[TheCryptoDonkey]

Latest test-only follow-up ca7fd80 corrects the post-readback oracle: clearing the child still holds confirmation; an already accepted handoff passing e permits the saved room to be confirmed while the whole-operation deadline remains current. All84 owner cases passed across Chromium, Firefox and WebKit. The prior failing CI receipts remain preserved. Production files are byte-identical to b069.

Accepted rendezvous children now remain usable after the short encrypted handoff acceptance deadline, until rotation, revocation, clear/sign-out or protected-state loss. Fresh late replies still refuse. Request, credential, room and invitation expiry and current-child guards remain enforced; no automatic reprovisioning or new authority is added.

Latest candidate b069dba includes main 0eb82a2. 71 focused units, 15 Bark/retained Chromium cases, 37 existing focused room/join cases plus one corrected new retained-join case in its separate successful run; typecheck and production build passed. This is component/composition evidence; updated-head hosted CI is separate.

The experimental browser invitation profile now supports the first-party Bark route instead of requiring a direct bunker account. The app owns a target transport key inside its witnessed protected persona/installation state and passes only its public key to Bark's typed provisionRendezvousV1 operation. It verifies the exact original account, target, index, nonce and expiry before unsealing Heartwood's child-key NIP44 response into the existing encrypted child vault. Provider/account changes, uncertain target ACK and unavailable witness results hold; no Bark client key, root key, generic RPC or generic secret getter is exposed.

The actual development owner and panel expose the explicit handoff and use opaque proven public-device custody for room operations. Direct bunker custody remains supported. Sign-out and account changes invalidate the captured provider and retained work.

This draft retains the complete invitation ceremony, protected response/adoption recovery, independent keeper registration receipt and member-only Add, messages and all-current-member Remove, including creator removal. It also retains the prior private keeper request/permission/sender controls. Production MLS remains disabled.

The invitation adapter selection no longer adds an early witness transaction before the existing admission lock. Development mode uses one exact adapter instance for both profiles; the protected room metadata selects the profile opener, with an explicit hold when the invitation flag is off. This restores legacy lock ordering and offline refusal without weakening either assertion.

Validation:

• At the prior handoff candidate 9130c75: 10 new actual Chromium cases passed for protected target-key/child handoff, actual custody and room creation, late/binding/offline refusal, lost target ACK recovery and legacy/invitation coexistence. These use a synthetic typed Bark provider, not the built extension.
• Three existing direct-bunker cancellation/expiry/foreground custody cases passed; six invitation lifecycle cases passed at the final frozen commit.
• The original two hosted ordering/offline failures passed with unchanged assertions on Chromium, Firefox and WebKit: six targeted checks. Failed prior-head CI receipts remain retained; current-head hosted CI is separate.
• Full typecheck, both exact WASM pin verifiers and production PWA build with both MLS preview flags false passed; telemetry check passed.

Includes current main 0eb82a2 and private-read work #572. Requires forgesworn/bark#63, forgesworn/vennel#315, and forgesworn/bothy-node#121/#122 for the corresponding real signer/node paths. Android counterpart is forgesworn/kithmoot-android#329.

Development only; keep draft. The actual built Bark-extension/app composition, complete native Link/Bothy mixed-client journey, physical Bark/Cambium/Heartwood acceptance, measured live relay metadata and independent security review remain unproven. The current app demo is single-home. Arbitrary jointly restored backups remain outside the selected profile. No production activation or deployment is included.