@astrosheep/square 0.3.86 → 0.3.87

package/plugins/opencode/delivery.ts

@@ -1,59 +1,70 @@
-import type { EvidenceRecord, NativeDeliveryEvidence, PresenceRecord } from '../../host-ledger.js';
-import type { SquareRead, WakeTransportPort } from '../../ports.js';
-import { nameKey } from '../../model.js';
-import { nativePendingPreview, observeSessionPending, sessionInbox } from '../../inbox.js';
-import { hostLedgerForEnv } from '../../registry.js';
-import { openSquare } from '../../open-square.js';
-import { closeOpenSquare } from '../../open-square.js';
-import { presentationSuppressesWake, projectPresentationEvidence } from '../../square-projections.js';
-import { presentPending } from '../../presentation-operations.js';
+import { createHash } from 'node:crypto';
+import { createArtifactPort } from '../../artifact.js';
 import { deliverPending } from '../../delivery-operations.js';
-import { createWakeTransport } from '../../notifications.js';
-import { publishWakeRoute } from '../../routes.js';
+import { nativePendingPreview, observeSessionPending, projectSessionSeats } from '../../inbox.js';
+import { automaticWakeEligible, presentationBlocksWake } from '../../delivery.js';
+import { sameBody, type Seat } from '../../model.js';
+import type { SquareRead, WakeRequest, WakeTransportPort } from '../../ports.js';
 import { formatActivityId, parseActivityId } from '../../square-core.js';
+import { indexedSquareEntries } from '../../square-index.js';
+import { asSeatRef } from '../../seats.js';
+import { presentPending } from '../../presentation-operations.js';
 import { createNativeInputId, sendNativeText, type OpenCodeNativeSession } from '../../packages/agent-delivery/src/opencode-native.js';
 
 const routeKind = 'opencode-server' as const;
-type NativeRow = EvidenceRecord & { claimToken: string; nativeDelivery: Extract<NativeDeliveryEvidence, { harness: 'opencode' }> };
+const bodyFor = (sessionId: string) => ({ channel: 'opencode', session: sessionId });
+const payloadHash = (payload: string) => createHash('sha256').update(payload).digest('hex');
 export interface OpenCodeContextMessage { readonly id?: string; readonly role: string; readonly content: readonly { readonly type: string; readonly text?: string }[] }
-const key = (location: string, participant: string, index: number) => `${location}\0${nameKey(participant)}\0${index}`;
 
-/** The one native pending preview: the audience/catch/epoch fence before send and inside presentation. */
-function preview(facts: SquareRead, owner: PresenceRecord, index: number) {
-  return nativePendingPreview(facts, { location: owner.location, routeKind, sessionId: owner.session, participant: owner.participant, actIndex: index, epoch: owner.epoch, address: { sessionId: owner.session }, cancelledThrough: owner.cancelledThrough, now: Date.now() });
+function preview(facts: SquareRead, location: string, seat: Seat, index: number) {
+  return nativePendingPreview(facts, {
+    location, routeKind, sessionId: seat.body.session, participant: seat.participant,
+    actIndex: index, address: { sessionId: seat.body.session }, now: Date.now(),
+  });
+}
+
+export async function indexedOpenCodeSessions(env: NodeJS.ProcessEnv): Promise<readonly string[]> {
+  return [...new Set((await indexedSquareEntries({ channel: 'opencode' }, env)).map((entry) => entry.body.session))];
 }
 
