@astrosheep/square 0.3.93 → 0.3.95

package/guides/pi-tools.md

@@ -1,6 +1,6 @@
 # Pi native tools
 
-The existing Square Pi extension registers `square_join`, `square_express`, `square_catch`, `square_history`, `square_attention`, `square_hold`, `square_done`, and `square_status`. `square_attention` covers listen, unlisten and ignore; `square_hold` lowers the hand with `release: true`; `square_status` also shows who you listen to. No additional MCP server or subprocess is needed.
+The existing Square Pi extension registers `square_join`, `square_express`, `square_catch`, `square_history`, `square_attention`, `square_done`, and `square_status`. `square_attention` covers listen, unlisten and ignore; `square_status` also shows who you listen to. No additional MCP server or subprocess is needed.
 
 Tools use the `square` namespace with codemode exposure. Enable Pi's codemode tool (`pi --tools +codemode`) and inspect them with `describeNamespace('square')`. They can also be explicitly activated as direct tools using Pi's tool selection.
 
@@ -11,11 +11,40 @@ const result = await tools.square_express({
   body: 'A different angle on this.',
   mentions: ['aoi'],
 });
-text(result);
+text(result); // CLI text: confirmation and bounded unread previews
 ```
 
-`location` defaults to `SQUARE_LOCATION`; relative paths use the current call's cwd. `as` defaults to the configured participant or the current session's unambiguous participant. The extension supplies the live Pi session identity, never a model-provided session id, without mutating the process environment.
+`location` defaults to `SQUARE_LOCATION`; relative paths use the current call's cwd. Join requires
+an explicit `as`. For later participant operations, an explicit `as` must name a current attached
+seat of the live Pi owner; without it, exactly one such seat is required. Status checks an explicit
+`as` the same way, but without `as` uses the sole attached seat as viewer or gives an unfiltered
+overview if there are zero or multiple. The extension encodes the live Pi session with
+`harnessOwner({channel: 'pi', session})`, never a model-provided session id, without mutating
+the process environment.
 
-Codemode receives the operation's data object directly. Failures return `{ error: { code, message, facts?, operation? } }` and are marked as failed tool results; scripts must inspect `error`. `catch` consumes activity; `history` does not. Exact parameters and semantics come from the tool descriptions, shared with MCP through `square-tools.ts`.
+All seven tools return the CLI's human-readable text, without an `outputSchema` or
+`structuredContent`. In Pi codemode, a successful call resolves to a `string`:
+use `text(result)`, not `text(result.text)`. Failures are marked as failed tool results;
+codemode rejects with the readable error and recovery commands rather than returning
+an error object. For machine-readable domain results, use the [SDK](square-api.md).
 
-Each operation owns and closes its connection through the facade, including cancellation cleanup. Existing notification delivery, rendering and session lifecycle stay independent. Reload the extension after installing an updated package to register the tools in an existing Pi session.
+`express` confirms landing and reach warnings without echoing the sent body. Unread
+context shows at most the latest five directed activities, in chronological order,
+with at most 400 Unicode characters per preview. Already consumed activities are
+excluded, including those beyond an earlier unread hole. Previews never consume
+activity; the text supplies a `catch` command and the count of other unread activities.
+Use `catch` for consumption or `history` for archives. Exact parameters and semantics
+come from the tool descriptions, shared with MCP through `square-tools.ts`.
+
+Each operation owns and closes its connection through the facade, including cancellation cleanup.
+Pi `session_shutdown` detaches that exact owner's seats, not membership: no `done` lands, listens
+and the read horizon remain, and mentions received while away stay unread. Catch ownership,
+deferrals and wake readiness are cleared. Detached participants cannot write or receive proactive
+delivery. On `session_start`, before watching, the extension uses `seatsOf(owner)` to discover only
+that exact owner's detached standing seats and `reattach(name, {owner, wakeAddress?})` to restore them.
+One failed seat/location does not block the others. New/forked harness owners restore nothing, voluntary
+`done` is never revived, and away has no timeout. Permanent deletion is a separate host-confirmed
+membership ending; Pi shutdown is not such proof. See [participant-ownership.md](participant-ownership.md).
+
+Notification rendering remains independent of tool calls. Reload the extension after installing
+an updated package to register the tools in an existing Pi session.

package/guides/primitive-catch-consolidation.md

@@ -20,7 +20,7 @@ Deliverer evidence only, **not independent review or acceptance**.
 
 | Removed | Canonical owner / retained boundary |
 | --- | --- |
-| `CatchDecision`, its unused `changed`, and its all-full perception map | `CatchSelection` contains raw selected activities, participant, cursor/remaining, say ordinals, clock, count/hold/cap/terminal facts. Pure `decideCatch` selects and writes receipts through `SquareWrite`, then captures these facts in that transaction. |
+| `CatchDecision`, its unused `changed`, and its all-full perception map | `CatchSelection` contains raw selected activities, participant, cursor/remaining, say ordinals, clock, count/cap/terminal facts. Pure `decideCatch` selects and writes receipts through `SquareWrite`, then captures these facts in that transaction. |
 | `CatchSelectionResult` combining public activities with a second raw observation | `catchUp` admits the owner, checks the lease ID and invokes `decideCatch` in one receipt transaction, publishes presence best effort, and returns that exact selection. It no longer performs public conversion. |
 | `CatchSelectionObservation` and `WatchPresentation` | `catchOwned` carries the same selection through completion, alongside actual lifecycle stop, waitStarted and replaced facts. No second selected-record wrapper or public page is built inside the lifecycle. |
 | Completion's separate empty-result construction | `observeCatchSelection` captures the same concrete contract using `SquareRead` without marking seen. Only a completion without a committed selection calls it; it does not reopen or rehydrate a committed page. Empty ordinals are `{}` without an unnecessary selector call. |
@@ -34,7 +34,7 @@ Necessary abstractions remain: typed transaction capabilities, pure selection, o
 ## Preserved lifecycle and observation timing
 
 - Lease acquisition retains its own transaction. Lease-ID validation, selection, markSeen, cursor, remaining and selected-page facts share the `catchUp` receipt transaction. A replaced waiter cannot insert a receipt in the gap after its heartbeat.
-- Revision is still captured before evaluation. Heartbeats, hold-paused quiet expiry, replacement and ID-fenced signal-free cleanup remain unchanged. Already-active/replaced/capped/quorum remain distinct from empty-now/stale.
+- Revision is still captured before evaluation. Heartbeats, lease-paused quiet expiry, replacement and ID-fenced signal-free cleanup remain unchanged. Already-active/replaced/capped/quorum remain distinct from empty-now/stale.
 - Successful selection never falls back to a postcommit page/context read. Presence publication, lease release and notification enrichment remain best effort after authoritative consumption. Optional nearby presence can be unavailable without erasing the selected page.
 - Empty terminal/quiet completion reads authoritative cursor and filtered remaining without markSeen. It never invents a null cursor after consumption. Seen holes, continuous cursor, historical catch and notification latest-join semantics remain unchanged.
 - Public conversion now occurs later, at each API exit, rather than in the action/lifecycle. Selection facts still reflect the receipt transaction, not optional presence time. Empty completion's clock is captured when constructing that read-only selection; no selected body is hydrated. No SDK default or wire result changes are intended.
@@ -80,9 +80,9 @@ The first full run exposed an unnecessary `sayOrdinals([])` read on empty SDK co
 
 Boundary evidence:
 
-- `performance`: real raw selection hydrates only its bounded page; remaining uses directedCount; presence/rendering never rehydrates it. A new postcommit mutation fixture changes own count, hold and pending rows after selection and rejects any action-level read: returned ordinals/cursor/remaining/count/hold/clock still match the receipt transaction. A mismatched lease ID returns null without revision/receipt change.
-- `application-boundary`: a real delivered receipt triggers failing host publication and a failing postcommit clock/presence read; catch still returns the consumed public page and its original projection facts, with enrichmentUnavailable and no raw activities projection. A later catch is empty. Existing real leased replacement, cancellation cleanup, hold/resume and quiet expiry fixtures pass, including the preserved consumed cursor after an actual say.
-- `presentation`: public/raw rendering parity checks multiline body, activity ID, reply ID, mention metadata, done and listen; presence omits bodies. Raw read remains empty and actorless hold remains renderable.
+- `performance`: real raw selection hydrates only its bounded page; remaining uses directedCount; presence/rendering never rehydrates it. A new postcommit mutation fixture changes own count and pending rows after selection and rejects any action-level read: returned ordinals/cursor/remaining/count/clock still match the receipt transaction. A mismatched lease ID returns null without revision/receipt change.
