@cello-protocol/daemon 0.0.167 → 0.0.169

package/dist/document-store.js

@@ -30,9 +30,7 @@
  * display label and reusable after retirement. The M7 session tables join on `agent_name`; that
  * is a known defect (`DOD-AGENT-ID-JOINKEY-1`), not a precedent to copy.
  */
-import { addColumnIfMissing } from "./column-birth.js";
-import { DOCUMENT_AMENDMENTS_CREATE_SQL, walkMembership } from "./document-amendment-store.js";
-import { decodeDocumentAmendment } from "@cello-protocol/protocol-types";
+import { DOCUMENT_ENTRIES_CREATE_SQL, dropLegacyEpochColumn, dropLegacyColumns, } from "./document-amendment-store.js";
 /** Thrown when a read path refuses to materialize over a chain that does not verify. */
 export class DocumentChainError extends Error {
     reason;
@@ -63,10 +61,12 @@ const CREATE_ENVELOPES_SQL = `
     envelope_hash   TEXT    NOT NULL,
     sender_agent_id TEXT    NOT NULL,
     doc_prev_hash   TEXT,
-    epoch_id        INTEGER NOT NULL,
     signature       BLOB    NOT NULL,
     state_vector    BLOB    NOT NULL,
     payload         BLOB,
+    -- SYNC-G1: the author's governance frontier at authoring (JSON array of entry hashes) —
+    -- content's causal link to the governance that made it admissible. Inside the signed TBS.
+    governance_parents TEXT NOT NULL DEFAULT '[]',
     kind            TEXT    NOT NULL CHECK (kind IN ('update', 'withdrawal', 'rejection')),
     -- The Yjs clientID the sender SIGNED for (ENVELOPE-1 puts it inside the TBS). Recorded so the
     -- gate's authorship rule has a binding derived from authenticated data rather than from a seam
@@ -76,33 +76,6 @@ const CREATE_ENVELOPES_SQL = `
     references_hash TEXT,
     created_at      INTEGER NOT NULL,
     log_index       INTEGER NOT NULL,
-    -- DELIVERY-1. Pending outbound is DERIVED from these columns rather than held in a queue:
-    -- a queue in memory does not survive a restart, and a queue in its own table is a second
-    -- source of truth that can disagree with the log about what was sent. "Unacknowledged
-    -- envelopes I authored" is the whole definition, and it is a WHERE clause.
-    -- TWO facts, and they are genuinely different: delivered_at is when the envelope LEFT (or was
-    -- parked for an offline peer), acked_at is when the peer's daemon said it admitted or rejected
-    -- it. An earlier version had delivered_at with no real writer — its only assignment was a
-    -- COALESCE inside the ack, so it always equalled acked_at and the distinction was one the
-    -- schema could not express. It has a writer now (markDelivered), so the distinction is real:
-    -- "sent, awaiting confirmation" is exactly the state a store-and-forward transport leaves an
-    -- envelope in, and an operator asking why something has not landed needs to tell it from
-    -- "never sent".
-    delivered_at    INTEGER,
-    acked_at        INTEGER,
-    -- A THIRD fact, and it is not either of the two above. abandoned_at is when WE STOPPED TRYING
-    -- (the unacked ceiling) — a local decision, and NOT a claim about the peer.
-    --
-    -- It exists because the ceiling first stopped delivery by calling markAcked, and acked_at means
-    -- "the peer's daemon said it admitted or rejected it". Overloading it made withdraw tell the
-    -- operator "your peer holds it, so it cannot be withdrawn" about an envelope the peer may never
-    -- have seen. Same class as any other false claim of confirmation, and a column is cheaper.
-    abandoned_at    INTEGER,
-    -- How many times delivery has been attempted, and when the next attempt is due. On the row,
-    -- because a backoff that resets on restart is not a backoff — a daemon restarting in a
-    -- reconnect loop would hammer an unreachable peer at full rate forever.
-    attempts        INTEGER NOT NULL DEFAULT 0,
-    next_attempt_at INTEGER,
     PRIMARY KEY (owner_agent_id, document_id, envelope_hash),
     -- A duplicate index would make ORDER BY log_index non-deterministic, and this log's entire
     -- value is deterministic replay. Two daemons on one DB file (the orphan-process case this
@@ -153,6 +126,10 @@ const CREATE_QUARANTINE_SQL = `
     limit_name            TEXT,
     limit_value           INTEGER,
     limit_actual          INTEGER,
+    -- SYNC-R35: the EXACT signed refusal frame, so the refusal can travel by the ordinary
+    -- exchange (re-encoding from columns cannot reproduce the signed bytes). Nullable: rows
+    -- born before R35 hold no wire, and the exchange simply has nothing to attach for them.
+    rejection_wire        BLOB,
     created_at            INTEGER NOT NULL,
     PRIMARY KEY (owner_agent_id, document_id, rejection_envelope_hash),
     FOREIGN KEY (owner_agent_id, document_id) REFERENCES documents (owner_agent_id, document_id)
@@ -182,16 +159,6 @@ const CREATE_REJECTIONS_RECEIVED_SQL = `
     FOREIGN KEY (owner_agent_id, document_id) REFERENCES documents (owner_agent_id, document_id)
   );
 `;
-/** Mirrors `DocumentLifecycle`'s definition exactly — see the note at the exec site. */
-const CREATE_WITHDRAWALS_SQL = `
-  CREATE TABLE IF NOT EXISTS document_withdrawals (
-    owner_agent_id TEXT    NOT NULL,
-    document_id    TEXT    NOT NULL,
-    envelope_hash  TEXT    NOT NULL,
-    created_at     INTEGER NOT NULL,
-    PRIMARY KEY (owner_agent_id, document_id, envelope_hash)
-  );
-`;
 const CREATE_SNAPSHOTS_SQL = `
   CREATE TABLE IF NOT EXISTS document_snapshots (
     owner_agent_id      TEXT    NOT NULL,
@@ -219,86 +186,61 @@ export class DocumentStore {
         this.#db = db;
         this.#logger = logger;
         this.#db.exec(CREATE_DOCUMENTS_SQL);
+        // SYNC-G1 birth-gated column (the consent-migration precedent): a database created before
+        // the causal-anchor column exists gains it here, defaulted to the empty frontier — CREATE
+        // IF NOT EXISTS cannot add columns, and a client-side migration that fails is unrecoverable
+        // on an operator machine, so the ALTER is guarded by the actual table shape.
+        const envelopeColumns = this.#db
+            .prepare(`PRAGMA table_info(document_envelopes)`)
+            .all();
+        if (envelopeColumns.length > 0 &&
+            !envelopeColumns.some((c) => c.name === "governance_parents")) {
+            this.#db.exec(`ALTER TABLE document_envelopes ADD COLUMN governance_parents TEXT NOT NULL DEFAULT '[]'`);
+        }
         // M14B / DOD-MP-AMEND-1 — the amendments table this store READS (currentDocumentEpoch);
         // DocumentAmendmentStore owns writes. Shared definition, whichever constructs first wins.
