@astrosheep/square 0.3.70 → 0.3.71

package/guides/primitive-status-consolidation.md

@@ -0,0 +1,87 @@
+# Canonical status and participant queries — delivery evidence
+
+Deliverer evidence, not independent review or acceptance.
+
+## Coordinates and lane attribution
+
+- Fixed baseline: `501ddc27d5520717f7a9e4d9a5b97406ea72022f`.
+- Isolated status implementation: `43afbc329da827be976232684bf176236a014196`, already containing raw latest removal and the CLI Map lookup.
+- Shared renderer adoption: `9c61849b18704faef5b569f42bc45a832f491bb6`, copying only `presentation.ts` from catch commit `d4df16e0db10d50c01b7ca6646b3c2bdb2871184`. This dependency is **not** counted as status work.
+- Final integrated source: `d8831c729017b69a50f095d9581ff0a0ca61875a`. This document's final update is documentation-only; the tender receipt identifies the final candidate.
+- Integrated target: `main@47aee31156832bac23cf99e44bd9260bdcb8c1ee`, including accepted catch `c3a341e` and history. Both were merged in this worktree. The renderer adoption collapses exactly into accepted catch; only status changes remain relative to this target.
+
+Using the production classification and git-object snapshot recipe in [application-facade-delivery-evidence](application-facade-delivery-evidence.md), with `BASE=501ddc27d5520717f7a9e4d9a5b97406ea72022f` and `CANDIDATE=43afbc329da827be976232684bf176236a014196`:
+
+```text
+baseline: 110 production files, 13926 physical lines, 732940 bytes
+status:   110 production files, 13907 physical lines, 731887 bytes
+production added 83, deleted 102, net -19 lines; -1053 bytes
+
+  0 lines   +163 bytes cli/observation-commands.ts
+-10 lines   -760 bytes decisions.ts
+-26 lines  -1076 bytes square-application.ts
+ -3 lines   -547 bytes square-facade.ts
++20 lines  +1167 bytes views.ts
+```
+
+`git diff --numstat 501ddc2 43afbc3` supplies the added/deleted counts; apply the same production predicate (handwritten `.ts`/`.js`/`.mjs`, excluding tests, generated/build/vendor code, scripts and documentation). There are no new production files. These isolated coordinates remain reproducible after target movement; other lanes' source reductions are never included in the -19. The shared renderer adds 22/deletes 13 lines in its separate commit and is excluded from status attribution. No minification, unrelated deletion, offloading, comment stripping, or weakened tests is used.
+
+### Final residual and whole-source count
+
+The same recipe on `BASE=47aee31156832bac23cf99e44bd9260bdcb8c1ee`, `CANDIDATE=d8831c729017b69a50f095d9581ff0a0ca61875a` isolates the final status residual after both accepted lanes:
+
+```text
+target:    110 files, 13865 physical lines, 729188 bytes
+candidate: 110 files, 13846 physical lines, 728155 bytes
+status residual: added 84, deleted 103, net -19 lines; -1033 bytes
+
+  0 lines   +163 bytes cli/observation-commands.ts
+-10 lines   -760 bytes decisions.ts
+-26 lines  -1076 bytes square-application.ts
+ -3 lines   -547 bytes square-facade.ts
++20 lines  +1187 bytes views.ts
+```
+
+The original isolated commit already includes raw latest removal and Map lookup. The final residual differs by one changed import line (+20 bytes): after history deletes its use of `ApplicationOutcome`, status explicitly retains that needed type. No renderer or other-lane deletion is counted in the residual.
+
+For completeness, **whole integrated source** against fixed `501ddc2` is 110 files, 13846 lines, 728155 bytes: added 291/deleted 371, net **-80 lines/-4785 bytes**. This total includes catch/history and is not claimed as this lane's reduction.
+
+## Removed responsibility and remaining owners
+
+| Removed | Owner after consolidation |
+| --- | --- |
+| `coreStatus` aggregation and `StatusObservation` | Pure `queryStatus(facts, context, viewer)` assembles the final `StatusApplicationData` directly. `coreParticipants`/`ParticipantSummary` remain pure shared domain policy. |
+| `statusPresentation`, `StatusPresentation`, `projection.status`, application status reshaping | Application owns one artifact read, optional viewer discovery and resource lifetime. The query returns final `{data, projection}` without an intermediate status representation. |
+| `participantsPresentation`, `ParticipantsPresentation`, `projection.participants` | Pure `queryParticipants` returns one canonical data roster with shared presence annotations. |
+| Projection copies of ordered participant summaries | Ordered names join to canonical data through a linear-time CLI Map. Presence classification and watcher-first ordering remain pure, shared policy. |
+| Raw status latest duplicated beside public latest | CLI renders `data.latestActivity` through the catch-owned public/raw renderer and uses its public id in the continuation command. Perception and lifetime say ordinal remain additional projection facts. |
+
+Full versus filtered roster is a real distinction: status data omits never-joined historical actor names, while participants data retains them. `knownParticipantCount` separately preserves the complete-roster continuation count; it is not `status.data.participants.length` or the standing count.
