@cello-protocol/daemon 0.0.167 → 0.0.169

package/dist/document-delivery-transport.d.ts

@@ -12,12 +12,8 @@
  * because opening is the expensive half — a directory negotiation, a dial, and a seal — and a
  * backlog of pending envelopes for one peer would otherwise pay it per envelope. It is also the
  * behaviour an operator expects when they are mid-conversation about the document: the change lands
- * in the same sealed record as the discussion, without anyone passing a session hint.
- *
- * An explicit `sessionHint` overrides the choice but NOT the validation — a hint naming a session
- * that is not active with this peer is refused rather than silently replaced by the daemon's own
- * pick, because the one reason to pass a hint is to control which sealed record the change lands
- * in, and quietly choosing a different one defeats exactly that.
+ * in the same sealed record as the discussion. (SYNC-D10: the explicit session hint is deleted —
+ * the daemon's reuse-most-recent choice is the whole rule.)
  *
  * ── WHAT AN ACK IS HERE, AND WHAT IT IS NOT ───────────────────────────────────────────────────
  *
@@ -33,8 +29,6 @@
  * permanent-redelivery shape this milestone has already fixed once. The worker records the envelope
  * as delivered, leaves it unacked, and asks again on the capped backoff.
  */
-import type { DocumentDeliveryTransport } from "./document-delivery.js";
-import type { DocumentEnvelopeRow } from "./document-store.js";
 import { DiscoveryUnavailableError } from "./document-reachability.js";
 import type { DiscoveryOutcome } from "./cross-node-negotiation.js";
 import type { Logger } from "./types.js";
@@ -86,52 +80,8 @@ export interface DocumentTransportDeps {
         reason: string;
         error: string;
     }>;
-    /** Encode a document envelope row onto the wire, and its content hash. */
-    encodeEnvelope(envelope: DocumentEnvelopeRow): {
-        bytes: Uint8Array;
-        hash: Uint8Array;
-    };
-    /**
-     * Wait for the peer to ANSWER this envelope, bounded. Resolves true if the ack landed.
-     *
-     * The seal below tears the session down, and the teardown drops any content still held for
-     * ordering — so an ack that arrives correctly and is held for a gap is DELETED rather than
-     * applied. Measured on a live daemon: the ack was sent, logged `session.content.held`, and the
-     * session was destroyed three seconds later with it still buffered. The sender then re-sent the
-     * envelope every tick until the unacked ceiling retired it.
-     *
-     * Waiting here is deliberately indifferent to WHY the answer is slow — held for ordering, a slow
-     * relay, a busy peer. The rule is simply that we do not tear down the channel an answer is due
-     * on until it has arrived or we have given up on it.
-     */
-    /** Waits for THE DIALED HOLDER'S answer — any other holder's ack must not resolve it (H1). */
-    awaitAck(envelopeHash: string, expectedAckerAgentId: string, timeoutMs: number): Promise<{
-        admitted: boolean;
-    } | null>;
-    /**
-     * Try to fill this session's ordering gaps, so anything HELD can be released.
-     *
-     * Without it the grace above cannot help in the very case it was written for. An ack whose
-     * canonical sequence lands ahead of our tree is HELD, and held content is not routed to the
-     * document layer at all — it waits for `#releaseHeld`, which only runs when the missing
-     * in-between sequence arrives. So the ack sits in a buffer, nothing settles, the grace expires in
-     * full, and the seal then discards it. The wait alone converted a fast silent failure into a slow
-     * one.
-     *
-     * A no-op when the session has no gap, so the ordinary delivery pays nothing.
-     */
-    drainHeld(sessionId: string, correlationId: string): Promise<void>;
     logger: Logger;
 }
-/**
- * How long a session WE opened stays up waiting for the peer's answer.
- *
- * Sized against the observed round trip, not guessed: on a live cross-region session the ack was
- * on the wire ~375ms after the frame landed, and the seal ceremony itself takes ~3s. Ten seconds
- * covers a slow relay and a park-and-recover round without keeping an autonomous session alive
- * long enough to be mistaken for a conversation.
- */
-export declare const DELIVERY_ACK_GRACE_MS = 10000;
 /**
  * Everything this transport sends is document-domain traffic, so 0x04 is the default rather than
  * something each call site remembers. A refusal overrides it with 0x05 — the two are distinguished
@@ -145,6 +95,45 @@ export declare const DELIVERY_ACK_GRACE_MS = 10000;
  * this path submitted every document leaf as a MESSAGE.
  */
 export declare const DOCUMENT_LEAF_KIND = 4;
+/**
+ * The document frame carrier (SYNC-P4: D1/D2/D4 deleted — this used to live in the delivery
+ * worker's module). Two capabilities survive: a reachability probe, and putting already-encoded
+ * bytes on a session the transport opens or reuses then seals. There is no `deliver` and no ack
+ * wait — content confirmation is the peer's position at the next reconcile exchange.
+ */
+export interface DocumentDeliveryTransport {
+    /**
+     * Is the peer reachable right now? `discovery_lookup` today. Returns false rather than throwing
+     * for an ordinary "not online"; a throw means the LOOKUP failed, which is a different fact and
+     * must not be recorded as the peer being away.
