@cello-protocol/daemon 0.0.168 → 0.0.170

package/dist/document-layer.js

@@ -21,7 +21,6 @@
  * would be a default answer to "is this authentic", and both inbound paths refuse rather than
  * admit when it says no.
  */
-import { createHash } from "node:crypto";
 import { verify } from "@cello-protocol/crypto";
 import { DocumentStore } from "./document-store.js";
 import { DocumentEngine } from "./document-engine.js";
@@ -29,9 +28,7 @@ import { DocumentGate } from "./document-gate.js";
 import { screeningRule, SCREEN_RULE_ID } from "./document-screen.js";
 import { DocumentRejections } from "./document-rejection.js";
 import { DocumentInbound } from "./document-inbound.js";
-import { DocumentAckInbound } from "./document-ack-inbound.js";
 import { DocumentAmendmentStore } from "./document-amendment-store.js";
-import { DocumentJoinStore } from "./document-join-store.js";
 import { DocumentFrameRouter } from "./document-frame-router.js";
 import { LiveDocuments } from "./document-live-docs.js";
 import { DocumentLifecycle } from "./document-lifecycle.js";
@@ -41,8 +38,9 @@ import { projectDocumentText } from "./document-json.js";
 import { rootForDocumentType } from "./document-types.js";
 import { DocumentHandshake } from "./document-handshake.js";
 import { DocumentWritePath } from "./document-write-path.js";
-import { decodeDocumentRejection, buildDocumentRejectionTbs, documentRejectionHash, decodeDocumentProposalAck, buildDocumentProposalAckTbs, decodeDocumentControl, buildDocumentControlTbs, decodeDocumentUpdateEnvelope, buildDocumentUpdateTbs, documentEnvelopeHash, buildDocumentJoinAnswerTbs, encodeDocumentJoinAnswer, buildDocumentJoinOfferTbs, decodeDocumentJoinOffer, decodeDocumentAmendment, decodeDocumentProposal, encodeDocumentProposalAck, DOCUMENT_PROPOSAL_ACK_VERSION, MAX_PROPOSAL_REFUSAL_REASON_LENGTH, documentAmendmentHash, validateDocumentJoinOffer, documentGovernancePolicy, arrangementGenesisFromProposal, deriveArrangement, encodeDocumentAck, buildDocumentAckTbs, } from "@cello-protocol/protocol-types";
+import { decodeDocumentRejection, buildDocumentRejectionTbs, documentRejectionHash, decodeDocumentProposalAck, buildDocumentProposalAckTbs, decodeDocumentUpdateEnvelope, encodeDocumentAmendment, decodeDocumentAmendment, decodeDocumentProposal, encodeDocumentProposal, documentIdFromProposal, buildDocumentProposalTbs, encodeDocumentProposalAck, DOCUMENT_PROPOSAL_ACK_VERSION, MAX_PROPOSAL_REFUSAL_REASON_LENGTH, documentAmendmentHash, documentGovernancePolicy, arrangementGenesisFromProposal, deriveDocumentState, deriveDocumentStateAt, checkEntryAdmissible, decodeDocumentReconcile, encodeDocumentReconcile, DOCUMENT_RECONCILE_EXCHANGE_VERSION, } from "@cello-protocol/protocol-types";
 import { LEAF_KIND_REJECT } from "./session-relay-client.js";
+import { buildReconcileBlock, respondToReconcile, } from "./document-reconcile-engine.js";
 /**
  * The default `publicKeyFor`: a remote agent's id IS its K_local public key, hex-encoded (M14-D5).
  *
@@ -84,22 +82,16 @@ export function createDocumentLayer(deps) {
         const record = handshake.get(ownerAgentId, documentId);
         return record?.envelope.starting_content ?? null;
     });
-    const lifecycle = new DocumentLifecycle(store, logger, { notifyPeer: deps.notifyPeer }, deps.rollback, undefined, 
-    // DOD-MP-CONTROL-N-1 — the inbound gate. `holdersFor` is declared below and resolved lazily,
-    // the same shape `live` uses above; the gate is only ever called long after construction.
-    // Wired HERE rather than left to the daemon so every consumer of the layer — including the
-    // e2e fixture — gets the real derivation and cannot silently keep the bilateral gate.
+    const lifecycle = new DocumentLifecycle(store, logger, 
+    // SYNC-D8 — "was this owner written out?" answered by the same fold as everything else.
+    (ownerAgentId, documentId) => standingOf(ownerAgentId, documentId, ownerAgentId) === "removed", 
+    // Review F2 — "is it ended?" answered by the fold too; `derived: false` hands the pre-pivot
+    // bilateral record back to its column.
     (ownerAgentId, documentId) => {
-        // LEGACY vs UNKNOWN, decided HERE because only this scope can tell them apart: no genesis
-        // record means no chain at all — a bilateral document predating amendments, for which the
-        // peer column IS the membership. A genesis record whose chain will not replay is a different
-        // fact, and one this daemon must not paper over by assuming two parties.
-        if (!handshake.get(ownerAgentId, documentId))
-            return { kind: "legacy" };
-        const holders = holdersFor(ownerAgentId, documentId);
-        return holders === null
-            ? { kind: "unknown", reason: "document_chain_underivable" }
-            : { kind: "derived", holders };
+        const derived = reconcileReads(ownerAgentId).deriveState(documentId);
+        return derived.ok
+            ? { derived: true, ended: derived.state.ended }
+            : { derived: false, ended: null };
     });
     const notifications = new DocumentNotifications(store, logger);
     // THE FILE SURFACE. Built, tested and instantiated NOWHERE until now — the same defect the tool
@@ -134,68 +126,34 @@ export function createDocumentLayer(deps) {
         logger,
         verifySignature,
         liveDocFor: (ownerAgentId, documentId) => live.get(ownerAgentId, documentId),
-        membershipOf: (ownerAgentId, documentId, agentId) => amendments.membershipOf(ownerAgentId, documentId, agentId),
-        currentHolders: (ownerAgentId, documentId) => holdersFor(ownerAgentId, documentId),
-        sign: deps.sign,
-    });
-    // WAITERS for `awaitAck`, keyed by owner + envelope. A Set per key because two callers may wait
-    // on the same envelope (a redelivery racing the original), and dropping one of them would leave a
-    // session held open for the full grace period with the answer already in hand.
-    // KEYED BY ACKER TOO (FANOUT-1 review H1): an envelope-keyed waiter let ANY holder's ack —
-    // including a redelivered one from an already-settled holder — resolve the grace wait for
-    // whichever holder was being dialed, and the worker then settled the DIALED holder's row for
-    // content that never reached them. §7-1's silent divergence, through the sender's own
-    // bookkeeping.
-    const ackWaiters = new Map();
-    const waiterKey = (ownerAgentId, envelopeHash, ackerAgentId) => `${ownerAgentId}\u0000${envelopeHash}\u0000${ackerAgentId}`;
-    const ackInbound = new DocumentAckInbound({
-        store,
-        rejections,
-        logger,
-        verifySignature,
-        currentHolders: (o, d) => holdersFor(o, d),
-        onSettled: (ownerAgentId, envelopeHash, ackerAgentId, admitted) => {
-            const key = waiterKey(ownerAgentId, envelopeHash, ackerAgentId);
-            const waiting = ackWaiters.get(key);
-            if (!waiting)
-                return;
-            ackWaiters.delete(key);
-            // The OUTCOME, not just the fact of one. A caller told only "answered" has to report the
-            // envelope as still in flight, which is how `document.delivery.sweep { delivered: N }` came
-            // to be permanently 0 — a sweep that delivered nothing looked identical to a healthy one.
-            for (const wake of waiting)
-                wake(admitted);
+        standingOf: (ownerAgentId, documentId, agentId) => standingOf(ownerAgentId, documentId, agentId),
+        // The CONTENT door: strictly participants (R17 — invited seats receive, never author).
+        currentHolders: (ownerAgentId, documentId) => participantsFor(ownerAgentId, documentId),
+        // SYNC-G1 — the world an envelope's signed frontier names (R20's input for the causal gate).
+        deriveAtFrontier: (ownerAgentId, documentId, frontier) => {
+            const record = handshake.get(ownerAgentId, documentId);
+            if (!record)
+                return { ok: false, reason: "document_genesis_missing" };
+            try {
+                const at = deriveDocumentStateAt(arrangementGenesisFromProposal(record.envelope), amendments.chain(ownerAgentId, documentId), frontier, documentGovernancePolicy, verifySignature);
+                if (!at.ok)
+                    return { ok: false, reason: at.reason, missing: at.missing };
+                return {
+                    ok: true,
+                    participants: at.state.participants,
+                    invited: at.state.invited,
+                    ended: at.state.ended,
+                };
+            }
+            catch (err) {
+                return {
+                    ok: false,
+                    reason: `document_chain_undecodable: ${err instanceof Error ? err.message : String(err)}`,
+                };
+            }
         },
+        sign: deps.sign,
     });
-    const awaitAck = async (ownerAgentId, envelopeHash, expectedAckerAgentId, timeoutMs) => {
-        // ALREADY SETTLED WINS — by THE HOLDER BEING DIALED (H1): the per-acker read first, the
-        // envelope-level read only for the zero-row bilateral legacy.