-function createOpenCodeWakeTransport(target: OpenCodeNativeSession, env: NodeJS.ProcessEnv, lifetime: AbortSignal): WakeTransportPort {
-  const ledger = hostLedgerForEnv(env);
+export async function discoverOpenCodeSeats(sessionId: string, env: NodeJS.ProcessEnv, signal?: AbortSignal) {
+  return projectSessionSeats({ body: bodyFor(sessionId), env }, signal);
+}
+
+function sameSeat(left: Seat | undefined, right: Seat): boolean {
+  return left !== undefined && left.generation === right.generation && sameBody(left.body, right.body);
+}
+
+function createOpenCodeWakeTransport(target: OpenCodeNativeSession, lifetime: AbortSignal): WakeTransportPort {
   return {
-    probe: async (route) => !lifetime.aborted && route.kind === routeKind && route.sessionId === target.sessionId && route.address.sessionId === target.sessionId,
-    async attempt(request, timeoutMs, beforeSend) {
+    probe: async (route) => !lifetime.aborted && route.kind === routeKind
+      && route.sessionId === target.sessionId && route.address.sessionId === target.sessionId,
+    async attempt(request: WakeRequest, timeoutMs: number, beforeSend) {
+      const index = parseActivityId(request.activity);
+      const artifact = request.artifact;
+      if (artifact === undefined || request.claimToken === undefined || index === undefined
+        || !sameBody(request.seat.body, bodyFor(target.sessionId))
+        || request.route.kind !== routeKind || request.route.address.sessionId !== target.sessionId) {
+        return { outcome: 'not-capable', diagnostic: 'OpenCode attention has no matching artifact claim or session.' };
+      }
       const signal = AbortSignal.any([lifetime, AbortSignal.timeout(timeoutMs)]);
-      const deadline = Date.now() + timeoutMs;
-      // Start the native call under the ownership fence, but await it OUTSIDE: prompt may
-      // enter our context hook synchronously and that hook needs the same ownership lock.
-      const started = await ledger.withClaimLock(async () => {
-        if (signal.aborted || request.route.sessionId !== target.sessionId || !request.claimToken
-          || !await (beforeSend?.() ?? Promise.resolve(true))) return undefined;
-        const owner = (await ledger.listPresence({ location: request.location, participant: request.participant, session: target.sessionId }))
-          .find((binding) => binding.channel === 'opencode' && binding.epoch === request.route.epoch);
-        const index = parseActivityId(request.activity);
-        if (!owner || index === undefined) return undefined;
-        const square = await openSquare(owner.location, { hostLedger: ledger, env, signal });
-        try {
-          const { value: prepared } = await square.artifact.read((facts) => preview(facts, owner, index), signal);
-          if (!prepared) return undefined;
-          const row: NativeRow & { routeKind: typeof routeKind } = { location: owner.location, participant: owner.participant, session: target.sessionId,
-            activity: request.activity, kind: 'wake', outcome: 'dispatching', routeKind, attemptN: request.attemptN, claimToken: request.claimToken,
-            nativeDelivery: { harness: 'opencode', epoch: owner.epoch ?? 0, inputId: createNativeInputId(), payload: prepared.payload } };
-          if (!await ledger.prepareNativeWake(row) || !await (beforeSend?.() ?? Promise.resolve(true)) || signal.aborted
-            || (await square.artifact.read((facts) => preview(facts, owner, index)?.payload, signal)).value !== prepared.payload) return undefined;
-          return { sending: sendNativeText(target, prepared.payload, { inputId: row.nativeDelivery.inputId, delivery: 'steer',
-            timeoutMs: Math.max(1, deadline - Date.now()), signal }) };
-        } finally { await closeOpenSquare(square); }
-      }, signal);
-      if (!started) return { outcome: 'not-capable', diagnostic: 'OpenCode attention, binding or local delivery generation changed before send.' };
-      const result = await started.sending;
+      const started = Date.now();
+      if (signal.aborted || !await beforeSend())
+        return { outcome: 'not-capable', diagnostic: 'OpenCode attention changed before send.' };
+      const { value: prepared } = await artifact.read((facts) => preview(facts, request.location, request.seat as Seat, index), signal);
+      if (prepared === undefined) return { outcome: 'not-capable', diagnostic: 'OpenCode attention is no longer current.' };
+      const inputId = createNativeInputId();
+      const correlation = { harness: 'opencode' as const, token: inputId, payloadHash: payloadHash(prepared.payload) };
+      if (!await artifact.prepareDelivery({ seat: request.seat, claimToken: request.claimToken, correlation }, signal))
+        return { outcome: 'not-capable', diagnostic: 'OpenCode delivery claim is no longer current.' };
+      const fresh = await artifact.read((facts) => preview(facts, request.location, request.seat as Seat, index), signal);
+      if (fresh.value === undefined || payloadHash(fresh.value.payload) !== correlation.payloadHash)
+        return { outcome: 'not-capable', diagnostic: 'OpenCode attention changed before native send.' };
+      if (signal.aborted || !await beforeSend())
+        return { outcome: 'not-capable', diagnostic: 'OpenCode attention was consumed before send.' };
+      const result = await sendNativeText(target, prepared.payload, {
+        inputId, delivery: 'steer', timeoutMs: Math.max(1, timeoutMs - (Date.now() - started)), signal,
+      });
       if (result.state === 'accepted') return { outcome: 'accepted' };
       if (result.state === 'unavailable') return { outcome: 'failed', unavailable: true, retainRoute: true, signature: result.code };
       return { outcome: 'unknown', signature: result.code };
@@ -61,89 +72,130 @@ function createOpenCodeWakeTransport(target: OpenCodeNativeSession, env: NodeJS.
   };
 }
 