+     */
+    isPeerReachable(peerAgentId: string, correlationId: string): Promise<{
+        reachable: boolean;
+        unknownAgent: boolean;
+    }>;
+    /**
+     * Send already-encoded bytes to a peer over the open-or-reuse-then-seal path. `documentId` is
+     * for the log line only. `parked: true` means the relay took it because the peer had no live
+     * counterparty — it is NOT with them yet, and only the next exchange proves anything landed.
+     */
+    sendBytes(input: {
+        peerAgentId: string;
+        documentId: string;
+        bytes: Uint8Array;
+        correlationId: string;
+        /** The witnessed leaf DOMAIN. Defaults to the document kind (0x04); a refusal passes 0x05. */
+        leafKind?: number;
+    }): Promise<{
+        ok: true;
+        sessionId: string;
+        sessionOpened: boolean;
+        parked?: boolean;
+    } | {
+        ok: false;
+        reason: string;
+        detail?: string;
+    }>;
+}
 export declare function createDocumentDeliveryTransport(deps: DocumentTransportDeps): DocumentDeliveryTransport;
 export { DiscoveryUnavailableError };
 //# sourceMappingURL=document-delivery-transport.d.ts.map

package/dist/document-delivery-transport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"document-delivery-transport.d.ts","sourceRoot":"","sources":["../src/document-delivery-transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAExE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAA6B,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAClG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAEpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAGzC,MAAM,WAAW,qBAAqB;IACpC;;;;;;OAMG;IACH,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACvG,yEAAyE;IACzE,SAAS,EAAE,MAAM,CAAC;IAClB,4FAA4F;IAC5F,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAClF;;;;;OAKG;IACH,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxF,wDAAwD;IACxD,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACrE,4EAA4E;IAC5E,WAAW,CACT,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/F,wCAAwC;IACxC,WAAW,CACT,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,UAAU,EACnB,WAAW,EAAE,UAAU,EACvB,aAAa,EAAE,MAAM;IACrB,yEAAyE;IACzE,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CACN;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,SAAS,EAAE,IAAI,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GACpD;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,SAAS,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,IAAI,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GACnE;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAC/C,CAAC;IACF,0EAA0E;IAC1E,cAAc,CAAC,QAAQ,EAAE,mBAAmB,GAAG;QAAE,KAAK,EAAE,UAAU,CAAC;QAAC,IAAI,EAAE,UAAU,CAAA;KAAE,CAAC;IACvF;;;;;;;;;;;;OAYG;IACH,8FAA8F;IAC9F,QAAQ,CACN,YAAY,EAAE,MAAM,EACpB,oBAAoB,EAAE,MAAM,EAC5B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACzC;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,QAAS,CAAC;AAE5C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB,IAAgB,CAAC;AAEhD,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,qBAAqB,GAC1B,yBAAyB,CAsS3B;AAED,OAAO,EAAE,yBAAyB,EAAE,CAAC"}
+{"version":3,"file":"document-delivery-transport.d.ts","sourceRoot":"","sources":["../src/document-delivery-transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAGH,OAAO,EAA6B,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAClG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAEpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAGzC,MAAM,WAAW,qBAAqB;IACpC;;;;;;OAMG;IACH,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACvG,yEAAyE;IACzE,SAAS,EAAE,MAAM,CAAC;IAClB,4FAA4F;IAC5F,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAClF;;;;;OAKG;IACH,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxF,wDAAwD;IACxD,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACrE,4EAA4E;IAC5E,WAAW,CACT,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/F,wCAAwC;IACxC,WAAW,CACT,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,UAAU,EACnB,WAAW,EAAE,UAAU,EACvB,aAAa,EAAE,MAAM;IACrB,yEAAyE;IACzE,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CACN;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,SAAS,EAAE,IAAI,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GACpD;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,SAAS,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,IAAI,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GACnE;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAC/C,CAAC;IACF,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB,IAAgB,CAAC;AAEhD;;;;;GAKG;AACH,MAAM,WAAW,yBAAyB;IACxC;;;;OAIG;IACH,eAAe,CACb,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC1D;;;;OAIG;IACH,SAAS,CAAC,KAAK,EAAE;QACf,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,EAAE,UAAU,CAAC;QAClB,aAAa,EAAE,MAAM,CAAC;QACtB,8FAA8F;QAC9F,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CACP;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,GACzE;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CACjD,CAAC;CACH;AAED,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,qBAAqB,GAC1B,yBAAyB,CAwJ3B;AAED,OAAO,EAAE,yBAAyB,EAAE,CAAC"}

package/dist/document-delivery-transport.js

@@ -12,12 +12,8 @@
  * because opening is the expensive half — a directory negotiation, a dial, and a seal — and a
  * backlog of pending envelopes for one peer would otherwise pay it per envelope. It is also the
  * behaviour an operator expects when they are mid-conversation about the document: the change lands
- * in the same sealed record as the discussion, without anyone passing a session hint.
- *
- * An explicit `sessionHint` overrides the choice but NOT the validation — a hint naming a session
- * that is not active with this peer is refused rather than silently replaced by the daemon's own
- * pick, because the one reason to pass a hint is to control which sealed record the change lands
- * in, and quietly choosing a different one defeats exactly that.
+ * in the same sealed record as the discussion. (SYNC-D10: the explicit session hint is deleted —
+ * the daemon's reuse-most-recent choice is the whole rule.)