+- `application-boundary`: a real delivered receipt triggers failing host publication and a failing postcommit clock/presence read; catch still returns the consumed public page and its original projection facts, with enrichmentUnavailable and no raw activities projection. A later catch is empty. Existing real leased replacement, cancellation cleanup and quiet expiry fixtures pass, including the preserved consumed cursor after an actual say.
+- `presentation`: public/raw rendering parity checks multiline body, activity ID, reply ID, mention metadata, done and listen; presence omits bodies. Raw read remains empty.
 - `row-domain`, `core`, `delivery`, `perception-projection`: filter-before-limit, exact repeat, original receipt timestamp, gap/cursor and latest-join differences remain tested. Obsolete changed assertions were replaced by actual receipts, or removed only where the immediately adjacent unchanged receiptAssignments equality already proves no write. No boundary assertion was weakened to preserve a retired mechanism.
 - `operation-cancellation`, `square-facade`: commit survives response abort; SDK returns only its established CatchResult, no application body projections. CLI process coverage retains filtered continuation, mention/body visibility, stable IDs and lifecycle feedback. MCP continues serializing data only.
 - Production reference search for `CatchDecision|CatchSelectionResult|CatchSelectionObservation|WatchPresentation|exposeCaught` returned no matches (excluding dist/node_modules); `git diff --check` passed. CLI has no `projection.activities.find` or raw reconstruction.

package/guides/primitive-history-consolidation.md

@@ -57,9 +57,9 @@ Entry still uses the actual selector with explicit `['say', 'done']` kinds and i
 ## Necessary distinctions retained
 
 - **Defaults:** SDK `Square.history` is unbounded. SDK `Participant.history` defaults to ten. Application/CLI/MCP default to ten, cap explicit limits at 100, and reject an implicit merged context larger than 100 with the original `operation.historyBounds` detail. Supplying a limit bounds that context. Application's stricter grep/fixed, non-empty search, finite since and safe nonnegative context validation is unchanged; SDK search remains intentionally looser.
-- **Three subsets:** raw selected records can contain reads and historical actorless lifecycle records; public `Activity` omits read/actorless records but retains listen/ignore; ordinary terminal visibility contains join/say/done/hold/resume. Hidden listener events still occupy page positions. Since/context windows still select raw bookkeeping; ordinary history excludes reads. JSON/field formatting continues using raw records. No third event model was introduced.
+- **Three subsets:** raw selected records can contain reads and historical actorless lifecycle records; public `Activity` omits read/actorless records but retains listen/ignore; ordinary terminal visibility contains join/say/done. Hidden listener events still occupy page positions. Since/context windows still select raw bookkeeping; ordinary history excludes reads. Field formatting uses raw records; CLI JSON now serializes the public SDK result and omits bookkeeping records. No third event model was introduced.
 - **Paging:** cursor bounds remain exclusive stable IDs, sparse context counts existing positions, and from/mention/search intersect before applying the limit. An after cursor selects the oldest eligible page; otherwise the newest eligible page is selected. `order` only reverses the selected page. Continuation uses the terminal-visible subset and the same filtered candidate universe; a listener-only page has no invented terminal anchor. Audience paging continues through empty intersections.
-- **Projection:** ordinals, presence anchors, standing/held facts and final data come from the same read callback. The projection clock is now sampled within that callback instead of after the intermediate async presentation completed. It is still an observation-only operation with no receipt, presence or lease writes. Overflow is rejected before unnecessary anchor/ordinal enrichment.
+- **Projection:** ordinals, presence anchors, roster facts and final data come from the same read callback. The projection clock is now sampled within that callback instead of after the intermediate async presentation completed. It is still an observation-only operation with no receipt, presence or lease writes. Overflow is rejected before unnecessary anchor/ordinal enrichment.
 - CLI and MCP require no policy changes: CLI continues formatting raw/terminal records and owner-produced continuation; MCP serializes public data only. Catch's renderer-accessor changes are owned by its separate lane.
 
 ## Verification

package/guides/primitive-status-consolidation.md

@@ -63,14 +63,14 @@ For completeness, **whole integrated source** against fixed `501ddc2` is 110 fil
 
 Full versus filtered roster is a real distinction: status data omits never-joined historical actor names, while participants data retains them. `knownParticipantCount` separately preserves the complete-roster continuation count; it is not `status.data.participants.length` or the standing count.
 
-The amended guidance's reachable-latest clause is applied: the selector remains newest `say`/`done`. Both require an actor in valid storage, whereas actorless `hold`/`resume` and `read` are not selected. Therefore status has no reachable raw/public latest distinction. The conversion guard remains conservative, but no hypothetical duplicate projection is retained. History and other operations' genuine raw/public distinctions are untouched by this lane.
+The amended guidance's reachable-latest clause is applied: the selector remains newest `say`/`done`. Both require an actor in valid storage, whereas `read` is not selected. Therefore status has no reachable raw/public latest distinction. The conversion guard remains conservative, but no hypothetical duplicate projection is retained. History and other operations' genuine raw/public distinctions are untouched by this lane.
 
 ## Behavior and timing evidence
 
-- `test/projections.test.js`: exact canonical status data, full versus filtered roster, absent duplicate projections, hold/cap/throttle fields, and read/actorless-hold exclusion from latest selection. Existing viewer perception, exact-spelling rejoin and bounded hydration assertions remain. Shared watching/recent/lingering policy remains read-only.
+- `test/projections.test.js`: exact canonical status data, full versus filtered roster, absent duplicate projections, cap/throttle fields, and read exclusion from latest selection. Existing viewer perception, exact-spelling rejoin and bounded hydration assertions remain. Shared watching/recent/lingering policy remains read-only.
 - `test/application-boundary.test.js`: configured named, discovered (including blank environment name), explicit blank, explicit override and ambient viewer; body perception and attention names; unchanged artifact state and ownership/presence ledger after status.
 - `test/core.test.js`: status and participants continue sharing actual authored and receipt times, including a fresh rejoin and watcher.
-- `test/process/square-cli-render.test.js`: the compact ten-person preview now includes a valid historical never-joined actor in the artifact. Status still hides that actor but its executable continuation uses the full count 14 rather than filtered count 13; participants prints the complete roster. Existing hold duration, exact rejoin, attention, clipping/public-id continuation and presence feedback remain covered.
+- `test/process/square-cli-render.test.js`: the compact ten-person preview now includes a valid historical never-joined actor in the artifact. Status still hides that actor but its executable continuation uses the full count 14 rather than filtered count 13; participants prints the complete roster. Existing exact rejoin, attention, clipping/public-id continuation and presence feedback remain covered.
 
 No observation timing change is intended: optional viewer discovery still precedes status's resource read; the clock is sampled once inside the transaction, and all domain data, classification, perception and rendering annotations are assembled in that read. Queries perform no I/O or mutations themselves. SDK participant/snapshot shapes and MCP serialization of data remain unchanged. No join/claim is introduced.
 

package/guides/primitive-storage-consolidation.md

@@ -25,7 +25,7 @@ Deliverer evidence, not independent review or acceptance.
 | `square-state.ts` legacy SQLite framing | `square-sqlite.ts`: read-only owned-v1 recognition beside row framing/codecs |
 | `square-state.ts` legacy payload validation | `square-migration.ts`: explicit legacy envelope, order/gap and assigned-reference checks, permissive finite route data and path-specific nonfinite rejection |
 | General-model snapshot/runtime DTOs | `square-sqlite.ts`: explicit import/export DTOs, not runtime transaction state |
-| Dead `StoredActHead`, `HoldState`, `findParticipantName`, empty `ReceiverRoute` alias | Deleted; interchange routes use the existing `WakeRoute` type |
+| Dead `StoredActHead`, `findParticipantName`, empty `ReceiverRoute` alias | Deleted; interchange routes use the existing `WakeRoute` type |
 
 There are no forwarding stubs. The renamed build preparation is the actual implementation, not an alias. File SDK build, synchronous memory build and application build share it. Application build returns the normalized configuration from canonical creation rather than reconstructing it. Ordinary storage/resource imports perform no guide reads; the first build reads only its selected guides and caches them.
 

package/guides/receive-primitive.md

@@ -0,0 +1,90 @@
