) throw new Error('cmb-encrypted: bad sequence');
   const m = frame.metadata;
   if (!m || typeof m !== 'object') throw new Error('cmb-encrypted: missing metadata');
-
   const aad = aeadAADv2({
     protocolVersion: PROTOCOL_VERSION, sessionId: frame.sessionId, direction: frame.direction, sequence: String(frame.sequence),
     key: m.key, assertionId: m.assertionId, createdByNodeId: m.createdByNodeId, room: m.room, to: m.to,
   });
-  const nonce = nonceForSequence(frame.sequence);
-  const plaintext = openV2(trafficKey, nonce, aad, Buffer.from(frame.sealed, 'base64url'));
-  const text = plaintext.toString('utf8');
+  return openV2(trafficKey, nonceForSequence(frame.sequence), aad, Buffer.from(frame.sealed, 'base64url'));
+}
+
+/**
+ * The logical record of an opened `cmb-encrypted` frame. Throws when the plaintext is not one (not
+ * JSON, too deep): the record is refused, and nothing else about the session changes. The caller
+ * then runs §8.8.5's verification order.
+ * @returns {{ cmb: object, applicationBytes: Buffer|null, sequence: string, direction: string }}
+ */
+function parseEncryptedPlain(frame, plaintext) {
+  const text = Buffer.from(plaintext).toString('utf8');
   // The peer wrote this JSON as surely as a cleartext frame, so it meets the same nesting bound.
   if (nestedTooDeep(text)) throw new Error(`cmb-encrypted: plaintext nests deeper than ${MAX_FRAME_DEPTH} levels`);
   const parsed = JSON.parse(text);
+  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) throw new Error('cmb-encrypted: the plaintext is not an object');
   const applicationBytes = (typeof parsed.applicationData === 'string')
     ? Buffer.from(parsed.applicationData, 'base64url') : null;
-
   return {
-    cmb: { categories: parsed.categories, metadata: m },
+    cmb: { categories: parsed.categories, metadata: frame.metadata },
     applicationBytes,
     sequence: String(frame.sequence),
     direction: frame.direction,
   };
 }
 
+/** Open and parse in one step (tests, tools). A session opens first and parses after the position. */
+function openEncryptedFrame({ frame, trafficKey }) {
+  return parseEncryptedPlain(frame, openEncryptedSealed({ frame, trafficKey }));
+}
+
 module.exports = {
   FRAME_TYPE, PROTOCOL_VERSION, SUITE,
-  nonceForSequence, protectedPlaintext, buildEncryptedFrame, openEncryptedFrame,
+  nonceForSequence, protectedPlaintext, buildEncryptedFrame, openEncryptedFrame, openEncryptedSealed, parseEncryptedPlain,
 };
diff --git a/lib/core/room-grant.js b/lib/core/room-grant.js
index 079bc858..e987f5b5 100644
--- a/lib/core/room-grant.js
+++ b/lib/core/room-grant.js
@@ -102,10 +102,44 @@ function roomGrantPayload(g) {
   ]);
 }
 
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+const GRANT_MEMBERS = new Set(['type', 'room', 'grantee', 'granteeKey', 'grantedBy', 'grantedAt', 'expiresAt', 'sigAlg', 'sig']);
+const isTime = (t) => Number.isSafeInteger(t) && t >= 0;
+
+/**
+ * MMP §5.8.1 (room-join.schema.json's grant), checked BEFORE the signature: a closed object of
+ * exactly the signed members, typed as the schema types them. The payload signs decimal text, so
+ * `"1786…"` and `1786…` sign the same bytes; only this check keeps a string timestamp, which the
+ * expiry timer would not arm on, from being taken (spec review #31).
+ * @returns {string|null} why not, or null
+ */
+function grantShapeReason(g) {
+  if (!g || typeof g !== 'object' || Array.isArray(g)) return 'not an object';
+  for (const k of Object.keys(g)) if (!GRANT_MEMBERS.has(k)) return `a member the schema does not define (${String(k).slice(0, 32)})`;
+  if (g.type !== 'room-join') return 'type';
+  if (typeof g.room !== 'string' || !/^[a-z0-9._-]{1,64}$/.test(g.room)) return 'room';
+  if (typeof g.grantee !== 'string' || !UUID.test(g.grantee)) return 'grantee is not a lowercase UUID';
+  if (typeof g.granteeKey !== 'string' || !/^[A-Za-z0-9_-]{43}$/.test(g.granteeKey)) return 'granteeKey';
+  if (typeof g.grantedBy !== 'string' || !UUID.test(g.grantedBy)) return 'grantedBy is not a lowercase UUID';
+  if (!isTime(g.grantedAt)) return 'grantedAt is not an integer';
+  if (!isTime(g.expiresAt)) return 'expiresAt is not an integer';
+  if (g.sigAlg !== 'ed25519') return 'sigAlg';
+  if (typeof g.sig !== 'string' || !/^[A-Za-z0-9_-]{86}$/.test(g.sig)) return 'sig';
+  return null;
+}
+
+/** A grant as it goes on the wire: the schema's members only, whatever object the host passed. */
+function grantForWire(g) {
+  const out = {};
+  if (g && typeof g === 'object') for (const k of GRANT_MEMBERS) if (g[k] !== undefined) out[k] = g[k];
+  return out;
+}
+
 /**
- * Mint and sign a room-join grant with the OWNER's raw Ed25519 private key.
- * Refuses an unownable room and clamps the lifetime to the cap at mint time — the
- * verifier enforces it again, because that is where it has to hold.
+ * Mint and sign a room-join grant with the OWNER's raw Ed25519 private key. The grant is exactly
+ * the schema's object (members the caller passed beyond it are not kept), and one that could never
+ * verify is refused here. Refuses an unownable room and clamps the lifetime to the cap at mint time
+ * — the verifier enforces it again, because that is where it has to hold.
  * @returns {object} the signed grant
  */
 function signRoomGrant(grant, ownerPrivateKeyB64url) {
@@ -118,13 +152,18 @@ function signRoomGrant(grant, ownerPrivateKeyB64url) {
   const grantedAt = grant.grantedAt ?? Date.now();
   const requested = grant.expiresAt ?? (grantedAt + MAX_GRANT_LIFETIME_MS);
   const g = {
-    ...grant,
     type: 'room-join',
+    room: grant.room,
+    grantee: grant.grantee,
+    granteeKey: grant.granteeKey,
+    grantedBy: grant.grantedBy,
     grantedAt,
     expiresAt: Math.min(requested, grantedAt + MAX_GRANT_LIFETIME_MS),
   };
   g.sig = crypto.sign(null, roomGrantPayload(g), privateKeyObject(ownerPrivateKeyB64url)).toString('base64url');
   g.sigAlg = 'ed25519';
+  const bad = grantShapeReason(g);
+  if (bad) throw new Error(`signRoomGrant: the grant would not be well formed (${bad})`);
   return g;
 }
 
@@ -132,9 +171,10 @@ function signRoomGrant(grant, ownerPrivateKeyB64url) {
  * Verify a room-join grant AT JOIN TIME. Fail-closed: every path that is not an
  * affirmative pass returns ok:false with a reason.
  *
- * Expiry is judged HERE and only here — an already-admitted peer is never evicted
- * mid-session by its grant lapsing (review F9: a phone's room node must not strand
- * mid-listen; it presents a fresh grant on its next join).
+ * Expiry is judged here at join time, and the node arms a timer from the verified
+ * `expiresAt` that closes the admitted session when its grant lapses (security review:
+ * a grant admits until it expires, not for as long as the session lasts); the grantee
+ * presents a fresh grant on its next join.
  *
  * THE EXPECTATION IS MANDATORY. `expect.room` and `expect.grantee` are what turn a
  * signature into an authorisation FOR THIS PEER, IN THIS ROOM; when they were optional,
@@ -153,6 +193,9 @@ function verifyRoomGrant(grant, ownerPublicKeyB64url, expect = {}) {
   if (!expect.room || !expect.grantee) return { ok: false, reason: 'no-expectation' };
   if (!grant || grant.type !== 'room-join') return { ok: false, reason: 'not-a-room-join-grant' };
   if (!grant.sig || grant.sigAlg !== 'ed25519') return { ok: false, reason: 'unsigned' };
+  // The schema first, before anything is verified (MMP §5.8.1): integer timestamps, no extra member.
+  const bad = grantShapeReason(grant);
+  if (bad) return { ok: false, reason: `malformed: ${bad}` };
   if (!ownerPublicKeyB64url) return { ok: false, reason: 'no-owner-key-pinned' };
   if (!isOwnableRoom(grant.room)) return { ok: false, reason: 'room-not-ownable' };
   if (grant.room !== expect.room) return { ok: false, reason: 'room-mismatch' };
@@ -183,20 +226,16 @@ function verifyRoomGrant(grant, ownerPublicKeyB64url, expect = {}) {
   // dev-team-3 from the code, reproduced by its failing test on 2026-09-16: an impostor offering
   // a different key was admitted to a gated room.
   //
-  // The caller must now present the key the peer PROVED, and there is no way to pass "trust the
-  // asserted one" — that would be no bar at all, since the key is inside the grant the impostor
-  // is holding. Absent proof, admission is refused rather than granted: nothing in the estate
-  // gates a room today (no owner pins on any node), so failing closed costs nothing real and
-  // removes a promise the code was not keeping. A gated room becomes usable again when the
-  // proving handshake (lib/core/handshake-v2.js, present but not yet reachable from the
-  // connection path) supplies a proven key here.
+  // The caller must present the key the peer PROVED in its §5.2 handshake, and there is no way to
+  // pass "trust the asserted one" — that would be no bar at all, since the key is inside the grant
+  // the impostor is holding. Absent proof, admission is refused rather than granted. In 0.14 every
+  // session runs the proving handshake, and the node passes the session's proven key here.
   if (!expect.provenKey) return { ok: false, reason: 'no-proven-key — a gated room requires a proving handshake; the asserted key is not a credential' };
   if (!grant.granteeKey) return { ok: false, reason: 'grant-binds-no-key' };
   if (grant.granteeKey !== expect.provenKey) return { ok: false, reason: 'grantee-key-mismatch' };
 
-  const grantedAt = Number(grant.grantedAt);
-  const expiresAt = Number(grant.expiresAt);
-  if (!Number.isFinite(grantedAt) || !Number.isFinite(expiresAt)) return { ok: false, reason: 'bad-timestamps' };
+  const grantedAt = grant.grantedAt;
+  const expiresAt = grant.expiresAt;
   // The cap is enforced by the RECEIVER: a grant minted with a longer life is
   // refused outright rather than silently truncated, so the window is never a
   // number the far end chose.
@@ -218,6 +257,8 @@ module.exports = {
   ROOM_GRANT_DOMAIN,
   signRoomGrant,
   verifyRoomGrant,
+  grantShapeReason,
+  grantForWire,
   roomGrantPayload,
   isOwnableRoom,
   MAX_GRANT_LIFETIME_MS,
diff --git a/lib/core/sealed-control.js b/lib/core/sealed-control.js
index 57fb562b..2efbf212 100644
--- a/lib/core/sealed-control.js
+++ b/lib/core/sealed-control.js
@@ -9,7 +9,7 @@
  * directional key, and every other frame travels in the clear. Over a relay that leaves control
  * frames injectable by anyone who can address the relay envelope (design §9: "Only CMBs are bound
  * to the session"). A Core Secure session in sym therefore carries EVERY post-handshake frame except
- * `ping`, `pong` and `error` inside this envelope: `mood` (cognitive content, §9.3), `peer-info` and
+ * `ping` and `pong` inside this envelope (an `error` too, security review F): `mood` (cognitive content, §9.3), `peer-info` and
  * `wake-channel` (so what is learned from a session is learned from the node that proved itself on
  * it), the signed gossip frames, `cmb-fetch` and `cmb-fetch-result` (its correlation id and key
  * lists; the fetched records themselves travel as `cmb-encrypted`), and the room-join grant.
@@ -80,13 +80,23 @@ function isControlFrame(f) {
 }
 
 /**
- * Open a sealed control frame. Throws on any AEAD failure or a malformed inner frame.
- * @returns {object} the inner frame
+ * Authenticate and decrypt a sealed control frame: the AEAD alone. Throws only when the frame does
+ * not open (MMP §18.2.1: a frame that opens advances the session's receive sequence, whatever it
+ * carries, so the caller parses what it returns only after the position is taken).
+ * @returns {Buffer} the plaintext
  */
-function openControlFrame({ frame, trafficKey }) {
+function openControlSealed({ frame, trafficKey }) {
   if (!isControlFrame(frame)) throw new Error('control-encrypted: malformed frame');
-  const plain = openV2(trafficKey, nonceForSequence(frame.sequence), controlAAD(frame), Buffer.from(frame.sealed, 'base64url'));
-  const text = plain.toString('utf8');
+  return openV2(trafficKey, nonceForSequence(frame.sequence), controlAAD(frame), Buffer.from(frame.sealed, 'base64url'));
+}
+
+/**
+ * The inner frame of an opened control frame. Throws when it is not one (not JSON, too deep, a type
+ * that never travels sealed): the frame is refused, and nothing else about the session changes.
+ * @returns {object} the inner frame
+ */
+function parseControlPlain(plain) {
+  const text = Buffer.from(plain).toString('utf8');
   // The peer wrote this JSON as surely as a cleartext frame, so it meets the same nesting bound.
   if (nestedTooDeep(text)) throw new Error(`control-encrypted: plaintext nests deeper than ${MAX_FRAME_DEPTH} levels`);
   const inner = JSON.parse(text);
@@ -96,4 +106,9 @@ function openControlFrame({ frame, trafficKey }) {
   return inner;
 }
 
-module.exports = { FRAME_TYPE, AAD_DOMAIN, controlAAD, buildControlFrame, openControlFrame, isControlFrame, NEVER_INNER, neverInner };
+/** Open and parse in one step (tests, tools). A session opens first and parses after the position. */
+function openControlFrame({ frame, trafficKey }) {
+  return parseControlPlain(openControlSealed({ frame, trafficKey }));
+}
+
+module.exports = { FRAME_TYPE, AAD_DOMAIN, controlAAD, buildControlFrame, openControlFrame, openControlSealed, parseControlPlain, isControlFrame, NEVER_INNER, neverInner };
diff --git a/lib/node.js b/lib/node.js
index e014a136..65979fc4 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -40,7 +40,7 @@ const projectionOrNull = (cmb) => {
 const { wireNodeId, wireName, wireKey } = require('./wire-identity');
 const { keepPeerState } = require('./peer-state');
 const { RoomOwnershipRegistry } = require('./room-ownership');
-const { verifyRoomGrant } = require('./core/room-grant');
+const { verifyRoomGrant, grantForWire } = require('./core/room-grant');
 const { DecisionLog } = require('./decision-log');
 const {
   encode, DIM, createCMB, renderContent, FIELD_WEIGHT_PROFILES,
@@ -3100,20 +3100,26 @@ class SymNode extends EventEmitter {
   }
 
   /**
-   * Send an error frame to a peer. Per MMP Section 7.2, error frames are
-   * informational — the receiver MUST NOT treat them as commands.
-   * Codes 1xxx are connection-level (close after sending).
-   * Codes 2xxx are evaluation-level (informational only).
+   * Send an error frame to a peer (sealed on its session). Per MMP §7.2 a host's error is
+   * information: 1002 (frame rejected) or an evaluation-level 2xxx code (2001 SVAF rejected).
+   * Any other code throws EBADERRORCODE.
    *
    * @param {string} peerId — target peer
-   * @param {number} code — error code (1001-1005, 2001-2002)
+   * @param {number} code — 1002, or 2000-2999
    * @param {string} message — human-readable error description
    * @param {string} [detail] — optional debug detail (MUST NOT contain sensitive info)
    */
   sendError(peerId, code, message, detail) {
+    // MMP §7.2: a host sends information, never the protocol's own decisions. 1009, 1010 and 1011 are
+    // the session's (identity conflict, close, unknown session), the other Close codes end a session
+    // a host does not own, and 4xxx are relay close codes, never peer errors (draft PR #23). What a
+    // host may send: 1002 (frame rejected) and the informational 2xxx codes.
+    if (!(code === 1002 || (Number.isInteger(code) && code >= 2000 && code <= 2999))) {
+      throw Object.assign(new Error(`sendError: ${code} is not a code a host may send (1002, or 2000-2999)`), { code: 'EBADERRORCODE' });
+    }
     const peer = this._peers.get(peerId);
     if (!peer) return;
-    peer.transport.send({ type: 'error', code, message, detail: detail || undefined });
+    peer.transport.send({ type: 'error', code, message: String(message ?? '').slice(0, 200), ...(detail ? { detail: String(detail).slice(0, 200) } : {}) });
     this._log(`Error sent to ${peer.name}: ${code} ${message}`);
   }
 
@@ -3521,7 +3527,7 @@ class SymNode extends EventEmitter {
       return;
     }
     // A room-join grant this node holds goes first, so a gated peer can admit it.
-    if (this._roomGrant) session.send({ type: 'room-join', grant: this._roomGrant });
+    if (this._roomGrant) session.send({ type: 'room-join', grant: grantForWire(this._roomGrant) }); // the schema's members only (§5.8.1)
     session.admission = { state: 'pending', since: Date.now() };
     this._decideAdmission(session);
   }
diff --git a/lib/session.js b/lib/session.js
index f629f4c4..f02db3f7 100644
--- a/lib/session.js
+++ b/lib/session.js
@@ -47,8 +47,8 @@ const crypto = require('crypto');
 const { EventEmitter } = require('events');
 const { clientHello, serverAccept, clientFinish, serverConfirm, PROTOCOL_VERSION } = require('./core/handshake-v2-flow');
 const { EXT_CMB_ENCRYPTED_V2 } = require('./core/mmp-extensions');
-const { buildEncryptedFrame, openEncryptedFrame, FRAME_TYPE: CMB_ENCRYPTED } = require('./core/cmb-encrypted-frame');
-const { buildControlFrame, openControlFrame, FRAME_TYPE: CONTROL_ENCRYPTED } = require('./core/sealed-control');
+const { buildEncryptedFrame, openEncryptedSealed, parseEncryptedPlain, FRAME_TYPE: CMB_ENCRYPTED } = require('./core/cmb-encrypted-frame');
+const { buildControlFrame, openControlSealed, parseControlPlain, FRAME_TYPE: CONTROL_ENCRYPTED } = require('./core/sealed-control');
 const { SEND_FAILURE, MAX_FRAME_SIZE } = require('./frame-parser');
 
 const HANDSHAKE_TIMEOUT_MS = 10_000;
@@ -58,6 +58,12 @@ const HANDSHAKE_TYPES = new Set(['client-hello', 'server-hello', 'client-finish'
 const IDENTITY_CONFLICT = 1009;
 const SESSION_CLOSED = 1010;
 const UNKNOWN_SESSION = 1011;
+/**
+ * MMP §7.2: the error codes whose action is Close. A SEALED error with one of these ends the session
+ * at the receiver (it is the peer's own word); any other sealed code is information. A clear error
+ * never changes a session's state (1011 only prompts a handshake).
+ */
+const CLOSE_CODES = new Set([1001, 1003, 1004, 1005, 1006, 1007, 1008, IDENTITY_CONFLICT, SESSION_CLOSED]);
 /** Room left for a relay envelope ({to, payload}) around a sealed frame. */
 const ENVELOPE_ALLOWANCE = 4096;
 const X25519_SPKI_PREFIX = Buffer.from('302a300506032b656e032100', 'hex');
@@ -336,8 +342,13 @@ class PeerSession extends EventEmitter {
     // opens, so anyone on a relay could have sent it); a genuine one from the peer leaves a gap that
     // the next frame's sequence closes the session on.
     if (typeof f.sealed === 'string' && f.sealed.length > MAX_SEALED_CHARS) { this._refuse(f.type, 'record-too-large'); return; }
-    const out = this._position(f, (trafficKey) => openEncryptedFrame({ frame: f, trafficKey }), 'record');
-    if (!out) return;
+    // MMP §18.2.1: a frame that opens advances the receive sequence, whatever it carries. Its plaintext
+    // is parsed only after the position is taken, so refusing what it carries changes nothing else
+    // (before, a refused plaintext left the counter behind, and the next frame closed the session as a gap).
+    const plain = this._position(f, (trafficKey) => openEncryptedSealed({ frame: f, trafficKey }), 'record');
+    if (!plain) return;
+    let out;
+    try { out = parseEncryptedPlain(f, plain); } catch (err) { this._refuse(f.type, `record refused: ${err && err.message}`); return; }
     const metadata = { ...out.cmb.metadata };
     // The clear metadata carries the application descriptor without its data; the bytes ride sealed
     // as applicationData (§18.2.1). The logical record has them back in metadata.application.data.
@@ -352,14 +363,19 @@ class PeerSession extends EventEmitter {
   }
 
   _openControl(f) {
-    const inner = this._position(f, (trafficKey) => openControlFrame({ frame: f, trafficKey }), 'control frame');
-    if (!inner) return;
+    // As for a record: the position is taken once the frame opens, and the inner frame parsed after.
+    const plain = this._position(f, (trafficKey) => openControlSealed({ frame: f, trafficKey }), 'control frame');
+    if (!plain) return;
+    let inner;
+    try { inner = parseControlPlain(plain); } catch (err) { this._refuse(f.type, `inner frame refused: ${err && err.message}`); return; }
     if (inner.type === 'error') {
-      // A SEALED error is the peer's own word: 1010 it closed this session, 1009 it binds this node's
-      // nodeId to another key (draft spec PR #21); anything else is information.
+      // A SEALED error is the peer's own word. One whose §7.2 action is Close ends the session: 1009
+      // it binds this node's nodeId to another key, 1010 it closed this session, and the other Close
+      // codes alike; anything else is information.
       const message = typeof inner.message === 'string' ? inner.message.slice(0, 200) : 'error frame';
-      if (inner.code === SESSION_CLOSED) { this._fail('peer-closed', message, { notify: false }); return; }
       if (inner.code === IDENTITY_CONFLICT) { this._fail('identity-conflict', message, { notify: false }); return; }
+      if (inner.code === SESSION_CLOSED) { this._fail('peer-closed', message, { notify: false }); return; }
+      if (CLOSE_CODES.has(inner.code)) { this._fail('peer-closed', `${inner.code}: ${message}`, { notify: false }); return; }
       this._refuse('error', `peer-error-${Number.isInteger(inner.code) && inner.code >= 1000 && inner.code < 5000 ? inner.code : 'other'}`);
       return;
     }
@@ -414,6 +430,12 @@ class PeerSession extends EventEmitter {
     // the node it was signed to.
     const to = cmb.metadata.to;
     if (to !== null && to !== undefined && to !== this.nodeId) throw new AudienceError(`a record signed to ${String(to).slice(0, 8)} is never sealed to ${String(this.nodeId).slice(0, 8)}`);
+    // The signed room governs too: a node's store is per node, not per room, so a record signed for
+    // another room (one this node held before it moved rooms) is never sealed to this session's peer,
+    // whichever path offered it (a fetch answer, an anchor replay). Its content would be disclosed
+    // before the receiver refused it.
+    const room = cmb.metadata.room;
+    if (typeof room !== 'string' || room.normalize('NFC') !== String(this.room).normalize('NFC')) throw new AudienceError(`a record signed for room '${String(room).slice(0, 64)}' is never sealed to a session in '${String(this.room).slice(0, 64)}'`);
     // Only the signed projection travels (finding B): members no signature covers are not sent.
     cmb = signedProjection(cmb);
     const metadata = { ...cmb.metadata };
@@ -469,4 +491,4 @@ class PeerSession extends EventEmitter {
   }
 }
 
-module.exports = { PeerSession, agreeX25519, freshX25519, checkOffer, HANDSHAKE_TIMEOUT_MS, HANDSHAKE_TYPES, IDENTITY_CONFLICT, SESSION_CLOSED, UNKNOWN_SESSION };
+module.exports = { PeerSession, agreeX25519, freshX25519, checkOffer, HANDSHAKE_TIMEOUT_MS, HANDSHAKE_TYPES, IDENTITY_CONFLICT, SESSION_CLOSED, UNKNOWN_SESSION, CLOSE_CODES };
diff --git a/tests/room-admission.test.js b/tests/room-admission.test.js
index 1d5791f4..87843b9f 100644
--- a/tests/room-admission.test.js
+++ b/tests/room-admission.test.js
@@ -25,6 +25,8 @@ function keypair() {
 }
 
 const ROOM = 'x-review--team-02779b950c3d8d7378fd11d6';
+// MMP §5.8.1's grant schema: nodeIds are lowercase UUIDs. A readable name stands for a fixed one.
+const U = (name) => { const h = crypto.createHash('sha256').update(String(name)).digest('hex'); return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20, 32)}`; };
 
 /** A receiver in `room`, optionally gating it with `owner`. */
 function receiver(room, owner) {
@@ -45,62 +47,64 @@ describe('ungated rooms admit every confirmed session', () => {
 describe('gated rooms — fail closed on proven keys, and the owner is never locked out', () => {
   it('a stranger with no grant is pending (refused when its handshake timeout passes)', () => {
     const owner = keypair();
-    const r = receiver(ROOM, { nodeId: 'owner-node', publicKey: owner.pub });
-    assert.deepStrictEqual(decide(r, 'stranger', keypair().pub), { pending: true });
+    const r = receiver(ROOM, { nodeId: U('owner-node'), publicKey: owner.pub });
+    assert.deepStrictEqual(decide(r, U('stranger'), keypair().pub), { pending: true });
   });
 
   it('the OWNER needs no grant in its own room — recognised by its pinned key, not its id', () => {
     const owner = keypair();
-    const r = receiver(ROOM, { nodeId: 'owner-node', publicKey: owner.pub });
-    assert.strictEqual(decide(r, 'owner-node', owner.pub).admit, true);
-    const imp = decide(r, 'owner-node', keypair().pub);
+    const r = receiver(ROOM, { nodeId: U('owner-node'), publicKey: owner.pub });
+    assert.strictEqual(decide(r, U('owner-node'), owner.pub).admit, true);
+    const imp = decide(r, U('owner-node'), keypair().pub);
     assert.strictEqual(imp.admit, false, 'the owner\'s id under another key is not the owner');
     assert.match(imp.reason, /under another key/);
   });
 
   it('a grantee is admitted when the grant binds the key its session proved; an impostor proving its own key is not', () => {
     const owner = keypair(), volunteer = keypair();
-    const r = receiver(ROOM, { nodeId: 'owner-node', publicKey: owner.pub });
-    const grant = signRoomGrant({ room: ROOM, grantee: 'volunteer', granteeKey: volunteer.pub, grantedBy: 'owner-node' }, owner.priv);
-    assert.strictEqual(decide(r, 'volunteer', volunteer.pub, grant).admit, true, 'sharing stays possible, as an act');
-    const imp = decide(r, 'volunteer', keypair().pub, grant);
+    const r = receiver(ROOM, { nodeId: U('owner-node'), publicKey: owner.pub });
+    const grant = signRoomGrant({ room: ROOM, grantee: U('volunteer'), granteeKey: volunteer.pub, grantedBy: U('owner-node') }, owner.priv);
+    assert.strictEqual(decide(r, U('volunteer'), volunteer.pub, grant).admit, true, 'sharing stays possible, as an act');
+    const imp = decide(r, U('volunteer'), keypair().pub, grant);
     assert.strictEqual(imp.admit, false, 'a copied grant admits nobody: the binding is enforced');
     assert.match(String(imp.reason), /grantee-key-mismatch/);
   });
 
   it('a grant minted by someone who is NOT the owner is refused', () => {
     const owner = keypair(), impostor = keypair(), evil = keypair();
-    const r = receiver(ROOM, { nodeId: 'owner-node', publicKey: owner.pub });
-    const forged = signRoomGrant({ room: ROOM, grantee: 'evil', granteeKey: evil.pub, grantedBy: 'owner-node' }, impostor.priv);
-    const d = decide(r, 'evil', evil.pub, forged);
+    const r = receiver(ROOM, { nodeId: U('owner-node'), publicKey: owner.pub });
+    const forged = signRoomGrant({ room: ROOM, grantee: U('evil'), granteeKey: evil.pub, grantedBy: U('owner-node') }, impostor.priv);
+    const d = decide(r, U('evil'), evil.pub, forged);
     assert.strictEqual(d.admit, false);
     assert.match(d.reason, /grant refused/);
   });
 
   it('a valid grant issued to SOMEONE ELSE cannot be presented by this session', () => {
     const owner = keypair(), alice = keypair();
-    const r = receiver(ROOM, { nodeId: 'owner-node', publicKey: owner.pub });
-    const grant = signRoomGrant({ room: ROOM, grantee: 'alice', granteeKey: alice.pub, grantedBy: 'owner-node' }, owner.priv);
-    const d = decide(r, 'mallory', keypair().pub, grant);
+    const r = receiver(ROOM, { nodeId: U('owner-node'), publicKey: owner.pub });
+    const grant = signRoomGrant({ room: ROOM, grantee: U('alice'), granteeKey: alice.pub, grantedBy: U('owner-node') }, owner.priv);
+    const d = decide(r, U('mallory'), keypair().pub, grant);
     assert.strictEqual(d.admit, false);
     assert.match(d.reason, /grantee-mismatch/);
   });
 
   it('a grant that binds no key is a bearer token and is refused (§5.8.1)', () => {
     const owner = keypair(), bob = keypair();
-    const r = receiver(ROOM, { nodeId: 'owner-node', publicKey: owner.pub });
-    const bearer = signRoomGrant({ room: ROOM, grantee: 'bob', grantedBy: 'owner-node' }, owner.priv);
-    assert.strictEqual(decide(r, 'bob', bob.pub, bearer).admit, false);
+    const r = receiver(ROOM, { nodeId: U('owner-node'), publicKey: owner.pub });
+    assert.throws(() => signRoomGrant({ room: ROOM, grantee: U('bob'), grantedBy: U('owner-node') }, owner.priv), /not be well formed/, 'never minted');
+    const keyed = signRoomGrant({ room: ROOM, grantee: U('bob'), granteeKey: bob.pub, grantedBy: U('owner-node') }, owner.priv);
+    const { granteeKey, ...bearer } = keyed; void granteeKey;
+    assert.strictEqual(decide(r, U('bob'), bob.pub, bearer).admit, false);
   });
 
   it('an expired grant is refused at join', () => {
     const owner = keypair(), late = keypair();
-    const r = receiver(ROOM, { nodeId: 'owner-node', publicKey: owner.pub });
+    const r = receiver(ROOM, { nodeId: U('owner-node'), publicKey: owner.pub });
     const longAgo = Date.now() - 48 * 3600_000;
     const grant = signRoomGrant(
-      { room: ROOM, grantee: 'late', granteeKey: late.pub, grantedBy: 'owner-node', grantedAt: longAgo, expiresAt: longAgo + 3600_000 },
+      { room: ROOM, grantee: U('late'), granteeKey: late.pub, grantedBy: U('owner-node'), grantedAt: longAgo, expiresAt: longAgo + 3600_000 },
       owner.priv);
-    assert.match(decide(r, 'late', late.pub, grant).reason, /expired/);
+    assert.match(decide(r, U('late'), late.pub, grant).reason, /expired/);
   });
 });
 
diff --git a/tests/room-grant-grantor.test.js b/tests/room-grant-grantor.test.js
index 073be4b9..3e275e64 100644
--- a/tests/room-grant-grantor.test.js
+++ b/tests/room-grant-grantor.test.js
@@ -23,23 +23,29 @@ describe('the grant must name the hand that signed it', () => {
     };
   };
   const ROOM2 = 'x-review--team-02779b950c3d8d7378fd11d6';
+  // MMP §5.8.1's grant schema: nodeIds are lowercase UUIDs, the key is 43 base64url characters.
+  const PEER = '018f47a0-7b21-7abc-8def-000000000001';
+  const SOMEONE_ELSE = '018f47a0-7b21-7abc-8def-0000000000e1';
+  const THE_OWNER = '018f47a0-7b21-7abc-8def-0000000000a1';
+  const WHOEVER = '018f47a0-7b21-7abc-8def-0000000000b1';
+  const PK = kp().pub;
 
   it('refuses a grant recording an issuer who is not the room owner, even when the OWNER signed it', () => {
     // Only the owner's key can produce this, so it is not an admission hole. But the grant IS the
     // evidence of admission, and an audit trail that names someone the cryptography does not
     // support is a record that cannot be relied on later.
     const owner = kp();
-    const g = signRoomGrant({ room: ROOM2, grantee: 'peer-1', granteeKey: 'pk', grantedBy: 'someone-else' }, owner.priv);
-    const v = verifyRoomGrant(g, owner.pub, { room: ROOM2, grantee: 'peer-1', provenKey: 'pk', ownerNodeId: 'the-owner' });
+    const g = signRoomGrant({ room: ROOM2, grantee: PEER, granteeKey: PK, grantedBy: SOMEONE_ELSE }, owner.priv);
+    const v = verifyRoomGrant(g, owner.pub, { room: ROOM2, grantee: PEER, provenKey: PK, ownerNodeId: THE_OWNER });
     assert.equal(v.ok, false);
     assert.match(v.reason, /grantor-not-owner/);
-    assert.match(v.reason, /someone-else/, 'the refusal must name what the grant claimed');
+    assert.ok(v.reason.includes(SOMEONE_ELSE), 'the refusal must name what the grant claimed');
   });
 
   it('accepts a coherent grant', () => {
     const owner = kp();
-    const g = signRoomGrant({ room: ROOM2, grantee: 'peer-1', granteeKey: 'pk', grantedBy: 'the-owner' }, owner.priv);
-    assert.equal(verifyRoomGrant(g, owner.pub, { room: ROOM2, grantee: 'peer-1', provenKey: 'pk', ownerNodeId: 'the-owner' }).ok, true);
+    const g = signRoomGrant({ room: ROOM2, grantee: PEER, granteeKey: PK, grantedBy: THE_OWNER }, owner.priv);
+    assert.equal(verifyRoomGrant(g, owner.pub, { room: ROOM2, grantee: PEER, provenKey: PK, ownerNodeId: THE_OWNER }).ok, true);
   });
 
   it('a grant signed by a MEMBER is refused by the signature, not merely by the coherence check', () => {
@@ -48,15 +54,15 @@ describe('the grant must name the hand that signed it', () => {
     // by a field the credential carries. A verifier that looked the key up by grantedBy would
     // admit this, which is exactly the hole dev-team-3 found in their own implementation.
     const owner = kp(); const member = kp();
-    const g = signRoomGrant({ room: ROOM2, grantee: 'peer-1', granteeKey: 'pk', grantedBy: 'the-owner' }, member.priv);
-    const v = verifyRoomGrant(g, owner.pub, { room: ROOM2, grantee: 'peer-1', provenKey: 'pk', ownerNodeId: 'the-owner' });
+    const g = signRoomGrant({ room: ROOM2, grantee: PEER, granteeKey: PK, grantedBy: THE_OWNER }, member.priv);
+    const v = verifyRoomGrant(g, owner.pub, { room: ROOM2, grantee: PEER, provenKey: PK, ownerNodeId: THE_OWNER });
     assert.equal(v.ok, false);
     assert.equal(v.reason, 'bad-signature', 'owner-only is enforced by the key, not by the label');
   });
 
   it('an older caller that passes no ownerNodeId still works', () => {
     const owner = kp();
-    const g = signRoomGrant({ room: ROOM2, grantee: 'peer-1', granteeKey: 'pk', grantedBy: 'whoever' }, owner.priv);
-    assert.equal(verifyRoomGrant(g, owner.pub, { room: ROOM2, grantee: 'peer-1', provenKey: 'pk' }).ok, true);
+    const g = signRoomGrant({ room: ROOM2, grantee: PEER, granteeKey: PK, grantedBy: WHOEVER }, owner.priv);
+    assert.equal(verifyRoomGrant(g, owner.pub, { room: ROOM2, grantee: PEER, provenKey: PK }).ok, true);
   });
 });
diff --git a/tests/room-grant-key-binding.test.js b/tests/room-grant-key-binding.test.js
index 92f2c5f9..40f22170 100644
--- a/tests/room-grant-key-binding.test.js
+++ b/tests/room-grant-key-binding.test.js
@@ -43,8 +43,8 @@ const invitee = ed25519();         // the node the owner MEANT to admit
 const impostor = ed25519();        // anyone who sees the invite URL
 
 const ROOM = 'first-scar-strike';
-const OWNER_ID = 'node-owner-0001';
-const INVITEE_ID = 'node-invitee-0002';
+const OWNER_ID = '018f47a0-7b21-7abc-8def-0000000000a1'; // lowercase UUIDs: MMP §5.8.1's grant schema
+const INVITEE_ID = '018f47a0-7b21-7abc-8def-0000000000a2';
 
 let failures = 0;
 const check = (name, got, want) => {
diff --git a/tests/room-join-auth.test.js b/tests/room-join-auth.test.js
index 896180cb..7347c5d8 100644
--- a/tests/room-join-auth.test.js
+++ b/tests/room-join-auth.test.js
@@ -30,6 +30,14 @@ function keypair() {
 
 const ROOM = 'x-review--team-02779b950c3d8d7378fd11d6';
 
+// MMP §5.8.1's grant schema: grantee and grantedBy are lowercase UUIDs, and a grant names the key
+// it binds. A readable name in these tests stands for a fixed UUID; a grant minted without a key
+// binds a fresh one.
+const U = (name) => { if (/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(String(name))) return name; const h = crypto.createHash('sha256').update(String(name)).digest('hex'); return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20, 32)}`; };
+function mint(fields, priv) {
+  return signRoomGrant({ ...fields, grantee: U(fields.grantee), grantedBy: U(fields.grantedBy), granteeKey: fields.granteeKey || keypair().pub }, priv);
+}
+
 describe('room ownability — derived from the mapping, not a hardcoded list', () => {
   it('ordinary and tenant-suffixed rooms are ownable', () => {
     assert.strictEqual(isOwnableRoom('backend-team'), true);
@@ -56,40 +64,40 @@ describe('room ownability — derived from the mapping, not a hardcoded list', (
 describe('the grant — mint and verify', () => {
   it('a grant minted by the owner verifies against the owner key', () => {
     const owner = keypair(), grantee = keypair();
-    const g = signRoomGrant({ room: ROOM, grantee: 'node-b', granteeKey: grantee.pub, grantedBy: 'node-a' }, owner.priv);
-    assert.deepStrictEqual(verifyRoomGrant(g, owner.pub, { room: ROOM, grantee: 'node-b', provenKey: grantee.pub }), { ok: true });
+    const g = mint({ room: ROOM, grantee: U('node-b'), granteeKey: grantee.pub, grantedBy: 'node-a' }, owner.priv);
+    assert.deepStrictEqual(verifyRoomGrant(g, owner.pub, { room: ROOM, grantee: U('node-b'), provenKey: grantee.pub }), { ok: true });
   });
 
   it('a DIFFERENT key never verifies it — the signature is the whole gate', () => {
     const owner = keypair(), impostor = keypair();
-    const g = signRoomGrant({ room: ROOM, grantee: 'node-b', grantedBy: 'node-a' }, owner.priv);
-    assert.strictEqual(verifyRoomGrant(g, impostor.pub, { room: ROOM, grantee: 'node-b', provenKey: 'proof-not-under-test' }).ok, false);
+    const g = mint({ room: ROOM, grantee: U('node-b'), grantedBy: 'node-a' }, owner.priv);
+    assert.strictEqual(verifyRoomGrant(g, impostor.pub, { room: ROOM, grantee: U('node-b'), provenKey: 'proof-not-under-test' }).ok, false);
   });
 
   it('a grant for one room cannot be replayed into another', () => {
     const owner = keypair();
-    const g = signRoomGrant({ room: ROOM, grantee: 'node-b', grantedBy: 'node-a' }, owner.priv);
+    const g = mint({ room: ROOM, grantee: U('node-b'), grantedBy: 'node-a' }, owner.priv);
     const moved = { ...g, room: 'other-room--team-0123456789abcdef01234567' };
-    assert.strictEqual(verifyRoomGrant(moved, owner.pub, { room: moved.room, grantee: 'node-b', provenKey: 'proof-not-under-test' }).ok, false, 'signature binds the room');
-    assert.strictEqual(verifyRoomGrant(g, owner.pub, { room: 'other-room', grantee: 'node-b', provenKey: 'proof-not-under-test' }).reason, 'room-mismatch');
+    assert.strictEqual(verifyRoomGrant(moved, owner.pub, { room: moved.room, grantee: U('node-b'), provenKey: 'proof-not-under-test' }).ok, false, 'signature binds the room');
+    assert.strictEqual(verifyRoomGrant(g, owner.pub, { room: 'other-room', grantee: U('node-b'), provenKey: 'proof-not-under-test' }).reason, 'room-mismatch');
   });
 
   it('a grant for one grantee cannot be presented by another', () => {
     const owner = keypair();
-    const g = signRoomGrant({ room: ROOM, grantee: 'node-b', grantedBy: 'node-a' }, owner.priv);
-    assert.strictEqual(verifyRoomGrant(g, owner.pub, { room: ROOM, grantee: 'node-c', provenKey: 'proof-not-under-test' }).reason, 'grantee-mismatch');
+    const g = mint({ room: ROOM, grantee: U('node-b'), grantedBy: 'node-a' }, owner.priv);
+    assert.strictEqual(verifyRoomGrant(g, owner.pub, { room: ROOM, grantee: U('node-c'), provenKey: 'proof-not-under-test' }).reason, 'grantee-mismatch');
   });
 
   it('the grantee key is bound: swapping it breaks the signature', () => {
     const owner = keypair(), a = keypair(), b = keypair();
-    const g = signRoomGrant({ room: ROOM, grantee: 'node-b', granteeKey: a.pub, grantedBy: 'node-a' }, owner.priv);
-    assert.strictEqual(verifyRoomGrant({ ...g, granteeKey: b.pub }, owner.pub, { room: ROOM, grantee: 'node-b', provenKey: 'proof-not-under-test' }).ok, false);
+    const g = mint({ room: ROOM, grantee: U('node-b'), granteeKey: a.pub, grantedBy: 'node-a' }, owner.priv);
+    assert.strictEqual(verifyRoomGrant({ ...g, granteeKey: b.pub }, owner.pub, { room: ROOM, grantee: U('node-b'), provenKey: 'proof-not-under-test' }).ok, false);
   });
 
   it('an unownable room cannot be granted at all, at mint or at verify', () => {
     const owner = keypair();
-    assert.throws(() => signRoomGrant({ room: 'sym', grantee: 'n', grantedBy: 'o' }, owner.priv), /cannot be owned/);
-    assert.throws(() => signRoomGrant({ room: 'default', grantee: 'n', grantedBy: 'o' }, owner.priv), /cannot be owned/);
+    assert.throws(() => mint({ room: 'sym', grantee: U('n'), grantedBy: 'o' }, owner.priv), /cannot be owned/);
+    assert.throws(() => mint({ room: 'default', grantee: U('n'), grantedBy: 'o' }, owner.priv), /cannot be owned/);
   });
 });
 
@@ -103,11 +111,9 @@ describe('the payload is injective — a delimiter cannot shift a field boundary
     assert.ok(!a.equals(b), 'distinct grants must never share a preimage');
   });
 
-  it('a grant signed for one grantee does not verify when re-split across the key field', () => {
+  it('a grant cannot even be minted for a grantee that is not a UUID, so there is nothing to re-split', () => {
     const owner = keypair();
-    const g = signRoomGrant({ room: ROOM, grantee: 'x|y', granteeKey: 'z', grantedBy: 'o' }, owner.priv);
-    const resplit = { ...g, grantee: 'x', granteeKey: 'y|z' };
-    assert.strictEqual(verifyRoomGrant(resplit, owner.pub, { room: ROOM, grantee: 'x' }).ok, false);
+    assert.throws(() => signRoomGrant({ room: ROOM, grantee: 'x|y', granteeKey: keypair().pub, grantedBy: U('o') }, owner.priv), /not be well formed/);
   });
 
   it('the domain separator keeps a room grant from being read as any other signed object', () => {
@@ -120,7 +126,7 @@ describe('the 24h cap IS the offline-revocation window — enforced by the recei
   it('the minter clamps a longer request to the cap', () => {
     const owner = keypair();
     const now = 1_700_000_000_000;
-    const g = signRoomGrant({ room: ROOM, grantee: 'b', grantedBy: 'a', grantedAt: now, expiresAt: now + 365 * 86400_000 }, owner.priv);
+    const g = mint({ room: ROOM, grantee: U('b'), grantedBy: 'a', grantedAt: now, expiresAt: now + 365 * 86400_000 }, owner.priv);
     assert.strictEqual(g.expiresAt, now + MAX_GRANT_LIFETIME_MS, 'clamped at mint');
   });
 
@@ -129,12 +135,12 @@ describe('the 24h cap IS the offline-revocation window — enforced by the recei
     // the clamp (or a hostile one) must not buy a longer window from this receiver
     const owner = keypair();
     const now = 1_700_000_000_000;
-    const g = { type: 'room-join', room: ROOM, grantee: 'b', granteeKey: 'k', grantedBy: 'a', grantedAt: now, expiresAt: now + 30 * 86400_000 };
-    g.sig = crypto.sign(null,
-      Buffer.from(`room-join|${g.room}|${g.grantee}||${g.grantedBy}|${g.grantedAt}|${g.expiresAt}`, 'utf8'),
+    const k = keypair().pub;
+    const g = { type: 'room-join', room: ROOM, grantee: U('b'), granteeKey: k, grantedBy: U('a'), grantedAt: now, expiresAt: now + 30 * 86400_000 };
+    g.sig = crypto.sign(null, roomGrantPayload(g),
       crypto.createPrivateKey({ key: Buffer.concat([Buffer.from('302e020100300506032b657004220420', 'hex'), Buffer.from(owner.priv, 'base64url')]), format: 'der', type: 'pkcs8' })).toString('base64url');
     g.sigAlg = 'ed25519';
-    const v = verifyRoomGrant(g, owner.pub, { room: ROOM, grantee: 'b', provenKey: 'k', now: now + 1000 });
+    const v = verifyRoomGrant(g, owner.pub, { room: ROOM, grantee: U('b'), provenKey: k, now: now + 1000 });
     assert.strictEqual(v.ok, false);
     assert.strictEqual(v.reason, 'lifetime-exceeds-cap', 'refused outright — the window is never the sender\'s choice');
   });
@@ -142,26 +148,26 @@ describe('the 24h cap IS the offline-revocation window — enforced by the recei
   it('an expired grant is refused, and skew is tolerated at the boundary', () => {
     const owner = keypair(), inv = keypair();
     const now = 1_700_000_000_000;
-    const g = signRoomGrant({ room: ROOM, grantee: 'b', granteeKey: inv.pub, grantedBy: 'a', grantedAt: now, expiresAt: now + 60_000 }, owner.priv);
-    assert.strictEqual(verifyRoomGrant(g, owner.pub, { room: ROOM, grantee: 'b', provenKey: inv.pub, now: now + 30_000 }).ok, true, 'live');
-    assert.strictEqual(verifyRoomGrant(g, owner.pub, { room: ROOM, grantee: 'b', provenKey: inv.pub, now: now + 60_000 + EXPIRY_SKEW_MS - 1 }).ok, true, 'inside skew');
-    assert.strictEqual(verifyRoomGrant(g, owner.pub, { room: ROOM, grantee: 'b', provenKey: inv.pub, now: now + 60_000 + EXPIRY_SKEW_MS + 1 }).reason, 'expired');
+    const g = mint({ room: ROOM, grantee: U('b'), granteeKey: inv.pub, grantedBy: 'a', grantedAt: now, expiresAt: now + 60_000 }, owner.priv);
+    assert.strictEqual(verifyRoomGrant(g, owner.pub, { room: ROOM, grantee: U('b'), provenKey: inv.pub, now: now + 30_000 }).ok, true, 'live');
+    assert.strictEqual(verifyRoomGrant(g, owner.pub, { room: ROOM, grantee: U('b'), provenKey: inv.pub, now: now + 60_000 + EXPIRY_SKEW_MS - 1 }).ok, true, 'inside skew');
+    assert.strictEqual(verifyRoomGrant(g, owner.pub, { room: ROOM, grantee: U('b'), provenKey: inv.pub, now: now + 60_000 + EXPIRY_SKEW_MS + 1 }).reason, 'expired');
   });
 
   it('a grant from the future is refused beyond skew', () => {
     const owner = keypair(), inv = keypair();
     const now = 1_700_000_000_000;
-    const g = signRoomGrant({ room: ROOM, grantee: 'b', granteeKey: inv.pub, grantedBy: 'a', grantedAt: now, expiresAt: now + 3600_000 }, owner.priv);
-    assert.strictEqual(verifyRoomGrant(g, owner.pub, { room: ROOM, grantee: 'b', provenKey: inv.pub, now: now - EXPIRY_SKEW_MS - 1 }).reason, 'not-yet-valid');
+    const g = mint({ room: ROOM, grantee: U('b'), granteeKey: inv.pub, grantedBy: 'a', grantedAt: now, expiresAt: now + 3600_000 }, owner.priv);
+    assert.strictEqual(verifyRoomGrant(g, owner.pub, { room: ROOM, grantee: U('b'), provenKey: inv.pub, now: now - EXPIRY_SKEW_MS - 1 }).reason, 'not-yet-valid');
   });
 
   it('unsigned, wrong-typed and key-less inputs all fail closed', () => {
     const owner = keypair();
-    const g = signRoomGrant({ room: ROOM, grantee: 'b', grantedBy: 'a' }, owner.priv);
-    assert.strictEqual(verifyRoomGrant({ ...g, sig: undefined }, owner.pub, { room: ROOM, grantee: 'b' }).reason, 'unsigned');
-    assert.strictEqual(verifyRoomGrant({ ...g, type: 'role-grant' }, owner.pub, { room: ROOM, grantee: 'b' }).reason, 'not-a-room-join-grant');
-    assert.strictEqual(verifyRoomGrant(g, null, { room: ROOM, grantee: 'b' }).reason, 'no-owner-key-pinned');
-    assert.strictEqual(verifyRoomGrant(null, owner.pub, { room: ROOM, grantee: 'b' }).ok, false);
+    const g = mint({ room: ROOM, grantee: U('b'), grantedBy: 'a' }, owner.priv);
+    assert.strictEqual(verifyRoomGrant({ ...g, sig: undefined }, owner.pub, { room: ROOM, grantee: U('b') }).reason, 'unsigned');
+    assert.strictEqual(verifyRoomGrant({ ...g, type: 'role-grant' }, owner.pub, { room: ROOM, grantee: U('b') }).reason, 'not-a-room-join-grant');
+    assert.strictEqual(verifyRoomGrant(g, null, { room: ROOM, grantee: U('b') }).reason, 'no-owner-key-pinned');
+    assert.strictEqual(verifyRoomGrant(null, owner.pub, { room: ROOM, grantee: U('b') }).ok, false);
   });
 });
 
@@ -252,13 +258,13 @@ describe('end to end: the incident this exists to make impossible', () => {
 
     // the stranger presents nothing — there is no path to admission
     assert.strictEqual(reg.isGated(ROOM), true);
-    assert.strictEqual(verifyRoomGrant(null, reg.ownerOf(ROOM).publicKey, { room: ROOM, grantee: 'stranger-node', provenKey: 'anything' }).ok, false);
+    assert.strictEqual(verifyRoomGrant(null, reg.ownerOf(ROOM).publicKey, { room: ROOM, grantee: U('stranger-node'), provenKey: 'anything' }).ok, false);
 
     // the owner deliberately admits a FOREIGN crew — sharing as an act
-    const grant = signRoomGrant(
+    const grant = mint(
       { room: ROOM, grantee: 'volunteer-node', granteeKey: volunteer.pub, grantedBy: 'owner-node' }, owner.priv);
     assert.strictEqual(
-      verifyRoomGrant(grant, reg.ownerOf(ROOM).publicKey, { room: ROOM, grantee: 'volunteer-node', provenKey: volunteer.pub }).ok, true,
+      verifyRoomGrant(grant, reg.ownerOf(ROOM).publicKey, { room: ROOM, grantee: U('volunteer-node'), provenKey: volunteer.pub }).ok, true,
       'an open room stays possible — it is now a decision someone made');
   });
 });
@@ -266,17 +272,17 @@ describe('end to end: the incident this exists to make impossible', () => {
 describe('review folds — the guard cannot be defeated by how it is CALLED', () => {
   it('F2: omitting the expectation is a refusal, never a pass — no bearer tokens', () => {
     const owner = keypair();
-    const g = signRoomGrant({ room: ROOM, grantee: 'b', grantedBy: 'a' }, owner.priv);
+    const g = mint({ room: ROOM, grantee: U('b'), grantedBy: 'a' }, owner.priv);
     // the old default returned ok here: any copy of any unexpired grant, presented by anyone
     assert.strictEqual(verifyRoomGrant(g, owner.pub).reason, 'no-expectation');
     assert.strictEqual(verifyRoomGrant(g, owner.pub, {}).reason, 'no-expectation');
     assert.strictEqual(verifyRoomGrant(g, owner.pub, { room: ROOM }).reason, 'no-expectation', 'room alone is not enough');
-    assert.strictEqual(verifyRoomGrant(g, owner.pub, { grantee: 'b' }).reason, 'no-expectation', 'grantee alone is not enough');
+    assert.strictEqual(verifyRoomGrant(g, owner.pub, { grantee: U('b') }).reason, 'no-expectation', 'grantee alone is not enough');
     // AND THE HALF THIS TEST WAS NAMED FOR BUT DID NOT COVER (2026-09-16): room + grantee alone
     // used to admit, which made the grant a bearer token for anyone holding the string. A proven
     // key is now part of the expectation, and its absence is a refusal like any other.
-    assert.strictEqual(verifyRoomGrant(g, owner.pub, { room: ROOM, grantee: 'b' }).ok, false, 'room + grantee alone is a bearer token');
-    assert.match(String(verifyRoomGrant(g, owner.pub, { room: ROOM, grantee: 'b' }).reason), /no-proven-key/);
+    assert.strictEqual(verifyRoomGrant(g, owner.pub, { room: ROOM, grantee: U('b') }).ok, false, 'room + grantee alone is a bearer token');
+    assert.match(String(verifyRoomGrant(g, owner.pub, { room: ROOM, grantee: U('b') }).reason), /no-proven-key/);
   });
 });
 
diff --git a/tests/spec-update-session.test.js b/tests/spec-update-session.test.js
new file mode 100644
index 00000000..9da8dc0a
--- /dev/null
+++ b/tests/spec-update-session.test.js
@@ -0,0 +1,178 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME before lib/config loads
+
+/**
+ * sym 0.14.0 aligned with the MMP 2.0 update 1 drafts it implements (the session and sealed-control
+ * set: #26, #30, #31, #37, #23), the founder's rulings for that update, and the reviews of each draft
+ * against sym 390b4af. Each test here fails on 390b4af.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const crypto = require('crypto');
+const { SymNode } = require('../lib/node');
+const { NullDiscovery } = require('../lib/discovery');
+const { nodeDirById } = require('../lib/config');
+const { PeerSession } = require('../lib/session');
+const { buildControlFrame, openControlSealed } = require('../lib/core/sealed-control');
+const { buildEncryptedFrame } = require('../lib/core/cmb-encrypted-frame');
+const { signRoomGrant, verifyRoomGrant } = require('../lib/core/room-grant');
+const { identity, connectNodes, until, signedRecord, signerOf } = require('./_core-secure');
+
+const uniq = (b) => `${b}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+const made = [];
+function node(base, opts = {}) {
+  const n = new SymNode({ name: uniq(base), silent: true, discovery: new NullDiscovery(), room: opts.room || 'upd', ...opts });
+  made.push(n);
+  return n;
+}
+async function stopAll() {
+  for (const n of made.splice(0)) { try { await n.stop(); } catch { /* */ } try { fs.rmSync(nodeDirById(n.nodeId), { recursive: true, force: true }); } catch { /* */ } }
+}
+const sessionTo = (n, other) => { const p = n._peers.get(other.nodeId); return p && p.transport; };
+
+describe('S1: the signed room governs the seal point (#26)', () => {
+  it('a record signed for another room is never sealed to a session, whichever path offers it', async () => {
+    try {
+      const A = node('s1-a', { room: 'beta' }); const B = node('s1-b', { room: 'beta' });
+      await A.start(); await B.start();
+      await connectNodes(B, A);
+      // A held this before it moved rooms: its own record, signed for 'alpha'.
+      const old = signedRecord(signerOf(A), { categories: { focus: 'said in the alpha room' }, room: 'alpha' });
+      const r = sessionTo(A, B).trySend({ type: 'cmb', cmb: old });
+      assert.strictEqual(r.ok, false);
+      assert.strictEqual(r.reason, 'not-addressed');
+      // The same record for this room goes.
+      const here = signedRecord(signerOf(A), { categories: { focus: 'said in the beta room' }, room: 'beta' });
+      assert.strictEqual(sessionTo(A, B).trySend({ type: 'cmb', cmb: here }).ok, true);
+      // A fetch for the old record is answered missing: the store is per node, not per room.
+      A._store.receiveFromPeer('self-older', { key: old.metadata.key, content: 'x', source: A.name, cmb: old, _cmbVerified: true });
+      const got = await B.fetchCMB(old.metadata.key, { timeoutMs: 1500 });
+      assert.strictEqual(got, null, 'never served across rooms');
+    } finally { await stopAll(); }
+  });
+});
+
+describe('S2: a room-join grant is checked against its schema before it is verified (#31)', () => {
+  const kp = () => { const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519'); return { pub: publicKey.export({ format: 'jwk' }).x, priv: privateKey.export({ format: 'jwk' }).d }; };
+  it('string timestamps (the same signed bytes) are refused; so is any member the schema does not define', () => {
+    const owner = kp(); const grantee = kp();
+    const ownerId = crypto.randomUUID(); const granteeId = crypto.randomUUID();
+    const now = Date.now();
+    const g = signRoomGrant({ room: 'team-room', grantee: granteeId, granteeKey: grantee.pub, grantedBy: ownerId, grantedAt: now - 1000, expiresAt: now + 60_000 }, owner.priv);
+    const expect = { room: 'team-room', grantee: granteeId, provenKey: grantee.pub, ownerNodeId: ownerId };
+    assert.strictEqual(verifyRoomGrant(g, owner.pub, expect).ok, true);
+    const strings = { ...g, grantedAt: String(g.grantedAt), expiresAt: String(g.expiresAt) };
+    const r = verifyRoomGrant(strings, owner.pub, expect);
+    assert.strictEqual(r.ok, false, 'a grant whose timestamps are strings never verifies');
+    assert.match(r.reason, /malformed/);
+    assert.strictEqual(verifyRoomGrant({ ...g, note: 'x' }, owner.pub, expect).ok, false, 'an extra member: malformed');
+    assert.strictEqual(verifyRoomGrant({ ...g, expiresAt: g.expiresAt + 0.5 }, owner.pub, expect).ok, false, 'not an integer');
+  });
+  it('a node sends the schema\'s grant only, whatever object its host passed', () => {
+    const { grantForWire } = require('../lib/core/room-grant');
+    const owner = kp();
+    const g = signRoomGrant({ room: 'team-room', grantee: crypto.randomUUID(), granteeKey: kp().pub, grantedBy: crypto.randomUUID() }, owner.priv);
+    assert.deepStrictEqual(grantForWire({ ...g, note: 'host data', extra: 1 }), g);
+  });
+  it('the grant a node mints is the schema\'s object only: extra members the caller passed are not kept', () => {
+    const owner = kp();
+    const g = signRoomGrant({ room: 'team-room', grantee: crypto.randomUUID(), granteeKey: kp().pub, grantedBy: crypto.randomUUID(), note: 'host data' }, owner.priv);
+    assert.deepStrictEqual(Object.keys(g).sort(), ['expiresAt', 'grantedAt', 'grantedBy', 'grantee', 'granteeKey', 'room', 'sig', 'sigAlg', 'type'].sort());
+  });
+});
+
+describe('S4: a sealed frame that opens advances the receive sequence (#26)', () => {
+  /** A confirmed pair of PeerSessions over a memory pipe, and a way to inject sealed frames from one to the other. */
+  async function pair() {
+    const A = node('s4-a'); const B = node('s4-b');
+    await A.start(); await B.start();
+    await connectNodes(B, A);
+    const sA = sessionTo(A, B); const sB = sessionTo(B, A);
+    return { A, B, sA, sB };
+  }
+  it('an authentic control frame whose inner frame is refused changes nothing else: the next frame is taken', async () => {
+    try {
+      const { sA, sB } = await pair();
+      const refused = []; const closed = [];
+      sB.on('refused', (type, reason) => refused.push([type, reason]));
+      sB.on('closed', (e) => closed.push(e.reason));
+      // A sealed frame whose plaintext is not a control frame (a relay frame type inside).
+      const pos = sA._mmp.nextSend();
+      const bad = buildControlFrame({ frame: { type: 'mood', mood: 'x' }, sessionId: sA.sessionId, direction: pos.direction, sequence: pos.sequence, trafficKey: pos.trafficKey });
+      // Re-seal with a forbidden inner type at the same position (bypassing the builder's own refusal).
+      const { sealV2 } = require('../lib/core/e2e-v2');
+      const { nonceForSequence } = require('../lib/core/cmb-encrypted-frame');
+      const { controlAAD } = require('../lib/core/sealed-control');
+      bad.sealed = sealV2(pos.trafficKey, nonceForSequence(pos.sequence), controlAAD(bad), Buffer.from(JSON.stringify({ type: 'relay-auth', nodeId: 'x' }))).toString('base64url').replace(/=+$/, '');
+      sA._wire(bad);
+      await new Promise((r) => setTimeout(r, 30));
+      assert.ok(refused.some(([, reason]) => /inner frame refused/.test(reason)), JSON.stringify(refused));
+      // The next ordinary frame is taken: no gap, no close.
+      const got = [];
+      sB.on('frame', (f) => got.push(f.type));
+      sA.trySend({ type: 'peer-info', peers: [] });
+      await until(() => got.includes('peer-info'), 1000);
+      assert.deepStrictEqual(closed, []);
+      assert.ok(got.includes('peer-info'));
+    } finally { await stopAll(); }
+  });
+  it('an authentic record whose plaintext is refused changes nothing else either', async () => {
+    try {
+      const { sA, sB } = await pair();
+      const closed = [];
+      sB.on('closed', (e) => closed.push(e.reason));
+      const pos = sA._mmp.nextSend();
+      const rec = signedRecord(identity('x'), { room: sA.room });
+      const wire = buildEncryptedFrame({ cmb: rec, applicationBytes: null, sessionId: sA.sessionId, direction: pos.direction, sequence: pos.sequence, trafficKey: pos.trafficKey });
+      // The same position, with a plaintext that is not an object.
+      const { sealV2 } = require('../lib/core/e2e-v2');
+      const { nonceForSequence } = require('../lib/core/cmb-encrypted-frame');
+      const { aeadAADv2 } = require('../lib/core/e2e-v2');
+      const m = wire.metadata;
+      const aad = aeadAADv2({ protocolVersion: '2.0', sessionId: wire.sessionId, direction: wire.direction, sequence: String(wire.sequence), key: m.key, assertionId: m.assertionId, createdByNodeId: m.createdByNodeId, room: m.room, to: m.to });
+      wire.sealed = sealV2(pos.trafficKey, nonceForSequence(pos.sequence), aad, Buffer.from('not json at all')).toString('base64url').replace(/=+$/, '');
+      sA._wire(wire);
+      await new Promise((r) => setTimeout(r, 30));
+      const got = [];
+      sB.on('frame', (f) => got.push(f.type));
+      sA.trySend({ type: 'peer-info', peers: [] });
+      await until(() => got.includes('peer-info'), 1000);
+      assert.deepStrictEqual(closed, []);
+    } finally { await stopAll(); }
+  });
+});
+
+describe('§7.2: every sealed Close-action error closes the session; a host sends only information (#23)', () => {
+  it('a sealed 1008 from a peer closes the session; a sealed 2001 does not', async () => {
+    try {
+      const A = node('e-a'); const B = node('e-b');
+      await A.start(); await B.start();
+      await connectNodes(B, A);
+      const closed = [];
+      sessionTo(B, A).on('closed', (e) => closed.push(e.reason));
+      sessionTo(A, B).trySend({ type: 'error', code: 2001, message: 'svaf rejected' });
+      await new Promise((r) => setTimeout(r, 30));
+      assert.deepStrictEqual(closed, []);
+      sessionTo(A, B).trySend({ type: 'error', code: 1008, message: 'replay' });
+      await until(() => closed.length > 0, 1000);
+      assert.deepStrictEqual(closed, ['peer-closed']);
+    } finally { await stopAll(); }
+  });
+  it('sendError refuses 1009, 1010, 1011, the other Close codes and 4xxx; 1002 and 2xxx go', async () => {
+    try {
+      const A = node('se-a'); const B = node('se-b');
+      await A.start(); await B.start();
+      await connectNodes(B, A);
+      for (const code of [1001, 1006, 1009, 1010, 1011, 4004, 4007, 999, 'x']) {
+        assert.throws(() => A.sendError(B.nodeId, code, 'no'), (e) => e.code === 'EBADERRORCODE', String(code));
+      }
+      assert.doesNotThrow(() => A.sendError(B.nodeId, 2001, 'svaf rejected'));
+      assert.doesNotThrow(() => A.sendError(B.nodeId, 1002, 'frame rejected'));
+    } finally { await stopAll(); }
+  });
+});
+
+void PeerSession; void openControlSealed;

From 018206df4026e56b85e19cb556313ebd0f652efb Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 8 Oct 2026 11:16:04 +0100
Subject: [PATCH 126/148] attestations: none about directed or Legacy Import
 records; the #27 wire grammar; equivocation relayed once; no root over a
 suffix (S3, D1, #27)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

MMP 2.0 update 1 (#27, sym-attest-v1) and the review of it against 390b4af:

- S3: no attestation is signed about a directed record (a signed `to`) or a Legacy Import record,
  so none enters this node's chain or is gossiped: the room would otherwise learn a sealed one-to-one
  record's cognition key, assertion and verdict (a confirmation oracle on private content), and
  every receiver refused the Legacy Import ones anyway (no assertion id). A peer's attestation about
  a directed record this node holds is kept as evidence and never relayed.
- Grammar: the attestation object is closed (a member the schema does not define refuses it), with
  exactly seven verdicts; by and attester are lowercase UUIDs; a role is up to 64 characters (any
  role a §6.6.2 grant confers), a method up to 32.
- Equivocation: the conflicting checkpoint is relayed once, as evidence; a witness already signed
  stands; a third root is dropped before any work, as before.
- _attesterRole judges a scoped role on the record its assertionId names: a cognition key is shared
  by every record with the same categories, so one held under it but asserted by another judges no
  scope.
- D1 (until #27's chained construction lands): a checkpoint root is never signed over a suffix of
  this node's chain. Once its own early attestations are evicted, checkpoints pause, and the node
  says so once.
- The attestation-received doc comment no longer calls `method` unsigned.

Tests: spec-update-attest (each fails on 390b4af). gossip-lanes and admission-attestation use UUID
signers, and expect the conflicting copy relayed once.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QRVMpaJkAA2fFbvuHCEzqH
---
 lib/core/attestation.js             |  17 ++-
 lib/frame-handler.js                |  11 +-
 lib/node-authority.js               |   8 +-
 lib/node.js                         |  49 ++++++---
 tests/admission-attestation.test.js |   5 +-
 tests/gossip-lanes.test.js          |  11 +-
 tests/spec-update-attest.test.js    | 162 ++++++++++++++++++++++++++++
 7 files changed, 234 insertions(+), 29 deletions(-)
 create mode 100644 tests/spec-update-attest.test.js

diff --git a/lib/core/attestation.js b/lib/core/attestation.js
index 31a0a775..bbf3f501 100644
--- a/lib/core/attestation.js
+++ b/lib/core/attestation.js
@@ -239,8 +239,14 @@ function verifyWitness(w, witnessPublicKeyB64url) {
 
 // ── The wire form (sym-attest-v1 §5) ─────────────────────────────────────────────────
 
-const ID_RE = /^[\x21-\x7e]{1,128}$/;
-const TOKEN_RE = /^[a-z0-9][a-z0-9_-]{0,31}$/;
+// sym-attest-v1 as MMP 2.0 update 1 registers it (#27): the attester and witness are nodes, so a
+// lowercase UUID (§3.1.1); a role is any role a grant can confer (§6.6.2: up to 64 characters); a
+// method a short token.
+const ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+const METHOD_RE = /^[a-z0-9][a-z0-9_-]{0,31}$/;
+const ROLE_RE = /^[a-z0-9][a-z0-9_-]{0,63}$/;
+/** The members of an attestation, exactly: the object is closed. */
+const ATTESTATION_MEMBERS = new Set(['of', 'assertionId', 'by', 'at', 'room', 'method', 'verdict', 'categories', 'role', 'seq', 'prev', 'sigAlg', 'sig']);
 const HEX64 = /^[0-9a-f]{64}$/;
 const SIG_RE = /^[A-Za-z0-9_-]{86}$/;
 const isId = (v) => typeof v === 'string' && ID_RE.test(v);
@@ -261,17 +267,18 @@ function toWireAttestation(a) {
  */
 function fromWireAttestation(w) {
   if (!w || typeof w !== 'object' || Array.isArray(w)) return null;
+  for (const k of Object.keys(w)) if (!ATTESTATION_MEMBERS.has(k)) return null; // closed (#27)
   if (typeof w.of !== 'string' || !/^cmb-[0-9a-f]{64}$/.test(w.of)) return null;
   if (typeof w.assertionId !== 'string' || !/^asrt-[0-9a-f]{64}$/.test(w.assertionId)) return null;
   if (!isId(w.by) || !isTime(w.at) || !isRoom(w.room)) return null;
-  if (typeof w.method !== 'string' || !TOKEN_RE.test(w.method)) return null;
+  if (typeof w.method !== 'string' || !METHOD_RE.test(w.method)) return null;
   if (!RECORD_VERDICTS.includes(w.verdict)) return null;
   const c = w.categories;
   if (!c || typeof c !== 'object' || Array.isArray(c)) return null;
   const categories = {};
   for (const f of CAT7_CATEGORIES) { if (!VERDICTS.includes(c[f])) return null; categories[f] = c[f]; }
   if (Object.keys(c).length !== CAT7_CATEGORIES.length) return null;
-  if (typeof w.role !== 'string' || !TOKEN_RE.test(w.role)) return null;
+  if (typeof w.role !== 'string' || !ROLE_RE.test(w.role)) return null;
   if (!isPos(w.seq)) return null;
   if (w.seq === 1 ? w.prev !== 'genesis' : !(typeof w.prev === 'string' && HEX64.test(w.prev))) return null;
   if (w.sigAlg !== 'ed25519' || typeof w.sig !== 'string' || !SIG_RE.test(w.sig)) return null;
@@ -294,7 +301,7 @@ function toWireWitness(x) {
 function fromWireWitness(w) {
   if (!w || typeof w !== 'object' || Array.isArray(w)) return null;
   if (!isId(w.attester) || !isRoom(w.room) || !isPos(w.uptoSeq) || typeof w.root !== 'string' || !HEX64.test(w.root)) return null;
-  if (!isId(w.by) || typeof w.role !== 'string' || !TOKEN_RE.test(w.role) || !isTime(w.at)) return null;
+  if (!isId(w.by) || typeof w.role !== 'string' || !ROLE_RE.test(w.role) || !isTime(w.at)) return null;
   if (w.sigAlg !== 'ed25519' || typeof w.sig !== 'string' || !SIG_RE.test(w.sig)) return null;
   return { type: 'witness', attester: w.attester, roster: w.room, upto_seq: w.uptoSeq, root: w.root, by: w.by, role: w.role, at: w.at, sigAlg: w.sigAlg, sig: w.sig };
 }
diff --git a/lib/frame-handler.js b/lib/frame-handler.js
index de9de83b..2c71af75 100644
--- a/lib/frame-handler.js
+++ b/lib/frame-handler.js
@@ -136,6 +136,9 @@ const AUDIENCE_REPORT_MS = 60_000;
  *
  * Routes each frame type to the appropriate handler method.
  */
+/** Whether a record carries a signed `to` (a directed record). */
+const recordDirected = (c) => !!(c && c.metadata && c.metadata.to !== null && c.metadata.to !== undefined);
+
 class FrameHandler {
 
   /**
@@ -1373,7 +1376,7 @@ class FrameHandler {
           stableThreshold: this._node._svafStableThreshold,
           guardedThreshold: this._node._svafGuardedThreshold,
         });
-        this._node._buildAdmissionAttestation(rejKey, 'rejected', rejVerdicts, 'neural', msg.cmb?.metadata?.assertionId, { quarantined: msg._legacyImport === true });
+        this._node._buildAdmissionAttestation(rejKey, 'rejected', rejVerdicts, 'neural', msg.cmb?.metadata?.assertionId, { quarantined: msg._legacyImport === true, directed: recordDirected(msg.cmb) });
       }
 
       // MMP Section 9.3: mood MUST still be delivered from rejected CMBs.
@@ -1429,7 +1432,7 @@ class FrameHandler {
         guardedThreshold: this._node._svafGuardedThreshold,
       });
       // `of` is the record's cognition key (never the directed mark this node dedups by).
-      const att = this._node._buildAdmissionAttestation(recordKey(msg.cmb) || incomingKey, decision, categoryVerdicts, 'neural', msg.cmb?.metadata?.assertionId, { quarantined: msg._legacyImport === true });
+      const att = this._node._buildAdmissionAttestation(recordKey(msg.cmb) || incomingKey, decision, categoryVerdicts, 'neural', msg.cmb?.metadata?.assertionId, { quarantined: msg._legacyImport === true, directed: recordDirected(msg.cmb) });
       // On the entry, beside the record: a two-section record has exactly two members (§8.8.1).
       if (att) fusedEntry.admission = att;
     }
@@ -1552,7 +1555,7 @@ class FrameHandler {
       // event (omission-evidence). The Phase-A heuristic already produced the
       // per-category verdict; index it (no remix is stored on this path).
       const rejKey = recordKey(msg.cmb) || msg.key;
-      if (rejKey) this._node._buildAdmissionAttestation(rejKey, result.decision, result.categoryVerdicts, 'heuristic', msg.cmb?.metadata?.assertionId, { quarantined: msg._legacyImport === true });
+      if (rejKey) this._node._buildAdmissionAttestation(rejKey, result.decision, result.categoryVerdicts, 'heuristic', msg.cmb?.metadata?.assertionId, { quarantined: msg._legacyImport === true, directed: recordDirected(msg.cmb) });
 
       // MMP Section 9.3: mood MUST still be delivered from rejected CMBs.
       // (redundant signals also deliver mood — the affect may have changed)
@@ -1568,7 +1571,7 @@ class FrameHandler {
     // persist it on the remix's store entry as the durable audit record.
     if (result.fusedEntry && result.fusedEntry.cmb) {
       const of = recordKey(msg.cmb) || msg.key;
-      const att = this._node._buildAdmissionAttestation(of, result.decision, result.categoryVerdicts, 'heuristic', msg.cmb?.metadata?.assertionId, { quarantined: msg._legacyImport === true });
+      const att = this._node._buildAdmissionAttestation(of, result.decision, result.categoryVerdicts, 'heuristic', msg.cmb?.metadata?.assertionId, { quarantined: msg._legacyImport === true, directed: recordDirected(msg.cmb) });
       // On the entry, beside the record: a two-section record has exactly two members (§8.8.1).
       if (att) result.fusedEntry.admission = att;
     }
diff --git a/lib/node-authority.js b/lib/node-authority.js
index 14fafda0..df09a0fa 100644
--- a/lib/node-authority.js
+++ b/lib/node-authority.js
@@ -184,7 +184,13 @@ const methods = {
   _attesterRole(att) {
     if (!att) return 'participant';
     let cmb = null;
-    try { const e = this._store.get(att.of); cmb = e && e.cmb; } catch { cmb = null; }
+    // The attested record is the one its assertion names: a cognition key is shared by every record
+    // with the same categories, so a record held under it but asserted by another (another author,
+    // another room) is not the one attested, and its fields judge no scope (#27).
+    try {
+      const e = this._store.get(att.of);
+      cmb = e && e.cmb && e.cmb.metadata && att.assertionId && e.cmb.metadata.assertionId === att.assertionId ? e.cmb : null;
+    } catch { cmb = null; }
     return this.resolveRole(att.by, { cmb });
   },
 
diff --git a/lib/node.js b/lib/node.js
index 65979fc4..3786b983 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -1109,11 +1109,13 @@ class SymNode extends EventEmitter {
    * @param {string} method - 'neural' | 'heuristic'
    * @private
    */
-  _buildAdmissionAttestation(of, verdict, categoryVerdicts, method, assertionId, { quarantined = false } = {}) {
-    // A Legacy Import record is quarantined (design D7), and so is what this node says about it
-    // (security review E): the method, which the signature covers, carries the mark, so no reader
-    // weighs this verdict as one about a verified record.
-    if (quarantined) method = `legacy-import-${method}`;
+  _buildAdmissionAttestation(of, verdict, categoryVerdicts, method, assertionId, { quarantined = false, directed = false } = {}) {
+    // No attestation is signed about a Legacy Import record (#27: only records verified under Core
+    // Secure are attested; every receiver refuses one without an assertion id) or about a directed
+    // record (#27: the room would learn a sealed one-to-one record's key, assertion and verdict, a
+    // confirmation oracle on private content). Neither enters this node's chain, so the chain the room
+    // sees has no gap where one was left out.
+    if (quarantined || directed) return null;
     const att = {
       of,
       assertionId,
@@ -1263,6 +1265,14 @@ class SymNode extends EventEmitter {
   _emitCheckpoint() {
     const chain = this._attestations.chainOf(this.nodeId);
     if (chain.length === 0) return null;
+    // A root commits to seq 1..uptoSeq (sym-attest-v1 §5.2). Once the store has evicted any of this
+    // node's own attestations it holds a suffix, and a root over a suffix labelled uptoSeq is a false
+    // statement every peer would find inconsistent: none is signed. (MMP 2.0 update 1 chains each
+    // checkpoint to the previous root, so a bounded state suffices; sym adopts it when #27 lands.)
+    if (chain[0].seq !== 1 || chain[chain.length - 1].seq !== chain.length) {
+      if (!this._checkpointSuffixSaid) { this._checkpointSuffixSaid = true; this._log('Checkpoints paused: this node\'s own attestation chain is no longer held from its first entry (a root over a suffix is never signed)'); }
+      return null;
+    }
     const cp = {
       type: 'checkpoint',
       scheme: ATTEST_SCHEME,
@@ -1328,6 +1338,9 @@ class SymNode extends EventEmitter {
       // Two signed roots for one position: equivocation, or a chain restarted after a lost log.
       this._log(`[sym-security] conflicting checkpoint from ${String(cp.by).slice(0, 8)} at ${cp.upto_seq}: kept root ${String(r.keptRoot).slice(0, 12)}, refused ${String(cp.root).slice(0, 12)}`);
       this.emit('metric', { type: 'attestation-conflict', kind: 'checkpoint', attester: cp.by, upto_seq: cp.upto_seq, keptRoot: r.keptRoot, otherRoot: cp.root });
+      // The conflicting copy is relayed once, as evidence, so the room learns of the equivocation (#27);
+      // a witness this node already signed for the first root stands.
+      this._gossipToRoster({ type: ATTEST_FRAME.checkpoint, checkpoint: toWireCheckpoint(cp) }, fromPeerId);
     }
     if (r.stored) {
       this._gossipToRoster({ type: ATTEST_FRAME.checkpoint, checkpoint: toWireCheckpoint(cp) }, fromPeerId); // relay-once
@@ -1748,22 +1761,32 @@ class SymNode extends EventEmitter {
     // Record (rate-limited as ingested). Relay-once only on first sight.
     const r = this._attestations.record(att, { ingested: true });
     if (r.stored) {
-      this._gossipAttestation(att, fromPeerId);
+      // Never relayed when the record it attests is a directed one this node holds (#27): a peer that
+      // signed it should not have; this node does not spread it.
+      if (!this._attestsDirected(att)) this._gossipAttestation(att, fromPeerId);
       this._emitAttestationReceived(att, fromPeerId, fromPeerName);
     }
     return { ok: r.stored, reason: r.reason };
   }
 
+  /** @private Whether `att` attests a record this node holds with a signed `to` (the assertion matching). */
+  _attestsDirected(att) {
+    try {
+      const e = att && this._store.get(att.of);
+      const m = e && e.cmb && e.cmb.metadata;
+      return !!(m && m.assertionId === att.assertionId && m.to !== null && m.to !== undefined);
+    } catch { return false; }
+  }
+
   /**
    * Emit 'attestation-received' for an attestation that was just verified and recorded.
    *
-   * Signed fields pass through as signed: `of`, `by`, `at`, `roster`, `verdict`, `seq`, `prev`,
-   * `role`, and the seven CAT7 `categories` as the strings the signature covers (any other key is
-   * unsigned and dropped), with `sig`/`sigAlg`, so verifyAttestation(event, key) re-checks it.
-   * `role` is the attester's own CLAIM: a node can stamp any role and still sign validly, so
-   * `roleResolved`/`roleMatches` give the role this node's grant chain resolves. What the signature
-   * does not cover is named so: `methodUnsigned` is outside the signed bytes, so a relay could have
-   * changed it, and `byName` is the label the peer announced; `by` is the identity.
+   * Signed fields pass through as signed: `of`, `assertionId`, `by`, `at`, `roster`, `method`,
+   * `verdict`, `seq`, `prev`, `role`, and the seven CAT7 `categories` as the strings the signature
+   * covers (sym-attest-v1 signs every field), with `sig`/`sigAlg`, so verifyAttestation(event, key)
+   * re-checks it. `role` is the attester's own CLAIM: a node can stamp any role and still sign
+   * validly, so `roleResolved`/`roleMatches` give the role this node resolves from its in-force
+   * authority set. `byName` is the label the peer announced, never signed; `by` is the identity.
    *
    * `verified` means the signature checked out against the key this node holds for `by`, and
    * `keySource` says where that key came from (design D3): 'anchor' (configured), 'proven' (a
diff --git a/tests/admission-attestation.test.js b/tests/admission-attestation.test.js
index 6dfe0beb..c1bcc3e9 100644
--- a/tests/admission-attestation.test.js
+++ b/tests/admission-attestation.test.js
@@ -502,7 +502,7 @@ describe('the witness storm', () => {
     });
   });
 
-  it('a signed second root is a conflict: surfaced once, reported by reconcile, never relayed', () => {
+  it('a signed second root is a conflict: surfaced once, reported by reconcile, relayed once as evidence (#27)', () => {
     const ATT = kp();
     withNode('att-conflict', { lifecycleRole: 'participant', room: 'g' }, (node) => {
       node._roster.bind('node-att', ATT.pub, 'proven');
@@ -514,8 +514,9 @@ describe('the witness storm', () => {
       node._ingestCheckpoint(cp('r8', 1), 'peer-x');
       const n = relayed.length;
       assert.strictEqual(node._ingestCheckpoint(cp('r-after-reset', 2), 'peer-x').reason, 'conflict');
+      assert.strictEqual(relayed.length, n + 1, 'the conflicting copy is relayed once, as evidence');
       node._ingestCheckpoint(cp('r-after-reset', 3), 'peer-x');
-      assert.strictEqual(relayed.length, n, 'a conflict is not relayed');
+      assert.strictEqual(relayed.length, n + 1, 'and no more');
       const conflicts = metrics.filter((x) => x.type === 'attestation-conflict');
       assert.strictEqual(conflicts.length, 1, 'said once per position');
       assert.deepStrictEqual([conflicts[0].keptRoot, conflicts[0].otherRoot], ['r8', 'r-after-reset']);
diff --git a/tests/gossip-lanes.test.js b/tests/gossip-lanes.test.js
index 14d0d665..adda3320 100644
--- a/tests/gossip-lanes.test.js
+++ b/tests/gossip-lanes.test.js
@@ -44,8 +44,10 @@ const { admitAs } = require('./_core-secure');
 const ROOM = 'g';
 const kp = (id) => {
   const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519', { publicKeyEncoding: { type: 'spki', format: 'der' }, privateKeyEncoding: { type: 'pkcs8', format: 'der' } });
-  // nodeIds are canonical lowercase at every door, a grant's included (security review B).
-  return { id: id.toLowerCase(), pub: publicKey.slice(-32).toString('base64url'), priv: privateKey.slice(-32).toString('base64url') };
+  // nodeIds are canonical lowercase UUIDs at every door (security review B; sym-attest-v1's signers,
+  // MMP 2.0 update 1): a readable label stands for a fixed UUID.
+  const h = crypto.createHash('sha256').update(String(id)).digest('hex');
+  return { id: `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20, 32)}`, pub: publicKey.slice(-32).toString('base64url'), priv: privateKey.slice(-32).toString('base64url') };
 };
 const signed = (fields, priv, sign) => { const o = { ...fields }; sign(o, priv); return o; };
 const forgedSig = () => crypto.randomBytes(64).toString('base64url');
@@ -202,7 +204,7 @@ describe('the budget is kept per PROVEN peer (F2; Core Secure design D1)', () =>
       node._log = (m) => logs.push(m);
       const p = admitAs(node, { nodeId: 'peer-flooding' });
       for (let i = 0; i < 50; i++) node._frameHandler.handle(p, { type: 'sym-attest-attestation', attestation: wireForged(A) });
-      for (let i = 0; i < 50; i++) node._frameHandler.handle(p, { type: 'sym-attest-attestation', attestation: wireForged(A, { by: `nobody-${i}` }) });
+      for (let i = 0; i < 50; i++) node._frameHandler.handle(p, { type: 'sym-attest-attestation', attestation: wireForged(A, { by: crypto.randomUUID() }) }); // signers nobody bound
       assert.strictEqual(logs.filter((l) => /Attestation from .* dropped \(bad-signature\)/.test(l)).length, 1);
       assert.strictEqual(logs.filter((l) => /dropped \(unknown-attester-key\)/.test(l)).length, 1);
     });
@@ -309,6 +311,7 @@ describe('equivocation at one position (F6)', () => {
       assert.deepStrictEqual([ingest(cp(8, 'r8')).ok, ingest(cp(16, 'r16')).ok, ingest(cp(24, 'r24')).reason], [true, true, 'over-rate'], "the attester's rate is spent");
       const relayed = sent.length;
       assert.strictEqual(ingest(cp(8, 'forked')).reason, 'conflict', 'a second root at a held position: the evidence');
+      assert.strictEqual(sent.length, relayed + 1, 'relayed once, as evidence (#27)');
       assert.strictEqual(node._attestations.conflictAt(A.id, 8).root, 'forked', 'kept although the rate is spent');
       assert.strictEqual(metrics.filter((m) => m.type === 'attestation-conflict').length, 1);
       const tokens = node._gossipBuckets.get('p').tokens;
@@ -318,7 +321,7 @@ describe('equivocation at one position (F6)', () => {
       }
       assert.strictEqual(node._gossipBuckets.get('p').tokens, tokens, 'a third root spends nothing: no signature is checked');
       assert.strictEqual(node._attestations.conflictAt(A.id, 8).root, 'forked', 'and changes nothing');
-      assert.strictEqual(sent.length, relayed, 'nor is relayed');
+      assert.strictEqual(sent.length, relayed + 1, 'a third root is not relayed');
     });
   });
 });
diff --git a/tests/spec-update-attest.test.js b/tests/spec-update-attest.test.js
new file mode 100644
index 00000000..c74dbfd2
--- /dev/null
+++ b/tests/spec-update-attest.test.js
@@ -0,0 +1,162 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME before lib/config loads
+
+/**
+ * sym-attest-v1 as MMP 2.0 update 1 registers it (#27), and the founder's rulings for it: what this
+ * node never attests or relays (S3), the wire grammar (closed attestation, lowercase UUID signers, a
+ * role of up to 64 characters, a method of up to 32), equivocation relayed once as evidence, the
+ * scope of an attester's role judged on the record its assertion names, and no checkpoint root over
+ * a suffix (D1). Each test fails on 390b4af.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const crypto = require('crypto');
+const { SymNode } = require('../lib/node');
+const { NullDiscovery } = require('../lib/discovery');
+const { nodeDirById } = require('../lib/config');
+const { signAttestation, signCheckpoint, fromWireAttestation, toWireAttestation, ATTEST_FRAME } = require('../lib/core');
+const { identity, connectNodes, until, signedRecord, signerOf, admitAs } = require('./_core-secure');
+
+const uniq = (b) => `${b}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+const made = [];
+function node(base, opts = {}) {
+  const n = new SymNode({ name: uniq(base), silent: true, discovery: new NullDiscovery(), room: 'att', ...opts });
+  made.push(n);
+  return n;
+}
+async function stopAll() {
+  for (const n of made.splice(0)) { try { await n.stop(); } catch { /* */ } try { fs.rmSync(nodeDirById(n.nodeId), { recursive: true, force: true }); } catch { /* */ } }
+}
+const ALIGNED = { decision: 'aligned', total_drift: 0.1, category_drifts: { focus: 0.1 }, gate_values: { g: 1 } };
+const CATS7 = { focus: 'admit', issue: 'admit', intent: 'admit', motivation: 'admit', commitment: 'admit', perspective: 'admit', mood: 'admit' };
+const hex = () => crypto.randomBytes(32).toString('hex');
+
+describe('S3: no attestation about a directed or a Legacy Import record leaves this node', () => {
+  it('a directed record this node gates is attested by nobody: nothing signed, nothing gossiped; a broadcast is', async () => {
+    try {
+      const A = node('s3-a'); const B = node('s3-b');
+      A._svafEvaluator.evaluate = async () => ALIGNED;
+      await A.start(); await B.start();
+      await connectNodes(B, A);
+      const gossiped = [];
+      const real = A._gossipToRoster.bind(A);
+      A._gossipToRoster = (f, x) => { gossiped.push(f.type); return real(f, x); };
+      const got = [];
+      A.on('cmb-accepted', (e) => got.push(e));
+      B.remember({ focus: 'for A only', issue: 'i', intent: 'n', motivation: 'm', commitment: 'c', perspective: 'p', mood: { text: 'calm' } }, { to: A.nodeId });
+      B.remember({ focus: 'for the room', issue: 'i', intent: 'n', motivation: 'm', commitment: 'c', perspective: 'p', mood: { text: 'calm' } });
+      await until(() => got.length >= 2, 5000);
+      await new Promise((r) => setTimeout(r, 200));
+      const atts = A._attestations.chainOf(A.nodeId);
+      const directed = got.find((e) => e.cmb && e.cmb.metadata && e.cmb.metadata.to);
+      const broadcast = got.find((e) => e.cmb && e.cmb.metadata && !e.cmb.metadata.to);
+      assert.ok(directed && broadcast, 'both were delivered');
+      assert.ok(!atts.some((x) => x.assertionId === directed.cmb.metadata.assertionId), 'no attestation about the directed record');
+      assert.ok(atts.some((x) => x.assertionId === broadcast.cmb.metadata.assertionId), 'the broadcast is attested');
+      assert.strictEqual(gossiped.filter((t) => t === ATTEST_FRAME.attestation).length, 1, 'one attestation went out: the broadcast\'s');
+    } finally { await stopAll(); }
+  });
+
+  it('nothing is signed about a Legacy Import record', async () => {
+    try {
+      const A = node('s3-legacy');
+      assert.strictEqual(A._buildAdmissionAttestation(`cmb-${hex()}`, 'aligned', CATS7, 'heuristic', `asrt-${hex()}`, { quarantined: true }), null);
+      assert.strictEqual(A._attestations.chainOf(A.nodeId).length, 0);
+    } finally { await stopAll(); }
+  });
+
+  it('a peer\'s attestation about a directed record this node holds is kept, never relayed', async () => {
+    try {
+      const A = node('s3-relay');
+      const X = identity('x'); const M = identity('m');
+      A._roster.bind(X.nodeId, X.publicKey, 'proven');
+      const rec = signedRecord(M, { room: A._room, to: A.nodeId, categories: { focus: 'between M and A' } });
+      A._store.receiveFromPeer(M.nodeId, { key: rec.metadata.key, content: 'x', source: 'm', cmb: rec, _cmbVerified: true });
+      const att = signAttestation({ of: rec.metadata.key, assertionId: rec.metadata.assertionId, by: X.nodeId, at: Date.now(), roster: A._room, method: 'heuristic', verdict: 'aligned', categories: CATS7, role: 'participant', seq: 1, prev: 'genesis' }, X.privateKey);
+      const gossiped = [];
+      A._gossipToRoster = (f) => gossiped.push(f.type);
+      const s = admitAs(A, identity('relayer'));
+      const r = A._ingestAttestation(att, s.nodeId, 'relayer', s);
+      assert.strictEqual(r.ok, true, 'kept as evidence');
+      assert.deepStrictEqual(gossiped, [], 'not relayed');
+    } finally { await stopAll(); }
+  });
+});
+
+describe('the sym-attest-v1 wire grammar (#27)', () => {
+  const X = identity('w');
+  const base = () => toWireAttestation(signAttestation({ of: `cmb-${hex()}`, assertionId: `asrt-${hex()}`, by: X.nodeId, at: 1, roster: 'att', method: 'heuristic', verdict: 'aligned', categories: CATS7, role: 'participant', seq: 1, prev: 'genesis' }, X.privateKey));
+  it('the attestation object is closed, with exactly seven verdicts', () => {
+    assert.ok(fromWireAttestation(base()));
+    assert.strictEqual(fromWireAttestation({ ...base(), note: 'x' }), null, 'a member the schema does not define');
+    const b = base(); b.categories = { ...b.categories, extra: 'admit' };
+    assert.strictEqual(fromWireAttestation(b), null);
+  });
+  it('the attester is a lowercase UUID', () => {
+    assert.strictEqual(fromWireAttestation({ ...base(), by: 'node-x' }), null);
+    assert.strictEqual(fromWireAttestation({ ...base(), by: X.nodeId.toUpperCase() }), null);
+  });
+  it('a role up to 64 characters (any role a grant confers), a method up to 32', () => {
+    const r64 = `a${'b'.repeat(63)}`;
+    assert.ok(fromWireAttestation({ ...base(), role: r64 }), 'a 64-character role');
+    assert.strictEqual(fromWireAttestation({ ...base(), role: `${r64}c` }), null);
+    assert.ok(fromWireAttestation({ ...base(), method: `m${'x'.repeat(31)}` }));
+    assert.strictEqual(fromWireAttestation({ ...base(), method: `m${'x'.repeat(32)}` }), null);
+  });
+});
+
+describe('equivocation, the attester\'s role and checkpoints (#27)', () => {
+  it('a conflicting checkpoint is relayed once, as evidence', async () => {
+    try {
+      const A = node('eq');
+      const X = identity('x');
+      A._roster.bind(X.nodeId, X.publicKey, 'proven');
+      const gossiped = [];
+      A._gossipToRoster = (f) => gossiped.push(f.type);
+      A._witnessCheckpoint = () => {};
+      const s = admitAs(A, identity('relayer'));
+      const cp = (root) => { const o = { type: 'checkpoint', by: X.nodeId, roster: A._room, upto_seq: 8, root, at: Date.now() }; signCheckpoint(o, X.privateKey); return o; };
+      assert.strictEqual(A._ingestCheckpoint(cp(hex()), s.nodeId, s).ok, true);
+      assert.strictEqual(gossiped.length, 1);
+      const r = A._ingestCheckpoint(cp(hex()), s.nodeId, s);
+      assert.strictEqual(r.reason, 'conflict');
+      assert.strictEqual(gossiped.length, 2, 'the conflicting copy went out once');
+      A._ingestCheckpoint(cp(hex()), s.nodeId, s);
+      assert.strictEqual(gossiped.length, 2, 'a third root adds nothing');
+    } finally { await stopAll(); }
+  });
+
+  it('an attester\'s scoped role is judged on the record its assertion names, not on another under the same key', async () => {
+    try {
+      const an = identity('anchor');
+      const world = (p, cmb) => !!(cmb && cmb.metadata && cmb.metadata.room === p);
+      const A = node('scope', { anchor: { threshold: 1, keys: [{ key: an.publicKey }] }, authorityScopes: { 'test-room': world } });
+      const V = identity('v');
+      const Auth = require('../lib/core/authority');
+      const g = Auth.signStatement({ kind: 'grant', authorisedBy: 'anchor', subject: { nodeId: V.nodeId, key: V.publicKey }, role: 'validator', scope: 'test-room:att', nonce: Auth.freshNonce(), sigs: [] }, an.privateKey, an.publicKey);
+      assert.strictEqual(A.submitAuthority(g).status, 'in-force');
+      A._roster.bind(V.nodeId, V.publicKey, 'proven');
+      const M = identity('m');
+      const rec = signedRecord(M, { room: 'att', categories: { focus: 'in the att room' } });
+      A._store.receiveFromPeer(M.nodeId, { key: rec.metadata.key, content: 'x', source: 'm', cmb: rec, _cmbVerified: true });
+      const att = (assertionId) => ({ of: rec.metadata.key, assertionId, by: V.nodeId });
+      assert.strictEqual(A._attesterRole(att(rec.metadata.assertionId)), 'validator', 'the record it names is inside the scope');
+      assert.strictEqual(A._attesterRole(att(`asrt-${hex()}`)), 'participant', 'another assertion under the same key judges no scope');
+    } finally { await stopAll(); }
+  });
+
+  it('no checkpoint root is signed over a suffix of this node\'s chain (D1)', async () => {
+    try {
+      const A = node('d1');
+      for (let i = 0; i < 3; i++) A._buildAdmissionAttestation(`cmb-${hex()}`, 'aligned', CATS7, 'heuristic', `asrt-${hex()}`);
+      const full = A._attestations.chainOf(A.nodeId);
+      assert.strictEqual(full.length, 3);
+      assert.ok(A._emitCheckpoint(), 'over the whole chain, a checkpoint');
+      A._attestations.chainOf = () => full.slice(1); // the store evicted seq 1
+      assert.strictEqual(A._emitCheckpoint(), null, 'over a suffix, none');
+    } finally { await stopAll(); }
+  });
+});

From 958592a85e65d4d535d18647b8231103ea4d0780 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 8 Oct 2026 11:32:22 +0100
Subject: [PATCH 127/148] records: one signed projection per assertion; the
 update's vectors vendored (D2, #34, #37)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

MMP 2.0 update 1 (meshcognition-website PR #43, spec/mmp-2.0-update-1 at 2660ab9), §8.8.5 step 1:
a relayer could reorder parents, respell a signed string in NFD or send lineage {parents: []} for
null, and the record still verified while nodes stored different bytes for one assertion
(records/probe-malleability.js). Now:

- a received record whose category text, createdBy or room is not NFC is refused, never
  normalised; createCMB mints all three NFC;
- lineage.parents and each meta.parents are held sorted bytewise, as they are signed, and minted
  as a sorted set (each reference once);
- a lineage with no parents is held, and minted, as null;
- the 256-character caps on createdBy, room and a parent reference count code points, as JSON
  Schema's maxLength does (a 200-emoji label was refused at 400 UTF-16 units);
- MAX_RECORD_BYTES is measured on the two-section record only: remember()'s decoded payload kept
  beside its own record was counted a second time at mint.

HELD, by the coordinator's word: the update also projects an absent application as null; that
rule is under review, so a null application is still dropped. The vector test pins exactly that
one member as the difference.

Vendored from 2660ab9 with their manifest digests in SOURCES.json: record-projection-v2,
record-size-v2, control-encrypted-v2, the cmb, control-frame, control-encrypted, cmb-fetch,
cmb-fetch-result, room-join, relay-frame, sym-attest-frame and encrypted-cmb-frame schemas, the
frame registry, and scripts/mmp/lib.mjs, the reference construction, which
tests/spec-update-vectors.test.js runs beside sym's code (projection, size measures, control AAD,
the never-inner list).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QRVMpaJkAA2fFbvuHCEzqH
---
 lib/core/cmb-encoder.js                       |   46 +-
 lib/core/record-canonical.js                  |   45 +-
 tests/fixtures/SOURCES.json                   |   76 +-
 tests/fixtures/cmb-fetch-result.schema.json   |   38 +
 tests/fixtures/cmb-fetch.schema.json          |   31 +
 tests/fixtures/cmb.schema.json                |  126 ++
 tests/fixtures/control-encrypted-v2.json      |  123 +
 tests/fixtures/control-encrypted.schema.json  |   49 +
 tests/fixtures/control-frame.schema.json      |   96 +
 .../fixtures/encrypted-cmb-frame.schema.json  |   62 +
 tests/fixtures/frame-registry.json            |   39 +
 tests/fixtures/mmp-lib.mjs                    |  852 +++++++
 tests/fixtures/record-projection-v2.json      | 1980 +++++++++++++++++
 tests/fixtures/record-size-v2.json            |  322 +++
 tests/fixtures/relay-frame.schema.json        |   62 +
 tests/fixtures/room-join.schema.json          |   31 +
 tests/fixtures/sym-attest-frame.schema.json   |  138 ++
 tests/spec-update-records.test.js             |  142 ++
 tests/spec-update-vectors.test.js             |  105 +
 19 files changed, 4340 insertions(+), 23 deletions(-)
 create mode 100644 tests/fixtures/cmb-fetch-result.schema.json
 create mode 100644 tests/fixtures/cmb-fetch.schema.json
 create mode 100644 tests/fixtures/cmb.schema.json
 create mode 100644 tests/fixtures/control-encrypted-v2.json
 create mode 100644 tests/fixtures/control-encrypted.schema.json
 create mode 100644 tests/fixtures/control-frame.schema.json
 create mode 100644 tests/fixtures/encrypted-cmb-frame.schema.json
 create mode 100644 tests/fixtures/frame-registry.json
 create mode 100644 tests/fixtures/mmp-lib.mjs
 create mode 100644 tests/fixtures/record-projection-v2.json
 create mode 100644 tests/fixtures/record-size-v2.json
 create mode 100644 tests/fixtures/relay-frame.schema.json
 create mode 100644 tests/fixtures/room-join.schema.json
 create mode 100644 tests/fixtures/sym-attest-frame.schema.json
 create mode 100644 tests/spec-update-records.test.js
 create mode 100644 tests/spec-update-vectors.test.js

diff --git a/lib/core/cmb-encoder.js b/lib/core/cmb-encoder.js
index 13a813f1..dbfe62a0 100644
--- a/lib/core/cmb-encoder.js
+++ b/lib/core/cmb-encoder.js
@@ -527,14 +527,18 @@ function assertAgentId(createdBy) {
 }
 
 /**
- * The record's encoded size as §8.8.6 measures it: its minified JSON, metadata.application.data
- * included, plus SIGNATURE_RESERVE_BYTES until it is signed.
+ * The record's encoded size as §8.8.6 measures it: the RFC 8785 length of the two-section record,
+ * metadata.application.data included, which is the UTF-8 length of JSON.stringify of it in any
+ * member order; plus SIGNATURE_RESERVE_BYTES until it is signed. Only `categories` and `metadata`
+ * are measured: what a node keeps beside its own record (the decoded `payload`, a store annotation)
+ * is not the record and never travels.
  * @param {object} record
  * @returns {number}
  */
 function recordBytes(record) {
   const signed = !!(record && record.metadata && record.metadata.sig);
-  return Buffer.byteLength(JSON.stringify(record), 'utf8') + (signed ? 0 : SIGNATURE_RESERVE_BYTES);
+  const twoSections = record && typeof record === 'object' ? { categories: record.categories, metadata: record.metadata } : record;
+  return Buffer.byteLength(JSON.stringify(twoSections), 'utf8') + (signed ? 0 : SIGNATURE_RESERVE_BYTES);
 }
 
 /**
@@ -551,12 +555,34 @@ function assertRecordSendable(record) {
   }
 }
 
+/**
+ * A parents list as it is minted: each reference once, sorted by its UTF-8 bytes, the order it is
+ * signed in (§8.8.4) and the order every verifier holds it in (§8.8.5 step 1).
+ */
+function parentSet(list) {
+  return [...new Set(list)].sort((a, b) => Buffer.compare(Buffer.from(String(a), 'utf8'), Buffer.from(String(b), 'utf8')));
+}
+
+/**
+ * The lineage as it is minted: its parents as a sorted set, and none at all when it names no parent
+ * (a lineage with no parents signs as none, and a verifier holds it as null). An unsigned `method`
+ * is kept for this node's own reading; the signed projection drops it on the way out.
+ */
+function mintLineage(lineage) {
+  if (!lineage || typeof lineage !== 'object' || !Array.isArray(lineage.parents) || lineage.parents.length === 0) return null;
+  const out = { parents: parentSet(lineage.parents) };
+  if (lineage.method !== undefined) out.method = lineage.method;
+  return out;
+}
+
 function createCMB(opts = {}) {
   // §7.2 [MUST]: createdBy is the agent id and is REQUIRED. It used to default to the string
   // 'unknown', which minted a record whose author could never be resolved to a key — an
   // unverifiable block created silently, at the moment it was easiest to prevent. That is the
   // defect class this boundary exists to delete, so it fails closed.
-  const createdBy = opts.createdBy;
+  // Every signed string is minted NFC (§8.8.5 step 1): a receiver refuses one that is not, and never
+  // normalises it, so the emitter does.
+  const createdBy = typeof opts.createdBy === 'string' ? opts.createdBy.normalize('NFC') : opts.createdBy;
   if (typeof createdBy !== 'string' || createdBy.length === 0) {
     throw new Error('createCMB requires createdBy — the author\'s agent id (§7.2); it is signature-bound and cannot be defaulted');
   }
@@ -593,7 +619,7 @@ function createCMB(opts = {}) {
       // valence and arousal are measurements in [-1, 1]. One that is absent is OMITTED, never
       // invented as 0 (a 0 claims a measured neutral), and one out of range is refused. A mood given
       // only as numbers keeps them: dropping to {text:'neutral'} threw the measurement away.
-      const mood = { text: (typeof value.text === 'string' && value.text) || 'neutral' };
+      const mood = { text: ((typeof value.text === 'string' && value.text) || 'neutral').normalize('NFC') };
       for (const axis of ['valence', 'arousal']) {
         const v = value[axis];
         if (v === undefined || v === null) continue;
@@ -604,8 +630,8 @@ function createCMB(opts = {}) {
       }
       categories[f] = mood;
     } else {
-      const text = (typeof value === 'string' ? value : value?.text) || 'neutral';
-      categories[f] = { text };
+      const text = ((typeof value === 'string' ? value : value?.text) || 'neutral');
+      categories[f] = { text: typeof text === 'string' ? text.normalize('NFC') : text };
     }
   }
   // A record built from a peer's categories-only frame, only to be evaluated, is held to no minting
@@ -628,7 +654,7 @@ function createCMB(opts = {}) {
   for (const f of CAT7_CATEGORIES) {
     categories[f].meta = {
       key: categoryKeyV1(f, categories[f].text),
-      parents: Array.isArray(categoryParents[f]) ? [...categoryParents[f]] : [],
+      parents: Array.isArray(categoryParents[f]) ? parentSet(categoryParents[f]) : [],
     };
   }
 
@@ -645,10 +671,10 @@ function createCMB(opts = {}) {
     key: blockKeyV2(categories),
     createdBy,
     createdTimestamp,
-    lineage: opts.lineage || null,
+    lineage: mintLineage(opts.lineage),
     // §7: the room is explicit, and a record with none is in the literal room 'default'. A null
     // here signed the string "null" and read as "every room" on receipt.
-    room: (typeof opts.room === 'string' && opts.room) ? opts.room : DEFAULT_ROOM,
+    room: (typeof opts.room === 'string' && opts.room) ? opts.room.normalize('NFC') : DEFAULT_ROOM,
     to: opts.to ?? null,
   };
 
diff --git a/lib/core/record-canonical.js b/lib/core/record-canonical.js
index 3e85661d..3be7a10d 100644
--- a/lib/core/record-canonical.js
+++ b/lib/core/record-canonical.js
@@ -16,14 +16,24 @@
  *   - `metadata.to` is a lowercase UUID or null, `createdByNodeId` a lowercase UUID (§3.1.1);
  *   - each category's carried `meta.key` must equal its recomputation from the category name and
  *     the signed text (§8.8.5 step 4): a mismatch refuses the record;
+ *   - every signed string (each category's text, `createdBy`, `room`) is already NFC: a value that
+ *     is not is refused, never normalised, as no type is coerced (MMP 2.0 update 1, §8.8.5 step 1);
+ *   - `createdBy`, `room` and each parent reference are at most 256 characters, counted as JSON
+ *     Schema counts them (code points), and a parents list holds at most 256 entries;
  *   - the carried but unsigned members (§8.8.4) — the mood's `valence` and `arousal`, and
  *     `lineage.method` — are dropped.
  *
- * It returns a NEW object:
+ * It returns a NEW object, the canonical projection, so one assertion is held as the same bytes at
+ * every node (§8.8.5 step 1; the record-projection-v2 vector):
  *
- *   categories.<each of the seven>  { text, meta: { key, parents } }
+ *   categories.<each of the seven>  { text, meta: { key, parents (sorted bytewise) } }
  *   metadata  { key, addressScheme, assertionId, signatureSuite, createdByNodeId, createdBy,
- *               createdTimestamp, room, to, lineage: { parents } | null, application?, sigAlg, sig }
+ *               createdTimestamp, room, to, lineage: { parents (sorted bytewise) } | null,
+ *               application?, sigAlg, sig }
+ *
+ * Each of those forms signs the same as the one it replaces: parents are signed as sorted sets, and
+ * a lineage with no parents signs as none (§8.8.4). The update also holds an absent application as
+ * null; that rule is under review and not applied yet (a null application is dropped, as before).
  *
  * The node stores, emits (the verified-record hook) and serves only what this returns.
  *
@@ -59,6 +69,18 @@ const METADATA_MEMBERS = new Set(['key', 'addressScheme', 'assertionId', 'signat
   'createdTimestamp', 'room', 'to', 'lineage', 'application', 'sigAlg', 'sig']);
 const APPLICATION_MEMBERS = ['mediaType', 'schema', 'encoding', 'byteLength', 'digest', 'data'];
 