-        this.#db.exec(DOCUMENT_AMENDMENTS_CREATE_SQL);
-        // M14B / DOD-MP-FANOUT-1 — per-(envelope, holder) delivery state. The envelope row's
-        // bilateral ack columns cannot carry N answers; this table can, and it is DERIVED
-        // bookkeeping over the log — the envelope is the truth, a row here is one holder's
-        // outstanding confirmation. Restart-survivable by construction.
-        this.#db.exec(`
-      CREATE TABLE IF NOT EXISTS document_deliveries (
-        owner_agent_id  TEXT    NOT NULL,
-        document_id     TEXT    NOT NULL,
-        envelope_hash   TEXT    NOT NULL,
-        holder_agent_id TEXT    NOT NULL,
-        delivered_at    INTEGER,
-        acked_at        INTEGER,
-        abandoned_at    INTEGER,
-        attempts        INTEGER NOT NULL DEFAULT 0,
-        -- SENDS is the ceiling's counter; ATTEMPTS is the schedule's. Conflating them was the
-        -- old worker's defect: five quiet deferrals to an offline peer counted as five unacked
-        -- sends, and the first real send after they returned abandoned the envelope.
-        sends           INTEGER NOT NULL DEFAULT 0,
-        next_attempt_at INTEGER,
-        created_at      INTEGER NOT NULL,
-        PRIMARY KEY (owner_agent_id, document_id, envelope_hash, holder_agent_id)
-      );
-    `);
-        // DOD-MP-INVITE-FANOUT-1 — the admitting amendment gets the SAME durability a content edit
-        // has. It used to be sent best-effort over direct transport: one shot, no row, no retry, no
-        // restart survival, so a single failed send lost a membership change permanently while every
-        // surface reported success. The governance act that decides who is a party to the document is
-        // the last thing that should be less durable than a typo fix.
-        //
-        // A SEPARATE table rather than a `payload_kind` column on `document_deliveries`: that query is
-        // the hot path every content edit rides, and ordering — the only reason to share a queue — is
-        // preserved explicitly instead, by draining amendments FIRST in every pass (see
-        // DocumentDelivery#run). A holder must apply the amendment before any edit authored at the new
-        // epoch, or they refuse that edit as coming from a non-participant, which is the observed
-        // symptom.
-        this.#db.exec(`
-      CREATE TABLE IF NOT EXISTS document_amendment_deliveries (
-        owner_agent_id  TEXT    NOT NULL,
-        document_id     TEXT    NOT NULL,
-        amendment_hash  TEXT    NOT NULL,
-        holder_agent_id TEXT    NOT NULL,
-        -- SENT is 'the bytes left this daemon'. ACKED is 'the holder demonstrably applied it'.
-        -- Conflating them was the review's HIGH-2: a successful send means the frame reached their
-        -- daemon, and the receiver can still REFUSE to record it (recordAmendment throws on a chain
-        -- gap or a failed derivation, and the router logs it and answers nothing). Acking on that
-        -- reproduced the original defect through the new machinery.
-        sent_at         INTEGER,
-        acked_at        INTEGER,
-        -- RETIRED is not delivered. A holder the chain no longer contains is owed nothing, and
-        -- recording that as an ack would make the durable record claim a delivery that never
-        -- happened.
-        retired_at      INTEGER,
-        attempts        INTEGER NOT NULL DEFAULT 0,
-        next_attempt_at INTEGER,
-        created_at      INTEGER NOT NULL,
-        PRIMARY KEY (owner_agent_id, document_id, amendment_hash, holder_agent_id)
-      );
-    `);
+        this.#db.exec(`DROP TABLE IF EXISTS document_amendments`);
+        this.#db.exec(DOCUMENT_ENTRIES_CREATE_SQL);
+        dropLegacyEpochColumn(this.#db, "document_entries");
         this.#db.exec(CREATE_ENVELOPES_SQL);
+        dropLegacyEpochColumn(this.#db, "document_envelopes");
+        // SYNC-AC3 residue. P4 deleted the delivery worker and its ledgers but left DELIVERY-1's
+        // bookkeeping columns standing on the envelope log — no writer, no reader, and exactly the
+        // per-recipient DEBT the pivot exists to abolish ("X still owes Y this envelope"). Dead
+        // columns are not harmless here: the next author to see `next_attempt_at` in the schema
+        // reasonably concludes retry state belongs on the row and rebuilds the machine. Dropped on
+        // open, birth-gated like the epoch column beside it.
+        dropLegacyColumns(this.#db, "document_envelopes", [
+            "delivered_at", "acked_at", "abandoned_at", "attempts", "next_attempt_at",
+        ]);
         this.#db.exec(CREATE_QUARANTINE_SQL);
+        // SYNC-R35, birth-gated like the epoch drops: a database born earlier lacks the column.
+        {
+            const cols = this.#db.prepare(`PRAGMA table_info(document_quarantine)`).all();
+            if (!cols.some((c) => c.name === "rejection_wire")) {
+                this.#db.exec(`ALTER TABLE document_quarantine ADD COLUMN rejection_wire BLOB`);
+            }
+        }
         this.#db.exec(CREATE_REJECTIONS_RECEIVED_SQL);
-        // Owned by DocumentLifecycle, created HERE too because `pendingDeliveries` references it and a
-        // store used without the lifecycle module is a legitimate configuration. Both statements are
-        // CREATE TABLE IF NOT EXISTS over the same definition, so whichever runs first wins and the
-        // other is a no-op — the alternative is a query that throws on a missing table and takes an
-        // entire delivery pass down with it.
-        this.#db.exec(CREATE_WITHDRAWALS_SQL);
+        // D9 residue sweep (review F5): withdrawals have no reader or writer left.
+        this.#db.exec(`DROP TABLE IF EXISTS document_withdrawals`);
+        // SYNC-P5 (spec §9): the per-party DISPLAY CACHE — last successful exchange and the
+        // position that party last claimed. Non-authoritative by construction: no correctness
+        // decision reads it (R44); it exists so `cello_doc_list` can say in_sync|behind|unseen
+        // without initiating an exchange per row.
+        this.#db.exec(`
+      CREATE TABLE IF NOT EXISTS document_party_view (
+        owner_agent_id   TEXT    NOT NULL,
+        document_id      TEXT    NOT NULL,
+        party_agent_id   TEXT    NOT NULL,
+        last_exchange_ms INTEGER NOT NULL,
+        gov_seqs         TEXT    NOT NULL,
+        content_counts   TEXT    NOT NULL,
+        refused          TEXT    NOT NULL,
+        PRIMARY KEY (owner_agent_id, document_id, party_agent_id)
+      );
+    `);
         this.#db.exec(CREATE_SNAPSHOTS_SQL);
-        // COLUMN BIRTH. A daemon that already holds an envelope log must gain the column without
-        // losing the log. `ALTER TABLE ... ADD COLUMN` throws when it is already there, which is the
-        // guard — the same pattern `document-handshake.ts` uses, rather than a version number nobody
-        // maintains.
