@cello-protocol/daemon 0.0.166 → 0.0.167

package/dist/document-delivery.js

@@ -123,6 +123,122 @@ export class DocumentDelivery {
         const result = {
             attempted: 0, delivered: 0, sent: 0, rejected: 0, deferred: 0, failed: 0,
         };
+        // DOD-MP-INVITE-FANOUT-1 — AMENDMENTS DRAIN FIRST, and the order is the point.
+        //
+        // A holder must apply the admitting amendment BEFORE any edit authored at the new epoch,
+        // otherwise they refuse that edit as coming from a non-participant — the exact symptom seen
+        // live, where a joiner's edits were silently dropped by a holder still at the old epoch.
+        // Draining this queue ahead of the envelope queue in every pass makes that ordering a
+        // guarantee rather than a coincidence of timing; the store's head-of-line rule makes it hold
+        // ACROSS passes too.
+        //
+        // An owed row whose amendment is not in the recorded chain can never be sent (the pending query
+        // inner-joins the chain, deliberately: a redelivery must never send bytes this daemon's own
+        // chain does not contain). Such a row is invisible AND owed forever, so it is named rather than
+        // scanned past in silence.
+        for (const orphan of this.#store.amendmentDeliveriesWithoutChainRow(ownerAgentId)) {
+            this.#logger.error("document.amendment.chain_row_missing", {
+                documentId: orphan.documentId,
+                amendmentHash: orphan.amendmentHash,
+                holderAgentId: orphan.holderAgentId,
+                correlationId,
+                impact: "this membership change is owed to a holder and its bytes are not in the local chain, " +
+                    "so it can never be delivered — the holder will stay at the old epoch",
+            });
+        }
+        for (const owed of this.#store.pendingAmendmentDeliveries(ownerAgentId, nowMs)) {
+            const holders = holdersFor(owed.documentId);
+            if (holders === null) {
+                // NOT transient, and NOT silent. The envelope pass logs `no_holders` only for documents
+                // that also have pending ENVELOPES — a document whose content is fully acked has none, so
+                // this row would otherwise be re-scanned every tick forever with nothing said anywhere.
+                // Scheduled at the cap so it stops spinning, and logged so it stops being invisible.
+                this.#store.recordAmendmentAttempt(ownerAgentId, owed.documentId, owed.amendmentHash, owed.holderAgentId, nowMs + DELIVERY_UNRESOLVABLE_RETRY_MS);
+                this.#logger.error("document.amendment.holders_underivable", {
+                    documentId: owed.documentId,
+                    amendmentHash: owed.amendmentHash,
+                    holderAgentId: owed.holderAgentId,
+                    correlationId,
+                    impact: "the document row is gone or its chain does not derive, so this membership change " +
+                        "cannot be addressed to anyone — it stays owed",
+                });
+                continue;
+            }
+            // A holder the chain no longer contains, or one it records as removed, is owed nothing.
+            // RETIRED, never acked: an ack here would make the durable record claim a delivery that
+            // never happened. Both checks, because the envelope path uses both and a disagreement
+            // between them would otherwise keep this loop dialing a locally-removed holder.
+            const removed = this.#store.memberRemoved(ownerAgentId, owed.documentId, owed.holderAgentId);
+            if (!holders.includes(owed.holderAgentId) || removed.removed) {
+                this.#store.retireAmendmentDelivery(ownerAgentId, owed.documentId, owed.amendmentHash, owed.holderAgentId, nowMs);
+                this.#logger.info("document.amendment.holder_retired", {
+                    documentId: owed.documentId,
+                    amendmentHash: owed.amendmentHash,
+                    holderAgentId: owed.holderAgentId,
+                    correlationId,
+                });
+                continue;
+            }
+            // CLAIM THE ROW BEFORE DIALING — the same rule the envelope path states and for the same
+            // reason: a crash mid-dial would otherwise leave the row immediately due with `attempts`
+            // unchanged, so a crash-looping daemon dials at full rate forever and never escalates. It
+            // also closes the window where the 60s sweep fires inside the invite handler's own await and
+            // sends the same amendment twice.
+            const attemptsNow = this.#store.recordAmendmentAttempt(ownerAgentId, owed.documentId, owed.amendmentHash, owed.holderAgentId, nowMs + backoffFor(owed.attempts));
+            result.attempted += 1;
+            let sent;
+            try {
+                const out = await this.#transport.sendBytes({
+                    peerAgentId: owed.holderAgentId,
+                    documentId: owed.documentId,
+                    bytes: owed.bytes,
+                    correlationId,
+                });
+                sent = out.ok ? { ok: true, parked: out.parked === true } : out;
+            }
+            catch (err) {
+                sent = { ok: false, reason: "amendment_send_threw", detail: err instanceof Error ? err.message : String(err) };
+            }
+            if (sent.ok && sent.parked !== true) {
+                // SENT, NOT ACKED. Their daemon received the frame; whether it RECORDED it is a separate
+                // fact and it can refuse (a chain gap or a failed derivation throws on the receiver and
+                // answers nothing). The row stays owed and is re-offered, and it settles for real when the
+                // holder acks any envelope at this epoch or later — which proves they applied it, because
+                // the inbound epoch gate would have refused that envelope otherwise.
+                this.#store.markAmendmentSent(ownerAgentId, owed.documentId, owed.amendmentHash, owed.holderAgentId, nowMs, DELIVERY_ACK_TIMEOUT_MS);
+                result.sent += 1;
+                this.#logger.info("document.amendment.sent", {
+                    documentId: owed.documentId,
+                    holderAgentId: owed.holderAgentId,
+                    amendmentHash: owed.amendmentHash,
+                    epochId: owed.epochId,
+                    attempts: attemptsNow,
+                    correlationId,
+                });
+            }
+            else {
+                // PARKED IS NOT DELIVERED. The relay took it because the holder had no live counterparty;
+                // if that holder never drains it and the debt has been cleared, the membership change is
+                // gone with both surfaces reporting success. It is a retry, exactly like a refusal.
