@astrosheep/square 0.3.94 → 0.3.95

package/guides/primitive-catch-consolidation.md

@@ -20,7 +20,7 @@ Deliverer evidence only, **not independent review or acceptance**.
 
 | Removed | Canonical owner / retained boundary |
 | --- | --- |
-| `CatchDecision`, its unused `changed`, and its all-full perception map | `CatchSelection` contains raw selected activities, participant, cursor/remaining, say ordinals, clock, count/hold/cap/terminal facts. Pure `decideCatch` selects and writes receipts through `SquareWrite`, then captures these facts in that transaction. |
+| `CatchDecision`, its unused `changed`, and its all-full perception map | `CatchSelection` contains raw selected activities, participant, cursor/remaining, say ordinals, clock, count/cap/terminal facts. Pure `decideCatch` selects and writes receipts through `SquareWrite`, then captures these facts in that transaction. |
 | `CatchSelectionResult` combining public activities with a second raw observation | `catchUp` admits the owner, checks the lease ID and invokes `decideCatch` in one receipt transaction, publishes presence best effort, and returns that exact selection. It no longer performs public conversion. |
 | `CatchSelectionObservation` and `WatchPresentation` | `catchOwned` carries the same selection through completion, alongside actual lifecycle stop, waitStarted and replaced facts. No second selected-record wrapper or public page is built inside the lifecycle. |
 | Completion's separate empty-result construction | `observeCatchSelection` captures the same concrete contract using `SquareRead` without marking seen. Only a completion without a committed selection calls it; it does not reopen or rehydrate a committed page. Empty ordinals are `{}` without an unnecessary selector call. |
@@ -34,7 +34,7 @@ Necessary abstractions remain: typed transaction capabilities, pure selection, o
 ## Preserved lifecycle and observation timing
 
 - Lease acquisition retains its own transaction. Lease-ID validation, selection, markSeen, cursor, remaining and selected-page facts share the `catchUp` receipt transaction. A replaced waiter cannot insert a receipt in the gap after its heartbeat.
-- Revision is still captured before evaluation. Heartbeats, hold-paused quiet expiry, replacement and ID-fenced signal-free cleanup remain unchanged. Already-active/replaced/capped/quorum remain distinct from empty-now/stale.
+- Revision is still captured before evaluation. Heartbeats, lease-paused quiet expiry, replacement and ID-fenced signal-free cleanup remain unchanged. Already-active/replaced/capped/quorum remain distinct from empty-now/stale.
 - Successful selection never falls back to a postcommit page/context read. Presence publication, lease release and notification enrichment remain best effort after authoritative consumption. Optional nearby presence can be unavailable without erasing the selected page.
 - Empty terminal/quiet completion reads authoritative cursor and filtered remaining without markSeen. It never invents a null cursor after consumption. Seen holes, continuous cursor, historical catch and notification latest-join semantics remain unchanged.
 - Public conversion now occurs later, at each API exit, rather than in the action/lifecycle. Selection facts still reflect the receipt transaction, not optional presence time. Empty completion's clock is captured when constructing that read-only selection; no selected body is hydrated. No SDK default or wire result changes are intended.
@@ -80,9 +80,9 @@ The first full run exposed an unnecessary `sayOrdinals([])` read on empty SDK co
 
 Boundary evidence:
 
-- `performance`: real raw selection hydrates only its bounded page; remaining uses directedCount; presence/rendering never rehydrates it. A new postcommit mutation fixture changes own count, hold and pending rows after selection and rejects any action-level read: returned ordinals/cursor/remaining/count/hold/clock still match the receipt transaction. A mismatched lease ID returns null without revision/receipt change.
-- `application-boundary`: a real delivered receipt triggers failing host publication and a failing postcommit clock/presence read; catch still returns the consumed public page and its original projection facts, with enrichmentUnavailable and no raw activities projection. A later catch is empty. Existing real leased replacement, cancellation cleanup, hold/resume and quiet expiry fixtures pass, including the preserved consumed cursor after an actual say.
-- `presentation`: public/raw rendering parity checks multiline body, activity ID, reply ID, mention metadata, done and listen; presence omits bodies. Raw read remains empty and actorless hold remains renderable.
+- `performance`: real raw selection hydrates only its bounded page; remaining uses directedCount; presence/rendering never rehydrates it. A new postcommit mutation fixture changes own count and pending rows after selection and rejects any action-level read: returned ordinals/cursor/remaining/count/clock still match the receipt transaction. A mismatched lease ID returns null without revision/receipt change.
+- `application-boundary`: a real delivered receipt triggers failing host publication and a failing postcommit clock/presence read; catch still returns the consumed public page and its original projection facts, with enrichmentUnavailable and no raw activities projection. A later catch is empty. Existing real leased replacement, cancellation cleanup and quiet expiry fixtures pass, including the preserved consumed cursor after an actual say.
+- `presentation`: public/raw rendering parity checks multiline body, activity ID, reply ID, mention metadata, done and listen; presence omits bodies. Raw read remains empty.
 - `row-domain`, `core`, `delivery`, `perception-projection`: filter-before-limit, exact repeat, original receipt timestamp, gap/cursor and latest-join differences remain tested. Obsolete changed assertions were replaced by actual receipts, or removed only where the immediately adjacent unchanged receiptAssignments equality already proves no write. No boundary assertion was weakened to preserve a retired mechanism.
 - `operation-cancellation`, `square-facade`: commit survives response abort; SDK returns only its established CatchResult, no application body projections. CLI process coverage retains filtered continuation, mention/body visibility, stable IDs and lifecycle feedback. MCP continues serializing data only.
 - Production reference search for `CatchDecision|CatchSelectionResult|CatchSelectionObservation|WatchPresentation|exposeCaught` returned no matches (excluding dist/node_modules); `git diff --check` passed. CLI has no `projection.activities.find` or raw reconstruction.

package/guides/primitive-history-consolidation.md

@@ -57,9 +57,9 @@ Entry still uses the actual selector with explicit `['say', 'done']` kinds and i
 ## Necessary distinctions retained
 
