@cello-protocol/daemon 0.0.167 → 0.0.169

package/dist/document-lifecycle.js

@@ -11,11 +11,6 @@
  *             and the log. The peer keeps what it holds, and that is said out loud: it is the one
  *             thing an operator is most likely to assume a kill undoes, and the one thing it
  *             cannot.
- *   withdraw  ONE UNDELIVERED update. A local rollback plus a withdrawal record BESIDE the
- *             original — marked, never deleted, because a hole in an append-only log is
- *             indistinguishable from tampering. Once the peer has it, withdrawal is refused rather
- *             than faked.
- *
  * ── THE KILL SWITCH (§16.7-11) ────────────────────────────────────────────────────────────────
  *
  * A platform-paused agent refuses OUTBOUND publishes loudly, still admits INBOUND mechanically,
@@ -24,55 +19,7 @@
  * their doing; refusing outbound silently would leave the operator writing into a document that is
  * going nowhere, with their work piling up locally and no sign anything is wrong.
  */
-/**
- * "Did every holder hear it?" — and NO on an empty map.
- *
- * `[].every(…)` is `true`, so folding an empty fan-out with `every` alone reports that everybody
- * was notified precisely when nobody was. The notifier refuses a holder-less document by name, so
- * this is the second line rather than the first, but the vacuous-truth reading is the one that
- * would surface to an operator as a clean close that told no one.
- */
-function everyHolderNotified(ok, holders) {
-    const told = Object.values(holders ?? {});
-    return ok && told.length > 0 && told.every((v) => v);
-}
 const CREATE_LIFECYCLE_SQL = `
-  CREATE TABLE IF NOT EXISTS document_closes (
-    owner_agent_id TEXT    NOT NULL,
-    document_id    TEXT    NOT NULL,
-    -- WHO closed, not how many closes there were. Counting would let one party close a document
-    -- unilaterally by asking twice, which is precisely the bilateral guarantee gone.
-    closed_by      TEXT    NOT NULL,
-    created_at     INTEGER NOT NULL,
-    PRIMARY KEY (owner_agent_id, document_id, closed_by)
-  );
-
-  -- WITHDRAWALS live here, NOT in document_envelopes, and that placement is the fix for three
-  -- separate defects rather than a filing preference.
-  --
-  -- 1. CHAIN. A withdrawal is local-only by design: it is never delivered (the update it concerns
-  --    was never delivered, so the peer has nothing to act on). As an envelope it still advanced
-  --    our per-sender chain, so our NEXT update chained onto a node the peer will never hold and
-  --    the peer refused it with document_chain_broken — sending an operator to the chain layer for
-  --    a withdrawal-scoping bug, and leaving the document unopenable after their next restart.
-  --    Chaining it to the last DELIVERABLE envelope instead would fork our chain, since the next
-  --    update claims the same predecessor. It cannot be a node in that chain at all.
-  -- 2. CRYPTO. As an envelope it needed a signature and a state vector, and it had neither of its
-  --    own — the first version copied the ORIGINAL's, putting a real Ed25519 signature made over a
-  --    different record onto a permanent append-only row. document-rejection.ts states the rule
-  --    this violated in writing: required, never fabricated.
-  -- 3. REPLAY. An envelope row is something rebuildSnapshot must reason about; an audit row is not.
-  --
-  -- Same shape as document_quarantine, for the same reason: audit that must survive, must not be
-  -- replayed, and must not be chained.
-  CREATE TABLE IF NOT EXISTS document_withdrawals (
-    owner_agent_id TEXT    NOT NULL,
-    document_id    TEXT    NOT NULL,
-    envelope_hash  TEXT    NOT NULL,
-    created_at     INTEGER NOT NULL,
-    PRIMARY KEY (owner_agent_id, document_id, envelope_hash)
-  );
-
   CREATE TABLE IF NOT EXISTS agent_platform_pause (
     agent_id   TEXT    NOT NULL PRIMARY KEY,
     paused     INTEGER NOT NULL,
@@ -82,359 +29,24 @@ const CREATE_LIFECYCLE_SQL = `
 export class DocumentLifecycle {
     #store;
     #logger;
-    #notifier;
-    /**
-     * Our own wire sender id for an agent. M14-D5 makes it the pubkey hex, which is NOT the local
-     * owner key this store is otherwise keyed by — and passing the wrong one here reports every
-     * pending update as delivered.