+/** A string's length as JSON Schema's maxLength counts it: in code points, not UTF-16 units. */
+function codePoints(s) {
+  let n = 0;
+  // eslint-disable-next-line no-unused-vars
+  for (const _ of s) n++;
+  return n;
+}
+/** A signed string is NFC already, or the record is refused (§8.8.5 step 1): never normalised. */
+const isNFC = (s) => s === s.normalize('NFC');
+/** Parents are signed as a set sorted by their UTF-8 bytes (§8.8.4); the projection holds that order. */
+const sortedBytewise = (list) => [...list].sort((a, b) => Buffer.compare(Buffer.from(a, 'utf8'), Buffer.from(b, 'utf8')));
+
 const isPlain = (v) => v !== null && typeof v === 'object' && !Array.isArray(v) && Object.getPrototypeOf(v) === Object.prototype;
 const isNodeId = (v) => typeof v === 'string' && (LOWER_UUID.test(v) || LOWER_ID.test(v));
 const isLowerUuid = (v) => typeof v === 'string' && LOWER_UUID.test(v);
@@ -72,11 +94,11 @@ function refs(list, what, pattern) {
   if (list.length > MAX_PARENTS) throw new RecordShapeError(`${what} has more than ${MAX_PARENTS} entries`);
   const seen = new Set();
   for (const r of list) {
-    if (typeof r !== 'string' || r.length === 0 || r.length > MAX_REF || (pattern && !pattern.test(r))) throw new RecordShapeError(`${what} holds a value that is not a reference`);
+    if (typeof r !== 'string' || r.length === 0 || codePoints(r) > MAX_REF || (pattern && !pattern.test(r))) throw new RecordShapeError(`${what} holds a value that is not a reference`);
     if (seen.has(r)) throw new RecordShapeError(`${what} repeats an entry`);
     seen.add(r);
   }
-  return [...list];
+  return sortedBytewise(list);
 }
 
 function category(name, v) {
@@ -84,6 +106,7 @@ function category(name, v) {
   const allowed = name === 'mood' ? new Set(['text', 'meta', 'valence', 'arousal']) : new Set(['text', 'meta']);
   for (const k of Object.keys(v)) if (!allowed.has(k)) throw new RecordShapeError(`category ${name} carries an unknown member`);
   if (typeof v.text !== 'string') throw new RecordShapeError(`category ${name} has no text`);
+  if (!isNFC(v.text)) throw new RecordShapeError(`category ${name} text is not NFC`);
   if (name === 'mood') {
     // Validated as the schema types them, then dropped: unsigned (§8.8.4).
     for (const k of ['valence', 'arousal']) {
@@ -162,9 +185,11 @@ function canonicalRecordV2_0(cmb) {
   if (typeof m.assertionId !== 'string' || !ASRT.test(m.assertionId)) throw new RecordShapeError('assertionId is malformed');
   if (m.signatureSuite !== 'mmp-sig-v2.0') throw new RecordShapeError('signatureSuite is not mmp-sig-v2.0');
   if (!isLowerUuid(m.createdByNodeId)) throw new RecordShapeError('createdByNodeId is not a lowercase UUID');
-  if (typeof m.createdBy !== 'string' || m.createdBy.length === 0 || m.createdBy.length > 256) throw new RecordShapeError('createdBy is not a label');
+  if (typeof m.createdBy !== 'string' || m.createdBy.length === 0 || codePoints(m.createdBy) > 256) throw new RecordShapeError('createdBy is not a label');
+  if (!isNFC(m.createdBy)) throw new RecordShapeError('createdBy is not NFC');
   if (!Number.isSafeInteger(m.createdTimestamp) || m.createdTimestamp < 0) throw new RecordShapeError('createdTimestamp is not an integer');
-  if (typeof m.room !== 'string' || m.room.length === 0 || m.room.length > 256) throw new RecordShapeError('room is not a room');
+  if (typeof m.room !== 'string' || m.room.length === 0 || codePoints(m.room) > 256) throw new RecordShapeError('room is not a room');
+  if (!isNFC(m.room)) throw new RecordShapeError('room is not NFC');
   if (!(m.to === null || isLowerUuid(m.to))) throw new RecordShapeError('to is not a lowercase UUID or null');
   let lineage = null;
   if (m.lineage === undefined) throw new RecordShapeError('lineage is missing (an object or null)');
@@ -173,7 +198,9 @@ function canonicalRecordV2_0(cmb) {
     for (const k of Object.keys(m.lineage)) if (k !== 'parents' && k !== 'method') throw new RecordShapeError('lineage carries an unknown member');
     // Optional, unsigned and dropped (§8.8.4), but typed as the schema types it.
     if (m.lineage.method !== undefined && (typeof m.lineage.method !== 'string' || m.lineage.method.length === 0)) throw new RecordShapeError('lineage.method is not text');
-    lineage = { parents: refs(m.lineage.parents, 'lineage.parents', CMB_KEY) };
+    const parents = refs(m.lineage.parents, 'lineage.parents', CMB_KEY);
+    // No parents signs as no lineage (§8.8.4), so it is held as none.
+    lineage = parents.length > 0 ? { parents } : null;
   }
   if (m.sigAlg !== 'ed25519') throw new RecordShapeError('sigAlg is not ed25519');
   if (typeof m.sig !== 'string' || !SIG.test(m.sig)) throw new RecordShapeError('sig is not an unpadded Ed25519 signature');
@@ -182,6 +209,8 @@ function canonicalRecordV2_0(cmb) {
     createdByNodeId: m.createdByNodeId, createdBy: m.createdBy, createdTimestamp: m.createdTimestamp,
     room: m.room, to: m.to, lineage,
   };
+  // HELD (coordinator, 2026-10-08): the update's projection holds an absent application as null
+  // (#34, record-projection-v2); that rule is under review, so this still drops a null one.
   if (m.application !== undefined && m.application !== null) metadata.application = application(m.application);
   metadata.sigAlg = m.sigAlg;
   metadata.sig = m.sig;
diff --git a/tests/fixtures/SOURCES.json b/tests/fixtures/SOURCES.json
index d02dd106..6ba86624 100644
--- a/tests/fixtures/SOURCES.json
+++ b/tests/fixtures/SOURCES.json
@@ -1,9 +1,75 @@
 {
-  "note": "MMP v2.0 conformance artifacts vendored for sym's tests, copied unchanged. authority-v2.json and authority-frame.schema.json come from sym-bot/meshcognition-website branch spec/authority-errata-1 at df79e04 (MMP §6.6 errata 1: unique signature keys, adding the xRepeatKey case), not yet merged to main; ed25519-strict-v2.json is unchanged since main at 8c3381d (PR #40) and the published 218df24. The sha256 values equal df79e04's public/spec/mmp/artifact-manifest.json; tests/authority-vectors.test.js checks them before it reads anything.",
-  "source": "https://github.com/sym-bot/meshcognition-website/tree/df79e04/public/spec/mmp",
+  "note": "MMP v2.0 conformance artifacts vendored for sym's tests, copied unchanged. Every file comes from sym-bot/meshcognition-website branch spec/mmp-2.0-update-1 at 2660ab9 (MMP 2.0 update 1: #24, #25, #17, #22, #26, #30, #23, #31, #37, #34, #35, #27, #28 folded, with the §6.6 errata 1 and 2 beneath them), not yet merged to main. authority-v2.json, authority-frame.schema.json and ed25519-strict-v2.json are unchanged since df79e04. The sha256 values equal 2660ab9's public/spec/mmp/artifact-manifest.json; the tests that read a file check its digest first.",
+  "source": "https://github.com/sym-bot/meshcognition-website/tree/2660ab9/public/spec/mmp",
   "files": {
-    "authority-v2.json": { "from": "conformance/v2/authority-v2.json", "sha256": "0e17b3e52282968e02ea18cd7827a143d70887d7885e21618ea21bef173048f6" },
-    "ed25519-strict-v2.json": { "from": "conformance/v2/ed25519-strict-v2.json", "sha256": "323d8d9f1a4ab985a53e3c7031e39c004e456df74a87a48550761160e3c1997b" },
-    "authority-frame.schema.json": { "from": "schema/authority-frame.schema.json", "sha256": "f0717dea628b525b450892b979690bb97033f39159ee79ac023bb968d6d76c42" }
+    "authority-v2.json": {
+      "from": "conformance/v2/authority-v2.json",
+      "sha256": "0e17b3e52282968e02ea18cd7827a143d70887d7885e21618ea21bef173048f6"
+    },
+    "ed25519-strict-v2.json": {
+      "from": "conformance/v2/ed25519-strict-v2.json",
+      "sha256": "323d8d9f1a4ab985a53e3c7031e39c004e456df74a87a48550761160e3c1997b"
+    },
+    "authority-frame.schema.json": {
+      "from": "schema/authority-frame.schema.json",
+      "sha256": "f0717dea628b525b450892b979690bb97033f39159ee79ac023bb968d6d76c42"
+    },
+    "record-projection-v2.json": {
+      "from": "conformance/v2/record-projection-v2.json",
+      "sha256": "f2ad4134c4002f6178a3a82e0d1d67abacb5359f32a727dfe952172db088df72"
+    },
+    "record-size-v2.json": {
+      "from": "conformance/v2/record-size-v2.json",
+      "sha256": "c02e489a4fd0d157d3cabf79010d9b06b1e9da09ebae7bbad01c2ff7eff5aa32"
+    },
+    "control-encrypted-v2.json": {
+      "from": "conformance/v2/control-encrypted-v2.json",
+      "sha256": "56937695ac2247fe798ac4a8b63ed515c5c3491743472b3565009814b4f55941"
+    },
+    "cmb.schema.json": {
+      "from": "schema/cmb.schema.json",
+      "sha256": "3e1a6558807e01bb52fe435e84a1535ce4754947fc2da6be1fc38244627bc71d"
+    },
+    "control-frame.schema.json": {
+      "from": "schema/control-frame.schema.json",
+      "sha256": "8693e622601cc2220e497bbdf7f8a02be527151640e9343c0bdf0293f66c6ce4"
+    },
+    "control-encrypted.schema.json": {
+      "from": "schema/control-encrypted.schema.json",
+      "sha256": "f3831faf86b7f9ca25abb7687e0f938de3413b828908c9fdfad51e439adc8db5"
+    },
+    "cmb-fetch.schema.json": {
+      "from": "schema/cmb-fetch.schema.json",
+      "sha256": "ee2bf81e9ecea47221162f260a77379bcdbf489b444b22a1a730e99969d64cb9"
+    },
+    "cmb-fetch-result.schema.json": {
+      "from": "schema/cmb-fetch-result.schema.json",
+      "sha256": "7fa14a3284e639e8b179f3d71ecde67785e14843893ea7ddc3e3e55096c6c4d6"
+    },
+    "room-join.schema.json": {
+      "from": "schema/room-join.schema.json",
+      "sha256": "ccc0a3366a652d7c2447fc2ca54fe5666ccfa810d0e2dd38a689e5a1ff388601"
+    },
+    "relay-frame.schema.json": {
+      "from": "schema/relay-frame.schema.json",
+      "sha256": "2718c16b7356eeb5ced4825c78b8cc7d0cdf78e694d60192a6b0f7ed2c035aa4"
+    },
+    "sym-attest-frame.schema.json": {
+      "from": "schema/sym-attest-frame.schema.json",
+      "sha256": "2586e9db797da404130af9501f4e8a33131d931d1f2824284b7db2fb5481a98e"
+    },
+    "encrypted-cmb-frame.schema.json": {
+      "from": "schema/encrypted-cmb-frame.schema.json",
+      "sha256": "c786d74a0b3557b26fcd7424f5f71f0201167999f9738288ed6dbb7d45e58b39"
+    },
+    "frame-registry.json": {
+      "from": "frame-registry.json",
+      "sha256": "400de6fc26b7261cd068ec1cba380b602ccfc12987cad4eb447e77d82a42b2aa"
+    },
+    "mmp-lib.mjs": {
+      "from": "scripts/mmp/lib.mjs (repository root)",
+      "sha256": "990c963ac556180ebee37e7f54915801f475bf92810d46c9afdc7da4c973aece",
+      "note": "the reference construction (scripts/mmp/lib.mjs at 2660ab9); not a published artifact, so not in the manifest"
+    }
   }
 }
diff --git a/tests/fixtures/cmb-fetch-result.schema.json b/tests/fixtures/cmb-fetch-result.schema.json
new file mode 100644
index 00000000..1b6f1d03
--- /dev/null
+++ b/tests/fixtures/cmb-fetch-result.schema.json
@@ -0,0 +1,38 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://meshcognition.org/spec/mmp/schema/cmb-fetch-result.schema.json",
+  "title": "MMP cmb-fetch-result frame (§7, §15.8, §18.2.1)",
+  "description": "Sent sealed inside control-encrypted. Carries no record: each returned record travels before it as its own cmb-encrypted frame.",
+  "type": "object",
+  "required": [
+    "type",
+    "reqId",
+    "returned",
+    "missing"
+  ],
+  "additionalProperties": false,
+  "properties": {
+    "type": {
+      "const": "cmb-fetch-result"
+    },
+    "reqId": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 128
+    },
+    "returned": {
+      "type": "array",
+      "maxItems": 256,
+      "uniqueItems": true,
+      "items": { "type": "string", "pattern": "^cmb-[0-9a-f]{64}$" },
+      "description": "Keys whose records were sent, each as its own cmb-encrypted frame, before this result"
+    },
+    "missing": {
+      "type": "array",
+      "maxItems": 256,
+      "uniqueItems": true,
+      "items": { "type": "string", "pattern": "^cmb-[0-9a-f]{64}$" },
+      "description": "Requested keys not returned: not held, or not disclosable to this requester"
+    }
+  }
+}
diff --git a/tests/fixtures/cmb-fetch.schema.json b/tests/fixtures/cmb-fetch.schema.json
new file mode 100644
index 00000000..b2e23f85
--- /dev/null
+++ b/tests/fixtures/cmb-fetch.schema.json
@@ -0,0 +1,31 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://meshcognition.org/spec/mmp/schema/cmb-fetch.schema.json",
+  "title": "MMP cmb-fetch frame (\u00a77, \u00a715.8)",
+  "type": "object",
+  "required": [
+    "type",
+    "reqId",
+    "key"
+  ],
+  "additionalProperties": false,
+  "properties": {
+    "type": {
+      "const": "cmb-fetch"
+    },
+    "reqId": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 128
+    },
+    "key": {
+      "type": "string",
+      "pattern": "^cmb-[0-9a-f]{64}$",
+      "description": "Content-address key requested (\u00a78.2.1)"
+    },
+    "timestamp": {
+      "type": "integer",
+      "minimum": 0
+    }
+  }
+}
diff --git a/tests/fixtures/cmb.schema.json b/tests/fixtures/cmb.schema.json
new file mode 100644
index 00000000..104dadd5
--- /dev/null
+++ b/tests/fixtures/cmb.schema.json
@@ -0,0 +1,126 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://meshcognition.org/spec/mmp/schema/cmb.schema.json",
+  "title": "MMP v2.0 Cognitive Memory Block — corrected Core Secure profile",
+  "description": "The decrypted logical record has exactly two top-level sections. CAT7 cognition is content-addressed; metadata carries authenticated authorship, audience, descent and optional application bytes.",
+  "type": "object",
+  "required": ["categories", "metadata"],
+  "additionalProperties": false,
+  "properties": {
+    "categories": {
+      "type": "object",
+      "description": "The seven CAT7 categories. An unrecognised category is allowed here and dropped by the verifier (§8, §8.8.5 step 1): it is outside the address and the signature.",
+      "required": ["focus", "issue", "intent", "motivation", "commitment", "perspective", "mood"],
+      "additionalProperties": true,
+      "properties": {
+        "focus": { "$ref": "#/$defs/category" },
+        "issue": { "$ref": "#/$defs/category" },
+        "intent": { "$ref": "#/$defs/category" },
+        "motivation": { "$ref": "#/$defs/category" },
+        "commitment": { "$ref": "#/$defs/category" },
+        "perspective": { "$ref": "#/$defs/category" },
+        "mood": { "$ref": "#/$defs/moodCategory" }
+      }
+    },
+    "metadata": {
+      "type": "object",
+      "required": [
+        "key", "addressScheme", "assertionId", "signatureSuite",
+        "createdByNodeId", "createdBy", "createdTimestamp", "room", "to",
+        "lineage", "sigAlg", "sig"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "key": { "type": "string", "pattern": "^cmb-[0-9a-f]{64}$" },
+        "addressScheme": { "const": "mmp-cmb-merkle-v2" },
+        "assertionId": { "type": "string", "pattern": "^asrt-[0-9a-f]{64}$" },
+        "signatureSuite": { "const": "mmp-sig-v2.0" },
+        "createdByNodeId": { "type": "string", "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", "description": "The author's nodeId, in its one lowercase spelling (§3.1.1)." },
+        "createdBy": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 256,
+          "description": "Signed display label, NFC (§8.8.5). Never used for identity resolution or routing."
+        },
+        "createdTimestamp": { "type": "integer", "minimum": 0 },
+        "room": { "type": "string", "minLength": 1, "maxLength": 256, "description": "Signed room identifier, NFC (§8.8.5)." },
+        "to": {
+          "description": "The record's audience (§9.2.2): null for room-bound, or the recipient's nodeId in its one lowercase spelling.",
+          "anyOf": [
+            { "type": "string", "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$" },
+            { "type": "null" }
+          ]
+        },
+        "lineage": {
+          "anyOf": [
+            { "$ref": "#/$defs/lineage" },
+            { "type": "null" }
+          ]
+        },
+        "application": {
+          "anyOf": [
+            { "$ref": "application.schema.json" },
+            { "type": "null" }
+          ]
+        },
+        "sigAlg": { "const": "ed25519" },
+        "sig": {
+          "type": "string",
+          "pattern": "^[A-Za-z0-9_-]{86}$",
+          "description": "Unpadded base64url Ed25519 signature over mmp-sig-v2.0."
+        }
+      }
+    }
+  },
+  "$defs": {
+    "categoryMeta": {
+      "type": "object",
+      "required": ["key", "parents"],
+      "additionalProperties": false,
+      "properties": {
+        "key": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
+        "parents": {
+          "type": "array",
+          "maxItems": 256,
+          "uniqueItems": true,
+          "items": { "type": "string", "maxLength": 256 }
+        }
+      }
+    },
+    "category": {
+      "type": "object",
+      "required": ["text", "meta"],
+      "additionalProperties": false,
+      "properties": {
+        "text": { "type": "string", "maxLength": 262144, "description": "At most MAX_CATEGORY_TEXT (262,144) UTF-8 bytes after NFC (§8.8.6); this schema bound counts characters, so it is necessary, not sufficient." },
+        "meta": { "$ref": "#/$defs/categoryMeta" }
+      }
+    },
+    "moodCategory": {
+      "type": "object",
+      "required": ["text", "meta"],
+      "additionalProperties": false,
+      "properties": {
+        "text": { "type": "string", "maxLength": 262144, "description": "At most MAX_CATEGORY_TEXT (262,144) UTF-8 bytes after NFC (§8.8.6); this schema bound counts characters, so it is necessary, not sufficient." },
+        "meta": { "$ref": "#/$defs/categoryMeta" },
+        "valence": { "type": "number", "minimum": -1, "maximum": 1, "description": "Unsigned under mmp-sig-v2.0; dropped by a Core Secure verifier (§8.8.4)." },
+        "arousal": { "type": "number", "minimum": -1, "maximum": 1, "description": "Unsigned under mmp-sig-v2.0; dropped by a Core Secure verifier (§8.8.4)." }
+      }
+    },
+    "lineage": {
+      "type": "object",
+      "description": "parents is signed. method is optional, unsigned and dropped by a Core Secure verifier (§8.8.4).",
+      "required": ["parents"],
+      "additionalProperties": false,
+      "properties": {
+        "parents": {
+          "type": "array",
+          "maxItems": 256,
+          "uniqueItems": true,
+          "items": { "type": "string", "pattern": "^cmb-[0-9a-f]{64}$" }
+        },
+        "method": { "type": "string", "minLength": 1 }
+      }
+    }
+  }
+}
diff --git a/tests/fixtures/control-encrypted-v2.json b/tests/fixtures/control-encrypted-v2.json
new file mode 100644
index 00000000..5826eb02
--- /dev/null
+++ b/tests/fixtures/control-encrypted-v2.json
@@ -0,0 +1,123 @@
+{
+  "protocolVersion": "2.0",
+  "suite": "X25519-HKDF-SHA256-ChaCha20-Poly1305",
+  "sessionId": "f85383e8ebb887a1fe9578adabae4b5d",
+  "keysFrom": "handshake-v2.json expected.clientToServerKeyHex and expected.serverToClientKeyHex",
+  "aadRule": "UTF8(\"mmp-aead-control-v2\\n\") || lp(\"2.0\") || lp(sessionId) || lp(direction) || lp(sequence); plaintext is the minified JSON of the inner frame",
+  "cases": [
+    {
+      "direction": "server-to-client",
+      "sequence": "1",
+      "trafficKeyHex": "cfcddba80535583d252d8e744d55fe9cc792c7a63facbe5b13c5cb100bc289ae",
+      "nonceHex": "000000000000000000000001",
+      "aadHex": "6d6d702d616561642d636f6e74726f6c2d76320a333a322e3033323a663835333833653865626238383761316665393537386164616261653462356431363a7365727665722d746f2d636c69656e74313a31",
+      "plaintextUtf8": "{\"type\":\"mood\",\"mood\":\"calm, focused\",\"context\":null,\"timestamp\":1786611600000}",
+      "frame": {
+        "type": "control-encrypted",
+        "protocolVersion": "2.0",
+        "suite": "X25519-HKDF-SHA256-ChaCha20-Poly1305",
+        "sessionId": "f85383e8ebb887a1fe9578adabae4b5d",
+        "sequence": "1",
+        "direction": "server-to-client",
+        "sealed": "GbLKtJTaPcdk1O8C8LploXIAwYV-6lOuX8_VW6H2zf3gSviWN06Zb0Gn7uaO0nkZmj005je4V36vqoa35sHanYOgcKMywstLeNv_Cr1YIOvvlFxmUH6rTbdNW1AcWw8"
+      },
+      "inner": {
+        "type": "mood",
+        "mood": "calm, focused",
+        "context": null,
+        "timestamp": 1786611600000
+      }
+    },
+    {
+      "direction": "client-to-server",
+      "sequence": "2",
+      "trafficKeyHex": "789c875b5646722f94938d29a7712fcab924873cf5df4c1cf44ac18836990130",
+      "nonceHex": "000000000000000000000002",
+      "aadHex": "6d6d702d616561642d636f6e74726f6c2d76320a333a322e3033323a663835333833653865626238383761316665393537386164616261653462356431363a636c69656e742d746f2d736572766572313a32",
+      "plaintextUtf8": "{\"type\":\"cmb-fetch\",\"reqId\":\"fetch-0001\",\"key\":\"cmb-abababababababababababababababababababababababababababababababab\"}",
+      "frame": {
+        "type": "control-encrypted",
+        "protocolVersion": "2.0",
+        "suite": "X25519-HKDF-SHA256-ChaCha20-Poly1305",
+        "sessionId": "f85383e8ebb887a1fe9578adabae4b5d",
+        "sequence": "2",
+        "direction": "client-to-server",
+        "sealed": "yFkKncb_oRSPUTXn5TlDxmKW7ag_ml_NvDUn0aNUpjw6U3MqXfFOGbIt8Yrd0l1NFIb8Hle7xDp5iIkf9T_f2_XmIuQup1Ja16zULjmhGozMdSVRYoZeqQCtFrrg-HGiN0U02iOm_nQ2Zk53ywUwaKz8TOvstq3piG-xtkDwMmzwDXTFWCg"
+      },
+      "inner": {
+        "type": "cmb-fetch",
+        "reqId": "fetch-0001",
+        "key": "cmb-abababababababababababababababababababababababababababababababab"
+      }
+    },
+    {
+      "direction": "server-to-client",
+      "sequence": "2",
+      "trafficKeyHex": "cfcddba80535583d252d8e744d55fe9cc792c7a63facbe5b13c5cb100bc289ae",
+      "nonceHex": "000000000000000000000002",
+      "aadHex": "6d6d702d616561642d636f6e74726f6c2d76320a333a322e3033323a663835333833653865626238383761316665393537386164616261653462356431363a7365727665722d746f2d636c69656e74313a32",
+      "plaintextUtf8": "{\"type\":\"cmb-fetch-result\",\"reqId\":\"fetch-0001\",\"returned\":[],\"missing\":[\"cmb-abababababababababababababababababababababababababababababababab\"]}",
+      "frame": {
+        "type": "control-encrypted",
+        "protocolVersion": "2.0",
+        "suite": "X25519-HKDF-SHA256-ChaCha20-Poly1305",
+        "sessionId": "f85383e8ebb887a1fe9578adabae4b5d",
+        "sequence": "2",
+        "direction": "server-to-client",
+        "sealed": "gF6OsSQ5n5YAUApzZdIvhNzHl8jhYL-Adz5A9sIhF9Cyg3fdb3qQUW-Bjw-auJE_jaFfq1dQZ0OTEWXUISX20UW1qcxNI-cOzn3_gLuJpNGznClOiKE-dLfLtZss040Qlz9ovjYxs6pyrSuN0eS54Fv16tzSup-dd5ju4OWyll_YGCwCsBEFLail8plty--iEfaWO0jFZkbAvjBg3hqJSHg"
+      },
+      "inner": {
+        "type": "cmb-fetch-result",
+        "reqId": "fetch-0001",
+        "returned": [],
+        "missing": [
+          "cmb-abababababababababababababababababababababababababababababababab"
+        ]
+      }
+    },
+    {
+      "direction": "client-to-server",
+      "sequence": "3",
+      "trafficKeyHex": "789c875b5646722f94938d29a7712fcab924873cf5df4c1cf44ac18836990130",
+      "nonceHex": "000000000000000000000003",
+      "aadHex": "6d6d702d616561642d636f6e74726f6c2d76320a333a322e3033323a663835333833653865626238383761316665393537386164616261653462356431363a636c69656e742d746f2d736572766572313a33",
+      "plaintextUtf8": "{\"type\":\"ping\"}",
+      "frame": {
+        "type": "control-encrypted",
+        "protocolVersion": "2.0",
+        "suite": "X25519-HKDF-SHA256-ChaCha20-Poly1305",
+        "sessionId": "f85383e8ebb887a1fe9578adabae4b5d",
+        "sequence": "3",
+        "direction": "client-to-server",
+        "sealed": "LZOJ6S-sr9C2uDf87MPv_hDZ61TklBd3s-oK_BIedw"
+      },
+      "inner": {
+        "type": "ping"
+      }
+    }
+  ],
+  "innerRefused": {
+    "rule": "An authentic envelope whose inner frame §7.1 forbids: it opens, so the receiver advances to the next sequence, refuses the inner frame, and changes nothing else (§18.2.1).",
+    "direction": "server-to-client",
+    "sequence": "3",
+    "trafficKeyHex": "cfcddba80535583d252d8e744d55fe9cc792c7a63facbe5b13c5cb100bc289ae",
+    "nonceHex": "000000000000000000000003",
+    "aadHex": "6d6d702d616561642d636f6e74726f6c2d76320a333a322e3033323a663835333833653865626238383761316665393537386164616261653462356431363a7365727665722d746f2d636c69656e74313a33",
+    "plaintextUtf8": "{\"type\":\"cmb\"}",
+    "frame": {
+      "type": "control-encrypted",
+      "protocolVersion": "2.0",
+      "suite": "X25519-HKDF-SHA256-ChaCha20-Poly1305",
+      "sessionId": "f85383e8ebb887a1fe9578adabae4b5d",
+      "sequence": "3",
+      "direction": "server-to-client",
+      "sealed": "XxQXdbOsyXEmwFoTbgkK-pui29fRzGJbcEmP2pXC"
+    },
+    "expected": {
+      "opens": true,
+      "innerAccepted": false,
+      "nextSequence": "4",
+      "sessionOpen": true
+    }
+  }
+}
diff --git a/tests/fixtures/control-encrypted.schema.json b/tests/fixtures/control-encrypted.schema.json
new file mode 100644
index 00000000..44270b71
--- /dev/null
+++ b/tests/fixtures/control-encrypted.schema.json
@@ -0,0 +1,49 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://meshcognition.org/spec/mmp/schema/control-encrypted.schema.json",
+  "title": "MMP v2.0 control-encrypted envelope (§18.2.1)",
+  "description": "The sealed envelope of one control frame. The plaintext is the minified JSON of one inner frame (control-frame.schema.json and the other inner schemas); the AAD is mmp-aead-control-v2 over version, session, direction and sequence. It shares its direction's sequence counter with cmb-encrypted.",
+  "type": "object",
+  "required": [
+    "type",
+    "protocolVersion",
+    "suite",
+    "sessionId",
+    "sequence",
+    "direction",
+    "sealed"
+  ],
+  "additionalProperties": false,
+  "properties": {
+    "type": {
+      "const": "control-encrypted"
+    },
+    "protocolVersion": {
+      "const": "2.0"
+    },
+    "suite": {
+      "const": "X25519-HKDF-SHA256-ChaCha20-Poly1305"
+    },
+    "sessionId": {
+      "type": "string",
+      "pattern": "^[0-9a-f]{32}$"
+    },
+    "sequence": {
+      "type": "string",
+      "pattern": "^(0|[1-9][0-9]{0,28})$",
+      "description": "Unsigned decimal, less than 2^96 (the AEAD nonce is the sequence in 96 bits)."
+    },
+    "direction": {
+      "enum": [
+        "client-to-server",
+        "server-to-client"
+      ]
+    },
+    "sealed": {
+      "type": "string",
+      "minLength": 22,
+      "pattern": "^[A-Za-z0-9_-]+$",
+      "description": "Unpadded base64url of the ciphertext followed by the 16-byte Poly1305 tag; at least the tag."
+    }
+  }
+}
diff --git a/tests/fixtures/control-frame.schema.json b/tests/fixtures/control-frame.schema.json
new file mode 100644
index 00000000..5d90742c
--- /dev/null
+++ b/tests/fixtures/control-frame.schema.json
@@ -0,0 +1,96 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://meshcognition.org/spec/mmp/schema/control-frame.schema.json",
+  "title": "MMP v2.0 peer control frames",
+  "description": "On a CONNECTED Core Secure session these frames travel only as the inner frame of a control-encrypted envelope (§7.1, §18.2.1; the envelope is control-encrypted.schema.json), except ping and pong, which may also travel in clear, and error, which is also defined in clear (§7.4). Validating a frame here says nothing about whether it may appear on the wire in clear.",
+  "oneOf": [
+    { "$ref": "#/$defs/peerInfo" },
+    { "$ref": "#/$defs/wakeChannel" },
+    { "$ref": "#/$defs/error" },
+    { "$ref": "#/$defs/ping" },
+    { "$ref": "#/$defs/pong" },
+    { "$ref": "#/$defs/mood" },
+    { "$ref": "#/$defs/cmbAnchors" }
+  ],
+  "$defs": {
+    "mood": {
+      "type": "object",
+      "description": "A session-scoped mood frame (§9.3), sent only as the inner frame of control-encrypted on a confirmed Core Secure session. It names no sender: a receiver attributes it to the session's proven nodeId and name. It is not a record and carries no signature; it is never stored, relayed or remixed. timestamp is the sender's, information only.",
+      "required": ["type", "mood"],
+      "additionalProperties": false,
+      "properties": {
+        "type": { "const": "mood" },
+        "mood": { "type": "string", "minLength": 1, "maxLength": 1024 },
+        "context": { "anyOf": [{ "type": "string", "maxLength": 4096 }, { "type": "null" }] },
+        "timestamp": { "type": "integer", "minimum": 0 }
+      }
+    },
+    "cmbAnchors": {
+      "type": "object",
+      "description": "Sealed control frame (§9.4), the first frame a node sends on a session it admits: the cognition keys of its own records about to be replayed on this session, in send order, or an empty list when none follow.",
+      "required": ["type", "keys"],
+      "additionalProperties": false,
+      "properties": {
+        "type": { "const": "cmb-anchors" },
+        "keys": { "type": "array", "maxItems": 50, "items": { "type": "string", "pattern": "^cmb-[0-9a-f]{64}$" } }
+      }
+    },
+    "wake": {
+      "type": "object",
+      "required": ["platform", "token", "environment"],
+      "additionalProperties": false,
+      "properties": {
+        "platform": { "type": "string", "minLength": 1, "maxLength": 32 },
+        "token": { "type": "string", "minLength": 1, "maxLength": 4096 },
+        "environment": { "type": "string", "minLength": 1, "maxLength": 32 }
+      }
+    },
+    "peerInfo": {
+      "type": "object",
+      "required": ["type", "peers"],
+      "additionalProperties": false,
+      "properties": {
+        "type": { "const": "peer-info" },
+        "peers": {
+          "type": "array",
+          "maxItems": 4096,
+          "items": {
+            "type": "object",
+            "required": ["nodeId", "name", "lastSeen"],
+            "additionalProperties": false,
+            "properties": {
+              "nodeId": { "type": "string", "format": "uuid" },
+              "name": { "type": "string", "minLength": 1, "maxLength": 255 },
+              "wakeChannel": { "$ref": "#/$defs/wake" },
+              "lastSeen": { "type": "integer", "minimum": 0 }
+            }
+          }
+        }
+      }
+    },
+    "wakeChannel": {
+      "type": "object",
+      "required": ["type", "platform", "token", "environment"],
+      "additionalProperties": false,
+      "properties": {
+        "type": { "const": "wake-channel" },
+        "platform": { "type": "string", "minLength": 1, "maxLength": 32 },
+        "token": { "type": "string", "minLength": 1, "maxLength": 4096 },
+        "environment": { "type": "string", "minLength": 1, "maxLength": 32 }
+      }
+    },
+    "error": {
+      "type": "object",
+      "required": ["type", "code", "message"],
+      "additionalProperties": false,
+      "properties": {
+        "type": { "const": "error" },
+        "code": { "type": "integer", "minimum": 1000, "maximum": 9999 },
+        "message": { "type": "string", "minLength": 1, "maxLength": 1024 },
+        "detail": { "type": "string", "maxLength": 4096 }
+      }
+    },
+    "ping": { "type": "object", "required": ["type"], "additionalProperties": false, "properties": { "type": { "const": "ping" } } },
+    "pong": { "type": "object", "required": ["type"], "additionalProperties": false, "properties": { "type": { "const": "pong" } } }
+  }
+}
diff --git a/tests/fixtures/encrypted-cmb-frame.schema.json b/tests/fixtures/encrypted-cmb-frame.schema.json
new file mode 100644
index 00000000..12c52366
--- /dev/null
+++ b/tests/fixtures/encrypted-cmb-frame.schema.json
@@ -0,0 +1,62 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://meshcognition.org/spec/mmp/schema/encrypted-cmb-frame.schema.json",
+  "title": "MMP v2.0 Core Secure encrypted CMB transport envelope",
+  "type": "object",
+  "required": ["type", "protocolVersion", "suite", "sessionId", "sequence", "direction", "metadata", "sealed"],
+  "additionalProperties": false,
+  "properties": {
+    "type": { "const": "cmb-encrypted" },
+    "protocolVersion": { "const": "2.0" },
+    "suite": { "const": "X25519-HKDF-SHA256-ChaCha20-Poly1305" },
+    "sessionId": { "type": "string", "pattern": "^[0-9a-f]{32}$" },
+    "sequence": { "type": "string", "pattern": "^(0|[1-9][0-9]*)$" },
+    "direction": { "enum": ["client-to-server", "server-to-client"] },
+    "metadata": {
+      "type": "object",
+      "description": "Clear routing and verification metadata. metadata.application omits data; all members are AEAD-bound and record-signed.",
+      "required": [
+        "key", "addressScheme", "assertionId", "signatureSuite",
+        "createdByNodeId", "createdBy", "createdTimestamp", "room", "to",
+        "lineage", "application", "sigAlg", "sig"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "key": { "type": "string", "pattern": "^cmb-[0-9a-f]{64}$" },
+        "addressScheme": { "const": "mmp-cmb-merkle-v2" },
+        "assertionId": { "type": "string", "pattern": "^asrt-[0-9a-f]{64}$" },
+        "signatureSuite": { "const": "mmp-sig-v2.0" },
+        "createdByNodeId": { "type": "string", "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$" },
+        "createdBy": { "type": "string", "minLength": 1 },
+        "createdTimestamp": { "type": "integer", "minimum": 0 },
+        "room": { "type": "string", "minLength": 1 },
+        "to": { "anyOf": [{ "type": "string", "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$" }, { "type": "null" }] },
+        "lineage": { "anyOf": [{ "$ref": "cmb.schema.json#/$defs/lineage" }, { "type": "null" }] },
+        "application": {
+          "anyOf": [
+            {
+              "type": "object",
+              "required": ["mediaType", "schema", "encoding", "byteLength", "digest"],
+              "additionalProperties": false,
+              "properties": {
+                "mediaType": { "type": "string", "minLength": 1 },
+                "schema": { "type": "string", "format": "uri" },
+                "encoding": { "const": "base64url" },
+                "byteLength": { "type": "integer", "minimum": 0 },
+                "digest": { "type": "string", "pattern": "^sha256-[0-9a-f]{64}$" }
+              }
+            },
+            { "type": "null" }
+          ]
+        },
+        "sigAlg": { "const": "ed25519" },
+        "sig": { "type": "string", "pattern": "^[A-Za-z0-9_-]{86}$" }
+      }
+    },
+    "sealed": {
+      "type": "string",
+      "pattern": "^[A-Za-z0-9_-]+$",
+      "description": "Unpadded base64url ciphertext concatenated with the 16-byte Poly1305 tag."
+    }
+  }
+}
diff --git a/tests/fixtures/frame-registry.json b/tests/fixtures/frame-registry.json
new file mode 100644
index 00000000..459d610b
--- /dev/null
+++ b/tests/fixtures/frame-registry.json
@@ -0,0 +1,39 @@
+{
+  "$schema": "https://meshcognition.org/spec/mmp/schema/frame-registry.schema.json",
+  "protocolVersion": "2.0",
+  "frames": [
+    { "type": "client-hello", "scope": "peer", "layer": "2", "gated": "No", "status": "core", "schema": "handshake.schema.json", "fields": "First authenticated handshake offer." },
+    { "type": "server-hello", "scope": "peer", "layer": "2", "gated": "No", "status": "core", "schema": "handshake.schema.json", "fields": "Server offer, negotiated extensions, transcript proof and key confirmation." },
+    { "type": "client-finish", "scope": "peer", "layer": "2", "gated": "No", "status": "core", "schema": "handshake.schema.json", "fields": "Transcript hash, client proof and key confirmation." },
+    { "type": "cmb", "scope": "peer", "layer": "3/4", "gated": "SVAF", "status": "core", "schema": "cmb-frame.schema.json", "fields": "Signed CAT7 record assertion." },
+    { "type": "cmb-encrypted", "scope": "peer", "layer": "2/3", "gated": "After decrypt", "status": "core", "schema": "encrypted-cmb-frame.schema.json", "fields": "Directional ChaCha20-Poly1305 envelope with session, sequence, routing metadata and sealed record bytes." },
+    { "type": "control-encrypted", "scope": "peer", "layer": "2", "gated": "After decrypt", "status": "core", "schema": "control-encrypted.schema.json", "fields": "Directional ChaCha20-Poly1305 envelope sealing one control frame; shares the session's per-direction sequence with cmb-encrypted." },
+    { "type": "cmb-anchors", "scope": "peer", "layer": "4", "gated": "Sealed only", "status": "core", "schema": "control-frame.schema.json", "fields": "Sent first on every admitted Core Secure session: the cognition keys of the sender's own records about to be replayed as context, or none (§9.4); changes no verification or admission." },
+    { "type": "cmb-fetch", "scope": "peer", "layer": "3", "gated": "No", "status": "core", "schema": "cmb-fetch.schema.json", "fields": "Request a record by exact content address." },
+    { "type": "cmb-fetch-result", "scope": "peer", "layer": "3", "gated": "No", "status": "core", "schema": "cmb-fetch-result.schema.json", "fields": "Correlation id with the keys returned and the keys not found; each returned record travels before it as its own cmb-encrypted frame." },
+    { "type": "authority-statement", "scope": "peer", "layer": "3", "gated": "Authority", "status": "core", "schema": "authority-frame.schema.json", "fields": "One signed grant, revoke or endorse statement, identified by the hash of its canonical bytes; it counts only as §6.6 resolution places it." },
+    { "type": "authority-digest", "scope": "peer", "layer": "3", "gated": "No", "status": "core", "schema": "authority-frame.schema.json", "fields": "The sender's authority root and in-force count, for anti-entropy (§6.6.8)." },
+    { "type": "authority-fetch", "scope": "peer", "layer": "3", "gated": "No", "status": "core", "schema": "authority-frame.schema.json", "fields": "Asks for statements by id, with their chains, or for a page of the responder's live set in authority order (§6.6.8)." },
+    { "type": "authority-set", "scope": "peer", "layer": "3", "gated": "Authority", "status": "core", "schema": "authority-frame.schema.json", "fields": "Answers an authority-fetch with statements in authority order; each is verified as gossip is, never on the session's word." },
+    { "type": "mood", "scope": "peer", "layer": "4", "gated": "Sealed only", "status": "core", "schema": "control-frame.schema.json", "fields": "Session-scoped mood text and context, sealed in control-encrypted on a confirmed Core Secure session; attributed to the session's proven peer; never stored, relayed or remixed (§9.3)." },
+    { "type": "room-join", "scope": "peer", "layer": "2", "gated": "Sealed only", "status": "core", "schema": "room-join.schema.json", "fields": "Owner-signed room-join grant presented after the handshake; admits the session to a gated room when it binds the proven key (§5.8.1)." },
+    { "type": "peer-info", "scope": "peer", "layer": "2", "gated": "No", "status": "core", "schema": "control-frame.schema.json", "fields": "Authenticated-room peer and wake-channel gossip." },
+    { "type": "wake-channel", "scope": "peer", "layer": "2", "gated": "No", "status": "core", "schema": "control-frame.schema.json", "fields": "Platform wake-channel registration." },
+    { "type": "error", "scope": "peer", "layer": "2", "gated": "No", "status": "core", "schema": "control-frame.schema.json", "fields": "Protocol error code, message and optional bounded detail." },
+    { "type": "ping", "scope": "peer", "layer": "2", "gated": "No", "status": "core", "schema": "control-frame.schema.json", "fields": "Peer keepalive request." },
+    { "type": "pong", "scope": "peer", "layer": "2", "gated": "No", "status": "core", "schema": "control-frame.schema.json", "fields": "Peer keepalive response." },
+    { "type": "relay-auth", "scope": "relay", "layer": "1", "gated": "Relay auth", "status": "transport", "schema": "relay-frame.schema.json", "fields": "Authenticate a node to a relay." },
+    { "type": "relay-peers", "scope": "relay", "layer": "1", "gated": "No", "status": "transport", "schema": "relay-frame.schema.json", "fields": "Relay peer directory." },
+    { "type": "relay-ping", "scope": "relay", "layer": "1", "gated": "No", "status": "transport", "schema": "relay-frame.schema.json", "fields": "Relay keepalive request." },
+    { "type": "relay-pong", "scope": "relay", "layer": "1", "gated": "No", "status": "transport", "schema": "relay-frame.schema.json", "fields": "Relay keepalive response." },
+    { "type": "relay-reauth", "scope": "relay", "layer": "1", "gated": "No", "status": "transport", "schema": "relay-frame.schema.json", "fields": "Request a fresh relay-auth frame." },
+    { "type": "relay-peer-joined", "scope": "relay", "layer": "1", "gated": "No", "status": "transport", "schema": "relay-frame.schema.json", "fields": "Relay presence notification." },
+    { "type": "relay-peer-left", "scope": "relay", "layer": "1", "gated": "No", "status": "transport", "schema": "relay-frame.schema.json", "fields": "Relay departure notification." },
+    { "type": "relay-error", "scope": "relay", "layer": "1", "gated": "No", "status": "transport", "schema": "relay-frame.schema.json", "fields": "Relay-level error: message, with kind, code (the close that follows) and reason (§4.4.9)." },
+    { "type": "role-grant", "scope": "peer", "layer": "legacy", "gated": "No", "status": "legacy", "schema": null, "fields": "Retired time-replayed role grant (sym 0.14.0 and earlier drafts). Confers nothing; MUST NOT emit; ignore on receipt. See §6.6.11 migration." },
+    { "type": "role-revoke", "scope": "peer", "layer": "legacy", "gated": "No", "status": "legacy", "schema": null, "fields": "Retired time-replayed role revoke with a cutoff (sym 0.14.0 and earlier drafts). MUST NOT emit; ignore on receipt. See §6.6.11 migration." },
+    { "type": "state-sync", "scope": "peer", "layer": "deprecated", "gated": "No", "status": "legacy", "schema": null, "fields": "Reserved legacy type. MUST NOT emit; ignore on receipt." },
+    { "type": "message", "scope": "peer", "layer": "legacy", "gated": "No", "status": "legacy", "schema": null, "fields": "Legacy unsigned application message." },
+    { "type": "xmesh-insight", "scope": "peer", "layer": "legacy", "gated": "No", "status": "legacy", "schema": null, "fields": "Legacy runtime projection." }
+  ]
+}
diff --git a/tests/fixtures/mmp-lib.mjs b/tests/fixtures/mmp-lib.mjs
new file mode 100644
index 00000000..9397d432
--- /dev/null
+++ b/tests/fixtures/mmp-lib.mjs
@@ -0,0 +1,852 @@
+import crypto from 'node:crypto';
+
+export const PROTOCOL_VERSION = '2.0';
+export const SIGNATURE_SUITE = 'mmp-sig-v2.0';
+export const ADDRESS_SCHEME = 'mmp-cmb-merkle-v2';
+export const CAT7 = ['focus', 'issue', 'intent', 'motivation', 'commitment', 'perspective', 'mood'];
+
+export function lp(value) {
+  const bytes = Buffer.from(String(value), 'utf8');
+  return Buffer.concat([Buffer.from(`${bytes.length}:`, 'ascii'), bytes]);
+}
+
+export function decimal(value) {
+  if (!Number.isSafeInteger(value) || value < 0) {
+    throw new TypeError(`expected non-negative safe integer, got ${value}`);
+  }
+  return String(value);
+}
+
+export function sortedBytewise(values) {
+  return [...values].map(String).sort((a, b) => Buffer.compare(Buffer.from(a), Buffer.from(b)));
+}
+
+export function framedList(values) {
+  const items = sortedBytewise(new Set(values));
+  return Buffer.concat([lp(decimal(items.length)), ...items.map(lp)]);
+}
+
+export function sha256(value) {
+  return crypto.createHash('sha256').update(value).digest();
+}
+
+export function sha256Hex(value) {
+  return sha256(value).toString('hex');
+}
+
+export function categoryKeyV1(name, text) {
+  return sha256Hex(Buffer.concat([
+    Buffer.from('mmp-cmb-v1\n', 'utf8'),
+    lp(name),
+    lp(String(text ?? '').normalize('NFC')),
+  ]));
+}
+
+export function categoryParentsCommitment(categories) {
+  const parts = [Buffer.from('mmp-fp-v1\n', 'utf8')];
+  for (const name of CAT7) {
+    const refs = sortedBytewise(categories?.[name]?.meta?.parents ?? []);
+    parts.push(lp(name), lp(decimal(refs.length)), ...refs.map(lp));
+  }
+  return sha256Hex(Buffer.concat(parts));
+}
+
+export function blockKeyV2(categories) {
+  let level = CAT7.map((name) => {
+    const digest = Buffer.from(categoryKeyV1(name, categories?.[name]?.text ?? ''), 'hex');
+    return sha256(Buffer.concat([Buffer.from([0]), digest]));
+  });
+  while (level.length > 1) {
+    const next = [];
+    for (let i = 0; i < level.length; i += 2) {
+      next.push(i + 1 < level.length
+        ? sha256(Buffer.concat([Buffer.from([1]), level[i], level[i + 1]]))
+        : level[i]);
+    }
+    level = next;
+  }
+  return `cmb-${level[0].toString('hex')}`;
+}
+
+export function applicationBytes(application) {
+  if (application == null) return null;
+  if (application.encoding !== 'base64url') throw new Error('application encoding must be base64url');
+  if (typeof application.data !== 'string' || application.data.includes('=')) {
+    throw new Error('application data must be unpadded base64url');
+  }
+  const bytes = Buffer.from(application.data, 'base64url');
+  if (bytes.toString('base64url') !== application.data) throw new Error('application data is not canonical base64url');
+  if (bytes.length !== application.byteLength) throw new Error('application byteLength mismatch');
+  if (bytes.length > 524288) throw new Error('application exceeds 524288-byte limit');
+  if (`sha256-${sha256Hex(bytes)}` !== application.digest) throw new Error('application digest mismatch');
+  return bytes;
+}
+
+export function applicationCommitmentV1(application) {
+  const domain = Buffer.from('mmp-app-v1\n', 'utf8');
+  if (application == null) return sha256Hex(Buffer.concat([domain, lp('0')]));
+  applicationBytes(application);
+  if (!/^[a-z0-9][a-z0-9!#$&^_.+\/-]*$/.test(application.mediaType) || application.mediaType.includes(';')) {
+    throw new Error('application mediaType must be canonical lowercase ASCII without parameters');
+  }
+  const schema = String(application.schema ?? '').normalize('NFC');
+  return sha256Hex(Buffer.concat([
+    domain,
+    lp('1'),
+    lp(application.mediaType),
+    lp(schema),
+    lp('base64url'),
+    lp(decimal(application.byteLength)),
+    lp(application.digest),
+  ]));
+}
+
+// §8.8.6 record size limits, in bytes.
+export const MAX_CATEGORY_TEXT = 262144;
+export const MAX_RECORD_TEXT = 524288;
+export const MAX_RECORD_BYTES = 737280;
+// The longest sealed value a MAX_RECORD_BYTES plaintext can produce, the 16-byte tag included.
+export const MAX_SEALED_RECORD_CHARS = Math.ceil((4 * (MAX_RECORD_BYTES + 16)) / 3);
+
+// RFC 8785 (JCS) for the JSON a record holds: members sorted by UTF-16 code units, strings and
+// numbers as ECMAScript writes them, no whitespace.
+export function canonicalJSON(value) {
+  if (value === null || typeof value !== 'object') {
+    if (typeof value === 'number' && !Number.isFinite(value)) throw new Error('RFC 8785 has no non-finite numbers');
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) return `[${value.map(canonicalJSON).join(',')}]`;
+  const keys = Object.keys(value).filter((k) => value[k] !== undefined).sort();
+  return `{${keys.map((k) => `${JSON.stringify(k)}:${canonicalJSON(value[k])}`).join(',')}}`;
+}
+
+// The §8.8.6 measures of one two-section record, and the limits it is over (none when it is within).
+export function recordSize(record) {
+  const categoryTextBytes = Object.fromEntries(CAT7.map((name) => {
+    const text = record?.categories?.[name]?.text;
+    return [name, typeof text === 'string' ? Buffer.byteLength(text.normalize('NFC'), 'utf8') : 0];
+  }));
+  const recordTextBytes = Object.values(categoryTextBytes).reduce((a, b) => a + b, 0);
+  const recordBytes = Buffer.byteLength(canonicalJSON(record), 'utf8');
+  const over = [];
+  if (Object.values(categoryTextBytes).some((n) => n > MAX_CATEGORY_TEXT)) over.push('MAX_CATEGORY_TEXT');
+  if (recordTextBytes > MAX_RECORD_TEXT) over.push('MAX_RECORD_TEXT');
+  if (recordBytes > MAX_RECORD_BYTES) over.push('MAX_RECORD_BYTES');
+  return { categoryTextBytes, recordTextBytes, recordBytes, over };
+}
+
+// §8.8.5 step 1 after the record schema (closed objects, types, lowercase nodeIds, caps): the NFC
+// rule and the canonical signed projection, then the step 4 key checks. Returns the projection, or
+// the rule that refused the record. The projection keeps only what mmp-sig-v2.0 binds, so every
+// node holds one assertion as the same RFC 8785 bytes.
+export function recordProjectionV2(record) {
+  const isNFC = (v) => typeof v === 'string' && v === v.normalize('NFC');
+  for (const name of CAT7) if (!isNFC(record.categories[name].text)) return { ok: false, refusedBy: 'not NFC', member: `categories.${name}.text` };
+  for (const member of ['createdBy', 'room']) if (!isNFC(record.metadata[member])) return { ok: false, refusedBy: 'not NFC', member: `metadata.${member}` };
+  const categories = Object.fromEntries(CAT7.map((name) => {
+    const c = record.categories[name];
+    return [name, { text: c.text, meta: { key: c.meta.key, parents: sortedBytewise(c.meta.parents) } }];
+  }));
+  const m = record.metadata;
+  const parents = sortedBytewise(m.lineage?.parents ?? []);
+  const metadata = {
+    key: m.key,
+    addressScheme: m.addressScheme,
+    assertionId: m.assertionId,
+    signatureSuite: m.signatureSuite,
+    createdByNodeId: m.createdByNodeId,
+    createdBy: m.createdBy,
+    createdTimestamp: m.createdTimestamp,
+    room: m.room,
+    to: m.to,
+    lineage: parents.length === 0 ? null : { parents },
+    application: m.application ?? null,
+    sigAlg: m.sigAlg,
+    sig: m.sig,
+  };
+  for (const name of CAT7) if (categoryKeyV1(name, categories[name].text) !== categories[name].meta.key) return { ok: false, refusedBy: 'meta.key', member: `categories.${name}.meta.key` };
+  if (blockKeyV2(categories) !== metadata.key) return { ok: false, refusedBy: 'metadata.key', member: 'metadata.key' };
+  return { ok: true, projection: { categories, metadata } };
+}
+
+export function signingPayloadV2_0(record) {
+  const m = record?.metadata;
+  if (!m) throw new Error('metadata is required');
+  if (m.signatureSuite !== SIGNATURE_SUITE) throw new Error(`signatureSuite must be ${SIGNATURE_SUITE}`);
+  if (m.addressScheme !== ADDRESS_SCHEME) throw new Error(`addressScheme must be ${ADDRESS_SCHEME}`);
+  const parents = sortedBytewise(m.lineage?.parents ?? []);
+  return Buffer.concat([
+    Buffer.from('mmp-sig-v2.0\n', 'utf8'),
+    lp(PROTOCOL_VERSION),
+    lp(ADDRESS_SCHEME),
+    lp(m.key),
+    lp(m.createdByNodeId),
+    lp(String(m.createdBy).normalize('NFC')),
+    lp(decimal(m.createdTimestamp)),
+    lp(String(m.room).normalize('NFC')),
+    lp(m.to ?? ''),
+    lp(decimal(parents.length)),
+    ...parents.map(lp),
+    lp(categoryParentsCommitment(record.categories)),
+    lp(applicationCommitmentV1(m.application ?? null)),
+  ]);
+}
+
+export function assertionId(record) {
+  return `asrt-${sha256Hex(signingPayloadV2_0(record))}`;
+}
+
+export function handshakeTranscriptV2(h) {
+  if (h.protocolVersion !== PROTOCOL_VERSION) throw new Error('protocolVersion must be 2.0');
+  return Buffer.concat([
+    Buffer.from('mmp-handshake-transcript-v2\n', 'utf8'),
+    lp(PROTOCOL_VERSION),
+    lp(String(h.room).normalize('NFC')),
+    lp(h.client.nonce),
+    lp(h.server.nonce),
+    lp(h.client.nodeId),
+    lp(h.client.identityPublicKey),
+    lp(h.client.e2ePublicKey),
+    lp(String(h.client.name).normalize('NFC')),
+    lp(h.client.implementation.name),
+    lp(h.client.implementation.version),
+    framedList(h.client.extensions),
+    lp(h.server.nodeId),
+    lp(h.server.identityPublicKey),
+    lp(h.server.e2ePublicKey),
+    lp(String(h.server.name).normalize('NFC')),
+    lp(h.server.implementation.name),
+    lp(h.server.implementation.version),
+    framedList(h.server.extensions),
+    framedList(h.selectedExtensions),
+  ]);
+}
+
+export function handshakeProofV2(role, transcriptHash) {
+  if (role !== 'client' && role !== 'server') throw new Error('handshake role must be client or server');
+  return Buffer.concat([
+    Buffer.from('mmp-handshake-proof-v2\n', 'utf8'),
+    lp(role),
+    lp(Buffer.from(transcriptHash).toString('hex')),
+  ]);
+}
+
+export function hkdf(sharedSecret, salt, info) {
+  return Buffer.from(crypto.hkdfSync('sha256', sharedSecret, salt, Buffer.from(info, 'utf8'), 32));
+}
+
+export function keyConfirmation(role, finishedKey, transcriptHash) {
+  const payload = Buffer.concat([
+    Buffer.from('mmp-key-confirm-v2\n', 'utf8'),
+    lp(role),
+    lp(Buffer.from(transcriptHash).toString('hex')),
+  ]);
+  return crypto.createHmac('sha256', finishedKey).update(payload).digest();
+}
+
+export function nonceFromSequence(sequence) {
+  const n = BigInt(sequence);
+  if (n < 0n || n >= (1n << 96n)) throw new RangeError('sequence outside unsigned 96-bit range');
+  const nonce = Buffer.alloc(12);
+  nonce.writeUInt32BE(Number((n >> 64n) & 0xffffffffn), 0);
+  nonce.writeBigUInt64BE(n & 0xffffffffffffffffn, 4);
+  return nonce;
+}
+
+export function requireNextSequence(expected, received) {
+  const e = BigInt(expected);
+  const r = BigInt(received);
+  if (r !== e) throw new Error(`unexpected sequence: expected ${e}, received ${r}`);
+  return (e + 1n).toString();
+}
+
+export function aeadAADV2({ sessionId, direction, sequence, metadata }) {
+  if (direction !== 'client-to-server' && direction !== 'server-to-client') throw new Error('invalid direction');
+  return Buffer.concat([
+    Buffer.from('mmp-aead-aad-v2\n', 'utf8'),
+    lp(PROTOCOL_VERSION),
+    lp(sessionId),
+    lp(direction),
+    lp(String(sequence)),
+    lp(metadata.key),
+    lp(metadata.assertionId),
+    lp(metadata.createdByNodeId),
+    lp(String(metadata.room).normalize('NFC')),
+    lp(metadata.to ?? ''),
+  ]);
+}
+
+export const CONTROL_AAD_DOMAIN = 'mmp-aead-control-v2\n';
+
+// §18.2.1 control-encrypted: the record AAD's session prefix under its own domain, with no record fields.
+export function controlAADV2({ sessionId, direction, sequence }) {
+  if (direction !== 'client-to-server' && direction !== 'server-to-client') throw new Error('invalid direction');
+  return Buffer.concat([
+    Buffer.from(CONTROL_AAD_DOMAIN, 'utf8'),
+    lp(PROTOCOL_VERSION),
+    lp(sessionId),
+    lp(direction),
+    lp(String(sequence)),
+  ]);
+}
+
+// §7.1: what a control-encrypted envelope never carries. ping and pong may travel either way.
+const CONTROL_NEVER_INNER = new Set(['client-hello', 'server-hello', 'client-finish', 'handshake', 'cmb', 'cmb-encrypted', 'control-encrypted', 'state-sync']);
+export function controlInnerForbidden(type) {
+  return typeof type !== 'string' || CONTROL_NEVER_INNER.has(type) || type.startsWith('relay-');
+}
+
+export function encryptChaChaPoly({ key, sequence, plaintext, aad }) {
+  const nonce = nonceFromSequence(sequence);
+  const cipher = crypto.createCipheriv('chacha20-poly1305', key, nonce, { authTagLength: 16 });
+  cipher.setAAD(aad, { plaintextLength: plaintext.length });
+  const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+  return Buffer.concat([ciphertext, cipher.getAuthTag()]);
+}
+
+export function decryptChaChaPoly({ key, sequence, sealed, aad }) {
+  const nonce = nonceFromSequence(sequence);
+  const ciphertext = sealed.subarray(0, -16);
+  const tag = sealed.subarray(-16);
+  const decipher = crypto.createDecipheriv('chacha20-poly1305', key, nonce, { authTagLength: 16 });
+  decipher.setAAD(aad, { plaintextLength: ciphertext.length });
+  decipher.setAuthTag(tag);
+  return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+}
+
+const ED25519_PRIVATE_PREFIX = Buffer.from('302e020100300506032b657004220420', 'hex');
+const ED25519_PUBLIC_PREFIX = Buffer.from('302a300506032b6570032100', 'hex');
+const X25519_PRIVATE_PREFIX = Buffer.from('302e020100300506032b656e04220420', 'hex');
+const X25519_PUBLIC_PREFIX = Buffer.from('302a300506032b656e032100', 'hex');
+
+export function ed25519PrivateKey(raw) {
+  return crypto.createPrivateKey({ key: Buffer.concat([ED25519_PRIVATE_PREFIX, raw]), format: 'der', type: 'pkcs8' });
+}
+
+export function ed25519PublicKey(raw) {
+  return crypto.createPublicKey({ key: Buffer.concat([ED25519_PUBLIC_PREFIX, raw]), format: 'der', type: 'spki' });
+}
+
+export function x25519PrivateKey(raw) {
+  return crypto.createPrivateKey({ key: Buffer.concat([X25519_PRIVATE_PREFIX, raw]), format: 'der', type: 'pkcs8' });
+}
+
+export function x25519PublicKey(raw) {
+  return crypto.createPublicKey({ key: Buffer.concat([X25519_PUBLIC_PREFIX, raw]), format: 'der', type: 'spki' });
+}
+
+export function rawPublicKey(keyObject) {
+  return keyObject.export({ format: 'der', type: 'spki' }).subarray(-32);
+}
+
+
+// ---------------------------------------------------------------------------------------------
+// §18.3.2 Ed25519 verification for authority statements, pinned exactly.
+// RFC 8032 §5.1.7 verification, cofactorless ([S]B = R + [k]A, compared as points), after four
+// pre-checks: A and R are canonical encodings of points on the curve, both of prime order (in the
+// prime-order subgroup and not the identity), and S < L. With A and R of prime order the
+// cofactored and cofactorless equations give the same answer, so every conforming library agrees.
+// Node's crypto.verify (OpenSSL) supplies the equation; the pre-checks below are what it lacks.
+// ---------------------------------------------------------------------------------------------
+
+const ED_P = 2n ** 255n - 19n;
+export const ED25519_L = 2n ** 252n + 27742317777372353535851937790883648493n;
+const edMod = (a) => { const r = a % ED_P; return r < 0n ? r + ED_P : r; };
+const edPow = (b, e) => { let r = 1n; let x = edMod(b); let n = e; while (n > 0n) { if (n & 1n) r = (r * x) % ED_P; x = (x * x) % ED_P; n >>= 1n; } return r; };
+const ED_D = edMod(-121665n * edPow(121666n, ED_P - 2n));
+const ED_SQRT_M1 = edPow(2n, (ED_P - 1n) / 4n);
+const ED_IDENTITY = { X: 0n, Y: 1n, Z: 1n, T: 0n };
+const leInt = (bytes) => BigInt(`0x${Buffer.from(bytes).reverse().toString('hex') || '0'}`);
+
+// Decode a 32-byte point. strict: reject y >= p and the encoding of x = 0 with the sign bit set
+// (RFC 8032 §5.1.3 canonical encodings). lenient (ZIP-215 style) reduces y and ignores that sign bit;
+// it is used only to show what an unchecked library would compute.
+function edDecode(bytes, { lenient = false } = {}) {
+  if (!bytes || bytes.length !== 32) return null;
+  const b = Buffer.from(bytes);
+  const sign = (b[31] >> 7) & 1;
+  b[31] &= 0x7f;
+  let y = leInt(b);
+  if (y >= ED_P) { if (!lenient) return null; y = edMod(y); }
+  const u = edMod(y * y - 1n);
+  const v = edMod(ED_D * y * y + 1n);
+  let x = edMod(u * edPow(v, 3n) * edPow(u * edPow(v, 7n), (ED_P - 5n) / 8n));
+  const vx2 = edMod(v * x * x);
+  if (vx2 === u) { /* root found */ } else if (vx2 === edMod(-u)) x = edMod(x * ED_SQRT_M1); else return null;
+  if (x === 0n && sign === 1 && !lenient) return null;
+  if (Number(x & 1n) !== sign) x = edMod(-x);
+  return { X: x, Y: y, Z: 1n, T: edMod(x * y) };
+}
+function edAdd(p, q) {
+  const A = edMod((p.Y - p.X) * (q.Y - q.X));
+  const B = edMod((p.Y + p.X) * (q.Y + q.X));
+  const C = edMod(2n * ED_D * p.T * q.T);
+  const D2 = edMod(2n * p.Z * q.Z);
+  const E = B - A; const F = D2 - C; const G = D2 + C; const H = B + A;
+  return { X: edMod(E * F), Y: edMod(G * H), Z: edMod(F * G), T: edMod(E * H) };
+}
+const edNeg = (p) => ({ X: edMod(-p.X), Y: p.Y, Z: p.Z, T: edMod(-p.T) });
+function edMul(p, k) {
+  let r = ED_IDENTITY;
+  for (let i = k.toString(2).length - 1; i >= 0; i--) {
+    r = edAdd(r, r);
+    if ((k >> BigInt(i)) & 1n) r = edAdd(r, p);
+  }
+  return r;
+}
+const edIsIdentity = (p) => edMod(p.X) === 0n && edMod(p.Y - p.Z) === 0n;
+const edEqual = (p, q) => edMod(p.X * q.Z - q.X * p.Z) === 0n && edMod(p.Y * q.Z - q.Y * p.Z) === 0n;
+const ED_BASE = edDecode(Buffer.from('5866666666666666666666666666666666666666666666666666666666666666', 'hex'));
+
+// Prime order: a canonical point P with [L]P = O and P != O. Small-order points fail the first test
+// (L = 5 mod 8, so [L]T = [5]T != O for torsion T != O), mixed-order points fail it too, and the
+// identity fails the second. Cached per encoding: keys and signatures repeat across resolutions.
+const primeOrderCache = new Map();
+export function isPrimeOrderPoint(bytes) {
+  const k = Buffer.from(bytes).toString('hex');
+  if (primeOrderCache.has(k)) return primeOrderCache.get(k);
+  const p = edDecode(bytes);
+  const ok = p !== null && !edIsIdentity(p) && edIsIdentity(edMul(p, ED25519_L));
+  primeOrderCache.set(k, ok);
+  return ok;
+}
+
+// The reason a (key, signature) pair fails the pre-checks, or null when it passes them.
+export function ed25519PrecheckFailure(publicKey, signature) {
+  const A = Buffer.from(publicKey);
+  const sig = Buffer.from(signature);
+  if (A.length !== 32 || sig.length !== 64) return 'length';
+  if (!edDecode(A)) return 'A is not a canonical encoding of a curve point';
+  if (!isPrimeOrderPoint(A)) return 'A is not of prime order';
+  const R = sig.subarray(0, 32);
+  if (!edDecode(R)) return 'R is not a canonical encoding of a curve point';
+  if (!isPrimeOrderPoint(R)) return 'R is not of prime order';
+  if (leInt(sig.subarray(32)) >= ED25519_L) return 'S is not less than L';
+  return null;
+}
+
+// Point arithmetic for building the edge-case vector (not used by verification itself).
+function edEncode(p) {
+  const zi = edPow(p.Z, ED_P - 2n);
+  const x = edMod(p.X * zi);
+  const y = edMod(p.Y * zi);
+  const out = Buffer.from(y.toString(16).padStart(64, '0'), 'hex').reverse();
+  if (x & 1n) out[31] |= 0x80;
+  return out;
+}
+export const ed25519Points = {
+  base: ED_BASE,
+  identity: ED_IDENTITY,
+  // A point of order 8 (from the torsion subgroup), checked below.
+  torsion8: edDecode(Buffer.from('26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc05', 'hex')),
+  decode: (bytes) => edDecode(bytes),
+  encode: edEncode,
+  add: edAdd,
+  mul: edMul,
+  isIdentity: edIsIdentity,
+  scalar: (bytes) => leInt(bytes) % ED25519_L,
+  le32: (n) => Buffer.from(n.toString(16).padStart(64, '0'), 'hex').reverse(),
+  challenge: (R, A, message) => leInt(crypto.createHash('sha512').update(Buffer.concat([Buffer.from(R), Buffer.from(A), Buffer.from(message)])).digest()) % ED25519_L,
+};
+if (!edIsIdentity(edMul(ed25519Points.torsion8, 8n)) || edIsIdentity(edMul(ed25519Points.torsion8, 4n))) throw new Error('torsion point is not of order 8');
+
+// §18.3.2, the rule as written: the four pre-checks, then [S]B = R + [k]A, all computed here in
+// BigInt, independently of any library. Slow; used to cross-check the edge-case vector.
+export function verifyEd25519StrictFull(message, publicKey, signature) {
+  if (ed25519PrecheckFailure(publicKey, signature) !== null) return false;
+  return ed25519Equations(message, publicKey, signature).cofactorless;
+}
+
+// §18.3.2 as a cofactorless verifier that compares R by its bytes (OpenSSL, hence Node) implements
+// it: check A (canonical, prime order: cached per key), S < L, and that R is not the identity's
+// encoding, then call the library. This is the same rule. If the library accepts, R's bytes are the
+// canonical encoding of R' = [S]B - [k]A, which lies in the prime-order subgroup because B and A do,
+// and R' is not the identity, so R is canonical and of prime order. If the rule accepts, R' = R and
+// the library's byte comparison succeeds. The edge-case vector checks both on every case.
+const ED_IDENTITY_BYTES = Buffer.concat([Buffer.from([1]), Buffer.alloc(31)]);
+export function verifyEd25519Strict(message, publicKey, signature) {
+  const A = Buffer.from(publicKey);
+  const sig = Buffer.from(signature);
+  if (A.length !== 32 || sig.length !== 64) return false;
+  if (!isPrimeOrderPoint(A)) return false;
+  if (sig.subarray(0, 32).equals(ED_IDENTITY_BYTES)) return false;
+  if (leInt(sig.subarray(32)) >= ED25519_L) return false;
+  try {
+    return crypto.verify(null, message, ed25519PublicKey(A), sig);
+  } catch {
+    return false;
+  }
+}
+
+// Both RFC 8032 equations computed directly, without pre-checks and with lenient decoding, for the
+// edge-case vector only: they show what an unchecked library may answer, and that once the
+// pre-checks pass the two equations agree.
+export function ed25519Equations(message, publicKey, signature) {
+  const Araw = Buffer.from(publicKey);
+  const sig = Buffer.from(signature);
+  const A = edDecode(Araw, { lenient: true });
+  const R = edDecode(sig.subarray(0, 32), { lenient: true });
+  if (!A || !R) return { cofactorless: false, cofactored: false };
+  const S = leInt(sig.subarray(32));
+  const k = leInt(crypto.createHash('sha512').update(Buffer.concat([sig.subarray(0, 32), Araw, Buffer.from(message)])).digest()) % ED25519_L;
+  const SB = edMul(ED_BASE, S);
+  const RkA = edAdd(R, edMul(A, k));
+  const diff = edAdd(SB, edNeg(RkA));
+  return { cofactorless: edEqual(SB, RkA), cofactored: edIsIdentity(edMul(diff, 8n)) };
+}
+
+// ---------------------------------------------------------------------------------------------
+// §6.6 authority statements: grant, revoke and endorse, linked by hash, resolved as a set.
+// This is the reference construction the authority vector is generated from and checked against.
+// Nothing here reads a clock or depends on the order statements arrive in.
+// ---------------------------------------------------------------------------------------------
+
+export const AUTHORITY_DOMAIN = 'mmp-authority-v1\n';
+export const AUTHORITY_ROOT_DOMAIN = 'mmp-authority-root-v1\n';
+export const ANCHOR_PIN_DOMAIN = 'mmp-anchor-pin-v1\n';
+export const MAX_DELEGATION_DEPTH = 4;
+export const AUTHORITY_QUOTA = 256;
+export const AUTHORITY_ANCHOR_QUOTA = 4096;
+export const AUTHORITY_DELEGATE_QUOTA = 16;
+export const AUTHORITY_MAX_TARGETS = 64;
+export const ANCHOR_MAX_KEYS = 16;
+export const AUTHORITY_SCOPE_MAX = 256;
+export const MAX_ISSUED_AT = Number.MAX_SAFE_INTEGER; // 2^53 - 1
+
+const AUTHORITY_ID = /^auth-[0-9a-f]{64}$/;
+const B64U_KEY = /^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/;
+const B64U_SIG = /^[A-Za-z0-9_-]{85}[AQgw]$/;
+const B64U_NONCE = /^[A-Za-z0-9_-]{21}[AQgw]$/;
+// Canonical RFC 4122 text form, lowercase only: the bytes signed are exactly these characters.
+export const NODE_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+const EXTENSION_ROLE = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)+$/;
+// namespace ":" path, path segments separated by "/". A narrower scope adds segments. A segment
+// made only of dots ("." or "..") is forbidden: paths are opaque and compared exactly, never
+// normalised, so nothing may look like a step up to anyone who would resolve it.
+export const SCOPE = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*:(?!\.+(?:\/|$))[A-Za-z0-9._~-]+(?:\/(?!\.+(?:\/|$))[A-Za-z0-9._~-]+)*$/;
+// Roles that may sign statements, hence are counted against the delegate quota.
+export const DELEGATING_ROLES = new Set(['admin', 'validator', 'issuer']);
+const CORE_ROLES = new Set(['admin', 'validator', 'issuer', 'participant']);
+// The lifecycle a role may advance another CMB to (§3.5), inside its grant's scope.
+export const LIFECYCLE_AUTHORITY = { anchor: 'canonical', admin: 'canonical', validator: 'validated' };
+
+export function isNonAuthorityRole(role) {
+  return role === 'participant' || (typeof role === 'string' && role.length <= 64 && EXTENSION_ROLE.test(role)
+    && !CORE_ROLES.has(role));
+}
+
+export function isRole(role) {
+  return DELEGATING_ROLES.has(role) || isNonAuthorityRole(role);
+}
+
+export function isScope(scope) {
+  return typeof scope === 'string' && scope.length <= AUTHORITY_SCOPE_MAX && SCOPE.test(scope);
+}
+
+// A child's scope equals or narrows its parent's. No scope is the widest: the whole mesh.
+export function scopeNarrows(parent, child) {
+  if (parent === undefined) return true;
+  if (child === undefined) return false;
+  return child === parent || child.startsWith(`${parent}/`);
+}
+
+function canonicalB64u(value, pattern, bytes) {
+  if (typeof value !== 'string' || !pattern.test(value)) return false;
+  const decoded = Buffer.from(value, 'base64url');
+  return decoded.length === bytes && decoded.toString('base64url') === value;
+}
+
+// The canonical signed bytes. Every field is length-prefixed (lp), so the encoding is injective;
+// targets are a count-prefixed list in bytewise order, so their order on the wire does not matter.
+export function authorityPayloadV1(s) {
+  const parts = [Buffer.from(AUTHORITY_DOMAIN, 'utf8'), lp(s.kind), lp(s.authorisedBy)];
+  if (s.kind === 'grant') parts.push(lp(s.subject.nodeId), lp(s.subject.key), lp(s.role), lp(s.scope ?? ''));
+  else if (s.kind === 'revoke' || s.kind === 'endorse') parts.push(framedList(s.targets));
+  else throw new Error(`unknown statement kind ${s.kind}`);
+  parts.push(lp(s.nonce), lp(s.issuedAt === undefined ? '' : decimal(s.issuedAt)));
+  return Buffer.concat(parts);
+}
+
+export function authorityId(s) {
+  return `auth-${sha256Hex(authorityPayloadV1(s))}`;
+}
+
+// The anchor pin as bytes: threshold, then each member as its key. Under a threshold of 1 a member
+// pinned with the nodeId of its holder is "key:nodeId", because only then does that nodeId change
+// what resolves (the holder is the anchor, §6.6.1). A key is 43 base64url characters, so the colon
+// is unambiguous.
+export function anchorPinDigest(pin) {
+  const members = pin.keys.map((m) => (pin.threshold === 1 && m.nodeId ? `${m.key}:${m.nodeId}` : m.key));
+  return sha256Hex(Buffer.concat([Buffer.from(ANCHOR_PIN_DOMAIN, 'utf8'), lp(decimal(pin.threshold)), framedList(members)]));
+}
+
+// The authority root (§6.6.7): which in-force set, under which anchor. Two nodes with the same pin
+// and the same in-force set have the same root, whatever else each happens to hold.
+export function authorityRoot(pin, inForceIds) {
+  return sha256Hex(Buffer.concat([
+    Buffer.from(AUTHORITY_ROOT_DOMAIN, 'utf8'),
+    lp(anchorPinDigest(pin)),
+    framedList(inForceIds),
+  ]));
+}
+
+// Shape checks that need no other statement (§6.6.3, rule 1).
+export function authorityWellFormed(s) {
+  if (!s || typeof s !== 'object') return false;
+  const common = ['kind', 'authorisedBy', 'nonce', 'sigs'];
+  const allowed = new Set([...common, 'issuedAt', ...(s.kind === 'grant' ? ['subject', 'role', 'scope'] : ['targets'])]);
+  if (Object.keys(s).some((k) => !allowed.has(k)) || common.some((k) => !(k in s))) return false;
+  if (s.authorisedBy !== 'anchor' && !AUTHORITY_ID.test(s.authorisedBy)) return false;
+  if (!canonicalB64u(s.nonce, B64U_NONCE, 16)) return false;
+  if (s.issuedAt !== undefined && !(Number.isSafeInteger(s.issuedAt) && s.issuedAt >= 0 && s.issuedAt <= MAX_ISSUED_AT)) return false;
+  if (!Array.isArray(s.sigs) || s.sigs.length < 1) return false;
+  if (s.authorisedBy !== 'anchor' && s.sigs.length !== 1) return false;
+  if (s.sigs.length > ANCHOR_MAX_KEYS) return false;
+  for (const e of s.sigs) {
+    if (!e || typeof e !== 'object' || Object.keys(e).length !== 2 || !canonicalB64u(e.key, B64U_KEY, 32) || !canonicalB64u(e.sig, B64U_SIG, 64)) return false;
+  }
+  // Each entry's key is unique within the statement: a repeated key is a shape error, found here,
+  // before any signature is checked, so a copy cannot buy repeated checks under one pinned key.
+  if (new Set(s.sigs.map((e) => e.key)).size !== s.sigs.length) return false;
+  if (s.kind === 'grant') {
+    const sub = s.subject;
+    if (!sub || typeof sub !== 'object' || Object.keys(sub).length !== 2 || typeof sub.nodeId !== 'string' || !NODE_ID.test(sub.nodeId)) return false;
+    if (!canonicalB64u(sub.key, B64U_KEY, 32) || !isPrimeOrderPoint(Buffer.from(sub.key, 'base64url'))) return false;
+    if (s.scope !== undefined && !isScope(s.scope)) return false;
+    return isRole(s.role);
+  }
+  if (s.kind !== 'revoke' && s.kind !== 'endorse') return false;
+  if (!Array.isArray(s.targets) || s.targets.length < 1 || s.targets.length > AUTHORITY_MAX_TARGETS) return false;
+  if (new Set(s.targets).size !== s.targets.length) return false;
+  return s.targets.every((t) => typeof t === 'string' && AUTHORITY_ID.test(t));
+}
+
+// Which statements the holder of the authorising role may sign (§6.6.2).
+function permits(authorisingRole, s) {
+  if (s.kind === 'grant') {
+    if (authorisingRole === 'anchor' || authorisingRole === 'admin') return DELEGATING_ROLES.has(s.role) || isNonAuthorityRole(s.role);
+    if (authorisingRole === 'validator' || authorisingRole === 'issuer') return isNonAuthorityRole(s.role);
+    return false;
+  }
+  if (s.kind === 'revoke') return authorisingRole === 'anchor' || DELEGATING_ROLES.has(authorisingRole);
+  return authorisingRole === 'anchor' || authorisingRole === 'admin';
+}
+
+const verifyEntry = (payload, e) => verifyEd25519Strict(payload, Buffer.from(e.key, 'base64url'), Buffer.from(e.sig, 'base64url'));
+
+function anchorCopyValid(pin, payload, s, verify) {
+  const pinned = new Set(pin.keys.map((m) => m.key));
+  const counted = new Set();
+  for (const e of s.sigs) {
+    if (pinned.has(e.key) && !counted.has(e.key) && verify(payload, e)) counted.add(e.key);
+  }
+  return counted.size >= pin.threshold;
+}
+
+/**
+ * Resolve a set of authority statements against a pinned anchor set (§6.6.4).
+ * pin: { threshold, keys: [{ key, nodeId? }] }. statements: any array (order is irrelevant).
+ * Returns the status of every distinct statement id, the in-force ids, the live set, the roles of
+ * each (nodeId, key), the bucket that kept each in-force statement, and the authority root.
+ * `verifySignature` exists only so the randomised bound check in the verifier can run thousands of
+ * statements without signing them; every conformance case uses the §18.3.2 rule.
+ */
+export function resolveAuthority({
+  pin, statements, quota = AUTHORITY_QUOTA, anchorQuota = AUTHORITY_ANCHOR_QUOTA,
+  delegateQuota = AUTHORITY_DELEGATE_QUOTA, verifySignature = verifyEntry,
+}) {
+  if (!(pin && Number.isInteger(pin.threshold) && pin.threshold >= 1 && pin.threshold <= pin.keys.length
+    && pin.keys.length <= ANCHOR_MAX_KEYS)) throw new Error('invalid anchor pin');
+  // 1. Group copies by id. A copy that is not well formed is not a statement at all.
+  const copies = new Map();
+  const malformed = new Set(); // ids of copies that are not well formed, where an id can be computed
+  for (const s of statements) {
+    if (!authorityWellFormed(s)) {
+      try { malformed.add(authorityId(s)); } catch { /* no id at all */ }
+      continue;
+    }
+    const id = authorityId(s);
+    if (!copies.has(id)) copies.set(id, []);
+    copies.get(id).push(s);
+  }
+  // 2. Static validity (rules 2-4). Walk authorisedBy at most MAX_DELEGATION_DEPTH links: a chain
+  // that reaches the anchor is validated top-down; one that names a statement not held is pending;
+  // one that is still not at the anchor after MAX_DELEGATION_DEPTH links is too deep, hence invalid.
+  const info = new Map(); // id -> { status, s, depth, chain: [grant ids above it, nearest first] }
+  const validateOne = (id, parentId) => {
+    if (info.has(id)) return;
+    const all = copies.get(id);
+    const payload = authorityPayloadV1(all[0]);
+    if (parentId === null) {
+      const good = all.find((c) => anchorCopyValid(pin, payload, c, verifySignature));
+      info.set(id, good && permits('anchor', good) ? { status: 'valid', s: good, depth: 1, chain: [] } : { status: 'invalid', s: all[0] });
+      return;
+    }
+    const up = info.get(parentId);
+    if (up.status !== 'valid' || up.s.kind !== 'grant') { info.set(id, { status: 'invalid', s: all[0] }); return; }
+    const good = all.find((c) => c.sigs[0].key === up.s.subject.key && verifySignature(payload, c.sigs[0]));
+    const scoped = !good || good.kind !== 'grant' || scopeNarrows(up.s.scope, good.scope);
+    info.set(id, good && scoped && permits(up.s.role, good)
+      ? { status: 'valid', s: good, depth: up.depth + 1, chain: [parentId, ...up.chain] }
+      : { status: 'invalid', s: all[0] });
+  };
+  const check = (id) => {
+    if (info.has(id)) return;
+    const walk = [id];
+    let cur = copies.get(id)[0];
+    while (cur.authorisedBy !== 'anchor') {
+      if (walk.length === MAX_DELEGATION_DEPTH) { info.set(id, { status: 'invalid', s: copies.get(id)[0] }); return; }
+      if (!copies.has(cur.authorisedBy)) { info.set(id, { status: 'pending', s: copies.get(id)[0] }); return; }
+      walk.push(cur.authorisedBy);
+      cur = copies.get(cur.authorisedBy)[0];
+    }
+    for (let i = walk.length - 1; i >= 0; i--) validateOne(walk[i], i === walk.length - 1 ? null : walk[i + 1]);
+  };
+  for (const id of copies.keys()) check(id);
+
+  // 3. Index the valid statements: buckets by authorisedBy, and who names whom.
+  const buckets = new Map(); // authorisedBy -> { key, depth, removals: [], grants: [] }
+  const namedBy = new Map(); // target id -> [revoke/endorse ids naming it]
+  for (const [id, x] of info) {
+    if (x.status !== 'valid') continue;
+    const key = x.s.authorisedBy;
+    if (!buckets.has(key)) buckets.set(key, { key, depth: x.depth, removals: [], grants: [] });
+    buckets.get(key)[x.s.kind === 'grant' ? 'grants' : 'removals'].push(id);
+    if (x.s.kind !== 'grant') for (const t of x.s.targets) {
+      if (!namedBy.has(t)) namedBy.set(t, []);
+      namedBy.get(t).push(id);
+    }
+  }
+  const bytewise = (a, b) => Buffer.compare(Buffer.from(a), Buffer.from(b));
+  for (const list of namedBy.values()) list.sort(bytewise);
+  const status = new Map([...info].map(([id, x]) => [id, x.status]));
+  for (const id of malformed) if (!status.has(id)) status.set(id, 'invalid');
+  const inForce = new Set();
+  const keptBy = new Map(); // in-force id -> the bucket that keeps it (its own, or its rescuer's)
+  const charged = new Map(); // bucket -> statements kept by it, its own and those it rescued
+  const delegates = new Map(); // bucket -> delegating grants kept by it, its own and rescued
+  const kindOf = (id) => info.get(id).s.kind;
+  const isDelegating = (id) => kindOf(id) === 'grant' && DELEGATING_ROLES.has(info.get(id).s.role);
+  const quotaOf = (bucket) => (bucket === 'anchor' ? anchorQuota : quota);
+  // Keep id in bucket if it has room: Q statements, and (unless it is the anchor's) the delegate quota.
+  const keep = (bucket, id) => {
+    if ((charged.get(bucket) ?? 0) >= quotaOf(bucket)) return false;
+    if (isDelegating(id) && bucket !== 'anchor' && (delegates.get(bucket) ?? 0) >= delegateQuota) return false;
+    charged.set(bucket, (charged.get(bucket) ?? 0) + 1);
+    if (isDelegating(id)) delegates.set(bucket, (delegates.get(bucket) ?? 0) + 1);
+    inForce.add(id);
+    status.set(id, 'in-force');
+    keptBy.set(id, bucket);
+    return true;
+  };
+  // An endorse e may rescue s iff s is not anchor-level and e's authority lies strictly above the
+  // grant that authorises s (e could remove that grant). A revoke r may remove grant g iff r's
+  // authority is the anchor or lies on g's chain above g.
+  const mayRescue = (e, s) => {
+    const sa = info.get(s);
+    return sa.s.authorisedBy !== 'anchor' && (info.get(e).s.authorisedBy === 'anchor' || sa.chain.slice(1).includes(info.get(e).s.authorisedBy));
+  };
+  const mayRemove = (r, g) => info.get(r).s.authorisedBy === 'anchor' || info.get(g).chain.includes(info.get(r).s.authorisedBy);
+  const removed = (g) => (namedBy.get(g) ?? []).some((r) => kindOf(r) === 'revoke' && inForce.has(r) && mayRemove(r, g));
+  // Cut by a revoke: past the dead grants on its chain, the first grant that is not dead is removed.
+  // A statement cut by a quota (the first such grant is over quota) is never rescued.
+  const cutByRevoke = (id) => {
+    for (const up of info.get(id).chain) {
+      const st = status.get(up);
+      if (st !== 'dead') return st === 'removed';
+    }
+    return false;
+  };
+  // Rescue: charge s to the first in-force endorse naming it, in ascending id order, that may rescue
+  // it and whose bucket has room. Endorses are never rescued, so the rescuer's bucket is in force.
+  const rescue = (id) => {
+    const rescuers = (namedBy.get(id) ?? []).filter((e) => kindOf(e) === 'endorse' && inForce.has(e) && mayRescue(e, id));
+    for (const e of rescuers) if (keep(info.get(e).s.authorisedBy, id)) return;
+    status.set(id, rescuers.length ? 'over-quota' : 'dead');
+  };
+
+  // 4. Depth by depth: revokes and endorses first (phase A), then grants (phase B). In each phase a
+  // bucket whose authorising grant is in force keeps its own statements by ascending id; then the
+  // statements of the other buckets that a revoke cut off are offered for rescue, by ascending id.
+  for (let d = 1; d <= MAX_DELEGATION_DEPTH; d++) {
+    const level = [...buckets.values()].filter((b) => b.depth === d);
+    const up = (b) => b.key === 'anchor' || inForce.has(b.key);
+    const candidates = [];
+    for (const b of level) {
+      if (up(b)) {
+        for (const id of [...b.removals].sort(bytewise)) if (!keep(b.key, id)) status.set(id, 'over-quota');
+      } else {
+        for (const id of b.removals) {
+          if (kindOf(id) === 'revoke' && cutByRevoke(id)) candidates.push(id); else status.set(id, 'dead');
+        }
+      }
+    }
+    for (const id of candidates.sort(bytewise)) rescue(id);
+    const grantCandidates = [];
+    for (const b of level) {
+      if (up(b)) {
+        const standing = [];
+        for (const id of b.grants) if (removed(id)) status.set(id, 'removed'); else standing.push(id);
+        for (const id of standing.sort(bytewise)) if (!keep(b.key, id)) status.set(id, 'over-quota');
+      } else {
+        for (const id of b.grants) {
+          if (!cutByRevoke(id)) status.set(id, 'dead');
+          else if (removed(id)) status.set(id, 'removed');
+          else grantCandidates.push(id);
+        }
+      }
+    }
+    for (const id of grantCandidates.sort(bytewise)) rescue(id);
+  }
+
+  // 5. Roles follow the key: (nodeId, key) of every in-force grant, with its scope, plus every
+  // member of a threshold-1 anchor that is pinned with its nodeId.
+  const roles = new Map();
+  const addRole = (nodeId, key, role, scope) => {
+    const k = `${nodeId} ${key}`;
+    if (!roles.has(k)) roles.set(k, []);
+    roles.get(k).push({ role, scope: scope ?? null });
+  };
+  for (const id of inForce) {
+    const s = info.get(id).s;
+    if (s.kind === 'grant') addRole(s.subject.nodeId, s.subject.key, s.role, s.scope);
+  }
+  if (pin.threshold === 1) for (const m of pin.keys) if (m.nodeId) addRole(m.nodeId, m.key, 'anchor', null);
+  for (const list of roles.values()) list.sort((a, b) => (`${a.role} ${a.scope ?? ''}` < `${b.role} ${b.scope ?? ''}` ? -1 : 1));
+  const live = new Set(inForce);
+  for (const id of inForce) for (const upId of info.get(id).chain) live.add(upId);
+  const inForceIds = sortedBytewise(inForce);
+  return {
+    status,
+    inForce: inForceIds,
+    live: sortedBytewise(live),
+    roles,
+    keptBy,
+    depthOf: (id) => info.get(id)?.depth,
+    // The copy a node keeps for a valid statement: the one whose signatures it counted.
+    statementOf: (id) => (info.get(id)?.status === 'valid' ? info.get(id).s : undefined),
+    chainOf: (id) => info.get(id)?.chain,
+    root: authorityRoot(pin, inForceIds),
+  };
+}
+
+// The lifecycle a set of role entries lets a node advance a CMB to (§3.5), for a CMB the caller
+// says is or is not inside each scope. An unscoped entry reaches every CMB; a scoped one only CMBs
+// inside its scope. An extension defines what "inside" means for its namespace; a receiver that does
+// not implement the namespace treats no CMB as inside it.
+export function lifecycleAuthority(entries, inScope = () => false) {
+  const rank = { none: 0, validated: 1, canonical: 2 };
+  let best = 'none';
+  for (const { role, scope } of entries ?? []) {
+    const reach = LIFECYCLE_AUTHORITY[role] ?? 'none';
+    if ((scope === null || scope === undefined || inScope(scope)) && rank[reach] > rank[best]) best = reach;
+  }
+  return best;
+}
+
+// The order in which a node sends a set: depth, then revokes and endorses before grants, then id.
+// Every statement then arrives after everything that can change its standing (§6.6.8).
+export function authorityOrder(entries) {
+  const rank = (s) => (s.kind === 'grant' ? 1 : 0);
+  return [...entries].sort((a, b) => a.depth - b.depth || rank(a.s) - rank(b.s) || Buffer.compare(Buffer.from(a.id), Buffer.from(b.id)));
+}
diff --git a/tests/fixtures/record-projection-v2.json b/tests/fixtures/record-projection-v2.json
new file mode 100644
index 00000000..441f1149
--- /dev/null
+++ b/tests/fixtures/record-projection-v2.json
@@ -0,0 +1,1980 @@
+{
+  "protocolVersion": "2.0",
+  "rule": "§8.8.5 step 1: validate the record schema (closed objects except categories, JSON types, lowercase nodeIds, the 256 caps), refuse a signed string that is not NFC, then keep the canonical signed projection: the seven categories with text and meta {key, parents sorted bytewise}, and metadata with lineage {parents sorted bytewise} or null when it has none, application or null, and nothing unsigned. Step 4 then recomputes every meta.key and metadata.key.",
+  "usage": "For an accepted case, compute the projection and compare it, and the SHA-256 of its RFC 8785 serialization, with expected; the signature (record-signature-v2 testKey) verifies on the record as given and on the projection. For a refused case, refuse at the rule named; which rule reports first is not pinned when several apply.",
+  "testKey": {
+    "publicKeyBase64url": "IVL40Zt5HSRFMkLhXy6rbLfP-ntqXtMAl5YOBpiB2xI"
+  },
+  "cases": [
+    {
+      "label": "valence, arousal and lineage.method are dropped",
+      "record": {
+        "categories": {
+          "focus": {
+            "text": "review the café menu",
+            "meta": {
+              "key": "d2ee95788fc6f697ee3997158c4c189432dc15835aa2efa2c8a57f030f1ceb86",
+              "parents": []
+            }
+          },
+          "issue": {
+            "text": "the public vectors and runtime disagree",
+            "meta": {
+              "key": "8f37da919d4165770650b6508b66af65f0710157209b10724e7cc4aab717da83",
+              "parents": [
+                "cmb-0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a",
+                "cmb-f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0"
+              ]
+            }
+          },
+          "intent": {
+            "text": "make independent implementations interoperate",
+            "meta": {
+              "key": "f47998bfc4aedee3ac20c485f9cd07caacccf622ceced426c02e178741718f67",
+              "parents": []
+            }
+          },
+          "motivation": {
+            "text": "a protocol claim must be executable",
+            "meta": {
+              "key": "9dfa469fab3eeb8c98f79df69c3b2f02f277a017f9cbe3bf0f32ccbf9a4f129d",
+              "parents": []
+            }
+          },
+          "commitment": {
+            "text": "one contract drives every implementation",
+            "meta": {
+              "key": "d3bbf94949feceaea72667efe8c43a4bf3aed557ecc632caf82b7c3f2447e3c8",
+              "parents": []
+            }
+          },
+          "perspective": {
+            "text": "protocol editor",
+            "meta": {
+              "key": "3e48fe2e89a1e02f5c17c08e853bd09d5355d18a491a1bd926568089626ffa35",
+              "parents": []
+            }
+          },
+          "mood": {
+            "text": "calm",
+            "meta": {
+              "key": "d816b3859d6849569138dba79c0f1c82b7ce827a74ae63072d04f6f8a96a0e8f",
+              "parents": []
+            },
+            "valence": 0.2,
+            "arousal": -0.1
+          }
+        },
+        "metadata": {
+          "key": "cmb-15087b3c3a0a6b79971af8f56ebeccafbe4e5f71e4f88bd26c30ba99c7fe341e",
+          "addressScheme": "mmp-cmb-merkle-v2",
+          "signatureSuite": "mmp-sig-v2.0",
+          "createdByNodeId": "018f47a0-7b21-7abc-8def-0123456789ab",
+          "createdBy": "zoë",
+          "createdTimestamp": 1786611600000,
+          "room": "conformance-room",
+          "to": null,
+          "lineage": {
+            "parents": [
+              "cmb-0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a",
+              "cmb-f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0"
+            ],
+            "method": "SVAF-v2"
+          },
+          "application": null,
+          "assertionId": "asrt-dff1bf3d7fe9a7a446aab9759db2b7ea5fe6e415270b2f62ae0e22ecb456d24b",
+          "sigAlg": "ed25519",
+          "sig": "we3Ny_mwTSVDw4Tqg2qRc0ILxuAcHQK9JOghYZ76QEutab0C-E07IftV0c93W0CJygb9JoJzU7rWHnHWfEP6Bg"
+        }
+      },
+      "expected": {
+        "accepted": true,
+        "projection": {
+          "categories": {
+            "focus": {
+              "text": "review the café menu",
+              "meta": {
+                "key": "d2ee95788fc6f697ee3997158c4c189432dc15835aa2efa2c8a57f030f1ceb86",
+                "parents": []
+              }
+            },
+            "issue": {
+              "text": "the public vectors and runtime disagree",
+              "meta": {
+                "key": "8f37da919d4165770650b6508b66af65f0710157209b10724e7cc4aab717da83",
+                "parents": [
+                  "cmb-0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a",
+                  "cmb-f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0"
+                ]
+              }
+            },
+            "intent": {
+              "text": "make independent implementations interoperate",
+              "meta": {
+                "key": "f47998bfc4aedee3ac20c485f9cd07caacccf622ceced426c02e178741718f67",
+                "parents": []
+              }
+            },
+            "motivation": {
+              "text": "a protocol claim must be executable",
+              "meta": {
+                "key": "9dfa469fab3eeb8c98f79df69c3b2f02f277a017f9cbe3bf0f32ccbf9a4f129d",
+                "parents": []
+              }
+            },
+            "commitment": {
+              "text": "one contract drives every implementation",
+              "meta": {
+                "key": "d3bbf94949feceaea72667efe8c43a4bf3aed557ecc632caf82b7c3f2447e3c8",
+                "parents": []
+              }
+            },
+            "perspective": {
+              "text": "protocol editor",
+              "meta": {
+                "key": "3e48fe2e89a1e02f5c17c08e853bd09d5355d18a491a1bd926568089626ffa35",
+                "parents": []
+              }
+            },
+            "mood": {
+              "text": "calm",
+              "meta": {
+                "key": "d816b3859d6849569138dba79c0f1c82b7ce827a74ae63072d04f6f8a96a0e8f",
+                "parents": []
+              }
+            }
+          },
+          "metadata": {
+            "key": "cmb-15087b3c3a0a6b79971af8f56ebeccafbe4e5f71e4f88bd26c30ba99c7fe341e",
+            "addressScheme": "mmp-cmb-merkle-v2",
+            "assertionId": "asrt-dff1bf3d7fe9a7a446aab9759db2b7ea5fe6e415270b2f62ae0e22ecb456d24b",
+            "signatureSuite": "mmp-sig-v2.0",
+            "createdByNodeId": "018f47a0-7b21-7abc-8def-0123456789ab",
+            "createdBy": "zoë",
+            "createdTimestamp": 1786611600000,
+            "room": "conformance-room",
+            "to": null,
+            "lineage": {
+              "parents": [
+                "cmb-0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a",
+                "cmb-f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0"
+              ]
+            },
+            "application": null,
+            "sigAlg": "ed25519",
+            "sig": "we3Ny_mwTSVDw4Tqg2qRc0ILxuAcHQK9JOghYZ76QEutab0C-E07IftV0c93W0CJygb9JoJzU7rWHnHWfEP6Bg"
+          }
+        },
+        "projectionSha256": "fd5ad38910d0800877fa8020833cd54f7839edf5f5346adc8248e6163f59d40d"
+      }
+    },
+    {
+      "label": "an unrecognised category is dropped",
+      "record": {
+        "categories": {
+          "focus": {
+            "text": "review the café menu",
+            "meta": {
+              "key": "d2ee95788fc6f697ee3997158c4c189432dc15835aa2efa2c8a57f030f1ceb86",
+              "parents": []
+            }
+          },
+          "issue": {
+            "text": "the public vectors and runtime disagree",
+            "meta": {
+              "key": "8f37da919d4165770650b6508b66af65f0710157209b10724e7cc4aab717da83",
+              "parents": [
+                "cmb-0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a",
+                "cmb-f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0"
+              ]
+            }
+          },
+          "intent": {
+            "text": "make independent implementations interoperate",
+            "meta": {
+              "key": "f47998bfc4aedee3ac20c485f9cd07caacccf622ceced426c02e178741718f67",
+              "parents": []
+            }
+          },
+          "motivation": {
+            "text": "a protocol claim must be executable",
+            "meta": {
+              "key": "9dfa469fab3eeb8c98f79df69c3b2f02f277a017f9cbe3bf0f32ccbf9a4f129d",
+              "parents": []
+            }
+          },
+          "commitment": {
+            "text": "one contract drives every implementation",
+            "meta": {
+              "key": "d3bbf94949feceaea72667efe8c43a4bf3aed557ecc632caf82b7c3f2447e3c8",
+              "parents": []
+            }
+          },
+          "perspective": {
+            "text": "protocol editor",
+            "meta": {
+              "key": "3e48fe2e89a1e02f5c17c08e853bd09d5355d18a491a1bd926568089626ffa35",
+              "parents": []
+            }
+          },
+          "mood": {
+            "text": "calm",
+            "meta": {
+              "key": "d816b3859d6849569138dba79c0f1c82b7ce827a74ae63072d04f6f8a96a0e8f",
+              "parents": []
+            },
+            "valence": 0.2,
+            "arousal": -0.1
+          },
+          "x-vendor-note": {
+            "text": "not a CAT7 category"
+          }
+        },
+        "metadata": {
+          "key": "cmb-15087b3c3a0a6b79971af8f56ebeccafbe4e5f71e4f88bd26c30ba99c7fe341e",
+          "addressScheme": "mmp-cmb-merkle-v2",
+          "signatureSuite": "mmp-sig-v2.0",
+          "createdByNodeId": "018f47a0-7b21-7abc-8def-0123456789ab",
+          "createdBy": "zoë",
+          "createdTimestamp": 1786611600000,
+          "room": "conformance-room",
+          "to": null,
+          "lineage": {
+            "parents": [
+              "cmb-0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a",
+              "cmb-f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0"
+            ],
+            "method": "SVAF-v2"
+          },
+          "application": null,
+          "assertionId": "asrt-dff1bf3d7fe9a7a446aab9759db2b7ea5fe6e415270b2f62ae0e22ecb456d24b",
+          "sigAlg": "ed25519",
+          "sig": "we3Ny_mwTSVDw4Tqg2qRc0ILxuAcHQK9JOghYZ76QEutab0C-E07IftV0c93W0CJygb9JoJzU7rWHnHWfEP6Bg"
+        }
+      },
+      "expected": {
+        "accepted": true,
+        "projection": {
+          "categories": {
+            "focus": {
+              "text": "review the café menu",
+              "meta": {
+                "key": "d2ee95788fc6f697ee3997158c4c189432dc15835aa2efa2c8a57f030f1ceb86",
+                "parents": []
+              }
+            },
+            "issue": {
+              "text": "the public vectors and runtime disagree",
+              "meta": {
+                "key": "8f37da919d4165770650b6508b66af65f0710157209b10724e7cc4aab717da83",
+                "parents": [
+                  "cmb-0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a",
+                  "cmb-f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0"
+                ]
+              }
+            },
+            "intent": {
+              "text": "make independent implementations interoperate",
+              "meta": {
+                "key": "f47998bfc4aedee3ac20c485f9cd07caacccf622ceced426c02e178741718f67",
+                "parents": []
+              }
+            },
+            "motivation": {
+              "text": "a protocol claim must be executable",
+              "meta": {
+                "key": "9dfa469fab3eeb8c98f79df69c3b2f02f277a017f9cbe3bf0f32ccbf9a4f129d",
+                "parents": []
+              }
+            },
+            "commitment": {
+              "text": "one contract drives every implementation",
+              "meta": {
+                "key": "d3bbf94949feceaea72667efe8c43a4bf3aed557ecc632caf82b7c3f2447e3c8",
+                "parents": []
+              }
+            },
+            "perspective": {
+              "text": "protocol editor",
+              "meta": {
+                "key": "3e48fe2e89a1e02f5c17c08e853bd09d5355d18a491a1bd926568089626ffa35",
+                "parents": []
+              }
+            },
+            "mood": {
+              "text": "calm",
+              "meta": {
+                "key": "d816b3859d6849569138dba79c0f1c82b7ce827a74ae63072d04f6f8a96a0e8f",
+                "parents": []
+              }
+            }
+          },
+          "metadata": {
+            "key": "cmb-15087b3c3a0a6b79971af8f56ebeccafbe4e5f71e4f88bd26c30ba99c7fe341e",
+            "addressScheme": "mmp-cmb-merkle-v2",
+            "assertionId": "asrt-dff1bf3d7fe9a7a446aab9759db2b7ea5fe6e415270b2f62ae0e22ecb456d24b",
+            "signatureSuite": "mmp-sig-v2.0",
+            "createdByNodeId": "018f47a0-7b21-7abc-8def-0123456789ab",
+            "createdBy": "zoë",
+            "createdTimestamp": 1786611600000,
+            "room": "conformance-room",
+            "to": null,
+            "lineage": {
+              "parents": [
+                "cmb-0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a",
+                "cmb-f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0"
+              ]
+            },
+            "application": null,
+            "sigAlg": "ed25519",
+            "sig": "we3Ny_mwTSVDw4Tqg2qRc0ILxuAcHQK9JOghYZ76QEutab0C-E07IftV0c93W0CJygb9JoJzU7rWHnHWfEP6Bg"
+          }
+        },
+        "projectionSha256": "fd5ad38910d0800877fa8020833cd54f7839edf5f5346adc8248e6163f59d40d"
+      }
+    },
+    {
+      "label": "lineage.parents and meta.parents in another order: the same projection",
+      "record": {
+        "categories": {
+          "focus": {
+            "text": "review the café menu",
+            "meta": {
+              "key": "d2ee95788fc6f697ee3997158c4c189432dc15835aa2efa2c8a57f030f1ceb86",
+              "parents": []
+            }
+          },
+          "issue": {
+            "text": "the public vectors and runtime disagree",
+            "meta": {
+              "key": "8f37da919d4165770650b6508b66af65f0710157209b10724e7cc4aab717da83",
+              "parents": [
+                "cmb-f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0",
+                "cmb-0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a"
+              ]
+            }
+          },
+          "intent": {
+            "text": "make independent implementations interoperate",
+            "meta": {
+              "key": "f47998bfc4aedee3ac20c485f9cd07caacccf622ceced426c02e178741718f67",
+              "parents": []
+            }
+          },
+          "motivation": {
+            "text": "a protocol claim must be executable",
+            "meta": {
+              "key": "9dfa469fab3eeb8c98f79df69c3b2f02f277a017f9cbe3bf0f32ccbf9a4f129d",
+              "parents": []
+            }
+          },
+          "commitment": {
+            "text": "one contract drives every implementation",
+            "meta": {
+              "key": "d3bbf94949feceaea72667efe8c43a4bf3aed557ecc632caf82b7c3f2447e3c8",
+              "parents": []
+            }
+          },
+          "perspective": {
+            "text": "protocol editor",
+            "meta": {
+              "key": "3e48fe2e89a1e02f5c17c08e853bd09d5355d18a491a1bd926568089626ffa35",
+              "parents": []
+            }
+          },
+          "mood": {
+            "text": "calm",
+            "meta": {
+              "key": "d816b3859d6849569138dba79c0f1c82b7ce827a74ae63072d04f6f8a96a0e8f",
+              "parents": []
+            },
+            "valence": 0.2,
+            "arousal": -0.1
+          }
+        },
+        "metadata": {
+          "key": "cmb-15087b3c3a0a6b79971af8f56ebeccafbe4e5f71e4f88bd26c30ba99c7fe341e",
+          "addressScheme": "mmp-cmb-merkle-v2",
+          "signatureSuite": "mmp-sig-v2.0",
+          "createdByNodeId": "018f47a0-7b21-7abc-8def-0123456789ab",
+          "createdBy": "zoë",
+          "createdTimestamp": 1786611600000,
+          "room": "conformance-room",
+          "to": null,
+          "lineage": {
+            "parents": [
+              "cmb-f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0",
+              "cmb-0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a"
+            ],
+            "method": "SVAF-v2"
+          },
+          "application": null,
+          "assertionId": "asrt-dff1bf3d7fe9a7a446aab9759db2b7ea5fe6e415270b2f62ae0e22ecb456d24b",
+          "sigAlg": "ed25519",
+          "sig": "we3Ny_mwTSVDw4Tqg2qRc0ILxuAcHQK9JOghYZ76QEutab0C-E07IftV0c93W0CJygb9JoJzU7rWHnHWfEP6Bg"
+        }
+      },
+      "expected": {
+        "accepted": true,
+        "projection": {
+          "categories": {
+            "focus": {
+              "text": "review the café menu",
+              "meta": {
+                "key": "d2ee95788fc6f697ee3997158c4c189432dc15835aa2efa2c8a57f030f1ceb86",
+                "parents": []
+              }
+            },
+            "issue": {
+              "text": "the public vectors and runtime disagree",
+              "meta": {
+                "key": "8f37da919d4165770650b6508b66af65f0710157209b10724e7cc4aab717da83",
+                "parents": [
+                  "cmb-0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a",
+                  "cmb-f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0"
+                ]
+              }
+            },
+            "intent": {
+              "text": "make independent implementations interoperate",
+              "meta": {
+                "key": "f47998bfc4aedee3ac20c485f9cd07caacccf622ceced426c02e178741718f67",
+                "parents": []
+              }
+            },
+            "motivation": {
+              "text": "a protocol claim must be executable",
+              "meta": {
+                "key": "9dfa469fab3eeb8c98f79df69c3b2f02f277a017f9cbe3bf0f32ccbf9a4f129d",
+                "parents": []
+              }
+            },
+            "commitment": {
+              "text": "one contract drives every implementation",
+              "meta": {
+                "key": "d3bbf94949feceaea72667efe8c43a4bf3aed557ecc632caf82b7c3f2447e3c8",
+                "parents": []
+              }
+            },
+            "perspective": {
+              "text": "protocol editor",
+              "meta": {
+                "key": "3e48fe2e89a1e02f5c17c08e853bd09d5355d18a491a1bd926568089626ffa35",
+                "parents": []
+              }
+            },
+            "mood": {
+              "text": "calm",
+              "meta": {
+                "key": "d816b3859d6849569138dba79c0f1c82b7ce827a74ae63072d04f6f8a96a0e8f",
+                "parents": []
+              }
+            }
+          },
+          "metadata": {
+            "key": "cmb-15087b3c3a0a6b79971af8f56ebeccafbe4e5f71e4f88bd26c30ba99c7fe341e",
+            "addressScheme": "mmp-cmb-merkle-v2",
+            "assertionId": "asrt-dff1bf3d7fe9a7a446aab9759db2b7ea5fe6e415270b2f62ae0e22ecb456d24b",
+            "signatureSuite": "mmp-sig-v2.0",
+            "createdByNodeId": "018f47a0-7b21-7abc-8def-0123456789ab",
+            "createdBy": "zoë",
+            "createdTimestamp": 1786611600000,
+            "room": "conformance-room",
+            "to": null,
+            "lineage": {
+              "parents": [
+                "cmb-0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a",
+                "cmb-f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0"
+              ]
+            },
+            "application": null,
+            "sigAlg": "ed25519",
+            "sig": "we3Ny_mwTSVDw4Tqg2qRc0ILxuAcHQK9JOghYZ76QEutab0C-E07IftV0c93W0CJygb9JoJzU7rWHnHWfEP6Bg"
+          }
+        },
+        "projectionSha256": "fd5ad38910d0800877fa8020833cd54f7839edf5f5346adc8248e6163f59d40d"
+      }
+    },
+    {
+      "label": "lineage with no parents is null",
+      "record": {
+        "categories": {
+          "focus": {
+            "text": "review the café menu",
+            "meta": {
+              "key": "d2ee95788fc6f697ee3997158c4c189432dc15835aa2efa2c8a57f030f1ceb86",
+              "parents": []
+            }
+          },
+          "issue": {
+            "text": "the public vectors and runtime disagree",
+            "meta": {
+              "key": "8f37da919d4165770650b6508b66af65f0710157209b10724e7cc4aab717da83",
+              "parents": []
+            }
+          },
+          "intent": {
+            "text": "make independent implementations interoperate",
+            "meta": {
+              "key": "f47998bfc4aedee3ac20c485f9cd07caacccf622ceced426c02e178741718f67",
+              "parents": []
+            }
+          },
+          "motivation": {
+            "text": "a protocol claim must be executable",
+            "meta": {
+              "key": "9dfa469fab3eeb8c98f79df69c3b2f02f277a017f9cbe3bf0f32ccbf9a4f129d",
+              "parents": []
+            }
+          },
+          "commitment": {
+            "text": "one contract drives every implementation",
+            "meta": {
+              "key": "d3bbf94949feceaea72667efe8c43a4bf3aed557ecc632caf82b7c3f2447e3c8",
+              "parents": []
+            }
+          },
+          "perspective": {
+            "text": "protocol editor",
+            "meta": {
+              "key": "3e48fe2e89a1e02f5c17c08e853bd09d5355d18a491a1bd926568089626ffa35",
+              "parents": []
+            }
+          },
+          "mood": {
+            "text": "calm",
+            "meta": {
+              "key": "d816b3859d6849569138dba79c0f1c82b7ce827a74ae63072d04f6f8a96a0e8f",
+              "parents": []
+            }
+          }
+        },
+        "metadata": {
+          "key": "cmb-15087b3c3a0a6b79971af8f56ebeccafbe4e5f71e4f88bd26c30ba99c7fe341e",
+          "addressScheme": "mmp-cmb-merkle-v2",
+          "signatureSuite": "mmp-sig-v2.0",
+          "createdByNodeId": "018f47a0-7b21-7abc-8def-0123456789ab",
+          "createdBy": "zoë",
+          "createdTimestamp": 1786611600000,
+          "room": "conformance-room",
+          "to": null,
+          "lineage": {
+            "parents": []
+          },
+          "application": null,
+          "assertionId": "asrt-12341a2f369977ec7b451302582f92786d2f06e2852a088d97532af3b4776f28",
+          "sigAlg": "ed25519",
+          "sig": "MrUpmGPwXflWtKD_2b9xhrgmMPB7O46cvq28aUt8HaQxP1hSKgq8utUK1ZR4DIue-j0X5BkIoiWrCId5w0BWCA"
+        }
+      },
+      "expected": {
+        "accepted": true,
+        "projection": {
+          "categories": {
+            "focus": {
+              "text": "review the café menu",
+              "meta": {
+                "key": "d2ee95788fc6f697ee3997158c4c189432dc15835aa2efa2c8a57f030f1ceb86",
+                "parents": []
+              }
+            },
+            "issue": {
+              "text": "the public vectors and runtime disagree",
+              "meta": {
+                "key": "8f37da919d4165770650b6508b66af65f0710157209b10724e7cc4aab717da83",
+                "parents": []
+              }
+            },
+            "intent": {
+              "text": "make independent implementations interoperate",
+              "meta": {
+                "key": "f47998bfc4aedee3ac20c485f9cd07caacccf622ceced426c02e178741718f67",
+                "parents": []
+              }
+            },
+            "motivation": {
+              "text": "a protocol claim must be executable",
+              "meta": {
+                "key": "9dfa469fab3eeb8c98f79df69c3b2f02f277a017f9cbe3bf0f32ccbf9a4f129d",
+                "parents": []
+              }
+            },
+            "commitment": {
+              "text": "one contract drives every implementation",
+              "meta": {
+                "key": "d3bbf94949feceaea72667efe8c43a4bf3aed557ecc632caf82b7c3f2447e3c8",
+                "parents": []
+              }
+            },
+            "perspective": {
+              "text": "protocol editor",
+              "meta": {
+                "key": "3e48fe2e89a1e02f5c17c08e853bd09d5355d18a491a1bd926568089626ffa35",
+                "parents": []
+              }
+            },
+            "mood": {
+              "text": "calm",
+              "meta": {
+                "key": "d816b3859d6849569138dba79c0f1c82b7ce827a74ae63072d04f6f8a96a0e8f",
+                "parents": []
+              }
+            }
+          },
+          "metadata": {
+            "key": "cmb-15087b3c3a0a6b79971af8f56ebeccafbe4e5f71e4f88bd26c30ba99c7fe341e",
+            "addressScheme": "mmp-cmb-merkle-v2",
+            "assertionId": "asrt-12341a2f369977ec7b451302582f92786d2f06e2852a088d97532af3b4776f28",
+            "signatureSuite": "mmp-sig-v2.0",
+            "createdByNodeId": "018f47a0-7b21-7abc-8def-0123456789ab",
+            "createdBy": "zoë",
+            "createdTimestamp": 1786611600000,
+            "room": "conformance-room",
+            "to": null,
+            "lineage": null,
+            "application": null,
+            "sigAlg": "ed25519",
+            "sig": "MrUpmGPwXflWtKD_2b9xhrgmMPB7O46cvq28aUt8HaQxP1hSKgq8utUK1ZR4DIue-j0X5BkIoiWrCId5w0BWCA"
+          }
+        },
+        "projectionSha256": "a3ca03c35c9951c0156ce6a596286188a8adbb0648e5c23ada76ea379a739063"
+      }
+    },
+    {
+      "label": "lineage null: the same projection as no parents",
+      "record": {
+        "categories": {
+          "focus": {
+            "text": "review the café menu",
+            "meta": {
+              "key": "d2ee95788fc6f697ee3997158c4c189432dc15835aa2efa2c8a57f030f1ceb86",
+              "parents": []
+            }
+          },
+          "issue": {
+            "text": "the public vectors and runtime disagree",
+            "meta": {
+              "key": "8f37da919d4165770650b6508b66af65f0710157209b10724e7cc4aab717da83",
+              "parents": []
+            }
+          },
+          "intent": {
+            "text": "make independent implementations interoperate",
+            "meta": {
+              "key": "f47998bfc4aedee3ac20c485f9cd07caacccf622ceced426c02e178741718f67",
+              "parents": []
+            }
+          },
+          "motivation": {
+            "text": "a protocol claim must be executable",
+            "meta": {
+              "key": "9dfa469fab3eeb8c98f79df69c3b2f02f277a017f9cbe3bf0f32ccbf9a4f129d",
+              "parents": []
+            }
+          },
+          "commitment": {
+            "text": "one contract drives every implementation",
+            "meta": {
+              "key": "d3bbf94949feceaea72667efe8c43a4bf3aed557ecc632caf82b7c3f2447e3c8",
+              "parents": []
+            }
+          },
+          "perspective": {
+            "text": "protocol editor",
+            "meta": {
+              "key": "3e48fe2e89a1e02f5c17c08e853bd09d5355d18a491a1bd926568089626ffa35",
+              "parents": []
+            }
+          },
+          "mood": {
+            "text": "calm",
+            "meta": {
+              "key": "d816b3859d6849569138dba79c0f1c82b7ce827a74ae63072d04f6f8a96a0e8f",
+              "parents": []
+            }
+          }
+        },
+        "metadata": {
+          "key": "cmb-15087b3c3a0a6b79971af8f56ebeccafbe4e5f71e4f88bd26c30ba99c7fe341e",
+          "addressScheme": "mmp-cmb-merkle-v2",
+          "signatureSuite": "mmp-sig-v2.0",
+          "createdByNodeId": "018f47a0-7b21-7abc-8def-0123456789ab",
+          "createdBy": "zoë",
+          "createdTimestamp": 1786611600000,
+          "room": "conformance-room",
+          "to": null,
+          "lineage": null,
+          "application": null,
+          "assertionId": "asrt-12341a2f369977ec7b451302582f92786d2f06e2852a088d97532af3b4776f28",
+          "sigAlg": "ed25519",
+          "sig": "MrUpmGPwXflWtKD_2b9xhrgmMPB7O46cvq28aUt8HaQxP1hSKgq8utUK1ZR4DIue-j0X5BkIoiWrCId5w0BWCA"
+        }
+      },
+      "expected": {
+        "accepted": true,
+        "projection": {
+          "categories": {
+            "focus": {
+              "text": "review the café menu",
+              "meta": {
+                "key": "d2ee95788fc6f697ee3997158c4c189432dc15835aa2efa2c8a57f030f1ceb86",
+                "parents": []
+              }
+            },
+            "issue": {
+              "text": "the public vectors and runtime disagree",
+              "meta": {
+                "key": "8f37da919d4165770650b6508b66af65f0710157209b10724e7cc4aab717da83",
+                "parents": []
+              }
+            },
+            "intent": {
+              "text": "make independent implementations interoperate",
+              "meta": {
+                "key": "f47998bfc4aedee3ac20c485f9cd07caacccf622ceced426c02e178741718f67",
+                "parents": []
+              }
+            },
+            "motivation": {
+              "text": "a protocol claim must be executable",
+              "meta": {
+                "key": "9dfa469fab3eeb8c98f79df69c3b2f02f277a017f9cbe3bf0f32ccbf9a4f129d",
+                "parents": []
+              }
+            },
+            "commitment": {
+              "text": "one contract drives every implementation",
+              "meta": {
+                "key": "d3bbf94949feceaea72667efe8c43a4bf3aed557ecc632caf82b7c3f2447e3c8",
+                "parents": []
+              }
+            },
+            "perspective": {
+              "text": "protocol editor",
+              "meta": {
+                "key": "3e48fe2e89a1e02f5c17c08e853bd09d5355d18a491a1bd926568089626ffa35",
+                "parents": []
+              }
+            },
+            "mood": {
+              "text": "calm",
+              "meta": {
+                "key": "d816b3859d6849569138dba79c0f1c82b7ce827a74ae63072d04f6f8a96a0e8f",
+                "parents": []
+              }
+            }
+          },
+          "metadata": {
+            "key": "cmb-15087b3c3a0a6b79971af8f56ebeccafbe4e5f71e4f88bd26c30ba99c7fe341e",
+            "addressScheme": "mmp-cmb-merkle-v2",
+            "assertionId": "asrt-12341a2f369977ec7b451302582f92786d2f06e2852a088d97532af3b4776f28",
+            "signatureSuite": "mmp-sig-v2.0",
+            "createdByNodeId": "018f47a0-7b21-7abc-8def-0123456789ab",
+            "createdBy": "zoë",
+            "createdTimestamp": 1786611600000,
+            "room": "conformance-room",
+            "to": null,
+            "lineage": null,
+            "application": null,
+            "sigAlg": "ed25519",
+            "sig": "MrUpmGPwXflWtKD_2b9xhrgmMPB7O46cvq28aUt8HaQxP1hSKgq8utUK1ZR4DIue-j0X5BkIoiWrCId5w0BWCA"
+          }
+        },
+        "projectionSha256": "a3ca03c35c9951c0156ce6a596286188a8adbb0648e5c23ada76ea379a739063"
+      }
+    },
+    {
+      "label": "an absent application is null",
+      "record": {
+        "categories": {
+          "focus": {
+            "text": "review the café menu",
+            "meta": {
+              "key": "d2ee95788fc6f697ee3997158c4c189432dc15835aa2efa2c8a57f030f1ceb86",
+              "parents": []
+            }
+          },
+          "issue": {
+            "text": "the public vectors and runtime disagree",
+            "meta": {
+              "key": "8f37da919d4165770650b6508b66af65f0710157209b10724e7cc4aab717da83",
+              "parents": [
+                "cmb-0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a",
+                "cmb-f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0"
+              ]
+            }
+          },
+          "intent": {
+            "text": "make independent implementations interoperate",
+            "meta": {
+              "key": "f47998bfc4aedee3ac20c485f9cd07caacccf622ceced426c02e178741718f67",
+              "parents": []
+            }
+          },
+          "motivation": {
+            "text": "a protocol claim must be executable",
+            "meta": {
+              "key": "9dfa469fab3eeb8c98f79df69c3b2f02f277a017f9cbe3bf0f32ccbf9a4f129d",
+              "parents": []
+            }
+          },
+          "commitment": {
+            "text": "one contract drives every implementation",
+            "meta": {
+              "key": "d3bbf94949feceaea72667efe8c43a4bf3aed557ecc632caf82b7c3f2447e3c8",
+              "parents": []
+            }
+          },
+          "perspective": {
+            "text": "protocol editor",
+            "meta": {
+              "key": "3e48fe2e89a1e02f5c17c08e853bd09d5355d18a491a1bd926568089626ffa35",
+              "parents": []
+            }
+          },
+          "mood": {
+            "text": "calm",
+            "meta": {
+              "key": "d816b3859d6849569138dba79c0f1c82b7ce827a74ae63072d04f6f8a96a0e8f",
+              "parents": []
+            },
+            "valence": 0.2,
+            "arousal": -0.1
+          }
+        },
+        "metadata": {
+          "key": "cmb-15087b3c3a0a6b79971af8f56ebeccafbe4e5f71e4f88bd26c30ba99c7fe341e",
+          "addressScheme": "mmp-cmb-merkle-v2",
+          "signatureSuite": "mmp-sig-v2.0",
+          "createdByNodeId": "018f47a0-7b21-7abc-8def-0123456789ab",
+          "createdBy": "zoë",
+          "createdTimestamp": 1786611600000,
+          "room": "conformance-room",
+          "to": null,
+          "lineage": {
+            "parents": [
+              "cmb-0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a",
+              "cmb-f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0"
+            ],
+            "method": "SVAF-v2"
+          },
+          "assertionId": "asrt-dff1bf3d7fe9a7a446aab9759db2b7ea5fe6e415270b2f62ae0e22ecb456d24b",
+          "sigAlg": "ed25519",
+          "sig": "we3Ny_mwTSVDw4Tqg2qRc0ILxuAcHQK9JOghYZ76QEutab0C-E07IftV0c93W0CJygb9JoJzU7rWHnHWfEP6Bg"
+        }
+      },
+      "expected": {
+        "accepted": true,
+        "projection": {
+          "categories": {
+            "focus": {
+              "text": "review the café menu",
+              "meta": {
+                "key": "d2ee95788fc6f697ee3997158c4c189432dc15835aa2efa2c8a57f030f1ceb86",
+                "parents": []
+              }
+            },
+            "issue": {
+              "text": "the public vectors and runtime disagree",
+              "meta": {
+                "key": "8f37da919d4165770650b6508b66af65f0710157209b10724e7cc4aab717da83",
+                "parents": [
+                  "cmb-0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a",
+                  "cmb-f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0"
+                ]
+              }
+            },
+            "intent": {
+              "text": "make independent implementations interoperate",
+              "meta": {
+                "key": "f47998bfc4aedee3ac20c485f9cd07caacccf622ceced426c02e178741718f67",
+                "parents": []
+              }
+            },
+            "motivation": {
+              "text": "a protocol claim must be executable",
+              "meta": {
+                "key": "9dfa469fab3eeb8c98f79df69c3b2f02f277a017f9cbe3bf0f32ccbf9a4f129d",
+                "parents": []
+              }
+            },
+            "commitment": {
+              "text": "one contract drives every implementation",
+              "meta": {
+                "key": "d3bbf94949feceaea72667efe8c43a4bf3aed557ecc632caf82b7c3f2447e3c8",
+                "parents": []
+              }
+            },
+            "perspective": {
+              "text": "protocol editor",
+              "meta": {
+                "key": "3e48fe2e89a1e02f5c17c08e853bd09d5355d18a491a1bd926568089626ffa35",
+                "parents": []
+              }
+            },
+            "mood": {
+              "text": "calm",
+              "meta": {
+                "key": "d816b3859d6849569138dba79c0f1c82b7ce827a74ae63072d04f6f8a96a0e8f",
+                "parents": []
+              }
+            }
+          },
+          "metadata": {
+            "key": "cmb-15087b3c3a0a6b79971af8f56ebeccafbe4e5f71e4f88bd26c30ba99c7fe341e",
+            "addressScheme": "mmp-cmb-merkle-v2",
+            "assertionId": "asrt-dff1bf3d7fe9a7a446aab9759db2b7ea5fe6e415270b2f62ae0e22ecb456d24b",
+            "signatureSuite": "mmp-sig-v2.0",
+            "createdByNodeId": "018f47a0-7b21-7abc-8def-0123456789ab",
+            "createdBy": "zoë",
+            "createdTimestamp": 1786611600000,
+            "room": "conformance-room",
+            "to": null,
+            "lineage": {
+              "parents": [
+                "cmb-0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a",
+                "cmb-f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0"
+              ]
+            },
+            "application": null,
+            "sigAlg": "ed25519",
+            "sig": "we3Ny_mwTSVDw4Tqg2qRc0ILxuAcHQK9JOghYZ76QEutab0C-E07IftV0c93W0CJygb9JoJzU7rWHnHWfEP6Bg"
+          }
+        },
+        "projectionSha256": "fd5ad38910d0800877fa8020833cd54f7839edf5f5346adc8248e6163f59d40d"
+      }
+    },
+    {
+      "label": "a rewritten meta.key",
+      "record": {
+        "categories": {
+          "focus": {
+            "text": "review the café menu",
+            "meta": {
+              "key": "0000000000000000000000000000000000000000000000000000000000000000",
+              "parents": []
+            }
+          },
+          "issue": {
+            "text": "the public vectors and runtime disagree",
+            "meta": {
+              "key": "8f37da919d4165770650b6508b66af65f0710157209b10724e7cc4aab717da83",
+              "parents": [
+                "cmb-0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a",
+                "cmb-f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0"
+              ]
+            }
+          },
+          "intent": {
+            "text": "make independent implementations interoperate",
+            "meta": {
+              "key": "f47998bfc4aedee3ac20c485f9cd07caacccf622ceced426c02e178741718f67",
+              "parents": []
+            }
+          },
+          "motivation": {
+            "text": "a protocol claim must be executable",
+            "meta": {
+              "key": "9dfa469fab3eeb8c98f79df69c3b2f02f277a017f9cbe3bf0f32ccbf9a4f129d",
+              "parents": []
+            }
+          },
+          "commitment": {
+            "text": "one contract drives every implementation",
+            "meta": {
+              "key": "d3bbf94949feceaea72667efe8c43a4bf3aed557ecc632caf82b7c3f2447e3c8",
+              "parents": []
+            }
+          },
+          "perspective": {
+            "text": "protocol editor",
+            "meta": {
+              "key": "3e48fe2e89a1e02f5c17c08e853bd09d5355d18a491a1bd926568089626ffa35",
+              "parents": []
+            }
+          },
+          "mood": {
+            "text": "calm",
+            "meta": {
+              "key": "d816b3859d6849569138dba79c0f1c82b7ce827a74ae63072d04f6f8a96a0e8f",
+              "parents": []
+            },
+            "valence": 0.2,
+            "arousal": -0.1
+          }
+        },
+        "metadata": {
+          "key": "cmb-15087b3c3a0a6b79971af8f56ebeccafbe4e5f71e4f88bd26c30ba99c7fe341e",
+          "addressScheme": "mmp-cmb-merkle-v2",
+          "signatureSuite": "mmp-sig-v2.0",
+          "createdByNodeId": "018f47a0-7b21-7abc-8def-0123456789ab",
+          "createdBy": "zoë",
+          "createdTimestamp": 1786611600000,
+          "room": "conformance-room",
+          "to": null,
+          "lineage": {
+            "parents": [
+              "cmb-0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a",
+              "cmb-f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0"
+            ],
+            "method": "SVAF-v2"
+          },
+          "application": null,
+          "assertionId": "asrt-dff1bf3d7fe9a7a446aab9759db2b7ea5fe6e415270b2f62ae0e22ecb456d24b",
+          "sigAlg": "ed25519",
+          "sig": "we3Ny_mwTSVDw4Tqg2qRc0ILxuAcHQK9JOghYZ76QEutab0C-E07IftV0c93W0CJygb9JoJzU7rWHnHWfEP6Bg"
+        }
+      },
+      "expected": {
+        "accepted": false,
+        "refusedBy": "step 4: meta.key"
+      }
+    },
+    {
+      "label": "category text in NFD, though it signs the same",
+      "record": {
+        "categories": {
+          "focus": {
+            "text": "review the café menu",
+            "meta": {
+              "key": "d2ee95788fc6f697ee3997158c4c189432dc15835aa2efa2c8a57f030f1ceb86",
+              "parents": []
+            }
+          },
+          "issue": {
+            "text": "the public vectors and runtime disagree",
+            "meta": {
+              "key": "8f37da919d4165770650b6508b66af65f0710157209b10724e7cc4aab717da83",
+              "parents": [
+                "cmb-0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a",
+                "cmb-f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0"
+              ]
+            }
+          },
+          "intent": {
+            "text": "make independent implementations interoperate",
+            "meta": {
+              "key": "f47998bfc4aedee3ac20c485f9cd07caacccf622ceced426c02e178741718f67",
+              "parents": []
+            }
+          },
+          "motivation": {
+            "text": "a protocol claim must be executable",
+            "meta": {
+              "key": "9dfa469fab3eeb8c98f79df69c3b2f02f277a017f9cbe3bf0f32ccbf9a4f129d",
+              "parents": []
+            }
+          },
+          "commitment": {
+            "text": "one contract drives every implementation",
+            "meta": {
+              "key": "d3bbf94949feceaea72667efe8c43a4bf3aed557ecc632caf82b7c3f2447e3c8",
+              "parents": []
+            }
+          },
+          "perspective": {
+            "text": "protocol editor",
+            "meta": {
+              "key": "3e48fe2e89a1e02f5c17c08e853bd09d5355d18a491a1bd926568089626ffa35",
+              "parents": []
+            }
+          },
+          "mood": {
+            "text": "calm",
+            "meta": {
+              "key": "d816b3859d6849569138dba79c0f1c82b7ce827a74ae63072d04f6f8a96a0e8f",
+              "parents": []
+            },
+            "valence": 0.2,
+            "arousal": -0.1
+          }
+        },
+        "metadata": {
+          "key": "cmb-15087b3c3a0a6b79971af8f56ebeccafbe4e5f71e4f88bd26c30ba99c7fe341e",
+          "addressScheme": "mmp-cmb-merkle-v2",
+          "signatureSuite": "mmp-sig-v2.0",
+          "createdByNodeId": "018f47a0-7b21-7abc-8def-0123456789ab",
+          "createdBy": "zoë",
+          "createdTimestamp": 1786611600000,
+          "room": "conformance-room",
+          "to": null,
+          "lineage": {
+            "parents": [
+              "cmb-0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a",
+              "cmb-f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0"
+            ],
+            "method": "SVAF-v2"
+          },
+          "application": null,
+          "assertionId": "asrt-dff1bf3d7fe9a7a446aab9759db2b7ea5fe6e415270b2f62ae0e22ecb456d24b",
+          "sigAlg": "ed25519",
+          "sig": "we3Ny_mwTSVDw4Tqg2qRc0ILxuAcHQK9JOghYZ76QEutab0C-E07IftV0c93W0CJygb9JoJzU7rWHnHWfEP6Bg"
+        }
+      },
+      "expected": {
+        "accepted": false,
+        "refusedBy": "step 1: not NFC"
+      }
+    },
+    {
+      "label": "createdBy in NFD, though it signs the same",
+      "record": {
+        "categories": {
+          "focus": {
+            "text": "review the café menu",
+            "meta": {
+              "key": "d2ee95788fc6f697ee3997158c4c189432dc15835aa2efa2c8a57f030f1ceb86",
+              "parents": []
+            }
+          },
+          "issue": {
+            "text": "the public vectors and runtime disagree",
+            "meta": {
+              "key": "8f37da919d4165770650b6508b66af65f0710157209b10724e7cc4aab717da83",
+              "parents": [
+                "cmb-0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a",
+                "cmb-f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0"
+              ]
+            }
+          },
+          "intent": {
+            "text": "make independent implementations interoperate",
+            "meta": {
+              "key": "f47998bfc4aedee3ac20c485f9cd07caacccf622ceced426c02e178741718f67",
+              "parents": []
+            }
+          },
+          "motivation": {
+            "text": "a protocol claim must be executable",
+            "meta": {
+              "key": "9dfa469fab3eeb8c98f79df69c3b2f02f277a017f9cbe3bf0f32ccbf9a4f129d",
+              "parents": []
+            }
+          },
+          "commitment": {
+            "text": "one contract drives every implementation",
+            "meta": {
+              "key": "d3bbf94949feceaea72667efe8c43a4bf3aed557ecc632caf82b7c3f2447e3c8",
+              "parents": []
+            }
+          },
+          "perspective": {
+            "text": "protocol editor",
+            "meta": {
+              "key": "3e48fe2e89a1e02f5c17c08e853bd09d5355d18a491a1bd926568089626ffa35",
+              "parents": []
+            }
+          },
+          "mood": {
+            "text": "calm",
+            "meta": {
+              "key": "d816b3859d6849569138dba79c0f1c82b7ce827a74ae63072d04f6f8a96a0e8f",
+              "parents": []
+            },
+            "valence": 0.2,
+            "arousal": -0.1
+          }
+        },
+        "metadata": {
+          "key": "cmb-15087b3c3a0a6b79971af8f56ebeccafbe4e5f71e4f88bd26c30ba99c7fe341e",
+          "addressScheme": "mmp-cmb-merkle-v2",
+          "signatureSuite": "mmp-sig-v2.0",
+          "createdByNodeId": "018f47a0-7b21-7abc-8def-0123456789ab",
+          "createdBy": "zoë",
+          "createdTimestamp": 1786611600000,
+          "room": "conformance-room",
+          "to": null,
+          "lineage": {
+            "parents": [
+              "cmb-0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a",
+              "cmb-f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0"
+            ],
+            "method": "SVAF-v2"
+          },
+          "application": null,
+          "assertionId": "asrt-dff1bf3d7fe9a7a446aab9759db2b7ea5fe6e415270b2f62ae0e22ecb456d24b",
+          "sigAlg": "ed25519",
+          "sig": "we3Ny_mwTSVDw4Tqg2qRc0ILxuAcHQK9JOghYZ76QEutab0C-E07IftV0c93W0CJygb9JoJzU7rWHnHWfEP6Bg"
+        }
+      },
+      "expected": {
+        "accepted": false,
+        "refusedBy": "step 1: not NFC"
+      }
+    },
+    {
+      "label": "an uppercase createdByNodeId",
+      "record": {
+        "categories": {
+          "focus": {
+            "text": "review the café menu",
+            "meta": {
+              "key": "d2ee95788fc6f697ee3997158c4c189432dc15835aa2efa2c8a57f030f1ceb86",
+              "parents": []
+            }
+          },
+          "issue": {
+            "text": "the public vectors and runtime disagree",
+            "meta": {
+              "key": "8f37da919d4165770650b6508b66af65f0710157209b10724e7cc4aab717da83",
+              "parents": [
+                "cmb-0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a",
+                "cmb-f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0"
+              ]
+            }
+          },
+          "intent": {
+            "text": "make independent implementations interoperate",
+            "meta": {
+              "key": "f47998bfc4aedee3ac20c485f9cd07caacccf622ceced426c02e178741718f67",
+              "parents": []
+            }
+          },
+          "motivation": {
+            "text": "a protocol claim must be executable",
+            "meta": {
+              "key": "9dfa469fab3eeb8c98f79df69c3b2f02f277a017f9cbe3bf0f32ccbf9a4f129d",
+              "parents": []
+            }
+          },
+          "commitment": {
+            "text": "one contract drives every implementation",
+            "meta": {
+              "key": "d3bbf94949feceaea72667efe8c43a4bf3aed557ecc632caf82b7c3f2447e3c8",
+              "parents": []
+            }
+          },
+          "perspective": {
+            "text": "protocol editor",
+            "meta": {
+              "key": "3e48fe2e89a1e02f5c17c08e853bd09d5355d18a491a1bd926568089626ffa35",
+              "parents": []
+            }
+          },
+          "mood": {
+            "text": "calm",
+            "meta": {
+              "key": "d816b3859d6849569138dba79c0f1c82b7ce827a74ae63072d04f6f8a96a0e8f",
+              "parents": []
+            },
+            "valence": 0.2,
+            "arousal": -0.1
+          }
+        },
+        "metadata": {
+          "key": "cmb-15087b3c3a0a6b79971af8f56ebeccafbe4e5f71e4f88bd26c30ba99c7fe341e",
+          "addressScheme": "mmp-cmb-merkle-v2",
+          "signatureSuite": "mmp-sig-v2.0",
+          "createdByNodeId": "018F47A0-7B21-7ABC-8DEF-0123456789AB",
+          "createdBy": "zoë",
+          "createdTimestamp": 1786611600000,
+          "room": "conformance-room",
+          "to": null,
+          "lineage": {
+            "parents": [
+              "cmb-0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a",
+              "cmb-f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0"
+            ],
+            "method": "SVAF-v2"
+          },
+          "application": null,
+          "assertionId": "asrt-dff1bf3d7fe9a7a446aab9759db2b7ea5fe6e415270b2f62ae0e22ecb456d24b",
+          "sigAlg": "ed25519",
+          "sig": "we3Ny_mwTSVDw4Tqg2qRc0ILxuAcHQK9JOghYZ76QEutab0C-E07IftV0c93W0CJygb9JoJzU7rWHnHWfEP6Bg"
+        }
+      },
+      "expected": {
+        "accepted": false,
+        "refusedBy": "step 1: record schema"
+      }
+    },
+    {
+      "label": "a timestamp sent as its decimal string",
+      "record": {
+        "categories": {
+          "focus": {
+            "text": "review the café menu",
+            "meta": {
+              "key": "d2ee95788fc6f697ee3997158c4c189432dc15835aa2efa2c8a57f030f1ceb86",
+              "parents": []
+            }
+          },
+          "issue": {
+            "text": "the public vectors and runtime disagree",
+            "meta": {
+              "key": "8f37da919d4165770650b6508b66af65f0710157209b10724e7cc4aab717da83",
+              "parents": [
+                "cmb-0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a",
+                "cmb-f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0"
+              ]
+            }
+          },
+          "intent": {
+            "text": "make independent implementations interoperate",
+            "meta": {
+              "key": "f47998bfc4aedee3ac20c485f9cd07caacccf622ceced426c02e178741718f67",
+              "parents": []
+            }
+          },
+          "motivation": {
+            "text": "a protocol claim must be executable",
+            "meta": {
+              "key": "9dfa469fab3eeb8c98f79df69c3b2f02f277a017f9cbe3bf0f32ccbf9a4f129d",
+              "parents": []
+            }
+          },
+          "commitment": {
+            "text": "one contract drives every implementation",
+            "meta": {
+              "key": "d3bbf94949feceaea72667efe8c43a4bf3aed557ecc632caf82b7c3f2447e3c8",
+              "parents": []
+            }
+          },
+          "perspective": {
+            "text": "protocol editor",
+            "meta": {
+              "key": "3e48fe2e89a1e02f5c17c08e853bd09d5355d18a491a1bd926568089626ffa35",
+              "parents": []
+            }
+          },
+          "mood": {
+            "text": "calm",
+            "meta": {
+              "key": "d816b3859d6849569138dba79c0f1c82b7ce827a74ae63072d04f6f8a96a0e8f",
+              "parents": []
+            },
+            "valence": 0.2,
+            "arousal": -0.1
+          }
+        },
+        "metadata": {
+          "key": "cmb-15087b3c3a0a6b79971af8f56ebeccafbe4e5f71e4f88bd26c30ba99c7fe341e",
+          "addressScheme": "mmp-cmb-merkle-v2",
+          "signatureSuite": "mmp-sig-v2.0",
+          "createdByNodeId": "018f47a0-7b21-7abc-8def-0123456789ab",
+          "createdBy": "zoë",
+          "createdTimestamp": "1786611600000",
+          "room": "conformance-room",
+          "to": null,
+          "lineage": {
+            "parents": [
+              "cmb-0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a",
+              "cmb-f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0"
+            ],
+            "method": "SVAF-v2"
+          },
+          "application": null,
+          "assertionId": "asrt-dff1bf3d7fe9a7a446aab9759db2b7ea5fe6e415270b2f62ae0e22ecb456d24b",
+          "sigAlg": "ed25519",
+          "sig": "we3Ny_mwTSVDw4Tqg2qRc0ILxuAcHQK9JOghYZ76QEutab0C-E07IftV0c93W0CJygb9JoJzU7rWHnHWfEP6Bg"
+        }
+      },
+      "expected": {
+        "accepted": false,
+        "refusedBy": "step 1: record schema"
+      }
+    },
+    {
+      "label": "an embedding vector beside a category",
+      "record": {
+        "categories": {
+          "focus": {
+            "text": "review the café menu",
+            "meta": {
+              "key": "d2ee95788fc6f697ee3997158c4c189432dc15835aa2efa2c8a57f030f1ceb86",
+              "parents": []
+            },
+            "vector": [
+              0.1,
+              0.2,
+              0.3
+            ]
+          },
+          "issue": {
+            "text": "the public vectors and runtime disagree",
+            "meta": {
+              "key": "8f37da919d4165770650b6508b66af65f0710157209b10724e7cc4aab717da83",
+              "parents": [
+                "cmb-0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a",
+                "cmb-f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0"
+              ]
+            }
+          },
+          "intent": {
+            "text": "make independent implementations interoperate",
+            "meta": {
+              "key": "f47998bfc4aedee3ac20c485f9cd07caacccf622ceced426c02e178741718f67",
+              "parents": []
+            }
+          },
+          "motivation": {
+            "text": "a protocol claim must be executable",
+            "meta": {
+              "key": "9dfa469fab3eeb8c98f79df69c3b2f02f277a017f9cbe3bf0f32ccbf9a4f129d",
+              "parents": []
+            }
+          },
+          "commitment": {
+            "text": "one contract drives every implementation",
+            "meta": {
+              "key": "d3bbf94949feceaea72667efe8c43a4bf3aed557ecc632caf82b7c3f2447e3c8",
+              "parents": []
+            }
+          },
+          "perspective": {
+            "text": "protocol editor",
+            "meta": {
+              "key": "3e48fe2e89a1e02f5c17c08e853bd09d5355d18a491a1bd926568089626ffa35",
+              "parents": []
+            }
+          },
+          "mood": {
+            "text": "calm",
+            "meta": {
+              "key": "d816b3859d6849569138dba79c0f1c82b7ce827a74ae63072d04f6f8a96a0e8f",
+              "parents": []
+            },
+            "valence": 0.2,
+            "arousal": -0.1
+          }
+        },
+        "metadata": {
+          "key": "cmb-15087b3c3a0a6b79971af8f56ebeccafbe4e5f71e4f88bd26c30ba99c7fe341e",
+          "addressScheme": "mmp-cmb-merkle-v2",
+          "signatureSuite": "mmp-sig-v2.0",
+          "createdByNodeId": "018f47a0-7b21-7abc-8def-0123456789ab",
+          "createdBy": "zoë",
+          "createdTimestamp": 1786611600000,
+          "room": "conformance-room",
+          "to": null,
+          "lineage": {
+            "parents": [
+              "cmb-0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a",
+              "cmb-f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0"
+            ],
+            "method": "SVAF-v2"
+          },
+          "application": null,
+          "assertionId": "asrt-dff1bf3d7fe9a7a446aab9759db2b7ea5fe6e415270b2f62ae0e22ecb456d24b",
+          "sigAlg": "ed25519",
+          "sig": "we3Ny_mwTSVDw4Tqg2qRc0ILxuAcHQK9JOghYZ76QEutab0C-E07IftV0c93W0CJygb9JoJzU7rWHnHWfEP6Bg"
+        }
+      },
+      "expected": {
+        "accepted": false,
+        "refusedBy": "step 1: record schema"
+      }
+    },
+    {
+      "label": "a member outside categories and metadata",
+      "record": {
+        "categories": {
+          "focus": {
+            "text": "review the café menu",
+            "meta": {
+              "key": "d2ee95788fc6f697ee3997158c4c189432dc15835aa2efa2c8a57f030f1ceb86",
+              "parents": []
+            }
+          },
+          "issue": {
+            "text": "the public vectors and runtime disagree",
+            "meta": {
+              "key": "8f37da919d4165770650b6508b66af65f0710157209b10724e7cc4aab717da83",
+              "parents": [
+                "cmb-0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a",
+                "cmb-f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0"
+              ]
+            }
+          },
+          "intent": {
+            "text": "make independent implementations interoperate",
+            "meta": {
+              "key": "f47998bfc4aedee3ac20c485f9cd07caacccf622ceced426c02e178741718f67",
+              "parents": []
+            }
+          },
+          "motivation": {
+            "text": "a protocol claim must be executable",
+            "meta": {
+              "key": "9dfa469fab3eeb8c98f79df69c3b2f02f277a017f9cbe3bf0f32ccbf9a4f129d",
+              "parents": []
+            }
+          },
+          "commitment": {
+            "text": "one contract drives every implementation",
+            "meta": {
+              "key": "d3bbf94949feceaea72667efe8c43a4bf3aed557ecc632caf82b7c3f2447e3c8",
+              "parents": []
+            }
+          },
+          "perspective": {
+            "text": "protocol editor",
+            "meta": {
+              "key": "3e48fe2e89a1e02f5c17c08e853bd09d5355d18a491a1bd926568089626ffa35",
+              "parents": []
+            }
+          },
+          "mood": {
+            "text": "calm",
+            "meta": {
+              "key": "d816b3859d6849569138dba79c0f1c82b7ce827a74ae63072d04f6f8a96a0e8f",
+              "parents": []
+            },
+            "valence": 0.2,
+            "arousal": -0.1
+          }
+        },
+        "metadata": {
+          "key": "cmb-15087b3c3a0a6b79971af8f56ebeccafbe4e5f71e4f88bd26c30ba99c7fe341e",
+          "addressScheme": "mmp-cmb-merkle-v2",
+          "signatureSuite": "mmp-sig-v2.0",
+          "createdByNodeId": "018f47a0-7b21-7abc-8def-0123456789ab",
+          "createdBy": "zoë",
+          "createdTimestamp": 1786611600000,
+          "room": "conformance-room",
+          "to": null,
+          "lineage": {
+            "parents": [
+              "cmb-0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a",
+              "cmb-f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0"
+            ],
+            "method": "SVAF-v2"
+          },
+          "application": null,
+          "assertionId": "asrt-dff1bf3d7fe9a7a446aab9759db2b7ea5fe6e415270b2f62ae0e22ecb456d24b",
+          "sigAlg": "ed25519",
+          "sig": "we3Ny_mwTSVDw4Tqg2qRc0ILxuAcHQK9JOghYZ76QEutab0C-E07IftV0c93W0CJygb9JoJzU7rWHnHWfEP6Bg"
+        },
+        "payload": {}
+      },
+      "expected": {
+        "accepted": false,
+        "refusedBy": "step 1: record schema"
+      }
+    },
+    {
+      "label": "createdBy over 256 characters",
+      "record": {
+        "categories": {
+          "focus": {
+            "text": "review the café menu",
+            "meta": {
+              "key": "d2ee95788fc6f697ee3997158c4c189432dc15835aa2efa2c8a57f030f1ceb86",
+              "parents": []
+            }
+          },
+          "issue": {
+            "text": "the public vectors and runtime disagree",
+            "meta": {
+              "key": "8f37da919d4165770650b6508b66af65f0710157209b10724e7cc4aab717da83",
+              "parents": [
+                "cmb-0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a",
+                "cmb-f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0"
+              ]
+            }
+          },
+          "intent": {
+            "text": "make independent implementations interoperate",
+            "meta": {
+              "key": "f47998bfc4aedee3ac20c485f9cd07caacccf622ceced426c02e178741718f67",
+              "parents": []
+            }
+          },
+          "motivation": {
+            "text": "a protocol claim must be executable",
+            "meta": {
+              "key": "9dfa469fab3eeb8c98f79df69c3b2f02f277a017f9cbe3bf0f32ccbf9a4f129d",
+              "parents": []
+            }
+          },
+          "commitment": {
+            "text": "one contract drives every implementation",
+            "meta": {
+              "key": "d3bbf94949feceaea72667efe8c43a4bf3aed557ecc632caf82b7c3f2447e3c8",
+              "parents": []
+            }
+          },
+          "perspective": {
+            "text": "protocol editor",
+            "meta": {
+              "key": "3e48fe2e89a1e02f5c17c08e853bd09d5355d18a491a1bd926568089626ffa35",
+              "parents": []
+            }
+          },
+          "mood": {
+            "text": "calm",
+            "meta": {
+              "key": "d816b3859d6849569138dba79c0f1c82b7ce827a74ae63072d04f6f8a96a0e8f",
+              "parents": []
+            },
+            "valence": 0.2,
+            "arousal": -0.1
+          }
+        },
+        "metadata": {
+          "key": "cmb-15087b3c3a0a6b79971af8f56ebeccafbe4e5f71e4f88bd26c30ba99c7fe341e",
+          "addressScheme": "mmp-cmb-merkle-v2",
+          "signatureSuite": "mmp-sig-v2.0",
+          "createdByNodeId": "018f47a0-7b21-7abc-8def-0123456789ab",
+          "createdBy": "zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz",
+          "createdTimestamp": 1786611600000,
+          "room": "conformance-room",
+          "to": null,
+          "lineage": {
+            "parents": [
+              "cmb-0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a",
+              "cmb-f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0"
+            ],
+            "method": "SVAF-v2"
+          },
+          "application": null,
+          "assertionId": "asrt-493b690ad4c7f98fa70e8f436e7e0a3b52c5a79de33f2a8c3d63a8e210ce1f9a",
+          "sigAlg": "ed25519",
+          "sig": "V-QSrQESvu4cUeHtfpezDVFhUZhe7p7wBqHAT8psLcweQ9Pp7-JDW0acaNDHzE-H4nprNao-9FXGohzv-SV6Ag"
+        }
+      },
+      "expected": {
+        "accepted": false,
+        "refusedBy": "step 1: record schema"
+      }
+    },
+    {
+      "label": "257 lineage parents",
+      "record": {
+        "categories": {
+          "focus": {
+            "text": "review the café menu",
+            "meta": {
+              "key": "d2ee95788fc6f697ee3997158c4c189432dc15835aa2efa2c8a57f030f1ceb86",
+              "parents": []
+            }
+          },
+          "issue": {
+            "text": "the public vectors and runtime disagree",
+            "meta": {
+              "key": "8f37da919d4165770650b6508b66af65f0710157209b10724e7cc4aab717da83",
+              "parents": [
+                "cmb-0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a",
+                "cmb-f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0"
+              ]
+            }
+          },
+          "intent": {
+            "text": "make independent implementations interoperate",
+            "meta": {
+              "key": "f47998bfc4aedee3ac20c485f9cd07caacccf622ceced426c02e178741718f67",
+              "parents": []
+            }
+          },
+          "motivation": {
+            "text": "a protocol claim must be executable",
+            "meta": {
+              "key": "9dfa469fab3eeb8c98f79df69c3b2f02f277a017f9cbe3bf0f32ccbf9a4f129d",
+              "parents": []
+            }
+          },
+          "commitment": {
+            "text": "one contract drives every implementation",
+            "meta": {
+              "key": "d3bbf94949feceaea72667efe8c43a4bf3aed557ecc632caf82b7c3f2447e3c8",
+              "parents": []
+            }
+          },
+          "perspective": {
+            "text": "protocol editor",
+            "meta": {
+              "key": "3e48fe2e89a1e02f5c17c08e853bd09d5355d18a491a1bd926568089626ffa35",
+              "parents": []
+            }
+          },
+          "mood": {
+            "text": "calm",
+            "meta": {
+              "key": "d816b3859d6849569138dba79c0f1c82b7ce827a74ae63072d04f6f8a96a0e8f",
+              "parents": []
+            }
+          }
+        },
+        "metadata": {
+          "key": "cmb-15087b3c3a0a6b79971af8f56ebeccafbe4e5f71e4f88bd26c30ba99c7fe341e",
+          "addressScheme": "mmp-cmb-merkle-v2",
+          "signatureSuite": "mmp-sig-v2.0",
+          "createdByNodeId": "018f47a0-7b21-7abc-8def-0123456789ab",
+          "createdBy": "zoë",
+          "createdTimestamp": 1786611600000,
+          "room": "conformance-room",
+          "to": null,
+          "lineage": {
+            "parents": [
+              "cmb-0000000000000000000000000000000000000000000000000000000000000000",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000001",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000002",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000003",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000004",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000005",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000006",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000007",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000008",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000009",
+              "cmb-000000000000000000000000000000000000000000000000000000000000000a",
+              "cmb-000000000000000000000000000000000000000000000000000000000000000b",
+              "cmb-000000000000000000000000000000000000000000000000000000000000000c",
+              "cmb-000000000000000000000000000000000000000000000000000000000000000d",
+              "cmb-000000000000000000000000000000000000000000000000000000000000000e",
+              "cmb-000000000000000000000000000000000000000000000000000000000000000f",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000010",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000011",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000012",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000013",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000014",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000015",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000016",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000017",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000018",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000019",
+              "cmb-000000000000000000000000000000000000000000000000000000000000001a",
+              "cmb-000000000000000000000000000000000000000000000000000000000000001b",
+              "cmb-000000000000000000000000000000000000000000000000000000000000001c",
+              "cmb-000000000000000000000000000000000000000000000000000000000000001d",
+              "cmb-000000000000000000000000000000000000000000000000000000000000001e",
+              "cmb-000000000000000000000000000000000000000000000000000000000000001f",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000020",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000021",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000022",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000023",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000024",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000025",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000026",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000027",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000028",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000029",
+              "cmb-000000000000000000000000000000000000000000000000000000000000002a",
+              "cmb-000000000000000000000000000000000000000000000000000000000000002b",
+              "cmb-000000000000000000000000000000000000000000000000000000000000002c",
+              "cmb-000000000000000000000000000000000000000000000000000000000000002d",
+              "cmb-000000000000000000000000000000000000000000000000000000000000002e",
+              "cmb-000000000000000000000000000000000000000000000000000000000000002f",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000030",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000031",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000032",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000033",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000034",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000035",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000036",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000037",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000038",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000039",
+              "cmb-000000000000000000000000000000000000000000000000000000000000003a",
+              "cmb-000000000000000000000000000000000000000000000000000000000000003b",
+              "cmb-000000000000000000000000000000000000000000000000000000000000003c",
+              "cmb-000000000000000000000000000000000000000000000000000000000000003d",
+              "cmb-000000000000000000000000000000000000000000000000000000000000003e",
+              "cmb-000000000000000000000000000000000000000000000000000000000000003f",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000040",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000041",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000042",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000043",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000044",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000045",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000046",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000047",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000048",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000049",
+              "cmb-000000000000000000000000000000000000000000000000000000000000004a",
+              "cmb-000000000000000000000000000000000000000000000000000000000000004b",
+              "cmb-000000000000000000000000000000000000000000000000000000000000004c",
+              "cmb-000000000000000000000000000000000000000000000000000000000000004d",
+              "cmb-000000000000000000000000000000000000000000000000000000000000004e",
+              "cmb-000000000000000000000000000000000000000000000000000000000000004f",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000050",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000051",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000052",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000053",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000054",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000055",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000056",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000057",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000058",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000059",
+              "cmb-000000000000000000000000000000000000000000000000000000000000005a",
+              "cmb-000000000000000000000000000000000000000000000000000000000000005b",
+              "cmb-000000000000000000000000000000000000000000000000000000000000005c",
+              "cmb-000000000000000000000000000000000000000000000000000000000000005d",
+              "cmb-000000000000000000000000000000000000000000000000000000000000005e",
+              "cmb-000000000000000000000000000000000000000000000000000000000000005f",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000060",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000061",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000062",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000063",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000064",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000065",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000066",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000067",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000068",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000069",
+              "cmb-000000000000000000000000000000000000000000000000000000000000006a",
+              "cmb-000000000000000000000000000000000000000000000000000000000000006b",
+              "cmb-000000000000000000000000000000000000000000000000000000000000006c",
+              "cmb-000000000000000000000000000000000000000000000000000000000000006d",
+              "cmb-000000000000000000000000000000000000000000000000000000000000006e",
+              "cmb-000000000000000000000000000000000000000000000000000000000000006f",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000070",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000071",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000072",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000073",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000074",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000075",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000076",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000077",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000078",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000079",
+              "cmb-000000000000000000000000000000000000000000000000000000000000007a",
+              "cmb-000000000000000000000000000000000000000000000000000000000000007b",
+              "cmb-000000000000000000000000000000000000000000000000000000000000007c",
+              "cmb-000000000000000000000000000000000000000000000000000000000000007d",
+              "cmb-000000000000000000000000000000000000000000000000000000000000007e",
+              "cmb-000000000000000000000000000000000000000000000000000000000000007f",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000080",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000081",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000082",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000083",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000084",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000085",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000086",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000087",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000088",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000089",
+              "cmb-000000000000000000000000000000000000000000000000000000000000008a",
+              "cmb-000000000000000000000000000000000000000000000000000000000000008b",
+              "cmb-000000000000000000000000000000000000000000000000000000000000008c",
+              "cmb-000000000000000000000000000000000000000000000000000000000000008d",
+              "cmb-000000000000000000000000000000000000000000000000000000000000008e",
+              "cmb-000000000000000000000000000000000000000000000000000000000000008f",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000090",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000091",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000092",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000093",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000094",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000095",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000096",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000097",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000098",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000099",
+              "cmb-000000000000000000000000000000000000000000000000000000000000009a",
+              "cmb-000000000000000000000000000000000000000000000000000000000000009b",
+              "cmb-000000000000000000000000000000000000000000000000000000000000009c",
+              "cmb-000000000000000000000000000000000000000000000000000000000000009d",
+              "cmb-000000000000000000000000000000000000000000000000000000000000009e",
+              "cmb-000000000000000000000000000000000000000000000000000000000000009f",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000a0",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000a1",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000a2",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000a3",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000a4",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000a5",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000a6",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000a7",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000a8",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000a9",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000aa",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000ab",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000ac",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000ad",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000ae",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000af",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000b0",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000b1",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000b2",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000b3",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000b4",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000b5",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000b6",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000b7",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000b8",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000b9",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000ba",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000bb",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000bc",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000bd",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000be",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000bf",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000c0",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000c1",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000c2",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000c3",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000c4",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000c5",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000c6",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000c7",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000c8",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000c9",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000ca",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000cb",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000cc",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000cd",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000ce",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000cf",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000d0",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000d1",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000d2",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000d3",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000d4",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000d5",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000d6",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000d7",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000d8",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000d9",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000da",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000db",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000dc",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000dd",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000de",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000df",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000e0",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000e1",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000e2",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000e3",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000e4",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000e5",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000e6",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000e7",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000e8",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000e9",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000ea",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000eb",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000ec",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000ed",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000ee",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000ef",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000f0",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000f1",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000f2",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000f3",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000f4",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000f5",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000f6",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000f7",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000f8",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000f9",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000fa",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000fb",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000fc",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000fd",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000fe",
+              "cmb-00000000000000000000000000000000000000000000000000000000000000ff",
+              "cmb-0000000000000000000000000000000000000000000000000000000000000100"
+            ]
+          },
+          "application": null,
+          "assertionId": "asrt-d3db706c6cbade6102d44bbeb84c613721429b8fbd8efdd6b438fb1e0ea0b6e6",
+          "sigAlg": "ed25519",
+          "sig": "wLa6doUy1Qh3rU2e8ciAHNc23W9otkf1SMtw5gcj-zROARGayG_loAYBWUG4jabFrPgl-3ecp9_9a9iJO2osCw"
+        }
+      },
+      "expected": {
+        "accepted": false,
+        "refusedBy": "step 1: record schema"
+      }
+    }
+  ]
+}
diff --git a/tests/fixtures/record-size-v2.json b/tests/fixtures/record-size-v2.json
new file mode 100644
index 00000000..efe61b11
--- /dev/null
+++ b/tests/fixtures/record-size-v2.json
@@ -0,0 +1,322 @@
+{
+  "protocolVersion": "2.0",
+  "measure": "MAX_CATEGORY_TEXT and MAX_RECORD_TEXT count the UTF-8 bytes of each category text after NFC; MAX_RECORD_BYTES counts the bytes of the RFC 8785 serialization of the two-section record, metadata.application.data included, which equals the UTF-8 length of ECMAScript JSON.stringify of it in any member order (§8.8.6)",
+  "usage": "Expand each case: the base record with each fill category text set to unit repeated count times and, when applicationBytes is given, metadata.application set to { mediaType: \"application/octet-stream\", schema: \"https://meshcognition.org/schema/size-fixture-v1.json\", encoding: \"base64url\", byteLength, digest, data } over that many bytes of 0x61. Measure; compare. Only the size verdict is pinned: an expanded record keeps the base key and signature.",
+  "limits": {
+    "MAX_CATEGORY_TEXT": 262144,
+    "MAX_RECORD_TEXT": 524288,
+    "MAX_RECORD_BYTES": 737280,
+    "MAX_SEALED_RECORD_CHARS": 983062
+  },
+  "base": {
+    "categories": {
+      "focus": {
+        "text": "publish corrected MMP conformance artifacts",
+        "meta": {
+          "key": "5016f1bd82f5ec8ad064f9fb0a47c10988190c407c9d534e76b366634bf2e268",
+          "parents": []
+        }
+      },
+      "issue": {
+        "text": "the public vectors and runtime disagree",
+        "meta": {
+          "key": "8f37da919d4165770650b6508b66af65f0710157209b10724e7cc4aab717da83",
+          "parents": [
+            "cmb-abababababababababababababababababababababababababababababababab"
+          ]
+        }
+      },
+      "intent": {
+        "text": "make independent implementations interoperate",
+        "meta": {
+          "key": "f47998bfc4aedee3ac20c485f9cd07caacccf622ceced426c02e178741718f67",
+          "parents": []
+        }
+      },
+      "motivation": {
+        "text": "a protocol claim must be executable",
+        "meta": {
+          "key": "9dfa469fab3eeb8c98f79df69c3b2f02f277a017f9cbe3bf0f32ccbf9a4f129d",
+          "parents": []
+        }
+      },
+      "commitment": {
+        "text": "one contract drives every implementation",
+        "meta": {
+          "key": "d3bbf94949feceaea72667efe8c43a4bf3aed557ecc632caf82b7c3f2447e3c8",
+          "parents": []
+        }
+      },
+      "perspective": {
+        "text": "protocol editor",
+        "meta": {
+          "key": "3e48fe2e89a1e02f5c17c08e853bd09d5355d18a491a1bd926568089626ffa35",
+          "parents": []
+        }
+      },
+      "mood": {
+        "text": "determined",
+        "meta": {
+          "key": "a515fb1d0492e7661b89c2b02d6bf81372ee07560bfca054863c76dec74880da",
+          "parents": []
+        }
+      }
+    },
+    "metadata": {
+      "key": "cmb-7f7b55653aa9854999c2efeb9751ce4428f9dfe95839e34e4358ab0be5cdf98d",
+      "addressScheme": "mmp-cmb-merkle-v2",
+      "signatureSuite": "mmp-sig-v2.0",
+      "createdByNodeId": "018f47a0-7b21-7abc-8def-0123456789ab",
+      "createdBy": "vector-author",
+      "createdTimestamp": 1786611600000,
+      "room": "conformance-room",
+      "to": "018f47a0-7b21-7abc-8def-fedcba987654",
+      "lineage": {
+        "parents": [
+          "cmb-abababababababababababababababababababababababababababababababab"
+        ],
+        "method": "svaf-heuristic"
+      },
+      "application": null,
+      "assertionId": "asrt-926d08932fe23abc3950001f80df80f93f9ae0942eb04329cd5d6c4748a0ff7e",
+      "sigAlg": "ed25519",
+      "sig": "ae5wP18m0_bGBxiqL4faj70eTjwK_nZL1FocG021xhwmHqmX1Ne3SlVZzdquOZiuh5haKtss6nGXWZdvXzVpCg"
+    }
+  },
+  "cases": [
+    {
+      "label": "a published record, measured",
+      "expected": {
+        "categoryTextBytes": {
+          "focus": 43,
+          "issue": 39,
+          "intent": 45,
+          "motivation": 35,
+          "commitment": 40,
+          "perspective": 15,
+          "mood": 10
+        },
+        "recordTextBytes": 227,
+        "recordBytes": 1820,
+        "within": true,
+        "over": []
+      }
+    },
+    {
+      "label": "CJK text is measured as its UTF-8 bytes (3 a character), never as \\u escapes (6)",
+      "fill": {
+        "focus": {
+          "unit": "認知",
+          "count": 1000
+        }
+      },
+      "expected": {
+        "categoryTextBytes": {
+          "focus": 6000,
+          "issue": 39,
+          "intent": 45,
+          "motivation": 35,
+          "commitment": 40,
+          "perspective": 15,
+          "mood": 10
+        },
+        "recordTextBytes": 6184,
+        "recordBytes": 7777,
+        "notTheMeasure": {
+          "asciiEscapedBytes": 13777
+        },
+        "within": true,
+        "over": []
+      }
+    },
+    {
+      "label": "one category at MAX_CATEGORY_TEXT",
+      "fill": {
+        "focus": {
+          "unit": "a",
+          "count": 262144
+        }
+      },
+      "expected": {
+        "categoryTextBytes": {
+          "focus": 262144,
+          "issue": 39,
+          "intent": 45,
+          "motivation": 35,
+          "commitment": 40,
+          "perspective": 15,
+          "mood": 10
+        },
+        "recordTextBytes": 262328,
+        "recordBytes": 263921,
+        "within": true,
+        "over": []
+      }
+    },
+    {
+      "label": "one category a byte over MAX_CATEGORY_TEXT",
+      "fill": {
+        "focus": {
+          "unit": "a",
+          "count": 262145
+        }
+      },
+      "expected": {
+        "categoryTextBytes": {
+          "focus": 262145,
+          "issue": 39,
+          "intent": 45,
+          "motivation": 35,
+          "commitment": 40,
+          "perspective": 15,
+          "mood": 10
+        },
+        "recordTextBytes": 262329,
+        "recordBytes": 263922,
+        "within": false,
+        "over": [
+          "MAX_CATEGORY_TEXT"
+        ]
+      }
+    },
+    {
+      "label": "three-byte characters: within the schema maxLength, over MAX_CATEGORY_TEXT",
+      "fill": {
+        "focus": {
+          "unit": "漢",
+          "count": 87382
+        }
+      },
+      "expected": {
+        "categoryTextBytes": {
+          "focus": 262146,
+          "issue": 39,
+          "intent": 45,
+          "motivation": 35,
+          "commitment": 40,
+          "perspective": 15,
+          "mood": 10
+        },
+        "recordTextBytes": 262330,
+        "recordBytes": 263923,
+        "notTheMeasure": {
+          "asciiEscapedBytes": 526069
+        },
+        "within": false,
+        "over": [
+          "MAX_CATEGORY_TEXT"
+        ]
+      }
+    },
+    {
+      "label": "the seven texts at MAX_RECORD_TEXT",
+      "fill": {
+        "focus": {
+          "unit": "a",
+          "count": 262144
+        },
+        "issue": {
+          "unit": "b",
+          "count": 261999
+        }
+      },
+      "expected": {
+        "categoryTextBytes": {
+          "focus": 262144,
+          "issue": 261999,
+          "intent": 45,
+          "motivation": 35,
+          "commitment": 40,
+          "perspective": 15,
+          "mood": 10
+        },
+        "recordTextBytes": 524288,
+        "recordBytes": 525881,
+        "within": true,
+        "over": []
+      }
+    },
+    {
+      "label": "the seven texts a byte over MAX_RECORD_TEXT",
+      "fill": {
+        "focus": {
+          "unit": "a",
+          "count": 262144
+        },
+        "issue": {
+          "unit": "b",
+          "count": 262000
+        }
+      },
+      "expected": {
+        "categoryTextBytes": {
+          "focus": 262144,
+          "issue": 262000,
+          "intent": 45,
+          "motivation": 35,
+          "commitment": 40,
+          "perspective": 15,
+          "mood": 10
+        },
+        "recordTextBytes": 524289,
+        "recordBytes": 525882,
+        "within": false,
+        "over": [
+          "MAX_RECORD_TEXT"
+        ]
+      }
+    },
+    {
+      "label": "the encoded record at MAX_RECORD_BYTES",
+      "fill": {
+        "focus": {
+          "unit": "a",
+          "count": 95266
+        }
+      },
+      "applicationBytes": 480000,
+      "expected": {
+        "categoryTextBytes": {
+          "focus": 95266,
+          "issue": 39,
+          "intent": 45,
+          "motivation": 35,
+          "commitment": 40,
+          "perspective": 15,
+          "mood": 10
+        },
+        "recordTextBytes": 95450,
+        "recordBytes": 737280,
+        "within": true,
+        "over": []
+      }
+    },
+    {
+      "label": "the encoded record a byte over MAX_RECORD_BYTES, every text within",
+      "fill": {
+        "focus": {
+          "unit": "a",
+          "count": 95267
+        }
+      },
+      "applicationBytes": 480000,
+      "expected": {
+        "categoryTextBytes": {
+          "focus": 95267,
+          "issue": 39,
+          "intent": 45,
+          "motivation": 35,
+          "commitment": 40,
+          "perspective": 15,
+          "mood": 10
+        },
+        "recordTextBytes": 95451,
+        "recordBytes": 737281,
+        "within": false,
+        "over": [
+          "MAX_RECORD_BYTES"
+        ]
+      }
+    }
+  ]
+}
diff --git a/tests/fixtures/relay-frame.schema.json b/tests/fixtures/relay-frame.schema.json
new file mode 100644
index 00000000..be5cce29
--- /dev/null
+++ b/tests/fixtures/relay-frame.schema.json
@@ -0,0 +1,62 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://meshcognition.org/spec/mmp/schema/relay-frame.schema.json",
+  "title": "MMP v2.0 relay transport frames",
+  "oneOf": [
+    { "$ref": "#/$defs/auth" }, { "$ref": "#/$defs/peers" },
+    { "$ref": "#/$defs/ping" }, { "$ref": "#/$defs/pong" },
+    { "$ref": "#/$defs/reauth" }, { "$ref": "#/$defs/joined" },
+    { "$ref": "#/$defs/left" }, { "$ref": "#/$defs/error" }
+  ],
+  "$defs": {
+    "wake": {
+      "type": "object",
+      "required": ["platform", "token", "environment"],
+      "additionalProperties": false,
+      "properties": {
+        "platform": { "type": "string", "minLength": 1, "maxLength": 32 },
+        "token": { "type": "string", "minLength": 1, "maxLength": 4096 },
+        "environment": { "type": "string", "minLength": 1, "maxLength": 32 }
+      }
+    },
+    "auth": {
+      "type": "object", "required": ["type", "nodeId", "name"], "additionalProperties": false,
+      "properties": {
+        "type": { "const": "relay-auth" }, "nodeId": { "type": "string", "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$" },
+        "name": { "type": "string", "minLength": 1, "maxLength": 255 },
+        "token": { "type": "string", "minLength": 1, "maxLength": 4096 },
+        "room": { "type": "string", "pattern": "^[a-z0-9._-]{1,64}$", "description": "§5.8 room identifier; absent means default. Addressing, never permission." },
+        "engine": { "type": "string", "minLength": 1, "maxLength": 32, "description": "Implementation label for the relay operator's logs; never forwarded." },
+        "wakeChannel": { "$ref": "#/$defs/wake" }
+      }
+    },
+    "peer": {
+      "type": "object", "required": ["nodeId", "name"], "additionalProperties": false,
+      "properties": {
+        "nodeId": { "type": "string", "format": "uuid" }, "name": { "type": "string", "minLength": 1, "maxLength": 255 },
+        "offline": { "type": "boolean" }, "wakeChannel": { "$ref": "#/$defs/wake" }
+      }
+    },
+    "peers": {
+      "type": "object", "required": ["type", "peers"], "additionalProperties": false,
+      "properties": {
+        "type": { "const": "relay-peers" }, "peers": { "type": "array", "maxItems": 4096, "items": { "$ref": "#/$defs/peer" } },
+        "features": { "type": "array", "maxItems": 64, "uniqueItems": true, "items": { "type": "string", "pattern": "^[a-z][a-z0-9-]{0,63}$" } }
+      }
+    },
+    "ping": { "type": "object", "required": ["type"], "additionalProperties": false, "properties": { "type": { "const": "relay-ping" } } },
+    "pong": { "type": "object", "required": ["type"], "additionalProperties": false, "properties": { "type": { "const": "relay-pong" } } },
+    "reauth": { "type": "object", "required": ["type"], "additionalProperties": false, "properties": { "type": { "const": "relay-reauth" } } },
+    "joined": { "type": "object", "required": ["type", "nodeId", "name"], "additionalProperties": false, "properties": { "type": { "const": "relay-peer-joined" }, "nodeId": { "type": "string", "format": "uuid" }, "name": { "type": "string", "minLength": 1, "maxLength": 255 } } },
+    "left": { "type": "object", "required": ["type", "nodeId", "name"], "additionalProperties": false, "properties": { "type": { "const": "relay-peer-left" }, "nodeId": { "type": "string", "format": "uuid" }, "name": { "type": "string", "minLength": 1, "maxLength": 255 } } },
+    "error": {
+      "type": "object", "required": ["type", "message"], "additionalProperties": false,
+      "properties": {
+        "type": { "const": "relay-error" }, "message": { "type": "string", "minLength": 1, "maxLength": 1024 },
+        "kind": { "type": "string", "pattern": "^[a-z][a-z0-9-]{0,63}$" },
+        "code": { "type": "integer", "minimum": 4000, "maximum": 4999 },
+        "reason": { "type": "string", "pattern": "^[a-z][a-z0-9-]{0,63}$" }
+      }
+    }
+  }
+}
diff --git a/tests/fixtures/room-join.schema.json b/tests/fixtures/room-join.schema.json
new file mode 100644
index 00000000..5bc1cc52
--- /dev/null
+++ b/tests/fixtures/room-join.schema.json
@@ -0,0 +1,31 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://meshcognition.org/spec/mmp/schema/room-join.schema.json",
+  "title": "MMP v2.0 room-join frame (\u00a75.8.1)",
+  "description": "Sealed control frame presenting an owner-signed room-join grant after the handshake. Checked against this schema before the signature is verified; the grant is verified under §18.3.2 against the owner key pinned for the room (never one selected by grantedBy) and must bind the session's proven nodeId and identity key.",
+  "type": "object",
+  "required": ["type", "grant"],
+  "additionalProperties": false,
+  "properties": {
+    "type": { "const": "room-join" },
+    "grant": { "$ref": "#/$defs/grant" }
+  },
+  "$defs": {
+    "grant": {
+      "type": "object",
+      "required": ["type", "room", "grantee", "granteeKey", "grantedBy", "grantedAt", "expiresAt", "sigAlg", "sig"],
+      "additionalProperties": false,
+      "properties": {
+        "type": { "const": "room-join" },
+        "room": { "type": "string", "pattern": "^[a-z0-9._-]{1,64}$" },
+        "grantee": { "type": "string", "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$" },
+        "granteeKey": { "type": "string", "pattern": "^[A-Za-z0-9_-]{43}$" },
+        "grantedBy": { "type": "string", "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$" },
+        "grantedAt": { "type": "integer", "minimum": 0 },
+        "expiresAt": { "type": "integer", "minimum": 0 },
+        "sigAlg": { "const": "ed25519" },
+        "sig": { "type": "string", "pattern": "^[A-Za-z0-9_-]{86}$" }
+      }
+    }
+  }
+}
diff --git a/tests/fixtures/sym-attest-frame.schema.json b/tests/fixtures/sym-attest-frame.schema.json
new file mode 100644
index 00000000..10f128a8
--- /dev/null
+++ b/tests/fixtures/sym-attest-frame.schema.json
@@ -0,0 +1,138 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://meshcognition.org/spec/mmp/schema/sym-attest-frame.schema.json",
+  "title": "sym-attest-v1 extension frames (Draft Candidate Extension, §16.4)",
+  "description": "The four frames of the sym-attest-v1 extension (/spec/mmp/extensions/sym-attest), sent only where the extension was negotiated, as the inner frame of control-encrypted. Every object is closed. Shape only: chain, root and signature rules are in the extension text.",
+  "oneOf": [
+    { "$ref": "#/$defs/attestationFrame" },
+    { "$ref": "#/$defs/checkpointFrame" },
+    { "$ref": "#/$defs/witnessFrame" },
+    { "$ref": "#/$defs/nodeStatsFrame" }
+  ],
+  "$defs": {
+    "nodeId": { "type": "string", "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$" },
+    "room": { "type": "string", "pattern": "^[a-z0-9._-]{1,64}$" },
+    "time": { "type": "integer", "minimum": 0 },
+    "position": { "type": "integer", "minimum": 1 },
+    "hex64": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
+    "link": { "anyOf": [{ "const": "genesis" }, { "$ref": "#/$defs/hex64" }] },
+    "role": { "type": "string", "pattern": "^[a-z0-9][a-z0-9_-]{0,63}$" },
+    "sig": { "type": "string", "pattern": "^[A-Za-z0-9_-]{86}$" },
+    "categoryVerdict": { "enum": ["admit", "guard", "redundant", "reject", "silent"] },
+    "attestationFrame": {
+      "type": "object",
+      "required": ["type", "attestation"],
+      "additionalProperties": false,
+      "properties": {
+        "type": { "const": "sym-attest-attestation" },
+        "attestation": {
+          "type": "object",
+          "required": ["of", "assertionId", "by", "at", "room", "method", "verdict", "categories", "role", "seq", "prev", "sigAlg", "sig"],
+          "additionalProperties": false,
+          "properties": {
+            "of": { "type": "string", "pattern": "^cmb-[0-9a-f]{64}$" },
+            "assertionId": { "type": "string", "pattern": "^asrt-[0-9a-f]{64}$" },
+            "by": { "$ref": "#/$defs/nodeId" },
+            "at": { "$ref": "#/$defs/time" },
+            "room": { "$ref": "#/$defs/room" },
+            "method": { "type": "string", "pattern": "^[a-z0-9][a-z0-9_-]{0,31}$" },
+            "verdict": { "enum": ["aligned", "guarded", "redundant", "rejected"] },
+            "categories": {
+              "type": "object",
+              "description": "Exactly the seven CAT7 categories.",
+              "required": ["focus", "issue", "intent", "motivation", "commitment", "perspective", "mood"],
+              "additionalProperties": false,
+              "properties": {
+                "focus": { "$ref": "#/$defs/categoryVerdict" },
+                "issue": { "$ref": "#/$defs/categoryVerdict" },
+                "intent": { "$ref": "#/$defs/categoryVerdict" },
+                "motivation": { "$ref": "#/$defs/categoryVerdict" },
+                "commitment": { "$ref": "#/$defs/categoryVerdict" },
+                "perspective": { "$ref": "#/$defs/categoryVerdict" },
+                "mood": { "$ref": "#/$defs/categoryVerdict" }
+              }
+            },
+            "role": { "$ref": "#/$defs/role" },
+            "seq": { "$ref": "#/$defs/position" },
+            "prev": { "$ref": "#/$defs/link", "description": "genesis exactly when seq is 1." },
+            "sigAlg": { "const": "ed25519" },
+            "sig": { "$ref": "#/$defs/sig" }
+          },
+          "if": { "properties": { "seq": { "const": 1 } }, "required": ["seq"] },
+          "then": { "properties": { "prev": { "const": "genesis" } } },
+          "else": { "properties": { "prev": { "$ref": "#/$defs/hex64" } } }
+        }
+      }
+    },
+    "checkpointFrame": {
+      "type": "object",
+      "required": ["type", "checkpoint"],
+      "additionalProperties": false,
+      "properties": {
+        "type": { "const": "sym-attest-checkpoint" },
+        "checkpoint": {
+          "type": "object",
+          "required": ["by", "room", "fromSeq", "uptoSeq", "prev", "root", "at", "sigAlg", "sig"],
+          "additionalProperties": false,
+          "properties": {
+            "by": { "$ref": "#/$defs/nodeId" },
+            "room": { "$ref": "#/$defs/room" },
+            "fromSeq": { "$ref": "#/$defs/position" },
+            "uptoSeq": { "$ref": "#/$defs/position" },
+            "prev": { "$ref": "#/$defs/link", "description": "genesis exactly when fromSeq is 1; otherwise the previous checkpoint's root." },
+            "root": { "$ref": "#/$defs/hex64" },
+            "at": { "$ref": "#/$defs/time" },
+            "sigAlg": { "const": "ed25519" },
+            "sig": { "$ref": "#/$defs/sig" }
+          },
+          "if": { "properties": { "fromSeq": { "const": 1 } }, "required": ["fromSeq"] },
+          "then": { "properties": { "prev": { "const": "genesis" } } },
+          "else": { "properties": { "prev": { "$ref": "#/$defs/hex64" } } }
+        }
+      }
+    },
+    "witnessFrame": {
+      "type": "object",
+      "required": ["type", "witness"],
+      "additionalProperties": false,
+      "properties": {
+        "type": { "const": "sym-attest-witness" },
+        "witness": {
+          "type": "object",
+          "required": ["attester", "room", "uptoSeq", "root", "by", "role", "at", "sigAlg", "sig"],
+          "additionalProperties": false,
+          "properties": {
+            "attester": { "$ref": "#/$defs/nodeId" },
+            "room": { "$ref": "#/$defs/room" },
+            "uptoSeq": { "$ref": "#/$defs/position" },
+            "root": { "$ref": "#/$defs/hex64" },
+            "by": { "$ref": "#/$defs/nodeId" },
+            "role": { "$ref": "#/$defs/role" },
+            "at": { "$ref": "#/$defs/time" },
+            "sigAlg": { "const": "ed25519" },
+            "sig": { "$ref": "#/$defs/sig" }
+          }
+        }
+      }
+    },
+    "nodeStatsFrame": {
+      "type": "object",
+      "required": ["type", "stats"],
+      "additionalProperties": false,
+      "properties": {
+        "type": { "const": "sym-attest-node-stats" },
+        "stats": {
+          "type": "object",
+          "required": ["emitted", "admitted", "memory", "at"],
+          "additionalProperties": false,
+          "properties": {
+            "emitted": { "type": "integer", "minimum": 0 },
+            "admitted": { "type": "integer", "minimum": 0 },
+            "memory": { "type": "integer", "minimum": 0 },
+            "at": { "$ref": "#/$defs/time" }
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/tests/spec-update-records.test.js b/tests/spec-update-records.test.js
new file mode 100644
index 00000000..82078811
--- /dev/null
+++ b/tests/spec-update-records.test.js
@@ -0,0 +1,142 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME before lib/config loads
+
+/**
+ * Records as MMP 2.0 update 1 states them (#34 and #37, folded into spec/mmp-2.0-update-1 at
+ * 2660ab9): one signed projection per assertion (D2), so every node holds one assertion as the same
+ * bytes, and the record size measure. Each case of the record-projection-v2 and record-size-v2
+ * vectors runs against sym's own code; the D2 tests fail on 018206d.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+const { canonicalRecordV2_0, RecordShapeError } = require('../lib/core/record-canonical');
+const { verifyCMB } = require('../lib/core/cmb-signing');
+const { createCMB, recordBytes, textBytes, MAX_RECORD_BYTES } = require('../lib/core/cmb-encoder');
+const { canonicalJSON } = require('../lib/core/verified-receipt');
+const { CAT7_CATEGORIES } = require('../lib/core/cmb');
+
+const FIX = path.join(__dirname, 'fixtures');
+const sources = JSON.parse(fs.readFileSync(path.join(FIX, 'SOURCES.json'), 'utf8'));
+function vendored(name) {
+  const bytes = fs.readFileSync(path.join(FIX, name));
+  assert.strictEqual(crypto.createHash('sha256').update(bytes).digest('hex'), sources.files[name].sha256, `${name}: the vendored copy is the published one`);
+  return JSON.parse(bytes.toString('utf8'));
+}
+
+describe('record-projection-v2: the canonical signed projection (#34, D2)', () => {
+  const v = vendored('record-projection-v2.json');
+  const key = v.testKey.publicKeyBase64url;
+  for (const c of v.cases) {
+    it(c.label, () => {
+      if (c.expected.accepted) {
+        const p = canonicalRecordV2_0(c.record);
+        // HELD (coordinator, 2026-10-08): the vector holds an absent application as null (#34), a rule
+        // under review that sym does not apply yet. Exactly that member is the difference: sym's
+        // projection with it added is the vector's, byte for byte. Remove `held` when the ruling lands.
+        assert.strictEqual(p.metadata.application, undefined, 'the held rule: no application member');
+        const held = { categories: p.categories, metadata: { ...p.metadata, application: null } };
+        assert.deepStrictEqual(held, c.expected.projection);
+        assert.strictEqual(crypto.createHash('sha256').update(canonicalJSON(held), 'utf8').digest('hex'), c.expected.projectionSha256, 'the same RFC 8785 bytes');
+        assert.strictEqual(verifyCMB(p, key).valid, true, 'the projection verifies');
+        assert.strictEqual(verifyCMB(c.record, key).valid, true, 'and so does the record as given');
+      } else {
+        let err = null;
+        try { canonicalRecordV2_0(c.record); } catch (e) { err = e; }
+        assert.ok(err instanceof RecordShapeError, `refused (${c.expected.refusedBy})`);
+        if (/not NFC/.test(c.expected.refusedBy)) assert.match(err.reason, /not NFC/);
+        else if (/meta\.key/.test(c.expected.refusedBy)) assert.strictEqual(err.reason, 'content-mismatch');
+        else assert.doesNotMatch(err.reason, /not NFC|content-mismatch/, 'refused by the record schema');
+      }
+    });
+  }
+
+  it('every accepted variant of one assertion is one projection: the same bytes at every node', () => {
+    const bySig = new Map();
+    for (const c of v.cases.filter((x) => x.expected.accepted)) {
+      const sig = c.record.metadata.sig;
+      if (!bySig.has(sig)) bySig.set(sig, new Set());
+      bySig.get(sig).add(canonicalJSON(canonicalRecordV2_0(c.record)));
+    }
+    assert.strictEqual(bySig.size, 2, 'two assertions among the accepted cases');
+    for (const forms of bySig.values()) assert.strictEqual(forms.size, 1);
+  });
+
+  it('a 256-character limit counts code points, as JSON Schema counts maxLength', () => {
+    const base = v.cases[0].record;
+    const astral = '\u{1F600}'.repeat(200); // 200 code points, 400 UTF-16 units
+    const r = JSON.parse(JSON.stringify(base));
+    r.metadata.createdBy = astral;
+    let err = null;
+    try { canonicalRecordV2_0(r); } catch (e) { err = e; }
+    // Within the cap: it gets past the label check (and is then refused by nothing in step 1).
+    assert.strictEqual(err, null, err && err.reason);
+    r.metadata.createdBy = '\u{1F600}'.repeat(257);
+    assert.throws(() => canonicalRecordV2_0(r), (e) => e.reason === 'createdBy is not a label');
+  });
+});
+
+describe('a node mints the canonical projection (D2)', () => {
+  const cats = (focus) => Object.fromEntries(CAT7_CATEGORIES.map((f) => [f, f === 'focus' ? focus : (f === 'mood' ? { text: 'calm' } : `${f} text`)]));
+  const P = (b) => `cmb-${b.repeat(64)}`;
+  it('NFC text, createdBy and room; parents a sorted set; no parents is no lineage', () => {
+    const nfd = 'café'; // "café" in NFD
+    const r = createCMB({ categories: cats(nfd), createdBy: `zoë`, room: `róom`, lineage: { parents: [P('f'), P('0'), P('f')], method: 'SVAF-v2' }, categoryParents: { issue: ['z', 'a', 'z'] } });
+    assert.strictEqual(r.categories.focus.text, nfd.normalize('NFC'));
+    assert.strictEqual(r.metadata.createdBy, 'zoë');
+    assert.strictEqual(r.metadata.room, 'róom'.normalize('NFC'));
+    assert.deepStrictEqual(r.metadata.lineage.parents, [P('0'), P('f')]);
+    assert.deepStrictEqual(r.categories.issue.meta.parents, ['a', 'z']);
+    assert.strictEqual(createCMB({ categories: cats('x'), createdBy: 'a', lineage: { parents: [] } }).metadata.lineage, null);
+  });
+
+  it('a minted, signed record is its own projection', () => {
+    const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519');
+    const { signCMB, assertionIdV2_0 } = require('../lib/core/cmb-signing');
+    const r = createCMB({ categories: cats('café'), createdBy: 'zoë', room: 'r', lineage: { parents: [P('f'), P('0')] }, emitV2: true, createdByNodeId: crypto.randomUUID() });
+    r.metadata.assertionId = assertionIdV2_0(r);
+    signCMB(r, privateKey.export({ format: 'jwk' }).d);
+    const p = canonicalRecordV2_0(r);
+    // The minted record carries application: null; the held #34 rule is not applied, so the
+    // projection drops it (see record-projection-v2 above).
+    const { application, ...metadata } = r.metadata;
+    assert.strictEqual(application, null);
+    assert.strictEqual(canonicalJSON(p), canonicalJSON({ categories: Object.fromEntries(CAT7_CATEGORIES.map((f) => [f, { text: r.categories[f].text, meta: r.categories[f].meta }])), metadata: { ...metadata, lineage: { parents: r.metadata.lineage.parents } } }));
+    assert.strictEqual(verifyCMB(p, publicKey.export({ format: 'jwk' }).x).valid, true);
+  });
+});
+
+describe('record-size-v2: one measure for MAX_RECORD_BYTES (#37)', () => {
+  const v = vendored('record-size-v2.json');
+  function expand(c) {
+    const r = JSON.parse(JSON.stringify(v.base));
+    for (const [f, { unit, count }] of Object.entries(c.fill || {})) r.categories[f].text = unit.repeat(count);
+    if (c.applicationBytes !== undefined) {
+      const bytes = Buffer.alloc(c.applicationBytes, 0x61);
+      r.metadata.application = { mediaType: 'application/octet-stream', schema: 'https://meshcognition.org/schema/size-fixture-v1.json', encoding: 'base64url', byteLength: bytes.length, digest: `sha256-${crypto.createHash('sha256').update(bytes).digest('hex')}`, data: bytes.toString('base64url') };
+    }
+    return r;
+  }
+  for (const c of v.cases) {
+    it(c.label, () => {
+      const r = expand(c);
+      for (const f of CAT7_CATEGORIES) assert.strictEqual(textBytes(r.categories[f].text), c.expected.categoryTextBytes[f], f);
+      assert.strictEqual(recordBytes(r), c.expected.recordBytes);
+      let refused = null;
+      try { canonicalRecordV2_0(r); } catch (e) { refused = e; }
+      const sizeRefused = !!(refused && /too long/.test(refused.reason));
+      assert.strictEqual(!sizeRefused, c.expected.within, refused && refused.reason);
+    });
+  }
+
+  it('a record\'s decoded payload beside it is not counted twice: the measure is the two-section record', () => {
+    const r = expand({ fill: { focus: { unit: 'a', count: 95266 } }, applicationBytes: 480000 });
+    assert.strictEqual(recordBytes(r), MAX_RECORD_BYTES);
+    r.payload = { decoded: 'x'.repeat(1000) }; // what remember() keeps beside its own record
+    assert.strictEqual(recordBytes(r), MAX_RECORD_BYTES);
+  });
+});
diff --git a/tests/spec-update-vectors.test.js b/tests/spec-update-vectors.test.js
new file mode 100644
index 00000000..59c9e039
--- /dev/null
+++ b/tests/spec-update-vectors.test.js
@@ -0,0 +1,105 @@
+'use strict';
+
+/**
+ * The MMP 2.0 update 1 artifacts sym vendors (tests/fixtures, from meshcognition-website PR #43,
+ * branch spec/mmp-2.0-update-1 at 2660ab9; SOURCES.json records each digest), checked as copies, and
+ * the reference construction (scripts/mmp/lib.mjs, vendored as mmp-lib.mjs) run beside sym's own code
+ * on the same inputs: what sym builds, the reference builds byte for byte.
+ */
+
+const { describe, it, before } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+const { buildControlFrame, openControlSealed, parseControlPlain, controlAAD, neverInner } = require('../lib/core/sealed-control');
+const { canonicalRecordV2_0 } = require('../lib/core/record-canonical');
+const { recordBytes, textBytes, MAX_CATEGORY_BYTES, MAX_RECORD_TEXT_BYTES, MAX_RECORD_BYTES, MAX_SEALED_CHARS } = require('../lib/core/cmb-encoder');
+const { canonicalJSON } = require('../lib/core/verified-receipt');
+const { CAT7_CATEGORIES } = require('../lib/core/cmb');
+
+const FIX = path.join(__dirname, 'fixtures');
+const sources = JSON.parse(fs.readFileSync(path.join(FIX, 'SOURCES.json'), 'utf8'));
+const vendored = (name) => JSON.parse(fs.readFileSync(path.join(FIX, name), 'utf8'));
+
+describe('the vendored MMP 2.0 update 1 artifacts are the published copies', () => {
+  for (const [name, { sha256 }] of Object.entries(sources.files)) {
+    it(name, () => {
+      const bytes = fs.readFileSync(path.join(FIX, name));
+      assert.strictEqual(crypto.createHash('sha256').update(bytes).digest('hex'), sha256);
+    });
+  }
+});
+
+describe('control-encrypted-v2 (§7.1, §18.2.1)', () => {
+  const v = vendored('control-encrypted-v2.json');
+  for (const c of v.cases) {
+    it(`${c.direction} ${c.sequence}: ${c.inner.type} seals to the vector's bytes and opens to its inner frame`, () => {
+      const trafficKey = Buffer.from(c.trafficKeyHex, 'hex');
+      assert.strictEqual(controlAAD({ sessionId: v.sessionId, direction: c.direction, sequence: c.sequence }).toString('hex'), c.aadHex);
+      assert.strictEqual(JSON.stringify(c.inner), c.plaintextUtf8);
+      const built = buildControlFrame({ frame: c.inner, sessionId: v.sessionId, direction: c.direction, sequence: c.sequence, trafficKey });
+      assert.deepStrictEqual(built, c.frame);
+      assert.deepStrictEqual(parseControlPlain(openControlSealed({ frame: c.frame, trafficKey })), c.inner);
+    });
+  }
+  it('an authentic envelope whose inner frame §7.1 forbids opens, and its inner frame is refused', () => {
+    const r = v.innerRefused;
+    const trafficKey = Buffer.from(r.trafficKeyHex, 'hex');
+    assert.strictEqual(r.expected.opens, true);
+    const plain = openControlSealed({ frame: r.frame, trafficKey }); // opens: the position is taken
+    assert.strictEqual(plain.toString('utf8'), r.plaintextUtf8);
+    assert.throws(() => parseControlPlain(plain), /not a control frame/);
+    // The session-level half (nextSequence, sessionOpen) is tests/spec-update-session.test.js S4.
+  });
+});
+
+describe('the reference construction (scripts/mmp/lib.mjs) and sym agree', () => {
+  let L;
+  before(async () => { L = await import(path.join(FIX, 'mmp-lib.mjs')); });
+
+  it('the size limits', () => {
+    assert.strictEqual(L.MAX_CATEGORY_TEXT, MAX_CATEGORY_BYTES);
+    assert.strictEqual(L.MAX_RECORD_TEXT, MAX_RECORD_TEXT_BYTES);
+    assert.strictEqual(L.MAX_RECORD_BYTES, MAX_RECORD_BYTES);
+    assert.strictEqual(L.MAX_SEALED_RECORD_CHARS, MAX_SEALED_CHARS);
+  });
+
+  it('the control AAD, and which frames never travel sealed in a control envelope', () => {
+    for (const direction of ['client-to-server', 'server-to-client']) {
+      for (const sequence of ['0', '1', '4294967296']) {
+        const sessionId = crypto.randomBytes(16).toString('hex');
+        assert.deepStrictEqual(controlAAD({ sessionId, direction, sequence }), L.controlAADV2({ sessionId, direction, sequence }));
+      }
+    }
+    const registry = vendored('frame-registry.json');
+    const types = [...new Set([...registry.frames.map((f) => f.type), 'relay-fanout', 'relay-challenge', 'sym-attest-attestation'])];
+    for (const t of types) assert.strictEqual(neverInner(t), L.controlInnerForbidden(t), t);
+  });
+
+  it('the record projection, on every accepted record-projection-v2 case', () => {
+    const v = vendored('record-projection-v2.json');
+    for (const c of v.cases.filter((x) => x.expected.accepted)) {
+      const ref = L.recordProjectionV2(c.record);
+      assert.strictEqual(ref.ok, true);
+      const p = canonicalRecordV2_0(c.record);
+      // HELD (#34 application-as-null, under review): see tests/spec-update-records.test.js.
+      assert.strictEqual(canonicalJSON({ categories: p.categories, metadata: { ...p.metadata, application: p.metadata.application ?? null } }), canonicalJSON(ref.projection), c.label);
+    }
+  });
+
+  it('the size measures, on every record-size-v2 case', () => {
+    const v = vendored('record-size-v2.json');
+    for (const c of v.cases) {
+      const r = JSON.parse(JSON.stringify(v.base));
+      for (const [f, { unit, count }] of Object.entries(c.fill || {})) r.categories[f].text = unit.repeat(count);
+      if (c.applicationBytes !== undefined) {
+        const bytes = Buffer.alloc(c.applicationBytes, 0x61);
+        r.metadata.application = { mediaType: 'application/octet-stream', schema: 'https://meshcognition.org/schema/size-fixture-v1.json', encoding: 'base64url', byteLength: bytes.length, digest: `sha256-${crypto.createHash('sha256').update(bytes).digest('hex')}`, data: bytes.toString('base64url') };
+      }
+      const ref = L.recordSize(r);
+      assert.strictEqual(recordBytes(r), ref.recordBytes, c.label);
+      for (const f of CAT7_CATEGORIES) assert.strictEqual(textBytes(r.categories[f].text), ref.categoryTextBytes[f], `${c.label}: ${f}`);
+    }
+  });
+});