 - **Defaults:** SDK `Square.history` is unbounded. SDK `Participant.history` defaults to ten. Application/CLI/MCP default to ten, cap explicit limits at 100, and reject an implicit merged context larger than 100 with the original `operation.historyBounds` detail. Supplying a limit bounds that context. Application's stricter grep/fixed, non-empty search, finite since and safe nonnegative context validation is unchanged; SDK search remains intentionally looser.
-- **Three subsets:** raw selected records can contain reads and historical actorless lifecycle records; public `Activity` omits read/actorless records but retains listen/ignore; ordinary terminal visibility contains join/say/done/hold/resume. Hidden listener events still occupy page positions. Since/context windows still select raw bookkeeping; ordinary history excludes reads. Field formatting uses raw records; CLI JSON now serializes the public SDK result and omits bookkeeping records. No third event model was introduced.
+- **Three subsets:** raw selected records can contain reads and historical actorless lifecycle records; public `Activity` omits read/actorless records but retains listen/ignore; ordinary terminal visibility contains join/say/done. Hidden listener events still occupy page positions. Since/context windows still select raw bookkeeping; ordinary history excludes reads. Field formatting uses raw records; CLI JSON now serializes the public SDK result and omits bookkeeping records. No third event model was introduced.
 - **Paging:** cursor bounds remain exclusive stable IDs, sparse context counts existing positions, and from/mention/search intersect before applying the limit. An after cursor selects the oldest eligible page; otherwise the newest eligible page is selected. `order` only reverses the selected page. Continuation uses the terminal-visible subset and the same filtered candidate universe; a listener-only page has no invented terminal anchor. Audience paging continues through empty intersections.
-- **Projection:** ordinals, presence anchors, standing/held facts and final data come from the same read callback. The projection clock is now sampled within that callback instead of after the intermediate async presentation completed. It is still an observation-only operation with no receipt, presence or lease writes. Overflow is rejected before unnecessary anchor/ordinal enrichment.
+- **Projection:** ordinals, presence anchors, roster facts and final data come from the same read callback. The projection clock is now sampled within that callback instead of after the intermediate async presentation completed. It is still an observation-only operation with no receipt, presence or lease writes. Overflow is rejected before unnecessary anchor/ordinal enrichment.
 - CLI and MCP require no policy changes: CLI continues formatting raw/terminal records and owner-produced continuation; MCP serializes public data only. Catch's renderer-accessor changes are owned by its separate lane.
 
 ## Verification

package/guides/primitive-status-consolidation.md

@@ -63,14 +63,14 @@ For completeness, **whole integrated source** against fixed `501ddc2` is 110 fil
 
 Full versus filtered roster is a real distinction: status data omits never-joined historical actor names, while participants data retains them. `knownParticipantCount` separately preserves the complete-roster continuation count; it is not `status.data.participants.length` or the standing count.
 
-The amended guidance's reachable-latest clause is applied: the selector remains newest `say`/`done`. Both require an actor in valid storage, whereas actorless `hold`/`resume` and `read` are not selected. Therefore status has no reachable raw/public latest distinction. The conversion guard remains conservative, but no hypothetical duplicate projection is retained. History and other operations' genuine raw/public distinctions are untouched by this lane.
+The amended guidance's reachable-latest clause is applied: the selector remains newest `say`/`done`. Both require an actor in valid storage, whereas `read` is not selected. Therefore status has no reachable raw/public latest distinction. The conversion guard remains conservative, but no hypothetical duplicate projection is retained. History and other operations' genuine raw/public distinctions are untouched by this lane.
 
 ## Behavior and timing evidence
 
-- `test/projections.test.js`: exact canonical status data, full versus filtered roster, absent duplicate projections, hold/cap/throttle fields, and read/actorless-hold exclusion from latest selection. Existing viewer perception, exact-spelling rejoin and bounded hydration assertions remain. Shared watching/recent/lingering policy remains read-only.
+- `test/projections.test.js`: exact canonical status data, full versus filtered roster, absent duplicate projections, cap/throttle fields, and read exclusion from latest selection. Existing viewer perception, exact-spelling rejoin and bounded hydration assertions remain. Shared watching/recent/lingering policy remains read-only.
 - `test/application-boundary.test.js`: configured named, discovered (including blank environment name), explicit blank, explicit override and ambient viewer; body perception and attention names; unchanged artifact state and ownership/presence ledger after status.
 - `test/core.test.js`: status and participants continue sharing actual authored and receipt times, including a fresh rejoin and watcher.
-- `test/process/square-cli-render.test.js`: the compact ten-person preview now includes a valid historical never-joined actor in the artifact. Status still hides that actor but its executable continuation uses the full count 14 rather than filtered count 13; participants prints the complete roster. Existing hold duration, exact rejoin, attention, clipping/public-id continuation and presence feedback remain covered.
+- `test/process/square-cli-render.test.js`: the compact ten-person preview now includes a valid historical never-joined actor in the artifact. Status still hides that actor but its executable continuation uses the full count 14 rather than filtered count 13; participants prints the complete roster. Existing exact rejoin, attention, clipping/public-id continuation and presence feedback remain covered.
 
 No observation timing change is intended: optional viewer discovery still precedes status's resource read; the clock is sampled once inside the transaction, and all domain data, classification, perception and rendering annotations are assembled in that read. Queries perform no I/O or mutations themselves. SDK participant/snapshot shapes and MCP serialization of data remain unchanged. No join/claim is introduced.
 

package/guides/primitive-storage-consolidation.md

@@ -25,7 +25,7 @@ Deliverer evidence, not independent review or acceptance.
 | `square-state.ts` legacy SQLite framing | `square-sqlite.ts`: read-only owned-v1 recognition beside row framing/codecs |
 | `square-state.ts` legacy payload validation | `square-migration.ts`: explicit legacy envelope, order/gap and assigned-reference checks, permissive finite route data and path-specific nonfinite rejection |
 | General-model snapshot/runtime DTOs | `square-sqlite.ts`: explicit import/export DTOs, not runtime transaction state |
-| Dead `StoredActHead`, `HoldState`, `findParticipantName`, empty `ReceiverRoute` alias | Deleted; interchange routes use the existing `WakeRoute` type |
+| Dead `StoredActHead`, `findParticipantName`, empty `ReceiverRoute` alias | Deleted; interchange routes use the existing `WakeRoute` type |
 
 There are no forwarding stubs. The renamed build preparation is the actual implementation, not an alias. File SDK build, synchronous memory build and application build share it. Application build returns the normalized configuration from canonical creation rather than reconstructing it. Ordinary storage/resource imports perform no guide reads; the first build reads only its selected guides and caches them.
 

