@astrosheep/square 0.3.92 → 0.3.94

package/dist/wakes.d.ts

@@ -1,4 +1,4 @@
-import { type WatchLease, type WatchOptions } from './model.js';
+import { type WatchOptions } from './model.js';
 import type { SquareArtifactPort } from './ports.js';
 import type { Seat } from './model.js';
 export type WatchLeaseStart = {
@@ -8,7 +8,6 @@ export type WatchLeaseStart = {
     readonly heartbeatAt: number;
 } | {
     readonly type: 'active';
-    readonly lease: WatchLease;
 };
 export type WatchLeasePulse = {
     readonly type: 'replaced';

package/dist/wakes.js

@@ -9,7 +9,7 @@ export async function acquireWatchLease(artifact, seat, at, leaseId, options, si
     const { value } = await artifact.transactAs({ kind: 'participant', seat }, facts => {
         const known = resolveKnownName(facts, name), existing = freshWatchLease(facts, known, at);
         if (existing !== undefined && !options.replace)
-            return { type: 'active', lease: existing };
+            return { type: 'active' };
         facts.putLease(known, newLease(leaseId, at, options), seat.generation);
         return { type: 'started', leaseId, replaced: existing !== undefined, heartbeatAt: at };
     }, signal);

package/guides/application-facade-delivery-evidence.md

@@ -176,7 +176,7 @@ These are deliverer closures, not a reviewer verdict. Rows distinguish behavior
 | Express cleanup/enrichment erases commit or calls it unsent | Resource close cannot replace a completed result. Action route/host publication is best effort after commit. Commit observation replaces duplicate post-read. Boundary fixtures prove postcommit host-publication failure returns the activity, projection-clock failure retains landed ID without replay, and selected-row corruption is unknown rather than proven unsent. Operation-cancellation has before-return commit abort coverage. |
 | Catch completion/enrichment erases a committed page | Raw page, ordinals/count/cap/hold/terminal facts travel with receipt selection; completion never rereads them. Only optional `catchPresence` can be unavailable. `performance`: real selection hydrates exactly its page; presence/rendering adds no hydration/reads. Operation-cancellation preserves committed consumption after abort. |
 | Replaced/cancelled waiter consumes later activity or releases new lease | Catch selection transaction checks lease ID. Finally cleanup is non-aborted and ID-fenced. Boundary fixtures prove replacement owns consumption, old waiter returns replaced, cancelled waiter releases lease, later attention stays pending. Hold/expiry and CLI watch-wait heartbeat fixtures pass. |
-| SDK projection roundtrip / leaked observations | SDK express uses `prepareExpression` + `landExpression`, strips observation/waited and retains delivery; SDK catch uses `catchOwned` and returns only established CatchResult. SDK test asserts established fields and avoids application body projections. SDK Square history stays unbounded, Participant recent-ten; parity history fixture proves both, and projection test preserves detached delivered predicate. |
+| SDK projection roundtrip / leaked observations | The current SDK result shapes are documented in [Square/Participant API](square-api.md); parity tests exercise the real resource and projection tests preserve the detached delivered predicate. |
 | Duplicate contracts, aliases and dead mixed views | Private status/unread producers import/re-export facade contracts; catch observation extends shared expression facts and enriched projection reuses it; required express participant replaces name alias. Retired helper search is empty. Recovery selects only gates/bounded unread summaries, not discarded feed/ordinals/perceptions. |
 | Packed owner orchestration hides effects/count integrity | History, lifecycle branches, maintenance/discovery/recovery, catch conflict and SDK recognize are expanded into readable steps. Remaining one-line SDK delegates are supported simple resource calls, not packed async policy. Inspect implementation diff; all new source is included in count. |
 | Invalid reply / done repair regressions | Typed `invalid_reply` covers malformed and valid-but-absent IDs; typed reach/done reasons stay domain facts, CLI owns glyphs/flags. Express-recovery tests execute printed repaired commands, preserving raw drafts, body candidates and other recipients. Unknown/landed effects offer reconciliation, never replay. |

package/guides/claude-native.md

@@ -5,6 +5,10 @@ contains only `{"modules":["./register.js"]}`. Install with `square install clau
 and load/approve it in a trusted interactive Claude terminal. Installation is
 not evidence of a live receiver.
 
