@astrosheep/square 0.3.88 → 0.3.90

package/dist/square-stdio.js

@@ -1,10 +1,12 @@
+import { randomUUID } from 'node:crypto';
+import { validateMetadataMatch, validateDeferralDuration, validateDeferralId } from './delivery-deferral.js';
 import { spawn } from 'node:child_process';
 import path from 'node:path';
 import { createInterface } from 'node:readline';
 import { SquareError } from './model.js';
 import { harnessSessionSources } from './participant-identity.js';
 import { requireJoinName } from './seats.js';
-export const STDIO_PROTOCOL_VERSION = 1;
+export const STDIO_PROTOCOL_VERSION = 2;
 export const STDIO_MAX_FRAME_BYTES = 8 * 1024 * 1024;
 export const identityVariables = [...harnessSessionSources.flatMap(source => [source.variable, ...(source.childVariable ? [source.childVariable] : [])])];
 export function wireIdentity(env) {
@@ -157,33 +159,44 @@ class StdioSquare {
         this.connection = connection;
         this.handle = handle;
     }
-    call(method, args, control, participant) {
-        return this.connection.request(method, { handle: this.handle, args, ...(participant === undefined ? {} : { participant }) }, control);
+    call(method, args, control, participant, participantHandle) {
+        return this.connection.request(method, { handle: this.handle, args, ...(participant === undefined ? {} : { participant, participantHandle }) }, control);
     }
-    participantHandle(name) {
+    participantHandle(name, reference) {
+        const call = (method, args, control) => this.call(method, args, control, name, reference);
         return {
             name,
             express: ((bodyOrInput, optionsOrControl, control) => {
                 if (typeof bodyOrInput === 'object' && bodyOrInput !== null)
-                    return this.call('express', [bodyOrInput, undefined], optionsOrControl, name);
-                return this.call('express', [bodyOrInput, optionsOrControl], control, name);
+                    return call('express', [bodyOrInput, undefined], optionsOrControl);
+                return call('express', [bodyOrInput, optionsOrControl], control);
             }),
-            catch: (options, control) => this.call('catch', [options], control, name),
-            listen: (target, options, control) => this.call('listen', [target, options], control, name),
-            ignore: (target, options, control) => this.call('ignore', [target, options], control, name),
-            unlisten: (target, options, control) => this.call('unlisten', [target, options], control, name),
-            listening: (options, control) => this.call('listening', [options], control, name),
-            hold: (reason, options, control) => this.call('hold', [reason, options], control, name),
-            resume: (options, control) => this.call('resume', [options], control, name),
-            done: (body, options, control) => this.call('done', [body, options], control, name),
+            catch: (options, control) => call('catch', [options], control),
+            listen: (target, options, control) => call('listen', [target, options], control),
+            ignore: (target, options, control) => call('ignore', [target, options], control),
+            unlisten: (target, options, control) => call('unlisten', [target, options], control),
+            listening: (options, control) => call('listening', [options], control),
+            hold: (reason, options, control) => call('hold', [reason, options], control),
+            resume: (options, control) => call('resume', [options], control),
+            done: (body, options, control) => call('done', [body, options], control),
+            deferDelivery: async (input, control) => {
+                const match = validateMetadataMatch(input?.match), durationMs = validateDeferralDuration(input?.durationMs);
+                return call('deferDelivery', [{ match, durationMs }], control);
+            },
+            renewDeliveryDeferral: async (id, durationMs, control) => call('renewDeliveryDeferral', [validateDeferralId(id), validateDeferralDuration(durationMs)], control),
+            releaseDeliveryDeferral: async (id, control) => call('releaseDeliveryDeferral', [validateDeferralId(id)], control),
             history: (query, control) => this.history(query, control),
         };
     }
-    async participant(name) { return this.participantHandle(await this.call('participant', [name])); }
+    async participant(name) {
+        const reference = randomUUID();
+        return this.participantHandle(await this.call('participant', [name, reference]), reference);
+    }
     async join(...[name, options, control]) {
         requireJoinName(name);
-        const result = await this.call('join', [name, options], control);
-        return { ...result, participant: this.participantHandle(result.participant) };
+        const reference = randomUUID();
+        const result = await this.call('join', [name, options, reference], control);
+        return { ...result, participant: this.participantHandle(result.participant, reference) };
     }
     history(...[query, control]) { return this.call('history', [query], control); }
     status(...[options, control]) { return this.call('status', [options], control); }