-/** Only the matching prepared primary context authorizes presentation, never admission. */
+function textMessage(message: OpenCodeContextMessage): string | undefined {
+  if (message.role !== 'user' || message.id === undefined || !message.content.every((part) => part.type === 'text' && typeof part.text === 'string')) return undefined;
+  return message.content.map((part) => part.text!).join('');
+}
+
+/** The exact prepared native message can authorize artifact-backed presentation once. */
 export async function observeOpenCodeContext(sessionId: string, messages: readonly OpenCodeContextMessage[], env: NodeJS.ProcessEnv, signal: AbortSignal): Promise<void> {
-  const ledger = hostLedgerForEnv(env);
-  await ledger.withClaimLock(async () => {
+  const observed = new Map(messages.flatMap((message) => {
+    const text = textMessage(message);
+    return text === undefined ? [] : [[message.id!, payloadHash(text)] as const];
+  }));
+  if (observed.size === 0 || signal.aborted) return;
+  for (const { location, seat } of await discoverOpenCodeSeats(sessionId, env, signal)) {
     if (signal.aborted) return;
-    const rows = (await ledger.listEvidence({ kind: 'wake', session: sessionId })).filter((row): row is NativeRow =>
-      row.nativeDelivery?.harness === 'opencode' && !!row.claimToken && ['dispatching', 'unknown', 'accepted'].includes(row.outcome));
-    for (const row of rows) {
-      if (signal.aborted || !messages.some((message) => message.id === row.nativeDelivery.inputId && message.role === 'user'
-        && message.content.every((part) => part.type === 'text' && typeof part.text === 'string')
-        && message.content.map((part) => part.text).join('') === row.nativeDelivery.payload)) continue;
-      const owner = (await ledger.listPresence({ location: row.location, participant: row.participant, session: sessionId }))
-        .find((binding) => binding.channel === 'opencode' && binding.epoch === row.nativeDelivery.epoch);
-      const index = parseActivityId(row.activity);
-      if (!owner || index === undefined) continue;
-      const square = await openSquare(row.location, { hostLedger: ledger, env, signal });
-      try {
-        const { value: prepared } = await square.artifact.read((facts) => preview(facts, owner, index), signal);
-        if (!prepared || prepared.payload !== row.nativeDelivery.payload) continue;
-        const prior = await projectPresentationEvidence({ hostLedger: ledger, location: row.location, participant: row.participant, sessionId, activity: row.activity });
-        if (presentationSuppressesWake(prior)) continue;
-        await presentPending({ artifact: square.artifact, hostLedger: ledger, location: row.location, participant: row.participant, session: sessionId,
-          activity: row.activity, sink: { present() {} }, markSeen: !prepared.clipped, signal,
-          current: (facts) => !signal.aborted && preview(facts, owner, index)?.payload === row.nativeDelivery.payload });
-      } finally { await closeOpenSquare(square); }
-    }
-  }, signal);
+    const artifact = createArtifactPort(location, undefined, signal);
+    try {
+      const { value: matches } = await artifact.read((facts) => {
+        if (!sameSeat(facts.seat(seat.participant), seat)) return [];
+        return facts.deliveryEvidence(seat.participant, seat.generation).flatMap((evidence) => {
+          const token = evidence.correlation?.harness === 'opencode' ? evidence.correlation.token : undefined;
+          const hash = token === undefined ? undefined : observed.get(token);
+          const index = parseActivityId(evidence.activity);
+          if (token === undefined || hash === undefined || evidence.claimToken === undefined || index === undefined
+            || !['dispatching', 'unknown', 'accepted'].includes(evidence.outcome)
+            || evidence.correlation?.payloadHash !== hash) return [];
+          const prepared = preview(facts, location, seat, index);
+          if (prepared === undefined || payloadHash(prepared.payload) !== hash
+            || presentationBlocksWake(facts.deliveryEvidence(seat.participant, seat.generation, evidence.activity), Date.now())) return [];
+          return [{ evidence, index, hash, clipped: prepared.clipped }];
+        });
+      }, signal);
+      for (const { evidence, index, hash, clipped } of matches) {
+        if (signal.aborted || evidence.claimToken === undefined) return;
+        await presentPending({ artifact, location, participant: seat.participant,
+          activity: formatActivityId(index), seat: asSeatRef(seat), sink: { present() {} }, markSeen: !clipped, signal,
+          current: (facts) => {
+            const current = facts.seat(seat.participant);
+            const prepared = current === undefined || !sameSeat(current, seat) ? undefined : preview(facts, location, seat, index);
+            const correlation = facts.deliveryByToken(evidence.claimToken!);
+            return prepared !== undefined && payloadHash(prepared.payload) === hash
+              && correlation?.correlation?.harness === 'opencode'
+              && correlation.correlation.token !== undefined
+              && correlation.correlation.payloadHash === hash;
+          },
+        });
+      }
+    } finally { await artifact.close(); }
+  }
 }
 
