@cello-protocol/daemon 0.0.161 → 0.0.163

package/dist/daemon.js

@@ -2512,7 +2512,7 @@ async function startDaemonHoldingLock(config, singletonLock) {
             // this as a completed endorsement would promise three steps that have not happened.
             guidance: res.storedWarning
                 ? `Submitted for '${sel.name}'. ${res.storedWarning}`
-                : `Submitted for '${sel.name}'. The portal will scan and mint it, then the subject must ACCEPT it before it is visible to anyone — a signal they have not accepted is inert. Nothing here is final until they decide.`,
+                : `Submitted for '${sel.name}'. The portal will scan and mint it, and it stays invisible to everyone unless the subject ACCEPTS it — they are free to refuse, and a signal they have not accepted is inert. Nothing here is final until they decide.`,
         };
     });
     /**
@@ -3407,6 +3407,10 @@ async function startDaemonHoldingLock(config, singletonLock) {
             owners: () => loadedAgents
                 .filter((a) => a.pubkey)
                 .map((a) => ({ agentName: a.name, ownerAgentId: a.pubkey.toLowerCase() })),
+            // DOD-MP-CONTROL-N-1 — the ONE implementation, on the layer, shared with every test fixture.
+            // A closure here instead would be untested by construction and hand-copied into fixtures
+            // that cannot disagree with it, which is exactly how the original defect survived.
+            holders: (ownerAgentId, documentId) => documentLayer.controlHolders(ownerAgentId, documentId),
             sign: async (agentName, tbs) => {
                 const provider = keyProviders.get(agentName);
                 if (!provider)
@@ -3559,7 +3563,7 @@ async function startDaemonHoldingLock(config, singletonLock) {
             // The owner KEY, not the agent name — every document row is scoped by our own pubkey hex
             // (M14-D5), and the store query behind this reads that column. Passing the name here
             // returns no rows and the wait times out on every delivery.
-            awaitAck: async (envelopeHash, timeoutMs) => {
+            awaitAck: async (envelopeHash, expectedAckerAgentId, timeoutMs) => {
                 const ownerKey = documentOwnerKeyFor(agentName);
                 if (ownerKey === null) {
                     // NOT "the peer stayed silent". `false` means the grace expired with no answer, and the
@@ -3571,7 +3575,7 @@ async function startDaemonHoldingLock(config, singletonLock) {
                     logger.error("document.delivery.ack_wait_unwired", { agentName, envelopeHash });
                     return null;
                 }
-                return documentLayer.awaitAck(ownerKey, envelopeHash, timeoutMs);
+                return documentLayer.awaitAck(ownerKey, envelopeHash, expectedAckerAgentId, timeoutMs);
             },
             drainHeld: async (sessionId, correlationId) => {
                 // ONLY WHEN THERE IS A GAP. `sealReadiness` already answers exactly this question, and
@@ -3615,6 +3619,7 @@ async function startDaemonHoldingLock(config, singletonLock) {
     // to go: without the inbound path a peer's answer is unroutable, and without the delivery worker a
     // published update never leaves.
     const documentPublish = new DocumentPublish({
+        holdersFor: (ownerAgentId, documentId) => documentLayer.holdersFor(ownerAgentId, documentId),
         store: documentLayer.store,
         engine: documentLayer.engine,
         logger,
@@ -3702,8 +3707,13 @@ async function startDaemonHoldingLock(config, singletonLock) {
                     if (ownerAgentId === null)
                         continue;
                     agentsSwept++;
-                    const peerFor = (documentId) => documentLayer.store.getDocument(ownerAgentId, documentId)?.peerAgentId ?? null;
-                    const result = await documentDeliveryFor(agentName).tick(ownerAgentId, peerFor, Date.now(), {
+                    // FANOUT-1: targets are the DERIVED holders minus ourselves — never per-sender
+                    // config, never the genesis peer column (§7-1's silent-divergence hazard).
+                    const holdersFor = (documentId) => {
+                        const holders = documentLayer.holdersFor(ownerAgentId, documentId);
+                        return holders === null ? null : holders.filter((h) => h !== ownerAgentId);
+                    };
+                    const result = await documentDeliveryFor(agentName).tick(ownerAgentId, holdersFor, Date.now(), {
                         senderAgentId: ownerAgentId,
                     });
                     attempted += result.attempted;