package/guides/receive-primitive.md

@@ -0,0 +1,90 @@
+# Transaction-local receive and consumption
+
+`@astrosheep/square/receive` admits items and their settled audience, selects
+received heads without consumption, and records sparse first-write-wins receipts.
+It has no runtime dependencies, Square membership, SQLite or transport requirement.
+For computing an audience before admission, see [attention](attention-primitive.md).
+
+```ts
+import { receive, consumeReceived } from '@astrosheep/square/receive';
+
+// Both callbacks belong to your storage implementation, not this package.
+store.transaction(tx => receive(tx, {
+  item: { key: 'opaque:west/7?hello', data: { text: 'Hello' } },
+  audience: [{ recipient: 'east:bob', via: 'link' }],
+}));
+const page = store.transaction(tx => consumeReceived(tx, 'east:bob', {
+  kind: 'page', query: { sender: 'west:alice' }, limit: 10,
+}, Date.now()));
+// { items: [{ key, data, via }], newlyConsumed, remaining }
+```
+
+`store` and `tx` above are caller-owned storage, not exports. Implement
+`ReceiveRead<K,D,V,Q>` / `ReceiveWrite<K,D,V,Q>` structurally; each function only
+requires the `Pick` of methods it uses. `K extends string | number` is an opaque
+equality identity: no ordering, parsing, numeric sequence, or `act/N` convention
+is imposed. The storage defines head order and query semantics. `D`, route `V`,
+and query `Q` are caller data. Recipients are strings; the caller owns canonical
+identity and eligibility. Item and address keys must be unique in storage.
+
+## Capabilities and ownership
+
+- `insertItem({key,data})` and `insertAddress(key,{recipient,via},order)` admit an
+  item and its audience in supplied order. `receive` permits an empty audience.
+  Supply unique recipient keys; duplicate items/addresses must throw, never
+  overwrite or silently deduplicate. Roll back the whole admission on failure.
+- `heads(recipient,query,{unconsumed,limit})` applies the query and consumption
+  predicate **before** limiting, returning ordered `{key,via}` heads.
+  `addressed(recipient,key)` ignores receipt state, but checks addressedness.
+- `load(keys)` hydrates the selected keys once as a `ReadonlyMap<K,D>`.
+  Missing keys are errors; an explicitly stored `undefined` value is not missing.
+  `count(recipient,query,unconsumed)` counts the same selection without a limit.
+- `receipt({recipient,item})` reads `{at}` or `undefined`.
+  `insertReceipt(ref,at)` returns true only for a new coordinate and preserves the
+  first timestamp. The identity is `(recipient,item)`, not a cursor or generation.
+
+All functions are synchronous. Supply capabilities from **one isolated,
+caller-owned transaction**, with storage uniqueness constraints and rollback on
+any thrown error, including failures during hydration, receipt insertion or the
+final count. No capability or selected page should escape that transaction for
+later consumption. The leaf does not start, commit, retry or emulate transactions.
+Its atomicity depends on this caller obligation.
+
+## Selection and receipts
+
+`selectReceivedHeads(tx,recipient,selection)` never hydrates or writes. A page is
+`{kind:'page',query,limit}` and always selects unconsumed heads; `limit` must be a
+positive safe integer, with no policy maximum. An exact selection is
+`{kind:'exact',key,remainingQuery}` and remains repeatable after consumption.
+
+`consumeReceived` selects inside the supplied transaction, hydrates all selected
+keys before any receipt insertion, preserves head order, records the captured
+coordinates and counts matching unconsumed items. Exact remaining uses
+`remainingQuery`; page remaining uses `query`. Repeating exact consumption returns
+the same item with `newlyConsumed: 0`, not a second receipt.
+
+`recordConsumed(tx,refs,at)` only needs `insertReceipt`. It records captured
+coordinates without reselecting, loading or checking eligibility. Duplicate refs
+are idempotent through storage and cannot change the first timestamp. Timestamps
+must be finite numbers (negative/fractional timestamps are allowed). Nonnumber
+limits/timestamps throw `TypeError`; out-of-range numbers throw `RangeError`.
+`ReceiveError` exposes `code: 'not_addressed' | 'missing_item'` and the opaque `key`.
+Storage errors propagate unchanged; they still require caller rollback.
+
+This is not a remote message protocol, replay envelope, permission system,
+ordering service, billing ledger or exactly-once external effect guarantee.
+Delivery attempts and presentation are separate from consumption. The
+[symmetric domains example](symmetric-domains.md) composes all three public
+primitive entrypoints without constructing Square.
+
+## Square composition
+
+Square uses these functions for production landing, catch and `markSeen` against
+its existing activity, audience and receipt tables. Numeric activity indexes stay
+internal keys; the primitive does not know Square IDs. Square retains validation,
+limits, filtering, perception, ownership, leases, hints and error mapping. The
+empty-catch read probe does not hydrate or acquire a writer; a nonempty probe is
+reselected inside the writer. Ordinary catch sees historical receipt holes,
+including before rejoin; proactive pending still starts after the latest join.
+The artifact schema/format and receipt identity are unchanged. See the
+[Square API](square-api.md) for product operations.

package/guides/row-runtime-delivery-evidence.md

@@ -10,7 +10,7 @@ Candidate implementation: `833d6f15c9071767eb49a9562a4c42a93c6f4000` plus post-r
 | Whole-history fold on normal operations; replay delivery/perception closures | `square-domain.ts::deriveLanding` maintains participant, attention and ordered audience indices once at landing; `runtime.ts` computes cursor/presence/terminal from narrow domain facts. |
 | `FromState`/delta bridges and old core append/observation update helpers | Removed. `SquareWrite.land/markSeen/putLease/removeLease/replaceRoutes` are the finite domain mutations. Memory uses the same SQLite driver in `:memory:`, not a second selector/policy implementation. |
 | Renderer `.state` inputs and replay-based ordinal/perception lookup | `views.ts`, `perception-projection.ts` and presentation operations settle selected bodies, ordinals, counts and perceptions inside the transaction; renderers receive detached values. |
-| Join/status/hold/resume/done snapshot loads for counts | `joinFacts`, standing counts, roster/status aggregates and header reads. Public SDK snapshot is no longer used by these production callers. |
+| Join/status/done snapshot loads for counts | `joinFacts`, standing counts, roster/status aggregates and header reads. Public SDK snapshot is no longer used by these production callers. |
 | Global whole-history notification/wake enumeration | Bodyless `pendingAudience` groups with a captured activity upper bound and recipient join coordinates; receivers use their own `directed` relation. Scans advance past withheld groups and do not restart on unrelated writes. |
 | Whole-history native/Claude currentness and cancellation | Exact pending facts, ordered routes, lease and captured host fences; cancellation selects activity heads by descending coordinate and tests timestamp. Host/network work stays outside artifact transactions. |
 | Preliminary full load before file-backed open/probe/wait | Validated header/schema boundary, revision-only observer; selected row validation on access. Full doctor is explicit. |

package/guides/row-storage-design.md

@@ -27,7 +27,7 @@ Replace AGENTS.md's `All behavior operates on SquareState ...` sentence, with th
 
 > Behavior operates on typed Square domain facts obtained through transaction-scoped reads and domain transitions. SQLite schema, SQL, and storage framing remain private to the artifact boundary. Partial fact reads must not masquerade as a complete SquareState.
 
-One typed domain representation: activities, sparse seen receipts, catch leases, and ordered published routes, plus small configuration facts. Current participants/attention and historical landed audience are reconstructible indices. No inbox, continuous cursor, pending flag, eligibility, persisted ordinal, or receiver acknowledgement watermark. Hold is read from the latest hold/resume activity, not another authoritative fact.
+One typed domain representation: activities, sparse seen receipts, catch leases, and ordered published routes, plus small configuration facts. Current participants/attention and historical landed audience are reconstructible indices. No inbox, continuous cursor, pending flag, eligibility, persisted ordinal, or receiver acknowledgement watermark.
 