+                const reason = sent.ok ? "relay_parked" : sent.reason;
+                result.failed += 1;
+                // WARN, NEVER ERROR, and NEVER ABANDONED: a membership change that cannot be delivered yet
+                // is a retry, not a loss. There is no attempt ceiling here on purpose — abandoning would
+                // put two holders permanently out of step over exactly the fact they must agree on.
+                this.#logger.warn("document.amendment.delivery_failed", {
+                    documentId: owed.documentId,
+                    holderAgentId: owed.holderAgentId,
+                    amendmentHash: owed.amendmentHash,
+                    epochId: owed.epochId,
+                    reason,
+                    // The CAUSE, not just the exit-point label. `session_sealed` says where it surfaced;
+                    // detail says why.
+                    detail: sent.ok ? "the relay is holding it — the holder had no live counterparty" : sent.detail,
+                    attempts: attemptsNow,
+                    correlationId,
+                });
+            }
+        }
         // Grouped (document, holder): one derivation and one reachability probe serve every pending
         // envelope for that pair.
         const byDocument = new Map();
@@ -284,6 +400,24 @@ export class DocumentDelivery {
                             opened: outcome.sessionOpened, correlationId,
                         });
                         if (outcome.admitted) {
+                            // PROOF BY EPOCH (DOD-MP-INVITE-FANOUT-1). There is no amendment ack frame, but an
+                            // ADMISSION is one: the inbound epoch gate requires the envelope's epoch to EQUAL the
+                            // receiver's own derived epoch, so a holder that admitted an envelope at epoch E
+                            // demonstrably holds every amendment up to E. Their acceptance of the content is an
+                            // acceptance of the governance that made the content admissible — which settles the
+                            // amendment row on evidence rather than on inference.
+                            //
+                            // ADMITTED ONLY, NEVER MERELY ANSWERED. A rejection is also an ack for delivery
+                            // purposes, and it proves nothing here: the checks that run BEFORE the epoch gate —
+                            // an unknown document, a failed signature — refuse terminally while the holder may be
+                            // at any epoch at all. Settling on those would ack an amendment they do not have,
+                            // which is the exact defect this queue exists to prevent, reintroduced one layer up.
+                            const settled = this.#store.ackAmendmentsThroughEpoch(ownerAgentId, documentId, holderAgentId, envelope.epochId, nowMs);
+                            if (settled > 0) {
+                                this.#logger.info("document.amendment.confirmed_by_epoch", {
+                                    documentId, holderAgentId, epochId: envelope.epochId, settled, correlationId,
+                                });
+                            }
                             this.#logger.info("document.delivery.acked", {
                                 documentId, envelopeHash: envelope.envelopeHash, holderAgentId,
                                 sessionId: outcome.sessionId, firstAck: first, correlationId,

package/dist/document-delivery.js.map

@@ -1 +1 @@
-{"version":3,"file":"document-delivery.js","sourceRoot":"","sources":["../src/document-delivery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAgHH;;;;;;;;;;;GAWG;AACH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC;AAEnD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAU,CAAC;AACrF,MAAM,CAAC,MAAM,uBAAuB,GAAG,mBAAmB,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAE3F;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,uBAAuB,CAAC;AAE/D;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC;AAE5C;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,uBAAuB,CAAC;AAEtE,MAAM,UAAU,UAAU,CAAC,QAAgB;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,mBAAmB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC5E,OAAO,mBAAmB,CAAC,GAAG,CAAE,CAAC;AACnC,CAAC;AAaD,MAAM,OAAO,gBAAgB;IAClB,MAAM,CAAgB;IACtB,UAAU,CAA4B;IACtC,OAAO,CAAS;IACzB,SAAS,GAAuC,IAAI,CAAC;IAErD,YAAY,KAAoB,EAAE,SAAoC,EAAE,MAAc;QACpF,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACxB,CAAC;IAED;;;;OAIG;IACH;;;;OAIG;IACH,KAAK,CAAC,IAAI,CACR,YAAoB,EACpB,UAAmD,EACnD,KAAa,EACb,OAKI,EAAE;QAEN,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAC7D,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,MAAM,GAAG,CAAC;QACnB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACxB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CACR,YAAoB,EACpB,UAAmD,EACnD,KAAa,EACb,IAIC;QAED,IAAI,sBAAsB,GAAG,4BAA4B,CAAC;QAC1D,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC;QACvF,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,YAAY,CAAC;QAEzD,wFAAwF;QACxF,iFAAiF;QACjF,IAAI,CAAC,MAAM,CAAC,2BAA2B,CAAC,YAAY,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC;QAE5E,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QACzE,MAAM,MAAM,GAAuB;YACjC,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;SACzE,CAAC;QAEF,4FAA4F;QAC5F,0BAA0B;QAC1B,MAAM,UAAU,GAAG,IAAI,GAAG,EAAmF,CAAC;QAC9G,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,IAAI,GAAG,EAAE,CAAC;gBACpB,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YACxC,CAAC;YACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;YAC1C,IAAI,IAAI;gBAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;;gBAClB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,CAAC;QAED,KAAK,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,IAAI,UAAU,EAAE,CAAC;YACpD,MAAM,cAAc,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;YAC9C,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