@astrosheep/square 0.3.106 → 0.4.1

package/dist/boundary-presentation.js

@@ -1,120 +1,40 @@
-import { squareIndexPath } from './square-index.js';
-import { createHash } from 'node:crypto';
-import { withFileLock } from './file-lock.js';
-import { createArtifactPort } from './artifact.js';
-import { preparePendingPresentation } from './presentation-operations.js';
-import { presentPreparedBatch } from './delivery-effects.js';
-import { sessionInbox, projectBoundaryEligibility, pendingAtBoundary, pendingKey } from './inbox.js';
-import { attentionBodyIsClipped, renderAttentionPreview, renderSquareReminder } from './attention-presentation.js';
-export { pendingAtBoundary };
+import { DeliveryLedger } from './delivery-ledger.js';
+import { deliveryFrameOverhead, renderDeliveryReminder } from './delivery-frame.js';
 const CONTEXT_MAX = 1200;
-export function renderPendingAtBoundary(inbox) {
-    return renderBoundary(inbox).context;
-}
-function renderBoundary(inbox) {
-    const queued = inbox.flatMap((membership) => membership.notifications.map((notification) => ({ membership, notification })));
-    const blocks = [];
-    const agoraBlocks = [];
-    const deliveries = [];
-    let remainingAgora = queued.filter(({ notification }) => notification.delivery?.mode !== 'direct').length;
-    const entries = [];
-    let omitted = 0;
-    const omission = (count) => `${count} more ${count === 1 ? 'activity' : 'activities'} not shown.`;
-    for (const entry of queued) {
-        const { membership, notification } = entry;
-        // The omission line represents the rest of this batch too, but never consumes its bodies.
-        const coverage = { membership, actIndex: notification.actIndex, markSeen: false };
-        entries.push(coverage);
-        const block = renderAttentionPreview({
-            squarePath: membership.location,
-            actIndex: notification.actIndex,
-            recipient: membership.seat.participant,
-            actor: notification.actor,
-            route: notification.route,
-            body: notification.body,
-            delivery: notification.delivery,
-        });
-        if (notification.delivery?.mode !== 'direct') {
-            remainingAgora -= 1;
-            const omittedAfter = omitted + remainingAgora;
-            const prospective = renderSquareReminder([...agoraBlocks, block, ...(omittedAfter > 0 ? [omission(omittedAfter)] : [])]);
-            if (prospective.length > CONTEXT_MAX) {
-                omitted += 1;
-                continue;
-            }
-            agoraBlocks.push(block);
-        }
-        blocks.push(block);
-        deliveries.push(notification.delivery);
-        coverage.markSeen = !attentionBodyIsClipped(notification.body, notification.delivery);
-    }
-    return {
-        context: renderSquareReminder([...blocks, ...(omitted > 0 ? [omission(omitted)] : [])], deliveries),
-        entries,
-    };
-}
-async function presentPendingAtBoundaryUnlocked(identity, present, lookup = sessionInbox, env = process.env, signal) {
-    const inbox = await lookup(identity, env, signal);
-    if (signal?.aborted)
-        return undefined;
-    const pending = await projectBoundaryEligibility(inbox);
-    if (pending.length === 0 || signal?.aborted)
-        return undefined;
-    const artifacts = new Map();
-    const claims = [];
+/** The sink must resolve only after the host has actually accepted the output. */
+export async function presentPendingAtBoundary(owner, present, env = process.env, signal) {
+    const ledger = await DeliveryLedger.open({ location: env.SQUARE_DELIVERY });
     try {
+        const session = await ledger.session(owner);
+        if (!session || session.state !== 'attached' || signal?.aborted)
+            return undefined;
+        const claim = await ledger.claimPresentation(owner, { generation: session.generation, budgetChars: CONTEXT_MAX - deliveryFrameOverhead({ tagged: true }), signal });
+        if (!claim)
+            return undefined;
+        let current;
         try {
-            // Enumeration owns discovery/connections only; returned handles belong to the common runner.
-            for (const entry of renderBoundary(pending).entries) {
-                const { location, seat } = entry.membership;
-                let artifact = artifacts.get(location);
-                if (artifact === undefined) {
-                    // Keep connections alive through all signal-independent settlement/cleanup.
-                    artifact = createArtifactPort(location);
-                    artifacts.set(location, artifact);
-                }
-                const claim = await preparePendingPresentation({ artifact, location, participant: seat.participant,
-                    activity: entry.actIndex, seat, markSeen: entry.markSeen, signal });
-                if (claim !== undefined)
-                    claims.push({ key: pendingKey(entry.membership, entry.actIndex), claim });
-            }
+            current = await claim.current(signal);
         }
         catch (error) {
-            // Transfer has not happened: enumeration must abandon any custody already acquired.
-            await Promise.all(claims.map(({ claim }) => claim.release()));
+            await claim.settle('released');
             throw error;
         }
-        const report = await presentPreparedBatch(claims.map(({ claim }) => claim), eligibleClaims => {
-            const eligible = new Set(claims.filter(({ claim }) => eligibleClaims.includes(claim)).map(({ key }) => key));
-            const delivered = pending.map(membership => ({ ...membership,
-                notifications: membership.notifications.filter(note => eligible.has(pendingKey(membership, note.actIndex))),
-            })).filter(membership => membership.notifications.length > 0);
-            return { payload: { context: renderBoundary(delivered).context, delivered }, included: eligibleClaims };
-        }, payload => present(payload.context, payload.delivered), { signal });
-        if (report.observation.kind === 'threw')
-            throw report.observation.error;
-        for (const { result } of report.settlements)
-            if (result.persistence.status === 'error')
-                throw result.persistence.error;
-        return report.observation.kind === 'returned' ? report.observation.value : undefined;
+        if (!current || signal?.aborted) {
+            await claim.settle('released');
+            return undefined;
+        }
+        let result;
+        try {
+            result = await present(renderDeliveryReminder(claim.cards.map(card => card.text), { tagged: true }));
+        }
+        catch (error) {
+            await claim.settle('unknown');
+            throw error;
+        }
+        await claim.settle('presented');
+        return result;
     }
     finally {
-        await Promise.all([...artifacts.values()].map(artifact => artifact.close()));
+        await ledger.close();
     }
 }
-/**
- * Serialize a boundary across hook processes so one stale inbox cannot render twice.
- *
- * `lookup` returns the session's memberships for this boundary. It may reuse an observation it has
- * verified against the current presence binding and artifact revision; the boundary still projects
- * presentation evidence live. Every item is claimed and revalidated before the batch sink;
- * after success, captured-seat commits record the winning batch, including budget omissions as
- * clipped (no consumption receipt), without an eligibility veto. Coverage is conservative if a
- * competing claim's removal lets a previously omitted body fit in the final preview.
- * A source that cannot verify its reuse must read the inbox again.
- */
-export async function presentPendingAtBoundary(identity, present, lookup = sessionInbox, env = process.env, signal) {
-    const indexPath = squareIndexPath(env);
-    const ownerKey = createHash('sha256').update(JSON.stringify(identity)).digest('hex');
-    return withFileLock(`${indexPath}.boundary-${ownerKey}.lock`, { retryMs: 10, signal }, () => presentPendingAtBoundaryUnlocked(identity, present, lookup, env, signal));
-}