-        addColumnIfMissing(this.#db, this.#logger, {
-            table: "document_envelopes",
-            column: "abandoned_at",
-            sql: "ALTER TABLE document_envelopes ADD COLUMN abandoned_at INTEGER",
-        });
         // Reading the log in arrival order is the only access pattern that matters.
         this.#db.exec("CREATE INDEX IF NOT EXISTS idx_document_envelopes_order ON document_envelopes (owner_agent_id, document_id, log_index)");
     }
@@ -321,16 +263,6 @@ export class DocumentStore {
             .get(ownerAgentId, documentId);
         return r ? toDocumentRow(r) : null;
     }
-    /**
-     * Does this daemon hold ANY document, under any owner?
-     *
-     * Deliberately unscoped, and that is the point: it is the only question that can tell a delivery
-     * sweep visiting zero agents apart from a daemon that simply has no documents. Without it the two
-     * look identical in the log, which is what let an owner-key mismatch hide.
-     */
-    anyDocumentExists() {
-        return this.#db.prepare("SELECT 1 FROM documents LIMIT 1").get() !== undefined;
-    }
     listDocuments(ownerAgentId) {
         const rows = this.#db
             .prepare("SELECT * FROM documents WHERE owner_agent_id = ? ORDER BY created_at ASC")
@@ -367,14 +299,14 @@ export class DocumentStore {
         try {
             info = this.#db
                 .prepare(`INSERT INTO document_envelopes
-           (owner_agent_id, document_id, envelope_hash, sender_agent_id, doc_prev_hash, epoch_id,
-            signature, state_vector, payload, kind, references_hash, sender_client_id,
-            created_at, log_index)
+           (owner_agent_id, document_id, envelope_hash, sender_agent_id, doc_prev_hash,
+            signature, state_vector, payload, governance_parents, kind, references_hash,
+            sender_client_id, created_at, log_index)
          SELECT ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?,
                 COALESCE((SELECT MAX(log_index) + 1 FROM document_envelopes
                            WHERE owner_agent_id = ? AND document_id = ?), 0)
          ON CONFLICT (owner_agent_id, document_id, envelope_hash) DO NOTHING`)
-                .run(ownerAgentId, envelope.documentId, envelope.envelopeHash, envelope.senderAgentId, envelope.docPrevHash, envelope.epochId, Buffer.from(envelope.signature), Buffer.from(envelope.stateVector), envelope.payload === null ? null : Buffer.from(envelope.payload), envelope.kind, envelope.referencesEnvelopeHash ?? null, envelope.senderClientId ?? null, envelope.createdAtMs, ownerAgentId, envelope.documentId);
+                .run(ownerAgentId, envelope.documentId, envelope.envelopeHash, envelope.senderAgentId, envelope.docPrevHash, Buffer.from(envelope.signature), Buffer.from(envelope.stateVector), envelope.payload === null ? null : Buffer.from(envelope.payload), JSON.stringify(envelope.governanceParents ?? []), envelope.kind, envelope.referencesEnvelopeHash ?? null, envelope.senderClientId ?? null, envelope.createdAtMs, ownerAgentId, envelope.documentId);
         }
         catch (err) {
             const message = err instanceof Error ? err.message : String(err);
@@ -439,9 +371,9 @@ export class DocumentStore {
             documentId: q.documentId,
             senderAgentId: q.rejectedSenderAgentId,
             docPrevHash: q.rejectedDocPrevHash,
+            governanceParents: [],
             // EXEMPT from current-epoch stamping (M14B Entry 5): a stub is a SYNTHETIC verification
             // node — never on the wire, never replayed — and the chain walk checks hash linkage only.
-            epochId: 0,
             signature: new Uint8Array(0),
             stateVector: new Uint8Array(0),
             payload: null,
@@ -555,10 +487,10 @@ export class DocumentStore {
             .prepare(`INSERT INTO document_quarantine
            (owner_agent_id, document_id, rejection_envelope_hash, rejected_envelope_hash,
             rejected_sender_agent_id, rejected_doc_prev_hash, payload, reason, detail,
-            rule, limit_name, limit_value, limit_actual, created_at)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+            rule, limit_name, limit_value, limit_actual, rejection_wire, created_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
          ON CONFLICT (owner_agent_id, document_id, rejection_envelope_hash) DO NOTHING`)
-            .run(ownerAgentId, row.documentId, row.rejectionEnvelopeHash, row.rejectedEnvelopeHash, row.rejectedSenderAgentId, row.rejectedDocPrevHash, Buffer.from(row.payload), row.reason, row.detail ?? null, row.rule ?? null, row.limitName ?? null, row.limitValue ?? null, row.limitActual ?? null, row.createdAtMs);
+            .run(ownerAgentId, row.documentId, row.rejectionEnvelopeHash, row.rejectedEnvelopeHash, row.rejectedSenderAgentId, row.rejectedDocPrevHash, Buffer.from(row.payload), row.reason, row.detail ?? null, row.rule ?? null, row.limitName ?? null, row.limitValue ?? null, row.limitActual ?? null, row.rejectionWire ? Buffer.from(row.rejectionWire) : null, row.createdAtMs);
         return Number(info.changes) > 0;
     }
     listQuarantined(ownerAgentId, documentId) {
@@ -584,6 +516,7 @@ export class DocumentStore {
             limitName: r["limit_name"] ?? undefined,
             limitValue: r["limit_value"] ?? undefined,
             limitActual: r["limit_actual"] ?? undefined,
+            rejectionWire: r["rejection_wire"] == null ? undefined : toU8(r["rejection_wire"]),
             createdAtMs: r["created_at"],
         }));
     }
@@ -723,597 +656,46 @@ export class DocumentStore {
      */
     /**
      * The document's CURRENT epoch: the head of its recorded amendment chain, 0 at genesis.
-     * Trustworthy for stamping because every append site validates (deriveArrangement) before
+     * Trustworthy for stamping because every append site rules on admissibility before
      * recording — a row in document_amendments is post-validation by invariant (M14B Entry 5).
      */
-    /**
-     * DOD-MP-REMOVE-1 — was THIS OWNER written out of the arrangement? DERIVED from the recorded
-     * chain, never stored: a status column would need a CHECK-constraint rebuild on every operator
-     * DB, and a stored flag can drift from the chain that actually governs. Forward-only by
-     * construction — nothing here touches content.
-     */
-    removedFromArrangement(ownerAgentId, documentId) {
-        return this.memberRemoved(ownerAgentId, documentId, ownerAgentId);
-    }
-    /** The same walk for ANY agent — the delivery worker asks it about the TARGET (F1). */
-    memberRemoved(ownerAgentId, documentId, agentId) {
+    /** SYNC-P5 (review F6) — per-sender envelope counts without hauling payload blobs. */
+    envelopeCountsBySender(ownerAgentId, documentId) {
         const rows = this.#db
-            .prepare(`SELECT received_bytes FROM document_amendments
+            .prepare(`SELECT sender_agent_id, COUNT(*) AS n FROM document_envelopes
           WHERE owner_agent_id = ? AND document_id = ?