;gBAC5B,sFAAsF;gBACtF,iFAAiF;gBACjF,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE;oBACjD,UAAU;oBACV,OAAO,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;oBACrE,aAAa;iBACd,CAAC,CAAC;gBACH,KAAK,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,YAAY,EAAE,CAAC;oBAC1C,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;wBACrB,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAC7B,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,EACzD,KAAK,GAAG,8BAA8B,CACvC,CAAC;oBACJ,CAAC;oBACD,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;gBAC/B,CAAC;gBACD,SAAS;YACX,CAAC;YACD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;YAE3C,KAAK,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,YAAY,EAAE,CAAC;gBACjD,iFAAiF;gBACjF,+EAA+E;gBAC/E,iDAAiD;gBACjD,IACE,CAAC,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC;oBAC9B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC,OAAO,EAC1E,CAAC;oBACD,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,uBAAuB,CACvD,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,KAAK,CAC/C,CAAC;oBACF,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;wBACjC,IAAI,CAAC,MAAM,CAAC,2BAA2B,CAAC,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;oBACjF,CAAC;oBACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,gCAAgC,EAAE;wBAClD,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,CAAC,MAAM,EAAE,aAAa;qBACxE,CAAC,CAAC;oBACH,SAAS;gBACX,CAAC;gBAED,IAAI,KAAoD,CAAC;gBACzD,IAAI,CAAC;oBACH,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;gBAC9E,CAAC;gBAAC,OAAO,GAAY,EAAE,CAAC;oBACtB,uFAAuF;oBACvF,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,iCAAiC,EAAE;wBACnD,UAAU,EAAE,aAAa,EAAE,aAAa;wBACxC,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;qBACzD,CAAC,CAAC;oBACH,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;wBACrB,kFAAkF;wBAClF,6EAA6E;wBAC7E,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAC7B,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,aAAa,EAChE,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAC/B,CAAC;oBACJ,CAAC;oBACD,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC;oBAC/B,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;oBACrB,IAAI,CAAC,OAAO,CAAC,IAAI,CACf,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,oCAAoC,EAC5F,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,CACnE,CAAC;oBACF,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;wBACrB,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAC7B,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,aAAa,EAChE,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAC/B,CAAC;oBACJ,CAAC;oBACD,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC;oBAC/B,SAAS;gBACX,CAAC;gBAED,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;oBACvB,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;oBAC9B,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC;oBACtB,qFAAqF;oBACrF,8BAA8B;oBAC9B,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAC7B,YAAY,EAAE,UAAU,EAAE,QAAQ,CAAC,YAAY,EAAE,aAAa,EAC9D,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CACjC,CAAC;oBACF,IAAI,OAAkE,CAAC;oBACvE,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;oBAClC,IAAI,CAAC;wBACH,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;4BACtC,WAAW,EAAE,aAAa;4BAC1B,UAAU;4BACV,QAAQ;4BACR,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,sBAAsB,CAAC;4BAC/C,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC,UAAU,CAAC;4BAC/C,aAAa;yBACd,CAAC,CAAC;oBACL,CAAC;oBAAC,OAAO,GAAY,EAAE,CAAC;wBACtB,OAAO,GAAG;4BACR,EAAE,EAAE,KAAK;4BACT,MAAM,EAAE,yBAAyB;4BACjC,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;yBACzD,CAAC;oBACJ,CAAC;4BAAS,CAAC;wBACT,sBAAsB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,CAAC;oBACxD,CAAC;oBAED,IAAI,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;wBAC5C,mFAAmF;wBACnF,mFAAmF;wBACnF,mFAAmF;wBACnF,8BAA8B;wBAC9B,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAC7B,YAAY,EAAE,UAAU,EAAE,QAAQ,CAAC,YAAY,EAAE,aAAa,EAAE,KAAK,CACtE,CAAC;wBACF,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,CACxC,YAAY,EAAE,UAAU,EAAE,QAAQ,CAAC,YAAY,EAAE,aAAa,CAC/D,CAAC;wBACF,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAC7B,YAAY,EAAE,UAAU,EAAE,QAAQ,CAAC,YAAY,EAAE,aAAa,EAC9D,KAAK,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAC9E,CAAC;wBACF,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,wBAAwB,EAAE;4BAC1C,UAAU;4BACV,YAAY,EAAE,QAAQ,CAAC,YAAY;4BACnC,aAAa;4BACb,SAAS,EAAE,OAAO,CAAC,SAAS;4BAC5B,aAAa,EAAE,OAAO,CAAC,aAAa;4BACpC,YAAY,EAAE,KAAK;4BACnB,aAAa;yBACd,CAAC,CAAC;wBACH,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;wBAEjB,IAAI,KAAK,IAAI,0BAA0B,EAAE,CAAC;4BACxC,+EAA+E;4BAC/E,iFAAiF;4BACjF,gFAAgF;4BAChF,IAAI,CAAC,MAAM,CAAC,2BAA2B,CACrC,YAAY,EAAE,UAAU,EAAE,QAAQ,CAAC,YAAY,EAAE,aAAa,EAAE,KAAK,CACtE,CAAC;4BACF,IAAI,CAAC,MAAM,CAAC,2BAA2B,CACrC,YAAY,EAAE,UAAU,EAAE,QAAQ,CAAC,YAAY,EAAE,KAAK,CACvD,CAAC;4BACF,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,iCAAiC,EAAE;gCACpD,UAAU;gCACV,YAAY,EAAE,QAAQ,CAAC,YAAY;gCACnC,aAAa;gCACb,KAAK;gCACL,aAAa;gCACb,MAAM,EACJ,kCAAkC,KAAK,sCAAsC;oCAC7E,8EAA8E;oCAC9E,4DAA4D;oCAC5D,4EAA4E;oCAC5E,qDAAqD;oCACrD,8EAA8E;oCAC9E,cAAc;6BACjB,CAAC,CAAC;4BACH,MAAM,YAAY,GAAG,cAAc;iCAChC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,aAAa,CAAC;iCAClC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;4BAC5E,IAAI,YAAY,EAAE,CAAC;gCACjB,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,YAAY,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;gCACnE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,uCAAuC,EAAE;oCAC1D,UAAU,EAAE,aAAa;iCAC1B,CAAC,CAAC;4BACL,CAAC;wBACH,CAAC;oBACH,CAAC;yBAAM,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;wBACtB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,CACzC,YAAY,EAAE,UAAU,EAAE,QAAQ,CAAC,YAAY,EAAE,aAAa,EAAE,KAAK,CACtE,CAAC;wBACF,uEAAuE;wBACvE,IAAI,CAAC,MAAM,CAAC,2BAA2B,CACrC,YAAY,EAAE,UAAU,EAAE,QAAQ,CAAC,YAAY,EAAE,KAAK,CACvD,CAAC;wBACF,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,2BAA2