Function seal_active_checked 

pub fn seal_active_checked(bytes: Vec<u8>) -> Option<Vec<u8>>

Seal bytes for the live send path: through the active keyed ActiveSession if installed (which may fail closed, returning None — e.g. a one-time pad is exhausted), else through the active stateless suite, else pass-through. A None result is the fail-closed signal the caller MUST surface as a send error — never transmit the plaintext instead.