-        const already = store.holderSettlement(ownerAgentId, envelopeHash, expectedAckerAgentId) ??
-            store.envelopeSettlement(ownerAgentId, envelopeHash);
-        if (already)
-            return already;
-        const key = waiterKey(ownerAgentId, envelopeHash, expectedAckerAgentId);
-        return new Promise((resolve) => {
-            let timer;
-            const wake = (admitted) => {
-                clearTimeout(timer);
-                resolve({ admitted });
-            };
-            const set = ackWaiters.get(key) ?? new Set();
-            set.add(wake);
-            ackWaiters.set(key, set);
-            timer = setTimeout(() => {
-                // DEREGISTER on the way out. A waiter left in the map for an envelope that is never acked
-                // is a leak the length of the daemon's life, and `unref` is deliberately NOT used: the
-                // grace period must be able to hold the process just as the seal it precedes does.
-                const current = ackWaiters.get(key);
-                current?.delete(wake);
-                if (current && current.size === 0)
-                    ackWaiters.delete(key);
-                resolve(null);
-            }, timeoutMs);
-        });
-    };
     // The handshake verifies a proposal against its NAMED proposer — the same resolver, so a forged
     // proposal is refused before it can occupy a document_id (ON CONFLICT DO NOTHING makes the first
     // arrival's bytes permanent for that id).
@@ -204,7 +162,6 @@ export function createDocumentLayer(deps) {
     // path (`currentDocumentEpoch`) has run through DocumentStore since AMEND-1; these are the
     // WRITE path, and every append below validates first (the standing AMEND-1 condition).
     const amendments = new DocumentAmendmentStore(db, logger);
-    const joins = new DocumentJoinStore(db, logger);
     /**
      * M14B / DOD-MP-FANOUT-1 — the CURRENT holders of a document, derived from genesis + the
      * recorded chain. Null when the document is unknown or its chain does not derive — NOT an
@@ -229,7 +186,7 @@ export function createDocumentLayer(deps) {
         // where it surfaced, in place of the refusal the publish path was already holding ready.
         let derived;
         try {
-            derived = deriveArrangement(arrangementGenesisFromProposal(genesisRecord.envelope), amendments.chain(ownerAgentId, documentId), documentGovernancePolicy, verifySignature);
+            derived = deriveDocumentState(arrangementGenesisFromProposal(genesisRecord.envelope), amendments.chain(ownerAgentId, documentId), documentGovernancePolicy, verifySignature);
         }
         catch (err) {
             logger.error("document.holders.undecodable", {
@@ -245,96 +202,642 @@ export function createDocumentLayer(deps) {
             });
             return null;
         }
-        return [...derived.arrangement.participants];
+        // PARTICIPANTS ∪ INVITED (P2 review F4/F5): this is the "who is seated" set — delivery
+        // targets, control-frame addressing, and the close agreement all reach every seat, because a
+        // peer whose consent entry is still in flight must neither be starved of the entries they
+        // will need nor ended around. An invited seat still cannot AUTHOR anything but its own
+        // consent/refusal — the CONTENT door checks `participantsFor`, and the fold enforces it for
+        // governance regardless of who we send to.
+        return [...derived.state.participants, ...derived.state.invited];
     };
     /**
-     * Who a control frame (`close`, `kill`) must be addressed to — DOD-MP-CONTROL-N-1.
-     *
-     * THIS LIVES HERE, not as a closure in the composition root, for the reason
-     * `document-control-notifier.ts`'s own header records about itself: a closure in `daemon.ts` has
-     * no test, so every fixture hand-copies it, and a hand-copy cannot disagree with the original.
-     * The first draft of this WAS such a closure and had already drifted — it re-derived the
-     * arrangement itself and so never emitted `document.holders.underivable`, leaving the control
-     * path invisible to the exact log search meant to find it.
-     *
-     * Everyone EXCEPT the owner, because the owner is the one doing the ending. A chain that will
-     * not derive is refused by name rather than falling back to the genesis `peerAgentId` — that
-     * fallback is the original defect, and after a removal it aims the frame at precisely the
-     * removed holder.
+     * Strictly-consented participants — the CONTENT-AUTHORSHIP set (R17: an invited seat may
+     * receive, never author). The inbound sender gate checks this; everything delivery-facing uses
+     * `holdersFor`, which also counts invited seats.
      */
-    const controlHolders = (ownerAgentId, documentId) => {
-        // LEGACY FIRST, and for the same reason the settle path checks it first: a document with no
-        // stored genesis proposal has NO CHAIN, so the peer column is not a fallback — it IS the
-        // membership. Without this branch the send path refused the very condition the settle path
-        // calls legacy, so no close frame ever left, neither side recorded the other's close, and such
-        // a document could never be ended by agreement at all. Reachable two ways: documents proposed
-        // before `recordOutgoing` shipped, and a crash between `createDocument` and `recordOutgoing`,
-        // which run in that order.
-        //
-        // The two paths must agree about what "cannot answer" means. Their disagreeing is the whole
-        // shape of this milestone's defects.
-        const doc = store.getDocument(ownerAgentId, documentId);
-        if (doc && !handshake.get(ownerAgentId, documentId)) {
-            return { ok: true, holders: [doc.peerAgentId] };
+    const participantsFor = (ownerAgentId, documentId) => {
+        const genesisRecord = handshake.get(ownerAgentId, documentId);
+        if (!genesisRecord)
+            return null;
+        let derived;
+        try {
+            derived = deriveDocumentState(arrangementGenesisFromProposal(genesisRecord.envelope), amendments.chain(ownerAgentId, documentId), documentGovernancePolicy, verifySignature);
+        }
+        catch {
+            return null;
         }
-        let derivedHolders;
+        if (!derived.ok)
+            return null;
+        return [...derived.state.participants];
+    };
+    /**
+     * SYNC-D8 — the ONE derivation of an agent's standing in a document, from the fold. The old
+     * old linear membership walk was a second derivation that could disagree with
+     * the fold about who is seated; every consumer now asks this.
+     *
+     *  - participant / invited: seated, per R17.
+     *  - removed: not seated, and an APPLIED remove_holder entry names them (fold-void removals
+     *    do not count — a void contributed nothing, F4).
+     *  - stranger: not seated, never removed.
+     *  - unknown: the chain does not derive (no genesis, undecodable bytes) — callers must not
+     *    treat this as any of the other four.
+     */
+    const standingOf = (ownerAgentId, documentId, agentId) => {
+        const derived = reconcileReads(ownerAgentId).deriveState(documentId);
+        if (!derived.ok)
+            return "unknown";
+        if (derived.state.participants.has(agentId))
+            return "participant";
+        if (derived.state.invited.has(agentId))
+            return "invited";
+        const inert = new Set([
+            ...derived.state.voids.map((v) => v.hash),
+            ...derived.state.excluded.map((e) => e.hash),
+        ]);
+        let chain;
         try {
-            derivedHolders = holdersFor(ownerAgentId, documentId);
+            chain = [...amendments.chain(ownerAgentId, documentId)];
         }
-        catch (err) {
-            // CONTAINED for the same reason `cello_doc_list` contains it: a chain this build cannot
-            // decode THROWS, and an uncontained throw would take down the close/kill verb entirely
-            // rather than reporting why the frame could not be addressed.
-            return {
-                ok: false,
-                reason: `document_chain_undecodable: ${err instanceof Error ? err.message : String(err)}`,
-            };
+        catch {
+            return "unknown";
+        }
+        for (const env of chain) {
+            if (env.body.kind !== "remove_holder" || env.body.subject_agent_id !== agentId)
+                continue;
+            const hash = Buffer.from(documentAmendmentHash(env.body)).toString("hex");
+            if (!inert.has(hash))
+                return "removed";
         }
-        // A chain that EXISTS and will not replay keeps the refusal — it may name holders we cannot
-        // see, and addressing the genesis peer alone there is the original defect.
-        if (derivedHolders === null)
-            return { ok: false, reason: "document_holders_underivable" };
-        return { ok: true, holders: derivedHolders.filter((p) => p !== ownerAgentId).sort() };
+        return "stranger";
+    };
+    /**
+     * SYNC-R46 / spec §9 — one party's sync state, from the DISPLAY CACHE against our own
+     * positions. ONE implementation for the list surface and the sweep's believed-current
+     * suppression (R43) — two copies of "are they behind" is two daemons disagreeing about who
+     * needs an exchange. Never a correctness input (R44).
+     */
+    const partySync = (ownerAgentId, documentId, partyAgentId) => {
+        const view = store.partyView(ownerAgentId, documentId, partyAgentId);
+        if (!view)
+            return { sync: "unseen", lastSyncedAtMs: null };
+        let behind = false;
+        for (const [author, mark] of amendments.watermarks(ownerAgentId, documentId)) {
+            if (mark.seq > (view.govSeqs[author] ?? 0))
+                behind = true;
+        }
+        for (const [author, count] of store.envelopeCountsBySender(ownerAgentId, documentId)) {
+            if (count > (view.contentCounts[author] ?? 0))
+                behind = true;
+        }
+        const blockedBy = view.refused.length === 0
+            ? undefined
+            : view.refused.find((hash) => store.getEnvelopeLog(ownerAgentId, documentId).some((row) => row.docPrevHash === hash));
+        return {
+            sync: behind ? "behind" : "in_sync",
+            lastSyncedAtMs: view.lastExchangeMs,
+            ...(blockedBy ? { blockedBy } : {}),
+        };
+    };
+    /**
+     * SYNC-P5 (R43) — every (party → shared ACTIVE documents) pair one owner's sweep considers.