 Three layers:
 - Domain actions validate admission and produce `Act` values; domain projections combine the read capabilities below. Host/network work is outside artifact transactions.
@@ -82,7 +82,6 @@ interface ActivityFilter {
   readonly kinds?: readonly StoredAct['kind'][];
   readonly actors?: readonly string[];
   readonly actorMatch?: 'identity' | 'exact'; // default identity
-  readonly actorRequired?: true;
   readonly afterAt?: number; // exclusive; no implicit upper-time bound
 }
 interface IndexPage {
@@ -144,9 +143,6 @@ interface SquareRead {
   attention(listener: string): readonly AttentionFact[]; // sinceIndex ascending
   incomingAttention(sender: string): readonly AttentionFact[];
   // incoming matches nameKey(target); includes listen and ignore, not only joined actors
-  hold(): { readonly active: boolean; readonly at?: number;
-            readonly reason?: string; readonly actor?: string };
-
   activity(index: ActivityIndex): StoredAct | undefined;
   activityHeads(filter: ActivityFilter, page: IndexPage): FactPage<ActivityHead>;
   activities(indexes: readonly ActivityIndex[]): readonly StoredAct[];
@@ -232,7 +228,7 @@ interface LandingFacts {
 function deriveLanding(activity: StoredAct, facts: LandingFacts): LandingEffect;
 ```
 
-`deriveLanding` is pure and shared by runtime and rebuild. `land()` reads the necessary narrow facts, validates structural invariants (not action admission again), allocates **header.nextActIndex**, calls this transition, and applies the effect plus nextActIndex increment atomically. Migration supplies the preserved assigned indices; it never calls the allocator or admission validation. Earlier reply author lookup uses the existing activity row, including join/done/read/listen/actor-bearing hold; missing earlier coordinate means no author. Valid legacy replay never requires a future author because reply < own index.
+`deriveLanding` is pure and shared by runtime and rebuild. `land()` reads the necessary narrow facts, validates structural invariants (not action admission again), allocates **header.nextActIndex**, calls this transition, and applies the effect plus nextActIndex increment atomically. Migration supplies the preserved assigned indices; it never calls the allocator or admission validation. Earlier reply author lookup uses the existing activity row; missing earlier coordinate means no author. Valid replay never requires a future author because reply < own index.
 
 `markSeen` accepts any nonnegative index below nextActIndex, even if no activity/participant exists. It refuses unassigned coordinates and non-finite timestamps; it inserts only missing exact-owner receipts. Actions—not a receipt FK—ensure catch/native writes concern the intended activities. Lease writers similarly retain unknown/raw owner fallback. Only receipt insertion marks seen; presentation outcome, cancellation, and wake evidence do not.
 
@@ -257,14 +253,12 @@ CREATE TABLE square_meta (
 CREATE TABLE activities (
   act_index INTEGER PRIMARY KEY CHECK (act_index BETWEEN 0 AND 9007199254740991),
   at REAL NOT NULL,
-  kind TEXT NOT NULL CHECK (kind IN ('join','done','say','hold','resume','read','listen','ignore')),
-  actor_json TEXT COLLATE BINARY,
-  actor_key_json TEXT COLLATE BINARY,
+  kind TEXT NOT NULL CHECK (kind IN ('join','done','say','read','listen','ignore')),
+  actor_json TEXT COLLATE BINARY NOT NULL,
+  actor_key_json TEXT COLLATE BINARY NOT NULL,
   reach TEXT CHECK (reach = 'bell'),
   reply_index INTEGER CHECK (reply_index >= 0 AND reply_index < act_index),
   payload_json TEXT NOT NULL CHECK (json_valid(payload_json)),
-  CHECK ((actor_json IS NULL) = (actor_key_json IS NULL)),
-  CHECK (kind IN ('hold','resume') OR actor_json IS NOT NULL),
   CHECK (kind = 'say' OR (reach IS NULL AND reply_index IS NULL))
 );
 CREATE INDEX activity_kind_index ON activities(kind, act_index);
@@ -333,9 +327,9 @@ CREATE INDEX audience_recipient ON landed_audience(recipient_key_json, act_index
 No foreign keys. In particular receipts must not reference activities or participants; replies/through must not require existing rows; leases/routes must not require known names. Derived tables are maintained and checked against authority, not used to reinterpret permissible v1 authority as invalid. `next_act_index > greatest existing activity index` and receipts < next_act_index are checked by the boundary (all receipts only on full integrity/import; inserted receipts on writes). No contiguous-index constraint. Finite fractional activity/receipt/lease times remain REAL, not INTEGER. Number-safe limits are enforced in the codec and allocator.
 
 Activity payload shapes, with optional-property presence preserved:
-- join/resume: `{}`.
+- join: `{}`.
 - say: `{body: string, mentions?: string[]}`; reach/reply live only in their columns.
-- done/hold: `{body?: string}`.
+- done: `{body?: string}`.
 - read: `{through: number}`; no reference check on through.
 - listen/ignore: `{target: string}`; no participant reference check on target.
 Actor's original spelling lives in actor_json; actor_key_json is its indexed identity derivative. Neither is repeated in payload. Indices store coordinates/keys, never duplicate bodies.
@@ -344,7 +338,7 @@ Route payload contains location, original participant spelling, channel, address
 
 Preserve finite route epoch/extra JSON values and empty strings; do not otherwise tighten their legacy shapes. Use ordinary JSON encoding, not a bespoke numeric codec. Migration explicitly refuses non-finite numbers anywhere in a route (updatedAt, epoch, or nested extras) before DDL/inserts and leaves the artifact unchanged; never silently coerce them to null. These exponent-overflow values can pass the old permissive validator on manually authored JSON, but are not non-finite values normally persisted by the v1 JSON.stringify writer. Runtime codecs likewise require finite route numeric values. Raw schema equality is not receipt or participant equality.
 
-No receipt `state` column: all receipts are seen. No persisted hold table: `hold()` selects last hold/resume using activity_kind_index; resume returns inactive with no stale reason/actor/time. No additional name registry: a participant is first touched by ANY actor-bearing activity, not necessarily join.
+No receipt `state` column: all receipts are seen. No additional name registry: a participant is first touched by ANY actor-bearing activity, not necessarily join.
 
 ## 4. Exact derived transitions and routes
 
@@ -352,7 +346,7 @@ Landing uses pre-activity participant/attention facts:
 1. Compute a say audience first. Resolve deduplicated mentions against standing roster (bell: all standing); then standing reply author; then active listeners in roster order. Skip sender and duplicate recipients. Ignore blocks all non-bell reach; bell bypasses ignore. Store ordered unique recipients and priority **bell > mention > reply > attention**. Explicit self mention remains in activity metadata but creates no self audience edge. Missing/departed reply author creates no edge; action result retains existing replyAuthorNotHere semantics.
 2. Touch actor if new: name is first actor spelling, joined=false, done=false, sayCount=0. Update lastActiveAt with max(existing, activity.at), not latest-by-index time.
 3. join sets joined=true/done=false and lastJoinIndex=index. done sets joined=false/done=true and clears OUTGOING listen only. Ignore survives departure/rejoin; incoming attention is not cleared. Say increments lifetime count, even for unusual imported prejoin/postdone sequences.
-4. listen inserts listen only when not already listening; removes matching ignore. ignore removes matching listen and inserts ignore only when absent. Preserve target's first retained spelling and relation order, including unknown/self targets. A no-op legacy activity still touches actor time; replay never applies the current ten-name admission cap. hold/resume remain events; read does not acknowledge receipts or advance a persisted cursor.
