@astrosheep/square 0.3.90 → 0.3.91

package/dist/cli/maintenance-commands.js

@@ -10,10 +10,13 @@ export const migrateCommand = {
     async execute(_intent, context) {
         const squarePath = requireSquarePath(context);
         const outcome = await migrateSquare(squareInput(context));
-        const body = outcome.status === 'migrated' && outcome.counts !== undefined
+        const body = outcome.status === 'migrated'
             ? [
                 '✓ migrated to current row storage',
-                `  · ${outcome.counts.activities} activities · ${outcome.counts.receipts} receipts · ${outcome.counts.leases} leases · ${outcome.counts.routes} routes`,
+                ...(outcome.counts === undefined ? [] : [
+                    `  · ${outcome.counts.activities} activities · ${outcome.counts.receipts} receipts · ${outcome.counts.leases} leases · ${outcome.counts.routes} routes`,
+                    `  · ${outcome.counts.recoveredSeats} recovered seats · ${outcome.counts.unownedStanding} unowned standing · ${outcome.counts.sharedBodySeats} shared-body seats · ${outcome.counts.skippedEvidence} skipped evidence`,
+                ]),
             ].join('\n')
             : '· already current format — nothing changed';
         return { output: withPathOutput(squarePath, body, { participantCount: outcome.standing }) };

package/dist/help.js

@@ -92,8 +92,8 @@ const COMMANDS = [
     },
     {
         names: ['migrate'], usage: 'migrate', usesSquare: true, group: 'maintenance',
-        summary: 'Convert an existing version 2 or 3 square to current format 4 in place.',
-        details: ['For the selected .square artifact only. Stop sessions using this artifact before conversion. Back up the stopped artifact, migrate it, then run square --location <path> doctor before starting updated clients.', 'A version 2 or 3 square is accepted; version 1, unrelated or unsupported artifacts are refused without a write. There is no --check, --backup or --force.'],
+        summary: 'Convert a supported older square to the current format in place.',
+        details: ['For the selected .square artifact only. Stop sessions using this artifact before conversion. Back up the stopped artifact, migrate it, then run square --location <path> doctor before starting updated clients.', 'Versions 2, 3 and 4 are accepted; version 1, unrelated or unsupported artifacts are refused without a write. Names whose own owner and route evidence agrees may share a body; names with missing or conflicting ownership stay standing without write or delivery authority. Migration reports recovered seats, unowned standing names, shared-body seats and skipped evidence. There is no --check, --backup or --force.'],
     },
 ];
 function definitionFor(command) {

package/dist/square-migration.d.ts

@@ -6,6 +6,10 @@ export interface MigrationCounts {
     readonly receipts: number;
     readonly leases: number;
     readonly routes: number;
+    readonly recoveredSeats: number;
+    readonly unownedStanding: number;
+    readonly sharedBodySeats: number;
+    readonly skippedEvidence: number;
 }
 export interface MigrationOutcome {
     readonly status: 'migrated' | 'already-current';

