@astrosheep/square 0.4.0 → 0.4.2

package/dist/views.d.ts

@@ -12,8 +12,8 @@ export declare function parseRequiredActivityId(id: ActivityId): number;
 /** History adds archive context and ordering to the shared storage-side query predicates. */
 export declare function selectHistory(facts: SquareRead, query: HistoryQuery, limit: number | null, kinds: ActivityFilter['kinds'], presentation?: boolean): {
     continuation?: HistoryContinuation | undefined;
-    activities: HydratedAct[];
-    visibleActivities: HydratedAct[];
+    activities: import("./model.js").StoredAct[];
+    visibleActivities: import("./model.js").StoredAct[];
     totalMatches: number;
 };
 export declare function publicActivities(activities: readonly ArchiveRecord[]): Activity[];

package/dist/views.js

@@ -16,7 +16,6 @@ export function toPublicActivity(stored) {
     if (stored.kind === 'read')
         throw new Error(`Cannot expose stored activity ${formatActivityId(stored.index)}`);
     return { id: formatActivityId(stored.index), at: stored.at, kind: stored.kind, actor: stored.actor,
-        ...(stored.kind === 'say' && stored.messageIndex !== undefined ? { messageId: `msg/${stored.messageIndex}` } : {}),
         ...(stored.kind === 'say' && stored.reach !== undefined ? { reach: stored.reach } : {}),
         ...('body' in stored && stored.body !== undefined ? { body: stored.body } : {}),
         ...('metadata' in stored && stored.metadata !== undefined ? { metadata: stored.metadata } : {}),

package/dist/wake-sink.d.ts

@@ -1,18 +1,11 @@
-/** One Paseo wake attempt: where it goes, what it says, and what identifies it. */
 export interface PaseoWakeRequest {
     agentId: string;
     prompt: string;
-    location: string;
-    participant: string;
-    message: string;
-    attemptN?: number;
+    messageId: string;
 }
-/**
- * The daemon's own dedup key for one attempt. Every retry of the same attempt
- * derives the same id; a later attempt of the same attention derives a new one.
- */
-export declare function paseoWakeMessageId(request: Pick<PaseoWakeRequest, 'location' | 'participant' | 'message' | 'attemptN'>): string;
-/** Steer one existing Paseo agent through the shared delivery entry. Never interrupts a turn. */
+/** Steer one existing Paseo agent, without interrupting its turn. */
 export declare function sendPaseoWake(request: PaseoWakeRequest, opts?: {
     timeoutMs?: number;
+    beforeSend?: () => Promise<boolean>;
+    signal?: AbortSignal;
 }): Promise<void>;