-     */
-    #senderAgentId;
-    #rollback;
-    #currentHolders;
-    /**
-     * May this sender end this document? Derived membership is the WHOLE gate when the chain
-     * derives — a joined third holder's close is as admissible as the genesis peer's, and a removed
-     * holder's is not admissible at all. The peer column stands in only when the chain cannot
-     * answer. Mirrors `document-inbound.ts`'s sender gate deliberately; two different answers to
-     * "is this agent a party to this document" is how the two paths drift apart.
-     *
-     * TWO KINDS OF "CANNOT ANSWER", and they get different answers because only one of them is
-     * legacy. A null derivation is the pre-amendment bilateral document — the peer column stands in,
-     * which NARROWS who may act and is the same rule the update path uses. A THROW is bytes this
-     * build cannot read, which is not a legacy document but an unknown one: this gate FAILS CLOSED
-     * rather than admitting the genesis peer, who by then may be a holder the chain removed. The
-     * operator's own `kill` is unaffected — it is local and needs no gate.
-     */
-    #senderMayEnd(ownerAgentId, documentId, senderAgentId, peerAgentId) {
-        const v = this.#holderVerdict(ownerAgentId, documentId);
-        if (v.kind === "derived")
-            return v.holders.includes(senderAgentId);
-        if (v.kind === "legacy")
-            return senderAgentId === peerAgentId;
-        // UNKNOWN fails closed. Admitting the genesis peer here would admit a party the chain may have
-        // removed — and the chain is precisely what we could not read. The operator's own `kill` is
-        // unaffected: it is local and needs no gate.
-        this.#logger.warn("document.end.holders_unknown", { documentId, reason: v.reason });
-        return false;
-    }
-    /** The injected derivation, with its throw contained and named. */
-    #holderVerdict(ownerAgentId, documentId) {
-        try {
-            return this.#currentHolders(ownerAgentId, documentId);
-        }
-        catch (err) {
-            // `holdersFor` decodes every stored amendment and THROWS on bytes this build cannot read.
-            // Uncontained, that throw escaped the row, escaped the map, and the operator asking "what
-            // documents do I have" got a raw CBOR decoder string naming no document — the regression
-            // already fixed once in `arrangementFor`, re-opened through this call site.
-            const reason = err instanceof Error ? err.message : String(err);
-            this.#logger.error("document.holders.undecodable", { documentId, reason });
-            return { kind: "unknown", reason };
-        }
-    }
-    constructor(store, logger, notifier, 
-    /**
-     * Undo one envelope's operations on the LIVE document, as inverses. Injected because the live
-     * `Y.Doc` and its UndoManager belong to the engine, not here — and REQUIRED, because a default
-     * that quietly did nothing would restore exactly the defect this argument exists to fix.
-     */
-    rollback, senderAgentId = (id) => id, 
+    #removedFor;
+    #endedFor;
+    constructor(store, logger, 
+    /** SYNC-D8 — "was this owner written out?", answered by the layer's one fold derivation. */
+    removedFor, 
     /**
-     * The inbound authorization gate (DOD-MP-CONTROL-N-1). Defaults to "cannot answer", which
-     * routes to the `peerAgentId` check — the pre-multiplayer behaviour — so a caller that has not
-     * been wired yet is bilateral-correct rather than open. It is NOT defaulted to a permissive
-     * answer: a membership gate whose default admits everyone is worse than no gate, because it
-     * reads as one.
+     * SYNC-P4 review F2 — "is this document ended?", answered by the fold, never the status
+     * column. `derived: false` means the chain does not derive (legacy bilateral, undecodable
+     * bytes); ONLY there does the stored column stand in, because for a pre-pivot document the
+     * column IS the record of its ending.
      */
-    currentHolders = () => ({ kind: "legacy" })) {
+    endedFor) {
         this.#store = store;
         this.#logger = logger;
-        this.#notifier = notifier;
-        this.#rollback = rollback;
-        this.#senderAgentId = senderAgentId;
-        this.#currentHolders = currentHolders;
+        this.#removedFor = removedFor;
+        this.#endedFor = endedFor;
         this.#store.rawDb.exec(CREATE_LIFECYCLE_SQL);
     }
-    list(ownerAgentId, nowMs) {
-        // Every pending envelope regardless of schedule: the operator is asking "what has not reached
-        // my peer", not "what is due for a retry in the next few seconds".