+     * Seats come from the FOLD, per document; an ended or underivable document contributes
+     * nothing, which is what lets a converged-and-ended document reach quiescence.
+     */
+    const sweepTargets = (ownerAgentId) => {
+        const targets = new Map();
+        for (const doc of store.listDocuments(ownerAgentId)) {
+            if (doc.status !== "active")
+                continue;
+            const derived = reconcileReads(ownerAgentId).deriveState(doc.documentId);
+            if (!derived.ok || derived.state.ended !== null)
+                continue;
+            const seats = [...derived.state.participants, ...derived.state.invited];
+            // A HOLDER THAT NO LONGER HOLDS A SEAT HAS NOTHING TO EXCHANGE.
+            //
+            // Removal is forward-only: the copy and its history stay ours to read, but edits no longer
+            // publish outward and theirs no longer arrive. So there is, by derivation, nothing left to
+            // reconcile — and the peers say so, refusing with `terminal: true` and the words "there is
+            // nothing further to reconcile".
+            //
+            // Without this the sweep derived its targets from the OTHER seats and never asked whether we
+            // still occupied one, so a removed holder asked forever: measured 105 refusals against one
+            // document in 85 minutes, every one of them terminal, every one of them asked again.
+            //
+            // The cost is not the wasted dial. Each attempt opens a session and pushes ack frames, and
+            // every frame consumes a relay canonical position while the receiving tree does not advance
+            // with it. That is what drives a conversation's tree behind the relay counter and strands
+            // real messages behind an ordering gap that nothing fills.
+            if (!seats.includes(ownerAgentId))
+                continue;
+            for (const seat of seats) {
+                if (seat === ownerAgentId)
+                    continue;
+                const docs = targets.get(seat);
+                if (docs)
+                    docs.push(doc.documentId);
+                else
+                    targets.set(seat, [doc.documentId]);
+            }
+        }
+        return targets;
     };
     /** Is this agent a CURRENT holder — the ack gate's membership question. */
     const isCurrentHolder = (ownerAgentId, documentId, agentId) => {
         const holders = holdersFor(ownerAgentId, documentId);
         return holders !== null && holders.includes(agentId);
     };
-    /** Sign and send a join answer — best-effort, never a veto over the local decision. */
-    const sendJoinAnswer = async (ownerAgentId, inviterAgentId, documentId, amendmentHash, accepted, reason) => {
+    const recordAmendmentImpl = (ownerAgentId, wire, nowMs) => {
+        // An entry reaching an EXISTING holder. The door refuses only what no future entry can
+        // ever make good — a broken collection binding, an unproven author, a failed signature
+        // (checkEntryAdmissible). Everything semantic is the FOLD's ruling at consumption, and a
+        // fold-void entry is still history (F4): bouncing it here would leave two holders holding
+        // different sets.
+        const env = decodeDocumentAmendment(wire);
+        const documentId = env.body.document_id;
+        if (!store.getDocument(ownerAgentId, documentId)) {
+            throw new Error(`document_unknown: no document ${documentId.slice(0, 16)}… for this agent`);
+        }
+        const record = handshake.get(ownerAgentId, documentId);
+        if (!record) {
+            throw new Error(`document_genesis_missing: ${documentId.slice(0, 16)}… has a row but no stored genesis ` +
+                `proposal to replay from`);
+        }
+        const admissible = checkEntryAdmissible(env, verifySignature);
+        if (!admissible.ok)
+            throw new Error(admissible.reason);
+        // THE STRANGER DOOR (SYNC-R18, interim until P3's full entitlement classes): a fold-void
+        // entry is history only when its author is KNOWN to this document — a genesis party or
+        // someone an EFFECTIVE admission names (which covers invited and removed authors, whose
+        // earlier work must still converge, R20). Effective, not merely held: a hostile holder can
+        // mint a self-signed, fold-void admission naming any key, and counting it would hand that
+        // key an unbounded license to grow every holder's entry set (review F4). A stranger's
+        // governance is refused by name, never stored.
+        const author = env.body.author_agent_id;
+        const genesisArr = arrangementGenesisFromProposal(record.envelope);
+        let authorKnown = genesisArr.proposerAgentId === author || genesisArr.peerAgentId === author;
+        if (!authorKnown) {
+            const held = amendments.chain(ownerAgentId, documentId);
+            const doorDerived = deriveDocumentState(genesisArr, held, documentGovernancePolicy, verifySignature);
+            if (!doorDerived.ok)
+                throw new Error(doorDerived.reason);
+            const inert = new Set([
+                ...doorDerived.state.voids.map((v) => v.hash),
+                ...doorDerived.state.excluded.map((e) => e.hash),
+            ]);
+            authorKnown = held.some((e) => e.body.kind === "add_holder" &&
+                e.body.subject_agent_id === author &&
+                !inert.has(Buffer.from(documentAmendmentHash(e.body)).toString("hex")));
+        }
+        if (!authorKnown) {
+            throw new Error(`document_author_stranger: ${author} is neither a genesis party nor named by any ` +
+                `effective admission — a stranger's governance is refused, not stored`);
+        }
+        const appended = amendments.append(ownerAgentId, documentId, wire, nowMs);
+        // Post-apply surfacing runs for EVERYTHING that just applied: the direct arrival, and
+        // every held entry this arrival promoted (review F2 — the held path silently dropped the
+        // removal notice and the lifecycle completion, reintroducing the stuck-`active` defect
+        // CLOSE-N-1 fixed, on exactly the out-of-order path the pending table exists for).
+        const surfaceApplied = (applied) => {
+            // DOD-MP-REMOVE-1 — a removal NAMING THIS AGENT is applied and SURFACED, not just
+            // stored: the row flips to `removed` (publishes refuse locally, naming the condition;
+            // the copy, the file, the history all remain — forward-only by doctrine), and the event
+            // is the operator's notice. Everyone else's arrangement changes are visible through
+            // list/inbox derivation; being written out of one is the change an operator must not
+            // miss.
+            if (applied.body.kind === "remove_holder" &&
+                applied.body.subject_agent_id === ownerAgentId) {
+                logger.warn("document.removed_from", {
+                    documentId,
+                    removedBy: applied.collection.required_signers.join(","),
+                });
+            }
+            // THE ARRIVING CONSENT IS THE JOIN ANSWER (SYNC-P3, the D5 replacement): an inviter's
+            // pending row settles from the entry itself — the subject's own signed yes or no — so
+            // the legacy answer frame carries nothing the record does not. Settle-once semantics
+            // SYNC-P4 (R27/R28, review F2): the stored status is a DISPLAY PROJECTION of the derived
+            // ending — recomputed on EVERY applied entry, in BOTH directions. One-way, kind-gated
+            // syncing let two holders converge on the fold while holding different status columns
+            // forever: a concurrently-authored admission re-opens the derivation (an invited seat
+            // blocks closure), and nothing ever wrote `active` back. The derivation is the truth; the
+            // column exists so the list surface does not re-derive every row, and no correctness gate
+            // reads it for endings anymore (canPublish/canAdmit ask the fold).
+            {
+                const derivedEnd = reconcileReads(ownerAgentId).deriveState(documentId);
+                if (derivedEnd.ok) {
+                    const current = store.getDocument(ownerAgentId, documentId)?.status;
+                    if (derivedEnd.state.ended !== null && current === "active") {
+                        store.setDocumentStatus(ownerAgentId, documentId, derivedEnd.state.ended === "killed" ? "killed" : "closed");
+                        logger.info("document.ended.derived", { documentId, ended: derivedEnd.state.ended });
+                    }
+                    else if (derivedEnd.state.ended === null &&
+                        (current === "closed" || current === "killed")) {
+                        store.setDocumentStatus(ownerAgentId, documentId, "active");
+                        logger.info("document.reopened.derived", { documentId });
+                    }
+                }
+            }
+        };
+        // An entry held for missing parents (R14) is recorded but NOT applied — its notices wait
+        // with it and fire on promotion. The store's `document.entry.held` event is the trace.
+        if (!appended.held)
+            surfaceApplied(env);
+        for (const promoted of appended.promoted)
+            surfaceApplied(promoted.envelope);
+    };
+    const rewriteFileImpl = async (ownerAgentId, inResponseTo) => {
+        if (!writePath)
+            return;
+        const env = decodeDocumentUpdateEnvelope(inResponseTo);
+        const document = store.getDocument(ownerAgentId, env.document_id);
+        if (!document)
+            return;
+        await writePath.materialize(ownerAgentId, env.document_id, document.documentType, live.get(ownerAgentId, env.document_id));
+    };
+    const noticeInboundUpdateImpl = (ownerAgentId, inResponseTo) => {
+        const env = decodeDocumentUpdateEnvelope(inResponseTo);
+        // COUNTED FROM THE LOG, not incremented blindly: envelopes redeliver, and a counter bumped on
+        // every arrival would drift upward on ordinary retries and tell the operator there is more to
+        // read than there is.