+# Transaction-local receive and consumption
+
+`@astrosheep/square/receive` admits items and their settled audience, selects
+received heads without consumption, and records sparse first-write-wins receipts.
+It has no runtime dependencies, Square membership, SQLite or transport requirement.
+For computing an audience before admission, see [attention](attention-primitive.md).
+
+```ts
+import { receive, consumeReceived } from '@astrosheep/square/receive';
+
+// Both callbacks belong to your storage implementation, not this package.
+store.transaction(tx => receive(tx, {
+  item: { key: 'opaque:west/7?hello', data: { text: 'Hello' } },
+  audience: [{ recipient: 'east:bob', via: 'link' }],
+}));
+const page = store.transaction(tx => consumeReceived(tx, 'east:bob', {
+  kind: 'page', query: { sender: 'west:alice' }, limit: 10,
+}, Date.now()));
+// { items: [{ key, data, via }], newlyConsumed, remaining }
+```
+
+`store` and `tx` above are caller-owned storage, not exports. Implement
+`ReceiveRead<K,D,V,Q>` / `ReceiveWrite<K,D,V,Q>` structurally; each function only
+requires the `Pick` of methods it uses. `K extends string | number` is an opaque
+equality identity: no ordering, parsing, numeric sequence, or `act/N` convention
+is imposed. The storage defines head order and query semantics. `D`, route `V`,
+and query `Q` are caller data. Recipients are strings; the caller owns canonical
+identity and eligibility. Item and address keys must be unique in storage.
+
+## Capabilities and ownership
+
+- `insertItem({key,data})` and `insertAddress(key,{recipient,via},order)` admit an
+  item and its audience in supplied order. `receive` permits an empty audience.
+  Supply unique recipient keys; duplicate items/addresses must throw, never
+  overwrite or silently deduplicate. Roll back the whole admission on failure.
+- `heads(recipient,query,{unconsumed,limit})` applies the query and consumption
+  predicate **before** limiting, returning ordered `{key,via}` heads.
+  `addressed(recipient,key)` ignores receipt state, but checks addressedness.
+- `load(keys)` hydrates the selected keys once as a `ReadonlyMap<K,D>`.
+  Missing keys are errors; an explicitly stored `undefined` value is not missing.
+  `count(recipient,query,unconsumed)` counts the same selection without a limit.
+- `receipt({recipient,item})` reads `{at}` or `undefined`.
+  `insertReceipt(ref,at)` returns true only for a new coordinate and preserves the
+  first timestamp. The identity is `(recipient,item)`, not a cursor or generation.
+
+All functions are synchronous. Supply capabilities from **one isolated,
+caller-owned transaction**, with storage uniqueness constraints and rollback on
+any thrown error, including failures during hydration, receipt insertion or the
+final count. No capability or selected page should escape that transaction for
+later consumption. The leaf does not start, commit, retry or emulate transactions.
+Its atomicity depends on this caller obligation.
+
+## Selection and receipts
+
+`selectReceivedHeads(tx,recipient,selection)` never hydrates or writes. A page is
+`{kind:'page',query,limit}` and always selects unconsumed heads; `limit` must be a
+positive safe integer, with no policy maximum. An exact selection is
+`{kind:'exact',key,remainingQuery}` and remains repeatable after consumption.
+
+`consumeReceived` selects inside the supplied transaction, hydrates all selected
+keys before any receipt insertion, preserves head order, records the captured
+coordinates and counts matching unconsumed items. Exact remaining uses
+`remainingQuery`; page remaining uses `query`. Repeating exact consumption returns
+the same item with `newlyConsumed: 0`, not a second receipt.
+
+`recordConsumed(tx,refs,at)` only needs `insertReceipt`. It records captured
+coordinates without reselecting, loading or checking eligibility. Duplicate refs
+are idempotent through storage and cannot change the first timestamp. Timestamps
+must be finite numbers (negative/fractional timestamps are allowed). Nonnumber
+limits/timestamps throw `TypeError`; out-of-range numbers throw `RangeError`.
+`ReceiveError` exposes `code: 'not_addressed' | 'missing_item'` and the opaque `key`.
+Storage errors propagate unchanged; they still require caller rollback.
+
+This is not a remote message protocol, replay envelope, permission system,
+ordering service, billing ledger or exactly-once external effect guarantee.
+Delivery attempts and presentation are separate from consumption. The
+[symmetric domains example](symmetric-domains.md) composes all three public
+primitive entrypoints without constructing Square.
+
+## Square composition
+
+Square uses these functions for production landing, catch and `markSeen` against
+its existing activity, audience and receipt tables. Numeric activity indexes stay
+internal keys; the primitive does not know Square IDs. Square retains validation,
+limits, filtering, perception, ownership, leases, hints and error mapping. The
+empty-catch read probe does not hydrate or acquire a writer; a nonempty probe is
+reselected inside the writer. Ordinary catch sees historical receipt holes,
+including before rejoin; proactive pending still starts after the latest join.
+The artifact schema/format and receipt identity are unchanged. See the
+[Square API](square-api.md) for product operations.

package/guides/row-runtime-delivery-evidence.md

@@ -10,7 +10,7 @@ Candidate implementation: `833d6f15c9071767eb49a9562a4c42a93c6f4000` plus post-r
 | Whole-history fold on normal operations; replay delivery/perception closures | `square-domain.ts::deriveLanding` maintains participant, attention and ordered audience indices once at landing; `runtime.ts` computes cursor/presence/terminal from narrow domain facts. |
 | `FromState`/delta bridges and old core append/observation update helpers | Removed. `SquareWrite.land/markSeen/putLease/removeLease/replaceRoutes` are the finite domain mutations. Memory uses the same SQLite driver in `:memory:`, not a second selector/policy implementation. |
 | Renderer `.state` inputs and replay-based ordinal/perception lookup | `views.ts`, `perception-projection.ts` and presentation operations settle selected bodies, ordinals, counts and perceptions inside the transaction; renderers receive detached values. |
-| Join/status/hold/resume/done snapshot loads for counts | `joinFacts`, standing counts, roster/status aggregates and header reads. Public SDK snapshot is no longer used by these production callers. |
+| Join/status/done snapshot loads for counts | `joinFacts`, standing counts, roster/status aggregates and header reads. Public SDK snapshot is no longer used by these production callers. |
 | Global whole-history notification/wake enumeration | Bodyless `pendingAudience` groups with a captured activity upper bound and recipient join coordinates; receivers use their own `directed` relation. Scans advance past withheld groups and do not restart on unrelated writes. |
 | Whole-history native/Claude currentness and cancellation | Exact pending facts, ordered routes, lease and captured host fences; cancellation selects activity heads by descending coordinate and tests timestamp. Host/network work stays outside artifact transactions. |
 | Preliminary full load before file-backed open/probe/wait | Validated header/schema boundary, revision-only observer; selected row validation on access. Full doctor is explicit. |

package/guides/row-storage-design.md

@@ -27,7 +27,7 @@ Replace AGENTS.md's `All behavior operates on SquareState ...` sentence, with th
 
 > Behavior operates on typed Square domain facts obtained through transaction-scoped reads and domain transitions. SQLite schema, SQL, and storage framing remain private to the artifact boundary. Partial fact reads must not masquerade as a complete SquareState.
 
-One typed domain representation: activities, sparse seen receipts, catch leases, and ordered published routes, plus small configuration facts. Current participants/attention and historical landed audience are reconstructible indices. No inbox, continuous cursor, pending flag, eligibility, persisted ordinal, or receiver acknowledgement watermark. Hold is read from the latest hold/resume activity, not another authoritative fact.
+One typed domain representation: activities, sparse seen receipts, catch leases, and ordered published routes, plus small configuration facts. Current participants/attention and historical landed audience are reconstructible indices. No inbox, continuous cursor, pending flag, eligibility, persisted ordinal, or receiver acknowledgement watermark.
 
 Three layers:
 - Domain actions validate admission and produce `Act` values; domain projections combine the read capabilities below. Host/network work is outside artifact transactions.
@@ -82,7 +82,6 @@ interface ActivityFilter {
   readonly kinds?: readonly StoredAct['kind'][];
   readonly actors?: readonly string[];
   readonly actorMatch?: 'identity' | 'exact'; // default identity
-  readonly actorRequired?: true;
   readonly afterAt?: number; // exclusive; no implicit upper-time bound
 }
 interface IndexPage {
@@ -144,9 +143,6 @@ interface SquareRead {
   attention(listener: string): readonly AttentionFact[]; // sinceIndex ascending
   incomingAttention(sender: string): readonly AttentionFact[];
   // incoming matches nameKey(target); includes listen and ignore, not only joined actors
-  hold(): { readonly active: boolean; readonly at?: number;
-            readonly reason?: string; readonly actor?: string };
-
   activity(index: ActivityIndex): StoredAct | undefined;
   activityHeads(filter: ActivityFilter, page: IndexPage): FactPage<ActivityHead>;
   activities(indexes: readonly ActivityIndex[]): readonly StoredAct[];
@@ -232,7 +228,7 @@ interface LandingFacts {
 function deriveLanding(activity: StoredAct, facts: LandingFacts): LandingEffect;
 ```
 