+4. listen inserts listen only when not already listening; removes matching ignore. ignore removes matching listen and inserts ignore only when absent. Preserve target's first retained spelling and relation order, including unknown/self targets. A no-op legacy activity still touches actor time; replay never applies the current ten-name admission cap. Read does not acknowledge receipts or advance a persisted cursor.
 
 There is one production transition, no SQL triggers and no separate migration fold. Test-only frozen old fold/replay supplies differential evidence. Index integrity checking can rebuild through the production transition but cannot replace differential tests with self-comparison.
 
@@ -370,9 +364,9 @@ Let P be resolved participant, K=P.name (or requested raw spelling if unknown),
 
 ### Continuous cursor
 
-Find B = smallest landed-audience index > J without receipt (K,index). Then find C = greatest EXISTING activity index > J and < B (no upper bound if no B), with actor present and kind != read. Return max(J,C), with missing C treated as J. Implementation uses `directed(... unseenOnly, oldest limit=1)` and `activityHeads(... actorRequired, kinds excluding read, newest limit=1)` in the SAME transaction. It does not read every intervening activity body.
+Find B = smallest landed-audience index > J without receipt (K,index). Then find C = greatest EXISTING activity index > J and < B (no upper bound if no B), with kind != read. Every persisted activity has an actor. Return max(J,C), with missing C treated as J. Implementation uses `directed(... unseenOnly, oldest limit=1)` and `activityHeads(... kinds excluding read, newest limit=1)` in the SAME transaction. It does not read every intervening activity body.
 
-Why this is exact: audience edges only exist on peer says. Before the first unseen addressed say, own and nonaddressed actor-bearing non-read events all advance readCursor. Read and actorless events do not. No cursor at B-1 is invented: if J=4, actor-bearing act/7 exists, act/9 is actorless, and unseen addressed act/12 blocks, cursor is 7, not 11 or 9. Seen act/13 beyond that hole does not advance it.
+Why this is exact: audience edges only exist on peer says. Before the first unseen addressed say, own and nonaddressed non-read events all advance readCursor. Reads do not. No cursor at B-1 is invented: if J=4, act/7 exists, act/9 is a read, and unseen addressed act/12 blocks, cursor is 7, not 11 or 9. Seen act/13 beyond that hole does not advance it.
 
 ### Evidence and presence
 
@@ -417,12 +411,12 @@ No production structure below carries `.state`, all `.activities`, or a deferred
 |---|---|
 | openSquare/openSquareArtifact, wait baselines, watch headers, cli/program | header/revision only; remove preliminary whole-state validation/load. Every normal selected-row decode remains validated. |
 | square-actions join/implicitJoin/takeover/done/endOwnedSession, registry-associated route cleanup | participant/roster as needed, routes, land/replaceRoutes; same host claim lock scopes and cleanup sequences. Takeover done+join is one txn. No full SDK snapshot. |
-| Join's before/after snapshot and CLI hold/resume/done count calls | `Square.join` returns a Participant handle and committed activity; optional observations use transaction-captured counts, held state and time. Listener/lifecycle commit facts likewise come from the mutation transaction; join's extra entry history is best-effort. See [Square/Participant API](square-api.md). |
-| express/decideAct and behind rendering | header, actor fact, roster for longest standing-body mention resolution, hold, reply head/existence, recentSayTimes, continuous cursor, directed suffix. Admission normalization/error order unchanged. A valid reply coordinate is <nextActIndex, even if a gap: preserve current acceptance of assigned-but-missing reply. Recovery supplies own count/cap/hold and behind summaries with one full preview per sender. |
-| listen/ignore/listening, watch leases and terminal checks | actor fact, outgoing attention; roster only for quorum; land or lease methods. Unknown valid attention target still allowed. Pulse keeps hold-before-terminal priority. |
+| Join/status/done count calls | `Square.join` returns a Participant handle and committed activity; optional observations use transaction-captured counts and time. Listener/lifecycle commit facts likewise come from the mutation transaction; join's extra entry history is best-effort. See [Square/Participant API](square-api.md). |
+| express/decideAct and behind rendering | header, actor fact, roster for longest standing-body mention resolution, reply head/existence, recentSayTimes, continuous cursor, directed suffix. Admission normalization/error order unchanged. A valid reply coordinate is <nextActIndex, even if a gap: preserve current acceptance of assigned-but-missing reply. Recovery supplies own count/cap and behind summaries with one full preview per sender. |
+| listen/ignore/listening, watch leases and terminal checks | actor fact, outgoing attention; roster only for quorum; land or lease methods. Unknown valid attention target still allowed. |
 | catch / native seen | directed selectors/activity exact, markSeen, cursor/counts in txn; native `current` becomes synchronous `(facts: SquareRead)=>boolean`, evaluated ONLY within reads/receipt txn. It cannot escape or call host I/O. |
 | entryPresentation / cli/square-commands join | bounded newest say/done heads then public activities with settled perceptions for the selected viewer; header context/scene; actor's join count from activityCount(kind join, actor identity). Supply `joinedBefore` rather than replaying `.state.acts`. `lastN=null` remains an explicit complete history request, not normal join's default. |
-| statusPresentation / cli/observation-commands status | roster+attention, hold, receiptFacts, continuous cursors and directed counts, fresh lease status; latest say/done. Supply last THREE public join events after latest public index, total number of such joins, and each `rejoined` boolean from existence of earlier done with EXACT actor spelling (current CLI equality). Latest line carries settled perception for context.name (including '' ambient viewer), not a SquareState. No receipts/history map hydrated. |
+| statusPresentation / cli/observation-commands status | roster+attention, receiptFacts, continuous cursors and directed counts, fresh lease status; latest say/done. Supply last THREE public join events after latest public index, total number of such joins, and each `rejoined` boolean from existence of earlier done with EXACT actor spelling (current CLI equality). Latest line carries settled perception for context.name (including '' ambient viewer), not a SquareState. No receipts/history map hydrated. |
 | participants/participantsPresentation/listPresentation | roster-derived status sorted by existing compareParticipantActivity; receipts/leases aggregates for participant statuses; list requires only active names, header preamble and say count. Change probeSquare to create a validated file-backed port, not full read then memory clone. |
 | history / participantHistory / historyPresentation | relational head filter + contextIndexes; hydrate filtered candidate bodies for JS search, otherwise page only; count before final limit; selected ordinals + detached presence anchors/perceptions. Retain CLI lifecycle archive/raw coordinate windows and facade non-read inclusion. See algorithm below. |
 | catch selection and rendering | hydrate ONLY selected rows, capture caught perceptions, participant status/clock, count/cap/terminal in the receipt transaction. Empty completion does not hydrate bodies. No all-history lookup of caught ids. |