-        const pending = this.#store.pendingDeliveries(ownerAgentId, Number.MAX_SAFE_INTEGER, this.#senderAgentId(ownerAgentId));
-        const pendingByDocument = new Map();
-        for (const e of pending) {
-            const c = pendingByDocument.get(e.documentId) ?? { total: 0, sent: 0 };
-            c.total += 1;
-            // SPLIT, because "sent, awaiting confirmation" and "never left this machine" are different
-            // things to tell an operator asking why their work has not landed. FANOUT-1: the fact
-            // moved to the per-holder rows — "sent" means it reached AT LEAST ONE holder's wire.
-            if (e.deliveredAtMs != null || this.#store.envelopeEverSent(ownerAgentId, e.envelopeHash))
-                c.sent += 1;
-            pendingByDocument.set(e.documentId, c);
-        }
-        void nowMs;
-        return this.#store.listDocuments(ownerAgentId).map((d) => ({
-            documentId: d.documentId,
-            peerAgentId: d.peerAgentId,
-            documentType: d.documentType,
-            // DOD-MP-REMOVE-1 — display overlay, derived: a removed holder's row still says active in
-            // the table (removal is a chain fact, not a stored flag), and a list that said "active"
-            // would be the surface claiming more than forward-only allows.
-            ...(this.#store.removedFromArrangement(ownerAgentId, d.documentId).removed
-                ? { removed: true }
-                : {}),
-            assuranceTier: "authenticated",
-            epochId: this.#store.currentDocumentEpoch(ownerAgentId, d.documentId),
-            status: d.status,
-            pendingDeliveries: pendingByDocument.get(d.documentId)?.total ?? 0,
-            pendingSent: pendingByDocument.get(d.documentId)?.sent ?? 0,
-            pendingUnsent: (pendingByDocument.get(d.documentId)?.total ?? 0) -
-                (pendingByDocument.get(d.documentId)?.sent ?? 0),
-            abandonedDeliveries: this.#store.abandonedCount(ownerAgentId, d.documentId),
-            // "I have closed and we are still waiting on someone" — ALL of them, not just the genesis
-            // peer (DOD-MP-CLOSE-N-1). Against the peer alone this read "not pending" the moment the
-            // genesis pair agreed, while a joiner had not answered and the document was still open.
-            closePending: this.#closePendingFor(ownerAgentId, d.documentId, d.peerAgentId),
-        }));
-    }
-    /** Our half of a bilateral close. Completes only when the peer's half is also on record. */
-    async close(ownerAgentId, documentId, nowMs) {
-        const doc = this.#store.getDocument(ownerAgentId, documentId);
-        if (!doc) {
-            return { ok: false, reason: "document_unknown", detail: `no document ${documentId.slice(0, 16)}…` };
-        }
-        this.#recordClose(ownerAgentId, documentId, ownerAgentId, nowMs);
-        const notified = await this.#notifier.notifyPeer(documentId, "close");
-        if (!notified.ok) {
-            // RAISED to error, and RETURNED, matching `kill`. This was a warn whose outcome went nowhere:
-            // the caller answered `{ok: true, status: "active"}`, which is indistinguishable from "sent
-            // fine, they have not answered yet". Control frames are fire-once — not in the log, never
-            // swept — so a close the peer never received means the document can never settle, and neither
-            // operator has anything to look at.
-            this.#logger.error("document.close.peer_not_notified", {
-                documentId,
-                reason: notified.reason,
-                detail: notified.detail ?? "",
-            });
-        }
-        this.#settleClose(ownerAgentId, documentId);
-        const holdersNotified = notified.ok ? notified.holdersNotified : {};
-        const holderFailures = notified.ok ? notified.holderFailures : {};
-        // EVERY current holder, not "the send returned ok" — with N holders a partial fan-out is the
-        // normal failure and one boolean cannot describe it. The map is the precise answer; this stays
-        // as the summary a caller can branch on.
-        const allNotified = everyHolderNotified(notified.ok, holdersNotified);
-        this.#logger.info("document.close.requested", { documentId, peerNotified: allNotified, holdersNotified });
-        // THE REASON TRAVELS. It used to stop here, so one guidance string covered a transport failure,
-        // a missing signing key and a wiring fault — and it told the operator to wait for their peer,
-        // which only helps for the first of the three.