package/dist/square-migration.js

@@ -229,25 +229,24 @@ function establishingJoin(driver, participant) {
     return join.index;
 }
 function planSeats(location, roster, routes, owners, driver) {
-    const standing = roster.filter((participant) => participant.joined);
-    return standing.map((participant) => {
+    const seats = [];
+    const localRoutes = routes.filter(route => canonicalPathSync(route.location) === location);
+    for (const participant of roster.filter((participant) => participant.joined)) {
         const joined = establishingJoin(driver, participant);
-        const candidates = routes.filter((route) => canonicalPathSync(route.location) === location && nameKey(route.participant) === nameKey(participant.name));
+        const candidates = localRoutes.filter((route) => nameKey(route.participant) === nameKey(participant.name));
         const owner = owners.find(row => nameKey(row.participant) === nameKey(participant.name));
-        assertSource(owner !== undefined, `standing participant ${participant.name} has no legacy owner.`);
-        const { body } = owner;
-        assertSource(candidates.length > 0 && candidates.every(route => sameBody(route.body, body)), `standing participant ${participant.name} has no unique legacy body agreeing with its owner.`);
-        const shared = [...owners, ...routes.filter(route => canonicalPathSync(route.location) === location)]
-            .some(row => nameKey(row.participant) !== nameKey(participant.name) && sameBody(row.body, body));
-        assertSource(!shared, `standing participant ${participant.name} shares a legacy body with another owner.`);
+        const body = owner?.body ?? candidates[0]?.body;
+        if (body === undefined || !candidates.every(route => sameBody(route.body, body)))
+            continue;
         const address = uniqueSeatAddress(candidates);
-        return {
+        seats.push({
             participant: participant.name,
             body,
             generation: formatActivityId(joined),
             ...(address === undefined ? {} : { wakeAddress: address }),
-        };
-    });
+        });
+    }
+    return seats;
 }
 function tableToken(database, table, order) {
     const rows = database.prepare(`SELECT * FROM ${table} ORDER BY ${order}`).all();
@@ -313,15 +312,20 @@ function inspectLegacyRowArtifact(database, location, host) {
             leaseGenerations.push({ ownerJson: row.owner_json, generation: formatActivityId(ownerParticipant.lastJoinIndex) });
     }
     const seats = planSeats(location, roster, routes, host.owners, driver);
+    const standingCount = roster.filter(participant => participant.joined).length;
+    const deliveries = planLegacyDeliveries(host.evidence, seats, driver);
     const counts = {
         activities: activityCount,
         receipts: Number(database.prepare('SELECT COUNT(*) AS n FROM receipts').get().n),
         leases: leaseOwners.length,
         routes: routes.length,
+        recoveredSeats: seats.length,
+        unownedStanding: standingCount - seats.length,
+        sharedBodySeats: seats.filter(seat => seats.some(other => other !== seat && sameBody(other.body, seat.body))).length,
+        skippedEvidence: host.evidence.length - deliveries.length,
     };
     const sourceToken = legacySourceToken(database);
-    return { standing: seats.length, seats, leaseGenerations, sourceToken, counts,
-        deliveries: planLegacyDeliveries(host.evidence, seats, driver) };
+    return { standing: standingCount, seats, leaseGenerations, sourceToken, counts, deliveries };
 }
 function legacyPayloadHash(payload) {
     return createHash('sha256').update(payload).digest('hex');
@@ -348,47 +352,49 @@ function legacyDeliveryPayload(source, current) {
 }
 function planLegacyDeliveries(records, seats, driver) {
     const byGroup = new Map();
-    const tokens = new Set(), completedBodies = new Map();
+    const completedBodies = new Map();
     for (const source of records) {
+        // Validate structure even when no surviving owner can accept this row.
+        assertSource(source.kind === 'wake' || source.kind === 'presentation', 'delivery evidence kind is unsupported.');
+        assertSource(['dispatching', 'accepted', 'failed', 'unknown', 'released', 'presented', 'clipped'].includes(source.outcome), 'delivery evidence outcome is unsupported.');
+        assertSource(source.session.length > 0
+            && (source.channel === undefined || typeof source.channel === 'string' && source.channel.length > 0)
+            && (source.agent === undefined || typeof source.agent === 'string' && source.agent.length > 0), 'delivery evidence body is malformed.');
+        const index = parseActivityId(source.activity);
+        assertSource(index !== undefined, 'delivery evidence activity id is malformed.');
+        const at = sourceFinite(source.at);
+        const expiresAt = source.expiresAt === undefined ? undefined : sourceFinite(source.expiresAt);
+        const claimToken = source.claimToken;
+        assertSource(claimToken === undefined || typeof claimToken === 'string' && claimToken.length > 0, 'delivery claim token is malformed.');
+        assertSource(source.attemptN === undefined || Number.isSafeInteger(source.attemptN) && source.attemptN >= 0, 'delivery attempt number is malformed.');
         const participant = driver.participant(source.participant);
+        const seat = seats.find(seat => nameKey(seat.participant) === nameKey(source.participant));
+        const payload = legacyDeliveryPayload(source, seat?.wakeAddress);
         const native = source.kind === 'wake' && source.nativeDelivery !== undefined;
-        if (!participant?.joined && !native)
-            continue; // Noncritical completed diagnostics are not imported.
-        assertSource(participant?.joined || participant?.done, `native delivery evidence for ${source.participant} has no unique participant.`);