B,EAAE;4BAC7C,UAAU,EAAE,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;4BACvD,MAAM,EAAE,OAAO,CAAC,aAAa,EAAE,aAAa;yBAC7C,CAAC,CAAC;wBACH,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;4BACrB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,yBAAyB,EAAE;gCAC3C,UAAU,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,aAAa;gCAC9D,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa;6BAC7D,CAAC,CAAC;4BACH,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC;wBACxB,CAAC;6BAAM,CAAC;4BACN,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,4BAA4B,EAAE;gCAC9C,UAAU,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,aAAa;gCAC9D,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,eAAe,EAAE,aAAa;6BAC7E,CAAC,CAAC;4BACH,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;wBACvB,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,0BAA0B,EAAE;4BAC5C,UAAU,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,aAAa;4BAC9D,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,GAAG,CAAC;4BAC1E,aAAa;yBACd,CAAC,CAAC;wBACH,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;oBACrB,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}
+{"version":3,"file":"document-delivery.js","sourceRoot":"","sources":["../src/document-delivery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAyHH;;;;;;;;;;;GAWG;AACH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC;AAEnD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAU,CAAC;AACrF,MAAM,CAAC,MAAM,uBAAuB,GAAG,mBAAmB,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAE3F;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,uBAAuB,CAAC;AAE/D;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC;AAE5C;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,uBAAuB,CAAC;AAEtE,MAAM,UAAU,UAAU,CAAC,QAAgB;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,mBAAmB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC5E,OAAO,mBAAmB,CAAC,GAAG,CAAE,CAAC;AACnC,CAAC;AAaD,MAAM,OAAO,gBAAgB;IAClB,MAAM,CAAgB;IACtB,UAAU,CAA4B;IACtC,OAAO,CAAS;IACzB,SAAS,GAAuC,IAAI,CAAC;IAErD,YAAY,KAAoB,EAAE,SAAoC,EAAE,MAAc;QACpF,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACxB,CAAC;IAED;;;;OAIG;IACH;;;;OAIG;IACH,KAAK,CAAC,IAAI,CACR,YAAoB,EACpB,UAAmD,EACnD,KAAa,EACb,OAKI,EAAE;QAEN,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAC7D,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,MAAM,GAAG,CAAC;QACnB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACxB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CACR,YAAoB,EACpB,UAAmD,EACnD,KAAa,EACb,IAIC;QAED,IAAI,sBAAsB,GAAG,4BAA4B,CAAC;QAC1D,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC;QACvF,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,YAAY,CAAC;QAEzD,wFAAwF;QACxF,iFAAiF;QACjF,IAAI,CAAC,MAAM,CAAC,2BAA2B,CAAC,YAAY,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC;QAE5E,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QACzE,MAAM,MAAM,GAAuB;YACjC,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;SACzE,CAAC;QAEF,+EAA+E;QAC/E,EAAE;QACF,yFAAyF;QACzF,4FAA4F;QAC5F,yFAAyF;QACzF,sFAAsF;QACtF,6FAA6F;QAC7F,qBAAqB;QACrB,EAAE;QACF,gGAAgG;QAChG,4FAA4F;QAC5F,gGAAgG;QAChG,2BAA2B;QAC3B,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,kCAAkC,CAAC,YAAY,CAAC,EAAE,CAAC;YAClF,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,sCAAsC,EAAE;gBACzD,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,aAAa;gBACb,MAAM,EACJ,uFAAuF;oBACvF,sEAAsE;aACzE,CAAC,CAAC;QACL,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,0BAA0B,CAAC,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC;YAC/E,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC5C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,wFAAwF;gBACxF,0FAA0F;gBAC1F,wFAAwF;gBACxF,qFAAqF;gBACrF,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAChC,YAAY,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,aAAa,EACrE,KAAK,GAAG,8BAA8B,CACvC,CAAC;gBACF,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,wCAAwC,EAAE;oBAC3D,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,aAAa,EAAE,IAAI,CAAC,aAAa;oBACjC,aAAa,EAAE,IAAI,CAAC,aAAa;oBACjC,aAAa;oBACb,MAAM,EACJ,mFAAmF;wBACnF,+CAA+C;iBAClD,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,wFAAwF;YACxF,wFAAwF;YACxF,sFAAsF;YACtF,gFAAgF;YAChF,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;YAC7F,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBAC7D,IAAI,CAAC,MAAM,CAAC,uBAAuB,CACjC,YAAY,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,KAAK,CAC7E,CAAC;gBACF,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,mCAAmC,EAAE;oBACrD,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,aAAa,EAAE,IAAI,CAAC,aAAa;oBACjC,aAAa,EAAE,IAAI,CAAC,aAAa;oBACjC,aAAa;iBACd,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,yFAAyF;YACzF,yFAAyF;YACzF,0FAA0F;YAC1F,6FAA6F;YAC7F,kCAAkC;YAClC,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,sBAAsB,CACpD,YAAY,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,aAAa,EACrE,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAClC,CAAC;YACF,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC;YACtB,IAAI,IAAqF,CAAC;YAC1F,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;oBAC1C,WAAW,EAAE,IAAI,CAAC,aAAa;oBAC/B,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,aAAa;iBACd,CAAC,CAAC;gBACH,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YAClE,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,IAAI,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACjH,CAAC;YACD,IAAI,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpC,yFAAyF;gBACzF,wFAAwF;gBACxF,2FAA2F;gBAC3F,0FAA0F;gBAC1F,qEAAqE;gBACrE,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAC3B,YAAY,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,aAAa,EACrE,KAAK,EAAE,uBAAuB,CAC/B,CAAC;gBACF,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;gBACjB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,yBAAyB,EAAE;oBAC3C,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,aAAa,EAAE,IAAI,CAAC,aAAa;oBACjC,aAAa,EAAE,IAAI,CAAC,aAAa;oBACjC,