v0.99.0

Added

• Zero-config trust-on-first-use identity (ownership keystone P-C). The
  first command that connects auto-provisions one Ed25519 keypair for the
  whole machine under $XDG_DATA_HOME/synapse/identity/ (owner-only,
  exclusive-create, race-safe); the production waiter signs its registration
  with it and carries the public half in a new additive identity_public_key
  registration field. A hub running the default loopback posture verifies the
  self-contained proof with the same signed-event primitives the operator
  bundle uses (freshness, replay, sender binding) and pins the name to
  the key on first valid use — durably (synapse hub --identity-pins,
  default ~/synapse/identity-pins.json; empty string keeps pins in
  memory). From then on the name binds only to a connection proving
  possession of the pinned key, across reconnects and hub restarts: a
  different key or a missing signature is refused with close code 4013
  (identity pin mismatch) and a recovery path naming the pin file. Names
  that never sign keep classic first-come semantics, so no existing client
  is locked out, and --require-identity-binding still takes precedence
  with its operator-bundle semantics unchanged. The waiter yields (exit 4)
  on an identity refusal instead of retrying. Provisioning is best-effort: a
  read-only home degrades to an unsigned connection, never a startup
  failure. The 4013 close code is now shared between the capacity refusal
  and identity refusals — clients disambiguate on the reason text
  (is_identity_refused_close).

• Hub-authoritative name-ownership lease (ownership keystone P-B). A name
  now has exactly one owner across reconnects, not merely per socket: a
  registration that declares lease: true on a free name is granted an opaque
  owner_lease token in a directed lease_granted frame (the hub keeps only
  a SHA-256 digest), and while the lease is live any claim on that name must
  present the token or it is refused with the new close code 4016
  (name owned) — the takeover flag does not override it. A claim that
  presents the token still crosses the takeover damping, so the oscillation
  quarantine holds for lease holders too. The lease survives the holder's
  disconnect for --lease-offline-ttl seconds (default 3600, synapse hub
  flag / SynapseHub(lease_offline_ttl=…) / TakeoverDamping), then the name
  self-heals to first-come-first-owned, so a lost token file is a bounded
  wait, never a bricked name. The production waiter opts in end to end:
  synapse wait/arm persist the granted token per connect name under
  ~/synapse/owner-lease/ (atomic, 0600) and present it on every re-arm, so
  a re-arm re-takes its own -rx identity and a stranger cannot squat the
  waiter in the gap — closing the squatting half of the 2026-07-10 identity
  incident class. A refusal is a yield verdict for the waiter (exit 4,
  actionable message), not a retry. SynapseAgent exposes the same opt-in
  (request_lease/owner_lease/on_lease_granted) for any embedder;
  ephemeral one-shot verbs stay classic until the zero-config TOFU keypair
  (P-C) covers every verb uniformly. Fully additive on the wire: a pre-lease
  hub ignores the fields and a pre-lease client is never locked out of its
  own names.

Changed

• Ambient $SYN_IDENTITY is never a silent identity source (ownership
  keystone P-A). It is honoured only when $SYN_PROJECT is also set and
  agrees with its project segment — the pair the shell hook exports together
  is the opt-in. An unqualified syn command in a shell carrying a lone or
  disagreeing SYN_IDENTITY (the borrowed-shell signature behind the
  2026-07-10 directed-delivery incident) now proceeds as the local identity
  and says so on stderr, or refuses (exit 2) when the local fallback also
  looks accidental; syn name reports the dropped ambient identity on an
  ambient: line. Behaviour change for shells that exported only
  SYN_IDENTITY: set SYN_PROJECT alongside it (what
  synapse install-shell-hook already does) or pass --project/--id.
  Pinned end to end against a live hub: the production syn say path in a
  poisoned shell authors as the local project, never as the borrowed name.

• The free tier now carries the ecosystem's standard donation surface: a
  low-key coffee line (Buy Me a Coffee, GitHub Sponsors, PayPal) with the
  canonical branded QR code under assets/bmc_qr.png, the BTC/ETH/LTC
  donation addresses and the TWINT link published at anulum.li, and
  buy_me_a_coffee: anulum joins .github/FUNDING.yml so the repository
  Sponsor button offers it too. Free tier only — paid surfaces stay
  donation-free.

• The footer logos render at one shared height (aspect ratios preserved)
  instead of one shared width, which had drawn them visibly unequal.

• README readability: the dense prose runs — the syn command ergonomics,
  the discovery/advisory-routing surfaces, the A2A bridge description, and
  the eleven security/governance profile paragraphs — are restructured into
  scannable tables, with the profile statuses corrected against the current
  design docs (identity+ACL: implemented in shadow mode with opt-in
  enforcement; policy engine: first tranche implemented, advisory; signed
  events + mTLS: runtime primitives shipped). New section: Beyond one
  machine — SYNAPSE CHANNEL Fleet, a factual description and topology map
  of the commercial multi-machine tier, cross-linked from the
  single-machine limitation and the licensing section.