  *
  * ── WHAT AN ACK IS HERE, AND WHAT IT IS NOT ───────────────────────────────────────────────────
  *
@@ -37,15 +33,6 @@ import { wireContentHash } from "./wire-content-hash.js";
 import { reachabilityFromDiscovery, DiscoveryUnavailableError } from "./document-reachability.js";
 import { LEAF_KIND_DOC } from "./session-relay-client.js";
 import { createSessionSuspects, TERMINAL_ISH_REFUSALS } from "./delivery-session-suspects.js";
-/**
- * How long a session WE opened stays up waiting for the peer's answer.
- *
- * Sized against the observed round trip, not guessed: on a live cross-region session the ack was
- * on the wire ~375ms after the frame landed, and the seal ceremony itself takes ~3s. Ten seconds
- * covers a slow relay and a park-and-recover round without keeping an autonomous session alive
- * long enough to be mistaken for a conversation.
- */
-export const DELIVERY_ACK_GRACE_MS = 10_000;
 /**
  * Everything this transport sends is document-domain traffic, so 0x04 is the default rather than
  * something each call site remembers. A refusal overrides it with 0x05 — the two are distinguished
@@ -85,40 +72,14 @@ export function createDocumentDeliveryTransport(deps) {
         suspects.noteSuccess(sessionId);
     }
     /**
-     * Acquire a session with the peer — the hint, then the most recent active one, then a fresh dial.
+     * Acquire a session with the peer — the most recent active one, else a fresh dial (SYNC-D10).
      *
      * ONE implementation for every document frame kind. A proposal that opened its own session by a
      * separate code path would drift on which session gets reused and on whether a session this
      * daemon opened is sealed, and both are unrecoverable after the fact.
      */
-    async function acquireSession(peerAgentId, sessionHint, correlationId) {
+    async function acquireSession(peerAgentId, correlationId) {
         const active = deps.activeSessionsWith(deps.agentName, peerAgentId);
-        if (sessionHint !== undefined) {
-            if (!active.includes(sessionHint)) {
-                // Refused, not replaced. The only reason to pass a hint is to control which sealed record
-                // the change lands in; quietly substituting the daemon's own pick would defeat exactly
-                // that, and it would do so silently.
-                return {
-                    ok: false,
-                    reason: "document_session_hint_invalid",
-                    detail: `session ${sessionHint.slice(0, 16)}… is not an active session with ${peerAgentId}, ` +
-                        `so the change cannot be placed in that record`,
-                };
-            }
-            if (suspects.isSuspect(sessionHint)) {
-                // HONOURED, NOT SUBSTITUTED — the only reason to pass a hint is to control which sealed
-                // record the change lands in, and quietly picking another session would defeat exactly
-                // that. But a caller aiming at a session whose record is gone should be told.
-                deps.logger.warn("document.delivery.session.hint_suspect", {
-                    peerAgentId,
-                    sessionId: sessionHint,
-                    correlationId,
-                    impact: "this session has answered terminally more than once — the change is being placed in " +
-                        "it as asked, and its record may no longer be growing",
-                });
-            }
-            return { ok: true, sessionId: sessionHint, sessionOpened: false };
-        }
         // Most recent LAST — activeSessionsWith is ordered oldest-first by the daemon's adapter.
         //
         // DOD-MP-SESSION-RETIRE-1 — a session that has answered terminally more than once is skipped
@@ -160,8 +121,8 @@ export function createDocumentDeliveryTransport(deps) {
             return reachabilityFromDiscovery(outcome);
         },
         async sendBytes(input) {
-            const { peerAgentId, documentId, bytes, sessionHint, correlationId } = input;
-            const session = await acquireSession(peerAgentId, sessionHint, correlationId);
+            const { peerAgentId, documentId, bytes, correlationId } = input;
+            const session = await acquireSession(peerAgentId, correlationId);
             if (!session.ok)
                 return session;
             // THE WIRE HASH, domain-separated. This was `sha256(bytes)`, and the receiver recomputes
@@ -222,117 +183,6 @@ export function createDocumentDeliveryTransport(deps) {
                 parked: sent.delivered === false,
             };
         },
-        async deliver(input) {
-            const { peerAgentId, documentId, envelope, sessionHint, correlationId } = input;
-            const session = await acquireSession(peerAgentId, sessionHint, correlationId);
-            if (!session.ok)
-                return session;
-            const { sessionId, sessionOpened } = session;
-            const { bytes, hash } = deps.encodeEnvelope(envelope);
-            const sent = await deps.sendContent(deps.agentName, sessionId, bytes, hash, correlationId, DOCUMENT_LEAF_KIND);
-            // DOD-MP-SESSION-RETIRE-1 — same accounting on the envelope path. Both paths acquire through
-            // `acquireSession`, so a session judged on one is skipped by the other; splitting the record
-            // would let a session that keeps refusing envelopes still be picked for the next frame.
-            noteSendOutcome(sessionId, sent);
-            if (sent.ok)
-                deps.appendLeaf(deps.agentName, sessionId, hash, correlationId);
-            if (!sent.ok) {
-                // SEAL WHAT WE OPENED, on the failure path too. This branch walked away from a session it
-                // had just dialled — a live node the operator never started, with no sealed record, which
-                // is precisely what the rule twenty lines below says the seal exists to prevent. A failed
-                // send is when it is most likely to happen, not least.