From 4f8440b52343af65ecf01a0f2d67b386b3d807ac Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 8 Oct 2026 11:44:58 +0100
Subject: [PATCH 128/148] session frames as update 1 closes them: mood, fetch,
 anchors, 1011, sealed ping; fetched records verified (D4, #26, #30, #23)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

MMP 2.0 update 1 (meshcognition-website PR #43 at 2660ab9) and the founder's mood ruling:

- mood is { type, mood, context, timestamp }: mood 1 to 1,024 characters, context at most 4,096
  or null, counted in code points (lib/core/mood-frame). broadcastMood sends no from/fromName and
  throws EMOODFRAME rather than send an out-of-bounds frame. On receipt a frame carrying any other
  member (from, fromName, valence) is refused, and the event is labelled with the session's proven
  name, never a payload name.
- cmb-fetch carries no from and names one key (a keys array, or any member the schema does not
  define, is refused and counted); cmb-fetch-result carries no timestamp, and both are checked
  closed on receipt. A record is served only into a session of its own signed room. fetchCMB asks
  only for a cognition key.
- D4: a fetched record is put through the whole of §8.8.5 (author key by createdByNodeId,
  signature, assertion identity, audience). fetchCMB returns { verified: true, cmb, authorNodeId }
  only when it passes, and otherwise { verified: false, reason, categories } with no metadata, which
  the §15.8 audit may use for the tether. A record held under Legacy Import answers the same way. A
  non-v2.0 record answers nothing; an altered category is reported as a mismatch, apart from a
  malformed record.
- cmb-anchors: only a non-empty list starts the once-a-minute limit (an admission with nothing to
  replay no longer held back the next one's context); replay is limited to records this node
  authored in the session's room; a frame that is not the schema's (more than 50 keys, a non-key, an
  extra member) is refused whole.
- A clear 1011 prompts a re-handshake only on the client side, while the peer is present, when its
  detail names a session this node holds with that peer or a probe ping is outstanding, while no
  newer session is waiting to supersede, and no faster than the retry backoff (1 s doubling to 30 s).
- A sealed ping is answered with a pong, and a pong (clear or sealed) ends an outstanding probe.
- control-encrypted is checked as its schema bounds it: the members exactly, a 32-hex sessionId, a
  sequence of at most 29 digits, a sealed value at least as long as the tag.

Already as update 1 states, with no change: the server supersedes at admission (after room-join
in a gated room); a sealed error never completes a client's supersession (it never reaches the
frame path); 1009 is sent sealed and not retried.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QRVMpaJkAA2fFbvuHCEzqH
---
 lib/core/mood-frame.js            |  50 ++++++
 lib/core/record-canonical.js      |   2 +-
 lib/core/sealed-control.js        |  14 +-
 lib/frame-handler.js              | 142 +++++++++++----
 lib/node.js                       | 135 +++++++++++----
 lib/session.js                    |  10 +-
 tests/cmb-fetch-serves-v2.test.js |   2 +-
 tests/cmb-fetch.test.js           | 105 +++++------
 tests/inbound-frame-guard.test.js |   6 +-
 tests/spec-update-frames.test.js  | 279 ++++++++++++++++++++++++++++++
 tests/wire-fromname.test.js       |  19 +-
 11 files changed, 620 insertions(+), 144 deletions(-)
 create mode 100644 lib/core/mood-frame.js
 create mode 100644 tests/spec-update-frames.test.js

diff --git a/lib/core/mood-frame.js b/lib/core/mood-frame.js
new file mode 100644
index 00000000..0390270a
--- /dev/null
+++ b/lib/core/mood-frame.js
@@ -0,0 +1,50 @@
+'use strict';
+
+/**
+ * @module sym/core/mood-frame
+ * @description The `mood` control frame (MMP §9.3; control-frame.schema.json, MMP 2.0 update 1 by the
+ * founder's ruling): `{ type, mood, context, timestamp }`, sealed on a confirmed Core Secure session.
+ *
+ *   mood       1 to 1,024 characters
+ *   context    at most 4,096 characters, or null
+ *   timestamp  the sender's clock, an integer, information only
+ *
+ * It names no sender: a receiver attributes it to the session's proven nodeId and name, so a frame
+ * carrying `from` or `fromName` (the 0.13 shape, where a payload name labelled the event) is not this
+ * frame. It carries no valence or arousal, and it is never stored, relayed or remixed. Characters are
+ * counted as JSON Schema's maxLength counts them, in code points.
+ *
+ * @copyright 2026 SYM.BOT Ltd.
+ * @license Apache-2.0
+ */
+
+const { codePoints } = require('./record-canonical');
+
+const MOOD_MAX = 1024;
+const CONTEXT_MAX = 4096;
+const MEMBERS = new Set(['type', 'mood', 'context', 'timestamp']);
+
+/** Why `f` is not a mood frame, or null when it is one. */
+function moodFrameReason(f) {
+  if (!f || typeof f !== 'object' || Array.isArray(f) || f.type !== 'mood') return 'not a mood frame';
+  for (const k of Object.keys(f)) if (!MEMBERS.has(k)) return `carries ${JSON.stringify(k.slice(0, 32))}, which the frame does not define`;
+  if (typeof f.mood !== 'string' || f.mood.length === 0) return 'mood is not text';
+  if (codePoints(f.mood) > MOOD_MAX) return `mood is over ${MOOD_MAX} characters`;
+  if (!(f.context === undefined || f.context === null || typeof f.context === 'string')) return 'context is not text or null';
+  if (typeof f.context === 'string' && codePoints(f.context) > CONTEXT_MAX) return `context is over ${CONTEXT_MAX} characters`;
+  if (!(f.timestamp === undefined || (Number.isSafeInteger(f.timestamp) && f.timestamp >= 0))) return 'timestamp is not an integer';
+  return null;
+}
+
+/**
+ * The frame a node sends for `mood` and `context`, or a RangeError (`code` EMOODFRAME) naming what is
+ * out of bounds: a node never sends a frame its peers refuse.
+ */
+function buildMoodFrame(mood, context, now = Date.now()) {
+  const f = { type: 'mood', mood, context: context === undefined || context === '' ? null : context, timestamp: now };
+  const why = moodFrameReason(f);
+  if (why) { const e = new RangeError(`mood: ${why}`); e.code = 'EMOODFRAME'; throw e; }
+  return f;
+}
+
+module.exports = { moodFrameReason, buildMoodFrame, MOOD_MAX, CONTEXT_MAX };
diff --git a/lib/core/record-canonical.js b/lib/core/record-canonical.js
index 3be7a10d..dd419bdf 100644
--- a/lib/core/record-canonical.js
+++ b/lib/core/record-canonical.js
@@ -227,4 +227,4 @@ function signedProjection(cmb) {
   return canonicalRecordV2_0({ categories: cmb.categories, metadata: cmb.metadata });
 }
 
-module.exports = { canonicalRecordV2_0, signedProjection, sizeRefusal, RecordShapeError, isCanonicalNodeId: isNodeId, isLowerUuid, LOWER_UUID };
+module.exports = { canonicalRecordV2_0, signedProjection, sizeRefusal, RecordShapeError, isCanonicalNodeId: isNodeId, isLowerUuid, LOWER_UUID, codePoints };
diff --git a/lib/core/sealed-control.js b/lib/core/sealed-control.js
index 2efbf212..d02c469f 100644
--- a/lib/core/sealed-control.js
+++ b/lib/core/sealed-control.js
@@ -39,7 +39,6 @@ const FRAME_TYPE = 'control-encrypted';
 const AAD_DOMAIN = 'mmp-aead-control-v2\n';
 const DIRECTIONS = new Set(['client-to-server', 'server-to-client']);
 
-/** The frame types a sealed control frame may carry. Records, handshakes and envelopes never. */
 // Never inside a control envelope: records (they have their own), envelopes, handshake frames, and
 // the relay protocol's own frames (a peer's sealed frame is never a relay instruction).
 const NEVER_INNER = new Set(['cmb', 'cmb-encrypted', 'control-encrypted', 'client-hello', 'server-hello', 'client-finish', 'handshake', 'state-sync',
@@ -67,16 +66,21 @@ function buildControlFrame({ frame, sessionId, direction, sequence, trafficKey }
   if (!frame || typeof frame.type !== 'string' || neverInner(frame.type)) throw new Error(`control-encrypted: refusing to seal a '${frame && frame.type}' frame`);
   if (!/^[0-9a-f]{32}$/.test(sessionId || '')) throw new Error('control-encrypted: sessionId must be 32 lowercase hex');
   if (!DIRECTIONS.has(direction)) throw new Error('control-encrypted: bad direction');
-  if (!/^(0|[1-9][0-9]*)$/.test(String(sequence))) throw new Error('control-encrypted: bad sequence');
+  if (!/^(0|[1-9][0-9]{0,28})$/.test(String(sequence))) throw new Error('control-encrypted: bad sequence');
   const sealed = sealV2(trafficKey, nonceForSequence(sequence), controlAAD({ sessionId, direction, sequence }), Buffer.from(JSON.stringify(frame), 'utf8'));
   return { type: FRAME_TYPE, protocolVersion: PROTOCOL_VERSION, suite: SUITE, sessionId, sequence: String(sequence), direction, sealed: b64urlUnpadded(sealed) };
 }
 
 /** Whether a wire frame is shaped as a sealed control frame (nothing about its authenticity). */
+// control-encrypted.schema.json (MMP 2.0 update 1): the members exactly, a sequence below 2^96 (at
+// most 29 digits; the nonce bounds it exactly), a sealed value at least as long as the 16-byte tag.
+const ENVELOPE_MEMBERS = new Set(['type', 'protocolVersion', 'suite', 'sessionId', 'sequence', 'direction', 'sealed']);
 function isControlFrame(f) {
-  return !!f && f.type === FRAME_TYPE && f.protocolVersion === PROTOCOL_VERSION && f.suite === SUITE
-    && typeof f.sessionId === 'string' && DIRECTIONS.has(f.direction)
-    && /^(0|[1-9][0-9]*)$/.test(String(f.sequence)) && typeof f.sealed === 'string' && /^[A-Za-z0-9_-]+$/.test(f.sealed);
+  return !!f && typeof f === 'object' && f.type === FRAME_TYPE && f.protocolVersion === PROTOCOL_VERSION && f.suite === SUITE
+    && Object.keys(f).every((k) => ENVELOPE_MEMBERS.has(k))
+    && typeof f.sessionId === 'string' && /^[0-9a-f]{32}$/.test(f.sessionId) && DIRECTIONS.has(f.direction)
+    && typeof f.sequence === 'string' && /^(0|[1-9][0-9]{0,28})$/.test(f.sequence)
+    && typeof f.sealed === 'string' && f.sealed.length >= 22 && /^[A-Za-z0-9_-]+$/.test(f.sealed);
 }
 
 /**
diff --git a/lib/frame-handler.js b/lib/frame-handler.js
index 2c71af75..4b7443f5 100644
--- a/lib/frame-handler.js
+++ b/lib/frame-handler.js
@@ -5,6 +5,7 @@ const crypto = require('crypto');
 const { recordKey, recordLineage, recordParents, recordCreatedBy, setRecordLineage } = require('./record');
 const { wireNodeId, wireName } = require('./wire-identity');
 const { canonicalRecordV2_0 } = require('./core/record-canonical');
+const { moodFrameReason } = require('./core/mood-frame');
 const { ATTEST_FRAME, fromWireAttestation, fromWireCheckpoint, fromWireWitness, fromWireNodeStats } = require('./core/attestation');
 
 /**
@@ -127,8 +128,6 @@ const DIRECTED_WINDOW_MS = 24 * 60 * 60 * 1000;
 /** Assertion identities the host hook has fired for, at most. */
 const HOOK_SEEN_MAX = 100_000;
 
-/** The most keys one cmb-fetch may name (design D1). */
-const MAX_FETCH_KEYS = 32;
 const AUDIENCE_REPORT_MS = 60_000;
 
 /**
@@ -137,6 +136,28 @@ const AUDIENCE_REPORT_MS = 60_000;
  * Routes each frame type to the appropriate handler method.
  */
 /** Whether a record carries a signed `to` (a directed record). */
+const COGNITION_KEY = /^cmb-[0-9a-f]{64}$/;
+const FETCH_MEMBERS = new Set(['type', 'reqId', 'key', 'timestamp']);
+const FETCH_RESULT_MEMBERS = new Set(['type', 'reqId', 'returned', 'missing']);
+const isReqId = (v) => typeof v === 'string' && v.length > 0 && v.length <= 128;
+/** Why a cmb-fetch is not the schema's frame (closed: no `keys`, no `from`), or null. */
+function fetchFrameReason(f) {
+  for (const k of Object.keys(f)) if (!FETCH_MEMBERS.has(k)) return `carries ${JSON.stringify(k.slice(0, 32))}, which the frame does not define`;
+  if (!isReqId(f.reqId)) return 'reqId is not 1 to 128 characters';
+  if (typeof f.key !== 'string' || !COGNITION_KEY.test(f.key)) return 'key is not a cognition key';
+  if (!(f.timestamp === undefined || (Number.isSafeInteger(f.timestamp) && f.timestamp >= 0))) return 'timestamp is not an integer';
+  return null;
+}
+/** Why a cmb-fetch-result is not the schema's frame (closed: no `timestamp`), or null. */
+function fetchResultFrameReason(f) {
+  for (const k of Object.keys(f)) if (!FETCH_RESULT_MEMBERS.has(k)) return `carries ${JSON.stringify(k.slice(0, 32))}, which the frame does not define`;
+  if (!isReqId(f.reqId)) return 'reqId is not 1 to 128 characters';
+  for (const list of [f.returned, f.missing]) {
+    if (!Array.isArray(list) || list.length > 256 || new Set(list).size !== list.length || !list.every((k) => typeof k === 'string' && COGNITION_KEY.test(k))) return 'returned and missing are not lists of distinct cognition keys';
+  }
+  return null;
+}
+
 const recordDirected = (c) => !!(c && c.metadata && c.metadata.to !== null && c.metadata.to !== undefined);
 
 class FrameHandler {
@@ -397,11 +418,17 @@ class FrameHandler {
       case 'cmb':
         return this._handleMemoryShare(peerId, peerName, msg, session);
 
-      case 'cmb-anchors':
+      case 'cmb-anchors': {
         // The records that follow on this session are the sender's replayed context, not new signals
-        // (they cannot carry a flag of their own: the record frame is fixed by §18.2.1).
-        if (Array.isArray(msg.keys)) session._anchorKeys = new Set(msg.keys.filter((k) => typeof k === 'string').slice(0, 50));
+        // (they cannot carry a flag of their own: the record frame is fixed by §18.2.1). The frame is
+        // the schema's or refused whole (§9.4: `keys`, at most 50 cognition keys, nothing else).
+        const keys = msg.keys;
+        if (Object.keys(msg).some((k) => k !== 'type' && k !== 'keys') || !Array.isArray(keys) || keys.length > 50 || !keys.every((k) => typeof k === 'string' && COGNITION_KEY.test(k))) {
+          throw new Error('cmb-anchors refused: not a list of at most 50 cognition keys');
+        }
+        if (session) session._anchorKeys = new Set(keys);
         return undefined;
+      }
 
       case 'mood':
         return this._handleMood(peerId, peerName, msg, session);
@@ -817,17 +844,18 @@ class FrameHandler {
    * plaintext (§18.2.1) — and then one `cmb-fetch-result` that carries only the correlation id and
    * the key lists:
    *
-   *   { type: 'cmb-fetch-result', reqId, returned: [key…], missing: [key…], timestamp }
+   *   { type: 'cmb-fetch-result', reqId, returned: [key…], missing: [key…] }
    *
-   * sealed as a control frame (`control-encrypted`), field names per draft spec PR #26. Each key
-   * requested appears in exactly one list, once; the records go first and the result last, on the
-   * session's one sequence, so they arrive before the result that lists them. A request names one
-   * `key` (the §7 schema) or up to MAX_FETCH_KEYS `keys`. Only a signed v2.0 record is served;
-   * anything else (a key this node does not hold, one not well-formed) is `missing`.
+   * sealed as a control frame (`control-encrypted`; cmb-fetch-result.schema.json, MMP 2.0 update 1).
+   * The requested key appears in exactly one list; the record goes first and the result last, on
+   * the session's one sequence, so it arrives before the result that lists it. A request names one
+   * `key` (cmb-fetch.schema.json). Only a signed v2.0 record this node may seal into the asking
+   * session (its room, and its recipient or none: §18.2.1) is served; anything else is `missing`.
    * @private
    */
   _handleCmbFetch(peerId, peerName, msg, session) {
-    if (!msg || typeof msg.reqId !== 'string' || !msg.reqId || msg.reqId.length > 128) return;
+    const why = fetchFrameReason(msg);
+    if (why) throw new Error(`cmb-fetch refused: ${why}`);
     if (!session || typeof session.send !== 'function') return;
     // Bounded (security review D, fetch-amp): a request costs ~200 bytes and an answer up to a 1 MiB
     // record, so fetches are rate-limited per session, a record is served at most once per session
@@ -839,21 +867,17 @@ class FrameHandler {
     fb.at = now;
     if (fb.tokens < 1) { this._node.emit('metric', { type: 'cmb-fetch-over-rate', from: peerName }); return; }
     fb.tokens -= 1;
-    const asked = Array.isArray(msg.keys) ? msg.keys.slice(0, MAX_FETCH_KEYS) : [msg.key];
     const returned = [];
     const missing = [];
-    const seen = new Set();
-    for (const key of asked) {
-      // A key is text; anything else names nothing and is not listed.
-      if (typeof key !== 'string' || !key || key.length > 256 || seen.has(key)) continue;
-      seen.add(key);
-      const cmb = key.length <= 128 ? this._node._store.get(key)?.cmb : null;
+    for (const key of [msg.key]) {
+      const cmb = this._node._store.get(key)?.cmb;
       // Served only to an audience its author signed (review finding A): a room-bound record, or one
-      // signed to the asking session's own node. A directed record for anyone else is `missing`, as
-      // if this node did not hold it.
+      // signed to the asking session's own node, and only in the session's room (S1: the store is per
+      // node, not per room). Anything else is `missing`, as if this node did not hold it.
       const to = cmb && cmb.metadata ? cmb.metadata.to : undefined;
       const servable = !!(cmb && cmb.metadata && cmb.metadata.signatureSuite === 'mmp-sig-v2.0' && cmb.metadata.sig)
-        && (to === null || to === undefined || to === session.nodeId);
+        && (to === null || to === undefined || to === session.nodeId)
+        && typeof cmb.metadata.room === 'string' && cmb.metadata.room.normalize('NFC') === String(session.room).normalize('NFC');
       const servedAt = fb.served.get(key);
       const fresh = servedAt === undefined || now - servedAt >= FETCH_REPEAT_MS;
       const room = typeof session.pendingBytes !== 'function' || session.pendingBytes() <= FETCH_PENDING_MAX;
@@ -867,8 +891,7 @@ class FrameHandler {
         missing.push(key);
       }
     }
-    if (returned.length + missing.length === 0) return;
-    session.send({ type: 'cmb-fetch-result', reqId: msg.reqId, returned, missing, timestamp: Date.now() });
+    session.send({ type: 'cmb-fetch-result', reqId: msg.reqId, returned, missing });
     if (returned.length) this._node._log(`[cmb-fetch] served ${returned.length} record(s) (${returned[0].slice(0, 16)}…) to ${peerName}`);
   }
 
@@ -881,8 +904,9 @@ class FrameHandler {
    * @private
    */
   _handleCmbFetchResult(peerId, peerName, msg, session) {
-    const reqId = msg && typeof msg.reqId === 'string' ? msg.reqId : null;
-    if (!reqId) return;
+    const why = fetchResultFrameReason(msg);
+    if (why) throw new Error(`cmb-fetch-result refused: ${why}`);
+    const reqId = msg.reqId;
     if (session && session._fetchExpect) {
       for (const [k, r] of [...session._fetchExpect]) if (r === reqId) session._fetchExpect.delete(k);
     }
@@ -904,9 +928,16 @@ class FrameHandler {
   }
 
   /**
-   * A record that answers this node's cmb-fetch on `session`. §15.8 is SELF-VERIFYING: the requester
-   * recomputes the content address, so serving extends no trust and requires none. classifyAddress
-   * derives by the record's structural role and separates "could not check" from "does not match".
+   * A record that answers this node's cmb-fetch on `session` (MMP §7.1, §15.8, §8.8.5; MMP 2.0
+   * update 1, #26). The requester recomputes the cognition key: a copy whose key does not match is
+   * discarded, so serving extends no trust and needs none. The key binds the categories only, never
+   * the author or the metadata (§8.8.2), so the record is then put through the whole of §8.8.5 — its
+   * author's key resolved by `createdByNodeId`, its signature, assertion identity and audience. Only a
+   * record that passes is handed back as a record, with its author (`verified: true`). One that does
+   * not — a lineage root whose author this node has never proven, typically — is handed back as its
+   * categories alone (`verified: false`, with the reason), which §15.8 may use for the lineage tether
+   * and nothing else: its metadata is not given out as if it were attributed. Neither is admitted,
+   * stored or delivered: a fetch is not an admission.
    * @private
    */
   _resolveFetched(peerId, peerName, msg, reqId) {
@@ -918,10 +949,18 @@ class FrameHandler {
     if (cmb && cmb.metadata && cmb.metadata.signatureSuite === 'mmp-sig-v2.0') {
       try { cmb = canonicalRecordV2_0(cmb); } catch (err) {
         if (!err || err.code !== 'ERECORDSHAPE') throw err;
-        this._node.emit('metric', { type: 'cmb-fetch-forged', from: peerName, key: pending.key, verdict: 'malformed', scheme: null });
+        // A category text that does not match its carried key is an altered record, not an unreadable
+        // one: the two classes stay apart in telemetry.
+        const altered = err.reason === 'content-mismatch';
+        if (altered) this._node._log(`[cmb-fetch] content-address MISMATCH from ${peerName} for ${String(pending.key).slice(0, 16)}… — discarded`);
+        this._node.emit('metric', { type: 'cmb-fetch-forged', from: peerName, key: pending.key, verdict: altered ? 'mismatch' : 'malformed', scheme: null });
         pending.miss(peerId);
         return;
       }
+    } else {
+      // Core Secure serves signed v2.0 records only (see _handleCmbFetch); anything else answers nothing.
+      pending.miss(peerId);
+      return;
     }
     const served = cmb?.metadata?.key ?? cmb?.key;
     if (!cmb || served !== pending.key) { pending.miss(peerId); return; }
@@ -933,7 +972,38 @@ class FrameHandler {
       pending.miss(peerId);
       return;
     }
-    pending.resolve({ cmb, from: peerName, peerId });
+    const v = this._verifyFetched(cmb);
+    const categories = deepFreeze(structuredClone(cmb.categories));
+    if (!v.ok) {
+      this._node.emit('metric', { type: 'cmb-fetch-unverified', from: peerName, key: pending.key, reason: v.reason });
+      pending.resolve({ key: pending.key, verified: false, reason: v.reason, categories, from: peerName, peerId });
+      return;
+    }
+    pending.resolve({ key: pending.key, verified: true, cmb, categories, authorNodeId: v.authorNodeId, from: peerName, peerId });
+  }
+
+  /**
+   * §8.8.5 steps 3 to 7 for a fetched record already projected and key-checked: the application
+   * commitment and signature, the assertion identity, and the signed audience, against the author key
+   * this node binds to `createdByNodeId`. Pure: it charges no budget, penalises no session (the server
+   * is rarely the author) and earns no binding.
+   * @returns {{ ok: true, authorNodeId: string } | { ok: false, reason: string }}
+   * @private
+   */
+  _verifyFetched(cmb) {
+    const { verifyCMB, assertionIdV2_0, checkAudience } = require('./core');
+    const md = cmb.metadata;
+    if (!md.sig) return { ok: false, reason: 'unsigned' };
+    const authorKey = this._node._identityKey(md.createdByNodeId);
+    if (!authorKey) return { ok: false, reason: 'unresolvable-author' };
+    const v = verifyCMB(cmb, authorKey);
+    if (!v.valid) return { ok: false, reason: v.error || 'invalid' };
+    let derivedId = null;
+    try { derivedId = assertionIdV2_0(cmb); } catch { /* not a well-formed v2.0 record */ }
+    if (!derivedId || md.assertionId !== derivedId) return { ok: false, reason: 'assertion-id-mismatch' };
+    const aud = checkAudience(cmb, this._node._room, this._node.nodeId);
+    if (!aud.ok) return { ok: false, reason: aud.reason || 'audience' };
+    return { ok: true, authorNodeId: md.createdByNodeId };
   }
 
   _handleMemoryShare(peerId, peerName, msg, session) {
@@ -1837,13 +1907,17 @@ class FrameHandler {
    * @private
    */
   _handleMood(peerId, peerName, msg, session = null) {
-    if (typeof msg.mood !== 'string' || !msg.mood) return;
+    // The frame's one shape (MMP §9.3): a frame the schema does not define is refused, counted by
+    // the inbound guard. It names no sender, so it is the session's proven peer's, by that peer's name.
+    const why = moodFrameReason(msg);
+    if (why) throw new Error(`mood frame refused: ${why}`);
 
     const { h1: moodH1, h2: moodH2 } = encode(msg.mood);
     const mesh = this._node._meshNode;
     const drift = ((1 - cosineSimilarity(mesh.localH1, moodH1)) + (1 - cosineSimilarity(mesh.localH2, moodH2))) / 2;
 
-    const from = wireName(msg.fromName, peerName);
+    const from = peerName;
+    const context = msg.context === undefined ? null : msg.context;
 
     if (drift <= this._node._moodThreshold) {
       this._node._log(`Mood from ${from}: "${msg.mood.slice(0, 50)}" → ACCEPTED (drift: ${drift.toFixed(3)}, threshold: ${this._node._moodThreshold})`);
@@ -1851,7 +1925,7 @@ class FrameHandler {
       // key, assertion or author signature: `verification` is null). It travelled sealed on that
       // session, so the session's frozen facts come with it, by the inbox entry's field name.
       const facts = session && typeof this._node._sessionFacts === 'function' ? this._node._sessionFacts(session) : null;
-      this._node.emit('mood-delivered', Object.freeze({ from, mood: msg.mood, drift, context: msg.context, key: null, assertionId: null, authorNodeId: peerId, deliveredBy: Object.freeze({ nodeId: peerId, name: peerName }), verified: false, profile: facts ? facts.profile : null, verification: null, session: facts }));
+      this._node.emit('mood-delivered', Object.freeze({ from, mood: msg.mood, drift, context, key: null, assertionId: null, authorNodeId: peerId, deliveredBy: Object.freeze({ nodeId: peerId, name: peerName }), verified: false, profile: facts ? facts.profile : null, verification: null, session: facts }));
     } else {
       this._node._log(`Mood from ${from}: "${msg.mood.slice(0, 50)}" → IGNORED (drift: ${drift.toFixed(3)}, threshold: ${this._node._moodThreshold})`);
       this._node.emit('mood-rejected', { from, mood: msg.mood, drift });
diff --git a/lib/node.js b/lib/node.js
index 3786b983..b37370ef 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -32,6 +32,7 @@ const authorityMixin = require('./node-authority');
 const { parsePin } = require('./core/authority');
 const { RosterKeyRegistry, keyFingerprint } = require('./roster-keys');
 const { signedProjection, isLowerUuid } = require('./core/record-canonical');
+const { buildMoodFrame } = require('./core/mood-frame');
 /** A stored record's signed projection, or null for one that is not a v2.0 record. */
 const projectionOrNull = (cmb) => {
   if (!cmb || !cmb.metadata || cmb.metadata.signatureSuite !== 'mmp-sig-v2.0') return null;
@@ -881,20 +882,6 @@ class SymNode extends EventEmitter {
     if (b.bound) this._roster.noteVerified(nodeId);
   }
 
-  /**
-   * MMP §7 cmb-fetch: retrieve a CMB by content address from connected peers —
-   * the §15.8 re-verification path for lineage roots this store cannot resolve.
-   * Self-verifying: a response is accepted only if its recomputed content
-   * address equals the requested key (forged responses are discarded and
-   * reported), so no trust in the serving peer is required.
-   *
-   * @param {string} key - Content-address key. The SCHEME is the digest length
-   *   (64 hex = v1, 32 hex = legacy), not the prefix — v1 keys wear cmb1- or cmb-.
-   * @param {object} [opts]
-   * @param {number} [opts.timeoutMs=5000]
-   * @returns {Promise<{cmb: object, from: string, peerId: string}|null>} first
-   *   verified hit, or null when no connected peer serves a verifiable copy.
-   */
   /**
    * MMP §15.8 retroactive lineage-tether audit: apply the tether to chains
    * stored BEFORE the invariant existed (or received from pre-tether peers).
@@ -939,7 +926,8 @@ class SymNode extends EventEmitter {
           // answers from the store first — it would hand back the record that walk refused.
           if (this._store.get(k)) continue;
           const hit = await this.fetchCMB(k, { timeoutMs: opts.timeoutMs ?? 3000 });
-          if (hit?.cmb?.categories) { anchorCategories = hit.cmb.categories; anchorKey = k; report.fetched++; break; }
+          // The categories, whether or not the record verified: the key binds them (§15.8 MAY use them).
+          if (hit?.categories) { anchorCategories = hit.categories; anchorKey = k; report.fetched++; break; }
         }
       }
       if (!anchorCategories) { report.unchecked++; continue; }
@@ -986,11 +974,37 @@ class SymNode extends EventEmitter {
     return report;
   }
 
+  /**
+   * MMP §7 cmb-fetch: retrieve a record by its cognition key from connected peers — the §15.8 path
+   * for lineage roots this store cannot resolve. A copy whose recomputed key differs is discarded and
+   * reported, so no trust in the serving peer is needed for the categories. The key binds nothing
+   * else (§8.8.2), so the record is then verified by the whole of §8.8.5 (MMP 2.0 update 1, #26):
+   *
+   *   { key, verified: true,  cmb, categories, authorNodeId, from, peerId }  — it passed: a record
+   *   { key, verified: false, categories, reason, from, peerId }             — the categories only
+   *
+   * An unverified answer never carries the record's metadata, so nothing reads it as attributed. A
+   * record this node holds answers first: its own, or one it admitted verified, as a record; one held
+   * under Legacy Import as its categories only.
+   *
+   * @param {string} key - cognition key, cmb-<64 hex>
+   * @param {object} [opts]
+   * @param {number} [opts.timeoutMs=5000]
+   * @returns {Promise<object|null>} the first answer whose key matches, or null when none does.
+   */
   async fetchCMB(key, opts = {}) {
     if (!key || typeof key !== 'string') return null;
     const local = this._store.get(key);
-    if (local?.cmb) return { cmb: local.cmb, from: this.name, peerId: this.nodeId };
-    if (this._peers.size === 0) return null;
+    if (local?.cmb) {
+      const categories = local.cmb.categories;
+      const own = local.peerId == null;
+      if (own || local.verified === true) {
+        return { key, verified: true, cmb: local.cmb, categories, authorNodeId: own ? this.nodeId : (local.cmb.metadata?.createdByNodeId ?? null), from: this.name, peerId: this.nodeId };
+      }
+      return { key, verified: false, reason: local.profile === 'legacy-import' ? 'legacy-import' : 'unverified', categories, from: this.name, peerId: this.nodeId };
+    }
+    // Only a cognition key is asked for (cmb-fetch.schema.json): a peer refuses a request for anything else.
+    if (this._peers.size === 0 || !/^cmb-[0-9a-f]{64}$/.test(key)) return null;
     const timeoutMs = opts.timeoutMs ?? 5000;
     const reqId = `cf-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
     if (!this._cmbFetchPending) this._cmbFetchPending = new Map();
@@ -1020,7 +1034,7 @@ class SymNode extends EventEmitter {
           // The record answers before the result that lists it (design D1): the session is told now
           // that a record under `key` is this fetch's.
           this._frameHandler.expectFetched(peer.transport, key, reqId);
-          if (peer.transport.send({ type: 'cmb-fetch', reqId, key, from: this.nodeId, timestamp: Date.now() }) !== false) asked.add(peerId);
+          if (peer.transport.send({ type: 'cmb-fetch', reqId, key, timestamp: Date.now() }) !== false) asked.add(peerId);
         }
       }
       if (asked.size === 0) done(null);
@@ -3001,22 +3015,17 @@ class SymNode extends EventEmitter {
   // ── Mood (with cognitive evaluation) ───────────────────────
 
   /**
-   * Broadcast a mood frame to all connected peers.
-   * See MMP v0.2.0 Section 7 (Frame Types).
+   * Broadcast a mood frame to all connected peers (MMP §9.3): `{ type, mood, context, timestamp }`,
+   * sealed on each confirmed session. It names no sender; each receiver attributes it to the session
+   * it arrived on (lib/core/mood-frame).
    *
-   * @param {string} mood — mood text
+   * @param {string} mood — mood text, 1 to 1,024 characters
    * @param {object} [opts]
-   * @param {string} [opts.context] — optional context for the mood
+   * @param {string} [opts.context] — optional context for the mood, at most 4,096 characters
+   * @throws {RangeError} EMOODFRAME when either is out of bounds: nothing is sent
    */
   broadcastMood(mood, opts = {}) {
-    const frame = {
-      type: 'mood',
-      from: this._identity.nodeId,
-      fromName: this.name,
-      mood,
-      context: opts.context || null,
-      timestamp: Date.now(),
-    };
+    const frame = buildMoodFrame(mood, opts.context);
     this._broadcastToPeers(frame);
     this._wakeManager.wakeSleepingPeers('mood', frame);
     this._log(`Mood broadcast: "${mood.slice(0, 50)}"`);
@@ -3515,8 +3524,8 @@ class SymNode extends EventEmitter {
     session.on('refused', (type, reason) => this._noteSessionRefusal(session, type, reason));
     // A clear 1011 on a confirmed relay session: the peer restarted and holds no session with this
     // node. The client re-handshakes; the session stays until the new one supersedes it.
-    session.on('unknown-session', () => {
-      if (session.kind === 'relay' && this.nodeId < session.relayFrom && this._relay && this._relay.present.has(session.relayFrom)) this._startRelayClient(session.relayFrom);
+    session.on('unknown-session', (s, f) => {
+      if (session.kind === 'relay') this._onUnknownSession(session.relayFrom, f);
     });
     session.on('closed', (info) => {
       this._guardInbound(session.nodeId || '?', session.name || '?', { type: 'session-closed' }, kind, () => this._onSessionClosed(session, info));
@@ -3710,16 +3719,22 @@ class SymNode extends EventEmitter {
     const lastSent = this._lastAnchorSent.get(peer.peerId) || 0;
     const now = Date.now();
     let announced = false;
+    // MMP §9.4 (update 1, #30): a NON-EMPTY cmb-anchors at most once a minute per peer; the empty
+    // list goes on every admission. Only a list that was sent starts the minute: an admission with
+    // nothing to replay does not hold back the next one's context.
     if (now - lastSent >= 60000) {
-      keepPeerState(this._lastAnchorSent, peer.peerId, now, this._peers);
-      // Own emissions only (anti-echo, §15.7), and only records that can travel in Core Secure.
-      // Room-bound records only (review finding A): a record signed to one node is never replayed as
-      // context to another, whoever's session this is.
+      // Records this node authored itself under mmp-sig-v2.0 (§15.7: replay is not forwarding), and
+      // only ones it may seal into this session (§18.2.1): this session's room, and no recipient (a
+      // record signed to one node is never replayed as context to another, whoever's session this is).
+      const room = String(session.room ?? this._room).normalize('NFC');
       const anchors = this._store.recent(50)
         .filter((a) => a.cmb && a.peerId == null && a.cmb.metadata && a.cmb.metadata.signatureSuite === 'mmp-sig-v2.0' && a.cmb.metadata.sig
+          && a.cmb.metadata.createdByNodeId === this.nodeId
+          && typeof a.cmb.metadata.room === 'string' && a.cmb.metadata.room.normalize('NFC') === room
           && (a.cmb.metadata.to === null || a.cmb.metadata.to === undefined))
         .slice(0, 5);
       if (anchors.length > 0) {
+        keepPeerState(this._lastAnchorSent, peer.peerId, now, this._peers);
         announced = true;
         session.send({ type: 'cmb-anchors', keys: anchors.map((a) => a.cmb.metadata.key) });
         let sent = 0;
@@ -4032,6 +4047,43 @@ class SymNode extends EventEmitter {
     if (soonest !== Infinity) this._schedulePumpRelay(Math.max(50, soonest - now));
   }
 
+  /**
+   * A clear 1011 UNKNOWN_SESSION from relay `from` (MMP §5.2.2, update 1 #23). Anyone on the relay
+   * path can write one, so it prompts a new handshake only on the client side, only while the peer
+   * is present, only when its `detail` names a session this node holds with that peer or a probe
+   * ping to it is outstanding, while no newer session with it is waiting to supersede, and no faster
+   * than the handshake retry backoff (1 s, doubling, at most 30 s; it starts over after a quiet
+   * minute). The existing session stays until the new one supersedes it. Nothing else follows.
+   * @returns {string|null} why it prompted nothing, or null when it did
+   * @private
+   */
+  _onUnknownSession(from, frame) {
+    const st = this._relaySessions && this._relaySessions.get(from);
+    if (!(this.nodeId < from)) return 'unknown-session-server-role';
+    if (!st || !this._relay || !this._relay.present.has(from)) return 'unknown-session-no-peer';
+    const now = Date.now();
+    const m = frame && typeof frame.detail === 'string' ? /^session:([0-9a-f]{32})$/.exec(frame.detail) : null;
+    const held = [...st.confirmed].filter((x) => x.confirmed && !x.closed);
+    const names = !!m && held.some((x) => x.sessionId === m[1]);
+    const probed = held.find((x) => x.probeSince && now - x.probeSince <= this._handshakeTimeoutMs);
+    if (!names && !probed) return 'unknown-session-not-ours';
+    // A newer session with that peer is already waiting to supersede (or a handshake is in flight):
+    // another would only chain re-handshakes through the supersession window.
+    if ((st.client && !st.client.closed) || [...st.confirmed].some((x) => x._supersedes && !x.closed)) return 'unknown-session-superseding';
+    if (!this._unknownSessionPrompts) this._unknownSessionPrompts = new Map();
+    const g = this._unknownSessionPrompts.get(from) || { attempt: 0, at: -Infinity };
+    if (now - g.at > 60_000) g.attempt = 0;
+    if (now - g.at < Math.min(1000 * 2 ** Math.max(0, g.attempt - 1), 30_000)) return 'unknown-session-backoff';
+    g.attempt++;
+    g.at = now;
+    this._unknownSessionPrompts.delete(from);
+    if (this._unknownSessionPrompts.size >= 1024) this._unknownSessionPrompts.delete(this._unknownSessionPrompts.keys().next().value);
+    this._unknownSessionPrompts.set(from, g);
+    if (probed) probed.probeSince = 0;
+    this._startRelayClient(from);
+    return null;
+  }
+
   /** @private Tell relay `from` that `sessionId` (or, null, any session) is not held here (rate-limited per from). */
   _sayUnknownSession(from, sessionId) {
     if (!this._unknownSessionSaid) this._unknownSessionSaid = new Map();
@@ -4100,7 +4152,13 @@ class SymNode extends EventEmitter {
     const live = st && [...st.confirmed].find((x) => x.confirmed && !x.closed);
     if (live) {
       const now = Date.now();
-      if (now - (live._probedAt || 0) >= 1000) { live._probedAt = now; try { live.send({ type: 'ping' }); } catch { /* it closes itself */ } }
+      if (now - (live._probedAt || 0) >= 1000) {
+        live._probedAt = now;
+        // Outstanding until a pong comes back (lib/session.js): a 1011 while it is may prompt a
+        // re-handshake though it names no session (§5.2.2).
+        if (!live.probeSince) live.probeSince = now;
+        try { live.send({ type: 'ping' }); } catch { /* it closes itself */ }
+      }
       return;
     }
     this._startRelayClient(nodeId);
@@ -4241,7 +4299,8 @@ class SymNode extends EventEmitter {
         // one confirms and supersedes it; the server waits for the client's hello. A session's own
         // errors (1010 closing, 1009 identity conflict) arrive sealed, on the session.
         if (payload.code === UNKNOWN_SESSION_CODE) {
-          if (st && this.nodeId < from && this._relay.present.has(from)) this._startRelayClient(from);
+          const why = this._onUnknownSession(from, payload);
+          if (why) refuse(why);
           return;
         }
         refuse('clear-error-ignored');
diff --git a/lib/session.js b/lib/session.js
index f02db3f7..4325f8ce 100644
--- a/lib/session.js
+++ b/lib/session.js
@@ -301,12 +301,13 @@ class PeerSession extends EventEmitter {
       case CMB_ENCRYPTED: return this._openRecord(f);
       case CONTROL_ENCRYPTED: return this._openControl(f);
       case 'ping': this.lastSeen = Date.now(); this._wire({ type: 'pong' }); return;
-      case 'pong': this.lastSeen = Date.now(); return;
+      case 'pong': this.lastSeen = Date.now(); this.probeSince = 0; return;
       case 'error':
         // A CLEAR error on a confirmed session is anyone's to write (security review F): never a
         // command. Only 1011 UNKNOWN_SESSION means something — the peer holds no session with this
-        // node (it restarted) — and it prompts a new handshake while this session stays.
-        if (f.code === UNKNOWN_SESSION) { this.emit('unknown-session', this); return; }
+        // node (it restarted) — and it may prompt a new handshake while this session stays; the owner
+        // decides whether it names this session (§5.2.2).
+        if (f.code === UNKNOWN_SESSION) { this.emit('unknown-session', this, f); return; }
         this._refuse('error', 'clear-error-ignored');
         return;
       default:
@@ -368,6 +369,9 @@ class PeerSession extends EventEmitter {
     if (!plain) return;
     let inner;
     try { inner = parseControlPlain(plain); } catch (err) { this._refuse(f.type, `inner frame refused: ${err && err.message}`); return; }
+    // ping and pong may travel sealed too (§7.1): liveness, exactly as in clear.
+    if (inner.type === 'ping') { this._wire({ type: 'pong' }); return; }
+    if (inner.type === 'pong') { this.probeSince = 0; return; }
     if (inner.type === 'error') {
       // A SEALED error is the peer's own word. One whose §7.2 action is Close ends the session: 1009
       // it binds this node's nodeId to another key, 1010 it closed this session, and the other Close
diff --git a/tests/cmb-fetch-serves-v2.test.js b/tests/cmb-fetch-serves-v2.test.js
index 466d0784..81e95745 100644
--- a/tests/cmb-fetch-serves-v2.test.js
+++ b/tests/cmb-fetch-serves-v2.test.js
@@ -48,7 +48,7 @@ describe('cmb-fetch serving', () => {
       assert.deepStrictEqual(verifyCMB(cmb, pub).valid, true, 'precondition: the stored record verifies');
       node._store.get = (k) => (k === cmb.metadata.key ? { key: k, cmb } : null);
       const { res, record, recordFirst } = serve(node, cmb.metadata.key, 'r1');
-      assert.deepStrictEqual(res, { type: 'cmb-fetch-result', reqId: 'r1', returned: [cmb.metadata.key], missing: [], timestamp: res.timestamp }, 'the result carries only the id and the key lists');
+      assert.deepStrictEqual(res, { type: 'cmb-fetch-result', reqId: 'r1', returned: [cmb.metadata.key], missing: [] }, 'the result carries only the id and the key lists (no timestamp: cmb-fetch-result.schema.json)');
       assert.ok(recordFirst, 'the record goes first, in its own frame');
       for (const k of ['signatureSuite', 'addressScheme', 'createdByNodeId', 'application', 'assertionId']) {
         assert.ok(k in record.metadata, `${k} is served`);
diff --git a/tests/cmb-fetch.test.js b/tests/cmb-fetch.test.js
index e244b7ae..bd239050 100644
--- a/tests/cmb-fetch.test.js
+++ b/tests/cmb-fetch.test.js
@@ -39,6 +39,8 @@ function cat7(t) {
 // before sealing. A fetch is answered by each record in its own sealed record frame, then a sealed
 // cmb-fetch-result carrying only the correlation id and the returned / missing key lists (design D1).
 const { admitAs } = require('./_core-secure');
+/** A cognition key no node holds. */
+const NOWHERE = `cmb-${'ab'.repeat(32)}`;
 function fakePeer(node, peerId) {
   return admitAs(node, { nodeId: peerId, name: peerId });
 }
@@ -56,7 +58,7 @@ describe('MMP §7 cmb-fetch — content-addressed retrieval', () => {
       node._frameHandler.handle(peer, { type: 'cmb-fetch', key: root.key, reqId: 'r1' });
       const res = peer.sent.find((f) => f.type === 'cmb-fetch-result');
       assert.ok(res, 'responds');
-      assert.deepStrictEqual(Object.keys(res).sort(), ['missing', 'reqId', 'returned', 'timestamp', 'type'], 'the id and the key lists, never the record (it was plaintext; §18.2.1)');
+      assert.deepStrictEqual(Object.keys(res).sort(), ['missing', 'reqId', 'returned', 'type'], 'the id and the key lists, never the record (it was plaintext; §18.2.1), and no timestamp (cmb-fetch-result.schema.json)');
       assert.deepStrictEqual([res.reqId, res.returned, res.missing], ['r1', [root.key], []]);
       assert.ok(peer.sent.findIndex((f) => f.type === 'cmb') < peer.sent.indexOf(res), 'the record goes first');
       const rec = peer.sent.find((f) => f.type === 'cmb');
@@ -70,9 +72,9 @@ describe('MMP §7 cmb-fetch — content-addressed retrieval', () => {
   it('lists an unknown key as missing, and sends no record', async () => {
     await withNode('cfetch-miss', async (node) => {
       const peer = fakePeer(node, 'peerX');
-      node._frameHandler.handle(peer, { type: 'cmb-fetch', key: 'cmb1-doesnotexist', reqId: 'r2' });
+      node._frameHandler.handle(peer, { type: 'cmb-fetch', key: NOWHERE, reqId: 'r2' });
       const res = peer.sent.find((f) => f.type === 'cmb-fetch-result');
-      assert.deepStrictEqual([res.returned, res.missing], [[], ['cmb1-doesnotexist']]);
+      assert.deepStrictEqual([res.returned, res.missing], [[], [NOWHERE]]);
       assert.strictEqual(peer.sent.filter((f) => f.type === 'cmb').length, 0);
     });
   });
@@ -86,6 +88,8 @@ describe('MMP §7 cmb-fetch — content-addressed retrieval', () => {
       const served = toB.sent.find((f) => f.type === 'cmb').cmb;
 
       await withNode('cfetch-req', async (nodeB) => {
+        // nodeB has proven nodeA's key (D4: a fetched record is attributed only after §8.8.5).
+        nodeB._roster.bind(nodeA.nodeId, nodeA._identity.publicKey, 'proven');
         const a = fakePeer(nodeB, 'peerA');
         const evil = fakePeer(nodeB, 'peerEvil');
         const p = nodeB.fetchCMB(root.key, { timeoutMs: 2000 });
@@ -103,88 +107,71 @@ describe('MMP §7 cmb-fetch — content-addressed retrieval', () => {
         const hit = await p;
         assert.ok(hit, 'verified response resolves');
         assert.strictEqual(hit.from, 'peerA', 'the forged response did not win');
+        assert.strictEqual(hit.verified, true);
+        assert.strictEqual(hit.authorNodeId, nodeA.nodeId);
         assert.strictEqual(hit.cmb.metadata.key, root.key);
       });
     });
   });
 
-  it('a PRE-BOUNDARY record is accepted, not discarded as forged (core 0.8.1 regression guard)', async () => {
-    // THE REGRESSION THIS EXISTS TO CATCH, measured before it shipped:
-    //
-    // This call site used to dispatch on `cmb.metadata` and call core's `recomputeKey` for
-    // records without it — a workaround for recomputeKey being broken (it read `cmb.key`, absent
-    // on v2 records, and derived roots with the FLAT scheme while createCMB minted MERKLE).
-    // core 0.8.1 fixed recomputeKey, and the workaround became a regression the instant it did:
-    // a pre-boundary record with a flat root key recomputed to the MERKLE address, mismatched,
-    // and was DISCARDED AS FORGED. The whole legacy DAG would have been dropped on fetch.
-    //
-    // sym's suite was 309/309 green through all of that, because no test served a record of this
-    // shape. That is the point of this one: the fix is not "bump the dependency", it is "check
-    // what the dependency now returns for the records you actually hold".
+  it('a record that is not a signed v2.0 record answers nothing: Core Secure serves only those (MMP 2.0 update 1, D4)', async () => {
+    // Until the update this took a pre-boundary record (no metadata, a flat key) on its address
+    // alone. Over Core Secure a server sends only signed v2.0 records, and a fetched record passes
+    // the whole of §8.8.5 before it is attributed; one that has no v2.0 metadata cannot.
     const { cmbKeyV1 } = require('../lib/core');
     await withNode('cfetch-legacy', async (nodeB) => {
       const a = fakePeer(nodeB, 'peerA');
       const categories = cat7('a pre-boundary block minted before the merkle cutover');
-      // Pre-boundary wire shape: NO `metadata`, address at the top level, FLAT root derivation.
       const legacy = { categories, key: cmbKeyV1(categories) };
-
-      const p = nodeB.fetchCMB(legacy.key, { timeoutMs: 2000 });
+      const p = nodeB.fetchCMB(NOWHERE, { timeoutMs: 2000 });
       const reqId = [...nodeB._cmbFetchPending.keys()][0];
-      // (Over Core Secure a server sends only a v2.0 record; the requester's address check, the one
-      // under test, still takes a pre-boundary one.)
-      answer(nodeB, a, reqId, legacy.key, legacy);
-
-      const hit = await p;
-      assert.ok(hit, 'a legitimate pre-boundary record must VERIFY, not be discarded as forged');
-      assert.strictEqual(hit.cmb.key, legacy.key);
+      answer(nodeB, a, reqId, NOWHERE, legacy);
+      assert.strictEqual(await p, null);
     });
   });
 
-  it('an UNVERIFIABLE response is distinguished from a FORGED one in telemetry', async () => {
-    // The three classes must not merge here either. A record we cannot read is a compatibility
-    // problem; a record whose content does not match its key is an attack. Both are discarded —
-    // and both used to arrive as a bare `null` that this call site reported as a mismatch,
-    // accusing a record it had merely failed to read.
-    await withNode('cfetch-classes', async (nodeB) => {
-      const a = fakePeer(nodeB, 'peerA');
-      const metrics = [];
-      nodeB.on('metric', (m) => { if (m.type === 'cmb-fetch-forged') metrics.push(m); });
-
-      const categories = cat7('content that will be served without any container at all');
-      const { cmbKeyV1 } = require('../lib/core');
-      const key = cmbKeyV1(categories);
-
-      const p = nodeB.fetchCMB(key, { timeoutMs: 600 });
-      const reqId = [...nodeB._cmbFetchPending.keys()][0];
-      // Same key, NO container — unreadable rather than altered.
-      answer(nodeB, a, reqId, key, { key });
-      await p;
-
-      assert.strictEqual(metrics.length, 1);
-      assert.strictEqual(metrics[0].verdict, 'cannot-verify',
-        'an unreadable record must not be reported as a content mismatch');
+  it('a response that does not match its key is told apart from one that is malformed, in telemetry', async () => {
+    // The classes must not merge: a record whose content does not match its key is an attack; a
+    // record that is not a record is a compatibility problem. Both are discarded.
+    await withNode('cfetch-classes', async (nodeA) => {
+      const root = nodeA.remember(cat7('content served twice, once altered and once broken'));
+      const toB = fakePeer(nodeA, 'peerB');
+      nodeA._frameHandler.handle(toB, { type: 'cmb-fetch', key: root.key, reqId: 'wire' });
+      const served = toB.sent.find((f) => f.type === 'cmb').cmb;
+      await withNode('cfetch-classes-b', async (nodeB) => {
+        const a = fakePeer(nodeB, 'peerA');
+        const c = fakePeer(nodeB, 'peerC');
+        const metrics = [];
+        nodeB.on('metric', (m) => { if (m.type === 'cmb-fetch-forged') metrics.push(m); });
+        const p = nodeB.fetchCMB(root.key, { timeoutMs: 600 });
+        const reqId = [...nodeB._cmbFetchPending.keys()][0];
+        const altered = JSON.parse(JSON.stringify(served)); altered.categories.focus.text = 'other words under the same key';
+        const broken = JSON.parse(JSON.stringify(served)); delete broken.categories;
+        answer(nodeB, a, reqId, root.key, altered);
+        answer(nodeB, c, reqId, root.key, broken);
+        await p;
+        assert.deepStrictEqual(metrics.map((m) => m.verdict), ['mismatch', 'malformed']);
+      });
     });
   });
 
-  it('serves several keys in one request: each returned record in its own frame, then one result', async () => {
+  it('a request names one key: a keys array is refused, not served', async () => {
     await withNode('cfetch-multi', async (node) => {
       const r1 = node.remember(cat7('the first record of a multi-key fetch about avalanche risk'));
-      const r2 = node.remember(cat7('the second record of a multi-key fetch about lift closures'));
       const peer = fakePeer(node, 'peerX');
-      node._frameHandler.handle(peer, { type: 'cmb-fetch', keys: [r1.key, 'cmb1-missing', r2.key, r1.key], reqId: 'm1' });
-      assert.deepStrictEqual(peer.sent.map((f) => f.type), ['cmb', 'cmb', 'cmb-fetch-result']);
-      const res = peer.sent[2];
-      assert.deepStrictEqual([res.returned, res.missing], [[r1.key, r2.key], ['cmb1-missing']], 'each key once');
+      node._receiveSessionFrame(peer, { type: 'cmb-fetch', key: r1.key, keys: [r1.key], reqId: 'm1' });
+      assert.deepStrictEqual(peer.sent, []);
+      assert.strictEqual(node._metrics.framesRefusedByType['cmb-fetch'], 1);
     });
   });
 
   it('a result that lists the key as returned closes the request for that peer when no verifying record came first', async () => {
     await withNode('cfetch-found-nothing', async (node) => {
       const a = fakePeer(node, 'peerA');
-      const p = node.fetchCMB('cmb1-claimed', { timeoutMs: 3000 });
+      const p = node.fetchCMB(NOWHERE, { timeoutMs: 3000 });
       const reqId = [...node._cmbFetchPending.keys()][0];
       const t0 = Date.now();
-      node._frameHandler.handle(a, { type: 'cmb-fetch-result', reqId, returned: ['cmb1-claimed'], missing: [] });
+      node._frameHandler.handle(a, { type: 'cmb-fetch-result', reqId, returned: [NOWHERE], missing: [] });
       assert.strictEqual(await p, null);
       assert.ok(Date.now() - t0 < 1000, 'closed by the result, not by the timeout');
       assert.strictEqual(a._fetchExpect.size, 0, 'the expectation is let go');
@@ -204,9 +191,9 @@ describe('MMP §7 cmb-fetch — content-addressed retrieval', () => {
   it('fetchCMB times out to null when every peer misses', async () => {
     await withNode('cfetch-timeout', async (node) => {
       const peer = fakePeer(node, 'peerX');
-      const p = node.fetchCMB('cmb1-nowhere', { timeoutMs: 300 });
+      const p = node.fetchCMB(NOWHERE, { timeoutMs: 300 });
       const reqId = [...node._cmbFetchPending.keys()][0];
-      answer(node, peer, reqId, 'cmb1-nowhere', null);
+      answer(node, peer, reqId, NOWHERE, null);
       assert.strictEqual(await p, null);
     });
   });
diff --git a/tests/inbound-frame-guard.test.js b/tests/inbound-frame-guard.test.js
index 5155fc87..512905da 100644
--- a/tests/inbound-frame-guard.test.js
+++ b/tests/inbound-frame-guard.test.js
@@ -119,7 +119,7 @@ describe('a mood frame on a stock node (G2)', () => {
     node.on('mood-rejected', (d) => out.push(['rejected', d]));
     try {
       const p = admitAs(node, { nodeId: 'p' });
-      node._frameHandler.handle(p, { type: 'mood', mood: 'tired', fromName: 'p' });
+      node._frameHandler.handle(p, { type: 'mood', mood: 'tired' });
       assert.strictEqual(out.length, 1);
       assert.strictEqual(typeof out[0][1].drift, 'number');
       assert.ok(out[0][1].drift >= 0 && out[0][1].drift <= 2, `drift ${out[0][1].drift} is a cosine drift`);
@@ -127,8 +127,10 @@ describe('a mood frame on a stock node (G2)', () => {
       const entry = node.remember({ focus: 'own work after a mood frame', issue: 'none', intent: 'x', motivation: 'y', commitment: 'z', perspective: 'me', mood: { text: 'calm', valence: 0, arousal: 0 } });
       assert.ok(entry, 'remember() still works (in 0.13.16 it threw for two minutes after one mood frame)');
       assert.ok(Array.isArray(node.peers()));
-      for (const mood of [42, { text: 'x' }, null, '']) node._frameHandler.handle(p, { type: 'mood', mood });
+      // Refused through the guard (MMP 2.0 update 1: the mood frame is the schema's or refused, counted).
+      for (const mood of [42, { text: 'x' }, null, '']) node._receiveSessionFrame(p, { type: 'mood', mood });
       assert.strictEqual(out.length, 1, 'a mood that is not text is not a mood');
+      assert.strictEqual(node._metrics.framesRefusedByType.mood, 4);
     } finally { node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
   });
 
diff --git a/tests/spec-update-frames.test.js b/tests/spec-update-frames.test.js
new file mode 100644
index 00000000..4577ab04
--- /dev/null
+++ b/tests/spec-update-frames.test.js
@@ -0,0 +1,279 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME before lib/config loads
+
+/**
+ * The session frames as MMP 2.0 update 1 (meshcognition-website PR #43, 2660ab9) defines them: the
+ * mood frame by the founder's ruling, cmb-fetch and cmb-fetch-result as their schemas close them,
+ * fetched records verified by the whole of §8.8.5 (D4), cmb-anchors as §9.4 sends it, a clear 1011
+ * acted on only when it names this node's session or answers its probe, sealed ping and pong, and the
+ * control envelope's bounds. Each test fails on 958592a.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const crypto = require('crypto');
+const { SymNode } = require('../lib/node');
+const { NullDiscovery } = require('../lib/discovery');
+const { nodeDirById } = require('../lib/config');
+const { isControlFrame, buildControlFrame } = require('../lib/core/sealed-control');
+const { identity, connectNodes, until, signedRecord, signerOf, admitAs, deliver } = require('./_core-secure');
+
+const uniq = (b) => `${b}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+const made = [];
+function node(base, opts = {}) {
+  const n = new SymNode({ name: uniq(base), silent: true, discovery: new NullDiscovery(), room: 'frames', ...opts });
+  made.push(n);
+  return n;
+}
+async function stopAll() {
+  for (const n of made.splice(0)) { try { await n.stop(); } catch { /* */ } try { fs.rmSync(nodeDirById(n.nodeId), { recursive: true, force: true }); } catch { /* */ } }
+}
+const sessionTo = (n, other) => { const p = n._peers.get(other.nodeId); return p && p.transport; };
+/** Every inner frame `n` sends on `session`, captured before it is sealed. */
+function capture(session) {
+  const out = [];
+  const real = session.trySend.bind(session);
+  session.trySend = (f) => { out.push(JSON.parse(JSON.stringify(f))); return real(f); };
+  return out;
+}
+const HEX = () => crypto.randomBytes(32).toString('hex');
+
+describe('the mood frame: {type, mood, context, timestamp} (founder ruling, #26)', () => {
+  it('is sent with no sender fields, and the text and context are bounded', async () => {
+    try {
+      const A = node('m-a'); const B = node('m-b');
+      await A.start(); await B.start();
+      await connectNodes(B, A);
+      const sent = capture(sessionTo(A, B));
+      A.broadcastMood('calm, focused', { context: 'after the review' });
+      const f = sent.find((x) => x.type === 'mood');
+      assert.deepStrictEqual(Object.keys(f).sort(), ['context', 'mood', 'timestamp', 'type']);
+      assert.strictEqual(f.context, 'after the review');
+      assert.throws(() => A.broadcastMood('x'.repeat(1025)), (e) => e.code === 'EMOODFRAME');
+      assert.throws(() => A.broadcastMood('ok', { context: 'c'.repeat(4097) }), (e) => e.code === 'EMOODFRAME');
+      assert.doesNotThrow(() => A.broadcastMood('\u{1F600}'.repeat(1024)), '1,024 characters, counted as code points');
+    } finally { await stopAll(); }
+  });
+
+  it('on receipt it is the session\'s proven peer\'s, by that peer\'s name; a frame naming a sender is refused', async () => {
+    try {
+      const A = node('m-recv');
+      A._moodThreshold = 2; // accept any drift: the label is what is tested
+      const P = identity('proven-peer');
+      const s = admitAs(A, P);
+      const got = [];
+      A.on('mood-delivered', (e) => got.push(e));
+      deliver(A, s, { type: 'mood', mood: 'calm', context: null, timestamp: 1 });
+      assert.strictEqual(got.length, 1);
+      assert.strictEqual(got[0].from, 'proven-peer');
+      assert.strictEqual(got[0].authorNodeId, P.nodeId);
+      const refusedBefore = A._metrics.framesRefusedByType.mood || 0;
+      deliver(A, s, { type: 'mood', from: P.nodeId, fromName: 'mallory', mood: 'calm', context: null, timestamp: 1 });
+      deliver(A, s, { type: 'mood', mood: 'x'.repeat(1025) });
+      deliver(A, s, { type: 'mood', mood: 'calm', valence: 0.5 });
+      assert.strictEqual(got.length, 1, 'none of the three is delivered');
+      assert.strictEqual((A._metrics.framesRefusedByType.mood || 0) - refusedBefore, 3);
+    } finally { await stopAll(); }
+  });
+});
+
+describe('cmb-fetch and cmb-fetch-result as their schemas close them (#26)', () => {
+  it('a fetch names no sender, and its result carries no timestamp', async () => {
+    try {
+      const A = node('f-a'); const B = node('f-b');
+      await A.start(); await B.start();
+      await connectNodes(B, A);
+      const asked = capture(sessionTo(A, B));
+      const answered = capture(sessionTo(B, A));
+      const r = await A.fetchCMB(`cmb-${HEX()}`, { timeoutMs: 1500 });
+      assert.strictEqual(r, null);
+      const fetch = asked.find((f) => f.type === 'cmb-fetch');
+      assert.deepStrictEqual(Object.keys(fetch).sort(), ['key', 'reqId', 'timestamp', 'type']);
+      const result = answered.find((f) => f.type === 'cmb-fetch-result');
+      assert.deepStrictEqual(Object.keys(result).sort(), ['missing', 'reqId', 'returned', 'type']);
+    } finally { await stopAll(); }
+  });
+
+  it('a fetch carrying a keys array, or a from, is refused, not served', async () => {
+    try {
+      const A = node('f-srv');
+      const own = signedRecord(signerOf(A), { room: A._room, categories: { focus: 'served once' } });
+      A._store.receiveFromPeer('self', { key: own.metadata.key, content: 'x', source: A.name, cmb: own, _cmbVerified: true });
+      const s = admitAs(A, identity('asker'));
+      deliver(A, s, { type: 'cmb-fetch', reqId: 'r1', key: own.metadata.key, keys: [own.metadata.key] });
+      deliver(A, s, { type: 'cmb-fetch', reqId: 'r2', key: own.metadata.key, from: s.nodeId });
+      assert.deepStrictEqual(s.sent, [], 'neither is answered');
+      assert.strictEqual(A._metrics.framesRefusedByType['cmb-fetch'], 2);
+      deliver(A, s, { type: 'cmb-fetch', reqId: 'r3', key: own.metadata.key });
+      assert.deepStrictEqual(s.sent.map((f) => f.type), ['cmb', 'cmb-fetch-result']);
+    } finally { await stopAll(); }
+  });
+});
+
+describe('D4: a fetched record is attributed only after the whole of §8.8.5 (#26)', () => {
+  it('a record whose author this node cannot resolve comes back as its categories only, unverified', async () => {
+    try {
+      const A = node('d4-a'); const B = node('d4-b');
+      await A.start(); await B.start();
+      await connectNodes(B, A);
+      const M = identity('stranger');
+      const root = signedRecord(M, { room: B._room, categories: { focus: 'a lineage root by a stranger' } });
+      B._store.receiveFromPeer(M.nodeId, { key: root.metadata.key, content: 'x', source: 'stranger', cmb: root, _cmbVerified: true });
+      const r = await A.fetchCMB(root.metadata.key, { timeoutMs: 3000 });
+      assert.ok(r, 'answered');
+      assert.strictEqual(r.verified, false);
+      assert.strictEqual(r.reason, 'unresolvable-author');
+      assert.strictEqual(r.cmb, undefined, 'no metadata handed out as if attributed');
+      assert.strictEqual(r.categories.focus.text, 'a lineage root by a stranger');
+    } finally { await stopAll(); }
+  });
+
+  it('a record by an author this node has proven comes back verified, with its author', async () => {
+    try {
+      const A = node('d4v-a'); const B = node('d4v-b');
+      await A.start(); await B.start();
+      await connectNodes(B, A);
+      const own = signedRecord(signerOf(B), { room: B._room, categories: { focus: 'by the serving node itself' } });
+      B._store.receiveFromPeer('self-older', { key: own.metadata.key, content: 'x', source: B.name, cmb: own, _cmbVerified: true });
+      const r = await A.fetchCMB(own.metadata.key, { timeoutMs: 3000 });
+      assert.strictEqual(r.verified, true);
+      assert.strictEqual(r.authorNodeId, B.nodeId);
+      assert.strictEqual(r.cmb.metadata.assertionId, own.metadata.assertionId);
+    } finally { await stopAll(); }
+  });
+
+  it('a record it holds under Legacy Import answers as its categories only', async () => {
+    try {
+      const A = node('d4-local');
+      const rec = signedRecord(identity('legacy'), { room: A._room, categories: { focus: 'imported' } });
+      A._store.receiveFromPeer('legacy', { key: rec.metadata.key, content: 'x', source: 'legacy', cmb: rec, _cmbVerified: false });
+      const e = A._store.get(rec.metadata.key); e.verified = false; e.profile = 'legacy-import';
+      const r = await A.fetchCMB(rec.metadata.key);
+      assert.strictEqual(r.verified, false);
+      assert.strictEqual(r.cmb, undefined);
+    } finally { await stopAll(); }
+  });
+});
+
+describe('cmb-anchors (§9.4, #30)', () => {
+  it('an admission with nothing to replay does not hold back the next one\'s context', async () => {
+    try {
+      const A = node('an-a');
+      const P = identity('peer');
+      const peer = { peerId: P.nodeId, name: 'peer' };
+      const s1 = admitAs(A, P);
+      A._greetSession(peer, s1, true);
+      assert.deepStrictEqual(s1.sent.filter((f) => f.type === 'cmb-anchors').map((f) => f.keys), [[]]);
+      A.remember({ focus: 'my own context', issue: 'i', intent: 'n', motivation: 'm', commitment: 'c', perspective: 'p', mood: { text: 'calm' } });
+      const s2 = admitAs(A, P);
+      A._greetSession(peer, s2, false);
+      const anchors = s2.sent.filter((f) => f.type === 'cmb-anchors');
+      assert.strictEqual(anchors.length, 1);
+      assert.strictEqual(anchors[0].keys.length, 1, 'the record made after the empty list is replayed');
+      const s3 = admitAs(A, P);
+      A._greetSession(peer, s3, false);
+      assert.deepStrictEqual(s3.sent.filter((f) => f.type === 'cmb-anchors').map((f) => f.keys), [[]], 'a non-empty list at most once a minute; the empty one every time');
+    } finally { await stopAll(); }
+  });
+
+  it('a record signed for another room is not replayed, nor announced', async () => {
+    try {
+      const A = node('an-room');
+      const old = signedRecord(signerOf(A), { room: 'elsewhere', categories: { focus: 'said in another room' } });
+      A._store.write('x', { cmb: old });
+      const s = admitAs(A, identity('peer'));
+      A._greetSession({ peerId: s.nodeId, name: 'peer' }, s, true);
+      assert.deepStrictEqual(s.sent.filter((f) => f.type === 'cmb-anchors').map((f) => f.keys), [[]]);
+      assert.strictEqual(s.sent.filter((f) => f.type === 'cmb').length, 0);
+    } finally { await stopAll(); }
+  });
+
+  it('a cmb-anchors frame that is not the schema\'s is refused whole', async () => {
+    try {
+      const A = node('an-recv');
+      const s = admitAs(A, identity('peer'));
+      deliver(A, s, { type: 'cmb-anchors', keys: Array.from({ length: 51 }, () => `cmb-${HEX()}`) });
+      deliver(A, s, { type: 'cmb-anchors', keys: ['not-a-key'] });
+      deliver(A, s, { type: 'cmb-anchors', keys: [], note: 'x' });
+      assert.strictEqual(A._metrics.framesRefusedByType['cmb-anchors'], 3);
+      deliver(A, s, { type: 'cmb-anchors', keys: [`cmb-${HEX()}`] });
+      assert.strictEqual(s._anchorKeys.size, 1);
+    } finally { await stopAll(); }
+  });
+});
+
+describe('a clear 1011 over a relay (§5.2.2, #23)', () => {
+  function relayClient() {
+    const A = node('u-a');
+    const from = 'ffffffff-ffff-7fff-bfff-ffffffffffff'; // larger than any v7 nodeId: A is the client
+    const held = { confirmed: true, closed: false, sessionId: crypto.randomBytes(16).toString('hex'), probeSince: 0 };
+    A._relay = { present: new Set([from]), sendTo() {} };
+    A._relaySessions = new Map([[from, { client: null, server: null, confirmed: new Set([held]) }]]);
+    const started = [];
+    A._startRelayClient = (id) => started.push(id);
+    return { A, from, held, started };
+  }
+  it('prompts a handshake only when its detail names this node\'s session or its probe is outstanding', async () => {
+    try {
+      const { A, from, held, started } = relayClient();
+      A._relayEnvelope(from, 'peer', { type: 'error', code: 1011, message: 'unknown session' });
+      A._relayEnvelope(from, 'peer', { type: 'error', code: 1011, message: 'unknown session', detail: `session:${'0'.repeat(32)}` });
+      assert.deepStrictEqual(started, [], 'no detail, or another session: nothing');
+      A._relayEnvelope(from, 'peer', { type: 'error', code: 1011, message: 'unknown session', detail: `session:${held.sessionId}` });
+      assert.deepStrictEqual(started, [from]);
+    } finally { await stopAll(); }
+  });
+  it('prompts nothing while a newer session with that peer waits to supersede the one named', async () => {
+    try {
+      const { A, from, held, started } = relayClient();
+      const waiting = { confirmed: true, closed: false, sessionId: crypto.randomBytes(16).toString('hex'), _supersedes: held };
+      A._relaySessions.get(from).confirmed.add(waiting);
+      A._relayEnvelope(from, 'peer', { type: 'error', code: 1011, message: 'unknown session', detail: `session:${held.sessionId}` });
+      assert.deepStrictEqual(started, []);
+    } finally { await stopAll(); }
+  });
+  it('a probe outstanding is answered by a 1011 with no detail; the prompts are paced by the retry backoff', async () => {
+    try {
+      const { A, from, held, started } = relayClient();
+      held.probeSince = Date.now();
+      A._relayEnvelope(from, 'peer', { type: 'error', code: 1011, message: 'unknown session' });
+      assert.strictEqual(started.length, 1);
+      for (let i = 0; i < 20; i++) A._relayEnvelope(from, 'peer', { type: 'error', code: 1011, message: 'unknown session', detail: `session:${held.sessionId}` });
+      assert.strictEqual(started.length, 1, 'forged repeats within the backoff prompt nothing more');
+    } finally { await stopAll(); }
+  });
+});
+
+describe('ping and pong sealed, and the control envelope\'s bounds (§7.1, #26)', () => {
+  it('a sealed ping is answered with a pong; a sealed pong ends an outstanding probe', async () => {
+    try {
+      const A = node('p-a'); const B = node('p-b');
+      await A.start(); await B.start();
+      await connectNodes(B, A);
+      const sA = sessionTo(A, B); const sB = sessionTo(B, A);
+      const refused = [];
+      sB.on('refused', (t, r) => refused.push([t, r]));
+      const wired = [];
+      const realWire = sB._wire.bind(sB);
+      sB._wire = (f) => { wired.push(f.type); return realWire(f); };
+      sA.probeSince = Date.now();
+      const pos = sA._mmp.nextSend();
+      sA._wire(buildControlFrame({ frame: { type: 'ping' }, sessionId: sA.sessionId, direction: pos.direction, sequence: pos.sequence, trafficKey: pos.trafficKey }));
+      await until(() => wired.includes('pong'), 1000);
+      assert.ok(wired.includes('pong'));
+      assert.deepStrictEqual(refused, []);
+      await until(() => sA.probeSince === 0, 1000);
+      assert.strictEqual(sA.probeSince, 0);
+    } finally { await stopAll(); }
+  });
+  it('an envelope with a 30-digit sequence, a sealed value shorter than the tag, or another member is not a control envelope', () => {
+    const ok = { type: 'control-encrypted', protocolVersion: '2.0', suite: 'X25519-HKDF-SHA256-ChaCha20-Poly1305', sessionId: 'a'.repeat(32), sequence: '1', direction: 'client-to-server', sealed: 'A'.repeat(22) };
+    assert.strictEqual(isControlFrame(ok), true);
+    assert.strictEqual(isControlFrame({ ...ok, sequence: '1'.repeat(30) }), false);
+    assert.strictEqual(isControlFrame({ ...ok, sealed: 'A'.repeat(21) }), false);
+    assert.strictEqual(isControlFrame({ ...ok, note: 'x' }), false);
+    assert.strictEqual(isControlFrame({ ...ok, sessionId: 'not-hex' }), false);
+  });
+});
diff --git a/tests/wire-fromname.test.js b/tests/wire-fromname.test.js
index 4867ee96..5267a2b0 100644
--- a/tests/wire-fromname.test.js
+++ b/tests/wire-fromname.test.js
@@ -25,8 +25,25 @@ const { admitAs, deliver, identity } = require('./_core-secure');
 
 describe('a frame\'s fromName is taken as text (R5)', () => {
   // 0.14: frames arrive on a confirmed session (design D1); the session's proven name is the fallback.
+  // MMP 2.0 update 1 (founder ruling): the mood frame names no sender. A mood frame carrying any
+  // fromName is not that frame and is refused; the event is labelled with the session's proven name.
+  it('mood: a frame naming a sender is refused, whatever its fromName; the session\'s name labels the rest', () => {
+    const name = uniq('fromname-mood');
+    const node = new SymNode({ name, silent: true, discovery: new NullDiscovery(), room: 'g' });
+    const froms = [];
+    for (const e of ['mood-delivered', 'mood-rejected']) node.on(e, (d) => froms.push(d.from));
+    try {
+      const session = admitAs(node, identity('peer-p'));
+      for (const fromName of [BAD, 42, ['x'], { a: 1 }, null, 'its own label']) {
+        assert.strictEqual(deliver(node, session, { type: 'mood', mood: 'calm and focused', fromName }), false, 'refused');
+      }
+      assert.deepStrictEqual(froms, []);
+      assert.strictEqual(deliver(node, session, { type: 'mood', mood: 'calm and focused' }), true);
+      assert.deepStrictEqual(froms, ['peer-p']);
+    } finally { node.stop(); fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
+  });
+
   for (const [type, frame, event, fromOf] of [
-    ['mood', { type: 'mood', mood: 'calm and focused' }, ['mood-delivered', 'mood-rejected'], (args) => args[0].from],
     ['xmesh-insight', { type: 'xmesh-insight', anomaly: 0.1, remixScore: 0.2, coherence: 0.3 }, 'xmesh-insight', (args) => args[0].from],
   ]) {
     it(`${type}: a fromName that is not text is not printed or passed on; the session's name is used`, () => {