package/dist/card-presentation.d.ts

@@ -0,0 +1 @@
+export { isCardPresentation, type CardPresentation } from './plugins/paseo/shared/card-presentation.js';

package/dist/card-presentation.js

@@ -0,0 +1,2 @@
+// Keep the shared schema inside the standalone Paseo plugin's package boundary.
+export { isCardPresentation } from './plugins/paseo/shared/card-presentation.js';

package/dist/catch-decisions.d.ts

@@ -1,4 +1,4 @@
-import { type StoredAct } from './model.js';
+import { type HydratedAct } from './model.js';
 import type { ActivityIndex, DirectedFilter, SquareRead, SquareWrite } from './ports.js';
 import type { CatchOptions, CatchReason, PerceivedActivity } from './square-facade.js';
 export interface CatchSelection {
@@ -14,7 +14,7 @@ export interface CatchSelection {
     readonly hint?: string;
 }
 /** Capture a selected page (or an empty completion) without opening another resource. */
-export declare function observeCatchSelection(facts: SquareRead, participant: string, activities: readonly StoredAct[], filter: DirectedFilter, at: number, remaining?: number): CatchSelection;
+export declare function observeCatchSelection(facts: SquareRead, participant: string, activities: readonly HydratedAct[], filter: DirectedFilter, at: number, remaining?: number): CatchSelection;
 export declare const CATCH_DEFAULT_LIMIT = 10;
 export declare const CATCH_MAX_LIMIT = 100;
 export declare function catchLimit(value: number | undefined): number;

package/dist/catch-decisions.js

@@ -33,7 +33,7 @@ function catchPageSelection(facts, requestedName, options) {
     const participant = resolveKnownName(facts, requestedName);
     const limit = catchLimit(options.limit);
     const senders = options.from?.map(name => resolveKnownName(facts, name));
-    const filter = { unseenOnly: true, ...(senders === undefined ? {} : { senders }), ...(options.mention === true ? { attentionOnly: true } : {}) };
+    const filter = { kinds: ['say'], unseenOnly: true, ...(senders === undefined ? {} : { senders }), ...(options.mention === true ? { attentionOnly: true } : {}) };
     return { participant, filter, selection: { kind: 'page', query: filter, limit } };
 }
 /** Select non-ID catch coordinates without hydrating bodies or recording receipts. */
@@ -44,7 +44,7 @@ export function selectCatchPage(facts, requestedName, options) {
 /** Selection, receipts and resulting cursor belong to one artifact write transaction. */
 export function decideCatch(facts, requestedName, options, at) {
     let viewer;
-    let filter = { unseenOnly: true };
+    let filter = { kinds: ['say'], unseenOnly: true };
     let selection;
     if (options.id !== undefined) {
         viewer = resolveKnownName(facts, requestedName);
@@ -66,6 +66,10 @@ export function decideCatch(facts, requestedName, options, at) {
     try {
         consumed = consumeReceived({
             ...squareReceiveRead(facts),
+            addressed(recipient, index) {
+                const head = facts.directed(recipient, { indexes: [index], kinds: ['say'] }, { edge: 'oldest', limit: 1 }).items[0];
+                return head === undefined ? undefined : { key: head.index, via: head.route };
+            },
             insertReceipt: (ref, time) => facts.markSeen(ref.recipient, [ref.item], time) > 0,
         }, viewer, selection, at);
     }
@@ -85,7 +89,7 @@ export function decideCatch(facts, requestedName, options, at) {
     const delivered = consumed.items.map(item => item.data);
     const observed = observeCatchSelection(facts, viewer, delivered, filter, at, consumed.remaining);
     // Receipts are the durable catch count: everything directed here minus what is still unseen.
-    const caught = facts.directedCount(viewer, {}) - facts.directedCount(viewer, { unseenOnly: true });
+    const caught = facts.directedCount(viewer, { kinds: ['say'] }) - facts.directedCount(viewer, { kinds: ['say'], unseenOnly: true });
     // An exact id catch is a targeted fetch and stays repeatable, so it carries no nudge.
     const hint = options.id === undefined ? catchHint(caught - consumed.newlyConsumed, caught) : undefined;
     return hint === undefined ? observed : { ...observed, hint };

package/dist/catch-selection.d.ts

@@ -4,3 +4,11 @@ export declare function matchesCatchSelection(actor: string, audience: Audience,
     readonly participants?: readonly string[];
     readonly mention?: string;
 }, replyAuthor?: string): boolean;
+/** One directed arrival and the upper reason it reached its recipient. */
+export interface RoutedNotification {
+    readonly actor: string;
+    readonly route: import('./model.js').DirectedNotificationRoute;
+    readonly recipient: string;
+}
+/** A live catch owns every matching notification, independent of its page size. */
+export declare function leaseOwnsNotification(lease: import('./model.js').WatchLease, notification: RoutedNotification): boolean;

