Merge pull request 'TS write-receipt client against the real Rust and C# receipt servers (interop harness)' (#67) from libby/write-receipt-ts-interop into main

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

contracts/cultnet/cultnet-distributed-database.md

@@ -115,6 +115,7 @@ copies), the C# `CultNetErrorMessage` factory, the Rust `CultNetErrorCode`, and
 `unowned_schema` (a write, or a remote put or delete, for a schema and key no shard owns),
 `write_not_authorized` (a peer's put or delete its server's remote write authority did not grant) and
 `unsupported_schema_version` (a message whose `schemaVersion` the peer does not speak; `details` names `schemaVersion` and the offered value) and
+`limit_reached` (a receipt-capable server's per-session remembered-write table is full, so a new write is refused; `details` all null) and
 `message_invalid` (a request that lacks a required field or carries an ill-typed one: a document-put or delete, or a subscription without an id; `details.field` names the request field, or `message` when the whole frame cannot be read).
 A malformed put or delete is `message_invalid`, not a per-operation code: the peer knows which operation it sent.
 

contracts/cultnet/interop/cultnet.error.v1.schema.json

@@ -0,0 +1,122 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/GameCult/CultLib/contracts/cultnet/interop/cultnet.error.v1.schema.json",
+  "title": "CultNet Error Message v1",
+  "description": "cultnet.error.v0 plus messageId (write-receipt.md). Sent in place of cultnet.error.v0 only to a connection that declared the write-receipt capability. v0 is unchanged: its schema is closed (additionalProperties false), so an extra key would make a v0 peer reject the frame instead of ignoring it. Map-mode: every key is written, messageId nil when the error answers no readable message. The code enum is the v0 enum plus limit_reached (write-receipt.md, Remembered-write limits).",
+  "type": "object",
+  "required": [
+    "schemaVersion",
+    "error",
+    "routingHint",
+    "code",
+    "details",
+    "messageId"
+  ],
+  "additionalProperties": false,
+  "properties": {
+    "schemaVersion": {
+      "const": "cultnet.error.v1"
+    },
+    "error": {
+      "type": "string",
+      "minLength": 1
+    },
+    "routingHint": {
+      "description": "Optional shard routing detail for an authority failure. Null for every selection/cursor refusal code (R-N).",
+      "type": [
+        "object",
+        "null"
+      ],
+      "additionalProperties": false,
+      "required": [
+        "shard",
+        "reason"
+      ],
+      "properties": {
+        "shard": {
+          "type": [
+            "object",
+            "null"
+          ]
+        },
+        "reason": {
+          "type": "string"
+        }
+      }
+    },
+    "code": {
+      "description": "Machine-readable refusal code (R-N). Additive: a v0 peer that does not know this field ignores it. The set is a closed enum: Rust and TypeScript refuse a message whose code is not listed, so adding a code is one coordinated change across every runtime (this schema, the C# factory, the Rust CultNetErrorCode, and a captured-bytes case for each). limit_reached: a receipt-capable server refuses a NEW write because its per-session remembered-write table (1024 entries) or its server-wide memory budget is full; messageId is the write's id.",
+      "type": [
+        "string",
+        "null"
+      ],
+      "enum": [
+        null,
+        "selection_invalid",
+        "cursor_stale",
+        "cursor_invalid",
+        "reference_outside_target",
+        "variant_unsupported",
+        "unowned_schema",
+        "write_not_authorized",
+        "unsupported_schema_version",
+        "message_invalid",
+        "limit_reached"
+      ]
+    },
+    "details": {
+      "description": "Code-specific structured detail (R-N). Every field is populated only for the code that defines it; the others are null, not omitted.",
+      "type": [
+        "object",
+        "null"
+      ],
+      "additionalProperties": false,
+      "required": [
+        "field",
+        "value",
+        "asOf",
+        "current"
+      ],
+      "properties": {
+        "field": {
+          "description": "selection_invalid: the selection field that failed. variant_unsupported: \"subscriptionId\", when a subscription was ended. unowned_schema: \"schemaId\". write_not_authorized: \"recordKey\". unsupported_schema_version: \"schemaVersion\". message_invalid: the request field that is missing or ill-typed (\"message\" when the whole frame cannot be read). limit_reached: no field; details stay all null. message_invalid also names \"messageId\" (over 256 bytes), \"document\", \"schemaId\" or \"channel\" (write on an unreliable channel).",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "value": {
+          "description": "selection_invalid: the offending value, when there is one string worth naming. variant_unsupported: the id of the subscription that ended. unowned_schema: the schema id no shard owns. write_not_authorized: the key of the refused write. unsupported_schema_version: the schemaVersion the peer does not speak.",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "asOf": {
+          "description": "cursor_stale: the cursor's own minted asOf.",
+          "type": [
+            "integer",
+            "null"
+          ],
+          "minimum": 0
+        },
+        "current": {
+          "description": "cursor_stale: the answering server's current asOf.",
+          "type": [
+            "integer",
+            "null"
+          ],
+          "minimum": 0
+        }
+      }
+    },
+    "messageId": {
+      "description": "The messageId of the write (or other request) this error answers, echoed byte for byte. Null only when the frame was unreadable or carried no messageId.",
+      "type": [
+        "string",
+        "null"
+      ],
+      "minLength": 1
+    }
+  }
+}

contracts/cultnet/interop/cultnet.write-admitted.schema.json

@@ -0,0 +1,16 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/GameCult/CultLib/contracts/cultnet/interop/cultnet.write-admitted.schema.json",
+  "title": "CultNet Write Admitted",
+  "description": "The receipt for one admitted document put or delete (write-receipt.md). Sent only after the write's commit point, only to a connection that declared the write-receipt capability, once per messageId. Map-mode: every key is written, none is nil. A receipt never carries an error, and an error.v1 never carries admission.",
+  "type": "object",
+  "required": ["schemaVersion", "messageId", "operation", "schemaId", "recordKey"],
+  "additionalProperties": false,
+  "properties": {
+    "schemaVersion": { "const": "cultnet.write_admitted.v0" },
+    "messageId": { "description": "The messageId of the put or delete this admits, echoed byte for byte.", "type": "string", "minLength": 1 },
+    "operation": { "enum": ["put", "delete"] },
+    "schemaId": { "description": "The schemaId of the admitted write, echoed.", "type": "string", "minLength": 1 },
+    "recordKey": { "description": "The recordKey of the admitted write, echoed.", "type": "string", "minLength": 1 }
+  }
+}