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,QAAQ,EAAE,WAAW;oBACrB,aAAa;iBACd,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,0FAA0F;gBAC1F,yFAAyF;gBACzF,oFAAoF;gBACpF,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;gBACtD,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;gBACnB,2FAA2F;gBAC3F,yFAAyF;gBACzF,oFAAoF;gBACpF,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,oCAAoC,EAAE;oBACtD,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,aAAa,EAAE,IAAI,CAAC,aAAa;oBACjC,aAAa,EAAE,IAAI,CAAC,aAAa;oBACjC,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,MAAM;oBACN,qFAAqF;oBACrF,mBAAmB;oBACnB,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,+DAA+D,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM;oBAC/F,QAAQ,EAAE,WAAW;oBACrB,aAAa;iBACd,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,4FAA4F;QAC5F,0BAA0B;QAC1B,MAAM,UAAU,GAAG,IAAI,GAAG,EAAmF,CAAC;QAC9G,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,IAAI,GAAG,EAAE,CAAC;gBACpB,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YACxC,CAAC;YACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;YAC1C,IAAI,IAAI;gBAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;;gBAClB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,CAAC;QAED,KAAK,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,IAAI,UAAU,EAAE,CAAC;YACpD,MAAM,cAAc,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;YAC9C,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;gBAC5B,sFAAsF;gBACtF,iFAAiF;gBACjF,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE;oBACjD,UAAU;oBACV,OAAO,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;oBACrE,aAAa;iBACd,CAAC,CAAC;gBACH,KAAK,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,YAAY,EAAE,CAAC;oBAC1C,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;wBACrB,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAC7B,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,EACzD,KAAK,GAAG,8BAA8B,CACvC,CAAC;oBACJ,CAAC;oBACD,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;gBAC/B,CAAC;gBACD,SAAS;YACX,CAAC;YACD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;YAE3C,KAAK,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,YAAY,EAAE,CAAC;gBACjD,iFAAiF;gBACjF,+EAA+E;gBAC/E,iDAAiD;gBACjD,IACE,CAAC,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC;oBAC9B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC,OAAO,EAC1E,CAAC;oBACD,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,uBAAuB,CACvD,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,KAAK,CAC/C,CAAC;oBACF,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;wBACjC,IAAI,CAAC,MAAM,CAAC,2BAA2B,CAAC,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;oBACjF,CAAC;oBACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,gCAAgC,EAAE;wBAClD,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,CAAC,MAAM,EAAE,aAAa;qBACxE,CAAC,CAAC;oBACH,SAAS;gBACX,CAAC;gBAED,IAAI,KAAoD,CAAC;gBACzD,IAAI,CAAC;oBACH,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;gBAC9E,CAAC;gBAAC,OAAO,GAAY,EAAE,CAAC;oBACtB,uFAAuF;oBACvF,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,iCAAiC,EAAE;wBACnD,UAAU,EAAE,aAAa,EAAE,aAAa;wBACxC,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;qBACzD,CAAC,CAAC;oBACH,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;wBACrB,kFAAkF;wBAClF,6EAA6E;wBAC7E,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAC7B,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,aAAa,EAChE,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAC/B,CAAC;oBACJ,CAAC;oBACD,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC;oBAC/B,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;oBACrB,IAAI,CAAC,OAAO,CAAC,IAAI,CACf,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,oCAAoC,EAC5F,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,CACnE,CAAC;oBACF,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;wBACrB,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAC7B,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,aAAa,EAChE,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAC/B,CAAC;oBACJ,CAAC;oBACD,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC;oBAC/B,SAAS;gBACX,CAAC;gBAED,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;oBACvB,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;oBAC9B,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC;oBACtB,qFAAqF;oBACrF,8BAA8B;oBAC9B,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAC7B,YAAY,EAAE,UAAU,EAAE,QAAQ,CAAC,YAAY,EAAE,aAAa,EAC9D,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CACjC,CAAC;oBACF,IAAI,OAAkE,CAAC;oBACvE,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;oBAClC,IAAI,CAAC;wBACH,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;4BACtC,WAAW,EAAE,aAAa;4BAC1B,UAAU;4BACV,QAAQ;4BACR,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,sBAAsB,CAAC;4BAC/C,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC,UAAU,CAAC;4BAC/C,aAAa;yBACd,CAAC,CAAC;oBACL,CAAC;oBAAC,OAAO,GAAY,EAAE,CAAC;wBACtB,OAAO,GAAG;4BACR,EAAE,EAAE,KAAK;4BACT,MAAM,EAAE,yBAAyB;4BACjC,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;yBACzD,CAAC;oBACJ,CAAC;4BAAS,CAAC;wBACT,sBAAsB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,CAAC;oBACxD,CAAC;oBAED,IAAI,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;wBAC5C,mFAAmF;wBACnF,mFAAmF;wBACnF,mFAAmF;wBACnF,8BAA8B;wBAC9B,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAC7B,YAAY,EAAE,UAAU,EAAE,QAAQ,CAAC,YAAY,EAAE,aAAa,EAAE,KAAK,CACtE,CAAC;wBACF,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,CACxC,YAAY,EAAE,UAAU,EAAE,QAAQ,CAAC,YAAY,EAAE,aAAa,CAC/D,CAAC;wBACF,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAC7B,YAAY,EAAE,UAAU,EAAE,QAAQ,CAAC,YAAY,EAAE,aAAa,EAC9D,KAAK,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAC9E,CAAC;wBACF,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,wBAAwB,EAAE;4BAC1C,UAAU;4BACV,YAAY,EAAE,QAAQ,CAAC,YAAY;4BACnC,aAAa;4BACb,SAAS,EAAE,OAAO,CAAC,SAAS;4BAC5B,aAAa,EAAE,OAAO,CAAC,aAAa;4BACpC,YAAY,EAAE,KAAK;4BACnB,aAAa;yBACd,CAAC,CAAC;