+Public `Square.at` and `Square.build` use the default Claude/Codex/Paseo wake transport when
+`wakeTransport` is omitted. Supply a port to replace it or `false` to disable proactive wake;
+synchronous `Square.inMemory` uses only an explicit port. See [square-api.md](square-api.md).
+
 ## Validated capability
 
 The supported baseline is **macOS Claude Code with the mod actually loaded**;
@@ -24,7 +28,7 @@ An absent/broken endpoint is unavailable; it does not consume Square activity.
 Native delivery is preferred, including under Paseo. CLI and call-local MCP Codex
 joins register the native queue for their thread. Claude and OpenCode receivers
 register their native wake addresses only through their loaded integrations. An
-ordinary reconnect or implicit join cannot replace a current native address with a
+ordinary reconnect or reattachment cannot replace a current native address with a
 generic Paseo proposal. Addresses belong to the artifact seat generation, not an
 expiring routes table: explicit receiver withdrawal permits fallback, and a new
 seat generation cannot inherit the previous generation's native registration.
@@ -95,15 +99,20 @@ Initial activation and hot reload use `session.start`. New conversations use
 `classic.SessionStart`: clear reads the new API coordinate; **resume's event
 `session_id` is already the resumed coordinate while `$.session.id()` still reads
 the ending one (observed in 2.1.295)**. The event coordinate is used at that boundary, with
-API cwd/version/socket. Modern `session.end` retires only its pinned `e.sessionId`
-and captured ownership epochs, within the event budget. Late committed joins
+API cwd/version/socket. Modern `session.end` detaches only its pinned `e.sessionId`
+and captured owner/join generations, within the event budget. Late committed joins
 are discovered at the pinned end timestamp. A process crash can omit end.
 
-A resumed conversation restores only memberships whose last lifecycle activity
-is exactly the `done` recorded by its previous confirmed end in the existing
-host ledger. It never takes another owner's participant or re-enters a later
-explicit user `done`. Restoration advances the binding epoch, so callbacks and
-old ends cannot retire that replacement. Unchanged reload preserves epochs.
+Host end is not a participant departure: no `done` lands, and membership, listens,
+read horizon and generation remain intact. Catch ownership, deferrals and wake readiness
+are cleared; the participant appears away and keeps accumulating unread audience without
+proactive delivery. Before arming a receiver, start/resume discovers the exact owner's
+standing seats through `seatsOf(owner)` and restores only detached ones with
+`reattach(name, {owner, wakeAddress?})`. The adapter obtains that owner with
+`harnessOwner({channel: 'claude-code', session, agent?})`. One failed seat or location does not block the
+others. New/forked harness owners restore nothing. Neither a voluntary `done` nor a takeover is
+revived; there is no completed-seat recovery path or timeout that turns away into done.
+See [participant-ownership.md](participant-ownership.md).
 
 ## Body, admission, and presentation
 
@@ -143,7 +152,7 @@ Explicit plugin `turn.abort` and terminal `turn.complete(reason:'aborted')`
 suppress the outstanding local batch without recording seen. Ordinary answer,
 refusal, and error completion are not user cancellation. Separate engine-owned
 family state survives hot reload, containing the abort timestamp and frozen
-membership epochs. Same-epoch host-ledger presence stores a monotonic activity
+membership generations. The artifact stores a generation-scoped monotonic activity
 cutoff; replacement generations cannot inherit the old abort.
 
 Engine state reads are snapshots of one dispatch. Confirmation therefore uses

package/guides/codex-delivery.md

@@ -5,14 +5,22 @@ maintaining a second hook protocol, boundary store or CLI sender. The standalone
 package's [README](../packages/agent-delivery/README.md) describes both its native
 app-server capability and its host-owned hook integration.
 
+Public `Square.at` and `Square.build` use the default Claude/Codex/Paseo wake transport when
+`wakeTransport` is omitted. Supply a port to replace it or `false` to disable proactive wake;
+synchronous `Square.inMemory` uses only an explicit port. See [square-api.md](square-api.md).
+
 ## Square's hook path
 
 `plugins/codex/hooks/hooks.json` invokes `square codex-hook`:
 
 - `SessionStart`, `SessionResume` and `UserPromptSubmit` invalidate the previous
-  Stop observation. `SessionEnd` marks the session ended and ends Square's owned
-  memberships. Later Stop/tool callbacks cannot re-enable queue until a new
-  `SessionStart` or `SessionResume`.
+  Stop observation. `SessionEnd` marks the host session ended and detaches its exact
+  owner's seats without landing `done`, ending membership, dropping listens or resetting
+  the read horizon. Later Stop/tool callbacks cannot re-enable queue until a new
+  `SessionStart` or `SessionResume`. Before enabling delivery, those start paths use
+  `seatsOf(owner)` and `reattach(name, {owner, wakeAddress?})` to restore only detached
+  standing seats of that exact owner; voluntary departures and takeovers are never revived.
+  A new/forked session restores nothing.
 - `PostToolUse` asks Square for current pending activity and returns the existing
   bounded `additionalContext` presentation.
 - `Stop` records queue eligibility and sweeps pending work, but does not itself
@@ -20,7 +28,7 @@ app-server capability and its host-owned hook integration.
 