-`deriveLanding` is pure and shared by runtime and rebuild. `land()` reads the necessary narrow facts, validates structural invariants (not action admission again), allocates **header.nextActIndex**, calls this transition, and applies the effect plus nextActIndex increment atomically. Migration supplies the preserved assigned indices; it never calls the allocator or admission validation. Earlier reply author lookup uses the existing activity row, including join/done/read/listen/actor-bearing hold; missing earlier coordinate means no author. Valid legacy replay never requires a future author because reply < own index.
+`deriveLanding` is pure and shared by runtime and rebuild. `land()` reads the necessary narrow facts, validates structural invariants (not action admission again), allocates **header.nextActIndex**, calls this transition, and applies the effect plus nextActIndex increment atomically. Migration supplies the preserved assigned indices; it never calls the allocator or admission validation. Earlier reply author lookup uses the existing activity row; missing earlier coordinate means no author. Valid replay never requires a future author because reply < own index.
 
 `markSeen` accepts any nonnegative index below nextActIndex, even if no activity/participant exists. It refuses unassigned coordinates and non-finite timestamps; it inserts only missing exact-owner receipts. Actions—not a receipt FK—ensure catch/native writes concern the intended activities. Lease writers similarly retain unknown/raw owner fallback. Only receipt insertion marks seen; presentation outcome, cancellation, and wake evidence do not.
 
