fix(relay): close F6 replay K_content nonce reuse via per-generation epoch-in-key

The recoverable replay key was stable per (hostContentSecret, sessionId) while the
agent-side sealer resets its deterministic-nonce seq to 0 on every restart/re-attach
→ two sealer generations sealed distinct plaintext under the SAME (key, nonce).

Add a required 'epoch' to ReplayKeyParams, fold it into the K_content HKDF salt
(sessionId U+001F epoch), mint a fresh epoch per createReplaySealer generation and
expose it, and thread it through ReplaySource so the browser re-derives the matching
key. Fresh epoch per generation ⇒ fresh key ⇒ seq=0 can never collide; recoverability
within a generation is preserved.

Touches relay-contracts/relay-e2e/agent/relay-web. Green: contracts 81, e2e 78,
agent 133, web 99; tsc clean. Regression proves same seq-0 nonce, different key.

relay-web/src/entry/manage-page.ts

@@ -16,11 +16,23 @@ import { createApiClient } from '../api-client'
 import { mountPreviewGrid } from '../preview-grid'
 import type { ReplaySource } from '../preview-client'
 
+/**
+ * FIX 3b / F6 placeholder epoch. The real per-generation `epoch` MUST be served by P1/P2 alongside
+ * the ciphertext ring buffer (the agent stamps a fresh epoch each time it reconstructs the sealer and
+ * resets seq to 0). This constant only keeps the `ReplaySource` shape explicit until those endpoints
+ * land; the stub still throws, so no frame is ever decrypted under it.
+ */
+const PLACEHOLDER_EPOCH = 'PENDING_P1_P2_EPOCH'
+
 async function loadReplay(
   _hostId: string,
 ): Promise<{ replay: ReplaySource; hostContentSecret: Uint8Array }> {
-  // TODO(P5/P1): fetch ciphertext replay + hostContentSecret (post auth/step-up). Not yet available.
-  throw new Error('replay source not yet wired (pending P5/P1 endpoints)')
+  // TODO(P5/P1/P2): fetch ciphertext replay + hostContentSecret (post auth/step-up) AND the real
+  // per-generation `epoch` (FIX 3b / F6) that the frames were sealed under. Until then the shape is:
+  //   { replay: { sessionId, alg, epoch: PLACEHOLDER_EPOCH, frames }, hostContentSecret }
+  // Not yet available → throw so a card shows "unavailable" rather than a fabricated screen.
+  void PLACEHOLDER_EPOCH
+  throw new Error('replay source not yet wired (pending P5/P1/P2 endpoints)')
 }
 
 function boot(): void {

relay-web/src/preview-client.ts

@@ -6,10 +6,11 @@
  * Ring-buffer replay survives a reload because the agent (P2) sealed each stored frame with
  * `sealReplayFrame` under the RECOVERABLE content key `K_content` — NOT the ephemeral live
  * `DirectionalKeys` (which are re-derived per handshake and lost on reload). The browser re-derives
- * the SAME `K_content` via `deriveContentKey({ hostContentSecret, sessionId, alg })` (§4.4 FIX 3;
+ * the SAME `K_content` via `deriveContentKey({ hostContentSecret, sessionId, alg, epoch })` (§4.4 FIX 3;
  * `hostContentSecret` obtained via P5 after auth/step-up) and decrypts each payload with
- * `openReplayCiphertext`. A wrong/ephemeral key throws (AEAD tag) → the card shows "unavailable",
- * never a torn/garbled screen (cross-host/session isolation, INV1).
+ * `openReplayCiphertext`. A wrong/ephemeral key — or a `ReplaySource.epoch` that doesn't match the
+ * generation the frames were sealed under (FIX 3b / F6) — throws (AEAD tag) → the card shows
+ * "unavailable", never a torn/garbled screen (cross-host/session isolation, INV1).
  *
  * The §4.4 crypto (`deriveContentKey`/`openReplayCiphertext`) is imported from `relay-e2e` and
  * injected — cited verbatim, never re-implemented. `hostContentSecret`/`K_content` are transient in
@@ -17,10 +18,17 @@
  */
 import type { AeadAlg, AeadKey, ReplayKeyParams } from 'relay-contracts'
 