package/dist/stdio-server.js

@@ -16,6 +16,13 @@ export async function runSquareStdioServer(root) {
     let square;
     let location;
     let opening = false, closing = false;
+    const participants = new Map();
+    const captureParticipant = (reference, participant) => {
+        if (typeof reference !== 'string' || reference.length === 0 || participants.has(reference))
+            throw new SquareError('invalid_args', 'Participant handle must be a fresh connection-local reference');
+        participants.set(reference, participant);
+        return participant.name;
+    };
     const running = new Map();
     const write = (message) => { if (!process.stdout.destroyed)
         process.stdout.write(JSON.stringify(message) + '\n'); };
@@ -91,10 +98,12 @@ export async function runSquareStdioServer(root) {
         const args = params.args.map((arg) => arg === null ? undefined : arg);
         let result;
         switch (method) {
-            case 'participant': return (await square.participant(args[0])).name;
+            case 'participant': return captureParticipant(args[1], await square.participant(args[0]));
             case 'join': {
+                if (typeof args[2] !== 'string' || args[2].length === 0 || participants.has(args[2]))
+                    throw new SquareError('invalid_args', 'Participant handle must be a fresh connection-local reference');
                 const joined = await square.join(args[0], args[1], control);
-                result = { ...joined, participant: joined.participant.name };
+                result = { ...joined, participant: captureParticipant(args[2], joined.participant) };
                 break;
             }
             case 'history':
@@ -112,8 +121,19 @@ export async function runSquareStdioServer(root) {
             default: {
                 if (typeof params.participant !== 'string')
                     throw new SquareError('invalid_args', 'Participant operation requires a name');
-                const participant = await square.participant(params.participant);
+                const participant = participants.get(params.participantHandle);
+                if (participant === undefined || participant.name !== params.participant)
+                    throw new SquareError('invalid_args', 'Select a captured participant handle on this connection');
                 switch (method) {
+                    case 'deferDelivery':
+                        result = await participant.deferDelivery(args[0], control);
+                        break;
+                    case 'renewDeliveryDeferral':
+                        result = await participant.renewDeliveryDeferral(args[0], args[1], control);
+                        break;
+                    case 'releaseDeliveryDeferral':
+                        result = await participant.releaseDeliveryDeferral(args[0], control);
+                        break;
                     case 'express':
                         result = await participant.express(args[0], args[1], control);
                         break;

package/guides/backends.md

@@ -55,9 +55,10 @@ import { Square, type SquareBackends } from '@astrosheep/square';
 const backends: SquareBackends = {
   local: { command: process.execPath, args: ['/absolute/path/to/square/dist/stdio-server.js', '--root', '/tmp/squares'] },
 };
-const square = await Square.at({ path: 'stdio://local/design', backends, participant: 'Bob' });
+const square = await Square.at({ path: 'stdio://local/design', backends, participant: 'Bob',
+  body: { channel: 'example', session: 'bob-process' } });
 try {
-  const bob = (await square.join()).participant;
+  const bob = (await square.join('Bob')).participant;
   const caught = await bob.catch();
   console.log(caught.activities);
 } finally {
@@ -99,7 +100,7 @@ configured local SQLite connection. Pi tools accept the identical location and r
 - CLI failed-expression drafts stay in local `./drafts` for backend locations; recovery commands and
   display labels retain the URI. Local-artifact draft placement is unchanged.
 
-## Protocol version 1
+## Protocol version 2
 
 Newline-delimited JSON-RPC 2.0 over UTF-8 stdin/stdout, one object per line, at most 8 MiB per frame.
 Stdout is protocol only. No batch requests. The initial versioned handshake opens one logical square
@@ -107,9 +108,9 @@ per connection and returns an opaque handle. IDs are unique positive integers on
 requests may overlap and responses may arrive out of order.
 
 ```json
-{"jsonrpc":"2.0","id":1,"method":"square/open","params":{"version":1,"key":"design","location":"stdio://local/design","identity":{"PI_SESSION_ID":"session-id"},"participant":"Bob"}}
-{"jsonrpc":"2.0","id":1,"result":{"version":1,"handle":"square"}}
-{"jsonrpc":"2.0","id":2,"method":"join","params":{"handle":"square","args":["Bob",{"observe":true}]}}
+{"jsonrpc":"2.0","id":1,"method":"square/open","params":{"version":2,"key":"design","location":"stdio://local/design","identity":{"PI_SESSION_ID":"session-id"},"body":{"channel":"pi","session":"session-id"},"participant":"Bob"}}
+{"jsonrpc":"2.0","id":1,"result":{"version":2,"handle":"square"}}
+{"jsonrpc":"2.0","id":2,"method":"join","params":{"handle":"square","args":["Bob",{"observe":true},"fresh-participant-reference"]}}
 ```
 