 The shared handler owns hook framing, lifecycle sequencing, its cancellation
 budget and bounded sweeps. Square supplies activity selection, formatting,
-artifact-owned presentation claims, cancellation, membership cleanup and
+artifact-owned presentation claims, cancellation, attachment cleanup and
 pending-work sweeps. The handler cooperatively awaits Square's pull: the signal
 cancels work before presentation, but a successful presentation's `settleAs`
 finishes independently of request cancellation. Even when that settlement crosses
@@ -28,11 +36,14 @@ the internal budget, the hook waits for it and returns the associated context;
 it never abandons settlement that can mark activity seen without returning text.
 After expiry, no sweep starts, and a sweep timeout cannot erase successful pull
 output. Settlement must still finish within Codex's external hook timeout. Hook inbox lookup uses
-an exact Body (`{ channel: 'codex', session }`), not a bare session id. The shared
+an exact owner from `harnessOwner({ channel: 'codex', session })`, not a bare session id. The shared
 boundary store uses Square's caller-selected `SQUARE_CODEX_BOUNDARIES` file,
 defaulting to `~/.square/codex-boundaries.json`; its JSON observations are not
 conversation storage and are not proof of current native execution or consumption.
-Square's format5 artifact remains authoritative for seats and delivery evidence.
+Square's format-7 artifact remains authoritative for membership, attachment and delivery evidence.
+Detached members appear away indefinitely and keep accumulating unread audience, but have no
+write or proactive delivery eligibility until same-owner reattachment. Only a host-confirmed
+permanent deletion uses fenced membership-ending cleanup; Codex SessionEnd is not that proof.
 
 `CodexQueueTransport` implements the existing `WakeTransportPort` and uses the public
 `connect({ harness: 'codex', transport: 'cli', sessionId, boundaries, ... })`

package/guides/mcp-connection-lifetime.md

@@ -1,6 +1,6 @@
 # MCP connection lifetime
 
-An MCP server owns one artifact connection for its configured square. Its lifetime ends on close or disconnect; create a new server instance for a new connection. Replacing an artifact file under a running server remains unsupported. Every tool call opens an actual `Square` handle with that request's captured environment, default participant and harness session; `square.participant()` performs nonmutating name selection. Calls with an explicit `location` override instead open and close a per-call connection, leaving the configured-square owner untouched. Only the default connection is shared: authorization, presence, activity facts and cancellation remain operation-scoped. The artifact port already serializes transactions on its connection.
+An MCP server owns one artifact connection for its configured square. Its lifetime ends on close or disconnect; create a new server instance for a new connection. Replacing an artifact file under a running server remains unsupported. Every tool call opens an identity-free `Square` handle with that request's resource environment; harness identity is passed to `join(name, {body, wakeAddress?})` or `selectOwnSeat(square, body, as?)`, never captured by the resource. Calls with an explicit `location` override instead open and close a per-call connection, leaving the configured-square owner untouched. Only the default connection is shared: authorization, presence, activity facts and cancellation remain operation-scoped. The artifact port already serializes transactions on its connection.
 
 `createSquareResourceOwner()` is the explicit lifetime boundary. `Square.at({resources, ...})` borrows its connection; closing a request handle leaves the owner open. Ordinary callers open and close their own Square. Cross-square `inbox()` reads remain independent. The connection captures no request abort signal. Explicit server close and transport disconnect share one shutdown path: the SDK cancels requests, handlers finish their cleanup, then the connection closes.
 

package/guides/mcp.md

@@ -2,12 +2,12 @@
 
 Square provides a stdio MCP server through `square mcp-server`.
 