+
+The amended guidance's reachable-latest clause is applied: the selector remains newest `say`/`done`. Both require an actor in valid storage, whereas actorless `hold`/`resume` and `read` are not selected. Therefore status has no reachable raw/public latest distinction. The conversion guard remains conservative, but no hypothetical duplicate projection is retained. History and other operations' genuine raw/public distinctions are untouched by this lane.
+
+## Behavior and timing evidence
+
+- `test/projections.test.js`: exact canonical status data, full versus filtered roster, absent duplicate projections, hold/cap/throttle fields, and read/actorless-hold exclusion from latest selection. Existing viewer perception, exact-spelling rejoin and bounded hydration assertions remain. Shared watching/recent/lingering policy remains read-only.
+- `test/application-boundary.test.js`: configured named, discovered (including blank environment name), explicit blank, explicit override and ambient viewer; body perception and attention names; unchanged artifact state and ownership/presence ledger after status.
+- `test/core.test.js`: status and participants continue sharing actual authored and receipt times, including a fresh rejoin and watcher.
+- `test/process/square-cli-render.test.js`: the compact ten-person preview now includes a valid historical never-joined actor in the artifact. Status still hides that actor but its executable continuation uses the full count 14 rather than filtered count 13; participants prints the complete roster. Existing hold duration, exact rejoin, attention, clipping/public-id continuation and presence feedback remain covered.
+
+No observation timing change is intended: optional viewer discovery still precedes status's resource read; the clock is sampled once inside the transaction, and all domain data, classification, perception and rendering annotations are assembled in that read. Queries perform no I/O or mutations themselves. SDK participant/snapshot shapes and MCP serialization of data remain unchanged. No join/claim is introduced.
+
+Production reference search for `coreStatus|StatusObservation|StatusPresentation|ParticipantsPresentation|statusPresentation|participantsPresentation|StatusResult` returns no matches. Neither status nor participants has a duplicate roster in its projection. `git diff --check` passes.
+
+## Verification
+
+Final complete scripts ran on `d8831c7`, above accepted `main@47aee31`:
+
+| Command | Result | Raw log |
+| --- | --- | --- |
+| `npm test` | 610 tests, 609 passed, 0 failed, 1 existing opt-in skip | `/tmp/status-full-final.log` |
+| `npm run test:cli-process` | 48 passed, 0 failed | `/tmp/status-process-final.log` |
+
+Focused build + sandboxed core/projections/application tests passed 53/53 before target integration (`/tmp/status-focused-final.log`); both complete scripts above include their final merged versions. No extra scenario matrix was added.
+
+The skipped test is the existing opt-in shipped Claude mod real-runtime test. No live harness capacity probe was run.
+
+Formal `kei audit kei/one-canonical-participant-status-e138 --include-dirty` reruns both complete declarations for the final integrated candidate; raw log `/tmp/status-audit-final.log`. The audit and tender receipts record the captured candidate, target and satisfied declarations. This is verification and delivery evidence only, not a reviewer verdict. The independent reviewer records acceptance separately.

package/guides/primitive-storage-consolidation.md

@@ -0,0 +1,128 @@
+# Artifact and resource primitive consolidation
+
+Deliverer evidence, not independent review or acceptance.
+
+## Coordinates and scope
+
+- Fixed baseline: `501ddc27d5520717f7a9e4d9a5b97406ea72022f`.
+- Implementation: `c08a4fc5bb966b0bfe7429d10463d64e01ce5d35`.
+- Final source integration: `d3f2faa5b79081638d9fa44295081b8e7b36dd05`, merging all accepted application work at `main` **`bf8ab04fe10505b1e3f40f7cbe3f206142a1a3d6`** (catch `c3a341e`, history `47aee31` ancestors). Application hunks auto-merged; conflicts in model/test imports were resolved by preserving history's removed query language, status's canonical queries and storage's relocated DTOs/actual primitive imports. Catch's public conversion/performance assertions remain. No application implementation outside the owned build/import hunk was changed by this lane.
+- Own-lane measurements below remain separate from accepted catch/history/status changes; integrated totals follow them. The parallel application lanes retain actions/facade/views ownership; this lane changes only imports and build preparation/creation in `square-application.ts`. The final journal receipt identifies the captured candidate and observed target.
+- No schema/version, host registry, native transport or wake-protocol changes.
+
+## Deletion and responsibility map
+
+| Removed concept | Surviving owner |
+| --- | --- |
+| `square-storage.ts`, file/memory cell aliases, snapshot write/create aliases | `artifact.ts`: canonical artifact access, publication, connections and transaction lifetime |
+| `square-file-adapter.ts`, `openSquareArtifact`, `observeSquareChanges`, unused `probeSquare` | Actual callers use `artifact.ts` for storage-only work and `open-square.ts` for host-bound resources |
+| `square-state.ts` guide/configuration branch; duplicate application/SDK validators | `artifact.prepareSquareBuild`: cap/throttle validation, default cap, optional throttle presence, normalized context/warmup, lazy synchronous guide cache |
+| `square-state.ts` legacy SQLite framing | `square-sqlite.ts`: read-only owned-v1 recognition beside row framing/codecs |
+| `square-state.ts` legacy payload validation | `square-migration.ts`: explicit legacy envelope, order/gap and assigned-reference checks, permissive finite route data and path-specific nonfinite rejection |
+| General-model snapshot/runtime DTOs | `square-sqlite.ts`: explicit import/export DTOs, not runtime transaction state |
+| Dead `StoredActHead`, `HoldState`, `findParticipantName`, empty `ReceiverRoute` alias | Deleted; interchange routes use the existing `WakeRoute` type |
+
+There are no forwarding stubs. The renamed build preparation is the actual implementation, not an alias. File SDK build, synchronous memory build and application build share it. Application build returns the normalized configuration from canonical creation rather than reconstructing it. Ordinary storage/resource imports perform no guide reads; the first build reads only its selected guides and caches them.