 Open may include `build: {markdown, hardCap?, throttlePerMinute?, template?, force?}` instead of
@@ -120,25 +121,36 @@ coordinates (including PASEO_AGENT_ID), then overlays explicit call-local facts
 `process.env`. Participant defaults remain separate from square keys. Each new tool open therefore
 uses that call's identity, not MCP/Pi/backend startup identity.
 
-After open, methods take `{handle, args, participant?}`. `args` is the public operation's positional
-arguments excluding `OperationControl`; trailing JSON nulls represent omitted optional arguments.
+After open, square methods take `{handle, args}` and Participant methods additionally require
+`{participant, participantHandle}`. Selection/join supply a fresh opaque connection-local reference;
+the server retains the actual captured Participant under it instead of reselecting by name per
+request. Version 2 deliberately refuses older peers rather than accepting unfenced handles.
+`args` is the public operation's positional arguments excluding `OperationControl`, plus the
+selection reference noted below; trailing JSON nulls represent omitted optional arguments.
 Nested nulls such as `history({limit:null})` retain their public meaning.
 
 | Methods | args | participant field |
 | --- | --- | --- |
-| `participant` | `[name?]` | no; selection only, not joining |
-| `join` | `[name?, options?]` | no |
+| `participant` | `[name?, freshReference]` | no; selection only, not joining |
+| `join` | `[name, options?, freshReference]` | no |
 | `history`, `status`, `participants` | `[options?]` | no |
 | `recovery` | `[name?]` | no |
 | `express` | `[body, options?]` | required |
 | `catch`, `listening`, `resume` | `[options?]` | required |
 | `listen`, `ignore`, `unlisten` | `[target, options?]` | required |
 | `hold`, `done` | `[body?, options?]` | required |
+| `deferDelivery` | `[{match, durationMs}]` | required |
+| `renewDeliveryDeferral` | `[id, durationMs]` | required |
+| `releaseDeliveryDeferral` | `[id]` | required |
 
 Results are the concrete public operation results, including requested observations. Participant
 handles serialize as names for `participant` and `join.participant` and become real local handles
-on the client. Observation locations are canonical remote URIs and automatic delivery is false.
-Errors are JSON-RPC `{code:-32000,message,data:{code?,facts?,operation?}}`; Square codes, structured
+on the client, using their retained connection-local references. Done/takeover/rejoin fences old
+references even when the same Body later reacquires the name. Observation locations are canonical
+remote URIs and automatic delivery is false. SDK/stdio deferrals have identical validation, independent
+lease and owner-generation semantics; create/renew return only `{id, expiresAt}`, renew returns null
+and release false for an inactive ID, and stale handles receive the normal ownership refusal.
+No CLI/MCP/Pi deferral-authoring command is included. Errors are JSON-RPC `{code:-32000,message,data:{code?,facts?,operation?}}`; Square codes, structured
 facts, history bounds and express certainty survive the boundary. The client does not infer
 `unsent` from a connection failure. There is no mutation retry or replay.
 
@@ -147,7 +159,8 @@ Progress is a notification
 `OperationProgress`. Request abort sends `$/cancelRequest` with `{id}`; the server aborts only that
 request and returns its response **after** cleanup, including releasing a catch lease. Another
 request on the same handle continues normally. Cancellation never undoes an explicitly committed
-receipt. `square/close` with `{}` aborts/drains outstanding requests, closes SQLite and acknowledges
+receipt or lease mutation. A committed deferral remains until release, expiry or seat retirement;
+connection close does not cancel it. `square/close` with `{}` aborts/drains outstanding requests, closes SQLite and acknowledges
 with a null result. Client close is idempotent, waits briefly for graceful cleanup, then terminates
 an unresponsive process. EOF, malformed framing, version mismatch and process exit reject pending
 requests and release the connection. A lost express response after dispatch has unknown effect;

package/guides/change-waits.md

@@ -1,14 +1,40 @@
 # Waiting for changes
 
-Square's artifact and host-ledger adapters own change detection. Notifications are hints, not activity delivery or consumption receipts.
+Artifact revisions and the rebuildable discovery index drive change detection. Filesystem
+notifications are hints, not activity delivery or consumption receipts.
 