@@ -257,14 +253,12 @@ CREATE TABLE square_meta (
 CREATE TABLE activities (
   act_index INTEGER PRIMARY KEY CHECK (act_index BETWEEN 0 AND 9007199254740991),
   at REAL NOT NULL,
-  kind TEXT NOT NULL CHECK (kind IN ('join','done','say','hold','resume','read','listen','ignore')),
-  actor_json TEXT COLLATE BINARY,
-  actor_key_json TEXT COLLATE BINARY,
+  kind TEXT NOT NULL CHECK (kind IN ('join','done','say','read','listen','ignore')),
+  actor_json TEXT COLLATE BINARY NOT NULL,
+  actor_key_json TEXT COLLATE BINARY NOT NULL,
   reach TEXT CHECK (reach = 'bell'),
   reply_index INTEGER CHECK (reply_index >= 0 AND reply_index < act_index),
   payload_json TEXT NOT NULL CHECK (json_valid(payload_json)),
-  CHECK ((actor_json IS NULL) = (actor_key_json IS NULL)),
-  CHECK (kind IN ('hold','resume') OR actor_json IS NOT NULL),
   CHECK (kind = 'say' OR (reach IS NULL AND reply_index IS NULL))
 );
 CREATE INDEX activity_kind_index ON activities(kind, act_index);
@@ -333,9 +327,9 @@ CREATE INDEX audience_recipient ON landed_audience(recipient_key_json, act_index
 No foreign keys. In particular receipts must not reference activities or participants; replies/through must not require existing rows; leases/routes must not require known names. Derived tables are maintained and checked against authority, not used to reinterpret permissible v1 authority as invalid. `next_act_index > greatest existing activity index` and receipts < next_act_index are checked by the boundary (all receipts only on full integrity/import; inserted receipts on writes). No contiguous-index constraint. Finite fractional activity/receipt/lease times remain REAL, not INTEGER. Number-safe limits are enforced in the codec and allocator.
 
 Activity payload shapes, with optional-property presence preserved:
-- join/resume: `{}`.
+- join: `{}`.
 - say: `{body: string, mentions?: string[]}`; reach/reply live only in their columns.
-- done/hold: `{body?: string}`.
+- done: `{body?: string}`.
 - read: `{through: number}`; no reference check on through.
 - listen/ignore: `{target: string}`; no participant reference check on target.
 Actor's original spelling lives in actor_json; actor_key_json is its indexed identity derivative. Neither is repeated in payload. Indices store coordinates/keys, never duplicate bodies.
@@ -344,7 +338,7 @@ Route payload contains location, original participant spelling, channel, address
 
 Preserve finite route epoch/extra JSON values and empty strings; do not otherwise tighten their legacy shapes. Use ordinary JSON encoding, not a bespoke numeric codec. Migration explicitly refuses non-finite numbers anywhere in a route (updatedAt, epoch, or nested extras) before DDL/inserts and leaves the artifact unchanged; never silently coerce them to null. These exponent-overflow values can pass the old permissive validator on manually authored JSON, but are not non-finite values normally persisted by the v1 JSON.stringify writer. Runtime codecs likewise require finite route numeric values. Raw schema equality is not receipt or participant equality.
 