contracts/cultnet/interop/write-receipt.md

@@ -0,0 +1,85 @@
+# CultNet write receipt (specification)
+
+Status: specification. No runtime implements it yet; the conformance follow-ups below do.
+Rules: Heimdall's ruling of 2026-11-08 (a write completes on its result frame; an ack or a return is not admission).
+Files here: `cultnet.write-admitted.schema.json`, `cultnet.error.v1.schema.json`, `write-receipt-vectors.json`. They move to `contracts/cultnet/` when the first runtime implements them.
+
+## The problem
+
+A put or delete today has two answers on the wire: nothing (admitted, or the server never read it) and `cultnet.error.v0` (refused, with no id saying which write). A transport ack proves delivery. Clients that completed on the ack, or on a window with no refusal, reported refused writes as done (CultLib #55 to #58 bound this with a result window; this spec replaces the window with an answer).
+
+## Frames
+
+**`cultnet.write_admitted.v0`**: `{ schemaVersion, messageId, operation: "put"|"delete", schemaId, recordKey }`, every key written, none nil. Sent once a put or delete is admitted. The id echoes the write's `messageId` byte for byte; `operation`, `schemaId`, `recordKey` echo the write.
+
+**`cultnet.error.v1`**: `cultnet.error.v0` plus a required `messageId` (string or nil). The code enum is v0's plus `limit_reached` (see Remembered-write limits); `cultnet.error.v1.schema.json` is the authority for the closed set. Sent in place of `error.v0` to a receipt-capable connection. `messageId` is the id of the request the error answers; nil only when the frame was unreadable or carried no id.
+
+Why a new error version and not an extra key on v0: the v0 schema is closed (`additionalProperties: false`) and the TypeScript decoder (Ajv over the closed schemas) rejects unknown keys and unknown `schemaVersion`s, and `parseCultNetMessage` throws on an unknown version; Rust's decoder errors on an unknown version too. Unknown-key tolerance of the Rust, Python and Kotlin error decoders was not checked, so none is assumed, so a surprise key or frame breaks an old client's whole receive path. Old clients are therefore never sent either new frame. This reverses the "old clients ignore it" assumption, which is false for today's decoders.
+
+## Capability: opting in
+
+A connection is receipt-capable when its `cultnet.hello.v0` (sent before its first write; the schema channel is reliable and ordered) lists both `cultnet.write_admitted.v0` and `cultnet.error.v1` in `supportedMessageVersions`. A server MUST NOT send either new frame to any other connection, and answers it exactly as before (no receipt, `error.v0`). A receipt-capable server lists both in its own hello, so a client can tell a legacy server from a receipt server that has not answered yet. A client that sends no hello gets legacy behaviour. A server advertises the two frames in its hello only if it implements the receipt rules end to end.
+
+**The capability changes framing only; it never authorizes.** A hello authenticates nothing and grants nothing: who may write, and which keys, is decided by the server from the transport-authenticated actor exactly as without the capability. Declaring the capability never makes a refused write admitted, never widens an actor's authority, and never changes what a write does; it selects only which frame the answer arrives in.
+
+## Server rules
+
+1. **One answer.** For every put or delete on a receipt-capable connection the server sends exactly one of `write_admitted` or `error.v1`, carrying that write's `messageId`. Never both, never two different answers.
+2. **After the commit point.** `write_admitted` is sent only after the write is committed by the same rule that makes it visible to readers. Receipt of the bytes, parse, or authorisation alone is not admission.
+3. **Id on every refusal.** Every refusal of a write, whatever its code (`write_not_authorized`, `message_invalid`, `unowned_schema`, `unsupported_schema_version`, shard authority errors, ...), is an `error.v1` whose `messageId` is the write's id. When the frame is readable enough to find the id, it is found; `message_invalid` for a missing or ill-typed field still carries the id. Nil only when no id can be read.
+4. **Batches.** There is no batch frame; a batch is N writes, each with its own `messageId`, each answered under rules 1 to 3. A failed batch names its member by that id. A server may not collapse a batch into one answer.
+5. **Identity and idempotent resend.** A `messageId` is unique per authenticated actor and session: the client mints it, never reuses it for different content in that session, and a server never accepts the id of one actor as the id of another. The server's dedupe key is `(actor, messageId)`, where *actor* is the transport-authenticated identity, never a name the hello or the frame claims. Alongside the key it keeps the **content hash** of the write and the answer it gave. The content hash is SHA-256 of the MessagePack array `[operation, schemaId, recordKey, payload]`, where `payload` is the raw document payload as a MessagePack `bin` for a put and nil for a delete (the vectors give worked hashes). **Scope: at least the session.** The key lives for the life of the session it was made in, and a server may bound how many writes it remembers per session (see Remembered-write limits; a server never forgets an id it promised to answer). A server MAY keep the key longer for the same actor, up to `DEDUPE_RETENTION_MS` (10 minutes), but a client MUST NOT rely on it: **a reconnect is a new session, and a resend on the new session is a new write.**
+   - Same key, same content hash, answer was `write_admitted`: answer `write_admitted` again with the same body. The write is not applied twice.
+   - Same key, same content hash, answer was a refusal: the same refusal again.
+   - **Same key, different content hash: refuse `message_invalid` (details `field: "messageId"`) and never re-send the old receipt.** Old receipts are for the old content; showing one for new content would report an unapplied write as admitted. The original write's state is unchanged.
+   - **Id size.** A write's `messageId` is at most 256 bytes of UTF-8. A longer id is refused `message_invalid` (`details.field: "messageId"`, the refusal's `messageId` the id as received, text fixed per Fixed texts) BEFORE anything is remembered: no table entry, no digest, no budget charge. Such a refusal is therefore not replayed from the table; a resend is refused afresh, identically.
+   - **What is remembered.** Per entry a server keeps only fixed-size digests (SHA-256) of the `messageId` and of the content hash, plus the answer (`admitted`, or the refusal's code and details). Memory per entry is bounded independent of id length and payload size. Lookup compares digests.
+   - **Remembered-write limits.** The per-session table holds at most 1024 entries. A server MAY also enforce a server-wide memory budget across all sessions (reference: 32 MiB of remembered entries). A NEW write (a key not already in the table) that would exceed either bound is refused `limit_reached` for that write alone, `messageId` the write's id, `details` all null; the write is not applied and the session continues. A resend of a remembered key is still answered from the table.
+   - **Limit refusals are remembered.** A `limit_reached` refusal is remembered like any other: a resend of the same id and content hash replays `limit_reached`. No slot is freed mid-session, so an id refused at a bound never becomes admitted later in that session (a server at the cap keeps the refused digest pair in a bounded refusal set of at most 1024 per session, outside the entry budget; past it, a further new write is refused `limit_reached` without being remembered, and the session refuses every id it has not seen for the rest of its life, even if a server-wide budget has since freed, so a refusal that was not remembered is never followed by an admission of the same id). The client mints a new id on a new session.
+   - **Required fields.** A put or delete whose document or `schemaId` is null or missing is refused `message_invalid` with `details.field` `"document"` or `"schemaId"` (the first missing in that order) and fixed text; the write is not applied. A put or delete that is present but names nothing is not "missing": the write is refused `message_invalid` exactly as a frame that does not read, with `details.field` `"message"`, the fixed unreadable text and the write's id (vector `error_v1_empty_schema_id_is_unreadable_and_names_the_write`), and is never applied; a server must not hand it to its store. Names nothing means, on a put or delete, a `schemaId` or `recordKey` that is blank; on a put's document, also a `storedAt` that is blank, a `payload` of zero bytes (a MessagePack value is at least one byte, so an empty payload is no document), a `sourceRuntimeId`, `sourceAgentId` or `sourceRole` that is present and blank, and a `tags` entry that is blank. **Blank** means empty or made only of Unicode White_Space code points (the PropList property) and nothing else, in every runtime, whatever its platform's own whitespace test says. The set is exactly U+0009 to U+000D, U+0020, U+0085, U+00A0, U+1680, U+2000 to U+200A, U+2028, U+2029, U+202F, U+205F and U+3000. U+200B, U+200C, U+200D, U+2060, U+FEFF, U+180E and U+001C to U+001F are not White_Space (some platforms' whitespace tests accept U+001C to U+001F or U+180E, for example Java's `Character.isWhitespace` and older .NET, so a runtime must check the list, not its platform test): a string of them names something. The vectors list both sets (`whiteSpaceCodePoints`, `notWhiteSpaceCodePoints`) and a runtime checks every code point in every covered field. Absent or nil source ids and tags, and an empty `tags` list, are valid. The rule holds on every connection, receipt-capable or not (a legacy connection is refused with the `error.v0` of the same code, details and text); the vectors' `blankFields` section lists each case.
+   - **Fixed texts.** The `error` string of these refusals is fixed, so vectors can compare it: `message_invalid: messageId exceeds 256 bytes`, `message_invalid: document is required`, `message_invalid: schemaId is required`, `message_invalid: the message could not be read` (a frame that does not decode, or a write that names nothing; the text is the same for both and never carries a decoder's own wording), `message_invalid: receipt sessions require the reliable channel`, `limit_reached: the session's remembered-write limit is full`.
+   - **Reliable channel only.** A write is accepted on a receipt session only on a channel that is reliable and not sequenced (reliable ordered and reliable unordered both qualify; a sequenced channel drops superseded packets, so a write on it can vanish without trace). A write arriving on any other channel is refused `message_invalid` with `details.field: "channel"` (the transport profile's word for it) and fixed text. Receipts and refusals travel the reliable channel; a write that could be lost without trace cannot be answered once. The server refuses a sequenced write whenever it can read the write's id: from the delivered frame, and from a superseded packet that carries its whole frame. A write sent as several fragments whose frame is superseded is dropped whole and may go unanswered; the client's unconfirmed outcome covers it.  A repeat of a packet the server already took, or a packet too far ahead to be taken, draws no further answer (rule 1).
+   - Past the session (or a server's longer retention, if it keeps one) a resend is a new write.
+6. **Forwarded writes.** A server that forwards a non-primary write answers the original peer only with what the primary answered: the primary's receipt becomes `write_admitted` with the original id, its refusal becomes `error.v1` with the original id. If the forward gets no answer the server relays nothing: no receipt, no error, no synthesized refusal. The client's own rule below then reports the write as unconfirmed. A forwarder never turns an absent or ambiguous primary answer into an admission.
+7. **Looks alike.** An admitted and a refused write differ in `schemaVersion`; a receipt has no `error`, an `error.v1` has no admission. A transport ack is neither.
+
+## Client rules: three outcomes
+
+A write settles as exactly one of:
+
+- **admitted**: a `write_admitted` whose `messageId` is the write's.
+- **refused**: an `error.v1` whose `messageId` is the write's, carrying its `code` and `details` as the typed error.
+- **unconfirmed**: nothing settled it. Reasons: `window_elapsed` (the result window ran from the *send* and passed with no answer; see Result window), `session_ended` (the peer closed the session, or it ended, before the write was answered; a write registered after the session ended settles this way when it is sent) and `local_send_failed` (the client's own send of this write failed). A local send failure is never reported as refused: no server answer exists, and the write may or may not have left the machine. Unconfirmed is not success and not refusal. APIs that return a value return the tri-state; APIs that throw throw a distinct refused error and a distinct unconfirmed error and return normally only for admitted. A caller that needs admission treats unconfirmed as not admitted. Resend with the same `messageId` and unchanged content, **on the same session**, is safe against a receipt-capable server (rule 5). After a reconnect the resend is a new write, and a legacy server may apply a resend twice: the caller resends only writes that are idempotent by record key (a put of the same content to the same key, a delete of a key), and reads the record back before resending any other.
+
+**Result window.** Two named constants (also in the vectors): `RECEIPT_RESULT_WINDOW_MS = 5000`, the default against a receipt-capable server (its hello lists both frames); `LEGACY_RESULT_WINDOW_MS = 500`, used only as the fallback against a server whose hello does not list them (or that sent none). The window runs from the send. It ends when the write's age reaches it: an answer arriving at exactly that instant is late. A receipt-capable server that has not answered within its window is reported as unconfirmed like any other; clients log it as a server that missed its window.
+
+**Late answers.** An answer for a write that already settled `unconfirmed` does not change what the caller was told, but the client records it on the write: a late `write_admitted` makes the write's recorded state `admitted_late`, a late refusal makes it `refused_late`. The write handle exposes that state, and a caller that got `unconfirmed` MUST consult it (and the record) before resending: it must not blind-resend a write that was admitted late. A resend on the same session with the same id and content is harmless on a receipt-capable server (rule 5); across a reconnect the caller follows the idempotence rule above.
+
+**Legacy answers.** An `error.v0`, or an `error.v1` with nil `messageId`, names no write. It is attributed to a write only when exactly one write on the connection is unanswered; it then refuses that write. With two or more unanswered writes it settles none of them and each ends unconfirmed at its window. A frame naming a `messageId` that is not in flight settles nothing.
+
+**Batches can commit partially.** A batch is N independent writes with no atomicity: some members may be admitted while others are refused or unanswered, and nothing is rolled back. The client reports each member's outcome and a batch result is only their set: admitted if every member is admitted, refused if any member is refused (naming the members), otherwise unconfirmed (naming the unanswered members). The caller owns retry: it resends exactly the members that are not admitted, with their original ids.
+
+## Changes to what #55 to #58 shipped
+
+Those clients complete *successfully* when the window ends with no refusal. Under this spec that case is `unconfirmed`. The TypeScript one-shot writer (#62) already reports it so: it resolves `admitted` only on a `write_admitted` carrying the put's id, and no other frame, a put echoed under the same id included, ever counts as admission. A caller whose server cannot answer a write yet (Odin, until it is receipt-capable) opts into the explicit send-only mode per call (`sendOnly: true`), which resolves the distinct outcome `sent` once the transport has acknowledged the put and never `admitted`. The Idunn presence publisher is send-only by its own function (`sendPresenceDocument`, not the `sendOnly` option): the same `sent` result, plus a rejection if a refusal naming the put (or naming nothing) arrives by the transport ack. Receipts and send-only are both opt-in, neither is the default. The C# and Rust clients of #55 to #58 keep the window-success until their conformance work lands, and callers of those must not read it as admission.
+
+## Vectors
+
+`write-receipt-vectors.json`: `constants` (the named windows and retention), `contentHash` (worked dedupe hashes), `dedupe` (server replay cases for rule 5), `wire` (MessagePack hex plus the decoded message for each new frame; the bytes are spec-authored with msgpack-python and every runtime's first conformance PR re-captures them with its own encoder and must match), `schemaInvalid` (frames that must be refused by a validator, each with why), and `blankFields` (server input cases for the Required fields rule: which document fields make a put unreadable, which are accepted), `scenarios` (event replays with the outcome each write must settle as; the clock is abstract; each case names its window constant). A conformant client passes every scenario; a conformant server's answers for the same inputs satisfy server rules 1 to 7.
+
+## Conformance status
+
+| Server class | Advertises both frames | Server-wide memory budget (MAY, Remembered-write limits) |
+|---|---|---|
+| `CultNetDatabaseServer` | yes | not implemented: only the per-session limit of 1024 applies |
+| Shard write forwarder | yes | not implemented: only the per-session limit of 1024 applies |
+| Rust RUDP document server | yes | implemented (32 MiB default, `max_remembered_write_bytes`) |
+| C# RUDP schema server (`CultNetRudpSchemaServer`, `src/GameCult.Networking/CultNetRudpSchemaServer.cs`) | no | n/a |
+
+Advertising is per server class, not per transport. A class advertises both frames in its hello only if it implements the receipt rules end to end; the C# RUDP schema server stays "no" until it answers writes with receipts.
+
+Cross-runtime check: `packages/cultmesh-ts/test/interop/write-receipt-interop.test.ts` (`npm run test:interop` in `packages/cultmesh-ts`) runs the TypeScript client (`WriteTracker`, the decoder, the one-shot writer) against the real Rust RUDP document server and the real `CultNetDatabaseServer` over loopback, one scenario set against both. Known gap it records as a todo: the Rust RUDP document server refuses every delete (`write_not_authorized: the server does not take deletes`), where this spec has an admitted delete receipted like a put.
+
+## Conformance follow-ups (not in this PR)
+
+C# server and client, Rust, TypeScript, Python, Kotlin: emit and parse the two frames; hello capability; tri-state client outcome; replace the #55 to #58 window-success; re-capture the wire vectors in each runtime. Server write paths include the shard write forwarder (rule 6) and the Odin catalog.

docs/cultnet-rudp-ack-cut.md

@@ -441,8 +441,8 @@ consumer that waits wants delivered, which is now just Acknowledged.
 | `cultmesh-rs/src/lib.rs:781-838` `request_raw_snapshot_from_rudp_catalog` (Idunn `src/drivers.rs:5527` uses it) | a hand-rolled loop until `Acknowledged`, then the response | Cut 4: `wait_acknowledged` |
 | `cultmesh-rs/src/lib.rs:870-900` `publish_cultnet_message_to_rudp_catalog` (Odin `odin-daemon`) | a hand-rolled loop until `Acknowledged`, then disconnect. The doc at `:869` claims "application admission" | Cut 4: `wait_acknowledged`; the doc says delivered to the document server's sink (`rudp_document_server.rs:343-372`) |
 | `cultmesh-rs/src/lib.rs:918-938` `publish_cultnet_messages_to_rudp_catalog` (Ghostlight `mesh.rs:323`) | `flush_reliable`, then drop. **Several ordered frames, then close** | None; flush now means it |
-| `cultmesh-ts/src/index.ts:6070-6098` `publishRudpDocumentOnce` (Heimdall, StreamPixels, Stonks, weksa, Bifrost, VoidBot, Hermodr) | `peer.flush` (`cultnet-ts/src/peer.ts:109-110`), then close | None. Cut 5 moves its connect-and-wait helper (`index.ts:6603-6650`) into cultnet-ts |
+| `cultmesh-ts/src/index.ts:6211-6303` `publishRudpDocumentOnce` (Heimdall, StreamPixels, Stonks, weksa, Bifrost, VoidBot, Hermodr) | `peer.flush` (`cultnet-ts/src/peer.ts:109-110`), then close | None. Cut 5 moves its connect-and-wait helper (`index.ts:6603-6650`) into cultnet-ts |
-| `cultnet-ts/src/idunn-odin-presence-publisher.ts:89-215` `publishDocument`, behind `createIdunnRuntimePresencePublisher`. **StreamPixels' service runs this**: `apps/service/scripts/idunn-entry.mjs` runs `deployment/idunn/runtime-presence.mjs`, which calls `createIdunnRuntimePresencePublisher` (`:46`) from its vendored CultLib `542ddd3` (StreamPixels `a49f7d8`; pass 2's `30ee8b9` is stale), where it lives under its older name `cultnet-ts/src/idunn-runtime-authority.ts:206` | a hand-rolled session loop (`:186-208`) until `outstandingReliablePacketCount === 0`. It does resend (`:205`). It drops `readyToSend` (`:198`), so promoted queued packets wait for the resend timer. It pins `initialSequence: 1` (`:103`) and never sends a Disconnect, so Odin's hub keeps each publish's peer until it times out (each publish binds a new port, so each is a new peer) | Cut 5: the socket transport, `connectAndWait`, `send("schema")`, `flush`, `close` (which sends the Disconnect, `rudp.ts:956-969`) |
+| `cultnet-ts/src/idunn-odin-presence-publisher.ts:97-136` `sendPresenceDocument` (formerly `publishDocument`), behind `createIdunnRuntimePresencePublisher`. **StreamPixels' service runs this**: `apps/service/scripts/idunn-entry.mjs` runs `deployment/idunn/runtime-presence.mjs`, which calls `createIdunnRuntimePresencePublisher` (`:46`) from its vendored CultLib `542ddd3` (StreamPixels `a49f7d8`; pass 2's `30ee8b9` is stale), where it lives under its older name `cultnet-ts/src/idunn-runtime-authority.ts:206` | a hand-rolled session loop (`:186-208`) until `outstandingReliablePacketCount === 0`. It does resend (`:205`). It drops `readyToSend` (`:198`), so promoted queued packets wait for the resend timer. It pins `initialSequence: 1` (`:103`) and never sends a Disconnect, so Odin's hub keeps each publish's peer until it times out (each publish binds a new port, so each is a new peer) | Cut 5: the socket transport, `connectAndWait`, `send("schema")`, `flush`, `close` (which sends the Disconnect, `rudp.ts:956-969`) |
 | `cultnet-ts/src/signed-daemon-health.ts:104-162` `publishSignedDaemonHealth` (Hermodr, Odin `idunn-rudp.cjs`) | a hand-rolled loop: sends the packets `sendMany` admitted, waits up to 500 ms for the **first** Ack packet of any content (`:146-153`), swallows the timeout, closes. Resends run inside that wait (`:303`) but promoted queued packets are never sent | Cut 5, as above. Today a write not acked within 500 ms, or any payload over 32 packets, is reported published |
 | `cultnet-ts/src/operation-service.ts` | the operation response | none (the response is the proof) |
 | C# `FlushReliable` callers: Gjallar `Program.cs:3055-3080` (two ordered frames, flush, dispose) | flush | None |

packages/cultmesh-kotlin/README.md

@@ -474,3 +474,14 @@ powershell -ExecutionPolicy Bypass -File .\packages\cultmesh-kotlin\build.ps1
 The build writes `artifacts/cultmesh-kotlin/cultmesh-kotlin.jar`.
 It also runs the built-in RUDP packet fixture and localhost UDP socket
 self-test.
+
+## Write Receipt
+
+`WriteReceipt.kt` decodes `cultnet.write_admitted.v0` and `cultnet.error.v1` (and `error.v0`) strictly against their
+closed schemas (`decodeWriteAdmitted`, `decodeErrorFrame`), computes the dedupe `writeContentHash`, tests a hello with
+`helloAdvertisesWriteReceipts`, and settles sent writes as admitted, refused or unconfirmed in `WriteTracker`
+(pure state machine, abstract clock; the caller owns transport and timers). Kotlin has no write client yet, so nothing
+sends a put and waits on this. `WriteReceiptVectors.kt` replays
+`contracts/cultnet/interop/write-receipt-vectors.json` (constants, contentHash, wire, schemaInvalid, scenarios; the
+server-side `dedupe` and `blankFields` sections are not run); `build.ps1` runs it after the self-test, or run
+`CultMeshKt write-receipt-vectors <path>`.