+        const unread = notifications.unreadFromPeer(ownerAgentId, env.document_id);
+        notifications.notice(ownerAgentId, env.document_id, unread, Date.now());
+        // DOD-DOC-WATCH-1 — the selective nudge.
+        //
+        // Matched against what changed since THIS agent last READ, not against this envelope. Per
+        // envelope re-fires on redelivery and on the peer's every keystroke; the net difference from
+        // the read mark asks the question an operator actually has — has the thing I am waiting on
+        // moved since I saw it — and self-cancels the moment they read.
+        //
+        // Wrapped whole: a notification is a courtesy on a path whose real job (admitting the peer's
+        // update) has already succeeded, and must never be able to fail it.
         try {
-            const answer = {
-                type: "document_join_answer",
-                document_id: documentId,
-                amendment_hash: amendmentHash,
-                invitee_agent_id: ownerAgentId,
-                accepted,
-                refusal_reason: accepted ? null : reason,
-                answered_at_ms: Date.now(),
-                signature: new Uint8Array(0),
-            };
-            answer.signature = await deps.sign(ownerAgentId, buildDocumentJoinAnswerTbs(answer));
-            await deps.sendFrame(ownerAgentId, inviterAgentId, encodeDocumentJoinAnswer(answer));
+            const watches = notifications.watches(ownerAgentId, env.document_id);
+            if (watches.length === 0)
+                return;
+            if (!notifications.nudgeOwed(ownerAgentId, env.document_id))
+                return;
+            const document = store.getDocument(ownerAgentId, env.document_id);
+            if (!document)
+                return;
+            const seen = notifications.lastSeen(ownerAgentId, env.document_id);
+            const after = projectDocumentText(live.get(ownerAgentId, env.document_id), document.documentType);
+            // NEVER READ is not "everything changed" for the purposes of a nudge — the agent has not
+            // established a baseline, so there is nothing it can be waiting on a change to.
+            if (seen === null || seen === after)
+                return;
+            // A text document has no key paths, so the only thing it can report is that it moved. That
+            // is why the whole-document watch has to be spelled `*` rather than implied.
+            const paths = rootForDocumentType(document.documentType) === "map"
+                ? changedKeyPaths(seen, after) ?? ["*"]
+                : ["*"];
+            const hits = matchWatchedPaths(watches, paths);
+            if (hits.length === 0)
+                return;
+            // THE AGENT'S OWN PATTERNS travel, never the changed paths. A changed path can carry a key
+            // the PEER named, and a doorbell body is an unscreened route into the agent's context —
+            // see `matchingWatches`. The precise field comes from cello_doc_diff, which IS screened.
+            const firedWatches = matchingWatches(watches, paths);
+            notifications.markNudged(ownerAgentId, env.document_id, Date.now());
+            logger.info("document.watch.nudged", {
+                documentId: env.document_id,
+                paths: hits.length,
+                watches: firedWatches.length,
+            });
+            deps.nudge?.(ownerAgentId, env.document_id, firedWatches);
         }
         catch (err) {
-            logger.warn("document.join.answer_send_failed", {
-                documentId,
-                amendmentHash,
+            logger.warn("document.watch.nudge_failed", {
+                documentId: env.document_id,
                 error: err instanceof Error ? err.message : String(err),
             });
         }
     };
-    /** Re-send the STANDING decision for an already-decided offer a redelivery just matched. */
-    const resendJoinAnswer = async (ownerAgentId, amendmentHash, inviterAgentId) => {
-        const record = joins.get(ownerAgentId, amendmentHash);
-        if (!record || record.state === "pending")
-            return;
-        await sendJoinAnswer(ownerAgentId, inviterAgentId, record.documentId, amendmentHash, record.state === "accepted", record.reason);
+    /** SYNC-P3 — the reads the reconcile engine consumes, over THIS owner's stores. */
+    const reconcileReads = (ownerAgentId) => ({
+        deriveState: (documentId) => {
+            const record = handshake.get(ownerAgentId, documentId);
+            if (!record)
+                return { ok: false, reason: "document_genesis_missing" };
+            try {
+                return deriveDocumentState(arrangementGenesisFromProposal(record.envelope), amendments.chain(ownerAgentId, documentId), documentGovernancePolicy, verifySignature);
+            }
+            catch (err) {
+                return {
+                    ok: false,
+                    reason: `document_chain_undecodable: ${err instanceof Error ? err.message : String(err)}`,
+                };
+            }
+        },
+        watermarks: (documentId) => amendments.watermarks(ownerAgentId, documentId),
+        entriesByAuthorAfter: (documentId, author, afterSeq) => amendments.entriesByAuthorAfter(ownerAgentId, documentId, author, afterSeq),
+        envelopeLog: (documentId) => store.getEnvelopeLog(ownerAgentId, documentId),
+        refusedHashes: (documentId) => rejections.quarantined(ownerAgentId, documentId).map((q) => q.rejectedEnvelopeHash),
+        // SYNC-R35: the exact signed frames, from the quarantine — rows born before the column hold
+        // none, and the exchange simply has nothing to attach for them.
+        refusalRecords: (documentId) => rejections
+            .quarantined(ownerAgentId, documentId)
+            .map((q) => q.rejectionWire)
+            .filter((w) => w !== undefined),
+        standingOf: (documentId, agentId) => standingOf(ownerAgentId, documentId, agentId),
+        genesisBytes: (documentId) => {
+            const record = handshake.get(ownerAgentId, documentId);
+            return record ? new Uint8Array(encodeDocumentProposal(record.envelope)) : null;
+        },
+        removalClosure: (documentId, agentId) => {
+            // The LAST removal naming them, plus every ancestor — walked over the held entry set.
+            const chain = amendments.chain(ownerAgentId, documentId);
+            const byHash = new Map(chain.map((env) => [
+                Buffer.from(documentAmendmentHash(env.body)).toString("hex"),
+                env,
+            ]));
+            let removalHash = null;
+            for (const [hash, env] of byHash) {
+                if (env.body.kind === "remove_holder" && env.body.subject_agent_id === agentId) {
+                    removalHash = hash;
+                }
+            }
+            if (!removalHash)
+                return null;
+            const wanted = new Set([removalHash]);
+            const queue = [removalHash];
+            while (queue.length > 0) {
+                const env = byHash.get(queue.pop());
+                if (!env)
+                    continue;
+                for (const parent of env.body.parents) {
+                    if (!wanted.has(parent)) {
+                        wanted.add(parent);
+                        queue.push(parent);
+                    }
+                }
+            }
+            // Foldable order: parents before children — the chain read is already epoch/seq ordered.
+            return chain
+                .filter((env) => wanted.has(Buffer.from(documentAmendmentHash(env.body)).toString("hex")))
+                .map((env) => new Uint8Array(encodeDocumentAmendment(env)));
+        },
+    });
+    /**
+     * SYNC-P3 — one arriving reconcile frame, all three steps. Apply what it carries (governance
+     * entries FIRST, R12 — through the same causal door every amendment takes; then content
+     * envelopes through the same inbound gate every update takes), then answer: a version this
+     * build does not speak or a stranger gets the named refusal ON the frame; a peer that lacks
+     * something gets the difference; a converged exchange gets silence — which is what terminates
+     * it (R15: idempotence is the absence of a difference, not bookkeeping).
+     */
+    const handleReconcile = async (ownerAgentId, wire, senderAgentId, nowMs, correlationId) => {
+        const frame = decodeDocumentReconcile(wire);
+        if (frame.refusal) {
+            // The peer's answer to OUR exchange — a fact to surface, never to retry blindly.
+            logger.warn("document.reconcile.refused_by_peer", {
+                senderAgentId, reason: frame.refusal.reason, terminal: frame.refusal.terminal, correlationId,
+            });
+            // ACTED ON, not merely surfaced. The comment above has always said "never to retry blindly",
+            // and until now nothing downstream could tell a refusal from a success.
+            deps.onPeerRefusal?.(ownerAgentId, senderAgentId, frame.refusal.terminal);
+            return { ok: true };
+        }
+        for (const block of frame.documents) {
+            if (block.refusal) {
+                logger.warn("document.reconcile.refused_by_peer", {
+                    documentId: block.document_id, senderAgentId,
+                    reason: block.refusal.reason, terminal: block.refusal.terminal, correlationId,
+                });
+                deps.onPeerRefusal?.(ownerAgentId, senderAgentId, block.refusal.terminal);
+            }
+        }
+        if (frame.exchange_version !== DOCUMENT_RECONCILE_EXCHANGE_VERSION) {
+            const reason = `document_reconcile_version: you speak exchange version ${frame.exchange_version} and ` +
+                `this holder speaks ${DOCUMENT_RECONCILE_EXCHANGE_VERSION} — upgrade together; there is ` +
+                `no dual-speak mode`;
+            logger.warn("document.reconcile.version_refused", { senderAgentId, correlationId, reason });
+            await deps.sendFrame(ownerAgentId, senderAgentId, encodeDocumentReconcile({
+                type: "document_reconcile",
+                exchange_version: DOCUMENT_RECONCILE_EXCHANGE_VERSION,
+                documents: [],
+                refusal: { reason, terminal: false },
+            }));
+            return { ok: false, reason: "document_reconcile_version" };
+        }
+        const reads = reconcileReads(ownerAgentId);
+        const replyBlocks = [];
+        // One reply frame's payload allowance, shared across its blocks (review F3): headroom under
+        // the router's 2 MiB frame ceiling so positions, hashes, and CBOR overhead always fit.