-/** Ciphertext ring-buffer replay for one host/session. */
+/** Ciphertext ring-buffer replay for one host/session (one sealer generation). */
 export interface ReplaySource {
   readonly sessionId: string
   readonly alg: AeadAlg // negotiated aead (matches how P2 sealed the replay)
+  // FIX 3b / F6: the per-generation `epoch` under which THESE frames were sealed. The agent resets
+  // its deterministic-nonce seq to 0 on every reconstruction (restart/re-attach); folding a fresh
+  // epoch into K_content gives each generation a fresh key, so a seq=0 reset can never collide with
+  // a prior generation's (key, nonce). NON-SECRET — carried with the ring buffer so the browser
+  // re-derives the matching key. Frames from a DIFFERENT epoch derive a different key → AEAD tag
+  // fails → "unavailable" (never a torn screen).
+  readonly epoch: string
   readonly frames: readonly Uint8Array[] // stored DATA payloads, each a sealReplayFrame envelope
 }
 
@@ -85,6 +93,7 @@ export function mountPreviewClient(
         hostContentSecret,
         sessionId: replay.sessionId,
         alg: replay.alg,
+        epoch: replay.epoch, // F6: bind the key to THIS generation; a mismatched epoch → wrong key.
       })
     } catch {
       showUnavailable()

relay-web/test/default-terminal.test.ts

@@ -52,10 +52,12 @@ describe('default (real-xterm) loaders behind the DI seam', () => {
 
   it('mountPreviewClient renders via the default read-only xterm loader', async () => {
     const secret = randomBytes(32)
-    const k = deriveContentKey({ hostContentSecret: secret, sessionId: 's', alg: 'aes-256-gcm' })
+    const epoch = 'gen-1' // FIX 3b / F6: seal + declare under the same generation.
+    const k = deriveContentKey({ hostContentSecret: secret, sessionId: 's', alg: 'aes-256-gcm', epoch })
     const replay: ReplaySource = {
       sessionId: 's',
       alg: 'aes-256-gcm',
+      epoch,
       frames: [encodeEnvelope(sealReplayFrame(k, 0n, new TextEncoder().encode('DEFAULT-XTERM')))],
     }
     const card = document.createElement('div')

relay-web/test/extra-coverage.test.ts

@@ -207,7 +207,7 @@ describe('preview-client unavailable path', () => {
     const card = document.createElement('div')
     const client = mountPreviewClient(
       card,
-      { sessionId: 's', alg: 'aes-256-gcm', frames: [new Uint8Array([1])] },
+      { sessionId: 's', alg: 'aes-256-gcm', epoch: 'gen-1', frames: [new Uint8Array([1])] },
       new Uint8Array(32),
       { cols: 80, rows: 24 },
       {

relay-web/test/preview-client.test.ts

@@ -11,16 +11,38 @@ import {
 const HOST_SECRET = randomBytes(32)
 const SESSION_ID = 'sess-1'
 const ALG = 'aes-256-gcm' as const
+const EPOCH = 'gen-1' // FIX 3b / F6: the sealer generation these fixtures seal + declare under.
 
-/** Seal a screen (as a P2 agent stub would) under K_content with sealReplayFrame. */
-function sealedReplay(lines: readonly string[], secret = HOST_SECRET): ReplaySource {
-  const k = deriveContentKey({ hostContentSecret: secret, sessionId: SESSION_ID, alg: ALG })
+interface SealOpts {
+  readonly secret?: Uint8Array
+  /** Epoch the FRAMES are actually sealed under (the key that encrypts). */
+  readonly sealEpoch?: string
+  /** Epoch the ReplaySource DECLARES (the key the browser will re-derive). Defaults to sealEpoch. */
+  readonly declaredEpoch?: string
+}
+
+/**
+ * Seal a screen (as a P2 agent stub would) under K_content with sealReplayFrame. Recoverability
+ * holds because the frames are sealed with the SAME (secret, sessionId, alg, epoch) the returned
+ * ReplaySource declares. For the F6 regression, `sealEpoch` and `declaredEpoch` are set apart so the
+ * browser derives a different key than the frames were sealed under.
+ */
+function sealedReplay(lines: readonly string[], opts: SealOpts = {}): ReplaySource {
+  const secret = opts.secret ?? HOST_SECRET
+  const sealEpoch = opts.sealEpoch ?? EPOCH
+  const declaredEpoch = opts.declaredEpoch ?? sealEpoch
+  const k = deriveContentKey({
+    hostContentSecret: secret,
+    sessionId: SESSION_ID,
+    alg: ALG,
+    epoch: sealEpoch,
+  })
   const frames = lines.map((line, i) =>
     // sealReplayFrame → E2EEnvelope, encoded to a DATA payload the browser opens.
     // openReplayCiphertext decodes+opens; we mirror the encode via the session envelope codec.
     encodeReplayFrame(sealReplayFrame(k, BigInt(i), new TextEncoder().encode(line))),
   )
-  return { sessionId: SESSION_ID, alg: ALG, frames }
+  return { sessionId: SESSION_ID, alg: ALG, epoch: declaredEpoch, frames }
 }
 