package/dist/catch-selection.js

@@ -12,3 +12,8 @@ export function matchesCatchSelection(actor, audience, filter, replyAuthor) {
     return audienceIncludes(audience, filter.mention)
         || (replyAuthor !== undefined && sameName(replyAuthor, filter.mention));
 }
+/** A live catch owns every matching notification, independent of its page size. */
+export function leaseOwnsNotification(lease, notification) {
+    return matchesCatchSelection(notification.actor, notification.route === 'bell' ? { kind: 'bell' }
+        : { kind: 'mentions', names: notification.route === 'mention' ? [notification.recipient] : [] }, lease.filter ?? {}, notification.route === 'reply' ? notification.recipient : undefined);
+}

package/dist/claude-delivery.d.ts

@@ -1,15 +1,17 @@
-import type { WakeTransportPort } from './ports.js';
-export declare function nativeTokens(text: string): string[];
-export declare function nativePayload(token: string, preview: string): string;
-export declare function createClaudeWakeTransport(env?: NodeJS.ProcessEnv): WakeTransportPort;
-/** Recognize the whole frame first; one inactive token vetoes it before any evidence/receipt write. */
-export declare function observeClaudeDelivery(sessionId: string, text: string, operation: 'guard' | 'admitted' | 'stored', env?: NodeJS.ProcessEnv): Promise<{
-    recognized: boolean;
-    current: boolean;
-}>;
+import { type DeliveryHandoffRef } from './delivery-ledger.js';
+export { createClaudeWakeTransport, nativeTokens, nativePayload } from './claude-transport.js';
 export type ClaudeBinding = {
-    readonly location: string;
-    readonly participant: string;
     readonly session: string;
-    readonly generation?: import('./square-core.js').ActivityId;
+    readonly generation: string;
 };
+/** Extract complete frames and hash the exact bytes observed by the native host. */
+export declare function claudeFrames(text: string): readonly {
+    token: string;
+    payloadHash: string;
+}[];
+/** Guard pre-effect; admit and observe only the exact captured handoff after each native effect. */
+export declare function observeClaudeDelivery(sessionId: string, text: string, operation: 'guard' | 'admitted' | 'stored', env?: NodeJS.ProcessEnv, captured?: readonly DeliveryHandoffRef[]): Promise<{
+    recognized: boolean;
+    current: boolean;
+    refs?: readonly DeliveryHandoffRef[];
+}>;