-No receipt `state` column: all receipts are seen. No persisted hold table: `hold()` selects last hold/resume using activity_kind_index; resume returns inactive with no stale reason/actor/time. No additional name registry: a participant is first touched by ANY actor-bearing activity, not necessarily join.
+No receipt `state` column: all receipts are seen. No additional name registry: a participant is first touched by ANY actor-bearing activity, not necessarily join.
 
 ## 4. Exact derived transitions and routes
 
@@ -352,7 +346,7 @@ Landing uses pre-activity participant/attention facts:
 1. Compute a say audience first. Resolve deduplicated mentions against standing roster (bell: all standing); then standing reply author; then active listeners in roster order. Skip sender and duplicate recipients. Ignore blocks all non-bell reach; bell bypasses ignore. Store ordered unique recipients and priority **bell > mention > reply > attention**. Explicit self mention remains in activity metadata but creates no self audience edge. Missing/departed reply author creates no edge; action result retains existing replyAuthorNotHere semantics.
 2. Touch actor if new: name is first actor spelling, joined=false, done=false, sayCount=0. Update lastActiveAt with max(existing, activity.at), not latest-by-index time.
 3. join sets joined=true/done=false and lastJoinIndex=index. done sets joined=false/done=true and clears OUTGOING listen only. Ignore survives departure/rejoin; incoming attention is not cleared. Say increments lifetime count, even for unusual imported prejoin/postdone sequences.
-4. listen inserts listen only when not already listening; removes matching ignore. ignore removes matching listen and inserts ignore only when absent. Preserve target's first retained spelling and relation order, including unknown/self targets. A no-op legacy activity still touches actor time; replay never applies the current ten-name admission cap. hold/resume remain events; read does not acknowledge receipts or advance a persisted cursor.
+4. listen inserts listen only when not already listening; removes matching ignore. ignore removes matching listen and inserts ignore only when absent. Preserve target's first retained spelling and relation order, including unknown/self targets. A no-op legacy activity still touches actor time; replay never applies the current ten-name admission cap. Read does not acknowledge receipts or advance a persisted cursor.
 
 There is one production transition, no SQL triggers and no separate migration fold. Test-only frozen old fold/replay supplies differential evidence. Index integrity checking can rebuild through the production transition but cannot replace differential tests with self-comparison.
 
@@ -370,9 +364,9 @@ Let P be resolved participant, K=P.name (or requested raw spelling if unknown),
 
 ### Continuous cursor
 
-Find B = smallest landed-audience index > J without receipt (K,index). Then find C = greatest EXISTING activity index > J and < B (no upper bound if no B), with actor present and kind != read. Return max(J,C), with missing C treated as J. Implementation uses `directed(... unseenOnly, oldest limit=1)` and `activityHeads(... actorRequired, kinds excluding read, newest limit=1)` in the SAME transaction. It does not read every intervening activity body.
+Find B = smallest landed-audience index > J without receipt (K,index). Then find C = greatest EXISTING activity index > J and < B (no upper bound if no B), with kind != read. Every persisted activity has an actor. Return max(J,C), with missing C treated as J. Implementation uses `directed(... unseenOnly, oldest limit=1)` and `activityHeads(... kinds excluding read, newest limit=1)` in the SAME transaction. It does not read every intervening activity body.
 
-Why this is exact: audience edges only exist on peer says. Before the first unseen addressed say, own and nonaddressed actor-bearing non-read events all advance readCursor. Read and actorless events do not. No cursor at B-1 is invented: if J=4, actor-bearing act/7 exists, act/9 is actorless, and unseen addressed act/12 blocks, cursor is 7, not 11 or 9. Seen act/13 beyond that hole does not advance it.
+Why this is exact: audience edges only exist on peer says. Before the first unseen addressed say, own and nonaddressed non-read events all advance readCursor. Reads do not. No cursor at B-1 is invented: if J=4, act/7 exists, act/9 is a read, and unseen addressed act/12 blocks, cursor is 7, not 11 or 9. Seen act/13 beyond that hole does not advance it.
 
 ### Evidence and presence
 
@@ -385,7 +379,7 @@ Presence anchor: if no join, return -1. E=max(J, largest own actor-bearing activ
 - Suffix/behind/unreadActivityCount use directed rows > continuous cursor, **including individually seen rows beyond a hole**. Notification pending instead requires joined, >latest join, individually unseen. Do not substitute one count for the other.
 - Hard cap uses lifetime sayCount. Quorum uses all known peers' done booleans (there must be at least one peer), not only currently standing peers.
 - Throttle: request newest `limit` global say times with at > now-THROTTLE_WINDOW_MS; if that many exist, releaseAt is the oldest returned + window, retry=max(1, releaseAt-now). Bell: newest 1 actor bell timestamp > now-1h; that timestamp +1h is nextAt. Neither query excludes future timestamps.
-- Behind summaries retain current per-sender counts/latest timestamp, last THREE suffix previews and their **suffix-relative** numbering. Lifetime sayOrdinals are for ordinary history/feed rendering; they are not substituted for unread-summary numbers. Block only when !force, suffix nonempty, and freshest summary age > UNREAD_BLOCK_GRACE_MS; max(0,now-at) remains the age. force bypasses behind only.
+- Behind summaries retain per-sender counts, latest timestamp and one greatest-index suffix preview. The latest timestamp need not belong to that preview. Lifetime sayOrdinals are retained for history field formatting, not recovery previews. Block only when !force, suffix nonempty, and freshest summary age > UNREAD_BLOCK_GRACE_MS; max(0,now-at) remains the age. force bypasses behind only.
 
