v0.99.18

Added

• Close a universal-receipt read-side omission for four existing durable audit
  families: content-minimized claim and guard denials, dead-letter escalation,
  and identity-pin reclaim decisions now retain their real log anchors in event
  query, dashboard, and cockpit feeds. Every declared durable EventKind is
  exhaustively classified as receipt-bearing or intentionally non-receipt so a new kind
  cannot silently disappear from evidence queries.
• Publish a machine-checked registry for six hostile coordination-invariant
  boundaries. It links normative guarantees to executable evidence, labels
  residual gaps as partial, and keeps both commit and release freshness gates
  red on stale generated evidence without treating ordinary coverage as proof.
• Add deterministic bounded exploration over the real claim, scope, epoch,
  version, handoff, and expiry state machine so every trace through depth four
  complements randomized property and fault-injection evidence.
• Prevent a superseded heartbeat handler from resuming after a second takeover
  and overwriting the winning agent_sockets entry with its stale socket.
  Exercise the fix with two independent client processes released by one
  barrier and require a stable one-owner registry bijection.
• Bind the conformance registry to existing hostile partition and restart
  evidence: contested namespaces refuse, failed rounds cannot false-heal, and
  only verified recovery clears durable suspicion.
• Expose payload-free unresolved conflict objects when the latest observed task
  snapshots from different hubs diverge. Equal snapshots converge without a
  conflict; the display remains non-authoritative and explicitly non-causal.
• Add optional content-bound causal parents to task declarations and updates.
  The observed multi-hub fold verifies the named parent event's identity,
  fingerprint, and task id, removes only proven ancestors from the conflict
  heads, and prefers a unique causal head over a clock-ahead ancestor. Missing,
  malformed, or mismatched parents remain visible and cannot suppress a
  divergent contender; unresolved heads are not mislabeled as concurrent.

Changed

• Make accepted recall-log and finding writes apply once when the typed client
  supplies idem_key. A journal-backed hub commits the memory event, exact
  acknowledgement or recorded verdict, request digest, and evidence intent in
  one FULL-synchronous transaction; identical retries replay after restart and
  changed payloads fail value-free. Finding quota now publishes only after the
  event commit, so a failed append cannot consume live admission capacity.
• Extend the keyed operator-relay boundary to two-person mode. Pending approval
  and its audit now publish together through the shared mutation actor; a
  quorum-completing request atomically clears approval state, releases the
  lease, commits exact response/evidence, and publishes both live projections.
  Keys are bound to the verified federation principal so a serving-grant
  reassignment under the same sender label cannot replay the prior principal's
  verdict. Validated pending inbound audits now restore the bounded first-
  principal quorum after restart; malformed or contradictory evidence restores
  nothing. Keyed pending and completed-quorum no-op verdicts also commit their
  exact response and evidence intent, while every retry is reauthorised against
  live peer, scope, and ownership policy. The origin hub's outbound audit
  remains a separate cross-hub effect.
• Make a single-person governed operator relay apply once when it carries
  --idem-key: the owning hub commits the release, inbound provenance, exact
  verdict, and evidence intent together; identical retries replay only after
  fresh peer/scope/ownership authorization, while changed-payload reuse fails
  value-free. Forwarding preserves the key. The origin hub's outbound audit
  remains explicitly outside the owning hub's local transaction.
• Extend the journal-backed apply-once transaction to task-board declare,
  update, and progress writes. Identical keyed retries replay the exact response,
  changed payloads fail without mutation, keyed and unkeyed board writes share
  one serialized publication boundary, and committed release/handoff progress
  now reaches live memory even if the request task is cancelled after commit.
  The typed client and all three synapse task commands expose the stable retry
  key explicitly.
• Extract MCP board, state, manifest, capability-directory, and resource-template
  snapshot queries into a dedicated facade while preserving the public bridge,
  tool, resource, timeout, and correlation contracts.

Fixed

• Finish the WebSocket close handshake for one-shot CLI query and task
  commands before cancelling their listener. Immediate successive commands
  under the same identity no longer race a stale hub name binding or
  transiently consume connection capacity during teardown.
• Bind each federated (hub_id, seq) identity to a canonical full-event
  fingerprint. Conflicting content now freezes the candidate view and cursor,
  durably quarantines a watched peer with payload-free evidence, blocks automatic
  reconnects, and requires an audited new-generation recovery; exact duplicates
  remain idempotent and malformed cursor batches fail before publication.
• Commit receipt-requested directed chat, receipt lifecycle state, and each
  sender notification through one durable delivery aggregate with a stable
  at-least-once outbox. Deferred receipts now survive an offline sender and
  retry on its next authenticated connection without claiming model action.

Artifact checksums (SHA-256)

1392b5693d0146d42cc5e9725448ef20a8afe3d5fc62ff705dbce53595392e1e  synapse_channel-0.99.18-py3-none-any.whl
c8fc00b6c90a2ffbaa583e5c3eca4c2ca589a2d02f78b9170befe5ac1a40032e  synapse_channel-0.99.18.tar.gz
7deff680d950e49c6fc744539182832386c2ca23a314a58a6ad4feeca897bf22  synapse-channel-v0.99.18-sbom.cdx.json