package/dist/claude-delivery.js

@@ -1,155 +1,55 @@
-import { stat } from 'node:fs/promises';
-import { createHash, randomUUID } from 'node:crypto';
-import { createArtifactPort } from './artifact.js';
-import { presentPending } from './presentation-operations.js';
-import { nativePendingPreview } from './inbox.js';
-import { parseActivityId } from './square-core.js';
-import { decodeHarnessOwner } from './owner.js';
-import { indexedSquareEntries } from './square-index.js';
-import { asSeatRef } from './seats.js';
-import { writeClaudeNative } from './packages/agent-delivery/src/claude-native.js';
-const marker = /(?:^|\n)\[square-inbox:([a-zA-Z0-9-]+)\](?:\n|$)/g;
-export function nativeTokens(text) { return [...text.matchAll(marker)].map((match) => match[1]); }
-export function nativePayload(token, preview) { return `[square-inbox:${token}]\n${preview}\n[/square-inbox:${token}]`; }
-function nativeSupported(route) { return route.address.loaded === 'true' && !!route.address.endpoint; }
-function hashPayload(payload) { return createHash('sha256').update(payload).digest('hex'); }
-function previewFacts(facts, request) {
-    const index = parseActivityId(request.activity);
-    if (index === undefined || request.route.kind !== 'claude-native' || request.route.address.endpoint === undefined)
-        return undefined;
-    return nativePendingPreview(facts, { location: request.location, routeKind: 'claude-native', generation: request.seat.generation,
-        address: request.route.address,
-        participant: request.participant, actIndex: index, now: Date.now() });
-}
-async function preview(artifact, request) {
-    return (await artifact.read((facts) => previewFacts(facts, request))).value;
-}
-async function writeClaudeWake(sessionId, endpoint, messageId, payload, timeoutMs, signal) {
-    const result = await writeClaudeNative({ sessionId, endpoint, messageId }, payload, { deadline: Date.now() + timeoutMs, signal });
-    if (result.outcome === 'unavailable')
-        return { outcome: 'failed', signature: 'claude_endpoint_unavailable', message: result.message };
-    return { outcome: 'unknown', signature: 'native_admission_unconfirmed', message: result.outcome === 'written' ? 'Claude accepted the local write; native admission is unconfirmed.' : result.message };
-}
-export function createClaudeWakeTransport(env = process.env) {
-    return {
-        async probe(route) {
-            if (!nativeSupported(route))
-                return { outcome: 'not-capable', diagnostic: 'Claude native inbox unavailable: a loaded interactive Square mod is required.' };
-            try {
-                return (await stat(route.address.endpoint)).isSocket() || { outcome: 'not-capable', diagnostic: 'Claude native inbox endpoint is not a socket.' };
-            }
-            catch {
-                return { outcome: 'not-capable', diagnostic: 'Claude native inbox endpoint unavailable.' };
-            }
-        },
-        attempt: (request, timeoutMs, beforeSend) => dispatchClaude(request, timeoutMs, beforeSend, env),
-    };
-}
-async function dispatchClaude(request, timeoutMs, beforeSend, env = process.env) {
-    void env;
-    const signal = AbortSignal.timeout(timeoutMs);
-    if (!nativeSupported(request.route) || request.artifact === undefined || request.claimToken === undefined)
-        return { outcome: 'not-capable', diagnostic: 'Claude native delivery needs a current artifact claim and loaded inbox.' };
-    if (signal.aborted || !await beforeSend())
-        return { outcome: 'unknown', signature: 'native_send_suppressed' };
-    const prepared = await preview(request.artifact, request);
-    if (prepared === undefined)
-        return { outcome: 'not-capable', diagnostic: 'Claude activity is no longer current.' };
-    const messageId = randomUUID();
-    const payload = nativePayload(request.claimToken, prepared.payload);
-    const correlation = { harness: 'claude', token: request.claimToken, messageId, payloadHash: hashPayload(payload) };
-    if (!await request.artifact.prepareDelivery({ seat: request.seat, claimToken: request.claimToken, correlation }))
-        return { outcome: 'not-capable', diagnostic: 'Claude delivery claim is no longer current.' };
-    const fresh = await preview(request.artifact, request);