package/dist/wake-sink.js

@@ -1,37 +1,13 @@
-import { createHash } from 'node:crypto';
 import { DeliveryError, connect } from './packages/agent-delivery/src/index.js';
-/**
- * The daemon's own dedup key for one attempt. Every retry of the same attempt
- * derives the same id; a later attempt of the same attention derives a new one.
- */
-export function paseoWakeMessageId(request) {
-    const digest = createHash('sha256')
-        .update([request.location, request.participant, request.message, request.attemptN ?? 0].join('|'))
-        .digest('hex');
-    return `square-${digest.slice(0, 32)}`;
-}
-/** Steer one existing Paseo agent through the shared delivery entry. Never interrupts a turn. */
+/** Steer one existing Paseo agent, without interrupting its turn. */
 export async function sendPaseoWake(request, opts = {}) {
-    const budgetMs = opts.timeoutMs;
-    // A usable budget becomes one deadline both phases share; anything else is an
-    // argument error, so it is handed to the entry untouched to classify.
-    const bounded = budgetMs !== undefined && Number.isFinite(budgetMs) && budgetMs > 0;
-    const deadline = bounded ? Date.now() + budgetMs : 0;
-    // An elapsed budget never reached the daemon, so it is the shared entry's own
-    // "unavailable" failure rather than a send error of its own.
-    const connectMs = bounded ? Math.max(0, deadline - Date.now()) : budgetMs;
-    if (bounded && connectMs === 0)
+    const budget = opts.timeoutMs;
+    const deadline = budget === undefined ? undefined : Date.now() + budget;
+    if (deadline !== undefined && (!Number.isFinite(budget) || budget <= 0))
         throw new DeliveryError('unavailable');
-    const agent = await connect({
-        harness: 'paseo',
-        agentId: request.agentId,
-        ...(connectMs === undefined ? {} : { timeoutMs: connectMs }),
-    });
-    const steerMs = bounded ? Math.max(0, deadline - Date.now()) : budgetMs;
-    if (bounded && steerMs === 0)
+    const agent = await connect({ harness: 'paseo', agentId: request.agentId, ...(budget === undefined ? {} : { timeoutMs: budget }), signal: opts.signal });
+    if (opts.signal?.aborted || (deadline !== undefined && Date.now() >= deadline))
         throw new DeliveryError('unavailable');
-    await agent.steer(request.prompt, {
-        id: paseoWakeMessageId(request),
-        ...(steerMs === undefined ? {} : { timeoutMs: steerMs }),
-    });
+    const remaining = deadline === undefined ? undefined : deadline - Date.now();
+    await agent.steer(request.prompt, { id: request.messageId, ...(remaining === undefined ? {} : { timeoutMs: remaining }), signal: opts.signal, beforeSend: opts.beforeSend });
 }

package/dist/wake-transports.d.ts

@@ -1,7 +1,4 @@
-import type { WakeRouteKind } from './channel-values.js';
-import type { WakeTransportPort } from './channel-transport.js';
-export type WakeTransports = Readonly<Partial<Record<WakeRouteKind, WakeTransportPort>>>;
-/** Concrete transports use wall time; semantic state time belongs to Square operations. */