-                if (sessionOpened)
-                    await deps.sealSession(deps.agentName, sessionId, correlationId);
-                return { ok: false, reason: sent.reason, detail: sent.error };
-            }
-            deps.logger.info("document.delivery.sent", {
-                documentId,
-                sessionId,
-                sessionOpened,
-                parked: sent.delivered === false,
-                correlationId,
-            });
-            // SEAL what we opened. §16.4: the autonomous session still happens because it carries
-            // signing, encryption and the seal — the ceremony goes to zero, the seal does not. A session
-            // this adapter opened and walked away from is a live node the operator never started, and
-            // the sealed record the design exists to produce is never produced. A session we REUSED is
-            // not ours to close: its owner decides when that conversation ends.
-            // PARKED CONTENT CANNOT BE ACKED, so waiting for one is spending the pass budget on a
-            // certainty. `delivered: false` means the peer was offline and the relay took the frame; the
-            // ack comes whenever they next come online, which is not within any grace. Waiting here also
-            // fired `ack_grace_expired` on a designed, benign state — a warning on the normal case.
-            const answerPossible = sent.delivered !== false;
-            // The peer's ANSWER, when one arrives inside the grace. Reported back as `admitted` so the
-            // worker records a settled delivery instead of an in-flight one.
-            let settlement = null;
-            if (sessionOpened && answerPossible && input.ackGraceMs > 0) {
-                // WAIT FOR THE ANSWER BEFORE TEARING DOWN THE CHANNEL IT COMES BACK ON.
-                //
-                // The seal destroys the session, and the teardown drops content still held for ordering.
-                // Sealing straight after the send therefore raced the peer's ack and, on a real network,
-                // lost: 90 re-sends of one envelope against a ceiling of 5.
-                //
-                // A REUSED session is untouched by this — it is not ours to close, so its owner keeps it
-                // alive and the ack has all the time it needs. That asymmetry is exactly why every spine
-                // enforcer passed: they open a conversation first, so the worker always reused one.
-                // The SMALLER of this envelope's share and the standard grace. The caller spends a budget
-                // across the whole sweep pass; see DELIVERY_ACK_GRACE_BUDGET_MS.
-                const graceMs = Math.min(DELIVERY_ACK_GRACE_MS, input.ackGraceMs);
-                // UNSTICK BEFORE WAITING. If the ack is already sitting in the hold buffer, no amount of
-                // waiting produces it — the release is driven by the missing sequence arriving, not by
-                // time. Ordering-complete sessions return immediately.
-                // CONTAINED. A drain failure must not fail a delivery whose content has already left — the
-                // same contract the ack itself has. Uncontained, a relay hiccup during the drain would
-                // surface as `document_delivery_threw` and re-send content the peer already holds.
-                await deps.drainHeld(sessionId, correlationId).catch((err) => {
-                    deps.logger.warn("document.delivery.drain_threw", {
-                        documentId,
-                        sessionId,
-                        correlationId,
-                        reason: err instanceof Error ? err.message : String(err),
-                    });
-                });
-                settlement = await deps.awaitAck(envelope.envelopeHash, input.peerAgentId, graceMs);
-                if (!settlement) {
-                    // NOT a failure of the send — the content left and the peer may still answer later. Said
-                    // out loud because a seal that discards a held ack is otherwise invisible, and this is
-                    // the only moment anything knows it is about to happen.
-                    deps.logger.warn("document.delivery.ack_grace_expired", {
-                        documentId,
-                        envelopeHash: envelope.envelopeHash,
-                        sessionId,
-                        graceMs,
-                        correlationId,
-                    });
-                }
-            }
-            // SEAL WHAT WE OPENED — unconditionally, whether or not we waited. The wait is about giving
-            // an answer time to arrive; the seal is about never leaving an autonomous session running.
-            // Making the seal conditional on the wait would trade one defect for a worse one.
-            if (sessionOpened) {
-                await deps.sealSession(deps.agentName, sessionId, correlationId);
-            }
-            // SENT, NOT ACKED — `admitted: null`. The content left (or was parked for an offline peer),
-            // which is a transport fact; the DoD's ack is the peer's daemon confirming admission, and
-            // that answer comes from the inbound document handler, which is its own line.
-            //
-            // Neither of the two-valued answers is available honestly. `true` would mark the envelope
-            // acknowledged in the log while the peer may never have applied it — and the log being right
-            // about what the peer holds is the entire reason pending is derived from it. `false` would
-            // count a send that WORKED as a failure and re-send content already in flight, which is the
-            // permanent-redelivery shape this milestone already fixed once.
-            // THE ANSWER IF WE HAVE IT. `null` still means "left, unanswered" — the honest third state —
-            // but an ack that landed inside the grace is no longer thrown away as if it had not.
-            return {
-                ok: true,
-                sessionId,
-                sessionOpened,
-                admitted: settlement ? settlement.admitted : null,
-                // PARKED, reported rather than inferred. The worker cannot tell it from an ordinary
-                // awaiting-answer send otherwise, and the two need different retry schedules.