+        if (!participant?.joined && !(participant?.done && native))
+            continue;
+        if (participant.joined && (seat === undefined || seat.body.session !== source.session
+            || source.agent !== seat.body.agent || source.channel !== undefined && source.channel !== seat.body.channel))
+            continue;
+        const harness = source.nativeDelivery?.harness;
+        if (native && seat !== undefined && harness !==
+            (seat.body.channel === 'claude-code' ? 'claude' : seat.body.channel === 'opencode' ? 'opencode' : undefined))
+            continue;
         const joined = establishingJoin(driver, participant);
         const generation = formatActivityId(joined);
-        const seat = seats.find(seat => nameKey(seat.participant) === nameKey(participant.name));
-        if (participant.joined)
-            assertSource(seat !== undefined && seat.body.session === source.session
-                && source.agent === seat.body.agent && (source.channel === undefined || source.channel === seat.body.channel), `delivery evidence for standing participant ${source.participant} has no unique owner.`);
-        if (native && seat !== undefined)
-            assertSource(source.nativeDelivery?.harness ===
-                (seat.body.channel === 'claude-code' ? 'claude' : seat.body.channel === 'opencode' ? 'opencode' : undefined), 'native delivery harness conflicts with its owner body.');
-        const index = parseActivityId(source.activity);
-        assertSource(index !== undefined && index > joined && driver.activity(index)?.kind === 'say'
-            && driver.directedAt(participant.name, index) !== undefined, `delivery evidence for ${source.participant} has no unique activity in its join generation.`);
-        const payload = legacyDeliveryPayload(source, seat?.wakeAddress);
+        if (index <= joined || driver.activity(index)?.kind !== 'say' || driver.directedAt(participant.name, index) === undefined)
+            continue;
         if (participant.done) {
             const done = driver.activityHeads({ actors: [participant.name], kinds: ['done'] }, { edge: 'newest', limit: 1 }).items[0];
-            assertSource(done !== undefined && index < done.index && source.session.length > 0, `native delivery evidence for ${source.participant} has no unique completed generation.`);
-            const harness = source.nativeDelivery.harness;
+            if (done === undefined || index >= done.index)
+                continue;
             const body = { channel: harness === 'claude' ? 'claude-code' : 'opencode', session: source.session,
                 ...(source.agent === undefined ? {} : { agent: source.agent }) };
-            validateBody(body);
+            if (source.channel !== undefined && source.channel !== body.channel)
+                continue;
             const coordinate = JSON.stringify([body.channel, body.session, body.agent]);
-            const previous = completedBodies.get(nameKey(participant.name));
-            assertSource(previous === undefined || previous === coordinate, 'completed native delivery owner mapping is ambiguous.');
-            completedBodies.set(nameKey(participant.name), coordinate);
-        }
-        assertSource(source.kind === 'wake' || source.kind === 'presentation', 'delivery evidence kind is unsupported.');
-        assertSource(['dispatching', 'accepted', 'failed', 'unknown', 'released', 'presented', 'clipped'].includes(source.outcome), 'delivery evidence outcome is unsupported.');
-        const at = sourceFinite(source.at);
-        const expiresAt = source.expiresAt === undefined ? undefined : sourceFinite(source.expiresAt);
-        const claimToken = source.claimToken;
-        assertSource(claimToken === undefined || typeof claimToken === 'string' && claimToken.length > 0, 'delivery claim token is malformed.');
-        if (claimToken !== undefined) {
-            assertSource(!tokens.has(claimToken), 'delivery claim token is ambiguous.');
-            tokens.add(claimToken);
+            const key = nameKey(participant.name), previous = completedBodies.get(key);
+            completedBodies.set(key, previous === undefined || previous === coordinate ? coordinate : null);
         }
         const group = JSON.stringify([nameKey(participant.name), generation, index, source.kind]);
         const row = {
@@ -409,14 +415,19 @@ function planLegacyDeliveries(records, seats, driver) {
     }
     const deliveries = [];
     for (const rows of byGroup.values()) {
-        const attempts = rows.map(row => row.attemptN);
-        const explicit = attempts.filter((attempt) => attempt !== undefined);
-        assertSource(explicit.every((attempt) => Number.isSafeInteger(attempt) && attempt >= 0) && new Set(explicit).size === explicit.length, 'delivery attempt mapping is ambiguous.');
-        if (explicit.length !== rows.length)
-            assertSource(rows.length === 1 && explicit.length === 0, 'delivery attempt mapping is ambiguous.');
+        if (completedBodies.get(nameKey(rows[0].participant)) === null)
+            continue;
+        const explicit = rows.flatMap(row => row.attemptN === undefined ? [] : [row.attemptN]);
+        if (new Set(explicit).size !== explicit.length || explicit.length !== rows.length && rows.length !== 1)
+            continue;
         rows.forEach((row, index) => deliveries.push({ ...row, attemptN: explicit.length === 0 ? 0 : explicit[index] }));
     }
-    return deliveries;
+    const tokens = new Map();
+    for (const row of deliveries) {
+        if (row.claimToken !== undefined)
+            tokens.set(row.claimToken, (tokens.get(row.claimToken) ?? 0) + 1);
+    }
+    return deliveries.filter(row => row.claimToken === undefined || tokens.get(row.claimToken) === 1);
 }
 const V4_REBUILT_TABLES = ['square_meta', 'catch_leases'];
 function tableDefinition(name) {