-        return {
-            ok: true,
-            peerNotified: allNotified,
-            holdersNotified,
-            holderFailures,
-            ...(notified.ok ? {} : { notifyReason: notified.reason, notifyDetail: notified.detail }),
-        };
-    }
-    /** The peer's half, arriving over the session. */
-    recordPeerClose(ownerAgentId, documentId, peerAgentId, nowMs) {
-        const doc = this.#store.getDocument(ownerAgentId, documentId);
-        if (!doc) {
-            // Without this the row is written for a document that does not exist — there is no foreign
-            // key on this table — and `setDocumentStatus` updates zero rows and returns silently.
-            return {
-                ok: false,
-                reason: "document_unknown",
-                detail: `no document ${documentId.slice(0, 16)}… for this agent`,
-            };
-        }
-        if (!this.#senderMayEnd(ownerAgentId, documentId, peerAgentId, doc.peerAgentId)) {
-            // THE PARTY GUARANTEE. The closer id came from the caller and was written as `closed_by`
-            // and settled against ITSELF, so any second distinct string — a stale contact id, a
-            // pubkey-vs-name mismatch, a hostile session — plus our own close flipped the document to
-            // closed. The whole point of recording WHO closed is defeated if who is never checked.
-            //
-            // The check is now MEMBERSHIP, not identity-with-one-peer: a joiner is a party and their
-            // close must count, a removed holder is not and theirs must not.
-            this.#logger.warn("document.close.not_holder", {
-                documentId,
-                claimedBy: peerAgentId,
-                peerAgentId: doc.peerAgentId,
-            });
-            return {
-                ok: false,
-                reason: "document_close_not_peer",
-                detail: `${peerAgentId} does not currently hold this document, so their close is not one of the ` +
-                    `halves that can settle it`,
-            };
-        }
-        // RECORDED AGAINST THE SENDER, not against `doc.peerAgentId`. Writing the peer column here
-        // credited a joiner's close to the genesis peer — the wrong name on the record, and with two
-        // joiners closing it would settle twice against one identity.
-        this.#recordClose(ownerAgentId, documentId, peerAgentId, nowMs);
-        this.#settleClose(ownerAgentId, documentId);
-        this.#logger.info("document.close.peer_requested", { documentId, peerAgentId });
-        return { ok: true };
-    }
-    /**
-     * The peer KILLED the document. Their half of the unilateral end.
-     *
-     * Terminal immediately, and there is no reciprocal step: a kill is one-sided by definition, which
-     * is what separates it from a close. Continuing to publish afterwards would send updates to a
-     * party who has stopped listening — refused at their end forever, with nothing on this screen
-     * explaining why.
-     *
-     * The SENDER IS CHECKED against the document's peer for the same reason `recordPeerClose` checks
-     * it: without that, any string plus a valid-looking frame ends someone else's document.
-     */
-    recordPeerKill(ownerAgentId, documentId, peerAgentId, nowMs) {
-        const doc = this.#store.getDocument(ownerAgentId, documentId);
-        if (!doc) {
-            return {
-                ok: false,
-                reason: "document_unknown",
-                detail: `no document ${documentId.slice(0, 16)}… for this agent`,
-            };
-        }
-        if (!this.#senderMayEnd(ownerAgentId, documentId, peerAgentId, doc.peerAgentId)) {
-            this.#logger.warn("document.kill.not_holder", {
-                documentId,
-                claimedBy: peerAgentId,
-                peerAgentId: doc.peerAgentId,
-            });
-            return {
-                ok: false,
-                reason: "document_kill_not_peer",
-                detail: `${peerAgentId} does not currently hold this document, so their kill is not theirs to make`,
-            };
-        }
-        void nowMs;
-        if (doc.status !== "active" && doc.status !== "stalled") {
-            // ONLY FROM ACTIVE, the same guard `#settleClose` carries and for the mirror reason. The
-            // transport WILL redeliver, and nothing bounds a control frame's freshness — `sent_at_ms` is
-            // signed and never checked. Unconditional, a kill arriving after a bilateral close rewrote a
-            // settled agreement as a unilateral end.