 // The replay codec: relay-e2e's openReplayCiphertext expects the encoded envelope bytes.
@@ -67,6 +89,35 @@ describe('mountPreviewClient (T9)', () => {
     expect(term.written).toEqual([]) // never wrote a torn screen
   })
 
+  it('F6: a ReplaySource epoch that does NOT match the sealed generation → "unavailable", never a torn screen', async () => {
+    const card = document.createElement('div')
+    const term = mockTerminal()
+    // Frames sealed under generation "gen-1", but the ReplaySource declares a DIFFERENT epoch
+    // ("gen-2") — as if the ring buffer were mislabeled with the wrong generation. The browser
+    // re-derives a different K_content → AEAD tag fails → unavailable (no garbled render).
+    const replay = sealedReplay(['stale-screen'], { sealEpoch: 'gen-1', declaredEpoch: 'gen-2' })
+    const client = mountPreviewClient(card, replay, HOST_SECRET, { cols: 80, rows: 24 }, {
+      ...realDeps,
+      createTerminal: () => term,
+    })
+    await client.render()
+    expect(card.querySelector('.preview-unavailable')?.textContent).toBe('unavailable')
+    expect(term.written).toEqual([]) // never wrote a torn screen from the wrong generation
+  })
+
+  it('F6: a matching per-generation epoch preserves recoverability (frames render)', async () => {
+    const card = document.createElement('div')
+    const term = mockTerminal()
+    // sealEpoch === declaredEpoch (both "gen-7") ⇒ same key within one generation ⇒ replay recovers.
+    const replay = sealedReplay(['line-A', 'line-B'], { sealEpoch: 'gen-7', declaredEpoch: 'gen-7' })
+    const client = mountPreviewClient(card, replay, HOST_SECRET, { cols: 80, rows: 24 }, {
+      ...realDeps,
+      createTerminal: () => term,
+    })
+    await client.render()
+    expect(term.written).toEqual(['line-A', 'line-B'])
+  })
+
   it('read-only: the preview terminal exposes NO input path (no onData/send)', async () => {
     const card = document.createElement('div')
     const term = mockTerminal()

relay-web/test/preview-grid.test.ts

@@ -27,9 +27,16 @@ function host(sub: string): HostRecord {
   }
 }
 
+const EPOCH = 'gen-1' // FIX 3b / F6: per-generation key diversifier (seal + declare under the same one).
+
 function sealed(sessionId: string, secret: Uint8Array, line: string): ReplaySource {
-  const k = deriveContentKey({ hostContentSecret: secret, sessionId, alg: ALG })
-  return { sessionId, alg: ALG, frames: [encodeEnvelope(sealReplayFrame(k, 0n, new TextEncoder().encode(line)))] }
+  const k = deriveContentKey({ hostContentSecret: secret, sessionId, alg: ALG, epoch: EPOCH })
+  return {
+    sessionId,
+    alg: ALG,
+    epoch: EPOCH,
+    frames: [encodeEnvelope(sealReplayFrame(k, 0n, new TextEncoder().encode(line)))],
+  }
 }
 
 function fakeApi(hosts: readonly HostRecord[]): ApiClient {