-Set `SQUARE_LOCATION` to the default `.square` artifact path; calls may override it with `location`. Relative paths use the server's startup working directory. Join with an explicit `as` name. Later calls may omit `as` only when the artifact recognizes exactly one current name held by the call's exact Body (`channel`, `session`, optional `agent`); zero or multiple matches refuse and require explicit selection. An explicit name selects a voice but never grants custody. Request metadata supplies the live Codex (`threadId`) or OpenCode (`ai.opencode/sessionID`) coordinate when present; otherwise a reliable startup coordinate is required for participant writes. Read-only calls do not need a Body.
+Set `SQUARE_LOCATION` to the default `.square` artifact path; calls may override it with `location`. Relative paths use the server's startup working directory. Join with an explicit `as` name. Later calls may omit `as` only when the artifact recognizes exactly one current name held by the call's exact opaque owner; zero or multiple matches refuse and require explicit selection. An explicit name selects a voice but never grants custody. Request metadata supplies the live Codex (`threadId`) or OpenCode (`ai.opencode/sessionID`) coordinate when present, encoded through `harnessOwner`; otherwise the server-configured owner applies. CLI startup resolves `--owner`/`SQUARE_OWNER`, a complete harness coordinate, or the local user owner in that order, refusing incomplete harness identity. Owner is never a model tool argument. Read-only calls do not need an owner.
 
-The server exposes `join`, `express`, `catch`, `history`, `attention`, `hold`, `done`, and `status`. `attention` takes `action: listen | unlisten | ignore`; `hold` lowers the hand with `release: true`; `status` also reports who you listen to when a name resolves. `catch` consumes activities. `history` is read-only and accepts stable `act/<index>` cursors. Tool results include JSON `structuredContent` and a text representation of the same data. Square failures are returned as tool errors with a structured `{ error: { code, message, facts? } }` value.
+The server exposes `join`, `express`, `catch`, `history`, `attention`, `hold`, `done`, and `status`. `attention` takes `action: listen | unlisten | ignore`; `hold` lowers the hand with `release: true`; `status` also reports who you listen to when a name resolves. `catch` consumes activities. `history` is read-only and accepts stable `act/<index>` cursors. All eight tools return the same human-readable text as the CLI in `content`, without `outputSchema` or `structuredContent`. Square failures set `isError: true` and return readable refusal and recovery text in `content`. Clients keep their native MCP result envelope; machine-readable domain results remain available through the SDK.
 
 Claude's bundled plugin configures this server automatically. Its mod supplies live session/cwd/subagent attribution through an out-of-band tool-use-ID association, not AI-visible arguments; see [Claude call identity](claude-native.md#mcp-tools-and-call-identity). The bundled endpoint requires that association rather than falling back to its startup environment.
 
-Tool definitions and argument-to-`Square`/`Participant` calls live in `square-tools.ts`, shared with the [Pi native tools](pi-tools.md). Join serializes the handle's name and receipt fields, never resource internals. All callers use the [same concrete resource API](square-api.md), with no alternate factory or generic outcome envelope. `express.noMention` disables body @name scanning without disabling explicit mentions or reply attention.
+Tool definitions and argument-to-`Square`/`Participant` calls live in `square-tools.ts`, shared with the [Pi native tools](pi-tools.md). Domain receipts stay internal to these adapters; tools return only their rendered text. All callers use the [same concrete resource API](square-api.md), with no alternate factory or generic outcome envelope. `express.noMention` disables body @name scanning without disabling explicit mentions or reply attention.
 
 Configure a client with command `npx` and arguments `--yes --package @astrosheep/square square mcp-server`, or use the installed `square` executable with argument `mcp-server`. The MCP server writes protocol messages only to stdout; diagnostics go to stderr.

package/guides/migration.md

@@ -1,159 +1,150 @@
 # Migrating an existing square
 
-Square stores its authority in one versioned SQLite artifact. Format 1 kept the
-history as one JSON snapshot; format 2 introduced typed rows; format 3 added the
-`unlisten` activity; format 4 added artifact-owned participant seats and delivery
-evidence; format 5 adds independent expiring delivery deferrals. Existing artifacts are never
-converted implicitly.
+Square stores its authority in one versioned SQLite artifact. Format 1 kept a snapshot;
+format 2 introduced typed facts; format 3 added `unlisten`; format 4 moved participant custody
+and delivery evidence into the artifact; format 5 added independent delivery deferrals.
+**Format 6 separates participant membership from host attachment; format 7 replaces harness Body
+coordinates with opaque owners.** Existing artifacts are never converted implicitly.
 