wBACH,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;wBAEjB,IAAI,KAAK,IAAI,0BAA0B,EAAE,CAAC;4BACxC,+EAA+E;4BAC/E,iFAAiF;4BACjF,gFAAgF;4BAChF,IAAI,CAAC,MAAM,CAAC,2BAA2B,CACrC,YAAY,EAAE,UAAU,EAAE,QAAQ,CAAC,YAAY,EAAE,aAAa,EAAE,KAAK,CACtE,CAAC;4BACF,IAAI,CAAC,MAAM,CAAC,2BAA2B,CACrC,YAAY,EAAE,UAAU,EAAE,QAAQ,CAAC,YAAY,EAAE,KAAK,CACvD,CAAC;4BACF,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,iCAAiC,EAAE;gCACpD,UAAU;gCACV,YAAY,EAAE,QAAQ,CAAC,YAAY;gCACnC,aAAa;gCACb,KAAK;gCACL,aAAa;gCACb,MAAM,EACJ,kCAAkC,KAAK,sCAAsC;oCAC7E,8EAA8E;oCAC9E,4DAA4D;oCAC5D,4EAA4E;oCAC5E,qDAAqD;oCACrD,8EAA8E;oCAC9E,cAAc;6BACjB,CAAC,CAAC;4BACH,MAAM,YAAY,GAAG,cAAc;iCAChC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,aAAa,CAAC;iCAClC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;4BAC5E,IAAI,YAAY,EAAE,CAAC;gCACjB,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,YAAY,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;gCACnE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,uCAAuC,EAAE;oCAC1D,UAAU,EAAE,aAAa;iCAC1B,CAAC,CAAC;4BACL,CAAC;wBACH,CAAC;oBACH,CAAC;yBAAM,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;wBACtB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,CACzC,YAAY,EAAE,UAAU,EAAE,QAAQ,CAAC,YAAY,EAAE,aAAa,EAAE,KAAK,CACtE,CAAC;wBAEF,uEAAuE;wBACvE,IAAI,CAAC,MAAM,CAAC,2BAA2B,CACrC,YAAY,EAAE,UAAU,EAAE,QAAQ,CAAC,YAAY,EAAE,KAAK,CACvD,CAAC;wBACF,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,2BAA2B,EAAE;4BAC7C,UAAU,EAAE,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS;4BACvD,MAAM,EAAE,OAAO,CAAC,aAAa,EAAE,aAAa;yBAC7C,CAAC,CAAC;wBACH,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;4BACrB,mFAAmF;4BACnF,sFAAsF;4BACtF,iFAAiF;4BACjF,oFAAoF;4BACpF,oFAAoF;4BACpF,sDAAsD;4BACtD,EAAE;4BACF,gFAAgF;4BAChF,oFAAoF;4BACpF,sFAAsF;4BACtF,kFAAkF;4BAClF,qFAAqF;4BACrF,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,yBAAyB,CACnD,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CACjE,CAAC;4BACF,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;gCAChB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,uCAAuC,EAAE;oCACzD,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,aAAa;iCAC7E,CAAC,CAAC;4BACL,CAAC;4BACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,yBAAyB,EAAE;gCAC3C,UAAU,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,aAAa;gCAC9D,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa;6BAC7D,CAAC,CAAC;4BACH,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC;wBACxB,CAAC;6BAAM,CAAC;4BACN,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,4BAA4B,EAAE;gCAC9C,UAAU,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,aAAa;gCAC9D,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,eAAe,EAAE,aAAa;6BAC7E,CAAC,CAAC;4BACH,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;wBACvB,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACN,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,0BAA0B,EAAE;4BAC5C,UAAU,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,aAAa;4BAC9D,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,GAAG,CAAC;4BAC1E,aAAa;yBACd,CAAC,CAAC;wBACH,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;oBACrB,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/document-handlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"document-handlers.d.ts","sourceRoot":"","sources":["../src/document-handlers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAiCH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAYxE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,aAAa,CAAC;IACrB,OAAO,EAAE,eAAe,CAAC;IACzB,qFAAqF;IACrF,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,yBAAyB,CAAC;IAC3D,uFAAuF;IACvF,YAAY,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACrE,mFAAmF;IACnF,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC9C,+BAA+B;IAC/B,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC9D,GAAG,IAAI,MAAM,CAAC;CACf;AAOD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,mBAAmB,GAAG,IAAI,CAy+DxE"}
+{"version":3,"file":"document-handlers.d.ts","sourceRoot":"","sources":["../src/document-handlers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAiCH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAaxE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,aAAa,CAAC;IACrB,OAAO,EAAE,eAAe,CAAC;IACzB,qFAAqF;IACrF,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,yBAAyB,CAAC;IAC3D,uFAAuF;IACvF,YAAY,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACrE,mFAAmF;IACnF,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC9C,+BAA+B;IAC/B,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC9D,GAAG,IAAI,MAAM,CAAC;CACf;AAOD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,mBAAmB,GAAG,IAAI,CAkmExE"}

package/dist/document-handlers.js

@@ -26,6 +26,7 @@
 import { randomBytes, randomUUID } from "node:crypto";
 import * as Y from "yjs";
 import { encodeDocumentProposal, deriveArrangement, documentGovernancePolicy, arrangementGenesisFromProposal, documentAmendmentHash, buildDocumentMultisigTbs, encodeDocumentAmendment, buildDocumentJoinOfferTbs, encodeDocumentJoinOffer, validateDocumentJoinOffer, encodeDocumentUpdateEnvelope, DOCUMENT_UPDATE_ENCODING_V1, buildDocumentProposalTbs, documentIdFromProposal, seamViolation, ASSURANCE_TIER_V1, TOPOLOGY_DEFAULT, DOCUMENT_FEATURE_VERSION, encodeDocumentProposalAck, buildDocumentProposalAckTbs, DOCUMENT_PROPOSAL_ACK_VERSION, MAX_PROPOSAL_REFUSAL_REASON_LENGTH, } from "@cello-protocol/protocol-types";
+import { DELIVERY_ACK_TIMEOUT_MS } from "./document-delivery.js";
 import { lineHunks, isSupportedDocumentType, SUPPORTED_DOCUMENT_TYPES } from "./document-write-path.js";
 import { openingNoticeFor, rootForDocumentType } from "./document-types.js";
 import { projectDocumentText, parseJsonDocument, applyJsonToMap } from "./document-json.js";
@@ -579,6 +580,67 @@ export function registerDocumentHandlers(deps) {
                 : {}),
         };
     });
+    /**
+     * DOD-MP-INVITE-FANOUT-1 — fan a governance amendment to the CURRENT holders, durably.