-          ORDER BY epoch_id ASC`)
+          GROUP BY sender_agent_id`)
             .all(ownerAgentId, documentId);
-        // CONTAINED, for the same reason the arrangement read is: `decodeDocumentAmendment` throws
-        // on bytes this build cannot read, and this runs once PER ROW inside `list` — so one
-        // undecodable chain took down the operator's whole document list. Reporting not-removed
-        // here is not a health claim: the same row carries `arrangementUnavailable` naming the
-        // undecodable chain, so the surface says it cannot answer rather than answering wrongly.
-        let verdict;
-        try {
-            verdict = walkMembership(rows.map((r) => decodeDocumentAmendment(new Uint8Array(r.received_bytes))), agentId);
-        }
-        catch (err) {
-            this.#logger.error("document.membership.undecodable", {
-                documentId,
-                agentId,
-                reason: err instanceof Error ? err.message : String(err),
-            });
-            return { removed: false, epochId: null };
-        }
-        return { removed: verdict.state === "removed", epochId: verdict.epochId };
-    }
-    currentDocumentEpoch(ownerAgentId, documentId) {
-        const r = this.#db
-            .prepare(`SELECT MAX(epoch_id) AS max_epoch FROM document_amendments
-          WHERE owner_agent_id = ? AND document_id = ?`)
-            .get(ownerAgentId, documentId);
-        return r?.max_epoch ?? 0;
-    }
-    /**
-     * Append an envelope AND seed its per-holder delivery rows in ONE transaction (review M5):
-     * a crash between the two left an envelope in the log with zero rows, and the bilateral
-     * backfill would re-seed only the genesis peer — the fan-out holders silently starved.
-     * Returns the append verdict unchanged.
-     */
-    appendEnvelopeWithDeliveries(ownerAgentId, envelope, holderAgentIds, nowMs) {
-        this.#db.exec("BEGIN IMMEDIATE");
-        try {
-            const appended = this.appendEnvelope(ownerAgentId, envelope);
-            if (appended) {
-                this.seedDeliveries(ownerAgentId, envelope.documentId, envelope.envelopeHash, holderAgentIds, nowMs);
-            }
-            this.#db.exec("COMMIT");
-            return appended;
-        }
-        catch (err) {
-            this.#db.exec("ROLLBACK");
-            throw err;
-        }
-    }
-    /** DOD-MP-FANOUT-1 — one pending row per CURRENT holder for a freshly published envelope. */
-    seedDeliveries(ownerAgentId, documentId, envelopeHash, holderAgentIds, nowMs) {
-        const insert = this.#db.prepare(`INSERT INTO document_deliveries
-         (owner_agent_id, document_id, envelope_hash, holder_agent_id, created_at)
-       VALUES (?, ?, ?, ?, ?)
-       ON CONFLICT (owner_agent_id, document_id, envelope_hash, holder_agent_id) DO NOTHING`);
-        for (const holder of holderAgentIds) {
-            insert.run(ownerAgentId, documentId, envelopeHash, holder, nowMs);
-        }
-    }
-    /**
-     * DOD-MP-INVITE-FANOUT-1 — one owed row per holder who must learn about this amendment.
-     *
-     * The inviter and the subject are excluded by the CALLER, not here: this records what is owed,
-     * and who is owed it is a governance question the handler has already derived.
-     */
-    seedAmendmentDeliveries(ownerAgentId, documentId, amendmentHash, holderAgentIds, nowMs) {
-        const insert = this.#db.prepare(`INSERT INTO document_amendment_deliveries
-         (owner_agent_id, document_id, amendment_hash, holder_agent_id, created_at)
-       VALUES (?, ?, ?, ?, ?)
-       ON CONFLICT (owner_agent_id, document_id, amendment_hash, holder_agent_id) DO NOTHING`);
-        for (const holder of holderAgentIds) {
-            insert.run(ownerAgentId, documentId, amendmentHash, holder, nowMs);
-        }
-    }
-    /**
-     * Amendments still owed to a holder, with the exact bytes to send. Joined to
-     * `document_amendments` — the recorded chain IS the payload, so a redelivery can never send
-     * something the local chain does not contain.
-     */
-    pendingAmendmentDeliveries(ownerAgentId, nowMs, opts = {}) {
-        // HEAD-OF-LINE, PER (DOCUMENT, HOLDER) — and this is a correctness rule, not a nicety.
-        //
-        // Ordering by `created_at` among only the rows that are DUE inverts the chain: epoch N fails
-        // once and takes a backoff, epoch N+1 is seeded due immediately, so the next pass sends N+1
-        // alone. The receiver then refuses it with `document_amendment_chain_gap` — "an out-of-order
-        // arrival is retried by its sender, never buffered silently" — and under the old ack-on-send
-        // there was no retry, so N+1 was lost permanently and the one message that would have explained
-        // it said the opposite. Proven by the unit review.
-        //
-        // So: order by the CHAIN's epoch, and never offer an amendment while an earlier one is still
-        // outstanding for that same holder. Per (document, holder), never globally — one holder's stuck
-        // chain must not hold up another's.
-        const rows = this.#db
-            .prepare(`SELECT holder_agent_id, document_id, amendment_hash, epoch_id, attempts, received_bytes
-           FROM (
-             SELECT d.holder_agent_id, d.document_id, d.amendment_hash, d.attempts,
-                    a.epoch_id, a.received_bytes,
-                    d.next_attempt_at,
-                    ROW_NUMBER() OVER (
-                      PARTITION BY d.document_id, d.holder_agent_id
-                      ORDER BY a.epoch_id ASC
-                    ) AS rn
-               FROM document_amendment_deliveries d
-               JOIN document_amendments a
-                 ON a.owner_agent_id = d.owner_agent_id
-                AND a.document_id = d.document_id
-                AND a.amendment_hash = d.amendment_hash
-              WHERE d.owner_agent_id = ?
-                AND d.acked_at IS NULL
-                AND d.retired_at IS NULL
-           )
-          WHERE rn = 1
-            AND (next_attempt_at IS NULL OR next_attempt_at <= ?)
-          ORDER BY document_id ASC, holder_agent_id ASC
-          LIMIT ?`)
-            .all(ownerAgentId, nowMs, opts.limit ?? 50);
-        return rows.map((r) => ({
-            holderAgentId: r["holder_agent_id"],
-            documentId: r["document_id"],
-            amendmentHash: r["amendment_hash"],
-            epochId: r["epoch_id"] ?? 0,
-            attempts: r["attempts"] ?? 0,
-            bytes: new Uint8Array(r["received_bytes"]),
-        }));
-    }
-    /**
-     * Owed amendment rows with NO matching row in the recorded chain.
-     *
-     * The pending query INNER JOINs the chain, which is right — a redelivery must never send bytes
-     * this daemon's own chain does not contain — but an inner join also makes such a row invisible
-     * AND owed forever. Surfaced so the worker can say so instead of scanning past it every tick.