-Use the explicit command while all processes using the artifact are stopped:
+Stop all processes using the artifact, make an offline backup, then run:
 
 ```sh
 square --location /path/to/SQUARE.square migrate
+square --location /path/to/SQUARE.square doctor
 ```
 
-The command handles supported formats 2, 3 and 4 in place and publishes only final format 5.
-It does not create a
-backup, stop processes, install a runtime, or update another artifact. A legacy
-HostLedger that needs its own format conversion must be prepared separately with
-the old runtime's offline tooling.
-
-## Format 4 additive conversion
-
-An exact format-4 artifact needs no legacy owner or route import: that authority already lives
-inside the artifact. Read-only preflight checks framing and stored facts. One SQLite transaction
-adds the empty `delivery_deferrals` table and its owner/generation/expiry lookup index, then
-publishes format 5. The dedicated table stores participant key, captured generation, opaque ID,
-validated match and expiry, separately from catch leases and delivery evidence. All existing
-activities (including metadata), audience, receipts, seats, catch leases, delivery evidence,
-cancellation boundaries and both revision values remain unchanged. No lease is manufactured.
-The conversion does not consult or mutate HostLedger. Failure rolls back the table, index and
-format marker together.
-
-## Format 3 preflight and conversion
-
-Before writing, migration validates the exact format-3 schema, header, and legacy
-rows read-only. The configured legacy HostLedger must be frozen along with the
-artifact. Its latest owner row for each participant at this artifact is selected
-by source `(effectiveAt, seq)` only: no wall clock, retention, expiry, or ownership
-history reconstruction is involved.
-
-- A legacy owner Body (`channel`, `session`, optional `agent`) establishes a
-  standing seat only when it agrees with all of that name's local route Bodies
-  and the establishing last join is verified. An owner without routes needs no
-  wake address. Without a legacy owner, one unambiguous Body recorded by that
-  participant's own routes establishes its seat instead. An absent agent means
-  the top-level body; a known agent is preserved and compared exactly. Repeated
-  matching registrations are acceptable; a wake address is carried forward only
-  when the routes agree on it. Routes are location-bound: moving an artifact copy
-  to another path does not establish that its original routes apply there. An
-  off-location copy is not ownership-recovery evidence for the original location.
-- Without an owner or any route Body, the participant stays standing without a
-  seat. Its source participant state, activities, attention, receipts, landed
-  audience and catch lease are preserved. No Body, route or departure is invented;
-  the name has no write authority or delivery eligibility. Doctor retains its
-  strict history-derived consistency checks.
-- A Body may own several participant seats. Each name retains its own seat,
-  establishing join generation and wake address; sharing does not merge names or
-  choose one name over another. All evidence for each name must agree: if its
-  routes disagree with each other or with its legacy owner Body, that name stays
-  standing without a seat. Disagreement does not abort migration and neither side
-  is chosen as authoritative. Unverifiable joins still refuse before publication.
-  Migration does not guess or synthesize authority.
-- Evidence structure is validated before placement, including rows that cannot be
-  imported. Malformed fields, invalid activity IDs or malformed native correlation
-  still refuse without changing either source.
-- Wake/presentation evidence for a recovered seat is imported only when its Body
-  agrees and it names an existing directed say after the verified current join.
-  A missing seat, conflicting session/agent/channel or native harness, unknown
-  participant, or activity outside the generation causes the row to be skipped,
-  not a failed conversion. Nothing is reassigned to another owner.
-- Done participants get **no seat or completed coordinate**. Only native wake
-  correlation directly attributable to their verified latest join and a directed
-  activity between that join and done is retained for retired-token recognition.
-  It does not authorize admission, completion, or presentation. Conflicting
-  completed Body mappings, duplicate claim tokens and ambiguous attempt numbering
-  cause all affected rows to be skipped, rather than selecting a winner. A single
-  record without an attempt number receives attempt 0. Migrated Claude native
-  addresses include `sessionId` on both seats and evidence routes.
-
-This is deliberately a narrow, lossy conversion, not a general history importer.
-Conversation facts (activity IDs, bodies and audience), receipts and source revision
-meaning survive. Replay-critical delivery coordinates, outcomes and native
-correlation survive direct mappings. Completed non-native evidence and noncritical
-metadata—including old presence history, epochs, diagnostic messages, native
-observation histories and arbitrary legacy fields—are not imported. The legacy
-ledger is read-only and remains untouched, so it is still available for offline