-                parked: sent.delivered === false,
-            };
-        },
     };
 }
 export { DiscoveryUnavailableError };

package/dist/document-delivery-transport.js.map

@@ -1 +1 @@
-{"version":3,"file":"document-delivery-transport.js","sourceRoot":"","sources":["../src/document-delivery-transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAElG,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE1D,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAiF9F;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAE5C;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAAC;AAEhD,MAAM,UAAU,+BAA+B,CAC7C,IAA2B;IAE3B,8FAA8F;IAC9F,6FAA6F;IAC7F,iGAAiG;IACjG,MAAM,QAAQ,GAAG,qBAAqB,EAAE,CAAC;IAEzC;;;;;;;OAOG;IACH,SAAS,eAAe,CACtB,SAAiB,EACjB,IAEiD;QAEjD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,IAAI,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;gBAAE,QAAQ,CAAC,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YACpF,QAAQ,CAAC,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QACD,QAAQ,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,UAAU,cAAc,CAC3B,WAAmB,EACnB,WAA+B,EAC/B,aAAqB;QAKrB,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QACpE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBAClC,0FAA0F;gBAC1F,uFAAuF;gBACvF,qCAAqC;gBACrC,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,+BAA+B;oBACvC,MAAM,EACJ,WAAW,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,mCAAmC,WAAW,IAAI;wBACrF,+CAA+C;iBAClD,CAAC;YACJ,CAAC;YACD,IAAI,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC;gBACpC,wFAAwF;gBACxF,uFAAuF;gBACvF,8EAA8E;gBAC9E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE;oBACzD,WAAW;oBACX,SAAS,EAAE,WAAW;oBACtB,aAAa;oBACb,MAAM,EACJ,sFAAsF;wBACtF,sDAAsD;iBACzD,CAAC,CAAC;YACL,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;QACpE,CAAC;QACD,yFAAyF;QACzF,EAAE;QACF,6FAA6F;QAC7F,sFAAsF;QACtF,6FAA6F;QAC7F,+FAA+F;QAC/F,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;QAChE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;QACvF,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE;gBACrD,WAAW;gBACX,OAAO,EAAE,MAAM,CAAC,MAAM;gBACtB,aAAa;gBACb,MAAM,EACJ,wFAAwF;oBACxF,6CAA6C;aAChD,CAAC,CAAC;QACL,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;QAClF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,oFAAoF;YACpF,wEAAwE;YACxE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;QACvE,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IACxE,CAAC;IAED,OAAO;QACL,KAAK,CAAC,eAAe,CAAC,WAAmB,EAAE,aAAqB;YAC9D,2FAA2F;YAC3F,0FAA0F;YAC1F,6FAA6F;YAC7F,2BAA2B;YAC3B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;YAClE,4FAA4F;YAC5F,6FAA6F;YAC7F,2FAA2F;YAC3F,sCAAsC;YACtC,OAAO,yBAAyB,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,KAAK;YACnB,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC;YAC7E,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,WAAW,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;YAC9E,IAAI,CAAC,OAAO,CAAC,EAAE;gBAAE,OAAO,OAAO,CAAC;YAEhC,yFAAyF;YACzF,2FAA2F;YAC3F,yFAAyF;YACzF,4FAA4F;YAC5F,oDAAoD;YACpD,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;YACpC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,CAAC,QAAQ,IAAI,kBAAkB,CAAC,CAAC;YACzI,6FAA6F;YAC7F,EAAE;YACF,6FAA6F;YAC7F,yFAAyF;YACzF,8FAA8F;YAC9F,2FAA2F;YAC3F,+CAA+C;YAC/C,eAAe,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACb,4FAA4F;gBAC5F,2FAA2F;gBAC3F,sCAAsC;gBACtC,IAAI,OAAO,CAAC,aAAa;oBAAE,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;gBACpG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;YAChE,CAAC;YACD,6EAA6E;YAC7E,EAAE;YACF,8FAA8F;YAC9F,6FAA6F;YAC7F,6FAA6F;YAC7F,8FAA8F;YAC9F,8DAA8D;YAC9D,EAAE;YACF,2FAA2F;YAC3F,yFAAyF;YACzF,0FAA0F;YAC1F,SAAS;YACT,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;YACxE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE;gBACtC,UAAU;gBACV,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,KAAK,EAAE,KAAK,CAAC,MAAM;gBACnB,MAAM,EAAE,IAAI,CAAC,SAAS,KAAK,KAAK;gBAChC,aAAa;aACd,CAAC,CAAC;YACH,IAAI,OAAO,CAAC,aAAa;gBAAE,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;YACpG,8FAA8F;YAC9F,6FAA6F;YAC7F,8FAA8F;YAC9F,8FAA8F;YAC9F,wCAAwC;YACxC,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,MAAM,EAAE,IAAI,CAAC,SAAS,KAAK,KAAK;aACjC,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,KAAK;YACjB,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC;YAEhF,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,WAAW,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;YAC9E,IAAI,CAAC,OAAO,CAAC,EAAE;gBAAE,OAAO,OAAO,CAAC;YAChC,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC;YAE7C,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YACtD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,kBAAkB,CAAC,CAAC;YAC/G,6FAA6F;YAC7F,6FAA6F;YAC7F,wFAAwF;YACxF,eAAe,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACjC,IAAI,IAAI,CAAC,EAAE;gBAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;YAC7E,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACb,0FAA0F;gBAC1F,0FAA0F;gBAC1F,0FAA0F;gBAC1F,uDAAuD;gBACvD,IAAI,aAAa;oBAAE,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;gBACpF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;YAChE,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE;gBACzC,UAAU;gBACV,SAAS;gBACT,aAAa;gBACb,MAAM,EAAE,IAAI,CAAC,SAAS,KAAK,KAAK;gBAChC,aAAa;aACd,CAAC,CAAC;YAEH,sFAAsF;YACtF,6FAA6F;YAC7F,0FAA0F;YAC1F,2FAA2F;YAC3F,oEAAoE;YACpE,sFAAsF;YACtF,6FAA6F;YAC7F,6FAA6F;YAC7F,wFAAwF;YACxF,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC;YAChD,2FAA2F;YAC3F,iEAAiE;YACjE,IAAI,UAAU,GAAiC,IAAI,CAAC;YACpD,IAAI,aAAa,IAAI,cAAc,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;gBAC5D,wEAAwE;gBACxE,EAAE;gBACF,yFAAyF;gBACzF,yFAAyF;gBACzF,4DAA4D;gBAC5D,EAAE;gBACF,yFAAyF;gBACzF,yFAAyF;gBACzF,oFAAoF;gBACpF,0FAA0F;gBAC1F,iEAAiE;gBACjE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;gBAClE,yFAAyF;gBACzF,uFAAuF;gBACvF,uDAAuD;gBACvD,2FAA2F;gBAC3F,uFAAuF;gBACvF,mFAAmF;gBACnF,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;oBACpE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;wBAChD,UAAU;wBACV,SAAS;wBACT,aAAa;wBACb,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;qBACzD,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;gBACH,UAAU,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;gBACpF,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,yFAAyF;oBACzF,uFAAuF;oBACvF,wDAAwD;oBACxD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE;wBACtD,UAAU;wBACV,YAAY,EAAE,QAAQ,CAAC,YAAY;wBACnC,SAAS;wBACT,OAAO;wBACP,aAAa;qBACd,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,4FAA4F;YAC5F,2FAA2F;YAC3F,kFAAkF;YAClF,IAAI,aAAa,EAAE,CAAC;gBAClB,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;YACnE,CAAC;YAED,4FAA4F;YAC5F,0FAA0F;YAC1F,8EAA8E;YAC9E,EAAE;YACF,0FAA0F;YAC1F,6FAA6F;YAC7F,2FAA2F;YAC3F,4FAA4F;YAC5F,gEAAgE;YAChE,6FAA6F;YAC7F,qFAAqF;YACrF,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,SAAS;gBACT,aAAa;gBACb,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;gBACjD,oFAAoF;gBACpF,8EAA8E;gBAC9E,MAAM,EAAE,IAAI,CAAC,SAAS,KAAK,KAAK;aACjC,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,yBAAyB,EAAE,CAAC"}
+{"version":3,"file":"document-delivery-transport.js","sourceRoot":"","sources":["../src/document-delivery-transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAElG,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE1D,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AA+C9F;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAAC;AAoChD,MAAM,UAAU,+BAA+B,CAC7C,IAA2B;IAE3B,8FAA8F;IAC9F,6FAA6F;IAC7F,iGAAiG;IACjG,MAAM,QAAQ,GAAG,qBAAqB,EAAE,CAAC;IAEzC;;;;;;;OAOG;IACH,SAAS,eAAe,CACtB,SAAiB,EACjB,IAEiD;QAEjD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,IAAI,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;gBAAE,QAAQ,CAAC,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YACpF,QAAQ,CAAC,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QACD,QAAQ,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,UAAU,cAAc,CAC3B,WAAmB,EACnB,aAAqB;QAKrB,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QACpE,yFAAyF;QACzF,EAAE;QACF,6FAA6F;QAC7F,sFAAsF;QACtF,6FAA6F;QAC7F,+FAA+F;QAC/F,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;QAChE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;QACvF,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE;gBACrD,WAAW;gBACX,OAAO,EAAE,MAAM,CAAC,MAAM;gBACtB,aAAa;gBACb,MAAM,EACJ,wFAAwF;oBACxF,6CAA6C;aAChD,CAAC,CAAC;QACL,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;QAClF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,oFAAoF;YACpF,wEAAwE;YACxE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;QACvE,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IACxE,CAAC;IAED,OAAO;QACL,KAAK,CAAC,eAAe,CAAC,WAAmB,EAAE,aAAqB;YAC9D,2FAA2F;YAC3F,0FAA0F;YAC1F,6FAA6F;YAC7F,2BAA2B;YAC3B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;YAClE,4FAA4F;YAC5F,6FAA6F;YAC7F,2FAA2F;YAC3F,sCAAsC;YACtC,OAAO,yBAAyB,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,KAAK;YACnB,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC;YAChE,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;YACjE,IAAI,CAAC,OAAO,CAAC,EAAE;gBAAE,OAAO,OAAO,CAAC;YAEhC,yFAAyF;YACzF,2FAA2F;YAC3F,yFAAyF;YACzF,4FAA4F;YAC5F,oDAAoD;YACpD,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;YACpC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,CAAC,QAAQ,IAAI,kBAAkB,CAAC,CAAC;YACzI,6FAA6F;YAC7F,EAAE;YACF,6FAA6F;YAC7F,yFAAyF;YACzF,8FAA8F;YAC9F,2FAA2F;YAC3F,+CAA+C;YAC/C,eAAe,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACb,4FAA4F;gBAC5F,2FAA2F;gBAC3F,sCAAsC;gBACtC,IAAI,OAAO,CAAC,aAAa;oBAAE,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;gBACpG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;YAChE,CAAC;YACD,6EAA6E;YAC7E,EAAE;YACF,8FAA8F;YAC9F,6FAA6F;YAC7F,6FAA6F;YAC7F,8FAA8F;YAC9F,8DAA8D;YAC9D,EAAE;YACF,2FAA2F;YAC3F,yFAAyF;YACzF,0FAA0F;YAC1F,SAAS;YACT,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;YACxE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE;gBACtC,UAAU;gBACV,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,KAAK,EAAE,KAAK,CAAC,MAAM;gBACnB,MAAM,EAAE,IAAI,CAAC,SAAS,KAAK,KAAK;gBAChC,aAAa;aACd,CAAC,CAAC;YACH,IAAI,OAAO,CAAC,aAAa;gBAAE,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;YACpG,8FAA8F;YAC9F,6FAA6F;YAC7F,8FAA8F;YAC9F,8FAA8F;YAC9F,wCAAwC;YACxC,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,MAAM,EAAE,IAAI,CAAC,SAAS,KAAK,KAAK;aACjC,CAAC;QACJ,CAAC;KAEF,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,yBAAyB,EAAE,CAAC"}

package/dist/document-frame-router.d.ts

@@ -67,7 +67,6 @@
  * The guard must never again be described as what makes hostile input safe. It was, and it was not.