-- A process shares a revision reader per canonical artifact and a filesystem watcher per containing directory. Subscribers have independent baselines, deadlines, and cancellation. The final release closes the watcher, reconciliation timer, and any outstanding read.
-- Directory notifications invalidate lightweight reads. A two-second reconciliation checks revisions/ledger metadata even when notifications are missing. Missing directories, unsupported watches, and watcher failures retain that fallback; directory replacement is detected during reconciliation. Normal notification latency is not a hard guarantee: a missed hint may wait for reconciliation, plus scheduling and lock contention.
-- The artifact revision remains authoritative. No new sidecar, broker, or persistent cache is introduced. Changed projections read typed recipient facts and selected bodies, not the whole historical state. A missing artifact is a stable observation, not a repeated change: reconciliation remains quiet while it stays absent and detects its return without deleting its session bindings. Strict artifact reads still report absence as an error. Host-ledger database metadata invalidates a process-shared read of its separate presence/evidence revisions; unchanged metadata requires no SQLite open. Revisions are read together in one short snapshot and cached against metadata captured before that read, so a concurrent mutation remains detectable. Failed reads are not cached. Missing ledger storage is stable until it appears. Neither metadata nor revisions are delivery evidence.
-- Each Pi session owns a long-lived pending observer, including when it has no bindings yet. Presence and evidence changes update its subscriptions. There is no repeated thirty-second restart and no per-second binding scan. A failed injection waits for a substantive change; its own failed evidence write does not trigger a retry loop.
-- Blocking CLI catch waits for a revision or its next heartbeat/quiet deadline. A held catch keeps its lease alive and pauses quiet expiry. Core catch, NDJSON stream, and delivery-receipt waits use the same change detector. Held express also waits for changes; throttling still waits for its eligibility time.
-- Catch lease expiry, ledger retention/claim expiry, and cancellation are independent wake conditions. No filesystem write is required for a time-based eligibility change.
-- Existing catch filters, lease priority, presentation claims, full-delivery seen receipts, clipped previews, and session-local cancellation suppression remain in force. Sharing storage detection does not share session delivery state. Cancellation never creates a receipt or removes history.
+- A process shares a revision reader per canonical artifact and a filesystem watcher per containing
+  directory. Subscribers have independent baselines, deadlines and cancellation. The final release
+  closes the watcher, reconciliation timer and outstanding read.
+- Directory notifications invalidate lightweight reads. A two-second reconciliation checks revisions
+  even when notifications are missing. Missing directories, unsupported watches, watcher failures
+  and directory replacement retain that fallback. Latency is not a hard guarantee: a missed hint
+  may wait for reconciliation, scheduling and lock contention.
+- Conversation revision controls the pending-content cache. Delivery revision separately invalidates
+  eligibility, including delivery evidence, cancellation and deferral writes. Projections resolve
+  current typed seats and selected bodies in one coherent artifact read; they never grant authority
+  from an index entry or a cached eligibility decision. No sidecar, broker or second delivery store
+  is introduced. An unreadable candidate cannot authorize cached content.
+- Each active session pending observer subscribes before selecting current candidates and facts,
+  including when no seat is yet discoverable. Index publication can wake discovery without an
+  artifact write. A failed injection waits for substantive change; its own failed evidence write
+  does not cause a retry loop.
+- Deferral create/renew/release and opportunistic pruning change delivery revision, not conversation
+  activity. Release rechecks eligibility without a new message. Expiry needs no synthetic write:
+  the observer includes the earliest relevant matching live deferral expiry in its existing wait
+  deadline, alongside catch-lease expiry/staleness. Overlapping leases remain OR; an early expiry
+  rechecks the remaining live leases. Renewal changes that deadline without self-triggered delivery.
+- There is no new daemon or detached per-message timer. A one-shot producer skips deferred work and
+  returns promptly. An existing active delivery observer will reconsider release/expiry; absent an
+  observer, pending work waits for the next normal delivery opportunity. A lease does not create a
+  process that was not already running.
+- Blocking catch waits for conversation revision or its heartbeat/quiet deadline. A held catch keeps
+  its single lease alive and pauses quiet expiry. Core catch and streams use the same storage change
+  detector. Held express also waits for changes; throttling waits for its eligibility time.
+- Deferrals are independent of catch filters, presentation claims, full-delivery seen receipts,
+  clipped previews and session-local cancellation. Sharing storage detection does not share session
+  delivery state. Cancellation never creates a receipt or removes archive history. A deferral cannot
+  recall a send already past its final freshness check.
 