From c0e615f8e90278c3365772484ffde9f9bfeb51d9 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 8 Oct 2026 11:50:39 +0100
Subject: [PATCH 129/148] =?UTF-8?q?rooms=20are=20=C2=A75.8=20identifiers?=
 =?UTF-8?q?=20everywhere;=20an=20absent=20application=20is=20null;=20appli?=
 =?UTF-8?q?cation.schema=20NFC?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

From the PR #43 verification (coordinator, 2026-10-08; the hold on #34's application rule lifted):

- An absent application projects to null (§8.8.4: both sign as lp("0")). Every published record
  spells it so, and encrypted-cmb-frame.schema.json requires the member: sym's sealed records with
  no application were schema-invalid (the reviewer reproduced it with buildEncryptedFrame). The
  record-projection-v2 vector now matches with no exception, byte for byte, as does lib.mjs's
  recordProjectionV2.
- One room grammar, §5.8's [a-z0-9._-] of 1 to 64 characters (lib/core/room-id): a node's own room
  (SymNode throws EBADROOM), the handshake hello, a record's signed room (received and minted), an
  attestation's room (was any text up to 256), and rooms.isValidRoom, which refused §5.8-valid
  dotted and underscored rooms (the spec's recommended acme.prod among them). `sym` stays refused and
  unownable while per-room service types exist (§5.1 migration). Being ASCII, a room is its own NFC
  form: the NFC tests for rooms become refusals.
- application.schema is signed as NFC(schema): minted NFC, and refused on receipt when it is not.
- legacyServiceType(room): the per-room DNS-SD type earlier releases used, only where it is a valid
  RFC 6335 service name (for the §5.1 migration browse).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QRVMpaJkAA2fFbvuHCEzqH
---
 lib/core/attestation.js            |  3 +-
 lib/core/cmb-encoder.js            |  9 ++++--
 lib/core/record-canonical.js       | 34 +++++++++++---------
 lib/core/room-grant.js             | 21 +++++--------
 lib/core/room-id.js                | 31 ++++++++++++++++++
 lib/node.js                        | 11 +++++--
 lib/rooms.js                       | 37 ++++++++++------------
 lib/session.js                     |  3 +-
 tests/core-secure-rereview.test.js | 16 +++++-----
 tests/core-secure-review.test.js   |  6 ++--
 tests/room-join-auth.test.js       |  2 +-
 tests/rooms.test.js                | 15 ++++++---
 tests/spec-update-records.test.js  | 50 ++++++++++++++++++++----------
 tests/spec-update-vectors.test.js  |  3 +-
 tests/sym-attest-v1.test.js        |  8 +++--
 15 files changed, 154 insertions(+), 95 deletions(-)
 create mode 100644 lib/core/room-id.js

diff --git a/lib/core/attestation.js b/lib/core/attestation.js
index bbf3f501..42cd5365 100644
--- a/lib/core/attestation.js
+++ b/lib/core/attestation.js
@@ -250,7 +250,8 @@ const ATTESTATION_MEMBERS = new Set(['of', 'assertionId', 'by', 'at', 'room', 'm
 const HEX64 = /^[0-9a-f]{64}$/;
 const SIG_RE = /^[A-Za-z0-9_-]{86}$/;
 const isId = (v) => typeof v === 'string' && ID_RE.test(v);
-const isRoom = (v) => typeof v === 'string' && v.length > 0 && v.length <= 256;
+// A room is a §5.8 identifier (sym-attest-frame.schema.json `room`, MMP 2.0 update 1).
+const { isRoomId: isRoom } = require('./room-id');
 const isTime = (v) => Number.isSafeInteger(v) && v >= 0;
 const isPos = (v) => Number.isSafeInteger(v) && v >= 1;
 
diff --git a/lib/core/cmb-encoder.js b/lib/core/cmb-encoder.js
index dbfe62a0..ad46cc38 100644
--- a/lib/core/cmb-encoder.js
+++ b/lib/core/cmb-encoder.js
@@ -16,6 +16,7 @@
  */
 
 const crypto = require('crypto');
+const { isRoomId } = require('./room-id');
 const { encode, DIM } = require('./context-encoder');
 const { CAT7_CATEGORIES } = require('./cmb');
 // record-shape requires nothing, so this cannot cycle. It is the ONE answer to "where is the
@@ -674,7 +675,7 @@ function createCMB(opts = {}) {
     lineage: mintLineage(opts.lineage),
     // §7: the room is explicit, and a record with none is in the literal room 'default'. A null
     // here signed the string "null" and read as "every room" on receipt.
-    room: (typeof opts.room === 'string' && opts.room) ? opts.room.normalize('NFC') : DEFAULT_ROOM,
+    room: (typeof opts.room === 'string' && opts.room) ? opts.room : DEFAULT_ROOM,
     to: opts.to ?? null,
   };
 
@@ -695,8 +696,12 @@ function createCMB(opts = {}) {
     metadata.addressScheme = 'mmp-cmb-merkle-v2';
     metadata.signatureSuite = 'mmp-sig-v2.0';
     metadata.createdByNodeId = opts.createdByNodeId;
-    metadata.application = opts.application ?? null;
+    // application.schema is signed as NFC (§8.8.3) and refused otherwise on receipt: minted NFC.
+    const app = opts.application ?? null;
+    metadata.application = app && typeof app === 'object' && typeof app.schema === 'string' ? { ...app, schema: app.schema.normalize('NFC') } : app;
   }
+  // A §5.8 room identifier, or nothing is minted: every receiver refuses a record signed for any other.
+  if (minting && !isRoomId(metadata.room)) throw new RangeError(`createCMB: room ${JSON.stringify(String(metadata.room).slice(0, 80))} is not a §5.8 room identifier ([a-z0-9._-], 1 to 64 characters)`);
 
   const record = { categories, metadata };
   if (minting) assertRecordSendable(record);
diff --git a/lib/core/record-canonical.js b/lib/core/record-canonical.js
index dd419bdf..9df9deb5 100644
--- a/lib/core/record-canonical.js
+++ b/lib/core/record-canonical.js
@@ -16,10 +16,11 @@
  *   - `metadata.to` is a lowercase UUID or null, `createdByNodeId` a lowercase UUID (§3.1.1);
  *   - each category's carried `meta.key` must equal its recomputation from the category name and
  *     the signed text (§8.8.5 step 4): a mismatch refuses the record;
- *   - every signed string (each category's text, `createdBy`, `room`) is already NFC: a value that
- *     is not is refused, never normalised, as no type is coerced (MMP 2.0 update 1, §8.8.5 step 1);
- *   - `createdBy`, `room` and each parent reference are at most 256 characters, counted as JSON
- *     Schema counts them (code points), and a parents list holds at most 256 entries;
+ *   - every signed string (each category's text, `createdBy`, `application.schema`) is already NFC:
+ *     a value that is not is refused, never normalised, as no type is coerced (MMP 2.0 update 1,
+ *     §8.8.5 step 1); `room` is a §5.8 room identifier, which is ASCII;
+ *   - `createdBy` and each parent reference are at most 256 characters, counted as JSON Schema
+ *     counts them (code points), and a parents list holds at most 256 entries;
  *   - the carried but unsigned members (§8.8.4) — the mood's `valence` and `arousal`, and
  *     `lineage.method` — are dropped.
  *
@@ -29,11 +30,10 @@
  *   categories.<each of the seven>  { text, meta: { key, parents (sorted bytewise) } }
  *   metadata  { key, addressScheme, assertionId, signatureSuite, createdByNodeId, createdBy,
  *               createdTimestamp, room, to, lineage: { parents (sorted bytewise) } | null,
- *               application?, sigAlg, sig }
+ *               application | null, sigAlg, sig }
  *
- * Each of those forms signs the same as the one it replaces: parents are signed as sorted sets, and
- * a lineage with no parents signs as none (§8.8.4). The update also holds an absent application as
- * null; that rule is under review and not applied yet (a null application is dropped, as before).
+ * Each of those forms signs the same as the one it replaces: parents are signed as sorted sets, a
+ * lineage with no parents signs as none, and an absent application as null (§8.8.4).
  *
  * The node stores, emits (the verified-record hook) and serves only what this returns.
  *
@@ -43,6 +43,7 @@
 
 const { CAT7_CATEGORIES } = require('./cmb');
 const { categoryKeyV1, textBytes, MAX_CATEGORY_BYTES, MAX_RECORD_TEXT_BYTES, MAX_RECORD_BYTES } = require('./cmb-encoder');
+const { isRoomId } = require('./room-id');
 
 const LOWER_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 /** A canonical nodeId: a lowercase UUID, or (tests and older hosts) another lowercase identifier. */
@@ -131,6 +132,9 @@ function application(a) {
   for (const k of Object.keys(a)) if (!APPLICATION_MEMBERS.includes(k)) throw new RecordShapeError('application carries an unknown member');
   if (typeof a.mediaType !== 'string' || !MEDIA.test(a.mediaType)) throw new RecordShapeError('application mediaType is malformed');
   if (typeof a.schema !== 'string' || a.schema.length > 2048) throw new RecordShapeError('application schema is not text');
+  // Signed as NFC(schema) (§8.8.3), so a free spelling would be a second form of one assertion: it is
+  // NFC already, or refused (§8.8.5 step 1, MMP 2.0 update 1).
+  if (!isNFC(a.schema)) throw new RecordShapeError('application schema is not NFC');
   if (a.encoding !== 'base64url') throw new RecordShapeError('application encoding is not base64url');
   if (!Number.isSafeInteger(a.byteLength) || a.byteLength < 0 || a.byteLength > 524288) throw new RecordShapeError('application byteLength is malformed');
   if (typeof a.digest !== 'string' || !DIGEST.test(a.digest)) throw new RecordShapeError('application digest is malformed');
@@ -188,8 +192,9 @@ function canonicalRecordV2_0(cmb) {
   if (typeof m.createdBy !== 'string' || m.createdBy.length === 0 || codePoints(m.createdBy) > 256) throw new RecordShapeError('createdBy is not a label');
   if (!isNFC(m.createdBy)) throw new RecordShapeError('createdBy is not NFC');
   if (!Number.isSafeInteger(m.createdTimestamp) || m.createdTimestamp < 0) throw new RecordShapeError('createdTimestamp is not an integer');
-  if (typeof m.room !== 'string' || m.room.length === 0 || codePoints(m.room) > 256) throw new RecordShapeError('room is not a room');
-  if (!isNFC(m.room)) throw new RecordShapeError('room is not NFC');
+  // A §5.8 room identifier (MMP 2.0 update 1: one room grammar everywhere). Being ASCII it is its own
+  // NFC form, so the NFC rule for the signed room is met by the grammar.
+  if (!isRoomId(m.room)) throw new RecordShapeError('room is not a §5.8 room identifier');
   if (!(m.to === null || isLowerUuid(m.to))) throw new RecordShapeError('to is not a lowercase UUID or null');
   let lineage = null;
   if (m.lineage === undefined) throw new RecordShapeError('lineage is missing (an object or null)');
@@ -208,12 +213,11 @@ function canonicalRecordV2_0(cmb) {
     key: m.key, addressScheme: m.addressScheme, assertionId: m.assertionId, signatureSuite: m.signatureSuite,
     createdByNodeId: m.createdByNodeId, createdBy: m.createdBy, createdTimestamp: m.createdTimestamp,
     room: m.room, to: m.to, lineage,
+    // An absent application signs as null (§8.8.4), so it is held as null: every published record
+    // spells it so, and encrypted-cmb-frame.schema.json requires the member.
+    application: (m.application === undefined || m.application === null) ? null : application(m.application),
+    sigAlg: m.sigAlg, sig: m.sig,
   };
-  // HELD (coordinator, 2026-10-08): the update's projection holds an absent application as null
-  // (#34, record-projection-v2); that rule is under review, so this still drops a null one.
-  if (m.application !== undefined && m.application !== null) metadata.application = application(m.application);
-  metadata.sigAlg = m.sigAlg;
-  metadata.sig = m.sig;
   return { categories, metadata };
 }
 
diff --git a/lib/core/room-grant.js b/lib/core/room-grant.js
index e987f5b5..fdbdd996 100644
--- a/lib/core/room-grant.js
+++ b/lib/core/room-grant.js
@@ -40,7 +40,7 @@ const crypto = require('crypto');
 const { verifyStrict } = require('./ed25519');
 const { privateKeyObject, publicKeyObject } = require('./cmb-signing');
 const { lp } = require('./cmb-encoder');
-const { isValidRoom, roomServiceType, serviceTypeToRoom } = require('../rooms');
+const { isValidRoom } = require('../rooms');
 
 /** Grants may never outlive this. The number IS the offline-revocation window. */
 const MAX_GRANT_LIFETIME_MS = 24 * 60 * 60 * 1000;
@@ -51,22 +51,15 @@ const EXPIRY_SKEW_MS = 5 * 60 * 1000;
 /**
  * May this room name be OWNED (and therefore gated)?
  *
- * `default` is the public mesh and is never ownable by rule (MMP §5.8). Everything
- * else is derived rather than listed: a name is ownable only if it survives the
- * room↔service-type round trip, which is what refuses `sym` — `roomServiceType('sym')`
- * is `_sym._tcp` and its inverse is `default`, so the mapping is NOT injective and an
- * "owned" room named `sym` would silently BE the public square (grammar review F5).
+ * `default` is the public mesh and is never ownable by rule (MMP §5.8), and `sym` is refused with it:
+ * while per-room service types are advertised anywhere, it maps to `_sym._tcp`, indistinguishable
+ * there from default (§5.1 migration, "MUST NOT be owned"). Every other §5.8 room identifier is
+ * ownable (rooms.isValidRoom).
  *
- * WHAT THIS DOES NOT PROVE, stated because the predicate reads stronger than it is: the
- * round trip tests SYM'S OWN mapping, not every consumer's. A shipped consumer that
- * truncates the service name at 15 characters collapses `x-review--team-<a>` and
- * `x-review--team-<b>` onto one type, and this predicate blesses both — two rooms with
- * different owners looking like one room on that path. The name was never the boundary;
- * the grant is. This check removes one silent collapse, it does not make names unique.
+ * The name was never the boundary; the grant is.
  */
 function isOwnableRoom(room) {
-  if (!isValidRoom(room) || room === 'default') return false;
-  return serviceTypeToRoom(roomServiceType(room)) === room;
+  return isValidRoom(room) && room !== 'default' && room !== 'sym';
 }
 
 /** Domain separator: a signature over these bytes can never be read as a CMB
diff --git a/lib/core/room-id.js b/lib/core/room-id.js
new file mode 100644
index 00000000..0475b3c5
--- /dev/null
+++ b/lib/core/room-id.js
@@ -0,0 +1,31 @@
+'use strict';
+
+/**
+ * @module sym/core/room-id
+ * @description The room identifier (MMP §5.8): `[a-z0-9._-]`, 1 to 64 characters, case-sensitive.
+ *
+ * One grammar everywhere a room is named (MMP 2.0 update 1): a node's own room, the handshake, a
+ * record's signed room, an attestation's room, a room-join grant, relay-auth and the TXT `room` key.
+ * Being ASCII, a valid identifier is its own NFC form, so the NFC rules for rooms are met by it.
+ *
+ * @copyright 2026 SYM.BOT Ltd.
+ * @license Apache-2.0
+ */
+
+const ROOM_RE = /^[a-z0-9._-]{1,64}$/;
+
+/** Whether `room` is a §5.8 room identifier. */
+const isRoomId = (room) => typeof room === 'string' && ROOM_RE.test(room);
+
+/**
+ * The per-room DNS-SD service type earlier releases derived from a room (`_<room>._tcp`), where that
+ * is a valid RFC 6335 service name (§5.1 migration: browsed, never advertised), or null: 1 to 15
+ * letters, digits and hyphens, at least one letter, no hyphen first, last or twice in a row.
+ */
+function legacyServiceType(room) {
+  if (!isRoomId(room) || room === 'default') return null;
+  if (room.length > 15 || !/^[a-z0-9-]+$/.test(room) || !/[a-z]/.test(room) || room.startsWith('-') || room.endsWith('-') || room.includes('--')) return null;
+  return `_${room}._tcp`;
+}
+
+module.exports = { ROOM_RE, isRoomId, legacyServiceType };
diff --git a/lib/node.js b/lib/node.js
index b37370ef..39704e51 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -33,6 +33,7 @@ const { parsePin } = require('./core/authority');
 const { RosterKeyRegistry, keyFingerprint } = require('./roster-keys');
 const { signedProjection, isLowerUuid } = require('./core/record-canonical');
 const { buildMoodFrame } = require('./core/mood-frame');
+const { isRoomId } = require('./core/room-id');
 /** A stored record's signed projection, or null for one that is not a v2.0 record. */
 const projectionOrNull = (cmb) => {
   if (!cmb || !cmb.metadata || cmb.metadata.signatureSuite !== 'mmp-sig-v2.0') return null;
@@ -727,8 +728,14 @@ class SymNode extends EventEmitter {
     // room for nodes that do not declare one; `room` is advertised in the
     // handshake frame (§5.2 optional category) so heterogeneous peers on the same
     // LAN can tell which room they belong to.
-    // §5.2: the room is NFC-normalised; this node keeps, announces and compares it in NFC.
-    this._room = String(opts.room || 'default').normalize('NFC');
+    // §5.8: a room identifier is [a-z0-9._-], 1 to 64 characters (MMP 2.0 update 1, one grammar
+    // everywhere); a node in any other room could mint no record a peer takes. ASCII, so it is NFC.
+    this._room = opts.room === undefined || opts.room === null || opts.room === '' ? 'default' : opts.room;
+    if (!isRoomId(this._room)) {
+      const e = new RangeError(`SymNode: room ${JSON.stringify(String(this._room).slice(0, 80))} is not a §5.8 room identifier ([a-z0-9._-], 1 to 64 characters)`);
+      e.code = 'EBADROOM';
+      throw e;
+    }
 
     // Discovery — pluggable for testability. See MMP v0.2.0 Section 5.
     // `discoveryServiceType` enables LAN-level Bonjour isolation for mesh
diff --git a/lib/rooms.js b/lib/rooms.js
index 3ae48a2c..6753b1bb 100644
--- a/lib/rooms.js
+++ b/lib/rooms.js
@@ -44,32 +44,24 @@
  */
 
 const KEBAB_CASE_RE = /^[a-z0-9]+(?:--?[a-z0-9]+)*$/;
+const { isRoomId } = require('./core/room-id');
 
 /**
- * A valid room name is "default" or kebab-case AND canonical.
+ * A valid room name is a §5.8 room identifier: `[a-z0-9._-]`, 1 to 64 characters (MMP 2.0 update 1,
+ * one grammar everywhere). Until the update this was kebab-case only, which refused §5.8-valid
+ * rooms, the spec's recommended dotted names (`acme.prod`) and underscores among them.
  *
- * Canonical means one name per room and one room per name: the name a node
- * declares MUST be the name that comes back out of the service type it
- * advertises on. Grammar alone does not give that. `sym` passes the kebab
- * regex, but `roomServiceType('sym')` is `_sym._tcp` and its inverse is
- * `default` — so `sym` is a second spelling of the global mesh. A node asking
- * for a room named `sym` believes it is somewhere specific and is in fact in
- * the public square, and nothing on any path raises an error.
+ * One name is refused though the grammar admits it: `sym`. While per-room service types are
+ * advertised anywhere, `sym` maps to `_sym._tcp`, indistinguishable there from `default` (§5.1
+ * migration: it MUST NOT be owned and SHOULD NOT be used). A node asking for a room named `sym` would
+ * believe it is somewhere specific and be in the public square.
  *
- * Founder ruling 2026-08-27: room names must be canonical. So the round trip
- * is part of validity, not a separate predicate applied only where someone
- * remembered to ask. It was already the ownability rule (isOwnableRoom);
- * confining it there meant an UNOWNED room could still be an alias, which is
- * where the silent collapse actually happens.
- *
- * Refuse rather than repair. A name that is not already canonical MUST NOT be
- * rewritten into one that is — repair maps several distinct names onto one
- * room, which is the same collapse arriving through the front door.
+ * Refuse rather than repair. A name that is not already valid MUST NOT be rewritten into one that is:
+ * repair maps several distinct names onto one room.
  */
 function isValidRoom(room) {
   if (room === 'default') return true;
-  if (typeof room !== 'string' || !KEBAB_CASE_RE.test(room)) return false;
-  return serviceTypeToRoom(roomServiceType(room)) === room;
+  return isRoomId(room) && room !== 'sym';
 }
 
 /**
@@ -86,7 +78,12 @@ function canonicalRoom(room) {
   return isValidRoom(trimmed) ? trimmed : null;
 }
 
-/** Map a room name to its Bonjour service type. */
+/**
+ * The per-room Bonjour service type earlier releases advertised a room on (`_<room>._tcp`; default:
+ * `_sym._tcp`). Since MMP 2.0 update 1 every room is advertised on `_sym._tcp` with its name in the
+ * TXT `room` key (§5.1); this mapping is kept for display and for the migration browse
+ * (core/room-id legacyServiceType says where it names a valid service).
+ */
 function roomServiceType(room) {
   return (room && room !== 'default') ? `_${room}._tcp` : '_sym._tcp';
 }
diff --git a/lib/session.js b/lib/session.js
index 4325f8ce..1c70d9ef 100644
--- a/lib/session.js
+++ b/lib/session.js
@@ -70,6 +70,7 @@ const X25519_SPKI_PREFIX = Buffer.from('302a300506032b656e032100', 'hex');
 /** A record offered to a session its signed audience does not include (review finding A). */
 class AudienceError extends Error {}
 const { signedProjection } = require('./core/record-canonical');
+const { isRoomId } = require('./core/room-id');
 const { MAX_SEALED_CHARS } = require('./core/cmb-encoder');
 // nodeIds are canonical lowercase on the wire (§3.1.1; review finding B): an upper-case alias of a
 // bound nodeId is not a second identity, it is refused at the door.
@@ -112,7 +113,7 @@ const is32 = (s) => typeof s === 'string' && B64_32.test(s) && Buffer.from(s, 'b
 function checkOffer(f, kind) {
   if (!f || typeof f !== 'object' || Array.isArray(f)) throw new Error(`handshake: ${kind} is not an object`);
   if (f.protocolVersion !== PROTOCOL_VERSION) throw new Error('handshake: unsupported protocolVersion');
-  if (typeof f.room !== 'string' || !f.room || f.room.length > 128) throw new Error(`handshake: ${kind} room is not a room`);
+  if (!isRoomId(f.room)) throw new Error(`handshake: ${kind} room is not a §5.8 room identifier`);
   if (typeof f.nodeId !== 'string' || !UUID_RE.test(f.nodeId)) throw new Error(`handshake: ${kind} nodeId is not a UUID`);
   if (typeof f.name !== 'string' || !f.name || f.name.length > 256) throw new Error(`handshake: ${kind} name is not a name`);
   for (const k of ['identityPublicKey', 'e2ePublicKey', 'nonce']) {
diff --git a/tests/core-secure-rereview.test.js b/tests/core-secure-rereview.test.js
index 8960c8ac..f2088c33 100644
--- a/tests/core-secure-rereview.test.js
+++ b/tests/core-secure-rereview.test.js
@@ -240,21 +240,19 @@ describe('leads', () => {
     assert.throws(() => canonicalRecordV2_0(absent), /to is not a lowercase UUID or null/);
   });
 
-  it('a signed attestation, checkpoint or witness whose room is spelled in another Unicode form is compared in NFC', async () => {
-    const b = mk('nfc-b', { room: 'café' });
+  it('a room is a §5.8 identifier, so no two Unicode spellings of one room exist (MMP 2.0 update 1)', async () => {
+    // Until update 1 a room could be any text, compared in NFC; now it is [a-z0-9._-], 1 to 64
+    // characters, everywhere it is named, and ASCII has one spelling.
+    assert.throws(() => mk('nfc-b', { room: 'cafe\u0301' }), (e) => e.code === 'EBADROOM');
+    assert.throws(() => mk('nfc-c', { room: 'café' }), (e) => e.code === 'EBADROOM');
+    const b = mk('nfc-d', { room: 'cafe.prod_1' });
     try {
       await b.start();
       const X = identity('x');
       const sX = admitAs(b, X);
       b._roster.bind(X.nodeId, X.publicKey, 'pinned');
-      const decomposed = 'café';
-      assert.notStrictEqual(decomposed, b._room);
-      const att = signedAs({ of: `cmb-${hex()}`, by: X.nodeId, at: Date.now(), roster: decomposed, verdict: 'aligned', categories: CATS7, seq: 1, prev: 'genesis' }, X.privateKey, signAttestation);
+      const att = signedAs({ of: `cmb-${hex()}`, by: X.nodeId, at: Date.now(), roster: b._room, verdict: 'aligned', categories: CATS7, seq: 1, prev: 'genesis' }, X.privateKey, signAttestation);
       assert.notStrictEqual(b._ingestAttestation(att, X.nodeId, X.name, sX).reason, 'roster-mismatch');
-      const cp = signedAs({ by: X.nodeId, upto_seq: 1, root: hex(), at: Date.now(), roster: decomposed }, X.privateKey, signCheckpoint);
-      assert.notStrictEqual(b._ingestCheckpoint(cp, X.nodeId, sX).reason, 'roster-mismatch');
-      const w = signedAs({ attester: X.nodeId, upto_seq: 2, root: hex(), by: X.nodeId, role: 'participant', at: Date.now(), roster: decomposed }, X.privateKey, signWitness);
-      assert.notStrictEqual(b._ingestWitness(w, X.nodeId, sX).reason, 'roster-mismatch');
       assert.strictEqual(b._ingestAttestation({ ...att, sig: att.sig, roster: 'another-room' }, X.nodeId, X.name, sX).reason, 'roster-mismatch', 'another room is still refused');
     } finally { await stopAll(b); }
   });
diff --git a/tests/core-secure-review.test.js b/tests/core-secure-review.test.js
index def42038..3cc06031 100644
--- a/tests/core-secure-review.test.js
+++ b/tests/core-secure-review.test.js
@@ -554,10 +554,8 @@ describe('F. errors are information (cs-review-A/relay-errors, relay-failed-reha
     assert.ok(parseInvite(url).error, 'an invite');
   });
 
-  it('rooms compare in NFC', () => {
-    const nfd = 'café'; const nfc = 'café';
-    const n = mk('nfc', { room: nfd });
-    try { assert.strictEqual(n._room, nfc, 'kept and announced in NFC'); } finally { n.stop().catch(() => {}); }
+  it('a room has one spelling: a §5.8 identifier, refused otherwise (was: compared in NFC; MMP 2.0 update 1)', () => {
+    for (const room of ['cafe\u0301', 'caf\u00e9']) assert.throws(() => mk('nfc', { room }), (e) => e.code === 'EBADROOM', room);
   });
 });
 
diff --git a/tests/room-join-auth.test.js b/tests/room-join-auth.test.js
index 7347c5d8..e040c9c3 100644
--- a/tests/room-join-auth.test.js
+++ b/tests/room-join-auth.test.js
@@ -55,7 +55,7 @@ describe('room ownability — derived from the mapping, not a hardcoded list', (
   });
 
   it('an invalid room name is not ownable', () => {
-    for (const bad of ['UPPER', 'has space', '-leading', 'a---b', '']) {
+    for (const bad of ['UPPER', 'has space', 'café', 'x'.repeat(65), '']) {
       assert.strictEqual(isOwnableRoom(bad), false, bad);
     }
   });
diff --git a/tests/rooms.test.js b/tests/rooms.test.js
index 26bc086f..d2fb5b0e 100644
--- a/tests/rooms.test.js
+++ b/tests/rooms.test.js
@@ -32,17 +32,22 @@ describe('mesh rooms', () => {
     });
   });
 
-  describe('isValidRoom', () => {
-    it('accepts "default" and kebab-case', () => {
-      for (const g of ['default', 'acme', 'backend-team', 'a1', 'home-office-2']) {
+  describe('isValidRoom: the §5.8 room identifier (MMP 2.0 update 1)', () => {
+    it('accepts "default" and every [a-z0-9._-] name of 1 to 64 characters, dotted and underscored included', () => {
+      for (const g of ['default', 'acme', 'backend-team', 'a1', 'home-office-2', 'acme.prod', 'research.lab', 'backend_team', '-leading', 'trailing-', 'a---b', 'x'.repeat(64)]) {
         assert.ok(isValidRoom(g), `${g} should be valid`);
       }
     });
-    it('rejects non-kebab / unsafe names', () => {
-      for (const g of ['Backend_Team', 'has space', 'UPPER', '-leading', 'trailing-', 'a---b', 'a--', '--b', '', null, undefined]) {
+    it('rejects anything else, and sym (it aliases default on a per-room service type)', () => {
+      for (const g of ['Backend_Team', 'has space', 'UPPER', 'café', 'x'.repeat(65), '', null, undefined, 'sym']) {
         assert.strictEqual(isValidRoom(g), false, `${g} should be invalid`);
       }
     });
+    it('a legacy per-room service type exists only where it is a valid RFC 6335 service name', () => {
+      const { legacyServiceType } = require('../lib/core/room-id');
+      assert.strictEqual(legacyServiceType('backend-team'), '_backend-team._tcp');
+      for (const g of ['default', 'acme.prod', 'backend_team', 'a--b', '-lead', 'trail-', '1234', 'sixteen-chars-xx']) assert.strictEqual(legacyServiceType(g), null, g);
+    });
   });
 
   it('tenant-suffixed rooms are valid — the grammar xMesh scopes recipe rooms with (ruling 2026-08-26)', () => {
diff --git a/tests/spec-update-records.test.js b/tests/spec-update-records.test.js
index 82078811..530ab76e 100644
--- a/tests/spec-update-records.test.js
+++ b/tests/spec-update-records.test.js
@@ -35,13 +35,8 @@ describe('record-projection-v2: the canonical signed projection (#34, D2)', () =
     it(c.label, () => {
       if (c.expected.accepted) {
         const p = canonicalRecordV2_0(c.record);
-        // HELD (coordinator, 2026-10-08): the vector holds an absent application as null (#34), a rule
-        // under review that sym does not apply yet. Exactly that member is the difference: sym's
-        // projection with it added is the vector's, byte for byte. Remove `held` when the ruling lands.
-        assert.strictEqual(p.metadata.application, undefined, 'the held rule: no application member');
-        const held = { categories: p.categories, metadata: { ...p.metadata, application: null } };
-        assert.deepStrictEqual(held, c.expected.projection);
-        assert.strictEqual(crypto.createHash('sha256').update(canonicalJSON(held), 'utf8').digest('hex'), c.expected.projectionSha256, 'the same RFC 8785 bytes');
+        assert.deepStrictEqual(p, c.expected.projection);
+        assert.strictEqual(crypto.createHash('sha256').update(canonicalJSON(p), 'utf8').digest('hex'), c.expected.projectionSha256, 'the same RFC 8785 bytes');
         assert.strictEqual(verifyCMB(p, key).valid, true, 'the projection verifies');
         assert.strictEqual(verifyCMB(c.record, key).valid, true, 'and so does the record as given');
       } else {
@@ -80,15 +75,41 @@ describe('record-projection-v2: the canonical signed projection (#34, D2)', () =
   });
 });
 
+describe('rooms, application.schema and the application member on receipt (MMP 2.0 update 1)', () => {
+  const v = vendored('record-projection-v2.json');
+  const base = () => JSON.parse(JSON.stringify(v.cases[0].record));
+  it('a record whose room is not a §5.8 identifier is refused', () => {
+    for (const room of ['Conformance-Room', 'cafe\u0301', 'caf\u00e9', 'x'.repeat(65), 'a b']) {
+      const r = base(); r.metadata.room = room;
+      assert.throws(() => canonicalRecordV2_0(r), (e) => e.reason === 'room is not a §5.8 room identifier', room);
+    }
+  });
+  it('an application whose schema is not NFC is refused; an absent application is held as null', () => {
+    const r = base();
+    r.metadata.application = { mediaType: 'application/json', schema: 'https://example.org/cafe\u0301', encoding: 'base64url', byteLength: 0, digest: `sha256-${crypto.createHash('sha256').update('').digest('hex')}`, data: '' };
+    assert.throws(() => canonicalRecordV2_0(r), (e) => e.reason === 'application schema is not NFC');
+    const absent = base(); delete absent.metadata.application;
+    assert.strictEqual(canonicalRecordV2_0(absent).metadata.application, null);
+  });
+  it('a sealed record carries metadata.application, as encrypted-cmb-frame.schema.json requires', () => {
+    const { buildEncryptedFrame } = require('../lib/core/cmb-encrypted-frame');
+    const p = canonicalRecordV2_0(base());
+    const f = buildEncryptedFrame({ cmb: p, applicationBytes: null, sessionId: 'a'.repeat(32), direction: 'client-to-server', sequence: '0', trafficKey: crypto.randomBytes(32) });
+    assert.ok(Object.prototype.hasOwnProperty.call(f.metadata, 'application'));
+    assert.strictEqual(f.metadata.application, null);
+  });
+});
+
 describe('a node mints the canonical projection (D2)', () => {
   const cats = (focus) => Object.fromEntries(CAT7_CATEGORIES.map((f) => [f, f === 'focus' ? focus : (f === 'mood' ? { text: 'calm' } : `${f} text`)]));
   const P = (b) => `cmb-${b.repeat(64)}`;
   it('NFC text, createdBy and room; parents a sorted set; no parents is no lineage', () => {
     const nfd = 'café'; // "café" in NFD
-    const r = createCMB({ categories: cats(nfd), createdBy: `zoë`, room: `róom`, lineage: { parents: [P('f'), P('0'), P('f')], method: 'SVAF-v2' }, categoryParents: { issue: ['z', 'a', 'z'] } });
-    assert.strictEqual(r.categories.focus.text, nfd.normalize('NFC'));
-    assert.strictEqual(r.metadata.createdBy, 'zoë');
-    assert.strictEqual(r.metadata.room, 'róom'.normalize('NFC'));
+    const r = createCMB({ categories: cats(nfd), createdBy: "zoe\u0308", room: "acme.prod", lineage: { parents: [P("f"), P("0"), P("f")], method: "SVAF-v2" }, categoryParents: { issue: ["z", "a", "z"] }, emitV2: true, createdByNodeId: crypto.randomUUID(), application: { mediaType: "application/json", schema: "https://example.org/cafe\u0301", encoding: "base64url", byteLength: 0, digest: `sha256-${crypto.createHash("sha256").update("").digest("hex")}`, data: "" } });
+    assert.strictEqual(r.categories.focus.text, nfd.normalize("NFC"));
+    assert.strictEqual(r.metadata.createdBy, "zo\u00eb");
+    assert.strictEqual(r.metadata.application.schema, "https://example.org/caf\u00e9", "application.schema minted NFC");
+    assert.throws(() => createCMB({ categories: cats("x"), createdBy: "a", room: "ro\u0301om" }), /§5\.8 room identifier/, "a room outside §5.8 is never minted");
     assert.deepStrictEqual(r.metadata.lineage.parents, [P('0'), P('f')]);
     assert.deepStrictEqual(r.categories.issue.meta.parents, ['a', 'z']);
     assert.strictEqual(createCMB({ categories: cats('x'), createdBy: 'a', lineage: { parents: [] } }).metadata.lineage, null);
@@ -101,11 +122,8 @@ describe('a node mints the canonical projection (D2)', () => {
     r.metadata.assertionId = assertionIdV2_0(r);
     signCMB(r, privateKey.export({ format: 'jwk' }).d);
     const p = canonicalRecordV2_0(r);
-    // The minted record carries application: null; the held #34 rule is not applied, so the
-    // projection drops it (see record-projection-v2 above).
-    const { application, ...metadata } = r.metadata;
-    assert.strictEqual(application, null);
-    assert.strictEqual(canonicalJSON(p), canonicalJSON({ categories: Object.fromEntries(CAT7_CATEGORIES.map((f) => [f, { text: r.categories[f].text, meta: r.categories[f].meta }])), metadata: { ...metadata, lineage: { parents: r.metadata.lineage.parents } } }));
+    assert.strictEqual(r.metadata.application, null);
+    assert.strictEqual(canonicalJSON(p), canonicalJSON({ categories: Object.fromEntries(CAT7_CATEGORIES.map((f) => [f, { text: r.categories[f].text, meta: r.categories[f].meta }])), metadata: { ...r.metadata, lineage: { parents: r.metadata.lineage.parents } } }));
     assert.strictEqual(verifyCMB(p, publicKey.export({ format: 'jwk' }).x).valid, true);
   });
 });
diff --git a/tests/spec-update-vectors.test.js b/tests/spec-update-vectors.test.js
index 59c9e039..7b5a4611 100644
--- a/tests/spec-update-vectors.test.js
+++ b/tests/spec-update-vectors.test.js
@@ -83,8 +83,7 @@ describe('the reference construction (scripts/mmp/lib.mjs) and sym agree', () =>
       const ref = L.recordProjectionV2(c.record);
       assert.strictEqual(ref.ok, true);
       const p = canonicalRecordV2_0(c.record);
-      // HELD (#34 application-as-null, under review): see tests/spec-update-records.test.js.
-      assert.strictEqual(canonicalJSON({ categories: p.categories, metadata: { ...p.metadata, application: p.metadata.application ?? null } }), canonicalJSON(ref.projection), c.label);
+      assert.strictEqual(canonicalJSON(p), canonicalJSON(ref.projection), c.label);
     }
   });
 
diff --git a/tests/sym-attest-v1.test.js b/tests/sym-attest-v1.test.js
index 235e19ff..bf262a63 100644
--- a/tests/sym-attest-v1.test.js
+++ b/tests/sym-attest-v1.test.js
@@ -85,13 +85,15 @@ describe('the signed constructions (sym-attest-v1 §5)', () => {
 
 describe('the wire form (sym-attest-v1 §5, §6 step 1)', () => {
   it('toWire uses the extension\'s names; fromWire takes only a well-formed frame', () => {
-    const a = core.signAttestation(att(), A.privateKey);
+    // On the wire a room is a §5.8 identifier (sym-attest-frame.schema.json, MMP 2.0 update 1).
+    const a = core.signAttestation({ ...att(), roster: 'room-e' }, A.privateKey);
     const w = core.toWireAttestation(a);
+    assert.strictEqual(core.fromWireAttestation(core.toWireAttestation(core.signAttestation(att(), A.privateKey))), null, 'a room outside §5.8 is refused');
     assert.deepStrictEqual(Object.keys(w).sort(), ['assertionId', 'at', 'by', 'categories', 'method', 'of', 'prev', 'role', 'room', 'seq', 'sig', 'sigAlg', 'verdict']);
-    assert.strictEqual(w.room, 'room-é');
+    assert.strictEqual(w.room, 'room-e');
     assert.strictEqual(core.verifyAttestation(core.fromWireAttestation(w), A.publicKey).valid, true, 'round trip verifies');
     const bad = [
-      { ...w, assertionId: undefined }, { ...w, of: 'cmb-1' }, { ...w, room: undefined, roster: 'room-é' },
+      { ...w, assertionId: undefined }, { ...w, of: 'cmb-1' }, { ...w, room: undefined, roster: 'room-e' },
       { ...w, method: { toString: 1 } }, { ...w, verdict: 'maybe' }, { ...w, categories: { ...CATS, focus: 'stable' } },
       { ...w, categories: { focus: 'admit' } }, { ...w, categories: { ...CATS, extra: 'admit' } }, { ...w, role: 2 },
       { ...w, seq: 1, prev: hex('c') }, { ...w, seq: 2, prev: 'genesis' }, { ...w, seq: 0 }, { ...w, sig: `${w.sig}=` }, { ...w, sigAlg: 'rsa' },

From 7ee5f239d96420482572a54acbdc66e5b9cc41f8 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 8 Oct 2026 11:55:56 +0100
Subject: [PATCH 130/148] discovery: one service type with TXT room, the
 migration browse, the mmp list, RFC 6763 TXT keys (#17, #22)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

MMP 2.0 update 1, §5.1 (PR #43 at 2660ab9), and the relay review's ALIGN-SYM items:

- The daemon advertises every room on _sym._tcp with its name in TXT room, as the library already
  did; it advertised and browsed only _<room>._tcp, so a daemon node and a library node in one room
  never saw each other. It browses the per-room type earlier releases advertised as well
  (discoveryBrowseTypes), where that is a valid RFC 6335 service name, and never advertises it.
- A node dials only an advertisement whose TXT room is its own (absent reads as default), and
  whose mmp, a comma-separated version list, lists 2.0 (it compared mmp === '2.0').
- TXT keys are read from the raw strings as RFC 6763 §6.4 says: case-insensitively, the first
  occurrence winning, a string beginning with '=' ignored (bonjour-service's own object lets the
  last one win and keeps case).
- A discovery the host built advertises the node's own room (Discovery.setRoom): a caller's
  BonjourDiscovery advertised 'default' whatever room its node was in, which the TXT room filter
  would have turned into a partition.
- The loopback registry takes a registration under any type this node browses.
- The dns-sd code path (_startDnsSd, _resolvePeer) was unreachable since 0.3.72 and held the
  unanchored /mmp=(\S+)/ match the review found: removed.
- CLI and daemon messages say the §5.8 grammar and the one service type.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QRVMpaJkAA2fFbvuHCEzqH
---
 bin/sym-daemon.js                   |  16 +-
 bin/sym.js                          |  12 +-
 lib/discovery.js                    | 239 ++++++++++++----------------
 lib/node.js                         |  21 ++-
 tests/spec-update-discovery.test.js | 119 ++++++++++++++
 5 files changed, 253 insertions(+), 154 deletions(-)
 create mode 100644 tests/spec-update-discovery.test.js

diff --git a/bin/sym-daemon.js b/bin/sym-daemon.js
index 5bf54ecd..df745c19 100755
--- a/bin/sym-daemon.js
+++ b/bin/sym-daemon.js
@@ -116,9 +116,11 @@ if (args.includes('--status')) {
 // Resolve which room this node joins, in precedence order:
 //   1. SYM_ROOM env   2. persisted ~/.sym/room (written by `sym join`)   3. default
 // The persisted file is the source of truth across launchd/spawn restarts;
-// env overrides it for one run. room -> service type matches the MCP node +
-// sym-swift, so CLI peers discover app/Claude peers in the same room.
-const { roomServiceType, isValidRoom } = require('../lib/rooms');
+// env overrides it for one run. Every room is advertised on _sym._tcp with its name in the TXT
+// `room` key (MMP §5.1, update 1); the per-room type earlier releases advertised is browsed too,
+// where it is a valid service name, so a 2.0 node still advertising only that type is found.
+const { isValidRoom } = require('../lib/rooms');
+const { legacyServiceType } = require('../lib/core/room-id');
 const ROOM_FILE = path.join(SYM_DIR, 'room');
 // The room used to persist under a different filename. That file is NOT read — one name, no
 // fallback — but its presence is ANNOUNCED, because the alternative is the worst outcome
@@ -145,10 +147,11 @@ if (ROOM === 'default' && !process.env.SYM_ROOM) {
 }
 
 if (!isValidRoom(ROOM)) {
-  log(`Invalid room "${ROOM}" — must be kebab-case or "default". Falling back to default.`);
+  log(`Invalid room "${ROOM}" — a room is [a-z0-9._-], 1 to 64 characters (MMP §5.8), and not "sym". Falling back to default.`);
   ROOM = 'default';
 }
-log(`Mesh room: ${ROOM} (${roomServiceType(ROOM)})`);
+const LEGACY_BROWSE = legacyServiceType(ROOM);
+log(`Mesh room: ${ROOM} (_sym._tcp, TXT room=${ROOM}${LEGACY_BROWSE ? `; also browsing ${LEGACY_BROWSE}` : ''})`);
 
 // ── SYM Node ───────────────────────────────────────────────────
 
@@ -169,7 +172,8 @@ const node = new SymNode({
   cliHostMode: true,  // Local CLI-host peer — forward only, no persistence
   relayOnly: RELAY_ONLY,
   room: ROOM,
-  discoveryServiceType: roomServiceType(ROOM),
+  discoveryServiceType: '_sym._tcp',
+  discoveryBrowseTypes: LEGACY_BROWSE ? [LEGACY_BROWSE] : [],
   relay: relayUrl,
   relayToken: relayToken,
   silent: false,
diff --git a/bin/sym.js b/bin/sym.js
index 527d593d..bb8df349 100755
--- a/bin/sym.js
+++ b/bin/sym.js
@@ -47,7 +47,7 @@ const path = require('path');
 const { execSync, spawn } = require('child_process');
 
 const { getSocketPath, getLogDir } = require('../lib/platform');
-const { isValidRoom, roomServiceType } = require('../lib/rooms');
+const { isValidRoom } = require('../lib/rooms');
 // The CLI's state lives where its daemon's does (SYM_STATE_DIR, default ~/.sym): rooted in the
 // home, two SYM_STATE_DIR deployments shared one pid file (`sym stop` for one stopped the other),
 // and a room or relay set for a rooted daemon went to a file it never reads.
@@ -248,7 +248,7 @@ function applyStartFlags() {
   const g = flagValue('--room');
   if (g !== null) {
     if (!isValidRoom(g)) {
-      console.error(`Invalid room "${g}" — use kebab-case (e.g. backend-team) or "default".`);
+      console.error(`Invalid room "${g}" — a room is [a-z0-9._-], 1 to 64 characters (e.g. backend-team, acme.prod), or "default"; not "sym".`);
       process.exit(1);
     }
     persistRoom(g);
@@ -322,9 +322,9 @@ function restartIntoRoom(room, doneMsg) {
 
 function cmdJoin() {
   const g = args[1];
-  if (!g) { console.error('Usage: sym join <room>   (kebab-case, or "default")'); process.exit(1); }
+  if (!g) { console.error('Usage: sym join <room>   ([a-z0-9._-], 1 to 64 characters, or "default")'); process.exit(1); }
   if (!isValidRoom(g)) {
-    console.error(`Invalid room "${g}" — use kebab-case (e.g. backend-team) or "default".`);
+    console.error(`Invalid room "${g}" — a room is [a-z0-9._-], 1 to 64 characters (e.g. backend-team, acme.prod), or "default"; not "sym".`);
     process.exit(1);
   }
   restartIntoRoom(g, `joined room "${g}".`);
@@ -336,7 +336,7 @@ function cmdLeave() {
 
 function cmdRoom() {
   const g = readRoom();
-  console.log(`current room: ${g}   (${roomServiceType(g)})`);
+  console.log(`current room: ${g}   (advertised on _sym._tcp, TXT room=${g})`);
 }
 
 // Discover SYM-mesh rooms with at least one node online on this LAN.
@@ -1269,7 +1269,7 @@ ${bold('Usage:')}
   sym peers                          List connected peers
   sym room                          Show the current room
   sym rooms                         Discover SYM-mesh rooms live on the LAN
-  sym join <name>                    Switch into a room (kebab-case, or "default")
+  sym join <name>                    Switch into a room ([a-z0-9._-], or "default")
   sym leave                          Return to the default global mesh
   sym metrics                        Show protocol metrics and LLM cost
   sym publish [flags] <json>         Publish a projection (CAT7 categories as JSON)
diff --git a/lib/discovery.js b/lib/discovery.js
index 17465f5a..4c1a1e58 100644
--- a/lib/discovery.js
+++ b/lib/discovery.js
@@ -4,7 +4,7 @@
  * Discovery — pluggable peer discovery for SYM mesh nodes.
  *
  * Three implementations:
- * - BonjourDiscovery: LAN discovery via dns-sd (macOS) or bonjour-service (Linux)
+ * - BonjourDiscovery: LAN discovery via bonjour-service (multicast DNS, every platform)
  * - NullDiscovery: no-op for relay-only nodes and tests
  *
  * SymNode accepts a discovery instance via opts.discovery. If not provided,
@@ -56,6 +56,9 @@ class Discovery extends EventEmitter {
    */
   async start(identity, log) { return 0; }
 
+  /** The node's room (§5.8), advertised in TXT `room` (§5.1). Called before start(). */
+  setRoom(room) { this._room = room; }
+
   /**
    * Stop discovery: close listener, stop browsing, clean up.
    * @returns {Promise<void>}
@@ -99,6 +102,43 @@ const LISTENER_INFLIGHT_PER_HOST = 16;
 /** A LAN peer not re-announced for this long is dropped from the reconnect cache (see _reconnectCachedPeers). */
 const BONJOUR_PEER_TTL_MS = 5 * 60_000;
 
+// ── TXT records (RFC 6763 §6) ────────────────────────────────
+
+/**
+ * A DNS-SD TXT record's keys, as RFC 6763 §6.4 reads them and MMP §5.1 requires: a key is compared
+ * case-insensitively (held lowercase), and when a key occurs more than once the FIRST occurrence wins.
+ * A string with no `=` is a key present with no value (null); one that begins with `=` is ignored.
+ * @param {Array<Buffer|string>} strings - the record's character-strings, in order
+ * @returns {Map<string, string|null>}
+ */
+function parseTxtStrings(strings) {
+  const out = new Map();
+  for (const raw of Array.isArray(strings) ? strings : []) {
+    const str = Buffer.isBuffer(raw) ? raw.toString('utf8') : (typeof raw === 'string' ? raw : null);
+    if (str === null || str.length === 0 || str[0] === '=') continue;
+    const eq = str.indexOf('=');
+    const key = (eq === -1 ? str : str.slice(0, eq)).toLowerCase();
+    if (out.has(key)) continue;
+    out.set(key, eq === -1 ? null : str.slice(eq + 1));
+  }
+  return out;
+}
+
+/** A discovered service's TXT keys: from its raw strings when the library kept them, else its object. */
+function serviceTxt(service) {
+  if (service && Array.isArray(service.rawTxt)) return parseTxtStrings(service.rawTxt);
+  const obj = service && service.txt && typeof service.txt === 'object' ? service.txt : {};
+  return parseTxtStrings(Object.entries(obj).map(([k, v]) => `${k}=${v}`));
+}
+
+/**
+ * Whether an advertisement's `mmp` value lists protocol version 2.0 (MMP §5.1): a comma-separated
+ * list with no spaces; versions this node does not know are ignored.
+ */
+function mmpLists20(mmp) {
+  return typeof mmp === 'string' && mmp.split(',').includes('2.0');
+}
+
 // ── Bonjour Discovery ────────────────────────────────────────
 
 /**
@@ -115,6 +155,9 @@ class BonjourDiscovery extends Discovery {
    *   sub-mesh on the same LAN (e.g. `_melotune._tcp`) pass their own
    *   service type here. Peers on different service types never discover
    *   each other at the mDNS layer.
+   * @param {string[]} [opts.browseTypes] — further service types to browse, never advertised: the
+   *   §5.1 migration browse of the per-room type earlier releases advertised (core/room-id
+   *   legacyServiceType), so a 2.0 node still advertising only that type is found.
    * @param {number} [opts.handshakeTimeoutMs=10000] — inbound identification deadline (MMP §19.1)
    */
   constructor(opts = {}) {
@@ -129,13 +172,11 @@ class BonjourDiscovery extends Discovery {
     this._bonjourType = this._serviceType
       .replace(/^_/, '')
       .replace(/\._tcp\.?$/, '');
-    // Regex anchor for dns-sd browse output. Escape for embedding.
-    this._browseAnchor = this._serviceType.replace(/\./g, '\\.');
+    // The types browsed: the advertised one, then the migration browse (§5.1).
+    this._browseTypes = [...new Set([this._serviceType, ...(Array.isArray(opts.browseTypes) ? opts.browseTypes.filter((t) => typeof t === 'string' && /^_[a-z0-9-]{1,15}\._tcp$/.test(t)) : [])])];
     this._server = null;
-    this._dnssdRegister = null;
-    this._dnssdBrowse = null;
     this._bonjour = null;
-    this._browser = null;
+    this._browsers = [];
     this._port = 0;
     this._identity = null;
     this._log = () => {};
@@ -172,17 +213,7 @@ class BonjourDiscovery extends Discovery {
   }
 
   async stop() {
-    // Kill dns-sd processes
-    if (this._dnssdRegister) {
-      try { this._dnssdRegister.kill(); } catch {}
-      this._dnssdRegister = null;
-    }
-    if (this._dnssdBrowse) {
-      try { this._dnssdBrowse.kill(); } catch {}
-      this._dnssdBrowse = null;
-    }
-
-    // Stop bonjour-service fallback
+    // Stop bonjour-service
     if (this._reconnectTimer) {
       clearInterval(this._reconnectTimer);
       this._reconnectTimer = null;
@@ -191,10 +222,7 @@ class BonjourDiscovery extends Discovery {
       this._bonjourPeerCache.clear();
       this._bonjourPeerCache = null;
     }
-    if (this._browser) {
-      try { this._browser.stop(); } catch {}
-      this._browser = null;
-    }
+    this._stopBrowsers();
     if (this._bonjour) {
       try { this._bonjour.destroy(); } catch {}
       this._bonjour = null;
@@ -286,84 +314,6 @@ class BonjourDiscovery extends Discovery {
     transport.on('close', () => { clearTimeout(timeout); leave(); });
   }
 
-  _startDnsSd() {
-    const { spawn } = require('child_process');
-    const identity = this._identity;
-
-    const txtParts = [
-      `node-id=${identity.nodeId}`,
-      `node-name=${identity.name}`,
-      `public-key=${identity.publicKey}`,
-      `hostname=${identity.hostname}`,
-      'mmp=2.0',
-      `room=${this._room}`,
-    ];
-    this._dnssdRegister = spawn('dns-sd', [
-      '-R', identity.nodeId, this._serviceType, 'local.',
-      String(this._port), ...txtParts,
-    ], { stdio: 'ignore', windowsHide: true });
-
-    this._dnssdRegister.on('error', (err) => {
-      this._log(`dns-sd not available, falling back to bonjour-service: ${err.message}`);
-      this._dnssdRegister = null;
-      if (this._dnssdBrowse) {
-        try { this._dnssdBrowse.kill(); } catch {}
-        this._dnssdBrowse = null;
-      }
-      this._startBonjourFallback();
-    });
-
-    this._dnssdBrowse = spawn('dns-sd', ['-B', this._serviceType], { stdio: ['ignore', 'pipe', 'ignore'], windowsHide: true });
-    this._dnssdBrowse.on('error', () => { this._dnssdBrowse = null; });
-
-    const browseRegex = new RegExp(`\\s+Add\\s+\\d+\\s+\\d+\\s+\\S+\\s+${this._browseAnchor}\\.\\s+(.+)$`);
-    let browseBuffer = '';
-    this._dnssdBrowse.stdout.on('data', (data) => {
-      browseBuffer += data.toString();
-      let idx;
-      while ((idx = browseBuffer.indexOf('\n')) !== -1) {
-        const line = browseBuffer.slice(0, idx).trim();
-        browseBuffer = browseBuffer.slice(idx + 1);
-        const match = line.match(browseRegex);
-        if (match) {
-          const instanceName = match[1].trim();
-          if (instanceName === identity.nodeId) continue;
-          this._resolvePeer(instanceName);
-        }
-      }
-    });
-  }
-
-  _resolvePeer(instanceName) {
-    const { spawn } = require('child_process');
-    const identity = this._identity;
-    const resolve = spawn('dns-sd', ['-L', instanceName, this._serviceType, 'local.'], { stdio: ['ignore', 'pipe', 'ignore'], windowsHide: true });
-    let resolveBuffer = '';
-    const timeout = setTimeout(() => resolve.kill(), 5000);
-
-    resolve.stdout.on('data', (data) => {
-      resolveBuffer += data.toString();
-      const match = resolveBuffer.match(/can be reached at (.+?):(\d+)/);
-      if (!match) return;
-
-      clearTimeout(timeout);
-      const host = match[1];
-      const port = parseInt(match[2]);
-
-      const nodeIdMatch = resolveBuffer.match(/node-id=(\S+)/);
-      const nodeNameMatch = resolveBuffer.match(/node-name=(\S+)/);
-      const mmpMatch = resolveBuffer.match(/mmp=(\S+)/);
-      const roomMatch = resolveBuffer.match(/room=(\S+)/);
-      const peerId = nodeIdMatch ? nodeIdMatch[1] : instanceName;
-      const peerName = nodeNameMatch ? nodeNameMatch[1] : 'unknown';
-
-      resolve.kill();
-
-      if (peerId === identity.nodeId) return;
-      this.emit('peer-found', host, port, peerId, peerName, { mmp: mmpMatch ? mmpMatch[1] : null, room: roomMatch ? roomMatch[1] : null, source: 'bonjour' });
-    });
-  }
-
   _startBonjourFallback() {
     const identity = this._identity;
     // A host whose multicast socket cannot bind or send (Termux on Android without a multicast
@@ -393,16 +343,46 @@ class BonjourDiscovery extends Discovery {
       txt: { 'node-id': identity.nodeId, 'node-name': identity.name, 'public-key': identity.publicKey, 'hostname': identity.hostname, mmp: '2.0', room: this._room },
     });
 
-    this._browser = this._bonjour.find({ type: this._bonjourType });
+    this._makeServiceHandlers(identity);
+    this._startBrowsers();
 
+    // Reconnect: restart the browser to force a fresh mDNS query.
+    // bonjour-service caches discoveries and only fires 'up' once per
+    // service name. If a peer restarts with a new port, the stale
+    // cache has the wrong port and TCP silently fails. Restarting the
+    // browser clears the cache and re-discovers with current ports.
+    this._reconnectCachedPeers = () => {
+      // Also try cached peers for fast reconnect when port hasn't changed. A peer that died without
+      // an mDNS goodbye (killed, crashed, the host asleep) never fires 'down', so it used to stay
+      // cached and be re-dialled every 15 s for as long as this node ran: on one host up to 17 dead
+      // endpoints at once, 8.6 million "Connect failed" lines, 837 MB of the daemon's 1 GB log
+      // (2026-09-28). Each browser restart below re-announces every live peer, so one not
+      // announced for BONJOUR_PEER_TTL_MS (about 20 restarts) is gone, and is dropped.
+      for (const [peerId, info] of this._cachedPeersToReoffer()) {
+        this.emit('peer-found', info.address, info.port, peerId, info.peerName, info.info || {});
+      }
+      // Restart the browsers to discover updated ports
+      this._stopBrowsers();
+      this._startBrowsers();
+    };
+
+    // Background timer: periodic reconnect every 15s.
+    this._reconnectTimer = setInterval(this._reconnectCachedPeers, 15000);
+  }
+
+  /** The browsers' handlers: a discovered service is offered to the node with its TXT read as §6.4 says. */
+  _makeServiceHandlers(identity) {
     // Cache discovered peers so we can reconnect when TCP drops.
     this._bonjourPeerCache = new Map();
 
     // Named handlers so the browser can be restarted with the same logic.
     this._onServiceUp = (service) => {
-      const peerId = service.txt?.['node-id'];
+      // TXT keys as RFC 6763 §6.4 reads them (MMP §5.1): case-insensitive, the first occurrence wins.
+      // bonjour-service's own `txt` lets the last one win and keeps case, so the raw strings are read.
+      const txt = serviceTxt(service);
+      const peerId = txt.get('node-id');
       if (!peerId || peerId === identity.nodeId) return;
-      const peerName = service.txt?.['node-name'] || 'unknown';
+      const peerName = txt.get('node-name') || 'unknown';
       // Prefer IPv4 over IPv6 link-local.
       const allAddrs = service.addresses || [];
       const ipv4 = allAddrs.find(a => a && !a.includes(':'));
@@ -410,7 +390,7 @@ class BonjourDiscovery extends Discovery {
       const port = service.port;
       if (!address || !port) return;
 
-      const info = { mmp: typeof service.txt?.mmp === 'string' ? service.txt.mmp : null, room: typeof service.txt?.room === 'string' ? service.txt.room : null, source: 'bonjour' };
+      const info = { mmp: typeof txt.get('mmp') === 'string' ? txt.get('mmp') : null, room: typeof txt.get('room') === 'string' ? txt.get('room') : null, source: 'bonjour' };
       // Update cache with current address:port, and when this peer was last announced
       this._bonjourPeerCache.set(peerId, { address, port, peerName, info, seenAt: Date.now() });
 
@@ -418,39 +398,24 @@ class BonjourDiscovery extends Discovery {
     };
 
     this._onServiceDown = (service) => {
-      const peerId = service.txt?.['node-id'];
+      const peerId = serviceTxt(service).get('node-id');
       if (peerId) this._bonjourPeerCache.delete(peerId);
     };
+  }
 
-    this._browser.on('up', this._onServiceUp);
-    this._browser.on('down', this._onServiceDown);
-
-    // Reconnect: restart the browser to force a fresh mDNS query.
-    // bonjour-service caches discoveries and only fires 'up' once per
-    // service name. If a peer restarts with a new port, the stale
-    // cache has the wrong port and TCP silently fails. Restarting the
-    // browser clears the cache and re-discovers with current ports.
-    this._reconnectCachedPeers = () => {
-      // Also try cached peers for fast reconnect when port hasn't changed. A peer that died without
-      // an mDNS goodbye (killed, crashed, the host asleep) never fires 'down', so it used to stay
-      // cached and be re-dialled every 15 s for as long as this node ran: on one host up to 17 dead
-      // endpoints at once, 8.6 million "Connect failed" lines, 837 MB of the daemon's 1 GB log
-      // (2026-09-28). Each browser restart below re-announces every live peer, so one not
-      // announced for BONJOUR_PEER_TTL_MS (about 20 restarts) is gone, and is dropped.
-      for (const [peerId, info] of this._cachedPeersToReoffer()) {
-        this.emit('peer-found', info.address, info.port, peerId, info.peerName, info.info || {});
-      }
-      // Restart the browser to discover updated ports
-      if (this._browser) {
-        try { this._browser.stop(); } catch {}
-      }
-      this._browser = this._bonjour.find({ type: this._bonjourType });
-      this._browser.on('up', this._onServiceUp);
-      this._browser.on('down', this._onServiceDown);
-    };
+  /** One bonjour-service browser per browsed type (the advertised one, then the migration browse). */
+  _startBrowsers() {
+    if (!this._bonjour) return;
+    for (const type of this._browseTypes) {
+      const b = this._bonjour.find({ type: type.replace(/^_/, '').replace(/\._tcp\.?$/, '') });
+      b.on('up', this._onServiceUp);
+      b.on('down', this._onServiceDown);
+      this._browsers.push(b);
+    }
+  }
 
-    // Background timer: periodic reconnect every 15s.
-    this._reconnectTimer = setInterval(this._reconnectCachedPeers, 15000);
+  _stopBrowsers() {
+    for (const b of this._browsers.splice(0)) { try { b.stop(); } catch {} }
   }
 
   /** The cached LAN peers to offer for reconnection now. A peer not announced for BONJOUR_PEER_TTL_MS
@@ -564,13 +529,13 @@ class BonjourDiscovery extends Discovery {
         try { process.kill(rec.pid, 0); } catch (e) { alive = e.code === 'EPERM'; }
       }
       if (!alive) { try { fs.unlinkSync(full); } catch {} continue; } // GC dead entries, any room
-      // Room isolation — only mesh the same service type (MMP §5.8).
-      if (rec.serviceType && rec.serviceType !== this._serviceType) continue;
+      // A registration under a type this node browses (the room itself is filtered on TXT room by the
+      // node, §5.1).
+      if (rec.serviceType && !this._browseTypes.includes(rec.serviceType)) continue;
       const fresh = rec.ts && (now - rec.ts) < 30000;
       if (!fresh) continue;
       if (!rec.port) continue;
-      // Tie-break: the lower nodeId dials; the higher one accepts the inbound.
-      // Mirrors the Bonjour _resolvePeer path so we connect exactly once.
+      // Tie-break: the lower nodeId dials; the higher one accepts the inbound, so the pair connects once.
       if (identity.nodeId < rec.nodeId) {
         this.emit('peer-found', '127.0.0.1', rec.port, rec.nodeId, rec.name, { mmp: rec.mmp, room: rec.room, source: 'loopback' });
       }
@@ -611,4 +576,4 @@ class NullDiscovery extends Discovery {
   async stop() {}
 }
 
-module.exports = { Discovery, BonjourDiscovery, NullDiscovery, createBonjour };
+module.exports = { Discovery, BonjourDiscovery, NullDiscovery, createBonjour, parseTxtStrings, serviceTxt, mmpLists20 };
diff --git a/lib/node.js b/lib/node.js
index 39704e51..97aeddc7 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -82,7 +82,7 @@ const ATTEST_FRAMES = new Set(Object.values(ATTEST_FRAME));
 const LEGACY_REFUSAL_REPORT_MS = 60_000;
 const { SEND_FAILURE, MAX_FRAME_SIZE } = require('./frame-parser');
 const { RelayConnection } = require('./relay');
-const { BonjourDiscovery, NullDiscovery } = require('./discovery');
+const { BonjourDiscovery, NullDiscovery, mmpLists20 } = require('./discovery');
 
 /**
  * Reduce a weighted verdict tally `{verdict -> weight}` to its dominant verdict and the
@@ -745,11 +745,18 @@ class SymNode extends EventEmitter {
     // at the mDNS layer so nodes in different rooms never discover each
     // other. Matches the sym-swift SymNode(discoveryServiceType:) parameter.
     this._discoveryServiceType = opts.discoveryServiceType || '_sym._tcp';
+    // §5.1 migration (MMP 2.0 update 1): every room is advertised on _sym._tcp with TXT room; the
+    // per-room types earlier releases advertised are browsed too (opts.discoveryBrowseTypes), never
+    // advertised.
+    this._discoveryBrowseTypes = Array.isArray(opts.discoveryBrowseTypes) ? opts.discoveryBrowseTypes : [];
     this._discovery = opts.discovery || (
       opts.relayOnly
         ? new NullDiscovery()
-        : new BonjourDiscovery({ serviceType: this._discoveryServiceType, room: this._room })
+        : new BonjourDiscovery({ serviceType: this._discoveryServiceType, browseTypes: this._discoveryBrowseTypes, room: this._room })
     );
+    // The room a discovery advertises in TXT is this node's (§5.1), whoever built the discovery: the
+    // dial filter compares TXT room with it, so an advertisement in another room is never this node's.
+    if (typeof this._discovery.setRoom === 'function') this._discovery.setRoom(this._room);
 
     // Wake
     this._wakeChannel = opts.wakeChannel || null;
@@ -2092,9 +2099,13 @@ class SymNode extends EventEmitter {
       const peerId = wireNodeId(foundId);
       if (!peerId || peerId === this.nodeId) return;
       const peerName = wireName(foundName);
-      // A record without TXT mmp=2.0 is a legacy node: never dialled as Core Secure. Only a
-      // configured Legacy Import route reaches it (design D7), by its own endpoint.
-      if (!info || info.mmp !== '2.0') return;
+      // A record whose TXT mmp does not list 2.0 (a comma-separated version list, MMP §5.1) is not
+      // dialled as Core Secure; one without mmp is a legacy node, reached only by a configured
+      // Legacy Import route (design D7), by its own endpoint.
+      if (!info || !mmpLists20(info.mmp)) return;
+      // §5.1: connect only to advertisements whose TXT room equals this node's (absent reads as
+      // `default`). A hint, never an admission: the handshake decides membership.
+      if ((info.room === null || info.room === undefined ? 'default' : info.room) !== this._room) return;
       // §5.1: the lexicographically smaller nodeId initiates; the other MUST NOT.
       if (!(this.nodeId < peerId)) return;
       // A peer that refused this node with 1009 IDENTITY_CONFLICT is not dialled again (review F).
diff --git a/tests/spec-update-discovery.test.js b/tests/spec-update-discovery.test.js
new file mode 100644
index 00000000..c63d69a2
--- /dev/null
+++ b/tests/spec-update-discovery.test.js
@@ -0,0 +1,119 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME before lib/config loads
+
+/**
+ * LAN discovery as MMP 2.0 update 1 states it (#17, #22; PR #43 at 2660ab9): one service type for
+ * every room, with the room in TXT `room`; a node dials only advertisements whose TXT room is its own
+ * and whose `mmp` (a comma-separated version list) lists 2.0; TXT keys read as RFC 6763 §6.4 says,
+ * case-insensitive with the first occurrence winning; the per-room type earlier releases advertised
+ * is browsed, never advertised, and only where it is a valid RFC 6335 name. Each test fails on c0e615f.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const crypto = require('crypto');
+const { SymNode } = require('../lib/node');
+const { Discovery, BonjourDiscovery } = require('../lib/discovery');
+const { nodeDirById } = require('../lib/config');
+
+const made = [];
+const uniq = (b) => `${b}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+class FakeDiscovery extends Discovery { async start() { return 0; } async stop() {} }
+function node(room) {
+  const n = new SymNode({ name: uniq('disc'), silent: true, discovery: new FakeDiscovery(), room });
+  made.push(n);
+  n._connectToPeer = (address, port, peerId) => { (n._dialled ||= []).push(peerId); };
+  return n;
+}
+async function stopAll() {
+  for (const n of made.splice(0)) { try { await n.stop(); } catch { /* */ } try { fs.rmSync(nodeDirById(n.nodeId), { recursive: true, force: true }); } catch { /* */ } }
+}
+const BIG = () => `ffffffff-${crypto.randomBytes(2).toString('hex')}-7fff-bfff-${crypto.randomBytes(6).toString('hex')}`; // larger than any v7 nodeId
+
+describe('the dial filter (§5.1)', () => {
+  it('dials only an advertisement whose TXT room is this node\'s room; an absent room reads as default', async () => {
+    try {
+      const A = node('backend-team');
+      await A.start();
+      const ids = [BIG(), BIG(), BIG()];
+      A._discovery.emit('peer-found', '10.0.0.1', 1, ids[0], 'x', { mmp: '2.0', room: 'other-team', source: 'bonjour' });
+      A._discovery.emit('peer-found', '10.0.0.2', 2, ids[1], 'y', { mmp: '2.0', room: null, source: 'bonjour' });
+      A._discovery.emit('peer-found', '10.0.0.3', 3, ids[2], 'z', { mmp: '2.0', room: 'backend-team', source: 'bonjour' });
+      assert.deepStrictEqual(A._dialled, [ids[2]]);
+      const D = node('default');
+      await D.start();
+      const d = BIG();
+      D._discovery.emit('peer-found', '10.0.0.4', 4, d, 'w', { mmp: '2.0', room: null, source: 'bonjour' });
+      assert.deepStrictEqual(D._dialled, [d]);
+    } finally { await stopAll(); }
+  });
+
+  it('mmp is a comma-separated version list: 2.0 among others is dialled, a list without it is not', async () => {
+    try {
+      const A = node('default');
+      await A.start();
+      const [a, b, c] = [BIG(), BIG(), BIG()];
+      A._discovery.emit('peer-found', '10.0.0.1', 1, a, 'a', { mmp: '2.0,2.1', room: 'default' });
+      A._discovery.emit('peer-found', '10.0.0.2', 2, b, 'b', { mmp: '2.1', room: 'default' });
+      A._discovery.emit('peer-found', '10.0.0.3', 3, c, 'c', { mmp: '2.0, 2.1', room: 'default' });
+      assert.deepStrictEqual(A._dialled, [a, c], '"2.0, 2.1" still lists "2.0"');
+    } finally { await stopAll(); }
+  });
+});
+
+describe('TXT keys (RFC 6763 §6.4)', () => {
+  const { parseTxtStrings, serviceTxt } = require('../lib/discovery');
+  it('compared case-insensitively; the first occurrence wins; =value strings are ignored', () => {
+    const t = parseTxtStrings(['MMP=2.0', 'mmp=1.0', 'Room=acme.prod', '=x', 'flag', 'empty=']);
+    assert.strictEqual(t.get('mmp'), '2.0');
+    assert.strictEqual(t.get('room'), 'acme.prod');
+    assert.strictEqual(t.get('flag'), null);
+    assert.strictEqual(t.get('empty'), '');
+    assert.strictEqual(t.has(''), false);
+  });
+  it('a service is read from its raw strings, so a node named "mmp=2.0" is not a 2.0 advertisement', () => {
+    const svc = { rawTxt: [Buffer.from('node-id=x'), Buffer.from('node-name=mmp=2.0')], txt: { 'node-id': 'x', 'node-name': 'mmp=2.0' } };
+    assert.strictEqual(serviceTxt(svc).get('mmp'), undefined);
+    const dup = { rawTxt: [Buffer.from('room=first'), Buffer.from('ROOM=second')], txt: { room: 'first', ROOM: 'second' } };
+    assert.strictEqual(serviceTxt(dup).get('room'), 'first');
+  });
+  it('a discovered service reaches the node with the TXT as §6.4 reads it', () => {
+    const d = new BonjourDiscovery({ mdns: false });
+    const found = [];
+    d.on('peer-found', (address, port, id, name, info) => found.push({ id, name, info }));
+    d._makeServiceHandlers({ nodeId: 'self' });
+    d._onServiceUp({ addresses: ['10.0.0.9'], port: 9, rawTxt: ['NODE-ID=peer-1', 'node-name=mmp=2.0', 'Room=acme.prod', 'room=other'].map((x) => Buffer.from(x)) });
+    assert.deepStrictEqual(found, [{ id: 'peer-1', name: 'mmp=2.0', info: { mmp: null, room: 'acme.prod', source: 'bonjour' } }]);
+  });
+});
+
+describe('one service type, and the migration browse (§5.1)', () => {
+  it('advertises on the one type and browses the legacy per-room type too', () => {
+    const published = []; const browsed = []; void published;
+    const d = new BonjourDiscovery({ serviceType: '_sym._tcp', browseTypes: ['_backend-team._tcp', 'not a type'], room: 'backend-team' });
+    d._identity = { nodeId: 'self', name: 'n', publicKey: 'pk', hostname: 'h' };
+    d._bonjour = { publish: (o) => published.push(o), find: (o) => { browsed.push(o.type); return { on() {}, stop() {} }; }, destroy() {} };
+    d._makeServiceHandlers(d._identity);
+    d._startBrowsers();
+    assert.deepStrictEqual(browsed, ['sym', 'backend-team'], 'the bad type is dropped');
+    d._stopBrowsers();
+    assert.deepStrictEqual(d._browsers, []);
+  });
+  it('a discovery the host built advertises the node\'s room, so two nodes in one named room find each other', async () => {
+    try {
+      const d = new BonjourDiscovery({ mdns: false });
+      const n = new SymNode({ name: uniq('disc-r'), silent: true, room: 'acme.prod', discovery: d });
+      made.push(n);
+      assert.strictEqual(d._room, 'acme.prod');
+    } finally { await stopAll(); }
+  });
+  it('a node given discoveryBrowseTypes browses them', async () => {
+    try {
+      const n = new SymNode({ name: uniq('disc-b'), silent: true, room: 'backend-team', discoveryBrowseTypes: ['_backend-team._tcp'] });
+      made.push(n);
+      assert.deepStrictEqual(n._discovery._browseTypes, ['_sym._tcp', '_backend-team._tcp']);
+    } finally { await stopAll(); }
+  });
+});

From 850136dfd248c2f3adfc1fd8b3bf2791a6522f6f Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 8 Oct 2026 11:58:41 +0100
Subject: [PATCH 131/148] relay client: 4007 an ordinary close; the fan-out
 forgotten with its socket; relay-auth lowercase (#25, #20 deferred)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

MMP 2.0 update 1, §4.4.9 (PR #43 at 2660ab9), and the relay review:

- 4007 is reconnected with backoff like any close but 4004 and 4006. It belongs to relay-auth key
  proof (draft #20), deferred past 0.14.0 and not in MMP; its review found that "MUST NOT reconnect
  after 4007" makes a lockout of up to a week. It was a hard stop here.
- What a relay listed in relay-peers.features (fan-out) is forgotten when its socket closes: the
  next relay says its own. It was kept across connections.
- relay-auth carries the nodeId in its lowercase form (§3.1.1; a relay refuses another with 4002).

Already as update 1 states, now pinned by tests: 1001, 1011, 1013, 4005 and 4008 reconnect with
backoff (1009 is handled the same way: every code outside HARD_STOPS is).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QRVMpaJkAA2fFbvuHCEzqH
---
 lib/relay.js              | 32 ++++++++++++-------------
 tests/relay-state.test.js | 50 +++++++++++++++++++++++++++++++++++----
 2 files changed, 61 insertions(+), 21 deletions(-)

diff --git a/lib/relay.js b/lib/relay.js
index 63a44022..96a86901 100644
--- a/lib/relay.js
+++ b/lib/relay.js
@@ -118,14 +118,16 @@ const FANOUT_FEATURE = 'fanout';
  * statement about this node's identity that a retry cannot change, and retrying would only fight the
  * holder the relay chose.
  *   4004 replaced — another process re-authenticated as this nodeId and the relay took it;
- *   4006 duplicate rejected — this node is the newcomer and the existing holder is the legitimate one;
- *   4007 key conflict — the relay binds this nodeId to a different key (draft, MMP spec PR
- *        meshcognition-website#20: handled when a relay sends it; relay-auth v2 is not implemented).
+ *   4006 duplicate rejected — this node is the newcomer and the existing holder is the legitimate one.
+ *
+ * Every other close is reconnected with backoff (MMP 2.0 update 1, §4.4.9): 4005, 4008, and the
+ * RFC 6455 closes 1001, 1009, 1011 and 1013 by the table, and 4007 too. 4007 belongs to relay-auth
+ * key proof (draft PR meshcognition-website#20), which is deferred past 0.14.0 and not in MMP: its
+ * review found a lockout in "MUST NOT reconnect after 4007", so it is an ordinary close here.
  */
 const HARD_STOPS = {
   4004: { phase: 'collision', kind: 'replaced' },
   4006: { phase: 'duplicate-rejected', kind: 'duplicate-rejected' },
-  4007: { phase: 'key-conflict', kind: 'key-conflict' },
 };
 const STOP_PHASES = Object.values(HARD_STOPS).map((h) => h.phase);
 const TERMINAL_PHASES = ['connected', 'refused', ...STOP_PHASES, 'off'];
@@ -209,7 +211,7 @@ class RelayConnection {
     this._authRefusedRetryMs = opts.authRefusedRetryMs || 10 * 60 * 1000;
     this._authRefused = false;
     this._nodeName = opts.nodeName;
-    this._identityCollision = false;   // a hard stop (4004 / 4006 / 4007): never reconnect on its own
+    this._identityCollision = false;   // a hard stop (4004 / 4006): never reconnect on its own
     this._stopped = null;              // { code, kind, reason, at } — why, for state() and describe()
 
     this._relayWs = null;
@@ -238,7 +240,7 @@ class RelayConnection {
   /**
    * Snapshot of the relay connection as the host should reason about it.
    * phase: off | idle | connecting | authenticating | connected | reconnecting | refused | collision (4004)
-   *        | duplicate-rejected (4006) | key-conflict (4007) — the last three are hard stops (HARD_STOPS)
+   *        | duplicate-rejected (4006) — the last two are hard stops (HARD_STOPS)
    */
   state() {
     return {
@@ -283,9 +285,6 @@ class RelayConnection {
         return `STOPPED: ${s.url} refused this connection because another live connection already holds this ` +
           `identity (4006); that holder is the legitimate one. Not reconnecting — stop the other process, or ` +
           `restart this one after it has gone.`;
-      case 'key-conflict':
-        return `STOPPED: ${s.url} binds this nodeId to a DIFFERENT key (4007): another party holds this nodeId at ` +
-          `the relay, or this identity was re-keyed. Not reconnecting — check which key is genuine before anything else.`;
       case 'reconnecting': {
         const last = s.lastClose ? `last close ${s.lastClose.code}${s.lastClose.reason ? `: ${s.lastClose.reason}` : ''}` :
           (s.lastError ? `last error: ${s.lastError.message}` : 'no answer');
@@ -372,7 +371,8 @@ class RelayConnection {
     const identity = this._getIdentity();
     const auth = {
       type: 'relay-auth',
-      nodeId: identity.nodeId,
+      // The lowercase form (MMP §3.1.1; relay-frame.schema.json): a relay refuses any other with 4002.
+      nodeId: String(identity.nodeId).toLowerCase(),
       name: this._nodeName,
       engine: ENGINE_VERSION,
       wakeChannel: this._wakeChannel || undefined,
@@ -472,8 +472,10 @@ class RelayConnection {
       if (this._relayPingTimer) { clearInterval(this._relayPingTimer); this._relayPingTimer = null; }
 
       // Section 4.6 + 5.5: every relay session ends with the connection it was bound to; a peer
-      // reachable over the LAN keeps that session. What was queued for the pacer is dropped with it.
+      // reachable over the LAN keeps that session. What was queued for the pacer is dropped with it,
+      // and so is what this relay advertised (relay-peers.features): the next relay says its own.
       this._present.clear();
+      this._fanout = null;
       this._queue.clear();
       if (this._flushTimer) { clearTimeout(this._flushTimer); this._flushTimer = null; }
       try { this._onDisconnected(); } catch (err) { this._log(`Relay disconnect handling failed: ${err && err.message}`); }
@@ -486,8 +488,8 @@ class RelayConnection {
       // loop. Loudly refuse instead — wrong winner is worse than loud
       // failure. The host can listen via onIdentityCollision and decide
       // whether to exit, wait, or alert.
-      // 4006 (the existing holder is legitimate) and 4007 (the relay binds this nodeId to another key)
-      // stop the same way: said once, kept in state().stopped, never retried (see HARD_STOPS).
+      // 4006 (the existing holder is legitimate) stops the same way: said once, kept in
+      // state().stopped, never retried (see HARD_STOPS).
       const hard = HARD_STOPS[code];
       if (hard) {
         const id = this._getIdentity();
@@ -499,9 +501,7 @@ class RelayConnection {
         if (first) {
           const what = code === 4004
             ? 'reports duplicate identity: another process is holding this keypair'
-            : code === 4006
-              ? 'rejected this connection as a duplicate: another live connection holds this identity and is the legitimate holder'
-              : 'binds this nodeId to a DIFFERENT key: another party holds this nodeId at the relay, or this identity was re-keyed';
+            : 'rejected this connection as a duplicate: another live connection holds this identity and is the legitimate holder';
           this._log(`FATAL: relay ${this._relayUrl} ${what} (${code}${reasonStr ? `: ${reasonStr.slice(0, 200)}` : ''}; nodeId=${id.nodeId}, name=${this._nodeName}). Not reconnecting.`);
           if (this._onIdentityCollision) {
             try { this._onIdentityCollision({ nodeId: id.nodeId, name: this._nodeName, code, kind: hard.kind, reason: reasonStr.slice(0, 200) }); } catch (err) {
diff --git a/tests/relay-state.test.js b/tests/relay-state.test.js
index 150b4a0a..6ec12607 100644
--- a/tests/relay-state.test.js
+++ b/tests/relay-state.test.js
@@ -167,12 +167,12 @@ test('destroy() returns the state to idle, never leaves a stale connected/refuse
   } finally { c.stop(); await relay.close(); }
 });
 
-// MMP §4.4.7 / §4.4.9: 4006 (the existing holder is the legitimate one) is a hard stop like 4004;
-// 4007 (draft spec PR meshcognition-website#20: the relay binds this nodeId to a different key) is an
-// identity conflict and stops the same way. Neither is retried; each is said once and kept in state().
-for (const [code, phase, words] of [[4006, 'duplicate-rejected', /\(4006\).*legitimate one\. Not reconnecting/], [4007, 'key-conflict', /DIFFERENT key \(4007\).*Not reconnecting/]]) {
+// MMP §4.4.7 / §4.4.9: 4006 (the existing holder is the legitimate one) is a hard stop like 4004: not
+// retried, said once and kept in state(). (4007, draft PR #20, is deferred and an ordinary close: see
+// the test below.)
+for (const [code, phase, words] of [[4006, 'duplicate-rejected', /\(4006\).*legitimate one\. Not reconnecting/]]) {
   test(`${code}: awaitOutcome resolves with phase ${phase}; no reconnect; said once; kept in state().stopped`, async () => {
-    const relay = fakeRelay((ws) => ws.close(code, code === 4007 ? 'nodeId bound to another key' : 'Duplicate rejected'));
+    const relay = fakeRelay((ws) => ws.close(code, 'Duplicate rejected'));
     const told = [];
     const c = client(relay.url, { onIdentityCollision: (info) => told.push(info) });
     try {
@@ -196,6 +196,46 @@ for (const [code, phase, words] of [[4006, 'duplicate-rejected', /\(4006\).*legi
   });
 }
 
+// MMP 2.0 update 1, §4.4.9: every close other than 4004 and 4006 reconnects with backoff — the RFC 6455
+// closes 1001, 1009, 1011 and 1013 by the table, and 4007, whose draft (#20) is deferred and not in MMP.
+for (const code of [4007, 1001, 1011, 1013, 4005, 4008]) {
+  test(`${code}: an ordinary close, reconnected with backoff`, async () => {
+    const relay = fakeRelay((ws, n) => { if (n === 1) ws.close(code, 'closing'); else ws.send(JSON.stringify({ type: 'relay-peers', peers: [] })); });
+    const c = client(relay.url);
+    try {
+      c.rc.connect();
+      await wait(300);
+      assert.equal(c.rc.state().phase, 'reconnecting');
+      assert.equal(c.rc.state().stopped, null);
+      assert.ok(c.rc.state().nextRetryAt > Date.now(), 'a retry is scheduled');
+      await wait(1500);
+      assert.equal(relay.state.attempts >= 2, true, 'it knocked again');
+      assert.equal(c.rc.state().phase, 'connected');
+    } finally { c.stop(); await relay.close(); }
+  });
+}
+
+test('relay-auth names the nodeId in its lowercase form; a closed socket forgets the fan-out its relay listed', async () => {
+  const frames = [];
+  const relay = fakeRelay((ws, n) => {
+    if (n === 1) { ws.send(JSON.stringify({ type: 'relay-peers', peers: [], features: ['fanout'] })); closeFirst = () => ws.close(1001, 'going away'); }
+  });
+  let closeFirst = null;
+  relay.wss.on('connection', (ws) => ws.on('message', (d) => frames.push(JSON.parse(String(d)))));
+  const id = 'ABCDEF01-2345-7678-9ABC-DEF012345678';
+  const c = client(relay.url, { getIdentity: () => ({ nodeId: id }) });
+  try {
+    c.rc.connect();
+    for (let t = 0; t < 3000 && !(c.rc.state().fanout && closeFirst); t += 10) await wait(10);
+    assert.deepStrictEqual(c.rc.state().fanout, { max: 64 });
+    closeFirst();
+    for (let t = 0; t < 3000 && c.rc.state().phase !== 'reconnecting'; t += 10) await wait(10);
+    assert.equal(c.rc.state().fanout, null, 'forgotten when its socket closed');
+    const auth = frames.find((f) => f.type === 'relay-auth');
+    assert.equal(auth.nodeId, id.toLowerCase());
+  } finally { c.stop(); await relay.close(); }
+});
+
 test('a socket destroy() let go never schedules a reconnect when its close arrives', async () => {
   const relay = fakeRelay((ws) => ws.send(JSON.stringify({ type: 'relay-peers', peers: [] })));
   const c = client(relay.url);

From 64c71bfe83477239fc50d15fa78acea8d8208c96 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 8 Oct 2026 12:10:11 +0100
Subject: [PATCH 132/148] coupling: no echo skip at ingest; no tether on a
 collapsed integration; only gated remixes count (D3, #35, #17)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

MMP 2.0 update 1 (PR #43 at 2660ab9):

- D3 (#35): a receiver MUST NOT skip or refuse a record because its lineage cites the receiver's
  own records. The ingest echo skip is gone: a reply, an outcome or a grounding citing this node is
  verified, gated, stored and delivered like any record. The anti-echo rule sits at the remix
  trigger (MeshAgent: a record citing this node's own records is not remixed) and the remix gate.
- §15.5 (#17): the §15.8 tether does not apply to a collapsed integration. sym's gates keep the
  incoming text, so every integration collapses onto the author's record as signed: no tether is
  evaluated, the record is never stored as a severed root, and no tether attestation is signed about
  it. The retroactive audit applies the same rule: it judges only records this node minted, never a
  peer's record it holds. The §15.8 suites that pinned receiver-side severance now pin the
  exemption.
- #35 counters: remixProduced counts remixes minted through the gated remix path (remix()), not
  every record with parents; the decision log says whether a refused record cites parents (`cites`),
  never that it was a remix, which a receiver cannot know.
- Layer 6 is given no valence or arousal: unsigned (§8.8.4), dropped from Core Secure records by the
  projection and unverified on a Legacy Import record.
- xmesh-insight-v1 is not offered by default (it is registered nowhere; the registry lists
  xmesh-insight as a legacy type); a host adds it with opts.extraExtensions.

Reported, not changed: with the exemption, §15.8 runs nowhere in sym's receive path, and the
remixing side (remix()) has never evaluated the tether; see the round's report.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QRVMpaJkAA2fFbvuHCEzqH
---
 lib/core/svaf-baseline.js                 |   7 +-
 lib/frame-handler.js                      |  49 ++++----
 lib/mesh-agent.js                         |   9 ++
 lib/node.js                               |  44 ++++---
 tests/audit-delivery-authorship.test.js   |  11 +-
 tests/cmb-signing.test.js                 |  10 +-
 tests/lineage-severance-signed.test.js    |  42 ++++---
 tests/lineage-tether-audit.test.js        |  73 +++++++-----
 tests/lineage-tether-neural.test.js       |  51 +++-----
 tests/lineage-tether-reproducible.test.js |  54 ++++-----
 tests/lineage-tether-severance.test.js    | 111 ++++--------------
 tests/neural-after-decision.test.js       |   7 +-
 tests/spec-update-coupling.test.js        | 136 ++++++++++++++++++++++
 tests/stored-entry-annotations.test.js    |   9 +-
 14 files changed, 351 insertions(+), 262 deletions(-)
 create mode 100644 tests/spec-update-coupling.test.js

diff --git a/lib/core/svaf-baseline.js b/lib/core/svaf-baseline.js
index fa3fa713..6aef229e 100644
--- a/lib/core/svaf-baseline.js
+++ b/lib/core/svaf-baseline.js
@@ -535,7 +535,9 @@ async function _processHeuristicSVAF(opts) {
     // about the chain: the tether compares the record with its lineage root, not with memory. This
     // exit returned without one, so the caller had nothing to sever on and a remix drifted past its
     // root's floor kept the lineage exactly where the receiver's memory is thinnest.
-    const csTether = await tetherOfRecord(cs.record.categories, opts.tetherAnchor, config);
+    // A collapsed integration stores the author's record as signed: the §15.8 tether does not apply
+    // to it (§15.5, update 1, #17), so none is evaluated.
+    const csTether = cs.collapsed ? null : await tetherOfRecord(cs.record.categories, opts.tetherAnchor, config);
     // Cold-start: no category was evaluable, so every per-category verdict is `silent`
     // (admitted on temporal grounds to bootstrap memory, gated on no category).
     return { accepted: true, totalDrift: csTotalDrift, decision: csDecision, maxCategoryDrift: 0, categoryVerdicts: computeCategoryVerdicts(verdictDrifts, config), fusedEntry: csEntry, fusedContent: csContent, effectiveTau: tau, changeSignal: 0, coldStartCause, tether: csTether };
@@ -601,7 +603,8 @@ async function _processHeuristicSVAF(opts) {
     collapsed: fused.collapsed || undefined,
   };
 
-  const tether = await tetherOfRecord(fused.record.categories, opts.tetherAnchor, config);
+  // A collapsed integration is the author's record as signed: no §15.8 tether (§15.5, update 1, #17).
+  const tether = fused.collapsed ? null : await tetherOfRecord(fused.record.categories, opts.tetherAnchor, config);
 
   return { accepted: true, decision, totalDrift, categoryVerdicts: computeCategoryVerdicts(verdictDrifts, config, nearestDrifts), fusedEntry, fusedContent, effectiveTau: tau, changeSignal: 0, tether };
 }
diff --git a/lib/frame-handler.js b/lib/frame-handler.js
index 4b7443f5..f0d96a84 100644
--- a/lib/frame-handler.js
+++ b/lib/frame-handler.js
@@ -20,7 +20,8 @@ const { ATTEST_FRAME, fromWireAttestation, fromWireCheckpoint, fromWireWitness,
  *
  * See MMP v0.2.0 Section 9: Coupling & SVAF.
  * See MMP v0.2.0 Section 12: XMesh (Layer 6).
- * Echo loop prevention: the anti-echo rule of MMP v2.0 §15.7 (it was Section 14 in v0.2.0).
+ * Echo loop prevention: the anti-echo rule of MMP v2.0 §15.7 sits at the remix trigger
+ * (lib/mesh-agent.js), never at ingest (update 1, #35).
  *
  * Copyright (c) 2026 SYM.BOT. Apache 2.0 License.
  */
@@ -679,7 +680,7 @@ class FrameHandler {
       const said = this._sayOnceAMinute(this._audienceSaid, `${peerId}|refused|${reason}`, (more) => `[sym-security] CMB ${String(k || '').slice(0, 16)} from ${peerName} refused — ${reason}${error ? ` (${String(error).slice(0, 120)})` : ''}${more}`);
       if (said && typeof this._node._recordDecision === 'function') {
         // The recorded label is the ACTUAL verdict (content-mismatch, bad-signature, …), not a constant.
-        this._node._recordDecision({ method: 'signature', source: peerName, cmbKey: k, decision: 'rejected-signature', totalDrift: null, categoryDrifts: null, gateValues: null, focusLabel: error || reason, remix: recordParents(cmb).length > 0 });
+        this._node._recordDecision({ method: 'signature', source: peerName, cmbKey: k, decision: 'rejected-signature', totalDrift: null, categoryDrifts: null, gateValues: null, focusLabel: error || reason, cites: recordParents(cmb).length > 0 });
       }
       return true;
     };
@@ -1281,27 +1282,11 @@ class FrameHandler {
       return undefined;
     }
 
-    // Echo loop prevention (MMP §15.7, anti-echo): if the incoming CMB's
-    // lineage parents include a key that exists in our local cmbs,
-    // this CMB is a derivative of our own broadcast. Skip all
-    // processing — including mood delivery — to prevent ping-pong
-    // between same-app peers. A directed reply its author signed to us is
-    // a conversation, not an echo, and is processed normally; one only the
-    // unsigned frame calls directed is delivered but never processed.
-    const incomingParents = recordParents(msg.cmb);
-    if (incomingParents.length > 0 && !authenticatedDirected) {
-      const isEcho = incomingParents.some(parentKey => this._node._store.hasLocalKey(parentKey));
-      if (isEcho) {
-        // §9.2.2: a CMB addressed to this node is still delivered — but not admitted, stored or
-        // remixed, which is what drives the ping-pong. De-duplication above bounds it to once.
-        if (msg._directedToMe) {
-          this._surfaceDirectedReject(msg, peerName, peerId, now, 'echo');
-          return;
-        }
-        this._node._log(`Echo detected — parent key found in local cmbs, skipping CMB from ${peerName}`);
-        return;
-      }
-    }
+    // No echo skip here (MMP §15.7, update 1, #35): a receiver MUST NOT skip or refuse a record
+    // because its lineage cites the receiver's own records. A reply, an outcome or a grounding that
+    // cites what this node said is verified, gated and delivered like any record. What keeps a
+    // citing record from driving a ping-pong is the remix trigger (lib/mesh-agent.js), which keeps it
+    // out of this node's own remix cycle, and the remix gate (node.remix(), §15.7).
 
     // CLI-host mode: forward only, do NOT persist. The node is just the
     // local IPC surface for sym CLI commands — it doesn't participate in
@@ -1516,7 +1501,8 @@ class FrameHandler {
       // as it was admitted, with no tether verdict.
       let tether = null;
       try {
-        tether = await tetherOfRecord(fusedEntry.cmb.categories, tetherAnchor, this._admissionPolicy());
+        // A collapsed integration (the author's record kept as signed) has no tether (§15.5).
+        if (fusedEntry.collapsed !== true) tether = await tetherOfRecord(fusedEntry.cmb.categories, tetherAnchor, this._admissionPolicy());
       } catch (err) {
         this._node._log(`§15.8 tether of a record from ${peerName} not evaluated: ${err.message} — stored unverified`);
       }
@@ -1540,8 +1526,10 @@ class FrameHandler {
         content: msg.content || '',
         timestamp: Date.now(),
         type: 'mesh',
-        valence: msg.cmb?.categories?.mood?.valence || 0,
-        arousal: msg.cmb?.categories?.mood?.arousal || 0,
+        // valence and arousal are unsigned (§8.8.4): a Core Secure record's are dropped by the
+        // projection, and a Legacy Import record's are unverified, so Layer 6 is given neither.
+        valence: 0,
+        arousal: 0,
       });
     }
 
@@ -1669,8 +1657,9 @@ class FrameHandler {
         content: result.fusedContent || msg.content || '',
         timestamp: Date.now(),
         type: 'mesh',
-        valence: msg.cmb?.categories?.mood?.valence || result.fusedCMB?.categories?.mood?.valence || 0,
-        arousal: msg.cmb?.categories?.mood?.arousal || result.fusedCMB?.categories?.mood?.arousal || 0,
+        // Unsigned (§8.8.4): Layer 6 is given neither, whatever the record or its fusion carried.
+        valence: 0,
+        arousal: 0,
       });
     }
 
@@ -1752,6 +1741,10 @@ class FrameHandler {
    */
   _applyLineageTether(entry, tether, now) {
     const cmb = entry?.cmb;
+    // §15.5 (MMP 2.0 update 1, #17): a collapsed integration keeps the author's record as signed and
+    // writes no self-edge, and the §15.8 tether does not apply to it: it is never stored as a severed
+    // root, and no tether attestation is signed about it.
+    if (entry && entry.collapsed === true) return false;
     if (!tether?.checked || !cmb) return false;
     let severed = false;
     if (!tether.tethered && recordParents(cmb).length > 0) {
diff --git a/lib/mesh-agent.js b/lib/mesh-agent.js
index 7a229daa..19a8eda2 100644
--- a/lib/mesh-agent.js
+++ b/lib/mesh-agent.js
@@ -258,6 +258,15 @@ class MeshAgent {
     const source = entry.source || recordCreatedBy(entry.cmb) || 'unknown';
     const focusText = entry.cmb?.categories?.focus?.text || entry.content || '';
 
+    // MMP §15.7 anti-echo, at the trigger (update 1, #35): a record whose lineage cites this node's
+    // own records was admitted and delivered like any other, and is kept out of this node's remix
+    // cycle, so a reply to this node never draws a remix back.
+    const cited = [...((recordLineage(entry.cmb) || {}).parents || []), ...((entry.lineage && entry.lineage.parents) || [])];
+    if (cited.some((k) => this._node._store.hasLocalKey(k))) {
+      console.log(`[${this._name}] ${source} cites this node's own record — not remixed (§15.7)`);
+      return;
+    }
+
     // Fix: only remix original domain observations, not remixes of remixes.
     // A CMB with lineage parents is itself a remix — re-remixing it creates
     // cascade storms across agents. Store it (SVAF accepted it) but don't
diff --git a/lib/node.js b/lib/node.js
index 97aeddc7..5da5b0b4 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -64,16 +64,22 @@ const { LegacyImport } = require('./legacy-import');
 const { EXT_CMB_ENCRYPTED_V2 } = require('./core/mmp-extensions');
 const ENGINE_VERSION = require('../package.json').version;
 /**
- * Extensions this node offers in every hello (§16). An extension is active on a session only when
- * both offered it and it was selected (§16.3), and its frames are sent only on such sessions:
+ * Extensions this node offers in every hello by default (§16). An extension is active on a session
+ * only when both offered it and it was selected (§16.3), and its frames are sent only on such
+ * sessions:
  *   cmb-encrypted-v2  — records travel sealed; required: a session without it is not Core Secure.
- *   sym-attest-v1     — admission attestations, checkpoints, witnesses, node-stats (design D1;
- *                       unregistered, so the registry entry is drafted for §16.4).
- *   xmesh-insight-v1  — the Layer-6 insight frame.
+ *   sym-attest-v1     — admission attestations, checkpoints, witnesses, node-stats (registered as a
+ *                       Draft Candidate in MMP 2.0 update 1, §16.4).
+ *
+ * xmesh-insight-v1 (the Layer-6 insight frame) is not offered by default: it is registered nowhere
+ * (the frame registry lists `xmesh-insight` as a legacy type), so a host that wants it adds it with
+ * opts.extraExtensions. (opts.extensions replaces the whole list.)
  */
 const EXT_ATTEST = 'sym-attest-v1';
 const EXT_XMESH_INSIGHT = 'xmesh-insight-v1';
-const OFFERED_EXTENSIONS = Object.freeze([EXT_CMB_ENCRYPTED_V2, EXT_ATTEST, EXT_XMESH_INSIGHT]);
+const OFFERED_EXTENSIONS = Object.freeze([EXT_CMB_ENCRYPTED_V2, EXT_ATTEST]);
+/** An extension token as §16.3 offers it: lowercase, versioned. */
+const EXTENSION_TOKEN = /^[a-z][a-z0-9-]{0,62}-v[0-9]+$/;
 /** Frames that ride only on sessions that selected sym-attest-v1. */
 // The extension's frames (MMP §16.2 names, draft spec PR meshcognition-website#27); sym 0.13's bare
 // `attestation` / `checkpoint` / `witness` / `node-stats` are never sent on a Core Secure session.
@@ -504,7 +510,9 @@ class SymNode extends EventEmitter {
     // persistent X25519 key and no per-peer secret map. `_sessions` holds every live session,
     // authenticating or confirmed; `_peers` only admitted ones, keyed by the PROVEN nodeId.
     this._sessions = new Set();
-    this._offeredExtensions = [...(opts.extensions || OFFERED_EXTENSIONS)];
+    // A host adds tokens through config (opts.extraExtensions), after the defaults; each is offered once.
+    const extra = Array.isArray(opts.extraExtensions) ? opts.extraExtensions.filter((t) => typeof t === 'string' && EXTENSION_TOKEN.test(t)) : [];
+    this._offeredExtensions = [...new Set([...(opts.extensions || OFFERED_EXTENSIONS), ...extra])];
     this._implementation = { name: 'sym', version: ENGINE_VERSION };
     // A stalled handshake ends in a few seconds (security review D): a hello costs this node a key
     // agreement and a signature, and an authenticating session holds a slot.
@@ -662,7 +670,7 @@ class SymNode extends EventEmitter {
       cmbProduced: 0,        // CMBs created by this agent via remember()
       cmbAccepted: 0,        // Peer CMBs accepted by SVAF
       cmbRejected: 0,        // Peer CMBs rejected by SVAF (logged by sym-core)
-      remixProduced: 0,      // Remix CMBs (remember() with parents)
+      remixProduced: 0,      // Remixes minted through the gated remix path (remix()); a record that cites parents is not thereby one (§15.7)
       remixRejected: 0,      // Remix attempts rejected (no new domain data)
       svafAligned: 0,        // SVAF aligned decisions
       svafGuarded: 0,        // SVAF guarded decisions
@@ -897,9 +905,11 @@ class SymNode extends EventEmitter {
   }
 
   /**
-   * MMP §15.8 retroactive lineage-tether audit: apply the tether to chains
-   * stored BEFORE the invariant existed (or received from pre-tether peers).
-   * Walks every stored remix carrying lineage, resolves its nearest anchor
+   * MMP §15.8 retroactive lineage-tether audit: apply the tether to the chains of records this node
+   * minted itself. A peer's record this node holds is a collapsed integration, kept exactly as its
+   * author signed it: the tether is the remixing node's to apply, and does not apply to it (§15.5,
+   * MMP 2.0 update 1, #17), so the audit leaves it alone.
+   * Walks every stored record of this node's carrying lineage, resolves its nearest anchor
    * (optionally fetching unresolvable roots by content address, cmb-fetch),
    * re-evaluates the tether with both sides re-encoded in the current kernel,
    * annotates provenance, signs a tether attestation, and — when `sever` is
@@ -921,6 +931,8 @@ class SymNode extends EventEmitter {
     for (const key of keys) {
       const entry = this._store.get(key);
       if (!entry) continue;
+      // A peer's record (a collapsed integration, its author's as signed): no tether (§15.5).
+      if (entry.peerId != null || entry.collapsed === true) continue;
       const cmb = entry.cmb;
       // An entry this node already severed is a root to it, though its record still names parents.
       const parents = isLineageSevered(entry) ? [] : recordParents(cmb);
@@ -2726,9 +2738,6 @@ class SymNode extends EventEmitter {
 
     // Protocol metrics
     this._metrics.cmbProduced++;
-    if (opts.parents && opts.parents.length > 0) {
-      this._metrics.remixProduced++;
-    }
     this.emit('metric', { type: 'cmb-produced', key: entry.key, hasLineage: !!(opts.parents?.length) });
 
     const context = this._buildContext();
@@ -2973,7 +2982,12 @@ class SymNode extends EventEmitter {
       return { refused: 'remix-without-new-domain-data' };
     }
     const entry = this.remember(categories, opts);
-    if (entry && !entry.refused && !entry.duplicate && !entry.collapsed) this._hasNewDomainData = false;
+    if (entry && !entry.refused && !entry.duplicate && !entry.collapsed) {
+      this._hasNewDomainData = false;
+      // Counted here, on the gated path only (MMP §15.7, update 1, #35): a record remember() mints with
+      // parents (a reply, an outcome, a trail decision) is not a remix.
+      this._metrics.remixProduced++;
+    }
     return entry;
   }
 
diff --git a/tests/audit-delivery-authorship.test.js b/tests/audit-delivery-authorship.test.js
index 6f0ae0bb..1104a63f 100644
--- a/tests/audit-delivery-authorship.test.js
+++ b/tests/audit-delivery-authorship.test.js
@@ -6,6 +6,8 @@ require('./_isolate-home'); // redirect $HOME to a temp sandbox before lib/confi
  * Directed delivery and authorship, from the 2026-10-01 MMP 2.0 audit of sym-mesh-channel.
  *
  * - B-D1  a directed reply citing one of the receiver's own CMBs was dropped as an "echo"
+ *         (MMP 2.0 update 1, #35: no record is dropped as an echo at ingest; the rule sits at the
+ *         remix trigger)
  * - B-D2  directed de-duplication used the content key for 7 days, so a new directed send of
  *         words already seen (even as a broadcast) never surfaced (§8.8.2)
  * - B-D3  a directed CMB SVAF admitted, but whose key the store already held, surfaced nowhere
@@ -117,7 +119,7 @@ describe('directed delivery (MMP §9.2.2, §8.8.2)', () => {
     });
   });
 
-  it('re-review F1: frame flags alone do not exempt a reply from echo suppression', async () => {
+  it('re-review F1: frame flags alone do not make a reply directed (and, since MMP 2.0 update 1, no reply is an echo at ingest)', async () => {
     await withNode('d1-forged', async (node) => {
       node._svafEvaluator.evaluate = async () => ALIGNED;
       const mine = node.remember({ focus: 'my broadcast', issue: 'x', intent: 'tell', motivation: 'm', commitment: 'c', perspective: 'me', mood: NEUTRAL });
@@ -125,7 +127,8 @@ describe('directed delivery (MMP §9.2.2, §8.8.2)', () => {
       // Signed as a broadcast (metadata.to null), frame forged to say directed.
       node._frameHandler.handle(from(node), directed(node, signed(mkCmb('remix pong', { parents: [mine.key] }))));
       await settle();
-      assert.strictEqual(seen.accepted.length, 0, 'a signed broadcast citing my CMB is an echo, whatever the frame says');
+      assert.strictEqual(seen.accepted.length, 1, 'gated as the room-bound record its author signed');
+      assert.notStrictEqual(seen.accepted[0].directed, true, 'never directed on the frame\'s word');
     });
   });
 
@@ -163,14 +166,14 @@ describe('directed delivery (MMP §9.2.2, §8.8.2)', () => {
     });
   });
 
-  it('B-D1: a broadcast citing the receiver\'s own CMB is still skipped as an echo', async () => {
+  it('B-D1, reversed by MMP 2.0 update 1 (#35): a broadcast citing the receiver\'s own CMB is gated and delivered, never skipped as an echo', async () => {
     await withNode('d1-echo', async (node) => {
       node._svafEvaluator.evaluate = async () => ALIGNED;
       const mine = node.remember({ focus: 'my broadcast', issue: 'x', intent: 'tell', motivation: 'm', commitment: 'c', perspective: 'me', mood: NEUTRAL });
       const seen = collect(node);
       node._frameHandler.handle(from(node), frame(signed(mkCmb('remix of your broadcast', { parents: [mine.key] }))));
       await settle();
-      assert.strictEqual(seen.accepted.length, 0);
+      assert.strictEqual(seen.accepted.length, 1, 'admitted like any record: the anti-echo rule sits at the remix trigger');
     });
   });
 
diff --git a/tests/cmb-signing.test.js b/tests/cmb-signing.test.js
index ff3053e1..978d613c 100644
--- a/tests/cmb-signing.test.js
+++ b/tests/cmb-signing.test.js
@@ -195,7 +195,8 @@ describe('rejection diagnosability — the decision records WHY, not a constant'
       assert.strictEqual(decisions.length, 1, 'the rejection is recorded');
       assert.strictEqual(decisions[0].focusLabel, 'content-mismatch',
         'the recorded reason is the ACTUAL verdict — this is what the constant hid');
-      assert.strictEqual(decisions[0].remix, false, 'and whether it was a remix is recorded');
+      assert.strictEqual(decisions[0].cites, false, 'and whether it cites parents is recorded');
+      assert.strictEqual(decisions[0].remix, undefined, 'never whether it was a remix: a receiver cannot know (§15.7, update 1)');
     });
   });
 
@@ -231,7 +232,7 @@ describe('rejection diagnosability — the decision records WHY, not a constant'
     });
   });
 
-  it('a REMIX rejection is flagged as one — the boolean the next diagnosis needs', async () => {
+  it('a rejection of a record that cites parents says so (cites), never that it was a remix (MMP 2.0 update 1, #35)', async () => {
     await withNode('diag-remix', async (node) => {
       node._svafEvaluator.evaluate = async () => ALIGNED;
       const peer = rawKeypair(), attacker = rawKeypair();
@@ -243,8 +244,9 @@ describe('rejection diagnosability — the decision records WHY, not a constant'
       node._frameHandler.handle(node.__peerSession, frame);
       await settle();
       assert.strictEqual(decisions.length, 1);
-      assert.strictEqual(decisions[0].remix, true,
-        'a rejected CMB is dropped and never stored, so root-vs-remix can only be captured here');
+      assert.strictEqual(decisions[0].cites, true,
+        'a rejected CMB is dropped and never stored, so whether it cited parents can only be captured here');
+      assert.strictEqual(decisions[0].remix, undefined, 'a record that cites its parent is not thereby a remix');
     });
   });
 });
diff --git a/tests/lineage-severance-signed.test.js b/tests/lineage-severance-signed.test.js
index e868cc11..fa06abea 100644
--- a/tests/lineage-severance-signed.test.js
+++ b/tests/lineage-severance-signed.test.js
@@ -3,18 +3,20 @@
 require('./_isolate-home'); // redirect $HOME to a temp sandbox before lib/config loads
 
 /**
- * §15.8 severance never edits a signed record.
+ * §15.8 severance never edits a signed record, and a record kept as its author signed it is never
+ * severed at all.
  *
  * When the gate admits a block unchanged, the record it stores IS the author's signed block (the
  * collapse). Severance used to null that record's metadata.lineage, which the signature covers, so
- * a severed record no longer verified under its author's key: the receiver's judgement about a
- * chain was written into someone else's signed statement and broke it. The retroactive audit did
- * the same to records already stored.
+ * a severed record no longer verified under its author's key. MMP 2.0 update 1 (§15.5, #17) then
+ * says the §15.8 tether does not apply to a collapsed integration at all: the receiver produced no
+ * remix and asserts no descent of its own, and the record's lineage is its author's. So a collapsed
+ * record is stored exactly as signed, its lineage walked as signed, with no tether.
  *
- * Severance is this node's judgement, so it is kept where this node's judgements live: on the
- * entry (entry.lineage.severed) and in the store's lineage index. The record stays exactly as
- * signed, and every walk of stored lineage honours the entry: the index, the §15.8 anchor walk,
- * and a rebuild of the index from disk.
+ * Severance remains this node's judgement about records it minted itself (the retroactive audit),
+ * kept where this node's judgements live: on the entry (entry.lineage.severed) and in the store's
+ * lineage index, never in the record. Every walk of stored lineage honours the entry: the index, the
+ * §15.8 anchor walk, and a rebuild of the index from disk.
  */
 
 const { describe, it } = require('node:test');
@@ -78,10 +80,10 @@ function signedRemix(text, parentKey) {
 }
 
 /** The severance as every reader of stored lineage must see it, live and after a rebuild from disk. */
-function assertSevered(node, label, record, rootKey) {
+function assertSevered(node, label, record, rootKey, authorKey = AUTHOR.pub) {
   const entry = node._store.get(record.metadata.key);
   assert.ok(entry, `${label}: stored`);
-  assert.strictEqual(verifyCMB(entry.cmb, AUTHOR.pub).valid, true, `${label}: the stored record still verifies under its author's key`);
+  assert.strictEqual(verifyCMB(entry.cmb, authorKey).valid, true, `${label}: the stored record still verifies under its author's key`);
   assert.deepStrictEqual(entry.cmb.metadata.lineage, record.metadata.lineage, `${label}: its lineage is exactly as signed`);
   assert.strictEqual(entry.lineage?.severed, true, `${label}: the severance is on the entry`);
   assert.strictEqual(entry.provenance?.tether?.severed, true, `${label}: and in its provenance`);
@@ -99,7 +101,7 @@ function assertSevered(node, label, record, rootKey) {
 
 describe('§15.8 severance keeps the author\'s record as signed', () => {
   for (const path of ['heuristic', 'neural']) {
-    it(`${path} gate: a severed collapsed record still verifies and is no longer a descendant`, async () => {
+    it(`${path} gate: a collapsed record is stored as signed and never severed (§15.5, MMP 2.0 update 1)`, async () => {
       await awaitSemantic();
       const opts = path === 'neural' ? { svafEvaluator: { evaluate: async () => ALIGNED } } : {};
       await withNode(opts, async (node) => {
@@ -110,21 +112,27 @@ describe('§15.8 severance keeps the author\'s record as signed', () => {
         const now = Date.now();
         if (path === 'neural') await node._frameHandler._processNeuralSVAF(ALIGNED, frame, 'peerA', 'peerA', now, now);
         else await node._frameHandler._processHeuristicSVAF(frame, 'peerA', 'peerA', now, now, 0);
-        assert.strictEqual(node._store.get(record.metadata.key)?.collapsed, true, 'precondition: the stored record is the author\'s block');
-        assertSevered(node, path, record, root.key);
+        const entry = node._store.get(record.metadata.key);
+        assert.strictEqual(entry?.collapsed, true, 'precondition: the stored record is the author\'s block');
+        assert.strictEqual(verifyCMB(entry.cmb, AUTHOR.pub).valid, true, 'it verifies under its author\'s key');
+        assert.deepStrictEqual(entry.cmb.metadata.lineage, record.metadata.lineage, 'its lineage is exactly as signed');
+        assert.notStrictEqual(entry.lineage?.severed, true, 'not severed');
+        assert.strictEqual(entry.tether, undefined, 'no tether attestation');
+        assert.strictEqual(entry.provenance?.tether, undefined, 'no tether evaluated');
+        assert.deepStrictEqual(node._store.parents(record.metadata.key), [root.key], 'walked as its author signed it');
       });
     });
   }
 