packages/cultmesh-kotlin/build.ps1

@@ -26,4 +26,7 @@ $sources = Get-ChildItem $src -Recurse -Filter *.kt | Select-Object -ExpandPrope
 if ($LASTEXITCODE -ne 0) { throw "kotlinc failed with exit code $LASTEXITCODE" }
 & $java -cp "$jarPath;$kotlinStdlib" org.gamecult.cultmesh.CultMeshKt
 if ($LASTEXITCODE -ne 0) { throw "cultmesh-kotlin self-test failed with exit code $LASTEXITCODE" }
+$vectors = Join-Path $repoRoot "contracts\cultnet\interop\write-receipt-vectors.json"
+& $java -cp "$jarPath;$kotlinStdlib" org.gamecult.cultmesh.CultMeshKt write-receipt-vectors $vectors
+if ($LASTEXITCODE -ne 0) { throw "write-receipt vector replay failed with exit code $LASTEXITCODE" }
 Write-Host "Built $jarPath"

packages/cultmesh-kotlin/src/main/kotlin/org/gamecult/cultmesh/CultMesh.kt

@@ -808,6 +808,7 @@ interface CultNetSchemaMessageTransport : AutoCloseable {
     val profile: CultNetTransportProfile
     val stats: CultNetTransportStats
 
+    /** Fire-and-forget: an ack or a return is not admission; read the result frame. */
     fun sendSchemaMessage(message: CultNetMessage)
 
     fun receiveSchemaMessage(timeoutMs: Long = 1_000, pollIntervalMs: Long = 5): CultNetMessage?
@@ -1099,9 +1100,9 @@ data class CultNetRawDocumentRecord(
             "payloadEncoding" to payloadEncoding,
             "payload" to payload.copyOf(),
         )
-        if (!sourceRuntimeId.isNullOrBlank()) wire["sourceRuntimeId"] = sourceRuntimeId
+        if (!isBlankText(sourceRuntimeId)) wire["sourceRuntimeId"] = sourceRuntimeId
-        if (!sourceAgentId.isNullOrBlank()) wire["sourceAgentId"] = sourceAgentId
+        if (!isBlankText(sourceAgentId)) wire["sourceAgentId"] = sourceAgentId
-        if (!sourceRole.isNullOrBlank()) wire["sourceRole"] = sourceRole
+        if (!isBlankText(sourceRole)) wire["sourceRole"] = sourceRole
         if (tags.isNotEmpty()) wire["tags"] = tags
         return wire
     }
@@ -3167,13 +3168,16 @@ class CultNetRudpSocketTransportConnection(
         return connected
     }
 
+    /** Fire-and-forget: an ack or a return is not admission; read the result frame. */
     fun send(channelId: String, payload: ByteArray) {
         session.sendMany(channelId, payload, channelSendOptions(channelId, nowMs()), maxFragmentBytes).forEach { sendPacket(it) }
         framesSent += 1
     }
 
+    /** Fire-and-forget: an ack or a return is not admission; read the result frame. */
     fun send(channelId: String, payload: String) = send(channelId, payload.toByteArray(StandardCharsets.UTF_8))
 
+    /** Fire-and-forget: an ack or a return is not admission; read the result frame. */
     fun sendSchema(payload: ByteArray) = send("schema", payload)
 
     fun sendSchema(payload: String) = sendSchema(payload.toByteArray(StandardCharsets.UTF_8))
@@ -3409,6 +3413,7 @@ fun main(args: Array<String>) {
         rudpClientBindsLoopbackOnlyForALoopbackEndpoint()
         rudpSocketTransportHandshakesAndCarriesReliableOrderedSchemaFrames()
         rudpSocketTransportCarriesFragmentedReliableOrderedSchemaFrames()
+        rawDocumentRecordDropsOnlyWhiteSpaceSourceIds()
         return
     }
 
@@ -3420,6 +3425,7 @@ fun main(args: Array<String>) {
         "rudp-dial-message-once" -> rudpDialSchemaMessageOnce(options)
         "serve" -> interopServe(options)
         "dial" -> interopDial(options)
+        "write-receipt-vectors" -> if (!replayWriteReceiptVectors(args.getOrNull(1) ?: error("usage: write-receipt-vectors <vectors.json>"))) kotlin.system.exitProcess(1)
         else -> error("Unknown mode ${args[0]}")
     }
 }

packages/cultmesh-kotlin/src/main/kotlin/org/gamecult/cultmesh/WriteReceipt.kt

@@ -0,0 +1,257 @@
+package org.gamecult.cultmesh
+
+// The write receipt (contracts/cultnet/interop/write-receipt.md): the two frames, their strict decode, the dedupe
+// content hash, the hello capability test and the client settle rules. Mirrors packages/cultnet-ts (contracts.ts,
+// write-tracker.ts) and packages/cultnet-rs (write_content_hash). The replay of write-receipt-vectors.json lives in
+// WriteReceiptVectors.kt. Server rules (dedupe, limits, blank fields) are not a decoder's business and are not here.
+
+import java.io.IOException
+import java.security.MessageDigest
+
+const val WRITE_ADMITTED_VERSION = "cultnet.write_admitted.v0"
+const val ERROR_V1_VERSION = "cultnet.error.v1"
+const val ERROR_V0_VERSION = "cultnet.error.v0"
+
+/** A connection is receipt-capable only when its hello lists both frames. */
+val CULTNET_WRITE_RECEIPT_MESSAGE_VERSIONS: List<String> = listOf(WRITE_ADMITTED_VERSION, ERROR_V1_VERSION)
+
+const val RECEIPT_RESULT_WINDOW_MS = 5000L
+const val LEGACY_RESULT_WINDOW_MS = 500L
+
+fun resultWindowMs(serverAdvertisesReceipts: Boolean): Long =
+    if (serverAdvertisesReceipts) RECEIPT_RESULT_WINDOW_MS else LEGACY_RESULT_WINDOW_MS
+
+/** The closed refusal-code set of error.v0; error.v1 adds `limit_reached`. */
+val CULTNET_ERROR_V0_CODES: Set<String> = setOf(
+    "selection_invalid", "cursor_stale", "cursor_invalid", "reference_outside_target", "variant_unsupported",
+    "unowned_schema", "write_not_authorized", "unsupported_schema_version", "message_invalid",
+)
+val CULTNET_ERROR_V1_CODES: Set<String> = CULTNET_ERROR_V0_CODES + "limit_reached"
+
+fun helloAdvertisesWriteReceipts(hello: CultNetMessage): Boolean {
+    val versions = hello.body["supportedMessageVersions"] as? List<*> ?: return false
+    return CULTNET_WRITE_RECEIPT_MESSAGE_VERSIONS.all { it in versions }
+}
+
+data class CultNetWriteAdmitted(val messageId: String, val operation: String, val schemaId: String, val recordKey: String) {
+    fun toMessage() = CultNetMessage(
+        WRITE_ADMITTED_VERSION,
+        linkedMapOf("messageId" to messageId, "operation" to operation, "schemaId" to schemaId, "recordKey" to recordKey),
+    )
+}
+
+data class CultNetErrorDetails(val field: String?, val value: String?, val asOf: Long?, val current: Long?)
+
+/** error.v0 (`messageId` always null, `version` 0) or error.v1 (`version` 1). */
+data class CultNetErrorFrame(
+    val version: Int,
+    val error: String,
+    val routingHint: Map<String, Any?>?,
+    val code: String?,
+    val details: CultNetErrorDetails?,
+    val messageId: String?,
+) {
+    fun toMessage(): CultNetMessage {
+        val body = linkedMapOf<String, Any?>(
+            "error" to error,
+            "routingHint" to routingHint,
+            "code" to code,
+            "details" to details?.let {
+                linkedMapOf("field" to it.field, "value" to it.value, "asOf" to it.asOf, "current" to it.current)
+            },
+        )
+        if (version == 1) body["messageId"] = messageId
+        return CultNetMessage(if (version == 1) ERROR_V1_VERSION else ERROR_V0_VERSION, body)
+    }
+}
+
+/**
+ * Strict decode of a write_admitted.v0 message against its closed schema: exactly five keys, a non-empty string each,
+ * operation put|delete.
+ */
+fun decodeWriteAdmitted(message: CultNetMessage): CultNetWriteAdmitted {
+    if (message.schemaVersion != WRITE_ADMITTED_VERSION) throw IOException("not a $WRITE_ADMITTED_VERSION message")
+    closedKeys(message, setOf("messageId", "operation", "schemaId", "recordKey"))
+    val operation = nonEmpty(message, "operation")
+    if (operation != "put" && operation != "delete") throw IOException("operation must be put or delete")
+    return CultNetWriteAdmitted(nonEmpty(message, "messageId"), operation, nonEmpty(message, "schemaId"), nonEmpty(message, "recordKey"))
+}
+
+/** Strict decode of error.v0 (no messageId, no limit_reached) or error.v1 (messageId required, string or nil, never empty). */
+fun decodeErrorFrame(message: CultNetMessage): CultNetErrorFrame {
+    val version = when (message.schemaVersion) {
+        ERROR_V1_VERSION -> 1
+        ERROR_V0_VERSION -> 0
+        else -> throw IOException("not an error message")
+    }
+    closedKeys(message, setOf("error", "routingHint", "code", "details") + if (version == 1) setOf("messageId") else emptySet())
+    val error = nonEmpty(message, "error")
+    val codeValue = message.body["code"]
+    if (codeValue != null && (codeValue !is String || codeValue !in (if (version == 1) CULTNET_ERROR_V1_CODES else CULTNET_ERROR_V0_CODES))) {
+        throw IOException("unknown error code")
+    }
+    var messageId: String? = null
+    if (version == 1) {
+        val id = message.body["messageId"]
+        if (id != null && (id !is String || id.isEmpty())) throw IOException("messageId must be a non-empty string or nil")
+        messageId = id as String?
+    }
+    return CultNetErrorFrame(version, error, routingHintOf(message.body["routingHint"]), codeValue as String?, detailsOf(message.body["details"]), messageId)
+}
+
+private fun closedKeys(message: CultNetMessage, required: Set<String>) {
+    if (!message.body.keys.containsAll(required)) throw IOException("${message.schemaVersion} is missing ${required - message.body.keys}")
+    val unknown = message.body.keys - required
+    if (unknown.isNotEmpty()) throw IOException("${message.schemaVersion} carries unknown keys $unknown")
+}
+
+private fun nonEmpty(message: CultNetMessage, key: String): String {
+    val value = message.body[key]
+    if (value !is String || value.isEmpty()) throw IOException("$key must be a non-empty string")
+    return value
+}
+
+private fun routingHintOf(value: Any?): Map<String, Any?>? {
+    if (value == null) return null
+    if (value !is Map<*, *> || value.keys != setOf("shard", "reason")) throw IOException("routingHint must be nil or {shard, reason}")
+    if (value["shard"] != null && value["shard"] !is Map<*, *>) throw IOException("routingHint.shard must be an object or nil")
+    if (value["reason"] !is String) throw IOException("routingHint.reason must be a string")
+    @Suppress("UNCHECKED_CAST")
+    return value as Map<String, Any?>
+}
+
+private fun detailsOf(value: Any?): CultNetErrorDetails? {
+    if (value == null) return null
+    if (value !is Map<*, *> || value.keys != setOf("field", "value", "asOf", "current")) {
+        throw IOException("details must be nil or {field, value, asOf, current}")
+    }
+    fun text(key: String): String? = value[key].let { if (it == null || it is String) it as String? else throw IOException("details.$key must be a string or nil") }
+    fun cursor(key: String): Long? = value[key].let {
+        if (it == null) null else if (it is Long && it >= 0) it else throw IOException("details.$key must be a non-negative integer or nil")
+    }
+    return CultNetErrorDetails(text("field"), text("value"), cursor("asOf"), cursor("current"))
+}
+
+/** sha256 of the MessagePack array [operation, schemaId, recordKey, payload]: payload a bin for a put, nil for a delete. Lowercase hex. */
+fun writeContentHash(operation: String, schemaId: String, recordKey: String, payload: ByteArray?): String {
+    val writer = MessagePackWriter().array(4).string(operation).string(schemaId).string(recordKey)
+    if (payload == null) writer.nil() else writer.binary(payload)
+    return MessageDigest.getInstance("SHA-256").digest(writer.toByteArray()).joinToString("") { "%02x".format(it) }
+}
+
+/** Why nothing settled a write. */
+enum class WriteUnconfirmedReason(val wire: String) { WINDOW_ELAPSED("window_elapsed"), SESSION_ENDED("session_ended"), LOCAL_SEND_FAILED("local_send_failed") }
+
+/** What a late answer is recorded as on a write that already settled unconfirmed. */
+enum class WriteRecorded(val wire: String) { ADMITTED_LATE("admitted_late"), REFUSED_LATE("refused_late") }
+
+/** What the caller was told. Settled once; never changed by a later frame. */
+sealed class WriteSettlement {
+    object Admitted : WriteSettlement()
+    data class Refused(val code: String?, val error: String, val response: CultNetErrorFrame) : WriteSettlement()
+    data class Unconfirmed(val reason: WriteUnconfirmedReason) : WriteSettlement()
+}
+
+/**
+ * The client half of the receipt rules: a pure state machine with an abstract clock, one decision, how each sent write
+ * settles. Transport, timers and decoding belong to the caller; `frame` takes a message and decodes it strictly.
+ */
+class WriteTracker(private val windowMs: Long, private val onSettle: (String, WriteSettlement) -> Unit = { _, _ -> }) {
+    private class Entry(val sentAtMs: Long) {
+        var settlement: WriteSettlement? = null
+        var recorded: WriteRecorded? = null
+    }
+
+    private val writes = linkedMapOf<String, Entry>()
+    private var ended = false
+
+    /** Registers a write sent at [atMs]. Re-sending a known id is the same write and does not restart its window. */
+    fun send(messageId: String, atMs: Long) {
+        tick(atMs)
+        if (messageId in writes) return
+        val entry = Entry(atMs)
+        writes[messageId] = entry
+        // On a session that already ended nothing can answer this write.
+        if (ended) settle(messageId, entry, WriteSettlement.Unconfirmed(WriteUnconfirmedReason.SESSION_ENDED))
+    }
+
+    /** Feeds one received message. Only write_admitted, error.v1 and error.v0 answer; anything else is ignored. */
+    fun frame(message: CultNetMessage, atMs: Long) {
+        tick(atMs)
+        when (message.schemaVersion) {
+            WRITE_ADMITTED_VERSION -> {
+                answer(decodeWriteAdmitted(message).messageId, WriteSettlement.Admitted, WriteRecorded.ADMITTED_LATE)
+                return
+            }
+            ERROR_V1_VERSION, ERROR_V0_VERSION -> {
+                val error = decodeErrorFrame(message)
+                val refusal = WriteSettlement.Refused(error.code, error.error, error)
+                if (error.messageId != null) {
+                    answer(error.messageId, refusal, WriteRecorded.REFUSED_LATE)
+                    return
+                }
+                // An error that names no write is attributable only when exactly one write is unanswered.
+                val unanswered = writes.filterValues { it.settlement == null }
+                if (unanswered.size == 1) settle(unanswered.keys.first(), unanswered.values.first(), refusal)
+            }
+            else -> return
+        }
+    }
+
+    /** Every unanswered write whose window, counted from its own send, has run settles unconfirmed. */
+    fun tick(atMs: Long) {
+        for ((id, entry) in writes) {
+            if (entry.settlement == null && atMs - entry.sentAtMs >= windowMs) settle(id, entry, WriteSettlement.Unconfirmed(WriteUnconfirmedReason.WINDOW_ELAPSED))
+        }
+    }
+
+    /** The session ended: every unanswered write settles unconfirmed, and so does any write sent afterwards. */
+    fun sessionEnd(atMs: Long) {
+        tick(atMs)
+        ended = true
+        for ((id, entry) in writes) if (entry.settlement == null) settle(id, entry, WriteSettlement.Unconfirmed(WriteUnconfirmedReason.SESSION_ENDED))
+    }
+
+    /** This client's own send of [messageId] failed: that write settles unconfirmed; the others are untouched. */
+    fun sendFailed(messageId: String, atMs: Long) {
+        val entry = writes[messageId]
+        if (entry != null && entry.settlement == null) settle(messageId, entry, WriteSettlement.Unconfirmed(WriteUnconfirmedReason.LOCAL_SEND_FAILED))
+        tick(atMs)
+    }
+
+    /** The settlement told to the caller, or null while unanswered or unknown. */
+    fun settlement(messageId: String): WriteSettlement? = writes[messageId]?.settlement
+
+    /** The late answer recorded on an unconfirmed write. */
+    fun recorded(messageId: String): WriteRecorded? = writes[messageId]?.recorded
+
+    private fun answer(messageId: String, settlement: WriteSettlement, late: WriteRecorded) {
+        val entry = writes[messageId] ?: return // names a write that is not in flight: settles nothing
+        val current = entry.settlement
+        if (current == null) settle(messageId, entry, settlement)
+        else if (current is WriteSettlement.Unconfirmed && entry.recorded == null) entry.recorded = late
+    }
+
+    private fun settle(messageId: String, entry: Entry, settlement: WriteSettlement) {
+        entry.settlement = settlement
+        onSettle(messageId, settlement)
+    }
+}
+
+/** Unicode White_Space (PropList), the one definition of "blank" in write-receipt.md rule 5; Kotlin's own isBlank takes U+001C to U+001F. */
+private val WHITE_SPACE_CODE_POINTS: Set<Int> = (0x0009..0x000D).toSet() + 0x0020 + 0x0085 + 0x00A0 + 0x1680 +
+    (0x2000..0x200A).toSet() + 0x2028 + 0x2029 + 0x202F + 0x205F + 0x3000
+
+/** True for null, empty, or only White_Space code points. */
+fun isBlankText(text: String?): Boolean = text == null || text.codePoints().allMatch { it in WHITE_SPACE_CODE_POINTS }
+
+/** Self-test: blank is White_Space, not Kotlin's isBlank (rule 5): U+001C to U+001F name something, U+00A0 and U+0085 do not. */
+fun rawDocumentRecordDropsOnlyWhiteSpaceSourceIds() {
+    fun wireKeys(id: String) = CultNetRawDocumentRecord("note.v0", "note:1", "2026-11-08T00:00:00Z", payload = byteArrayOf(1), sourceRuntimeId = id, sourceAgentId = id, sourceRole = id).toWireMap().keys
+    for (blank in listOf("", "\u0085", "\u00a0\u2003", "\u3000", "\t\r\n ")) {
+        check(isBlankText(blank) && "sourceRuntimeId" !in wireKeys(blank)) { "blank ${blank.map { it.code }} must be dropped" }
+    }
+    for (named in listOf("\u001c", "\u001f", "\u200b", "\ufeff", "\u180e", "a")) {
+        check(!isBlankText(named) && "sourceRuntimeId" in wireKeys(named) && "sourceRole" in wireKeys(named)) { "${named.map { it.code }} names something and must be kept" }
+    }
+}