+        const replyBudget = { remainingBytes: 1_500_000 };
+        for (const block of frame.documents) {
+            // THE NOTICE, RECEIVED (R25): a position for a document this holder does not hold, with
+            // no genesis attached, IS the invitation pointer — the frame already names the document
+            // and the session names the inviter. The answer is our EMPTY position ("I hold nothing;
+            // send everything"), and the peer's reply carries the genesis and the lot. Two empty
+            // hands stay silent, so nothing ping-pongs.
+            if (!block.genesis && !store.getDocument(ownerAgentId, block.document_id)) {
+                const peerClaimsAnything = block.governance.length > 0 || block.content.length > 0 ||
+                    block.entries.length > 0 || block.envelopes.length > 0;
+                if (peerClaimsAnything) {
+                    replyBlocks.push({
+                        document_id: block.document_id,
+                        governance: [], content: [], refused: [], entries: [], envelopes: [],
+                    });
+                    logger.info("document.reconcile.notice_received", {
+                        documentId: block.document_id, viaAgentId: senderAgentId, correlationId,
+                    });
+                }
+                continue;
+            }
+            // THE JOINER BOOTSTRAP (spec §4 — a joiner is simply very far behind): a block carrying
+            // the genesis for a document this holder does not have is the invitation arriving. The
+            // anchor is validated the way every genesis is — its hash IS the document id, its
+            // signature is the proposer's — and recording it is idempotent. The invitee then derives
+            // their own standing (invited) from the entries that follow; their ACCEPT is the ordinary
+            // consent-authoring accept.
+            if (block.genesis && !store.getDocument(ownerAgentId, block.document_id)) {
+                try {
+                    const genesisEnv = decodeDocumentProposal(block.genesis);
+                    if (documentIdFromProposal(genesisEnv) !== block.document_id) {
+                        throw new Error("document_reconcile_genesis_mismatch: the carried genesis does not hash to the " +
+                            "block's document id — the anchor cannot be swapped");
+                    }
+                    // THE ANCHOR IS VERIFIED, NOT TAKEN (P3 review F2): a proposal is only a proposal
+                    // under its proposer's own signature — an unsigned or forged genesis stored here
+                    // would attribute a document to someone who never made it, and hand any session
+                    // peer an unlimited license to grow this store with fabricated documents.
+                    if (!verifySignature(genesisEnv.proposer_agent_id, buildDocumentProposalTbs(genesisEnv), genesisEnv.signature)) {
+                        throw new Error(`document_reconcile_genesis_unsigned: the carried genesis does not verify ` +
+                            `against its named proposer ${genesisEnv.proposer_agent_id}`);
+                    }
+                    // AND IT MUST NAME US (F2's entitlement half): this holder bootstraps only a
+                    // document it is a party to — the genesis peer, or the subject of an admission
+                    // carried in the same block. Anything else is a stranger's document and is refused,
+                    // not stored.
+                    const namedAsGenesisPeer = genesisEnv.peer_agent_id === ownerAgentId;
+                    const namedByAdmission = block.entries.some((entryWire) => {
+                        try {
+                            const env = decodeDocumentAmendment(entryWire);
+                            return env.body.kind === "add_holder" && env.body.subject_agent_id === ownerAgentId;
+                        }
+                        catch {
+                            return false;
+                        }
+                    });
+                    if (!namedAsGenesisPeer && !namedByAdmission) {
+                        throw new Error("document_reconcile_not_invited: the carried world names this holder nowhere — " +
+                            "neither the genesis peer nor the subject of any carried admission; a document " +
+                            "we are no party to is refused, not stored");
+                    }
+                    handshake.recordJoined(ownerAgentId, block.genesis, nowMs);
+                    store.createDocument({
+                        documentId: block.document_id,
+                        ownerAgentId,
+                        // The GENESIS FACT, not the messenger (F6): the peer column is the proposer's —
+                        // whoever's session happened to carry the frame may be any holder (forwarding).
+                        peerAgentId: genesisEnv.proposer_agent_id,
+                        documentType: genesisEnv.document_type,
+                        properties: genesisEnv.properties,
+                        status: "active",
+                        createdAtMs: nowMs,
+                    });
+                    logger.info("document.reconcile.joined", {
+                        documentId: block.document_id, viaAgentId: senderAgentId, correlationId,
+                    });
+                }
+                catch (err) {
+                    logger.warn("document.reconcile.genesis_refused", {
+                        documentId: block.document_id, senderAgentId, correlationId,
+                        reason: err instanceof Error ? err.message : String(err),
+                    });
+                    continue;
+                }
+            }
+            // APPLY FIRST (R12 order: governance, then content). Both doors are the ordinary ones —
+            // idempotent, held-until-whole, refusal-recording — so a redelivered exchange changes
+            // nothing.
+            for (const entryWire of block.entries) {
+                try {
+                    recordAmendmentImpl(ownerAgentId, entryWire, nowMs);
+                }
+                catch (err) {
+                    logger.warn("document.reconcile.entry_refused", {
+                        documentId: block.document_id, senderAgentId, correlationId,
+                        reason: err instanceof Error ? err.message : String(err),
+                    });
+                }
+            }
+            // SYNC-R35: the sender's SIGNED refusal records — verified against their named refuser
+            // and recorded as received rejections, exactly as a directly-sent frame would be. This is
+            // how a third holder wedged behind a refused hash learns its name and reason (F5/F8), and
+            // how the refusal keeps traveling once the refuser is gone. Idempotent by primary key.
+            for (const refusalWire of block.refusals ?? []) {
+                try {
+                    const rej = decodeDocumentRejection(new Uint8Array(refusalWire));
+                    if (rej.document_id !== block.document_id) {
+                        throw new Error("document_refusal_document_mismatch: the record names another document");
+                    }
+                    if (!verifySignature(rej.rejecting_agent_id, buildDocumentRejectionTbs(rej), rej.signature)) {
+                        throw new Error(`document_rejection_signature_invalid: the refusal claims to come from ` +
+                            `${rej.rejecting_agent_id} but its signature does not verify against that agent`);
+                    }
+                    rejections.recordIncomingRejection(ownerAgentId, rej.document_id, {
+                        rejectionEnvelopeHash: documentRejectionHash(rej),
+                        rejectedEnvelopeHash: rej.rejected_envelope_hash,
+                        reason: rej.reason,
+                        detail: rej.detail,
+                        fromAgentId: rej.rejecting_agent_id,
+                    });
+                }
+                catch (err) {
+                    logger.warn("document.reconcile.refusal_record_refused", {
+                        documentId: block.document_id, senderAgentId, correlationId,
+                        reason: err instanceof Error ? err.message : String(err),
+                    });
+                }
+            }
+            for (const envWire of block.envelopes) {
+                const res = await inbound.receive(ownerAgentId, envWire, nowMs, correlationId);
+                if (res.ok && res.admitted) {
+                    try {
+                        noticeInboundUpdateImpl(ownerAgentId, envWire);
+                    }
+                    catch { /* the notice is a row; the content is already the truth */ }
+                    void rewriteFileImpl(ownerAgentId, envWire).catch((err) => {
+                        logger.warn("document.reconcile.rewrite_failed", {
+                            correlationId,
+                            reason: err instanceof Error ? err.message : String(err),
+                        });
+                    });
+                }
+            }
+            const answer = respondToReconcile(reads, senderAgentId, block, replyBudget);
+            // SYNC-P5 (spec §9): the block's position IS what this party last claimed — recorded as
+            // the display cache the list surface reads (in_sync|behind|unseen). AFTER the entitlement
+            // ruling (P5 review F9): a stranger's claimed position is not worth a row. Never consulted
+            // for correctness (R44).
+            if (!answer.block.refusal && store.getDocument(ownerAgentId, block.document_id)) {
+                store.recordPartyView(ownerAgentId, block.document_id, senderAgentId, {
+                    govSeqs: Object.fromEntries(block.governance.map((g) => [g.author, g.seq])),
+                    contentCounts: Object.fromEntries(block.content.map((c) => [c.author, c.count])),
+                    refused: [...block.refused],
+                }, nowMs);
+            }
+            if (answer.block.refusal) {
+                // Per-document, on the block (review F4) — a batch never silences one document's no.
+                logger.warn("document.reconcile.refused", {
+                    documentId: block.document_id, senderAgentId,
+                    reason: answer.block.refusal.reason, terminal: answer.block.refusal.terminal,
+                    correlationId,
+                });
+                replyBlocks.push(answer.block);
+                continue;
+            }
+            if (answer.truncated) {
+                // The byte budget cut the payload (review F3) — LOUD, never a silently-oversized frame
+                // the router would drop as unshaped. The exchange is idempotent: the peer's next
+                // initiate picks up from its advanced position.