-  it('the retroactive audit severs on the entry too', async () => {
+  it('the retroactive audit severs a record of this node\'s own on the entry, and the record still verifies', async () => {
     await awaitSemantic();
     await withNode({}, async (node) => {
       const root = node.remember(cat7(TOPIC_A));
-      const record = signedRemix(LAUNDERED, root.key);
-      node._store.receiveFromPeer('peerA', { key: record.metadata.key, content: LAUNDERED, source: 'peerA', cmb: JSON.parse(JSON.stringify(record)), _cmbVerified: true });
+      const own = node.remember(cat7(LAUNDERED), { parents: [{ key: root.key }] });
+      const record = JSON.parse(JSON.stringify(own.cmb));
       const r1 = await node.auditLineageTethers({ sever: true });
       assert.strictEqual(r1.severed, 1, 'precondition: the audit severed it');
-      assertSevered(node, 'audit', record, root.key);
+      assertSevered(node, 'audit', record, root.key, node._identity.publicKey);
       const r2 = await node.auditLineageTethers({ sever: true });
       assert.strictEqual(r2.audited, 0, 'a severed record is a root to the audit: there is no chain left to check');
     });
diff --git a/tests/lineage-tether-audit.test.js b/tests/lineage-tether-audit.test.js
index d9ecca85..504c5e6f 100644
--- a/tests/lineage-tether-audit.test.js
+++ b/tests/lineage-tether-audit.test.js
@@ -3,10 +3,13 @@
 require('./_isolate-home'); // redirect $HOME to a temp sandbox before lib/config loads
 
 /**
- * MMP §15.8 retroactive lineage-tether audit — chains stored before the
- * invariant (or received from pre-tether peers) get the same treatment:
- * re-evaluate against the resolvable root in the current kernel, annotate +
- * attest, and (opt-in) sever what fails the floor.
+ * MMP §15.8 retroactive lineage-tether audit — chains of records this node minted itself get the
+ * same treatment the invariant gives a remix: re-evaluate against the resolvable root in the current
+ * kernel, annotate + attest, and (opt-in) sever what fails the floor.
+ *
+ * A peer's record this node holds is a collapsed integration, kept exactly as its author signed it:
+ * the §15.8 tether does not apply to it (§15.5, MMP 2.0 update 1, #17), and the audit leaves it alone.
+ * Until the update the audit judged peers' records too; these fixtures were peer records then.
  */
 
 const { describe, it } = require('node:test');
@@ -26,21 +29,11 @@ function cat7(t) {
   };
 }
 
-/** Store a pre-tether chain entry: a remix citing `rootKey` with `topicText`
- *  content, injected the way a legacy receiver would have stored it. */
-function storeLegacyRemix(node, rootKey, topicText) {
-  // NOTE: createCMB mints content-only keys, so fixtures must use distinct
-  // texts — two identical texts collide on one key and dedup.
-  const cmb = createCMB({ categories: cat7(topicText), createdBy: 'legacy-peer' });
-  // Lineage goes in the section this record ACTUALLY carries. The fixture used to staple a flat
-  // `cmb.lineage` onto a record createCMB had already built with metadata — a hybrid that is
-  // neither generation, whose key read back undefined and whose lineage nothing walked.
-  cmb.metadata.lineage = { parents: [rootKey], ancestors: [rootKey], method: 'SVAF-v2' };
-  const key = cmb.metadata.key;
-  const entry = node._store.receiveFromPeer('legacy-peer', {
-    key, content: topicText, source: 'legacy-peer', cmb, storedAt: Date.now(),
-  });
-  return { key, entry };
+/** A record this node mints citing `rootKey`, with `topicText` content (before the tether ran on it).
+ *  NOTE: keys are content-only, so fixtures use distinct texts — identical texts collide and dedup. */
+function storeOwnRemix(node, rootKey, topicText) {
+  const entry = node.remember(cat7(topicText), { parents: [{ key: rootKey }] });
+  return { key: entry.key, entry };
 }
 
 const TOPIC_A = 'quarterly financial audit of the accounting ledger and tax filings';
@@ -49,6 +42,26 @@ const TOPIC_B = 'fresh snowfall reported on the upper mountain trail sections';
 const TOPIC_B2 = 'deep snow drifts covering the mountain hiking path near the summit ridge';
 
 describe('MMP §15.8 retroactive tether audit', () => {
+  it('a peer\'s record is a collapsed integration: the audit leaves it alone (MMP 2.0 update 1)', async () => {
+    const name = `audit-peer-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+    const node = new SymNode({ name, silent: true, discovery: new NullDiscovery() });
+    await node.start();
+    try {
+      await awaitSemantic();
+      const rootA = node.remember(cat7(TOPIC_A));
+      const cmb = createCMB({ categories: cat7(TOPIC_B2), createdBy: 'peer', lineage: { parents: [rootA.key], method: 'SVAF-v2' } });
+      node._store.receiveFromPeer('peer', { key: cmb.metadata.key, content: TOPIC_B2, source: 'peer', cmb, _cmbVerified: true });
+      const r = await node.auditLineageTethers({ sever: true });
+      assert.strictEqual(r.audited, 0);
+      const e = node._store.get(cmb.metadata.key);
+      assert.strictEqual(e.tether, undefined);
+      assert.deepStrictEqual(node._store.parents(cmb.metadata.key), [rootA.key], 'its lineage is its author\'s');
+    } finally {
+      await node.stop();
+      fs.rmSync(nodeDir(name), { recursive: true, force: true });
+    }
+  });
+
   it('annotate-only pass: failed-floor chains are attested but keep lineage; sever pass strips them', async () => {
     const name = `audit-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
     const node = new SymNode({ name, silent: true, discovery: new NullDiscovery() });
@@ -57,8 +70,8 @@ describe('MMP §15.8 retroactive tether audit', () => {
       await awaitSemantic();
       const rootA = node.remember(cat7(TOPIC_A));
       const rootB = node.remember(cat7(TOPIC_B_ROOT));
-      const laundered = storeLegacyRemix(node, rootA.key, TOPIC_B2); // topic-B content citing topic-A root
-      const faithful = storeLegacyRemix(node, rootB.key, TOPIC_B);   // topic-B content citing topic-B root
+      const laundered = storeOwnRemix(node, rootA.key, TOPIC_B2); // topic-B content citing topic-A root
+      const faithful = storeOwnRemix(node, rootB.key, TOPIC_B);   // topic-B content citing topic-B root
 
       // Pass 1: annotate + attest only (default).
       const r1 = await node.auditLineageTethers();
@@ -88,7 +101,7 @@ describe('MMP §15.8 retroactive tether audit', () => {
         'ancestor index no longer lists the severed remix');
 
       const f2 = node._store.get(faithful.key);
-      assert.ok(f2.cmb.metadata.lineage && f2.cmb.metadata.lineage.ancestors.includes(rootB.key), 'faithful chain untouched');
+      assert.deepStrictEqual(f2.cmb.metadata.lineage.parents, [rootB.key], 'faithful chain untouched');
       assert.strictEqual(f2.tether.verdict, 'tethered');
     } finally {
       await node.stop();
@@ -111,7 +124,7 @@ describe('MMP §15.8 retroactive tether audit', () => {
       node._store.receiveFromPeer('unverifiable-peer', {
         key: parent.metadata.key, content: TOPIC_B_ROOT, source: 'unverifiable-peer', cmb: parent, storedAt: Date.now(),
       });
-      const remix = storeLegacyRemix(node, parent.metadata.key, TOPIC_B);
+      const remix = storeOwnRemix(node, parent.metadata.key, TOPIC_B);
       const r = await node.auditLineageTethers({ fetch: true, timeoutMs: 50 });
       assert.strictEqual(r.audited, 1);
       assert.strictEqual(r.fetched, 0, 'the local unverified copy is not a fetch');
@@ -131,7 +144,7 @@ describe('MMP §15.8 retroactive tether audit', () => {
     await node.start();
     try {
       await awaitSemantic();
-      const orphan = storeLegacyRemix(node, 'cmb1-purged-root-nowhere', TOPIC_B);
+      const orphan = storeOwnRemix(node, `cmb-${'f'.repeat(64)}`, TOPIC_B);
       const r = await node.auditLineageTethers({ sever: true });
       assert.strictEqual(r.unchecked, 1);
       assert.strictEqual(r.severed, 0);
@@ -155,11 +168,10 @@ describe('MMP §15.8 retroactive tether audit', () => {
     try {
       await awaitSemantic();
       const root = node.remember(cat7(TOPIC_A));
-      // A faithful hop, admitted from a verified peer, then a laundered hop citing it.
+      // A faithful hop, admitted from a verified peer, then this node's laundered record citing it.
       const hop = createCMB({ categories: cat7(`${TOPIC_A} for the second quarter`), createdBy: 'peer', lineage: { parents: [root.key], method: 'SVAF-v2' } });
       node._store.receiveFromPeer('peer', { key: hop.metadata.key, content: 'hop', source: 'peer', cmb: hop, _cmbVerified: true });
-      const laundered = createCMB({ categories: cat7(TOPIC_B2), createdBy: 'peer', lineage: { parents: [hop.metadata.key], method: 'SVAF-v2' } });
-      node._store.receiveFromPeer('peer', { key: laundered.metadata.key, content: 'laundered', source: 'peer', cmb: laundered, _cmbVerified: true });
+      const laundered = node.remember(cat7(TOPIC_B2), { parents: [{ key: hop.metadata.key }] }).cmb;
       assert.ok(node._store.descendants(root.key).includes(laundered.metadata.key), 'precondition: indexed under the root through the hop');
 
       const r = await node.auditLineageTethers({ sever: true });
@@ -175,16 +187,13 @@ describe('MMP §15.8 retroactive tether audit', () => {
     }
   });
 
-  it('fetch: the candidates are the store\'s closure, never an ancestors list the record carries', async () => {
+  it('fetch: the candidates are the store\'s closure (the parents it indexed)', async () => {
     const name = `audit-anc-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
     const node = new SymNode({ name, silent: true, discovery: new NullDiscovery() });
     await node.start();
     try {
       const parent = 'cmb-' + 'a'.repeat(64);
-      const chosen = 'cmb-' + 'b'.repeat(64);
-      const cmb = createCMB({ categories: cat7(TOPIC_B), createdBy: 'peer' });
-      cmb.metadata.lineage = { parents: [parent], ancestors: [chosen], method: 'SVAF-v2' };
-      node._store.receiveFromPeer('peer', { key: cmb.metadata.key, content: TOPIC_B, source: 'peer', cmb });
+      node.remember(cat7(TOPIC_B), { parents: [{ key: parent }] });
       const asked = [];
       node.fetchCMB = async (k) => { asked.push(k); return null; };
       await node.auditLineageTethers({ fetch: true, timeoutMs: 50 });
diff --git a/tests/lineage-tether-neural.test.js b/tests/lineage-tether-neural.test.js
index c45285ba..7a645720 100644
--- a/tests/lineage-tether-neural.test.js
+++ b/tests/lineage-tether-neural.test.js
@@ -3,13 +3,14 @@
 require('./_isolate-home'); // redirect $HOME to a temp sandbox before lib/config loads
 
 /**
- * MMP §15.8 applies to every remix a node integrates, whichever gate admitted it.
+ * MMP §15.8 on the neural admission path, as MMP 2.0 update 1 states it.
  *
  * The frame handler offers each inbound block to the injected Layer-4 evaluator first and runs the
- * heuristic baseline only when that evaluator declines. The heuristic path resolved the lineage
- * root, evaluated the stored record against it, severed a drifted chain and signed a tether
- * attestation. The neural path did none of it: a remix the neural evaluator admitted kept a
- * laundered lineage, carried no attestation, and kept whatever attestation the sender had attached.
+ * heuristic baseline only when that evaluator declines. Both paths keep the incoming text, so both
+ * collapse onto the author's record, kept exactly as signed, and the §15.8 tether does not apply to
+ * a collapsed integration (§15.5): the receiver produced no remix and asserts no descent of its own.
+ * So neither path severs, evaluates or attests a tether, and neither keeps an attestation a sender
+ * attached. (Until update 1 both paths severed and attested; this suite pinned that they agreed.)
  *
  * The neural evaluator is dormant in a stock install (models/svaf_v2.pt is not shipped), so it is
  * stubbed here with the result shape it returns.
@@ -93,54 +94,38 @@ async function admitThrough(path, rootText, frameOf) {
 }
 
 describe('MMP §15.8 lineage tether on the neural admission path', () => {
-  it('the stock dispatch, with a neural evaluator that admits, severs a laundered chain and attests it', async () => {
+  it('the stock dispatch, with a neural evaluator that admits, keeps a laundered chain as signed: no severance, no attestation', async () => {
     await awaitSemantic();
     await withNode('tether-neural-dispatch', { svafEvaluator: { evaluate: async () => ALIGNED } }, async (node) => {
-      // The root is held as a verified peer admission: a remix citing a block this node authored
-      // would be dropped as an echo before any gate runs.
       const root = createCMB({ categories: cat7(TOPIC_A), createdBy: 'peerR' });
       node._store.receiveFromPeer('peerR', { key: root.metadata.key, content: TOPIC_A, source: 'peerR', cmb: root, _cmbVerified: true });
       const frame = remixFrame(TOPIC_B_NEW, root.metadata.key);
       await node._frameHandler._handleMemoryShare(PEER.nodeId, PEER.name, frame, admitAs(node, PEER));
 
       const stored = node._store.get(frame.cmb.metadata.key);
-      assert.ok(stored, 'the neural evaluator admitted the remix');
+      assert.ok(stored, 'the neural evaluator admitted the record');
       assert.strictEqual(stored.svaf?.method, 'neural', 'precondition: the neural path stored it');
-      // Severed on the entry and in the index; the record is the author's and keeps its lineage.
-      assert.strictEqual(stored.lineage.severed, true, 'the laundered lineage is severed');
-      assert.deepStrictEqual(node._store.parents(stored.key), [], 'the store walks no parents from it');
-      assert.deepStrictEqual(stored.cmb.metadata.lineage, frame.cmb.metadata.lineage, 'the record\'s own lineage is untouched');
-      assert.strictEqual(stored.provenance?.tether?.severed, true);
-      assert.strictEqual(stored.provenance.tether.departedFrom, root.metadata.key);
-      const att = stored.tether;
-      assert.ok(att, 'a tether attestation is attached');
-      assert.strictEqual(att.verdict, 'severed');
-      assert.strictEqual(att.anchor, root.metadata.key);
-      assert.strictEqual(att.by, node.nodeId);
-      assert.strictEqual(verifyTetherAttestation(att, node._identity.publicKey).valid, true);
+      assert.strictEqual(stored.collapsed, true);
+      assert.notStrictEqual(stored.lineage?.severed, true, 'not severed');
+      assert.deepStrictEqual(node._store.parents(stored.key), [root.metadata.key], 'its signed lineage is walked');
+      assert.strictEqual(stored.provenance?.tether, undefined);
+      assert.strictEqual(stored.tether, undefined, 'no tether attestation');
     });
   });
 
   for (const [label, rootText] of [['a laundered chain', TOPIC_A], ['a faithful chain', TOPIC_B_ROOT]]) {
-    it(`${label}: the neural path reaches the verdict the heuristic path does`, async () => {
+    it(`${label}: the neural path and the heuristic path store the same thing, with no tether`, async () => {
       await awaitSemantic();
       const frameOf = (rootKey) => remixFrame(TOPIC_B_NEW, rootKey);
       const neural = await admitThrough('neural', rootText, frameOf);
       const heuristic = await admitThrough('heuristic', rootText, frameOf);
       for (const r of [neural, heuristic]) {
-        assert.ok(r.att, 'attested');
-        assert.strictEqual(r.attValid, true);
-        assert.strictEqual(r.att.by, r.nodeId);
-        assert.strictEqual(r.att.anchor, r.root.key);
+        assert.strictEqual(r.att, undefined, 'not attested');
+        assert.strictEqual(r.stored.collapsed, true);
+        assert.strictEqual(r.stored.provenance?.tether, undefined);
       }
-      assert.strictEqual(neural.att.verdict, heuristic.att.verdict, 'same verdict');
-      assert.strictEqual(neural.att.kernelId, heuristic.att.kernelId, 'one kernel, so the drifts are comparable');
-      assert.strictEqual(neural.att.drift.toFixed(6), heuristic.att.drift.toFixed(6), 'same drift: one computation');
-      const withoutDrift = ({ drift, ...rest }) => rest; // drift is compared above, to the precision it is signed at
-      assert.deepStrictEqual(withoutDrift(neural.stored.provenance.tether), withoutDrift(heuristic.stored.provenance.tether), 'same provenance');
       assert.deepStrictEqual(neural.stored.cmb.metadata.lineage, heuristic.stored.cmb.metadata.lineage, 'same record lineage, as signed');
-      assert.deepStrictEqual(neural.stored.lineage, heuristic.stored.lineage, 'same lineage in the store: severed or kept alike');
-      assert.strictEqual(neural.att.verdict, rootText === TOPIC_A ? 'severed' : 'tethered');
+      assert.deepStrictEqual(neural.stored.lineage, heuristic.stored.lineage, 'same lineage in the store');
     });
   }
 
diff --git a/tests/lineage-tether-reproducible.test.js b/tests/lineage-tether-reproducible.test.js
index b22410a2..a9f5d62d 100644
--- a/tests/lineage-tether-reproducible.test.js
+++ b/tests/lineage-tether-reproducible.test.js
@@ -92,7 +92,7 @@ async function admit(node, frame) {
 }
 
 describe('§15.8 tether is reproducible by any holder of the root and the record (B-L5)', () => {
-  it('two nodes with different local memories sign the same tether for the same record', async () => {
+  it('the tether is a function of the root and the record alone: two nodes with different memories measure the same, and neither signs one about a collapsed record', async () => {
     await awaitSemantic();
     const seen = [];
     for (const [label, memory] of [['n1', MEMORY_1], ['n2', MEMORY_2]]) {
@@ -100,26 +100,22 @@ describe('§15.8 tether is reproducible by any holder of the root and the record
         const root = node.remember(cat7(ROOT));
         for (const t of memory) node.remember(cat7(t));
         const stored = await admit(node, remixFrame(INCOMING, root.key));
-        assert.ok(stored, `${label}: the remix admits`);
-        assert.ok(stored.tether, `${label}: the integrator signed a tether`);
-        assert.strictEqual(stored.tether.anchor, root.key, `${label}: anchored on the shared root`);
-        seen.push({ label, att: stored.tether, record: stored.cmb, root: root.cmb, node });
+        assert.ok(stored, `${label}: the record admits`);
+        // MMP 2.0 update 1, §15.5: the gate kept the author's record, so the tether is not the receiver's.
+        assert.strictEqual(stored.collapsed, true);
+        assert.strictEqual(stored.tether, undefined, `${label}: no tether signed about a collapsed record`);
+        const ev = await evaluateLineageTetherFromText({
+          remixCategories: stored.cmb.categories, anchorCategories: root.cmb.categories,
+          categoryWeights: node._svafCategoryWeights, guardedThreshold: node._svafGuardedThreshold,
+        });
+        seen.push({ label, ev, record: stored.cmb });
       });
     }
     const [a, b] = seen;
-    assert.strictEqual(a.att.kernelId, b.att.kernelId, 'precondition: one kernel, so the drifts are comparable');
     assert.strictEqual(a.record.metadata.key, b.record.metadata.key, 'precondition: the same record on both nodes');
-    // The attestation signs the drift at six fractional digits, so that is the value a holder reproduces.
-    assert.strictEqual(a.att.drift.toFixed(6), b.att.drift.toFixed(6), 'both integrators measured the same drift');
-
-    // And a third party holding only the root and the record recomputes it from text alone.
-    const recomputed = await evaluateLineageTetherFromText({
-      remixCategories: a.record.categories, anchorCategories: a.root.categories,
-      categoryWeights: a.node._svafCategoryWeights, guardedThreshold: a.node._svafGuardedThreshold,
-    });
-    assert.strictEqual(recomputed.kernelId, a.att.kernelId);
-    assert.strictEqual(recomputed.drift.toFixed(6), a.att.drift.toFixed(6), 'the signed drift is recomputable from the two texts');
-    assert.strictEqual(recomputed.tethered ? 'tethered' : 'severed', a.att.verdict);
+    assert.strictEqual(a.ev.kernelId, b.ev.kernelId, 'precondition: one kernel, so the drifts are comparable');
+    assert.strictEqual(a.ev.drift.toFixed(6), b.ev.drift.toFixed(6), 'both measure the same drift: memory plays no part');
+    assert.strictEqual(a.ev.tethered, b.ev.tethered);
   });
 
   it('a vector no text backs is not content, and never enters the tether', async () => {
@@ -171,8 +167,8 @@ describe('§15.8 tether is reproducible by any holder of the root and the record
   });
 });
 
-describe('§15.8 cold-start admissions carry a tether like warm ones (B-L6)', () => {
-  it('an empty-memory admission of a remix is tether-checked against its anchor', async () => {
+describe('§15.8 and cold start (B-L6): a cold-start admission is a collapsed integration like a warm one', () => {
+  it('an empty-memory admission of a record keeps it as signed, with no tether, as a warm one does', async () => {
     await awaitSemantic();
     const root = createCMB({ categories: cat7(LAUNDERED_ROOT), createdBy: 'author' });
     const frame = remixFrame(INCOMING, root.metadata.key);
@@ -183,19 +179,11 @@ describe('§15.8 cold-start admissions carry a tether like warm ones (B-L6)', ()
     });
     assert.strictEqual(r.accepted, true, 'cold start admits to bootstrap memory');
     assert.strictEqual(r.coldStartCause, 'empty-memory', 'precondition: this is the cold-start exit');
-    assert.ok(r.tether, 'the cold-start admission carries a tether');
-    assert.strictEqual(r.tether.anchorKey, root.metadata.key);
-    assert.strictEqual(r.tether.checked, true);
-    assert.strictEqual(r.tether.tethered, false, 'a remix drifted past the floor is caught at cold start too');
-
-    const recomputed = await evaluateLineageTetherFromText({
-      remixCategories: r.fusedEntry.cmb.categories, anchorCategories: root.categories, guardedThreshold: POLICY.guardedThreshold,
-    });
-    assert.strictEqual(r.tether.drift.toFixed(6), recomputed.drift.toFixed(6), 'the same computation as the warm path');
-    assert.strictEqual(r.tether.kernelId, recomputed.kernelId);
+    assert.strictEqual(r.fusedEntry.collapsed, true, 'the author\'s record, kept as signed');
+    assert.strictEqual(r.tether, null, 'the §15.8 tether does not apply to a collapsed integration (§15.5)');
   });
 
-  it('a fresh node signs a tether on its first (cold-start) admission, as a warm node does', async () => {
+  it('a fresh node and a warm node store a peer root alike: as signed, with no tether', async () => {
     await awaitSemantic();
     for (const warm of [false, true]) {
       await withNode(`tether-cold-${warm ? 'warm' : 'cold'}`, async (node) => {
@@ -203,9 +191,9 @@ describe('§15.8 cold-start admissions carry a tether like warm ones (B-L6)', ()
         const peerRoot = createCMB({ categories: cat7(ROOT), createdBy: 'peerA' });
         const stored = await admit(node, { type: 'cmb', timestamp: Date.now(), content: ROOT, cmb: peerRoot });
         assert.ok(stored, `${warm ? 'warm' : 'cold'}: the root admits`);
-        assert.strictEqual(stored.tether?.anchor, peerRoot.metadata.key, `${warm ? 'warm' : 'cold'}: a root is its own anchor`);
-        assert.strictEqual(stored.tether.verdict, 'tethered');
-        assert.strictEqual(stored.provenance?.tether?.severed, false);
+        assert.strictEqual(stored.collapsed, true);
+        assert.strictEqual(stored.tether, undefined);
+        assert.strictEqual(stored.provenance?.tether, undefined);
       });
     }
   });
diff --git a/tests/lineage-tether-severance.test.js b/tests/lineage-tether-severance.test.js
index 655e7f98..8a01ea6e 100644
--- a/tests/lineage-tether-severance.test.js
+++ b/tests/lineage-tether-severance.test.js
@@ -3,20 +3,18 @@
 require('./_isolate-home'); // redirect $HOME to a temp sandbox before lib/config loads
 
 /**
- * MMP §15.8 Lineage Tether — end-to-end severance through the heuristic gate.
+ * MMP §15.8 Lineage Tether through the heuristic gate, as MMP 2.0 update 1 states it.
  *
- * The drift-laundering scenario the tether exists to close: a chain's root is
- * about topic A; the receiver's RECENT anchors are about topic B (so the
- * §9.2 gate, which reads the five most recent anchors, admits topic-B
- * traffic); an incoming topic-B CMB carrying lineage back to the topic-A root
- * would — without the tether — store a remix whose content has nothing to do
- * with the root it cites. With the tether, the remix is stored as a fresh
- * root (lineage severed, departed source in provenance). A faithful chain
- * (remix genuinely about its root's topic) keeps its lineage intact.
+ * The drift-laundering scenario the tether exists to close: a chain's root is about topic A; an
+ * incoming topic-B record cites it. The tether is the REMIXING node's duty (§15.8: "at integration
+ * time, the remixing node MUST evaluate its remix"), and it does not apply to a collapsed integration
+ * (§15.5): the receiver produced no remix and asserts no descent of its own. sym's gate keeps the
+ * incoming text, so every integration it makes collapses onto the author's record, kept exactly as
+ * signed. Until update 1 this suite pinned the opposite: the receiver severed and attested the
+ * author's chain. It now pins that the receiver does neither, whatever the drift, and that disabling
+ * the tether changes nothing here.
  *
- * Uses the real store + real encoder (semantic when available, n-gram
- * otherwise — both sides of the tether comparison share one kernel by
- * construction, §15.8 in-gate evaluation).
+ * Uses the real store + real encoder (semantic when available, n-gram otherwise).
  */
 
 const { describe, it } = require('node:test');
@@ -25,7 +23,7 @@ const fs = require('fs');
 const { SymNode } = require('../lib/node');
 const { NullDiscovery } = require('../lib/discovery');
 const { nodeDir } = require('../lib/config');
-const { createCMB, verifyTetherAttestation, kernelId } = require('../lib/core');
+const { createCMB } = require('../lib/core');
 
 // The tether's reject-floor calibration assumes the semantic kernel (the
 // production default — §9.2.1: thresholds are meaningful only within a pinned
@@ -94,80 +92,19 @@ async function seedAndReceive(node, rootTopic, incomingTopic) {
   return { root, accepted };
 }
 
-describe('MMP §15.8 lineage tether — severance through the gate', () => {
-  it('drift laundering severs: topic-B remix citing a topic-A root is stored as a fresh root', async () => {
-    await withNode('tether-sever', async (node) => {
-      const { accepted } = await seedAndReceive(node, TOPIC_A, TOPIC_B_NEW);
-      assert.strictEqual(accepted.length, 1, 'incoming admits (aligned with recent topic-B anchors)');
-      const entry = accepted[0];
-      const cmb = entry.cmb;
-      // Severed on the entry and in the index; the record is the author's and keeps its lineage.
-      assert.strictEqual(entry.lineage.severed, true, 'lineage severed — stored as a fresh root');
-      assert.deepStrictEqual(node._store.parents(entry.key), [], 'the store walks no parents from it');
-      assert.ok(!isRootShaped(cmb.metadata.lineage), 'the record\'s own lineage is untouched');
-      assert.ok(entry.provenance.tether, 'tether recorded in provenance');
-      assert.strictEqual(entry.provenance.tether.severed, true);
-      assert.ok(entry.provenance.tether.drift > 0.5, `drift ${entry.provenance.tether.drift} exceeds the reject floor`);
-      assert.ok(entry.provenance.tether.departedFrom, 'departed source recorded informally');
-
-      // §15.8 tether attestation: the integrator's signed record of this exact
-      // evaluation rides the remix, verifiable against the node's identity key,
-      // and names the kernel the verdict was made in.
-      const att = entry.tether;
-      assert.ok(att, 'tether attestation attached');
-      assert.strictEqual(att.verdict, 'severed');
-      assert.strictEqual(att.of, cmb.metadata.key);
-      assert.strictEqual(att.kernelId, kernelId(), 'attestation names the evaluating kernel');
-      const v = verifyTetherAttestation(att, node._identity.publicKey);
-      assert.deepStrictEqual({ signed: v.signed, valid: v.valid }, { signed: true, valid: true });
-    });
-  });
-
-  it('faithful chain keeps lineage: topic-B remix citing a topic-B root stays tethered', async () => {
-    await withNode('tether-keep', async (node) => {
-      const { root, accepted } = await seedAndReceive(node, TOPIC_B_ROOT, TOPIC_B_NEW);
-      assert.strictEqual(accepted.length, 1, 'incoming admits');
-      const entry = accepted[0];
-      const cmb = entry.cmb;
-      assert.ok(!isRootShaped(cmb.metadata.lineage), 'lineage intact');
-      assert.ok(cmb.metadata.lineage.ancestors.includes(root.key), 'chain still reaches its root');
-      assert.strictEqual(entry.provenance.tether.severed, false);
-      assert.ok(entry.provenance.tether.drift <= 0.5);
-      assert.strictEqual(entry.tether?.verdict, 'tethered', 'kept chains carry a tethered attestation');
-    });
-  });
-
-  // §15.8 anchors on a root reached by recursively VERIFYING parent records. A peer block this node
-  // admitted without verifying its author is not such a record: whoever wrote it chose its content
-  // and its claimed parents, so treating it as the anchor let an unattributable block certify the
-  // next remix. The remix is stored unchanged (unverifiable is a trust state, never a severance),
-  // but the integrator signs no tether naming that block.
-  for (const [label, verified] of [['an UNVERIFIED admission is not an anchor', false], ['a VERIFIED admission is (control)', true]]) {
-    it(`parent stored from a peer: ${label}`, async () => {
-      await withNode(`tether-verify-${verified}`, async (node) => {
-        await awaitSemantic();
-        for (const t of TOPIC_B) node.remember(cat7(t));
-        const accepted = [];
-        node.on('cmb-accepted', (e) => accepted.push(e));
-        const now = Date.now();
-        const parent = createCMB({ categories: cat7(TOPIC_B_ROOT), createdBy: 'peerA' });
-        // The frame handler sets this from the author-key signature check before admission; the
-        // gate is driven directly here, so the verdict is set the way that check would leave it.
-        const parentFrame = { type: 'cmb', timestamp: now, content: TOPIC_B_ROOT, cmb: parent, _cmbVerified: verified };
-        await node._frameHandler._processHeuristicSVAF(parentFrame, 'peerA', 'peerA', now, now, 0);
-        assert.ok(node._store.get(parent.metadata.key), 'precondition: the parent was admitted and stored');
-
-        await node._frameHandler._processHeuristicSVAF(inboundFrame(TOPIC_B_NEW, parent.metadata.key), 'peerA', 'peerA', now, now, 0);
-        const remix = accepted.find((e) => e.cmb.categories.focus.text === TOPIC_B_NEW);
-        assert.ok(remix, 'the remix admits');
-        assert.deepStrictEqual(remix.cmb.metadata.lineage.parents, [parent.metadata.key], 'lineage is kept either way');
-        if (verified) {
-          assert.strictEqual(remix.tether?.anchor, parent.metadata.key, 'a verified parent anchors the tether');
-          assert.strictEqual(remix.tether.verdict, 'tethered');
-        } else {
-          assert.strictEqual(remix.tether, undefined, 'no tether attestation names an unverified record');
-          assert.strictEqual(remix.provenance?.tether, undefined, 'the tether is unverified, not evaluated');
-        }
+describe('MMP §15.8 lineage tether — not the receiver\'s on a collapsed integration', () => {
+  for (const [label, rootTopic] of [['a laundered chain (topic-B record citing a topic-A root)', TOPIC_A], ['a faithful chain (topic-B record citing a topic-B root)', TOPIC_B_ROOT]]) {
+    it(`${label}: admitted, kept as signed, never severed, no tether attestation`, async () => {
+      await withNode('tether-collapsed', async (node) => {
+        const { root, accepted } = await seedAndReceive(node, rootTopic, TOPIC_B_NEW);
+        assert.strictEqual(accepted.length, 1, 'incoming admits (aligned with recent topic-B anchors)');
+        const entry = accepted[0];
+        assert.strictEqual(entry.collapsed, true, 'the gate kept the author\'s record');
+        assert.ok(!isRootShaped(entry.cmb.metadata.lineage), 'the record\'s own lineage is untouched');
+        assert.notStrictEqual(entry.lineage?.severed, true, 'not severed');
+        assert.deepStrictEqual(node._store.parents(entry.key), [root.key], 'the store walks its signed lineage');
+        assert.strictEqual(entry.provenance?.tether, undefined, 'no tether evaluated');
+        assert.strictEqual(entry.tether, undefined, 'no tether attestation');
       });
     });
   }
diff --git a/tests/neural-after-decision.test.js b/tests/neural-after-decision.test.js
index e6fdc080..5821f72e 100644
--- a/tests/neural-after-decision.test.js
+++ b/tests/neural-after-decision.test.js
@@ -47,7 +47,7 @@ const frame = (text) => ({ type: 'cmb', timestamp: Date.now(), content: text, cm
 const share = (node, f) => node._frameHandler._handleMemoryShare(PEER.nodeId, PEER.name, f, admitAs(node, PEER));
 
 describe('the neural path after its decision', () => {
-  it('a tether that cannot be evaluated leaves the record stored unverified, decided and attested once', async () => {
+  it('a collapsed record evaluates no tether (§15.5, MMP 2.0 update 1), so an anchor the model cannot encode changes nothing: decided and attested once', async () => {
     await withNode(async (node, seen) => {
       // A lineage anchor whose categories cannot be read: what a model fault during the encode does.
       const broken = new Proxy({}, { get() { throw new Error('encoder fault'); }, ownKeys() { throw new Error('encoder fault'); } });
@@ -60,8 +60,9 @@ describe('the neural path after its decision', () => {
       assert.strictEqual(node._attestations.byCmb(key).length, 1, 'one attestation for the frame');
       const stored = node._store.get(key);
       assert.ok(stored, 'the admitted record is stored');
-      assert.strictEqual(stored.tether ?? null, null, 'with no tether verdict: unverified');
-      assert.ok(seen.logs.some((l) => /tether of a record from peerA not evaluated: encoder fault/.test(l)));
+      assert.strictEqual(stored.collapsed, true);
+      assert.strictEqual(stored.tether ?? null, null, 'no tether verdict');
+      assert.ok(!seen.logs.some((l) => /encoder fault/.test(l)), 'the anchor was never encoded');
     });
   });
 
diff --git a/tests/spec-update-coupling.test.js b/tests/spec-update-coupling.test.js
new file mode 100644
index 00000000..e33294ac
--- /dev/null
+++ b/tests/spec-update-coupling.test.js
@@ -0,0 +1,136 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME before lib/config loads
+
+/**
+ * Coupling as MMP 2.0 update 1 states it (PR #43 at 2660ab9): a record that cites the receiver's own
+ * records is gated and delivered like any other, and kept out of the receiver's remix cycle at the
+ * trigger (D3, #35); a collapsed integration gets no §15.8 tether (#17, §15.5); unsigned valence and
+ * arousal never reach Layer 6; only gated remixes count as remixes (#35); and xmesh-insight-v1 is
+ * offered only when a host adds it. Each test fails on 850136d unless it says it pins.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const { SymNode } = require('../lib/node');
+const { NullDiscovery } = require('../lib/discovery');
+const { nodeDirById } = require('../lib/config');
+const { MeshAgent } = require('../lib/mesh-agent');
+const { isLineageSevered } = require('../lib/core');
+const { identity, signedRecord, admitAs, deliver } = require('./_core-secure');
+
+const uniq = (b) => `${b}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
+const made = [];
+function node(base, opts = {}) {
+  const n = new SymNode({ name: uniq(base), silent: true, discovery: new NullDiscovery(), room: 'coup', ...opts });
+  made.push(n);
+  return n;
+}
+async function stopAll() {
+  for (const n of made.splice(0)) { try { await n.stop(); } catch { /* */ } try { fs.rmSync(nodeDirById(n.nodeId), { recursive: true, force: true }); } catch { /* */ } }
+}
+const ALIGNED = { decision: 'aligned', total_drift: 0.1, category_drifts: { focus: 0.1 }, gate_values: { g: 1 } };
+const CATS = (focus) => ({ focus, issue: 'coupling test', intent: 'check', motivation: 'm', commitment: 'c', perspective: 'p', mood: { text: 'calm' } });
+const settle = () => new Promise((r) => setTimeout(r, 150));
+
+describe('D3: no echo skip at ingest (#35)', () => {
+  it('a reply citing this node\'s record is admitted, stored and delivered', async () => {
+    try {
+      const A = node('d3-a');
+      A._svafEvaluator.evaluate = async () => ALIGNED;
+      const mine = A.remember(CATS('what A said first'));
+      const P = identity('peer');
+      const s = admitAs(A, P);
+      const got = [];
+      A.on('cmb-accepted', (e) => got.push(e));
+      const reply = signedRecord(P, { room: 'coup', categories: CATS('a reply to what A said'), lineage: { parents: [mine.key] } });
+      deliver(A, s, { type: 'cmb', cmb: reply });
+      await settle();
+      assert.strictEqual(got.length, 1);
+      assert.ok(A._store.get(reply.metadata.key) || got[0].key, 'stored');
+    } finally { await stopAll(); }
+  });
+
+  it('the remix trigger keeps it out of this node\'s remix cycle (pins the rule where it now sits)', async () => {
+    try {
+      const A = node('d3-trigger');
+      const mine = A.remember(CATS('what A said'));
+      let remixed = 0;
+      // The trigger itself, on this node (a MeshAgent would build its own node from its cwd's .env).
+      const agent = { _signingHalted: false, _shouldRemix: () => true, _name: 'a', _node: A, _remix: async () => { remixed++; return CATS('a remix'); }, _meshContext: () => ({}), _remember: () => null };
+      const P = identity('peer');
+      const reply = signedRecord(P, { room: 'coup', categories: CATS('reply'), lineage: { parents: [mine.key] } });
+      await MeshAgent.prototype._onCMBAccepted.call(agent, { key: reply.metadata.key, cmb: reply, source: 'peer' });
+      assert.strictEqual(remixed, 0);
+    } finally { await stopAll(); }
+  });
+});
+
+describe('a collapsed integration has no §15.8 tether (#17, §15.5)', () => {
+  it('a record kept as signed is never severed, and no tether is signed about it', async () => {
+    try {
+      const A = node('col');
+      A._svafEvaluator.evaluate = async () => ALIGNED;
+      // A root this node holds, and a peer record that cites it with nothing in common: the tether
+      // would sever a remix of it. The neural gate keeps the incoming text, so the record collapses.
+      // The root is another peer's (so no echo rule of any release applies), held verified.
+      const R = identity('root-author');
+      const rootRec = signedRecord(R, { room: 'coup', categories: { focus: 'quarterly tax filing deadlines for small companies', issue: 'accounting', intent: 'inform', motivation: 'compliance', commitment: 'file on time', perspective: 'accountant', mood: { text: 'focused' } } });
+      A._store.receiveFromPeer(R.nodeId, { key: rootRec.metadata.key, content: 'x', source: 'root-author', cmb: rootRec, _cmbVerified: true, verified: true });
+      const root = { key: rootRec.metadata.key };
+      const P = identity('peer');
+      const s = admitAs(A, P);
+      const rec = signedRecord(P, { room: 'coup', categories: { focus: 'alpine snow conditions on the north ridge this weekend', issue: 'avalanche risk', intent: 'warn', motivation: 'safety', commitment: 'stay off the ridge', perspective: 'mountain guide', mood: { text: 'wary' } }, lineage: { parents: [root.key] } });
+      deliver(A, s, { type: 'cmb', cmb: rec });
+      await settle();
+      const e = A._store.get(rec.metadata.key);
+      assert.ok(e, 'stored as signed under its own key (collapsed)');
+      assert.strictEqual(e.collapsed, true);
+      assert.strictEqual(isLineageSevered(e), false, 'not a severed root');
+      assert.strictEqual(e.tether, undefined, 'no tether attestation');
+      assert.strictEqual(e.provenance && e.provenance.tether, undefined);
+    } finally { await stopAll(); }
+  });
+});
+
+describe('Layer 6 is given no unsigned affect (§8.8.4)', () => {
+  it('a Legacy Import record\'s valence and arousal never reach the engine', async () => {
+    try {
+      const A = node('l6');
+      const fed = [];
+      A._xmesh = { ingestSignal: (sig) => fed.push(sig) };
+      const P = identity('legacy-peer');
+      const rec = signedRecord(P, { room: 'coup', categories: CATS('an imported observation') });
+      rec.categories.mood = { ...rec.categories.mood, valence: 0.9, arousal: -0.8 };
+      const msg = { type: 'cmb', cmb: rec, _legacyImport: true, content: 'x', source: 'legacy' };
+      await A._frameHandler._processNeuralSVAF(ALIGNED, msg, 'legacy', P.nodeId, Date.now(), Date.now());
+      assert.ok(fed.length >= 1);
+      for (const sig of fed) { assert.strictEqual(sig.valence, 0); assert.strictEqual(sig.arousal, 0); }
+    } finally { await stopAll(); }
+  });
+});
+
+describe('only a gated remix is a remix (#35)', () => {
+  it('remember() with parents counts as a record, remix() as a remix', async () => {
+    try {
+      const A = node('cnt');
+      const first = A.remember(CATS('an observation'));
+      A.remember(CATS('a reply citing it'), { parents: [first.cmb] });
+      assert.strictEqual(A.metrics().remixProduced, 0);
+      A.remember(CATS('new domain data'));
+      const r = A.remix(CATS('an integration of a peer record'), { parents: [first.cmb] });
+      assert.ok(r && !r.refused);
+      assert.strictEqual(A.metrics().remixProduced, 1);
+    } finally { await stopAll(); }
+  });
+});
+
+describe('xmesh-insight-v1 is offered only when a host adds it', () => {
+  it('the default offer, and a host\'s addition', async () => {
+    try {
+      assert.deepStrictEqual(node('ext')._offeredExtensions, ['cmb-encrypted-v2', 'sym-attest-v1']);
+      assert.deepStrictEqual(node('ext2', { extraExtensions: ['xmesh-insight-v1', 'xmesh-insight-v1', 'Bad Token'] })._offeredExtensions, ['cmb-encrypted-v2', 'sym-attest-v1', 'xmesh-insight-v1']);
+    } finally { await stopAll(); }
+  });
+});
diff --git a/tests/stored-entry-annotations.test.js b/tests/stored-entry-annotations.test.js
index cfb1f455..4d375d0c 100644
--- a/tests/stored-entry-annotations.test.js
+++ b/tests/stored-entry-annotations.test.js
@@ -87,10 +87,11 @@ describe('admission annotations live on the store entry', () => {
         assert.strictEqual(entry.admission?.of, record.metadata.key, 'the admission attestation is on the entry');
         assert.strictEqual(entry.admission.by, node.nodeId);
         assert.deepStrictEqual(verifyAttestation(entry.admission, node._identity.publicKey), { signed: true, valid: true });
-        assert.strictEqual(entry.tether?.anchor, record.metadata.key, 'the tether attestation is on the entry (a root is its own anchor)');
-        assert.strictEqual(verifyTetherAttestation(entry.tether, node._identity.publicKey).valid, true);
-        assert.strictEqual(entry.provenance?.tether?.severed, false, 'the provenance is on the entry');
-        assert.strictEqual(entry.provenance.forged, undefined, 'nothing the frame supplied reached it');
+        // A collapsed integration (the incoming block itself) has no §15.8 tether (§15.5, MMP 2.0
+        // update 1): the forged one the frame supplied is not kept, and none is signed.
+        assert.strictEqual(entry.tether, undefined, 'no tether attestation, and not the frame\'s');
+        assert.strictEqual(entry.provenance?.tether, undefined, 'no tether in the provenance');
+        assert.strictEqual(entry.provenance?.forged, undefined, 'nothing the frame supplied reached it');
         assert.strictEqual(entry.collapsed, true, 'the record is the incoming block itself');
         if (path_ === 'heuristic') {
           assert.strictEqual(typeof entry.provenance.totalDrift, 'number', 'the gate\'s evidence');

From bacab72c54bd6b8cbdcb6cdae6ca7a29c9364218 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 8 Oct 2026 12:19:05 +0100
Subject: [PATCH 133/148] docs: SECURITY, WIRE-0.14.0 and the changelog say
 what update 1 alignment ships; interop with 0.13.17
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- CHANGELOG 0.14.0: a section for MMP 2.0 update 1 (PR #43 at 2660ab9), item by item, and
  "Interop with 0.13.17": LAN meshing with 0.13.17 stops except through Legacy Import routes, by
  design. The passages the round made stale are corrected in place (the mood frame, rooms in NFC,
  discovery, the counter rule, cmb-fetch's keys, xmesh-insight-v1, 4007, the B-L5/B-L6 tethers).
  The released 0.13.17 (2026-10-07, a relay fix) gets its own entry; the earlier, unreleased
  0.13.17 security candidate keeps its record under that name.
- SECURITY.md: the counter advances when a frame opens; sealed Close-action errors; the clear-1011
  conditions; the seal point's room check; the canonical projection and §5.8 rooms; fetched records
  attributed only after §8.8.5; the mood frame; the attestation rules; grant schema checks; 4007 an
  ordinary close; TXT room as a hint; and, under what it does not solve, that §15.8 applies to
  nothing sym receives (collapsed integrations) while remix() does not evaluate it, and the 0.13.17
  LAN break.
- docs/WIRE-0.14.0.md: rewritten against update 1. What the spec now defines is named by section;
  what remains is what sym chooses (anchor replay, 1011 pacing, the probe, sendError, the relay pace
  against the §19.1 floors).
- reference.md and SKILL.md: the §5.8 room grammar and the one service type.
- application.schema.json vendored (the record schema references it) with its manifest digest.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QRVMpaJkAA2fFbvuHCEzqH
---
 .agents/skills/sym/SKILL.md            |   2 +-
 .claude/skills/sym/SKILL.md            |   2 +-
 CHANGELOG.md                           | 165 ++++++++++++++++----
 SECURITY.md                            |  89 ++++++++---
 docs/WIRE-0.14.0.md                    | 205 +++++++++++--------------
 docs/reference.md                      |   4 +-
 tests/fixtures/SOURCES.json            |   4 +
 tests/fixtures/application.schema.json |  35 +++++
 8 files changed, 334 insertions(+), 172 deletions(-)
 create mode 100644 tests/fixtures/application.schema.json

diff --git a/.agents/skills/sym/SKILL.md b/.agents/skills/sym/SKILL.md
index 1fcca9f6..93cd5043 100644
--- a/.agents/skills/sym/SKILL.md
+++ b/.agents/skills/sym/SKILL.md
@@ -120,7 +120,7 @@ A mesh holds many groups: the default global mesh, or named private rooms. You o
 ```bash
 sym groups            # which groups are live on the LAN right now
 sym group             # the group you're in
-sym join <name>       # switch into a group (kebab-case, e.g. backend-team)
+sym join <name>       # switch into a group ([a-z0-9._-], e.g. backend-team or acme.prod)
 sym leave             # back to the default mesh
 ```
 
diff --git a/.claude/skills/sym/SKILL.md b/.claude/skills/sym/SKILL.md
index 1fcca9f6..93cd5043 100644
--- a/.claude/skills/sym/SKILL.md
+++ b/.claude/skills/sym/SKILL.md
@@ -120,7 +120,7 @@ A mesh holds many groups: the default global mesh, or named private rooms. You o
 ```bash
 sym groups            # which groups are live on the LAN right now
 sym group             # the group you're in
-sym join <name>       # switch into a group (kebab-case, e.g. backend-team)
+sym join <name>       # switch into a group ([a-z0-9._-], e.g. backend-team or acme.prod)
 sym leave             # back to the default mesh
 ```
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index c066019f..2c252b33 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,13 +5,14 @@
 **Core Secure.** 0.14.0 makes every sym node an MMP v2.0 Core Secure participant (design
 "Core Secure identity: a peer is a proven session, never a hint", v2, 2026-10-02). It breaks the
 wire with 0.13 and older: a 0.13 node is reached only through an explicit Legacy Import route
-(below). It also breaks readers outside sym: the store's annotations moved from the stored record
+(below, and "Interop with 0.13.17"). It also breaks readers outside sym: the store's annotations moved from the stored record
 to the entry (see Changed). It includes 0.13.15 and 0.13.16 (the witness-storm fix and its
-follow-ups). **0.13.17 was never released:** its fixes and their tests ship in 0.14.0 (no more
-0.13.x releases), except two mechanisms 0.14's design replaces — the cap of 16,384 never-evicted
+follow-ups). **The 0.13.17 security candidate was never released as such:** its fixes and their
+tests ship in 0.14.0, except two mechanisms 0.14's design replaces — the cap of 16,384 never-evicted
 key bindings (a lockout anyone on the LAN could fill) by the binding lifetime below, and the
 in-memory pending set for grants that arrive before their root (which could be flooded), now by
-§6.6's bounded pending statements (below).
+§6.6's bounded pending statements (below). The 0.13.17 that was released (2026-10-07) is a relay
+fix on the 0.13 line; 0.14.0's relay sessions do not have the defect it fixes (see its entry).
 
 ### Authority: MMP §6.6
 
@@ -119,6 +120,89 @@ carried (cutoffs, ratification, budgets per delegation subtree, `role-chain-fetc
   the one rule at every verification site in ed25519-strict; threshold co-signing and migration in
   authority-migration; roles and weights in earned-authority-node.
 
+### MMP 2.0 update 1: the drafts this release implements, as the spec now states them
+
+The founder ruled that the drafts sym 0.14.0 implements land in the published spec before it ships.
+They are folded into one update, MMP 2.0 update 1 (sym-bot/meshcognition-website PR #43, branch
+spec/mmp-2.0-update-1 at 2660ab9: #24, #25, #17, #22, #26, #30, #23, #31, #37, #34, #35, #27 and #28
+on the §6.6 errata), and sym is aligned with its text, its reference construction (scripts/mmp/lib.mjs)
+and its schemas and vectors, vendored in tests/fixtures with their manifest digests
+(record-projection-v2, record-size-v2 and control-encrypted-v2 pass byte for byte, and every frame
+sym builds validates against the vendored schemas).
+
+- **The seal point (#26, S1).** A record is never sealed into a session of another room than its
+  signed one, whatever path offered it: a fetch answer, an anchor replay, a broadcast.
+- **room-join (#31, S2).** A grant is checked against its schema (closed, integer times, lowercase
+  ids) before any signature work: the same owner signature over string times verified, and the
+  expiry timer never armed for it. The expiry timer arms from the verified number; the node sends
+  only the schema's members of the grant it holds, and mints only those.
+- **Sequencing (#26, S4).** A sealed frame that opens advances the receive sequence, whatever it
+  carries; its record or inner frame is parsed after, and refusing it changes nothing else (it left
+  the counter behind, so the next frame closed the session as a gap).
+- **Errors (#23).** Every sealed error whose §7.2 action is Close ends the session (1008 from a peer
+  did not). `sendError` sends only 1002 and 2xxx. A clear 1011 prompts a re-handshake only when its
+  `detail` names this node's session or a probe ping is outstanding, while no newer session is
+  waiting to supersede, and no faster than the retry backoff (fifty forged 1011s with no detail
+  bought three re-handshakes in five seconds; now none). A sealed ping is answered with a pong.
+- **The mood frame (founder ruling).** `{ type, mood, context, timestamp }`: mood 1 to 1,024
+  characters, context at most 4,096 or null; no `from` or `fromName` (the receiver labelled the event
+  with the payload's name); a frame carrying them is refused. `broadcastMood` throws `EMOODFRAME`
+  rather than send one out of bounds.
+- **Fetch (#26).** `cmb-fetch` carries no `from` and names one `key` (a `keys` array is refused);
+  `cmb-fetch-result` carries no `timestamp` (it was schema-invalid). A fetched record is verified by
+  the whole of §8.8.5 before it is attributed: `fetchCMB()` returns `{ verified: true, cmb,
+  authorNodeId }`, or `{ verified: false, reason, categories }` with no metadata (D4; it returned
+  unverified metadata as if attributed).
+- **cmb-anchors (#30).** Only a non-empty list starts the once-a-minute limit (an admission with
+  nothing to replay held back the next one's context); only this node's own records of the
+  session's room are replayed; a frame that is not the schema's is refused whole.
+- **The canonical projection (#34, D2).** One assertion is held as the same bytes at every node: a
+  non-NFC category text, `createdBy` or `application.schema` is refused (and minted NFC), parents are
+  held and minted as a sorted set, a lineage with no parents is null, and an absent application is
+  null (so sealed records carry `metadata.application`, as encrypted-cmb-frame.schema.json requires).
+  The 256-character caps count code points. `MAX_RECORD_BYTES` measures the two-section record only
+  (#37), not remember()'s decoded payload beside it.
+- **Rooms.** A room is a §5.8 identifier, `[a-z0-9._-]` of 1 to 64 characters, everywhere it is
+  named: the node's own (`SymNode` throws `EBADROOM`), the handshake, a record, an attestation, a
+  grant. `sym join` and the daemon took kebab-case only and refused §5.8-valid dotted and underscored
+  rooms (the spec's recommended `acme.prod` among them). `sym` stays refused.
+- **Discovery (#17, #22).** The daemon advertises every room on `_sym._tcp` with TXT `room`, as the
+  library did (it used `_<room>._tcp`, so a daemon and a library node in one room never met), and
+  browses the per-room type earlier releases used, where it is a valid RFC 6335 name. A node dials
+  only an advertisement whose TXT room is its own and whose `mmp` (a comma-separated version list)
+  lists 2.0. TXT keys are read case-insensitively, the first occurrence winning. A discovery a host
+  builds advertises its node's room.
+- **The relay client (#25).** 4007 is an ordinary close with backoff (#20, relay-auth key proof, is
+  deferred, and its review found that never reconnecting after 4007 makes a lockout); what a relay
+  listed in `relay-peers.features` is forgotten with its socket; relay-auth carries the nodeId in its
+  lowercase form.
+- **sym-attest-v1 (#27, S3).** No attestation is signed about a Legacy Import record, and none about a
+  directed record is sent or relayed (one received is kept). The attestation is a closed object with
+  exactly seven verdicts, lowercase UUID attesters, a §5.8 room, a role of up to 64 characters and a
+  method of up to 32. A conflicting checkpoint is relayed once, as evidence. An attester's scoped role
+  is judged on the record its assertion names. No checkpoint root is signed over a suffix of the
+  chain (D1; the chained construction of the revised #27 is not in this release yet).
+- **Echoes (#35, D3).** A record citing this node's own records is verified, gated, stored and
+  delivered like any other: the ingest echo skip is gone, and the anti-echo rule sits at the remix
+  trigger. `remixProduced` counts only remixes minted through `remix()`, and the decision log says
+  whether a refused record cites parents (`cites`), never that it was a remix.
+- **No tether on a collapsed integration (#17, §15.5).** sym's gates keep the incoming text, so every
+  integration collapses onto the author's record as signed; it is no longer tethered, severed or
+  attested, and the retroactive audit judges only this node's own records. sym's receive path
+  therefore applies §15.8 to nothing, and `remix()` does not yet evaluate it (SECURITY.md).
+- **Layer 6** is given no valence or arousal (unsigned), a Legacy Import record's included.
+- **xmesh-insight-v1** is not offered by default; a host adds it with `extraExtensions`.
+
+### Interop with 0.13.17
+
+LAN meshing with 0.13.17 stops except through Legacy Import routes, by design. A 0.13.17 node
+advertises no `mmp` key, so a 0.14 node never dials it as Core Secure; a 0.14 listener closes the
+legacy one-frame hello a 0.13.17 node sends at once (logged once a minute per address). Over the
+relay they never share a session either: 0.14 attempts the Core Secure handshake with a 0.13.17
+relay peer, which never completes, and answers its pings with clear 1011s at the bounded rate. A
+0.13.17 node is reached only through a configured Legacy Import route naming its nodeId and pinned
+key (below), whose records are quarantined. Upgrade every node of a room together.
+
 ### `message` and `mood-delivered` carry their provenance
 
 - **The `message` event's meta and the `mood-delivered` event carry `verified`, `profile`,
@@ -133,8 +217,8 @@ carried (cutoffs, ratification, budgets per delegation subtree, `role-chain-fetc
   peer sent it, under the key that session proved (the frame is sealed on the session); it is not a
   signed record. Nothing about it can be verified again later, relayed with its author's signature,
   or attributed to anyone but that peer. A host shows it as the peer's word, not as a verified record.
-  MMP §6.6 errata 1 registers the mood frame as sym sends it (`{ type, from, fromName, mood,
-  context, timestamp }`, sealed on a Core Secure session, never stored, relayed or remixed).
+  The mood frame is `{ type, mood, context, timestamp }` (MMP 2.0 update 1, by the founder's
+  ruling): it names no sender, and `mood-delivered.from` is the session's proven name.
 
 ### The loaded version, and hot-swap
 
@@ -308,7 +392,7 @@ Seven design assumptions, each changed where it was made, not patched where it s
   Windows `listen` refuses unless `{ allowDefaultPipeAcl: true }`. The interior capability is bound
   to the first connection that presents it; `end` takes the capability, never the mindId; a
   submission's kind is its signed intent. The client refuses a selection outside both offers.
-  Rooms compare in NFC. A relay frame type never rides inside a sealed control frame. Node names
+  A room is a §5.8 identifier (MMP 2.0 update 1, above). A relay frame type never rides inside a sealed control frame. Node names
   are one path component. `sym keys <name>` lists without writing. `sym emit` pins its receiver
   (`--receiver <nodeId> --receiver-key <key|sha256:…>`) and holds the identity lock while
   connected. An anchor mark needs the record's author to be the session's node. `mood-delivered`
@@ -341,17 +425,18 @@ Seven design assumptions, each changed where it was made, not patched where it s
   hello naming another nodeId is refused),
   torn down on `relay-peer-left`, superseded by a newer confirmed session for the same (nodeId,
   key) (a restart under 4004), and never torn down by an unconfirmed hello. 5 s timeout.
-- **Discovery advertises the profile.** TXT `mmp=2.0` and `room=<room>` (and the same in the
-  loopback registry). A record without `mmp=2.0` is a legacy node: never dialled as Core Secure.
-  The lexicographically smaller nodeId dials (§5.1).
+- **Discovery advertises the profile.** Every room on `_sym._tcp`, with TXT `mmp=2.0` and
+  `room=<room>` (and the same in the loopback registry). A record whose `mmp` list lacks 2.0 is not
+  dialled as Core Secure, nor one whose TXT room is another room (MMP 2.0 update 1, above). The
+  lexicographically smaller nodeId dials (§5.1).
 - **Ephemeral E2E, sealed frames.** The persistent X25519 key (`e2e-keypair.json`) and the
   per-peer shared-secret map are gone: each handshake uses a fresh X25519 key pair and derives
   directional keys (§5.2.1). Records travel only as `cmb-encrypted` (§18.2.1), one sealed frame
   per peer session. Every other post-handshake frame except ping/pong travels sealed as
   `control-encrypted` (`mood` included: it is cognitive content; `error` too). The receive counter
-  advances only after the AEAD opens (it advanced first, so one forged frame with the right
-  sequence desynchronised a session); a gap closes the session and re-handshakes, a replay is
-  discarded.
+  advances when the AEAD opens (it advanced first, so one forged frame with the right sequence
+  desynchronised a session), whatever the frame carries (MMP 2.0 update 1, above); a gap closes the
+  session and re-handshakes, a replay is discarded.
 - **Records are v2.0** (`MMP_EMIT_V2` on). Every record is signed `mmp-sig-v2.0` with the signed
   author `createdByNodeId`; the receiver resolves the author key by `createdByNodeId` through
   the key registry. An unsigned, legacy-suite or unresolvable record is refused (a legacy-suite
@@ -364,19 +449,19 @@ Seven design assumptions, each changed where it was made, not patched where it s
   `remember({ payload })` payload now rides as the record's signed application section (§8.8.3)
   and is given back to the receiver as `cmb.payload`.
 - **The frame table.** `cmb` (plaintext) is refused (Legacy Import sessions only);
-  `cmb-fetch` may name one `key` or up to 32 `keys`; each record found goes out as its own
-  sealed `cmb-encrypted` frame, then one sealed `cmb-fetch-result` that carries only the
-  correlation id and the key lists, `{ reqId, returned: [...], missing: [...] }` (draft spec PR
-  #26; each key requested in exactly one list; it carried the record in the clear); `role-grant`/`role-revoke` are retired
+  `cmb-fetch` names one `key`; the record found goes out as its own sealed `cmb-encrypted` frame,
+  then one sealed `cmb-fetch-result` that carries only the correlation id and the key lists,
+  `{ reqId, returned: [...], missing: [...] }` (MMP 2.0 update 1; it carried the record in the
+  clear); `role-grant`/`role-revoke` are retired
   (MMP §6.6.11, above); `peer-info` and `wake-channel` are learned only
   for the session's own nodeId (gossip about other nodes and the relay's peer list are hints,
   never stored); `message` is retired: `send()` sends a directed CMB whose signed application
   section marks it a message, and the receiver raises its `message` event from it;
-  `xmesh-insight` goes only with `xmesh-insight-v1`; `state-sync` is refused. Records
-  replayed as context on connect are announced in a sealed `cmb-anchors` frame (the `_anchor`
-  frame flag could not ride a sealed record). The new wire elements that still need spec text
-  (`cmb-anchors`, the error rules and 1011, and what sym chooses where MMP §6.6 leaves a choice) are
-  written out in `docs/WIRE-0.14.0.md`; `room-join` is draft spec PR #31.
+  `xmesh-insight` goes only with `xmesh-insight-v1`, which is offered only when a host adds it;
+  `state-sync` is refused. Records replayed as context on connect are announced in a sealed
+  `cmb-anchors` frame (the `_anchor` frame flag could not ride a sealed record). MMP 2.0 update 1
+  now defines these frames; what sym chooses where the spec leaves a choice is in
+  `docs/WIRE-0.14.0.md`.
 - **Admission attestations are the `sym-attest-v1` extension** (draft spec PR
   meshcognition-website#27). The frames are `sym-attest-attestation`, `sym-attest-checkpoint`,
   `sym-attest-witness` and `sym-attest-node-stats`, sent only to sessions that selected the
@@ -493,13 +578,12 @@ Seven design assumptions, each changed where it was made, not patched where it s
 
 ### Relay
 
-- **4006 and 4007 are hard stops, like 4004.** The client did not handle 4006 (§4.4.7: the
-  existing holder is the legitimate one) and retried it at the normal backoff. Now 4006, and 4007
-  (draft MMP spec PR meshcognition-website#20: the relay binds this nodeId to a different key) are
-  said once, loudly, kept in `state().stopped` / `status().relayState.stopped` with phases
-  `duplicate-rejected` and `key-conflict`, reported to the host (`identity-collision` with `code`
-  and `kind`, and a `relay-hard-stop` metric), and never reconnected. relay-auth v2 (the
-  challenge in that PR) is not implemented until it merges.
+- **4006 is a hard stop, like 4004.** The client did not handle 4006 (§4.4.7: the existing holder
+  is the legitimate one) and retried it at the normal backoff. Now 4006 is said once, loudly, kept in
+  `state().stopped` / `status().relayState.stopped` with phase `duplicate-rejected`, reported to the
+  host (`identity-collision` with `code` and `kind`, and a `relay-hard-stop` metric), and never
+  reconnected. 4007 (draft MMP spec PR meshcognition-website#20, deferred past 0.14.0) is an
+  ordinary close, reconnected with backoff (MMP 2.0 update 1, above).
 - A relay socket that `destroy()` let go no longer schedules a reconnect when its close arrives
   (a stopped node object kept redialling when its host reported it still running).
 - The client paces everything it sends under sym-relay's limit (25 frames/s, burst 300, then
@@ -663,9 +747,9 @@ debt, and the daemon's log flood. Every item has a test that fails without its f
   stored records and 16,384 parent keys queued, and it stops at a bound instead of draining its
   queue. A record can name about 14,700 parents within one frame, and before this the queue grew
   with every long parent list the walk stepped onto.
-- **A tether could not be reproduced by another node (B-L5).** It is measured on the stored record's
-  text, encoded in one kernel, instead of on vectors blended with local memory.
-- **Cold-start admissions had no tether (B-L6).**
+- **A tether could not be reproduced by another node (B-L5).** It is measured on the record's text,
+  encoded in one kernel, instead of on vectors blended with local memory. (Since MMP 2.0 update 1 a
+  collapsed integration, which is every one sym's gates make, has no tether at all: above.)
 - The tether audit's fetch fallback no longer returns a local record the walk had refused.
 
 ### Changed — read these before upgrading
@@ -938,7 +1022,22 @@ spend it under the asking rule, as "Authority: MMP §6.6" says.)
 - Admission-as-collapse (B-L3) is pinned by a test: the conformance boundary of spec PR #17.
 - Tests wait on what they test instead of fixed sleeps: in-flight frames, and the encoder's own load.
 
-## 0.13.17 (never released — its fixes ship in 0.14.0)
+## 0.13.17 (2026-10-07)
+
+A relay fix, released on the 0.13 line (the 0.13 line otherwise stays closed).
+
+- **One peer re-announced by the relay no longer breaks every send in the room.** A replaced relay
+  transport is detached before it is closed, and a peer with no transport is skipped and logged,
+  never thrown on.
+- **A LAN transport added to a peer first met over the relay is used** (MMP §4.6: bonjour before
+  relay).
+- `stop()` closes every transport a peer holds, and tolerates a peer with none.
+
+0.14.0 does not carry this code: a 0.14 peer is a set of proven sessions, a repeated announcement
+reuses a live relay session (probing it with a ping), and LAN is preferred over relay
+(tests/relay-reannounce-scenes.test.js).
+
+## The 0.13.17 security candidate (not released as such; its fixes ship in 0.14.0)
 
 This entry is kept as the record of what the 0.13.17 review found and fixed. Two of its mechanisms
 do not ship: the 16,384-binding cap on the key registry (replaced by the binding lifetime) and the
diff --git a/SECURITY.md b/SECURITY.md
index 8fc900a5..e0632fda 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -22,15 +22,24 @@ Report a vulnerability privately to info@sym.bot (the address in package.json).
 - **Sealed, ordered channel.** Records travel only as `cmb-encrypted` (ChaCha20-Poly1305 under
   the session's directional traffic key, AEAD-bound to session, direction, sequence and the
   record's identity). Every other post-handshake frame except ping and pong — an `error` included —
-  travels as a sealed `control-encrypted` frame on the same ordered sequence. The receive counter
-  advances only after a frame authenticates, so a forged frame moves nothing; an authentic replay
-  or rollback is discarded, and a gap closes the session, which re-handshakes.
+  travels as a sealed `control-encrypted` frame on the same ordered sequence (ping and pong may too,
+  and a sealed ping is answered). The receive counter advances when a frame authenticates, whatever
+  it carries, so a forged frame moves nothing and an authentic frame whose record or inner frame is
+  refused changes nothing else; an authentic replay or rollback is discarded, and a gap closes the
+  session, which re-handshakes. The envelope is checked as its schema bounds it (its members, a
+  sequence of at most 29 digits, a sealed value at least the tag's length) before it is opened.
 - **Errors are information, never commands.** A clear `error` frame is anyone's to write: it is
-  ignored, except 1011 UNKNOWN_SESSION, which prompts a new handshake and never tears a session
-  down. A session ends on its peer's sealed 1010 SESSION_CLOSED or 1009 IDENTITY_CONFLICT only.
+  ignored, except 1011 UNKNOWN_SESSION, which never tears a session down and prompts a new handshake
+  only on the client side, only when its `detail` names a session this node holds with that peer or a
+  probe ping to it is outstanding, while no newer session is waiting to supersede, and no faster than
+  the retry backoff (1 s doubling to 30 s). A session ends on its peer's sealed error whose MMP §7.2
+  action is Close (1001, 1003–1010: 1010 SESSION_CLOSED and 1009 IDENTITY_CONFLICT among them). A
+  host can send only information (1002 and 2xxx): `sendError` refuses the protocol's own codes.
 - **A record goes only where its author signed it to.** The one seal point refuses a record whose
-  signed `metadata.to` names anyone but the session's proven peer, whatever path offered it
-  (a broadcast, an anchor replay, a fetch answer, a queued frame).
+  signed `metadata.to` names anyone but the session's proven peer, or whose signed room is not the
+  session's room (a node's store is per node, not per room), whatever path offered it (a broadcast,
+  an anchor replay, a fetch answer, a queued frame), so its content is never disclosed to a peer that
+  would refuse it.
 - **One key per nodeId.** Every confirmed session runs with a binding: the key it proved, held for
   that nodeId while the session lives. The durable key registry binds a nodeId only when the
   binding is earned — an admitted verified record, a verified record its author signed to this
@@ -51,7 +60,23 @@ Report a vulnerability privately to info@sym.bot (the address in package.json).
   lowercase ids, each category key recomputed and a mismatch refused), application bytes, cognition
   key, assertion identity, the Ed25519 signature against the key resolved by `createdByNodeId`, and
   the signed audience (room, recipient). Members no signature covers (`valence`, `arousal`,
-  `lineage.method`) are dropped, and what is stored, delivered and served is the projection.
+  `lineage.method`) are dropped, and what is stored, delivered and served is the projection. The
+  projection is canonical (MMP 2.0 update 1, §8.8.5 step 1), so one assertion is the same bytes at
+  every node: a category text, `createdBy` or `application.schema` that is not NFC is refused (this
+  node mints them NFC), parents are held sorted bytewise as they are signed, a lineage with no
+  parents is null and an absent application is null. A room is a §5.8 identifier
+  (`[a-z0-9._-]`, 1 to 64 characters) everywhere it is named. Valence and arousal never reach the
+  Layer-6 engine, whatever a record (a Legacy Import one included) carried.
+- **A fetched record is attributed only after §8.8.5.** A `cmb-fetch` answer is checked against the
+  requested cognition key, which binds the categories only, then verified in full (author key by
+  `createdByNodeId`, signature, assertion identity, audience). `fetchCMB()` returns a record with its
+  author only when that passes; otherwise it returns the categories alone (`verified: false`, with the
+  reason), which the §15.8 audit may use and nothing reads as attributed.
+- **The mood frame speaks for its session only.** A mood frame is `{type, mood, context,
+  timestamp}`, sealed: at most 1,024 characters of mood and 4,096 of context. It names no sender:
+  the receiver labels it with the session's proven peer and name, and refuses a frame that carries
+  `from`, `fromName` or anything else the schema does not define. It is never stored, relayed or
+  remixed.
   Directed versus room-bound delivery is decided by the signed `metadata.to`, never by a relay
   envelope; a directed record older than 24 h by its signed time is refused.
 - **Authority is a function of a set of signed statements (MMP §6.6, as merged at
@@ -111,10 +136,17 @@ Report a vulnerability privately to info@sym.bot (the address in package.json).
 - **Admission attestations under `sym-attest-v1`.** Attestations, checkpoints and witnesses are
   signed under their own domain tags with every field covered, verified against the signer's bound
   key (never the delivering session), and exchanged only with sessions that negotiated the
-  extension. They describe a decision; they never change the receiver's own.
+  extension. Their objects are closed, with exactly seven category verdicts, lowercase UUID
+  attesters and witnesses, a §5.8 room and the registered `role` and `method` grammars. No
+  attestation is signed about a Legacy Import record, and none about a directed record leaves this
+  node (one received is kept, never relayed): an attestation would make it a confirmation oracle. A
+  conflicting checkpoint is relayed once, as evidence. An attester's scoped role is judged on the
+  record its assertion names. They describe a decision; they never change the receiver's own.
 - **Gated rooms on proven keys.** A gated room admits its owner by the owner's pinned key and a
   grantee when its room-join grant binds the key its session proved. A copied grant admits
-  nobody.
+  nobody. A grant is checked against its schema (closed, integer times, lowercase ids) before any
+  signature work, so the same signature over string times never verifies, and the session closes
+  when the grant expires; a node sends only the schema's members of the grant it holds.
 - **Moved, and copied only when asked.** `sym node export` refuses while the node runs (in another
   process or this one), holds the identity's lock, tombstones the node before its encrypted bundle
   exists (so the source refuses to start it), signs the bundle with the node's key, and once the
@@ -181,8 +213,8 @@ Every store a peer can feed has a fixed bound. Reaching one never stops the node
   verified statements a second in all (burst 20,000) is spent only after the check; checkpoints at most
   4 a second per attester (burst 128); at most 1,024 attesters, 32 checkpoints each, 256 witnesses
   per position.
-- **Records** (MMP §8.8.6 as draft spec PR #37 states it): a category's text at most 256 KiB after
-  NFC, the seven at most 512 KiB, the record's JSON encoding at most 720 KiB, so every record fits
+- **Records** (MMP §8.8.6, MMP 2.0 update 1): a category's text at most 256 KiB after NFC, the seven
+  at most 512 KiB, the two-section record's RFC 8785 length at most 720 KiB, so every record fits
   one sealed frame. This node mints nothing larger, and refuses a received record over any limit
   before anything validates, verifies or encodes it; a sealed frame longer than a 720 KiB record can
   produce (983,062 base64url characters) is refused before it is opened. At most 8 new records a
@@ -213,7 +245,7 @@ Every store a peer can feed has a fixed bound. Reaching one never stops the node
   debounce go when the peer leaves, a refusal is kept (so a refused peer stays refused). The gossip
   budget and checkpoint-rate tables hold at most 4,096 peers each; the log-line deduplication maps
   1,024 keys each.
-- **Fetch and interior**: a `cmb-fetch` names at most 32 keys, a session expects at most 64 fetched
+- **Fetch and interior**: a `cmb-fetch` names one key (a `keys` array is refused), a session expects at most 64 fetched
   records; a node serves at most 2 fetches a second per session (burst 8), a record at most once a
   minute per session, and nothing while 2 MiB to that session is unsent; an interior submission is
   at most 64 KiB of category text and 512 KiB of application data, at the mission's rate (60 a
@@ -270,10 +302,11 @@ Every store a peer can feed has a fixed bound. Reaching one never stops the node
 - **Relay eviction.** `relay-auth` identity is not proven (MMP §4.4.1), and the relay replaces a
   connection that re-authenticates under the same nodeId (close 4004, §4.4.7). A token holder
   can therefore interrupt another node's relay path. It cannot impersonate it: it gets no
-  session without the key. The client stops for good on 4004, 4006 (the existing holder is the
-  legitimate one) and 4007 (a relay that binds this nodeId to another key), and says so in
-  status, so an eviction is visible rather than a reconnect loop. The fix (relay-auth proving key
-  possession, MMP spec PR meshcognition-website#20) is drafted, not implemented.
+  session without the key. The client stops for good on 4004 and 4006 (the existing holder is the
+  legitimate one), and says so in status, so an eviction is visible rather than a reconnect loop.
+  Every other close is reconnected with backoff, 4007 included: relay-auth key proof (MMP spec PR
+  meshcognition-website#20) is deferred past 0.14.0, and its review found that never reconnecting
+  after 4007 makes a lockout.
 - **No key rotation** (MMP §3.4). A compromised key means a new identity.
 - **The local machine.** Identity files are readable by any process running as the same user.
   Operating-system isolation is out of scope. The daemon's IPC socket trusts the same user the same
@@ -289,11 +322,25 @@ Every store a peer can feed has a fixed bound. Reaching one never stops the node
   `legacy-record`, and given no authority; a legacy peer never passes a gated room's door. A
   nodeId that has proven itself over Core Secure has its legacy route refused (a persisted floor)
   until an operator resets it. Network Legacy Import is removed in 0.15.0.
-- **Metadata.** The relay operator sees routing envelopes: who, to whom, room, timing, sizes.
+- **Metadata.** The relay operator sees routing envelopes: who, to whom, room, timing, sizes. On the
+  LAN every node advertises on `_sym._tcp` with its room in the TXT `room` key, in cleartext to the
+  segment: a room name is not a credential, and the TXT room is a hint for whom to dial, never an
+  admission (the handshake decides).
+- **§15.8 is not applied to what this node receives.** MMP 2.0 update 1 (§15.5) exempts a collapsed
+  integration from the lineage tether, and sym's gates always collapse (they keep the incoming text,
+  so they store the author's record as signed). A peer's record that cites a root it has drifted
+  from is therefore kept with its author's lineage; the tether is the remixing node's duty. sym's
+  own remix path (`remix()`) does not yet evaluate the tether before it mints, and the retroactive
+  audit (`auditLineageTethers`) judges only this node's own records, which it cannot tell apart from
+  its replies. Lineage confers retention here (a hot descendant keeps its ancestors hot), never
+  authority or lifecycle.
+- **LAN meshing with sym 0.13.17 stops** except through configured Legacy Import routes, by design:
+  a 0.13.17 node advertises no `mmp` key, so a 0.14 node never dials it as Core Secure, and a 0.14
+  listener closes its legacy hello at once.
 - **Attestations disclose decisions.** With `sym-attest-v1` (offered by default) every peer in the
-  room learns which records a node gated and what it decided; a content address is a confirmation
-  oracle for whoever holds the text. Leave the extension out (`extensions` option) where that
-  disclosure is not acceptable. An attestation proves who decided, not that the decision was
+  room learns which room-bound records a node gated and what it decided; a content address is a
+  confirmation oracle for whoever holds the text (a directed record's never leaves its attester).
+  Leave the extension out (`extensions` option) where that disclosure is not acceptable. An attestation proves who decided, not that the decision was
   honest; the chain and witnesses make a forked history detectable, not impossible.
 - **A room name or relay token is not an enterprise trust boundary.** Anyone holding the token
   is in the channel, and an invite that carries a token is a secret.
diff --git a/docs/WIRE-0.14.0.md b/docs/WIRE-0.14.0.md
index d3836405..9d7b0c5d 100644
--- a/docs/WIRE-0.14.0.md
+++ b/docs/WIRE-0.14.0.md
@@ -1,76 +1,53 @@
-# sym 0.14.0: wire elements that need spec text
+# sym 0.14.0: the wire, against MMP 2.0 update 1
 
-These are the wire elements that sym 0.14.0 (Core Secure) sends and that MMP v2.0 does not
-define yet, written so that a spec PR can be drafted from them. Each section gives the element's
-fields, how it is signed or sealed, when it is sent, and what a receiver does.
+This file began as the wire elements sym 0.14.0 sends that MMP v2.0 did not define, written so that
+spec PRs could be drafted from them. Those drafts are now folded into **MMP 2.0 update 1**
+(sym-bot/meshcognition-website PR #43, branch spec/mmp-2.0-update-1 at 2660ab9, pending the
+founder's merge): `control-encrypted` (§7.1, §18.2.1), `cmb-anchors` (§9.4), `room-join` (§5.8.1),
+the relay handshake and the error rules (§5.2.2, §7.2), the record size limits and the canonical
+projection (§8.8.5, §8.8.6), discovery's TXT `mmp` and `room` (§5.1), the relay fan-out envelope
+(§4.4.4) and `sym-attest-v1` (§16.4). What remains here is what sym chooses where the spec leaves a
+choice, and where sym does not yet do what the update says.
 
 Notation follows MMP v2.0. `lp(x)` is the §8.8.4 length prefix (`<utf8-byte-length>:<utf8 bytes>`).
-A **sealed control frame** is the inner frame of a `control-encrypted` envelope (draft spec PR
-meshcognition-website#26). It shares the session's single per-direction sequence with
-`cmb-encrypted`, so the frames below are ordered with the records around them, and none is ever
-sent in the clear on a Core Secure session.
+A **sealed control frame** is the inner frame of a `control-encrypted` envelope. It shares the
+session's single per-direction sequence with `cmb-encrypted`, so the frames below are ordered with
+the records around them, and none is ever sent in the clear on a Core Secure session.
 
-Frames that the published spec, or a draft PR, already defines are not repeated here. That
-includes `control-encrypted` (#26), `cmb-fetch` and `cmb-fetch-result` (#26: the result is
-`{reqId, returned[], missing[]}`, and each record travels in its own `cmb-encrypted` frame ahead
-of it), the `sym-attest-*` frames (#27), the error code 1009 `IDENTITY_CONFLICT` (#21), and the
-relay close code 4007 (#20).
+Not in the update, and not in sym 0.14.0: relay-auth key proof and its close code 4007 (#20,
+deferred past 0.14.0; sym treats 4007 as an ordinary close, reconnected with backoff), and the
+Near Band extension (#39).
 
 ---
 
-## 1. `cmb-anchors`: the records that follow are replayed context
-
-**Why.** When a session is admitted, a node replays a few of its own recent records as context,
-so that a newly joined peer has something to couple against. In 0.13 the replayed record frame
-carried an `_anchor: true` flag. In Core Secure the record frame is fixed by §18.2.1 (an
-`cmb-encrypted` envelope carries the record and nothing else), so the flag cannot ride on it.
-
-**Frame** (sealed control frame):
-
-```json
-{ "type": "cmb-anchors", "keys": ["cmb-<64 lowercase hex>", "..."] }
-```
-
-- `keys`: the cognition keys (`metadata.key`, §8.2.1) of the records about to be replayed, in the
-  order they will be sent. At most 50 keys. The sender sends at most 5 records.
-
-**Sealing and signing.** Sealed on the session (`control-encrypted`), unsigned. It is
-session-bound: it speaks only for the session's proven peer, about records that peer authored.
-
-**When it is sent.** To every admitted session, first: with the keys of the records about to be
-replayed (at most once a minute per peer), or with `keys: []` when none follow. It goes immediately
-before the replayed records, which follow it on the same session as ordinary `cmb-encrypted`
-frames. Only records the sender itself authored are replayed (anti-echo, §15.7), and only signed
-`mmp-sig-v2.0` records. Because it is always sent, it is also the first authenticated frame a relay
-client hears from its server on a new session: a client that re-handshakes while it holds a
-confirmed session keeps the old one until the new one carries a sealed frame from the server (it
-cannot otherwise know the server took its `client-finish`), and closes a new one that hears nothing
-within the handshake timeout (`unconfirmed-by-peer`). (0.14.0 used `role-digest` for this until
-§6.6 retired it; with no anchor pinned there is no `authority-digest` to send.)
-
-**Receiver.**
-- Keeps the key set for that session, replacing any earlier set from the same session. It keeps
-  at most 50 string keys and ignores entries that are not strings.
-- A record that then arrives on that session with a listed key goes through §8.8.5 verification
-  and admission like any other, and is marked as replayed context (`anchor: true` on the
-  `verified-record` event and on the stored entry) only when its signed `createdByNodeId` is the
-  session's proven nodeId: an anchor is the sender's own record.
-- Only room-bound records are replayed: a record signed to one node (`to` set) is never replayed
-  to another, whoever's session it is (the seal point refuses it in any case).
-- Nothing about the record's authority or verification changes. `cmb-anchors` never causes a
-  record to be accepted.
+## 1. `cmb-anchors`: MMP 2.0 update 1, §9.4
+
+The frame is §9.4's: `{ "type": "cmb-anchors", "keys": [...] }`, sealed, at most 50 cognition keys,
+the first sealed frame after admission (after `room-join`, where the server holds a grant), with
+`keys: []` when nothing is replayed. What sym chooses:
+
+- It replays at most 5 records, the newest of its own `mmp-sig-v2.0` records in the session's room
+  with no recipient, and sends a **non-empty** list to one peer at most once a minute; only a list
+  that was sent starts that minute. The empty list goes on every admission.
+- Receiving, it keeps the key set for that session (replacing any earlier one) and marks a record
+  as replayed context (`anchor: true` on the `verified-record` event and the stored entry) only when
+  its signed `createdByNodeId` is the session's proven nodeId. A frame that is not the schema's (more
+  than 50 keys, a non-key, another member) is refused whole and counted.
+- Because it is always sent, it is the first sealed frame a relay client hears on a new session:
+  the client supersedes its old session only when a sealed frame of the new one, other than an
+  `error`, opens, and abandons a new one that hears nothing within the handshake timeout
+  (`unconfirmed-by-peer`), keeping the old.
 
 ---
 
-## 2. `room-join`: now draft spec PR #31
+## 2. `room-join`: MMP 2.0 update 1, §5.8.1
 
-sym 0.14.0 sent this frame as `mesh-room-join` until the security review. It now sends and reads
-`room-join`, as draft spec PR meshcognition-website#31 names and defines it (§5.8.1: a sealed
-control frame carrying the owner-signed grant, sent as the first control frame of a newly
-confirmed session; pending admission for up to the handshake timeout; verified against the
-owner's pinned key, the session's proven nodeId and key, this room, and the grant's expiry). One
-behaviour beyond the draft: an admitted session whose grant expires is closed when it does
-(`room-grant-expired`), not kept for as long as the session lasts.
+As §5.8.1 states it: a sealed control frame carrying the owner-signed grant, sent first on a newly
+confirmed session; the grant checked against its schema (closed, integer times, lowercase ids)
+before any signature work, then verified under §18.3.2 against the owner's pinned key, the
+session's proven nodeId and key and this room, with 5 minutes of skew either way; admission
+decided before the session's next frame; the session closed when the grant expires
+(`room-grant-expired`). sym sends only the schema's members of the grant it holds.
 
 ---
 
@@ -145,58 +122,58 @@ counted (`authorityStatus().stats.retired`), and they are never sent. Nothing in
 
 ---
 
-## 4. Errors on a session: 1011 `UNKNOWN_SESSION` in the clear, everything else sealed
-
-sym 0.14.0 used sym-local codes 4404 ("unknown session") and 4400 ("session closed") until the
-security review. It now uses the renumbering draft spec PR meshcognition-website#23 adopts: **1011
-`UNKNOWN_SESSION`** and **1010 `SESSION_CLOSED`**, beside #21's 1009 `IDENTITY_CONFLICT`, and the
-rule that an error is information, never a command.
-
-**On a confirmed session every error is sealed** (`control-encrypted`): 1010 when a node closes the
-session, 1009 when the peer's proven key conflicts with the binding, and any 2xxx. A sealed 1010
-or 1009 ends the session at the receiver; any other sealed code is counted and changes nothing.
-A handshake that does not confirm sends nothing, and a superseded session sends nothing (the
-peer's own new session supersedes it): it leaves any confirmed session exactly as it was.
-
-**A clear `error`** on a confirmed session, or over the relay, is anyone's to write, and is
-ignored (counted as `clear-error-ignored`), with one exception:
-
-```json
-{ "type": "error", "code": 1011, "message": "unknown session", "detail": "session:<32 lowercase hex>" }
-```
-
-**Why.** A relay session is bound to the relay `from` (draft #23). When a peer restarts behind the
-relay, the relay replaces its connection (4004) and, since sym-relay 0.5.4, sends no
-`relay-peer-left`. The other node still holds the old confirmed session and cannot tell the
-restart from a repeated announcement. So the peer's new process says, in the clear (it has no
-session to seal under), that it holds no such session.
-
-- `detail` names the sessionId when the triggering frame carried one (a sealed frame), and is
-  absent when it did not (a `ping`).
-
-**When it is sent.** A node that receives, from a relay `from`, either a sealed frame naming a
-session it does not hold, or a `ping` from a `from` it holds no relay session with, answers with
-1011: at most once a second per relay `from` (the table of froms is bounded at 1,024, least
-recently said first out), and at most 2 a second in all (burst 8) across every `from`, past which
-replies are dropped, never queued (security review D, pacer-starve).
-
-**Receiver.**
-- If it is the client for that peer (the smaller nodeId, §5.2.2), and the peer is present on the
-  relay, it starts a new handshake. It **keeps** the session it has until the new one confirms
-  and supersedes it, so a restart produces no `peer-left`.
-- The server ignores it: the client will re-handshake.
-- 1011 never tears a session down. At most it prompts a new handshake.
-
-**A replayed frame.** An authentic sealed frame whose sequence the receiver has already passed (a
-relay repeating what it carried) is discarded and counted (`replay`); the session is unharmed. A
-gap still closes the session (a lost frame cannot heal).
-
-**1009 is not retried.** A node refused with 1009 does not re-handshake over the relay and is not
-re-dialled over the LAN (discovery's 15 s re-offer included) until it restarts.
-
-**Probe.** A node that sees a repeated announcement (`relay-peer-joined`, `relay-peers`) for a
-peer it holds a live relay session with does not re-handshake. It sends a `ping` on that session,
-at most once a second. A live peer answers `pong`; a restarted one answers 1011.
+## 4. Errors and the relay handshake: MMP 2.0 update 1, §5.2.2 and §7.2
+
+sym follows §5.2.2 and §7.2 as the update states them: every error on a confirmed session is sealed;
+a clear error changes nothing, except that 1011 `UNKNOWN_SESSION` may prompt a new handshake; a
+sealed error whose action is Close ends the session (1001, 1003 to 1010: 1009 `IDENTITY_CONFLICT`
+and 1010 `SESSION_CLOSED` among them); a replay is discarded on every transport; a gap closes the
+session with a sealed 1010. What sym chooses:
+
+- **1011 replies.** At most once a second per relay `from` (the table of froms bounded at 1,024,
+  least recently said first out), and at most 2 a second in all (burst 8), dropped past it, never
+  queued. `detail` is `session:<32 hex>` when the triggering frame named a session, absent for a
+  `ping`.
+- **Acting on 1011.** Only the client-role side, only while the peer is present on the relay, only
+  when `detail` names a session it holds with that peer or a probe ping to it is outstanding, only
+  while no newer session with it is waiting to supersede, and no faster than 1 s doubling to 30 s
+  (starting over after a quiet minute). It keeps the session it has until the new one supersedes it.
+- **Probe.** A repeated announcement (`relay-peer-joined`, `relay-peers`) for a peer with a live
+  relay session sends a `ping` on it, at most once a second; a pong (clear or sealed) ends the probe.
+  ping and pong may travel sealed; a sealed ping is answered with a pong.
+- **The server supersedes when it admits the new session** (in a gated room, after `room-join`).
+- **A failed handshake sends nothing.** 1009 is found only after both proofs validate, so it is sent
+  sealed on the session, and a node refused with 1009 does not re-handshake over the relay or
+  re-dial over the LAN (discovery's 15 s re-offer included) until it restarts.
+- **`sendError`** sends only 1002 and 2xxx; the protocol's own codes are the node's to send.
+
+## 4a. Records, fetch and the mood frame: MMP 2.0 update 1, §8.8, §7.1, §9.3
+
+- **The projection.** sym holds and serves the canonical signed projection (§8.8.5 step 1) and passes
+  record-projection-v2 byte for byte: NFC refused, never normalised, on receipt (minted NFC), parents
+  sorted bytewise, an empty lineage and an absent application null. The 256-character caps count
+  code points. A room is a §5.8 identifier everywhere.
+- **The size measure.** `MAX_RECORD_BYTES` is the RFC 8785 length of the two-section record
+  (record-size-v2), never a node's annotations beside it.
+- **Fetch.** `cmb-fetch` is `{ type, reqId, key, timestamp? }` and names one key;
+  `cmb-fetch-result` is `{ type, reqId, returned, missing }`; both are refused when they carry any
+  other member. A fetched record is verified by the whole of §8.8.5 before `fetchCMB()` attributes
+  it; otherwise only its categories are handed back (`verified: false`), for §15.8 lineage use.
+- **mood.** `{ type, mood, context, timestamp }`, attributed to the session's proven nodeId and name;
+  1,024 and 4,096 characters at most; refused when it carries `from`, `fromName` or anything else.
+
+## 4b. Discovery and the relay client: MMP 2.0 update 1, §5.1, §4.4
+
+- Every node, the daemon included, advertises `_sym._tcp` with TXT `room` and `mmp=2.0`, and dials
+  only advertisements whose TXT room is its own and whose `mmp` list contains 2.0. TXT keys are read
+  case-insensitively, the first occurrence winning. The daemon also browses `_<room>._tcp` where
+  that is a valid RFC 6335 name (the §5.1 migration browse), and never advertises it.
+- The relay client reconnects with backoff after every close but 4004 and 4006 (4005, 4008, 1001,
+  1009, 1011, 1013, and 4007); forgets a relay's `features` with its socket; and sends relay-auth's
+  nodeId lowercase, with `room` (when not default) and `engine`. It paces at 20 frames a second,
+  burst 200: the update's floors (§19.1, `RELAY_MIN_RATE` and `RELAY_MIN_BURST`) are those same
+  numbers, and relay-auth and relay-pong are sent outside the bucket, so there is no headroom
+  (a verification note on #43 asks for floors of 25/300; open).
 
 ---
 
diff --git a/docs/reference.md b/docs/reference.md
index e326163c..87d7e0bb 100644
--- a/docs/reference.md
+++ b/docs/reference.md
@@ -235,11 +235,11 @@ Every participant is a full node — cryptographic identity, a per-field relevan
 