-diagnostics. An absent ledger still permits route-derived seats; an unreadable
-or unsupported ledger refuses before changing the square. Evidence without a
-current or verified completed owner is skipped and counted. The source ledger is
-retained for offline diagnosis; skipped evidence never grants delivery authority.
-
-After successful preflight, one SQLite transaction imports seats and evidence
-and adds delivery deferral support, then publishes the current format. All
-existing activities, their indices and audience, participant state, attention,
-receipts, lease contents, and the source revision are preserved. Legacy routes
-are consumed only during migration. Lease generations are resolved only for exact
-owner spellings that match a standing participant; other lease rows retain their
-legacy, unbound generation. The command reports recovered seats and unowned
-standing names, and recovered seats whose Body is shared with another recovered
-seat, and skipped evidence rows, alongside the activity, receipt, lease and source
-route counts. The shared count measures seats, not distinct Bodies or shared groups.
-The skipped count includes every wake/presentation row read from the selected
-legacy ledger but not imported, including completed non-native diagnostics.
-The new delivery revision starts at zero. There is no intermediate published
-format, and any failure before commit rolls back the conversion.
-
-Format 2 first rebuilds only the activity table and its indexes to accept
-`unlisten`, then follows the same row-format preflight and conversion. Snapshot
-format 1 is not accepted by this migration. Formats 2/3 never publish an intermediate format 4.
-
-## What migration refuses
-
-Migration validates each source's exact row schema. Formats 2/3 include the legacy routes table,
-read using migration-local codecs; format 4 already has seats and delivery evidence. Current
-format 5 has no routes table or runtime route
-reader; migration consumes the old rows only to resolve seats, then drops the legacy
-table as part of the format change.
-
-Unrelated databases, unsupported formats, non-`DELETE` journal modes, unknown
-schemas, malformed headers, rows or native correlation are refused. The source artifact is preserved on every
-refusal. Migration is not a repair command and never rewrites journal mode to make
-conversion possible. A HostLedger that itself requires migration must be migrated
-separately before Square migration can import its delivery evidence.
-
-## Conservative retired-token restriction
-
-For an old artifact conversion, **any nonempty legacy `host_native_tokens` table
-makes preflight refuse**, including tokens for other sessions. Those token-only
-Claude tombstones are replay protection, not diagnostics: they contain only a
-session and token, with no artifact, participant or activity coordinate. The
-converter cannot safely assign them a join generation. This is deliberately a
-ledger-wide ambiguity refusal, not a claim that each token belongs to the square
-being converted. Even a tombstone duplicated by retained evidence is refused by
-this conservative implementation; no deduplication or history inference is done.
-
-Keep the original ledger and artifact intact. Resolve the ambiguity offline with
-replay protection preserved; **do not delete tombstones just to bypass preflight**.
-An already-current artifact returns without consulting the legacy ledger and
-remains a byte-preserving no-op.
-
-## Before and after migration
-
-Stop every session or service using the square, and for formats 2/3 freeze any process writing its
-legacy HostLedger. Make an offline backup, or use SQLite's backup facilities rather than
-copying a live database. Migration does not revoke an in-flight remote delivery or
-modify HostLedger evidence. Square writes use ordinary SQLite `DELETE` journals:
-the artifact must be writable and its containing directory must permit journal
-creation and removal. The legacy ledger needs read access only. After conversion,
-participation and delivery authority live in the artifact, not writable HOME;
-loss of the rebuildable HOME discovery index may limit automatic discovery but
-does not transfer custody or erase durable delivery evidence.
-
-Upgrade all attached runtimes before reopening the format-5 artifact; older runtimes
-must not be mixed with it. Updating a package does not migrate an artifact, and migrating an
-artifact does not install upgraded runtimes. For rollback after a committed conversion, stop all
-clients and restore the offline backup with its compatible older runtime; do not downgrade the
-format marker or drop tables in place. Run the read-only `doctor` command after migration and
-before restarting clients. Repeating migration on a current artifact is a
-byte-preserving no-op.
+The command handles supported formats 2–6 in place and publishes only final format 7, in one
+transaction. It does not make a backup, stop processes, install a runtime or update another
+artifact. For formats 2/3, also freeze and back up the legacy HostLedger used for owner/evidence
+import. A legacy ledger needing its own conversion must be prepared separately with its old
+runtime's offline tooling. Snapshot format 1 is not accepted by this conversion.
+