packages/cultmesh-kotlin/src/main/kotlin/org/gamecult/cultmesh/WriteReceiptVectors.kt

@@ -0,0 +1,243 @@
+package org.gamecult.cultmesh
+
+// Replays contracts/cultnet/interop/write-receipt-vectors.json against this runtime: constants, contentHash, every
+// `wire` frame (decode to the vector's fields, re-encode to its bytes), every `schemaInvalid` frame (must be refused),
+// and every `scenarios` event replay through WriteTracker. `dedupe` and `blankFields` are server inputs and are not
+// run here. Mode: `java -cp ... org.gamecult.cultmesh.CultMeshKt write-receipt-vectors <vectors.json>`.
+
+import java.io.File
+import java.io.IOException
+
+// The event actions scenarios.semantics names; anything else is refused, not skipped.
+private val EVENT_KEYS = listOf("send", "frame", "tick", "sessionEnd", "sendFailed", "transportAck")
+
+fun replayWriteReceiptVectors(path: String): Boolean {
+    @Suppress("UNCHECKED_CAST")
+    val vectors = JsonReader(File(path).readText(Charsets.UTF_8)).readDocument() as Map<String, Any?>
+    val results = linkedMapOf<String, List<String>>()
+    fun check(name: String, run: () -> List<String>) {
+        results[name] = try { run() } catch (e: Throwable) { listOf("threw: $e") }
+    }
+
+    val constants = obj(vectors["constants"])
+    check("constants") {
+        listOfNotNull(
+            "RECEIPT window".takeIf { constants["RECEIPT_RESULT_WINDOW_MS"] != RECEIPT_RESULT_WINDOW_MS },
+            "LEGACY window".takeIf { constants["LEGACY_RESULT_WINDOW_MS"] != LEGACY_RESULT_WINDOW_MS },
+        )
+    }
+
+    for (case in list(obj(vectors["contentHash"])["cases"])) {
+        val c = obj(case)
+        check("contentHash/${c["name"]}") {
+            val got = writeContentHash(c["operation"] as String, c["schemaId"] as String, c["recordKey"] as String, (c["payloadHex"] as String?)?.let(::unhex))
+            if (got == c["sha256"]) emptyList() else listOf("$got != ${c["sha256"]}")
+        }
+    }
+
+    for (case in list(vectors["wire"])) {
+        val c = obj(case)
+        check("wire/${c["name"]}") {
+            val bytes = unhex(c["messagePackHex"] as String)
+            val problems = mutableListOf<String>()
+            val message = decodeReceiptFrame(parseCultNetMessage(bytes))
+            if (message.toWireMap() != c["message"]) problems += "decoded ${message.toWireMap()} != ${c["message"]}"
+            val again = message.toBytes().joinToString("") { "%02X".format(it) }
+            if (again != (c["messagePackHex"] as String).uppercase()) problems += "re-encoded bytes $again != captured ${c["messagePackHex"]}"
+            problems
+        }
+    }
+
+    for (case in list(vectors["schemaInvalid"])) {
+        val c = obj(case)
+        check("schemaInvalid/${c["name"]}") {
+            try {
+                decodeReceiptFrame(parseCultNetMessage(unhex(c["messagePackHex"] as String)))
+                listOf("accepted a frame that must be refused (${c["why"]})")
+            } catch (_: IOException) {
+                emptyList()
+            }
+        }
+    }
+
+    // Not a vector: `limit_reached` is in error.v1's enum only (write-receipt.md), as the TS and Rust suites also pin.
+    check("error_v0_refuses_the_v1_only_limit_reached_code") {
+        val body = linkedMapOf<String, Any?>("error" to "x", "routingHint" to null, "code" to "limit_reached", "details" to null)
+        val v1 = decodeErrorFrame(CultNetMessage(ERROR_V1_VERSION, body + ("messageId" to null))).code
+        try {
+            decodeErrorFrame(CultNetMessage(ERROR_V0_VERSION, body))
+            listOf("error.v0 accepted limit_reached")
+        } catch (_: IOException) {
+            if (v1 == "limit_reached") emptyList() else listOf("error.v1 lost limit_reached")
+        }
+    }
+
+    for (case in list(obj(vectors["scenarios"])["cases"])) {
+        val scenario = obj(case)
+        check("scenario/${scenario["name"]}") {
+            val problems = mutableListOf<String>()
+            // The fake server states its capability the only way a real one does: in its hello.
+            val hello = cultNetHello(
+                "fake-server", "fake",
+                supportedMessageVersions = if (scenario["server"] == "receipt") CULTNET_WRITE_RECEIPT_MESSAGE_VERSIONS else emptyList(),
+            )
+            val windowMs = resultWindowMs(helloAdvertisesWriteReceipts(hello))
+            if (windowMs != constants[scenario["window"] as String]) problems += "window $windowMs != ${scenario["window"]}"
+            val told = linkedMapOf<String, WriteSettlement>()
+            val tracker = WriteTracker(windowMs) { id, settlement ->
+                if (id in told) problems += "$id settled twice"
+                told[id] = settlement
+            }
+            for (event in list(scenario["events"]).map(::obj).sortedBy { it["atMs"] as Long }) {
+                val at = event["atMs"] as Long
+                val actions = event.keys - "atMs"
+                if (actions.size != 1 || actions.first() !in EVENT_KEYS) { problems += "event at $at has keys $actions, wanted atMs and exactly one of $EVENT_KEYS"; continue }
+                when {
+                    "send" in event -> tracker.send(event["send"] as String, at)
+                    // A frame reaches the client as bytes: the fake server encodes it, the client decodes it.
+                    "frame" in event -> tracker.frame(parseCultNetMessage(MessagePackWriter().value(event["frame"]).toByteArray()), at)
+                    "tick" in event -> tracker.tick(at)
+                    "sessionEnd" in event -> tracker.sessionEnd(at)
+                    "sendFailed" in event -> tracker.sendFailed(event["sendFailed"] as String, at)
+                    // transportAck: delivery is not an answer; the tracker has no such input and must not need one.
+                }
+            }
+            val expect = obj(scenario["expect"])
+            for ((id, wantAny) in expect) {
+                val want = obj(wantAny)
+                val got = told[id]
+                if (got == null) { problems += "$id: never settled, wanted ${want["outcome"]}"; continue }
+                val (outcome, code, reason) = when (got) {
+                    is WriteSettlement.Admitted -> Triple("admitted", null, null)
+                    is WriteSettlement.Refused -> Triple("refused", got.code, null)
+                    is WriteSettlement.Unconfirmed -> Triple("unconfirmed", null, got.reason.wire)
+                }
+                if (outcome != want["outcome"]) problems += "$id: told $outcome, wanted ${want["outcome"]}"
+                if ("code" in want && code != want["code"]) problems += "$id: code $code, wanted ${want["code"]}"
+                if ("reason" in want && reason != want["reason"]) problems += "$id: reason $reason, wanted ${want["reason"]}"
+                if (tracker.recorded(id)?.wire != want["recorded"]) problems += "$id: recorded ${tracker.recorded(id)?.wire}, wanted ${want["recorded"]}"
+            }
+            for (id in told.keys) if (id !in expect) problems += "$id: settled but the scenario expects nothing for it"
+            problems
+        }
+    }
+
+    // A runner that read fewer vectors than the file declares has silently skipped some.
+    check("counts") {
+        val declared = obj(vectors["counts"])
+        fun ran(prefix: String) = results.keys.count { it.startsWith(prefix) }
+        val loaded = mapOf(
+            "wire" to list(vectors["wire"]).size, "schemaInvalid" to list(vectors["schemaInvalid"]).size,
+            "contentHashCases" to list(obj(vectors["contentHash"])["cases"]).size, "scenarioCases" to list(obj(vectors["scenarios"])["cases"]).size,
+        )
+        val executed = mapOf("wire" to ran("wire/"), "schemaInvalid" to ran("schemaInvalid/"), "contentHashCases" to ran("contentHash/"), "scenarioCases" to ran("scenario/"))
+        loaded.keys.filter { loaded[it] != (declared[it] as Long).toInt() || executed[it] != loaded[it] }
+            .map { "$it: declared ${declared[it]}, loaded ${loaded[it]}, ran ${executed[it]}" }
+    }
+
+    for ((name, problems) in results) {
+        println(if (problems.isEmpty()) "PASS $name" else "FAIL $name")
+        problems.forEach { println("     $it") }
+    }
+    val failed = results.values.count { it.isNotEmpty() }
+    println("${results.size - failed}/${results.size} passed")
+    return failed == 0
+}
+
+/** Strict decode of whichever receipt-family frame this is, returned as the message its typed form encodes; anything else is refused. */
+private fun decodeReceiptFrame(message: CultNetMessage): CultNetMessage = when (message.schemaVersion) {
+    WRITE_ADMITTED_VERSION -> decodeWriteAdmitted(message).toMessage()
+    ERROR_V1_VERSION, ERROR_V0_VERSION -> decodeErrorFrame(message).toMessage()
+    else -> throw IOException("not a receipt frame: ${message.schemaVersion}")
+}
+
+@Suppress("UNCHECKED_CAST")
+private fun obj(value: Any?): Map<String, Any?> = value as Map<String, Any?>
+private fun list(value: Any?): List<Any?> = value as List<Any?>
+
+private fun unhex(text: String): ByteArray = ByteArray(text.length / 2) { text.substring(it * 2, it * 2 + 2).toInt(16).toByte() }
+
+/** A small JSON reader for the vector file: objects, arrays, strings, integers, true/false/null. */
+private class JsonReader(private val text: String) {
+    private var at = 0
+
+    fun readDocument(): Any? = readValue().also { skipSpace(); if (at != text.length) throw IOException("trailing JSON") }
+
+    private fun skipSpace() { while (at < text.length && text[at] in " \t\r\n") at++ }
+
+    private fun readValue(): Any? {
+        skipSpace()
+        return when (val c = text[at]) {
+            '{' -> {
+                at++
+                val map = linkedMapOf<String, Any?>()
+                skipSpace()
+                if (text[at] == '}') { at++; return map }
+                do {
+                    skipSpace()
+                    val key = readString()
+                    skipSpace(); expect(':')
+                    map[key] = readValue()
+                    skipSpace()
+                } while (closes('}'))
+                map
+            }
+            '[' -> {
+                at++
+                val items = mutableListOf<Any?>()
+                skipSpace()
+                if (text[at] == ']') { at++; return items }
+                do {
+                    items += readValue()
+                    skipSpace()
+                } while (closes(']'))
+                items
+            }
+            '"' -> readString()
+            't' -> literal("true", true)
+            'f' -> literal("false", false)
+            'n' -> literal("null", null)
+            else -> {
+                if (c != '-' && !c.isDigit()) throw IOException("unexpected '$c' at $at")
+                val start = at++
+                while (at < text.length && text[at].isDigit()) at++
+                text.substring(start, at).toLong()
+            }
+        }
+    }
+
+    /** After an element: false when [close] ends the container, true after a comma. */
+    private fun closes(close: Char): Boolean {
+        val c = text[at++]
+        if (c == close) return false
+        if (c != ',') throw IOException("expected , or $close at ${at - 1}")
+        return true
+    }
+
+    private fun literal(word: String, value: Any?): Any? {
+        if (!text.startsWith(word, at)) throw IOException("bad literal at $at")
+        at += word.length
+        return value
+    }
+
+    private fun expect(c: Char) { if (text[at++] != c) throw IOException("expected $c at ${at - 1}") }
+
+    private fun readString(): String {
+        expect('"')
+        val out = StringBuilder()
+        while (true) {
+            val c = text[at++]
+            when (c) {
+                '"' -> return out.toString()
+                '\\' -> when (val e = text[at++]) {
+                    'n' -> out.append('\n'); 't' -> out.append('\t'); 'r' -> out.append('\r')
+                    'b' -> out.append('\b'); 'f' -> out.append('\u000c')
+                    'u' -> { out.append(text.substring(at, at + 4).toInt(16).toChar()); at += 4 }
+                    '"', '\\', '/' -> out.append(e)
+                    else -> throw IOException("bad escape \\$e")
+                }
+                else -> out.append(c)
+            }
+        }
+    }
+}