+                logger.warn("document.reconcile.truncated", {
+                    documentId: block.document_id, senderAgentId, correlationId,
+                });
+            }
+            // Refusal records RIDE replies; they never CAUSE one — counting them here would make any
+            // document with one standing refusal answer every exchange forever, and the exchange is
+            // terminated by silence. The wedge they exist to cure (F5) always involves a real
+            // difference, so they are on board whenever they matter.
+            const hasDifference = answer.block.entries.length > 0 || answer.block.envelopes.length > 0;
+            if (hasDifference || answer.peerAhead) {
+                replyBlocks.push(answer.block);
+            }
+        }
+        if (replyBlocks.length > 0) {
+            await deps.sendFrame(ownerAgentId, senderAgentId, encodeDocumentReconcile({
+                type: "document_reconcile",
+                exchange_version: DOCUMENT_RECONCILE_EXCHANGE_VERSION,
+                documents: replyBlocks,
+            }));
+        }
+        return { ok: true };
+    };
+    /** SYNC-P3 — step 1: send our position for these documents to a peer. */
+    // DOD-M12B-SHUTDOWN-1: THE CHOKE POINT for outbound reconciles. The scheduler is only one of the
+    // four callers — `nudgeSeats` and the two invite notices reach here directly, outside it — so
+    // gating the scheduler alone left three paths still dialling on the way out. `cello_doc_write`,
+    // `cello_doc_publish` and `cello_doc_invite` are all still SERVED during shutdown, because the
+    // IPC server is the last thing stopped, so this is not a theoretical window.
+    let reconcileStopped = false;
+    const initiateReconcile = async (ownerAgentId, peerAgentId, documentIds) => {
+        if (reconcileStopped)
+            return { ok: false, reason: "daemon_shutting_down" };
+        const reads = reconcileReads(ownerAgentId);
+        const blocks = documentIds.map((id) => buildReconcileBlock(reads, id));
+        const sent = await deps.sendFrame(ownerAgentId, peerAgentId, encodeDocumentReconcile({
+            type: "document_reconcile",
+            exchange_version: DOCUMENT_RECONCILE_EXCHANGE_VERSION,
+            documents: blocks,
+        }));
+        if (!sent.ok)
+            return { ok: false, reason: sent.reason ?? "document_reconcile_send_failed" };
+        logger.info("document.reconcile.initiated", { peerAgentId, documents: documentIds.length });
+        return { ok: true };
     };
     const router = new DocumentFrameRouter({
         inbound,
-        ackInbound,
+        handleReconcile,
         logger,
         ownerKeyFor: deps.ownerKeyFor,
         recordProposal: (ownerAgentId, wire, nowMs) => {
@@ -373,174 +876,12 @@ export function createDocumentLayer(deps) {
                 })();
             }
         },
-        recordJoinOffer: (ownerAgentId, wire, nowMs) => {
-            const offer = decodeDocumentJoinOffer(wire);
-            // ADDRESSED TO US — the same multi-agent-daemon rule recordProposal enforces: consent
-            // belongs to the agent the inviter named, and a throw here is contained by the router.
-            if (offer.invitee_agent_id !== ownerAgentId) {
-                throw new Error(`document_join_wrong_invitee: this offer is addressed to ${offer.invitee_agent_id}, ` +
-                    `not to ${ownerAgentId}`);
-            }
-            const validation = validateDocumentJoinOffer(offer, documentGovernancePolicy, verifySignature);
-            if (validation.ok) {
-                const stored = joins.recordIncoming(ownerAgentId, wire, validation.pendingAmendmentHash, { state: "pending" }, nowMs);
-                // REDELIVERY OF A DECIDED OFFER RE-SENDS THE ANSWER. A lost answer was otherwise lost
-                // forever: the invitee's decision stood, the inviter's row sat pending, and the
-                // inviter's only lever — re-inviting, which redelivers this exact offer — reached a
-                // DO-NOTHING insert. Now that redelivery is the recovery: the standing decision is
-                // re-signed and travels again. Best-effort, like every answer.
-                if (stored.state !== "pending") {
-                    void resendJoinAnswer(ownerAgentId, validation.pendingAmendmentHash, offer.inviter_agent_id);
-                }
-                return;
-            }
-            // A REFUSAL IS RECORDED — AND ANSWERED — ONLY WHEN IT IS AUTHENTICATED. The first cut
-            // recorded every refusal under the admitting amendment's hash, and that was a standing
-            // veto: any party holding the amendment bytes (every holder gets them in the fan-out)
-            // could deliver a garbage offer FIRST, occupy the real settle key with a refused row, and
-            // the genuine offer would arrive to a DO-NOTHING insert — the admin's admission silently
-            // suppressed, both operators seeing nothing. So: an offer whose signature does not verify
-            // against its named inviter THROWS (contained + logged, nothing recorded — the forged-
-            // proposal treatment), and an authenticated refusal is recorded under the hash of ITS OWN
-            // BYTES — visible to the operator, never able to occupy a real join's settle key.
-            if (!verifySignature(offer.inviter_agent_id, buildDocumentJoinOfferTbs(offer), offer.signature)) {
-                throw new Error(validation.reason);
-            }
-            const refusalKey = createHash("sha256").update(wire).digest("hex");
-            joins.recordIncoming(ownerAgentId, wire, refusalKey, { state: "refused", reason: validation.reason }, nowMs);
-            // BOTH ENDS get the sentence: the refusal answer travels back to the authenticated
-            // inviter, settling their row with the reason — the version-mismatch sentence was written
-            // for a human and was reaching a database column. The settle key is the admitting
-            // amendment's hash when one is recoverable (the inviter's row lives under it).
-            const last = offer.amendments[offer.amendments.length - 1];
-            if (last !== undefined) {
-                try {
-                    const settleKey = Buffer.from(documentAmendmentHash(decodeDocumentAmendment(last).body)).toString("hex");
-                    void sendJoinAnswer(ownerAgentId, offer.inviter_agent_id, offer.document_id, settleKey, false, validation.reason);
-                }
-                catch {
-                    // No recoverable settle key — the refusal stays visible locally and the inviter's
-                    // re-invite (which redelivers) will meet the same recorded refusal.
-                }
-            }
-        },
-        recordJoinAnswer: (ownerAgentId, wire, nowMs) => {
-            const r = joins.recordAnswer(ownerAgentId, wire, verifySignature, nowMs);
-            // A refusal is a verdict the router contains and reports — never a silent drop.
-            if (!r.ok)
-                throw new Error(r.reason);
-        },
-        recordAmendment: (ownerAgentId, wire, nowMs) => {
-            // An amendment reaching an EXISTING holder. VALIDATE-BEFORE-APPEND (the AMEND-1 standing
-            // condition): the whole chain, including this arrival, must replay through the real policy
-            // before one byte lands in the table — a row in document_amendments is post-validation by
-            // invariant, and epoch stamping rests on that.
-            const env = decodeDocumentAmendment(wire);
-            const documentId = env.body.document_id;
-            if (!store.getDocument(ownerAgentId, documentId)) {
-                throw new Error(`document_unknown: no document ${documentId.slice(0, 16)}… for this agent`);
-            }
-            const record = handshake.get(ownerAgentId, documentId);
-            if (!record) {
-                throw new Error(`document_genesis_missing: ${documentId.slice(0, 16)}… has a row but no stored genesis ` +
-                    `proposal to replay from`);
-            }
-            const derived = deriveArrangement(arrangementGenesisFromProposal(record.envelope), [...amendments.chain(ownerAgentId, documentId), env], documentGovernancePolicy, verifySignature);
-            if (!derived.ok)
-                throw new Error(derived.reason);
-            amendments.append(ownerAgentId, documentId, wire, nowMs);
-            // DOD-MP-REMOVE-1 — a removal NAMING THIS AGENT is applied and SURFACED, not just stored:
-            // the row flips to `removed` (publishes refuse locally, naming the condition; the copy,
-            // the file, the history all remain — forward-only by doctrine), and the event is the
-            // operator's notice. Everyone else's arrangement changes are visible through list/inbox
-            // derivation; being written out of one is the change an operator must not miss.
-            if (env.body.kind === "remove_holder" && env.body.subject_agent_id === ownerAgentId) {
-                // Applied by DERIVATION — the recorded chain IS the removal; publish gates and the list
-                // overlay read it. This warn is the operator's notice.
-                logger.warn("document.removed_from", {
-                    documentId,
-                    epochId: env.body.epoch_id,
-                    removedBy: env.collection.required_signers.join(","),
-                });
-            }
-            // DOD-MP-CLOSE-N-1 — a membership change can COMPLETE an agreement. Removing the one holder
-            // who had not closed leaves everyone who remains in agreement, and without this the document
-            // stayed `active` forever reporting that it waited on nobody: control frames are fire-once
-            // and never swept, so no later event would have settled it.