@@ -444,7 +438,7 @@ Keep synchronous arbitrary `delivered(name,id)`. `snapshot()` intentionally copi
    Execution is fixed: with an audience filter, enumerate historical `directed` pages without unseenOnly or a join cutoff; intersect each page's indices with the context union and other index/time/actor/kind filters through `activityHeads`. Without an audience filter, enumerate `activityHeads` directly. Continue the source traversal even when an intersection is empty. Public limiting follows the remaining filters/search; storage page exhaustion is distinct from a filtered empty page. This composition needs no new audience selector or query framework.
 2. Nonempty regex/fixed search additionally restricts to say/done. Compile existing JS case-insensitive search once and test id/actor/body, not SQL LIKE/SQLite regexp. Iterate all relationally matching candidate body pages in the txn to count matches; maintain only the requested edge's selected page plus the needed existence/count metadata. Regex remains potentially expensive exactly as current engine; no new safety claim. Empty supplied pattern keeps current no-search semantics for facade.
 3. Default/before selects LAST N filtered matches; after selects FIRST N. Select chronological edge first; desc reverses ONLY selected page. A complete request remains explicit and follows existing CLI maximum refusal. Continuation availability is computed over the current archive-visible kind set and current public page min/max, preserving current text/JSON differences; it is not simply a raw-head hasMore flag. Return total search matches, selected rows, public-before/public-after existence, selected ordinals and all anchor names landing on selected coordinates.
-4. Presence anchors are the §5 evidence algorithm for all roster names; compute without full hydration and attach only selected-coordinate annotations in roster order. Context positions include read/actorless activities; coordinate arithmetic must not replace position selection. History across separate calls promises stable activity-id coordinates, not frozen mutable receipt/presence annotations.
+4. Presence anchors are the §5 evidence algorithm for all roster names; compute without full hydration and attach only selected-coordinate annotations in roster order. Context positions include reads; coordinate arithmetic must not replace position selection. History across separate calls promises stable activity-id coordinates, not frozen mutable receipt/presence annotations.
 
 ## 8. Error/transaction lifecycle (fixed)
 
@@ -473,7 +467,7 @@ These terms apply together with the domain specification above.
 - Open existing canonical path create-disabled. A read-only preflight establishes owned known schema/version before any persistent pragma or DDL. Require existing DELETE journal mode, refuse another mode without changing it; the shipped v1 creator/writer already establishes DELETE. Set connection busy_timeout=0 and synchronous=FULL. Acquire BEGIN IMMEDIATE, re-check format/schema under the lock, and validate the full v1 snapshot inside it. If v2 is already present and has valid framing/header, return already-format-2 without changing revision. A second migrator follows this same in-lock check.
 - Use v1 validation retained ONLY in migration (test oracle may also retain it), plus one explicit restriction: non-finite numbers anywhere in a route (including nested extras) are unsupported input, refused before DDL/inserts with the artifact untouched. They are not normally persisted as non-finite values by the v1 JSON.stringify writer; do not add a bespoke overflow-number codec or silently coerce to null. Copy normally persisted authoritative facts losslessly, preserving revision and nextActIndex, activity indices/gaps and optional field distinctions, raw receipt/lease owner keys, route order/duplicates, strings and finite fractional timestamps. Absent routes and [] both become zero rows; empty receipt-owner maps are behaviorless and may become zero receipt rows. Do not canonicalize receipts or add foreign keys that reject accepted v1 facts.
 - Actual receipt lookup is exact canonical roster spelling, not lowercase nameKey: preserve the raw owner-key relation and resolve lookup via the domain. Free-form JS strings must survive SQLite binding; JSON string encoding (including for key strings where necessary) preserves lone surrogates. All normalized lookup keys come from domain nameKey, never SQLite LOWER.
-- Create v2 tables and insert authority. Build derived participant/hold/attention/audience facts with the SAME single-step domain transition used by runtime landing (admission checks are NOT replayed). Check insert/constraint failures normally; do not add a second full replay or a second in-memory copy just to validate the function against itself. Lossless authority equality and old-replay equivalence are migration tests; doctor can explicitly recompute indices for integrity checking. Drop square_snapshot. Set user_version=2 inside the same transaction. Commit once; nothing is published piecemeal.
+- Create v2 tables and insert authority. Build derived participant/attention/audience facts with the SAME single-step domain transition used by runtime landing (admission checks are NOT replayed). Check insert/constraint failures normally; do not add a second full replay or a second in-memory copy just to validate the function against itself. Lossless authority equality and old-replay equivalence are migration tests; doctor can explicitly recompute indices for integrity checking. Drop square_snapshot. Set user_version=2 inside the same transaction. Commit once; nothing is published piecemeal.
 - Busy acquisition/read retries yield using existing 25ms retry and operation cancellation. Busy COMMIT retries the same transaction; never rerun copy or domain callback. Error/abort before successful COMMIT rolls back. Process death before commit recovers v1 through SQLite journal; after commit leaves complete v2. Preserve path/inode/registry identity. No host-ledger mutation and no synthetic activity.
 - Storage exclusion is guaranteed for the shipped SQLite v1 runtime because it validates again after BEGIN IMMEDIATE: its write commits before migration, or it sees v2 and refuses afterward. A pre-migration read can finish with its old snapshot. Migration does not revoke in-flight remote delivery or stop processes; recommend stopping/upgrading attached runtimes for an operationally quiet migration. Arbitrary external path replacement and pre-SQLite binaries are outside the artifact update protocol. Do not claim a distributed transaction or exactly-once remote delivery.
 

package/guides/square-api.md

@@ -3,6 +3,14 @@
 `Square` opens the concrete local SQLite resource shared by SDK, CLI, MCP and Pi. `square-api.ts`
 exports the public `{at, build, inMemory}` entrypoints and `type Square`; `square.ts` remains the
 executable CLI entrypoint.
+For audience computation without opening a square, see the [attention primitive](attention-primitive.md).
+For transaction-scoped attempt custody and the storage-independent dispatch/prepared presentation
+lifecycles used by Square's actual adapters, see the [delivery primitives](delivery-primitives.md).
+Full presentation settlement atomically completes its captured attempt and full-consumption receipts;
+clipped previews record no full receipt. Cancellation/deferral is pre-effect policy, never a veto of a
+successful sink. The public primitive distinguishes sink observations from refused/failed persistence;
+Square retains its existing result shapes and explicit failed classification for rejected sinks.
+For caller-owned item admission and sparse consumption, see the [receive primitive](receive-primitive.md).
 `square-facade.ts` contains only public types. There is no separate operation factory, policy