+
+Necessary boundaries remain:
+
+- `ports.ts` alone declares synchronous typed `SquareRead`, `SquareWrite`, `SquareArtifactPort`; no SQL handles or replacement snapshots enter behavior.
+- `square-domain.ts` remains pure landing/allocation behavior; SQL effect persistence remains in `square-sqlite.ts`.
+- `artifact.ts` retains its ordered queue, capability expiry, poisoned transaction handling, synchronous callback checks, close/cancellation drain and same-callback busy-COMMIT retry.
+- `open-square.ts` composes artifact, captured environment, clock, ledger and transport, and owns resource close. Storage-only inbox observation uses artifact access directly.
+- `square-migration.ts` alone decodes/converts legacy payloads, atomically and explicitly. Ordinary open recognizes owned v1 only to refuse with the recovery command.
+
+Legacy activity/lease validation reuses existing row codecs because their persisted-JSON acceptance agrees. No runtime-wide permissive codec mode was introduced to accommodate nonpersistable own `undefined` keys. Legacy-only route validation remains deliberately separate: finite unknown route data, duplicate ordered routes, arbitrary finite epochs, exact owner strings, orphan assigned receipts, gaps, future read fences, empty/absent optional filters and mentions, NUL and surrogate strings all retain their existing meaning.
+
+## Boundary and behavior evidence
+
+`test/architecture-boundary.test.js` now parses and resolves local imports/exports rather than checking a filename-shaped regex that missed ordinary `./artifact.js`. It includes native plugin and separately compiled agent-delivery sources, including both changed OpenCode paths. Named artifact capabilities have specific callers; SQL imports stay inside artifact/migration. It exercises deliberate ordinary-artifact-import and native-helper SQL leaks, plus the existing transitive CLI/presentation traversal with a helper forwarding directly to artifact. Type-only facade `DiagnoseResult` is an explicit DTO exception, not snapshot access. Pure landing imports only model syntax and typed facts.
+
+| Invariant | Evidence |
+| --- | --- |
+| One configuration path; synchronous memory build; lazy/cached guides | New `build-preparation` parity across memory/file/application, default/optional configuration, selected template and invalid options. Its import-time probe observes **both** `fs.readFileSync` and `fs.promises.readFile`, then asserts synchronous cached build reads. |
+| Canonical creation before destination exists | `canonical-path` now uses a directory symlink with missing nested destination parents, then checks canonical presence/routes through the real path. Concurrent no-force publication remains covered by existing artifact/row suites. |
+| Transaction lifecycle | `artifact`, `sqlite-storage`, `operation-cancellation`: expired capabilities, caught-driver poisoning, synchronous callbacks, exact rollback, same-callback busy COMMIT, abort during COMMIT, close drain and process recovery. |
+| Build cancellation/publication | Existing real locked force-build cancellation leaves no delayed rebuild; cancellation after public link still returns committed success. |
+| Explicit migration fidelity | `migration`: complete authority/revision equality, optional-field presence and permissive legacy values, order/envelope/reference rejection, exact nonfinite paths, rollback, concurrent migration and busy COMMIT. No auto-migration or new schema. |
+| Row/perception behavior and bounded selection | Existing domain, catch, performance, SDK/application/CLI/MCP and native-adapter suites remain; revision observation does not hydrate historical bodies and catch hydrates its selected page. |
+| Test caller ownership | Test callers/child scripts import actual owners, without replacement wrappers. The async-transition fixture uses typed header reads. The opt-in Claude driver uses typed landing and explicit export inspection rather than the retired mutable snapshot callback. |
+
+A local opt-in-driver smoke executed setup/send/inspect through real artifact/ledger ports with an isolated fake receiver and **no Claude process or native route**. It is not live-runtime evidence. The existing opt-in real Claude test remains skipped by default.
+
+## Verification
+
+Repository scripts use the required sandbox preload. Raw logs are local evidence, not committed artifacts.