-            this.#logger.info("document.kill.peer_requested.ignored", {
-                documentId,
-                status: doc.status,
-            });
-            return { ok: true };
-        }
-        this.#store.setDocumentStatus(ownerAgentId, documentId, "killed");
-        this.#logger.info("document.kill.peer_requested", { documentId, peerAgentId: doc.peerAgentId });
-        return { ok: true };
-    }
-    /**
-     * Unilateral end. Local, and deliberately not contingent on the peer hearing about it — a
-     * decision to stop that depends on the other party being online is not a decision to stop.
-     */
-    async kill(ownerAgentId, documentId, nowMs) {
-        const doc = this.#store.getDocument(ownerAgentId, documentId);
-        if (!doc) {
-            return { ok: false, reason: "document_unknown", detail: `no document ${documentId.slice(0, 16)}…` };
-        }
-        void nowMs;
-        this.#store.setDocumentStatus(ownerAgentId, documentId, "killed");
-        const notified = await this.#notifier.notifyPeer(documentId, "kill");
-        if (!notified.ok) {
-            // Reported, not swallowed: a kill the peer never heard about leaves them publishing into a
-            // document that will never answer, and the operator is the one who needs to know that.
-            this.#logger.error("document.kill.peer_not_notified", {
-                documentId,
-                peerAgentId: doc.peerAgentId,
-                reason: notified.reason,
-                detail: notified.detail ?? "",
-            });
-        }
-        const holdersNotified = notified.ok ? notified.holdersNotified : {};
-        const holderFailures = notified.ok ? notified.holderFailures : {};
-        const allNotified = everyHolderNotified(notified.ok, holdersNotified);
-        this.#logger.info("document.killed", { documentId, peerNotified: allNotified, holdersNotified });
-        return {
-            ok: true,
-            peerNotified: allNotified,
-            holdersNotified,
-            holderFailures,
-            note: "this document no longer accepts or publishes updates, and your local copy and log are " +
-                "retained. Your peer keeps what it holds — a kill stops the collaboration, it does not " +
-                "retract content they already have.",
-            // Same reason `close` carries it: a local signing fault and an absent peer are opposite
-            // problems and only one of them is fixed by waiting.
-            ...(notified.ok ? {} : { notifyReason: notified.reason, notifyDetail: notified.detail }),
-        };
-    }
-    /**
-     * Withdraw ONE undelivered update: a withdrawal record beside the original.
-     *
-     * Every refusal here is the same shape — say no rather than produce a record that claims
-     * something untrue about the log.
-     */
-    withdraw(ownerAgentId, documentId, envelopeHash, nowMs) {
-        const log = this.#store.getEnvelopeLog(ownerAgentId, documentId);
-        const original = log.find((e) => e.envelopeHash === envelopeHash);
-        if (!original) {
-            // A withdrawal record pointing at nothing is worse than a refusal: it is a permanent claim
-            // in an append-only store about an envelope that never existed.
-            return {
-                ok: false,
-                reason: "document_envelope_unknown",
-                detail: `no envelope ${envelopeHash.slice(0, 16)}… in this document's log`,
-            };
-        }
-        if (original.senderAgentId !== ownerAgentId) {
-            return {
-                ok: false,
-                reason: "document_not_author",
-                detail: `envelope ${envelopeHash.slice(0, 16)}… was authored by ${original.senderAgentId}, not by you`,
-            };
-        }
-        if (original.ackedAtMs != null) {
-            // The honest refusal. Withdrawing a delivered update would tell the operator their content
-            // was retracted while the peer is holding it — the promise this module refuses to make.
-            return {
-                ok: false,
-                reason: "document_already_delivered",
-                detail: `envelope ${envelopeHash.slice(0, 16)}… has already been delivered and acknowledged — ` +
-                    `your peer holds it, so it cannot be withdrawn. Publish a superseding update instead.`,
-            };
-        }
-        // THE LOCAL ROLLBACK — the half that was missing. Writing only the record left the original in
-        // the log WITH its payload, and replay applies every update payload in order, so the withdrawn
-        // text stayed in the operator's own document and came back on every rebuild. The operator was
-        // told their update was withdrawn while their file still contained it.
