Parties, admission, informees

party leaf = H(PARTY_LEAF, party_id, epk.x, epk.y, fi_index)

A party registry (depth 24, root window R_PARTY) is written by FIs: an FI admits and revokes its own customers under its mpk. K opens every actor's party leaf and every created record's stakeholders' party leaves. That is the mandatory admission check, and it is also how the kernel learns each stakeholder's epk for delivery and each actor's fi_index for policy. revoked[party] is checked directly by the pool for actors, so the window does not delay revocation.

Informees, following Canton exactly: on create, signatories and observers of the record receive its envelope; on consuming exercise, signatories and observers of the consumed record and the actors learn of the consumption by recognizing the nullifier; on a non-consuming exercise, only signatories and actors do (observers see a recreation they cannot distinguish from consumption, which is a small deliberate divergence).

Disclosure to a non-stakeholder is explicit: an extra envelope slot the method may fill, plus a disclosure proof from the record commitment off chain. RFC-019's optional lineage hash lives at program level.