v0.98.26

Added

• The persistent waiter states its binding out loud: the first line of
  every arm names exactly whose messages it wakes on
  (waiting for messages to <identity>), and when the session
  environment carries a DIFFERENT SYN_IDENTITY a second line says so
  explicitly — ambient env never overrides an explicit name, and the
  mismatch (the classic sign of arming from a borrowed shell) is now
  visible immediately instead of after a night of missed messages.

Fixed

• Mailbox surfacing: a directed message is now either surfaced to the
  operator or stays pending — never silently consumed. A wake prints
  EVERY frame collected in its window (a replay burst previously printed
  only the last frame while the persisted cursor advanced past the whole
  backlog), the persisted resume point covers exactly the surfaced
  frames, and the mailbox cursor/ack no longer advances past a frame the
  wake filter refuses (SynapseAgent gains an optional
  mailbox_advance gate wired to the waiter's own wake predicate).
  Pinned end to end against a live hub with a durable journal, including
  the incident-shaped two-drain regression.
• Waiter identity binding: the SYN_TMUX_PROVIDER session marker now
  suppresses a passive arm/wait ONLY for the session's own
  $SYN_IDENTITY — an explicitly named waiter for a different seat is
  never yielded away. Previously any live provider session made every
  explicit syn-wait --name <other-seat> refuse to arm, so directed
  messages to that seat were lost from the live path while broadcasts
  kept flowing (P0, found live on the coordination fleet 2026-07-10).
  A dedicated regression surface pins the contract end to end against a
  live hub: explicit --name/--for beats ambient environment, the
  ambient identity's own arm still yields to its provider, and a foreign
  provider pidfile or corrupt pidfile never suppresses an explicit arm.
• Federation store durability: the peering store is now written atomically —
  to an owner-only sibling temporary file that is fsynced, renamed into place,
  then followed by a parent-directory fsync — so a power loss can neither leave
  a torn or partial policy behind nor lose a completed write. Loading validates
  every field deny-by-default (store version, record shape, provenance types,
  duplicate domain ids) and raises rather than admitting a partial or ambiguous
  policy, so a malformed store can never silently authorise or drop a peering.
• Identity resolution no longer splits a session across two projects: a
  $SYN_IDENTITY whose project segment disagrees with an explicit
  $SYN_PROJECT (the borrowed-shell signature of the directed-delivery
  incident) is no longer taken verbatim as the identity — since it did not
  supply the project, the identity falls back to the resolved bare project, so
  identity-scoped and project-scoped verbs always follow the same name.