+## Membership and attachment after conversion
+
+Membership owns a participant's join/done history, read horizon and outgoing listens. Attachment
+says whether its exact owner is currently executing for it. There are three distinct endings:
+
+- A participant's voluntary `done` ends membership. A later explicit participant join is required
+  to return; no host start/resume revives it.
+- Pi shutdown, Codex SessionEnd and Claude session end detach only. No activity lands; membership,
+  listens, read horizon, receipts and delivery evidence stay intact. Wake readiness, catch ownership
+  and delivery deferrals are cleared. Away participants still receive landed audience and accumulate
+  unread activity, but cannot write or receive proactive delivery. Away has no timeout.
+- Host-confirmed permanent deletion ends membership through fenced
+  `endHeld(name, {owner, generation})`, including for a detached seat. OpenCode `session.deleted`
+  uses this path.
+
+On start/resume, hosts discover only their exact owner's standing seats with `seatsOf(owner)` and
+restore the detached ones with `reattach(name, {owner, wakeAddress?})` before arming delivery.
+Same-owner `join` or `reattach` preserves the generation, read horizon and listens, so mentions
+received while away remain unread. Reattachment returns `null` for absent, foreign or done seats;
+it never creates membership. Explicit takeover still performs `done -> join` with a fresh
+generation, even when taking over an away participant; old cleanup/recovery cannot reclaim it.
+The owner API requires this explicit format migration; see the
+[SDK breaking migration](square-api.md#sdk-breaking-migration-opaque-owners).
+
+## Conversion from formats 6, 5 and 4
+
+Format 6 -> 7 maps each seat's `channel`, `session` and optional `agent` through the adapter codec
+into one owner string, preserving its generation, attachment and wake. Evidence, deferrals, catch
+leases, cancellations, conversation facts and both revisions stay unchanged. Unmappable legacy
+coordinates (for example an encoded owner exceeding 512 UTF-8 bytes) refuse without changing the
+source; they are never truncated or reassigned. Keep the source backup for offline resolution.
+
+Formats 4/5 first acquire format 6 semantics in that same transaction: every existing seat becomes
+attached. Format 4 also gains empty deferral support. No detached seat is invented. Formats 4–6
+never consult HostLedger; any failure rolls back schema changes and final publication together.
+
+Existing done participants stay done. Before format 6, a host-cleanup `done` was indistinguishable
+from a voluntary leave; migration conservatively treats both as voluntary. It does not infer
+attachment history, reconstruct departures or provide a host recovery path for completed seats.
+
+## Verified import from formats 3 and 2
+
+Formats 2/3 need owner and delivery evidence import. Before writing, migration validates exact
+source framing, header and legacy facts read-only. The frozen legacy HostLedger's latest owner
+for each participant at this artifact is selected by source `(effectiveAt, seq)` only: no wall
+clock, retention, expiry or ownership-history reconstruction is involved.
+
+- A legacy owner Body (`channel`, `session`, optional `agent`) establishes a standing, attached
+  seat only when it agrees with all of that name's local route Bodies and the establishing join
+  is verified. An owner without routes needs no wake address. Without an owner, one unambiguous
+  route Body can establish the seat. An absent agent means the top-level Body; a known agent is
+  preserved and compared exactly. Matching repeated registrations are acceptable; wake readiness
+  carries forward only when the routes agree. Routes are location-bound: moving an artifact copy
+  does not establish that its original routes apply there.
+- Without a verifiable owner or route Body, the participant stays standing without custody.
+  Membership, history, attention, receipts, landed audience and catch ownership are preserved.
+  No Body, route, attachment or departure is guessed. Its name grants no write/delivery authority.
+- A Body may own several names; each retains its own generation and wake readiness. Sharing
+  does not merge names or choose a winner. Conflicting owner/route Bodies leave that name
+  standing without custody; disagreement does not abort conversion. An unverifiable establishing
+  join still refuses before publication.
+- Evidence structure is validated before placement, including evidence that cannot be imported.
+  Malformed facts, activity IDs or native correlation refuse without changing either source.
+- Wake/presentation evidence imports only when its Body agrees and it names an existing directed
+  say after the verified current join. Missing custody, conflicting session/agent/channel or native
+  harness, unknown participants and activity outside the generation cause evidence to be skipped,
+  never reassigned to another owner.
+- Done participants gain no seat or recovery authority. Only native correlation directly
+  attributable to their verified latest join and directed activity before departure is retained
+  for retired-token recognition. It authorizes neither admission nor presentation. Ambiguous
