Command shared-document demonstrates the high-level shared.Document facade.
It remains a local teaching flow: a real receiver authenticates and
authorizes the peer, limits the transport body, and durably records its
outbox/checkpoint before calling ApplyUpdate.