 ### Catch transaction
 
@@ -411,22 +405,22 @@ Keep filesystem hints plus the existing 2-second authoritative revision reconcil
 
 ## 7. Complete caller replacement map (including render dependencies)
 
-No production structure below carries `.state`, all `.activities`, or a deferred DB query. Renderers receive settled perceptions and numbers, never recompute audience from a partial SquareState.
+No production structure below carries `.state`, all `.activities`, or a deferred DB query. Renderers receive settled perceptions, never recompute audience from a partial SquareState; history field formatting also receives selected ordinals.
 
 | Current callers | Exact facts/replacement |
 |---|---|
 | openSquare/openSquareArtifact, wait baselines, watch headers, cli/program | header/revision only; remove preliminary whole-state validation/load. Every normal selected-row decode remains validated. |
 | square-actions join/implicitJoin/takeover/done/endOwnedSession, registry-associated route cleanup | participant/roster as needed, routes, land/replaceRoutes; same host claim lock scopes and cleanup sequences. Takeover done+join is one txn. No full SDK snapshot. |
-| Join's before/after snapshot and CLI hold/resume/done count calls | Current `Square.join` returns its concrete receipt with a Participant handle; optional observations use transaction-captured counts, held state and time. Listener/lifecycle commit facts likewise come from the mutation transaction; join's extra entry history is best-effort. Known joined-or-done `participantCount` remains distinct from the standing count. See [Square/Participant API](square-api.md). |
-| express/decideAct and behind rendering (activity.ts) | header, actor fact, roster for longest standing-body mention resolution, hold, reply head/existence, recentSayTimes, continuous cursor, directed suffix. Admission normalization/error order unchanged. A valid reply coordinate is <nextActIndex, even if a gap: preserve current acceptance of assigned-but-missing reply. ActivityPresentation supplies own count/cap/hold/roster, suffix items with lifetime ordinals + settled full perception, and behind summaries. No whole history used just to number previews. |
-| listen/ignore/listening, watch leases and terminal checks | actor fact, outgoing attention; roster only for quorum; land or lease methods. Unknown valid attention target still allowed. Pulse keeps hold-before-terminal priority. |
+| Join/status/done count calls | `Square.join` returns a Participant handle and committed activity; optional observations use transaction-captured counts and time. Listener/lifecycle commit facts likewise come from the mutation transaction; join's extra entry history is best-effort. See [Square/Participant API](square-api.md). |
+| express/decideAct and behind rendering | header, actor fact, roster for longest standing-body mention resolution, reply head/existence, recentSayTimes, continuous cursor, directed suffix. Admission normalization/error order unchanged. A valid reply coordinate is <nextActIndex, even if a gap: preserve current acceptance of assigned-but-missing reply. Recovery supplies own count/cap and behind summaries with one full preview per sender. |
+| listen/ignore/listening, watch leases and terminal checks | actor fact, outgoing attention; roster only for quorum; land or lease methods. Unknown valid attention target still allowed. |
 | catch / native seen | directed selectors/activity exact, markSeen, cursor/counts in txn; native `current` becomes synchronous `(facts: SquareRead)=>boolean`, evaluated ONLY within reads/receipt txn. It cannot escape or call host I/O. |
-| entryPresentation / cli/square-commands join | bounded newest say/done heads then bodies; selected sayOrdinals; explicit per-index perceptions for the selected viewer; header context/scene; actor's join count from activityCount(kind join, actor identity). Supply `joinedBefore` rather than replaying `.state.acts`. `lastN=null` remains an explicit complete history request, not normal join's default. |
-| statusPresentation / cli/observation-commands status | roster+attention, hold, receiptFacts, continuous cursors and directed counts, fresh lease status; latest say/done + ordinal. Supply last THREE join events after latest public index, total number of such joins, and each `rejoined` boolean from existence of earlier done with EXACT actor spelling (current CLI equality). Latest line carries settled perception for context.name (including '' ambient viewer), not a SquareState. No receipts/history map hydrated. |
+| entryPresentation / cli/square-commands join | bounded newest say/done heads then public activities with settled perceptions for the selected viewer; header context/scene; actor's join count from activityCount(kind join, actor identity). Supply `joinedBefore` rather than replaying `.state.acts`. `lastN=null` remains an explicit complete history request, not normal join's default. |
+| statusPresentation / cli/observation-commands status | roster+attention, receiptFacts, continuous cursors and directed counts, fresh lease status; latest say/done. Supply last THREE public join events after latest public index, total number of such joins, and each `rejoined` boolean from existence of earlier done with EXACT actor spelling (current CLI equality). Latest line carries settled perception for context.name (including '' ambient viewer), not a SquareState. No receipts/history map hydrated. |
 | participants/participantsPresentation/listPresentation | roster-derived status sorted by existing compareParticipantActivity; receipts/leases aggregates for participant statuses; list requires only active names, header preamble and say count. Change probeSquare to create a validated file-backed port, not full read then memory clone. |
 | history / participantHistory / historyPresentation | relational head filter + contextIndexes; hydrate filtered candidate bodies for JS search, otherwise page only; count before final limit; selected ordinals + detached presence anchors/perceptions. Retain CLI lifecycle archive/raw coordinate windows and facade non-read inclusion. See algorithm below. |
-| watchPresentation/watch.ts/renderWatchOutput | pass caught activity ids into projection; hydrate ONLY those rows, selected lifetime ordinals, caller-supplied caught perceptions, participant statuses/clock, count/cap/terminal. Finish/terminal-only call omits ids. No all-history lookup of caught ids. |
-| streamProjection/streamTailProjection | ordinary stream pages raw activity heads BEFORE recipient filtering (100 existing rows), advances cursor to last examined raw row even on empty recipient output. Recipient stream filters historical audience, not pending/seen/latest-join. Tail selects last N matching rows but cursor is artifact's last actual index. Includes raw lifecycle/read exactly where current stream does. |
+| catch selection and rendering | hydrate ONLY selected rows, capture caught perceptions, participant status/clock, count/cap/terminal in the receipt transaction. Empty completion does not hydrate bodies. No all-history lookup of caught ids. |
+| streamProjection/streamTailProjection | stream pages canonical activity heads before recipient filtering, advances its cursor even on empty recipient output, and returns public Activity or viewer-relative PerceivedActivity. Recipient filtering uses the historical landed audience, not pending/seen/latest-join. Tail selects last N matching activities and advances to the artifact head. |
 | sessionInbox/located seats/boundary | exact-body seats + establishing join time, recipient directed unseen pages + live lease; complete result using §6. Boundary's stale-activity fallback uses activity(index) existence, not `.acts.every`. |
 | deliverPending/sweep/delivery-health/notifications | pendingAudience groups or audience(activity)+joined/latestJoin+receipt checks for exact activity, ordered routes and detached host ledger evidence. Eligibility projection takes these typed facts instead of state. Sweep scans past suppressed candidates. Health can explicitly collect its complete pending summaries without bodies; renderer's existing detail cap stays. |
 | Claude cancellation/resume/route discovery | cancellation=max existing activity index with at<=cutoff (not assumed chronological time); use newest activity-head pages in one read txn, testing timestamps from greatest index downward and stopping at the first match. If none matches, cutoff is -1. Resume last join/done by EXACT actor spelling; no full snapshot. Routes keep first-match order. |
@@ -444,7 +438,7 @@ Keep synchronous arbitrary `delivered(name,id)`. `snapshot()` intentionally copi
    Execution is fixed: with an audience filter, enumerate historical `directed` pages without unseenOnly or a join cutoff; intersect each page's indices with the context union and other index/time/actor/kind filters through `activityHeads`. Without an audience filter, enumerate `activityHeads` directly. Continue the source traversal even when an intersection is empty. Public limiting follows the remaining filters/search; storage page exhaustion is distinct from a filtered empty page. This composition needs no new audience selector or query framework.
 2. Nonempty regex/fixed search additionally restricts to say/done. Compile existing JS case-insensitive search once and test id/actor/body, not SQL LIKE/SQLite regexp. Iterate all relationally matching candidate body pages in the txn to count matches; maintain only the requested edge's selected page plus the needed existence/count metadata. Regex remains potentially expensive exactly as current engine; no new safety claim. Empty supplied pattern keeps current no-search semantics for facade.
 3. Default/before selects LAST N filtered matches; after selects FIRST N. Select chronological edge first; desc reverses ONLY selected page. A complete request remains explicit and follows existing CLI maximum refusal. Continuation availability is computed over the current archive-visible kind set and current public page min/max, preserving current text/JSON differences; it is not simply a raw-head hasMore flag. Return total search matches, selected rows, public-before/public-after existence, selected ordinals and all anchor names landing on selected coordinates.
-4. Presence anchors are the §5 evidence algorithm for all roster names; compute without full hydration and attach only selected-coordinate annotations in roster order. Context positions include read/actorless activities; coordinate arithmetic must not replace position selection. History across separate calls promises stable activity-id coordinates, not frozen mutable receipt/presence annotations.
+4. Presence anchors are the §5 evidence algorithm for all roster names; compute without full hydration and attach only selected-coordinate annotations in roster order. Context positions include reads; coordinate arithmetic must not replace position selection. History across separate calls promises stable activity-id coordinates, not frozen mutable receipt/presence annotations.
 