-/** One existing observer and the existing dispatch owner; no second queue or evidence store. */
+/** The native receiver owns no claims outside the artifact; HOME is used only for discovery. */
 export async function receiveOpenCodePending(target: OpenCodeNativeSession, env: NodeJS.ProcessEnv, signal: AbortSignal): Promise<void> {
-  const ledger = hostLedgerForEnv(env);
-  const observer = await observeSessionPending(target.sessionId, env);
-  const excluded = new Set<string>();
-  const refreshExclusions = async () => {
-    excluded.clear();
-    const owners = await ledger.listPresence({ session: target.sessionId });
-    for (const row of await ledger.listEvidence({ kind: 'wake', session: target.sessionId })) {
-      const index = parseActivityId(row.activity);
-      const current = owners.some((owner) => owner.location === row.location && nameKey(owner.participant) === nameKey(row.participant) && owner.epoch === row.nativeDelivery?.epoch);
-      if (index !== undefined && (['accepted', 'unknown'].includes(row.outcome) || row.outcome === 'dispatching' && current && row.nativeDelivery?.harness === 'opencode')) excluded.add(key(row.location, row.participant, index));
-    }
-    for (const membership of await sessionInbox(target.sessionId, env, signal)) {
-      const owner = owners.find((binding) => binding.location === membership.squarePath && nameKey(binding.participant) === nameKey(membership.name));
-      for (const note of membership.notifications) if (note.actIndex <= (owner?.cancelledThrough ?? -1)) excluded.add(key(membership.squarePath, membership.name, note.actIndex));
-    }
-  };
-  const transport = createWakeTransport([], ledger, Date.now, { [routeKind]: createOpenCodeWakeTransport(target, env, signal) });
+  const observer = await observeSessionPending(bodyFor(target.sessionId), env);
+  const transport = createOpenCodeWakeTransport(target, signal);
+  let waiting: ReturnType<typeof observer.wait> | undefined;
   try {
-    await refreshExclusions();
-    let pending = await observer.wait(Infinity, { signal, excludeKeys: excluded });
-    while (!signal.aborted && pending.length > 0) {
-      let armed!: (value: boolean) => void;
-      const ready = new Promise<boolean>((resolve) => { armed = resolve; });
-      // Capture the next state edge BEFORE dispatch. Evidence failures alone do not retry.
-      const next = observer.wait(Infinity, { signal, excludeKeys: excluded, skipImmediate: true, onChangeArmed: armed })
-        .catch(() => { armed(false); return []; });
-      if (!await ready || signal.aborted) break;
-      for (const membership of pending) {
-        const square = await openSquare(membership.squarePath, { hostLedger: ledger, env, signal });
+    while (!signal.aborted) {
+      const armed = new Promise<boolean>((resolve) => {
+        waiting = observer.wait(Infinity, { signal, skipImmediate: true, onChangeArmed: resolve });
+        void waiting.catch(() => resolve(false));
+      });
+      if (!await armed) { await waiting; break; }
+      for (const membership of await observer.read({ signal })) {
+        const { location, seat } = membership;
+        if (signal.aborted) return;
+        const artifact = createArtifactPort(location, undefined, signal);
         try {
-          for (const note of membership.notifications) {
-            if (signal.aborted || excluded.has(key(membership.squarePath, membership.name, note.actIndex))) continue;
-            await deliverPending({ artifact: square.artifact, hostLedger: ledger, transport, location: square.location, activity: formatActivityId(note.actIndex), now: Date.now() });
+          const { value: notifications } = await artifact.read((facts) => {
+            if (!sameSeat(facts.seat(seat.participant), seat)) return [];
+            return membership.notifications.filter((note) => automaticWakeEligible(
+              facts.deliveryEvidence(seat.participant, seat.generation, formatActivityId(note.actIndex)), Date.now()));
+          }, signal);
+          for (const note of notifications) {
+            if (signal.aborted) return;
+            await deliverPending({ artifact, transport, location, activity: formatActivityId(note.actIndex), now: Date.now() });
           }
-        } finally { await closeOpenSquare(square); }
+        } catch (error) {
+          if (signal.aborted) throw signal.reason ?? error;
+          // A candidate that became unreadable cannot authorize sending; the shared observer
+          // keeps its subscription and will reconsider the artifact after repair.
+        } finally { await artifact.close(); }
       }
-      await refreshExclusions();
-      pending = await next;
+      await waiting;
+      waiting = undefined;
     }
-  } finally { observer.close(); }
+  } catch (error) {
+    if (!signal.aborted) throw error;
+  } finally {
+    observer.close();
+    await waiting?.catch(() => {});
+  }
 }
 