packages/cultmesh-py/src/cultmesh_py/server.py

@@ -59,6 +59,16 @@ from cultnet_py.cultmesh_contracts import (
 )
 
 _LOGGER = logging.getLogger(__name__)
+
+# How many consecutive refused frames of one kind a RUDP session may send before it is ended: undecodable
+# frames (reset by any frame that decodes) and deletes the write authority refuses (reset by any decoded
+# frame that is not a refused delete). Fewer are answered with a typed refusal and the session is kept; the
+# frame that reaches this number is answered too, then the session ends. The same number is the cap in every
+# runtime.
+MAX_CONSECUTIVE_REFUSED_FRAMES = 8
+
+# How long a session whose capped frame was answered waits for the peer to acknowledge the answer before it ends anyway.
+_RUDP_CAPPED_ANSWER_GRACE_MS = 2000
 _EPHEMERAL_PAIR_ATTEMPTS = 64
 
 
@@ -90,6 +100,10 @@ class _DatabaseSubscription:
 class _RudpPeerConnection:
     session: CultNetRudpSession
     subscriptions: dict[str, _DatabaseSubscription] = field(default_factory=dict)
+    undecodable_frames_in_a_row: int = 0
+    refused_deletes_in_a_row: int = 0
+    # Set once the peer's capped frame has been answered: the session ends when the answers are acknowledged.
+    ending_deadline_ms: int | None = None
 
 
 @dataclass
@@ -346,6 +360,7 @@ class CultMeshLocalServer:
             if packet.connection_id != self.rudp_connection_id:
                 continue
 
+            self._end_answered_peers(rudp_socket, peers)
             now_ms = _now_ms()
             peer = peers.get(remote_addr)
             if packet.packet_type == CultNetRudpPacketType.CONNECT:
@@ -394,18 +409,31 @@ class CultMeshLocalServer:
                 for delivered in result.delivered:
                     if delivered.channel_id != "schema":
                         continue
+                    if peer.ending_deadline_ms is not None:
+                        # The capped frame was answered; nothing after it is served while the answer is delivered.
+                        break
                     try:
                         message = msgpack.unpackb(delivered.payload, raw=False)
                     except (msgpack.ExtraData, msgpack.FormatError, msgpack.StackError, ValueError):
-                        continue
+                        message = None
-                    if not isinstance(message, dict):
+                    if isinstance(message, dict):
-                        continue
+                        peer.undecodable_frames_in_a_row = 0
-                    responses = self._handle_connection_message(
+                        responses = self._handle_connection_message(
-                        message,
+                            message,
-                        peer.subscriptions,
+                            peer.subscriptions,
-                        over_rudp=True,
+                            over_rudp=True,
-                        peer=CultMeshServerPeer(f"{remote_addr[0]}:{remote_addr[1]}", "rudp"),
+                            peer=CultMeshServerPeer(f"{remote_addr[0]}:{remote_addr[1]}", "rudp"),
-                    )
+                        )
+                        refused_delete = message.get("schemaVersion") == "cultnet.document_delete.v0" and any(
+                            response.get("code") == "write_not_authorized" for response in responses
+                        )
+                        peer.refused_deletes_in_a_row = peer.refused_deletes_in_a_row + 1 if refused_delete else 0
+                        refused, run = refused_delete, peer.refused_deletes_in_a_row
+                    else:
+                        # A frame that is no CultNet message is answered, not dropped, and the session kept.
+                        peer.undecodable_frames_in_a_row += 1
+                        refused, run = True, peer.undecodable_frames_in_a_row
+                        responses = [self._message_invalid({}, "message", "CultMesh RUDP server could not read the message.")]
                     for response in responses:
                         if unsendable is None:
                             unsendable = self._send_rudp_schema_frame(
@@ -415,6 +443,11 @@ class CultMeshLocalServer:
                                 msgpack.packb(response, use_bin_type=True),
                                 message_id=str(response.get("messageId") or ""),
                             )
+                    if refused and run >= MAX_CONSECUTIVE_REFUSED_FRAMES:
+                        # The capped frame is answered like any other, reliably. The session ends once the peer
+                        # has acknowledged every answer (or the grace runs out): see _end_answered_peers.
+                        peer.ending_deadline_ms = now_ms + _RUDP_CAPPED_ANSWER_GRACE_MS
+                        break
             except Exception as error:  # noqa: BLE001 - one peer's message never ends the thread
                 # Whatever a peer's message makes the handling raise is that peer's failure.
                 # The session recorded the frame's sequence, so it cannot be kept: a retransmit
@@ -445,11 +478,26 @@ class CultMeshLocalServer:
             if unsendable is not None:
                 self._end_unsendable_peer(rudp_socket, peers, remote_addr, unsendable)
 
+    def _end_answered_peers(
+        self,
+        rudp_socket: socket.socket,
+        peers: dict[tuple[str, int], _RudpPeerConnection],
+    ) -> None:
+        """Ends each session whose capped frame was answered once the peer has acknowledged every answer (a lost
+        answer is resent first), or when the grace has run out."""
+        now_ms = _now_ms()
+        for remote_addr, peer in list(peers.items()):
+            if peer.ending_deadline_ms is None:
+                continue
+            if peer.session.outstanding_reliable_packet_count == 0 or now_ms >= peer.ending_deadline_ms:
+                self._end_refused_peer(rudp_socket, peers, remote_addr)
+
     def _poll_rudp_resends(
         self,
         rudp_socket: socket.socket,
         peers: dict[tuple[str, int], _RudpPeerConnection],
     ) -> None:
+        self._end_answered_peers(rudp_socket, peers)
         now_ms = _now_ms()
         for remote_addr, peer in list(peers.items()):
             for packet in peer.session.due_resends(now_ms):

packages/cultmesh-py/tests/test_client_write_completion.py

@@ -0,0 +1,52 @@
+"""Heimdall's invariant: no client treats a reliable-transport ack as write admission. A put completes only on
+its result frame (write_not_authorized, or the success reply).
+
+The Python write path is a subscription over RUDP: `send` queues the put, `read_next` returns the result frame
+and raises the peer's refusal. The server here refuses the put; its reliable ack of the put arrives (the test
+waits for it) and the client still reports the refusal, never success. The transport's `receive` yields data
+frames only, so the order of the ack against the refusal cannot change what `read_next` reports.
+"""
+
+from __future__ import annotations
+
+import unittest
+
+from cultcache_py import define_database_entry_type
+from cultmesh_py import CultMesh, create_node
+from cultmesh_py.server import CultMeshLocalServer
+from cultnet_py import CultNetDatabaseSubscription, CultNetPeerError, create_rudp_schema_transport
+
+from test_remote_write_authority import KEY_A, NOTE, SCHEMA_ID, put_of
+
+
+class ClientWriteCompletionTests(unittest.TestCase):
+    def test_a_put_the_server_refused_is_reported_refused_after_its_ack_arrived(self) -> None:
+        node = create_node(runtime_id="completion-server")
+        node.database.register_document(NOTE)
+        server = CultMeshLocalServer(node=node, port=0, write_authority=None)
+        server.start()
+        try:
+            subscription = CultNetDatabaseSubscription(
+                host="127.0.0.1",
+                port=server.port,
+                timeout_seconds=4.0,
+                subscription_id="completion",
+                schema_ids=[SCHEMA_ID],
+                include_snapshot=False,
+                create_transport=lambda: create_rudp_schema_transport(
+                    host="127.0.0.1", port=server.port, connection_id=server.rudp_connection_id, timeout_seconds=4.0
+                ),
+            )
+            with subscription as sub:
+                sub.send(put_of(KEY_A, "peer"))
+                sub._transport.flush_reliable(2.0)  # the put's reliable ack has arrived
+                with self.assertRaises(CultNetPeerError) as raised:
+                    sub.read_next()
+        finally:
+            server.stop()
+        self.assertEqual(raised.exception.response["code"], "write_not_authorized")
+        self.assertIsNone(server.node.cache.get(NOTE, KEY_A))
+
+
+if __name__ == "__main__":
+    unittest.main()

packages/cultmesh-py/tests/test_cultmesh.py

@@ -24,7 +24,9 @@ from cultcache_py import (
     define_document_type,
 )
 from cultcache_py.interop import INTEROP_SCHEMA_VERSION, interop_note_document
+from cultmesh_py.server import MAX_CONSECUTIVE_REFUSED_FRAMES
 from cultmesh_py.verify import verify
+from cultmesh_py.write_authority import CultMeshRemoteWriteDecision
 from cultnet_py import (
     compute_simulation_claim_hash,
     CultNetClientAuthorityScope,
@@ -4889,6 +4891,140 @@ class CultMeshTests(unittest.TestCase):
         self.assertEqual(after["documents"], [])
         self.assertTrue(alive)
 
