fix(fungible): recognize composite-owner outputs in multisig accept view

extractIssueOutputs/extractTransferOutputs now emit a single output owned
by the composite multisig/policy identity when a token has multiple
recipients, but AcceptCashView still checked outputs.ByRecipient(id)
against each responder's individual identity. The strict equality check
never matched the composite owner, so the existence assertion panicked
on bob's/charlie's node and the per-type balance check was silently
skipped, breaking dlog-fabric-t12 (EndToEnd Multisig) across all three
P2P transports.

Add OutputStream.ByRecipientOrMember, mirroring the membership check
already used in AssertTokens, and use it in AcceptCashView so a
responder recognizes outputs owned by a composite identity she is a
member of.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Signed-off-by: Angelo De Caro <adc@zurich.ibm.com>

Author: adecaro

integration/token/fungible/views/accept.go

@@ -35,12 +35,13 @@ func (a *AcceptCashView) Call(context view.Context) (any, error) {
 	outputs, err := tx.Outputs()
 	assert.NoError(err, "failed getting outputs")
 	assert.True(outputs.Count() > 0)
-	assert.True(outputs.ByRecipient(id).Count() > 0)
+	sigService := tx.TokenService().SigService()
+	assert.True(outputs.ByRecipientOrMember(context.Context(), id, sigService).Count() > 0)
 
 	// The recipient here is checking that, for each type of token she is receiving,
 	// she does not hold already more than 3000 units of that type.
 	// Just a fancy query to show the capabilities of the services we are using.
-	for _, output := range outputs.ByRecipient(id).Outputs() {
+	for _, output := range outputs.ByRecipientOrMember(context.Context(), id, sigService).Outputs() {
 		if output.Type == "MAX" {
 			continue
 		}

plan.md

@@ -0,0 +1,53 @@
+# Fix dlog-fabric-t12 (Multisig) panic caused by composite-owner output regression
+
+## Goal
+`dlog-fabric-t12` (EndToEnd Multisig, all three P2P transports: websocket, libp2p, replicas)
+panics deterministically on bob's/charlie's node inside `AcceptCashView.Call`
+(`integration/token/fungible/views/accept.go:38`). Root cause: commit `6269df950`
+changed `extractIssueOutputs`/`extractTransferOutputs` (`token/request.go`) to emit a
+single `Output` owned by the *composite* multisig/policy identity when a token has
+`len(recipients) > 1`, instead of one `Output` per individual co-owner. But
+`AcceptCashView.Call` still checks `outputs.ByRecipient(id)` where `id` is the
+responder's own *individual* identity (from `RespondRequestRecipientIdentityUsingWallet`),
+and `OutputStream.ByRecipient` (`token/stream.go`) does strict `id.Equal(t.Owner)`
+equality — which never matches the composite owner, so `assert.True(...)` panics.
+That panic propagates back to alice's `MultiSigLockView.Call` panic at `multisig.go:76`
+via `collectendorsements.go`'s `distributeTxToParties`/`fanOut`.
+
+Fix: make the ownership check membership-aware (composite-identity-aware), mirroring
+the existing pattern already used correctly in `AssertTokens` (`utils.go:32`:
+`output.Owner.Equal(id) || tx.TokenService().SigService().IsMe(ctx, output.Owner)`)
+and in `MultiSigAcceptSpendView.Call` (`multisig.go:209`).
+
+## Implementation steps
+1. [ ] Add a membership-aware output filter to `token/stream.go`, e.g.
+       `ByRecipientOrMember(ctx context.Context, id Identity, sigService *SignatureService) *OutputStream`,
+       filtering on `id.Equal(t.Owner) || sigService.IsMe(ctx, t.Owner)`.
+2. [ ] Update `AcceptCashView.Call` (`accept.go:38`) to use the new helper instead of
+       strict `outputs.ByRecipient(id)`.
+3. [ ] Update `AcceptCashView.Call` (`accept.go:43`) loop (balance sanity check) to use
+       the same helper — today it silently iterates zero outputs for composite owners
+       (no panic, but the balance check is skipped), which is a related correctness gap.
+4. [ ] Leave `AssertTokens` (`utils.go:32`) untouched — already correct; it's the
+       reference pattern.
+5. [ ] Confirm no other `ByRecipient` call site (`withdraw.go`, `upgrade.go`, `swap.go`,
+       `nft/views/accept.go`, `dvp/views/*`) needs the same fix — none of those flows use
+       multisig/policy composite owners, so they stay on strict `ByRecipient`.
+6. [ ] `make checks` and `make lint-auto-fix`.
+7. [ ] Run/validate `dlog-fabric-t12` (Multisig, T12 label) locally or via targeted CI run
+       across the three transport configs.
+
+## Implementation Progress
+- [x] Added `ByRecipientOrMember` to `token/stream.go` (membership-aware filter using `sigService.IsMe`)
+- [x] Updated `accept.go:38`/`:43` to use it instead of strict `ByRecipient`
+- [x] `make checks` and `make lint-auto-fix` clean; `go test ./token/...` passes
+- [x] `make integration-tests-dlog-fabric-t12` — **3 Passed | 0 Failed** across websocket, libp2p, replicas transports (previously panicked deterministically on all three)
+
+✅ COMPLETE
+
+## Notes & Decisions
+- Scope: this fix targets `dlog-fabric-t12` only, per explicit user request. `dlog-fabric-t14`/
+  `fabricx-dlog-t14` remain separately flagged as still red on PR #1953 despite `6269df950`
+  claiming to fix them — not investigated/fixed here.
+- `withdraw.go`, `upgrade.go`, `swap.go`, nft/dvp accept views confirmed not multisig-related;
+  left untouched.

token/stream.go

@@ -84,6 +84,15 @@ func (o *OutputStream) ByRecipient(id Identity) *OutputStream {
 	})
 }
 
+// ByRecipientOrMember filters the OutputStream to only include outputs whose owner is the
+// passed recipient, or a composite (e.g., multisig/policy) identity that the recipient is a
+// member of, as determined by sigService.IsMe (a signer is registered for each of its members).
+func (o *OutputStream) ByRecipientOrMember(ctx context.Context, id Identity, sigService *SignatureService) *OutputStream {
+	return o.Filter(func(t *Output) bool {
+		return id.Equal(t.Owner) || sigService.IsMe(ctx, t.Owner)
+	})
+}
+
 // ByType filters the OutputStream to only include outputs that match the passed type.
 func (o *OutputStream) ByType(typ token.Type) *OutputStream {
 	return o.Filter(func(t *Output) bool {