-export async function publishOpenCodeRoutes(sessionId: string, env: NodeJS.ProcessEnv, signal: AbortSignal): Promise<boolean> {
-  const ledger = hostLedgerForEnv(env);
-  return ledger.withClaimLock(async () => {
-    const owners = (await ledger.listPresence({ session: sessionId })).filter((binding) => binding.channel === 'opencode');
-    for (const owner of owners) {
-      const square = await openSquare(owner.location, { hostLedger: ledger, env, signal });
-      try { await publishWakeRoute(square.artifact, { location: owner.location, participant: owner.participant, sessionId, channel: 'opencode',
-        kind: routeKind, address: { sessionId }, epoch: owner.epoch }, { requireCurrentSession: true }); }
-      finally { await closeOpenSquare(square); }
-    }
-    return owners.length > 0;
-  }, signal);
+/** Publish the native address into current artifact seats; the legacy route projection is not read. */
+export async function publishOpenCodeAddress(sessionId: string, env: NodeJS.ProcessEnv, signal: AbortSignal): Promise<boolean> {
+  const seats = await discoverOpenCodeSeats(sessionId, env, signal);
+  for (const { location, seat } of seats) {
+    if (signal.aborted) return false;
+    const artifact = createArtifactPort(location, undefined, signal);
+    try {
+      await artifact.transactAs({ kind: 'participant', seat: asSeatRef(seat) }, (facts) =>
+        facts.updateWakeAddress(asSeatRef(seat), { kind: routeKind, address: { sessionId } }));
+    } finally { await artifact.close(); }
+  }
+  return seats.length > 0;
+}
+
+export async function cancelOpenCodeDeliveries(sessionId: string, env: NodeJS.ProcessEnv, signal: AbortSignal): Promise<void> {
+  for (const { location, seat } of await discoverOpenCodeSeats(sessionId, env, signal)) {
+    if (signal.aborted) return;
+    const artifact = createArtifactPort(location, undefined, signal);
+    try {
+      const { value: through } = await artifact.read((facts) => facts.header().lastActIndex, signal);
+      if (through >= 0) await artifact.cancelDeliveries(asSeatRef(seat), through, signal);
+    } finally { await artifact.close(); }
+  }
+}
+
+export async function endOpenCodeSession(sessionId: string, env: NodeJS.ProcessEnv, signal: AbortSignal): Promise<void> {
+  for (const { location, seat } of await discoverOpenCodeSeats(sessionId, env, signal)) {
+    if (signal.aborted) return;
+    const { Square } = await import('../../square-api.js');
+    const square = await Square.at({ path: location, env, body: seat.body, participant: seat.participant });
+    try { await square.endOwnedSession(seat.participant, sessionId, seat.generation, seat.body); }
+    finally { await square.close(); }
+  }
 }

package/plugins/opencode/index.ts

@@ -1,11 +1,7 @@
-import { operationEnv } from '../../participant-identity.js';
-import { hostLedgerForEnv } from '../../registry.js';
+import { observeSquareIndex } from '../../square-index.js';
 import { canonicalPath } from '../../canonical-path.js';
-import { openSquare } from '../../open-square.js';
-import { closeOpenSquare } from '../../open-square.js';
-import { Square } from '../../square-api.js';
 import { connectNative, type OpenCodeNativeSession, type OpenCodeSessionCapability } from '../../packages/agent-delivery/src/opencode-native.js';
-import { observeOpenCodeContext, publishOpenCodeRoutes, receiveOpenCodePending, type OpenCodeContextMessage } from './delivery.js';
+import { cancelOpenCodeDeliveries, endOpenCodeSession, indexedOpenCodeSessions, observeOpenCodeContext, publishOpenCodeAddress, receiveOpenCodePending, type OpenCodeContextMessage } from './delivery.js';
 
