- expiresAt on the envelope (deliverAfter's dual): a drain never
  delivers past it — local-fs and the MCP server claim expired mail
  into processed/ as audit without rendering, the hook skips it after
  claim, Restate drops it (no audit tier). Not a ledger event: the
  sender's obligation stands until its own deadline machinery fires.
  Exposed as expiresAfterSeconds on thread_send (extension + MCP) and
  --expires-in on thread-cli send.
- ext: reserved experiment namespace on the envelope; §6.4 gains a
  must-preserve rule and the "reserved actor over new field over new
  channel" design principle.
- presence: advisory capabilities tokens published by the extension
  (full six-token set), MCP server, and hook; optional wake revive
  recipe from PI_THREAD_WAKE / POSTBOX_WAKE env, with a normative
  code-execution trust caveat in the spec.

Spec is Rev 10; suite 123→127 unit + 17 mcp, tsc/eslint clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DCSuRhaEzAR8jVfU3K44eF