  */
 import type { DocumentInbound } from "./document-inbound.js";
-import type { DocumentAckInbound } from "./document-ack-inbound.js";
 import type { Logger } from "./types.js";
 /**
  * What the session layer should do with the frame.
@@ -76,7 +75,7 @@ import type { Logger } from "./types.js";
  * message and fires the doorbell exactly as before. Nothing about the conversation path changes.
  */
 /** Every document frame kind that can arrive on the session channel. */
-export type DocumentFrameKind = "update" | "ack" | "proposal" | "rejection" | "proposal_ack" | "control" | "join_offer" | "join_answer" | "amendment";
+export type DocumentFrameKind = "update" | "proposal" | "rejection" | "proposal_ack" | "amendment" | "reconcile";
 export type FrameRouting = {
     consumed: false;
 } | {
@@ -101,7 +100,6 @@ export type FrameClassification = {
 };
 export interface DocumentFrameRouterDeps {
     inbound: DocumentInbound;
-    ackInbound: DocumentAckInbound;
     /**
      * Record an arriving PROPOSAL. Without this a proposal frame is not document traffic as far as
      * the router is concerned, so it falls through to the conversation path and lands in the
@@ -121,14 +119,10 @@ export interface DocumentFrameRouterDeps {
      * conversation path and the operator keeps publishing into a document that will never answer,
      * with nothing on their screen explaining why.
      */
-    recordControl(ownerAgentId: string, wire: Uint8Array, nowMs: number): void;
     /**
      * M14B / DOD-MP-JOIN-1 — an admin's offer to a third party. Validated (the invitee REPLAYS the
      * carried bytes) and recorded — pending or refused-with-reason, never dropped.
      */
-    recordJoinOffer(ownerAgentId: string, wire: Uint8Array, nowMs: number): void;
-    /** The invitee's signed answer to an offer we authored. Settle-once. */
-    recordJoinAnswer(ownerAgentId: string, wire: Uint8Array, nowMs: number): void;
     /**
      * An amendment reaching an EXISTING holder — validated against our own chain
      * (validate-before-append) and appended, so our derived participant set does not silently
@@ -136,6 +130,16 @@ export interface DocumentFrameRouterDeps {
      * gate makes a missed one loud.
      */
     recordAmendment(ownerAgentId: string, wire: Uint8Array, nowMs: number): void;
+    /**
+     * SYNC-P3 — answer (or absorb) a reconcile exchange. Needs the SESSION's authenticated sender:
+     * the frame is unsigned by design, and entitlement (R17/R18) is a question about who is
+     * ASKING, which only the transport identity can answer. Everything the frame carries is still
+     * individually signed and verified on apply.
+     */
+    handleReconcile(ownerAgentId: string, wire: Uint8Array, senderAgentId: string, nowMs: number, correlationId: string): Promise<{
+        ok: boolean;
+        reason?: string;
+    }>;
     /**
      * Tell the sender what happened to their envelope — admitted or refused, both of which SETTLE it.
      *
@@ -163,14 +167,6 @@ export interface DocumentFrameRouterDeps {
     noticeInboundUpdate(ownerAgentId: string, inResponseTo: Uint8Array): void;
     /** Put an already-signed frame on the wire to whoever authored `wire` — the rejection, today. */
     sendFrameToPeer(ownerAgentId: string, inResponseTo: Uint8Array, bytes: Uint8Array): Promise<void>;
-    sendAck(ownerAgentId: string, 
-    /** The envelope as it arrived — the document id and the party to answer are both inside it. */
-    wire: Uint8Array, outcome: {
-        envelopeHash: string;
-        admitted: boolean;
-        rejectionReason?: string;
-        correlationId: string;
-    }): Promise<void>;
     /**
      * Map the daemon's AGENT NAME — the only identifier the session content path carries — to the
      * stable owner key every document row is scoped by (M14-D5: our own K_local pubkey hex).