 interface OpenCodePluginContext {
   readonly app: { readonly version: string };
@@ -24,7 +20,7 @@ export default {
   async setup(ctx: OpenCodePluginContext): Promise<() => Promise<void>> {
     if (ctx.app.version !== '2.0.20') return async () => {};
     const env = { ...process.env };
-    const ledger = hostLedgerForEnv(env);
+    const index = await observeSquareIndex(env);
     const lifetime = new AbortController();
     const receivers = new Map<string, Receiver>(); // Operational handles only; presence owns membership.
     const directory = await canonicalPath(ctx.location.directory);
@@ -53,18 +49,17 @@ export default {
       return target;
     };
     const reconcile = async (activeSession?: string) => {
-      const candidates = new Set((await ledger.listPresence({})).filter((binding) => binding.channel === 'opencode').map((binding) => binding.session));
+      const candidates = new Set(await indexedOpenCodeSessions(env));
       if (activeSession) candidates.add(activeSession);
       for (const sessionId of candidates) {
         if (lifetime.signal.aborted) return;
         const target = await validate(sessionId);
         if (!target) { stop(sessionId); continue; }
-        const scopedEnv = operationEnv('opencode', sessionId, env);
-        if (!await publishOpenCodeRoutes(sessionId, scopedEnv, lifetime.signal)) { stop(sessionId); continue; }
+        if (!await publishOpenCodeAddress(sessionId, env, lifetime.signal)) { stop(sessionId); continue; }
         if (receivers.get(sessionId)?.settled === false) continue;
         const abort = new AbortController();
         const signal = AbortSignal.any([lifetime.signal, abort.signal]);
-        const receiver: Receiver = { abort, settled: false, running: receiveOpenCodePending(target, scopedEnv, signal).catch(() => {}).finally(() => { receiver.settled = true; }) };
+        const receiver: Receiver = { abort, settled: false, running: receiveOpenCodePending(target, env, signal).catch(() => {}).finally(() => { receiver.settled = true; }) };
         receivers.set(sessionId, receiver);
       }
       for (const sessionId of receivers.keys()) if (!candidates.has(sessionId)) stop(sessionId);
@@ -73,23 +68,12 @@ export default {
       if (!receivers.has(sessionId)) return;
       // Stop synchronously; persist the cutoff before allowing reconciliation to start fresh work.
       stop(sessionId);
-      await ledger.withClaimLock(async () => {
-        for (const owner of (await ledger.listPresence({ session: sessionId })).filter((binding) => binding.channel === 'opencode')) {
-          const square = await openSquare(owner.location, { hostLedger: ledger, env, signal: lifetime.signal });
-          try { await ledger.suppressPresence(owner, (await square.artifact.read((facts) => facts.header().nextActIndex - 1, lifetime.signal)).value); }
-          finally { await closeOpenSquare(square); }
-        }
-      }, lifetime.signal);
+      await cancelOpenCodeDeliveries(sessionId, env, lifetime.signal);
       await reconcile();
     };
     const end = async (sessionId: string) => {
       stop(sessionId);
-      const memberships = (await ledger.listPresence({ session: sessionId })).filter((binding) => binding.channel === 'opencode');
-      for (const owner of memberships) {
-        const square = await Square.at({ path: owner.location, hostLedger: ledger, env: operationEnv('opencode', sessionId, env) });
-        try { await square.endOwnedSession(owner.participant, sessionId, owner.epoch); }
-        finally { await square.close(); }
-      }
+      await endOpenCodeSession(sessionId, env, lifetime.signal);
     };
 
     await ctx.session.hook('prompt', (event) => coordinate(() => reconcile(event.sessionID)));
@@ -97,16 +81,14 @@ export default {
       await coordinate(() => reconcile(event.sessionID));
       const receiver = receivers.get(event.sessionID);
       if (!receiver || lifetime.signal.aborted) return;
-      await observeOpenCodeContext(event.sessionID, event.messages, operationEnv('opencode', event.sessionID, env),
+      await observeOpenCodeContext(event.sessionID, event.messages, env,
         AbortSignal.any([lifetime.signal, receiver.abort.signal])).catch(() => {});
     });
-    const changes = await ledger.observeChanges();
-    changes.evidence.close(); // Manual joins activate an idle receiver; evidence already has a session observer.
     const presenceLoop = (async () => {
       while (!lifetime.signal.aborted) {
-        const baseline = await changes.presence.read(lifetime.signal);
+        const baseline = await index.read(lifetime.signal);
         await coordinate(() => reconcile());
-        await changes.presence.changed(baseline, Infinity, lifetime.signal);
+        await index.changed(baseline, Infinity, lifetime.signal);
       }
     })().catch(() => {});
     const eventLoop = (async () => {
@@ -124,7 +106,7 @@ export default {
     // Do not await any native prompt in setup: plugin activation itself is lazy.
     return async () => {
       lifetime.abort();
-      changes.presence.close();
+      index.close();
       const tasks = [presenceLoop, eventLoop, coordinating, ...[...receivers.keys()].map(stop)];
       let timer: ReturnType<typeof setTimeout> | undefined;
       try { await Promise.race([Promise.allSettled(tasks), new Promise<void>((resolve) => { timer = setTimeout(resolve, 3000); })]); }

package/plugins/pi/square-pi.js

@@ -8,7 +8,7 @@ import { SQUARE_TOOLS, SQUARE_TOOL_INSTRUCTIONS, squareToolFailure, squareToolFa
 import { presentPendingAtBoundary, renderPendingAtBoundary } from '../../dist/boundary-presentation.js';
 import { operationEnv } from '../../dist/participant-identity.js';
 import { endSessionMemberships } from '../../dist/session-lifecycle.js';
-import { sessionInbox, observeSessionPending } from '../../dist/inbox.js';
+import { projectSessionSeats, observeSessionPending, pendingKey } from '../../dist/inbox.js';
 import { previewAttentionBody, renderAttentionDescription, renderAttentionFull } from '../../dist/attention-presentation.js';
 import { formatActivityId } from '../../dist/square-core.js';
 import { createPiReceiver, sendPiMessage } from '../../dist/packages/agent-delivery/src/pi.js';
@@ -26,7 +26,7 @@ export function pendingInbox(inbox) {
 
 export function inboxKeys(inbox) {
   return pendingInbox(inbox).flatMap((item) => item.notifications.map((note) =>
-    `${item.squarePath}\u0000${item.name.toLocaleLowerCase()}\u0000${note.actIndex}`
+    pendingKey(item, note.actIndex)
   ));
 }
 