-        //
-        // Rolled back as INVERSES through the same undo path a rejection uses, never by dropping the
-        // payload: our own later work may be causally stacked on these operations, and REJECT-1
-        // measured what removing them costs — everything after stays pending forever and the document
-        // silently loses the legitimate work. The inverse enters the log on the next ordinary publish,
-        // computed from the live document, which is also why neither the original nor the inverse is
-        // ever delivered: the peer holds neither, and the next publish carries the net effect.
-        const rolledBack = this.#rollback(ownerAgentId, documentId, envelopeHash);
-        if (!rolledBack.ok) {
-            return {
-                ok: false,
-                reason: "document_withdraw_rollback_failed",
-                detail: `the local rollback did not happen (${rolledBack.reason}), so nothing was withdrawn — ` +
-                    `reporting success here would tell you your update was retracted while your file still ` +
-                    `contains it`,
-            };
-        }
-        const info = this.#store.rawDb
-            .prepare(`INSERT INTO document_withdrawals (owner_agent_id, document_id, envelope_hash, created_at)
-         VALUES (?, ?, ?, ?)
-         ON CONFLICT (owner_agent_id, document_id, envelope_hash) DO NOTHING`)
-            .run(ownerAgentId, documentId, envelopeHash, nowMs);
-        if (Number(info.changes) === 0) {
-            // Already withdrawn. Reported rather than inferred — the earlier version ignored the write's
-            // outcome and returned success for a no-op.
-            return {
-                ok: false,
-                reason: "document_already_withdrawn",
-                detail: `envelope ${envelopeHash.slice(0, 16)}… was already withdrawn`,
-            };
-        }
-        this.#logger.info("document.withdrawn", { documentId, envelopeHash });
-        return { ok: true };
-    }
-    // ─── the kill switch (§16.7-11) ───────────────────────────────────────────
     setPlatformPaused(agentId, paused, nowMs) {
         this.#store.rawDb
             .prepare(`INSERT INTO agent_platform_pause (agent_id, paused, updated_at) VALUES (?, ?, ?)
@@ -465,24 +77,31 @@ export class DocumentLifecycle {
         if (!doc) {
             return { ok: false, reason: "document_unknown", detail: `no document ${documentId.slice(0, 16)}…` };
         }
-        if (doc.status === "closed") {
+        // THE FOLD RULES ENDINGS (review F2): the status column is a display projection that can lag
+        // the derivation (a concurrently-arriving admission re-opens a closure). Only a document whose
+        // chain does not derive — the pre-pivot bilateral record — is judged by its column.
+        const ending = this.#endedFor(ownerAgentId, documentId);
+        const ended = ending.derived
+            ? ending.ended
+            : doc.status === "closed" || doc.status === "killed"
+                ? doc.status
+                : null;
+        if (ended === "closed") {
             return { ok: false, reason: "document_closed", detail: "this document was closed by agreement" };
         }
-        if (doc.status === "killed") {
+        if (ended === "killed") {
             return { ok: false, reason: "document_killed", detail: "this document was ended locally" };
         }
         // DOD-MP-REMOVE-1, forward-only — DERIVED from the amendment chain, never a stored flag:
         // the copy is theirs (reading, the file, the history all remain), but publishing into an
         // arrangement that no longer includes them would only be refused by every holder, so it is
         // refused here first, naming the actual condition and the epoch it happened at.
-        const membership = this.#store.removedFromArrangement(ownerAgentId, documentId);
-        if (membership.removed) {
+        if (this.#removedFor(ownerAgentId, documentId)) {
             return {
                 ok: false,
                 reason: "document_removed",
-                detail: `you were removed from this document's arrangement at epoch ${membership.epochId} — ` +
-                    `your copy and its history remain yours, but new edits no longer publish to the ` +
-                    `other holders`,
+                detail: `you were removed from this document's arrangement — your copy and its history remain ` +
+                    `yours, but new edits no longer publish to the other holders`,
             };
         }
         if (doc.status === "stalled") {
@@ -508,162 +127,8 @@ export class DocumentLifecycle {
         }
         return { ok: true };
     }
-    /** Inbound. A pause does NOT refuse it — see the header. */
-    canAdmit(ownerAgentId, documentId) {
-        const doc = this.#store.getDocument(ownerAgentId, documentId);
-        if (!doc) {
-            return { ok: false, reason: "document_unknown", detail: `no document ${documentId.slice(0, 16)}…` };
-        }
-        if (doc.status === "killed") {
-            return { ok: false, reason: "document_killed", detail: "this document was ended locally" };
-        }
-        if (doc.status === "closed") {
-            return { ok: false, reason: "document_closed", detail: "this document was closed by agreement" };
-        }
-        if (doc.status === "stalled") {
-            return {
-                ok: false,
-                reason: "document_stalled",
-                // NAMES BOTH CAUSES, because `stalled` has two and this text asserted one of them.