+     *
+     * ONE implementation for every site that fans one. There were four — invite, re-invite, remove,
+     * and remove's re-send — each with its own copy of the same best-effort loop, and the review found
+     * that wiring durability into one of them left the other three losing membership changes exactly
+     * as before. The re-invite is the verb the tool's own guidance tells an operator to run when a
+     * holder is out of step, so it carrying the defect meant the documented cure did nothing.
+     *
+     * RECORD THE DEBT FIRST. The send below is a fast path, never the guarantee: a daemon that dies
+     * between here and the send still owes the amendment on restart.
+     *
+     * A successful send is recorded as SENT, not acked — their daemon received the frame, and whether
+     * it RECORDED it is a separate fact it can refuse. The row settles for real when that holder acks
+     * any envelope at this epoch or later, which proves they applied it.
+     */
+    const fanOutAmendment = async (args) => {
+        layer.store.seedAmendmentDeliveries(args.ownerAgentId, args.documentId, args.amendmentHashHex, args.holders, deps.now());
+        const told = {};
+        for (const holder of args.holders) {
+            try {
+                const sent = await deps.transportFor(args.agentName).sendBytes({
+                    peerAgentId: holder,
+                    documentId: args.documentId,
+                    bytes: args.amendmentBytes,
+                    correlationId: randomUUID(),
+                });
+                // PARKED IS NOT NOTIFIED. The relay took it because the holder had no live counterparty.
+                const landed = sent.ok && sent.parked !== true;
+                told[holder] = landed;
+                if (landed) {
+                    layer.store.markAmendmentSent(args.ownerAgentId, args.documentId, args.amendmentHashHex, holder, deps.now(), DELIVERY_ACK_TIMEOUT_MS);
+                }
+                else {
+                    // NAMED, NOT JUST COUNTED. This used to record `false` with no log line anywhere, so the
+                    // only trace of a lost membership change was a boolean inside an `ok: true` response.
+                    logger.warn("document.amendment.holder_unnotified", {
+                        documentId: args.documentId,
+                        holderAgentId: holder,
+                        verb: args.verb,
+                        reason: sent.ok ? "relay_parked" : sent.reason,
+                        detail: sent.ok
+                            ? "the relay is holding it — the holder had no live counterparty"
+                            : sent.detail,
+                    });
+                }
+            }
+            catch (err) {
+                told[holder] = false;
+                // A throw used to be swallowed whole.
+                logger.warn("document.amendment.holder_unnotified", {
+                    documentId: args.documentId,
+                    holderAgentId: holder,
+                    verb: args.verb,
+                    reason: "amendment_send_threw",
+                    detail: err instanceof Error ? err.message : String(err),
+                });
+            }
+        }
+        return told;
+    };
     /**
      * M14B / DOD-MP-JOIN-1 — invite a third party into an existing document.
      *
@@ -670,24 +732,20 @@ export function registerDocumentHandlers(deps) {
                 // re-sent the amendment. The re-invite is the healing verb: it re-fans the admitting
                 // amendment to every other current holder, best-effort, reported per holder.
                 const admittingBytes = outgoing.offer.amendments[outgoing.offer.amendments.length - 1];
-                const holdersNotified = {};
-                if (admittingBytes !== undefined) {
-                    for (const holder of derived.arrangement.participants) {
-                        if (holder === who.ownerAgentId || holder === invitee)
-                            continue;
-                        try {
-                            const sentAmend = await deps.transportFor(who.agentName).sendBytes({
-                                peerAgentId: holder,
-                                documentId,
-                                bytes: new Uint8Array(admittingBytes),
-                                correlationId: randomUUID(),
-                            });
-                            holdersNotified[holder] = sentAmend.ok;
-                        }
-                        catch {
-                            holdersNotified[holder] = false;
-                        }
-                    }
+                let holdersNotified = {};
+                // `priorHash` is non-null whenever `outgoing` is — the lookup is keyed by it — but the
+                // narrowing does not survive the branch, and an amendment seeded under a null key would be
+                // owed to a row nothing can ever join.
+                if (admittingBytes !== undefined && priorHash !== null) {
+                    holdersNotified = await fanOutAmendment({
+                        agentName: who.agentName,
+                        ownerAgentId: who.ownerAgentId,
+                        documentId,
+                        amendmentHashHex: priorHash,
+                        amendmentBytes: new Uint8Array(admittingBytes),
+                        holders: [...derived.arrangement.participants].filter((holder) => holder !== who.ownerAgentId && holder !== invitee),
+                        verb: "re-invite",
+                    });
                 }
                 return {
                     ok: true,
@@ -793,20 +851,25 @@ export function registerDocumentHandlers(deps) {
                 documentId, error: err instanceof Error ? err.message : String(err),
             });
         }
-        const holdersTold = {};
-        for (const holder of derived.arrangement.participants) {
-            if (holder === who.ownerAgentId || holder === invitee)
-                continue;
-            try {
-                const sent = await deps.transportFor(who.agentName).sendBytes({
-                    peerAgentId: holder, documentId, bytes: amendmentBytes, correlationId: randomUUID(),
-                });
-                holdersTold[holder] = sent.ok;
-            }
-            catch {
-                holdersTold[holder] = false;
-            }
-        }
+        // DOD-MP-INVITE-FANOUT-1 — RECORD WHAT IS OWED BEFORE TRYING TO SEND IT.
+        //
+        // The loop below is a fast path, not the guarantee. It used to be both, and that is the whole
+        // defect: one failed send lost a membership change permanently, because nothing remained owing
+        // anywhere. A content edit has always had a pending row, a retry schedule and restart survival;
+        // the governance act that decides who is a party to the document had none of them.
+        //
+        // Seeding first also makes the crash window safe: a daemon that dies between here and the send
+        // still owes the amendment on restart.