-     */
-    amendmentDeliveriesWithoutChainRow(ownerAgentId) {
-        const rows = this.#db
-            .prepare(`SELECT d.document_id, d.amendment_hash, d.holder_agent_id
-           FROM document_amendment_deliveries d
-           LEFT JOIN document_amendments a
-             ON a.owner_agent_id = d.owner_agent_id
-            AND a.document_id = d.document_id
-            AND a.amendment_hash = d.amendment_hash
-          WHERE d.owner_agent_id = ?
-            AND d.acked_at IS NULL
-            AND d.retired_at IS NULL
-            AND a.amendment_hash IS NULL`)
-            .all(ownerAgentId);
-        return rows.map((r) => ({
-            documentId: r["document_id"],
-            amendmentHash: r["amendment_hash"],
-            holderAgentId: r["holder_agent_id"],
-        }));
-    }
-    /**
-     * The bytes left this daemon. NOT a confirmation — see the `sent_at` note on the table.
-     *
-     * The row stays owed and is re-offered after `retryAfterMs`, because the only thing that has
-     * happened is that their daemon received a frame. Whether it RECORDED it is a separate fact, and
-     * the receiver can refuse.
-     */
-    markAmendmentSent(ownerAgentId, documentId, amendmentHash, holderAgentId, nowMs, retryAfterMs) {
-        this.#db
-            .prepare(`UPDATE document_amendment_deliveries
-            SET sent_at = ?, next_attempt_at = ?
-          WHERE owner_agent_id = ? AND document_id = ? AND amendment_hash = ? AND holder_agent_id = ?`)
-            .run(nowMs, nowMs + retryAfterMs, ownerAgentId, documentId, amendmentHash, holderAgentId);
-    }
-    /** The holder demonstrably HAS it. Nothing further is owed for this (amendment, holder). */
-    ackAmendmentDelivery(ownerAgentId, documentId, amendmentHash, holderAgentId, nowMs) {
-        this.#db
-            .prepare(`UPDATE document_amendment_deliveries
-            SET acked_at = ?
-          WHERE owner_agent_id = ? AND document_id = ? AND amendment_hash = ? AND holder_agent_id = ?`)
-            .run(nowMs, ownerAgentId, documentId, amendmentHash, holderAgentId);
-    }
-    /**
-     * PROOF BY EPOCH — settle every amendment a holder has demonstrably applied.
-     *
-     * There is no amendment ack frame, and inventing one is wire work. But there is already a fact on
-     * the wire that PROVES receipt: a holder that acks an envelope authored at epoch E must hold every
-     * amendment up to E, because the inbound epoch gate refuses anything whose epoch does not match
-     * its own derived arrangement. So their ack of the content IS their ack of the governance that
-     * made the content admissible.
-     *
-     * Returns how many rows it settled, so the caller can say so.
-     */
-    ackAmendmentsThroughEpoch(ownerAgentId, documentId, holderAgentId, epochId, nowMs) {
-        const owed = this.#db
-            .prepare(`SELECT d.amendment_hash
-           FROM document_amendment_deliveries d
-           JOIN document_amendments a
-             ON a.owner_agent_id = d.owner_agent_id
-            AND a.document_id = d.document_id
-            AND a.amendment_hash = d.amendment_hash
-          WHERE d.owner_agent_id = ? AND d.document_id = ? AND d.holder_agent_id = ?
-            AND d.acked_at IS NULL AND d.retired_at IS NULL
-            AND a.epoch_id <= ?`)
-            .all(ownerAgentId, documentId, holderAgentId, epochId);
-        for (const row of owed) {
-            this.ackAmendmentDelivery(ownerAgentId, documentId, row.amendment_hash, holderAgentId, nowMs);
-        }
-        return owed.length;
-    }
-    /**
-     * The holder is no longer in the chain. Distinct from acked ON PURPOSE: an ack here would make
-     * the durable record claim a delivery that never happened.
-     */
-    retireAmendmentDelivery(ownerAgentId, documentId, amendmentHash, holderAgentId, nowMs) {
-        this.#db
-            .prepare(`UPDATE document_amendment_deliveries
-            SET retired_at = ?
-          WHERE owner_agent_id = ? AND document_id = ? AND amendment_hash = ? AND holder_agent_id = ?`)
-            .run(nowMs, ownerAgentId, documentId, amendmentHash, holderAgentId);
-    }
-    /** Record one failed attempt and when to try again; returns THEIR attempt count. */
-    recordAmendmentAttempt(ownerAgentId, documentId, amendmentHash, holderAgentId, nextAttemptAtMs) {
-        this.#db
-            .prepare(`UPDATE document_amendment_deliveries
-            SET attempts = attempts + 1, next_attempt_at = ?
-          WHERE owner_agent_id = ? AND document_id = ? AND amendment_hash = ? AND holder_agent_id = ?`)
-            .run(nextAttemptAtMs, ownerAgentId, documentId, amendmentHash, holderAgentId);
-        const row = this.#db
-            .prepare(`SELECT attempts FROM document_amendment_deliveries
-          WHERE owner_agent_id = ? AND document_id = ? AND amendment_hash = ? AND holder_agent_id = ?`)
-            .get(ownerAgentId, documentId, amendmentHash, holderAgentId);
-        return row?.attempts ?? 0;
-    }
-    /**
-     * Everything due for delivery, PER HOLDER, joined to its envelope. The window is bounded PER
-     * HOLDER (`ROW_NUMBER` over holder partitions) — one holder's backlog must never evict
-     * another's rows from the pass, which is the no_peer starvation shape multiplied by N.
-     */
-    pendingHolderDeliveries(ownerAgentId, nowMs, opts = {}) {
-        const limit = opts.perHolderLimit ?? 50;
-        const rows = this.#db
-            .prepare(
-        // holder_attempts ALIASED: e.* carries the envelope row's LEGACY bilateral attempts
-        // column, which would silently shadow the per-holder count in the result map.
-        `SELECT d.holder_agent_id, d.attempts AS holder_attempts, d.document_id AS delivery_document_id, e.*
-           FROM (
-             SELECT *, ROW_NUMBER() OVER (
-               PARTITION BY holder_agent_id
-               ORDER BY created_at ASC, envelope_hash ASC
-             ) AS rn
-             FROM document_deliveries
-             WHERE owner_agent_id = ?
-               AND acked_at IS NULL AND abandoned_at IS NULL
-               AND (next_attempt_at IS NULL OR next_attempt_at <= ?)
-           ) d
-           JOIN document_envelopes e
-             ON e.owner_agent_id = d.owner_agent_id
-            AND e.document_id = d.document_id
-            AND e.envelope_hash = d.envelope_hash
-          WHERE d.rn <= ?