 ## Verification
 
@@ -23,6 +49,9 @@ node --import ./test/sandbox-env.js scripts/benchmark-idle-wait.mjs --workers 30
 node --import ./test/sandbox-env.js scripts/benchmark-idle-wait.mjs --workers 300 --mode session --active --no-hints
 ```
 
-The benchmark creates disposable synthetic history. poll200 measures 200ms revision polling; events measures revision waits. session includes binding and notification projection, but excludes initial setup. Active session runs compare 1,800 and 18,000 unrelated history rows, inject one bell without push, then catch concurrently. `--no-hints` disables filesystem hints only inside benchmark workers. Runs report committed-write-to-projection latency, not native Pi message landing, and retain the twenty-second discovery deadline as a probe bound rather than an SLA. Three hundred processes still have three hundred monitors: sharing is process-local, not cross-process deduplication. See [row runtime delivery evidence](row-runtime-delivery-evidence.md) for actual completion, hydration, CPU, lock contention and host-ledger costs.
-
-A long-running Pi process must reload/restart its Square extension to use rebuilt code.
+The benchmark creates disposable synthetic history. Process-local sharing does not deduplicate
+monitors across processes. Timings measure committed-write-to-projection latency, not native
+message landing, and discovery deadlines are probe bounds rather than an SLA. Historical benchmark
+evidence may describe older HostLedger implementations; it is not current custody authority.
+A long-running extension must reload upgraded code before using the new artifact format; this
+delivery does not install or restart one.

package/guides/migration.md

@@ -2,8 +2,9 @@
 
 Square stores its authority in one versioned SQLite artifact. Format 1 kept the
 history as one JSON snapshot; format 2 introduced typed rows; format 3 added the
-`unlisten` activity; format 4 adds artifact-owned participant seats and delivery
-evidence. Existing artifacts are never converted implicitly.
+`unlisten` activity; format 4 added artifact-owned participant seats and delivery
+evidence; format 5 adds independent expiring delivery deferrals. Existing artifacts are never
+converted implicitly.
 
 Use the explicit command while all processes using the artifact are stopped:
 
@@ -11,11 +12,24 @@ Use the explicit command while all processes using the artifact are stopped:
 square --location /path/to/SQUARE.square migrate
 ```
 
-The command handles the supported older formats in place. It does not create a
+The command handles supported formats 2, 3 and 4 in place and publishes only final format 5.
+It does not create a
 backup, stop processes, install a runtime, or update another artifact. A legacy
 HostLedger that needs its own format conversion must be prepared separately with
 the old runtime's offline tooling.
 
+## Format 4 additive conversion
+
+An exact format-4 artifact needs no legacy owner or route import: that authority already lives
+inside the artifact. Read-only preflight checks framing and stored facts. One SQLite transaction
+adds the empty `delivery_deferrals` table and its owner/generation/expiry lookup index, then
+publishes format 5. The dedicated table stores participant key, captured generation, opaque ID,
+validated match and expiry, separately from catch leases and delivery evidence. All existing
+activities (including metadata), audience, receipts, seats, catch leases, delivery evidence,
+cancellation boundaries and both revision values remain unchanged. No lease is manufactured.
+The conversion does not consult or mutate HostLedger. Failure rolls back the table, index and
+format marker together.
+
 ## Format 3 preflight and conversion
 
 Before writing, migration validates the exact format-3 schema, header, and legacy
@@ -54,8 +68,8 @@ ledger is read-only and remains untouched, so it is still available for offline
 diagnostics. An absent ledger cannot establish standing ownership; an unreadable
 or unsupported ledger refuses before changing the square.
 
-After successful preflight, one SQLite transaction creates format-4 ownership and
-evidence rows and publishes the format marker. Activity history and indices,
+After successful preflight, one SQLite transaction creates ownership/evidence rows and the
+empty deferral table/index, then publishes format 5. Activity history and indices,
 receipts, lease contents, and the artifact revision are preserved. Legacy routes
 are decoded only during migration and their table is removed. Existing lease
 generations are resolved only for exact owner spellings that match a standing
@@ -65,12 +79,13 @@ format, and any failure before commit rolls back the conversion.
 