+    def _rudp_open(self, server: Any) -> Any:
+        return create_rudp_schema_transport(
+            host="127.0.0.1",
+            port=server.port,
+            connection_id=server.rudp_connection_id,
+            timeout_seconds=4.0,
+            max_fragment_bytes=1200,
+        )
+
+    def _rudp_answer(self, transport: Any, payload: bytes) -> dict[str, Any]:
+        transport.send("schema", payload)
+        return msgpack.unpackb(transport.receive(timeout_seconds=4.0).payload, raw=False)
+
+    def _assert_rudp_session_ended(self, transport: Any, server: Any) -> None:
+        transport.send("schema", msgpack.packb(snapshot_request(message_id="after-cap").to_wire(), use_bin_type=True))
+        with self.assertRaises(Exception):
+            transport.receive(timeout_seconds=1.0)
+        self.assertTrue(server._rudp_thread.is_alive())
+
+    def test_cultmesh_local_server_answers_unreadable_frames_and_ends_the_session_at_eight_in_a_row(self) -> None:
+        # An undecodable frame (not a msgpack map) is answered message_invalid and the session kept;
+        # eight in a row end it (the eighth is answered too); any decoded frame resets the run.
+        self.assertEqual(MAX_CONSECUTIVE_REFUSED_FRAMES, 8)
+        node = CultMesh.create_node(runtime_id="mesh-rudp-unreadable")
+        server = CultMesh.serve_node(node, write_authority=CultMeshGrantAllWrites())
+        garbage = b"\xc1"
+        snapshot = msgpack.packb(snapshot_request(message_id="ok").to_wire(), use_bin_type=True)
+        transport = self._rudp_open(server)
+        try:
+            for _ in range(2):
+                for _ in range(MAX_CONSECUTIVE_REFUSED_FRAMES - 1):
+                    reply = self._rudp_answer(transport, garbage)
+                    self.assertEqual(reply["code"], "message_invalid")
+                    self.assertEqual(reply["details"]["field"], "message")
+                self.assertEqual(self._rudp_answer(transport, snapshot)["messageId"], "ok")
+            for _ in range(MAX_CONSECUTIVE_REFUSED_FRAMES - 1):
+                self._rudp_answer(transport, garbage)
+            transport.send("schema", garbage)
+            eighth = msgpack.unpackb(transport.receive(timeout_seconds=4.0).payload, raw=False)
+            self.assertEqual(eighth["code"], "message_invalid")
+            self._assert_rudp_session_ended(transport, server)
+        finally:
+            transport.close()
+            server.stop()
+
+    def test_cultmesh_local_server_resends_a_lost_capped_answer_before_it_ends_the_session(self) -> None:
+        # The eighth refusal is answered reliably: the datagram carrying it is lost on the wire, and the
+        # peer still gets the answer (by resend) before the goodbye. An unreliable final answer, or a
+        # goodbye sent at once, would leave the peer without it.
+        node = CultMesh.create_node(runtime_id="mesh-rudp-lost-answer")
+        server = CultMesh.serve_node(node, write_authority=CultMeshGrantAllWrites())
+        send = server._send_rudp_packet
+        dropped: list[Any] = []
+        armed = threading.Event()
+
+        def lossy(rudp_socket: Any, remote_addr: Any, packet: Any) -> Any:
+            if armed.is_set() and not dropped and packet.packet_type == CultNetRudpPacketType.DATA and b"message_invalid" in (packet.payload or b""):
+                dropped.append(packet)
+                return None
+            return send(rudp_socket, remote_addr, packet)
+
+        server._send_rudp_packet = lossy
+        transport = self._rudp_open(server)
+        try:
+            for _ in range(MAX_CONSECUTIVE_REFUSED_FRAMES - 1):
+                self._rudp_answer(transport, b"\xc1")
+            armed.set()
+            reply = self._rudp_answer(transport, b"\xc1")
+            self.assertEqual(len(dropped), 1, "fixture: the first transmission of the last answer was lost")
+            self.assertEqual(reply["code"], "message_invalid")
+            self._assert_rudp_session_ended(transport, server)
+        finally:
+            transport.close()
+            server.stop()
+
+    def test_cultmesh_local_server_serves_nothing_after_the_capped_frame(self) -> None:
+        node = CultMesh.create_node(runtime_id="mesh-rudp-after-cap")
+        server = CultMesh.serve_node(node, write_authority=CultMeshGrantAllWrites())
+        transport = self._rudp_open(server)
+        try:
+            for _ in range(MAX_CONSECUTIVE_REFUSED_FRAMES - 1):
+                self._rudp_answer(transport, b"\xc1")
+            transport.send("schema", b"\xc1")
+            transport.send("schema", msgpack.packb(snapshot_request(message_id="behind-the-cap").to_wire(), use_bin_type=True))
+            first = msgpack.unpackb(transport.receive(timeout_seconds=4.0).payload, raw=False)
+            self.assertEqual(first["code"], "message_invalid")
+            with self.assertRaises(Exception):
+                transport.receive(timeout_seconds=1.0)
+        finally:
+            transport.close()
+            server.stop()
+
+    def test_cultmesh_local_server_ends_the_session_at_eight_refused_deletes_in_a_row(self) -> None:
+        class GrantOnlyKeyB:
+            def decide(self, request: Any) -> Any:
+                return CultMeshRemoteWriteDecision.grant() if request.record_key == "note:b" else CultMeshRemoteWriteDecision.refuse("no")
+
+        document = self._rudp_bound_note()
+        node = CultMesh.create_node(runtime_id="mesh-rudp-deletes")
+        node.database.register_document(document)
+        server = CultMesh.serve_node(node, write_authority=GrantOnlyKeyB())
+
+        def delete(key: str) -> bytes:
+            return msgpack.packb({
+                "schemaVersion": "cultnet.document_delete.v0",
+                "messageId": f"del-{key}",
+                "schemaId": document.schema_id,
+                "recordKey": key,
+            }, use_bin_type=True)
+
+        snapshot = msgpack.packb(snapshot_request(message_id="ok").to_wire(), use_bin_type=True)
+        transport = self._rudp_open(server)
+        try:
+            def refused_run(count: int) -> None:
+                for _ in range(count):
+                    reply = self._rudp_answer(transport, delete("note:a"))
+                    self.assertEqual(reply["code"], "write_not_authorized")
+                    self.assertEqual(reply["details"]["value"], "note:a")
+
+            refused_run(MAX_CONSECUTIVE_REFUSED_FRAMES - 1)
+            # A granted delete resets the run (nothing is stored under it, so the store answers that).
+            self.assertEqual(self._rudp_answer(transport, delete("note:b"))["code"], "unregistered_document_delete")
+            refused_run(MAX_CONSECUTIVE_REFUSED_FRAMES - 1)
+            # So does any decoded non-delete frame.
+            self.assertEqual(self._rudp_answer(transport, snapshot)["messageId"], "ok")
+            refused_run(MAX_CONSECUTIVE_REFUSED_FRAMES - 1)
+            transport.send("schema", delete("note:a"))
+            eighth = msgpack.unpackb(transport.receive(timeout_seconds=4.0).payload, raw=False)
+            self.assertEqual(eighth["code"], "write_not_authorized")
+            self._assert_rudp_session_ended(transport, server)
+        finally:
+            transport.close()
+            server.stop()
+
     def test_cultmesh_local_server_refuses_a_put_its_store_cannot_take_and_serves_on(self) -> None:
         # Well-formed puts the store refuses: a blank key, a payload that is not MessagePack, a
         # payload its schema cannot decode, a global document under another key. Each is refused

packages/cultmesh-rs/examples/receipt_interop_server.rs

@@ -0,0 +1,77 @@
+//! The real Rust RUDP document server on an ephemeral loopback port, for the cross-runtime write-receipt interop
+//! harness (packages/cultmesh-ts/test/interop/write-receipt-interop.test.ts). It is the production server with a
+//! recording sink and nothing else: stdout carries one JSON line per fact the harness asserts on, and the server runs
+//! until stdin closes.
+//!
+//!   {"event":"listening","port":N}
+//!   {"event":"applied","op":"put","messageId":"...","schemaId":"...","recordKey":"..."}
+//!
+//! Record keys that start with `refuse:` are refused by the sink (authorize and commit), which is how the harness
+//! asks for a refused write.
+use anyhow::Result;
+use cultmesh_rs::{
+    CultMeshRudpDocumentServer, CultMeshRudpRawDocumentReceipt, CultMeshRudpRawDocumentSink,
+    CultMeshRudpSnapshotQuery, CultMeshSystemClock,
+};
+use cultnet_rs::CultNetRawDocumentRecord;
+use serde_json::json;
+use std::io::Read;
+use std::net::UdpSocket;
+use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::thread;
+use std::time::Duration;
+
+const REFUSED_PREFIX: &str = "refuse:";
+
+struct RecordingSink;
+
+impl CultMeshRudpRawDocumentSink for RecordingSink {
+    fn authorize_raw_document(&mut self, receipt: &CultMeshRudpRawDocumentReceipt) -> Result<()> {
+        if receipt.document.record_key.starts_with(REFUSED_PREFIX) {
+            anyhow::bail!("not authorized");
+        }
+        Ok(())
+    }
+
+    fn accept_raw_document(&mut self, receipt: CultMeshRudpRawDocumentReceipt) -> Result<()> {
+        if receipt.document.record_key.starts_with(REFUSED_PREFIX) {
+            anyhow::bail!("not authorized");
+        }
+        println!(
+            "{}",
+            json!({
+                "event": "applied",
+                "op": "put",
+                "messageId": receipt.message_id,
+                "schemaId": receipt.document.schema_id,
+                "recordKey": receipt.document.record_key,
+            })
+        );
+        Ok(())
+    }
+}
+
+fn main() -> Result<()> {
+    let source = |_: &CultMeshRudpSnapshotQuery| -> Result<Vec<CultNetRawDocumentRecord>> { Ok(Vec::new()) };
+    let mut server = CultMeshRudpDocumentServer::new(
+        UdpSocket::bind("127.0.0.1:0")?,
+        RecordingSink,
+        source,
+        CultMeshSystemClock::default(),
+        Default::default(),
+    )?;
+    println!("{}", json!({ "event": "listening", "port": server.local_addr()?.port() }));
+    let stop = Arc::new(AtomicBool::new(false));
+    let watcher = Arc::clone(&stop);
+    thread::spawn(move || {
+        let mut sink = Vec::new();
+        let _ = std::io::stdin().read_to_end(&mut sink);
+        watcher.store(true, Ordering::SeqCst);
+    });
+    while !stop.load(Ordering::SeqCst) {
+        server.poll_once()?;
+        thread::sleep(Duration::from_millis(1));
+    }
+    Ok(())
+}

packages/cultmesh-rs/src/lib.rs

@@ -82,7 +82,10 @@ pub struct CultMeshRudpDocumentPublishOptions {
     pub target: SocketAddr,
     pub runtime_id: String,
     pub connect_timeout: Duration,
+    /// How long the acknowledgement of every put may take.
     pub flush_timeout: Duration,
+    /// How long after the acknowledgement a refusal may still arrive; a success frame ends the wait early.
+    pub result_window: Duration,
     pub poll_interval: Duration,
     pub resend_delay_ms: u64,
     pub source_agent_id: Option<String>,
@@ -149,6 +152,7 @@ impl Default for CultMeshRudpDocumentPublishOptions {
             runtime_id: "cultmesh-rudp-document-publisher".to_string(),
             connect_timeout: Duration::from_secs(3),
             flush_timeout: Duration::from_millis(300),
+            result_window: Duration::from_millis(500),
             poll_interval: Duration::from_millis(10),
             resend_delay_ms: 50,
             source_agent_id: None,
@@ -882,77 +886,30 @@ fn unix_millis() -> u128 {
 