-export declare function createDefaultWakeTransport(env?: NodeJS.ProcessEnv, suppliedTransports?: WakeTransports): Promise<WakeTransportPort>;
-/** Route selection only: all implementations receive the same request and final gate. */
-export declare function createWakeTransport(transports: WakeTransports): WakeTransportPort;
+import type { DeliveryTransport } from './delivery-ledger.js';
+export type WakeTransports = readonly DeliveryTransport[];
+/** Claude now receives only at native hooks; producers never target a socket. */
+export declare function createDefaultDeliveryTransports(env?: NodeJS.ProcessEnv): Promise<WakeTransports>;

package/dist/wake-transports.js

@@ -1,42 +1,10 @@
-/** Concrete transports use wall time; semantic state time belongs to Square operations. */
-export async function createDefaultWakeTransport(env = process.env, suppliedTransports) {
-    if (suppliedTransports !== undefined)
-        return createWakeTransport(suppliedTransports);
-    const transports = {};
-    try {
-        const { CodexQueueTransport } = await import('./codex-queue.js');
-        transports['codex-queue'] = new CodexQueueTransport({ env });
-    }
-    catch { /* core-only builds may omit Codex */ }
+/** Claude now receives only at native hooks; producers never target a socket. */
+export async function createDefaultDeliveryTransports(env = process.env) {
+    const { HttpWakeTransport } = await import('./http-delivery.js');
+    const transports = [new HttpWakeTransport({ env })];
     if (env.SQUARE_DISABLE_PASEO_WAKE !== '1') {
-        try {
-            const { PaseoWakeTransport } = await import('./paseo-delivery.js');
-            transports.paseo = new PaseoWakeTransport();
-        }
-        catch { /* Paseo is optional */ }
+        const { PaseoWakeTransport } = await import('./paseo-delivery.js');
+        transports.push(new PaseoWakeTransport());
     }
-    const { createClaudeWakeTransport } = await import('./claude-transport.js');
-    transports['claude-native'] = createClaudeWakeTransport(env);
-    const { HttpWakeTransport } = await import('./http-delivery.js');
-    transports.http = new HttpWakeTransport({ env });
-    return createWakeTransport(transports);
-}
-/** Route selection only: all implementations receive the same request and final gate. */
-export function createWakeTransport(transports) {
-    const missing = (kind) => ({ outcome: 'not-capable', diagnostic: `no transport for ${kind}` });
-    return {
-        async probe(route) {
-            const transport = transports[route.kind];
-            if (transport === undefined)
-                return missing(route.kind);
-            try {
-                return await transport.probe?.(route) ?? true;
-            }
-            catch (error) {
-                return { outcome: 'not-capable', diagnostic: error instanceof Error ? error.message : String(error) };
-            }
-        },
-        attempt: (request, timeoutMs, beforeSend) => transports[request.route.kind]?.attempt(request, timeoutMs, beforeSend)
-            ?? Promise.resolve(missing(request.route.kind)),
-    };
+    return transports;
 }