 dispatcher or `{data, projection}` envelope.
 
@@ -34,7 +42,7 @@ try {
 
 - `Square.build({path, markdown, hardCap?, throttlePerMinute?, template?, force?, ...})` returns
   the same open resource. Public `Square.at` and `Square.build` resolve an omitted `wakeTransport`
-  once from `env ?? process.env` to the product's Claude/Codex/Paseo defaults; if creation fails,
+  once from `env ?? process.env` to the product's Claude/Codex/Paseo/HTTP defaults; if creation fails,
   opening still succeeds without proactive wake. A supplied port is used unchanged; `false`
   disables proactive wake. Activities still land normally without a transport.
 - Synchronous `Square.inMemory` uses only an explicitly supplied port; omitted or `false` means
@@ -128,6 +136,65 @@ current seat it advances the suppression boundary through the current activity h
 whether it changed. A mismatched seat returns `false`; a detached or concurrently replaced seat may
 be refused. It does not consume activity or recall an external send already past its final check.
 
+## HTTP(S) wake notifications
+
+File-backed public opens include a built-in `http` wake transport for both HTTP and HTTPS.
+Register its address through SDK join or same-owner `reattach`:
+
+```ts
+const { participant: bob } = await square.join('Bob', {
+  owner: 'example:bob-process',
+  wakeAddress: { kind: 'http', address: {
+    url: 'https://example.com/square/wake',
+    tokenEnv: 'BOB_WAKE_TOKEN', // optional; sender process environment variable
+  } },
+});
+```
+
+The URL must have an HTTP(S) scheme and hostname, with no embedded username/password or fragment.
+Local/private endpoints are allowed. HTTPS uses normal certificate validation. The sender POSTs
+`Content-Type: application/json` to that URL without following redirects. When `tokenEnv` is
+configured, the sender resolves it in its own environment (`env` at open, otherwise `process.env`),
+not the receiver's. A missing, blank or invalid bearer token refuses locally without HTTP I/O.
+Keep the secret in that environment variable, never in the stored address. Diagnostics do not echo
+URLs or raw network errors; URL query strings may themselves be sensitive and remain stored config.
+
+The JSON body contains only:
+
+```json
+{
+  "location": "/sender/path/discussion.square",
+  "participant": "Bob",
+  "activity": "act/12",
+  "actor": "Alice",
+  "attemptN": 0,
+  "preview": "<existing rendered Square wake reminder>"
+}
+```
+
+`attemptN` is omitted when unavailable. The preview is the existing rendered awareness reminder,
+not a new payload template or full artifact. Owner, route and claim token are never included. `location` is the
+**sender's artifact locator**, not a downloadable URL. HTTP adds wake notification, not a remote
+Square backend: the receiver owns how it queues/wakes its agent and gives it access to Square.
+
+Return 2xx promptly only after accepting wake custody. A 2xx records an accepted wake, **not** catch
+or presentation; activity remains unread until normal consumption. Redirects and 4xx are rejected,
+5xx are transient failures, and other non-2xx statuses are rejected. A network error or timeout
+after sending starts is **unknown**: the receiver may already have accepted. Unknown/accepted wakes
+are not automatically replayed. There is no retry loop in the HTTP adapter; existing delivery policy
+owns future dispatch. Local configuration, absent preview, expired pre-send budget or a refused final
+gate sends nothing. One deadline covers preparation, the final gate and waiting for response headers;
+response bodies are cancelled rather than read. Claims, per-owner ordering, deferral, attachment and
+cancellation checks are shared with every transport. `wakeTransport: false` still disables wakes,
+and an injected transport remains authoritative.
+
+The enclosing dispatcher's safety deadline is transport-neutral: if an attempt is still unsettled,
+it records conservative **unknown**, even when HTTP has not started (for example, while the final
+send gate is stalled). A local pre-send expiry is known no-send only when the adapter's result arrives
+before that outer fallback. HTTP still must not start I/O after a stalled gate resumes past its
+deadline; the persisted unknown remains and prevents automatic replay. This does not change the
+shared dispatcher's timeout or retry policy.
+
 ## One set of operations and defaults
 
 Square owns `history`, `status`, `participants`, `snapshot`, `stream`, and recovery observations.
@@ -144,11 +211,11 @@ their landed directed activities and adds `perception` and the landing route `vi
 (`mention`, `reply`, `attention`, or `bell`). Perception follows the viewer's actual landed audience;
 `via` is absent when no directed route exists. Stream starts at a bounded tail or after an `ActivityId`
 like `act/12`; it never consumes activity.
-Participant owns `express`, `catch`, `listen`, `unlisten`, `ignore`, `listening`, `hold`, `resume`, `done`,
+Participant owns `express`, `catch`, `listen`, `unlisten`, `ignore`, `listening`, `done`,
 `deferDelivery`, `renewDeliveryDeferral`, and `releaseDeliveryDeferral`. History belongs only to
 Square; there is no `Participant.history`.
 
-- Express waits while held/throttled unless `noWait: true`, for **every** caller. `ExpressResult`
+- Express waits when throttled unless `noWait: true`, for **every** caller. `ExpressResult`
   includes the committed `activity`, optional landing-time warnings (`unmatchedMentions`,
   `replyAuthorNotHere`), `hint` and `observation`. Warnings are not stored on the activity.
 - A say may carry `metadata`, an immutable JSON object with nested JSON values and a maximum serialized
@@ -180,9 +247,8 @@ Square; there is no `Participant.history`.
 - `participants()` returns `{participants, observation?}` and `listening()` returns
   `{listening, observation?}`, not arrays carrying metadata. Participant summaries use `presence`
   (`never-joined`, `active`, `watching`, `away`, or `done`). Away participants remain members,
-  count toward in-square totals and keep receiving normal bell, mention and listened audience. Status reports a non-null `held` whenever a
-  hold is active; `by` is omitted only for historical actorless holds. Its roster supplies the
-  participant counts. Core `square.status({viewer})` uses only the explicitly supplied viewer; with
+  count toward in-square totals and keep receiving normal bell, mention and listened audience. Its roster
+  supplies the participant counts. Core `square.status({viewer})` uses only the explicitly supplied viewer; with
   no viewer it returns an unfiltered overview without viewer-specific `listening`. Core status does
   not select or authorize a seat. CLI and tools check an explicit `--as`/`as` with `selectOwnSeat`;
   otherwise exactly one attached seat of the caller's owner becomes the viewer, while zero or multiple
@@ -274,7 +340,7 @@ Express captures optional unread context before the attempt: the latest five dir
 unseen activities after the current join, each preview capped at 400 Unicode characters,
 plus the count outside that preview. It hydrates only that page, not the entire cursor suffix.
 This is a nonconsuming preview even when a short body fits in full; only `catch` or the
-normal full-notification presentation path consumes it. Count/held/time facts come
+normal full-notification presentation path consumes it. Count and time facts come
 from the committed transaction. Listener and lifecycle observations likewise use their mutation's
 facts, with no postcommit context read. Join uses its mutation's essential facts and treats optional
 entry/history enrichment as best-effort: `observation.enrichmentUnavailable` is explicit and the
@@ -296,13 +362,13 @@ receives the express abort signal, while recovery reopening is deliberately unca
 
 CLI and tools only adapt input, identity, resource lifetime and output. They do not import private