-    if (fresh === undefined || nativePayload(request.claimToken, fresh.payload) !== payload)
-        return { outcome: 'not-capable', diagnostic: 'Claude activity changed before native write.' };
-    if (signal.aborted || !await beforeSend())
-        return { outcome: 'not-capable', diagnostic: 'Claude activity was consumed before native write.' };
-    const sessionId = request.route.address.sessionId;
-    if (sessionId === undefined)
-        return { outcome: 'not-capable', diagnostic: 'Claude native route has no session address.' };
-    return writeClaudeWake(sessionId, request.route.address.endpoint, messageId, payload, timeoutMs, signal);
-}
-function currentPayload(facts, request) {
-    const seat = facts.seat(request.participant), evidence = facts.deliveryByToken(request.claimToken);
-    if (seat === undefined || seat.attachment !== 'attached' || evidence === undefined || seat.generation !== evidence.generation
-        || seat.generation !== request.seat.generation || seat.owner !== request.seat.owner
-        || evidence.activity !== request.activity || !['dispatching', 'unknown', 'accepted'].includes(evidence.outcome))
-        return undefined;
-    const native = previewFacts(facts, request);
-    if (native === undefined)
-        return undefined;
-    const payload = nativePayload(request.claimToken, native.payload);
-    return evidence.correlation?.payloadHash === hashPayload(payload) ? payload : undefined;
-}
-async function rowsForSession(sessionId, env, tokens) {
-    const rows = [];
-    const candidates = (await indexedSquareEntries({}, env)).filter(entry => {
-        const coordinate = decodeHarnessOwner(entry.owner);
-        return coordinate?.channel === 'claude-code' && coordinate.session === sessionId;
+import { DeliveryLedger } from './delivery-ledger.js';
+import { harnessOwner } from './owner.js';
+import { renderDeliveryReminder } from './delivery-frame.js';
+import { hashPayload, nativeTokens } from './claude-transport.js';
+export { createClaudeWakeTransport, nativeTokens, nativePayload } from './claude-transport.js';
+/** Extract complete frames and hash the exact bytes observed by the native host. */
+export function claudeFrames(text) {
+    const prefix = renderDeliveryReminder([''], { tagged: false });
+    return [...text.matchAll(/(?:^|\n)(\[square-inbox:([a-zA-Z0-9-]+)\]\n[\s\S]*?\n\[\/square-inbox:\2\])(?=\n|$)/g)]
+        .flatMap(frame => {
+        const start = frame.index + frame[0].length - frame[1].length;
+        return text.slice(start - prefix.length, start) === prefix
+            ? [{ token: frame[2], payloadHash: hashPayload(prefix + frame[1]) }] : [];
     });
-    const paths = new Set(candidates.map(candidate => candidate.location));
-    for (const location of paths) {
-        const artifact = createArtifactPort(location);
-        try {
-            const found = await artifact.read((facts) => tokens.flatMap((token) => {
-                const evidence = facts.deliveryByToken(token);
-                if (evidence?.kind !== 'wake' || evidence.correlation?.harness !== 'claude' || evidence.correlation.token !== token
-                    || evidence.route?.kind !== 'claude-native' || evidence.route.address.sessionId !== sessionId)
-                    return [];
-                const row = { artifact, evidence };
-                const seat = facts.seat(evidence.participant), index = parseActivityId(evidence.activity);
-                const item = index === undefined ? undefined : facts.activity(index);
-                if (seat === undefined || item?.kind !== 'say')
-                    return [row];
-                const route = { location, participant: seat.participant,
-                    ...evidence.route, updatedAt: evidence.at };
-                const request = { location, participant: seat.participant, activity: evidence.activity,
-                    actor: item.actor, seat: asSeatRef(seat), claimToken: token, attemptN: evidence.attemptN, route, artifact };
-                return [{ ...row, request, payload: currentPayload(facts, request) }];
-            }));
-            rows.push(...found.value);
-            if (found.value.length === 0)
-                await artifact.close();
-        }
-        catch {