+
+| Command | Result | Log |
+| --- | --- | --- |
+| `npm test` after preserving original low-level revision timing | 607 tests, 606 passed, 0 failed, 1 existing opt-in real-runtime skip; 57,466.954125 ms | `/tmp/primitive-storage-full3.log` |
+| `npm run test:cli-process` | 48 passed, 0 failed/skipped; 22,589.868167 ms | `/tmp/primitive-storage-cli.log` |
+| Focused boundary/configuration/canonical/transaction/migration/cancellation suites before target movement | 63 passed, 0 failed/skipped | `/tmp/primitive-storage-focused.log` |
+| Final integrated catch/history/status + storage: build; architecture, build preparation, projections, automatic session, application boundary, performance, core, migration, artifact, SQLite transactions and cancellation | 154 passed, 0 failed/skipped | `/tmp/primitive-storage-final-focused.log` |
+| Native adapter file after the revision-read correction | 34 passed, 0 failed/skipped | `/tmp/primitive-storage-adapters2.log` |
+
+Two earlier full runs failed the same Pi next-change retry test, although that test passed alone. The untouched baseline adapter file passed. Investigation removed a newly introduced redundant asynchronous canonicalization from low-level inspection/revision reads; public diagnosis canonicalizes at its entry, and create/write/open keep their canonical ownership. This restores the old revision-read scheduling without modifying the notification protocol or weakening the test. The complete adapter file and full suite then passed. No failure was hidden by selecting only passing tests or increasing wait budgets.
+
+The first formal audit and tender of `67be802`, and catch-integrated audit of `6d2d960`, satisfied 2/2 declarations. After history/status target movement, these earlier runs are not treated as final integrated verification: a fresh journaled `verified` audit/delivery runs both declared suites for the final merged candidate. Its receipt, not this prose, is the final attestation. The deliverer does not record an independent review verdict.
+
+## Production-source measurement
+
+Use the exact production classification and git-object recipe in [application-facade-delivery-evidence](application-facade-delivery-evidence.md), setting `BASE='501ddc2'` and `CANDIDATE='c08a4fc5bb966b0bfe7429d10463d64e01ce5d35'`. It covers every handwritten `.ts`, `.js`, `.mjs` outside the documented test/fixture/script/generated/vendor/build/docs/skills/internal exclusions, including native plugins and packages. `git ls-files --cached --others --exclude-standard` was also checked against the worktree: no new/untracked production source is omitted. The sole new source file is a test. Documentation descendants do not change the production result.
+
+`git diff --numstat BASE CANDIDATE`, filtered by that same predicate, gives **317 added / 481 deleted / net −164 production lines**. Totals and all changed production paths:
+
+```text
+baseline files 110 lines 13926 bytes 732940
+candidate files 107 lines 13762 bytes 726113
+    +46 lines     +2599 bytes artifact.ts
+     +0 lines        -8 bytes automatic-session.ts
+     +0 lines        -8 bytes boundary-presentation.ts
+     +0 lines        -8 bytes claude-delivery.ts
+     +0 lines        -8 bytes claude-mod.ts
+     +0 lines        -8 bytes delivery-health.ts
+     +0 lines        +2 bytes inbox.ts
+     +0 lines        -8 bytes list.ts
+    -29 lines      -822 bytes model.ts
+     +0 lines        -8 bytes notifications.ts
+    +56 lines     +2316 bytes open-square.ts
+     +0 lines        -8 bytes plugins/opencode/delivery.ts
+     +0 lines        -8 bytes plugins/opencode/index.ts
+    -10 lines      -583 bytes square-application.ts
+   -127 lines     -4771 bytes square-file-adapter.ts
+   +109 lines     +5442 bytes square-migration.ts
+    +70 lines     +4472 bytes square-sqlite.ts
+   -257 lines    -14048 bytes square-state.ts
+    -22 lines     -1353 bytes square-storage.ts
+     +0 lines        -9 bytes stream.ts
+added 317 deleted 481 net -164 bytes delta -6827
+```
+
+### Integrated target accounting
+
+The same recipe on final source integration `d3f2faa` separates this delivery from all accepted application lanes:
+
+| Coordinate | Production files | Lines | Bytes |
+| --- | ---: | ---: | ---: |
+| Fixed baseline `501ddc2` | 110 | 13,926 | 732,940 |
+| Accepted catch/history/status target `bf8ab04` | 110 | 13,846 | 728,155 |
+| Integrated storage + all application lanes `d3f2faa` | 107 | 13,682 | 721,328 |
+
+- Storage lane against final target: **317 added / 481 deleted / net −164 lines; −6,827 bytes** (unchanged from its isolated measurement).
+- Already-accepted application target against fixed baseline: **net −80 lines; −4,785 bytes**.
+- Cumulative candidate against fixed baseline: **608 added / 852 deleted / net −244 lines; −11,612 bytes**. This combined number is not claimed as storage-only reduction.
+- No untracked production source; documentation-only descendants leave these totals unchanged. Unrelated dirty root-worktree `plugins/paseo/client/square-message.tsx` is not in this worktree or candidate; it was neither staged nor restored.
+
+This is genuine deletion of alias/factory ladders, duplicate configuration/activity/lease validation, eager guide initialization and proven-dead declarations. Surviving responsibilities were moved to their owners and remain counted. No formatting compression, statement packing, excluded-path production offloading, generic framework, arbitrary comment deletion or unrelated production removal was used to meet the negative count. Necessary framing documentation was retained at its new SQL owner. Reduction is evidence, not by itself a quality verdict.
+
+## Reference search
+
+Search all production paths selected above, not merely root TypeScript:
+
+```text
+pattern: square-(storage|file-adapter|state)\.js
+pattern: \b(createFileCell|createMemoryCell|createSquareSnapshot|writeSquareSnapshot|openSquareArtifact|observeSquareChanges|probeSquare|createSquareState)\b
+(no production matches; rg exit 1 for both)
+```
+
+The three deleted paths are absent. Snapshot DTO references stay in `artifact.ts`, `square-sqlite.ts`, `square-migration.ts`; host/resource and behavior consumers use typed ports. Build validation strings occur only in `artifact.ts`. Resolved responsibility assertions above protect this map, rather than defending obsolete filenames.