-                //
-                // It is set by REJECT-1 after the peer's gate refuses repeatedly, AND by the delivery
-                // worker's unacked ceiling — where the peer's daemon never answered at all. Those are
-                // opposite subsystems. An operator hitting the second was told to go and read rejection
-                // reasons, which do not exist for it, and the shipped skill sent them to a `cello_doc_list`
-                // field that does not exist either.
-                detail: "this document stopped accepting updates. Two things set that state and they need " +
-                    "different actions: the peer's gate REFUSED your updates repeatedly (look for " +
-                    "document.rejection.received), or their daemon never CONFIRMED them at all (look for " +
-                    "document.delivery.unacked_limit — that one may be a local fault, not theirs)",
-            };
-        }
-        return { ok: true };
-    }
     shouldNotify(agentId) {
         return !this.isPlatformPaused(agentId);
     }
-    // ─── internals ────────────────────────────────────────────────────────────
-    #recordClose(ownerAgentId, documentId, closedBy, nowMs) {
-        this.#store.rawDb
-            .prepare(`INSERT INTO document_closes (owner_agent_id, document_id, closed_by, created_at)
-         VALUES (?, ?, ?, ?)
-         ON CONFLICT (owner_agent_id, document_id, closed_by) DO NOTHING`)
-            .run(ownerAgentId, documentId, closedBy, nowMs);
-    }
-    #hasClosed(ownerAgentId, documentId, who) {
-        const r = this.#store.rawDb
-            .prepare(`SELECT 1 AS present FROM document_closes
-          WHERE owner_agent_id = ? AND document_id = ? AND closed_by = ?`)
-            .get(ownerAgentId, documentId, who);
-        return r?.present === 1;
-    }
-    /**
-     * A document is complete BY AGREEMENT, so every current holder must have said it — DOD-MP-CLOSE-N-1.
-     *
-     * This settled on the owner plus `doc.peerAgentId`. With three holders that flipped the document
-     * to `closed` as soon as TWO of them had closed, while the third was still editing — which is
-     * exactly the failure this unit's own header forbids: "One side's close is a REQUEST — treating
-     * it as a conclusion would tell this operator the collaboration ended while the peer is still
-     * writing into it." Two of three is a conclusion drawn from a request.
-     *
-     * Ruled under M14B-PROCEDURE §3a as the least-reversal-risk reading. Requiring ALL is the
-     * conservative direction: it never claims an agreement that does not exist, and it is identical
-     * to the old behaviour for a two-party document. Loosening later (say, an admin closing for
-     * everyone) only widens what settles and strands nothing; shipping the loose rule first would
-     * leave documents already marked closed that never were, and no migration can un-say that.
-     *
-     * A chain that will not derive REFUSES to settle. It does NOT fall back to the genesis pair:
-     * that fallback re-creates this unit's own defect silently — a three-holder document settling on
-     * two, with the surface showing `closed` and nothing saying the derivation failed. The inbound
-     * gate's null branch NARROWS (fewer parties may act) and `controlHolders`' refuses by name; the
-     * same syntax here would WIDEN, which is the opposite safety direction.
-     */
-    /**
-     * Who must agree before this document is complete. Null means REFUSE — never a smaller set.
-     *
-     * The throw is contained here rather than at each call site because `holdersFor` decodes every
-     * stored amendment and throws on bytes this build cannot read, and an uncontained throw took the
-     * ENTIRE `cello_doc_list` down — the operator asking "what documents do I have" got a raw CBOR
-     * decoder string naming no document. That exact regression was fixed once already in
-     * `arrangementFor`; this unit re-opened it through a different call site.
-     */
-    #mustAgree(ownerAgentId, documentId, peerAgentId) {
-        const v = this.#holderVerdict(ownerAgentId, documentId);
-        // LEGACY is the one stand-in that is not a fallback: no chain exists, so the genesis pair IS
-        // the whole membership. `unknown` gets no such courtesy — a chain we cannot read may hold any
-        // number of holders, and settling on two of them is the defect this unit removes.