@@ -209,9 +205,9 @@ export declare class DocumentFrameRouter {
      * a per-document queue — see `#handle` — so the caller never waits and frames for one document
      * never overtake each other.
      */
-    routeSync(agentName: string, content: Uint8Array, nowMs: number, correlationId: string): FrameClassification;
+    routeSync(agentName: string, content: Uint8Array, nowMs: number, correlationId: string, senderAgentId?: string): FrameClassification;
     /** Classify and handle, awaiting the outcome. The path a caller takes when it wants the verdict. */
-    route(ownerAgentId: string, content: Uint8Array, nowMs: number, correlationId: string): Promise<FrameRouting>;
+    route(ownerAgentId: string, content: Uint8Array, nowMs: number, correlationId: string, senderAgentId?: string): Promise<FrameRouting>;
 }
 /**
  * The largest field count a document frame can declare. The update envelope has 10 fields and the

package/dist/document-frame-router.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"document-frame-router.d.ts","sourceRoot":"","sources":["../src/document-frame-router.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AAcH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC;;;;;GAKG;AACH,wEAAwE;AACxE,MAAM,MAAM,iBAAiB,GACzB,QAAQ,GACR,KAAK,GACL,UAAU,GACV,WAAW,GACX,cAAc,GACd,SAAS,GACT,YAAY,GACZ,aAAa,GACb,WAAW,CAAC;AAEhB,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,EAAE,KAAK,CAAA;CAAE,GACnB;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,iBAAiB,CAAC;IAAC,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9E;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IAAE,QAAQ,EAAE,KAAK,CAAA;CAAE,GACnB;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,iBAAiB,CAAA;CAAE,CAAC;AAEhD,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,eAAe,CAAC;IACzB,UAAU,EAAE,kBAAkB,CAAC;IAC/B;;;;;OAKG;IACH,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5E,wEAAwE;IACxE,eAAe,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7E;;;OAGG;IACH,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/E;;;;OAIG;IACH,aAAa,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3E;;;OAGG;IACH,eAAe,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7E,wEAAwE;IACxE,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9E;;;;;OAKG;IACH,eAAe,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7E;;;;;OAKG;IACH;;;;;;OAMG;IACH,WAAW,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E;;;;;;;;;OASG;IACH,mBAAmB,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,GAAG,IAAI,CAAC;IAC1E,iGAAiG;IACjG,eAAe,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClG,OAAO,CACL,YAAY,EAAE,MAAM;IACpB,+FAA+F;IAC/F,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE;QACP,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,OAAO,CAAC;QAClB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,aAAa,EAAE,MAAM,CAAC;KACvB,GACA,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB;;;;;;;;;;;;;;;;OAgBG;IACH,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC9C,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,mBAAmB;;gBAKlB,IAAI,EAAE,uBAAuB;IAIzC;;;;;;;OAOG;IACH;;;;;;OAMG;IACH,SAAS,CACP,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,UAAU,EACnB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,GACpB,mBAAmB;IA2EtB,oGAAoG;IAC9F,KAAK,CACT,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,UAAU,EACnB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,YAAY,CAAC;CAuKzB;AAED;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAE5C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB,QAAkB,CAAC"}
+{"version":3,"file":"document-frame-router.d.ts","sourceRoot":"","sources":["../src/document-frame-router.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AAWH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEzC;;;;;GAKG;AACH,wEAAwE;AACxE,MAAM,MAAM,iBAAiB,GACzB,QAAQ,GACR,UAAU,GACV,WAAW,GACX,cAAc,GACd,WAAW,GACX,WAAW,CAAC;AAEhB,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,EAAE,KAAK,CAAA;CAAE,GACnB;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,iBAAiB,CAAC;IAAC,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9E;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IAAE,QAAQ,EAAE,KAAK,CAAA;CAAE,GACnB;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,iBAAiB,CAAA;CAAE,CAAC;AAEhD,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,eAAe,CAAC;IACzB;;;;;OAKG;IACH,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5E,wEAAwE;IACxE,eAAe,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7E;;;OAGG;IACH,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/E;;;;OAIG;IACH;;;OAGG;IACH;;;;;OAKG;IACH,eAAe,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7E;;;;;OAKG;IACH,eAAe,CACb,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,UAAU,EAChB,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7C;;;;;OAKG;IACH;;;;;;OAMG;IACH,WAAW,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E;;;;;;;;;OASG;IACH,mBAAmB,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,GAAG,IAAI,CAAC;IAC1E,iGAAiG;IACjG,eAAe,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClG;;;;;;;;;;;;;;;;OAgBG;IACH,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC9C,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,mBAAmB;;gBAKlB,IAAI,EAAE,uBAAuB;IAIzC;;;;;;;OAOG;IACH;;;;;;OAMG;IACH,SAAS,CACP,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,UAAU,EACnB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EACrB,aAAa,SAAK,GACjB,mBAAmB;IA8EtB,oGAAoG;IAC9F,KAAK,CACT,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,UAAU,EACnB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EACrB,aAAa,SAAK,GACjB,OAAO,CAAC,YAAY,CAAC;CA2GzB;AAED;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAE5C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB,QAAkB,CAAC"}