package/guides/row-runtime-delivery-evidence.md

@@ -0,0 +1,160 @@
+# Row runtime delivery evidence
+
+Candidate implementation: `833d6f15c9071767eb49a9562a4c42a93c6f4000` plus post-review removal of three dead runtime exports and benchmark phase baselines. Baseline: `99679eb2905dde5f282025bc7f5494f7da065e54`. This report is Deliverer evidence, **not independent review or acceptance**. Explicit migration is a separate delivery; no publication, live migration, host service change, or remote native presentation was performed.
+
+## Deletion and replacement
+
+| Removed mechanism | Current owner / replacement |
+|---|---|
+| Blob-backed artifact read/transact, full-state clones and JSON equality change detection | `artifact.ts` queues synchronous guarded typed callbacks; `square-sqlite.ts` reads selected rows and tracks actual authoritative writes. Revision advances once per changed transaction. |
+| Whole-history fold on normal operations; replay delivery/perception closures | `square-domain.ts::deriveLanding` maintains participant, attention and ordered audience indices once at landing; `runtime.ts` computes cursor/presence/terminal from narrow domain facts. |
+| `FromState`/delta bridges and old core append/observation update helpers | Removed. `SquareWrite.land/markSeen/putLease/removeLease/replaceRoutes` are the finite domain mutations. Memory uses the same SQLite driver in `:memory:`, not a second selector/policy implementation. |
+| Renderer `.state` inputs and replay-based ordinal/perception lookup | `views.ts`, `perception-projection.ts` and presentation operations settle selected bodies, ordinals, counts and perceptions inside the transaction; renderers receive detached values. |
+| Join/status/hold/resume/done snapshot loads for counts | `joinFacts`, standing counts, roster/status aggregates and header reads. Public SDK snapshot is no longer used by these production callers. |
+| Global whole-history notification/wake enumeration | Bodyless `pendingAudience` groups with a captured activity upper bound and recipient join coordinates; receivers use their own `directed` relation. Scans advance past withheld groups and do not restart on unrelated writes. |
+| Whole-history native/Claude currentness and cancellation | Exact pending facts, ordered routes, lease and captured host fences; cancellation selects activity heads by descending coordinate and tests timestamp. Host/network work stays outside artifact transactions. |
+| Preliminary full load before file-backed open/probe/wait | Validated header/schema boundary, revision-only observer; selected row validation on access. Full doctor is explicit. |
+| Tests tied to removed callback-state mutation and serialization details | Replaced by typed transaction, differential oracle, sparse receipt, projection, process-race and recovery evidence. Behavioral coverage retained. |
+
+### Remaining references and explicit exceptions
+
+Searches were run over production `.ts/.js/.mjs`, excluding dependencies/generated output, and over call sites:
+
+```sh
+rg -n 'FromState|foldActivities|foldSquare|cloneState|loadSquare|readSquareState|writeSquareState|square_snapshot|\.state\b|SquareState' --glob '*.{ts,js,mjs}' --glob '!test/**' --glob '!scripts/**' --glob '!dist/**' --glob '!node_modules/**'
+rg -n 'validateSquareState|exportSqliteState|initializeSqlite|writeSquareSnapshot|createSquareSnapshot|createMemoryCell|writeSquareFile|deriveLanding|landingFacts|\.snapshot\(' --glob '*.ts' --glob '!dist/**' --glob '!node_modules/**'
+```
+
+- No production `FromState`, old fold/clone/load functions or hot `.snapshot()` caller remains.
+- `SquareState` remains an explicit initialization/import/export format in `model.ts`, `square-state.ts`, `square-sqlite.ts`, `artifact.ts`, `square-storage.ts` and `square-file-adapter.ts`. It is not a transaction result or partial fact projection.
+- `square-state.ts` retains legacy validation for the separately implemented migration and test oracle. Normal v1 recognition validates framing and refuses with `migration_required`; it never decodes v1 history. Common per-activity validation is also used by the row codec.
+- `artifact.ts::readSquareSnapshot` and `square-sqlite.ts::exportSqliteState` are explicit export/integrity capabilities. Doctor intentionally reads all authority and compares maintained indices against a rebuild. Neither is a hot-runtime fallback.
+- `createSquareSnapshot` initializes a new artifact. `writeSquareSnapshot/writeSquareFile` are explicit build `--force`/fixture import, not whole-state transaction callbacks. Existing v1 still refuses before destructive work. `initializeSqlite` also supplies the migration's shared rebuild; it calls the same `deriveLanding`, not another production fold.
+- Public SDK `snapshot().delivered()` copies raw receipt assignments into a detached exact-owner Set; it does not retain a query or transaction capability and copies no activity history.
+- `.state` matches elsewhere are participant/admission states, transport outcomes or Claude's native `$.state` API, not artifact snapshots. `packages/agent-delivery` remains untouched.