+  completed-Body mappings, duplicate claim tokens and ambiguous attempt numbering cause all
+  affected evidence to be skipped, rather than selecting a winner. A record without an attempt
+  number receives attempt 0. Migrated Claude wake addresses retain their native session identity.
+
+This is a narrow, deliberately lossy conversion, not a general history importer. Conversation,
+activity IDs, bodies, audience, receipts, source revision meaning and directly verified replay
+protection survive. Completed non-native evidence and noncritical metadata—including old presence
+history, epochs, diagnostic messages, native observation histories and arbitrary legacy extras—do
+not import. Evidence without current or verified completed ownership is skipped and counted. The
+read-only legacy ledger remains available for offline diagnosis; an absent ledger permits route-
+derived custody, but an unreadable or unsupported ledger refuses before changing the square.
+
+One transaction imports verified authority/evidence, adds deferral and attachment support and
+publishes format 7. Existing conversation and membership facts are preserved; no intermediate
+format is published. Legacy catch ownership is generation-bound only for exact standing owner
+spellings; otherwise it stays unbound. Legacy routes are consumed only during migration and are
+not a live authority source. The new delivery revision starts at zero. Format 2 first adds support
+for `unlisten`, then follows the same conversion.
+
+The receipt reports recovered seats, unowned standing names, seats sharing a recovered Body,
+skipped evidence, and source activity/receipt/catch/route counts. The shared count measures seats,
+not distinct Bodies or groups. Skipped includes every legacy wake/presentation record read but
+not imported, including completed non-native diagnostics.
+
+## Conservative refusal and retired-token protection
+
+Unrelated databases, unsupported formats, non-`DELETE` journal mode, unknown framing, malformed
+headers/facts or native correlation refuse without source changes. Migration is not repair and
+never rewrites journal mode to make conversion possible.
+
+For formats 2/3, **any nonempty legacy token-only tombstone collection makes preflight refuse**,
+including tokens for other sessions. Those Claude tombstones are replay protection, not diagnostics:
+they identify only a session and token, without artifact, participant, activity or join generation.
+The converter cannot safely assign them. This is a ledger-wide conservative ambiguity refusal,
+not a claim that each token belongs to the artifact being converted. Even a token duplicated by
+retained evidence refuses; conversion does not deduplicate or infer history to bypass protection.
+
+Keep the original ledger and artifact intact. Resolve ambiguity offline with replay protection
+preserved; **do not delete tombstones just to bypass preflight**. An already-current artifact
+returns without consulting the legacy ledger and remains a byte-preserving no-op.
+
+## Before reopening and rollback
+
+Freeze every artifact user and, for formats 2/3, every legacy-ledger writer. Make an offline backup
+or use SQLite backup facilities rather than copying a live database. Migration cannot revoke an
+in-flight remote delivery. Writes use ordinary SQLite `DELETE` journals: the artifact and its
+containing directory must permit writing and journal creation/removal. A legacy ledger needs read
+access only. Losing the rebuildable HOME discovery index may delay restoration/delivery but cannot
+transfer custody or erase evidence. The disposable index changes to `{location, owner}`; old index
+rows are ignored. Rejoin with the exact migrated owner to republish discovery (or let that same
+harness reconnect). This preserves generation, listens and unread activity; do not use takeover
+merely to rebuild the index.
+
+Upgrade all attached runtimes before reopening format 7; older runtimes must not be mixed with it.
+Updating a package does not migrate an artifact, and migration does not install upgraded runtimes.
+After conversion, run read-only `doctor` before restarting clients. To roll back a committed
+conversion, stop all clients and restore the offline backup with its compatible older runtime;
+do not downgrade the format marker or remove facts in place. Repeating current-format migration
+is a byte-preserving no-op.

package/guides/operation-cancellation.md

@@ -21,7 +21,7 @@ Ownership and delivery have the same limitation: cancellation can stop work that
 Presentation checks cancellation and eligibility before invoking its sink. A rejected sink is not
 success, including a native notification whose landing acknowledgement was cancelled. Once the sink
 succeeds, recording its evidence and seen receipts is mandatory settlement, not a new cancellable
-presentation attempt. It uses the same artifact connection and captured Body/join generation, without
+presentation attempt. It uses the same artifact connection and captured owner/join generation, without
 inheriting the pre-effect operation signal or a signal captured when opening that artifact. Claim
 release after a cancelled/failed attempt uses the same independent cleanup lifetime and writes no
 success receipt. Both settle through the normal authority gate, with a five-second storage budget;