-            await artifact.close();
-        }
-    }
-    return rows;
 }
-/** Recognize the whole frame first; one inactive token vetoes it before any evidence/receipt write. */
-export async function observeClaudeDelivery(sessionId, text, operation, env = process.env) {
+/** Guard pre-effect; admit and observe only the exact captured handoff after each native effect. */
+export async function observeClaudeDelivery(sessionId, text, operation, env = process.env, captured) {
     const tokens = nativeTokens(text);
-    if (tokens.length === 0)
+    if (!tokens.length)
         return { recognized: false, current: false };
-    const rows = await rowsForSession(sessionId, env, [...new Set(tokens)]);
-    const recognized = rows.length > 0;
-    const frames = [...text.matchAll(/(?:^|\n)(\[square-inbox:([a-zA-Z0-9-]+)\]\n[\s\S]*?\n\[\/square-inbox:\2\])(?=\n|$)/g)];
+    const frames = claudeFrames(text);
+    const owner = harnessOwner({ channel: 'claude-code', session: sessionId });
+    const ledger = await DeliveryLedger.open({ location: env.SQUARE_DELIVERY });
     try {
-        if (!recognized || rows.some(row => {
-            const matching = frames.filter(frame => frame[2] === row.evidence.claimToken);
-            return row.payload === undefined || matching.length !== tokens.filter(token => token === row.evidence.claimToken).length
-                || matching.some(frame => frame[1] !== row.payload);
-        }))
+        const found = await Promise.all(tokens.map(token => ledger.handoff(token)));
+        const recognized = found.some(Boolean);
+        if (!recognized)
+            return { recognized: false, current: false };
+        if (frames.length !== tokens.length || new Set(tokens).size !== tokens.length || found.some(ref => !ref))
             return { recognized, current: false };
-        for (const row of rows) {
-            if (operation === 'guard')
-                continue;
-            const request = row.request, payload = row.payload;
-            const admitted = await row.artifact.transactAs({ kind: 'participant', seat: request.seat }, facts => currentPayload(facts, request) === payload && facts.completeDelivery({ seat: request.seat,
-                activity: row.evidence.activity, claimToken: request.claimToken, outcome: 'accepted', at: Date.now() })).catch(() => ({ value: false }));
-            if (!admitted.value)
+        const refs = found;
+        if (refs.some((ref, i) => ref.owner !== owner || ref.routeKind !== 'claude-native' || ref.token !== frames[i].token || ref.payloadHash !== frames[i].payloadHash))
+            return { recognized, current: false };
+        if (operation === 'admitted' && (!Array.isArray(captured) || captured.length !== refs.length || refs.some((ref, i) => {
+            const old = captured[i];
+            return !old || old.token !== ref.token || old.owner !== ref.owner || old.generation !== ref.generation || old.payloadHash !== ref.payloadHash || old.routeKind !== ref.routeKind;
+        })))
+            return { recognized, current: false };
+        if (operation === 'guard') {
+            for (const ref of refs)
+                if (!await ledger.guardHandoff(ref))
+                    return { recognized, current: false };
+            return { recognized, current: true, refs };
+        }
+        for (const ref of refs) {
+            const recorded = operation === 'admitted' ? await ledger.acceptHandoff(ref) : await ledger.observePresentation(ref);
+            if (!recorded)
                 return { recognized, current: false };
-            if (operation === 'stored')
-                await presentPending({ artifact: row.artifact, location: request.location,
-                    // Claude's stored event consumes even Agora previews; retain that contract for both modes.
-                    participant: request.participant, activity: request.activity, seat: request.seat, observationOf: request.claimToken, markSeen: true, sink: { present() { } },
-                    current: facts => currentPayload(facts, request) === payload });
         }
         return { recognized, current: true };
     }
     finally {
-        await Promise.all([...new Set(rows.map(row => row.artifact))].map(artifact => artifact.close()));
+        await ledger.close();
     }
 }