package/guides/migration.md

@@ -38,25 +38,44 @@ artifact. Its latest owner row for each participant at this artifact is selected
 by source `(effectiveAt, seq)` only: no wall clock, retention, expiry, or ownership
 history reconstruction is involved.
 
-- A standing seat requires an agreeing owner Body (`channel`, `session`, optional
-  `agent`), route Body, and verified establishing last join. Routes alone never
-  establish ownership. An absent agent means the top-level body; a known agent is
-  preserved and compared exactly. Repeated matching route registrations are
-  acceptable; a wake address is carried forward only when they agree on it.
-- Missing owners or routes, conflicting or shared body mappings, and unverifiable
-  joins refuse before publication. Resolve these in the old runtime before
-  retrying; migration does not guess or synthesize authority.
-- Standing wake/presentation evidence maps only to that verified current join
-  generation and an existing directed say after the join. Evidence older than the
-  current generation, conflicting owner/session mappings, duplicate claim tokens,
-  or ambiguous attempt numbers refuse. A single record without an attempt number
-  receives attempt 0; missing numbers among multiple attempts are ambiguous.
+- A legacy owner Body (`channel`, `session`, optional `agent`) establishes a
+  standing seat only when it agrees with all of that name's local route Bodies
+  and the establishing last join is verified. An owner without routes needs no
+  wake address. Without a legacy owner, one unambiguous Body recorded by that
+  participant's own routes establishes its seat instead. An absent agent means
+  the top-level body; a known agent is preserved and compared exactly. Repeated
+  matching registrations are acceptable; a wake address is carried forward only
+  when the routes agree on it. Routes are location-bound: moving an artifact copy
+  to another path does not establish that its original routes apply there. An
+  off-location copy is not ownership-recovery evidence for the original location.
+- Without an owner or any route Body, the participant stays standing without a
+  seat. Its source participant state, activities, attention, receipts, landed
+  audience and catch lease are preserved. No Body, route or departure is invented;
+  the name has no write authority or delivery eligibility. Doctor retains its
+  strict history-derived consistency checks.
+- A Body may own several participant seats. Each name retains its own seat,
+  establishing join generation and wake address; sharing does not merge names or
+  choose one name over another. All evidence for each name must agree: if its
+  routes disagree with each other or with its legacy owner Body, that name stays
+  standing without a seat. Disagreement does not abort migration and neither side
+  is chosen as authoritative. Unverifiable joins still refuse before publication.
+  Migration does not guess or synthesize authority.
+- Evidence structure is validated before placement, including rows that cannot be
+  imported. Malformed fields, invalid activity IDs or malformed native correlation
+  still refuse without changing either source.
+- Wake/presentation evidence for a recovered seat is imported only when its Body
+  agrees and it names an existing directed say after the verified current join.
+  A missing seat, conflicting session/agent/channel or native harness, unknown
+  participant, or activity outside the generation causes the row to be skipped,
+  not a failed conversion. Nothing is reassigned to another owner.
 - Done participants get **no seat or completed coordinate**. Only native wake
   correlation directly attributable to their verified latest join and a directed
   activity between that join and done is retained for retired-token recognition.
-  It does not authorize admission, completion, or presentation. Ambiguous critical
-  native mappings refuse rather than disappear. Migrated Claude native addresses
-  include `sessionId` on both seats and evidence routes.
+  It does not authorize admission, completion, or presentation. Conflicting
+  completed Body mappings, duplicate claim tokens and ambiguous attempt numbering
+  cause all affected rows to be skipped, rather than selecting a winner. A single
+  record without an attempt number receives attempt 0. Migrated Claude native
+  addresses include `sessionId` on both seats and evidence routes.
 