 actions, storage, admission, scanners or query execution. CLI `--json` for join, express, catch,
-history, listen, ignore, unlisten, listening, hold, resume, done, status, participants and inbox
+history, listen, ignore, unlisten, listening, done, status, participants and inbox
 serializes the same SDK result without requesting `observe: true`. Only `observation` is omitted and
 a live Participant handle becomes `{name}`. History returns one JSON document, including an empty
 `activities` array; `history --format` remains human-oriented. `participants --limit` limits only
 human text, not the SDK result. Stream `--ndjson` remains one SDK stream record per line.
 
-MCP/Pi use the shared `square-tools.ts` definitions. All eight tools return only the CLI's rendered text, with no `outputSchema`
+MCP/Pi use the shared `square-tools.ts` definitions. All seven tools return only the CLI's rendered text, with no `outputSchema`
 or `structuredContent`. Join text includes its context and recent activity; express text
 includes landing ID/reach, warnings and bounded unread previews, never the sent body echo
 or internal observation tables. Failures remain failed tool results with readable recovery
@@ -344,7 +410,8 @@ does not migrate files or install a new runtime.
 
 ## SDK breaking migration: opaque owners
 
-Artifact format 7 requires explicit migration of existing format-6 artifacts before opening.
+Artifact format 7 introduced opaque owners; format-6 artifacts required explicit migration before
+opening with that format. Current artifacts use format 8 and require explicit migration from format 7.
 `Body`, `sameBody` and `validateBody` are removed from the core and public API. Replace identity
 objects with an explicit owner at each identity-bearing operation; do not put identity on a resource:
 

package/guides/symmetric-domains.md

@@ -0,0 +1,92 @@
+# Two equal domains, using the public primitives
+
+[`examples/symmetric-domains.mjs`](../examples/symmetric-domains.mjs) is a plain
+ESM installed-package consumer. It imports only Node builtins and
+`@astrosheep/square/attention`, `/receive`, and `/delivery`; it never constructs
+`Square`. Two instances of the **same `Domain` implementation** independently
+originate, receive, present and consume work. Neither is a master or a relay.
+
+## Run from an installed package
+
+In a consumer project with `@astrosheep/square` installed:
+
+```sh
+cp node_modules/@astrosheep/square/examples/symmetric-domains.mjs ./symmetric-domains.mjs
+node ./symmetric-domains.mjs
+```
+
+The script prints a JSON summary. It also exports
+`demonstrateSymmetricDomains()` for programmatic use. The repository's
+`test/package-consumer.test.js` packs the package, copies the shipped example
+into an isolated consumer, runs it there, and asserts the summary. It does not
+substitute repository-relative imports, a second implementation, or path aliases.
+
+## What the demonstration does
+
+1. East originates a message for one local reader and two selected west readers.
+   West independently originates a message for one local reader and two east
+   readers. The static application directory supplies eligibility and destination
+   routing; no primitive parses the recipient spelling.
+2. Each origin commits its local item/audience before any link effect. East uses
+   opaque random string keys; west uses decreasing negative numbers. Every
+   destination assigns its own key. `data.origin` is just application data, not
+   a global cursor, admission key or identity codec.
+3. `resolveAudience` selects recipients; the application maps `{recipient, route}`
+   once to receive's `{recipient, via}` addresses, preserving them locally and
+   across the handoff. Application routing groups that result by destination.
+   One `dispatchEffect` passes **one payload with both selected
+   remote recipients**, not one payload per recipient. Its attempt series is
+   bound to source item + destination + purpose in the source's private store.
+4. East's link returns `accepted` after west admits. West's link deliberately
+   returns `unknown` after east admits. Admission leaves both destination
+   recipients pending. In both directions a second dispatch acquires no claim:
+   the actual stored `accepted`/`unknown` attempt stops replay through
+   `claimAttempt`, not a callback counter or link-level duplicate filter.
+5. Each destination uses `preparePresentation` / `presentPrepared` to present the
+   full payload to its first recipient. Settlement completes that recipient's
+   presentation attempt and calls `recordConsumed` for the captured receipt in
+   **one synchronous transaction**. The other recipient remains pending until
+   separately consumed. Origin receipts are unchanged by destination consumption.
+6. With the link disabled, both domains still admit and consume three local-only
+   messages. Exact consumption of the middle item is repeatable; subsequent
+   one-item pages find the older and newer receipt holes in local insertion order.
+   No remote sink is invoked for this local work.
+
+## Primitive responsibilities and caller obligations
+
+| Primitive | Owns | Example caller supplies |
+|---|---|---|
+| `resolveAudience` | Deterministic attention selection | Eligible directory and explicit routing |
+| `receive` | Item and address insertion | Local IDs, uniqueness, isolation and rollback |
+| `consumeReceived` / `recordConsumed` | Selection/full receipts, first-write-wins coordinates | Ordered reads and recipient + local item receipt storage |
+| `claimAttempt` / `settleAttempt` | Scoped attempt transitions, terminal uncertainty | One transaction-bound series, tokens, lease times and persistence |
+| `dispatchEffect` | Claim/currentness/effect/timeout/settlement lifecycle | Bound port, link callback, pre-send policy and actual deadline enforcement |
+| `preparePresentation` / `presentPrepared` | One-shot custody, sink outcome and settlement | Captured payload, receipt coordinates and atomic completion + receipts |
+
+The memory adapter clones a draft and commits only when its synchronous callback
+returns. A throw discards all changes, including an attempt completion if receipt
+recording fails. It never holds a transaction across an `await`. Each effect claim
+commits before external work; settlement opens a new transaction. Returned rows
+are copied, and the two stores share no mutable state. A real application must
+provide equivalent isolation, fencing, uniqueness and atomic rollback in its own
+storage, plus durability if required. The primitives do not supply a database.
+
+The link obeys `beforeSend()` and checks cancellation/deadline **after** awaiting
+that gate, immediately before admission. A late policy answer is not permission
+to send after timeout. Settlement does not re-check policy after a successful
+sink: it records captured facts without erasing success or selecting new items.
+Public effect reports distinguish callback observation from persistence results.
+
+## Deliberately bounded claims
+
+The adapter is nondurable illustrative memory, and the link is an in-process
+function. `accepted` means destination admission only. Presentation success means
+this example's callback captured the supplied full payload, **not** that a human
+or model read it. Unknown suppresses automatic replay but does not reconcile it;
+this example has no crash recovery, cross-domain transaction, exactly-once effect,
+network protocol, federation, authentication or discovery implementation.
+
+One handoff per destination is a boundary an application **could choose** for
+billing. No charges, billing ledger or payment semantics are implemented here.
+For the underlying contracts, see [attention](attention-primitive.md),
+[receive](receive-primitive.md), and [delivery](delivery-primitives.md).