 /// Publish one raw CultNet schema message to a RUDP catalog.
 ///
-/// Each call owns a fresh connection epoch and returns only after the catalog
+/// A put completes on the catalog's result frame, never on the transport
-/// acknowledges reliable application admission. Against a Rust CultMesh
+/// acknowledgement: an ack proves delivery, not admission. A refusal (a
-/// catalog, which never acknowledges a message it refuses, a refusal is
+/// `cultnet.error.v0` frame) returns an error in either order against the ack,
-/// returned as an error, naming the refusal when it is one of the fixed texts
+/// naming the refusal when it is one of the fixed texts a catalog sends. A
-/// such a catalog sends. A catalog that acknowledges a message on receipt and
+/// catalog that admits a put sends no success frame, so after the ack the call
-/// refuses it afterwards (the TypeScript document server does) is reported as
+/// waits `result_window` for a refusal and reports the put as admitted when
-/// having admitted it: the acknowledgement arrives first.
+/// none comes (interim until the catalog sends a success frame; a success
+/// frame ends the wait early). Each call owns a fresh connection epoch.
 pub fn publish_cultnet_message_to_rudp_catalog(
     message: &cultnet_rs::CultNetMessage,
     options: CultMeshRudpDocumentPublishOptions,
 ) -> Result<()> {
-    if options.runtime_id.trim().is_empty() {
+    publish_cultnet_messages_to_rudp_catalog(std::slice::from_ref(message), options)
-        anyhow::bail!("runtime_id must be non-empty");
-    }
-    let mut client = connect_rudp_client(
-        options.target,
-        &options.runtime_id,
-        options.connect_timeout,
-        options.poll_interval,
-        options.resend_delay_ms,
-        "cultmesh-rudp-document-publisher",
-    )?;
-
-    let payload = encode_cultnet_message_to_vec(message, CultNetWireContract::CultNetSchemaV0)?;
-    let receipt = client.send_reliable("schema", payload)?;
-    let flush_deadline = Instant::now() + options.flush_timeout;
-    while Instant::now() < flush_deadline {
-        if let Some(frame) = client.receive_once()? {
-            if frame.channel_id == "schema" {
-                if let Ok(cultnet_rs::CultNetMessage::Error { error, .. }) =
-                    decode_cultnet_message_from_slice(
-                        &frame.payload,
-                        CultNetWireContract::CultNetSchemaV0,
-                    )
-                {
-                    let _ = client.disconnect(b"document-refused".to_vec());
-                    anyhow::bail!(
-                        "CultMesh RUDP catalog {} refused the put{}",
-                        options.target,
-                        recognised_refusal(&error)
-                    );
-                }
-            }
-        }
-        match client.reliable_send_status(&receipt) {
-            cultnet_rs::CultNetRudpReliableSendStatus::Acknowledged => {
-                let _ = client.disconnect(b"document-acknowledged".to_vec());
-                return Ok(());
-            }
-            cultnet_rs::CultNetRudpReliableSendStatus::Invalidated => {
-                anyhow::bail!("CultMesh RUDP document receipt was invalidated")
-            }
-            cultnet_rs::CultNetRudpReliableSendStatus::Pending => {}
-        }
-        client.poll_resends()?;
-        thread::sleep(options.poll_interval);
-    }
-    let _ = client.disconnect(b"document-unacknowledged".to_vec());
-    anyhow::bail!(
-        "timed out waiting for reliable acknowledgement from CultMesh RUDP catalog {}",
-        options.target
-    )
 }
 
-/// Publish a batch of raw CultNet schema messages to a RUDP catalog.
+/// Publish a batch of raw CultNet schema messages to a RUDP catalog on one
+/// connection.
 ///
-/// Unlike [`publish_cultnet_message_to_rudp_catalog`], which polls for
+/// Completes under the same rule as [`publish_cultnet_message_to_rudp_catalog`]:
-/// per-message application-level acknowledgement, this sends every message on
+/// every message acknowledged, then no refusal frame within `result_window`
-/// one connection and waits only for a transport-level `flush_reliable`. It
+/// (or one success frame per message). A refusal of any message in the batch
-/// trades per-receipt confirmation for batch throughput; callers that need a
+/// fails the whole call; the batch cannot hide it. The catalog's answers do not
-/// stronger delivery guarantee should use the singular publish path instead.
+/// name the message they answer, so a failed batch does not say which message
+/// was refused or whether the others were admitted.
 pub fn publish_cultnet_messages_to_rudp_catalog(
     messages: &[cultnet_rs::CultNetMessage],
     options: CultMeshRudpDocumentPublishOptions,
@@ -969,11 +926,62 @@ pub fn publish_cultnet_messages_to_rudp_catalog(
         "cultmesh-rudp-document-publisher",
     )?;
 
+    let mut receipts = Vec::with_capacity(messages.len());
     for message in messages {
         let payload = encode_cultnet_message_to_vec(message, CultNetWireContract::CultNetSchemaV0)?;
-        client.send("schema", payload)?;
+        receipts.push(client.send_reliable("schema", payload)?);
+    }
+    let ack_deadline = Instant::now() + options.flush_timeout;
+    let mut acknowledged_at: Option<Instant> = None;
+    let mut successes = 0;
+    loop {
+        while let Some(frame) = client.receive_once()? {
+            if frame.channel_id != "schema" {
+                continue;
+            }
+            match decode_cultnet_message_from_slice(&frame.payload, CultNetWireContract::CultNetSchemaV0) {
+                Ok(cultnet_rs::CultNetMessage::Error { error, .. }) => {
+                    let _ = client.disconnect(b"document-refused".to_vec());
+                    anyhow::bail!(
+                        "CultMesh RUDP catalog {} refused the put{}",
+                        options.target,
+                        recognised_refusal(&error)
+                    );
+                }
+                Ok(_) => successes += 1,
+                Err(_) => {}
+            }
+        }
+        if acknowledged_at.is_none() {
+            let mut all_acknowledged = true;
+            for receipt in &receipts {
+                match client.reliable_send_status(receipt) {
+                    cultnet_rs::CultNetRudpReliableSendStatus::Acknowledged => {}
+                    cultnet_rs::CultNetRudpReliableSendStatus::Invalidated => {
+                        anyhow::bail!("CultMesh RUDP document receipt was invalidated")
+                    }
+                    cultnet_rs::CultNetRudpReliableSendStatus::Pending => all_acknowledged = false,
+                }
+            }
+            if all_acknowledged {
+                acknowledged_at = Some(Instant::now());
+            } else if Instant::now() >= ack_deadline {
+                let _ = client.disconnect(b"document-unacknowledged".to_vec());
+                anyhow::bail!(
+                    "timed out waiting for reliable acknowledgement from CultMesh RUDP catalog {}",
+                    options.target
+                )
+            }
+        }
+        if let Some(acknowledged_at) = acknowledged_at {
+            if successes >= messages.len() || acknowledged_at.elapsed() >= options.result_window {
+                let _ = client.disconnect(b"document-completed".to_vec());
+                return Ok(());
+            }
+        }
+        client.poll_resends()?;
+        thread::sleep(options.poll_interval);
     }
-    client.flush_reliable(options.flush_timeout)
 }
 
 fn connect_rudp_client(
@@ -1451,6 +1459,141 @@ mod tests {
         Ok((target, stop, catalog))
     }
 
+    /// A catalog that acknowledges every reliable message it receives and refuses it with a typed
+    /// write_not_authorized, the acknowledgement either before the refusal or after it (the second packet
+    /// follows the first by 100 ms). The refusal carries no acknowledgement of its own.
+    /// What the stub catalog sends for a put, and in which order against the transport ack.
+    #[derive(Clone, Copy, PartialEq, Eq)]
+    enum CatalogReply {
+        RefusalThenAck,
+        AckThenRefusal,
+        AckThenSuccess,
+    }
+
+    fn acknowledging_refusing_catalog(
+        reply: CatalogReply,
+    ) -> Result<(
+        SocketAddr,
+        std::sync::Arc<std::sync::atomic::AtomicBool>,
+        thread::JoinHandle<Result<()>>,
+    )> {
+        use cultnet_rs::{
+            CultNetRudpPacketType, CultNetRudpSendOptions, CultNetRudpSession,
+            CultNetRudpSessionOptions, decode_rudp_packet, encode_rudp_packet,
+        };
+        let socket = UdpSocket::bind("127.0.0.1:0")?;
+        socket.set_read_timeout(Some(Duration::from_millis(5)))?;
+        let target = socket.local_addr()?;
+        let stop = std::sync::Arc::new(std::sync::atomic::AtomicBool::new(false));
+        let catalog_stop = stop.clone();
+        let catalog = thread::spawn(move || -> Result<()> {
+            let mut session: Option<CultNetRudpSession> = None;
+            let mut wire = vec![0_u8; 65_535];
+            while !catalog_stop.load(std::sync::atomic::Ordering::SeqCst) {
+                let Ok((bytes, peer)) = socket.recv_from(&mut wire) else {
+                    continue;
+                };
+                let Ok(packet) = decode_rudp_packet(&wire[..bytes]) else {
+                    continue;
+                };
+                if packet.packet_type == CultNetRudpPacketType::Connect {
+                    let mut accepted = CultNetRudpSession::new(CultNetRudpSessionOptions {
+                        connection_id: packet.connection_id,
+                        initial_sequence: None,
+                        resend_delay_ms: 10_000,
+                        max_pending_reliable_packets: Some(64),
+                    });
+                    let accept = accepted.accept_connect(&packet, 0, Vec::new())?;
+                    socket.send_to(&encode_rudp_packet(&accept)?, peer)?;
+                    session = Some(accepted);
+                    continue;
+                }
+                let Some(session) = session.as_mut() else {
+                    continue;
+                };
+                let Ok(received) = session.receive(&packet, 1) else {
+                    continue;
+                };
+                if !packet.reliable || received.delivered.is_empty() {
+                    continue;
+                }
+                let ack = session.create_ack_for_received(packet.sequence);
+                let refusal = encode_cultnet_message_to_vec(
+                    &if reply == CatalogReply::AckThenSuccess {
+                        cultnet_rs::CultNetMessage::SnapshotResponseRaw {
+                            message_id: "completion".into(),
+                            documents: Vec::new(),
+                        }
+                    } else {
+                        cultnet_rs::CultNetMessage::Error {
+                            error: "write_not_authorized: the catalog refused the document".into(),
+                            code: Some(cultnet_rs::CultNetErrorCode::WriteNotAuthorized),
+                            details: None,
+                        }
+                    },
+                    CultNetWireContract::CultNetSchemaV0,
+                )?;
+                let options = CultNetRudpSendOptions {
+                    reliable: false,
+                    ordered: false,
+                    sequenced: false,
+                    now_ms: 2,
+                    reliable_expire_after_ms: None,
+                };
+                let mut refusals = session.send_many("schema", refusal, options, Some(1200))?;
+                for refusal in &mut refusals {
+                    refusal.ack = 0;
+                    refusal.ack_mask = 0;
+                }
+                let send_refusals = |socket: &UdpSocket| -> Result<()> {
+                    for refusal in &refusals {
+                        socket.send_to(&encode_rudp_packet(refusal)?, peer)?;
+                    }
+                    Ok(())
+                };
+                if reply == CatalogReply::RefusalThenAck {
+                    send_refusals(&socket)?;
+                    thread::sleep(Duration::from_millis(100));
+                    socket.send_to(&encode_rudp_packet(&ack)?, peer)?;
+                } else {
+                    socket.send_to(&encode_rudp_packet(&ack)?, peer)?;
+                    thread::sleep(Duration::from_millis(100));
+                    send_refusals(&socket)?;
+                }
+            }
+            Ok(())
+        });
+        Ok((target, stop, catalog))
+    }
+
+    fn publish_options(target: SocketAddr) -> CultMeshRudpDocumentPublishOptions {
+        CultMeshRudpDocumentPublishOptions {
+            target,
+            connect_timeout: Duration::from_secs(2),
+            flush_timeout: Duration::from_secs(3),
+            poll_interval: Duration::from_millis(2),
+            resend_delay_ms: 5,
+            ..CultMeshRudpDocumentPublishOptions::default()
+        }
+    }
+
+    fn refused_note() -> cultnet_rs::CultNetMessage {
+        cultnet_rs::CultNetMessage::DocumentPutRaw {
+            message_id: "completion".into(),
+            document: cultnet_rs::CultNetRawDocumentRecord {
+                schema_id: "cultmesh.test.raw.v0".into(),
+                record_key: "tests:completion:a".into(),
+                stored_at: "2026-11-08T00:00:00Z".into(),
+                payload_encoding: cultnet_rs::CultNetRawPayloadEncoding::Messagepack,
+                payload: vec![0xc0],
+                source_runtime_id: None,
+                source_agent_id: None,
+                source_role: None,
+                tags: None,
+            },
+        }
+    }
+
     /// A catalog's refusal text is quoted only when it is one of the fixed
     /// refusals a CultMesh catalog sends. Any other text, which could carry
     /// anything, stays out of the publisher's error.
@@ -1901,4 +2044,63 @@ mod tests {
         assert_eq!(lease.bytes(), &[1, 2, 3]);
         Ok(())
     }
+
+    // Heimdall's invariant: no client treats a reliable-transport ack as write admission. The catalog here
+    // acknowledges the put and refuses it, the refusal arriving before or after the ack.
+    #[test]
+    fn a_publish_whose_refusal_arrives_before_the_ack_is_refused() -> Result<()> {
+        let (target, stop, catalog) = acknowledging_refusing_catalog(CatalogReply::RefusalThenAck)?;
+        let result = publish_cultnet_message_to_rudp_catalog(&refused_note(), publish_options(target));
+        stop.store(true, std::sync::atomic::Ordering::SeqCst);
+        catalog.join().expect("catalog thread should not panic")?;
+        let error = result.expect_err("a refused put is never reported as admitted");
+        assert!(error.to_string().contains("refused the put"), "{error:#}");
+        Ok(())
+    }
+
+
+    #[test]
+    fn a_publish_whose_ack_arrives_before_the_refusal_is_refused() -> Result<()> {
+        let (target, stop, catalog) = acknowledging_refusing_catalog(CatalogReply::AckThenRefusal)?;
+        let result = publish_cultnet_message_to_rudp_catalog(&refused_note(), publish_options(target));
+        stop.store(true, std::sync::atomic::Ordering::SeqCst);
+        catalog.join().expect("catalog thread should not panic")?;
+        let error = result.expect_err("a refused put is never reported as admitted");
+        assert!(error.to_string().contains("refused the put"), "{error:#}");
+        Ok(())
+    }
+
+    #[test]
+    fn a_batch_publish_is_not_complete_on_the_ack_of_refused_puts() -> Result<()> {
+        for reply in [CatalogReply::AckThenRefusal, CatalogReply::RefusalThenAck] {
+            let (target, stop, catalog) = acknowledging_refusing_catalog(reply)?;
+            let result = publish_cultnet_messages_to_rudp_catalog(&[refused_note()], publish_options(target));
+            stop.store(true, std::sync::atomic::Ordering::SeqCst);
+            catalog.join().expect("catalog thread should not panic")?;
+            assert!(result.is_err(), "a refused put was reported as published");
+        }
+        Ok(())
+    }
+
+    #[test]
+    fn a_success_frame_completes_the_publish_without_waiting_out_the_result_window() -> Result<()> {
+        for batch in [false, true] {
+            let (target, stop, catalog) = acknowledging_refusing_catalog(CatalogReply::AckThenSuccess)?;
+            let options = CultMeshRudpDocumentPublishOptions {
+                result_window: Duration::from_secs(30),
+                ..publish_options(target)
+            };
+            let started = Instant::now();
+            let result = if batch {
+                publish_cultnet_messages_to_rudp_catalog(&[refused_note()], options)
+            } else {
+                publish_cultnet_message_to_rudp_catalog(&refused_note(), options)
+            };
+            stop.store(true, std::sync::atomic::Ordering::SeqCst);
+            catalog.join().expect("catalog thread should not panic")?;
+            result?;
+            assert!(started.elapsed() < Duration::from_secs(10), "batch={batch}: waited out the window");
+        }
+        Ok(())
+    }
 }

packages/cultmesh-ts/CHANGELOG.md

@@ -5,8 +5,13 @@ All notable changes to `@gamecult/cultmesh-ts` are recorded here, following
 