-          ORDER BY d.holder_agent_id ASC, d.created_at ASC`)
-            .all(ownerAgentId, nowMs, limit);
-        return rows.map((r) => ({
-            holderAgentId: r["holder_agent_id"],
-            documentId: r["delivery_document_id"],
-            attempts: r["holder_attempts"] ?? 0,
-            envelope: toEnvelopeRow(r),
-        }));
-    }
-    /** Record one holder's attempt; returns THEIR attempt count. */
-    recordHolderAttempt(ownerAgentId, documentId, envelopeHash, holderAgentId, nextAttemptAtMs) {
-        this.#db
-            .prepare(`UPDATE document_deliveries
-            SET attempts = attempts + 1, next_attempt_at = ?
-          WHERE owner_agent_id = ? AND document_id = ? AND envelope_hash = ? AND holder_agent_id = ?`)
-            .run(nextAttemptAtMs, ownerAgentId, documentId, envelopeHash, holderAgentId);
-        const r = this.#db
-            .prepare(`SELECT attempts FROM document_deliveries
-          WHERE owner_agent_id = ? AND document_id = ? AND envelope_hash = ? AND holder_agent_id = ?`)
-            .get(ownerAgentId, documentId, envelopeHash, holderAgentId);
-        return r?.attempts ?? 0;
-    }
-    /** Settle one holder's confirmation. True exactly when THIS call settled it. */
-    ackHolderDelivery(ownerAgentId, documentId, envelopeHash, holderAgentId, nowMs) {
-        const r = this.#db
-            .prepare(`UPDATE document_deliveries
-            SET acked_at = ?, delivered_at = COALESCE(delivered_at, ?)
-          WHERE owner_agent_id = ? AND document_id = ? AND envelope_hash = ? AND holder_agent_id = ?
-            AND acked_at IS NULL AND abandoned_at IS NULL`)
-            .run(nowMs, nowMs, ownerAgentId, documentId, envelopeHash, holderAgentId);
-        return (r.changes ?? 0) > 0;
-    }
-    /**
-     * Retire EVERY outstanding row for one holder — our decision, announced by the caller.
-     * Returns the affected envelope hashes so the caller can reconcile the envelope-level record
-     * (an envelope whose every holder-row is settled-with-abandonment is itself abandoned).
-     */
-    abandonHolderDeliveries(ownerAgentId, documentId, holderAgentId, nowMs) {
-        const rows = this.#db
-            .prepare(`SELECT envelope_hash FROM document_deliveries
-          WHERE owner_agent_id = ? AND document_id = ? AND holder_agent_id = ?
-            AND acked_at IS NULL AND abandoned_at IS NULL`)
-            .all(ownerAgentId, documentId, holderAgentId);
-        this.#db
-            .prepare(`UPDATE document_deliveries
-            SET abandoned_at = ?
-          WHERE owner_agent_id = ? AND document_id = ? AND holder_agent_id = ?
-            AND acked_at IS NULL AND abandoned_at IS NULL`)
-            .run(nowMs, ownerAgentId, documentId, holderAgentId);
-        return rows.map((r) => r.envelope_hash);
+        return new Map(rows.map((r) => [r.sender_agent_id, r.n]));
     }
-    /** Count one REAL send (content left us — live or parked) toward this holder's ceiling. */
-    recordHolderSend(ownerAgentId, documentId, envelopeHash, holderAgentId) {
+    /** SYNC-P5 — record what a party's exchange just showed us (display cache; see the table). */
+    recordPartyView(ownerAgentId, documentId, partyAgentId, view, nowMs) {
         this.#db
-            .prepare(`UPDATE document_deliveries
-            SET sends = sends + 1
-          WHERE owner_agent_id = ? AND document_id = ? AND envelope_hash = ? AND holder_agent_id = ?`)
-            .run(ownerAgentId, documentId, envelopeHash, holderAgentId);
-        const r = this.#db
-            .prepare(`SELECT sends FROM document_deliveries
-          WHERE owner_agent_id = ? AND document_id = ? AND envelope_hash = ? AND holder_agent_id = ?`)
-            .get(ownerAgentId, documentId, envelopeHash, holderAgentId);
-        return r?.sends ?? 0;
-    }
-    /** One holder's copy LEFT the machine — the sent-vs-never-left fact, per holder. */
-    markHolderDelivered(ownerAgentId, documentId, envelopeHash, holderAgentId, nowMs) {
-        this.#db
-            .prepare(`UPDATE document_deliveries
-            SET delivered_at = COALESCE(delivered_at, ?)
-          WHERE owner_agent_id = ? AND document_id = ? AND envelope_hash = ? AND holder_agent_id = ?`)
-            .run(nowMs, ownerAgentId, documentId, envelopeHash, holderAgentId);
-    }
-    /** Has ANY holder's copy of this envelope left the machine? */
-    envelopeEverSent(ownerAgentId, envelopeHash) {
-        const r = this.#db
-            .prepare(`SELECT 1 FROM document_deliveries
-          WHERE owner_agent_id = ? AND envelope_hash = ? AND delivered_at IS NOT NULL
-          LIMIT 1`)
-            .get(ownerAgentId, envelopeHash);
-        return r !== undefined;
-    }
-    /** Reschedule one holder's retry WITHOUT counting an attempt — waiting is not sending. */
-    scheduleHolderRetry(ownerAgentId, documentId, envelopeHash, holderAgentId, nextAttemptAtMs) {
-        this.#db
-            .prepare(`UPDATE document_deliveries
-            SET next_attempt_at = ?
-          WHERE owner_agent_id = ? AND document_id = ? AND envelope_hash = ? AND holder_agent_id = ?`)
-            .run(nextAttemptAtMs, ownerAgentId, documentId, envelopeHash, holderAgentId);
-    }
-    /** Retire ONE (envelope, holder) row — the per-holder unacked ceiling's teeth. */
-    abandonSingleHolderDelivery(ownerAgentId, documentId, envelopeHash, holderAgentId, nowMs) {
-        this.#db
-            .prepare(`UPDATE document_deliveries
-            SET abandoned_at = ?
-          WHERE owner_agent_id = ? AND document_id = ? AND envelope_hash = ? AND holder_agent_id = ?
-            AND acked_at IS NULL AND abandoned_at IS NULL`)
-            .run(nowMs, ownerAgentId, documentId, envelopeHash, holderAgentId);
-    }
-    /**
-     * No holder still owes a confirmation on this envelope. TRUE with zero rows — the bilateral
-     * legacy case, where the envelope-row columns remain the record and this table has nothing to
-     * say.
-     */
-    envelopeFullySettled(ownerAgentId, envelopeHash) {
-        const r = this.#db
-            .prepare(`SELECT 1 FROM document_deliveries
-          WHERE owner_agent_id = ? AND envelope_hash = ?
-            AND acked_at IS NULL AND abandoned_at IS NULL
-          LIMIT 1`)
-            .get(ownerAgentId, envelopeHash);
-        return r === undefined;
-    }
-    /**
-     * Seed per-holder rows for LEGACY bilateral envelopes: anything this agent authored that is
-     * still unacknowledged on the envelope row and has no per-holder rows yet gets one for the
-     * genesis peer. Idempotent (the PK refuses duplicates); run per pass, cheap, and journaled —
-     * pre-fan-out backlogs are near-empty at alpha, this is insurance not migration.