+- `test/fixtures/legacy-square-core.js` is a frozen test-only v1 replay oracle. `square_snapshot` in the benchmark is instrumentation for detecting forbidden legacy reads, not a runtime path.
+
+### Production source size
+
+The Contract's exact `git diff --numstat` script, counting tracked production `.ts/.js/.mjs` and excluding tests/fixtures/scripts/dist/dependencies/reference, reports:
+
+| Candidate | Added | Deleted | Net |
+|---|---:|---:|---:|
+| Initial runtime (`6a4f818`) against fixed baseline | 2,396 | 2,601 | **-205** |
+| Post-review runtime against fixed baseline | 2,387 | 2,598 | **-211** |
+
+Documentation and benchmark/test additions are excluded by the prescribed rule; no production code was moved into excluded paths. Negative size alone does not establish quality: independent review must still judge duplication, unnecessary abstraction and formatting-only reduction. The initial reviewer confirmed raw -205 but found formatting contributes substantially; their uniform synthesized/comment-free TypeScript-printer diagnostic was 7,881 -> 7,960 (+79), not a new numerical gate. That concern is not waived by this report. Substantive deletions include core `createFoldAccumulator/applyActivity/finishFold/fold/replayLandedAudiences/perceive`, runtime `foldedState/countSays/sayNumberFor/recordObservation/writeWatchLease/removeWatchLease`, decisions `coreActivities/buildParticipantStatuses`, actions `storeActs/committedActivity`, delivery `deriveDeliveryModel/perceiveActivity/isActivitySeen`, and storage `cloneState/assertCellOpen/isThenable/discardThenable`. Their replacements are mapped above. Post-review also deletes the unused `matchesMentionTarget/resolveRosterName/actStableIndex` exports and their unused imports. No formatting-only cleanup was added to obtain the post-review delta. Migration's Deliverer reported the combined candidate at +2,527/-2,603 = -76; that candidate is not this runtime tender and still requires its own verification/review.
+
+## Behavioral verification
+
+Executed against the implementation above, sandboxed:
+
+- `npm test`: **556 pass, 0 fail, 1 skip**, 97.467s. The skip is the existing opt-in shipped Claude real-runtime scheduling/lifecycle test, not a row-runtime assertion.
+- `npm run test:cli-process`: **48 pass, 0 fail**, 47.833s.
+- Contract source-count command: pass, net -205.
+
+Earlier integrated full-suite execution had 520 pass / 7 fail. Actual stale fixture APIs and injected-clock mismatches were corrected; three timing failures then passed isolated and in the final full run. No timeout/assertion was relaxed to hide them.
+
+Evidence locations:
+
+| Invariant | Tests |
+|---|---|
+| Maintained roster/attention/audience equals independent v1 replay, including gaps, mixed spelling, reply/mention/listen/ignore/bell/done/rejoin priority and order | `test/row-domain.test.js`, frozen `test/fixtures/legacy-square-core.js` |
+| Sparse receipts, exact raw owners/orphans, unseen hole vs later catch, repeat no-op, filtered remaining, historical catch vs latest-join pending, distinct cursor/presence | `test/row-domain.test.js`, `test/perception-projection.test.js` |
+| Exact v2 schema, optional field preservation, immutable detached facts, expired capabilities, synchronous callbacks, caught storage failure rollback, no-op revision, selected corruption vs doctor | `test/artifact.test.js`, `test/core.test.js` |
+| Two real processes serialize catches; process death rolls activity and indices back; busy COMMIT retains callback/result; abort preserves reason; revision read has a positive SQL control | `test/sqlite-storage.test.js` |
+| Search filtering before limit; audience paging through empty intersections; context by existing positions; exact-spelling rejoin annotation; detached SDK receipt closure; stream advances bodyless raw page | `test/projections.test.js` |
+| Complete recipient discovery beyond 100 withheld rows; expiry-only reconsideration; failed evidence does not spin; isolation and repair of unreadable binding | `test/session-pending.test.js` |
+| Bodyless sweep advances through suppressed groups under unrelated writes, ignores new rows beyond captured bound; dispatch remains roster-major | `test/delivery-operations.test.js` |
+| Native epoch/cancel/claim/send fences, clipping and Pi omitted-batch handling remain green | Existing native, delivery, Pi and automatic-session tests in full suite |
+
+Raw local logs: `/tmp/doghouse-test-final.log`, `/tmp/doghouse-cli-final.log`. These paths are ephemeral; the reproducible commands and summarized results above are the durable evidence.
+
+## Actual 300-process capacity probes
+
+Node v26.10.0, disposable artifacts and a shared synthetic host ledger. Every run uses **300 independent worker processes on the same artifact**. In the initial reports below, idle CPU excludes setup but idle SQL/ledger counters are **cumulative receiver startup plus idle**, not isolated idle. The initial `sessionSetupExcluded:true` label was too broad; independent review caught this. Startup baselines were not retained in those old reports, so their unknown contribution is not fabricated or subtracted. Post-review instrumentation captures actual before-idle/before-catch counter baselines and reports deltas alongside the cumulative per-worker records; corrected measurements are recorded separately below. The required active command defaults to **both 1,800 and 18,000 unrelated rows**, each with 2,048-byte bodies. The producer lands a bell directly without notification push; `--no-hints` disables fs.watch only in benchmark workers. Authoritative reconciliation remains unchanged. This measures local projection discovery and concurrent catch, not native remote message landing or an SLA.