package/examples/symmetric-domains.mjs

@@ -1,250 +1,30 @@
-import { randomUUID } from 'node:crypto';
-import { realpathSync } from 'node:fs';
-import { pathToFileURL } from 'node:url';
-import { resolveAudience } from '@astrosheep/square/attention';
-import { receive, consumeReceived, recordConsumed } from '@astrosheep/square/receive';
-import { claimAttempt, settleAttempt, dispatchEffect, preparePresentation, presentPrepared } from '@astrosheep/square/delivery';
-
-// Application routing fixture, not discovery or a core identity format.
-const directory = new Map([
-  ['e/author', 'east'], ['e/reader', 'east'], ['e/other', 'east'],
-  ['w/author', 'west'], ['w/reader', 'west'], ['w/other', 'west'],
-]);
-
-// One structural ReceiveWrite adapter. Array insertion order is local order;
-// opaque item keys are only compared for equality, never parsed or sorted.
-function receiveStore(state) {
-  const tx = {
-    insertItem({ key, data }) {
-      if (state.items.has(key)) throw new Error('duplicate item');
-      state.items.set(key, structuredClone(data));
-    },
-    insertAddress(key, address) {
-      if (tx.addressed(address.recipient, key)) throw new Error('duplicate address');
-      state.addresses.push({ key, ...address });
-    },
-    heads(recipient, query, { unconsumed, limit }) {
-      return state.addresses.filter(row => row.recipient === recipient
-        && (!query.via || row.via === query.via)
-        && (!unconsumed || !tx.receipt({ recipient, item: row.key }))).slice(0, limit);
-    },
-    addressed: (recipient, key) => state.addresses.find(row => row.recipient === recipient && row.key === key),
-    load: keys => new Map(keys.filter(key => state.items.has(key)).map(key => [key, state.items.get(key)])),
-    count: (recipient, query, unconsumed) => tx.heads(recipient, query, { unconsumed, limit: Infinity }).length,
-    receipt: ({ recipient, item }) => state.receipts.get(recipient)?.get(item),
-    insertReceipt({ recipient, item }, at) {
-      if (!state.receipts.has(recipient)) state.receipts.set(recipient, new Map());
-      const receipts = state.receipts.get(recipient);
-      if (receipts.has(item)) return false;
-      receipts.set(item, { at });
-      return true;
-    },
-  };
-  return tx;
-}
-
-// A tiny illustrative consumer, NOT a storage backend or durable runtime.
-class Domain {
-  #state = { items: new Map(), addresses: [], receipts: new Map(), series: [] };
-
-  constructor(name, nextKey) {
-    this.name = name;
-    this.nextKey = nextKey;
-  }
-
-  transaction(change) {
-    const draft = structuredClone(this.#state);
-    const result = change(draft, receiveStore(draft));
-    if (result instanceof Promise) throw new Error('no awaits inside memory transactions');
-    // A throw above discards the draft. No capability or mutable row escapes.
-    const captured = structuredClone(result);
-    this.#state = draft;
-    return captured;
-  }
-
-  originate(actor, mentions, text) {
-    // Attention names its route; receive stores that application route as via.
-    const audience = resolveAudience({ actor, recipients: [...directory.keys()], mentions })
-      .map(({ recipient, route }) => ({ recipient, via: route }));
-    const key = this.nextKey();
-    const data = { text, origin: { domain: this.name, key } };
-    this.transaction((_state, tx) => receive(tx, {
-      item: { key, data }, audience: audience.filter(a => directory.get(a.recipient) === this.name),
-    }));
-    const outgoing = new Map();
-    for (const address of audience) {
-      const destination = directory.get(address.recipient);
-      if (destination === this.name) continue;
-      if (!outgoing.has(destination)) outgoing.set(destination, []);
-      outgoing.get(destination).push(address);
-    }
-    return { key, data, outgoing };
-  }
-
-  admit(data, audience) {
-    const key = this.nextKey(); // Destination owns this identity, not origin.key.
-    this.transaction((_state, tx) => receive(tx, {
-      item: { key, data }, audience,
-    }));
-    return key;
-  }
-
-  // Captured item/target/purpose are application coordinates, not an encoded key.
-  // For dispatch target is a destination; for presentation it is one recipient.
-  effectPort(purpose, item, target, fullReceipts = []) {
-    const rows = state => {
-      let series = state.series.find(s => s.purpose === purpose && s.item === item && s.target === target);
-      if (!series) {
-        series = { purpose, item, target, attempts: new Map() };
-        state.series.push(series);
-      }
-      return {
-        list: () => structuredClone([...series.attempts.values()].sort((a, b) => b.ordinal - a.ordinal)),