package/dist/claude-mcp-context.js

@@ -1,9 +1,9 @@
 import { createHash, randomBytes } from 'node:crypto';
 import { promises as fs } from 'node:fs';
 import path from 'node:path';
+import { deliveryLedgerLocation } from './delivery-ledger.js';
 import { z } from 'zod/v4';
 import { withFileLock } from './file-lock.js';
-import { squareIndexPath } from './square-index.js';
 import { SquareError } from './model.js';
 const LEASE_MS = 10 * 60 * 1000;
 const text = z.string().max(4096).refine(value => value.trim().length > 0 && !/[\x00-\x1f\x7f]/u.test(value));
@@ -12,7 +12,7 @@ const coordinate = z.object({
 });
 const record = coordinate.extend({ token: z.string().regex(/^[a-f0-9]{64}$/u), expiresAt: z.number() });
 const unavailable = () => new SquareError('unavailable', 'Claude MCP call context unavailable');
-const storeRoot = (env) => path.join(path.dirname(squareIndexPath(env)), 'claude-mcp-calls');
+const storeRoot = (env) => path.join(path.dirname(deliveryLedgerLocation(env)), 'claude-mcp-calls');
 const callFile = (root, id) => path.join(root, `${createHash('sha256').update(id).digest('hex')}.json`);
 async function readRecord(file) {
     try {