-            if (env.body.kind === "remove_holder" || env.body.kind === "add_holder") {
-                lifecycle.onMembershipChanged(ownerAgentId, documentId, env.body.kind === "remove_holder" ? (env.body.subject_agent_id ?? undefined) : undefined);
-            }
-        },
+        recordAmendment: recordAmendmentImpl,
         // `_nowMs` unused: the received-rejection row takes its clock where it is written, and the
         // rejection's own SIGNED timestamp is inside the envelope. A second clock read here would put a
         // third time on one event.
-        rewriteFile: async (ownerAgentId, inResponseTo) => {
-            if (!writePath)
-                return;
-            const env = decodeDocumentUpdateEnvelope(inResponseTo);
-            const document = store.getDocument(ownerAgentId, env.document_id);
-            if (!document)
-                return;
-            await writePath.materialize(ownerAgentId, env.document_id, document.documentType, live.get(ownerAgentId, env.document_id));
-        },
-        noticeInboundUpdate: (ownerAgentId, inResponseTo) => {
-            const env = decodeDocumentUpdateEnvelope(inResponseTo);
-            // COUNTED FROM THE LOG, not incremented blindly: envelopes redeliver, and a counter bumped on
-            // every arrival would drift upward on ordinary retries and tell the operator there is more to
-            // read than there is.
-            const unread = notifications.unreadFromPeer(ownerAgentId, env.document_id);
-            notifications.notice(ownerAgentId, env.document_id, unread, Date.now());
-            // DOD-DOC-WATCH-1 — the selective nudge.
-            //
-            // Matched against what changed since THIS agent last READ, not against this envelope. Per
-            // envelope re-fires on redelivery and on the peer's every keystroke; the net difference from
-            // the read mark asks the question an operator actually has — has the thing I am waiting on
-            // moved since I saw it — and self-cancels the moment they read.
-            //
-            // Wrapped whole: a notification is a courtesy on a path whose real job (admitting the peer's
-            // update) has already succeeded, and must never be able to fail it.
-            try {
-                const watches = notifications.watches(ownerAgentId, env.document_id);
-                if (watches.length === 0)
-                    return;
-                if (!notifications.nudgeOwed(ownerAgentId, env.document_id))
-                    return;
-                const document = store.getDocument(ownerAgentId, env.document_id);
-                if (!document)
-                    return;
-                const seen = notifications.lastSeen(ownerAgentId, env.document_id);
-                const after = projectDocumentText(live.get(ownerAgentId, env.document_id), document.documentType);
-                // NEVER READ is not "everything changed" for the purposes of a nudge — the agent has not
-                // established a baseline, so there is nothing it can be waiting on a change to.
-                if (seen === null || seen === after)
-                    return;
-                // A text document has no key paths, so the only thing it can report is that it moved. That
-                // is why the whole-document watch has to be spelled `*` rather than implied.
-                const paths = rootForDocumentType(document.documentType) === "map"
-                    ? changedKeyPaths(seen, after) ?? ["*"]
-                    : ["*"];
-                const hits = matchWatchedPaths(watches, paths);
-                if (hits.length === 0)
-                    return;
-                // THE AGENT'S OWN PATTERNS travel, never the changed paths. A changed path can carry a key
-                // the PEER named, and a doorbell body is an unscreened route into the agent's context —
-                // see `matchingWatches`. The precise field comes from cello_doc_diff, which IS screened.
-                const firedWatches = matchingWatches(watches, paths);
-                notifications.markNudged(ownerAgentId, env.document_id, Date.now());
-                logger.info("document.watch.nudged", {
-                    documentId: env.document_id,
-                    paths: hits.length,
-                    watches: firedWatches.length,
-                });
-                deps.nudge?.(ownerAgentId, env.document_id, firedWatches);
-            }
-            catch (err) {
-                logger.warn("document.watch.nudge_failed", {
-                    documentId: env.document_id,
-                    error: err instanceof Error ? err.message : String(err),
-                });
-            }
-        },
+        rewriteFile: rewriteFileImpl,
+        noticeInboundUpdate: noticeInboundUpdateImpl,
         sendFrameToPeer: async (ownerAgentId, inResponseTo, bytes) => {
             // Addressed to whoever AUTHORED the envelope being answered, taken from the envelope itself
             // rather than from the document row: the row's peer and the envelope's sender are the same
@@ -556,53 +897,6 @@ export function createDocumentLayer(deps) {
                 });
             }
         },
-        sendAck: async (ownerAgentId, wire, outcome) => {
-            const env = decodeDocumentUpdateEnvelope(wire);
-            const ack = {
-                type: "document_ack",
-                // The wire version this build speaks. Inlined rather than imported because protocol-types
-                // exports the domain and the codec but not the constant; the decoder pins it by value.
-                ack_version: 1,
-                document_id: env.document_id,
-                envelope_hash: outcome.envelopeHash,
-                acker_agent_id: ownerAgentId,
-                admitted: outcome.admitted,
-                ...(outcome.admitted ? {} : { rejection_reason: outcome.rejectionReason ?? "refused" }),
-                acked_at_ms: Date.now(),
-                signature: new Uint8Array(0),
-            };
-            ack.signature = await deps.sign(ownerAgentId, buildDocumentAckTbs(ack));
-            // BEST-EFFORT, and it must be: an ack that could not be sent is not a reason to refuse
-            // content we have already admitted. The sender redelivers on its own timer, and the
-            // redelivery is acked too — which is the case this whole path exists to terminate.
-            const sent = await deps.sendFrame(ownerAgentId, env.sender_agent_id, encodeDocumentAck(ack));
-            if (!sent.ok) {
-                logger.warn("document.ack.unsent", {
-                    documentId: env.document_id,
-                    envelopeHash: outcome.envelopeHash,
-                    reason: sent.reason,
-                    correlationId: outcome.correlationId,
-                });
-            }
-        },
-        recordControl: (ownerAgentId, wire, nowMs) => {
-            const control = decodeDocumentControl(wire);
-            // VERIFIED FIRST. A kill frame ends a collaboration; unsigned, anyone reaching the channel
-            // could end any document between any two parties and each operator would believe the other
-            // walked away.
-            if (!verifySignature(control.sender_agent_id, buildDocumentControlTbs(control), control.signature)) {
-                throw new Error(`document_control_signature_invalid: the ${control.verb} claims to come from ` +
-                    `${control.sender_agent_id} but its signature does not verify against that agent`);
-            }
-            const verdict = control.verb === "kill"
-                ? lifecycle.recordPeerKill(ownerAgentId, control.document_id, control.sender_agent_id, nowMs)
-                : lifecycle.recordPeerClose(ownerAgentId, control.document_id, control.sender_agent_id, nowMs);
-            if (!verdict.ok) {
-                // Refusals here are real: an unknown document, or a sender who is not this document's peer.
-                // Thrown so the router reports them rather than recording an end nobody was entitled to.
-                throw new Error(`${verdict.reason}: ${verdict.detail}`);
-            }
-        },
         recordProposalAck: (ownerAgentId, wire, _nowMs) => {
             const ack = decodeDocumentProposalAck(wire);
             // VERIFIED against the agent it names, before anything is written. A refusal ack makes the
@@ -645,213 +939,43 @@ export function createDocumentLayer(deps) {
             });
         },
     });
-    /**
-     * M14B / DOD-MP-JOIN-1 — the invitee's ACCEPT: consent becomes a held document.
-     *
-     * VALIDATE EVERYTHING, THEN MUTATE. The stored offer is re-validated at the moment of
-     * consequence (validate-before-append, on the bytes that will be appended), and the whole
-     * envelope-log snapshot is verified — every signature, every document binding — before one row
-     * lands. A snapshot with one bad envelope refuses the accept naming it, because skipping it
-     * silently would hand the joiner a document that reads complete and diverges from every other
-     * holder (NO-SILENT-DROP).
-     *
-     * Historical log envelopes are accepted at the epoch their SIGNED bytes claim — the inbound
-     * epoch gate is for live arrivals; a snapshot legitimately spans epochs 0..N.
-     */
-    const acceptJoin = async (ownerAgentId, amendmentHash, nowMs) => {
-        const record = joins.get(ownerAgentId, amendmentHash);
-        if (!record || record.role !== "invitee") {
-            return {
-                ok: false,
-                reason: "join_unknown_offer",
-                detail: `no join offer for this agent settles on ${amendmentHash.slice(0, 16)}…`,
-            };
-        }
-        if (record.state !== "pending") {
-            return {
-                ok: false,
-                reason: "join_already_decided",
-                detail: `this offer was already ${record.state} — a consent decision is made once`,
-            };
-        }
-        const validation = validateDocumentJoinOffer(record.offer, documentGovernancePolicy, verifySignature);
-        if (!validation.ok) {
-            // Recorded, not just returned: an offer that no longer validates is a settled fact.
-            joins.decide(ownerAgentId, amendmentHash, false, validation.reason, nowMs);
-            return { ok: false, reason: "join_offer_invalid", detail: validation.reason };
-        }
-        const documentId = record.documentId;
-        // WHO MAY APPEAR IN THE SNAPSHOT: anyone who held the document at ANY epoch of the carried
-        // chain — the genesis pair plus every add_holder subject (a removed holder's history stays
-        // legal). Without this, a malicious inviter plants envelopes signed by keys they control
-        // under identities that were never holders, and the joiner materializes content no
-        // legitimate holder ever saw — silent divergence the live path's sender-is-peer check
-        // would have refused.