-     */
-    backfillBilateralDeliveries(ownerAgentId, senderAgentId, nowMs) {
-        this.#db
-            .prepare(`INSERT INTO document_deliveries
-           (owner_agent_id, document_id, envelope_hash, holder_agent_id, attempts, created_at)
-         SELECT e.owner_agent_id, e.document_id, e.envelope_hash, d.peer_agent_id, e.attempts, ?
-           FROM document_envelopes e
-           JOIN documents d
-             ON d.owner_agent_id = e.owner_agent_id AND d.document_id = e.document_id
-          WHERE e.owner_agent_id = ? AND e.sender_agent_id = ?
-            AND e.acked_at IS NULL AND e.abandoned_at IS NULL AND e.kind = 'update'
-            AND NOT EXISTS (
-              SELECT 1 FROM document_deliveries dd
-               WHERE dd.owner_agent_id = e.owner_agent_id AND dd.envelope_hash = e.envelope_hash
-            )
-         ON CONFLICT (owner_agent_id, document_id, envelope_hash, holder_agent_id) DO NOTHING`)
-            .run(nowMs, ownerAgentId, senderAgentId);
-    }
-    /**
-     * THIS holder's settlement of THIS envelope — the per-acker twin of `envelopeSettlement`,
-     * with rejection attribution taken from the rejections-received rows' `from_agent_id`.
-     * Null when the holder has not answered (or has no row — the bilateral-legacy case, where the
-     * envelope-level read is the record).
-     */
-    holderSettlement(ownerAgentId, envelopeHash, holderAgentId) {
+            .prepare(`INSERT INTO document_party_view
+           (owner_agent_id, document_id, party_agent_id, last_exchange_ms, gov_seqs,
+            content_counts, refused)
+         VALUES (?, ?, ?, ?, ?, ?, ?)
+         ON CONFLICT (owner_agent_id, document_id, party_agent_id) DO UPDATE SET
+           last_exchange_ms = excluded.last_exchange_ms,
+           gov_seqs = excluded.gov_seqs,
+           content_counts = excluded.content_counts,
+           refused = excluded.refused`)
+            .run(ownerAgentId, documentId, partyAgentId, nowMs, JSON.stringify(view.govSeqs), JSON.stringify(view.contentCounts), JSON.stringify(view.refused));
+    }
+    partyView(ownerAgentId, documentId, partyAgentId) {
         const r = this.#db
-            .prepare(`SELECT document_id, acked_at FROM document_deliveries
-          WHERE owner_agent_id = ? AND envelope_hash = ? AND holder_agent_id = ?`)
-            .get(ownerAgentId, envelopeHash, holderAgentId);
-        if (!r || r.acked_at == null)
+            .prepare(`SELECT last_exchange_ms, gov_seqs, content_counts, refused FROM document_party_view
+          WHERE owner_agent_id = ? AND document_id = ? AND party_agent_id = ?`)
+            .get(ownerAgentId, documentId, partyAgentId);
+        if (!r)
             return null;
         return {
-            admitted: !this.rejectionReceivedFromFor(ownerAgentId, r.document_id, envelopeHash, holderAgentId),
+            lastExchangeMs: r.last_exchange_ms,
+            govSeqs: JSON.parse(r.gov_seqs),
+            contentCounts: JSON.parse(r.content_counts),
+            refused: JSON.parse(r.refused),
         };
     }
-    /** Was a rejection of this envelope received FROM this specific holder? */
-    rejectionReceivedFromFor(ownerAgentId, documentId, envelopeHash, fromAgentId) {
-        const r = this.#db
-            .prepare(`SELECT 1 FROM document_rejections_received
-          WHERE owner_agent_id = ? AND document_id = ? AND rejected_envelope_hash = ?
-            AND from_agent_id = ?
-          LIMIT 1`)
-            .get(ownerAgentId, documentId, envelopeHash, fromAgentId);
-        return r !== undefined;
-    }
-    /**
-     * ONE deterministic envelope-level terminal rule (FANOUT-1 review M3), applied by every
-     * reconciliation site: once no holder is outstanding, the envelope is ACKED if at least one
-     * holder acked, ABANDONED only when nobody ever answered. Without one rule, identical final
-     * holder states landed as opposite envelope-level facts depending on event order — and
-     * `withdraw`'s "your peer holds it" answered differently for the same reality.
-     */
-    reconcileEnvelopeSettlement(ownerAgentId, documentId, envelopeHash, nowMs) {
-        if (!this.envelopeFullySettled(ownerAgentId, envelopeHash))
-            return;
-        const anyAcked = this.#db
-            .prepare(`SELECT 1 FROM document_deliveries
-          WHERE owner_agent_id = ? AND envelope_hash = ? AND acked_at IS NOT NULL
-          LIMIT 1`)
-            .get(ownerAgentId, envelopeHash);
-        if (anyAcked !== undefined) {
-            this.markAcked(ownerAgentId, documentId, envelopeHash, nowMs);
-        }
-        else {
-            const anyRows = this.#db
-                .prepare(`SELECT 1 FROM document_deliveries WHERE owner_agent_id = ? AND envelope_hash = ? LIMIT 1`)
-                .get(ownerAgentId, envelopeHash);
-            // Zero rows = bilateral legacy — the envelope-level columns are already the record.
-            if (anyRows !== undefined) {
-                this.markAbandoned(ownerAgentId, documentId, envelopeHash, nowMs);
-            }
-        }
-    }
-    /** Does this holder still owe any confirmation on this document? */
-    holderHasPending(ownerAgentId, documentId, holderAgentId) {
-        const r = this.#db
-            .prepare(`SELECT 1 FROM document_deliveries
-          WHERE owner_agent_id = ? AND document_id = ? AND holder_agent_id = ?
-            AND acked_at IS NULL AND abandoned_at IS NULL
-          LIMIT 1`)
-            .get(ownerAgentId, documentId, holderAgentId);
-        return r !== undefined;
-    }
-    pendingDeliveries(ownerAgentId, nowMs, 
-    /**
-     * OUR OWN sender id on the wire — the author's pubkey hex (M14-D5).
-     *
-     * Kept as a separate parameter, and separately named, even though the daemon now scopes the
-     * store by that same pubkey hex so the two coincide. They are different FACTS: the owner key
-     * says whose local store this row is in, the sender id says who signed the envelope. An
-     * earlier version of the daemon scoped by agent name, and the mismatch returned nothing
-     * pending — every published update sitting in the log undelivered, with no error anywhere.
-     * Collapsing them into one argument makes that class of bug unrepresentable in the call and
-     * invisible in the query.
-     */
-    senderAgentId = ownerAgentId, limit = 100) {
-        const rows = this.#db
-            .prepare(`SELECT * FROM document_envelopes
-          WHERE owner_agent_id = ? AND sender_agent_id = ? AND acked_at IS NULL
-            -- ABANDONED rows are not pending. This is what actually stops the worker at the
-            -- unacked ceiling: the selection reads no document STATUS, so setting the document
-            -- stalled changed what the surface said and nothing about what the worker did, and one
-            -- envelope went out 74 times against a cap of 5.