@@ -41,9 +41,9 @@ function framePiMessage(content) {
 /** Renderer-only card facts for Pi and Paseo; Pi never sends `details` to the model. */
 export function pendingCardDetails(pending) {
   const items = pending.flatMap((membership) => membership.notifications.map((note) => ({
-    square: path.basename(membership.squarePath, '.square'),
+    square: path.basename(membership.location, '.square'),
     actor: note.actor,
-    recipient: membership.name,
+    recipient: membership.seat.participant,
     route: note.route,
     act: formatActivityId(note.actIndex),
     preview: previewAttentionBody(note.body),
@@ -52,9 +52,9 @@ export function pendingCardDetails(pending) {
   })));
   if (items.length === 0) return undefined;
   const fullText = pending.flatMap((membership) => membership.notifications.map((note) => renderAttentionFull({
-    squarePath: membership.squarePath,
+    squarePath: membership.location,
     actIndex: note.actIndex,
-    recipient: membership.name,
+    recipient: membership.seat.participant,
     ...note,
   }))).join('\n\n');
   return { items, fullText };
@@ -152,9 +152,11 @@ export default function squarePiExtension(pi) {
       namespace: { name: 'square', description: 'Participate in a shared public square.', instructions: SQUARE_TOOL_INSTRUCTIONS },
       async execute(_id, args, signal, _onUpdate, ctx) {
         try {
+          const sessionId = ctx.sessionManager.getSessionId();
           const square = await Square.at({
             cwd: ctx.cwd,
-            env: operationEnv('pi', ctx.sessionManager.getSessionId(), process.env),
+            env: operationEnv('pi', sessionId, process.env),
+            body: { channel: 'pi', session: sessionId },
             path: args.location,
             participant: args.as,
           }, { signal });
@@ -164,7 +166,7 @@ export default function squarePiExtension(pi) {
           return { content: [{ type: 'text', text: tool.render(data, args) ?? '' }], details: data, structuredContent: data };
         } catch (error) {
           const data = { error: squareToolFailure(error, signal) };
-          return { isError: true, content: [{ type: 'text', text: squareToolFailureText(data.error, { location: args.location ?? process.env.SQUARE_LOCATION, participant: args.as ?? process.env.SQUARE_PARTICIPANT_NAME }) }], details: data, structuredContent: data };
+          return { isError: true, content: [{ type: 'text', text: squareToolFailureText(data.error, { location: args.location ?? process.env.SQUARE_LOCATION, participant: args.as }) }], details: data, structuredContent: data };
         }
       },
     });
@@ -188,10 +190,14 @@ export default function squarePiExtension(pi) {
   let currentRunSignal;
   let detachRunAbort;
   let cancelledRun = false;
+  let pendingCancellations = new Map();
+  const cancellationFailures = new Set();
 
   const cancelRunDelivery = () => {
+    if (cancelledRun) return;
     cancelledRun = true;
     for (const key of observedPending) handledPending.add(key);
+    persistSessionCancellation(sessionId);
     generation += 1;
     stopWatcher();
     failAcks(new Error('Pi notification delivery cancelled'));
@@ -245,6 +251,40 @@ export default function squarePiExtension(pi) {
   // Pi owns PI_SESSION_ID and several SDK sessions may coexist in one process.
   const sessionEnv = (id) => ({ ...process.env, ...(id === undefined ? {} : { PI_SESSION_ID: id }) });
 