-        byToken: token => structuredClone(series.attempts.get(token)),
-        insert: row => { series.attempts.set(row.token, structuredClone(row)); },
-        replace: row => { series.attempts.set(row.token, structuredClone(row)); },
-      };
-    };
-    const current = (state, tx) => state.items.has(item) && (purpose === 'dispatch'
-      || Boolean(tx.addressed(target, item)) && !tx.receipt({ recipient: target, item }));
-    return {
-      claim: async () => this.transaction((state, tx) => {
-        if (!current(state, tx)) return undefined;
-        const claim = claimAttempt(rows(state), {
-          purpose, token: randomUUID(), at: Date.now(), leaseMs: 30_000, data: {},
-        });
-        return claim.status === 'acquired' ? { token: claim.token, ordinal: claim.ordinal } : undefined;
-      }),
-      current: async () => this.transaction(current),
-      settle: async (claim, completion) => this.transaction((state, tx) => {
-        const recorded = settleAttempt(rows(state), {
-          token: claim.token, outcome: completion.outcome, at: Date.now(), data: completion,
-        });
-        // ONE commit: attempt completion plus captured full-consumption receipts.
-        // No post-effect cancellation/currentness veto and no re-selection.
-        if (recorded && completion.outcome === 'presented') recordConsumed(tx, fullReceipts, Date.now());
-        return recorded;
-      }),
-    };
-  }
-
-  consume(recipient, selection) {
-    return this.transaction((_state, tx) => consumeReceived(tx, recipient, selection, Date.now()));
-  }
-
-  pending(recipient) {
-    return this.transaction((_state, tx) => tx.heads(recipient, {}, { unconsumed: true, limit: Infinity }).map(h => h.key));
-  }
-
-  receipts() {
-    return this.transaction(state => [...state.receipts].flatMap(([recipient, items]) =>
-      [...items].map(([item, { at }]) => ({ recipient, item, at }))));
-  }
-
-  attempts() {
-    return this.transaction(state => state.series.map(({ purpose, item, target, attempts }) =>
-      ({ purpose, item, target, outcomes: [...attempts.values()].map(a => a.outcome) })));
-  }
-
-  async present(recipient, item, sink) {
-    const payload = this.transaction((_state, tx) => {
-      if (!tx.addressed(recipient, item)) throw new Error('not addressed');
-      return tx.load([item]).get(item);
-    });
-    const prepared = await preparePresentation({
-      payload, coverage: 'full',
-      port: this.effectPort('presentation', item, recipient, [{ recipient, item }]),
-    });
-    return prepared ? presentPrepared(prepared, sink) : undefined;
-  }
-}
-
-export async function demonstrateSymmetricDomains() {
-  // Same implementation, truly separate stores and unrelated key spaces.
-  let westKey = -700;
-  const east = new Domain('east', () => `opaque?${randomUUID()}`);
-  const west = new Domain('west', () => westKey--);
-  const domains = new Map([['east', east], ['west', west]]);
-  const handoffs = [];
-  let online = true;
-
-  async function sendAll(source, message, mode = 'accepted') {
-    const reports = [];
-    for (const [destination, audience] of message.outgoing) {
-      const report = await dispatchEffect(source.effectPort('dispatch', message.key, destination), async context => {
-        if (!await context.beforeSend()) return { outcome: 'not-capable' };
-        // A final policy gate may finish after the runner's timeout. Never mutate
-        // the destination after our deadline or cancellation, even if it said yes.
-        if (context.signal?.aborted || Date.now() >= context.deadline) return { outcome: 'not-capable' };
-        if (!online) return { outcome: 'failed' }; // Known no-send in this in-process fixture.
-        const key = domains.get(destination).admit(message.data, audience);
-        handoffs.push({ from: source.name, to: destination, key, audience: structuredClone(audience) });
-        // Unknown deliberately happens AFTER admission. This is not a dedup protocol.
-        return { outcome: mode, data: { destinationKey: key } };
-      }, { timeoutMs: 1000 });
-      reports.push(report);
-    }
-    return reports;
-  }
-
-  const eastMessage = east.originate('e/author', ['e/reader', 'w/reader', 'w/other'], 'East says hello');
-  const westMessage = west.originate('w/author', ['w/reader', 'e/reader', 'e/other'], 'West says hello');
-  // Establish origin receipts before destination presentation: neither can overwrite the other.
-  east.consume('e/reader', { kind: 'exact', key: eastMessage.key, remainingQuery: {} });
-  west.consume('w/reader', { kind: 'exact', key: westMessage.key, remainingQuery: {} });
-