 ## Rooms — your "room chat"
 
-A mesh holds many rooms. The default mesh (`_sym._tcp`) is the public square; a **named room is a separate room** — only nodes in the same room discover each other and exchange CMBs. The CLI, the Claude MCP node, and sym-swift share one naming convention, so they all meet in the same room.
+A mesh holds many rooms. The default room is the public square; a **named room is a separate room** — only nodes in the same room exchange CMBs. Every node advertises on `_sym._tcp` with its room in the TXT `room` key and dials only advertisements in its own room (MMP §5.1); the handshake, which binds the room, is what admits. A room name is `[a-z0-9._-]`, 1 to 64 characters (MMP §5.8), for example `acme-office` or `acme.prod`; `sym` is refused.
 
 ```bash
 sym start --room acme-office   # join a room at launch
-sym join acme-office            # switch into one (kebab-case, or "default")
+sym join acme-office            # switch into one ([a-z0-9._-], or "default")
 sym rooms                      # list rooms live on your LAN
 sym room                       # show your current room
 sym leave                       # back to the default mesh
diff --git a/tests/fixtures/SOURCES.json b/tests/fixtures/SOURCES.json
index 6ba86624..4e1426e2 100644
--- a/tests/fixtures/SOURCES.json
+++ b/tests/fixtures/SOURCES.json
@@ -70,6 +70,10 @@
       "from": "scripts/mmp/lib.mjs (repository root)",
       "sha256": "990c963ac556180ebee37e7f54915801f475bf92810d46c9afdc7da4c973aece",
       "note": "the reference construction (scripts/mmp/lib.mjs at 2660ab9); not a published artifact, so not in the manifest"
+    },
+    "application.schema.json": {
+      "from": "schema/application.schema.json",
+      "sha256": "b52d2a385cb7eb382a960dbdb4003f859edeb185c7d1ebd719dfe2eb71f8690e"
     }
   }
 }
diff --git a/tests/fixtures/application.schema.json b/tests/fixtures/application.schema.json
new file mode 100644
index 00000000..52ba5f62
--- /dev/null
+++ b/tests/fixtures/application.schema.json
@@ -0,0 +1,35 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://meshcognition.org/spec/mmp/schema/application.schema.json",
+  "title": "MMP v2.0 authenticated application bytes",
+  "type": "object",
+  "required": ["mediaType", "schema", "encoding", "byteLength", "digest", "data"],
+  "additionalProperties": false,
+  "properties": {
+    "mediaType": {
+      "type": "string",
+      "pattern": "^[a-z0-9][a-z0-9!#$&^_.+\\/-]*$",
+      "description": "Canonical lowercase media type without parameters."
+    },
+    "schema": {
+      "type": "string",
+      "description": "Absolute schema URI or the empty string; NFC-normalized in the commitment."
+    },
+    "encoding": { "const": "base64url" },
+    "byteLength": {
+      "type": "integer",
+      "minimum": 0,
+      "maximum": 524288,
+      "description": "Decoded byte count."
+    },
+    "digest": {
+      "type": "string",
+      "pattern": "^sha256-[0-9a-f]{64}$"
+    },
+    "data": {
+      "type": "string",
+      "pattern": "^[A-Za-z0-9_-]*$",
+      "description": "Unpadded canonical base64url."
+    }
+  }
+}

From ee475b8b04964540628df3a4ae31924748a17517 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 8 Oct 2026 12:33:39 +0100
Subject: [PATCH 134/148] sym-attest-v1: chained checkpoints; witnesses sign
 fromSeq; equivocation by range or prev (D1, #27); re-vendor 5417176
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

MMP 2.0 update 1 at 5417176 (PR #43 with its verification fixes; the chained checkpoint pending one
reviewer check):

- A checkpoint covers the attester's attestations since its previous one, seq fromSeq..uptoSeq,
  chained to that checkpoint's root (`genesis` for the first):
  root = SHA-256("mmp-attest-chain-v1\n" || lp(prev) || lp(fromSeq) || lp(uptoSeq) ||
  lp(segment root)); it signs fromSeq and prev. So this node holds only its last segment. A node
  that lost its segment (or, with no checkpoint held, seq 1) signs nothing over fewer: its chain ends,
  visibly (`checkpoint-chain-ended`), and no further checkpoint is signed under it. The segment and
  the checkpoint are appended to the logs before anything that depends on them is gossiped.
- A witness carries and signs fromSeq (after lp(NFC(room))). A witness naming another range or root
  than the checkpoint held at its position is refused and said (`disagrees`), never taken as the
  attester's equivocation: it is only the witness's word, and would let any witness frame an honest
  attester.
- Two checkpoints from one attester that are not the same checkpoint conflict when their ranges
  overlap or they name the same prev (the rule catches a fork cut at other boundaries). Duplicates are
  judged by content (range, prev, root). The link checks run before any signature: a reversed range,
  prev not genesis exactly at fromSeq 1, or a checkpoint that does not start right after the one its
  prev names, is malformed, never evidence. After a conflict this node never witnesses that attester
  again and drops its further checkpoints unverified (`attester-equivocated`), which bounds the
  evidence to one copy. The stale drop stays "older than every position held".
- The wire forms are the schema's closed objects (node-stats included); time and position are safe
  integers. Logs written before the update hold unchained checkpoints; they are read and kept as
  before, one per position, and reconcileChain checks either form.
- cmb-encrypted is bounded as encrypted-cmb-frame.schema.json now bounds it (sequence of at most 29
  digits, sealed 22 to 983,062 characters, a 32-hex sessionId).
- The relay pacer sends relay-auth and relay-pong ahead of every other frame but inside the bucket
  (the update's floors are 25/300; sym stays at 20/200): they went out at once whatever the bucket
  held.

Re-vendored from 5417176 with the manifest digests in SOURCES.json: sym-attest-v1.json (new),
record-projection-v2 (six new cases: an application-bearing record, 256 against 257 astral
characters, an NFD application.schema, a non-§5.8 room, an uppercase to), record-size-v2 (a new CJK
case), control-encrypted-v2, the cmb, encrypted-cmb-frame, control-frame, control-encrypted,
room-join, relay-frame and sym-attest-frame schemas, the registry, and lib.mjs. sym passes every case,
and lib.mjs's sym-attest constructions, conflict and link rules agree with sym's on all of them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QRVMpaJkAA2fFbvuHCEzqH
---
 lib/attestation-store.js                      |  64 +-
 lib/core/attestation.js                       | 111 ++-
 lib/core/cmb-encrypted-frame.js               |  14 +-
 lib/node.js                                   | 114 ++-
 lib/relay.js                                  |  47 +-
 tests/admission-attestation.test.js           |  12 +-
 tests/checkpoint-rate.test.js                 |   6 +-
 tests/core-secure-rereview.test.js            |   4 +-
 tests/ed25519-strict.test.js                  |   4 +-
 tests/fixtures/SOURCES.json                   |  34 +-
 tests/fixtures/cmb.schema.json                |   2 +-
 tests/fixtures/control-encrypted-v2.json      |   1 +
 tests/fixtures/control-encrypted.schema.json  |   2 +-
 tests/fixtures/control-frame.schema.json      |   6 +-
 .../fixtures/encrypted-cmb-frame.schema.json  |  14 +-
 tests/fixtures/frame-registry.json            |   2 +-
 tests/fixtures/mmp-lib.mjs                    |  86 +++
 tests/fixtures/record-projection-v2.json      | 713 +++++++++++++++++-
 tests/fixtures/record-size-v2.json            |  34 +-
 tests/fixtures/relay-frame.schema.json        |   6 +-
 tests/fixtures/room-join.schema.json          |   4 +-
 tests/fixtures/sym-attest-frame.schema.json   |   7 +-
 tests/fixtures/sym-attest-v1.json             | 707 +++++++++++++++++
 tests/gossip-budget.test.js                   |  29 +-
 tests/gossip-lanes.test.js                    |  12 +-
 tests/relay-state.test.js                     |  15 +
 tests/spec-update-attest-chain.test.js        | 208 +++++
 tests/spec-update-attest.test.js              |  10 +-
 tests/spec-update-records.test.js             |   6 +-
 tests/sym-attest-v1.test.js                   |  22 +-
 30 files changed, 2123 insertions(+), 173 deletions(-)
 create mode 100644 tests/fixtures/sym-attest-v1.json
 create mode 100644 tests/spec-update-attest-chain.test.js

diff --git a/lib/attestation-store.js b/lib/attestation-store.js
index c0be986b..f7f94a56 100644
--- a/lib/attestation-store.js
+++ b/lib/attestation-store.js
@@ -91,6 +91,12 @@ const WRITE_CHUNK = 1 << 20;
 
 /** A checkpoint position: a non-negative integer, never its text spelling. */
 const isPosition = (n) => Number.isSafeInteger(n) && n >= 0;
+const { checkpointConflict, checkpointLinkValid } = require('./core/attestation');
+/** A checkpoint of the chained construction (sym-attest-v1 §5.2, MMP 2.0 update 1): it names its range
+ *  and the root it follows. One without `from_seq` is from a log written before the update. */
+const isChained = (cp) => !!cp && cp.from_seq !== undefined;
+/** The same checkpoint: the same range, prev and root (§6 step 4, duplicates by content). */
+const sameCheckpoint = (a, b) => a.from_seq === b.from_seq && a.upto_seq === b.upto_seq && a.prev === b.prev && a.root === b.root;
 
 /** The key a witness is held or waits under: (attester, position, witness), unambiguous for any ids. */
 const witnessKey = (attester, upto_seq, by) => JSON.stringify([attester, upto_seq, by]);
@@ -381,7 +387,29 @@ class AttestationStore {
     if (!cp || !cp.by || !isPosition(cp.upto_seq) || !cp.root || !cp.sig) return { stored: false, reason: 'malformed' };
     let m = this._checkpoints.get(cp.by);
     const existing = m && m.get(cp.upto_seq);
-    if (existing) {
+    if (isChained(cp)) {
+      // sym-attest-v1 §5.2 as MMP 2.0 update 1 revises it: chained checkpoints (fromSeq, prev).
+      if (!(isPosition(cp.from_seq) && cp.from_seq >= 1 && cp.upto_seq >= cp.from_seq && typeof cp.prev === 'string')) return { stored: false, reason: 'malformed' };
+      if (!this.linkValid(cp)) return { stored: false, reason: 'malformed-link' };
+      if (existing && sameCheckpoint(existing, cp)) return { stored: false, reason: 'duplicate' };
+      const ev = this._conflicted.get(cp.by);
+      if (ev && [...ev.values()].some((c) => sameCheckpoint(c, cp))) return { stored: false, reason: 'duplicate' };
+      // After a conflict this attester's further checkpoints are dropped (which bounds the evidence).
+      if (ev) return { stored: false, reason: 'attester-equivocated' };
+      // Two checkpoints from one attester whose ranges overlap, or that name the same prev, prove two
+      // histories, whatever boundaries each was cut at. The first held stays; this one is the evidence.
+      if (m) {
+        for (const held of m.values()) {
+          if (!isChained(held)) continue;
+          const because = checkpointConflict(held, cp);
+          if (because.length === 0) continue;
+          const first = this._markConflict(cp.by, cp.upto_seq, cp);
+          if (first) { this._keep(CP_FILE, cp); this._maybeRotate(CP_FILE); }
+          return { stored: false, reason: 'conflict', keptRoot: held.root, kept: held, because, first };
+        }
+      }
+    } else if (existing) {
+      // An unchained checkpoint (a log written before update 1): one per position, as it was.
       if (existing.root === cp.root) return { stored: false, reason: 'duplicate' };
       const first = this._markConflict(cp.by, cp.upto_seq, cp);
       if (first) { this._keep(CP_FILE, cp); this._maybeRotate(CP_FILE); }
@@ -430,6 +458,7 @@ class AttestationStore {
    */
   recordWitness(w) {
     if (!w || !w.attester || !isPosition(w.upto_seq) || !w.root || !w.by || !w.sig) return { stored: false, reason: 'malformed' };
+    if (w.from_seq !== undefined && !(isPosition(w.from_seq) && w.from_seq >= 1 && w.upto_seq >= w.from_seq)) return { stored: false, reason: 'malformed' };
     // This node's own witness is remembered before anything else is decided, so one that waits or
     // is refused still counts as signed (witness once, across restarts).
     const own = !!this._selfId && w.by === this._selfId;
@@ -440,7 +469,15 @@ class AttestationStore {
       if (existing.root === w.root) return { stored: false, reason: 'duplicate' };
       return { stored: false, reason: 'conflict', keptRoot: existing.root, first: this._noteWitnessConflict(w) };
     }
-    if (!this.checkpointAt(w.attester, w.upto_seq)) {
+    // A witness carries its checkpoint's range (update 1): one that names another range or root for a
+    // held checkpoint is about a checkpoint this node does not hold. It is the witness's word only, so
+    // it is refused and said (`disagrees`), never taken as the attester's equivocation: a witness could
+    // otherwise frame an honest attester.
+    const cpHeld = this.checkpointAt(w.attester, w.upto_seq);
+    if (cpHeld && isChained(cpHeld) && w.from_seq !== undefined && (cpHeld.from_seq !== w.from_seq || cpHeld.root !== w.root)) {
+      return { stored: false, reason: 'disagrees', keptRoot: cpHeld.root, first: this._noteWitnessConflict(w) };
+    }
+    if (!cpHeld) {
       const k = witnessKey(w.attester, w.upto_seq, w.by);
       const p = this._pending.get(k);
       if (p) {
@@ -559,6 +596,29 @@ class AttestationStore {
   /** Whether a second, different root was refused for (by, upto_seq). */
   hasConflict(by, upto_seq) { return !!this._conflicted.get(by)?.has(upto_seq); }
 
+  /** Whether this node holds evidence that `by` signed two histories (sym-attest-v1 §5.2): it then
+   *  witnesses none of its checkpoints and drops its further ones unverified. */
+  attesterEquivocated(by) { return this._conflicted.has(by); }
+
+  /** The link checks of a chained checkpoint (§5.2) against what is held: not reversed, prev genesis
+   *  exactly when fromSeq is 1, and when the checkpoint its prev names is held, starting right after
+   *  it. A failure is malformed, never evidence. */
+  linkValid(cp) {
+    if (!isChained(cp)) return true;
+    const m = this._checkpoints.get(cp.by);
+    let prevCp = null;
+    if (m && cp.prev !== 'genesis') for (const h of m.values()) if (isChained(h) && h.root === cp.prev) { prevCp = h; break; }
+    return checkpointLinkValid(cp, prevCp);
+  }
+
+  /** The newest chained checkpoint an attester has committed, or null. */
+  latestChainedCheckpoint(by) {
+    const m = this._checkpoints.get(by);
+    let best = null;
+    if (m) for (const h of m.values()) if (isChained(h) && (!best || h.upto_seq > best.upto_seq)) best = h;
+    return best;
+  }
+
   /** The refused copy with the other root for a held (by, upto_seq), or null. */
   conflictAt(by, upto_seq) { return this._conflicted.get(by)?.get(upto_seq) || null; }
 
diff --git a/lib/core/attestation.js b/lib/core/attestation.js
index 42cd5365..bee3d17b 100644
--- a/lib/core/attestation.js
+++ b/lib/core/attestation.js
@@ -68,6 +68,7 @@ const DOMAIN = Object.freeze({
   witness: 'mmp-attest-witness-v1\n',
   leaf: 'mmp-attest-leaf-v1\n',
   node: 'mmp-attest-node-v1\n',
+  chain: 'mmp-attest-chain-v1\n',
 });
 
 /** Canonical decimal ASCII for a non-negative safe integer (MMP §8.8.4); anything else throws. */
@@ -79,6 +80,7 @@ const text = (v) => (typeof v === 'string' ? v : '');
 const nfc = (v) => text(v).normalize('NFC');
 const roomOf = (o) => (typeof o.room === 'string' ? o.room : o.roster);
 const positionOf = (o) => (o.uptoSeq !== undefined ? o.uptoSeq : o.upto_seq);
+const fromOf = (o) => (o.fromSeq !== undefined ? o.fromSeq : o.from_seq);
 
 /**
  * The per-category verdicts as signed: the seven values in CAT7 order (kept for callers that show
@@ -164,11 +166,11 @@ function chainLink(sigB64url) {
 }
 
 /**
- * The checkpoint root (sym-attest-v1 §5.2): a promote-odd Merkle root over the attestations'
- * signature bytes, with separate leaf and node domain tags; an unpaired last node is carried up
- * unchanged, never paired with itself.
+ * The segment root (sym-attest-v1 §5.2): a promote-odd Merkle root over the signature bytes of the
+ * attestations seq fromSeq..uptoSeq, in order, with separate leaf and node domain tags; an unpaired
+ * last node is carried up unchanged, never paired with itself.
  *   leaf(i) = SHA-256("mmp-attest-leaf-v1\n" || sigBytes(i)),  node(l, r) = SHA-256("mmp-attest-node-v1\n" || l || r)
- * @param {string[]} sigs - base64url signatures, seq 1..uptoSeq in order
+ * @param {string[]} sigs - base64url signatures, in seq order (at least one)
  * @returns {string} lowercase hex
  */
 function attestMerkleRoot(sigs) {
@@ -176,7 +178,7 @@ function attestMerkleRoot(sigs) {
   const leafTag = Buffer.from(DOMAIN.leaf, 'utf8');
   const nodeTag = Buffer.from(DOMAIN.node, 'utf8');
   let level = (sigs || []).map((s) => H(leafTag, Buffer.from(String(s), 'base64url')));
-  if (level.length === 0) return H(leafTag).toString('hex');
+  if (level.length === 0) throw new Error('sym-attest: a segment holds at least one attestation');
   while (level.length > 1) {
     const next = [];
     for (let i = 0; i < level.length; i += 2) next.push(i + 1 < level.length ? H(nodeTag, level[i], level[i + 1]) : level[i]);
@@ -185,22 +187,70 @@ function attestMerkleRoot(sigs) {
   return level[0].toString('hex');
 }
 
+/**
+ * The chained checkpoint root (sym-attest-v1 §5.2, MMP 2.0 update 1): it commits to the previous
+ * checkpoint's root and the segment since it, so it commits to the whole history from seq 1 while the
+ * attester holds only its last segment.
+ *   root = lowercaseHex(SHA-256(UTF8("mmp-attest-chain-v1\n") || lp(prev) || lp(decimal(fromSeq)) ||
+ *                               lp(decimal(uptoSeq)) || lp(lowercaseHex(segment))))
+ * `prev` is `genesis` for an attester's first checkpoint (fromSeq 1).
+ */
+function attestCheckpointRoot({ prev, fromSeq, uptoSeq, segmentRoot }) {
+  return crypto.createHash('sha256').update(Buffer.concat([
+    Buffer.from(DOMAIN.chain, 'utf8'),
+    lp(text(prev)), lp(decimal(fromSeq)), lp(decimal(uptoSeq)), lp(text(segmentRoot)),
+  ])).digest('hex');
+}
+
+/**
+ * Whether two checkpoints from one attester prove that it signed two histories (sym-attest-v1 §5.2):
+ * not the same checkpoint (fromSeq, uptoSeq, prev and root), and their ranges overlap or they name the
+ * same prev. One chain does neither: its ranges are consecutive and each prev has one successor.
+ * @returns {string[]} the reasons ('overlapping ranges', 'same prev'); empty when they can lie on one chain
+ */
+function checkpointConflict(a, b) {
+  if (!a || !b || a.by !== b.by) return [];
+  const [af, au, bf, bu] = [fromOf(a), positionOf(a), fromOf(b), positionOf(b)];
+  if (af === bf && au === bu && a.prev === b.prev && a.root === b.root) return [];
+  const reasons = [];
+  if (af <= bu && bf <= au) reasons.push('overlapping ranges');
+  if (a.prev === b.prev) reasons.push('same prev');
+  return reasons;
+}
+
+/**
+ * The link checks (sym-attest-v1 §5.2): the range is not reversed, prev is genesis exactly when
+ * fromSeq is 1, and when the checkpoint named by prev is held the new one starts right after it. A
+ * checkpoint that fails is malformed, never evidence.
+ * @param {object} cp
+ * @param {object|null} [prevCheckpoint] - the held checkpoint whose root is cp.prev, if any
+ */
+function checkpointLinkValid(cp, prevCheckpoint = null) {
+  const f = fromOf(cp); const u = positionOf(cp);
+  if (!Number.isSafeInteger(f) || !Number.isSafeInteger(u) || u < f || f < 1) return false;
+  if ((f === 1) !== (cp.prev === 'genesis')) return false;
+  if (prevCheckpoint && prevCheckpoint.root === cp.prev && f !== positionOf(prevCheckpoint) + 1) return false;
+  return true;
+}
+
 // ── Checkpoints + witnesses (omission-evidence) ─────────────────────────────────────
 
 /**
  * The signed bytes of a checkpoint (sym-attest-v1 §5.2):
- *   UTF8("mmp-attest-checkpoint-v1\n") || lp(by) || lp(NFC(room)) || lp(decimal(uptoSeq)) || lp(root) || lp(decimal(at))
+ *   UTF8("mmp-attest-checkpoint-v1\n") || lp(by) || lp(NFC(room)) || lp(decimal(fromSeq)) ||
+ *   lp(decimal(uptoSeq)) || lp(prev) || lp(root) || lp(decimal(at))
  */
 function checkpointPayload(cp) {
   return Buffer.concat([
     Buffer.from(DOMAIN.checkpoint, 'utf8'),
-    lp(text(cp.by)), lp(nfc(roomOf(cp))), lp(decimal(positionOf(cp))), lp(text(cp.root)), lp(decimal(cp.at)),
+    lp(text(cp.by)), lp(nfc(roomOf(cp))), lp(decimal(fromOf(cp))), lp(decimal(positionOf(cp))),
+    lp(text(cp.prev)), lp(text(cp.root)), lp(decimal(cp.at)),
   ]);
 }
 
 /** Sign a checkpoint in place with the attester's raw Ed25519 private key (base64url). */
 function signCheckpoint(cp, privateKeyB64url) {
-  if (!cp || !cp.by || positionOf(cp) === undefined || !cp.root) throw new Error('signCheckpoint requires by + uptoSeq + root');
+  if (!cp || !cp.by || fromOf(cp) === undefined || positionOf(cp) === undefined || !cp.prev || !cp.root) throw new Error('signCheckpoint requires by + fromSeq + uptoSeq + prev + root');
   cp.sig = sign(checkpointPayload(cp), privateKeyB64url);
   cp.sigAlg = 'ed25519';
   return cp;
@@ -208,25 +258,26 @@ function signCheckpoint(cp, privateKeyB64url) {
 
 /** Verify a checkpoint's signature against the attester's raw Ed25519 public key. */
 function verifyCheckpoint(cp, attesterPublicKeyB64url) {
-  return verify(checkpointPayload, cp, attesterPublicKeyB64url);
+  try { return verify(checkpointPayload, cp, attesterPublicKeyB64url); } catch (e) { return { signed: !!(cp && cp.sig), valid: false, error: e.message }; }
 }
 
 /**
- * The signed bytes of a witness (sym-attest-v1 §5.3):
- *   UTF8("mmp-attest-witness-v1\n") || lp(attester) || lp(NFC(room)) || lp(decimal(uptoSeq)) ||
- *   lp(root) || lp(by) || lp(role) || lp(decimal(at))
+ * The signed bytes of a witness (sym-attest-v1 §5.3): it carries the witnessed checkpoint's range,
+ * so witnesses alone can show a fork:
+ *   UTF8("mmp-attest-witness-v1\n") || lp(attester) || lp(NFC(room)) || lp(decimal(fromSeq)) ||
+ *   lp(decimal(uptoSeq)) || lp(root) || lp(by) || lp(role) || lp(decimal(at))
  */
 function witnessPayload(w) {
   return Buffer.concat([
     Buffer.from(DOMAIN.witness, 'utf8'),
-    lp(text(w.attester)), lp(nfc(roomOf(w))), lp(decimal(positionOf(w))), lp(text(w.root)),
+    lp(text(w.attester)), lp(nfc(roomOf(w))), lp(decimal(fromOf(w))), lp(decimal(positionOf(w))), lp(text(w.root)),
     lp(text(w.by)), lp(text(w.role)), lp(decimal(w.at)),
   ]);
 }
 
 /** Sign a witness countersignature in place with the witness's raw Ed25519 private key. */
 function signWitness(w, privateKeyB64url) {
-  if (!w || !w.attester || !w.by || positionOf(w) === undefined || !w.root) throw new Error('signWitness requires attester + by + uptoSeq + root');
+  if (!w || !w.attester || !w.by || fromOf(w) === undefined || positionOf(w) === undefined || !w.root) throw new Error('signWitness requires attester + by + fromSeq + uptoSeq + root');
   w.sig = sign(witnessPayload(w), privateKeyB64url);
   w.sigAlg = 'ed25519';
   return w;
@@ -234,7 +285,7 @@ function signWitness(w, privateKeyB64url) {
 
 /** Verify a witness countersignature against the WITNESS's raw Ed25519 public key. */
 function verifyWitness(w, witnessPublicKeyB64url) {
-  return verify(witnessPayload, w, witnessPublicKeyB64url);
+  try { return verify(witnessPayload, w, witnessPublicKeyB64url); } catch (e) { return { signed: !!(w && w.sig), valid: false, error: e.message }; }
 }
 
 // ── The wire form (sym-attest-v1 §5) ─────────────────────────────────────────────────
@@ -252,6 +303,7 @@ const SIG_RE = /^[A-Za-z0-9_-]{86}$/;
 const isId = (v) => typeof v === 'string' && ID_RE.test(v);
 // A room is a §5.8 identifier (sym-attest-frame.schema.json `room`, MMP 2.0 update 1).
 const { isRoomId: isRoom } = require('./room-id');
+// time and position at most 2^53 − 1 (sym-attest-frame.schema.json): every parser reads the signed integer.
 const isTime = (v) => Number.isSafeInteger(v) && v >= 0;
 const isPos = (v) => Number.isSafeInteger(v) && v >= 1;
 
@@ -286,30 +338,42 @@ function fromWireAttestation(w) {
   return { of: w.of, assertionId: w.assertionId, by: w.by, at: w.at, roster: w.room, method: w.method, verdict: w.verdict, categories, role: w.role, seq: w.seq, prev: w.prev, sigAlg: w.sigAlg, sig: w.sig };
 }
 
+const CHECKPOINT_MEMBERS = new Set(['by', 'room', 'fromSeq', 'uptoSeq', 'prev', 'root', 'at', 'sigAlg', 'sig']);
+const WITNESS_MEMBERS = new Set(['attester', 'room', 'fromSeq', 'uptoSeq', 'root', 'by', 'role', 'at', 'sigAlg', 'sig']);
+const isLink = (v) => v === 'genesis' || (typeof v === 'string' && HEX64.test(v));
+
 function toWireCheckpoint(cp) {
-  return { by: cp.by, room: roomOf(cp), uptoSeq: positionOf(cp), root: cp.root, at: cp.at, sigAlg: cp.sigAlg, sig: cp.sig };
+  return { by: cp.by, room: roomOf(cp), fromSeq: fromOf(cp), uptoSeq: positionOf(cp), prev: cp.prev, root: cp.root, at: cp.at, sigAlg: cp.sigAlg, sig: cp.sig };
 }
+/** A `sym-attest-checkpoint` frame's checkpoint, checked against the schema (closed; prev genesis
+ *  exactly when fromSeq is 1; uptoSeq not below fromSeq), as the store holds it — or null. */
 function fromWireCheckpoint(w) {
   if (!w || typeof w !== 'object' || Array.isArray(w)) return null;
-  if (!isId(w.by) || !isRoom(w.room) || !isPos(w.uptoSeq) || typeof w.root !== 'string' || !HEX64.test(w.root) || !isTime(w.at)) return null;
+  for (const k of Object.keys(w)) if (!CHECKPOINT_MEMBERS.has(k)) return null;
+  if (!isId(w.by) || !isRoom(w.room) || !isPos(w.fromSeq) || !isPos(w.uptoSeq) || !isLink(w.prev) || typeof w.root !== 'string' || !HEX64.test(w.root) || !isTime(w.at)) return null;
+  if ((w.fromSeq === 1) !== (w.prev === 'genesis')) return null;
   if (w.sigAlg !== 'ed25519' || typeof w.sig !== 'string' || !SIG_RE.test(w.sig)) return null;
-  return { type: 'checkpoint', by: w.by, roster: w.room, upto_seq: w.uptoSeq, root: w.root, at: w.at, sigAlg: w.sigAlg, sig: w.sig };
+  return { type: 'checkpoint', by: w.by, roster: w.room, from_seq: w.fromSeq, upto_seq: w.uptoSeq, prev: w.prev, root: w.root, at: w.at, sigAlg: w.sigAlg, sig: w.sig };
 }
 
 function toWireWitness(x) {
-  return { attester: x.attester, room: roomOf(x), uptoSeq: positionOf(x), root: x.root, by: x.by, role: x.role, at: x.at, sigAlg: x.sigAlg, sig: x.sig };
+  return { attester: x.attester, room: roomOf(x), fromSeq: fromOf(x), uptoSeq: positionOf(x), root: x.root, by: x.by, role: x.role, at: x.at, sigAlg: x.sigAlg, sig: x.sig };
 }
+/** A `sym-attest-witness` frame's witness, checked against the schema (closed), as the store holds it — or null. */
 function fromWireWitness(w) {
   if (!w || typeof w !== 'object' || Array.isArray(w)) return null;
-  if (!isId(w.attester) || !isRoom(w.room) || !isPos(w.uptoSeq) || typeof w.root !== 'string' || !HEX64.test(w.root)) return null;
+  for (const k of Object.keys(w)) if (!WITNESS_MEMBERS.has(k)) return null;
+  if (!isId(w.attester) || !isRoom(w.room) || !isPos(w.fromSeq) || !isPos(w.uptoSeq) || w.uptoSeq < w.fromSeq || typeof w.root !== 'string' || !HEX64.test(w.root)) return null;
   if (!isId(w.by) || typeof w.role !== 'string' || !ROLE_RE.test(w.role) || !isTime(w.at)) return null;
   if (w.sigAlg !== 'ed25519' || typeof w.sig !== 'string' || !SIG_RE.test(w.sig)) return null;
-  return { type: 'witness', attester: w.attester, roster: w.room, upto_seq: w.uptoSeq, root: w.root, by: w.by, role: w.role, at: w.at, sigAlg: w.sigAlg, sig: w.sig };
+  return { type: 'witness', attester: w.attester, roster: w.room, from_seq: w.fromSeq, upto_seq: w.uptoSeq, root: w.root, by: w.by, role: w.role, at: w.at, sigAlg: w.sigAlg, sig: w.sig };
 }
 
-/** `sym-attest-node-stats` (§5.4): unsigned, informational, attributed to the session's peer. */
+/** `sym-attest-node-stats` (§5.4): unsigned, informational, attributed to the session's peer. Closed. */
+const NODE_STATS_MEMBERS = new Set(['emitted', 'admitted', 'memory', 'at']);
 function fromWireNodeStats(w) {
   if (!w || typeof w !== 'object' || Array.isArray(w)) return null;
+  for (const k of Object.keys(w)) if (!NODE_STATS_MEMBERS.has(k)) return null;
   const n = (v) => Number.isSafeInteger(v) && v >= 0;
   if (!n(w.emitted) || !n(w.admitted) || !n(w.memory) || !isTime(w.at)) return null;
   return { emitted: w.emitted, admitted: w.admitted, memory: w.memory, at: w.at };
@@ -329,6 +393,9 @@ module.exports = {
   verifyWitness,
   chainLink,
   attestMerkleRoot,
+  attestCheckpointRoot,
+  checkpointConflict,
+  checkpointLinkValid,
   toWireAttestation, fromWireAttestation,
   toWireCheckpoint, fromWireCheckpoint,
   toWireWitness, fromWireWitness,
diff --git a/lib/core/cmb-encrypted-frame.js b/lib/core/cmb-encrypted-frame.js
index 21470840..b612ccc7 100644
--- a/lib/core/cmb-encrypted-frame.js
+++ b/lib/core/cmb-encrypted-frame.js
@@ -32,6 +32,11 @@ const DIRECTIONS = new Set(['client-to-server', 'server-to-client']);
 const b64urlUnpadded = (buf) => Buffer.from(buf).toString('base64url').replace(/=+$/, '');
 
 /** The 96-bit big-endian nonce for a sequence — the canonical decimal string is the counter. */
+/** A canonical decimal sequence of at most 29 digits (2^96 − 1 has 29); the nonce bounds it exactly. */
+const SEQUENCE = /^(0|[1-9][0-9]{0,28})$/;
+/** The longest sealed value a MAX_RECORD_BYTES plaintext can produce (§8.8.6): 983,062 characters. */
+const { MAX_SEALED_CHARS } = require('./cmb-encoder');
+
 function nonceForSequence(sequence) {
   const n = BigInt(sequence);
   if (n < 0n || n > 0xffffffffffffffffffffffffn) throw new Error('cmb-encrypted: sequence out of 96-bit range');
@@ -79,7 +84,7 @@ function buildEncryptedFrame({ cmb, applicationBytes = null, sessionId, directio
   if (!cmb || !cmb.metadata || !cmb.categories) throw new Error('cmb-encrypted: record must have categories and metadata');
   if (!/^[0-9a-f]{32}$/.test(sessionId || '')) throw new Error('cmb-encrypted: sessionId must be 32 lowercase hex');
   if (!DIRECTIONS.has(direction)) throw new Error('cmb-encrypted: direction must be client-to-server|server-to-client');
-  if (!/^(0|[1-9][0-9]*)$/.test(String(sequence))) throw new Error('cmb-encrypted: sequence must be a canonical decimal string');
+  if (!SEQUENCE.test(String(sequence))) throw new Error('cmb-encrypted: sequence must be a canonical decimal string below 2^96');
 
   const m = cmb.metadata;
   const aad = aeadAADv2({
@@ -113,7 +118,12 @@ function openEncryptedSealed({ frame, trafficKey }) {
   if (frame.protocolVersion !== PROTOCOL_VERSION) throw new Error('cmb-encrypted: unsupported protocolVersion');
   if (frame.suite !== SUITE) throw new Error('cmb-encrypted: unsupported suite');
   if (!DIRECTIONS.has(frame.direction)) throw new Error('cmb-encrypted: bad direction');
-  if (!/^(0|[1-9][0-9]*)$/.test(String(frame.sequence))) throw new Error('cmb-encrypted: bad sequence');
+  // encrypted-cmb-frame.schema.json (MMP 2.0 update 1): a 32-hex sessionId, a sequence of at most 29
+  // digits (the nonce bounds it exactly), a sealed value at least the 16-byte tag and at most what a
+  // MAX_RECORD_BYTES plaintext produces.
+  if (typeof frame.sessionId !== 'string' || !/^[0-9a-f]{32}$/.test(frame.sessionId)) throw new Error('cmb-encrypted: bad sessionId');
+  if (typeof frame.sequence !== 'string' || !SEQUENCE.test(frame.sequence)) throw new Error('cmb-encrypted: bad sequence');
+  if (typeof frame.sealed !== 'string' || frame.sealed.length < 22 || frame.sealed.length > MAX_SEALED_CHARS || !/^[A-Za-z0-9_-]+$/.test(frame.sealed)) throw new Error('cmb-encrypted: bad sealed value');
   const m = frame.metadata;
   if (!m || typeof m !== 'object') throw new Error('cmb-encrypted: missing metadata');
   const aad = aeadAADv2({
diff --git a/lib/node.js b/lib/node.js
index 5da5b0b4..cf1b2001 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -50,7 +50,7 @@ const {
   signCMB, assertionIdV2_0, mintRemixKey, signAttestation, verifyAttestation, verifyAttestationRole,
   merkleRoot, signCheckpoint, verifyCheckpoint, signWitness, verifyWitness,
   CAT7_CATEGORIES, assertRecordSendable,
-  attestMerkleRoot, toWireAttestation, toWireCheckpoint, toWireWitness, ATTEST_FRAME,
+  attestMerkleRoot, attestCheckpointRoot, toWireAttestation, toWireCheckpoint, toWireWitness, ATTEST_FRAME,
 } = require('./core');
 /** What a checkpoint made since 0.14 commits (the sym-attest-v1 root); one without it is 0.13's. */
 const ATTEST_SCHEME = 'sym-attest-v1';
@@ -1296,30 +1296,54 @@ class SymNode extends EventEmitter {
   }
 
   /**
-   * Build, sign, record, and gossip a checkpoint: a Merkle root over this node's
-   * own attestation chain (the ordered signatures, seq 1..N). Roster peers witness
-   * it; thereafter dropping any attestation ≤ N diverges from the committed root.
-   * @returns {object|null} the checkpoint, or null on failure.
+   * Build, sign, record, and gossip a checkpoint (sym-attest-v1 §5.2, MMP 2.0 update 1): the chained
+   * root over this node's attestations since its last checkpoint, seq fromSeq..uptoSeq, chained to that
+   * checkpoint's root (`genesis` for the first). So it commits to the whole history from seq 1 while
+   * this node holds only the segment since its last checkpoint. Roster peers witness it.
+   *
+   * The segment and the previous checkpoint are persisted before anything that depends on them is sent
+   * (the store appends each attestation and checkpoint to its log before it is gossiped). A node that
+   * has lost them (a lost log, a store that evicted its own segment) signs no checkpoint over fewer: its
+   * checkpoint chain ends there, visibly (said once, `checkpoint-chain-ended`), and no further one is
+   * signed under it. No root is ever signed over the attestations it happens to still hold.
+   * @returns {object|null} the checkpoint, or null when none is signed.
    * @private
    */
   _emitCheckpoint() {
     const chain = this._attestations.chainOf(this.nodeId);
     if (chain.length === 0) return null;
-    // A root commits to seq 1..uptoSeq (sym-attest-v1 §5.2). Once the store has evicted any of this
-    // node's own attestations it holds a suffix, and a root over a suffix labelled uptoSeq is a false
-    // statement every peer would find inconsistent: none is signed. (MMP 2.0 update 1 chains each
-    // checkpoint to the previous root, so a bounded state suffices; sym adopts it when #27 lands.)
-    if (chain[0].seq !== 1 || chain[chain.length - 1].seq !== chain.length) {
-      if (!this._checkpointSuffixSaid) { this._checkpointSuffixSaid = true; this._log('Checkpoints paused: this node\'s own attestation chain is no longer held from its first entry (a root over a suffix is never signed)'); }
+    const head = chain[chain.length - 1].seq;
+    const last = this._attestations.latestChainedCheckpoint(this.nodeId);
+    const fromSeq = last ? last.upto_seq + 1 : 1;
+    const prev = last ? last.root : 'genesis';
+    if (head < fromSeq) return null; // nothing new since the last checkpoint
+    const bySeq = new Map(chain.map((a) => [a.seq, a]));
+    const segment = [];
+    for (let s = fromSeq; s <= head; s++) {
+      const a = bySeq.get(s);
+      if (!a) { segment.length = 0; break; }
+      segment.push(a);
+    }
+    // The previous checkpoint is the chain's own; with none held, the chain starts at seq 1 or not at all.
+    if (segment.length === 0 || (!last && chain[0].seq !== 1)) {
+      if (!this._checkpointChainEnded) {
+        this._checkpointChainEnded = true;
+        this._log(`Checkpoint chain ended: this node no longer holds its attestations ${fromSeq}..${head}${last ? ` after its checkpoint at ${last.upto_seq}` : ' from seq 1'} (sym-attest-v1 §5.2: no root is signed over fewer)`);
+        this.emit('metric', { type: 'checkpoint-chain-ended', fromSeq, uptoSeq: head });
+      }
       return null;
     }
+    if (this._checkpointChainEnded) return null;
+    const segmentRoot = attestMerkleRoot(segment.map((a) => a.sig)); // promote-odd, leaf/node tags
     const cp = {
       type: 'checkpoint',
       scheme: ATTEST_SCHEME,
       by: this.nodeId,
       roster: this._room,
-      upto_seq: chain[chain.length - 1].seq,
-      root: attestMerkleRoot(chain.map(a => a.sig)), // promote-odd, leaf/node tags (sym-attest-v1 §5.2)
+      from_seq: fromSeq,
+      upto_seq: head,
+      prev,
+      root: attestCheckpointRoot({ prev, fromSeq, uptoSeq: head, segmentRoot }),
       at: Date.now(),
     };
     try {
@@ -1341,7 +1365,7 @@ class SymNode extends EventEmitter {
    * @private
    */
   _ingestCheckpoint(cp, fromPeerId, session = null) {
-    if (!cp || !cp.by || cp.upto_seq === undefined || !cp.root || !sigOk(cp.sig)) return { ok: false, reason: 'malformed' };
+    if (!cp || !cp.by || cp.upto_seq === undefined || cp.from_seq === undefined || !cp.prev || !cp.root || !sigOk(cp.sig)) return { ok: false, reason: 'malformed' };
     if (cp.roster && this._room && nfcRoom(cp.roster) !== this._room) return { ok: false, reason: 'roster-mismatch' };
     // A position is an integer; the signature covers its text, so a re-spelled one is refused here,
     // before any signature check. A copy of a held checkpoint (same position, same root), of a
@@ -1349,15 +1373,17 @@ class SymNode extends EventEmitter {
     // under the witness storm most of a node's thread went to verifying copies it already held.
     // Only a new statement spends the peer's budget, and it does so before its signature is checked.
     // Nothing unverified changes any state.
-    if (!isPosition(cp.upto_seq)) return { ok: false, reason: 'malformed' };
+    if (!isPosition(cp.upto_seq) || !isPosition(cp.from_seq)) return { ok: false, reason: 'malformed' };
     const held = this._attestations.checkpointAt(cp.by, cp.upto_seq);
-    if (held && held.root === cp.root) return { ok: false, reason: 'duplicate' };
-    if (this._attestations.conflictAt(cp.by, cp.upto_seq)?.root === cp.root) return { ok: false, reason: 'duplicate' };
-    // A further root for a position already proven conflicted adds nothing: the evidence is held, and
-    // a conflict is neither stored nor relayed. So it is dropped here, before the budget and the
-    // signature, and one attester's equivocation costs at most one signature check per position it
-    // holds (positions come at its rate, below), not one per root it signs.
-    if (this._attestations.hasConflict(cp.by, cp.upto_seq)) return { ok: false, reason: 'conflict' };
+    const same = (c) => !!c && c.from_seq === cp.from_seq && c.prev === cp.prev && c.root === cp.root;
+    if (same(held)) return { ok: false, reason: 'duplicate' };
+    if (same(this._attestations.conflictAt(cp.by, cp.upto_seq))) return { ok: false, reason: 'duplicate' };
+    // The link checks (§5.2) need no signature: a checkpoint that does not start right after the one
+    // its prev names is malformed, never evidence.
+    if (!this._attestations.linkValid(cp)) return { ok: false, reason: 'malformed-link' };
+    // An attester this node holds equivocation evidence against: its further checkpoints add nothing
+    // and are dropped unverified (§6 step 6), which bounds the evidence to one copy per attester.
+    if (this._attestations.attesterEquivocated(cp.by)) return { ok: false, reason: 'attester-equivocated' };
     if (this._attestations.isStale(cp.by, cp.upto_seq)) return { ok: false, reason: 'stale' };
     if (!isCanonicalSig(cp.sig)) return this._refuseSpelling(fromPeerId, 'checkpoint', cp.by);
     const key = this._identityKey(cp.by);
@@ -1375,9 +1401,11 @@ class SymNode extends EventEmitter {
     if (!held && !this._checkpointRateOk(cp.by, fromPeerId)) return { ok: false, reason: 'over-rate' };
     const r = this._attestations.recordCheckpoint(cp);
     if (r.reason === 'conflict' && r.first) {
-      // Two signed roots for one position: equivocation, or a chain restarted after a lost log.
-      this._log(`[sym-security] conflicting checkpoint from ${String(cp.by).slice(0, 8)} at ${cp.upto_seq}: kept root ${String(r.keptRoot).slice(0, 12)}, refused ${String(cp.root).slice(0, 12)}`);
-      this.emit('metric', { type: 'attestation-conflict', kind: 'checkpoint', attester: cp.by, upto_seq: cp.upto_seq, keptRoot: r.keptRoot, otherRoot: cp.root });
+      // Two checkpoints that cannot lie on one chain (overlapping ranges, or one prev with two children):
+      // equivocation, or a chain restarted after a lost log.
+      const kept = r.kept || held;
+      this._log(`[sym-security] conflicting checkpoint from ${String(cp.by).slice(0, 8)}: ${cp.from_seq}..${cp.upto_seq} against the held ${kept ? `${kept.from_seq}..${kept.upto_seq}` : '?'} (${(r.because || ['same position']).join(', ')}); kept root ${String(r.keptRoot).slice(0, 12)}, refused ${String(cp.root).slice(0, 12)}; this attester is no longer witnessed`);
+      this.emit('metric', { type: 'attestation-conflict', kind: 'checkpoint', attester: cp.by, upto_seq: cp.upto_seq, from_seq: cp.from_seq, because: r.because || null, keptRoot: r.keptRoot, otherRoot: cp.root });
       // The conflicting copy is relayed once, as evidence, so the room learns of the equivocation (#27);
       // a witness this node already signed for the first root stands.
       this._gossipToRoster({ type: ATTEST_FRAME.checkpoint, checkpoint: toWireCheckpoint(cp) }, fromPeerId);
@@ -1667,6 +1695,9 @@ class SymNode extends EventEmitter {
   /** Countersign a checkpoint (witness) and gossip the witness. @private */
   _witnessCheckpoint(cp) {
     if (cp.by === this.nodeId) return; // don't witness your own
+    // Never an attester this node holds equivocation evidence against (sym-attest-v1 §5.2): not the
+    // conflicting copy, not any later checkpoint. A witness signed before the conflict was known stands.
+    if (this._attestations.attesterEquivocated(cp.by)) return;
     // Once per checkpoint, across restarts: a second signing is a second copy of the same
     // statement, and two copies in circulation were relayed back and forth without end.
     if (this._attestations.hasWitnessed(cp.by, cp.upto_seq, this.nodeId)) return;
@@ -1674,6 +1705,7 @@ class SymNode extends EventEmitter {
       type: 'witness',
       attester: cp.by,
       roster: cp.roster,
+      from_seq: cp.from_seq,
       upto_seq: cp.upto_seq,
       root: cp.root,
       by: this.nodeId,
@@ -1696,12 +1728,13 @@ class SymNode extends EventEmitter {
    * @private
    */
   _ingestWitness(w, fromPeerId, session = null) {
-    if (!w || !w.attester || w.upto_seq === undefined || !w.root || !w.by || !sigOk(w.sig)) return { ok: false, reason: 'malformed' };
+    if (!w || !w.attester || w.upto_seq === undefined || w.from_seq === undefined || !w.root || !w.by || !sigOk(w.sig)) return { ok: false, reason: 'malformed' };
     if (w.roster && this._room && nfcRoom(w.roster) !== this._room) return { ok: false, reason: 'roster-mismatch' };
-    if (!isPosition(w.upto_seq)) return { ok: false, reason: 'malformed' };
+    if (!isPosition(w.upto_seq) || !isPosition(w.from_seq)) return { ok: false, reason: 'malformed' };
     // A copy of a witness held or waiting, or of a conflicting one already refused: dropped unverified.
+    // Duplicates by content: the same (attester, fromSeq, uptoSeq, by) with the same root.
     const held = this._attestations.witnessSeen(w.attester, w.upto_seq, w.by);
-    if (held && held.root === w.root) return { ok: false, reason: 'duplicate' };
+    if (held && held.root === w.root && held.from_seq === w.from_seq) return { ok: false, reason: 'duplicate' };
     if (this._attestations.witnessConflictRoot(w.attester, w.upto_seq, w.by) === w.root) return { ok: false, reason: 'duplicate' };
     if (!isCanonicalSig(w.sig)) return this._refuseSpelling(fromPeerId, 'witness', w.by);
     const key = this._identityKey(w.by);
@@ -1714,6 +1747,12 @@ class SymNode extends EventEmitter {
     // only an admitted record, a grant in effect or a pin does; a fresh identity signs statements free).
     const r = this._attestations.recordWitness(w);
     if (r.stored) this._gossipToRoster({ type: ATTEST_FRAME.witness, witness: toWireWitness(w) }, fromPeerId);
+    if (r.reason === 'disagrees' && r.first) {
+      // A witness for another range or root than the checkpoint held at that position: the witness's word
+      // only, so it is said and counted, never taken as the attester's equivocation.
+      this._log(`[sym-security] witness from ${String(w.by).slice(0, 8)} for ${String(w.attester).slice(0, 8)} names ${w.from_seq}..${w.upto_seq} root ${String(w.root).slice(0, 12)}, not the checkpoint held there (root ${String(r.keptRoot).slice(0, 12)})`);
+      this.emit('metric', { type: 'attestation-conflict', kind: 'witness-disagrees', attester: w.attester, upto_seq: w.upto_seq, witness: w.by, keptRoot: r.keptRoot, otherRoot: w.root });
+    }
     if (r.reason === 'conflict' && r.first) {
       this._log(`[sym-security] conflicting witness from ${String(w.by).slice(0, 8)} for ${String(w.attester).slice(0, 8)} at ${w.upto_seq}: kept root ${String(r.keptRoot).slice(0, 12)}, refused ${String(w.root).slice(0, 12)}`);
       this.emit('metric', { type: 'attestation-conflict', kind: 'witness', attester: w.attester, upto_seq: w.upto_seq, witness: w.by, keptRoot: r.keptRoot, otherRoot: w.root });
@@ -1733,19 +1772,28 @@ class SymNode extends EventEmitter {
   reconcileChain(by) {
     const cp = this._attestations.latestCheckpoint(by);
     if (!cp) return { checkpoint: null, consistent: true, complete: true, gaps: [], witnesses: 0, witnessedRoot: null, recomputedRoot: null };
-    const chain = this._attestations.chainOf(by).filter(a => a.seq <= cp.upto_seq);
+    // A chained checkpoint (MMP 2.0 update 1) commits to its segment fromSeq..uptoSeq and the root it
+    // follows, so it is checked against that segment alone; an unchained one (a log from before the
+    // update, or 0.13's) against seq 1..uptoSeq.
+    const chained = cp.from_seq !== undefined;
+    const lo = chained ? cp.from_seq : 1;
+    const chain = this._attestations.chainOf(by).filter(a => a.seq >= lo && a.seq <= cp.upto_seq);
     const present = new Set(chain.map(a => a.seq));
     const gaps = [];
-    for (let s = 1; s <= cp.upto_seq; s++) if (!present.has(s)) gaps.push(s);
-    // A checkpoint made since 0.14 commits the sym-attest-v1 root; one kept from 0.13 the old one.
-    const recomputedRoot = (cp.scheme === ATTEST_SCHEME ? attestMerkleRoot : merkleRoot)(chain.map(a => a.sig));
+    for (let s = lo; s <= cp.upto_seq; s++) if (!present.has(s)) gaps.push(s);
+    let recomputedRoot = null;
+    try {
+      recomputedRoot = chained
+        ? attestCheckpointRoot({ prev: cp.prev, fromSeq: cp.from_seq, uptoSeq: cp.upto_seq, segmentRoot: attestMerkleRoot(chain.map(a => a.sig)) })
+        : (cp.scheme === ATTEST_SCHEME ? attestMerkleRoot : merkleRoot)(chain.map(a => a.sig));
+    } catch { /* no attestation of the segment held */ }
     const consistent = recomputedRoot === cp.root;
     return {
       checkpoint: cp,
       consistent,
       // The attester signed another root for this position too (equivocation, or a chain restarted
       // after a lost log): an inconsistency here is that, not tampering by a third party.
-      conflicted: this._attestations.hasConflict(by, cp.upto_seq),
+      conflicted: this._attestations.hasConflict(by, cp.upto_seq) || this._attestations.attesterEquivocated(by),
       complete: gaps.length === 0,
       gaps,
       witnesses: this._attestations.witnessesFor(by, cp.upto_seq, cp.root).length,
diff --git a/lib/relay.js b/lib/relay.js
index 96a86901..151e1bf3 100644
--- a/lib/relay.js
+++ b/lib/relay.js
@@ -26,9 +26,11 @@ const ENGINE_VERSION = require('../package.json').version;
 
 /**
  * The relay closes a connection that sends more than 25 frames a second sustained (burst 300) with
- * 4008 (sym-relay 0.5: a token bucket per connection, every frame counted). Core Secure seals one
- * frame per peer session, so a room broadcast is N frames: this client paces everything it sends
- * under that limit, with headroom, and queues what does not fit.
+ * 4008 (sym-relay 0.5: a token bucket per connection, every frame counted; MMP 2.0 update 1 makes
+ * 25/300 the floors a relay MUST allow, §19.1). Core Secure seals one frame per peer session, so a
+ * room broadcast is N frames: this client paces everything it sends at 20 a second (burst 200),
+ * relay-auth and relay-pong inside the same bucket, so the headroom holds whatever it sends, and
+ * queues what does not fit.
  */
 const RELAY_RATE_PER_SECOND = 20;
 const RELAY_BURST = 200;
@@ -199,6 +201,7 @@ class RelayConnection {
     this._rate = (opts.rate && opts.rate.perSecond) || RELAY_RATE_PER_SECOND;
     this._burst = (opts.rate && opts.rate.burst) || RELAY_BURST;
     this._bucket = { tokens: this._burst, at: Date.now() };
+    this._control = [];               // the relay's own frames (auth, pong), sent first, inside the bucket
     this._queue = new FairQueue();    // per class, per destination (see FairQueue)
     this._flushTimer = null;
     this._flushScheduled = false;
@@ -477,6 +480,7 @@ class RelayConnection {
       this._present.clear();
       this._fanout = null;
       this._queue.clear();
+      this._control.length = 0;
       if (this._flushTimer) { clearTimeout(this._flushTimer); this._flushTimer = null; }
       try { this._onDisconnected(); } catch (err) { this._log(`Relay disconnect handling failed: ${err && err.message}`); }
 
@@ -666,18 +670,20 @@ class RelayConnection {
     return b;
   }
 
-  /** Send what the bucket allows: fan-out envelopes when advertised, else one frame per payload. */
+  /** Send what the bucket allows: the relay's own frames first, then fan-out envelopes when
+   *  advertised, else one frame per payload. */
   _flush() {
     const ws = this._relayWs;
     if (!ws || ws.readyState !== 1) return;
+    while (this._control.length) {
+      const b = this._refill();
+      if (b.tokens < 1) { this._waitForToken(b); return; }
+      b.tokens -= 1;
+      try { ws.send(this._control.shift()); } catch (err) { this._log(`Relay send failed: ${err && err.message}`); }
+    }
     while (this._queue.length) {
       const b = this._refill();
-      if (b.tokens < 1) {
-        const wait = Math.ceil(((1 - b.tokens) * 1000) / this._rate);
-        this._flushTimer = setTimeout(() => { this._flushTimer = null; this._flush(); }, Math.max(wait, 5));
-        if (this._flushTimer.unref) this._flushTimer.unref();
-        return;
-      }
+      if (b.tokens < 1) { this._waitForToken(b); return; }
       let data;
       if (this._fanout && this._queue.length > 1) {
         // Frames in the queue's own order (class, then destinations in turn), up to FANOUT_MAX and the
@@ -703,10 +709,24 @@ class RelayConnection {
     }
   }
 
-  /** A frame of the relay protocol itself (auth, pong): sent at once, counted against the bucket. */
+  /** @private Flush again once the bucket holds a token. */
+  _waitForToken(b) {
+    if (this._flushTimer) return;
+    const wait = Math.ceil(((1 - b.tokens) * 1000) / this._rate);
+    this._flushTimer = setTimeout(() => { this._flushTimer = null; this._flush(); }, Math.max(wait, 5));
+    if (this._flushTimer.unref) this._flushTimer.unref();
+  }
+
+  /**
+   * A frame of the relay protocol itself (auth, pong): ahead of every other frame, but inside the
+   * bucket (MMP 2.0 update 1, §19.1's headroom sentence): sent at once while the bucket holds a token,
+   * and otherwise as soon as it does. It went out at once whatever the bucket held, so a full flush and
+   * a pong were 201 frames in a second against a floor of 200.
+   */
   _sendControl(ws, frame) {
-    this._refill().tokens -= 1;
-    ws.send(JSON.stringify(frame));
+    if (ws !== this._relayWs) return;
+    this._control.push(JSON.stringify(frame));
+    this._flush();
   }
 
   /**
@@ -737,6 +757,7 @@ class RelayConnection {
 
     this._present.clear();
     this._queue.clear();
+    this._control.length = 0;
     if (this._flushTimer) { clearTimeout(this._flushTimer); this._flushTimer = null; }
 
     if (this._relayWs) {
diff --git a/tests/admission-attestation.test.js b/tests/admission-attestation.test.js
index c1bcc3e9..e5d21382 100644
--- a/tests/admission-attestation.test.js
+++ b/tests/admission-attestation.test.js
@@ -470,10 +470,10 @@ describe('the witness storm', () => {
       node._roster.bind('node-wit', WIT.pub, 'proven');
       const relayed = [];
       node._gossipToRoster = (frame) => relayed.push(frame.type);
-      const cp = signed({ type: 'checkpoint', by: 'node-att', roster: 'g', upto_seq: 8, root: 'r8', at: 1 }, ATT.priv, signCheckpoint);
+      const cp = signed({ type: 'checkpoint', by: 'node-att', roster: 'g', from_seq: 8, upto_seq: 8, prev: (8) === 1 ? 'genesis' : `p${8}`, root: 'r8', at: 1 }, ATT.priv, signCheckpoint);
       assert.strictEqual(node._ingestCheckpoint(cp, 'node-att').ok, true);
       assert.deepStrictEqual(relayed, ['sym-attest-checkpoint', 'sym-attest-witness'], 'relayed once and witnessed once');
-      const copy = (at) => signed({ type: 'witness', attester: 'node-att', roster: 'g', upto_seq: 8, root: 'r8', by: 'node-wit', role: 'participant', at }, WIT.priv, signWitness);
+      const copy = (at) => signed({ type: 'witness', attester: 'node-att', roster: 'g', from_seq: 8, upto_seq: 8, root: 'r8', by: 'node-wit', role: 'participant', at }, WIT.priv, signWitness);
       assert.strictEqual(node._ingestWitness(copy(1), 'node-wit').ok, true);
       assert.strictEqual(node._ingestWitness(copy(2), 'node-wit').ok, false, 'a second signing of the same witness is not new');
       assert.strictEqual(node._ingestWitness(copy(1), 'node-wit').ok, false, 'nor is the first one, again');
@@ -489,14 +489,14 @@ describe('the witness storm', () => {
       node._roster.bind('node-att', ATT.pub, 'proven');
       node._roster.bind('node-wit', WIT.pub, 'proven');
       node._gossipToRoster = () => {};
-      const cp = signed({ type: 'checkpoint', by: 'node-att', roster: 'g', upto_seq: 8, root: 'r8', at: 1 }, ATT.priv, signCheckpoint);
+      const cp = signed({ type: 'checkpoint', by: 'node-att', roster: 'g', from_seq: 8, upto_seq: 8, prev: (8) === 1 ? 'genesis' : `p${8}`, root: 'r8', at: 1 }, ATT.priv, signCheckpoint);
       node._ingestCheckpoint(cp, 'node-att');
       assert.strictEqual(node._ingestCheckpoint({ ...cp, sig: 'not-a-signature' }, 'node-att').reason, 'duplicate', 'not even verified');
       const forgedSig = crypto.randomBytes(64).toString('base64url');
       assert.strictEqual(node._ingestCheckpoint({ ...cp, root: 'forged', sig: forgedSig }, 'node-att').reason, 'bad-signature', 'a different root is verified first');
       assert.strictEqual(node._ingestCheckpoint({ ...cp, root: 'forged', sig: 'garbage' }, 'node-att').reason, 'non-canonical-signature', 'one not spelled as a signature is not even verified');
       assert.strictEqual(node._attestations.hasConflict('node-att', 8), false, 'and an unverified one marks nothing');
-      const w = signed({ type: 'witness', attester: 'node-att', roster: 'g', upto_seq: 8, root: 'r8', by: 'node-wit', role: 'participant', at: 1 }, WIT.priv, signWitness);
+      const w = signed({ type: 'witness', attester: 'node-att', roster: 'g', from_seq: 8, upto_seq: 8, root: 'r8', by: 'node-wit', role: 'participant', at: 1 }, WIT.priv, signWitness);
       node._ingestWitness(w, 'node-wit');
       assert.strictEqual(node._ingestWitness({ ...w, sig: 'garbage' }, 'node-wit').reason, 'duplicate');
     });
@@ -510,7 +510,7 @@ describe('the witness storm', () => {
       node._gossipToRoster = (f) => relayed.push(f.type);
       const metrics = [];
       node.on('metric', (m) => metrics.push(m));
-      const cp = (root, at) => signed({ type: 'checkpoint', by: 'node-att', roster: 'g', upto_seq: 8, root, at }, ATT.priv, signCheckpoint);
+      const cp = (root, at) => signed({ type: 'checkpoint', by: 'node-att', roster: 'g', from_seq: 8, upto_seq: 8, prev: (8) === 1 ? 'genesis' : `p${8}`, root, at }, ATT.priv, signCheckpoint);
       node._ingestCheckpoint(cp('r8', 1), 'peer-x');
       const n = relayed.length;
       assert.strictEqual(node._ingestCheckpoint(cp('r-after-reset', 2), 'peer-x').reason, 'conflict');
@@ -529,7 +529,7 @@ describe('the witness storm', () => {
     withNode('att-text-seq', { lifecycleRole: 'participant', room: 'g' }, (node) => {
       node._roster.bind('node-att', ATT.pub, 'proven');
       node._gossipToRoster = () => {};
-      const cp = signed({ type: 'checkpoint', by: 'node-att', roster: 'g', upto_seq: 8, root: 'r8', at: 1 }, ATT.priv, signCheckpoint);
+      const cp = signed({ type: 'checkpoint', by: 'node-att', roster: 'g', from_seq: 8, upto_seq: 8, prev: (8) === 1 ? 'genesis' : `p${8}`, root: 'r8', at: 1 }, ATT.priv, signCheckpoint);
       node._ingestCheckpoint(cp, 'node-att');
       assert.strictEqual(node._ingestCheckpoint({ ...cp, upto_seq: '8' }, 'node-att').reason, 'malformed', 'refused before any signature check');
       assert.deepStrictEqual(node._attestations.checkpointsOf('node-att').map((c) => c.upto_seq), [8]);
diff --git a/tests/checkpoint-rate.test.js b/tests/checkpoint-rate.test.js
index 2247a4f2..0690801c 100644
--- a/tests/checkpoint-rate.test.js
+++ b/tests/checkpoint-rate.test.js
@@ -44,7 +44,7 @@ function withNode(n, fn) {
   } finally { fs.rmSync(nodeDir(name), { recursive: true, force: true }); }
 }
 
-const checkpoint = (k, upto_seq, at = upto_seq) => signed({ type: 'checkpoint', by: k.id, roster: ROOM, upto_seq, root: `root-${k.id}-${upto_seq}`, at }, k.priv);
+const checkpoint = (k, upto_seq, at = upto_seq) => signed({ type: 'checkpoint', by: k.id, roster: ROOM, from_seq: upto_seq, upto_seq, prev: upto_seq === 1 ? 'genesis' : `p${upto_seq}`, root: `root-${k.id}-${upto_seq}`, at }, k.priv);
 function signed(fields, priv) { const o = { ...fields }; signCheckpoint(o, priv); return o; }
 const witnessesBy = (sent, node, attester) => sent.filter((f) => f.type === 'sym-attest-witness' && f.witness.by === node.nodeId && f.witness.attester === attester);
 const relayed = (sent, attester) => sent.filter((f) => f.type === 'sym-attest-checkpoint' && f.checkpoint.by === attester);
@@ -82,7 +82,7 @@ describe('checkpoint rate — one attester', () => {
       assert.strictEqual(witnessesBy(sent, node, A.id).length, outcome.taken);
       // A second root for a position it holds is still recorded as a conflict: that spends nothing.
       const heldPos = node._attestations.latestCheckpoint(A.id).upto_seq;
-      const fork = signed({ type: 'checkpoint', by: A.id, roster: ROOM, upto_seq: heldPos, root: 'forked', at: 1 }, A.priv);
+      const fork = signed({ type: 'checkpoint', by: A.id, roster: ROOM, from_seq: heldPos, upto_seq: heldPos, prev: (heldPos) === 1 ? 'genesis' : `p${heldPos}`, root: 'forked', at: 1 }, A.priv);
       assert.strictEqual(node._ingestCheckpoint(fork, 'peer-0').reason, 'conflict');
       assert.strictEqual(node._attestations.hasConflict(A.id, heldPos), true);
     });
@@ -123,7 +123,7 @@ describe('checkpoint rate — one attester', () => {
       for (let i = 0; i < 2000; i++) {
         clock.t = t0 + Math.floor(i / 2);
         pos += 8;
-        const forged = { type: 'checkpoint', by: H.id, roster: ROOM, upto_seq: pos, root: 'x', at: 1, sig: crypto.randomBytes(64).toString('base64url') };
+        const forged = { type: 'checkpoint', by: H.id, roster: ROOM, from_seq: pos, upto_seq: pos, prev: (pos) === 1 ? 'genesis' : `p${pos}`, root: 'x', at: 1, sig: crypto.randomBytes(64).toString('base64url') };
         assert.strictEqual(node._ingestCheckpoint(forged, 'mallory').reason, 'bad-signature');
       }
       // Its own checkpoints, a burst of them, are all still taken.
diff --git a/tests/core-secure-rereview.test.js b/tests/core-secure-rereview.test.js
index f2088c33..6a4a6ea7 100644
--- a/tests/core-secure-rereview.test.js
+++ b/tests/core-secure-rereview.test.js
@@ -57,8 +57,8 @@ describe('N1: the forgery penalty is charged only to a session that signed in it
       deliver(b, sA, { type: 'cmb', cmb: signedRecord(X, { categories: { focus: 'X said this' }, room: b._room }) });
       // 2. X's genuine attestation, checkpoint and witness, relayed by A.
       b._ingestAttestation(signedAs({ of: `cmb-${hex()}`, by: X.nodeId, at: Date.now(), roster: b._room, verdict: 'aligned', categories: CATS7, seq: 1, prev: 'genesis' }, X.privateKey, signAttestation), A.nodeId, A.name, sA);
-      b._ingestCheckpoint(signedAs({ by: X.nodeId, upto_seq: 1, root: hex(), at: Date.now(), roster: b._room }, X.privateKey, signCheckpoint), A.nodeId, sA);
-      b._ingestWitness(signedAs({ attester: A.nodeId, upto_seq: 1, root: hex(), by: X.nodeId, role: 'participant', at: Date.now(), roster: b._room }, X.privateKey, signWitness), A.nodeId, sA);
+      b._ingestCheckpoint(signedAs({ by: X.nodeId, from_seq: 1, upto_seq: 1, prev: (1) === 1 ? 'genesis' : `p${1}`, root: hex(), at: Date.now(), roster: b._room }, X.privateKey, signCheckpoint), A.nodeId, sA);
+      b._ingestWitness(signedAs({ attester: A.nodeId, from_seq: 1, upto_seq: 1, root: hex(), by: X.nodeId, role: 'participant', at: Date.now(), roster: b._room }, X.privateKey, signWitness), A.nodeId, sA);
 
       assert.strictEqual(sA.closed, false, 'the honest relayer\'s session is not closed');
       assert.strictEqual(b._penalised(A.nodeId), false, 'and the relayer is not refused');
diff --git a/tests/ed25519-strict.test.js b/tests/ed25519-strict.test.js
index 47210f02..cd2195e9 100644
--- a/tests/ed25519-strict.test.js
+++ b/tests/ed25519-strict.test.js
@@ -106,11 +106,11 @@ describe('§18.3.2 at every verification site in sym', () => {
       return { bytes: () => core.attestationPayload(att), set: (sig) => { att.sig = sig; }, ok: () => core.verifyAttestation(att, id.publicKey).valid };
     },
     'checkpoints (verifyCheckpoint)': () => {
-      const cp = core.signCheckpoint({ by: id.nodeId, roster: 'default', uptoSeq: 3, root: 'r'.repeat(64), at: 1 }, id.privateKey);
+      const cp = core.signCheckpoint({ by: id.nodeId, roster: 'default', fromSeq: 1, uptoSeq: 3, prev: 'genesis', root: 'r'.repeat(64), at: 1 }, id.privateKey);
       return { bytes: () => core.checkpointPayload(cp), set: (sig) => { cp.sig = sig; }, ok: () => core.verifyCheckpoint(cp, id.publicKey).valid };
     },
     'witnesses (verifyWitness)': () => {
-      const w = core.signWitness({ attester: id.nodeId, by: id.nodeId, roster: 'default', uptoSeq: 3, root: 'r'.repeat(64), role: 'participant', at: 1 }, id.privateKey);
+      const w = core.signWitness({ attester: id.nodeId, by: id.nodeId, roster: 'default', fromSeq: 1, uptoSeq: 3, root: 'r'.repeat(64), role: 'participant', at: 1 }, id.privateKey);
       return { bytes: () => core.witnessPayload(w), set: (sig) => { w.sig = sig; }, ok: () => core.verifyWitness(w, id.publicKey).valid };
     },
     'room-join grants (verifyRoomGrant)': () => {
diff --git a/tests/fixtures/SOURCES.json b/tests/fixtures/SOURCES.json
index 4e1426e2..327191df 100644
--- a/tests/fixtures/SOURCES.json
+++ b/tests/fixtures/SOURCES.json
@@ -1,6 +1,6 @@
 {
-  "note": "MMP v2.0 conformance artifacts vendored for sym's tests, copied unchanged. Every file comes from sym-bot/meshcognition-website branch spec/mmp-2.0-update-1 at 2660ab9 (MMP 2.0 update 1: #24, #25, #17, #22, #26, #30, #23, #31, #37, #34, #35, #27, #28 folded, with the §6.6 errata 1 and 2 beneath them), not yet merged to main. authority-v2.json, authority-frame.schema.json and ed25519-strict-v2.json are unchanged since df79e04. The sha256 values equal 2660ab9's public/spec/mmp/artifact-manifest.json; the tests that read a file check its digest first.",
-  "source": "https://github.com/sym-bot/meshcognition-website/tree/2660ab9/public/spec/mmp",
+  "note": "MMP v2.0 conformance artifacts vendored for sym's tests, copied unchanged. Every file comes from sym-bot/meshcognition-website PR #43, branch spec/mmp-2.0-update-1 at 5417176 (MMP 2.0 update 1, with its verification fixes: the corrected chained checkpoint and the sym-attest-v1 draft vector among them), not yet merged to main. authority-v2.json, authority-frame.schema.json and ed25519-strict-v2.json are unchanged since df79e04. The sha256 values equal 5417176's public/spec/mmp/artifact-manifest.json; mmp-lib.mjs is scripts/mmp/lib.mjs at 5417176, the reference construction, which the manifest does not list. The tests that read a file check its digest first.",
+  "source": "https://github.com/sym-bot/meshcognition-website/tree/5417176/public/spec/mmp",
   "files": {
     "authority-v2.json": {
       "from": "conformance/v2/authority-v2.json",
@@ -16,27 +16,27 @@
     },
     "record-projection-v2.json": {
       "from": "conformance/v2/record-projection-v2.json",
-      "sha256": "f2ad4134c4002f6178a3a82e0d1d67abacb5359f32a727dfe952172db088df72"
+      "sha256": "6317f856b9016f8811c0dce8235643802732a34c13b74f5790173170abf89dbe"
     },
     "record-size-v2.json": {
       "from": "conformance/v2/record-size-v2.json",
-      "sha256": "c02e489a4fd0d157d3cabf79010d9b06b1e9da09ebae7bbad01c2ff7eff5aa32"
+      "sha256": "62d70f45a132043a3af2e506b158537d65bba68d4d9ee95aa406f1a4518b3e97"
     },
     "control-encrypted-v2.json": {
       "from": "conformance/v2/control-encrypted-v2.json",
-      "sha256": "56937695ac2247fe798ac4a8b63ed515c5c3491743472b3565009814b4f55941"
+      "sha256": "d000f007256731518c083fc6ba7f5e0159197c1b7c461a2aa41239b9ec9ae4ee"
     },
     "cmb.schema.json": {
       "from": "schema/cmb.schema.json",
-      "sha256": "3e1a6558807e01bb52fe435e84a1535ce4754947fc2da6be1fc38244627bc71d"
+      "sha256": "a720fafd3f1a2b126048e26625743f804f91c00bff8d199ea9927dd6e104f60e"
     },
     "control-frame.schema.json": {
       "from": "schema/control-frame.schema.json",
-      "sha256": "8693e622601cc2220e497bbdf7f8a02be527151640e9343c0bdf0293f66c6ce4"
+      "sha256": "f49c1026bcf3658341830ea5b96a82a1f3b6d06bde91aa770589a9255b15f93a"
     },
     "control-encrypted.schema.json": {
       "from": "schema/control-encrypted.schema.json",
-      "sha256": "f3831faf86b7f9ca25abb7687e0f938de3413b828908c9fdfad51e439adc8db5"
+      "sha256": "9fc38674114184faea12ad9f68777b1928ce3c9f0a87d6a8306cb48698ff1efe"
     },
     "cmb-fetch.schema.json": {
       "from": "schema/cmb-fetch.schema.json",
@@ -48,32 +48,36 @@
     },
     "room-join.schema.json": {
       "from": "schema/room-join.schema.json",
-      "sha256": "ccc0a3366a652d7c2447fc2ca54fe5666ccfa810d0e2dd38a689e5a1ff388601"
+      "sha256": "a7406ea81f82a9b83002f03426b2dc6b0bfaf6e41812a96f4ad061cecc0401e1"
     },
     "relay-frame.schema.json": {
       "from": "schema/relay-frame.schema.json",
-      "sha256": "2718c16b7356eeb5ced4825c78b8cc7d0cdf78e694d60192a6b0f7ed2c035aa4"
+      "sha256": "510bc531d5add6375f5e1f55c75a465c56d43e0df9ea88153218ecebc2ca9518"
     },
     "sym-attest-frame.schema.json": {
       "from": "schema/sym-attest-frame.schema.json",
-      "sha256": "2586e9db797da404130af9501f4e8a33131d931d1f2824284b7db2fb5481a98e"
+      "sha256": "7dd316be779e2384541968dd98d0153394b5ff7425f7fa30be21d5ba7a14fbd6"
     },
     "encrypted-cmb-frame.schema.json": {
       "from": "schema/encrypted-cmb-frame.schema.json",
-      "sha256": "c786d74a0b3557b26fcd7424f5f71f0201167999f9738288ed6dbb7d45e58b39"
+      "sha256": "0f30df5fe8faf133770856cebaf9fb288ccc84b909730409513d26f56c7d42a4"
     },
     "frame-registry.json": {
       "from": "frame-registry.json",
-      "sha256": "400de6fc26b7261cd068ec1cba380b602ccfc12987cad4eb447e77d82a42b2aa"
+      "sha256": "c0da960294bf4ed23a26d7281b6f88c9bcf7e2cdd5ffa7158ca6be6e63604474"
     },
     "mmp-lib.mjs": {
       "from": "scripts/mmp/lib.mjs (repository root)",
-      "sha256": "990c963ac556180ebee37e7f54915801f475bf92810d46c9afdc7da4c973aece",
-      "note": "the reference construction (scripts/mmp/lib.mjs at 2660ab9); not a published artifact, so not in the manifest"
+      "sha256": "020d09dfbfb2ec1b0446c065a9dd3824692216bd6be75b9721a7a3cd5b6ba148",
+      "note": "the reference construction (scripts/mmp/lib.mjs at 5417176); not a published artifact, so not in the manifest"
     },
     "application.schema.json": {
       "from": "schema/application.schema.json",
       "sha256": "b52d2a385cb7eb382a960dbdb4003f859edeb185c7d1ebd719dfe2eb71f8690e"
+    },
+    "sym-attest-v1.json": {
+      "from": "conformance/v2/sym-attest-v1.json",
+      "sha256": "934db3407e951377a4e08e2d32b23ef3a66d4220d313bb0cf1d4552bf5e6226d"
     }
   }
 }
diff --git a/tests/fixtures/cmb.schema.json b/tests/fixtures/cmb.schema.json
index 104dadd5..32ed304f 100644
--- a/tests/fixtures/cmb.schema.json
+++ b/tests/fixtures/cmb.schema.json
@@ -43,7 +43,7 @@
           "description": "Signed display label, NFC (§8.8.5). Never used for identity resolution or routing."
         },
         "createdTimestamp": { "type": "integer", "minimum": 0 },
-        "room": { "type": "string", "minLength": 1, "maxLength": 256, "description": "Signed room identifier, NFC (§8.8.5)." },
+        "room": { "type": "string", "pattern": "^[a-z0-9._-]{1,64}$", "description": "Signed room identifier, a §5.8 identifier (and so NFC, §8.8.5)." },
         "to": {
           "description": "The record's audience (§9.2.2): null for room-bound, or the recipient's nodeId in its one lowercase spelling.",
           "anyOf": [
diff --git a/tests/fixtures/control-encrypted-v2.json b/tests/fixtures/control-encrypted-v2.json
index 5826eb02..1da02cc2 100644
--- a/tests/fixtures/control-encrypted-v2.json
+++ b/tests/fixtures/control-encrypted-v2.json
@@ -3,6 +3,7 @@
   "suite": "X25519-HKDF-SHA256-ChaCha20-Poly1305",
   "sessionId": "f85383e8ebb887a1fe9578adabae4b5d",
   "keysFrom": "handshake-v2.json expected.clientToServerKeyHex and expected.serverToClientKeyHex",
+  "positions": "These positions continue e2e-v2.json cases on the same session, because cmb-encrypted and control-encrypted share one counter per direction: client-to-server 2 and 3 follow e2e-v2 sequences 0 and 1, and server-to-client 1 to 3 follow its 0. No traffic key seals two frames under one nonce.",
   "aadRule": "UTF8(\"mmp-aead-control-v2\\n\") || lp(\"2.0\") || lp(sessionId) || lp(direction) || lp(sequence); plaintext is the minified JSON of the inner frame",
   "cases": [
     {
diff --git a/tests/fixtures/control-encrypted.schema.json b/tests/fixtures/control-encrypted.schema.json
index 44270b71..c6d3dfb7 100644
--- a/tests/fixtures/control-encrypted.schema.json
+++ b/tests/fixtures/control-encrypted.schema.json
@@ -31,7 +31,7 @@
     "sequence": {
       "type": "string",
       "pattern": "^(0|[1-9][0-9]{0,28})$",
-      "description": "Unsigned decimal, less than 2^96 (the AEAD nonce is the sequence in 96 bits)."
+      "description": "Unsigned decimal, at most 79228162514264337593543950335 (2^96 − 1), since the AEAD nonce is the sequence in 96 bits. The 29-digit pattern is necessary, not sufficient."
     },
     "direction": {
       "enum": [
diff --git a/tests/fixtures/control-frame.schema.json b/tests/fixtures/control-frame.schema.json
index 5d90742c..90e10f9e 100644
--- a/tests/fixtures/control-frame.schema.json
+++ b/tests/fixtures/control-frame.schema.json
@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://meshcognition.org/spec/mmp/schema/control-frame.schema.json",
   "title": "MMP v2.0 peer control frames",
-  "description": "On a CONNECTED Core Secure session these frames travel only as the inner frame of a control-encrypted envelope (§7.1, §18.2.1; the envelope is control-encrypted.schema.json), except ping and pong, which may also travel in clear, and error, which is also defined in clear (§7.4). Validating a frame here says nothing about whether it may appear on the wire in clear.",
+  "description": "On a CONNECTED Core Secure session these frames travel only as the inner frame of a control-encrypted envelope (§7.1, §18.2.1; the envelope is control-encrypted.schema.json), except ping and pong, which may also travel in clear, and error, which a receiver may also read in clear, where it changes nothing (§7.1, §7.2). Validating a frame here says nothing about whether it may appear on the wire in clear.",
   "oneOf": [
     { "$ref": "#/$defs/peerInfo" },
     { "$ref": "#/$defs/wakeChannel" },
@@ -27,7 +27,7 @@
     },
     "cmbAnchors": {
       "type": "object",
-      "description": "Sealed control frame (§9.4), the first frame a node sends on a session it admits: the cognition keys of its own records about to be replayed on this session, in send order, or an empty list when none follow.",
+      "description": "Sealed control frame (§9.4), the first sealed frame a node sends on a session after admitting it: the cognition keys of its own records about to be replayed on this session, in send order, or an empty list when none follow.",
       "required": ["type", "keys"],
       "additionalProperties": false,
       "properties": {
@@ -59,7 +59,7 @@
             "required": ["nodeId", "name", "lastSeen"],
             "additionalProperties": false,
             "properties": {
-              "nodeId": { "type": "string", "format": "uuid" },
+              "nodeId": { "type": "string", "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$" },
               "name": { "type": "string", "minLength": 1, "maxLength": 255 },
               "wakeChannel": { "$ref": "#/$defs/wake" },
               "lastSeen": { "type": "integer", "minimum": 0 }
diff --git a/tests/fixtures/encrypted-cmb-frame.schema.json b/tests/fixtures/encrypted-cmb-frame.schema.json
index 12c52366..e1e07841 100644
--- a/tests/fixtures/encrypted-cmb-frame.schema.json
+++ b/tests/fixtures/encrypted-cmb-frame.schema.json
@@ -10,11 +10,11 @@
     "protocolVersion": { "const": "2.0" },
     "suite": { "const": "X25519-HKDF-SHA256-ChaCha20-Poly1305" },
     "sessionId": { "type": "string", "pattern": "^[0-9a-f]{32}$" },
-    "sequence": { "type": "string", "pattern": "^(0|[1-9][0-9]*)$" },
+    "sequence": { "type": "string", "pattern": "^(0|[1-9][0-9]{0,28})$", "description": "Unsigned decimal, at most 79228162514264337593543950335 (2^96 − 1), since the AEAD nonce is the sequence in 96 bits. The 29-digit pattern is necessary, not sufficient." },
     "direction": { "enum": ["client-to-server", "server-to-client"] },
     "metadata": {
       "type": "object",
-      "description": "Clear routing and verification metadata. metadata.application omits data; all members are AEAD-bound and record-signed.",
+      "description": "Clear routing and verification metadata, outside the ciphertext. metadata.application omits data. The AEAD binds key, assertionId, createdByNodeId, room and to (§18.2.1); the record signature binds what mmp-sig-v2.0 covers (§8.8.4); lineage.method is bound by neither, and a Core Secure verifier drops it (§8.8.4).",
       "required": [
         "key", "addressScheme", "assertionId", "signatureSuite",
         "createdByNodeId", "createdBy", "createdTimestamp", "room", "to",
@@ -27,9 +27,9 @@
         "assertionId": { "type": "string", "pattern": "^asrt-[0-9a-f]{64}$" },
         "signatureSuite": { "const": "mmp-sig-v2.0" },
         "createdByNodeId": { "type": "string", "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$" },
-        "createdBy": { "type": "string", "minLength": 1 },
+        "createdBy": { "type": "string", "minLength": 1, "maxLength": 256 },
         "createdTimestamp": { "type": "integer", "minimum": 0 },
-        "room": { "type": "string", "minLength": 1 },
+        "room": { "type": "string", "pattern": "^[a-z0-9._-]{1,64}$" },
         "to": { "anyOf": [{ "type": "string", "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$" }, { "type": "null" }] },
         "lineage": { "anyOf": [{ "$ref": "cmb.schema.json#/$defs/lineage" }, { "type": "null" }] },
         "application": {
@@ -40,7 +40,7 @@
               "additionalProperties": false,
               "properties": {
                 "mediaType": { "type": "string", "minLength": 1 },
-                "schema": { "type": "string", "format": "uri" },
+                "schema": { "type": "string", "description": "Absolute schema URI or the empty string, as in application.schema.json." },
                 "encoding": { "const": "base64url" },
                 "byteLength": { "type": "integer", "minimum": 0 },
                 "digest": { "type": "string", "pattern": "^sha256-[0-9a-f]{64}$" }
@@ -55,8 +55,10 @@
     },
     "sealed": {
       "type": "string",
+      "minLength": 22,
+      "maxLength": 983062,
       "pattern": "^[A-Za-z0-9_-]+$",
-      "description": "Unpadded base64url ciphertext concatenated with the 16-byte Poly1305 tag."
+      "description": "Unpadded base64url ciphertext concatenated with the 16-byte Poly1305 tag: at least the tag, and at most what a MAX_RECORD_BYTES plaintext produces (§8.8.6)."
     }
   }
 }
diff --git a/tests/fixtures/frame-registry.json b/tests/fixtures/frame-registry.json
index 459d610b..09a43955 100644
--- a/tests/fixtures/frame-registry.json
+++ b/tests/fixtures/frame-registry.json
@@ -8,7 +8,7 @@
     { "type": "cmb", "scope": "peer", "layer": "3/4", "gated": "SVAF", "status": "core", "schema": "cmb-frame.schema.json", "fields": "Signed CAT7 record assertion." },
     { "type": "cmb-encrypted", "scope": "peer", "layer": "2/3", "gated": "After decrypt", "status": "core", "schema": "encrypted-cmb-frame.schema.json", "fields": "Directional ChaCha20-Poly1305 envelope with session, sequence, routing metadata and sealed record bytes." },
     { "type": "control-encrypted", "scope": "peer", "layer": "2", "gated": "After decrypt", "status": "core", "schema": "control-encrypted.schema.json", "fields": "Directional ChaCha20-Poly1305 envelope sealing one control frame; shares the session's per-direction sequence with cmb-encrypted." },
-    { "type": "cmb-anchors", "scope": "peer", "layer": "4", "gated": "Sealed only", "status": "core", "schema": "control-frame.schema.json", "fields": "Sent first on every admitted Core Secure session: the cognition keys of the sender's own records about to be replayed as context, or none (§9.4); changes no verification or admission." },
+    { "type": "cmb-anchors", "scope": "peer", "layer": "4", "gated": "Sealed only", "status": "core", "schema": "control-frame.schema.json", "fields": "The first sealed frame a node sends on every Core Secure session it admits: the cognition keys of the sender's own records about to be replayed as context, or none (§9.4); changes no verification or admission." },
     { "type": "cmb-fetch", "scope": "peer", "layer": "3", "gated": "No", "status": "core", "schema": "cmb-fetch.schema.json", "fields": "Request a record by exact content address." },
     { "type": "cmb-fetch-result", "scope": "peer", "layer": "3", "gated": "No", "status": "core", "schema": "cmb-fetch-result.schema.json", "fields": "Correlation id with the keys returned and the keys not found; each returned record travels before it as its own cmb-encrypted frame." },
     { "type": "authority-statement", "scope": "peer", "layer": "3", "gated": "Authority", "status": "core", "schema": "authority-frame.schema.json", "fields": "One signed grant, revoke or endorse statement, identified by the hash of its canonical bytes; it counts only as §6.6 resolution places it." },
diff --git a/tests/fixtures/mmp-lib.mjs b/tests/fixtures/mmp-lib.mjs
index 9397d432..3dd3ebc7 100644
--- a/tests/fixtures/mmp-lib.mjs
+++ b/tests/fixtures/mmp-lib.mjs
@@ -143,6 +143,7 @@ export function recordProjectionV2(record) {
   const isNFC = (v) => typeof v === 'string' && v === v.normalize('NFC');
   for (const name of CAT7) if (!isNFC(record.categories[name].text)) return { ok: false, refusedBy: 'not NFC', member: `categories.${name}.text` };
   for (const member of ['createdBy', 'room']) if (!isNFC(record.metadata[member])) return { ok: false, refusedBy: 'not NFC', member: `metadata.${member}` };
+  if (record.metadata.application != null && !isNFC(record.metadata.application.schema)) return { ok: false, refusedBy: 'not NFC', member: 'metadata.application.schema' };
   const categories = Object.fromEntries(CAT7.map((name) => {
     const c = record.categories[name];
     return [name, { text: c.text, meta: { key: c.meta.key, parents: sortedBytewise(c.meta.parents) } }];
@@ -850,3 +851,88 @@ export function authorityOrder(entries) {
   const rank = (s) => (s.kind === 'grant' ? 1 : 0);
   return [...entries].sort((a, b) => a.depth - b.depth || rank(a.s) - rank(b.s) || Buffer.compare(Buffer.from(a.id), Buffer.from(b.id)));
 }
+
+// sym-attest-v1 (Draft Candidate Extension, /spec/mmp/extensions/sym-attest): the four signed
+// constructions and the chained checkpoint root.
+const ATTEST_DOMAIN = {
+  attestation: 'mmp-attest-v1\n',
+  checkpoint: 'mmp-attest-checkpoint-v1\n',
+  witness: 'mmp-attest-witness-v1\n',
+  leaf: 'mmp-attest-leaf-v1\n',
+  node: 'mmp-attest-node-v1\n',
+  chain: 'mmp-attest-chain-v1\n',
+};
+const nfcText = (v) => String(v).normalize('NFC');
+
+export function attestationPayloadV1(a) {
+  return Buffer.concat([
+    Buffer.from(ATTEST_DOMAIN.attestation, 'utf8'),
+    lp(a.of), lp(a.assertionId), lp(a.by), lp(decimal(a.at)), lp(nfcText(a.room)),
+    lp(a.method), lp(a.verdict),
+    ...CAT7.map((name) => lp(a.categories[name])),
+    lp(a.role), lp(decimal(a.seq)), lp(a.prev),
+  ]);
+}
+
+// prev of the next attestation: the lowercase hex SHA-256 of this one's signature bytes.
+export function attestChainLink(sigBase64url) {
+  return sha256Hex(Buffer.from(sigBase64url, 'base64url'));
+}
+
+// The promote-odd Merkle root over a segment's signature bytes, in seq order.
+export function attestSegmentRoot(sigsBase64url) {
+  if (sigsBase64url.length === 0) throw new Error('a segment holds at least one attestation');
+  let level = sigsBase64url.map((s) => sha256(Buffer.concat([Buffer.from(ATTEST_DOMAIN.leaf, 'utf8'), Buffer.from(s, 'base64url')])));
+  while (level.length > 1) {
+    const next = [];
+    for (let i = 0; i < level.length; i += 2) {
+      next.push(i + 1 < level.length ? sha256(Buffer.concat([Buffer.from(ATTEST_DOMAIN.node, 'utf8'), level[i], level[i + 1]])) : level[i]);
+    }
+    level = next;
+  }
+  return level[0].toString('hex');
+}
+
+export function attestCheckpointRoot({ prev, fromSeq, uptoSeq, segmentRoot }) {
+  return sha256Hex(Buffer.concat([
+    Buffer.from(ATTEST_DOMAIN.chain, 'utf8'),
+    lp(prev), lp(decimal(fromSeq)), lp(decimal(uptoSeq)), lp(segmentRoot),
+  ]));
+}
+
+export function attestCheckpointPayloadV1(cp) {
+  return Buffer.concat([
+    Buffer.from(ATTEST_DOMAIN.checkpoint, 'utf8'),
+    lp(cp.by), lp(nfcText(cp.room)), lp(decimal(cp.fromSeq)), lp(decimal(cp.uptoSeq)),
+    lp(cp.prev), lp(cp.root), lp(decimal(cp.at)),
+  ]);
+}
+
+export function attestWitnessPayloadV1(w) {
+  return Buffer.concat([
+    Buffer.from(ATTEST_DOMAIN.witness, 'utf8'),
+    lp(w.attester), lp(nfcText(w.room)), lp(decimal(w.fromSeq)), lp(decimal(w.uptoSeq)), lp(w.root),
+    lp(w.by), lp(w.role), lp(decimal(w.at)),
+  ]);
+}
+
+// §5.2: the same checkpoint is not a conflict; otherwise overlapping ranges, or one prev with two
+// children, prove two histories. Returns the reasons, empty when the two can lie on one chain.
+export function attestCheckpointConflict(a, b) {
+  if (a.by !== b.by) return [];
+  const same = a.fromSeq === b.fromSeq && a.uptoSeq === b.uptoSeq && a.prev === b.prev && a.root === b.root;
+  if (same) return [];
+  const reasons = [];
+  if (a.fromSeq <= b.uptoSeq && b.fromSeq <= a.uptoSeq) reasons.push('overlapping ranges');
+  if (a.prev === b.prev) reasons.push('same prev');
+  return reasons;
+}
+
+// §5.2 link checks: the range is not reversed, and when the checkpoint named by prev is held, the new
+// one starts right after it. A failure is malformed, not evidence.
+export function attestCheckpointLinkValid(cp, prevCheckpoint = null) {
+  if (cp.uptoSeq < cp.fromSeq) return false;
+  if ((cp.fromSeq === 1) !== (cp.prev === 'genesis')) return false;
+  if (prevCheckpoint && prevCheckpoint.root === cp.prev && cp.fromSeq !== prevCheckpoint.uptoSeq + 1) return false;
+  return true;
+}
diff --git a/tests/fixtures/record-projection-v2.json b/tests/fixtures/record-projection-v2.json
index 441f1149..32b5983a 100644
--- a/tests/fixtures/record-projection-v2.json
+++ b/tests/fixtures/record-projection-v2.json
@@ -6,6 +6,180 @@
     "publicKeyBase64url": "IVL40Zt5HSRFMkLhXy6rbLfP-ntqXtMAl5YOBpiB2xI"
   },
   "cases": [
+    {
+      "label": "a signed record with an application, as published",
+      "record": {
+        "categories": {
+          "focus": {
+            "text": "review the café menu",
+            "meta": {
+              "key": "d2ee95788fc6f697ee3997158c4c189432dc15835aa2efa2c8a57f030f1ceb86",
+              "parents": []
+            }
+          },
+          "issue": {
+            "text": "the public vectors and runtime disagree",
+            "meta": {
+              "key": "8f37da919d4165770650b6508b66af65f0710157209b10724e7cc4aab717da83",
+              "parents": [
+                "cmb-0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a",
+                "cmb-f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0"
+              ]
+            }
+          },
+          "intent": {
+            "text": "make independent implementations interoperate",
+            "meta": {
+              "key": "f47998bfc4aedee3ac20c485f9cd07caacccf622ceced426c02e178741718f67",
+              "parents": []
+            }
+          },
+          "motivation": {
+            "text": "a protocol claim must be executable",
+            "meta": {
+              "key": "9dfa469fab3eeb8c98f79df69c3b2f02f277a017f9cbe3bf0f32ccbf9a4f129d",
+              "parents": []
+            }
+          },
+          "commitment": {
+            "text": "one contract drives every implementation",
+            "meta": {
+              "key": "d3bbf94949feceaea72667efe8c43a4bf3aed557ecc632caf82b7c3f2447e3c8",
+              "parents": []
+            }
+          },
+          "perspective": {
+            "text": "protocol editor",
+            "meta": {
+              "key": "3e48fe2e89a1e02f5c17c08e853bd09d5355d18a491a1bd926568089626ffa35",
+              "parents": []
+            }
+          },
+          "mood": {
+            "text": "calm",
+            "meta": {
+              "key": "d816b3859d6849569138dba79c0f1c82b7ce827a74ae63072d04f6f8a96a0e8f",
+              "parents": []
+            }
+          }
+        },
+        "metadata": {
+          "key": "cmb-15087b3c3a0a6b79971af8f56ebeccafbe4e5f71e4f88bd26c30ba99c7fe341e",
+          "addressScheme": "mmp-cmb-merkle-v2",
+          "signatureSuite": "mmp-sig-v2.0",
+          "createdByNodeId": "018f47a0-7b21-7abc-8def-0123456789ab",
+          "createdBy": "zoë",
+          "createdTimestamp": 1786611600000,
+          "room": "conformance-room",
+          "to": null,
+          "lineage": {
+            "parents": [
+              "cmb-0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a",
+              "cmb-f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0"
+            ],
+            "method": "SVAF-v2"
+          },
+          "application": {
+            "mediaType": "application/json",
+            "schema": "https://meshcognition.org/schema/café-v1.json",
+            "encoding": "base64url",
+            "byteLength": 16,
+            "digest": "sha256-a1aa2c0f4350bff317d862929d35436ff3521e2d11f0c38fa95b3e2563823a32",
+            "data": "eyJtZW51IjoiY2Fmw6kifQ"
+          },
+          "assertionId": "asrt-8c29099c3a16e9c3dec34b73a8b96b7e77366d0ed5bb79e1fc9e1d2481f27cfc",
+          "sigAlg": "ed25519",
+          "sig": "E4Lw9knqeVNuXY1plB9IBe2M_GyaX0nmAcDsH5bG3fqwpUg6zFK_tukUYzfyXB9uClCJfVDtoAgH4gi6lAKBAw"
+        }
+      },
+      "expected": {
+        "accepted": true,
+        "projection": {
+          "categories": {
+            "focus": {
+              "text": "review the café menu",
+              "meta": {
+                "key": "d2ee95788fc6f697ee3997158c4c189432dc15835aa2efa2c8a57f030f1ceb86",
+                "parents": []
+              }
+            },
+            "issue": {
+              "text": "the public vectors and runtime disagree",
+              "meta": {
+                "key": "8f37da919d4165770650b6508b66af65f0710157209b10724e7cc4aab717da83",
+                "parents": [
+                  "cmb-0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a",
+                  "cmb-f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0"
+                ]
+              }
+            },
+            "intent": {
+              "text": "make independent implementations interoperate",
+              "meta": {
+                "key": "f47998bfc4aedee3ac20c485f9cd07caacccf622ceced426c02e178741718f67",
+                "parents": []
+              }
+            },
+            "motivation": {
+              "text": "a protocol claim must be executable",
+              "meta": {
+                "key": "9dfa469fab3eeb8c98f79df69c3b2f02f277a017f9cbe3bf0f32ccbf9a4f129d",
+                "parents": []
+              }
+            },
+            "commitment": {
+              "text": "one contract drives every implementation",
+              "meta": {
+                "key": "d3bbf94949feceaea72667efe8c43a4bf3aed557ecc632caf82b7c3f2447e3c8",
+                "parents": []
+              }
+            },
+            "perspective": {
+              "text": "protocol editor",
+              "meta": {
+                "key": "3e48fe2e89a1e02f5c17c08e853bd09d5355d18a491a1bd926568089626ffa35",
+                "parents": []
+              }
+            },
+            "mood": {
+              "text": "calm",
+              "meta": {
+                "key": "d816b3859d6849569138dba79c0f1c82b7ce827a74ae63072d04f6f8a96a0e8f",
+                "parents": []
+              }
+            }
+          },
+          "metadata": {
+            "key": "cmb-15087b3c3a0a6b79971af8f56ebeccafbe4e5f71e4f88bd26c30ba99c7fe341e",
+            "addressScheme": "mmp-cmb-merkle-v2",
+            "assertionId": "asrt-8c29099c3a16e9c3dec34b73a8b96b7e77366d0ed5bb79e1fc9e1d2481f27cfc",
+            "signatureSuite": "mmp-sig-v2.0",
+            "createdByNodeId": "018f47a0-7b21-7abc-8def-0123456789ab",
+            "createdBy": "zoë",
+            "createdTimestamp": 1786611600000,
+            "room": "conformance-room",
+            "to": null,
+            "lineage": {
+              "parents": [
+                "cmb-0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a",
+                "cmb-f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0"
+              ]
+            },
+            "application": {
+              "mediaType": "application/json",
+              "schema": "https://meshcognition.org/schema/café-v1.json",
+              "encoding": "base64url",
+              "byteLength": 16,
+              "digest": "sha256-a1aa2c0f4350bff317d862929d35436ff3521e2d11f0c38fa95b3e2563823a32",
+              "data": "eyJtZW51IjoiY2Fmw6kifQ"
+            },
+            "sigAlg": "ed25519",
+            "sig": "E4Lw9knqeVNuXY1plB9IBe2M_GyaX0nmAcDsH5bG3fqwpUg6zFK_tukUYzfyXB9uClCJfVDtoAgH4gi6lAKBAw"
+          }
+        },
+        "projectionSha256": "734749af38e445f22caad0d683b699b268e691aa736ee5937d589769e260e2c3"
+      }
+    },
     {
       "label": "valence, arousal and lineage.method are dropped",
       "record": {
@@ -945,13 +1119,13 @@
       }
     },
     {
-      "label": "a rewritten meta.key",
+      "label": "createdBy of 256 astral characters: the cap counts code points, not UTF-16 units",
       "record": {
         "categories": {
           "focus": {
             "text": "review the café menu",
             "meta": {
-              "key": "0000000000000000000000000000000000000000000000000000000000000000",
+              "key": "d2ee95788fc6f697ee3997158c4c189432dc15835aa2efa2c8a57f030f1ceb86",
               "parents": []
             }
           },
@@ -998,9 +1172,7 @@
             "meta": {
               "key": "d816b3859d6849569138dba79c0f1c82b7ce827a74ae63072d04f6f8a96a0e8f",
               "parents": []
-            },
-            "valence": 0.2,
-            "arousal": -0.1
+            }
           }
         },
         "metadata": {
@@ -1008,7 +1180,7 @@
           "addressScheme": "mmp-cmb-merkle-v2",
           "signatureSuite": "mmp-sig-v2.0",
           "createdByNodeId": "018f47a0-7b21-7abc-8def-0123456789ab",
-          "createdBy": "zoë",
+          "createdBy": "𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞",
           "createdTimestamp": 1786611600000,
           "room": "conformance-room",
           "to": null,
@@ -1020,24 +1192,100 @@
             "method": "SVAF-v2"
           },
           "application": null,
-          "assertionId": "asrt-dff1bf3d7fe9a7a446aab9759db2b7ea5fe6e415270b2f62ae0e22ecb456d24b",
+          "assertionId": "asrt-c203ab1b5a4bb6adbc837a39d3d5ef6d5736e56515718f1543826778bee50dc8",
           "sigAlg": "ed25519",
-          "sig": "we3Ny_mwTSVDw4Tqg2qRc0ILxuAcHQK9JOghYZ76QEutab0C-E07IftV0c93W0CJygb9JoJzU7rWHnHWfEP6Bg"
+          "sig": "OkIVJp-M66Ighvh2vIqv3UAEd_G7YBnIy0zZj0Zhlue6S0OXBzMajdG7Cob9YRLzXFeLlYtf-AwLNYUH9ZVrCA"
         }
       },
       "expected": {
-        "accepted": false,
-        "refusedBy": "step 4: meta.key"
+        "accepted": true,
+        "projection": {
+          "categories": {
+            "focus": {
+              "text": "review the café menu",
+              "meta": {
+                "key": "d2ee95788fc6f697ee3997158c4c189432dc15835aa2efa2c8a57f030f1ceb86",
+                "parents": []
+              }
+            },
+            "issue": {
+              "text": "the public vectors and runtime disagree",
+              "meta": {
+                "key": "8f37da919d4165770650b6508b66af65f0710157209b10724e7cc4aab717da83",
+                "parents": [
+                  "cmb-0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a",
+                  "cmb-f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0"
+                ]
+              }
+            },
+            "intent": {
+              "text": "make independent implementations interoperate",
+              "meta": {
+                "key": "f47998bfc4aedee3ac20c485f9cd07caacccf622ceced426c02e178741718f67",
+                "parents": []
+              }
+            },
+            "motivation": {
+              "text": "a protocol claim must be executable",
+              "meta": {
+                "key": "9dfa469fab3eeb8c98f79df69c3b2f02f277a017f9cbe3bf0f32ccbf9a4f129d",
+                "parents": []
+              }
+            },
+            "commitment": {
+              "text": "one contract drives every implementation",
+              "meta": {
+                "key": "d3bbf94949feceaea72667efe8c43a4bf3aed557ecc632caf82b7c3f2447e3c8",
+                "parents": []
+              }
+            },
+            "perspective": {
+              "text": "protocol editor",
+              "meta": {
+                "key": "3e48fe2e89a1e02f5c17c08e853bd09d5355d18a491a1bd926568089626ffa35",
+                "parents": []
+              }
+            },
+            "mood": {
+              "text": "calm",
+              "meta": {
+                "key": "d816b3859d6849569138dba79c0f1c82b7ce827a74ae63072d04f6f8a96a0e8f",
+                "parents": []
+              }
+            }
+          },
+          "metadata": {
+            "key": "cmb-15087b3c3a0a6b79971af8f56ebeccafbe4e5f71e4f88bd26c30ba99c7fe341e",
+            "addressScheme": "mmp-cmb-merkle-v2",
+            "assertionId": "asrt-c203ab1b5a4bb6adbc837a39d3d5ef6d5736e56515718f1543826778bee50dc8",
+            "signatureSuite": "mmp-sig-v2.0",
+            "createdByNodeId": "018f47a0-7b21-7abc-8def-0123456789ab",
+            "createdBy": "𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞",
+            "createdTimestamp": 1786611600000,
+            "room": "conformance-room",
+            "to": null,
+            "lineage": {
+              "parents": [
+                "cmb-0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a",
+                "cmb-f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0"
+              ]
+            },
+            "application": null,
+            "sigAlg": "ed25519",
+            "sig": "OkIVJp-M66Ighvh2vIqv3UAEd_G7YBnIy0zZj0Zhlue6S0OXBzMajdG7Cob9YRLzXFeLlYtf-AwLNYUH9ZVrCA"
+          }
+        },
+        "projectionSha256": "cbcd504cb204f21798ce60570cd1256b8be15ea354d5ad08eaae7aec60540637"
       }
     },
     {
-      "label": "category text in NFD, though it signs the same",
+      "label": "a rewritten meta.key",
       "record": {
         "categories": {
           "focus": {
-            "text": "review the café menu",
+            "text": "review the café menu",
             "meta": {
-              "key": "d2ee95788fc6f697ee3997158c4c189432dc15835aa2efa2c8a57f030f1ceb86",
+              "key": "0000000000000000000000000000000000000000000000000000000000000000",
               "parents": []
             }
           },
@@ -1113,15 +1361,15 @@
       },
       "expected": {
         "accepted": false,
-        "refusedBy": "step 1: not NFC"
+        "refusedBy": "step 4: meta.key"
       }
     },
     {
-      "label": "createdBy in NFD, though it signs the same",
+      "label": "category text in NFD, though it signs the same",
       "record": {
         "categories": {
           "focus": {
-            "text": "review the café menu",
+            "text": "review the café menu",
             "meta": {
               "key": "d2ee95788fc6f697ee3997158c4c189432dc15835aa2efa2c8a57f030f1ceb86",
               "parents": []
@@ -1180,7 +1428,7 @@
           "addressScheme": "mmp-cmb-merkle-v2",
           "signatureSuite": "mmp-sig-v2.0",
           "createdByNodeId": "018f47a0-7b21-7abc-8def-0123456789ab",
-          "createdBy": "zoë",
+          "createdBy": "zoë",
           "createdTimestamp": 1786611600000,
           "room": "conformance-room",
           "to": null,
@@ -1202,6 +1450,437 @@
         "refusedBy": "step 1: not NFC"
       }
     },
+    {
+      "label": "createdBy in NFD, though it signs the same",
+      "record": {
+        "categories": {
+          "focus": {
+            "text": "review the café menu",
+            "meta": {
+              "key": "d2ee95788fc6f697ee3997158c4c189432dc15835aa2efa2c8a57f030f1ceb86",
+              "parents": []
+            }
+          },
+          "issue": {
+            "text": "the public vectors and runtime disagree",
+            "meta": {
+              "key": "8f37da919d4165770650b6508b66af65f0710157209b10724e7cc4aab717da83",
+              "parents": [
+                "cmb-0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a",
+                "cmb-f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0"
+              ]
+            }
+          },
+          "intent": {
+            "text": "make independent implementations interoperate",
+            "meta": {
+              "key": "f47998bfc4aedee3ac20c485f9cd07caacccf622ceced426c02e178741718f67",
+              "parents": []
+            }
+          },
+          "motivation": {
+            "text": "a protocol claim must be executable",
+            "meta": {
+              "key": "9dfa469fab3eeb8c98f79df69c3b2f02f277a017f9cbe3bf0f32ccbf9a4f129d",
+              "parents": []
+            }
+          },
+          "commitment": {
+            "text": "one contract drives every implementation",
+            "meta": {
+              "key": "d3bbf94949feceaea72667efe8c43a4bf3aed557ecc632caf82b7c3f2447e3c8",
+              "parents": []
+            }
+          },
+          "perspective": {
+            "text": "protocol editor",
+            "meta": {
+              "key": "3e48fe2e89a1e02f5c17c08e853bd09d5355d18a491a1bd926568089626ffa35",
+              "parents": []
+            }
+          },
+          "mood": {
+            "text": "calm",
+            "meta": {
+              "key": "d816b3859d6849569138dba79c0f1c82b7ce827a74ae63072d04f6f8a96a0e8f",
+              "parents": []
+            },
+            "valence": 0.2,
+            "arousal": -0.1
+          }
+        },
+        "metadata": {
+          "key": "cmb-15087b3c3a0a6b79971af8f56ebeccafbe4e5f71e4f88bd26c30ba99c7fe341e",
+          "addressScheme": "mmp-cmb-merkle-v2",
+          "signatureSuite": "mmp-sig-v2.0",
+          "createdByNodeId": "018f47a0-7b21-7abc-8def-0123456789ab",
+          "createdBy": "zoë",
+          "createdTimestamp": 1786611600000,
+          "room": "conformance-room",
+          "to": null,
+          "lineage": {
+            "parents": [
+              "cmb-0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a",
+              "cmb-f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0"
+            ],
+            "method": "SVAF-v2"
+          },
+          "application": null,
+          "assertionId": "asrt-dff1bf3d7fe9a7a446aab9759db2b7ea5fe6e415270b2f62ae0e22ecb456d24b",
+          "sigAlg": "ed25519",
+          "sig": "we3Ny_mwTSVDw4Tqg2qRc0ILxuAcHQK9JOghYZ76QEutab0C-E07IftV0c93W0CJygb9JoJzU7rWHnHWfEP6Bg"
+        }
+      },
+      "expected": {
+        "accepted": false,
+        "refusedBy": "step 1: not NFC"
+      }
+    },
+    {
+      "label": "application.schema in NFD, though it signs the same",
+      "record": {
+        "categories": {
+          "focus": {
+            "text": "review the café menu",
+            "meta": {
+              "key": "d2ee95788fc6f697ee3997158c4c189432dc15835aa2efa2c8a57f030f1ceb86",
+              "parents": []
+            }
+          },
+          "issue": {
+            "text": "the public vectors and runtime disagree",
+            "meta": {
+              "key": "8f37da919d4165770650b6508b66af65f0710157209b10724e7cc4aab717da83",
+              "parents": [
+                "cmb-0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a",
+                "cmb-f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0"
+              ]
+            }
+          },
+          "intent": {
+            "text": "make independent implementations interoperate",
+            "meta": {
+              "key": "f47998bfc4aedee3ac20c485f9cd07caacccf622ceced426c02e178741718f67",
+              "parents": []
+            }
+          },
+          "motivation": {
+            "text": "a protocol claim must be executable",
+            "meta": {
+              "key": "9dfa469fab3eeb8c98f79df69c3b2f02f277a017f9cbe3bf0f32ccbf9a4f129d",
+              "parents": []
+            }
+          },
+          "commitment": {
+            "text": "one contract drives every implementation",
+            "meta": {
+              "key": "d3bbf94949feceaea72667efe8c43a4bf3aed557ecc632caf82b7c3f2447e3c8",
+              "parents": []
+            }
+          },
+          "perspective": {
+            "text": "protocol editor",
+            "meta": {
+              "key": "3e48fe2e89a1e02f5c17c08e853bd09d5355d18a491a1bd926568089626ffa35",
+              "parents": []
+            }
+          },
+          "mood": {
+            "text": "calm",
+            "meta": {
+              "key": "d816b3859d6849569138dba79c0f1c82b7ce827a74ae63072d04f6f8a96a0e8f",
+              "parents": []
+            }
+          }
+        },
+        "metadata": {
+          "key": "cmb-15087b3c3a0a6b79971af8f56ebeccafbe4e5f71e4f88bd26c30ba99c7fe341e",
+          "addressScheme": "mmp-cmb-merkle-v2",
+          "signatureSuite": "mmp-sig-v2.0",
+          "createdByNodeId": "018f47a0-7b21-7abc-8def-0123456789ab",
+          "createdBy": "zoë",
+          "createdTimestamp": 1786611600000,
+          "room": "conformance-room",
+          "to": null,
+          "lineage": {
+            "parents": [
+              "cmb-0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a",
+              "cmb-f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0"
+            ],
+            "method": "SVAF-v2"
+          },
+          "application": {
+            "mediaType": "application/json",
+            "schema": "https://meshcognition.org/schema/café-v1.json",
+            "encoding": "base64url",
+            "byteLength": 16,
+            "digest": "sha256-a1aa2c0f4350bff317d862929d35436ff3521e2d11f0c38fa95b3e2563823a32",
+            "data": "eyJtZW51IjoiY2Fmw6kifQ"
+          },
+          "assertionId": "asrt-8c29099c3a16e9c3dec34b73a8b96b7e77366d0ed5bb79e1fc9e1d2481f27cfc",
+          "sigAlg": "ed25519",
+          "sig": "E4Lw9knqeVNuXY1plB9IBe2M_GyaX0nmAcDsH5bG3fqwpUg6zFK_tukUYzfyXB9uClCJfVDtoAgH4gi6lAKBAw"
+        }
+      },
+      "expected": {
+        "accepted": false,
+        "refusedBy": "step 1: not NFC"
+      }
+    },
+    {
+      "label": "a room outside the §5.8 grammar (an NFD spelling)",
+      "record": {
+        "categories": {
+          "focus": {
+            "text": "review the café menu",
+            "meta": {
+              "key": "d2ee95788fc6f697ee3997158c4c189432dc15835aa2efa2c8a57f030f1ceb86",
+              "parents": []
+            }
+          },
+          "issue": {
+            "text": "the public vectors and runtime disagree",
+            "meta": {
+              "key": "8f37da919d4165770650b6508b66af65f0710157209b10724e7cc4aab717da83",
+              "parents": [
+                "cmb-0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a",
+                "cmb-f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0"
+              ]
+            }
+          },
+          "intent": {
+            "text": "make independent implementations interoperate",
+            "meta": {
+              "key": "f47998bfc4aedee3ac20c485f9cd07caacccf622ceced426c02e178741718f67",
+              "parents": []
+            }
+          },
+          "motivation": {
+            "text": "a protocol claim must be executable",
+            "meta": {
+              "key": "9dfa469fab3eeb8c98f79df69c3b2f02f277a017f9cbe3bf0f32ccbf9a4f129d",
+              "parents": []
+            }
+          },
+          "commitment": {
+            "text": "one contract drives every implementation",
+            "meta": {
+              "key": "d3bbf94949feceaea72667efe8c43a4bf3aed557ecc632caf82b7c3f2447e3c8",
+              "parents": []
+            }
+          },
+          "perspective": {
+            "text": "protocol editor",
+            "meta": {
+              "key": "3e48fe2e89a1e02f5c17c08e853bd09d5355d18a491a1bd926568089626ffa35",
+              "parents": []
+            }
+          },
+          "mood": {
+            "text": "calm",
+            "meta": {
+              "key": "d816b3859d6849569138dba79c0f1c82b7ce827a74ae63072d04f6f8a96a0e8f",
+              "parents": []
+            },
+            "valence": 0.2,
+            "arousal": -0.1
+          }
+        },
+        "metadata": {
+          "key": "cmb-15087b3c3a0a6b79971af8f56ebeccafbe4e5f71e4f88bd26c30ba99c7fe341e",
+          "addressScheme": "mmp-cmb-merkle-v2",
+          "signatureSuite": "mmp-sig-v2.0",
+          "createdByNodeId": "018f47a0-7b21-7abc-8def-0123456789ab",
+          "createdBy": "zoë",
+          "createdTimestamp": 1786611600000,
+          "room": "équipe",
+          "to": null,
+          "lineage": {
+            "parents": [
+              "cmb-0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a",
+              "cmb-f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0"
+            ],
+            "method": "SVAF-v2"
+          },
+          "application": null,
+          "assertionId": "asrt-dff1bf3d7fe9a7a446aab9759db2b7ea5fe6e415270b2f62ae0e22ecb456d24b",
+          "sigAlg": "ed25519",
+          "sig": "we3Ny_mwTSVDw4Tqg2qRc0ILxuAcHQK9JOghYZ76QEutab0C-E07IftV0c93W0CJygb9JoJzU7rWHnHWfEP6Bg"
+        }
+      },
+      "expected": {
+        "accepted": false,
+        "refusedBy": "step 1: record schema"
+      }
+    },
+    {
+      "label": "an uppercase to",
+      "record": {
+        "categories": {
+          "focus": {
+            "text": "review the café menu",
+            "meta": {
+              "key": "d2ee95788fc6f697ee3997158c4c189432dc15835aa2efa2c8a57f030f1ceb86",
+              "parents": []
+            }
+          },
+          "issue": {
+            "text": "the public vectors and runtime disagree",
+            "meta": {
+              "key": "8f37da919d4165770650b6508b66af65f0710157209b10724e7cc4aab717da83",
+              "parents": [
+                "cmb-0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a",
+                "cmb-f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0"
+              ]
+            }
+          },
+          "intent": {
+            "text": "make independent implementations interoperate",
+            "meta": {
+              "key": "f47998bfc4aedee3ac20c485f9cd07caacccf622ceced426c02e178741718f67",
+              "parents": []
+            }
+          },
+          "motivation": {
+            "text": "a protocol claim must be executable",
+            "meta": {
+              "key": "9dfa469fab3eeb8c98f79df69c3b2f02f277a017f9cbe3bf0f32ccbf9a4f129d",
+              "parents": []
+            }
+          },
+          "commitment": {
+            "text": "one contract drives every implementation",
+            "meta": {
+              "key": "d3bbf94949feceaea72667efe8c43a4bf3aed557ecc632caf82b7c3f2447e3c8",
+              "parents": []
+            }
+          },
+          "perspective": {
+            "text": "protocol editor",
+            "meta": {
+              "key": "3e48fe2e89a1e02f5c17c08e853bd09d5355d18a491a1bd926568089626ffa35",
+              "parents": []
+            }
+          },
+          "mood": {
+            "text": "calm",
+            "meta": {
+              "key": "d816b3859d6849569138dba79c0f1c82b7ce827a74ae63072d04f6f8a96a0e8f",
+              "parents": []
+            }
+          }
+        },
+        "metadata": {
+          "key": "cmb-15087b3c3a0a6b79971af8f56ebeccafbe4e5f71e4f88bd26c30ba99c7fe341e",
+          "addressScheme": "mmp-cmb-merkle-v2",
+          "signatureSuite": "mmp-sig-v2.0",
+          "createdByNodeId": "018f47a0-7b21-7abc-8def-0123456789ab",
+          "createdBy": "zoë",
+          "createdTimestamp": 1786611600000,
+          "room": "conformance-room",
+          "to": "018F47A0-7B21-7ABC-8DEF-FEDCBA987654",
+          "lineage": {
+            "parents": [
+              "cmb-0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a",
+              "cmb-f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0"
+            ],
+            "method": "SVAF-v2"
+          },
+          "application": null,
+          "assertionId": "asrt-eea0f6f57d28c999bb3eee87115d27593e84248c2b0b3132ef6859060c36ee1e",
+          "sigAlg": "ed25519",
+          "sig": "V2bOV4h91QWFaHvq4i9d-cjnHRYE7uHs4tmMMVEWLRzhbL9Ihyz_Yv2o7EgwXiMOqMcorLBeij-S8TiqSEqDBQ"
+        }
+      },
+      "expected": {
+        "accepted": false,
+        "refusedBy": "step 1: record schema"
+      }
+    },
+    {
+      "label": "createdBy of 257 astral characters",
+      "record": {
+        "categories": {
+          "focus": {
+            "text": "review the café menu",
+            "meta": {
+              "key": "d2ee95788fc6f697ee3997158c4c189432dc15835aa2efa2c8a57f030f1ceb86",
+              "parents": []
+            }
+          },
+          "issue": {
+            "text": "the public vectors and runtime disagree",
+            "meta": {
+              "key": "8f37da919d4165770650b6508b66af65f0710157209b10724e7cc4aab717da83",
+              "parents": [
+                "cmb-0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a",
+                "cmb-f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0"
+              ]
+            }
+          },
+          "intent": {
+            "text": "make independent implementations interoperate",
+            "meta": {
+              "key": "f47998bfc4aedee3ac20c485f9cd07caacccf622ceced426c02e178741718f67",
+              "parents": []
+            }
+          },
+          "motivation": {
+            "text": "a protocol claim must be executable",
+            "meta": {
+              "key": "9dfa469fab3eeb8c98f79df69c3b2f02f277a017f9cbe3bf0f32ccbf9a4f129d",
+              "parents": []
+            }
+          },
+          "commitment": {
+            "text": "one contract drives every implementation",
+            "meta": {
+              "key": "d3bbf94949feceaea72667efe8c43a4bf3aed557ecc632caf82b7c3f2447e3c8",
+              "parents": []
+            }
+          },
+          "perspective": {
+            "text": "protocol editor",
+            "meta": {
+              "key": "3e48fe2e89a1e02f5c17c08e853bd09d5355d18a491a1bd926568089626ffa35",
+              "parents": []
+            }
+          },
+          "mood": {
+            "text": "calm",
+            "meta": {
+              "key": "d816b3859d6849569138dba79c0f1c82b7ce827a74ae63072d04f6f8a96a0e8f",
+              "parents": []
+            }
+          }
+        },
+        "metadata": {
+          "key": "cmb-15087b3c3a0a6b79971af8f56ebeccafbe4e5f71e4f88bd26c30ba99c7fe341e",
+          "addressScheme": "mmp-cmb-merkle-v2",
+          "signatureSuite": "mmp-sig-v2.0",
+          "createdByNodeId": "018f47a0-7b21-7abc-8def-0123456789ab",
+          "createdBy": "𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞𝄞",
+          "createdTimestamp": 1786611600000,
+          "room": "conformance-room",
+          "to": null,
+          "lineage": {
+            "parents": [
+              "cmb-0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a0a",
+              "cmb-f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0"
+            ],
+            "method": "SVAF-v2"
+          },
+          "application": null,
+          "assertionId": "asrt-b5927bcf002c23babc4dae8c6bb4f004bfecd16d3c9833ec15dc459b52273448",
+          "sigAlg": "ed25519",
+          "sig": "S8fcC7igmjPTIrvlQreWDw_-RQXfXwdp37p5Kbr_4cfRkFpQFUwa4BSYeZO8MVtRcs9BbBzKPpMKiCZ_2qUuAg"
+        }
+      },
+      "expected": {
+        "accepted": false,
+        "refusedBy": "step 1: record schema"
+      }
+    },
     {
       "label": "an uppercase createdByNodeId",
       "record": {
diff --git a/tests/fixtures/record-size-v2.json b/tests/fixtures/record-size-v2.json
index efe61b11..857353a7 100644
--- a/tests/fixtures/record-size-v2.json
+++ b/tests/fixtures/record-size-v2.json
@@ -1,7 +1,7 @@
 {
   "protocolVersion": "2.0",
   "measure": "MAX_CATEGORY_TEXT and MAX_RECORD_TEXT count the UTF-8 bytes of each category text after NFC; MAX_RECORD_BYTES counts the bytes of the RFC 8785 serialization of the two-section record, metadata.application.data included, which equals the UTF-8 length of ECMAScript JSON.stringify of it in any member order (§8.8.6)",
-  "usage": "Expand each case: the base record with each fill category text set to unit repeated count times and, when applicationBytes is given, metadata.application set to { mediaType: \"application/octet-stream\", schema: \"https://meshcognition.org/schema/size-fixture-v1.json\", encoding: \"base64url\", byteLength, digest, data } over that many bytes of 0x61. Measure; compare. Only the size verdict is pinned: an expanded record keeps the base key and signature.",
+  "usage": "Expand each case: the base record with each fill category text set to unit repeated count times and, when applicationBytes is given, metadata.application set to { mediaType: \"application/octet-stream\", schema: \"https://meshcognition.org/schema/size-fixture-v1.json\", encoding: \"base64url\", byteLength, digest, data } over that many bytes of 0x61. Its digest is \"sha256-\" followed by the lowercase hex SHA-256 of those bytes (§8.8.3), and data is their unpadded base64url. Measure; compare. Only the size verdict is pinned: an expanded record keeps the base key and signature.",
   "limits": {
     "MAX_CATEGORY_TEXT": 262144,
     "MAX_RECORD_TEXT": 524288,
@@ -266,6 +266,38 @@
         ]
       }
     },
+    {
+      "label": "CJK text within every limit, which an encoder that escapes non-ASCII would measure over MAX_RECORD_BYTES",
+      "fill": {
+        "focus": {
+          "unit": "漢",
+          "count": 87357
+        },
+        "issue": {
+          "unit": "漢",
+          "count": 87357
+        }
+      },
+      "expected": {
+        "categoryTextBytes": {
+          "focus": 262071,
+          "issue": 262071,
+          "intent": 45,
+          "motivation": 35,
+          "commitment": 40,
+          "perspective": 15,
+          "mood": 10
+        },
+        "recordTextBytes": 524287,
+        "recordBytes": 525880,
+        "notTheMeasure": {
+          "asciiEscapedBytes": 1050022,
+          "asciiEscapedVerdict": "over MAX_RECORD_BYTES: the wrong measure refuses a record that is within"
+        },
+        "within": true,
+        "over": []
+      }
+    },
     {
       "label": "the encoded record at MAX_RECORD_BYTES",
       "fill": {
diff --git a/tests/fixtures/relay-frame.schema.json b/tests/fixtures/relay-frame.schema.json
index be5cce29..b291ead4 100644
--- a/tests/fixtures/relay-frame.schema.json
+++ b/tests/fixtures/relay-frame.schema.json
@@ -33,7 +33,7 @@
     "peer": {
       "type": "object", "required": ["nodeId", "name"], "additionalProperties": false,
       "properties": {
-        "nodeId": { "type": "string", "format": "uuid" }, "name": { "type": "string", "minLength": 1, "maxLength": 255 },
+        "nodeId": { "type": "string", "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$" }, "name": { "type": "string", "minLength": 1, "maxLength": 255 },
         "offline": { "type": "boolean" }, "wakeChannel": { "$ref": "#/$defs/wake" }
       }
     },
@@ -47,8 +47,8 @@
     "ping": { "type": "object", "required": ["type"], "additionalProperties": false, "properties": { "type": { "const": "relay-ping" } } },
     "pong": { "type": "object", "required": ["type"], "additionalProperties": false, "properties": { "type": { "const": "relay-pong" } } },
     "reauth": { "type": "object", "required": ["type"], "additionalProperties": false, "properties": { "type": { "const": "relay-reauth" } } },
-    "joined": { "type": "object", "required": ["type", "nodeId", "name"], "additionalProperties": false, "properties": { "type": { "const": "relay-peer-joined" }, "nodeId": { "type": "string", "format": "uuid" }, "name": { "type": "string", "minLength": 1, "maxLength": 255 } } },
-    "left": { "type": "object", "required": ["type", "nodeId", "name"], "additionalProperties": false, "properties": { "type": { "const": "relay-peer-left" }, "nodeId": { "type": "string", "format": "uuid" }, "name": { "type": "string", "minLength": 1, "maxLength": 255 } } },
+    "joined": { "type": "object", "required": ["type", "nodeId", "name"], "additionalProperties": false, "properties": { "type": { "const": "relay-peer-joined" }, "nodeId": { "type": "string", "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$" }, "name": { "type": "string", "minLength": 1, "maxLength": 255 } } },
+    "left": { "type": "object", "required": ["type", "nodeId", "name"], "additionalProperties": false, "properties": { "type": { "const": "relay-peer-left" }, "nodeId": { "type": "string", "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$" }, "name": { "type": "string", "minLength": 1, "maxLength": 255 } } },
     "error": {
       "type": "object", "required": ["type", "message"], "additionalProperties": false,
       "properties": {
diff --git a/tests/fixtures/room-join.schema.json b/tests/fixtures/room-join.schema.json
index 5bc1cc52..523039a0 100644
--- a/tests/fixtures/room-join.schema.json
+++ b/tests/fixtures/room-join.schema.json
@@ -21,8 +21,8 @@
         "grantee": { "type": "string", "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$" },
         "granteeKey": { "type": "string", "pattern": "^[A-Za-z0-9_-]{43}$" },
         "grantedBy": { "type": "string", "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$" },
-        "grantedAt": { "type": "integer", "minimum": 0 },
-        "expiresAt": { "type": "integer", "minimum": 0 },
+        "grantedAt": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 },
+        "expiresAt": { "type": "integer", "minimum": 0, "maximum": 9007199254740991, "description": "At most 2^53 − 1, so every parser reads the integer the owner signed." },
         "sigAlg": { "const": "ed25519" },
         "sig": { "type": "string", "pattern": "^[A-Za-z0-9_-]{86}$" }
       }
diff --git a/tests/fixtures/sym-attest-frame.schema.json b/tests/fixtures/sym-attest-frame.schema.json
index 10f128a8..5e7e405f 100644
--- a/tests/fixtures/sym-attest-frame.schema.json
+++ b/tests/fixtures/sym-attest-frame.schema.json
@@ -12,8 +12,8 @@
   "$defs": {
     "nodeId": { "type": "string", "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$" },
     "room": { "type": "string", "pattern": "^[a-z0-9._-]{1,64}$" },
-    "time": { "type": "integer", "minimum": 0 },
-    "position": { "type": "integer", "minimum": 1 },
+    "time": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 },
+    "position": { "type": "integer", "minimum": 1, "maximum": 9007199254740991 },
     "hex64": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
     "link": { "anyOf": [{ "const": "genesis" }, { "$ref": "#/$defs/hex64" }] },
     "role": { "type": "string", "pattern": "^[a-z0-9][a-z0-9_-]{0,63}$" },
@@ -99,11 +99,12 @@
         "type": { "const": "sym-attest-witness" },
         "witness": {
           "type": "object",
-          "required": ["attester", "room", "uptoSeq", "root", "by", "role", "at", "sigAlg", "sig"],
+          "required": ["attester", "room", "fromSeq", "uptoSeq", "root", "by", "role", "at", "sigAlg", "sig"],
           "additionalProperties": false,
           "properties": {
             "attester": { "$ref": "#/$defs/nodeId" },
             "room": { "$ref": "#/$defs/room" },
+            "fromSeq": { "$ref": "#/$defs/position" },
             "uptoSeq": { "$ref": "#/$defs/position" },
             "root": { "$ref": "#/$defs/hex64" },
             "by": { "$ref": "#/$defs/nodeId" },
diff --git a/tests/fixtures/sym-attest-v1.json b/tests/fixtures/sym-attest-v1.json
new file mode 100644
index 00000000..36c6c057
--- /dev/null
+++ b/tests/fixtures/sym-attest-v1.json
@@ -0,0 +1,707 @@
+{
+  "extension": "sym-attest-v1",
+  "status": "Draft Candidate Extension (/spec/mmp/extensions/sym-attest)",
+  "usage": "Verification only for signatures: check that your implementation ACCEPTS each sig over its pinned payload and key (§18.3.2), and never sign and compare bytes. Every payload, chain link, segment root and checkpoint root is deterministic and MUST reproduce exactly. The attestations of forkAttestations differ from attestations only from seq 5.",
+  "testKeys": {
+    "warning": "fixed test keys; never use as identities",
+    "attester": {
+      "nodeId": "018f47a0-7b21-7abc-8def-a77e57000001",
+      "privateSeedBase64url": "UVFRUVFRUVFRUVFRUVFRUVFRUVFRUVFRUVFRUVFRUVE",
+      "publicKeyBase64url": "wFDFY3pE-oYp__PMzOIwDLNipj2Z2V_FQUUmb0MyRFo"
+    },
+    "witness": {
+      "nodeId": "018f47a0-7b21-7abc-8def-a77e57000002",
+      "privateSeedBase64url": "UlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlI",
+      "publicKeyBase64url": "IBLLkMpg6OXY2vZuInLSIz4EhtVX6MZhQe2JIBd9frc"
+    }
+  },
+  "attestations": [
+    {
+      "attestation": {
+        "of": "cmb-1f7dc30b47a98552e43974825f489189077a611a1ef34d0ddb0bebea7c11577f",
+        "assertionId": "asrt-28a28578bdee2cc55fafe167311b3ae5ad3d56211a50750029a39d5234603e1b",
+        "by": "018f47a0-7b21-7abc-8def-a77e57000001",
+        "at": 1786611601000,
+        "room": "team-room",
+        "method": "neural",
+        "verdict": "aligned",
+        "categories": {
+          "focus": "admit",
+          "issue": "admit",
+          "intent": "admit",
+          "motivation": "admit",
+          "commitment": "admit",
+          "perspective": "admit",
+          "mood": "admit"
+        },
+        "role": "participant",
+        "seq": 1,
+        "prev": "genesis",
+        "sigAlg": "ed25519",
+        "sig": "yEuzFidMZvtuHRHJY1k-6-s7HnqpGziu91E8p9sE_ihiT1W9P1jz_EjttUxadoSerdYwFUU1AtVlOB60gpepBw"
+      },
+      "payloadHex": "6d6d702d6174746573742d76310a36383a636d622d3166376463333062343761393835353265343339373438323566343839313839303737613631316131656633346430646462306265626561376331313537376636393a617372742d3238613238353738626465653263633535666166653136373331316233616535616433643536323131613530373530303239613339643532333436303365316233363a30313866343761302d376232312d376162632d386465662d61373765353730303030303131333a31373836363131363031303030393a7465616d2d726f6f6d363a6e657572616c373a616c69676e6564353a61646d6974353a61646d6974353a61646d6974353a61646d6974353a61646d6974353a61646d6974353a61646d697431313a7061727469636970616e74313a31373a67656e65736973",
+      "chainLinkOfThis": "e2cc10c877bfb36206a8bec7bce9e0f9296b9fcb56f7c8a42c743dc2bb949bb4"
+    },
+    {
+      "attestation": {
+        "of": "cmb-1db1d8fe87dbee8468ae911b8e58a73111d4e0a3a9e270939334b9d20d3260ff",
+        "assertionId": "asrt-c0a615b9a2d02037e68bdf4c446cf432ab994dfab9e9ced99895c8786e606bb1",
+        "by": "018f47a0-7b21-7abc-8def-a77e57000001",
+        "at": 1786611602000,
+        "room": "team-room",
+        "method": "neural",
+        "verdict": "guarded",
+        "categories": {
+          "focus": "admit",
+          "issue": "guard",
+          "intent": "guard",
+          "motivation": "admit",
+          "commitment": "silent",
+          "perspective": "admit",
+          "mood": "admit"
+        },
+        "role": "participant",
+        "seq": 2,
+        "prev": "e2cc10c877bfb36206a8bec7bce9e0f9296b9fcb56f7c8a42c743dc2bb949bb4",
+        "sigAlg": "ed25519",
+        "sig": "iUwGaE0FXvojhEsiEQouRWGKvQR2NNKfIh0bC4QPEaTnhda9t1P4V5nSTW45cvzk6COS6b8F6rkSjP4ooAgdDg"
+      },
+      "payloadHex": "6d6d702d6174746573742d76310a36383a636d622d3164623164386665383764626565383436386165393131623865353861373331313164346530613361396532373039333933333462396432306433323630666636393a617372742d6330613631356239613264303230333765363862646634633434366366343332616239393464666162396539636564393938393563383738366536303662623133363a30313866343761302d376232312d376162632d386465662d61373765353730303030303131333a31373836363131363032303030393a7465616d2d726f6f6d363a6e657572616c373a67756172646564353a61646d6974353a6775617264353a6775617264353a61646d6974363a73696c656e74353a61646d6974353a61646d697431313a7061727469636970616e74313a3236343a65326363313063383737626662333632303661386265633762636539653066393239366239666362353666376338613432633734336463326262393439626234",
+      "chainLinkOfThis": "23726f1d67a56692ae97c9e10c848b05b0c5e801a31266b76f5b0972605b4044"
+    },
+    {
+      "attestation": {
+        "of": "cmb-450d6312ea3f7172c8a1b0b5228550a2d143c38d16cf28e6065c4f0f791dd5e5",
+        "assertionId": "asrt-12bb2870435fafa0fc24b95724d4afd8f949a15a45799ee2c4a8f2b0b322170c",
+        "by": "018f47a0-7b21-7abc-8def-a77e57000001",
+        "at": 1786611603000,
+        "room": "team-room",
+        "method": "neural",
+        "verdict": "rejected",
+        "categories": {
+          "focus": "reject",
+          "issue": "reject",
+          "intent": "reject",
+          "motivation": "silent",
+          "commitment": "silent",
+          "perspective": "reject",
+          "mood": "admit"
+        },
+        "role": "participant",
+        "seq": 3,
+        "prev": "23726f1d67a56692ae97c9e10c848b05b0c5e801a31266b76f5b0972605b4044",
+        "sigAlg": "ed25519",
+        "sig": "AJgocPedUK4YuQizrJAidjuXef-N1uk6MvwXZl-2kT_Nc_KLN5k9GT0x5X5WznMIWq0l7kaydvJifg3TlrdxDQ"
+      },
+      "payloadHex": "6d6d702d6174746573742d76310a36383a636d622d3435306436333132656133663731373263386131623062353232383535306132643134336333386431366366323865363036356334663066373931646435653536393a617372742d3132626232383730343335666166613066633234623935373234643461666438663934396131356134353739396565326334613866326230623332323137306333363a30313866343761302d376232312d376162632d386465662d61373765353730303030303131333a31373836363131363033303030393a7465616d2d726f6f6d363a6e657572616c383a72656a6563746564363a72656a656374363a72656a656374363a72656a656374363a73696c656e74363a73696c656e74363a72656a656374353a61646d697431313a7061727469636970616e74313a3336343a32333732366631643637613536363932616539376339653130633834386230356230633565383031613331323636623736663562303937323630356234303434",