 Format 2 first rebuilds only the activity table and its indexes to accept
 `unlisten`, then follows the same row-format preflight and conversion. Snapshot
-format 1 is not accepted by this format-4 migration.
+format 1 is not accepted by this migration. Formats 2/3 never publish an intermediate format 4.
 
 ## What migration refuses
 
-Migration validates the exact old row schema, including the legacy routes table,
-using migration-local codecs. Current format 4 has no routes table or runtime route
+Migration validates each source's exact row schema. Formats 2/3 include the legacy routes table,
+read using migration-local codecs; format 4 already has seats and delivery evidence. Current
+format 5 has no routes table or runtime route
 reader; migration consumes the old rows only to resolve seats, then drops the legacy
 table as part of the format change.
 
@@ -99,8 +114,8 @@ remains a byte-preserving no-op.
 
 ## Before and after migration
 
-Stop every session or service using the square and any process writing its
-HostLedger. Make an offline backup, or use SQLite's backup facilities rather than
+Stop every session or service using the square, and for formats 2/3 freeze any process writing its
+legacy HostLedger. Make an offline backup, or use SQLite's backup facilities rather than
 copying a live database. Migration does not revoke an in-flight remote delivery or
 modify HostLedger evidence. Square writes use ordinary SQLite `DELETE` journals:
 the artifact must be writable and its containing directory must permit journal
@@ -109,7 +124,10 @@ participation and delivery authority live in the artifact, not writable HOME;
 loss of the rebuildable HOME discovery index may limit automatic discovery but
 does not transfer custody or erase durable delivery evidence.
 
-Upgrade attached runtimes before reopening the format-4 artifact; older runtimes
-must not be mixed with it. Run the read-only `doctor` command after migration and
+Upgrade all attached runtimes before reopening the format-5 artifact; older runtimes
+must not be mixed with it. Updating a package does not migrate an artifact, and migrating an
+artifact does not install upgraded runtimes. For rollback after a committed conversion, stop all
+clients and restore the offline backup with its compatible older runtime; do not downgrade the
+format marker or drop tables in place. Run the read-only `doctor` command after migration and
 before restarting clients. Repeating migration on a current artifact is a
 byte-preserving no-op.

package/guides/operation-cancellation.md

@@ -10,10 +10,25 @@ The signal is checked before lifecycle work and before artifact mutation, and it
 
 Commit boundaries are one-way. Once an activity or observation commits, later cancellation cannot roll it back or turn the result into a retry. A caller may discard the response after the commit, but the committed activity remains recoverable through `history` or a later `catch`; Square does not add a second consumption acknowledgement phase.
 
-The single-root HostLedgerPort passes `(input, signal)` for cancellable claims; cancellation does not create a second storage scope.
+The single catch lease and independent delivery-deferral leases have distinct lifetimes. Cancelling
+an active catch releases only that catch's lease. Cancelling a deferral operation before commit
+prevents its mutation; once creation or renewal commits, the lease survives caller cancellation
+until explicit release, expiry or retirement of its captured seat. A committed release is likewise
+not undone. There is no automatic rollback lease or per-message cancellation timer.
 
 Ownership and delivery have the same limitation: cancellation can stop work that has not entered the boundary, but it cannot withdraw an ownership effect or a transport send that already happened. The returned committed result and existing degradation classification remain authoritative.
 
+Presentation checks cancellation and eligibility before invoking its sink. A rejected sink is not
+success, including a native notification whose landing acknowledgement was cancelled. Once the sink
+succeeds, recording its evidence and seen receipts is mandatory settlement, not a new cancellable
+presentation attempt. It uses the same artifact connection and captured Body/join generation, without
+inheriting the pre-effect operation signal or a signal captured when opening that artifact. Claim
+release after a cancelled/failed attempt uses the same independent cleanup lifetime and writes no
+success receipt. Both settle through the normal authority gate, with a five-second storage budget;
+explicit connection close still cancels them. Storage failure is reported, not converted into success.
+A batch settles all successfully rendered items before closing its connections, even if one settlement
+fails. No settlement reopens a path or grants a replacement seat authority.
+
 The same `Square`/`Participant` methods serve SDK and adapters; see [resource API](square-api.md). Join, listener and lifecycle essential observations use commit-time facts. Join's optional entry enrichment may be unavailable without rejecting its successful receipt. CLI express passes its abort signal through the initial `Square.at`; raw draft saving precedes a separate uncancelled recovery reopen.
 
 Pi notification cancellation is separate and unchanged.