-  const exchanges = [];
-  for (const [source, destination, message, mode, first, second] of [
-    [east, west, eastMessage, 'accepted', 'w/reader', 'w/other'],
-    [west, east, westMessage, 'unknown', 'e/reader', 'e/other'],
-  ]) {
-    const [report] = await sendAll(source, message, mode);
-    const destinationKey = report.settlement.completion.data.destinationKey;
-    const admission = [destination.pending(first), destination.pending(second)];
-    const originReceiptsBefore = source.receipts();
-    const output = [];
-    // The sink proves only that this example callback captured the full payload.
-    const presentation = await destination.present(first, destinationKey, payload => { output.push(payload); });
-    const afterPresentation = [destination.pending(first), destination.pending(second)];
-    const presentationReceipts = destination.receipts().filter(ref => ref.item === destinationKey);
-    const originReceiptsAfter = source.receipts();
-    const exact = { kind: 'exact', key: destinationKey, remainingQuery: {} };
-    const unmatched = destination.consume(second, { kind: 'page', query: { via: 'bell' }, limit: 1 });
-    const consumed = destination.consume(second, { kind: 'page', query: { via: 'mention' }, limit: 1 });
-    const repeated = destination.consume(second, exact);
-    const handoffsBeforeReplay = handoffs.length;
-    const [replay] = await sendAll(source, message, mode);
-    exchanges.push({
-      from: source.name, to: destination.name, sourceKey: message.key, destinationKey,
-      dispatch: report, admission, presentation, output, afterPresentation, presentationReceipts,
-      originReceiptsBefore, originReceiptsAfter, unmatched, consumed, repeated, replay,
-      handoffsBeforeReplay, handoffsAfterReplay: handoffs.length,
-    });
-  }
-
-  online = false;
-  const handoffsBeforeOffline = handoffs.length;
-  const offline = [];
-  for (const [domain, author, recipient] of [[east, 'e/author', 'e/reader'], [west, 'w/author', 'w/reader']]) {
-    const messages = [];
-    for (const text of ['oldest', 'middle', 'newest']) {
-      const message = domain.originate(author, [recipient], text);
-      messages.push(message);
-      await sendAll(domain, message); // Local work has no remote destination at all.
-    }
-    const exact = { kind: 'exact', key: messages[1].key, remainingQuery: {} };
-    const middle = domain.consume(recipient, exact);
-    const repeated = domain.consume(recipient, exact);
-    const page = () => domain.consume(recipient, { kind: 'page', query: { via: 'mention' }, limit: 1 });
-    offline.push({ domain: domain.name, keys: messages.map(m => m.key), middle, repeated, pages: [page(), page()] });
-  }
-  return {
-    exchanges, handoffs, offline, handoffsBeforeOffline, handoffsAfterOffline: handoffs.length,
-    attempts: { east: east.attempts(), west: west.attempts() },
-    receipts: { east: east.receipts(), west: west.receipts() },
-  };
-}
-
-if (process.argv[1] && import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href) {
-  console.log(JSON.stringify(await demonstrateSymmetricDomains(), null, 2));
+// A producer notice and its receiver's ledger presentation, using a disposable square.
+import { mkdtemp, rm } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { Square } from '@astrosheep/square';
+import { DeliveryLedger } from '@astrosheep/square/delivery-ledger';
+
+const directory = await mkdtemp(path.join(os.tmpdir(), 'square-notice-example-'));
+const ledgerPath = path.join(directory, 'delivery.sqlite');
+const env = { ...process.env, SQUARE_DELIVERY: ledgerPath };
+let square, ledger;
+try {
+  square = await Square.build({ path: path.join(directory, 'example.square'), markdown: 'Example', env });
+  ledger = await DeliveryLedger.open({ location: ledgerPath });
+  await square.join('Reader', { owner: 'example:reader' });
+  const notice = await square.send({
+    from: 'Coordinator', to: 'Reader', body: 'The work is ready.', metadata: { job: { id: 7 } },
+  });
+  const session = await ledger.session('example:reader');
+  const claim = await ledger.claimPresentation('example:reader', { generation: session.generation, budgetChars: 10000 });
+  if (!claim) throw new Error('No card was available for presentation');
+  // This callback represents the receiver actually presenting the card.
+  const presented = claim.cards.map(card => card.text);
+  await claim.settle('presented');
+  console.log(JSON.stringify({ notice, presented, receipts: await ledger.receipts('example:reader') }, null, 2));
+} finally {
+  await square?.close();
+  await ledger?.close();
+  await rm(directory, { recursive: true, force: true });
 }