+
+```sh
+node --import ./test/sandbox-env.js scripts/benchmark-idle-wait.mjs --workers 300 --mode session
+node --import ./test/sandbox-env.js scripts/benchmark-idle-wait.mjs --workers 300 --mode session --active --no-hints
+```
+
+Both exact required commands exited 0. The active command completed both history sizes with 300 ready / 300 complete each. Each worker discovered one bell, caught exactly one activity, then ordinary catch consumed zero again. The fixed 20s discovery deadline and existing derived 145s phase guard were retained.
+
+### Initial required standalone idle run (startup-inclusive counters)
+
+300 ready / 300 complete; five-second idle phase: **0 hydrated rows/bytes**, CPU total 3,909.983ms (mean 0.2563% per worker), 6,536 header statements, 38,208,000 ledger bytes / 6,802 operations, 0 busy errors. Positive controls: 3 header reads, 1 hydrated body / 2,090 encoded bytes, 6,308 seed write statements (at least 2,101 required), 2,400 ledger setup operations.
+
+### Initial required active comparison (idle counters include startup)
+
+All CPU/statement/byte/busy counts below are totals across 300 workers; latency and wall time are per-worker distributions. Bytes are instrumented encoded hydrated-row bytes, not SQLite page I/O.
+
+| Metric | 1,800 unrelated rows | 18,000 unrelated rows |
+|---|---:|---:|
+| Ready / completed | 300 / 300 | 300 / 300 |
+| Seed acts / ms / artifact bytes | 2,101 / 4,025 / 7,700,480 | 18,301 / 54,582 / 75,366,400 |
+| Idle hydrated rows / bytes | 0 / 0 | 0 / 0 |
+| Idle CPU ms / mean per-worker CPU % | 3,636.661 / 0.2406% | 3,273.842 / 0.2175% |
+| Startup + idle header statements | 5,990 | 5,754 |
+| Startup + idle ledger bytes / operations | 38,208,000 / 6,212 | 38,208,000 / 5,936 |
+| Bell producer commit wall ms | 117 | 50 |
+| Discovery latency p50 / p95 / max ms | 2,311 / 2,883 / 2,920 | 1,111 / 2,202 / 2,238 |
+| Discovery body rows / bytes | 300 / 18,000 | 300 / 18,000 |
+| Discovery head rows / header statements | 300 / 1,654 | 300 / 1,624 |
+| Discovery CPU ms | 4,428.157 | 3,635.459 |
+| Discovery ledger bytes / operations | 19,104,000 / 1,130 | 19,104,000 / 1,142 |
+| Discovery busy errors / busy COMMIT | 0 / 0 | 0 / 0 |
+| Discovery COMMIT attempts / execution ms | 677 / 130.135 | 662 / 15.854 |
+| Catch per worker / reconsume total | 1 / 0 | 1 / 0 |
+| Catch wall p50 / p95 / max ms | 25,673.901 / 28,002.005 / 28,372.043 | 16,462.888 / 18,329.207 / 18,594.534 |
+| Catch body rows / bytes | 300 / 18,000 | 300 / 18,000 |
+| Catch head rows / header statements | 2,100 / 3,906 | 2,100 / 3,900 |
+| Catch CPU ms | 55,637.897 | 41,478.691 |
+| Catch write statements | 600 | 600 |
+| Catch busy errors / busy COMMIT | 191,548 / 145 | 129,827 / 104 |
+| Catch COMMIT attempts / execution ms | 1,345 / 4,432.922 | 1,304 / 714.977 |
+| Catch ledger bytes / operations | 171,936,000 / 2,700 | 171,936,000 / 2,700 |
+
+Controls for **each** active size: 3 header reads, 1 body / 2,090 bytes, 2,400 ledger operations. Seed write counts were 6,308 (>=2,101) and 54,908 (>=18,301). Legacy whole-state reads were zero throughout. Instrumentation wraps actual SQLite prepare/exec and Statement all/get/run/iterate, classifies payload hydration including SELECT *, and counts positive body/header/write/ledger controls. Its self-test also induces a real SQLite busy condition. Failed runs emit received phase counters and exit nonzero rather than inventing missing results.
+
+### Failed/diagnostic probes and interpretation
+
+An earlier exact active command failed the 145s guard with all 300 workers ready. That is an **incomplete run, not a capacity pass**; the failure's cause was not established. Its old report did not retain enough phase detail, so partial failure reporting was added before the successful required rerun. An intervening diagnostic `--history 1800` run completed 300 workers, but counted only one size and was not used to satisfy the comparison requirement. No process count or deadline was lowered/extended to obtain the final pass.
+
+The completed comparison establishes no unrelated-history body hydration in receiver idle/discovery/catch phases. It does **not** establish constant-time SQL index counts, a fast catch SLA, or cross-process monitor deduplication. Simultaneous write acquisition causes substantial busy retries and tens-of-seconds catch wall time; COMMIT execution duration is not total waiting duration. Host-ledger parsing still contributes substantial bytes/work and is intentionally unchanged by this delivery. The larger-history run being faster is a run observation, not proof that adding history improves performance.