-        const everHeld = new Set([
-            validation.genesis.proposer_agent_id,
-            validation.genesis.peer_agent_id,
-        ]);
-        for (const amendment of validation.amendments) {
-            if (amendment.body.kind === "add_holder" && amendment.body.subject_agent_id !== null) {
-                everHeld.add(amendment.body.subject_agent_id);
-            }
-        }
-        // The WHOLE snapshot verified before any mutation.
-        const verified = [];
-        for (let i = 0; i < record.offer.envelope_log.length; i++) {
-            const bytes = record.offer.envelope_log[i];
-            let env;
-            try {
-                env = decodeDocumentUpdateEnvelope(bytes);
-            }
-            catch (err) {
-                return {
-                    ok: false,
-                    reason: "join_log_invalid",
-                    detail: `snapshot envelope ${i} does not decode: ${err instanceof Error ? err.message : String(err)}`,
-                };
-            }
-            if (env.document_id !== documentId) {
-                return {
-                    ok: false,
-                    reason: "join_log_invalid",
-                    detail: `snapshot envelope ${i} names document ${env.document_id.slice(0, 16)}…, not this one`,
-                };
-            }
-            if (!verifySignature(env.sender_agent_id, buildDocumentUpdateTbs(env), env.signature)) {
-                return {
-                    ok: false,
-                    reason: "join_log_invalid",
-                    detail: `snapshot envelope ${i} does not verify against its sender ${env.sender_agent_id}`,
-                };
-            }
-            if (!everHeld.has(env.sender_agent_id)) {
-                return {
-                    ok: false,
-                    reason: "join_log_invalid",
-                    detail: `snapshot envelope ${i} is signed by ${env.sender_agent_id}, who never held this ` +
-                        `document at any epoch of the carried chain — refused before anything materializes`,
-                };
-            }
-            verified.push({
-                envelopeHash: documentEnvelopeHash(env),
-                documentId,
-                senderAgentId: env.sender_agent_id,
-                docPrevHash: env.doc_prev_hash,
-                epochId: env.epoch_id,
-                signature: env.signature,
-                stateVector: env.state_vector,
-                payload: env.update,
-                kind: "update",
-                referencesEnvelopeHash: null,
-                createdAtMs: nowMs,
-            });
-        }
-        // Mutations, in dependency order: genesis (LiveDocuments reads starting_content from it),
-        // the chain (idempotent on redelivery), the row, the log, the live rebuild, the file.
-        handshake.recordJoined(ownerAgentId, record.offer.genesis, nowMs);
-        try {
-            for (const bytes of record.offer.amendments) {
-                amendments.append(ownerAgentId, documentId, bytes, nowMs);
-            }
-        }
-        catch (err) {
-            // TWO ADMINS INVITED THE SAME AGENT INDEPENDENTLY: each offer's chain is self-consistent
-            // and both sat pending, but their admitting amendments rival at one epoch — the second
-            // accept hits the store's fork refusal mid-append. Settled as refused with the conflict's
-            // own reason rather than thrown: a raw exception left the row pending and every retry
-            // rethrowing, a wedge the operator could not see past.
-            const reason = err instanceof Error ? err.message : String(err);
-            joins.decide(ownerAgentId, amendmentHash, false, reason, nowMs);
-            return { ok: false, reason: "join_conflicting_admission", detail: reason };
-        }
-        if (!store.getDocument(ownerAgentId, documentId)) {
-            store.createDocument({
-                documentId,
-                ownerAgentId,
-                // The inviter is this holder's live counterpart until fan-out delivery (P2) — the
-                // participants that MATTER derive from the amendment chain (Entry 9's decision).
-                peerAgentId: record.inviterAgentId,
-                documentType: validation.genesis.document_type,
-                properties: validation.genesis.properties,
-                status: "active",
-                createdAtMs: nowMs,
-            });
-        }
-        for (const row of verified)
-            store.appendEnvelope(ownerAgentId, row);
-        const doc = live.get(ownerAgentId, documentId);
-        if (writePath) {
-            await writePath.materialize(ownerAgentId, documentId, validation.genesis.document_type, doc);
-        }
-        joins.decide(ownerAgentId, amendmentHash, true, null, nowMs);
-        const answer = {
-            type: "document_join_answer",
-            document_id: documentId,
-            amendment_hash: amendmentHash,
-            invitee_agent_id: ownerAgentId,
-            accepted: true,
-            refusal_reason: null,
-            answered_at_ms: nowMs,
-            signature: new Uint8Array(0),
-        };
-        answer.signature = await deps.sign(ownerAgentId, buildDocumentJoinAnswerTbs(answer));
-        logger.info("document.join.accepted", { documentId, amendmentHash, applied: verified.length });
-        return {
-            ok: true,
-            documentId,
-            inviterAgentId: record.inviterAgentId,
-            documentType: validation.genesis.document_type,
-            applied: verified.length,
-            answerBytes: encodeDocumentJoinAnswer(answer),
-        };
-    };
-    /** The invitee's REFUSE — local and final; the signed answer travels best-effort. */
-    const refuseJoin = async (ownerAgentId, amendmentHash, reason, nowMs) => {
-        const record = joins.get(ownerAgentId, amendmentHash);
-        if (!record || record.role !== "invitee") {
-            return {
-                ok: false,
-                reason: "join_unknown_offer",
-                detail: `no join offer for this agent settles on ${amendmentHash.slice(0, 16)}…`,
-            };
-        }
-        const decided = joins.decide(ownerAgentId, amendmentHash, false, reason, nowMs);
-        if (!decided.decided) {
-            return {
-                ok: false,
-                reason: "join_already_decided",
-                detail: `this offer was already ${decided.state} — a consent decision is made once`,
-            };
-        }
-        const answer = {
-            type: "document_join_answer",
-            document_id: record.documentId,
-            amendment_hash: amendmentHash,
-            invitee_agent_id: ownerAgentId,
-            accepted: false,
-            refusal_reason: reason,
-            answered_at_ms: nowMs,
-            signature: new Uint8Array(0),
-        };
-        answer.signature = await deps.sign(ownerAgentId, buildDocumentJoinAnswerTbs(answer));
-        logger.info("document.join.refused", { documentId: record.documentId, amendmentHash });
-        return {
-            ok: true,
-            documentId: record.documentId,
-            inviterAgentId: record.inviterAgentId,
-            answerBytes: encodeDocumentJoinAnswer(answer),
-        };
-    };
     return {
+        /** DOD-M12B-SHUTDOWN-1 — see the interface. One-way, idempotent, and the single place that
+         *  closes the whole class rather than one of the four callers. */
+        stopReconciling() { reconcileStopped = true; },
         amendments,
-        joins,
         verifySignature,
         holdersFor,
-        controlHolders,
         isCurrentHolder,
-        acceptJoin,
-        refuseJoin,
+        standingOf,
+        partySync,
+        sweepTargets,
+        initiateReconcile,
+        governanceFrontierFor: (ownerAgentId, documentId) => {
+            const derived = reconcileReads(ownerAgentId).deriveState(documentId);
+            if (!derived.ok) {
+                // NAMED, not collapsed to null (review F4): the derivation's own reason — a missing
+                // genesis, undecodable bytes, a fold refusal — is the thing the operator hunts for,
+                // and the old holders gate logged it while this gate ran first and said nothing.
+                logger.error("document.frontier.underivable", { documentId, reason: derived.reason });
+                return null;
+            }
+            return [...derived.state.frontier];
+        },
+        deriveEnded: (ownerAgentId, documentId) => {
+            const derived = reconcileReads(ownerAgentId).deriveState(documentId);
+            if (!derived.ok)
+                return null;
+            return {
+                ended: derived.state.ended,
+                // Who the ending still waits on: every participant without a close entry, AND every open
+                // invitation — an invited seat IS a seat (Entry 54), so a close cannot settle around it.
+                waitingOn: [
+                    ...[...derived.state.participants].filter((participant) => !derived.state.closedBy.has(participant)),
+                    ...derived.state.invited,
+                ],
+            };
+        },
         store,
         writePath,
         handshake,
@@ -861,15 +985,14 @@ export function createDocumentLayer(deps) {
         notifications,
         rejections,
         router,
-        awaitAck,
-        onDocumentFrame: (agentName, _sessionId, content, _senderPubkey, correlationId) => 
+        onDocumentFrame: (agentName, _sessionId, content, senderPubkey, correlationId) => 
         // `agentName` names the owning agent for the session; the router maps it to the owner KEY
         // that scopes the store. The session id and the sender's transport pubkey are unused: a
         // document is bound to its PEER by the handshake, not to whichever session carried the
         // frame, and the envelope's own signed `sender_agent_id` is what the inbound path checks
         // against that binding. Trusting the transport identity instead would let a frame arriving
         // on any session act on any document that session's peer happens to share.
-        router.routeSync(agentName, content, Date.now(), correlationId ?? "frame"),
+        router.routeSync(agentName, content, Date.now(), correlationId ?? "frame", senderPubkey),
     };
 }
 //# sourceMappingURL=document-layer.js.map