+      "chainLinkOfThis": "30f766f9ba88d5e9e8a01f332914f52938b3c316a2d1717357ca92ad3d072336"
+    },
+    {
+      "attestation": {
+        "of": "cmb-65bf378c851144a530a78dde4177b2851a18c6d337aa71720a1fc4cc14fcfc15",
+        "assertionId": "asrt-c32f712a1378f1996a8e893f157b2df9316cbea86f11b0645f4c9d18589ccedd",
+        "by": "018f47a0-7b21-7abc-8def-a77e57000001",
+        "at": 1786611604000,
+        "room": "team-room",
+        "method": "neural",
+        "verdict": "redundant",
+        "categories": {
+          "focus": "redundant",
+          "issue": "redundant",
+          "intent": "redundant",
+          "motivation": "redundant",
+          "commitment": "silent",
+          "perspective": "redundant",
+          "mood": "admit"
+        },
+        "role": "participant",
+        "seq": 4,
+        "prev": "30f766f9ba88d5e9e8a01f332914f52938b3c316a2d1717357ca92ad3d072336",
+        "sigAlg": "ed25519",
+        "sig": "FprAoe5I72tgd2ffMGbocG7FJmm0YfeDq5fEC51nrU-UAw_njV28zJ3amwWdPYvCbX7xMYVA0c6hrCAHzj0nBA"
+      },
+      "payloadHex": "6d6d702d6174746573742d76310a36383a636d622d3635626633373863383531313434613533306137386464653431373762323835316131386336643333376161373137323061316663346363313466636663313536393a617372742d6333326637313261313337386631393936613865383933663135376232646639333136636265613836663131623036343566346339643138353839636365646433363a30313866343761302d376232312d376162632d386465662d61373765353730303030303131333a31373836363131363034303030393a7465616d2d726f6f6d363a6e657572616c393a726564756e64616e74393a726564756e64616e74393a726564756e64616e74393a726564756e64616e74393a726564756e64616e74363a73696c656e74393a726564756e64616e74353a61646d697431313a7061727469636970616e74313a3436343a33306637363666396261383864356539653861303166333332393134663532393338623363333136613264313731373335376361393261643364303732333336",
+      "chainLinkOfThis": "1611f58545f2c3e7fc080327e1351d0fb04ab803fa637d5887e983d9d7d81072"
+    },
+    {
+      "attestation": {
+        "of": "cmb-ce23a6884f00f5e88a0b2ff746ff17dd90ae9ca0fbf697de426920a293f6998c",
+        "assertionId": "asrt-ad81fbac6c09dbdff0d5d6f2e4fb473afe2743e532cee809421ba10bcc133506",
+        "by": "018f47a0-7b21-7abc-8def-a77e57000001",
+        "at": 1786611605000,
+        "room": "team-room",
+        "method": "neural",
+        "verdict": "aligned",
+        "categories": {
+          "focus": "admit",
+          "issue": "admit",
+          "intent": "admit",
+          "motivation": "admit",
+          "commitment": "admit",
+          "perspective": "admit",
+          "mood": "admit"
+        },
+        "role": "participant",
+        "seq": 5,
+        "prev": "1611f58545f2c3e7fc080327e1351d0fb04ab803fa637d5887e983d9d7d81072",
+        "sigAlg": "ed25519",
+        "sig": "3ta5NFflcI2KWcCYJeoMA3wAhTIjzp4ij5Q3_ciHv1fVcidI3opXraj3ePEwsEOUiZCM8GA2cLr-E_6eian7Aw"
+      },
+      "payloadHex": "6d6d702d6174746573742d76310a36383a636d622d6365323361363838346630306635653838613062326666373436666631376464393061653963613066626636393764653432363932306132393366363939386336393a617372742d6164383166626163366330396462646666306435643666326534666234373361666532373433653533326365653830393432316261313062636331333335303633363a30313866343761302d376232312d376162632d386465662d61373765353730303030303131333a31373836363131363035303030393a7465616d2d726f6f6d363a6e657572616c373a616c69676e6564353a61646d6974353a61646d6974353a61646d6974353a61646d6974353a61646d6974353a61646d6974353a61646d697431313a7061727469636970616e74313a3536343a31363131663538353435663263336537666330383033323765313335316430666230346162383033666136333764353838376539383364396437643831303732",
+      "chainLinkOfThis": "6d9ab323e22e9cb272b26869e47b2025ca7deb239079144381fbcf5190a3f882"
+    },
+    {
+      "attestation": {
+        "of": "cmb-8be42bc01c03d225a371ae4de5fe075f3c5eb0ec8b0251c3719093ac12620b56",
+        "assertionId": "asrt-b63dfb06722f00c6e368b2d98af4bab4306a74d59a5c3820207c62f4c3eff4d7",
+        "by": "018f47a0-7b21-7abc-8def-a77e57000001",
+        "at": 1786611606000,
+        "room": "team-room",
+        "method": "neural",
+        "verdict": "guarded",
+        "categories": {
+          "focus": "admit",
+          "issue": "guard",
+          "intent": "guard",
+          "motivation": "admit",
+          "commitment": "silent",
+          "perspective": "admit",
+          "mood": "admit"
+        },
+        "role": "participant",
+        "seq": 6,
+        "prev": "6d9ab323e22e9cb272b26869e47b2025ca7deb239079144381fbcf5190a3f882",
+        "sigAlg": "ed25519",
+        "sig": "ydFu1OFixHEcShi_xC5dguOABaZCoMgVvApEwIFz5pYrX2TC2ffpK_phSkgE1HuWRqNxa-sdhkHoG6_uMdLzCQ"
+      },
+      "payloadHex": "6d6d702d6174746573742d76310a36383a636d622d3862653432626330316330336432323561333731616534646535666530373566336335656230656338623032353163333731393039336163313236323062353636393a617372742d6236336466623036373232663030633665333638623264393861663462616234333036613734643539613563333832303230376336326634633365666634643733363a30313866343761302d376232312d376162632d386465662d61373765353730303030303131333a31373836363131363036303030393a7465616d2d726f6f6d363a6e657572616c373a67756172646564353a61646d6974353a6775617264353a6775617264353a61646d6974363a73696c656e74353a61646d6974353a61646d697431313a7061727469636970616e74313a3636343a36643961623332336532326539636232373262323638363965343762323032356361376465623233393037393134343338316662636635313930613366383832",
+      "chainLinkOfThis": "257aeb5f09c035ee4735c62497373d6e8c9ce609f1fe60c4a28c3498235f418c"
+    }
+  ],
+  "forkAttestations": [
+    {
+      "attestation": {
+        "of": "cmb-1f7dc30b47a98552e43974825f489189077a611a1ef34d0ddb0bebea7c11577f",
+        "assertionId": "asrt-28a28578bdee2cc55fafe167311b3ae5ad3d56211a50750029a39d5234603e1b",
+        "by": "018f47a0-7b21-7abc-8def-a77e57000001",
+        "at": 1786611601000,
+        "room": "team-room",
+        "method": "neural",
+        "verdict": "aligned",
+        "categories": {
+          "focus": "admit",
+          "issue": "admit",
+          "intent": "admit",
+          "motivation": "admit",
+          "commitment": "admit",
+          "perspective": "admit",
+          "mood": "admit"
+        },
+        "role": "participant",
+        "seq": 1,
+        "prev": "genesis",
+        "sigAlg": "ed25519",
+        "sig": "yEuzFidMZvtuHRHJY1k-6-s7HnqpGziu91E8p9sE_ihiT1W9P1jz_EjttUxadoSerdYwFUU1AtVlOB60gpepBw"
+      },
+      "payloadHex": "6d6d702d6174746573742d76310a36383a636d622d3166376463333062343761393835353265343339373438323566343839313839303737613631316131656633346430646462306265626561376331313537376636393a617372742d3238613238353738626465653263633535666166653136373331316233616535616433643536323131613530373530303239613339643532333436303365316233363a30313866343761302d376232312d376162632d386465662d61373765353730303030303131333a31373836363131363031303030393a7465616d2d726f6f6d363a6e657572616c373a616c69676e6564353a61646d6974353a61646d6974353a61646d6974353a61646d6974353a61646d6974353a61646d6974353a61646d697431313a7061727469636970616e74313a31373a67656e65736973"
+    },
+    {
+      "attestation": {
+        "of": "cmb-1db1d8fe87dbee8468ae911b8e58a73111d4e0a3a9e270939334b9d20d3260ff",
+        "assertionId": "asrt-c0a615b9a2d02037e68bdf4c446cf432ab994dfab9e9ced99895c8786e606bb1",
+        "by": "018f47a0-7b21-7abc-8def-a77e57000001",
+        "at": 1786611602000,
+        "room": "team-room",
+        "method": "neural",
+        "verdict": "guarded",
+        "categories": {
+          "focus": "admit",
+          "issue": "guard",
+          "intent": "guard",
+          "motivation": "admit",
+          "commitment": "silent",
+          "perspective": "admit",
+          "mood": "admit"
+        },
+        "role": "participant",
+        "seq": 2,
+        "prev": "e2cc10c877bfb36206a8bec7bce9e0f9296b9fcb56f7c8a42c743dc2bb949bb4",
+        "sigAlg": "ed25519",
+        "sig": "iUwGaE0FXvojhEsiEQouRWGKvQR2NNKfIh0bC4QPEaTnhda9t1P4V5nSTW45cvzk6COS6b8F6rkSjP4ooAgdDg"
+      },
+      "payloadHex": "6d6d702d6174746573742d76310a36383a636d622d3164623164386665383764626565383436386165393131623865353861373331313164346530613361396532373039333933333462396432306433323630666636393a617372742d6330613631356239613264303230333765363862646634633434366366343332616239393464666162396539636564393938393563383738366536303662623133363a30313866343761302d376232312d376162632d386465662d61373765353730303030303131333a31373836363131363032303030393a7465616d2d726f6f6d363a6e657572616c373a67756172646564353a61646d6974353a6775617264353a6775617264353a61646d6974363a73696c656e74353a61646d6974353a61646d697431313a7061727469636970616e74313a3236343a65326363313063383737626662333632303661386265633762636539653066393239366239666362353666376338613432633734336463326262393439626234"
+    },
+    {
+      "attestation": {
+        "of": "cmb-450d6312ea3f7172c8a1b0b5228550a2d143c38d16cf28e6065c4f0f791dd5e5",
+        "assertionId": "asrt-12bb2870435fafa0fc24b95724d4afd8f949a15a45799ee2c4a8f2b0b322170c",
+        "by": "018f47a0-7b21-7abc-8def-a77e57000001",
+        "at": 1786611603000,
+        "room": "team-room",
+        "method": "neural",
+        "verdict": "rejected",
+        "categories": {
+          "focus": "reject",
+          "issue": "reject",
+          "intent": "reject",
+          "motivation": "silent",
+          "commitment": "silent",
+          "perspective": "reject",
+          "mood": "admit"
+        },
+        "role": "participant",
+        "seq": 3,
+        "prev": "23726f1d67a56692ae97c9e10c848b05b0c5e801a31266b76f5b0972605b4044",
+        "sigAlg": "ed25519",
+        "sig": "AJgocPedUK4YuQizrJAidjuXef-N1uk6MvwXZl-2kT_Nc_KLN5k9GT0x5X5WznMIWq0l7kaydvJifg3TlrdxDQ"
+      },
+      "payloadHex": "6d6d702d6174746573742d76310a36383a636d622d3435306436333132656133663731373263386131623062353232383535306132643134336333386431366366323865363036356334663066373931646435653536393a617372742d3132626232383730343335666166613066633234623935373234643461666438663934396131356134353739396565326334613866326230623332323137306333363a30313866343761302d376232312d376162632d386465662d61373765353730303030303131333a31373836363131363033303030393a7465616d2d726f6f6d363a6e657572616c383a72656a6563746564363a72656a656374363a72656a656374363a72656a656374363a73696c656e74363a73696c656e74363a72656a656374353a61646d697431313a7061727469636970616e74313a3336343a32333732366631643637613536363932616539376339653130633834386230356230633565383031613331323636623736663562303937323630356234303434"
+    },
+    {
+      "attestation": {
+        "of": "cmb-65bf378c851144a530a78dde4177b2851a18c6d337aa71720a1fc4cc14fcfc15",
+        "assertionId": "asrt-c32f712a1378f1996a8e893f157b2df9316cbea86f11b0645f4c9d18589ccedd",
+        "by": "018f47a0-7b21-7abc-8def-a77e57000001",
+        "at": 1786611604000,
+        "room": "team-room",
+        "method": "neural",
+        "verdict": "redundant",
+        "categories": {
+          "focus": "redundant",
+          "issue": "redundant",
+          "intent": "redundant",
+          "motivation": "redundant",
+          "commitment": "silent",
+          "perspective": "redundant",
+          "mood": "admit"
+        },
+        "role": "participant",
+        "seq": 4,
+        "prev": "30f766f9ba88d5e9e8a01f332914f52938b3c316a2d1717357ca92ad3d072336",
+        "sigAlg": "ed25519",
+        "sig": "FprAoe5I72tgd2ffMGbocG7FJmm0YfeDq5fEC51nrU-UAw_njV28zJ3amwWdPYvCbX7xMYVA0c6hrCAHzj0nBA"
+      },
+      "payloadHex": "6d6d702d6174746573742d76310a36383a636d622d3635626633373863383531313434613533306137386464653431373762323835316131386336643333376161373137323061316663346363313466636663313536393a617372742d6333326637313261313337386631393936613865383933663135376232646639333136636265613836663131623036343566346339643138353839636365646433363a30313866343761302d376232312d376162632d386465662d61373765353730303030303131333a31373836363131363034303030393a7465616d2d726f6f6d363a6e657572616c393a726564756e64616e74393a726564756e64616e74393a726564756e64616e74393a726564756e64616e74393a726564756e64616e74363a73696c656e74393a726564756e64616e74353a61646d697431313a7061727469636970616e74313a3436343a33306637363666396261383864356539653861303166333332393134663532393338623363333136613264313731373335376361393261643364303732333336"
+    },
+    {
+      "attestation": {
+        "of": "cmb-ce23a6884f00f5e88a0b2ff746ff17dd90ae9ca0fbf697de426920a293f6998c",
+        "assertionId": "asrt-ad81fbac6c09dbdff0d5d6f2e4fb473afe2743e532cee809421ba10bcc133506",
+        "by": "018f47a0-7b21-7abc-8def-a77e57000001",
+        "at": 1786611605000,
+        "room": "team-room",
+        "method": "neural",
+        "verdict": "rejected",
+        "categories": {
+          "focus": "reject",
+          "issue": "reject",
+          "intent": "reject",
+          "motivation": "silent",
+          "commitment": "silent",
+          "perspective": "reject",
+          "mood": "admit"
+        },
+        "role": "participant",
+        "seq": 5,
+        "prev": "1611f58545f2c3e7fc080327e1351d0fb04ab803fa637d5887e983d9d7d81072",
+        "sigAlg": "ed25519",
+        "sig": "PPgu42lpwBoPmcxIudw7j78KczstUHx_dT0rcD9nTfx3Wt-6iMsncWx0q_FMYZeXHW5hw3-p-38WhphyE7ZuDQ"
+      },
+      "payloadHex": "6d6d702d6174746573742d76310a36383a636d622d6365323361363838346630306635653838613062326666373436666631376464393061653963613066626636393764653432363932306132393366363939386336393a617372742d6164383166626163366330396462646666306435643666326534666234373361666532373433653533326365653830393432316261313062636331333335303633363a30313866343761302d376232312d376162632d386465662d61373765353730303030303131333a31373836363131363035303030393a7465616d2d726f6f6d363a6e657572616c383a72656a6563746564363a72656a656374363a72656a656374363a72656a656374363a73696c656e74363a73696c656e74363a72656a656374353a61646d697431313a7061727469636970616e74313a3536343a31363131663538353435663263336537666330383033323765313335316430666230346162383033666136333764353838376539383364396437643831303732"
+    },
+    {
+      "attestation": {
+        "of": "cmb-8be42bc01c03d225a371ae4de5fe075f3c5eb0ec8b0251c3719093ac12620b56",
+        "assertionId": "asrt-b63dfb06722f00c6e368b2d98af4bab4306a74d59a5c3820207c62f4c3eff4d7",
+        "by": "018f47a0-7b21-7abc-8def-a77e57000001",
+        "at": 1786611606000,
+        "room": "team-room",
+        "method": "neural",
+        "verdict": "guarded",
+        "categories": {
+          "focus": "admit",
+          "issue": "guard",
+          "intent": "guard",
+          "motivation": "admit",
+          "commitment": "silent",
+          "perspective": "admit",
+          "mood": "admit"
+        },
+        "role": "participant",
+        "seq": 6,
+        "prev": "a4f0fa351d31346f0eebf41fde7de5977d9f3d57f46bad178f5abdd1c382422f",
+        "sigAlg": "ed25519",
+        "sig": "ZIHu1k8zNtd_L6CBMhpuu-7Nrb6Vu1N31jcMNCyiJh4CkHnt8AtegqbgllRRd-3bielktZ_qEIY9v2vlbnIsCw"
+      },
+      "payloadHex": "6d6d702d6174746573742d76310a36383a636d622d3862653432626330316330336432323561333731616534646535666530373566336335656230656338623032353163333731393039336163313236323062353636393a617372742d6236336466623036373232663030633665333638623264393861663462616234333036613734643539613563333832303230376336326634633365666634643733363a30313866343761302d376232312d376162632d386465662d61373765353730303030303131333a31373836363131363036303030393a7465616d2d726f6f6d363a6e657572616c373a67756172646564353a61646d6974353a6775617264353a6775617264353a61646d6974363a73696c656e74353a61646d6974353a61646d697431313a7061727469636970616e74313a3636343a61346630666133353164333133343666306565626634316664653764653539373764396633643537663436626164313738663561626464316333383234323266"
+    }
+  ],
+  "checkpoints": [
+    {
+      "checkpoint": {
+        "by": "018f47a0-7b21-7abc-8def-a77e57000001",
+        "room": "team-room",
+        "fromSeq": 1,
+        "uptoSeq": 1,
+        "prev": "genesis",
+        "root": "665f361a8e9344ee5ed38380daa454581bb929d581f7a4fed7fb7131f37197ba",
+        "at": 1786611601500,
+        "sigAlg": "ed25519",
+        "sig": "iUowNBs6Ht1_37-a_NkOZEUWuwvSv_Q3-dG6shKRDXivFOQORFALEETUYF-Clw2bUMnWe7-T1IyTRn8dlmuRBw"
+      },
+      "segmentRootHex": "b9829f179d0cec1e280c8dcc13391ea13f04504e3e219f6000e84153268c572a",
+      "payloadHex": "6d6d702d6174746573742d636865636b706f696e742d76310a33363a30313866343761302d376232312d376162632d386465662d613737653537303030303031393a7465616d2d726f6f6d313a31313a31373a67656e6573697336343a3636356633363161386539333434656535656433383338306461613435343538316262393239643538316637613466656437666237313331663337313937626131333a31373836363131363031353030"
+    },
+    {
+      "checkpoint": {
+        "by": "018f47a0-7b21-7abc-8def-a77e57000001",
+        "room": "team-room",
+        "fromSeq": 2,
+        "uptoSeq": 3,
+        "prev": "665f361a8e9344ee5ed38380daa454581bb929d581f7a4fed7fb7131f37197ba",
+        "root": "4412f69bb56e5256fe612ff5fbc1e550b4cc773a3f44fcd589f2727ff2eae44f",
+        "at": 1786611603500,
+        "sigAlg": "ed25519",
+        "sig": "zEZkjFio9Tsndr597PVPosp3XF2GRTWZzohifCkjDT9C2Hm-8d0eGE2k5uYgqBPN62r6iMNWwuRow4E994dKAg"
+      },
+      "segmentRootHex": "8e0d5ba33c8bf9954c635b99a5d5089413532baa998fc6d8d18c73b70bf326d7",
+      "payloadHex": "6d6d702d6174746573742d636865636b706f696e742d76310a33363a30313866343761302d376232312d376162632d386465662d613737653537303030303031393a7465616d2d726f6f6d313a32313a3336343a3636356633363161386539333434656535656433383338306461613435343538316262393239643538316637613466656437666237313331663337313937626136343a3434313266363962623536653532353666653631326666356662633165353530623463633737336133663434666364353839663237323766663265616534346631333a31373836363131363033353030"
+    },
+    {
+      "checkpoint": {
+        "by": "018f47a0-7b21-7abc-8def-a77e57000001",
+        "room": "team-room",
+        "fromSeq": 4,
+        "uptoSeq": 6,
+        "prev": "4412f69bb56e5256fe612ff5fbc1e550b4cc773a3f44fcd589f2727ff2eae44f",
+        "root": "325f034f4997191a61125f3d5eeaf5953d6a269faaa7f78c0b9b174d7d0b6a0a",
+        "at": 1786611606500,
+        "sigAlg": "ed25519",
+        "sig": "xV47BgwYlhtTL-4UzIhJb3GRlGtMJyDnScpiaKG-AyCymUUyTUHuWJrUjJVcXUZkglZALlpErekwnGsqwOQUAA"
+      },
+      "segmentRootHex": "115073deaae739db04cdbf2905804bfa9f619355cf88643dee5439e111462817",
+      "payloadHex": "6d6d702d6174746573742d636865636b706f696e742d76310a33363a30313866343761302d376232312d376162632d386465662d613737653537303030303031393a7465616d2d726f6f6d313a34313a3636343a3434313266363962623536653532353666653631326666356662633165353530623463633737336133663434666364353839663237323766663265616534346636343a3332356630333466343939373139316136313132356633643565656166353935336436613236396661616137663738633062396231373464376430623661306131333a31373836363131363036353030"
+    }
+  ],
+  "witness": {
+    "witness": {
+      "attester": "018f47a0-7b21-7abc-8def-a77e57000001",
+      "room": "team-room",
+      "fromSeq": 4,
+      "uptoSeq": 6,
+      "root": "325f034f4997191a61125f3d5eeaf5953d6a269faaa7f78c0b9b174d7d0b6a0a",
+      "by": "018f47a0-7b21-7abc-8def-a77e57000002",
+      "role": "participant",
+      "at": 1786611607000,
+      "sigAlg": "ed25519",
+      "sig": "U7dkrqqEA6W-6tksS5B801b_4SdFN4O12D2vYdUQ3FuDg871FXHcyOcNXWXIhchLywCTPZLWP7kJyHOzudOACA"
+    },
+    "payloadHex": "6d6d702d6174746573742d7769746e6573732d76310a33363a30313866343761302d376232312d376162632d386465662d613737653537303030303031393a7465616d2d726f6f6d313a34313a3636343a3332356630333466343939373139316136313132356633643565656166353935336436613236396661616137663738633062396231373464376430623661306133363a30313866343761302d376232312d376162632d386465662d61373765353730303030303231313a7061727469636970616e7431333a31373836363131363037303030"
+  },
+  "forkCheckpoints": {
+    "forkSameCut": {
+      "checkpoint": {
+        "by": "018f47a0-7b21-7abc-8def-a77e57000001",
+        "room": "team-room",
+        "fromSeq": 4,
+        "uptoSeq": 6,
+        "prev": "4412f69bb56e5256fe612ff5fbc1e550b4cc773a3f44fcd589f2727ff2eae44f",
+        "root": "be1685d8baca9f33c2443802ca6ef5fc5f9dcda8bb2b21b1bb28db5515211fba",
+        "at": 1786611606600,
+        "sigAlg": "ed25519",
+        "sig": "EJC5HSB5rjSJyGNYMXvwgOy2cTO7KcmNSzeh46NnoEiYHUkBgEIwAWNqB9sUFhBHlPBTERpft7OhpCIsW8pJCQ"
+      },
+      "segmentRootHex": "05424f50a3dcfc40b567005047b65f1fb76d55445840e3a6366c4111d509fc17",
+      "payloadHex": "6d6d702d6174746573742d636865636b706f696e742d76310a33363a30313866343761302d376232312d376162632d386465662d613737653537303030303031393a7465616d2d726f6f6d313a34313a3636343a3434313266363962623536653532353666653631326666356662633165353530623463633737336133663434666364353839663237323766663265616534346636343a6265313638356438626163613966333363323434333830326361366566356663356639646364613862623262323162316262323864623535313532313166626131333a31373836363131363036363030"
+    },
+    "forkFirst": {
+      "checkpoint": {
+        "by": "018f47a0-7b21-7abc-8def-a77e57000001",
+        "room": "team-room",
+        "fromSeq": 1,
+        "uptoSeq": 2,
+        "prev": "genesis",
+        "root": "ace1de806d14db12247dfbad9b1f0f6d264fb7134e6d97e3d297cbb2a4c2626b",
+        "at": 1786611602600,
+        "sigAlg": "ed25519",
+        "sig": "iVv3zWK7iCNPp0PP1XrOTFI0D_FG48pJWc825jEebn-50gCX47f7i-uYnQB_yjg_3S8F_JVlwM3-139etRDFBA"
+      },
+      "segmentRootHex": "1168a6c7e5b760729fb0b6848946e4ea42abff32da703bd821892b99d2cced81",
+      "payloadHex": "6d6d702d6174746573742d636865636b706f696e742d76310a33363a30313866343761302d376232312d376162632d386465662d613737653537303030303031393a7465616d2d726f6f6d313a31313a32373a67656e6573697336343a6163653164653830366431346462313232343764666261643962316630663664323634666237313334653664393765336432393763626232613463323632366231333a31373836363131363032363030"
+    },
+    "forkOtherCut": {
+      "checkpoint": {
+        "by": "018f47a0-7b21-7abc-8def-a77e57000001",
+        "room": "team-room",
+        "fromSeq": 3,
+        "uptoSeq": 5,
+        "prev": "ace1de806d14db12247dfbad9b1f0f6d264fb7134e6d97e3d297cbb2a4c2626b",
+        "root": "cec1a6a1b22265787b018c5c5b2f690a1c17befcbbf6268c608c009463176f2f",
+        "at": 1786611605600,
+        "sigAlg": "ed25519",
+        "sig": "37cSBTKyX2tm3UDknvfSZImmmBGWEEpU0v_5IQILns2xOyOty_hIQOlg0QubzXopcvd8Yrj_JgzuXLCY20udCA"
+      },
+      "segmentRootHex": "676ebb276d4ae82f55d1083f210b0ec06eb23315493d9338c92d63e616eba98f",
+      "payloadHex": "6d6d702d6174746573742d636865636b706f696e742d76310a33363a30313866343761302d376232312d376162632d386465662d613737653537303030303031393a7465616d2d726f6f6d313a33313a3536343a6163653164653830366431346462313232343764666261643962316630663664323634666237313334653664393765336432393763626232613463323632366236343a6365633161366131623232323635373837623031386335633562326636393061316331376265666362626636323638633630386330303934363331373666326631333a31373836363131363035363030"
+    },
+    "forkSamePrev": {
+      "checkpoint": {
+        "by": "018f47a0-7b21-7abc-8def-a77e57000001",
+        "room": "team-room",
+        "fromSeq": 2,
+        "uptoSeq": 4,
+        "prev": "665f361a8e9344ee5ed38380daa454581bb929d581f7a4fed7fb7131f37197ba",
+        "root": "701c741e614e3fd3d58da1ac1f26a7df1b47e3df7d7c3e30886b06d614882cc8",
+        "at": 1786611604600,
+        "sigAlg": "ed25519",
+        "sig": "0aYueP2FoJ7T26ybPJvNsdR9UpjdzVpzT66OcO9C7KyVJOAsukSj6Cr7GFJcAbOctaeMmKXVbAFH9-PafvlpDA"
+      },
+      "segmentRootHex": "fbeda54b4110e6ca0b90b39da85b4aba182c0d7668097cf0c15694b394d04b2c",
+      "payloadHex": "6d6d702d6174746573742d636865636b706f696e742d76310a33363a30313866343761302d376232312d376162632d386465662d613737653537303030303031393a7465616d2d726f6f6d313a32313a3436343a3636356633363161386539333434656535656433383338306461613435343538316262393239643538316637613466656437666237313331663337313937626136343a3730316337343165363134653366643364353864613161633166323661376466316234376533646637643763336533303838366230366436313438383263633831333a31373836363131363034363030"
+    }
+  },
+  "conflicts": [
+    {
+      "label": "the same uptoSeq with different roots (the fork cut at the same boundary)",
+      "a": {
+        "by": "018f47a0-7b21-7abc-8def-a77e57000001",
+        "room": "team-room",
+        "fromSeq": 4,
+        "uptoSeq": 6,
+        "prev": "4412f69bb56e5256fe612ff5fbc1e550b4cc773a3f44fcd589f2727ff2eae44f",
+        "root": "325f034f4997191a61125f3d5eeaf5953d6a269faaa7f78c0b9b174d7d0b6a0a",
+        "at": 1786611606500,
+        "sigAlg": "ed25519",
+        "sig": "xV47BgwYlhtTL-4UzIhJb3GRlGtMJyDnScpiaKG-AyCymUUyTUHuWJrUjJVcXUZkglZALlpErekwnGsqwOQUAA"
+      },
+      "b": {
+        "by": "018f47a0-7b21-7abc-8def-a77e57000001",
+        "room": "team-room",
+        "fromSeq": 4,
+        "uptoSeq": 6,
+        "prev": "4412f69bb56e5256fe612ff5fbc1e550b4cc773a3f44fcd589f2727ff2eae44f",
+        "root": "be1685d8baca9f33c2443802ca6ef5fc5f9dcda8bb2b21b1bb28db5515211fba",
+        "at": 1786611606600,
+        "sigAlg": "ed25519",
+        "sig": "EJC5HSB5rjSJyGNYMXvwgOy2cTO7KcmNSzeh46NnoEiYHUkBgEIwAWNqB9sUFhBHlPBTERpft7OhpCIsW8pJCQ"
+      },
+      "expected": {
+        "conflict": true,
+        "because": [
+          "overlapping ranges",
+          "same prev"
+        ]
+      }
+    },
+    {
+      "label": "overlapping ranges at different boundaries (2..3 against 3..5): no position or prev in common",
+      "a": {
+        "by": "018f47a0-7b21-7abc-8def-a77e57000001",
+        "room": "team-room",
+        "fromSeq": 2,
+        "uptoSeq": 3,
+        "prev": "665f361a8e9344ee5ed38380daa454581bb929d581f7a4fed7fb7131f37197ba",
+        "root": "4412f69bb56e5256fe612ff5fbc1e550b4cc773a3f44fcd589f2727ff2eae44f",
+        "at": 1786611603500,
+        "sigAlg": "ed25519",
+        "sig": "zEZkjFio9Tsndr597PVPosp3XF2GRTWZzohifCkjDT9C2Hm-8d0eGE2k5uYgqBPN62r6iMNWwuRow4E994dKAg"
+      },
+      "b": {
+        "by": "018f47a0-7b21-7abc-8def-a77e57000001",
+        "room": "team-room",
+        "fromSeq": 3,
+        "uptoSeq": 5,
+        "prev": "ace1de806d14db12247dfbad9b1f0f6d264fb7134e6d97e3d297cbb2a4c2626b",
+        "root": "cec1a6a1b22265787b018c5c5b2f690a1c17befcbbf6268c608c009463176f2f",
+        "at": 1786611605600,
+        "sigAlg": "ed25519",
+        "sig": "37cSBTKyX2tm3UDknvfSZImmmBGWEEpU0v_5IQILns2xOyOty_hIQOlg0QubzXopcvd8Yrj_JgzuXLCY20udCA"
+      },
+      "expected": {
+        "conflict": true,
+        "because": [
+          "overlapping ranges"
+        ]
+      }
+    },
+    {
+      "label": "one prev with two children (2..3 and 2..4 after 1..1)",
+      "a": {
+        "by": "018f47a0-7b21-7abc-8def-a77e57000001",
+        "room": "team-room",
+        "fromSeq": 2,
+        "uptoSeq": 3,
+        "prev": "665f361a8e9344ee5ed38380daa454581bb929d581f7a4fed7fb7131f37197ba",
+        "root": "4412f69bb56e5256fe612ff5fbc1e550b4cc773a3f44fcd589f2727ff2eae44f",
+        "at": 1786611603500,
+        "sigAlg": "ed25519",
+        "sig": "zEZkjFio9Tsndr597PVPosp3XF2GRTWZzohifCkjDT9C2Hm-8d0eGE2k5uYgqBPN62r6iMNWwuRow4E994dKAg"
+      },
+      "b": {
+        "by": "018f47a0-7b21-7abc-8def-a77e57000001",
+        "room": "team-room",
+        "fromSeq": 2,
+        "uptoSeq": 4,
+        "prev": "665f361a8e9344ee5ed38380daa454581bb929d581f7a4fed7fb7131f37197ba",
+        "root": "701c741e614e3fd3d58da1ac1f26a7df1b47e3df7d7c3e30886b06d614882cc8",
+        "at": 1786611604600,
+        "sigAlg": "ed25519",
+        "sig": "0aYueP2FoJ7T26ybPJvNsdR9UpjdzVpzT66OcO9C7KyVJOAsukSj6Cr7GFJcAbOctaeMmKXVbAFH9-PafvlpDA"
+      },
+      "expected": {
+        "conflict": true,
+        "because": [
+          "overlapping ranges",
+          "same prev"
+        ]
+      }
+    }
+  ],
+  "notConflicts": [
+    {
+      "label": "consecutive checkpoints of one chain",
+      "a": {
+        "by": "018f47a0-7b21-7abc-8def-a77e57000001",
+        "room": "team-room",
+        "fromSeq": 1,
+        "uptoSeq": 1,
+        "prev": "genesis",
+        "root": "665f361a8e9344ee5ed38380daa454581bb929d581f7a4fed7fb7131f37197ba",
+        "at": 1786611601500,
+        "sigAlg": "ed25519",
+        "sig": "iUowNBs6Ht1_37-a_NkOZEUWuwvSv_Q3-dG6shKRDXivFOQORFALEETUYF-Clw2bUMnWe7-T1IyTRn8dlmuRBw"
+      },
+      "b": {
+        "by": "018f47a0-7b21-7abc-8def-a77e57000001",
+        "room": "team-room",
+        "fromSeq": 2,
+        "uptoSeq": 3,
+        "prev": "665f361a8e9344ee5ed38380daa454581bb929d581f7a4fed7fb7131f37197ba",
+        "root": "4412f69bb56e5256fe612ff5fbc1e550b4cc773a3f44fcd589f2727ff2eae44f",
+        "at": 1786611603500,
+        "sigAlg": "ed25519",
+        "sig": "zEZkjFio9Tsndr597PVPosp3XF2GRTWZzohifCkjDT9C2Hm-8d0eGE2k5uYgqBPN62r6iMNWwuRow4E994dKAg"
+      },
+      "expected": {
+        "conflict": false,
+        "because": []
+      }
+    },
+    {
+      "label": "the same checkpoint signed again later: a duplicate, not a conflict",
+      "a": {
+        "by": "018f47a0-7b21-7abc-8def-a77e57000001",
+        "room": "team-room",
+        "fromSeq": 4,
+        "uptoSeq": 6,
+        "prev": "4412f69bb56e5256fe612ff5fbc1e550b4cc773a3f44fcd589f2727ff2eae44f",
+        "root": "325f034f4997191a61125f3d5eeaf5953d6a269faaa7f78c0b9b174d7d0b6a0a",
+        "at": 1786611606500,
+        "sigAlg": "ed25519",
+        "sig": "xV47BgwYlhtTL-4UzIhJb3GRlGtMJyDnScpiaKG-AyCymUUyTUHuWJrUjJVcXUZkglZALlpErekwnGsqwOQUAA"
+      },
+      "b": {
+        "by": "018f47a0-7b21-7abc-8def-a77e57000001",
+        "room": "team-room",
+        "fromSeq": 4,
+        "uptoSeq": 6,
+        "prev": "4412f69bb56e5256fe612ff5fbc1e550b4cc773a3f44fcd589f2727ff2eae44f",
+        "root": "325f034f4997191a61125f3d5eeaf5953d6a269faaa7f78c0b9b174d7d0b6a0a",
+        "at": 1786611609000,
+        "sigAlg": "ed25519",
+        "sig": "DylaTWwzn9Ga3glO6bJQ5wEDHvUdMDtTQEXaVUN35Uy2P0-vI43UtYkUCGBJH2rYjkBtfdw3tJbH6j-iQJPmBA"
+      },
+      "expected": {
+        "conflict": false,
+        "because": []
+      }
+    }
+  ],
+  "linkChecks": [
+    {
+      "label": "a checkpoint whose prev is held but which does not start right after it: malformed, not evidence",
+      "checkpoint": {
+        "by": "018f47a0-7b21-7abc-8def-a77e57000001",
+        "room": "team-room",
+        "fromSeq": 3,
+        "uptoSeq": 3,
+        "prev": "665f361a8e9344ee5ed38380daa454581bb929d581f7a4fed7fb7131f37197ba",
+        "root": "a105d7794427d371313e8496f4a8c9db38aeeac5cc36277949e20365b327e37f",
+        "at": 1786611603700,
+        "sigAlg": "ed25519",
+        "sig": "Mny8Li_LJFZQ350GjYgSMC1MjJowxjjtyHfrdqWOFYcdVZjIIGHZUv8u8-LLK7pgNqKf2cfJVMuZC1NHQRHJDA"
+      },
+      "prev": {
+        "by": "018f47a0-7b21-7abc-8def-a77e57000001",
+        "room": "team-room",
+        "fromSeq": 1,
+        "uptoSeq": 1,
+        "prev": "genesis",
+        "root": "665f361a8e9344ee5ed38380daa454581bb929d581f7a4fed7fb7131f37197ba",
+        "at": 1786611601500,
+        "sigAlg": "ed25519",
+        "sig": "iUowNBs6Ht1_37-a_NkOZEUWuwvSv_Q3-dG6shKRDXivFOQORFALEETUYF-Clw2bUMnWe7-T1IyTRn8dlmuRBw"
+      },
+      "expected": {
+        "valid": false
+      }
+    },
+    {
+      "label": "a reversed range: refused",
+      "checkpoint": {
+        "by": "018f47a0-7b21-7abc-8def-a77e57000001",
+        "room": "team-room",
+        "fromSeq": 3,
+        "uptoSeq": 2,
+        "prev": "665f361a8e9344ee5ed38380daa454581bb929d581f7a4fed7fb7131f37197ba",
+        "root": "4412f69bb56e5256fe612ff5fbc1e550b4cc773a3f44fcd589f2727ff2eae44f",
+        "at": 1786611603500,
+        "sigAlg": "ed25519",
+        "sig": "zEZkjFio9Tsndr597PVPosp3XF2GRTWZzohifCkjDT9C2Hm-8d0eGE2k5uYgqBPN62r6iMNWwuRow4E994dKAg"
+      },
+      "prev": {
+        "by": "018f47a0-7b21-7abc-8def-a77e57000001",
+        "room": "team-room",
+        "fromSeq": 1,
+        "uptoSeq": 1,
+        "prev": "genesis",
+        "root": "665f361a8e9344ee5ed38380daa454581bb929d581f7a4fed7fb7131f37197ba",
+        "at": 1786611601500,
+        "sigAlg": "ed25519",
+        "sig": "iUowNBs6Ht1_37-a_NkOZEUWuwvSv_Q3-dG6shKRDXivFOQORFALEETUYF-Clw2bUMnWe7-T1IyTRn8dlmuRBw"
+      },
+      "expected": {
+        "valid": false
+      }
+    },
+    {
+      "label": "the honest second checkpoint: valid",
+      "checkpoint": {
+        "by": "018f47a0-7b21-7abc-8def-a77e57000001",
+        "room": "team-room",
+        "fromSeq": 2,
+        "uptoSeq": 3,
+        "prev": "665f361a8e9344ee5ed38380daa454581bb929d581f7a4fed7fb7131f37197ba",
+        "root": "4412f69bb56e5256fe612ff5fbc1e550b4cc773a3f44fcd589f2727ff2eae44f",
+        "at": 1786611603500,
+        "sigAlg": "ed25519",
+        "sig": "zEZkjFio9Tsndr597PVPosp3XF2GRTWZzohifCkjDT9C2Hm-8d0eGE2k5uYgqBPN62r6iMNWwuRow4E994dKAg"
+      },
+      "prev": {
+        "by": "018f47a0-7b21-7abc-8def-a77e57000001",
+        "room": "team-room",
+        "fromSeq": 1,
+        "uptoSeq": 1,
+        "prev": "genesis",
+        "root": "665f361a8e9344ee5ed38380daa454581bb929d581f7a4fed7fb7131f37197ba",
+        "at": 1786611601500,
+        "sigAlg": "ed25519",
+        "sig": "iUowNBs6Ht1_37-a_NkOZEUWuwvSv_Q3-dG6shKRDXivFOQORFALEETUYF-Clw2bUMnWe7-T1IyTRn8dlmuRBw"
+      },
+      "expected": {
+        "valid": true
+      }
+    }
+  ]
+}
diff --git a/tests/gossip-budget.test.js b/tests/gossip-budget.test.js
index 4a8fb966..9bcca9c2 100644
--- a/tests/gossip-budget.test.js
+++ b/tests/gossip-budget.test.js
@@ -73,11 +73,11 @@ function* busyRoom(keys, G, seconds) {
         seq.set(k.id, n);
         frames.push(attestation(k, n));
         if (n % 8 === 0) {
-          const cp = signed({ type: 'checkpoint', by: k.id, roster: ROOM, upto_seq: n, root: `root-${k.id}-${n}`, at: n }, k.priv, signCheckpoint);
+          const cp = signed({ type: 'checkpoint', by: k.id, roster: ROOM, from_seq: n, upto_seq: n, prev: (n) === 1 ? 'genesis' : `p${n}`, root: `root-${k.id}-${n}`, at: n }, k.priv, signCheckpoint);
           frames.push({ type: 'checkpoint', checkpoint: cp });
           for (const w of keys) {
             if (w === k) continue;
-            frames.push({ type: 'witness', witness: signed({ type: 'witness', attester: k.id, roster: ROOM, upto_seq: n, root: cp.root, by: w.id, role: 'participant', at: n }, w.priv, signWitness) });
+            frames.push({ type: 'witness', witness: signed({ type: 'witness', attester: k.id, roster: ROOM, from_seq: n, upto_seq: n, root: cp.root, by: w.id, role: 'participant', at: n }, w.priv, signWitness) });
           }
         }
       }
@@ -139,11 +139,11 @@ describe('gossip budget — only new statements spend it', () => {
       const spent = () => node._gossipNewLane - tokens();
       // One of each held: an attestation, a checkpoint and its witness, a conflict, a waiting witness.
       const att = attestation(A, 1);
-      const cp = signed({ type: 'checkpoint', by: A.id, roster: ROOM, upto_seq: 8, root: 'r8', at: 1 }, A.priv, signCheckpoint);
-      const fork = signed({ type: 'checkpoint', by: A.id, roster: ROOM, upto_seq: 8, root: 'forked', at: 2 }, A.priv, signCheckpoint);
-      const wit = signed({ type: 'witness', attester: A.id, roster: ROOM, upto_seq: 8, root: 'r8', by: W.id, role: 'participant', at: 1 }, W.priv, signWitness);
-      const witFork = signed({ type: 'witness', attester: A.id, roster: ROOM, upto_seq: 8, root: 'forked', by: W.id, role: 'participant', at: 2 }, W.priv, signWitness);
-      const waiting = signed({ type: 'witness', attester: X.id, roster: ROOM, upto_seq: 16, root: 'r16', by: W.id, role: 'participant', at: 1 }, W.priv, signWitness);
+      const cp = signed({ type: 'checkpoint', by: A.id, roster: ROOM, from_seq: 8, upto_seq: 8, prev: (8) === 1 ? 'genesis' : `p${8}`, root: 'r8', at: 1 }, A.priv, signCheckpoint);
+      const fork = signed({ type: 'checkpoint', by: A.id, roster: ROOM, from_seq: 8, upto_seq: 8, prev: (8) === 1 ? 'genesis' : `p${8}`, root: 'forked', at: 2 }, A.priv, signCheckpoint);
+      const wit = signed({ type: 'witness', attester: A.id, roster: ROOM, from_seq: 8, upto_seq: 8, root: 'r8', by: W.id, role: 'participant', at: 1 }, W.priv, signWitness);
+      const witFork = signed({ type: 'witness', attester: A.id, roster: ROOM, from_seq: 8, upto_seq: 8, root: 'forked', by: W.id, role: 'participant', at: 2 }, W.priv, signWitness);
+      const waiting = signed({ type: 'witness', attester: X.id, roster: ROOM, from_seq: 16, upto_seq: 16, root: 'r16', by: W.id, role: 'participant', at: 1 }, W.priv, signWitness);
       for (const f of [att, { type: 'checkpoint', checkpoint: cp }, { type: 'checkpoint', checkpoint: fork }, { type: 'witness', witness: wit }, { type: 'witness', witness: witFork }, { type: 'witness', witness: waiting }]) ingest(node, 'p', f);
       assert.strictEqual(node._attestations.hasConflict(A.id, 8), true);
       assert.strictEqual(node._attestations.witnessSeen(X.id, 16, W.id).root, 'r16', 'one waits for its checkpoint');
@@ -176,10 +176,11 @@ describe('gossip budget — only new statements spend it', () => {
 
   it('a checkpoint older than every position held is dropped before it', () => {
     withNode(1, ({ node, keys: [A] }) => {
-      for (let n = 1; n <= 32; n++) ingest(node, 'p', { type: 'checkpoint', checkpoint: signed({ type: 'checkpoint', by: A.id, roster: ROOM, upto_seq: 100 + n, root: `r${n}`, at: n }, A.priv, signCheckpoint) });
+      for (let n = 1; n <= 32; n++) ingest(node, 'p', { type: 'checkpoint', checkpoint: signed({ type: 'checkpoint', by: A.id, roster: ROOM, from_seq: 100 + n, upto_seq: 100 + n, prev: (100 + n) === 1 ? 'genesis' : `p${100 + n}`, root: `r${n}`, at: n }, A.priv, signCheckpoint) });
       const spent = node._gossipNewLane - node._gossipBuckets.get('p').tokens;
       for (let i = 0; i < 1000; i++) {
-        const r = ingest(node, 'p', { type: 'checkpoint', checkpoint: { type: 'checkpoint', by: A.id, roster: ROOM, upto_seq: i % 100, root: 'old', at: 1, sig: forgedSig() } });
+        const pos = (i % 99) + 1;
+        const r = ingest(node, 'p', { type: 'checkpoint', checkpoint: { type: 'checkpoint', by: A.id, roster: ROOM, from_seq: pos, upto_seq: pos, prev: pos === 1 ? 'genesis' : `p${pos}`, root: 'old', at: 1, sig: forgedSig() } });
         assert.strictEqual(r.reason, 'stale');
       }
       assert.strictEqual(node._gossipNewLane - node._gossipBuckets.get('p').tokens, spent);
@@ -228,7 +229,7 @@ describe('gossip budget — what it reports, and what it keeps', () => {
       const t0 = clock.t;
       for (let i = 0; i < 40000; i++) {
         clock.t = t0 + Math.floor(i / 8);   // 8,000 a second for 5 s
-        const f = i % 2 ? forgedAttestation(keys[i % 2]) : { type: 'witness', witness: { type: 'witness', attester: 'x', roster: ROOM, upto_seq: i, root: 'r', by: keys[0].id, role: 'participant', at: 1, sig: forgedSig() } };
+        const f = i % 2 ? forgedAttestation(keys[i % 2]) : { type: 'witness', witness: { type: 'witness', attester: 'x', roster: ROOM, from_seq: i, upto_seq: i, root: 'r', by: keys[0].id, role: 'participant', at: 1, sig: forgedSig() } };
         if (ingest(node, 'flooder', f).reason === 'over-budget') dropped++;
       }
       assert.ok(dropped > 10000, `${dropped} dropped`);
@@ -336,8 +337,8 @@ describe('signature spelling', () => {
 
   it('a checkpoint or witness not spelled canonically is refused too, before any signature check', () => {
     withNode(2, ({ node, keys: [A, W] }) => {
-      const cp = signed({ type: 'checkpoint', by: A.id, roster: ROOM, upto_seq: 8, root: 'r8', at: 1 }, A.priv, signCheckpoint);
-      const w = signed({ type: 'witness', attester: A.id, roster: ROOM, upto_seq: 8, root: 'r8', by: W.id, role: 'participant', at: 1 }, W.priv, signWitness);
+      const cp = signed({ type: 'checkpoint', by: A.id, roster: ROOM, from_seq: 8, upto_seq: 8, prev: (8) === 1 ? 'genesis' : `p${8}`, root: 'r8', at: 1 }, A.priv, signCheckpoint);
+      const w = signed({ type: 'witness', attester: A.id, roster: ROOM, from_seq: 8, upto_seq: 8, root: 'r8', by: W.id, role: 'participant', at: 1 }, W.priv, signWitness);
       assert.strictEqual(node._ingestCheckpoint({ ...cp, sig: `${cp.sig}=` }, 'm').reason, 'non-canonical-signature');
       assert.strictEqual(node._ingestWitness({ ...w, sig: ` ${w.sig}` }, 'm').reason, 'non-canonical-signature');
       assert.strictEqual(node._gossipBuckets.has('m'), false);
@@ -354,7 +355,7 @@ describe('signature spelling', () => {
       node._gossipToRoster = (f) => sent.push(f);
       const verdicts = { focus: 'admit', issue: 'admit', intent: 'admit', motivation: 'admit', commitment: 'admit', perspective: 'admit', mood: 'admit' };
       for (let i = 0; i < 200; i++) assert.ok(node._buildAdmissionAttestation(`cmb-own-${i}`, 'aligned', verdicts, 'heuristic'));
-      node._ingestCheckpoint(signed({ type: 'checkpoint', by: A.id, roster: ROOM, upto_seq: 8, root: 'r8', at: 1 }, A.priv, signCheckpoint), 'p');
+      node._ingestCheckpoint(signed({ type: 'checkpoint', by: A.id, roster: ROOM, from_seq: 8, upto_seq: 8, prev: (8) === 1 ? 'genesis' : `p${8}`, root: 'r8', at: 1 }, A.priv, signCheckpoint), 'p');
       const ownFrames = sent.filter((f) => (f.attestation || f.checkpoint || f.witness).by === node.nodeId);
       assert.deepStrictEqual([...new Set(ownFrames.map((f) => f.type))].sort(), ['sym-attest-attestation', 'sym-attest-checkpoint', 'sym-attest-witness']);
       const own = ownFrames.map((f) => f.attestation || f.checkpoint || f.witness);
@@ -364,7 +365,7 @@ describe('signature spelling', () => {
       const seq = node._attestSeq;
       const before = sent.length;
       const cps = node._attestations.checkpointsOf(node.nodeId).length;
-      const cp16 = signed({ type: 'checkpoint', by: A.id, roster: ROOM, upto_seq: 16, root: 'r16', at: 2 }, A.priv, signCheckpoint);
+      const cp16 = signed({ type: 'checkpoint', by: A.id, roster: ROOM, from_seq: 16, upto_seq: 16, prev: (16) === 1 ? 'genesis' : `p${16}`, root: 'r16', at: 2 }, A.priv, signCheckpoint);
       crypto.sign = (...a) => realSign(...a).subarray(0, 63);
       try {
         assert.strictEqual(node._buildAdmissionAttestation('cmb-short', 'aligned', verdicts, 'heuristic'), null);
diff --git a/tests/gossip-lanes.test.js b/tests/gossip-lanes.test.js
index adda3320..ce344b20 100644
--- a/tests/gossip-lanes.test.js
+++ b/tests/gossip-lanes.test.js
@@ -277,8 +277,8 @@ describe('an over-long signature (F5)', () => {
       const has = node._attestations.has.bind(node._attestations);
       node._attestations.has = (sig) => { lookups++; return has(sig); };
       const att = signed({ of: 'cmb-1', by: A.id, at: 1, roster: ROOM, method: 'heuristic', verdict: 'aligned', categories: {}, role: 'participant', seq: 1, prev: 'p' }, A.priv, signAttestation);
-      const cp = signed({ type: 'checkpoint', by: A.id, roster: ROOM, upto_seq: 8, root: 'r8', at: 1 }, A.priv, signCheckpoint);
-      const w = signed({ type: 'witness', attester: A.id, roster: ROOM, upto_seq: 8, root: 'r8', by: W.id, role: 'participant', at: 1 }, W.priv, signWitness);
+      const cp = signed({ type: 'checkpoint', by: A.id, roster: ROOM, from_seq: 8, upto_seq: 8, prev: (8) === 1 ? 'genesis' : `p${8}`, root: 'r8', at: 1 }, A.priv, signCheckpoint);
+      const w = signed({ type: 'witness', attester: A.id, roster: ROOM, from_seq: 8, upto_seq: 8, root: 'r8', by: W.id, role: 'participant', at: 1 }, W.priv, signWitness);
       const ingest = (sig) => [
         node._ingestAttestation({ ...att, sig }, 'p', 'p').reason,
         node._ingestCheckpoint({ ...cp, sig }, 'p').reason,
@@ -302,11 +302,11 @@ describe('an over-long signature (F5)', () => {
 });
 
 describe('equivocation at one position (F6)', () => {
-  it('a further root for a conflicted position is dropped before the budget and the signature; the first conflict is kept although the rate is spent', () => {
+  it('after a conflict the attester\'s further checkpoints are dropped before the budget and the signature; the first conflict is kept although the rate is spent', () => {
     withNode({ checkpointRate: { perSecond: 4, burst: 2 } }, ({ node, sent, metrics }) => {
       const A = kp('att-A');
       node._roster.bind(A.id, A.pub, 'proven');
-      const cp = (seq, root) => signed({ type: 'checkpoint', by: A.id, roster: ROOM, upto_seq: seq, root, at: seq }, A.priv, signCheckpoint);
+      const cp = (seq, root) => signed({ type: 'checkpoint', by: A.id, roster: ROOM, from_seq: seq, upto_seq: seq, prev: (seq) === 1 ? 'genesis' : `p${seq}`, root, at: seq }, A.priv, signCheckpoint);
       const ingest = (c) => node._ingestCheckpoint(c, 'p');
       assert.deepStrictEqual([ingest(cp(8, 'r8')).ok, ingest(cp(16, 'r16')).ok, ingest(cp(24, 'r24')).reason], [true, true, 'over-rate'], "the attester's rate is spent");
       const relayed = sent.length;
@@ -317,7 +317,7 @@ describe('equivocation at one position (F6)', () => {
       const tokens = node._gossipBuckets.get('p').tokens;
       for (let i = 0; i < 2000; i++) {
         const third = i % 2 ? { ...cp(8, 'r8'), root: `fork-${i}`, sig: forgedSig() } : cp(8, `fork-${i}`);
-        assert.strictEqual(ingest(third).reason, 'conflict');
+        assert.strictEqual(ingest(third).reason, 'attester-equivocated', 'sym-attest-v1 §6 step 6 (update 1): dropped unverified');
       }
       assert.strictEqual(node._gossipBuckets.get('p').tokens, tokens, 'a third root spends nothing: no signature is checked');
       assert.strictEqual(node._attestations.conflictAt(A.id, 8).root, 'forked', 'and changes nothing');
@@ -380,7 +380,7 @@ describe('part A2 review suggestions', () => {
       node._log = (m) => logs.push(m);
       const A = kp('att-A');
       node._roster.bind(A.id, A.pub, 'proven');
-      const cp = (seq) => signed({ type: 'checkpoint', by: A.id, roster: ROOM, upto_seq: seq, root: `r${seq}`, at: seq }, A.priv, signCheckpoint);
+      const cp = (seq) => signed({ type: 'checkpoint', by: A.id, roster: ROOM, from_seq: seq, upto_seq: seq, prev: (seq) === 1 ? 'genesis' : `p${seq}`, root: `r${seq}`, at: seq }, A.priv, signCheckpoint);
       assert.strictEqual(node._ingestCheckpoint(cp(8), 'peer-one-xyz').ok, true);
       assert.strictEqual(node._ingestCheckpoint(cp(16), 'peer-two-xyz').reason, 'over-rate');
       assert.ok(logs.some((l) => /over their rate .* brought by peer-two/.test(l)), logs.join('\n'));
diff --git a/tests/relay-state.test.js b/tests/relay-state.test.js
index 6ec12607..655bca63 100644
--- a/tests/relay-state.test.js
+++ b/tests/relay-state.test.js
@@ -236,6 +236,21 @@ test('relay-auth names the nodeId in its lowercase form; a closed socket forgets
   } finally { c.stop(); await relay.close(); }
 });
 
+test('relay-auth and relay-pong are paced inside the bucket (MMP 2.0 update 1, §19.1 headroom)', async () => {
+  const at = [];
+  const relay = fakeRelay((ws, n) => {
+    at.push(Date.now());
+    if (n === 1) { ws.send(JSON.stringify({ type: 'relay-peers', peers: [] })); ws.send(JSON.stringify({ type: 'relay-ping' })); }
+  });
+  const c = client(relay.url, { rate: { perSecond: 4, burst: 1 } });
+  try {
+    c.rc.connect();
+    for (let t = 0; t < 3000 && at.length < 2; t += 10) await wait(10);
+    assert.strictEqual(at.length, 2, 'the auth, then the pong');
+    assert.ok(at[1] - at[0] >= 200, `the pong waited for a token (${at[1] - at[0]} ms after the auth, at 4 a second, burst 1)`);
+  } finally { c.stop(); await relay.close(); }
+});
+
 test('a socket destroy() let go never schedules a reconnect when its close arrives', async () => {
   const relay = fakeRelay((ws) => ws.send(JSON.stringify({ type: 'relay-peers', peers: [] })));
   const c = client(relay.url);
diff --git a/tests/spec-update-attest-chain.test.js b/tests/spec-update-attest-chain.test.js
new file mode 100644
index 00000000..aac71ff4
--- /dev/null
+++ b/tests/spec-update-attest-chain.test.js
@@ -0,0 +1,208 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME before lib/config loads
+
+/**
+ * sym-attest-v1's chained checkpoint (MMP 2.0 update 1, PR #43 at 5417176; D1): every case of the
+ * draft sym-attest-v1 vector against sym's own constructions and the reference lib.mjs, then the
+ * store's and the node's rules — link checks, equivocation as overlapping ranges or a shared prev, no
+ * witnessing an attester after a conflict, a chain that ends visibly when its segment is lost. Each
+ * test fails on bacab72.
+ */
+
+const { describe, it, before } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+const core = require('../lib/core');
+const { AttestationStore } = require('../lib/attestation-store');
+const { SymNode } = require('../lib/node');
+const { NullDiscovery } = require('../lib/discovery');
+const { nodeDirById } = require('../lib/config');
+const { identity, admitAs } = require('./_core-secure');
+
+const FIX = path.join(__dirname, 'fixtures');
+const sources = JSON.parse(fs.readFileSync(path.join(FIX, 'SOURCES.json'), 'utf8'));
+function vendored(name) {
+  const bytes = fs.readFileSync(path.join(FIX, name));
+  assert.strictEqual(crypto.createHash('sha256').update(bytes).digest('hex'), sources.files[name].sha256);
+  return JSON.parse(bytes.toString('utf8'));
+}
+const V = vendored('sym-attest-v1.json');
+const KEY = { attester: V.testKeys.attester.publicKeyBase64url, witness: V.testKeys.witness.publicKeyBase64url };
+const segmentOf = (atts, cp) => atts.map((x) => x.attestation).filter((a) => a.seq >= cp.fromSeq && a.seq <= cp.uptoSeq).sort((a, b) => a.seq - b.seq);
+const store = (cp) => core.fromWireCheckpoint(cp);
+
+describe('the sym-attest-v1 vector: the four signed constructions and the chained root', () => {
+  let L;
+  before(async () => { L = await import(path.join(FIX, 'mmp-lib.mjs')); });
+
+  for (const [label, list] of [['attestations', V.attestations], ['forkAttestations', V.forkAttestations]]) {
+    it(`${label}: payload bytes, signature and chain link`, () => {
+      for (const x of list) {
+        const a = core.fromWireAttestation(x.attestation);
+        assert.ok(a, 'the wire form is the schema\'s');
+        assert.strictEqual(core.attestationPayload(a).toString('hex'), x.payloadHex);
+        assert.strictEqual(core.verifyAttestation(a, KEY.attester).valid, true);
+        if (x.chainLinkOfThis) assert.strictEqual(core.chainLink(a.sig), x.chainLinkOfThis);
+        assert.deepStrictEqual(core.attestationPayload(a), L.attestationPayloadV1(x.attestation));
+      }
+    });
+  }
+
+  it('checkpoints: 1-, 2- and 3-leaf segments, the chained root, the payload and the signature', () => {
+    for (const [list, atts] of [[V.checkpoints, V.attestations], [Object.values(V.forkCheckpoints), V.forkAttestations]]) {
+      for (const x of list) {
+        const cp = x.checkpoint;
+        const sigs = segmentOf(atts, cp).map((a) => a.sig);
+        assert.strictEqual(sigs.length, cp.uptoSeq - cp.fromSeq + 1, 'the whole segment is in the vector');
+        assert.strictEqual(core.attestMerkleRoot(sigs), x.segmentRootHex);
+        assert.strictEqual(L.attestSegmentRoot(sigs), x.segmentRootHex);
+        const root = core.attestCheckpointRoot({ prev: cp.prev, fromSeq: cp.fromSeq, uptoSeq: cp.uptoSeq, segmentRoot: x.segmentRootHex });
+        assert.strictEqual(root, cp.root);
+        assert.strictEqual(L.attestCheckpointRoot({ prev: cp.prev, fromSeq: cp.fromSeq, uptoSeq: cp.uptoSeq, segmentRoot: x.segmentRootHex }), cp.root);
+        const held = store(cp);
+        assert.ok(held, 'the wire form is the schema\'s');
+        assert.strictEqual(core.checkpointPayload(held).toString('hex'), x.payloadHex);
+        assert.deepStrictEqual(core.checkpointPayload(held), L.attestCheckpointPayloadV1(cp));
+        assert.strictEqual(core.verifyCheckpoint(held, KEY.attester).valid, true);
+      }
+    }
+    assert.deepStrictEqual(V.checkpoints.map((x) => x.checkpoint.uptoSeq - x.checkpoint.fromSeq + 1), [1, 2, 3]);
+    for (let i = 1; i < V.checkpoints.length; i++) {
+      assert.strictEqual(V.checkpoints[i].checkpoint.prev, V.checkpoints[i - 1].checkpoint.root, 'chained to the one before');
+      assert.strictEqual(V.checkpoints[i].checkpoint.fromSeq, V.checkpoints[i - 1].checkpoint.uptoSeq + 1);
+    }
+  });
+
+  it('the witness carries and signs fromSeq', async () => {
+    const w = core.fromWireWitness(V.witness.witness);
+    assert.ok(w);
+    assert.strictEqual(core.witnessPayload(w).toString('hex'), V.witness.payloadHex);
+    assert.deepStrictEqual(core.witnessPayload(w), L.attestWitnessPayloadV1(V.witness.witness));
+    assert.strictEqual(core.verifyWitness(w, KEY.witness).valid, true);
+    assert.strictEqual(core.verifyWitness({ ...w, from_seq: w.from_seq + 1 }, KEY.witness).valid, false, 'fromSeq is signed');
+  });
+
+  it('conflicts: overlapping ranges or a shared prev, never the same checkpoint or a chain', () => {
+    for (const c of V.conflicts) {
+      const because = core.checkpointConflict(store(c.a), store(c.b));
+      assert.deepStrictEqual(because.sort(), [...c.expected.because].sort(), c.label);
+      assert.deepStrictEqual(because.sort(), L.attestCheckpointConflict(c.a, c.b).sort());
+    }
+    for (const c of V.notConflicts) {
+      assert.deepStrictEqual(core.checkpointConflict(store(c.a), store(c.b)), [], c.label);
+      assert.deepStrictEqual(L.attestCheckpointConflict(c.a, c.b), []);
+    }
+  });
+
+  it('link checks: malformed, not evidence', () => {
+    for (const c of V.linkChecks) {
+      // A reversed range is refused at the wire already; the rule is checked on the raw shape too.
+      const cp = { ...c.checkpoint, from_seq: c.checkpoint.fromSeq, upto_seq: c.checkpoint.uptoSeq };
+      const prev = c.prev ? { ...c.prev, from_seq: c.prev.fromSeq, upto_seq: c.prev.uptoSeq } : null;
+      assert.strictEqual(core.checkpointLinkValid(cp, prev), c.expected.valid, c.label);
+      assert.strictEqual(L.attestCheckpointLinkValid(c.checkpoint, c.prev || null), c.expected.valid);
+    }
+  });
+});
+
+describe('the store holds one chain per attester (§5.2)', () => {
+  const s = () => new AttestationStore({});
+  it('the vector\'s chain is taken in order; each conflicting pair\'s second copy is evidence, and then the attester is dropped', () => {
+    const st = s();
+    for (const x of V.checkpoints) assert.strictEqual(st.recordCheckpoint(store(x.checkpoint)).stored, true);
+    for (const c of V.conflicts) {
+      const t = s();
+      assert.strictEqual(t.recordCheckpoint(store(c.a)).stored, true, `${c.label}: the first is held`);
+      const r = t.recordCheckpoint(store(c.b));
+      assert.strictEqual(r.reason, 'conflict', c.label);
+      assert.strictEqual(r.first, true);
+      assert.strictEqual(t.attesterEquivocated(c.a.by), true);
+      // A later checkpoint from that attester adds nothing.
+      const later = store({ ...V.checkpoints[2].checkpoint, fromSeq: 7, uptoSeq: 7, prev: V.checkpoints[2].checkpoint.root });
+      assert.strictEqual(t.recordCheckpoint(later).reason, 'attester-equivocated');
+    }
+  });
+  it('a checkpoint that does not start right after the one its prev names is malformed, not evidence', () => {
+    const c = V.linkChecks[0];
+    const st = s();
+    assert.strictEqual(st.recordCheckpoint(store(c.prev)).stored, true);
+    assert.strictEqual(st.recordCheckpoint(store(c.checkpoint)).reason, 'malformed-link');
+    assert.strictEqual(st.attesterEquivocated(c.prev.by), false);
+  });
+  it('a witness naming another range or root than the checkpoint held is refused, and never frames the attester', () => {
+    const st = s();
+    for (const x of V.checkpoints) st.recordCheckpoint(store(x.checkpoint));
+    const w = core.fromWireWitness(V.witness.witness);
+    assert.strictEqual(st.recordWitness(w).stored, true);
+    const other = { ...w, by: '018f47a0-7b21-7abc-8def-a77e57000003', from_seq: 5, sig: w.sig.replace(/^./, (ch) => (ch === 'A' ? 'B' : 'A')) };
+    assert.strictEqual(st.recordWitness(other).reason, 'disagrees');
+    assert.strictEqual(st.attesterEquivocated(w.attester), false);
+  });
+});
+
+describe('the node chains its own checkpoints and stops witnessing an equivocating attester', () => {
+  const made = [];
+  const mk = (b, o = {}) => { const n = new SymNode({ name: `${b}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`, silent: true, discovery: new NullDiscovery(), room: 'team-room', checkpointInterval: 0, ...o }); made.push(n); return n; };
+  const stopAll = async () => { for (const n of made.splice(0)) { try { await n.stop(); } catch { /* */ } try { fs.rmSync(nodeDirById(n.nodeId), { recursive: true, force: true }); } catch { /* */ } } };
+  const CATS7 = { focus: 'admit', issue: 'admit', intent: 'admit', motivation: 'admit', commitment: 'admit', perspective: 'admit', mood: 'admit' };
+  const hex = () => crypto.randomBytes(32).toString('hex');
+  const attest = (n) => n._buildAdmissionAttestation(`cmb-${hex()}`, 'aligned', CATS7, 'heuristic', `asrt-${hex()}`);
+
+  it('each checkpoint covers the segment since the last, chained to its root, and verifies as the vector\'s do', async () => {
+    try {
+      const A = mk('chain');
+      for (let i = 0; i < 3; i++) attest(A);
+      const c1 = A._emitCheckpoint();
+      for (let i = 0; i < 2; i++) attest(A);
+      const c2 = A._emitCheckpoint();
+      assert.deepStrictEqual([c1.from_seq, c1.upto_seq, c1.prev], [1, 3, 'genesis']);
+      assert.deepStrictEqual([c2.from_seq, c2.upto_seq, c2.prev], [4, 5, c1.root]);
+      const seg = A._attestations.chainOf(A.nodeId).filter((a) => a.seq >= 4).map((a) => a.sig);
+      assert.strictEqual(c2.root, core.attestCheckpointRoot({ prev: c1.root, fromSeq: 4, uptoSeq: 5, segmentRoot: core.attestMerkleRoot(seg) }));
+      assert.strictEqual(core.verifyCheckpoint(c2, A._identity.publicKey).valid, true);
+      assert.strictEqual(A._emitCheckpoint(), null, 'nothing new since the last');
+      assert.strictEqual(A.reconcileChain(A.nodeId).consistent, true);
+    } finally { await stopAll(); }
+  });
+
+  it('a lost segment ends the chain visibly: no root is signed over fewer', async () => {
+    try {
+      const A = mk('ended');
+      const metrics = [];
+      A.on('metric', (m) => { if (m.type === 'checkpoint-chain-ended') metrics.push(m); });
+      for (let i = 0; i < 3; i++) attest(A);
+      A._emitCheckpoint();
+      for (let i = 0; i < 3; i++) attest(A);
+      const full = A._attestations.chainOf(A.nodeId);
+      A._attestations.chainOf = () => full.filter((a) => a.seq !== 5); // the store lost seq 5
+      assert.strictEqual(A._emitCheckpoint(), null);
+      assert.strictEqual(metrics.length, 1);
+      A._attestations.chainOf = () => full;
+      assert.strictEqual(A._emitCheckpoint(), null, 'and none is signed under that chain again');
+    } finally { await stopAll(); }
+  });
+
+  it('after a conflict this node never witnesses the attester again, and drops its further checkpoints unverified', async () => {
+    try {
+      const A = mk('witness');
+      const X = identity('x');
+      X.nodeId = V.testKeys.attester.nodeId; X.publicKey = KEY.attester;
+      A._roster.bind(X.nodeId, X.publicKey, 'pinned');
+      const witnessed = [];
+      A._gossipToRoster = (f) => { if (f.type === core.ATTEST_FRAME.witness) witnessed.push(f.witness); };
+      const s = admitAs(A, identity('relayer'));
+      const c = V.conflicts[1]; // overlapping ranges at different boundaries
+      assert.strictEqual(A._ingestCheckpoint(store(V.checkpoints[0].checkpoint), s.nodeId, s).ok, true);
+      assert.strictEqual(A._ingestCheckpoint(store(c.a), s.nodeId, s).ok, true);
+      assert.strictEqual(witnessed.length, 2, 'both witnessed before the conflict');
+      assert.strictEqual(A._ingestCheckpoint(store(c.b), s.nodeId, s).reason, 'conflict');
+      const later = store(V.checkpoints[2].checkpoint);
+      assert.strictEqual(A._ingestCheckpoint(later, s.nodeId, s).reason, 'attester-equivocated');
+      assert.strictEqual(witnessed.length, 2, 'nothing witnessed since');
+      assert.ok(witnessed.every((w) => Number.isInteger(w.fromSeq)), 'witnesses carry fromSeq');
+    } finally { await stopAll(); }
+  });
+});
diff --git a/tests/spec-update-attest.test.js b/tests/spec-update-attest.test.js
index c74dbfd2..b50bf3a1 100644
--- a/tests/spec-update-attest.test.js
+++ b/tests/spec-update-attest.test.js
@@ -118,7 +118,7 @@ describe('equivocation, the attester\'s role and checkpoints (#27)', () => {
       A._gossipToRoster = (f) => gossiped.push(f.type);
       A._witnessCheckpoint = () => {};
       const s = admitAs(A, identity('relayer'));
-      const cp = (root) => { const o = { type: 'checkpoint', by: X.nodeId, roster: A._room, upto_seq: 8, root, at: Date.now() }; signCheckpoint(o, X.privateKey); return o; };
+      const cp = (root) => { const o = { type: 'checkpoint', by: X.nodeId, roster: A._room, from_seq: 8, upto_seq: 8, prev: (8) === 1 ? 'genesis' : `p${8}`, root, at: Date.now() }; signCheckpoint(o, X.privateKey); return o; };
       assert.strictEqual(A._ingestCheckpoint(cp(hex()), s.nodeId, s).ok, true);
       assert.strictEqual(gossiped.length, 1);
       const r = A._ingestCheckpoint(cp(hex()), s.nodeId, s);
@@ -150,13 +150,13 @@ describe('equivocation, the attester\'s role and checkpoints (#27)', () => {
 
   it('no checkpoint root is signed over a suffix of this node\'s chain (D1)', async () => {
     try {
-      const A = node('d1');
+      const A = node('d1', { checkpointInterval: 0 });
       for (let i = 0; i < 3; i++) A._buildAdmissionAttestation(`cmb-${hex()}`, 'aligned', CATS7, 'heuristic', `asrt-${hex()}`);
       const full = A._attestations.chainOf(A.nodeId);
       assert.strictEqual(full.length, 3);
-      assert.ok(A._emitCheckpoint(), 'over the whole chain, a checkpoint');
-      A._attestations.chainOf = () => full.slice(1); // the store evicted seq 1
-      assert.strictEqual(A._emitCheckpoint(), null, 'over a suffix, none');
+      A._attestations.chainOf = () => full.slice(1); // the store evicted seq 1 before any checkpoint
+      assert.strictEqual(A._emitCheckpoint(), null, 'over a suffix, none: the chain starts at seq 1 or not at all');
+      // (The chained construction, tests/spec-update-attest-chain.test.js, carries this to every later segment.)
     } finally { await stopAll(); }
   });
 });
diff --git a/tests/spec-update-records.test.js b/tests/spec-update-records.test.js
index 530ab76e..6fb752a1 100644
--- a/tests/spec-update-records.test.js
+++ b/tests/spec-update-records.test.js
@@ -57,7 +57,8 @@ describe('record-projection-v2: the canonical signed projection (#34, D2)', () =
       if (!bySig.has(sig)) bySig.set(sig, new Set());
       bySig.get(sig).add(canonicalJSON(canonicalRecordV2_0(c.record)));
     }
-    assert.strictEqual(bySig.size, 2, 'two assertions among the accepted cases');
+    assert.ok(bySig.size >= 2, 'several assertions among the accepted cases');
+    assert.ok([...bySig.values()].some((forms) => forms.size === 1) && v.cases.filter((x) => x.expected.accepted).length > bySig.size, 'and some assertion comes in several variants');
     for (const forms of bySig.values()) assert.strictEqual(forms.size, 1);
   });
 
@@ -77,7 +78,8 @@ describe('record-projection-v2: the canonical signed projection (#34, D2)', () =
 
 describe('rooms, application.schema and the application member on receipt (MMP 2.0 update 1)', () => {
   const v = vendored('record-projection-v2.json');
-  const base = () => JSON.parse(JSON.stringify(v.cases[0].record));
+  // A published record with no application (record-projection-v2's own base case).
+  const base = () => JSON.parse(JSON.stringify(v.cases.find((c) => c.label.startsWith('valence, arousal and lineage.method')).record));
   it('a record whose room is not a §5.8 identifier is refused', () => {
     for (const room of ['Conformance-Room', 'cafe\u0301', 'caf\u00e9', 'x'.repeat(65), 'a b']) {
       const r = base(); r.metadata.room = room;
diff --git a/tests/sym-attest-v1.test.js b/tests/sym-attest-v1.test.js
index bf262a63..41ddaefe 100644
--- a/tests/sym-attest-v1.test.js
+++ b/tests/sym-attest-v1.test.js
@@ -51,11 +51,12 @@ describe('the signed constructions (sym-attest-v1 §5)', () => {
   });
 
   it('a checkpoint and a witness sign under their own tags; no signature verifies as another construction', () => {
-    const cp = { by: A.nodeId, roster: 'r', upto_seq: 8, root: hex('1'), at: 5 };
-    assert.ok(core.checkpointPayload(cp).equals(Buffer.concat([Buffer.from('mmp-attest-checkpoint-v1\n'), lp(A.nodeId), lp('r'), lp('8'), lp(hex('1')), lp('5')])));
+    // The chained checkpoint (MMP 2.0 update 1): fromSeq and prev are signed; so is a witness's fromSeq.
+    const cp = { by: A.nodeId, roster: 'r', from_seq: 5, upto_seq: 8, prev: hex('0'), root: hex('1'), at: 5 };
+    assert.ok(core.checkpointPayload(cp).equals(Buffer.concat([Buffer.from('mmp-attest-checkpoint-v1\n'), lp(A.nodeId), lp('r'), lp('5'), lp('8'), lp(hex('0')), lp(hex('1')), lp('5')])));
     const W = identity('witness');
-    const w = { attester: A.nodeId, roster: 'r', upto_seq: 8, root: hex('1'), by: W.nodeId, role: 'validator', at: 6 };
-    assert.ok(core.witnessPayload(w).equals(Buffer.concat([Buffer.from('mmp-attest-witness-v1\n'), lp(A.nodeId), lp('r'), lp('8'), lp(hex('1')), lp(W.nodeId), lp('validator'), lp('6')])));
+    const w = { attester: A.nodeId, roster: 'r', from_seq: 5, upto_seq: 8, root: hex('1'), by: W.nodeId, role: 'validator', at: 6 };
+    assert.ok(core.witnessPayload(w).equals(Buffer.concat([Buffer.from('mmp-attest-witness-v1\n'), lp(A.nodeId), lp('r'), lp('5'), lp('8'), lp(hex('1')), lp(W.nodeId), lp('validator'), lp('6')])));
     core.signCheckpoint(cp, A.privateKey);
     assert.strictEqual(core.verifyCheckpoint(cp, A.publicKey).valid, true);
     // Domain separation: a checkpoint's signature is no witness's, and no attestation's.
@@ -99,10 +100,13 @@ describe('the wire form (sym-attest-v1 §5, §6 step 1)', () => {
       { ...w, seq: 1, prev: hex('c') }, { ...w, seq: 2, prev: 'genesis' }, { ...w, seq: 0 }, { ...w, sig: `${w.sig}=` }, { ...w, sigAlg: 'rsa' },
     ];
     for (const b of bad) assert.strictEqual(core.fromWireAttestation(b), null, JSON.stringify(Object.keys(b)));
-    const cp = core.signCheckpoint({ by: A.nodeId, roster: 'r', upto_seq: 8, root: hex('1'), at: 5 }, A.privateKey);
+    const cp = core.signCheckpoint({ by: A.nodeId, roster: 'room-e', from_seq: 5, upto_seq: 8, prev: hex('0'), root: hex('1'), at: 5 }, A.privateKey);
     const wc = core.toWireCheckpoint(cp);
-    assert.deepStrictEqual(Object.keys(wc).sort(), ['at', 'by', 'room', 'root', 'sig', 'sigAlg', 'uptoSeq']);
+    assert.deepStrictEqual(Object.keys(wc).sort(), ['at', 'by', 'fromSeq', 'prev', 'room', 'root', 'sig', 'sigAlg', 'uptoSeq']);
     assert.strictEqual(core.fromWireCheckpoint({ ...wc, uptoSeq: undefined, upto_seq: 8 }), null, '0.13\'s field name is not read');
+    assert.strictEqual(core.fromWireCheckpoint({ ...wc, note: 'x' }), null, 'closed');
+    assert.strictEqual(core.fromWireCheckpoint({ ...wc, prev: 'genesis' }), null, 'genesis exactly when fromSeq is 1');
+    assert.strictEqual(core.fromWireCheckpoint({ ...wc, fromSeq: 1 }), null);
     assert.strictEqual(core.verifyCheckpoint(core.fromWireCheckpoint(wc), A.publicKey).valid, true);
   });
 
@@ -124,10 +128,12 @@ describe('the wire form (sym-attest-v1 §5, §6 step 1)', () => {
       const types = new Set(sent.map((f) => f.type));
       assert.ok(types.has('sym-attest-attestation') && types.has('sym-attest-checkpoint'), [...types].join(','));
       assert.ok([...types].every((t) => t.startsWith('sym-attest-')), 'only the extension\'s frames (a peer\'s witness, relayed once, among them)');
-      assert.ok(sent.every((f) => { const o = f.attestation || f.checkpoint || f.witness; return !('roster' in o) && !('upto_seq' in o); }));
+      assert.ok(sent.every((f) => { const o = f.attestation || f.checkpoint || f.witness; return !('roster' in o) && !('upto_seq' in o) && !('from_seq' in o); }));
       assert.deepStrictEqual(got.map((e) => [e.method, e.assertionId, e.room]), [['heuristic', `asrt-${hex('8')}`, 'sa-room'], ['neural', `asrt-${hex('6')}`, 'sa-room']]);
       assert.strictEqual(got[1].prev, core.chainLink(a._attestations.chainOf(a.nodeId)[0].sig));
-      assert.strictEqual(b._attestations.checkpointAt(a.nodeId, 2).root, core.attestMerkleRoot(a._attestations.chainOf(a.nodeId).map((x) => x.sig)));
+      // The first checkpoint is chained to genesis over seq 1..2 (MMP 2.0 update 1).
+      const segmentRoot = core.attestMerkleRoot(a._attestations.chainOf(a.nodeId).map((x) => x.sig));
+      assert.strictEqual(b._attestations.checkpointAt(a.nodeId, 2).root, core.attestCheckpointRoot({ prev: 'genesis', fromSeq: 1, uptoSeq: 2, segmentRoot }));
       const rec = a.reconcileChain(a.nodeId);
       assert.strictEqual(rec.consistent, true, 'the attester reconciles its own v1 checkpoint');
     } finally { for (const n of [a, b]) { await n.stop(); fs.rmSync(nodeDirById(n.nodeId), { recursive: true, force: true }); } }

From 22bc81a34ee57930094b35fc64556ea5a9db5efe Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 8 Oct 2026 12:35:34 +0100
Subject: [PATCH 135/148] tests: the cmb-encrypted envelope's schema bounds
 (fails on bacab72)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QRVMpaJkAA2fFbvuHCEzqH
---
 tests/spec-update-frames.test.js | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/tests/spec-update-frames.test.js b/tests/spec-update-frames.test.js
index 4577ab04..ec6d89af 100644
--- a/tests/spec-update-frames.test.js
+++ b/tests/spec-update-frames.test.js
@@ -268,6 +268,14 @@ describe('ping and pong sealed, and the control envelope\'s bounds (§7.1, #26)'
       assert.strictEqual(sA.probeSince, 0);
     } finally { await stopAll(); }
   });
+  it('a cmb-encrypted envelope is bounded as encrypted-cmb-frame.schema.json bounds it (5417176)', () => {
+    const { openEncryptedSealed } = require('../lib/core/cmb-encrypted-frame');
+    const base = { type: 'cmb-encrypted', protocolVersion: '2.0', suite: 'X25519-HKDF-SHA256-ChaCha20-Poly1305', sessionId: 'a'.repeat(32), sequence: '1', direction: 'client-to-server', metadata: {}, sealed: 'A'.repeat(22) };
+    const key = crypto.randomBytes(32);
+    for (const [label, f] of [['30 digits', { ...base, sequence: '1'.repeat(30) }], ['shorter than the tag', { ...base, sealed: 'A'.repeat(21) }], ['longer than a 720 KiB record seals to', { ...base, sealed: 'A'.repeat(983063) }], ['a sessionId that is not 32 hex', { ...base, sessionId: 'x' }], ['a sequence that is a number', { ...base, sequence: 1 }]]) {
+      assert.throws(() => openEncryptedSealed({ frame: f, trafficKey: key }), /bad (sequence|sealed value|sessionId)/, label);
+    }
+  });
   it('an envelope with a 30-digit sequence, a sealed value shorter than the tag, or another member is not a control envelope', () => {
     const ok = { type: 'control-encrypted', protocolVersion: '2.0', suite: 'X25519-HKDF-SHA256-ChaCha20-Poly1305', sessionId: 'a'.repeat(32), sequence: '1', direction: 'client-to-server', sealed: 'A'.repeat(22) };
     assert.strictEqual(isControlFrame(ok), true);

From 04df8cbb2b6d80a4ccf37afa8faf9e3a71184537 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 8 Oct 2026 12:36:04 +0100
Subject: [PATCH 136/148] docs: chained checkpoints, the envelope bounds and
 the relay pace in the changelog, SECURITY and WIRE

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QRVMpaJkAA2fFbvuHCEzqH
---
 CHANGELOG.md        | 32 +++++++++++++++++++++++---------
 SECURITY.md         | 11 ++++++++---
 docs/WIRE-0.14.0.md | 19 ++++++++++++++++---
 3 files changed, 47 insertions(+), 15 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2c252b33..72dd0225 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -124,11 +124,11 @@ carried (cutoffs, ratification, budgets per delegation subtree, `role-chain-fetc
 
 The founder ruled that the drafts sym 0.14.0 implements land in the published spec before it ships.
 They are folded into one update, MMP 2.0 update 1 (sym-bot/meshcognition-website PR #43, branch
-spec/mmp-2.0-update-1 at 2660ab9: #24, #25, #17, #22, #26, #30, #23, #31, #37, #34, #35, #27 and #28
-on the §6.6 errata), and sym is aligned with its text, its reference construction (scripts/mmp/lib.mjs)
-and its schemas and vectors, vendored in tests/fixtures with their manifest digests
-(record-projection-v2, record-size-v2 and control-encrypted-v2 pass byte for byte, and every frame
-sym builds validates against the vendored schemas).
+spec/mmp-2.0-update-1, at 5417176 with its verification fixes: #24, #25, #17, #22, #26, #30, #23,
+#31, #37, #34, #35, #27 and #28 on the §6.6 errata), and sym is aligned with its text, its reference
+construction (scripts/mmp/lib.mjs) and its schemas and vectors, vendored in tests/fixtures with their
+manifest digests (record-projection-v2, record-size-v2, control-encrypted-v2 and the draft
+sym-attest-v1 pass case by case, and every frame sym builds validates against the vendored schemas).
 
 - **The seal point (#26, S1).** A record is never sealed into a session of another room than its
   signed one, whatever path offered it: a fetch answer, an anchor replay, a broadcast.
@@ -175,13 +175,27 @@ sym builds validates against the vendored schemas).
 - **The relay client (#25).** 4007 is an ordinary close with backoff (#20, relay-auth key proof, is
   deferred, and its review found that never reconnecting after 4007 makes a lockout); what a relay
   listed in `relay-peers.features` is forgotten with its socket; relay-auth carries the nodeId in its
-  lowercase form.
+  lowercase form. The pace stays 20 frames a second, burst 200, under the update's floors of 25/300,
+  and relay-auth and relay-pong now go inside that bucket (they went out at once whatever it held).
+- **The sealed envelopes** are checked as their schemas bound them: a sequence of at most 29 digits,
+  a sealed value at least the tag's length (and a record's at most 983,062 characters), a 32-hex
+  sessionId, and for `control-encrypted` its members exactly.
 - **sym-attest-v1 (#27, S3).** No attestation is signed about a Legacy Import record, and none about a
   directed record is sent or relayed (one received is kept). The attestation is a closed object with
   exactly seven verdicts, lowercase UUID attesters, a §5.8 room, a role of up to 64 characters and a
-  method of up to 32. A conflicting checkpoint is relayed once, as evidence. An attester's scoped role
-  is judged on the record its assertion names. No checkpoint root is signed over a suffix of the
-  chain (D1; the chained construction of the revised #27 is not in this release yet).
+  method of up to 32. An attester's scoped role is judged on the record its assertion names.
+- **Chained checkpoints (#27, D1).** A checkpoint covers the attestations since the previous one,
+  seq fromSeq..uptoSeq, and is chained to its root (`genesis` first), so a node holds only its last
+  segment; it signs fromSeq and prev, and a witness signs fromSeq. sym signed a root over whatever
+  attestations it still held, and once it had evicted one, over a suffix. A node that loses its
+  segment signs nothing over fewer: its chain ends, visibly (`checkpoint-chain-ended`). Two
+  checkpoints that are not the same one conflict when their ranges overlap or they share a prev (the
+  old rule, one position with two roots, missed a fork cut at other boundaries); the conflicting copy
+  is relayed once, as evidence, and the attester is witnessed no more, its further checkpoints dropped
+  unverified. The link checks (a reversed range, a checkpoint that does not follow the one its prev
+  names) refuse a checkpoint as malformed before any signature work. A witness that names another
+  range or root than the checkpoint held is refused and said, and never counts against the attester.
+  Logs written before this hold unchained checkpoints, which are kept and read as before.
 - **Echoes (#35, D3).** A record citing this node's own records is verified, gated, stored and
   delivered like any other: the ingest echo skip is gone, and the anti-echo rule sits at the remix
   trigger. `remixProduced` counts only remixes minted through `remix()`, and the decision log says
diff --git a/SECURITY.md b/SECURITY.md
index e0632fda..302f7abf 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -139,9 +139,14 @@ Report a vulnerability privately to info@sym.bot (the address in package.json).
   extension. Their objects are closed, with exactly seven category verdicts, lowercase UUID
   attesters and witnesses, a §5.8 room and the registered `role` and `method` grammars. No
   attestation is signed about a Legacy Import record, and none about a directed record leaves this
-  node (one received is kept, never relayed): an attestation would make it a confirmation oracle. A
-  conflicting checkpoint is relayed once, as evidence. An attester's scoped role is judged on the
-  record its assertion names. They describe a decision; they never change the receiver's own.
+  node (one received is kept, never relayed): an attestation would make it a confirmation oracle. An
+  attester's scoped role is judged on the record its assertion names. Checkpoints are chained (each
+  covers the segment since the previous one and commits to its root), so a node signs no root over
+  the part of its history it still holds, and one that lost its segment ends its chain visibly. Two
+  checkpoints from one attester whose ranges overlap, or that share a prev, are equivocation: the
+  conflicting copy is relayed once as evidence, and this node witnesses that attester no more. A
+  witness that contradicts the checkpoint held is refused and never counts against the attester (it
+  is only the witness's word). They describe a decision; they never change the receiver's own.
 - **Gated rooms on proven keys.** A gated room admits its owner by the owner's pinned key and a
   grantee when its room-join grant binds the key its session proved. A copied grant admits
   nobody. A grant is checked against its schema (closed, integer times, lowercase ids) before any
diff --git a/docs/WIRE-0.14.0.md b/docs/WIRE-0.14.0.md
index 9d7b0c5d..cf5f6381 100644
--- a/docs/WIRE-0.14.0.md
+++ b/docs/WIRE-0.14.0.md
@@ -171,9 +171,22 @@ session with a sealed 1010. What sym chooses:
 - The relay client reconnects with backoff after every close but 4004 and 4006 (4005, 4008, 1001,
   1009, 1011, 1013, and 4007); forgets a relay's `features` with its socket; and sends relay-auth's
   nodeId lowercase, with `room` (when not default) and `engine`. It paces at 20 frames a second,
-  burst 200: the update's floors (§19.1, `RELAY_MIN_RATE` and `RELAY_MIN_BURST`) are those same
-  numbers, and relay-auth and relay-pong are sent outside the bucket, so there is no headroom
-  (a verification note on #43 asks for floors of 25/300; open).
+  burst 200, under the update's floors (§19.1: 25 a second, burst 300), counting relay-auth and
+  relay-pong inside the same bucket, ahead of every other frame.
+
+## 4c. sym-attest-v1: what sym chooses (§16.4, the extension text)
+
+- An attester checkpoints every 8 attestations (`checkpointInterval`), each over the segment since
+  its last, chained to that root. The segment and the checkpoint are appended to the attestation
+  logs before anything that depends on them is gossiped (appended, not fsynced). A node that no
+  longer holds its segment ends its chain and signs no further checkpoint until its state changes.
+- A witness that names another range or root than the checkpoint held at its position is refused
+  and said (`disagrees`), and not taken as equivocation evidence: the extension text counts two
+  witnesses, or a witness and a checkpoint, with overlapping ranges as evidence against the
+  attester, but a witness is only its signer's word, so that would let any witness stop every node
+  from witnessing an honest attester. Only two checkpoints the attester signed are evidence here.
+- Unchained checkpoints in a log written before update 1 are kept and read as before (one per
+  position, a second root for one a conflict); none is accepted from the wire.
 
 ---
 

From 0f4f0afc5b649cd69e0da11a588cddb05620cd8c Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 8 Oct 2026 12:38:55 +0100
Subject: [PATCH 137/148] mutation check: a forged fetched signature is tested;
 four redundant guards removed

A mutation pass over the round's changes (36 mutants, then 7) killed every mutant but five:

- Removing the signature check of a fetched record survived: no test served a record whose key and
  assertion matched under a swapped signature. Now one does (D4: `bad-signature`, categories only).
- Four guards duplicated a rule that holds elsewhere, so no test could tell them apart from nothing,
  and they are gone: the remix trigger's own cites-this-node check (the trigger already keeps every
  record that cites a parent out of the remix cycle); the witness's equivocation check (only a
  checkpoint the store took is witnessed, and it takes none of an equivocating attester's); the
  tether's collapsed check (no gate evaluates a tether for a collapsed integration); and the fetch
  server's room check (the session's one seal point refuses a record of another room, and the
  answer lists it missing). The comments say where each rule now holds.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QRVMpaJkAA2fFbvuHCEzqH
---
 lib/frame-handler.js             | 15 +++++++--------
 lib/mesh-agent.js                | 13 ++++---------
 lib/node.js                      |  6 +++---
 tests/spec-update-frames.test.js | 21 +++++++++++++++++++++
 4 files changed, 35 insertions(+), 20 deletions(-)

diff --git a/lib/frame-handler.js b/lib/frame-handler.js
index f0d96a84..0b0f74e6 100644
--- a/lib/frame-handler.js
+++ b/lib/frame-handler.js
@@ -873,12 +873,12 @@ class FrameHandler {
     for (const key of [msg.key]) {
       const cmb = this._node._store.get(key)?.cmb;
       // Served only to an audience its author signed (review finding A): a room-bound record, or one
-      // signed to the asking session's own node, and only in the session's room (S1: the store is per
-      // node, not per room). Anything else is `missing`, as if this node did not hold it.
+      // signed to the asking session's own node. The session's one seal point refuses anything else,
+      // a record of another room included (S1: the store is per node, not per room), and what it
+      // refuses is `missing`, as if this node did not hold it.
       const to = cmb && cmb.metadata ? cmb.metadata.to : undefined;
       const servable = !!(cmb && cmb.metadata && cmb.metadata.signatureSuite === 'mmp-sig-v2.0' && cmb.metadata.sig)
-        && (to === null || to === undefined || to === session.nodeId)
-        && typeof cmb.metadata.room === 'string' && cmb.metadata.room.normalize('NFC') === String(session.room).normalize('NFC');
+        && (to === null || to === undefined || to === session.nodeId);
       const servedAt = fb.served.get(key);
       const fresh = servedAt === undefined || now - servedAt >= FETCH_REPEAT_MS;
       const room = typeof session.pendingBytes !== 'function' || session.pendingBytes() <= FETCH_PENDING_MAX;
@@ -1741,10 +1741,9 @@ class FrameHandler {
    */
   _applyLineageTether(entry, tether, now) {
     const cmb = entry?.cmb;
-    // §15.5 (MMP 2.0 update 1, #17): a collapsed integration keeps the author's record as signed and
-    // writes no self-edge, and the §15.8 tether does not apply to it: it is never stored as a severed
-    // root, and no tether attestation is signed about it.
-    if (entry && entry.collapsed === true) return false;
+    // §15.5 (MMP 2.0 update 1, #17): a collapsed integration has no tether. The gates evaluate none
+    // for one (tether is null here), so it is never stored as a severed root, and no tether
+    // attestation is signed about it.
     if (!tether?.checked || !cmb) return false;
     let severed = false;
     if (!tether.tethered && recordParents(cmb).length > 0) {
diff --git a/lib/mesh-agent.js b/lib/mesh-agent.js
index 19a8eda2..8ed50f8f 100644
--- a/lib/mesh-agent.js
+++ b/lib/mesh-agent.js
@@ -258,15 +258,10 @@ class MeshAgent {
     const source = entry.source || recordCreatedBy(entry.cmb) || 'unknown';
     const focusText = entry.cmb?.categories?.focus?.text || entry.content || '';
 
-    // MMP §15.7 anti-echo, at the trigger (update 1, #35): a record whose lineage cites this node's
-    // own records was admitted and delivered like any other, and is kept out of this node's remix
-    // cycle, so a reply to this node never draws a remix back.
-    const cited = [...((recordLineage(entry.cmb) || {}).parents || []), ...((entry.lineage && entry.lineage.parents) || [])];
-    if (cited.some((k) => this._node._store.hasLocalKey(k))) {
-      console.log(`[${this._name}] ${source} cites this node's own record — not remixed (§15.7)`);
-      return;
-    }
-
+    // MMP §15.7 anti-echo sits here, at the trigger (update 1, #35: a receiver keeps a record that
+    // cites its own records out of its remix cycle, and never skips it at ingest). The rule below
+    // covers it and more: a record citing any parent, this node's included, is admitted and delivered
+    // like any other, and never remixed.
     // Fix: only remix original domain observations, not remixes of remixes.
     // A CMB with lineage parents is itself a remix — re-remixing it creates
     // cascade storms across agents. Store it (SVAF accepted it) but don't
diff --git a/lib/node.js b/lib/node.js
index cf1b2001..84b70f1d 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -1695,9 +1695,9 @@ class SymNode extends EventEmitter {
   /** Countersign a checkpoint (witness) and gossip the witness. @private */
   _witnessCheckpoint(cp) {
     if (cp.by === this.nodeId) return; // don't witness your own
-    // Never an attester this node holds equivocation evidence against (sym-attest-v1 §5.2): not the
-    // conflicting copy, not any later checkpoint. A witness signed before the conflict was known stands.
-    if (this._attestations.attesterEquivocated(cp.by)) return;
+    // Never an attester this node holds equivocation evidence against (sym-attest-v1 §5.2): this runs
+    // only for a checkpoint the store took, and the store takes none of such an attester's (neither
+    // the conflicting copy nor any later one). A witness signed before the conflict was known stands.
     // Once per checkpoint, across restarts: a second signing is a second copy of the same
     // statement, and two copies in circulation were relayed back and forth without end.
     if (this._attestations.hasWitnessed(cp.by, cp.upto_seq, this.nodeId)) return;
diff --git a/tests/spec-update-frames.test.js b/tests/spec-update-frames.test.js
index ec6d89af..42aed863 100644
--- a/tests/spec-update-frames.test.js
+++ b/tests/spec-update-frames.test.js
@@ -144,6 +144,27 @@ describe('D4: a fetched record is attributed only after the whole of §8.8.5 (#2
     } finally { await stopAll(); }
   });
 
+  it('a record whose signature does not verify under its proven author\'s key comes back unverified', async () => {
+    try {
+      const A = node('d4-sig');
+      const B = identity('author-b');
+      A._roster.bind(B.nodeId, B.publicKey, 'proven');
+      const s = admitAs(A, B);
+      const rec = signedRecord(B, { room: A._room, categories: { focus: 'signed by B, then its signature swapped' } });
+      const other = signedRecord(B, { room: A._room, categories: { focus: 'another record by B' } });
+      const forged = JSON.parse(JSON.stringify(rec));
+      forged.metadata.sig = other.metadata.sig; // B's signature, over other bytes: the key and the assertion still match
+      const p = A.fetchCMB(rec.metadata.key, { timeoutMs: 2000 });
+      const reqId = [...A._cmbFetchPending.keys()][0];
+      A._frameHandler.handle(s, { type: 'cmb', cmb: forged });
+      A._frameHandler.handle(s, { type: 'cmb-fetch-result', reqId, returned: [rec.metadata.key], missing: [] });
+      const r = await p;
+      assert.strictEqual(r.verified, false);
+      assert.strictEqual(r.reason, 'bad-signature');
+      assert.strictEqual(r.cmb, undefined);
+    } finally { await stopAll(); }
+  });
+
   it('a record it holds under Legacy Import answers as its categories only', async () => {
     try {
       const A = node('d4-local');

From 6b1075a3c4b96f8de54e8701e6a4e632fa4bdccc Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 8 Oct 2026 12:42:09 +0100
Subject: [PATCH 138/148] sym-attest-v1: a contradicting witness counts against
 the witness; the range check at step 1 (#27 ruling)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The coordinator's ruling for #27, which the spec author is applying to PR #43:

- Witnesses are not equivocation evidence: they are not attester-signed. Only two conflicting
  attester-signed checkpoints are (as sym already held). A verified witness that names another range
  or root than the attester-signed checkpoint held at its position counts against the witness: it is
  refused (`disagrees`), said once (`witness-contradicts-checkpoint`), and that witness's further
  witnesses are dropped unverified for 10 minutes (`witness-muted`; the ruling's MAY).
- The link checks run in §6's order: uptoSeq >= fromSeq at step 1 (fromWireCheckpoint refuses a
  reversed range, as it already refused prev other than genesis at fromSeq 1), and the prev link to
  a held checkpoint after step 4 (after the duplicate drop, before any signature work), as before.

The hello's room already has the §5.8 grammar here (c0e615f).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QRVMpaJkAA2fFbvuHCEzqH
---
 CHANGELOG.md                           |  6 +++--
 SECURITY.md                            |  4 +--
 docs/WIRE-0.14.0.md                    |  9 +++----
 lib/attestation-store.js               |  8 +++---
 lib/core/attestation.js                |  4 ++-
 lib/node.js                            | 36 ++++++++++++++++++++++----
 tests/spec-update-attest-chain.test.js | 25 ++++++++++++++++++
 7 files changed, 73 insertions(+), 19 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 72dd0225..8e08f78a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -193,8 +193,10 @@ sym-attest-v1 pass case by case, and every frame sym builds validates against th
   old rule, one position with two roots, missed a fork cut at other boundaries); the conflicting copy
   is relayed once, as evidence, and the attester is witnessed no more, its further checkpoints dropped
   unverified. The link checks (a reversed range, a checkpoint that does not follow the one its prev
-  names) refuse a checkpoint as malformed before any signature work. A witness that names another
-  range or root than the checkpoint held is refused and said, and never counts against the attester.
+  names) refuse a checkpoint as malformed before any signature work: the range at the schema step, the
+  prev link after the duplicate drop. Only attester-signed checkpoints are evidence: a witness that
+  names another range or root than the attester's checkpoint held counts against the witness, which
+  is refused and muted for 10 minutes.
   Logs written before this hold unchained checkpoints, which are kept and read as before.
 - **Echoes (#35, D3).** A record citing this node's own records is verified, gated, stored and
   delivered like any other: the ingest echo skip is gone, and the anti-echo rule sits at the remix
diff --git a/SECURITY.md b/SECURITY.md
index 302f7abf..e652e357 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -145,8 +145,8 @@ Report a vulnerability privately to info@sym.bot (the address in package.json).
   the part of its history it still holds, and one that lost its segment ends its chain visibly. Two
   checkpoints from one attester whose ranges overlap, or that share a prev, are equivocation: the
   conflicting copy is relayed once as evidence, and this node witnesses that attester no more. A
-  witness that contradicts the checkpoint held is refused and never counts against the attester (it
-  is only the witness's word). They describe a decision; they never change the receiver's own.
+  witness that contradicts the attester-signed checkpoint held counts against the witness, never the
+  attester: it is refused, and that witness is muted for 10 minutes. They describe a decision; they never change the receiver's own.
 - **Gated rooms on proven keys.** A gated room admits its owner by the owner's pinned key and a
   grantee when its room-join grant binds the key its session proved. A copied grant admits
   nobody. A grant is checked against its schema (closed, integer times, lowercase ids) before any
diff --git a/docs/WIRE-0.14.0.md b/docs/WIRE-0.14.0.md
index cf5f6381..a0a1582c 100644
--- a/docs/WIRE-0.14.0.md
+++ b/docs/WIRE-0.14.0.md
@@ -180,11 +180,10 @@ session with a sealed 1010. What sym chooses:
   its last, chained to that root. The segment and the checkpoint are appended to the attestation
   logs before anything that depends on them is gossiped (appended, not fsynced). A node that no
   longer holds its segment ends its chain and signs no further checkpoint until its state changes.
-- A witness that names another range or root than the checkpoint held at its position is refused
-  and said (`disagrees`), and not taken as equivocation evidence: the extension text counts two
-  witnesses, or a witness and a checkpoint, with overlapping ranges as evidence against the
-  attester, but a witness is only its signer's word, so that would let any witness stop every node
-  from witnessing an honest attester. Only two checkpoints the attester signed are evidence here.
+- Only two conflicting checkpoints the attester signed are equivocation evidence (a witness is not
+  attester-signed). A verified witness that names another range or root than the attester-signed
+  checkpoint held at its position counts against the witness: it is refused (`disagrees`), said once,
+  and that witness's further witnesses are dropped unverified for 10 minutes (`witness-muted`).
 - Unchained checkpoints in a log written before update 1 are kept and read as before (one per
   position, a second root for one a conflict); none is accepted from the wire.
 
diff --git a/lib/attestation-store.js b/lib/attestation-store.js
index f7f94a56..3cc37e2e 100644
--- a/lib/attestation-store.js
+++ b/lib/attestation-store.js
@@ -469,10 +469,10 @@ class AttestationStore {
       if (existing.root === w.root) return { stored: false, reason: 'duplicate' };
       return { stored: false, reason: 'conflict', keptRoot: existing.root, first: this._noteWitnessConflict(w) };
     }
-    // A witness carries its checkpoint's range (update 1): one that names another range or root for a
-    // held checkpoint is about a checkpoint this node does not hold. It is the witness's word only, so
-    // it is refused and said (`disagrees`), never taken as the attester's equivocation: a witness could
-    // otherwise frame an honest attester.
+    // A witness carries its checkpoint's range (update 1). One that names another range or root than
+    // the attester-signed checkpoint held at its position is not equivocation evidence (a witness is
+    // not attester-signed): it counts against the witness (sym-attest-v1 §5.3), and is refused
+    // (`disagrees`); the node may mute that witness.
     const cpHeld = this.checkpointAt(w.attester, w.upto_seq);
     if (cpHeld && isChained(cpHeld) && w.from_seq !== undefined && (cpHeld.from_seq !== w.from_seq || cpHeld.root !== w.root)) {
       return { stored: false, reason: 'disagrees', keptRoot: cpHeld.root, first: this._noteWitnessConflict(w) };
diff --git a/lib/core/attestation.js b/lib/core/attestation.js
index bee3d17b..7ee8a43c 100644
--- a/lib/core/attestation.js
+++ b/lib/core/attestation.js
@@ -351,7 +351,9 @@ function fromWireCheckpoint(w) {
   if (!w || typeof w !== 'object' || Array.isArray(w)) return null;
   for (const k of Object.keys(w)) if (!CHECKPOINT_MEMBERS.has(k)) return null;
   if (!isId(w.by) || !isRoom(w.room) || !isPos(w.fromSeq) || !isPos(w.uptoSeq) || !isLink(w.prev) || typeof w.root !== 'string' || !HEX64.test(w.root) || !isTime(w.at)) return null;
-  if ((w.fromSeq === 1) !== (w.prev === 'genesis')) return null;
+  // §6 step 1: the range is not reversed, and prev is genesis exactly when fromSeq is 1. (The prev link
+  // to a held checkpoint is checked after step 4, against what is held.)
+  if (w.uptoSeq < w.fromSeq || (w.fromSeq === 1) !== (w.prev === 'genesis')) return null;
   if (w.sigAlg !== 'ed25519' || typeof w.sig !== 'string' || !SIG_RE.test(w.sig)) return null;
   return { type: 'checkpoint', by: w.by, roster: w.room, from_seq: w.fromSeq, upto_seq: w.uptoSeq, prev: w.prev, root: w.root, at: w.at, sigAlg: w.sigAlg, sig: w.sig };
 }
diff --git a/lib/node.js b/lib/node.js
index 84b70f1d..d0b725dd 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -54,6 +54,8 @@ const {
 } = require('./core');
 /** What a checkpoint made since 0.14 commits (the sym-attest-v1 root); one without it is 0.13's. */
 const ATTEST_SCHEME = 'sym-attest-v1';
+/** How long the witnesses of a node that contradicted a held, attester-signed checkpoint are dropped. */
+const WITNESS_MUTE_MS = 10 * 60 * 1000;
 const { MMP_EMIT_V2 } = require('./emit-policy'); // the single reader-first flip switch
 /** How far this node's record timestamps may run ahead of its clock before they follow it again. */
 const MAX_CLOCK_LEAD_MS = 60 * 1000;
@@ -1692,6 +1694,23 @@ class SymNode extends EventEmitter {
     r.reportedAt = now;
   }
 
+  /** @private Whether witnesses signed by `by` are muted (it contradicted a held checkpoint). */
+  _witnessMuted(by) {
+    const until = this._mutedWitnesses && this._mutedWitnesses.get(by);
+    if (!until) return false;
+    if (Date.now() < until) return true;
+    this._mutedWitnesses.delete(by);
+    return false;
+  }
+
+  /** @private Mute the witnesses `by` signs for WITNESS_MUTE_MS; at most 1,024 witnesses, oldest first out. */
+  _muteWitness(by) {
+    if (!this._mutedWitnesses) this._mutedWitnesses = new Map();
+    this._mutedWitnesses.delete(by);
+    if (this._mutedWitnesses.size >= 1024) this._mutedWitnesses.delete(this._mutedWitnesses.keys().next().value);
+    this._mutedWitnesses.set(by, Date.now() + WITNESS_MUTE_MS);
+  }
+
   /** Countersign a checkpoint (witness) and gossip the witness. @private */
   _witnessCheckpoint(cp) {
     if (cp.by === this.nodeId) return; // don't witness your own
@@ -1735,6 +1754,9 @@ class SymNode extends EventEmitter {
     // Duplicates by content: the same (attester, fromSeq, uptoSeq, by) with the same root.
     const held = this._attestations.witnessSeen(w.attester, w.upto_seq, w.by);
     if (held && held.root === w.root && held.from_seq === w.from_seq) return { ok: false, reason: 'duplicate' };
+    // A witness that contradicted an attester-signed checkpoint this node holds is muted for a while:
+    // its further witnesses are dropped unverified (sym-attest-v1 §5.3, update 1: it MAY be muted).
+    if (this._witnessMuted(w.by)) return { ok: false, reason: 'witness-muted' };
     if (this._attestations.witnessConflictRoot(w.attester, w.upto_seq, w.by) === w.root) return { ok: false, reason: 'duplicate' };
     if (!isCanonicalSig(w.sig)) return this._refuseSpelling(fromPeerId, 'witness', w.by);
     const key = this._identityKey(w.by);
@@ -1747,11 +1769,15 @@ class SymNode extends EventEmitter {
     // only an admitted record, a grant in effect or a pin does; a fresh identity signs statements free).
     const r = this._attestations.recordWitness(w);
     if (r.stored) this._gossipToRoster({ type: ATTEST_FRAME.witness, witness: toWireWitness(w) }, fromPeerId);
-    if (r.reason === 'disagrees' && r.first) {
-      // A witness for another range or root than the checkpoint held at that position: the witness's word
-      // only, so it is said and counted, never taken as the attester's equivocation.
-      this._log(`[sym-security] witness from ${String(w.by).slice(0, 8)} for ${String(w.attester).slice(0, 8)} names ${w.from_seq}..${w.upto_seq} root ${String(w.root).slice(0, 12)}, not the checkpoint held there (root ${String(r.keptRoot).slice(0, 12)})`);
-      this.emit('metric', { type: 'attestation-conflict', kind: 'witness-disagrees', attester: w.attester, upto_seq: w.upto_seq, witness: w.by, keptRoot: r.keptRoot, otherRoot: w.root });
+    if (r.reason === 'disagrees') {
+      // A verified witness for another range or root than the attester-signed checkpoint held at that
+      // position counts against the witness, never the attester (sym-attest-v1 §5.3, update 1): it is
+      // said once, counted, and the witness is muted for WITNESS_MUTE_MS.
+      this._muteWitness(w.by);
+      if (r.first) {
+        this._log(`[sym-security] witness ${String(w.by).slice(0, 8)} for ${String(w.attester).slice(0, 8)} names ${w.from_seq}..${w.upto_seq} root ${String(w.root).slice(0, 12)}, not the attester's checkpoint held there (root ${String(r.keptRoot).slice(0, 12)}): its witnesses are dropped for ${WITNESS_MUTE_MS / 60000} minutes`);
+        this.emit('metric', { type: 'witness-contradicts-checkpoint', attester: w.attester, upto_seq: w.upto_seq, witness: w.by, keptRoot: r.keptRoot, otherRoot: w.root });
+      }
     }
     if (r.reason === 'conflict' && r.first) {
       this._log(`[sym-security] conflicting witness from ${String(w.by).slice(0, 8)} for ${String(w.attester).slice(0, 8)} at ${w.upto_seq}: kept root ${String(r.keptRoot).slice(0, 12)}, refused ${String(w.root).slice(0, 12)}`);
diff --git a/tests/spec-update-attest-chain.test.js b/tests/spec-update-attest-chain.test.js
index aac71ff4..9348d8a7 100644
--- a/tests/spec-update-attest-chain.test.js
+++ b/tests/spec-update-attest-chain.test.js
@@ -185,6 +185,31 @@ describe('the node chains its own checkpoints and stops witnessing an equivocati
     } finally { await stopAll(); }
   });
 
+  it('a witness contradicting an attester-signed checkpoint held counts against the witness, which is muted; never against the attester', async () => {
+    try {
+      const A = mk('wmute');
+      const X = { nodeId: V.testKeys.attester.nodeId, publicKey: KEY.attester };
+      A._roster.bind(X.nodeId, X.publicKey, 'pinned');
+      const Wi = identity('lying-witness');
+      A._roster.bind(Wi.nodeId, Wi.publicKey, 'pinned');
+      A._gossipToRoster = () => {};
+      A._witnessCheckpoint = () => {};
+      const s = admitAs(A, identity('relayer'));
+      for (const x of V.checkpoints) assert.strictEqual(A._ingestCheckpoint(store(x.checkpoint), s.nodeId, s).ok, true);
+      const held = V.checkpoints[2].checkpoint;
+      const lie = core.signWitness({ attester: X.nodeId, roster: A._room, from_seq: held.fromSeq, upto_seq: held.uptoSeq, root: crypto.randomBytes(32).toString('hex'), by: Wi.nodeId, role: 'participant', at: 1 }, Wi.privateKey);
+      assert.strictEqual(A._ingestWitness(lie, s.nodeId, s).reason, 'disagrees');
+      assert.strictEqual(A._attestations.attesterEquivocated(X.nodeId), false, 'the attester signed nothing wrong');
+      const honest = core.signWitness({ attester: X.nodeId, roster: A._room, from_seq: held.fromSeq, upto_seq: held.uptoSeq, root: held.root, by: Wi.nodeId, role: 'participant', at: 2 }, Wi.privateKey);
+      assert.strictEqual(A._ingestWitness(honest, s.nodeId, s).reason, 'witness-muted', 'its next witness is dropped unverified');
+    } finally { await stopAll(); }
+  });
+
+  it('a reversed range is refused at the schema step (§6 step 1), before anything else', () => {
+    const c = V.linkChecks.find((x) => /reversed/.test(x.label));
+    assert.strictEqual(core.fromWireCheckpoint(c.checkpoint), null);
+  });
+
   it('after a conflict this node never witnesses the attester again, and drops its further checkpoints unverified', async () => {
     try {
       const A = mk('witness');

From f3c1472861b1ecf1848d9379d7033d9e8b7e57bb Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 8 Oct 2026 12:45:17 +0100
Subject: [PATCH 139/148] sym-attest-v1: witness leads and witness evidence as
 round 2 of #43 states them; re-vendor 0ab7b76
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

meshcognition-website PR #43 at 0ab7b76 ("Verify #43, round 2: witness evidence, link-check
placement, and the handshake room"):

- A witness is never equivocation evidence against the attester. One that names the range of an
  attester-signed checkpoint held, with another root, is evidence against the witness (`disagrees`:
  refused, said once, the witness muted for 10 minutes). One that overlaps a held checkpoint without
  matching it is a lead (`witness-lead`: refused and said, no mute). sym muted the witness for any
  mismatch at the held position, a different range included; a lead is not evidence against anyone.
  AttestationStore.witnessAssessment gives the three verdicts; the vector's witnessLeads and lib.mjs's
  attestWitnessAssessment agree with it.
- §6's order (the range at step 1, the prev link at step 5, after the duplicate drop): as sym does,
  except that sym checks the signature's spelling (step 3) after steps 4 and 5; all three discard
  with no state changed, so only the refusal's reason differs (said in WIRE-0.14.0.md).
- The hello's room has the §5.8 pattern in handshake.schema.json now, as sym already refuses.

Re-vendored from 0ab7b76: sym-attest-v1.json and lib.mjs (nothing else changed); SOURCES.json
records the head and the digests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QRVMpaJkAA2fFbvuHCEzqH
---
 CHANGELOG.md                           |   4 +-
 SECURITY.md                            |   5 +-
 docs/WIRE-0.14.0.md                    |  10 ++-
 lib/attestation-store.js               |  36 ++++++--
 lib/node.js                            |   6 ++
 tests/fixtures/SOURCES.json            |  10 +--
 tests/fixtures/mmp-lib.mjs             |  12 +++
 tests/fixtures/sym-attest-v1.json      | 118 ++++++++++++++++++++++++-
 tests/spec-update-attest-chain.test.js |  26 +++++-
 9 files changed, 203 insertions(+), 24 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8e08f78a..5ee66430 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -195,8 +195,8 @@ sym-attest-v1 pass case by case, and every frame sym builds validates against th
   unverified. The link checks (a reversed range, a checkpoint that does not follow the one its prev
   names) refuse a checkpoint as malformed before any signature work: the range at the schema step, the
   prev link after the duplicate drop. Only attester-signed checkpoints are evidence: a witness that
-  names another range or root than the attester's checkpoint held counts against the witness, which
-  is refused and muted for 10 minutes.
+  names a held checkpoint's range with another root counts against the witness, which is refused and
+  muted for 10 minutes; one that overlaps a held checkpoint without matching it is a lead, refused.
   Logs written before this hold unchained checkpoints, which are kept and read as before.
 - **Echoes (#35, D3).** A record citing this node's own records is verified, gated, stored and
   delivered like any other: the ingest echo skip is gone, and the anti-echo rule sits at the remix
diff --git a/SECURITY.md b/SECURITY.md
index e652e357..6f7b2f21 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -145,8 +145,9 @@ Report a vulnerability privately to info@sym.bot (the address in package.json).
   the part of its history it still holds, and one that lost its segment ends its chain visibly. Two
   checkpoints from one attester whose ranges overlap, or that share a prev, are equivocation: the
   conflicting copy is relayed once as evidence, and this node witnesses that attester no more. A
-  witness that contradicts the attester-signed checkpoint held counts against the witness, never the
-  attester: it is refused, and that witness is muted for 10 minutes. They describe a decision; they never change the receiver's own.
+  witness that names a held attester-signed checkpoint's range with another root counts against the
+  witness, never the attester: it is refused, and that witness is muted for 10 minutes; one that only
+  overlaps a held checkpoint is a lead, refused and said. They describe a decision; they never change the receiver's own.
 - **Gated rooms on proven keys.** A gated room admits its owner by the owner's pinned key and a
   grantee when its room-join grant binds the key its session proved. A copied grant admits
   nobody. A grant is checked against its schema (closed, integer times, lowercase ids) before any
diff --git a/docs/WIRE-0.14.0.md b/docs/WIRE-0.14.0.md
index a0a1582c..73df3a7c 100644
--- a/docs/WIRE-0.14.0.md
+++ b/docs/WIRE-0.14.0.md
@@ -181,9 +181,13 @@ session with a sealed 1010. What sym chooses:
   logs before anything that depends on them is gossiped (appended, not fsynced). A node that no
   longer holds its segment ends its chain and signs no further checkpoint until its state changes.
 - Only two conflicting checkpoints the attester signed are equivocation evidence (a witness is not
-  attester-signed). A verified witness that names another range or root than the attester-signed
-  checkpoint held at its position counts against the witness: it is refused (`disagrees`), said once,
-  and that witness's further witnesses are dropped unverified for 10 minutes (`witness-muted`).
+  attester-signed). A verified witness that names the range of an attester-signed checkpoint held,
+  with another root, counts against the witness: it is refused (`disagrees`), said once, and that
+  witness's further witnesses are dropped unverified for 10 minutes (`witness-muted`). One that
+  overlaps a held checkpoint without matching it is a lead: refused and said (`witness-lead`), no more.
+- §6's order: sym drops a duplicate (step 4) and applies the prev link (step 5) before it checks the
+  signature's spelling (step 3); all three discard the frame with no state changed, so only the
+  reason a refusal names differs.
 - Unchained checkpoints in a log written before update 1 are kept and read as before (one per
   position, a second root for one a conflict); none is accepted from the wire.
 
diff --git a/lib/attestation-store.js b/lib/attestation-store.js
index 3cc37e2e..954b67f0 100644
--- a/lib/attestation-store.js
+++ b/lib/attestation-store.js
@@ -469,14 +469,17 @@ class AttestationStore {
       if (existing.root === w.root) return { stored: false, reason: 'duplicate' };
       return { stored: false, reason: 'conflict', keptRoot: existing.root, first: this._noteWitnessConflict(w) };
     }
-    // A witness carries its checkpoint's range (update 1). One that names another range or root than
-    // the attester-signed checkpoint held at its position is not equivocation evidence (a witness is
-    // not attester-signed): it counts against the witness (sym-attest-v1 §5.3), and is refused
-    // (`disagrees`); the node may mute that witness.
-    const cpHeld = this.checkpointAt(w.attester, w.upto_seq);
-    if (cpHeld && isChained(cpHeld) && w.from_seq !== undefined && (cpHeld.from_seq !== w.from_seq || cpHeld.root !== w.root)) {
-      return { stored: false, reason: 'disagrees', keptRoot: cpHeld.root, first: this._noteWitnessConflict(w) };
+    // A witness carries its checkpoint's range (update 1, sym-attest-v1 §5.3). It is not attester-signed,
+    // so it is never equivocation evidence against the attester. Naming the range of an attester-signed
+    // checkpoint held with another root, it is evidence against the witness (`disagrees`: refused, and
+    // the node may mute the witness). Overlapping a held checkpoint without matching it, it is a lead
+    // (`lead`: refused, and said), not proof of anything.
+    if (w.from_seq !== undefined) {
+      const a = this.witnessAssessment(w);
+      if (a.evidenceAgainstWitness) return { stored: false, reason: 'disagrees', keptRoot: a.kept.root, first: this._noteWitnessConflict(w) };
+      if (a.lead) return { stored: false, reason: 'lead', first: this._noteWitnessConflict(w) };
     }
+    const cpHeld = this.checkpointAt(w.attester, w.upto_seq);
     if (!cpHeld) {
       const k = witnessKey(w.attester, w.upto_seq, w.by);
       const p = this._pending.get(k);
@@ -611,6 +614,25 @@ class AttestationStore {
     return checkpointLinkValid(cp, prevCp);
   }
 
+  /**
+   * What a chained witness shows against the attester's checkpoints held (sym-attest-v1 §5.3): never
+   * equivocation evidence; a lead when it overlaps one without being its range and root; evidence
+   * against the witness when it names one's range with another root (`kept` is that checkpoint).
+   */
+  witnessAssessment(w) {
+    const m = this._checkpoints.get(w.attester);
+    let lead = false; let kept = null;
+    if (m) {
+      for (const cp of m.values()) {
+        if (!isChained(cp)) continue;
+        const sameRange = cp.from_seq === w.from_seq && cp.upto_seq === w.upto_seq;
+        if (cp.from_seq <= w.upto_seq && w.from_seq <= cp.upto_seq && !(sameRange && cp.root === w.root)) lead = true;
+        if (sameRange && cp.root !== w.root) kept = cp;
+      }
+    }
+    return { equivocationEvidence: false, lead, evidenceAgainstWitness: !!kept, kept };
+  }
+
   /** The newest chained checkpoint an attester has committed, or null. */
   latestChainedCheckpoint(by) {
     const m = this._checkpoints.get(by);
diff --git a/lib/node.js b/lib/node.js
index d0b725dd..0984a25b 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -1769,6 +1769,12 @@ class SymNode extends EventEmitter {
     // only an admitted record, a grant in effect or a pin does; a fresh identity signs statements free).
     const r = this._attestations.recordWitness(w);
     if (r.stored) this._gossipToRoster({ type: ATTEST_FRAME.witness, witness: toWireWitness(w) }, fromPeerId);
+    if (r.reason === 'lead' && r.first) {
+      // Overlapping an attester-signed checkpoint held without matching it: either the attester signed
+      // two histories or the witness signed a range the attester never did. A lead, not proof (§5.3).
+      this._log(`[sym-security] witness ${String(w.by).slice(0, 8)} for ${String(w.attester).slice(0, 8)} names ${w.from_seq}..${w.upto_seq}, a range that overlaps a checkpoint held without matching it: a lead, not evidence`);
+      this.emit('metric', { type: 'witness-lead', attester: w.attester, from_seq: w.from_seq, upto_seq: w.upto_seq, witness: w.by, root: w.root });
+    }
     if (r.reason === 'disagrees') {
       // A verified witness for another range or root than the attester-signed checkpoint held at that
       // position counts against the witness, never the attester (sym-attest-v1 §5.3, update 1): it is
diff --git a/tests/fixtures/SOURCES.json b/tests/fixtures/SOURCES.json
index 327191df..b00f6072 100644
--- a/tests/fixtures/SOURCES.json
+++ b/tests/fixtures/SOURCES.json
@@ -1,6 +1,6 @@
 {
-  "note": "MMP v2.0 conformance artifacts vendored for sym's tests, copied unchanged. Every file comes from sym-bot/meshcognition-website PR #43, branch spec/mmp-2.0-update-1 at 5417176 (MMP 2.0 update 1, with its verification fixes: the corrected chained checkpoint and the sym-attest-v1 draft vector among them), not yet merged to main. authority-v2.json, authority-frame.schema.json and ed25519-strict-v2.json are unchanged since df79e04. The sha256 values equal 5417176's public/spec/mmp/artifact-manifest.json; mmp-lib.mjs is scripts/mmp/lib.mjs at 5417176, the reference construction, which the manifest does not list. The tests that read a file check its digest first.",
-  "source": "https://github.com/sym-bot/meshcognition-website/tree/5417176/public/spec/mmp",
+  "note": "MMP v2.0 conformance artifacts vendored for sym's tests, copied unchanged. Every file comes from sym-bot/meshcognition-website PR #43, branch spec/mmp-2.0-update-1 at 0ab7b76 (MMP 2.0 update 1, with its verification fixes, rounds 1 and 2: the chained checkpoint, the sym-attest-v1 draft vector and its witness leads among them), not yet merged to main. authority-v2.json, authority-frame.schema.json and ed25519-strict-v2.json are unchanged since df79e04. The sha256 values equal 0ab7b76's public/spec/mmp/artifact-manifest.json; mmp-lib.mjs is scripts/mmp/lib.mjs at 0ab7b76, the reference construction, which the manifest does not list. The tests that read a file check its digest first.",
+  "source": "https://github.com/sym-bot/meshcognition-website/tree/0ab7b76/public/spec/mmp",
   "files": {
     "authority-v2.json": {
       "from": "conformance/v2/authority-v2.json",
@@ -68,8 +68,8 @@
     },
     "mmp-lib.mjs": {
       "from": "scripts/mmp/lib.mjs (repository root)",
-      "sha256": "020d09dfbfb2ec1b0446c065a9dd3824692216bd6be75b9721a7a3cd5b6ba148",
-      "note": "the reference construction (scripts/mmp/lib.mjs at 5417176); not a published artifact, so not in the manifest"
+      "sha256": "3c0dcc02a7add945eaa3e4f65d20d130b8bd0012de5e0efa711dfcbae859873f",
+      "note": "the reference construction (scripts/mmp/lib.mjs at 0ab7b76); not a published artifact, so not in the manifest"
     },
     "application.schema.json": {
       "from": "schema/application.schema.json",
@@ -77,7 +77,7 @@
     },
     "sym-attest-v1.json": {
       "from": "conformance/v2/sym-attest-v1.json",
-      "sha256": "934db3407e951377a4e08e2d32b23ef3a66d4220d313bb0cf1d4552bf5e6226d"
+      "sha256": "3f5639e92f7f1bcb34bd88b16d35badfcef6c3f22ed6f170faa36f884b3fa369"
     }
   }
 }
diff --git a/tests/fixtures/mmp-lib.mjs b/tests/fixtures/mmp-lib.mjs
index 3dd3ebc7..32b9d71a 100644
--- a/tests/fixtures/mmp-lib.mjs
+++ b/tests/fixtures/mmp-lib.mjs
@@ -936,3 +936,15 @@ export function attestCheckpointLinkValid(cp, prevCheckpoint = null) {
   if (prevCheckpoint && prevCheckpoint.root === cp.prev && cp.fromSeq !== prevCheckpoint.uptoSeq + 1) return false;
   return true;
 }
+
+// §5.3: what a witness can show. A witness is not signed by the attester, so it is never equivocation
+// evidence against the attester (only two conflicting attester-signed checkpoints are, §5.2). One that
+// overlaps a held checkpoint without matching it is a lead; one that names the range of a held
+// attester-signed checkpoint with a different root is evidence against the witness.
+export function attestWitnessAssessment(w, heldCheckpoints) {
+  const mine = heldCheckpoints.filter((cp) => cp.by === w.attester);
+  const overlapsUnlike = mine.some((cp) => cp.fromSeq <= w.uptoSeq && w.fromSeq <= cp.uptoSeq
+    && !(cp.fromSeq === w.fromSeq && cp.uptoSeq === w.uptoSeq && cp.root === w.root));
+  const againstWitness = mine.some((cp) => cp.fromSeq === w.fromSeq && cp.uptoSeq === w.uptoSeq && cp.root !== w.root);
+  return { equivocationEvidence: false, lead: overlapsUnlike, evidenceAgainstWitness: againstWitness };
+}
diff --git a/tests/fixtures/sym-attest-v1.json b/tests/fixtures/sym-attest-v1.json
index 36c6c057..f4afc331 100644
--- a/tests/fixtures/sym-attest-v1.json
+++ b/tests/fixtures/sym-attest-v1.json
@@ -618,6 +618,120 @@
       }
     }
   ],
+  "witnessLeads": [
+    {
+      "label": "a witness over a range no attester-signed checkpoint has (2..4, against held 1..1, 2..3 and 4..6): a lead, never equivocation evidence",
+      "witness": {
+        "attester": "018f47a0-7b21-7abc-8def-a77e57000001",
+        "room": "team-room",
+        "fromSeq": 2,
+        "uptoSeq": 4,
+        "root": "f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0",
+        "by": "018f47a0-7b21-7abc-8def-a77e57000002",
+        "role": "participant",
+        "at": 1786611608000,
+        "sigAlg": "ed25519",
+        "sig": "GNyXnrF4WqCauWbm8uLGsiu1n-0M7UPp7lfM0otKKZ0phgKzAEKJ0AkJY3mVkb4FGMlIKRSQgzHdwZcNZkMGBg"
+      },
+      "payloadHex": "6d6d702d6174746573742d7769746e6573732d76310a33363a30313866343761302d376232312d376162632d386465662d613737653537303030303031393a7465616d2d726f6f6d313a32313a3436343a6630663066306630663066306630663066306630663066306630663066306630663066306630663066306630663066306630663066306630663066306630663033363a30313866343761302d376232312d376162632d386465662d61373765353730303030303231313a7061727469636970616e7431333a31373836363131363038303030",
+      "held": [
+        {
+          "by": "018f47a0-7b21-7abc-8def-a77e57000001",
+          "room": "team-room",
+          "fromSeq": 1,
+          "uptoSeq": 1,
+          "prev": "genesis",
+          "root": "665f361a8e9344ee5ed38380daa454581bb929d581f7a4fed7fb7131f37197ba",
+          "at": 1786611601500,
+          "sigAlg": "ed25519",
+          "sig": "iUowNBs6Ht1_37-a_NkOZEUWuwvSv_Q3-dG6shKRDXivFOQORFALEETUYF-Clw2bUMnWe7-T1IyTRn8dlmuRBw"
+        },
+        {
+          "by": "018f47a0-7b21-7abc-8def-a77e57000001",
+          "room": "team-room",
+          "fromSeq": 2,
+          "uptoSeq": 3,
+          "prev": "665f361a8e9344ee5ed38380daa454581bb929d581f7a4fed7fb7131f37197ba",
+          "root": "4412f69bb56e5256fe612ff5fbc1e550b4cc773a3f44fcd589f2727ff2eae44f",
+          "at": 1786611603500,
+          "sigAlg": "ed25519",
+          "sig": "zEZkjFio9Tsndr597PVPosp3XF2GRTWZzohifCkjDT9C2Hm-8d0eGE2k5uYgqBPN62r6iMNWwuRow4E994dKAg"
+        },
+        {
+          "by": "018f47a0-7b21-7abc-8def-a77e57000001",
+          "room": "team-room",
+          "fromSeq": 4,
+          "uptoSeq": 6,
+          "prev": "4412f69bb56e5256fe612ff5fbc1e550b4cc773a3f44fcd589f2727ff2eae44f",
+          "root": "325f034f4997191a61125f3d5eeaf5953d6a269faaa7f78c0b9b174d7d0b6a0a",
+          "at": 1786611606500,
+          "sigAlg": "ed25519",
+          "sig": "xV47BgwYlhtTL-4UzIhJb3GRlGtMJyDnScpiaKG-AyCymUUyTUHuWJrUjJVcXUZkglZALlpErekwnGsqwOQUAA"
+        }
+      ],
+      "expected": {
+        "equivocationEvidence": false,
+        "lead": true,
+        "evidenceAgainstWitness": false
+      }
+    },
+    {
+      "label": "a witness naming a held checkpoint's range with another root: evidence against the witness, not the attester",
+      "witness": {
+        "attester": "018f47a0-7b21-7abc-8def-a77e57000001",
+        "room": "team-room",
+        "fromSeq": 4,
+        "uptoSeq": 6,
+        "root": "0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f",
+        "by": "018f47a0-7b21-7abc-8def-a77e57000002",
+        "role": "participant",
+        "at": 1786611608500,
+        "sigAlg": "ed25519",
+        "sig": "IozTfYxNqXooDZUQQ-yTQaGZ_wJnOSUsEflaQSLZaa9NlMe7-X8FQ0xSRi-LWjB8jYCnLlEc3sMNXQdZaP_RDQ"
+      },
+      "payloadHex": "6d6d702d6174746573742d7769746e6573732d76310a33363a30313866343761302d376232312d376162632d386465662d613737653537303030303031393a7465616d2d726f6f6d313a34313a3636343a3066306630663066306630663066306630663066306630663066306630663066306630663066306630663066306630663066306630663066306630663066306633363a30313866343761302d376232312d376162632d386465662d61373765353730303030303231313a7061727469636970616e7431333a31373836363131363038353030",
+      "held": [
+        {
+          "by": "018f47a0-7b21-7abc-8def-a77e57000001",
+          "room": "team-room",
+          "fromSeq": 1,
+          "uptoSeq": 1,
+          "prev": "genesis",
+          "root": "665f361a8e9344ee5ed38380daa454581bb929d581f7a4fed7fb7131f37197ba",
+          "at": 1786611601500,
+          "sigAlg": "ed25519",
+          "sig": "iUowNBs6Ht1_37-a_NkOZEUWuwvSv_Q3-dG6shKRDXivFOQORFALEETUYF-Clw2bUMnWe7-T1IyTRn8dlmuRBw"
+        },
+        {
+          "by": "018f47a0-7b21-7abc-8def-a77e57000001",
+          "room": "team-room",
+          "fromSeq": 2,
+          "uptoSeq": 3,
+          "prev": "665f361a8e9344ee5ed38380daa454581bb929d581f7a4fed7fb7131f37197ba",
+          "root": "4412f69bb56e5256fe612ff5fbc1e550b4cc773a3f44fcd589f2727ff2eae44f",
+          "at": 1786611603500,
+          "sigAlg": "ed25519",
+          "sig": "zEZkjFio9Tsndr597PVPosp3XF2GRTWZzohifCkjDT9C2Hm-8d0eGE2k5uYgqBPN62r6iMNWwuRow4E994dKAg"
+        },
+        {
+          "by": "018f47a0-7b21-7abc-8def-a77e57000001",
+          "room": "team-room",
+          "fromSeq": 4,
+          "uptoSeq": 6,
+          "prev": "4412f69bb56e5256fe612ff5fbc1e550b4cc773a3f44fcd589f2727ff2eae44f",
+          "root": "325f034f4997191a61125f3d5eeaf5953d6a269faaa7f78c0b9b174d7d0b6a0a",
+          "at": 1786611606500,
+          "sigAlg": "ed25519",
+          "sig": "xV47BgwYlhtTL-4UzIhJb3GRlGtMJyDnScpiaKG-AyCymUUyTUHuWJrUjJVcXUZkglZALlpErekwnGsqwOQUAA"
+        }
+      ],
+      "expected": {
+        "equivocationEvidence": false,
+        "lead": true,
+        "evidenceAgainstWitness": true
+      }
+    }
+  ],
   "linkChecks": [
     {
       "label": "a checkpoint whose prev is held but which does not start right after it: malformed, not evidence",
@@ -648,7 +762,7 @@
       }
     },
     {
-      "label": "a reversed range: refused",
+      "label": "a reversed range, signed over its own fields: refused by the rule, not the signature",
       "checkpoint": {
         "by": "018f47a0-7b21-7abc-8def-a77e57000001",
         "room": "team-room",
@@ -658,7 +772,7 @@
         "root": "4412f69bb56e5256fe612ff5fbc1e550b4cc773a3f44fcd589f2727ff2eae44f",
         "at": 1786611603500,
         "sigAlg": "ed25519",
-        "sig": "zEZkjFio9Tsndr597PVPosp3XF2GRTWZzohifCkjDT9C2Hm-8d0eGE2k5uYgqBPN62r6iMNWwuRow4E994dKAg"
+        "sig": "Lbbh326KY3AqjLAexr1FmomT0bO3wHsxZceHRcp_1iT98n4rXdPftOc0n7ZMZe4U0SazT8481hE4LQekWHujDg"
       },
       "prev": {
         "by": "018f47a0-7b21-7abc-8def-a77e57000001",
diff --git a/tests/spec-update-attest-chain.test.js b/tests/spec-update-attest-chain.test.js
index 9348d8a7..86218923 100644
--- a/tests/spec-update-attest-chain.test.js
+++ b/tests/spec-update-attest-chain.test.js
@@ -97,6 +97,23 @@ describe('the sym-attest-v1 vector: the four signed constructions and the chaine
     }
   });
 
+  it('witness leads: never equivocation evidence; evidence against the witness only for a held range with another root', () => {
+    for (const c of V.witnessLeads) {
+      const st = new AttestationStore({});
+      for (const h of c.held) assert.strictEqual(st.recordCheckpoint(store(h)).stored, true);
+      const w = core.fromWireWitness(c.witness);
+      assert.strictEqual(core.witnessPayload(w).toString('hex'), c.payloadHex, c.label);
+      assert.strictEqual(core.verifyWitness(w, KEY.witness).valid, true);
+      const a = st.witnessAssessment(w);
+      const ours = { equivocationEvidence: a.equivocationEvidence, lead: a.lead, evidenceAgainstWitness: a.evidenceAgainstWitness };
+      assert.deepStrictEqual(ours, c.expected, c.label);
+      assert.deepStrictEqual(ours, L.attestWitnessAssessment(c.witness, c.held));
+      const r = st.recordWitness(w);
+      assert.strictEqual(r.reason, c.expected.evidenceAgainstWitness ? 'disagrees' : 'lead');
+      assert.strictEqual(st.attesterEquivocated(c.witness.attester), false);
+    }
+  });
+
   it('link checks: malformed, not evidence', () => {
     for (const c of V.linkChecks) {
       // A reversed range is refused at the wire already; the rule is checked on the raw shape too.
@@ -132,13 +149,16 @@ describe('the store holds one chain per attester (§5.2)', () => {
     assert.strictEqual(st.recordCheckpoint(store(c.checkpoint)).reason, 'malformed-link');
     assert.strictEqual(st.attesterEquivocated(c.prev.by), false);
   });
-  it('a witness naming another range or root than the checkpoint held is refused, and never frames the attester', () => {
+  it('a witness naming another range (a lead) or another root (against the witness) than the checkpoint held is refused, and never frames the attester', () => {
     const st = s();
     for (const x of V.checkpoints) st.recordCheckpoint(store(x.checkpoint));
     const w = core.fromWireWitness(V.witness.witness);
     assert.strictEqual(st.recordWitness(w).stored, true);
-    const other = { ...w, by: '018f47a0-7b21-7abc-8def-a77e57000003', from_seq: 5, sig: w.sig.replace(/^./, (ch) => (ch === 'A' ? 'B' : 'A')) };
-    assert.strictEqual(st.recordWitness(other).reason, 'disagrees');
+    const respell = (ch) => (ch === 'A' ? 'B' : 'A');
+    const otherRange = { ...w, by: '018f47a0-7b21-7abc-8def-a77e57000003', from_seq: 5, sig: w.sig.replace(/^./, respell) };
+    assert.strictEqual(st.recordWitness(otherRange).reason, 'lead', 'another range overlapping the held one: a lead');