+
+Raw local reports: `/tmp/doghouse-benchmark-300-idle.json`, `/tmp/doghouse-benchmark-300-active-final.json` (includes individual workers), corresponding `.err` files; earlier failure `/tmp/doghouse-benchmark-300-active.err`; diagnostic `/tmp/doghouse-benchmark-300-diagnose.json`. Initial Contract audit satisfied 4/4 at `6a4f818` (receipt `01M4XSZ9REQ28W39MBJFW7AJ0G`), but the subsequent tender's fresh verification was interrupted by the Deliverer's insufficient outer tool timeout and did not establish a current satisfied gate. Independent review was **unsatisfied**, receipt `01M4XTE345H4DE4ZVWHC3VBXK8`, citing three dead exports, stale verification and the counter attribution caveat. That initial candidate is not accepted. The corrected complete candidate requires new formal verification and independent review.
+
+### Corrected phase-attributed probes (`daed87f`)
+
+Both exact required commands were rerun after the review corrections and **exited 0**: standalone idle 300 ready / 300 complete, active 300 ready / 300 complete at **both** history sizes. Before-idle counters are actual worker snapshots taken after `go`, aligned with the CPU/wall start; idle metrics subtract them. Before-catch snapshots are taken after the catch signal, aligned with catch CPU/wall start. Discovery subtracts the preceding idle-end snapshot. Reports retain these baselines, cumulative end snapshots and individual deltas; no old unknown startup contribution was estimated.
+
+Standalone corrected idle: CPU 3,642.488ms, mean 0.2418% per worker; **0 hydrated rows/bytes**, **0 ledger bytes**, 1,558 header statements, 1,580 ledger operations, 0 busy errors. The excluded measured receiver-before-idle baseline contained 3,704 header statements, 38,208,000 ledger bytes / 3,904 operations and 0 hydrated bodies. Thus a zero idle ledger byte result does not mean the ledger counter was inactive.
+
+| Corrected metric (worker totals unless distribution) | 1,800 unrelated rows | 18,000 unrelated rows |
+|---|---:|---:|
+| Ready / complete | 300 / 300 | 300 / 300 |
+| Seed ms / artifact bytes | 2,864 / 7,700,480 | 29,234 / 75,366,400 |
+| Measured before-idle header statements | 4,402 | 3,560 |
+| Measured before-idle ledger bytes / ops | 38,208,000 / 4,568 | 38,208,000 / 3,760 |
+| Idle body rows / bytes / ledger bytes | 0 / 0 / 0 | 0 / 0 / 0 |
+| Idle CPU ms / mean per-worker CPU % | 3,313.042 / 0.2198% | 3,546.703 / 0.2355% |
+| Idle header statements / ledger ops / busy | 1,552 / 1,596 / 0 | 1,568 / 1,604 / 0 |
+| Bell producer commit wall ms | 29 | 40 |
+| Discovery latency p50 / p95 / max ms | 1,430 / 1,992 / 2,026 | 1,532 / 2,051 / 2,066 |
+| Discovery body rows / bytes / head rows | 300 / 18,000 / 300 | 300 / 18,000 / 300 |
+| Discovery header statements / CPU ms | 1,666 / 3,472.307 | 1,660 / 3,550.010 |
+| Discovery ledger bytes / ops | 19,104,000 / 1,164 | 19,104,000 / 1,126 |
+| Discovery busy / COMMIT busy | 0 / 0 | 0 / 0 |
+| Discovery COMMIT attempts / execution ms | 683 / 4.981 | 680 / 97.996 |
+| Catch per worker / reconsume total | 1 / 0 | 1 / 0 |
+| Catch wall p50 / p95 / max ms | 17,606.704 / 19,263.257 / 19,432.453 | 15,233.103 / 17,050.284 / 17,369.085 |
+| Catch body rows / bytes / head rows | 300 / 18,000 / 2,100 | 300 / 18,000 / 2,100 |
+| Catch header statements / CPU ms | 3,902 / 40,895.422 | 3,900 / 37,722.763 |
+| Catch write statements / busy errors | 600 / 129,666 | 600 / 116,260 |
+| Catch COMMIT attempts / busy / execution ms | 1,328 / 128 / 658.882 | 1,317 / 117 / 450.338 |
+| Catch ledger bytes / ops | 171,936,000 / 2,700 | 171,936,000 / 2,700 |
+
+Positive controls remain 3 header reads, 1 body / 2,090 bytes, seed writes 6,308 (>=2,101) and 54,908 (>=18,301), 2,400 ledger setup operations, and zero legacy reads. The instrumentation self-test passed. A separate **two-worker diagnostic**, not capacity evidence, verified idle/catch deltas against actual nonzero startup baselines and aggregate sums. The 300-process reports' idle deltas/aggregate ledger sums were likewise checked against their actual retained baselines.
+
+Corrected raw records: `/tmp/doghouse-benchmark-300-idle-corrected.json`, `/tmp/doghouse-benchmark-300-active-corrected.json` and corresponding `.err`; diagnostic `/tmp/doghouse-phase-baseline-control.json`. The prior reports remain available rather than being overwritten. These corrected results establish phase attribution and completion, not a faster catch SLA or a host-ledger redesign.