-        if (v.kind === "legacy")
-            return [ownerAgentId, peerAgentId];
-        if (v.kind === "unknown")
-            return null;
-        const holders = v.holders;
-        // `[].every()` is TRUE and `[].some()` is FALSE — an empty set would settle instantly on
-        // nobody's agreement in one function and report "waiting on nobody" in the other. A derived
-        // arrangement always contains its proposer, so this is the second line rather than the first;
-        // it is here because the vacuous reading of this idiom already had to be closed once in this file.
-        if (holders.length === 0)
-            return null;
-        return holders;
-    }
-    /** Have WE closed while at least one current holder has not? The list row's question. */
-    #closePendingFor(ownerAgentId, documentId, peerAgentId) {
-        if (!this.#hasClosed(ownerAgentId, documentId, ownerAgentId))
-            return false;
-        const mustAgree = this.#mustAgree(ownerAgentId, documentId, peerAgentId);
-        // CANNOT PROVE the rest have closed — so we are still waiting. "Still waiting" is the safe
-        // answer here and "nothing pending" is not: the latter tells an operator a document needs
-        // nothing from anyone when in fact nothing can ever settle it.
-        if (mustAgree === null)
-            return true;
-        return mustAgree.some((h) => !this.#hasClosed(ownerAgentId, documentId, h));
-    }
-    /**
-     * Settle if EVERY current holder has now said it — idempotent, `active`-only, safe to call from
-     * anywhere the answer could have changed. That includes a MEMBERSHIP change: removing the one
-     * holder who had not closed leaves everyone who remains in agreement, and without re-evaluating
-     * here the document stayed `active` forever with `closePending` reading false — open, waiting on
-     * nobody, and unsettleable, because control frames are fire-once and never swept.
-     */
-    #settleClose(ownerAgentId, documentId, peerAgentId) {
-        // ONLY FROM ACTIVE. Unconditional, a peer close arriving after a unilateral kill overwrote
-        // `killed` with `closed` — the operator's own decision replaced by "closed by agreement", which
-        // is a different fact and the one they did not choose. Same for `stalled`.
-        if (this.#store.getDocument(ownerAgentId, documentId)?.status !== "active")
-            return;
-        const peer = peerAgentId ?? this.#store.getDocument(ownerAgentId, documentId)?.peerAgentId ?? "";
-        const mustAgree = this.#mustAgree(ownerAgentId, documentId, peer);
-        if (mustAgree === null) {
-            this.#logger.warn("document.close.holders_underivable", { documentId });
-            return;
-        }
-        if (mustAgree.every((h) => this.#hasClosed(ownerAgentId, documentId, h))) {
-            this.#store.setDocumentStatus(ownerAgentId, documentId, "closed");
-            // The epoch travels: `mustAgree` is derived per daemon from an eventually-consistent chain,
-            // so two holders can legitimately reach this line with different-sized sets. Without the
-            // epoch their logs cannot be reconciled.
-            this.#logger.info("document.closed", {
-                documentId,
-                agreedBy: mustAgree.length,
-                epochId: this.#store.currentDocumentEpoch(ownerAgentId, documentId),
-            });
-        }
-    }
-    /**
-     * A membership amendment landed — the agreement may now be complete, or a re-admitted holder's
-     * stale close may need clearing. Called from the layer after any chain append.
-     */
-    onMembershipChanged(ownerAgentId, documentId, removedAgentId) {
-        if (removedAgentId !== undefined) {
-            // FORWARD-ONLY, applied to the close record too. `document_closes` is keyed by identity with
-            // no epoch, so a holder who closed, was removed, and was later re-admitted would have their
-            // OLD close counted against their NEW tenure — this unit's headline failure, one epoch
-            // removed. Dropping the row on removal is the cheaper half of that fix and matches the
-            // forward-only doctrine: their past participation is not carried into a future one.
-            this.#store.rawDb
-                .prepare(`DELETE FROM document_closes WHERE owner_agent_id = ? AND document_id = ? AND closed_by = ?`)
-                .run(ownerAgentId, documentId, removedAgentId);
-        }
-        this.#settleClose(ownerAgentId, documentId);
-    }
 }
 //# sourceMappingURL=document-lifecycle.js.map