package/guides/change-waits.md

@@ -1,57 +1,17 @@
 # Waiting for changes
 
-Artifact revisions and the rebuildable discovery index drive change detection. Filesystem
-notifications are hints, not activity delivery or consumption receipts.
+Filesystem notifications are hints, not activity delivery or receipts. Artifact revision observation
+and reconciliation let catch and stream reconsider changes even if a filesystem event is missed;
+subscribers retain independent cancellation and deadlines. Throttling waits for its eligibility time.
+There is no discovery index and no daemon or per-message timer.
 
-- A process shares a revision reader per canonical artifact and a filesystem watcher per containing
-  directory. Subscribers have independent baselines, deadlines and cancellation. The final release
-  closes the watcher, reconciliation timer and outstanding read.
-- Directory notifications invalidate lightweight reads. A two-second reconciliation checks revisions
-  even when notifications are missing. Missing directories, unsupported watches, watcher failures
-  and directory replacement retain that fallback. Latency is not a hard guarantee: a missed hint
-  may wait for reconciliation, scheduling and lock contention.
-- Conversation revision controls the pending-content cache. Delivery revision separately invalidates
-  eligibility, including delivery evidence, cancellation and deferral writes. Projections resolve
-  current typed seats and selected bodies in one coherent artifact read; they never grant authority
-  from an index entry or a cached eligibility decision. No sidecar, broker or second delivery store
-  is introduced. An unreadable candidate cannot authorize cached content.
-- Each active session pending observer subscribes before selecting current candidates and facts,
-  including when no seat is yet discoverable. Index publication can wake discovery without an
-  artifact write. A failed injection waits for substantive change; its own failed evidence write
-  does not cause a retry loop.
-- Deferral create/renew/release and opportunistic pruning change delivery revision, not conversation
-  activity. Release rechecks eligibility without a new message. Expiry needs no synthetic write:
-  the observer includes the earliest relevant matching live deferral expiry in its existing wait
-  deadline, alongside catch-lease expiry/staleness. Overlapping leases remain OR; an early expiry
-  rechecks the remaining live leases. Renewal changes that deadline without self-triggered delivery.
-- There is no new daemon or detached per-message timer. A one-shot producer skips deferred work and
-  returns promptly. An existing active delivery observer will reconsider release/expiry; absent an
-  observer, pending work waits for the next normal delivery opportunity. A lease does not create a
-  process that was not already running.
-- Blocking catch waits for conversation revision or its heartbeat/quiet deadline. An active catch keeps
-  its single lease alive and pauses quiet expiry. Core catch and streams use the same storage change
-  detector. Throttling waits for its eligibility time.
-- Deferrals are independent of catch filters, presentation claims, full-delivery seen receipts,
-  clipped previews and session-local cancellation. Sharing storage detection does not share session
-  delivery state. Cancellation never creates a receipt or removes archive history. A deferral cannot
-  recall a send already past its final freshness check.
+ACK and export ownership serialize with insertion in producer storage; exact future ACK prevents a
+matching late insertion from bypassing it, but cannot recall an already owned export. Cancellation
+does not erase history or imply that activity was read. Proactive delivery suppression belongs in the
+host delivery ledger; see [delivery-primitives.md](delivery-primitives.md).
 
-## Verification
-
-Run all tests with the sandbox import; never attach synthetic participants to a live harness identity.
-
-```sh
-npm test
-npm run test:cli-process
-node --import ./test/sandbox-env.js scripts/benchmark-idle-wait.mjs --workers 100 --mode poll200
-node --import ./test/sandbox-env.js scripts/benchmark-idle-wait.mjs --workers 100 --mode events
-node --import ./test/sandbox-env.js scripts/benchmark-idle-wait.mjs --workers 300 --mode session
-node --import ./test/sandbox-env.js scripts/benchmark-idle-wait.mjs --workers 300 --mode session --active --no-hints
-```
-
-The benchmark creates disposable synthetic history. Process-local sharing does not deduplicate
-monitors across processes. Timings measure committed-write-to-projection latency, not native
-message landing, and discovery deadlines are probe bounds rather than an SLA. Historical benchmark
-evidence may describe older HostLedger implementations; it is not current custody authority.
-A long-running extension must reload upgraded code before using the new artifact format; this
-delivery does not install or restart one.
+At the next normal privileged posting opportunity, already-posted eligible keys can be dispatched
+again without reinserting cards or resetting producer state. Ledger attempts exclude accepted, unknown
+and presented work; only never-attempted or known-unsent failed/released work can proceed. No new
+scheduler or Stop watcher is needed. See [square-api.md](square-api.md) for bounded recovery of
+abandoned export ownership.