 This is deliberately a narrow, lossy conversion, not a general history importer.
 Conversation facts (activity IDs, bodies and audience), receipts and source revision
@@ -65,15 +84,23 @@ correlation survive direct mappings. Completed non-native evidence and noncritic
 metadata—including old presence history, epochs, diagnostic messages, native
 observation histories and arbitrary legacy fields—are not imported. The legacy
 ledger is read-only and remains untouched, so it is still available for offline
-diagnostics. An absent ledger cannot establish standing ownership; an unreadable
-or unsupported ledger refuses before changing the square.
-
-After successful preflight, one SQLite transaction creates ownership/evidence rows and the
-empty deferral table/index, then publishes format 5. Activity history and indices,
-receipts, lease contents, and the artifact revision are preserved. Legacy routes
-are decoded only during migration and their table is removed. Existing lease
-generations are resolved only for exact owner spellings that match a standing
-participant; other lease rows retain their legacy, unbound generation.
+diagnostics. An absent ledger still permits route-derived seats; an unreadable
+or unsupported ledger refuses before changing the square. Evidence without a
+current or verified completed owner is skipped and counted. The source ledger is
+retained for offline diagnosis; skipped evidence never grants delivery authority.
+
+After successful preflight, one SQLite transaction imports seats and evidence
+and adds delivery deferral support, then publishes the current format. All
+existing activities, their indices and audience, participant state, attention,
+receipts, lease contents, and the source revision are preserved. Legacy routes
+are consumed only during migration. Lease generations are resolved only for exact
+owner spellings that match a standing participant; other lease rows retain their
+legacy, unbound generation. The command reports recovered seats and unowned
+standing names, and recovered seats whose Body is shared with another recovered
+seat, and skipped evidence rows, alongside the activity, receipt, lease and source
+route counts. The shared count measures seats, not distinct Bodies or shared groups.
+The skipped count includes every wake/presentation row read from the selected
+legacy ledger but not imported, including completed non-native diagnostics.
 The new delivery revision starts at zero. There is no intermediate published
 format, and any failure before commit rolls back the conversion.
 
@@ -90,8 +117,7 @@ reader; migration consumes the old rows only to resolve seats, then drops the le
 table as part of the format change.
 
 Unrelated databases, unsupported formats, non-`DELETE` journal modes, unknown
-schemas, malformed headers or rows, unresolved standing ownership, and ambiguous
-standing or native delivery evidence are refused. The source artifact is preserved on every
+schemas, malformed headers, rows or native correlation are refused. The source artifact is preserved on every
 refusal. Migration is not a repair command and never rewrites journal mode to make
 conversion possible. A HostLedger that itself requires migration must be migrated
 separately before Square migration can import its delivery evidence.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrosheep/square",
-  "version": "0.3.90",
+  "version": "0.3.91",
   "description": "A shared public square where agents join, catch activity, express, and step out when done.",
   "type": "module",
   "bin": {

package/plugins/claude/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "square",
-  "version": "0.3.90",
+  "version": "0.3.91",
   "description": "Native Claude Code inbox delivery for Square participants",
   "types": "./types.d.ts",
   "author": {

package/plugins/codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "square",
-  "version": "0.3.90",
+  "version": "0.3.91",
   "description": "Shared Square activity with reliable participant attention at Codex boundaries.",
   "author": {
     "name": "Square"