Retry native party invitations and remove verified dead memberships

docs/survival-cooperation.md

@@ -11,3 +11,11 @@ Healthy, noncombat followers 18–90 yards from their bot leader on the same map
 Grouping assistance uses the existing parties-enabled setting, refreshed by the operations collector with a three-minute expiry. Danger detection and emergency self-preservation remain active for eligible bots. Bot Activity displays recent survival requests explicitly as requests. The ALE bridge supplies native combat role and up to 25 active quest IDs for companion matching.
 
 Install `ale/azerothai_survival.lua` beside the existing bridge. Its registry refreshes every minute. It uses no model calls and its per-character runtime observations expire after ten minutes offline. Game hooks and policy tests exercise retreat cooldown, follow distance, faction/hostility and human-control exclusions. In-game survival improvement must be evaluated over actual play; this is not a promise that bots cannot die.
+
+## Invitation and membership repair
+
+Install `ale/azerothai_parties.lua` beside the bridge and reload ALE before deploying the matching runtime. Party commands fail closed if this native guard is unavailable.
+
+Party invitations now carry both exact native identities and expire 45 seconds after creation. The native guard retries every two seconds while a participant is busy or out of range, allowing a meeting within 60 yards on the same map/phase. Every attempt rechecks identity, lifecycle, faction, levels, human control and group capacity. There is no teleport or forced combat interruption. A deferred bridge command receives its completion receipt only when membership is confirmed or the invitation expires/fails. Pending participants remain reserved so another invitation cannot race the first. ALE reloads lose in-memory retries; the durable lane eventually replays the expired request as a failure rather than applying an old invitation.
+
+Every ten seconds, the party guard checks incomplete groups against the complete persisted character membership and hardcore registry. It removes only a verified permanently dead member, after validating every identity and protecting human, unknown, active-but-offline, raid and combat parties. One mutation per group avoids touching a Group object after native disbanding. The audit table `acore_auth.azerothai_party_audit` records actual removals and invitation outcomes; it is covered by the full auth database backup.