+  const persistSessionCancellation = (id) => {
+    if (id === undefined) return Promise.resolve();
+    const previous = pendingCancellations.get(id) ?? Promise.resolve();
+    let operation;
+    operation = previous.then(async () => {
+      const body = { channel: 'pi', session: id };
+      const env = sessionEnv(id);
+      const seats = await projectSessionSeats({ body, env });
+      for (const { location, seat } of seats) {
+        const square = await Square.at({ path: location, env, body, participant: seat.participant });
+        try { await square.cancelDeliveries(seat.participant, seat.generation); }
+        finally { await square.close(); }
+      }
+    }).then(() => {
+      cancellationFailures.delete(id);
+    }, () => {
+      cancellationFailures.add(id);
+    }).finally(() => {
+      if (pendingCancellations.get(id) === operation) pendingCancellations.delete(id);
+    });
+    pendingCancellations.set(id, operation);
+    return operation;
+  };
+
+  const waitForSessionCancellation = async (id) => {
+    if (id === undefined) return true;
+    while (true) {
+      const pending = pendingCancellations.get(id);
+      if (pending !== undefined) await pending;
+      if (pendingCancellations.get(id) !== pending) continue;
+      return !cancellationFailures.has(id);
+    }
+  };
+
   // Aborting releases native landing waits; retain cleanup until the observer
   // has closed, including when cancellation precedes a lifecycle hook.
   const stopWatcher = () => {
@@ -267,7 +307,7 @@ export default function squarePiExtension(pi) {
   const wake = async (token, signal) => {
     const boundSessionId = sessionId;
     const env = sessionEnv(boundSessionId);
-    const observer = await observeSessionPending(boundSessionId, env);
+    const observer = await observeSessionPending({ channel: 'pi', session: boundSessionId }, env);
     try {
       if (signal.aborted || token !== generation) return;
       const armDeferredRetry = () => {
@@ -321,7 +361,7 @@ export default function squarePiExtension(pi) {
         let keepDeferred = false;
         try {
           await presentPendingAtBoundary(
-            boundSessionId,
+            { channel: 'pi', session: boundSessionId },
             async (content) => {
               if (signal.aborted || currentRunSignal?.aborted) throw new Error('Pi notification delivery cancelled');
               // One card for the human: a compact heading, expandable to the full body.
@@ -384,7 +424,8 @@ export default function squarePiExtension(pi) {
     sessionId = ctx.sessionManager.getSessionId();
     const token = generation;
     await stopped;
-    if (token !== generation) return;
+    await waitForSessionCancellation(sessionId);
+    if (token !== generation || cancellationFailures.has(sessionId)) return;
     watcherAbort = new AbortController();
     const signal = watcherAbort.signal;
     watcher = wake(token, signal).catch(() => undefined);
@@ -438,13 +479,9 @@ export default function squarePiExtension(pi) {
     currentRunSignal = undefined;
     if (!cancelledRun || sessionId === undefined) return;
     const token = generation;
-    // Cancel the entire pending batch, including entries not yet sent to Pi.
-    // This is local suppression, never evidence that the model saw the activity.
     await stopWatcher();
-    if (token !== generation || sessionId === undefined) return;
-    const cancelled = await sessionInbox(sessionId, sessionEnv(sessionId));
-    if (token !== generation || sessionId === undefined) return;
-    for (const key of inboxKeys(cancelled)) handledPending.add(key);
+    await waitForSessionCancellation(sessionId);
+    if (token !== generation || sessionId === undefined || cancellationFailures.has(sessionId)) return;
     cancelledRun = false;
     watcherAbort = new AbortController();
     watcher = wake(token, watcherAbort.signal).catch(() => undefined);
@@ -464,6 +501,7 @@ export default function squarePiExtension(pi) {
     activeTurn = undefined;
     currentRunSignal = undefined;
     await stopped;
+    await waitForSessionCancellation(endedId);
     if (endedId) await endSessionMemberships('pi', endedId, endedEnv).catch(() => undefined);
   });
 }

package/skills/square/SKILL.md

@@ -10,7 +10,7 @@ Bring a thought, a question, an objection, or a gesture. Leave private tool chat
 
 This skill explains what Square is and how to be present in it. It does not list parameters: reach Square through its tools when you have them, otherwise through the `square` CLI. The tool descriptions and `square <operation> --help` are the exact usage. The operations are the same either way.
 
-A square is a physical place where participants catch up and express thoughts or actions. Every square needs a location and a participant name. Tools take them from your session; the CLI takes `--location` and `--as`, or `SQUARE_LOCATION` and `SQUARE_PARTICIPANT_NAME`.
+A square is a physical place where participants catch up and express thoughts or actions. Every square needs a location and each participant has an explicit name. Tools take the execution body from their live harness context. Use `--location` (or `SQUARE_LOCATION`) and an explicit `--as <name>` when joining. Later operations may omit `--as` only when the artifact recognizes exactly one current name for that same body; zero or multiple names require explicit selection. A name never grants custody.
 
 ## The rhythm
 

package/dist/cli/ledger-command.d.ts

@@ -1,12 +0,0 @@
-import { type LedgerMaintenanceReport } from '../ledger-maintenance.js';
-import { type HostLedgerReport } from '../host-ledger-migration.js';
-import { type CommandSpec } from './context.js';
-type LedgerIntent = {
-    readonly action: 'verify' | 'migrate';
-} | {
-    readonly action: 'gc';
-    readonly dryRun: boolean;
-};
-type LedgerResult = HostLedgerReport | LedgerMaintenanceReport;
-export declare const ledgerCommand: CommandSpec<LedgerIntent, LedgerResult>;
-export {};