 ## 8. Error/transaction lifecycle (fixed)
 
@@ -473,7 +467,7 @@ These terms apply together with the domain specification above.
 - Open existing canonical path create-disabled. A read-only preflight establishes owned known schema/version before any persistent pragma or DDL. Require existing DELETE journal mode, refuse another mode without changing it; the shipped v1 creator/writer already establishes DELETE. Set connection busy_timeout=0 and synchronous=FULL. Acquire BEGIN IMMEDIATE, re-check format/schema under the lock, and validate the full v1 snapshot inside it. If v2 is already present and has valid framing/header, return already-format-2 without changing revision. A second migrator follows this same in-lock check.
 - Use v1 validation retained ONLY in migration (test oracle may also retain it), plus one explicit restriction: non-finite numbers anywhere in a route (including nested extras) are unsupported input, refused before DDL/inserts with the artifact untouched. They are not normally persisted as non-finite values by the v1 JSON.stringify writer; do not add a bespoke overflow-number codec or silently coerce to null. Copy normally persisted authoritative facts losslessly, preserving revision and nextActIndex, activity indices/gaps and optional field distinctions, raw receipt/lease owner keys, route order/duplicates, strings and finite fractional timestamps. Absent routes and [] both become zero rows; empty receipt-owner maps are behaviorless and may become zero receipt rows. Do not canonicalize receipts or add foreign keys that reject accepted v1 facts.
 - Actual receipt lookup is exact canonical roster spelling, not lowercase nameKey: preserve the raw owner-key relation and resolve lookup via the domain. Free-form JS strings must survive SQLite binding; JSON string encoding (including for key strings where necessary) preserves lone surrogates. All normalized lookup keys come from domain nameKey, never SQLite LOWER.
-- Create v2 tables and insert authority. Build derived participant/hold/attention/audience facts with the SAME single-step domain transition used by runtime landing (admission checks are NOT replayed). Check insert/constraint failures normally; do not add a second full replay or a second in-memory copy just to validate the function against itself. Lossless authority equality and old-replay equivalence are migration tests; doctor can explicitly recompute indices for integrity checking. Drop square_snapshot. Set user_version=2 inside the same transaction. Commit once; nothing is published piecemeal.
+- Create v2 tables and insert authority. Build derived participant/attention/audience facts with the SAME single-step domain transition used by runtime landing (admission checks are NOT replayed). Check insert/constraint failures normally; do not add a second full replay or a second in-memory copy just to validate the function against itself. Lossless authority equality and old-replay equivalence are migration tests; doctor can explicitly recompute indices for integrity checking. Drop square_snapshot. Set user_version=2 inside the same transaction. Commit once; nothing is published piecemeal.
 - Busy acquisition/read retries yield using existing 25ms retry and operation cancellation. Busy COMMIT retries the same transaction; never rerun copy or domain callback. Error/abort before successful COMMIT rolls back. Process death before commit recovers v1 through SQLite journal; after commit leaves complete v2. Preserve path/inode/registry identity. No host-ledger mutation and no synthetic activity.
 - Storage exclusion is guaranteed for the shipped SQLite v1 runtime because it validates again after BEGIN IMMEDIATE: its write commits before migration, or it sees v2 and refuses afterward. A pre-migration read can finish with its old snapshot. Migration does not revoke in-flight remote delivery or stop processes; recommend stopping/upgrading attached runtimes for an operationally quiet migration. Arbitrary external path replacement and pre-SQLite binaries are outside the artifact update protocol. Do not claim a distributed transaction or exactly-once remote delivery.