+        const owedHolders = [...derived.arrangement.participants].filter((holder) => holder !== who.ownerAgentId && holder !== invitee);
+        const holdersTold = await fanOutAmendment({
+            agentName: who.agentName,
+            ownerAgentId: who.ownerAgentId,
+            documentId,
+            amendmentHashHex: amendHashHex,
+            amendmentBytes,
+            holders: owedHolders,
+            verb: "invite",
+        });
         logger.info("document.join.invited", { documentId, invitee, epochId: body.epoch_id, offerSent });
         return {
             ok: true,
@@ -879,20 +942,31 @@ export function registerDocumentHandlers(deps) {
                 const removal = chain.find((e) => e.body.kind === "remove_holder" &&
                     e.body.subject_agent_id === holder &&
                     e.body.epoch_id === membership.epochId);
-                const resendTold = {};
+                let resendTold = {};
                 if (removal) {
                     const bytes = new Uint8Array(encodeDocumentAmendment(removal));
-                    const targets = new Set([...derived.arrangement.participants, holder]);
-                    targets.delete(who.ownerAgentId);
-                    for (const member of targets) {
+                    const remaining = [...derived.arrangement.participants].filter((m) => m !== who.ownerAgentId && m !== holder);
+                    // The healing re-send is durable for the holders who REMAIN, for the same reason the
+                    // re-invite is: it is the verb an operator runs precisely because someone is out of step,
+                    // so it must not be the one that gives up quietest.
+                    resendTold = await fanOutAmendment({
+                        agentName: who.agentName,
+                        ownerAgentId: who.ownerAgentId,
+                        documentId,
+                        amendmentHashHex: Buffer.from(documentAmendmentHash(removal.body)).toString("hex"),
+                        amendmentBytes: bytes,
+                        holders: remaining,
+                        verb: "remove-resend",
+                    });
+                    if (holder !== who.ownerAgentId) {
                         try {
                             const sent = await deps.transportFor(who.agentName).sendBytes({
-                                peerAgentId: member, documentId, bytes, correlationId: randomUUID(),
+                                peerAgentId: holder, documentId, bytes, correlationId: randomUUID(),
                             });
-                            resendTold[member] = sent.ok;
+                            resendTold[holder] = sent.ok && sent.parked !== true;
                         }
                         catch {
-                            resendTold[member] = false;
+                            resendTold[holder] = false;
                         }
                     }
                 }
@@ -957,29 +1031,43 @@ export function registerDocumentHandlers(deps) {
         // The amendment travels to EVERY current holder INCLUDING the removed one — being told is
         // how their daemon surfaces the removal to their operator. Best-effort at P1, per holder,
         // reported never assumed.
-        const holdersTold = {};
-        for (const member of withNew.arrangement.participants) {
-            if (member === who.ownerAgentId)
-                continue;
-            try {
-                const sent = await deps.transportFor(who.agentName).sendBytes({
-                    peerAgentId: member, documentId, bytes: amendmentBytes, correlationId: randomUUID(),
-                });
-                holdersTold[member] = sent.ok;
-            }
-            catch {
-                holdersTold[member] = false;
-            }
-        }
+        // DOD-MP-INVITE-FANOUT-1 — the REMAINING holders get the durable fan-out. A holder who misses
+        // a removal keeps delivering to, and accepting edits from, someone the chain has removed —
+        // silently and permanently, which is the same defect the invite had and is worse, because here
+        // the stale holder keeps honouring a membership that has been revoked.
+        const holdersTold = await fanOutAmendment({
+            agentName: who.agentName,
+            ownerAgentId: who.ownerAgentId,
+            documentId,
+            amendmentHashHex: Buffer.from(amendHash).toString("hex"),
+            amendmentBytes,
+            holders: [...withNew.arrangement.participants].filter((m) => m !== who.ownerAgentId),
+            verb: "remove",
+        });
+        // THE REMOVED HOLDER IS TOLD ONCE, and is deliberately NOT owed a durable retry: delivery to
+        // them stopping is what removal MEANS, so a queue that kept redialling them would contradict
+        // the act it is announcing. Forward-only cuts both ways — we tell them, we do not pursue them.
         if (holder !== who.ownerAgentId) {
             try {
                 const sent = await deps.transportFor(who.agentName).sendBytes({
                     peerAgentId: holder, documentId, bytes: amendmentBytes, correlationId: randomUUID(),
                 });
-                holdersTold[holder] = sent.ok;
+                holdersTold[holder] = sent.ok && sent.parked !== true;
+                if (!holdersTold[holder]) {
+                    logger.warn("document.amendment.holder_unnotified", {
+                        documentId, holderAgentId: holder, verb: "remove-subject",
+                        reason: sent.ok ? "relay_parked" : sent.reason,
+                        detail: sent.ok ? "the relay is holding it" : sent.detail,
+                    });
+                }
             }
-            catch {
+            catch (err) {
                 holdersTold[holder] = false;
+                logger.warn("document.amendment.holder_unnotified", {
+                    documentId, holderAgentId: holder, verb: "remove-subject",
+                    reason: "amendment_send_threw",
+                    detail: err instanceof Error ? err.message : String(err),
+                });
             }
         }
         logger.info("document.holder_removed", {
@@ -1778,7 +1866,14 @@ export function registerDocumentHandlers(deps) {
             // Waiting cannot reopen a sealed session. The cause is known per holder; it travels.
             const causes = [...new Set(Object.values(holderFailures ?? {}))].filter(Boolean);
             const because = causes.length > 0 ? ` (${causes.join(", ")})` : "";
-            const sealed = causes.some((c) => c.includes("sealed"));
+            // THE WHOLE FAMILY, not one substring. This tested `includes("sealed")`, so `session_sealed`
+            // got the useful sentence and every other way a session's record can be over —
+            // `relay_session_gone` (the relay restarted or swept it) and `session_not_found` — fell to
+            // generic wait-for-them advice, which is the one thing that cannot work when there is nothing
+            // left to wait for.
+            const sealed = causes.some((c) => c.includes("sealed") ||
+                c.includes("relay_session_gone") ||
+                c.includes("session_not_found"));
             return (`Your ${verb} was recorded but reached none of the ${missed.length} other ` +
                 `holder${missed.length > 1 ? "s" : ""} (${missed.join(", ")})${because}, so the document ` +
                 `cannot settle until they hear it. ` +