-            AND abandoned_at IS NULL
-            -- UPDATES only. A withdrawal record is local audit — the update it concerns was never
-            -- delivered, so there is nothing for the peer to act on — and a rejection reaches the
-            -- peer through the rejection protocol, not this worker. Without the scope the worker
-            -- would ship both, and the withdrawal would arrive as a reference to an envelope the
-            -- peer has never seen.
-            AND kind = 'update'
-            -- An ENDED document does not deliver. A killed or closed document that kept shipping
-            -- would contradict the verb the operator just used, and the peer would receive updates
-            -- on a collaboration they were told had stopped.
-            AND EXISTS (
-              SELECT 1 FROM documents d
-               WHERE d.owner_agent_id = document_envelopes.owner_agent_id
-                 AND d.document_id = document_envelopes.document_id
-                 AND d.status NOT IN ('killed', 'closed')
-            )
-            AND (next_attempt_at IS NULL OR next_attempt_at <= ?)
-            -- A WITHDRAWN update is not pending. Derived from the withdrawal record rather than a
-            -- flag on the row, so there is one fact in one place: without this the delivery worker
-            -- ships the very update the operator just withdrew.
-            --
-            -- The table is created by DocumentLifecycle, which may not have run — a store used
-            -- without it is a legitimate configuration — so the reference is guarded rather than
-            -- assumed. A missing table would otherwise throw here and take the whole delivery pass
-            -- down with it.
-            AND NOT EXISTS (
-              SELECT 1 FROM document_withdrawals w
-               WHERE w.owner_agent_id = document_envelopes.owner_agent_id
-                 AND w.document_id = document_envelopes.document_id
-                 AND w.envelope_hash = document_envelopes.envelope_hash
-            )
-          -- log_index is PER DOCUMENT, so it alone is not a total order across documents and the
-          -- bounded window could be filled by one document's backlog forever. The tiebreaks make
-          -- the window deterministic; the no-peer branch scheduling its rows is what stops one
-          -- document monopolising it.
-          ORDER BY log_index ASC, document_id ASC, envelope_hash ASC LIMIT ?`)
-            .all(ownerAgentId, senderAgentId, nowMs, limit);
-        return rows.map(toEnvelopeRow);
-    }
-    /** Record that the peer acknowledged. Idempotent — a redelivered ack must not move the clock. */
-    /**
-     * How many of our envelopes for this document were ABANDONED — the unacked ceiling fired and they
-     * will never be retried.
-     *
-     * Surfaced because an abandoned envelope leaves every pending counter, so a document that
-     * permanently dropped an update is otherwise indistinguishable from one that delivered everything.
-     */
-    abandonedCount(ownerAgentId, documentId) {
-        const row = this.#db
-            .prepare(`SELECT COUNT(*) AS n FROM document_envelopes
-          WHERE owner_agent_id = ? AND document_id = ? AND sender_agent_id = ? AND abandoned_at IS NOT NULL`)
-            .get(ownerAgentId, documentId, ownerAgentId);
-        return row?.n ?? 0;
-    }
-    /**
-     * Is this envelope SETTLED — the peer answered it, admitted or rejected?
-     *
-     * Keyed by envelope hash ALONE, without the document, because the caller waiting on it is the
-     * delivery transport, which holds a session open and knows the envelope it sent but has no reason
-     * to carry the document id through the wait. The hash is a sha256 over the envelope's own
-     * preimage, so it identifies one envelope across every document this owner holds.
-     */
-    isEnvelopeAcked(ownerAgentId, envelopeHash) {
-        return this.envelopeSettlement(ownerAgentId, envelopeHash) !== null;
-    }
-    /**
-     * HOW an envelope was settled, or null if the peer has not answered it.
-     *
-     * `admitted` is derived from whether a rejection was RECEIVED for it, because `acked_at` records
-     * only that the peer answered — a rejection is an ack for delivery purposes, so the two states
-     * share that column deliberately (see `DocumentAckInbound`). Reading the answer, not just its
-     * existence, is what lets the delivery worker report `delivered` and `rejected` truthfully rather
-     * than counting every answered envelope as still in flight.
-     */
-    envelopeSettlement(ownerAgentId, envelopeHash) {
-        const row = this.#db
-            .prepare(`SELECT document_id FROM document_envelopes
-          WHERE owner_agent_id = ? AND envelope_hash = ? AND acked_at IS NOT NULL LIMIT 1`)
-            .get(ownerAgentId, envelopeHash);
-        if (row?.document_id === undefined)
-            return null;
-        return { admitted: !this.rejectionReceivedFor(ownerAgentId, row.document_id, envelopeHash) };
-    }
-    /**
-     * WE GAVE UP — the unacked ceiling. Deliberately not `markAcked`: this records a decision of
-     * ours, and says nothing about whether the peer holds the envelope, because we do not know.
-     */
-    markAbandoned(ownerAgentId, documentId, envelopeHash, nowMs) {
-        const info = this.#db
-            .prepare(`UPDATE document_envelopes SET abandoned_at = ?
-          WHERE owner_agent_id = ? AND document_id = ? AND envelope_hash = ?
-            AND acked_at IS NULL AND abandoned_at IS NULL`)
-            .run(nowMs, ownerAgentId, documentId, envelopeHash);
-        return Number(info.changes) > 0;
-    }
-    markAcked(ownerAgentId, documentId, envelopeHash, nowMs) {
-        const info = this.#db
-            .prepare(`UPDATE document_envelopes SET acked_at = ?, delivered_at = COALESCE(delivered_at, ?)
-          WHERE owner_agent_id = ? AND document_id = ? AND envelope_hash = ? AND acked_at IS NULL`)
-            .run(nowMs, nowMs, ownerAgentId, documentId, envelopeHash);
-        return Number(info.changes) > 0;
-    }
     /** Record a rejection the PEER sent us. Returns whether a row was written (idempotent by leaf). */
     recordRejectionReceived(ownerAgentId, row) {
         const info = this.#db
@@ -1517,19 +899,15 @@ function toEnvelopeRow(r) {
         documentId: r["document_id"],
         senderAgentId: r["sender_agent_id"],
         docPrevHash: r["doc_prev_hash"] ?? null,
-        epochId: r["epoch_id"],
         signature: toU8(r["signature"]),
         stateVector: toU8(r["state_vector"]),
         payload: payload === null || payload === undefined ? null : toU8(payload),
+        governanceParents: JSON.parse(r["governance_parents"] ?? "[]"),
         kind: r["kind"],
         senderClientId: r["sender_client_id"] ?? null,
         referencesEnvelopeHash: r["references_hash"] ?? null,
         createdAtMs: r["created_at"],
         logIndex: r["log_index"],
-        deliveredAtMs: r["delivered_at"] ?? null,
-        ackedAtMs: r["acked_at"] ?? null,
-        attempts: r["attempts"] ?? 0,
-        nextAttemptAtMs: r["next_attempt_at"] ?? null,
     };
 }
 /**