+    const otherRoot = { ...w, by: '018f47a0-7b21-7abc-8def-a77e57000004', root: 'f'.repeat(64), sig: w.sig.replace(/^./, respell) };
+    assert.strictEqual(st.recordWitness(otherRoot).reason, 'disagrees', 'the held range with another root: against the witness');
     assert.strictEqual(st.attesterEquivocated(w.attester), false);
   });
 });

From 083be3220fd2d87071bc97188b085c4561fb35d1 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 8 Oct 2026 12:51:42 +0100
Subject: [PATCH 140/148] tests: the full suite at f3c1472, aligned: node-stats
 is closed, attestations are about room-bound records
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The full suite and the integration suite at f3c1472 (under the heavy lock) found four tests that
still pinned what update 1 changed:

- node-stats: the stats object is closed (sym-attest-frame.schema.json), so a frame carrying a
  self-asserted name and nodeId is now refused, not read around; the test sends both.
- e2e-admission, e2e-attestation-gossip, e2e-checkpoint-witness (integration): they gated directed
  records, about which no attestation is signed since S3 (018206d; sym-attest-v1 §5.1). They gate
  room-bound records now; e2e-admission also pins that a directed record is attested by nobody, and
  e2e-checkpoint-witness that the first checkpoint is chained to genesis over 1..2.

handshake.schema.json is vendored from 0ab7b76 too (PR #43's final head, per the coordinator), and
one test pins that the hello, a record, a sealed record, a grant, relay-auth and sym-attest all name a
room by the §5.8 pattern sym uses, and the hello its nodeId in the lowercase spelling.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QRVMpaJkAA2fFbvuHCEzqH
---
 tests/fixtures/SOURCES.json                 |   4 +
 tests/fixtures/handshake.schema.json        | 105 ++++++++++++++++++++
 tests/integration/e2e-admission.js          |  17 +++-
 tests/integration/e2e-attestation-gossip.js |   2 +-
 tests/integration/e2e-checkpoint-witness.js |   4 +-
 tests/node-stats.test.js                    |   4 +-
 tests/spec-update-vectors.test.js           |  17 ++++
 7 files changed, 147 insertions(+), 6 deletions(-)
 create mode 100644 tests/fixtures/handshake.schema.json

diff --git a/tests/fixtures/SOURCES.json b/tests/fixtures/SOURCES.json
index b00f6072..79bf4815 100644
--- a/tests/fixtures/SOURCES.json
+++ b/tests/fixtures/SOURCES.json
@@ -78,6 +78,10 @@
     "sym-attest-v1.json": {
       "from": "conformance/v2/sym-attest-v1.json",
       "sha256": "3f5639e92f7f1bcb34bd88b16d35badfcef6c3f22ed6f170faa36f884b3fa369"
+    },
+    "handshake.schema.json": {
+      "from": "schema/handshake.schema.json",
+      "sha256": "69f257bdc5606c25e4a1ddef27a05b0f626a6302ded916f355b42f7e76f504cb"
     }
   }
 }
diff --git a/tests/fixtures/handshake.schema.json b/tests/fixtures/handshake.schema.json
new file mode 100644
index 00000000..10b8a53d
--- /dev/null
+++ b/tests/fixtures/handshake.schema.json
@@ -0,0 +1,105 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://meshcognition.org/spec/mmp/schema/handshake.schema.json",
+  "title": "MMP v2.0 authenticated handshake frames",
+  "oneOf": [
+    { "$ref": "#/$defs/clientHello" },
+    { "$ref": "#/$defs/serverHello" },
+    { "$ref": "#/$defs/clientFinish" }
+  ],
+  "$defs": {
+    "nodeOffer": {
+      "type": "object",
+      "required": [
+        "protocolVersion", "room", "nodeId", "name", "identityPublicKey",
+        "e2ePublicKey", "nonce", "implementation", "extensions"
+      ],
+      "properties": {
+        "protocolVersion": { "const": "2.0" },
+        "room": { "type": "string", "pattern": "^[a-z0-9._-]{1,64}$" },
+        "nodeId": { "type": "string", "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$" },
+        "name": { "type": "string", "minLength": 1 },
+        "identityPublicKey": { "type": "string", "pattern": "^[A-Za-z0-9_-]{43}$" },
+        "e2ePublicKey": { "type": "string", "pattern": "^[A-Za-z0-9_-]{43}$" },
+        "nonce": { "type": "string", "pattern": "^[A-Za-z0-9_-]{43}$" },
+        "implementation": {
+          "type": "object",
+          "required": ["name", "version"],
+          "additionalProperties": false,
+          "properties": {
+            "name": { "type": "string", "minLength": 1 },
+            "version": { "type": "string", "minLength": 1 }
+          }
+        },
+        "extensions": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": { "type": "string", "pattern": "^[a-z0-9][a-z0-9._-]*$" }
+        }
+      }
+    },
+    "clientHello": {
+      "allOf": [
+        { "$ref": "#/$defs/nodeOffer" },
+        {
+          "type": "object",
+          "required": ["type"],
+          "additionalProperties": false,
+          "properties": {
+            "type": { "const": "client-hello" },
+            "protocolVersion": true,
+            "room": true,
+            "nodeId": true,
+            "name": true,
+            "identityPublicKey": true,
+            "e2ePublicKey": true,
+            "nonce": true,
+            "implementation": true,
+            "extensions": true
+          }
+        }
+      ]
+    },
+    "serverHello": {
+      "allOf": [
+        { "$ref": "#/$defs/nodeOffer" },
+        {
+          "type": "object",
+          "required": ["type", "clientNonce", "selectedExtensions", "proof", "keyConfirmation"],
+          "additionalProperties": false,
+          "properties": {
+            "type": { "const": "server-hello" },
+            "protocolVersion": true,
+            "room": true,
+            "nodeId": true,
+            "name": true,
+            "identityPublicKey": true,
+            "e2ePublicKey": true,
+            "nonce": true,
+            "implementation": true,
+            "extensions": true,
+            "clientNonce": { "type": "string", "pattern": "^[A-Za-z0-9_-]{43}$" },
+            "selectedExtensions": {
+              "type": "array",
+              "uniqueItems": true,
+              "items": { "type": "string", "pattern": "^[a-z0-9][a-z0-9._-]*$" }
+            },
+            "proof": { "type": "string", "pattern": "^[A-Za-z0-9_-]{86}$" },
+            "keyConfirmation": { "type": "string", "pattern": "^[A-Za-z0-9_-]{43}$" }
+          }
+        }
+      ]
+    },
+    "clientFinish": {
+      "type": "object",
+      "required": ["type", "transcriptHash", "proof", "keyConfirmation"],
+      "additionalProperties": false,
+      "properties": {
+        "type": { "const": "client-finish" },
+        "transcriptHash": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
+        "proof": { "type": "string", "pattern": "^[A-Za-z0-9_-]{86}$" },
+        "keyConfirmation": { "type": "string", "pattern": "^[A-Za-z0-9_-]{43}$" }
+      }
+    }
+  }
+}
diff --git a/tests/integration/e2e-admission.js b/tests/integration/e2e-admission.js
index e8d6ce57..b1bb479a 100644
--- a/tests/integration/e2e-admission.js
+++ b/tests/integration/e2e-admission.js
@@ -30,7 +30,9 @@ function bidirectionalPair() {
 const sleep = ms => new Promise(r => setTimeout(r, ms));
 
 describe('E2E Admission Attestation — gate attaches a signed verdict to the remix', () => {
-  it('an admitted directed CMB yields a valid attestation on B\'s stored remix', async () => {
+  // A room-bound record: since MMP 2.0 update 1 (sym-attest-v1 §5.1) no attestation is signed about a
+  // directed record, which would make the attestation a confirmation oracle on a one-to-one record.
+  it('an admitted room-bound CMB yields a valid attestation on B\'s stored remix; a directed one yields none', async () => {
     const aName = `e2e-adm-a-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
     const bName = `e2e-adm-b-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
     const A = new SymNode({ name: aName, silent: true, discovery: new NullDiscovery(), room: 'sym-bot-team' }); // same room as B (MMP §5.8: rooms do not exchange)
@@ -52,10 +54,10 @@ describe('E2E Admission Attestation — gate attaches a signed verdict to the re
         focus: 'e2e admission attestation', issue: 'gate must attach a signed verdict',
         intent: 'phase C', motivation: 'durable audit record', commitment: 'on the remix',
         perspective: 'A', mood: { text: 'procedural', valence: 0, arousal: 0 },
-      }, { to: B.nodeId });
+      });
 
       const admitted = await (async () => { for (let i = 0; i < 100 && !received; i++) await sleep(50); return !!received; })();
-      assert.ok(admitted, 'B must process and admit the directed CMB');
+      assert.ok(admitted, 'B must process and admit the room-bound CMB');
 
       // On the store entry, beside the record (§8.8.1: the record is exactly its two sections).
       const att = received.entry?.admission;
@@ -70,6 +72,15 @@ describe('E2E Admission Attestation — gate attaches a signed verdict to the re
       assert.strictEqual(att.prev, 'genesis');
       assert.deepStrictEqual(verifyAttestation(att, B._identity.publicKey), { signed: true, valid: true }, 'signature verifies against B\'s identity key');
 
+      // A directed record is gated and delivered, and attested by nobody.
+      const directed = A.remember({
+        focus: 'e2e admission, directed', issue: 'no attestation about a one-to-one record',
+        intent: 'S3', motivation: 'no confirmation oracle', commitment: 'nothing signed',
+        perspective: 'A', mood: { text: 'procedural', valence: 0, arousal: 0 },
+      }, { to: B.nodeId });
+      await sleep(800);
+      assert.strictEqual(B.attestationsFor(directed.key).length, 0, 'no attestation about the directed record');
+
     } finally {
       await Promise.allSettled([A.stop(), B.stop()]);
       fs.rmSync(nodeDir(aName), { recursive: true, force: true });
diff --git a/tests/integration/e2e-attestation-gossip.js b/tests/integration/e2e-attestation-gossip.js
index 5fc44228..a970fc65 100644
--- a/tests/integration/e2e-attestation-gossip.js
+++ b/tests/integration/e2e-attestation-gossip.js
@@ -54,7 +54,7 @@ describe('E2E Admission Attestation gossip (D2)', () => {
       focus: 'attestation gossip e2e', issue: 'verify attestation reaches the author',
       intent: 'D2', motivation: 'cross-mesh audit trail', commitment: 'roster gossip',
       perspective: 'B', mood: { text: 'procedural', valence: 0, arousal: 0 },
-    }, { to: A.nodeId });
+    }); // room-bound: no attestation about a directed record is sent (sym-attest-v1 §5.1, MMP 2.0 update 1)
     const K = entry.key;
 
     const arrived = await (async () => { for (let i = 0; i < 100; i++) { await sleep(50); if (B.attestationsFor(K).length) return true; } return false; })();
diff --git a/tests/integration/e2e-checkpoint-witness.js b/tests/integration/e2e-checkpoint-witness.js
index a007ae9c..81bce81d 100644
--- a/tests/integration/e2e-checkpoint-witness.js
+++ b/tests/integration/e2e-checkpoint-witness.js
@@ -46,7 +46,8 @@ describe('E2E checkpoint + witness (D3)', () => {
 
     // B sends two distinct CMBs to A; A admits both, reaching seq 2 → A checkpoints.
     for (const n of [1, 2]) {
-      B.remember({ focus: `checkpoint e2e ${n}`, issue: 'x', intent: 'D3', motivation: 'm', commitment: 'c', perspective: 'B', mood: { text: 'procedural', valence: 0, arousal: 0 } }, { to: A.nodeId });
+      // Room-bound: a directed record is attested by nobody (sym-attest-v1 §5.1, MMP 2.0 update 1).
+      B.remember({ focus: `checkpoint e2e ${n}`, issue: 'x', intent: 'D3', motivation: 'm', commitment: 'c', perspective: 'B', mood: { text: 'procedural', valence: 0, arousal: 0 } });
       await sleep(150);
     }
 
@@ -55,6 +56,7 @@ describe('E2E checkpoint + witness (D3)', () => {
 
     const cp = A._attestations.latestCheckpoint(A.nodeId);
     assert.strictEqual(cp.upto_seq, 2, 'checkpoint committed at the interval');
+    assert.deepStrictEqual([cp.from_seq, cp.prev], [1, 'genesis'], 'the first chained checkpoint (MMP 2.0 update 1)');
     assert.ok(B._attestations.latestCheckpoint(A.nodeId), 'B received A\'s checkpoint');
 
     const recon = A.reconcileChain(A.nodeId);
diff --git a/tests/node-stats.test.js b/tests/node-stats.test.js
index c9aa91fe..ae8e2431 100644
--- a/tests/node-stats.test.js
+++ b/tests/node-stats.test.js
@@ -60,8 +60,10 @@ describe('node-stats — self-reported store tally', () => {
       const seen = [];
       node.on('node-stats', s => seen.push(s));
       const peer = admitAs(node, identity('research'));
-      // A self-asserted name and nodeId in the frame are not read: the session says who it is.
+      // The stats object is closed (sym-attest-frame.schema.json, MMP 2.0 update 1): a self-asserted
+      // name and nodeId make the frame malformed; the session says who sent it.
       deliver(node, peer, { type: 'sym-attest-node-stats', stats: { name: 'liar', nodeId: 'someone-else', emitted: 7, admitted: 65, memory: 158, at: 1 } });
+      deliver(node, peer, { type: 'sym-attest-node-stats', stats: { emitted: 7, admitted: 65, memory: 158, at: 1 } });
       deliver(node, peer, { type: 'sym-attest-node-stats', stats: { emitted: -1, admitted: 1, memory: 2, at: 1 } }); // malformed
       deliver(node, peer, { type: 'sym-attest-node-stats', stats: null });
       assert.strictEqual(seen.length, 1, 'only the well-formed stats surfaced');
diff --git a/tests/spec-update-vectors.test.js b/tests/spec-update-vectors.test.js
index 7b5a4611..5730b2b2 100644
--- a/tests/spec-update-vectors.test.js
+++ b/tests/spec-update-vectors.test.js
@@ -54,6 +54,23 @@ describe('control-encrypted-v2 (§7.1, §18.2.1)', () => {
   });
 });
 
+describe('one room grammar and one nodeId spelling, as every schema of the update states them', () => {
+  const { ROOM_RE } = require('../lib/core/room-id');
+  const UUID = '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$';
+  it('the hello, a record, a sealed record, a grant, relay-auth and sym-attest all name a room by §5.8\'s pattern, which sym uses', () => {
+    const rooms = [
+      vendored('handshake.schema.json').$defs.nodeOffer.properties.room.pattern,
+      vendored('cmb.schema.json').properties.metadata.properties.room.pattern,
+      vendored('encrypted-cmb-frame.schema.json').properties.metadata.properties.room.pattern,
+      vendored('room-join.schema.json').$defs.grant.properties.room.pattern,
+      vendored('relay-frame.schema.json').$defs.auth.properties.room.pattern,
+      vendored('sym-attest-frame.schema.json').$defs.room.pattern,
+    ];
+    for (const r of rooms) assert.strictEqual(r, ROOM_RE.source);
+    assert.strictEqual(vendored('handshake.schema.json').$defs.nodeOffer.properties.nodeId.pattern, UUID, 'and the hello names its nodeId in the lowercase spelling sym requires');
+  });
+});
+
 describe('the reference construction (scripts/mmp/lib.mjs) and sym agree', () => {
   let L;
   before(async () => { L = await import(path.join(FIX, 'mmp-lib.mjs')); });

From 15849b0d0e3347bf93f164a1a689609380a69b19 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Thu, 8 Oct 2026 13:02:29 +0100
Subject: [PATCH 141/148] =?UTF-8?q?remix()=20is=20asynchronous=20and=20?=
 =?UTF-8?q?=C2=A715.8-tethered:=20a=20remix=20drifted=20from=20its=20root?=
 =?UTF-8?q?=20is=20minted=20as=20a=20fresh=20root?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

By the founder's ruling (0.14.0 is the breaking release): §15.8 runs where the spec puts it, on the
remixing node. node.remix() now resolves the remix's nearest verified lineage root from the parents
it cites and evaluates the remix's own text against it (content-only, one kernel, α-weighted against
Tguarded) before minting:

- faithful: minted with its lineage, a `tethered` mmp-tether-v1 attestation on the entry;
- drifted past the floor: minted as a fresh root, no parent from the severed chain, the departed
  source in provenance.tether.departedFrom, a `severed` attestation;
- no verified root in reach (or nothing evaluable): minted with its lineage, unverified, unsigned.

The §15.7 flag is consumed when the call begins (a concurrent remix() is refused) and given back when
nothing is minted (a duplicate, a collapse); remember() inside remix() no longer sets it. remix()
refuses opts.cmb. MeshAgent's remix cycle and the XMesh synthesis loop await it; createCMB and the
tether share one category-text rule (mintCategoryText). The receive path's collapsed integrations
stay exempt (§15.5), unchanged. CHANGELOG: under breaking, with before and after.

Test: tests/spec-update-remix-tether.test.js. Not done (coordinator: wrap up): the mutation check on
the new guard, and the downstream survey of node.remix() callers in mesh-channel and xmesh.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QRVMpaJkAA2fFbvuHCEzqH
---
 CHANGELOG.md                           |  26 +++++-
 SECURITY.md                            |  16 ++--
 lib/core/cmb-encoder.js                |  16 +++-
 lib/frame-handler.js                   |  18 ++--
 lib/mesh-agent.js                      |  32 +++++--
 lib/node.js                            | 114 +++++++++++++++++++++----
 tests/node.test.js                     |   8 +-
 tests/rule-a-collapse.test.js          |   2 +-
 tests/spec-update-coupling.test.js     |   2 +-
 tests/spec-update-remix-tether.test.js |  99 +++++++++++++++++++++
 10 files changed, 285 insertions(+), 48 deletions(-)
 create mode 100644 tests/spec-update-remix-tether.test.js

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5ee66430..6c5ba955 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -204,11 +204,33 @@ sym-attest-v1 pass case by case, and every frame sym builds validates against th
   whether a refused record cites parents (`cites`), never that it was a remix.
 - **No tether on a collapsed integration (#17, §15.5).** sym's gates keep the incoming text, so every
   integration collapses onto the author's record as signed; it is no longer tethered, severed or
-  attested, and the retroactive audit judges only this node's own records. sym's receive path
-  therefore applies §15.8 to nothing, and `remix()` does not yet evaluate it (SECURITY.md).
+  attested, and the retroactive audit judges only this node's own records. §15.8 runs on the
+  remixing side instead: `remix()` (below, breaking).
 - **Layer 6** is given no valence or arousal (unsigned), a Legacy Import record's included.
 - **xmesh-insight-v1** is not offered by default; a host adds it with `extraExtensions`.
 
+### Breaking: `remix()` is asynchronous, and §15.8 runs on what it produces
+
+By the founder's ruling, §15.8 is enforced where the spec puts it, on the remixing node, in 0.14.0.
+`node.remix(categories, opts)` now evaluates the remix against its nearest verified lineage root
+(content-only, one kernel, α-weighted drift against Tguarded) before it is minted: a faithful remix
+keeps its lineage; one drifted past the floor is minted as a fresh root, with no parent from the
+severed chain and the departed source on the entry (`provenance.tether.departedFrom`); one with no
+verified root in reach keeps its lineage, unverified. A verdict is signed as an mmp-tether-v1
+attestation on the entry (`entry.tether`). The §15.7 flag is consumed when the call begins and given
+back if nothing is minted. The receive path's collapsed integrations stay exempt (§15.5).
+
+```js
+// before (0.13, 0.14 development builds)
+const entry = node.remix(categories, { parents });
+// after (0.14.0)
+const entry = await node.remix(categories, { parents });
+if (entry.tether) console.log(entry.tether.verdict); // 'tethered' | 'severed'
+```
+
+`remix()` takes categories and parents only (`opts.cmb` throws). MeshAgent's remix cycle and the XMesh
+synthesis loop await it.
+
 ### Interop with 0.13.17
 
 LAN meshing with 0.13.17 stops except through Legacy Import routes, by design. A 0.13.17 node
diff --git a/SECURITY.md b/SECURITY.md
index 6f7b2f21..f2acbae1 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -332,14 +332,14 @@ Every store a peer can feed has a fixed bound. Reaching one never stops the node
   LAN every node advertises on `_sym._tcp` with its room in the TXT `room` key, in cleartext to the
   segment: a room name is not a credential, and the TXT room is a hint for whom to dial, never an
   admission (the handshake decides).
-- **§15.8 is not applied to what this node receives.** MMP 2.0 update 1 (§15.5) exempts a collapsed
-  integration from the lineage tether, and sym's gates always collapse (they keep the incoming text,
-  so they store the author's record as signed). A peer's record that cites a root it has drifted
-  from is therefore kept with its author's lineage; the tether is the remixing node's duty. sym's
-  own remix path (`remix()`) does not yet evaluate the tether before it mints, and the retroactive
-  audit (`auditLineageTethers`) judges only this node's own records, which it cannot tell apart from
-  its replies. Lineage confers retention here (a hot descendant keeps its ancestors hot), never
-  authority or lifecycle.
+- **§15.8 is applied by the remixing node, not the receiver.** MMP 2.0 update 1 (§15.5) exempts a
+  collapsed integration from the lineage tether, and sym's gates always collapse (they store the
+  author's record as signed), so a peer's record that cites a root it has drifted from is kept with
+  its author's lineage; the tether is that author's duty. sym does its own: `remix()` evaluates every
+  remix it mints against its root and severs a drifted lineage. The retroactive audit
+  (`auditLineageTethers`) judges only this node's own records, which it cannot tell apart from its
+  replies. Lineage confers retention here (a hot descendant keeps its ancestors hot), never authority
+  or lifecycle.
 - **LAN meshing with sym 0.13.17 stops** except through configured Legacy Import routes, by design:
   a 0.13.17 node advertises no `mmp` key, so a 0.14 node never dials it as Core Secure, and a 0.14
   listener closes its legacy hello at once.
diff --git a/lib/core/cmb-encoder.js b/lib/core/cmb-encoder.js
index ad46cc38..f62fdf8b 100644
--- a/lib/core/cmb-encoder.js
+++ b/lib/core/cmb-encoder.js
@@ -576,6 +576,16 @@ function mintLineage(lineage) {
   return out;
 }
 
+/**
+ * The text a category is minted with from what a caller passed (a string, or `{ text }`): NFC, and
+ * 'neutral' when there is none. One definition, for createCMB and for anything that must see a
+ * record's text before it is minted (remix()'s §15.8 tether).
+ */
+function mintCategoryText(value) {
+  const text = typeof value === 'string' ? value : (value && typeof value.text === 'string' ? value.text : '');
+  return (text || 'neutral').normalize('NFC');
+}
+
 function createCMB(opts = {}) {
   // §7.2 [MUST]: createdBy is the agent id and is REQUIRED. It used to default to the string
   // 'unknown', which minted a record whose author could never be resolved to a key — an
@@ -620,7 +630,7 @@ function createCMB(opts = {}) {
       // valence and arousal are measurements in [-1, 1]. One that is absent is OMITTED, never
       // invented as 0 (a 0 claims a measured neutral), and one out of range is refused. A mood given
       // only as numbers keeps them: dropping to {text:'neutral'} threw the measurement away.
-      const mood = { text: ((typeof value.text === 'string' && value.text) || 'neutral').normalize('NFC') };
+      const mood = { text: mintCategoryText(value) };
       for (const axis of ['valence', 'arousal']) {
         const v = value[axis];
         if (v === undefined || v === null) continue;
@@ -631,8 +641,7 @@ function createCMB(opts = {}) {
       }
       categories[f] = mood;
     } else {
-      const text = ((typeof value === 'string' ? value : value?.text) || 'neutral');
-      categories[f] = { text: typeof text === 'string' ? text.normalize('NFC') : text };
+      categories[f] = { text: mintCategoryText(value) };
     }
   }
   // A record built from a peer's categories-only frame, only to be evaluated, is held to no minting
@@ -799,6 +808,7 @@ module.exports = {
   assertRecordSize,
   assertAgentId,
   assertRecordSendable,
+  mintCategoryText,
   recordBytes,
   textBytes,
   DEFAULT_ROOM,
diff --git a/lib/frame-handler.js b/lib/frame-handler.js
index 0b0f74e6..e9da0118 100644
--- a/lib/frame-handler.js
+++ b/lib/frame-handler.js
@@ -2060,17 +2060,23 @@ class FrameHandler {
         return;
       }
       this._lastSynthesisAt = now;
+      // A record this node cannot sign is its key's failure, said by remember() already; naming the
+      // delegate would send the operator to the wrong place.
+      const failed = (err) => {
+        if (err && err.code === 'ESIGN') this._node._log('Synthesis not shared: this node cannot sign its records');
+        else this._node._log(`Synthesis delegate error: ${err && err.message}`);
+      };
       try {
         const synthesis = this._node._synthesisDelegate(insight);
         if (synthesis) {
-          const r = this._node.remix(synthesis, { tags: ['xmesh-synthesis'] });
-          if (r && !r.refused && !r.duplicate) this._node._log(`Synthesis loop: shared domain insight back to mesh`);
+          // remix() is asynchronous (0.14.0, §15.8); its outcome is said when it settles, and a failure
+          // is contained here rather than left to the unhandled-rejection handler.
+          Promise.resolve(this._node.remix(synthesis, { tags: ['xmesh-synthesis'] })).then((r) => {
+            if (r && !r.refused && !r.duplicate) this._node._log('Synthesis loop: shared domain insight back to mesh');
+          }, failed);
         }
       } catch (err) {
-        // A record this node cannot sign is its key's failure, said by remember() already; naming the
-        // delegate would send the operator to the wrong place.
-        if (err && err.code === 'ESIGN') this._node._log('Synthesis not shared: this node cannot sign its records');
-        else this._node._log(`Synthesis delegate error: ${err && err.message}`);
+        failed(err);
       }
     }
   }
diff --git a/lib/mesh-agent.js b/lib/mesh-agent.js
index 8ed50f8f..b5832405 100644
--- a/lib/mesh-agent.js
+++ b/lib/mesh-agent.js
@@ -11,7 +11,7 @@ const { recordCreatedBy, recordLineage } = require('./record');
  *
  * The agent IS the intelligence (Section 13). The protocol provides:
  *
- *   1. cmb-accepted → canRemix() → agent.remix() → remember() with lineage
+ *   1. cmb-accepted → canRemix() → agent.remix() → await node.remix() (§15.8-tethered) with lineage
  *   2. Domain poll → fingerprint change → agent.reason() → remember()
  *   3. Silence when nothing new (Section 14.7)
  *
@@ -320,7 +320,9 @@ class MeshAgent {
     };
 
     // The remix path (§15.5/§15.7): gated on new domain data, unlike an agent's own remember().
-    const stored = this._remember(remixCategories, { parents: [parent], ...(meta ? { meta } : {}) }, { remix: true });
+    // remix() is asynchronous (0.14.0): §15.8 evaluates the remix against its lineage root before it
+    // is minted, and severs a lineage the remix has drifted from.
+    const stored = await this._remix_(remixCategories, { parents: [parent], ...(meta ? { meta } : {}) });
     if (this._signingHalted) return;
     if (!stored || stored.refused || stored.duplicate) {
       console.log(`[${this._name}] remix not minted by SDK${stored && stored.refused ? ` (${stored.refused})` : stored && stored.duplicate ? ' (duplicate)' : ''}`);
@@ -338,17 +340,31 @@ class MeshAgent {
    * and observing, instead of an error per admitted record and a model call it can never use.
    * @private
    */
-  _remember(categories, opts, { remix = false } = {}) {
+  _remember(categories, opts) {
     try {
-      return remix ? this._node.remix(categories, opts) : this._node.remember(categories, opts);
+      return this._node.remember(categories, opts);
     } catch (err) {
-      if (!err || err.code !== 'ESIGN') throw err;
-      this._signingHalted = true;
-      console.error(`[${this._name}] HALTED: this node cannot sign (${err.message}). It emits nothing until its identity key is readable again; fix that and restart it.`);
-      return null;
+      return this._halted(err);
     }
   }
 
+  /** The remix path's remember(): node.remix(), awaited, with the same halt on ESIGN. @private */
+  async _remix_(categories, opts) {
+    try {
+      return await this._node.remix(categories, opts);
+    } catch (err) {
+      return this._halted(err);
+    }
+  }
+
+  /** @private Halt on ESIGN (this node cannot sign); any other error is the caller's. */
+  _halted(err) {
+    if (!err || err.code !== 'ESIGN') throw err;
+    this._signingHalted = true;
+    console.error(`[${this._name}] HALTED: this node cannot sign (${err.message}). It emits nothing until its identity key is readable again; fix that and restart it.`);
+    return null;
+  }
+
   async _checkDomain() {
     if (this._signingHalted) return;
     console.log(`[${this._name}] checking domain...`);
diff --git a/lib/node.js b/lib/node.js
index 0984a25b..2be15321 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -33,6 +33,10 @@ const { parsePin } = require('./core/authority');
 const { RosterKeyRegistry, keyFingerprint } = require('./roster-keys');
 const { signedProjection, isLowerUuid } = require('./core/record-canonical');
 const { buildMoodFrame } = require('./core/mood-frame');
+const { signTetherAttestation } = require('./core/tether-attestation');
+const { mintCategoryText } = require('./core/cmb-encoder');
+/** remember()'s mark that remix() is the caller: what it mints is not new domain data (§15.7). */
+const REMIX_MINT = Symbol('remix-mint');
 const { isRoomId } = require('./core/room-id');
 /** A stored record's signed projection, or null for one that is not a v2.0 record. */
 const projectionOrNull = (cmb) => {
@@ -2803,8 +2807,9 @@ class SymNode extends EventEmitter {
     }
 
     // A record the agent authored is new domain data by construction (§15.7.2, draft spec PR #35),
-    // with or without parents. Only the remix path (`remix()`) consumes the flag.
-    this._hasNewDomainData = true;
+    // with or without parents. Only the remix path (`remix()`) consumes the flag, and what it mints
+    // is not new domain data.
+    if (!opts[REMIX_MINT]) this._hasNewDomainData = true;
 
     // HEAD advances only when something was actually minted, and the key is remembered as ours
     // so a later self-parent is recognisable without resolving anything.
@@ -3045,32 +3050,111 @@ class SymNode extends EventEmitter {
   }
 
   /**
-   * THE REMIX PATH (MMP §15.5, §15.7; draft spec PR meshcognition-website#35): the record this node
-   * mints by integrating an admitted peer record (`parents`) through its own domain lens. Only this
-   * path is gated: with no new domain data since the last remix it is refused, and the result says
-   * so — `{ refused: 'remix-without-new-domain-data' }` — where remember() would have minted. A
-   * remix that mints consumes the flag. Everything else is remember()'s.
+   * THE REMIX PATH (MMP §15.5, §15.7, §15.8; MMP 2.0 update 1): the record this node mints by
+   * integrating admitted peer records (`parents`) through its own domain lens. Asynchronous, because
+   * §15.8 has the remixing node evaluate what it produces before it asserts any descent.
+   *
+   *   1. §15.7: with no new domain data since the last remix, nothing is minted:
+   *      `{ refused: 'remix-without-new-domain-data' }`. The flag is consumed when the call begins (a
+   *      second remix() started meanwhile waits for new data) and given back if nothing is minted.
+   *   2. §15.8: the remix is evaluated, content-only and in one kernel, against its nearest resolvable
+   *      lineage root (the earliest stored ancestor reached through records this node verified, as the
+   *      receiver's walk resolves it), with the α-weighted category drift against Tguarded:
+   *        - faithful (tethered): minted with its lineage;
+   *        - drifted past the floor (severed): minted as a fresh root, with no parent from the severed
+   *          chain; the departed source is kept on the entry (`provenance.tether.departedFrom`);
+   *        - no verified root in reach, or nothing evaluable (unverifiable): minted with its lineage,
+   *          and the tether is unverified, a trust state, never a severance.
+   *      A tethered or severed verdict is signed as an mmp-tether-v1 attestation (`entry.tether`,
+   *      beside the record) naming the remix, the anchor, the kernel, the drift and the verdict. With
+   *      the tether turned off (`lineageTether: false`) step 2 is skipped.
+   *   3. The record is minted by remember(). A remix whose words equal a record this node holds
+   *      mints nothing (a duplicate, or the collapse onto this node's HEAD): no tether applies to it
+   *      (§15.5), and the flag is given back.
+   *
+   * Breaking in 0.14.0: it returned the entry; it returns a Promise of it (see CHANGELOG).
    * @param {object} categories
    * @param {object} [opts] - remember()'s options; `parents` names the integrated records
-   * @returns {object|null} the stored entry, `{ refused }`, `{ key, duplicate: true }`, or null
+   * @returns {Promise<object|null>} the stored entry (with `.tether`, `.provenance.tether` when a
+   *   verdict was reached), `{ refused }`, `{ key, duplicate: true }`, a collapse, or null
    */
-  remix(categories, opts = {}) {
+  async remix(categories, opts = {}) {
     if (!this._hasNewDomainData) {
       this._metrics.remixRejected++;
       this._log('Remix not minted: no new domain data since the last remix (MMP §15.7)');
       this.emit('metric', { type: 'remix-rejected', reason: 'no-new-domain-data' });
       return { refused: 'remix-without-new-domain-data' };
     }
-    const entry = this.remember(categories, opts);
-    if (entry && !entry.refused && !entry.duplicate && !entry.collapsed) {
-      this._hasNewDomainData = false;
-      // Counted here, on the gated path only (MMP §15.7, update 1, #35): a record remember() mints with
-      // parents (a reply, an outcome, a trail decision) is not a remix.
-      this._metrics.remixProduced++;
+    if (opts.cmb) throw new TypeError('remix() mints its own record: it takes categories and parents, not a record (opts.cmb)');
+    this._hasNewDomainData = false; // consumed now; given back below if nothing is minted
+    let entry;
+    let tether = null;
+    const parentKeys = (Array.isArray(opts.parents) ? opts.parents : []).map((p) => p && (p.metadata?.key ?? p.key)).filter((k) => typeof k === 'string');
+    try {
+      let mintOpts = opts;
+      if (this._lineageTether && parentKeys.length > 0) {
+        tether = await this._remixTether(categories, parentKeys);
+        if (tether && tether.checked && !tether.tethered) mintOpts = { ...opts, parents: undefined, categoryParents: undefined };
+      }
+      entry = this.remember(categories, { ...mintOpts, [REMIX_MINT]: true });
+    } catch (err) {
+      this._hasNewDomainData = true;
+      throw err;
+    }
+    if (!entry || entry.refused || entry.duplicate || entry.collapsed) {
+      this._hasNewDomainData = true;
+      return entry;
     }
+    // Counted here, on the gated path only (MMP §15.7, update 1, #35): a record remember() mints with
+    // parents (a reply, an outcome, a trail decision) is not a remix.
+    this._metrics.remixProduced++;
+    if (tether && tether.checked) this._recordRemixTether(entry, tether, parentKeys);
     return entry;
   }
 
+  /**
+   * §15.8 for a remix about to be minted: resolve its nearest verified lineage root from the parents
+   * it cites, and evaluate the remix's own category text against it, content-only, in one kernel.
+   * @returns {Promise<object|null>} tetherOfRecord's verdict, or null when no verified root is in reach
+   * @private
+   */
+  async _remixTether(categories, parentKeys) {
+    const { resolveTetherAnchor, tetherOfRecord } = require('./core');
+    const anchor = resolveTetherAnchor({ metadata: { lineage: { parents: parentKeys } } }, (k) => this._store.get(k));
+    if (!anchor || !anchor.categories || !anchor.resolvedFromStore) return null;
+    const texts = Object.fromEntries(CAT7_CATEGORIES.map((f) => [f, { text: mintCategoryText(categories && categories[f]) }]));
+    const t = await tetherOfRecord(texts, anchor, { categoryWeights: this._svafCategoryWeights, guardedThreshold: this._svafGuardedThreshold });
+    if (t && t.checked && !t.tethered) {
+      this._log(`[§15.8] remix drifted ${t.drift.toFixed(3)} from its root ${String(t.anchorKey).slice(0, 16)}… past the reject floor: minted as a fresh root, with no lineage`);
+      this.emit('metric', { type: 'lineage-tether-severed', anchor: t.anchorKey, drift: t.drift, remix: true });
+    }
+    return t;
+  }
+
+  /**
+   * Keep a remix's §15.8 verdict on its store entry, beside the record (§8.8.1), and sign it as an
+   * mmp-tether-v1 attestation.
+   * @private
+   */
+  _recordRemixTether(entry, tether, parentKeys) {
+    const stored = this._store.get(entry.key);
+    if (!stored) return;
+    const severed = !tether.tethered;
+    const t = { severed, anchor: tether.anchorKey, kernelId: tether.kernelId, drift: tether.drift, ...(severed ? { departedFrom: parentKeys[0] ?? null } : {}) };
+    stored.provenance = { ...stored.provenance, tether: t };
+    try {
+      stored.tether = signTetherAttestation({
+        of: entry.key, anchor: tether.anchorKey, kernelId: tether.kernelId, drift: tether.drift,
+        verdict: severed ? 'severed' : 'tethered', by: this.nodeId, at: Date.now(),
+      }, this._identity.privateKey);
+    } catch (err) {
+      this._log(`[§15.8] tether attestation not signed: ${err.message}`); // SHOULD: the verdict stands without it
+    }
+    this._store._persist(stored);
+    entry.provenance = stored.provenance;
+    if (stored.tether) entry.tether = stored.tether;
+  }
+
   /**
    * Mark that the agent has completed a remix cycle. Resets the
    * new-domain-data flag so the agent stays silent until it has
diff --git a/tests/node.test.js b/tests/node.test.js
index a99034dd..b3e55ede 100644
--- a/tests/node.test.js
+++ b/tests/node.test.js
@@ -286,7 +286,7 @@ describe('SymNode', () => {
 
     // No domain data yet — the REMIX PATH is refused, and says so (draft spec PR #35: §15.7 gates
     // only the node's integration of a peer record, never remember()).
-    const rejected = node.remix(
+    const rejected = await node.remix(
       { focus: 'remix attempt', issue: 'none', intent: 'test', motivation: 'test',
         commitment: 'test', perspective: 'test', mood: { text: 'neutral', valence: 0, arousal: 0 } },
       { parents: [{ key: 'cmb-fake-parent', lineage: { ancestors: [] } }] }
@@ -301,7 +301,7 @@ describe('SymNode', () => {
     assert.strictEqual(node.canRemix(), true);
 
     // Now remix should succeed
-    const accepted = node.remix(
+    const accepted = await node.remix(
       { focus: 'valid remix', issue: 'none', intent: 'test', motivation: 'test',
         commitment: 'test', perspective: 'test', mood: { text: 'neutral', valence: 0, arousal: 0 } },
       { parents: [{ key: 'cmb-fake-parent', lineage: { ancestors: [] } }] }
@@ -392,7 +392,7 @@ describe('SymNode', () => {
     assert.strictEqual(node.canRemix(), true, 'domain observation should enable remix');
 
     // Remix should succeed and RESET canRemix
-    const remix = node.remix(
+    const remix = await node.remix(
       { ...categories, focus: 'remix of peer signal' },
       { parents: [{ key: 'cmb-parent-123', lineage: { ancestors: [] } }] }
     );
@@ -400,7 +400,7 @@ describe('SymNode', () => {
     assert.strictEqual(node.canRemix(), false, 'remix should reset hasNewDomainData');
 
     // Second remix without new domain data should be rejected
-    const rejected = node.remix(
+    const rejected = await node.remix(
       { ...categories, focus: 'second remix attempt' },
       { parents: [{ key: 'cmb-parent-456', lineage: { ancestors: [] } }] }
     );
diff --git a/tests/rule-a-collapse.test.js b/tests/rule-a-collapse.test.js
index 98ab3c0d..d88888e3 100644
--- a/tests/rule-a-collapse.test.js
+++ b/tests/rule-a-collapse.test.js
@@ -127,7 +127,7 @@ test('B-2: the REMIX PATH still requires new domain data; remember() citing a pe
   await withNode('rule-a-peerparent', async (node) => {
     node._hasNewDomainData = false;
     const peerBlock = { metadata: { key: 'cmb-' + 'f'.repeat(64) } };   // not ours
-    const res = node.remix({ ...FIELDS }, { parents: [peerBlock] });
+    const res = await node.remix({ ...FIELDS }, { parents: [peerBlock] });
     assert.deepStrictEqual(res, { refused: 'remix-without-new-domain-data' }, 'remixing a peer without new domain data is still refused');
     const reply = node.remember({ ...FIELDS, focus: 'a reply citing the peer' }, { parents: [peerBlock] });
     assert.ok(reply && reply.key && !reply.refused, 'a record the agent authors, citing a peer, is not a remix');
diff --git a/tests/spec-update-coupling.test.js b/tests/spec-update-coupling.test.js
index e33294ac..5c1fb5ca 100644
--- a/tests/spec-update-coupling.test.js
+++ b/tests/spec-update-coupling.test.js
@@ -119,7 +119,7 @@ describe('only a gated remix is a remix (#35)', () => {
       A.remember(CATS('a reply citing it'), { parents: [first.cmb] });
       assert.strictEqual(A.metrics().remixProduced, 0);
       A.remember(CATS('new domain data'));
-      const r = A.remix(CATS('an integration of a peer record'), { parents: [first.cmb] });
+      const r = await A.remix(CATS('an integration of a peer record'), { parents: [first.cmb] });
       assert.ok(r && !r.refused);
       assert.strictEqual(A.metrics().remixProduced, 1);
     } finally { await stopAll(); }
diff --git a/tests/spec-update-remix-tether.test.js b/tests/spec-update-remix-tether.test.js
new file mode 100644
index 00000000..6d896dc4
--- /dev/null
+++ b/tests/spec-update-remix-tether.test.js
@@ -0,0 +1,99 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME before lib/config loads
+
+/**
+ * §15.8 on the remix path (founder ruling, 0.14.0): remix() is asynchronous and evaluates what it
+ * produces against its nearest verified lineage root before it is minted. A faithful remix keeps its
+ * lineage, a remix drifted past the reject floor is minted as a fresh root, and one with no verified
+ * root in reach keeps its lineage, unverified; each verdict is signed as an mmp-tether-v1 attestation.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const { SymNode } = require('../lib/node');
+const { NullDiscovery } = require('../lib/discovery');
+const { nodeDirById } = require('../lib/config');
+const { createCMB, verifyTetherAttestation } = require('../lib/core');
+const { awaitSemantic } = require('./_semantic');
+
+const cat7 = (t) => ({ focus: t, issue: t, intent: t, motivation: t, commitment: t, perspective: 'peerA', mood: { text: 'neutral' } });
+const TOPIC_A = 'quarterly financial audit of the accounting ledger and tax filings';
+const TOPIC_A_REMIX = 'the second quarter financial audit of the accounting ledger and tax filings';
+const TOPIC_B = 'fresh snowfall reported on the upper mountain trail sections';
+
+async function withNode(fn) {
+  const n = new SymNode({ name: `remix-tether-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`, silent: true, discovery: new NullDiscovery() });
+  await n.start();
+  try { return await fn(n); } finally { await n.stop(); fs.rmSync(nodeDirById(n.nodeId), { recursive: true, force: true }); }
+}
+/** A verified peer record about `text`, held as an admitted peer record. */
+function peerRoot(node, text) {
+  const cmb = createCMB({ categories: cat7(text), createdBy: 'peerR' });
+  node._store.receiveFromPeer('peerR', { key: cmb.metadata.key, content: text, source: 'peerR', cmb, _cmbVerified: true });
+  return cmb;
+}
+
+describe('remix() evaluates the §15.8 tether on what it produces', () => {
+  it('drifted past the floor: minted as a fresh root, the departed source kept, a severed attestation signed', async () => {
+    await awaitSemantic();
+    await withNode(async (node) => {
+      const root = peerRoot(node, TOPIC_A);
+      node.remember(cat7('new domain data of this node'));
+      const p = node.remix(cat7(TOPIC_B), { parents: [root] });
+      assert.ok(p instanceof Promise, 'remix() is asynchronous');
+      const e = await p;
+      assert.ok(e && e.key && !e.refused);
+      const stored = node._store.get(e.key);
+      assert.strictEqual(stored.cmb.metadata.lineage, null, 'no parent from the severed chain');
+      assert.strictEqual(stored.provenance.tether.severed, true);
+      assert.strictEqual(stored.provenance.tether.departedFrom, root.metadata.key);
+      assert.strictEqual(stored.tether.verdict, 'severed');
+      assert.strictEqual(stored.tether.of, e.key);
+      assert.strictEqual(stored.tether.anchor, root.metadata.key);
+      assert.strictEqual(verifyTetherAttestation(stored.tether, node._identity.publicKey).valid, true);
+      assert.strictEqual(node.canRemix(), false, 'the flag is consumed');
+    });
+  });
+
+  it('faithful: minted with its lineage, and a tethered attestation', async () => {
+    await awaitSemantic();
+    await withNode(async (node) => {
+      const root = peerRoot(node, TOPIC_A);
+      node.remember(cat7('new domain data of this node'));
+      const e = await node.remix(cat7(TOPIC_A_REMIX), { parents: [root] });
+      const stored = node._store.get(e.key);
+      assert.deepStrictEqual(stored.cmb.metadata.lineage.parents, [root.metadata.key]);
+      assert.strictEqual(stored.provenance.tether.severed, false);
+      assert.strictEqual(stored.tether.verdict, 'tethered');
+      assert.strictEqual(verifyTetherAttestation(stored.tether, node._identity.publicKey).valid, true);
+    });
+  });
+
+  it('no verified root in reach: minted with its lineage, the tether unverified (a trust state), nothing signed', async () => {
+    await withNode(async (node) => {
+      node.remember(cat7('new domain data of this node'));
+      const missing = `cmb-${'e'.repeat(64)}`;
+      const e = await node.remix(cat7(TOPIC_B), { parents: [{ key: missing }] });
+      const stored = node._store.get(e.key);
+      assert.deepStrictEqual(stored.cmb.metadata.lineage.parents, [missing]);
+      assert.strictEqual(stored.tether, undefined);
+      assert.strictEqual(stored.provenance?.tether, undefined);
+    });
+  });
+
+  it('a remix that mints nothing gives the flag back; a second remix started meanwhile is refused', async () => {
+    await withNode(async (node) => {
+      const root = peerRoot(node, TOPIC_A);
+      node.remember(cat7('new domain data of this node'));
+      const [a, b] = await Promise.all([node.remix(cat7(TOPIC_A_REMIX), { parents: [root] }), node.remix(cat7(TOPIC_A), { parents: [root] })]);
+      assert.ok(a.key && !a.refused);
+      assert.deepStrictEqual(b, { refused: 'remix-without-new-domain-data' }, 'the flag was consumed when the first began');
+      node.remember(cat7('more domain data'));
+      const dup = await node.remix(cat7(TOPIC_A), { parents: [root] }); // the parent's own words: nothing new is minted
+      assert.ok(dup.duplicate || dup.collapsed);
+      assert.strictEqual(node.canRemix(), true, 'nothing minted, so the flag is given back');
+    });
+  });
+});

From 2936d812b3e997be1b29804f3fb328fb220547de Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Tue, 13 Oct 2026 18:07:25 +0100
Subject: [PATCH 142/148] =?UTF-8?q?tests:=20the=20synthesis-loop=20ESIGN?=
 =?UTF-8?q?=20test=20awaits=20the=20async=20remix()=20(0.14.0,=20=C2=A715.?=
 =?UTF-8?q?8)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The full suite at 15849b0 had one failure: "an ESIGN from the synthesis loop is said as the node
failing to sign" asserted synchronously, but remix() is asynchronous since 15849b0 and the loop
says the failure when it settles. The handler already contains it (a rejection is logged, never
left unhandled), so this is the test, not the lib. The test is async and awaits the settle;
withNode cleans up after an async callback settles instead of when it returns.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VMk5HbMaz4oD7zoakvPyA6
---
 tests/gossip-lanes.test.js | 24 ++++++++++++++++--------
 1 file changed, 16 insertions(+), 8 deletions(-)

diff --git a/tests/gossip-lanes.test.js b/tests/gossip-lanes.test.js
index ce344b20..68b7e045 100644
--- a/tests/gossip-lanes.test.js
+++ b/tests/gossip-lanes.test.js
@@ -63,6 +63,12 @@ const respell = (s) => [`${s}=`, `${s}==`, ` ${s}`, `${s.slice(0, 40)}\n${s.slic
 function withNode(opts, fn) {
   const name = `lanes-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`;
   const node = new SymNode({ name, silent: true, discovery: new NullDiscovery(), room: ROOM, ...opts });
+  const cleanup = () => {
+    for (const r of node._dropReports.values()) clearTimeout(r.timer);
+    node._releaseIdentityLock?.();
+    fs.rmSync(nodeDir(name), { recursive: true, force: true });
+  };
+  let out;
   try {
     const sent = [];
     node._gossipToRoster = (f) => sent.push(f);
@@ -70,12 +76,12 @@ function withNode(opts, fn) {
     node._gossipClock = () => clock.t;
     const metrics = [];
     node.on('metric', (m) => metrics.push(m));
-    return fn({ node, sent, clock, metrics });
-  } finally {
-    for (const r of node._dropReports.values()) clearTimeout(r.timer);
-    node._releaseIdentityLock?.();
-    fs.rmSync(nodeDir(name), { recursive: true, force: true });
-  }
+    out = fn({ node, sent, clock, metrics });
+  } catch (e) { cleanup(); throw e; }
+  // An async callback (remix() settles later, 0.14.0 §15.8) is cleaned up after it settles.
+  if (out && typeof out.then === 'function') return out.finally(cleanup);
+  cleanup();
+  return out;
 }
 
 describe('authority statements are gossip under the budget (F1, MMP §6.6.8)', () => {
@@ -355,14 +361,16 @@ describe('part A2 review suggestions', () => {
     } finally { Date.now = realNow; }
   });
 
-  it('an ESIGN from the synthesis loop is said as the node failing to sign, not as a delegate error', () => {
-    withNode({}, ({ node }) => {
+  it('an ESIGN from the synthesis loop is said as the node failing to sign, not as a delegate error', async () => {
+    const settle = () => new Promise((r) => setImmediate(r));
+    await withNode({}, async ({ node }) => {
       const logs = [];
       node._log = (m) => logs.push(m);
       node._synthesisDelegate = () => ({ focus: 'a synthesis' });
       node._hasNewDomainData = true; // the synthesis is the remix path (§15.7): it needs new domain data
       node.remember = () => { const e = new Error('CMB signing failed: no key'); e.code = 'ESIGN'; throw e; };
       node._frameHandler._handleXMeshInsight('p', 'p', { anomaly: 0.1 });
+      await settle(); // remix() is asynchronous (§15.8): its failure is said when it settles
       assert.ok(logs.includes('Synthesis not shared: this node cannot sign its records'), logs.join('\n'));
       assert.ok(!logs.some((l) => l.startsWith('Synthesis delegate error')));
       node._synthesisDelegate = () => { throw new Error('the delegate broke'); };

From cbefe2b5d9ad9dac314d2624ec0b51f579d46a9e Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Tue, 13 Oct 2026 18:16:36 +0100
Subject: [PATCH 143/148] =?UTF-8?q?remix():=20mutation=20check=20of=20the?=
 =?UTF-8?q?=20=C2=A715.8=20guard;=20tests=20for=20what=20survived;=20two?=
 =?UTF-8?q?=20redundant=20lines=20removed?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A 28-mutant pass over remix()'s tether guard (skip the evaluation, always faithful, always severed,
unverifiable as faithful, no fresh root, a parent kept, no or wrong attestation, the verdict
reversed, the §15.7 flag not consumed or not given back, opts.cmb allowed, and others) left 11
survivors. Seven were real gaps and now have tests (tests/spec-update-remix-tether.test.js, 12 tests):

- the anchor and attestation are about the lineage ROOT, not the parent cited (a hop above the root);
- a severed remix citing several parents keeps none, and no category descends from anything;
- the signed drift is what a third party recomputes from the minted record and the root (a remix
  given only a focus is evaluated on what it was minted with);
- the verdict is on disk (a store rebuilt from the node's directory holds it);
- nothing evaluable (every category weighted out): lineage kept, unverified, nothing signed;
- lineageTether:false: no evaluation, no severance;
- opts.cmb is refused and the flag is not spent; a remix that fails to mint gives the flag back.

Two lines were redundant and are removed: `categoryParents: undefined` on a severed remix (remember()
never reads categoryParents; the several-parents test would catch it if it ever does), and the copy of
the verdict onto the returned entry (remember() returns the store's own entry, so it already carries
it; the same test reads it from the returned entry). One mutant stays: dropping the `parentKeys.length
> 0` early-out changes nothing observable (a record with no parents resolves to no root), so it is an
equivalent mutant, kept as a cheap shortcut.

A test that read the anchor through two records stored in one millisecond was flaky (the walk takes the
earliest-stored ancestor): it waits 5 ms between them.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VMk5HbMaz4oD7zoakvPyA6
---
 lib/node.js                            |   5 +-
 tests/spec-update-remix-tether.test.js | 122 ++++++++++++++++++++++++-
 2 files changed, 121 insertions(+), 6 deletions(-)

diff --git a/lib/node.js b/lib/node.js
index 2be15321..10a6fbbe 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -3094,7 +3094,7 @@ class SymNode extends EventEmitter {
       let mintOpts = opts;
       if (this._lineageTether && parentKeys.length > 0) {
         tether = await this._remixTether(categories, parentKeys);
-        if (tether && tether.checked && !tether.tethered) mintOpts = { ...opts, parents: undefined, categoryParents: undefined };
+        if (tether && tether.checked && !tether.tethered) mintOpts = { ...opts, parents: undefined };
       }
       entry = this.remember(categories, { ...mintOpts, [REMIX_MINT]: true });
     } catch (err) {
@@ -3150,9 +3150,8 @@ class SymNode extends EventEmitter {
     } catch (err) {
       this._log(`[§15.8] tether attestation not signed: ${err.message}`); // SHOULD: the verdict stands without it
     }
+    // remember() returns the store's own entry, so the entry the caller gets carries the verdict too.
     this._store._persist(stored);
-    entry.provenance = stored.provenance;
-    if (stored.tether) entry.tether = stored.tether;
   }
 
   /**
diff --git a/tests/spec-update-remix-tether.test.js b/tests/spec-update-remix-tether.test.js
index 6d896dc4..b95b7ede 100644
--- a/tests/spec-update-remix-tether.test.js
+++ b/tests/spec-update-remix-tether.test.js
@@ -15,7 +15,8 @@ const fs = require('fs');
 const { SymNode } = require('../lib/node');
 const { NullDiscovery } = require('../lib/discovery');
 const { nodeDirById } = require('../lib/config');
-const { createCMB, verifyTetherAttestation } = require('../lib/core');
+const { createCMB, verifyTetherAttestation, evaluateLineageTetherFromText } = require('../lib/core');
+const { MemoryStore } = require('../lib/memory-store');
 const { awaitSemantic } = require('./_semantic');
 
 const cat7 = (t) => ({ focus: t, issue: t, intent: t, motivation: t, commitment: t, perspective: 'peerA', mood: { text: 'neutral' } });
@@ -23,8 +24,8 @@ const TOPIC_A = 'quarterly financial audit of the accounting ledger and tax fili
 const TOPIC_A_REMIX = 'the second quarter financial audit of the accounting ledger and tax filings';
 const TOPIC_B = 'fresh snowfall reported on the upper mountain trail sections';
 
-async function withNode(fn) {
-  const n = new SymNode({ name: `remix-tether-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`, silent: true, discovery: new NullDiscovery() });
+async function withNode(fn, opts = {}) {
+  const n = new SymNode({ name: `remix-tether-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`, silent: true, discovery: new NullDiscovery(), ...opts });
   await n.start();
   try { return await fn(n); } finally { await n.stop(); fs.rmSync(nodeDirById(n.nodeId), { recursive: true, force: true }); }
 }
@@ -35,6 +36,13 @@ function peerRoot(node, text) {
   return cmb;
 }
 
+/** A verified peer record about `text` that cites `parentKey`, held as an admitted peer record. */
+function peerChild(node, text, parentKey) {
+  const cmb = createCMB({ categories: cat7(text), createdBy: 'peerC', lineage: { parents: [parentKey], method: 'SVAF-v2' } });
+  node._store.receiveFromPeer('peerC', { key: cmb.metadata.key, content: text, source: 'peerC', cmb, _cmbVerified: true });
+  return cmb;
+}
+
 describe('remix() evaluates the §15.8 tether on what it produces', () => {
   it('drifted past the floor: minted as a fresh root, the departed source kept, a severed attestation signed', async () => {
     await awaitSemantic();
@@ -96,4 +104,112 @@ describe('remix() evaluates the §15.8 tether on what it produces', () => {
       assert.strictEqual(node.canRemix(), true, 'nothing minted, so the flag is given back');
     });
   });
+
+  it('the verdict and the attestation are about the lineage ROOT, not the parent cited, and the returned entry carries them', async () => {
+    await awaitSemantic();
+    await withNode(async (node) => {
+      const root = peerRoot(node, TOPIC_A);
+      await new Promise((r) => setTimeout(r, 5)); // the walk takes the earliest-stored ancestor: not a tie in one millisecond
+      const hop = peerChild(node, TOPIC_A_REMIX, root.metadata.key); // the cited parent, itself a hop above the root
+      node.remember(cat7('new domain data of this node'));
+      const e = await node.remix(cat7(TOPIC_B), { parents: [hop] });
+      assert.strictEqual(e.tether.anchor, root.metadata.key, 'the anchor is the root the walk reached');
+      assert.notStrictEqual(e.tether.anchor, hop.metadata.key);
+      assert.strictEqual(e.tether.verdict, 'severed');
+      assert.strictEqual(e.provenance.tether.anchor, root.metadata.key);
+      assert.strictEqual(e.provenance.tether.departedFrom, hop.metadata.key, 'the departed source is the parent cited');
+      assert.strictEqual(verifyTetherAttestation(e.tether, node._identity.publicKey).valid, true, 'the returned entry carries a verifying attestation');
+    });
+  });
+
+  it('a severed remix citing several parents keeps none of them', async () => {
+    await awaitSemantic();
+    await withNode(async (node) => {
+      const r1 = peerRoot(node, TOPIC_A);
+      const r2 = peerRoot(node, `${TOPIC_A} for the second quarter`);
+      node.remember(cat7('new domain data of this node'));
+      const e = await node.remix(cat7(TOPIC_B), { parents: [r1, r2], categoryParents: { focus: [r1.metadata.key] } });
+      const stored = node._store.get(e.key);
+      assert.strictEqual(stored.cmb.metadata.lineage, null);
+      for (const f of Object.keys(stored.cmb.categories)) assert.deepStrictEqual(stored.cmb.categories[f].meta.parents, [], `category ${f} descends from nothing`);
+      assert.deepStrictEqual(node._store.parents(e.key), []);
+    });
+  });
+
+  it('the verdict is the one a third party recomputes from the minted record and the root', async () => {
+    await awaitSemantic();
+    await withNode(async (node) => {
+      const root = peerRoot(node, TOPIC_A);
+      node.remember(cat7('new domain data of this node'));
+      // Only a focus is given; the other six are minted 'neutral', and the tether is of what was minted.
+      const e = await node.remix({ focus: TOPIC_A_REMIX }, { parents: [root] });
+      const stored = node._store.get(e.key);
+      const ev = await evaluateLineageTetherFromText({
+        remixCategories: stored.cmb.categories, anchorCategories: root.categories,
+        categoryWeights: node._svafCategoryWeights, guardedThreshold: node._svafGuardedThreshold,
+      });
+      assert.strictEqual(stored.tether.drift.toFixed(6), ev.drift.toFixed(6), 'the signed drift is recomputable from the record and its root');
+      assert.strictEqual(stored.tether.verdict, ev.tethered ? 'tethered' : 'severed');
+      assert.strictEqual(stored.tether.kernelId, ev.kernelId);
+    });
+  });
+
+  it('the verdict is kept on disk: a store rebuilt from the node\'s directory holds the attestation and the provenance', async () => {
+    await awaitSemantic();
+    await withNode(async (node) => {
+      const root = peerRoot(node, TOPIC_A);
+      node.remember(cat7('new domain data of this node'));
+      const e = await node.remix(cat7(TOPIC_B), { parents: [root] });
+      const reader = new MemoryStore(node._store._dir, 'reader');
+      const back = reader.get(e.key);
+      assert.strictEqual(back.tether.verdict, 'severed');
+      assert.strictEqual(verifyTetherAttestation(back.tether, node._identity.publicKey).valid, true);
+      assert.strictEqual(back.provenance.tether.departedFrom, root.metadata.key);
+    });
+  });
+
+  it('nothing evaluable (every category weighted out): minted with its lineage, unverified, nothing signed', async () => {
+    await awaitSemantic();
+    await withNode(async (node) => {
+      const root = peerRoot(node, TOPIC_A);
+      node._svafCategoryWeights = Object.fromEntries(['focus', 'issue', 'intent', 'motivation', 'commitment', 'perspective', 'mood'].map((f) => [f, 0]));
+      node.remember(cat7('new domain data of this node'));
+      const e = await node.remix(cat7(TOPIC_B), { parents: [root] });
+      const stored = node._store.get(e.key);
+      assert.deepStrictEqual(stored.cmb.metadata.lineage.parents, [root.metadata.key]);
+      assert.strictEqual(stored.tether, undefined);
+      assert.strictEqual(stored.provenance?.tether, undefined);
+    });
+  });
+
+  it('with the tether off, a drifted remix keeps its lineage and nothing is signed', async () => {
+    await awaitSemantic();
+    await withNode(async (node) => {
+      const root = peerRoot(node, TOPIC_A);
+      node.remember(cat7('new domain data of this node'));
+      const e = await node.remix(cat7(TOPIC_B), { parents: [root] });
+      const stored = node._store.get(e.key);
+      assert.deepStrictEqual(stored.cmb.metadata.lineage.parents, [root.metadata.key]);
+      assert.strictEqual(stored.tether, undefined);
+      assert.strictEqual(stored.provenance?.tether, undefined);
+    }, { lineageTether: false });
+  });
+
+  it('remix() mints its own record: opts.cmb is refused, and the flag is not spent', async () => {
+    await withNode(async (node) => {
+      node.remember(cat7('new domain data of this node'));
+      const own = createCMB({ categories: cat7(TOPIC_B), createdBy: node.name });
+      await assert.rejects(node.remix(cat7(TOPIC_B), { cmb: own }), (e) => e instanceof TypeError && /opts\.cmb/.test(e.message));
+      assert.strictEqual(node.canRemix(), true);
+    });
+  });
+
+  it('a remix that fails to mint gives the flag back', async () => {
+    await withNode(async (node) => {
+      node.remember(cat7('new domain data of this node'));
+      node.remember = () => { throw Object.assign(new Error('cannot sign'), { code: 'ESIGN' }); };
+      await assert.rejects(node.remix(cat7(TOPIC_B), { parents: [{ key: `cmb-${'e'.repeat(64)}` }] }), (e) => e.code === 'ESIGN');
+      assert.strictEqual(node.canRemix(), true, 'nothing was minted, so the flag is given back');
+    });
+  });
 });

From 3a70dcb047cf2aa74ee5a777e3fdb7a04c19c0b2 Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Tue, 13 Oct 2026 18:45:46 +0100
Subject: [PATCH 144/148] =?UTF-8?q?final=20review=20F1,=20F4,=20F7:=20the?=
 =?UTF-8?q?=20=C2=A715.8=20guard=20measures=20only=20in=20the=20calibrated?=
 =?UTF-8?q?=20kernel;=20tests=20for=20the=20fetched-record=20and=201011=20?=
 =?UTF-8?q?guards;=20three=20hardenings?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

F1 (Medium). remix()'s tether measured in whatever kernel happened to be loaded. The §9.2.1 reject
floor is calibrated on the semantic encoder (all-MiniLM-L6-v2); the lexical n-gram encoder that runs
until it loads, or in its place where the optional @huggingface/transformers dependency is missing,
measures drift on another scale, so a `tethered` or `severed` verdict, an attestation or a severance
made in it means nothing. remix() now awaits the calibrated kernel, at most `tetherKernelWaitMs`
(default 10 s). If it is unavailable by then the remix keeps its lineage, unverified: nothing is
evaluated, severed or signed, and a line is logged once (a `tether-kernel-unavailable` metric). A
verdict from the lexical kernel is never signed. auditLineageTethers follows the same rule and
leaves a chain unchecked.

F4. Tests that fail when each guard is removed: the clear-1011 server-role guard (the server side
never prompts a handshake), and the fetched record's assertion-identity, audience and signature
checks (one record each, the reviewer's f-fetched-verify.js as the model).

F7. Legacy Import's trySend refuses a record signed for another room, as the seal point does. The
relay client's own-frame queue (auth, pong) is bounded: a pong already waiting answers the next, and
at most 8 wait. A remix() that began before stop() mints nothing after it (`{ refused: 'node-stopped'
}`, the flag given back). Stale comments refreshed (lib/rooms.js, bin/sym-daemon.js), and the
"vouched" wording in the unresolvable-author message and comment now says what §6.6.9 does (an
in-force grant names the key).

Mutation check of the new guards (13 mutants: the kernel check, its bound, its said-once line, the
audit check, the stop guard, the 1011 server-role guard, the three fetched-record checks, the
legacy room check, the queue cap and the pong dedupe): all caught.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VMk5HbMaz4oD7zoakvPyA6
---
 bin/sym-daemon.js                      |   8 +-
 lib/frame-handler.js                   |   4 +-
 lib/legacy-import.js                   |   5 ++
 lib/node.js                            |  50 ++++++++++++
 lib/relay.js                           |  14 +++-
 lib/rooms.js                           |  48 +++--------
 tests/relay-state.test.js              |  15 ++++
 tests/spec-update-frames.test.js       |  65 ++++++++++++++-
 tests/spec-update-remix-tether.test.js | 106 +++++++++++++++++++++++++
 9 files changed, 271 insertions(+), 44 deletions(-)

diff --git a/bin/sym-daemon.js b/bin/sym-daemon.js
index df745c19..18eca11d 100755
--- a/bin/sym-daemon.js
+++ b/bin/sym-daemon.js
@@ -834,9 +834,11 @@ function log(msg) {
 // ── Room discovery beacon (MMP §5.8) ──────────────────────────
 // Advertise this node's room on one shared service type so `sym rooms` can
 // list live rooms cross-platform — bonjour-service browse works where Apple
-// dns-sd is absent (e.g. Windows). Discovery-only: comms stay isolated on the
-// room's own `_<room>._tcp`. The room name is whatever the user chose and
-// can be an anonymous/opaque code, so the broadcast need not reveal its purpose.
+// dns-sd is absent (e.g. Windows). Discovery-only: comms stay separated by the
+// TXT `room` on `_sym._tcp` (a node dials only its own room's advertisements,
+// MMP §5.1) and by the handshake, which binds the room. The room name is
+// whatever the user chose and can be an anonymous/opaque code, so the
+// broadcast need not reveal its purpose.
 let roomBeacon = null;
 function startRoomBeacon() {
   try {
diff --git a/lib/frame-handler.js b/lib/frame-handler.js
index e9da0118..7d0cfb4c 100644
--- a/lib/frame-handler.js
+++ b/lib/frame-handler.js
@@ -652,7 +652,7 @@ class FrameHandler {
    *     not enter Core Secure (it may only arrive on a Legacy Import session, below);
    *   - the author key is resolved by `createdByNodeId` through the key registry (design D3) — never
    *     by `createdBy`, never from the delivering session: a record from an author this node has
-   *     never proven and no grant vouches is unresolvable, and refused (release note M12: such "X via
+   *     never proven, pinned or named by an in-force grant (§6.6.9) is unresolvable, and refused (release note M12: such "X via
    *     Y" deliveries no longer surface);
    *   - the signature, the application commitment and the assertion identity must verify;
    *   - the signed audience (room, recipient) must be this node's.
@@ -720,7 +720,7 @@ class FrameHandler {
     const authorKey = this._node._identityKey(md.createdByNodeId);
     if (!authorKey) {
       this._node.emit('metric', { type: 'cmb-author-unresolvable', from: peerName, author: md.createdByNodeId, key: k });
-      return refuse('unresolvable-author', `no proven, pinned or vouched key for ${String(md.createdByNodeId).slice(0, 8)}`);
+      return refuse('unresolvable-author', `no proven, pinned or in-force-grant key for ${String(md.createdByNodeId).slice(0, 8)}`);
     }
     const rec = msg.cmb;
     const v = verifyCMB(rec, authorKey);
diff --git a/lib/legacy-import.js b/lib/legacy-import.js
index e422a917..52d9e7ea 100644
--- a/lib/legacy-import.js
+++ b/lib/legacy-import.js
@@ -225,6 +225,11 @@ class LegacySession extends EventEmitter {
     // is never sent to the routed one.
     const to = frame.cmb.metadata && typeof frame.cmb.metadata.to === 'string' ? frame.cmb.metadata.to : null;
     if (to && to !== this.nodeId) return { ok: false, reason: 'not-addressed' };
+    // And so does its signed room (MMP 2.0 update 1, the seal point's rule on a Core Secure session): a
+    // node's store is per node, not per room, and a record signed for another room is never sent into
+    // this one, whatever path offered it.
+    const signedRoom = frame.cmb.metadata && frame.cmb.metadata.room;
+    if (typeof signedRoom === 'string' && signedRoom.normalize('NFC') !== String(this.room).normalize('NFC')) return { ok: false, reason: 'not-addressed' };
     const { ciphertext, nonce } = encryptCategories(frame.cmb.categories, this._secret);
     return this._wire({ type: 'cmb', timestamp: frame.timestamp || Date.now(), cmb: { ...frame.cmb, categories: ciphertext, _e2e: { nonce } }, ...(to ? { to, directed: true } : {}) });
   }
diff --git a/lib/node.js b/lib/node.js
index 10a6fbbe..e604d86b 100644
--- a/lib/node.js
+++ b/lib/node.js
@@ -34,6 +34,7 @@ const { RosterKeyRegistry, keyFingerprint } = require('./roster-keys');
 const { signedProjection, isLowerUuid } = require('./core/record-canonical');
 const { buildMoodFrame } = require('./core/mood-frame');
 const { signTetherAttestation } = require('./core/tether-attestation');
+const contextEncoder = require('./core/context-encoder');
 const { mintCategoryText } = require('./core/cmb-encoder');
 /** remember()'s mark that remix() is the caller: what it mints is not new domain data (§15.7). */
 const REMIX_MINT = Symbol('remix-mint');
@@ -591,6 +592,11 @@ class SymNode extends EventEmitter {
     // Disable with opts.lineageTether=false or SYM_LINEAGE_TETHER=0.
     this._lineageTether = process.env.SYM_LINEAGE_TETHER === '0'
       ? false : opts.lineageTether !== false;
+    // §15.8 measures in the CALIBRATED kernel only (the semantic encoder the §9.2.1 reject floor is
+    // calibrated on): thresholds are meaningful only in a pinned kernel. A node waits at most this long
+    // for it to load; past that a remix keeps its lineage, unverified, and nothing is signed.
+    this._tetherKernelWaitMs = Number.isFinite(opts.tetherKernelWaitMs) && opts.tetherKernelWaitMs >= 0 ? opts.tetherKernelWaitMs : 10_000;
+    this._stopEpoch = 0; // bumped by stop(): a remix() that began before it mints nothing after it
 
     // Delivery inbox — the receive counterpart to remember() (send). The node
     // buffers every CMB it delivers (each 'cmb-accepted') so any consumer can
@@ -934,6 +940,7 @@ class SymNode extends EventEmitter {
     const report = { audited: 0, tethered: 0, severed: 0, failedFloor: 0, unchecked: 0, fetched: 0 };
     if (typeof evaluateLineageTetherFromText !== 'function') return report;
     const keys = [...this._store._index.byKey.keys()];
+    let calibrated = null;
     for (const key of keys) {
       const entry = this._store.get(key);
       if (!entry) continue;
@@ -963,6 +970,10 @@ class SymNode extends EventEmitter {
         }
       }
       if (!anchorCategories) { report.unchecked++; continue; }
+      // The calibrated kernel only: a verdict, an attestation or a severance made in the lexical kernel
+      // would be made on another scale (§9.2.1, §15.8), so the chain stays unchecked.
+      if (calibrated === null) calibrated = await this._calibratedKernel();
+      if (!calibrated) { report.unchecked++; continue; }
 
       const ev = await evaluateLineageTetherFromText({
         remixCategories: cmb.categories, anchorCategories,
@@ -2280,6 +2291,7 @@ class SymNode extends EventEmitter {
       return;
     }
     this._running = false;
+    this._stopEpoch++;
 
     if (this._heartbeatTimer) clearInterval(this._heartbeatTimer);
     if (this._encodeTimer) clearInterval(this._encodeTimer);
@@ -3068,6 +3080,12 @@ class SymNode extends EventEmitter {
    *      A tethered or severed verdict is signed as an mmp-tether-v1 attestation (`entry.tether`,
    *      beside the record) naming the remix, the anchor, the kernel, the drift and the verdict. With
    *      the tether turned off (`lineageTether: false`) step 2 is skipped.
+   *      The evaluation is made in the CALIBRATED kernel only (the semantic encoder; thresholds are
+   *      meaningful only in a pinned kernel, §9.2.1, §15.8). remix() waits for it at most
+   *      `tetherKernelWaitMs` (10 s); if it is unavailable by then (the optional
+   *      @huggingface/transformers dependency is missing, or too slow), the remix keeps its lineage,
+   *      unverified, nothing is signed, and a line is logged once. A verdict from the lexical n-gram
+   *      kernel is never signed.
    *   3. The record is minted by remember(). A remix whose words equal a record this node holds
    *      mints nothing (a duplicate, or the collapse onto this node's HEAD): no tether applies to it
    *      (§15.5), and the flag is given back.
@@ -3087,6 +3105,7 @@ class SymNode extends EventEmitter {
     }
     if (opts.cmb) throw new TypeError('remix() mints its own record: it takes categories and parents, not a record (opts.cmb)');
     this._hasNewDomainData = false; // consumed now; given back below if nothing is minted
+    const epoch = this._stopEpoch;
     let entry;
     let tether = null;
     const parentKeys = (Array.isArray(opts.parents) ? opts.parents : []).map((p) => p && (p.metadata?.key ?? p.key)).filter((k) => typeof k === 'string');
@@ -3096,6 +3115,11 @@ class SymNode extends EventEmitter {
         tether = await this._remixTether(categories, parentKeys);
         if (tether && tether.checked && !tether.tethered) mintOpts = { ...opts, parents: undefined };
       }
+      // A node stopped while the tether was being evaluated mints nothing: the store is closed.
+      if (this._stopEpoch !== epoch) {
+        this._hasNewDomainData = true;
+        return { refused: 'node-stopped' };
+      }
       entry = this.remember(categories, { ...mintOpts, [REMIX_MINT]: true });
     } catch (err) {
       this._hasNewDomainData = true;
@@ -3122,6 +3146,7 @@ class SymNode extends EventEmitter {
     const { resolveTetherAnchor, tetherOfRecord } = require('./core');
     const anchor = resolveTetherAnchor({ metadata: { lineage: { parents: parentKeys } } }, (k) => this._store.get(k));
     if (!anchor || !anchor.categories || !anchor.resolvedFromStore) return null;
+    if (!(await this._calibratedKernel())) return null; // unverified: a trust state, never a verdict
     const texts = Object.fromEntries(CAT7_CATEGORIES.map((f) => [f, { text: mintCategoryText(categories && categories[f]) }]));
     const t = await tetherOfRecord(texts, anchor, { categoryWeights: this._svafCategoryWeights, guardedThreshold: this._svafGuardedThreshold });
     if (t && t.checked && !t.tethered) {
@@ -3131,6 +3156,31 @@ class SymNode extends EventEmitter {
     return t;
   }
 
+  /**
+   * Whether the CALIBRATED §15.8 kernel is ready, waiting for it at most `tetherKernelWaitMs`. The reject
+   * floor is calibrated on the semantic encoder (all-MiniLM-L6-v2); the lexical n-gram encoder that runs
+   * until it loads, or in its place where the optional @huggingface/transformers dependency is missing,
+   * measures drift on another scale, so no verdict is made, signed or acted on in it (§9.2.1, §15.8).
+   * Said once per node when it is unavailable.
+   * @returns {Promise<boolean>}
+   * @private
+   */
+  async _calibratedKernel() {
+    if (contextEncoder.isSemanticReady()) return true;
+    let timer;
+    const ok = await Promise.race([
+      contextEncoder.semanticSettled(),
+      new Promise((resolve) => { timer = setTimeout(() => resolve(false), this._tetherKernelWaitMs); if (timer.unref) timer.unref(); }),
+    ]);
+    clearTimeout(timer);
+    if (!ok && !this._tetherKernelSaid) {
+      this._tetherKernelSaid = true;
+      this._log('[§15.8] the calibrated kernel (the semantic encoder) is not available: lineage tethers are not evaluated, and nothing is signed or severed in the lexical kernel; remixes keep their lineage, unverified. Install @huggingface/transformers and restart for §15.8.');
+      this.emit('metric', { type: 'tether-kernel-unavailable' });
+    }
+    return !!ok;
+  }
+
   /**
    * Keep a remix's §15.8 verdict on its store entry, beside the record (§8.8.1), and sign it as an
    * mmp-tether-v1 attestation.
diff --git a/lib/relay.js b/lib/relay.js
index 151e1bf3..ac2d6c72 100644
--- a/lib/relay.js
+++ b/lib/relay.js
@@ -134,6 +134,8 @@ const HARD_STOPS = {
 const STOP_PHASES = Object.values(HARD_STOPS).map((h) => h.phase);
 const TERMINAL_PHASES = ['connected', 'refused', ...STOP_PHASES, 'off'];
 const FANOUT_MAX = 64;
+/** The relay's own frames (auth, pong) waiting for a token at most; see _sendControl. */
+const CONTROL_QUEUE_MAX = 8;
 class RelayConnection {
 
   /**
@@ -679,7 +681,7 @@ class RelayConnection {
       const b = this._refill();
       if (b.tokens < 1) { this._waitForToken(b); return; }
       b.tokens -= 1;
-      try { ws.send(this._control.shift()); } catch (err) { this._log(`Relay send failed: ${err && err.message}`); }
+      try { ws.send(this._control.shift().data); } catch (err) { this._log(`Relay send failed: ${err && err.message}`); }
     }
     while (this._queue.length) {
       const b = this._refill();
@@ -725,7 +727,15 @@ class RelayConnection {
    */
   _sendControl(ws, frame) {
     if (ws !== this._relayWs) return;
-    this._control.push(JSON.stringify(frame));
+    // Bounded: a pong already waiting answers the relay's liveness check as well as a second would, and
+    // the queue holds at most CONTROL_QUEUE_MAX frames (the oldest pong goes first), however long the
+    // bucket stays empty.
+    if (frame.type === 'relay-pong' && this._control.some((c) => c.pong)) return;
+    this._control.push({ data: JSON.stringify(frame), pong: frame.type === 'relay-pong' });
+    while (this._control.length > CONTROL_QUEUE_MAX) {
+      const i = this._control.findIndex((c) => c.pong);
+      this._control.splice(i === -1 ? 0 : i, 1);
+    }
     this._flush();
   }
 
diff --git a/lib/rooms.js b/lib/rooms.js
index 6753b1bb..de9a610b 100644
--- a/lib/rooms.js
+++ b/lib/rooms.js
@@ -1,44 +1,22 @@
 'use strict';
 
 /**
- * Mesh rooms (MMP §5.8) — the shared source of truth for how a room name
- * maps to a Bonjour/mDNS service type, and what a valid room name is.
+ * Mesh rooms (MMP §5.8, MMP 2.0 update 1) — what a valid room name is, and the per-room Bonjour service
+ * type earlier releases advertised on.
  *
- * This MUST match the mapping used by sym-mesh-channel (the Claude MCP node)
- * and sym-swift, or CLI nodes won't discover app/Claude nodes in the same
- * room. Convention:
- *   - "default"        -> _sym._tcp   (the global/public mesh)
- *   - "<kebab-room>"  -> _<room>._tcp   (a private room / "room chat")
+ * A room identifier is `[a-z0-9._-]`, 1 to 64 characters, case-sensitive, or the literal "default"
+ * (lib/core/room-id.js is the one grammar, used wherever a room is named: the handshake, a record, an
+ * attestation, a grant, relay-auth). `sym` is refused: while per-room service types exist anywhere it
+ * maps to `_sym._tcp`, indistinguishable there from the default room (§5.1 migration).
  *
- * Room names are kebab-case (e.g. "backend-team") or the literal "default".
- * A DOUBLE hyphen is legal as a segment separator ("x-review--team-02779b…"):
- * it is the tenant-suffix grammar xMesh scopes recipe rooms with (founder ruling
- * 2026-08-26, docs/DESIGN-room-join-authorization.md) — before this, sym's own
- * CLI and daemon could not join the rooms its flagship product creates.
+ * Since update 1 EVERY room is advertised on `_sym._tcp` with its name in the TXT `room` key (§5.1), and a
+ * node dials only advertisements whose TXT room is its own; the handshake, not the service type, is what
+ * admits. `roomServiceType()` is the per-room type earlier releases advertised on (`_<room>._tcp`), kept for
+ * display and for the migration browse (core/room-id `legacyServiceType` says where it names a valid
+ * RFC 6335 service name; a long or double-hyphen room such as the tenant-suffixed `x-review--team-…` is
+ * therefore not browsed under its old type, and mesh-channel must move to `_sym._tcp` plus TXT `room`).
  *
- * STATED PLAINLY (grammar review F2/F3): roomServiceType() feeds the room name
- * into a DNS-SD Service Name unmodified, and RFC 6763 §7 forbids consecutive
- * hyphens there (and caps the label at 15 chars). Suffixed names are therefore
- * KNOWINGLY outside RFC 6335's Service Name rules; isolation rests on responders
- * not enforcing them (macOS mDNSResponder does not — measured twice, independently,
- * 2026-08-26 and 2026-08-27: a 39-char suffixed type registers and browses
- * untruncated and does not leak onto _sym._tcp).
- *
- * CORRECTED 2026-08-27, and the correction matters because this comment is the
- * stated rationale for the whole grammar. An earlier version of it claimed MeloMove's
- * 15-char cap COLLIDES two tenants' "x-review--team-…" rooms onto one type. It does
- * not: that consumer cuts to a 9-char prefix plus a 5-char FNV digest of the FULL
- * name, so the two produce distinct types. The claim was taken from a review excerpt
- * and written up as fact without reading the source — the excerpt was stale.
- *
- * The real interop harm is different and worse. For any room name over 15 characters,
- * a truncating consumer emits a service type NO other implementation emits, so it is
- * INVISIBLE rather than misrouted — and on iOS that type is undeclarable anyway,
- * because NSBonjourServices is a build-time allow-list with no wildcard, so a room
- * named at runtime can never be joined there at all. Which is the same conclusion the
- * old comment reached by the wrong route: names were never the boundary. An admission
- * decision has to live somewhere a runtime name can reach, and the only such place is
- * the handshake.
+ * Refuse rather than repair: a name that is not already valid is never rewritten into one that is.
  *
  * Copyright (c) 2026 SYM.BOT. Apache 2.0 License.
  */
diff --git a/tests/relay-state.test.js b/tests/relay-state.test.js
index 655bca63..7c07b881 100644
--- a/tests/relay-state.test.js
+++ b/tests/relay-state.test.js
@@ -251,6 +251,21 @@ test('relay-auth and relay-pong are paced inside the bucket (MMP 2.0 update 1, 
   } finally { c.stop(); await relay.close(); }
 });
 
+test('the relay\'s own frames waiting for a token are bounded: a pong already waiting answers the next, and the queue holds at most 8', () => {
+  const c = client('ws://127.0.0.1:1', { rate: { perSecond: 1, burst: 1 } });
+  try {
+    const sent = [];
+    const ws = { readyState: 1, send: (d) => sent.push(d) };
+    c.rc._relayWs = ws;
+    c.rc._bucket.tokens = -1e6; // the bucket stays empty
+    for (let i = 0; i < 100; i++) c.rc._sendControl(ws, { type: 'relay-pong' });
+    assert.equal(c.rc._control.length, 1, 'one pong waits, however many are asked for');
+    for (let i = 0; i < 50; i++) c.rc._sendControl(ws, { type: 'relay-auth', nodeId: String(i) });
+    assert.ok(c.rc._control.length <= 8, `held ${c.rc._control.length}`);
+    assert.equal(sent.length, 0, 'nothing is sent past the bucket');
+  } finally { c.rc._relayWs = null; c.stop(); }
+});
+
 test('a socket destroy() let go never schedules a reconnect when its close arrives', async () => {
   const relay = fakeRelay((ws) => ws.send(JSON.stringify({ type: 'relay-peers', peers: [] })));
   const c = client(relay.url);
diff --git a/tests/spec-update-frames.test.js b/tests/spec-update-frames.test.js
index 42aed863..69f45170 100644
--- a/tests/spec-update-frames.test.js
+++ b/tests/spec-update-frames.test.js
@@ -3,7 +3,7 @@
 require('./_isolate-home'); // redirect $HOME before lib/config loads
 
 /**
- * The session frames as MMP 2.0 update 1 (meshcognition-website PR #43, 2660ab9) defines them: the
+ * The session frames as MMP 2.0 update 1 (meshcognition-website main at c07ff20) defines them: the
  * mood frame by the founder's ruling, cmb-fetch and cmb-fetch-result as their schemas close them,
  * fetched records verified by the whole of §8.8.5 (D4), cmb-anchors as §9.4 sends it, a clear 1011
  * acted on only when it names this node's session or answers its probe, sealed ping and pong, and the
@@ -178,6 +178,34 @@ describe('D4: a fetched record is attributed only after the whole of §8.8.5 (#2
   });
 });
 
+describe('D4: every step of §8.8.5 a fetched record must pass (_verifyFetched), one record at a time', () => {
+  it('a good record verifies; a doctored assertionId under a valid signature, another room, another recipient, an unknown author and a forged signature are each refused', async () => {
+    try {
+      const A = node('d4-each-a'); const B = node('d4-each-b');
+      await A.start(); await B.start();
+      await connectNodes(B, A);
+      const fh = B._frameHandler;
+      const room = B._room;
+      const good = signedRecord(signerOf(A), { categories: { focus: 'fetched and verified' }, room });
+      assert.strictEqual(fh._verifyFetched(JSON.parse(JSON.stringify(good))).ok, true);
+      // The signature covers the preimage, not the derived assertionId: only the identity check catches this one.
+      const wrongAsrt = JSON.parse(JSON.stringify(good)); wrongAsrt.metadata.assertionId = `asrt-${'0'.repeat(64)}`;
+      assert.deepStrictEqual(fh._verifyFetched(wrongAsrt), { ok: false, reason: 'assertion-id-mismatch' });
+      const otherRoom = signedRecord(signerOf(A), { categories: { focus: 'another room' }, room: 'elsewhere' });
+      assert.strictEqual(fh._verifyFetched(otherRoom).ok, false, 'a record signed for another room');
+      const toOther = signedRecord(signerOf(A), { categories: { focus: 'signed to someone else' }, room, to: identity('third').nodeId });
+      assert.strictEqual(fh._verifyFetched(toOther).ok, false, 'a record signed to another node');
+      const unknown = signedRecord(identity('stranger'), { categories: { focus: 'unknown author' }, room });
+      assert.strictEqual(fh._verifyFetched(unknown).reason, 'unresolvable-author');
+      const forged = JSON.parse(JSON.stringify(good)); forged.metadata.sig = Buffer.alloc(64, 7).toString('base64url');
+      assert.strictEqual(fh._verifyFetched(forged).ok, false);
+      // Signed to this node: the one directed audience that passes.
+      const toMe = signedRecord(signerOf(A), { categories: { focus: 'signed to the fetcher' }, room, to: B.nodeId });
+      assert.strictEqual(fh._verifyFetched(toMe).ok, true);
+    } finally { await stopAll(); }
+  });
+});
+
 describe('cmb-anchors (§9.4, #30)', () => {
   it('an admission with nothing to replay does not hold back the next one\'s context', async () => {
     try {
@@ -236,6 +264,20 @@ describe('a clear 1011 over a relay (§5.2.2, #23)', () => {
     A._startRelayClient = (id) => started.push(id);
     return { A, from, held, started };
   }
+  it('the server-role side never prompts a handshake (the client will re-handshake), whatever the 1011 names', async () => {
+    try {
+      const A = node('u-srv');
+      const from = '00000000-0000-7000-8000-000000000000'; // smaller than any nodeId: A is the server for this peer
+      const held = { confirmed: true, closed: false, sessionId: crypto.randomBytes(16).toString('hex'), probeSince: Date.now() };
+      A._relay = { present: new Set([from]), sendTo() {} };
+      A._relaySessions = new Map([[from, { client: null, server: null, confirmed: new Set([held]) }]]);
+      const started = [];
+      A._startRelayClient = (id) => started.push(id);
+      A._relayEnvelope(from, 'peer', { type: 'error', code: 1011, message: 'unknown session', detail: `session:${held.sessionId}` });
+      A._relayEnvelope(from, 'peer', { type: 'error', code: 1011, message: 'unknown session' });
+      assert.deepStrictEqual(started, []);
+    } finally { await stopAll(); }
+  });
   it('prompts a handshake only when its detail names this node\'s session or its probe is outstanding', async () => {
     try {
       const { A, from, held, started } = relayClient();
@@ -289,7 +331,7 @@ describe('ping and pong sealed, and the control envelope\'s bounds (§7.1, #26)'
       assert.strictEqual(sA.probeSince, 0);
     } finally { await stopAll(); }
   });
-  it('a cmb-encrypted envelope is bounded as encrypted-cmb-frame.schema.json bounds it (5417176)', () => {
+  it('a cmb-encrypted envelope is bounded as encrypted-cmb-frame.schema.json bounds it (c07ff20)', () => {
     const { openEncryptedSealed } = require('../lib/core/cmb-encrypted-frame');
     const base = { type: 'cmb-encrypted', protocolVersion: '2.0', suite: 'X25519-HKDF-SHA256-ChaCha20-Poly1305', sessionId: 'a'.repeat(32), sequence: '1', direction: 'client-to-server', metadata: {}, sealed: 'A'.repeat(22) };
     const key = crypto.randomBytes(32);
@@ -306,3 +348,22 @@ describe('ping and pong sealed, and the control envelope\'s bounds (§7.1, #26)'
     assert.strictEqual(isControlFrame({ ...ok, sessionId: 'not-hex' }), false);
   });
 });
+
+describe('Legacy Import never sends a record signed for another room (the seal point\'s rule)', () => {
+  it('a record signed for another room, or to another node, is not sent; one for this room is', () => {
+    const { LegacySession } = require('../lib/legacy-import');
+    const { e2eGenerateKeyPair } = require('../lib/core');
+    const sent = [];
+    const transport = { trySend: (f) => { sent.push(f); return { ok: true }; }, send: () => true, close() {}, on() {} };
+    const s = new LegacySession({ route: { nodeId: crypto.randomUUID() }, kind: 'bonjour', transport, local: {}, room: 'legacy-room' });
+    s.state = 'confirmed'; s.nodeId = crypto.randomUUID(); s._secret = crypto.randomBytes(32);
+    try {
+      const mk = (room, to = null) => signedRecord(identity('author'), { room, to, categories: { focus: `for ${room}` } });
+      assert.deepStrictEqual(s.trySend({ type: 'cmb', cmb: mk('elsewhere') }), { ok: false, reason: 'not-addressed' });
+      assert.deepStrictEqual(s.trySend({ type: 'cmb', cmb: mk('legacy-room', crypto.randomUUID()) }), { ok: false, reason: 'not-addressed' });
+      assert.strictEqual(sent.filter((f) => f.type === 'cmb').length, 0);
+      assert.strictEqual(s.trySend({ type: 'cmb', cmb: mk('legacy-room') }).ok, true);
+      void e2eGenerateKeyPair;
+    } finally { clearTimeout(s._timer); }
+  });
+});
diff --git a/tests/spec-update-remix-tether.test.js b/tests/spec-update-remix-tether.test.js
index b95b7ede..b72499ff 100644
--- a/tests/spec-update-remix-tether.test.js
+++ b/tests/spec-update-remix-tether.test.js
@@ -17,6 +17,7 @@ const { NullDiscovery } = require('../lib/discovery');
 const { nodeDirById } = require('../lib/config');
 const { createCMB, verifyTetherAttestation, evaluateLineageTetherFromText } = require('../lib/core');
 const { MemoryStore } = require('../lib/memory-store');
+const contextEncoder = require('../lib/core/context-encoder');
 const { awaitSemantic } = require('./_semantic');
 
 const cat7 = (t) => ({ focus: t, issue: t, intent: t, motivation: t, commitment: t, perspective: 'peerA', mood: { text: 'neutral' } });
@@ -36,6 +37,17 @@ function peerRoot(node, text) {
   return cmb;
 }
 
+/**
+ * Run `fn` with the calibrated (semantic) kernel made unavailable, or slow: `settled` is what the encoder's
+ * semanticSettled() resolves to (a promise, never settled, for "too slow"). The lexical n-gram kernel is what
+ * is left. The encoder module's state is put back after.
+ */
+async function withKernel({ ready = false, settled }, fn) {
+  const real = { isSemanticReady: contextEncoder.isSemanticReady, semanticSettled: contextEncoder.semanticSettled };
+  contextEncoder.isSemanticReady = () => ready;
+  contextEncoder.semanticSettled = () => settled;
+  try { return await fn(); } finally { Object.assign(contextEncoder, real); }
+}
 /** A verified peer record about `text` that cites `parentKey`, held as an admitted peer record. */
 function peerChild(node, text, parentKey) {
   const cmb = createCMB({ categories: cat7(text), createdBy: 'peerC', lineage: { parents: [parentKey], method: 'SVAF-v2' } });
@@ -212,4 +224,98 @@ describe('remix() evaluates the §15.8 tether on what it produces', () => {
       assert.strictEqual(node.canRemix(), true, 'nothing was minted, so the flag is given back');
     });
   });
+
+  // ── The calibrated kernel (final review F1): thresholds are meaningful only in a pinned kernel ──
+
+  it('lexical kernel: the accounting-root example keeps its lineage, unverified and unsigned, and a line is said once', async () => {
+    await awaitSemantic();
+    await withNode(async (node) => {
+      const lines = [];
+      node._log = (m) => lines.push(m);
+      const metrics = [];
+      node.on('metric', (m) => { if (m.type === 'tether-kernel-unavailable') metrics.push(m); });
+      await withKernel({ settled: Promise.resolve(false) }, async () => {
+        const root = peerRoot(node, TOPIC_A);
+        node.remember(cat7('new domain data of this node'));
+        const e = await node.remix(cat7(TOPIC_B), { parents: [root] }); // drifted: in the calibrated kernel it is severed
+        const stored = node._store.get(e.key);
+        assert.deepStrictEqual(stored.cmb.metadata.lineage.parents, [root.metadata.key], 'not severed from a measurement in the wrong kernel');
+        assert.strictEqual(stored.tether, undefined, 'nothing is signed');
+        assert.strictEqual(stored.provenance?.tether, undefined, 'unverified');
+        node.remember(cat7('more domain data of this node'));
+        const e2 = await node.remix(cat7(TOPIC_A_REMIX), { parents: [root] }); // faithful: never signed `tethered` either
+        assert.strictEqual(node._store.get(e2.key).tether, undefined);
+      });
+      assert.strictEqual(lines.filter((l) => /calibrated kernel/.test(l)).length, 1, 'said once');
+      assert.strictEqual(metrics.length, 1);
+    });
+  });
+
+  it('a calibrated kernel too slow to load: remix() waits at most tetherKernelWaitMs, then mints unverified', { timeout: 20000 }, async () => {
+    await awaitSemantic();
+    await withNode(async (node) => {
+      await withKernel({ settled: new Promise(() => {}) }, async () => {
+        const root = peerRoot(node, TOPIC_A);
+        node.remember(cat7('new domain data of this node'));
+        const t0 = Date.now();
+        const e = await node.remix(cat7(TOPIC_B), { parents: [root] });
+        assert.ok(Date.now() - t0 < 3000, 'bounded');
+        assert.ok(Date.now() - t0 >= 100, 'it did wait for the bound');
+        const stored = node._store.get(e.key);
+        assert.deepStrictEqual(stored.cmb.metadata.lineage.parents, [root.metadata.key]);
+        assert.strictEqual(stored.tether, undefined);
+      });
+    }, { tetherKernelWaitMs: 120 });
+  });
+
+  it('a calibrated kernel that settles within the bound is used: the verdict is made and signed in it', async () => {
+    await awaitSemantic();
+    await withNode(async (node) => {
+      const root = peerRoot(node, TOPIC_A);
+      node.remember(cat7('new domain data of this node'));
+      // Not ready at the call, ready 80 ms later (the real encoder is loaded in this process).
+      await withKernel({ settled: new Promise((r) => setTimeout(() => r(true), 80)) }, async () => {
+        const e = await node.remix(cat7(TOPIC_B), { parents: [root] });
+        const stored = node._store.get(e.key);
+        assert.strictEqual(stored.tether.verdict, 'severed');
+        assert.match(stored.tether.kernelId, /^minilm-/, 'the calibrated kernel');
+        assert.strictEqual(stored.cmb.metadata.lineage, null);
+      });
+    });
+  });
+
+  it('the retroactive audit signs and severs nothing in the lexical kernel either', async () => {
+    await awaitSemantic();
+    await withNode(async (node) => {
+      const root = peerRoot(node, TOPIC_A);
+      const own = node.remember(cat7(TOPIC_B), { parents: [root] });
+      await withKernel({ settled: Promise.resolve(false) }, async () => {
+        const r = await node.auditLineageTethers({ sever: true });
+        assert.strictEqual(r.audited, 1);
+        assert.strictEqual(r.severed, 0);
+        assert.strictEqual(r.unchecked, 1);
+      });
+      assert.strictEqual(node._store.get(own.key).tether, undefined);
+      assert.notStrictEqual(node._store.get(own.key).lineage?.severed, true);
+    });
+  });
+
+  // ── A remix that began before stop() mints nothing after it ──
+
+  it('stop() while the tether is being evaluated: the remix mints nothing and gives the flag back', async () => {
+    await awaitSemantic();
+    await withNode(async (node) => {
+      const root = peerRoot(node, TOPIC_A);
+      node.remember(cat7('new domain data of this node'));
+      const before = node._store.allEntries().length;
+      await withKernel({ settled: new Promise((r) => setTimeout(() => r(true), 150)) }, async () => {
+        const p = node.remix(cat7(TOPIC_B), { parents: [root] });
+        await node.stop(); // while the remix waits for the kernel
+        const r = await p;
+        assert.deepStrictEqual(r, { refused: 'node-stopped' });
+      });
+      assert.strictEqual(node._store.allEntries().length, before, 'nothing was minted into the closed store');
+      assert.strictEqual(node.canRemix(), true);
+    });
+  });
 });

From cd71952b1a6e55e1bb5ca1cedb4bf6b53bf3341f Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Tue, 13 Oct 2026 18:45:47 +0100
Subject: [PATCH 145/148] final review F2, F3, F5, F6 and release prep: pins
 cite c07ff20; docs say what the code does; the tarball ships the docs it
 points to
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

F2. Every spec pin cites c07ff20, the merge of PR #43 into meshcognition-website main (the artifacts
are byte-identical to the 0ab7b76 ones vendored before): SOURCES.json, WIRE-0.14.0.md, the CHANGELOG
and the headers of the spec-update tests. "Pending merge" wording is gone.

F3. e2e-v2.json re-vendored from c07ff20 (80f6183e…, differing from the earlier copy only by a
`note`); the pin in tests/mmp-v2-vectors-published.test.js moved. The two tests that read it keep their
path, so the one copy is replaced in place.

F5. WIRE-0.14.0.md: a gap closes the session with a sealed 1010 on a relay session; on the LAN the
transport closes and nothing is sent.

F6. SECURITY.md: losing the attestation log while keeping the identity makes an honest attester look
like an equivocator to peers that kept its checkpoints; use a new identity after a wipe. And the
§15.8 paragraph (and the CHANGELOG's remix entry) now say that remix() and the audit measure in the
calibrated kernel only, and that without the optional dependency §15.8 is not enforced.

Release prep, short of the version: package.json "files" adds docs/AUTHORITY-OPERATOR.md,
docs/WIRE-0.14.0.md and CHANGELOG.md (the shipped SECURITY.md points to the two docs); npm pack
--dry-run lists 84 files, no tests. The EBADROOM note for a room like "My Team Room" moves from the
update-1 list to "Core Secure — breaking". "version" stays 0.13.17 and the heading "(unreleased)".

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VMk5HbMaz4oD7zoakvPyA6
---
 CHANGELOG.md                           | 30 ++++++++++++++++++++------
 SECURITY.md                            | 23 ++++++++++++++++----
 docs/WIRE-0.14.0.md                    |  7 +++---
 package.json                           |  3 +++
 tests/fixtures/SOURCES.json            |  6 +++---
 tests/mmp-v2-e2e.vector.json           |  1 +
 tests/mmp-v2-vectors-published.test.js |  4 +++-
 tests/spec-update-attest-chain.test.js |  2 +-
 tests/spec-update-coupling.test.js     |  2 +-
 tests/spec-update-discovery.test.js    |  2 +-
 tests/spec-update-records.test.js      |  4 ++--
 tests/spec-update-vectors.test.js      |  4 ++--
 12 files changed, 64 insertions(+), 24 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6c5ba955..a02b9227 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -123,9 +123,8 @@ carried (cutoffs, ratification, budgets per delegation subtree, `role-chain-fetc
 ### MMP 2.0 update 1: the drafts this release implements, as the spec now states them
 
 The founder ruled that the drafts sym 0.14.0 implements land in the published spec before it ships.
-They are folded into one update, MMP 2.0 update 1 (sym-bot/meshcognition-website PR #43, branch
-spec/mmp-2.0-update-1, at 5417176 with its verification fixes: #24, #25, #17, #22, #26, #30, #23,
-#31, #37, #34, #35, #27 and #28 on the §6.6 errata), and sym is aligned with its text, its reference
+They are folded into one update, MMP 2.0 update 1 (sym-bot/meshcognition-website PR #43, merged to main at
+c07ff20: #24, #25, #17, #22, #26, #30, #23, #31, #37, #34, #35, #27 and #28 on the §6.6 errata), and sym is aligned with its text, its reference
 construction (scripts/mmp/lib.mjs) and its schemas and vectors, vendored in tests/fixtures with their
 manifest digests (record-projection-v2, record-size-v2, control-encrypted-v2 and the draft
 sym-attest-v1 pass case by case, and every frame sym builds validates against the vendored schemas).
@@ -163,9 +162,9 @@ sym-attest-v1 pass case by case, and every frame sym builds validates against th
   The 256-character caps count code points. `MAX_RECORD_BYTES` measures the two-section record only
   (#37), not remember()'s decoded payload beside it.
 - **Rooms.** A room is a §5.8 identifier, `[a-z0-9._-]` of 1 to 64 characters, everywhere it is
-  named: the node's own (`SymNode` throws `EBADROOM`), the handshake, a record, an attestation, a
-  grant. `sym join` and the daemon took kebab-case only and refused §5.8-valid dotted and underscored
-  rooms (the spec's recommended `acme.prod` among them). `sym` stays refused.
+  named: the node's own, the handshake, a record, an attestation, a grant (breaking: see "Core
+  Secure — breaking"). `sym join` and the daemon took kebab-case only and refused §5.8-valid dotted
+  and underscored rooms (the spec's recommended `acme.prod` among them). `sym` stays refused.
 - **Discovery (#17, #22).** The daemon advertises every room on `_sym._tcp` with TXT `room`, as the
   library did (it used `_<room>._tcp`, so a daemon and a library node in one room never met), and
   browses the per-room type earlier releases used, where it is a valid RFC 6335 name. A node dials
@@ -231,6 +230,16 @@ if (entry.tether) console.log(entry.tether.verdict); // 'tethered' | 'severed'
 `remix()` takes categories and parents only (`opts.cmb` throws). MeshAgent's remix cycle and the XMesh
 synthesis loop await it.
 
+**The evaluation is made in the calibrated kernel only.** The §9.2.1 reject floor is calibrated on the
+semantic encoder (all-MiniLM-L6-v2, the optional `@huggingface/transformers` dependency); the lexical
+n-gram encoder that runs until it loads, or without the dependency, measures drift on another scale. So
+`remix()` waits up to `tetherKernelWaitMs` (default 10 s) for the calibrated kernel; if it is
+unavailable by then, the remix keeps its lineage, unverified (no evaluation, no severance, nothing
+signed), and a line is logged once (`tether-kernel-unavailable` metric). A `tethered` or `severed`
+verdict is never signed from the lexical kernel, and `auditLineageTethers` leaves a chain unchecked
+there too. A `remix()` that began before `stop()` mints nothing after it (`{ refused: 'node-stopped' }`,
+the flag given back).
+
 ### Interop with 0.13.17
 
 LAN meshing with 0.13.17 stops except through Legacy Import routes, by design. A 0.13.17 node
@@ -451,6 +460,15 @@ Seven design assumptions, each changed where it was made, not patched where it s
 
 ### Core Secure — breaking
 
+- **A room is a §5.8 identifier, and `SymNode` refuses any other.** `new SymNode({ room: 'My Team
+  Room' })` used to start (a room was any text, compared in NFC); it now throws `EBADROOM` before it
+  starts, and so does any room that is not `[a-z0-9._-]` of 1 to 64 characters, uppercase, spaces and
+  non-ASCII letters included (`'my-team-room'`, `'acme.prod'`). The room is signed into every record
+  and the handshake, so a host that kept a free-form room name must map it to an identifier of its
+  own once, and keep the mapping: a record signed for the old spelling is a record of another room.
+  `sym join` refuses an invalid room; the daemon's `SYM_ROOM` and a persisted room file are checked the
+  same way, and an invalid one falls back to `default`, said in the log.
+
 - **A peer is a proven session.** A sym peer used to exist before anything was proven about it: on
   TCP connect, on any first `handshake` frame (whose keys were pinned), on a relay's
   `relay-peer-joined`. Now every transport — LAN TCP, loopback, relay — runs the MMP §5.2
diff --git a/SECURITY.md b/SECURITY.md
index f2acbae1..0d6d981b 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -336,10 +336,25 @@ Every store a peer can feed has a fixed bound. Reaching one never stops the node
   collapsed integration from the lineage tether, and sym's gates always collapse (they store the
   author's record as signed), so a peer's record that cites a root it has drifted from is kept with
   its author's lineage; the tether is that author's duty. sym does its own: `remix()` evaluates every
-  remix it mints against its root and severs a drifted lineage. The retroactive audit
-  (`auditLineageTethers`) judges only this node's own records, which it cannot tell apart from its
-  replies. Lineage confers retention here (a hot descendant keeps its ancestors hot), never authority
-  or lifecycle.
+  remix it mints against its nearest verified root and severs a drifted lineage. **It does so in the
+  calibrated kernel only.** The reject floor is calibrated on the semantic encoder (all-MiniLM-L6-v2,
+  an optional dependency, `@huggingface/transformers`); the lexical n-gram encoder that runs until it
+  loads, or in its place where it is not installed, measures drift on another scale (§9.2.1, §15.8). So
+  `remix()` waits up to 10 s (`tetherKernelWaitMs`) for the calibrated kernel, and if it is not there
+  the remix keeps its lineage, **unverified**: nothing is evaluated, severed or signed, a line is
+  logged once, and no `tethered` verdict is ever signed from the lexical kernel. The retroactive audit
+  (`auditLineageTethers`) follows the same rule and leaves a chain unchecked. Without the dependency,
+  then, §15.8 is not enforced on this node's remixes. The audit judges only this node's own records,
+  which it cannot tell apart from its replies. Lineage confers retention here (a hot descendant keeps
+  its ancestors hot), never authority or lifecycle.
+- **Losing the attestation log makes an honest attester look like an equivocator.** A node's
+  checkpoint chain lives in its attestation log (`<node>/attestations`). If that log is lost while
+  the identity is kept, the node starts a new chain at seq 1, and every peer that kept its earlier
+  checkpoints holds ones whose ranges overlap the new chain: under sym-attest-v1 §5.2 that is
+  equivocation, and those peers stop witnessing the node and drop its further checkpoints, with no way
+  to tell the wipe from a fork. After a wipe of the attestation log, give the node a new identity
+  rather than reusing the old one for `sym-attest-v1`. (Losing only the part since the last
+  checkpoint ends the chain visibly instead: the node signs no further checkpoint.)
 - **LAN meshing with sym 0.13.17 stops** except through configured Legacy Import routes, by design:
   a 0.13.17 node advertises no `mmp` key, so a 0.14 node never dials it as Core Secure, and a 0.14
   listener closes its legacy hello at once.
diff --git a/docs/WIRE-0.14.0.md b/docs/WIRE-0.14.0.md
index 73df3a7c..60fa33e7 100644
--- a/docs/WIRE-0.14.0.md
+++ b/docs/WIRE-0.14.0.md
@@ -2,8 +2,8 @@
 
 This file began as the wire elements sym 0.14.0 sends that MMP v2.0 did not define, written so that
 spec PRs could be drafted from them. Those drafts are now folded into **MMP 2.0 update 1**
-(sym-bot/meshcognition-website PR #43, branch spec/mmp-2.0-update-1 at 2660ab9, pending the
-founder's merge): `control-encrypted` (§7.1, §18.2.1), `cmb-anchors` (§9.4), `room-join` (§5.8.1),
+(sym-bot/meshcognition-website PR #43, merged to main at c07ff20):
+`control-encrypted` (§7.1, §18.2.1), `cmb-anchors` (§9.4), `room-join` (§5.8.1),
 the relay handshake and the error rules (§5.2.2, §7.2), the record size limits and the canonical
 projection (§8.8.5, §8.8.6), discovery's TXT `mmp` and `room` (§5.1), the relay fan-out envelope
 (§4.4.4) and `sym-attest-v1` (§16.4). What remains here is what sym chooses where the spec leaves a
@@ -128,7 +128,8 @@ sym follows §5.2.2 and §7.2 as the update states them: every error on a confir
 a clear error changes nothing, except that 1011 `UNKNOWN_SESSION` may prompt a new handshake; a
 sealed error whose action is Close ends the session (1001, 1003 to 1010: 1009 `IDENTITY_CONFLICT`
 and 1010 `SESSION_CLOSED` among them); a replay is discarded on every transport; a gap closes the
-session with a sealed 1010. What sym chooses:
+session. On a relay session it closes with a sealed 1010, since the peer has no other way to learn
+of it; on the LAN the transport itself closes and nothing is sent. What sym chooses:
 
 - **1011 replies.** At most once a second per relay `from` (the table of froms bounded at 1,024,
   least recently said first out), and at most 2 a second in all (burst 8), dropped past it, never
diff --git a/package.json b/package.json
index 1c00a6e4..22c940db 100644
--- a/package.json
+++ b/package.json
@@ -45,6 +45,9 @@
     "lib/",
     ".agents/",
     ".claude/",
+    "docs/AUTHORITY-OPERATOR.md",
+    "docs/WIRE-0.14.0.md",
+    "CHANGELOG.md",
     "LICENSE",
     "README.md",
     "SECURITY.md"
diff --git a/tests/fixtures/SOURCES.json b/tests/fixtures/SOURCES.json
index 79bf4815..cc1019b9 100644
--- a/tests/fixtures/SOURCES.json
+++ b/tests/fixtures/SOURCES.json
@@ -1,6 +1,6 @@
 {
-  "note": "MMP v2.0 conformance artifacts vendored for sym's tests, copied unchanged. Every file comes from sym-bot/meshcognition-website PR #43, branch spec/mmp-2.0-update-1 at 0ab7b76 (MMP 2.0 update 1, with its verification fixes, rounds 1 and 2: the chained checkpoint, the sym-attest-v1 draft vector and its witness leads among them), not yet merged to main. authority-v2.json, authority-frame.schema.json and ed25519-strict-v2.json are unchanged since df79e04. The sha256 values equal 0ab7b76's public/spec/mmp/artifact-manifest.json; mmp-lib.mjs is scripts/mmp/lib.mjs at 0ab7b76, the reference construction, which the manifest does not list. The tests that read a file check its digest first.",
-  "source": "https://github.com/sym-bot/meshcognition-website/tree/0ab7b76/public/spec/mmp",
+  "note": "MMP v2.0 conformance artifacts vendored for sym's tests, copied unchanged. Every file comes from sym-bot/meshcognition-website main at c07ff20 (the merge of PR #43, MMP 2.0 update 1: #24, #25, #17, #22, #26, #30, #23, #31, #37, #34, #35, #27 and #28 on the §6.6 errata). authority-v2.json, authority-frame.schema.json and ed25519-strict-v2.json are unchanged since df79e04. The sha256 values equal c07ff20's public/spec/mmp/artifact-manifest.json; mmp-lib.mjs is scripts/mmp/lib.mjs at c07ff20, the reference construction, which the manifest does not list. The tests that read a file check its digest first. The four published vectors beside them (tests/mmp-v2-*.vector.json) are pinned in tests/mmp-v2-vectors-published.test.js.",
+  "source": "https://github.com/sym-bot/meshcognition-website/tree/c07ff20/public/spec/mmp",
   "files": {
     "authority-v2.json": {
       "from": "conformance/v2/authority-v2.json",
@@ -69,7 +69,7 @@
     "mmp-lib.mjs": {
       "from": "scripts/mmp/lib.mjs (repository root)",
       "sha256": "3c0dcc02a7add945eaa3e4f65d20d130b8bd0012de5e0efa711dfcbae859873f",
-      "note": "the reference construction (scripts/mmp/lib.mjs at 0ab7b76); not a published artifact, so not in the manifest"
+      "note": "the reference construction (scripts/mmp/lib.mjs at c07ff20); not a published artifact, so not in the manifest"
     },
     "application.schema.json": {
       "from": "schema/application.schema.json",
diff --git a/tests/mmp-v2-e2e.vector.json b/tests/mmp-v2-e2e.vector.json
index c1f16e70..232e2dc8 100644
--- a/tests/mmp-v2-e2e.vector.json
+++ b/tests/mmp-v2-e2e.vector.json
@@ -57,6 +57,7 @@
   ],
   "noApplication": {
     "rule": "metadata.application=null means applicationData is omitted; applicationData=\"\" is reserved for a present zero-byte application",
+    "note": "An alternative to cases[0], not a further frame of the same session: it reuses client-to-server sequence 0 under the same traffic key, which a live session never does (no key seals two frames under one nonce, §18.2.1).",
     "protectedPlaintextUtf8": "{\"categories\":{\"focus\":{\"text\":\"publish corrected MMP conformance artifacts\",\"meta\":{\"key\":\"5016f1bd82f5ec8ad064f9fb0a47c10988190c407c9d534e76b366634bf2e268\",\"parents\":[]}},\"issue\":{\"text\":\"the public vectors and runtime disagree\",\"meta\":{\"key\":\"8f37da919d4165770650b6508b66af65f0710157209b10724e7cc4aab717da83\",\"parents\":[\"cmb-abababababababababababababababababababababababababababababababab\"]}},\"intent\":{\"text\":\"make independent implementations interoperate\",\"meta\":{\"key\":\"f47998bfc4aedee3ac20c485f9cd07caacccf622ceced426c02e178741718f67\",\"parents\":[]}},\"motivation\":{\"text\":\"a protocol claim must be executable\",\"meta\":{\"key\":\"9dfa469fab3eeb8c98f79df69c3b2f02f277a017f9cbe3bf0f32ccbf9a4f129d\",\"parents\":[]}},\"commitment\":{\"text\":\"one contract drives every implementation\",\"meta\":{\"key\":\"d3bbf94949feceaea72667efe8c43a4bf3aed557ecc632caf82b7c3f2447e3c8\",\"parents\":[]}},\"perspective\":{\"text\":\"protocol editor\",\"meta\":{\"key\":\"3e48fe2e89a1e02f5c17c08e853bd09d5355d18a491a1bd926568089626ffa35\",\"parents\":[]}},\"mood\":{\"text\":\"determined\",\"meta\":{\"key\":\"a515fb1d0492e7661b89c2b02d6bf81372ee07560bfca054863c76dec74880da\",\"parents\":[]}}}}",
     "metadata": {
       "key": "cmb-7f7b55653aa9854999c2efeb9751ce4428f9dfe95839e34e4358ab0be5cdf98d",
diff --git a/tests/mmp-v2-vectors-published.test.js b/tests/mmp-v2-vectors-published.test.js
index 0a863093..854e8863 100644
--- a/tests/mmp-v2-vectors-published.test.js
+++ b/tests/mmp-v2-vectors-published.test.js
@@ -11,6 +11,8 @@
 // public/spec/mmp/conformance/v2/; mirrored in mesh-memory-protocol/conformance/v2/), whose
 // artifact-manifest.json pins these same sha256 digests. To update: copy the published file
 // verbatim and replace its digest below from that manifest — never edit a vector by hand.
+// e2e-v2.json was re-vendored from meshcognition-website main at c07ff20 (the merge of PR #43, MMP 2.0
+// update 1), where it differs from the earlier published copy only by a `note`.
 
 const { test } = require('node:test');
 const assert = require('node:assert');
@@ -20,7 +22,7 @@ const path = require('path');
 
 const PUBLISHED = {
   'mmp-v2-application.vector.json': ['application-v2.json', '28ef0e7a7a7f2fb1e85a8a35b2f899962a648193e61717165540e5f4b842eb30'],
-  'mmp-v2-e2e.vector.json': ['e2e-v2.json', '3e5d4adec0137a01f85c98cacba5c8d65b5d603d02085149f950c3d5ea77dbdc'],
+  'mmp-v2-e2e.vector.json': ['e2e-v2.json', '80f6183e06aab32aa7106a7e866714a40495be9ce9c348a5b15401691d6eb90c'],
   'mmp-v2-handshake.vector.json': ['handshake-v2.json', 'c93a8440c29b07b08cccd9b0ec51008f98bfd3f631e9a654f631cb391dfe3125'],
   'mmp-v2-record-signature.vector.json': ['record-signature-v2.json', '3725744c2162e3d9f2a6fb9499253057cff018ff1148ea934861826d033018d7'],
 };
diff --git a/tests/spec-update-attest-chain.test.js b/tests/spec-update-attest-chain.test.js
index 86218923..6cd6937e 100644
--- a/tests/spec-update-attest-chain.test.js
+++ b/tests/spec-update-attest-chain.test.js
@@ -3,7 +3,7 @@
 require('./_isolate-home'); // redirect $HOME before lib/config loads
 
 /**
- * sym-attest-v1's chained checkpoint (MMP 2.0 update 1, PR #43 at 5417176; D1): every case of the
+ * sym-attest-v1's chained checkpoint (MMP 2.0 update 1, meshcognition-website main at c07ff20; D1): every case of the
  * draft sym-attest-v1 vector against sym's own constructions and the reference lib.mjs, then the
  * store's and the node's rules — link checks, equivocation as overlapping ranges or a shared prev, no
  * witnessing an attester after a conflict, a chain that ends visibly when its segment is lost. Each
diff --git a/tests/spec-update-coupling.test.js b/tests/spec-update-coupling.test.js
index 5c1fb5ca..4d6b8e84 100644
--- a/tests/spec-update-coupling.test.js
+++ b/tests/spec-update-coupling.test.js
@@ -3,7 +3,7 @@
 require('./_isolate-home'); // redirect $HOME before lib/config loads
 
 /**
- * Coupling as MMP 2.0 update 1 states it (PR #43 at 2660ab9): a record that cites the receiver's own
+ * Coupling as MMP 2.0 update 1 states it (meshcognition-website main at c07ff20): a record that cites the receiver's own
  * records is gated and delivered like any other, and kept out of the receiver's remix cycle at the
  * trigger (D3, #35); a collapsed integration gets no §15.8 tether (#17, §15.5); unsigned valence and
  * arousal never reach Layer 6; only gated remixes count as remixes (#35); and xmesh-insight-v1 is
diff --git a/tests/spec-update-discovery.test.js b/tests/spec-update-discovery.test.js
index c63d69a2..86196db9 100644
--- a/tests/spec-update-discovery.test.js
+++ b/tests/spec-update-discovery.test.js
@@ -3,7 +3,7 @@
 require('./_isolate-home'); // redirect $HOME before lib/config loads
 
 /**
- * LAN discovery as MMP 2.0 update 1 states it (#17, #22; PR #43 at 2660ab9): one service type for
+ * LAN discovery as MMP 2.0 update 1 states it (#17, #22; meshcognition-website main at c07ff20): one service type for
  * every room, with the room in TXT `room`; a node dials only advertisements whose TXT room is its own
  * and whose `mmp` (a comma-separated version list) lists 2.0; TXT keys read as RFC 6763 §6.4 says,
  * case-insensitive with the first occurrence winning; the per-room type earlier releases advertised
diff --git a/tests/spec-update-records.test.js b/tests/spec-update-records.test.js
index 6fb752a1..97401fc2 100644
--- a/tests/spec-update-records.test.js
+++ b/tests/spec-update-records.test.js
@@ -3,8 +3,8 @@
 require('./_isolate-home'); // redirect $HOME before lib/config loads
 
 /**
- * Records as MMP 2.0 update 1 states them (#34 and #37, folded into spec/mmp-2.0-update-1 at
- * 2660ab9): one signed projection per assertion (D2), so every node holds one assertion as the same
+ * Records as MMP 2.0 update 1 states them (#34 and #37, in meshcognition-website main at
+ * c07ff20): one signed projection per assertion (D2), so every node holds one assertion as the same
  * bytes, and the record size measure. Each case of the record-projection-v2 and record-size-v2
  * vectors runs against sym's own code; the D2 tests fail on 018206d.
  */
diff --git a/tests/spec-update-vectors.test.js b/tests/spec-update-vectors.test.js
index 5730b2b2..16087151 100644
--- a/tests/spec-update-vectors.test.js
+++ b/tests/spec-update-vectors.test.js
@@ -1,8 +1,8 @@
 'use strict';
 
 /**
- * The MMP 2.0 update 1 artifacts sym vendors (tests/fixtures, from meshcognition-website PR #43,
- * branch spec/mmp-2.0-update-1 at 2660ab9; SOURCES.json records each digest), checked as copies, and
+ * The MMP 2.0 update 1 artifacts sym vendors (tests/fixtures, from meshcognition-website main at
+ * c07ff20, the merge of PR #43; SOURCES.json records each digest), checked as copies, and
  * the reference construction (scripts/mmp/lib.mjs, vendored as mmp-lib.mjs) run beside sym's own code
  * on the same inputs: what sym builds, the reference builds byte for byte.
  */

From 61948a2347d53e7f3bea64d4e6fbe193bbea6b1f Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Tue, 13 Oct 2026 18:57:02 +0100
Subject: [PATCH 146/148] test: the version a node names is package.json's, in
 every place

The hello's implementation, node.version, status().version and the module's
version are read from package.json; a release cannot leave a literal behind.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VMk5HbMaz4oD7zoakvPyA6
---
 tests/version-string.test.js | 39 ++++++++++++++++++++++++++++++++++++
 1 file changed, 39 insertions(+)
 create mode 100644 tests/version-string.test.js

diff --git a/tests/version-string.test.js b/tests/version-string.test.js
new file mode 100644
index 00000000..87988d43
--- /dev/null
+++ b/tests/version-string.test.js
@@ -0,0 +1,39 @@
+'use strict';
+
+require('./_isolate-home'); // redirect $HOME before lib/config loads
+
+/**
+ * The version a node names is package.json's, in every place it is named: the §5.2 hello's
+ * `implementation`, `node.version`, `status().version` and the module's `version`. None is a literal
+ * that a release could leave behind.
+ */
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const { SymNode } = require('../lib/node');
+const sym = require('../lib/node');
+const { NullDiscovery } = require('../lib/discovery');
+const { nodeDirById } = require('../lib/config');
+const { connectNodes } = require('./_core-secure');
+
+const VERSION = require('../package.json').version;
+
+describe('the version is package.json\'s', () => {
+  it('the hello, node.version, status() and the module name it', async () => {
+    const mk = (b) => new SymNode({ name: `${b}-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`, silent: true, discovery: new NullDiscovery(), room: 'ver' });
+    const a = mk('ver-a'); const b = mk('ver-b');
+    try {
+      await a.start(); await b.start();
+      await connectNodes(b, a);
+      assert.strictEqual(a.version, VERSION);
+      assert.strictEqual(sym.version, VERSION);
+      assert.strictEqual(a.status().version, VERSION);
+      const seenByB = b._peers.get(a.nodeId).transport.peerImplementation;
+      assert.deepStrictEqual(seenByB, { name: 'sym', version: VERSION }, 'what the peer\'s hello said');
+      assert.deepStrictEqual(a._implementation, { name: 'sym', version: VERSION });
+    } finally {
+      for (const n of [a, b]) { try { await n.stop(); } catch { /* */ } try { fs.rmSync(nodeDirById(n.nodeId), { recursive: true, force: true }); } catch { /* */ } }
+    }
+  });
+});

From 8ca18d2bae4f2992df76628242e302372a4ab42e Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Tue, 13 Oct 2026 18:57:02 +0100
Subject: [PATCH 147/148] 0.14.0

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VMk5HbMaz4oD7zoakvPyA6
---
 CHANGELOG.md        | 2 +-
 docs/WIRE-0.14.0.md | 6 +++---
 package-lock.json   | 4 ++--
 package.json        | 2 +-
 4 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ab08ad1b..e7c14141 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,6 @@
 # Changelog
 
-## 0.14.0 (unreleased)
+## 0.14.0 — 2026-10-13
 
 **Core Secure.** 0.14.0 makes every sym node an MMP v2.0 Core Secure participant (design
 "Core Secure identity: a peer is a proven session, never a hint", v2, 2026-10-02). It breaks the
diff --git a/docs/WIRE-0.14.0.md b/docs/WIRE-0.14.0.md
index 60fa33e7..f899dadd 100644
--- a/docs/WIRE-0.14.0.md
+++ b/docs/WIRE-0.14.0.md
@@ -53,9 +53,9 @@ decided before the session's next frame; the session closed when the grant expir
 
 ## 3. `role-chain-fetch`, `role-chain`, `role-digest`: retired
 
-sym 0.14.0 carried role grants and revokes with three frames of its own (`role-chain-fetch`,
-`role-chain` and `role-digest`) and resolved them by replaying signed times (the earlier sections 3,
-5 and 6 of this file). MMP §6.6 as merged (meshcognition-website main at 8c3381d, PR #40) replaces
+sym 0.14.0's development builds carried role grants and revokes with three frames of its own
+(`role-chain-fetch`, `role-chain` and `role-digest`) and resolved them by replaying signed times (the
+earlier sections 3, 5 and 6 of this file); none of that shipped. MMP §6.6 as merged (meshcognition-website main at 8c3381d, PR #40) replaces
 that rule and its frames: authority is a function of a set of hash-linked statements with no time in
 it, carried by `authority-statement`, `authority-digest`, `authority-fetch` and `authority-set`
 (§6.6.8, authority-frame.schema.json). sym implements §6.6 as written (lib/core/authority.js,
diff --git a/package-lock.json b/package-lock.json
index fe3f3e42..f336d9f2 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@sym-bot/sym",
-  "version": "0.13.17",
+  "version": "0.14.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@sym-bot/sym",
-      "version": "0.13.17",
+      "version": "0.14.0",
       "license": "Apache-2.0",
       "dependencies": {
         "bonjour-service": "^1.3.0",
diff --git a/package.json b/package.json
index 22c940db..fcc6fe7b 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@sym-bot/sym",
-  "version": "0.13.17",
+  "version": "0.14.0",
   "description": "Infrastructure and protocol for multi-agent collective intelligence",
   "main": "lib/node.js",
   "bin": {

From 6519392284c483b9e0c2e5015896e60f826b612c Mon Sep 17 00:00:00 2001
From: "SYM.BOT" <dev@sym.bot>
Date: Tue, 13 Oct 2026 19:02:15 +0100
Subject: [PATCH 148/148] gate: the stock-nodes driver sends a broadcast, not a
 record sealed to B

The ADMIT clause asserts the Admission Attestation on the stored entry. Since #27
(018206d) no attestation is signed about a directed record, so the driver's
{ to: nodeB.nodeId } record failed the clause on a correct runtime. The record is
now a room broadcast, which is attested. Dev tooling only: scripts/ is not in the
tarball, so the published artifact is unchanged.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VMk5HbMaz4oD7zoakvPyA6
---
 scripts/two-stock-nodes-driver.cjs | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/scripts/two-stock-nodes-driver.cjs b/scripts/two-stock-nodes-driver.cjs
index be5c34a8..072024a9 100644
--- a/scripts/two-stock-nodes-driver.cjs
+++ b/scripts/two-stock-nodes-driver.cjs
@@ -71,7 +71,11 @@ const FOCUS = 'two stock sym nodes prove the open runtime is self-sufficient';
   const received = [];
   nodeB.on('memory-received', (evt) => received.push(evt));
 
-  // CREATE + SIGN — remember() mints the record and signs it with A's identity key.
+  // CREATE + SIGN — remember() mints the record and signs it with A's identity key. It is a room
+  // broadcast, not a record addressed to B: a directed record is sealed to its addressee and no
+  // Admission Attestation is signed about it (#27: the room would learn a sealed record's key and
+  // verdict), so a directed record could not satisfy the ADMIT clause below, which asserts the
+  // attestation.
   const sent = nodeA.remember({
     focus: FOCUS,
     issue: 'a released runtime can resolve, start, and still fail to exchange a single block',
@@ -80,7 +84,7 @@ const FOCUS = 'two stock sym nodes prove the open runtime is self-sufficient';
     commitment: 'this gate blocks the release when any clause fails',
     perspective: 'node A, the sender',
     mood: { text: 'procedural', valence: 0, arousal: 0 },
-  }, { to: nodeB.nodeId });
+  });
   assert.ok(sent && sent.key, 'CREATE: remember() must return a local entry with a CMB key');
   console.log(`  A created + signed ${sent.key}`);