 ## Unreleased
 
+### Added
+
+- `publishRudpDocumentOnce` takes `writeReceipts: true`: it sends a hello listing `cultnet.write_admitted.v0` and `cultnet.error.v1` and, against a server that lists both back, resolves only on that write's `write_admitted`, rejects with `CultMeshRudpWriteRefusedError` (now also carrying an `error.v1`) on its refusal and with the new `CultMeshRudpWriteUnconfirmedError` (`reason`: `window_elapsed` after 5000 ms, `session_ended`, or `local_send_failed`) when nothing settles it. Without the option, or against a server that did not advertise, there is no hello and the window is 500 ms; a put nothing settled in it is unconfirmed too, no longer "published" (**behaviour change**: a server that applies a put but answers nothing now yields `CultMeshRudpWriteUnconfirmedError`, as the spec requires). A legacy server's echo of the put's id is not admission: only `write_admitted` is. The flush that sends the put is bounded by the result window, and a send not acknowledged by then is `local_send_failed`. `resultWindowMs` overrides either window. `publishRudpDocumentAndWaitForReceipt` is not changed.
+
 ### Breaking
 
+- `publishRudpDocumentOnce` no longer treats a window with no refusal as published: a put nothing settled in its result window (500 ms, or 5000 ms against a receipt-capable server) rejects `CultMeshRudpWriteUnconfirmedError`, and a legacy server's echo of the put's id is not admission. It now resolves `"admitted"` (only on a `write_admitted`) or `"sent"`. **Migration:** a caller whose server cannot answer a write yet (for example Odin, until it is receipt-capable) passes `sendOnly: true` per call and treats `"sent"` as "sent", never as admitted. Receipts stay opt-in (`writeReceipts: true`); neither mode is the default.
 - The package is renamed `cultmesh-ts` to `@gamecult/cultmesh-ts` (the repo already scopes `@gamecult/cultcache-ts`), so the unscoped name cannot be claimed by someone else. Import from `@gamecult/cultmesh-ts` and its subpaths; the API is unchanged. Depends on `@gamecult/cultnet-ts`.
 - `asSchemaAlias` is removed from `CultMeshDocumentHandle`, `CultMeshCollectionHandle` and their bound forms. Read the handle by the schema you mean.
 - `CultMeshDocumentCatalog` (`document`, `tryDocument`, `latest`, `replace`, `submitPrediction`, `authoritativeWriter`, `predictionWriter`, `watch`) and `CultMeshCollectionCatalog` (`collection`, `tryCollection`, `latest`, `watchChanges`) take `<TDocument = never, TSchema>` and yield `CultMeshCatalogValue<TDocument, TSchema>`: an explicit type argument wins, a CultCache document definition names its own value type, and a bare schema descriptor yields `unknown`. A value type is no longer inferred from a value or an expected result. The `parse` option is removed from these calls, and a lookup by type answers with that type's handle or none, not an alias of a compatible schema.
@@ -16,6 +21,7 @@ All notable changes to `@gamecult/cultmesh-ts` are recorded here, following
 
 ### Added
 
+- `createRudpDocumentServer` ends a session after `CULTMESH_RUDP_DOCUMENT_SERVER_MAX_CONSECUTIVE_REFUSED_FRAMES` (8) consecutive undecodable frames or consecutive deletes the write authority refuses; fewer are answered and the session is kept. Any decoded frame resets the undecodable run, any decoded non-refused-delete frame resets the delete run. The same cap holds in every runtime.
 - `CultMeshCatalogValue<TDocument, TSchema>`, exported.
 - `documentById` and `tryDocumentById` on `CultMeshDocumentCatalog`, which address one document by its document id when a catalog holds several documents of one type.
 

packages/cultmesh-ts/package.json

@@ -24,7 +24,8 @@
     "build": "node ../../node_modules/typescript/bin/tsc -p tsconfig.json",
     "prepack": "node ../../node_modules/typescript/bin/tsc -p tsconfig.json",
     "typecheck": "node ../../node_modules/typescript/bin/tsc -p tsconfig.json --pretty false",
-    "test": "node ../../node_modules/typescript/bin/tsc -p tsconfig.json && node ../../node_modules/typescript/bin/tsc -p tsconfig.test.json && node --expose-gc --test dist-test/test/*.test.js"
+    "test": "node ../../node_modules/typescript/bin/tsc -p tsconfig.json && node ../../node_modules/typescript/bin/tsc -p tsconfig.test.json && node --expose-gc --test dist-test/test/*.test.js",
+    "test:interop": "npm --prefix ../.. run build --workspace @gamecult/cultcache-ts --workspace @gamecult/cultnet-ts && node ../../node_modules/typescript/bin/tsc -p tsconfig.json && node ../../node_modules/typescript/bin/tsc -p tsconfig.test.json && node --test --test-force-exit dist-test/test/interop/write-receipt-interop.test.js"
   },
   "keywords": [
     "cultmesh",

packages/cultmesh-ts/src/index.ts

@@ -20,6 +20,10 @@ import {
   CultNetRudpSocketTransportConnection,
   rudpClientBindHost,
   CultNetSchemaCatalog,
+  CULTNET_WRITE_RECEIPT_MESSAGE_VERSIONS,
+  WriteTracker,
+  helloAdvertisesWriteReceipts,
+  resultWindowMs,
   cultNetMessageInvalidError,
   cultNetTextError,
   cultNetWriteNotAuthorizedError,
@@ -44,6 +48,8 @@ import {
   type CultNetSchemaCatalogOptions,
   type CultNetSnapshotResponseRawMessage,
   type CultNetWireContract,
+  type WriteSettlement,
+  type WriteUnconfirmedReason,
 } from "@gamecult/cultnet-ts";
 
 import {
@@ -4121,6 +4127,16 @@ export interface CultMeshRudpDocumentServerOptions extends CultMeshRudpSocketOpt
 /** A write authority that has not answered in this long has refused the write. */
 export const CULTMESH_RUDP_DOCUMENT_SERVER_DEFAULT_DECIDE_TIMEOUT_MS = 5_000;
 
+/**
+ * How many consecutive refused frames of one kind a `createRudpDocumentServer` session may send before it is
+ * ended: undecodable frames (reset by any frame that decodes) and deletes the write authority refuses (reset by any
+ * decoded frame that is not a refused delete). Fewer are answered with a typed refusal and the session is kept; the
+ * frame that reaches this number is answered too, then the session ends. The same number is the cap in every runtime.
+ */
+export const CULTMESH_RUDP_DOCUMENT_SERVER_MAX_CONSECUTIVE_REFUSED_FRAMES = 8;
+/** How long a session whose capped frame was answered waits for the peer to acknowledge the answers before it ends anyway. */
+const CULTMESH_RUDP_DOCUMENT_SERVER_CAPPED_ANSWER_GRACE_MS = 2000;
+
 /** Replies larger than one fragment are split into fragments of at most this many bytes. */
 export const CULTMESH_RUDP_DOCUMENT_SERVER_DEFAULT_MAX_FRAGMENT_BYTES = 1200;
 
@@ -4173,7 +4189,64 @@ export interface CultMeshRudpDocumentServer {
   close(): void;
 }
 
+/**
+ * A write the peer refused: the typed `cultnet.error.v0` it answered with (`write_not_authorized`,
+ * `message_invalid`, ...), whichever of the transport ack and the result frame came first.
+ */
+export class CultMeshRudpWriteRefusedError extends Error {
+  readonly code: string | undefined;
+  readonly response: Extract<CultNetMessage, { schemaVersion: "cultnet.error.v0" | "cultnet.error.v1" }>;
+  constructor(response: Extract<CultNetMessage, { schemaVersion: "cultnet.error.v0" | "cultnet.error.v1" }>) {
+    super(response.error);
+    this.name = "CultMeshRudpWriteRefusedError";
+    this.code = response.code ?? undefined;
+    this.response = response;
+  }
+}
+
+/**
+ * Nothing settled the write (write-receipt.md, "unconfirmed"): the result window ran out with no answer, the
+ * session ended first, or the client's own send failed. Not success and not refusal; a caller that needs admission treats it as not admitted.
+ */
+export class CultMeshRudpWriteUnconfirmedError extends Error {
+  readonly reason: WriteUnconfirmedReason;
+  readonly messageId: string;
+  constructor(messageId: string, reason: WriteUnconfirmedReason) {
+    super(`Write ${messageId} was not confirmed: ${reason}.`);
+    this.name = "CultMeshRudpWriteUnconfirmedError";
+    this.reason = reason;
+    this.messageId = messageId;
+  }
+}
+
 export interface CultMeshRudpDocumentPublishOptions extends CultMeshRudpPeerOptions {
+  /**
+   * How long, counted from the send, the put may wait for its result frame. A reliable-transport ack is not
+   * admission; the outcome is the peer's result frame. Default: 5000 ms against a server whose hello lists the
+   * write-receipt frames, 500 ms otherwise. A put nothing settled within the window is unconfirmed, never
+   * published, whatever the server advertised: only a `write_admitted` is admission. The send itself is also
+   * bounded by the window (`flushTimeoutMs` is the upper bound); a send not acknowledged by then is
+   * unconfirmed as `local_send_failed`.
+   */
+  resultWindowMs?: number;
+  /**
+   * Declare the write-receipt capability: send a hello listing `cultnet.write_admitted.v0` and `cultnet.error.v1`
+   * before the put. A server that lists both back is receipt-capable: the put then resolves only on its
+   * `write_admitted`, rejects with `CultMeshRudpWriteRefusedError` on its `error.v1`, and rejects with
+   * `CultMeshRudpWriteUnconfirmedError` when nothing settles it. Unset, no hello is sent and the server answers
+   * as it always did.
+   */
+  writeReceipts?: boolean;
+  /** With `writeReceipts`, how long to wait for the server's hello before treating it as legacy. Default 500 ms. */
+  helloWaitMs?: number;
+  /**
+   * Send the put and report only that it was sent: no hello, no wait for a result frame. Resolves `"sent"` once the
+   * transport has acknowledged the put (`flushTimeoutMs`), rejects `CultMeshRudpWriteUnconfirmedError`
+   * (`local_send_failed`) if it cannot be sent, and never resolves `"admitted"`: whether the server applied or
+   * refused it is unknown. For callers whose server cannot answer a write yet. Opt-in per call; not combinable with
+   * `writeReceipts`.
+   */
+  sendOnly?: boolean;
   messageId?: string;
   sourceRuntimeId?: string;
   sourceAgentId?: string;
@@ -5537,6 +5610,11 @@ export class CultMesh {
       closed: boolean;
       /** A packet it owed could never be sent, so the session ended. */
       unsendable: boolean;
+      /** Consecutive undecodable frames, and consecutive deletes the authority refused. */
+      unreadableInARow: number;
+      refusedDeletesInARow: number;
+      /** Set once the peer's capped frame is answered: the session ends when the answers are acknowledged, or at this time. */
+      endingDeadlineMs?: number;
       work: Promise<void>;
     };
     const sessions = new Map<string, SessionRecord>();
@@ -5591,6 +5669,8 @@ export class CultMesh {
             connectPayload,
             closed: false,
             unsendable: false,
+            unreadableInARow: 0,
+            refusedDeletesInARow: 0,
             session: new CultNetRudpSession({
               connectionId,
               initialSequence: options.initialSequence,
@@ -5655,7 +5735,8 @@ export class CultMesh {
       record: SessionRecord,
       payload: Uint8Array,
     ): Promise<void> {
-      if (record.closed) return;
+      // Nothing after the capped frame is served while its answer is delivered.
+      if (record.closed || record.endingDeadlineMs !== undefined) return;
       let decoded: unknown;
       let message: CultNetMessage;
       try {
@@ -5665,12 +5746,21 @@ export class CultMesh {
         // A frame the server cannot read is judged as the write it looks like (a put when it does not even decode), so
         // an ungranted peer hears the same refusal for it as for any other write, not a parse error.
         const write = readableWrite(decoded);
-        if (decoded !== undefined && !write) throw error;
+        record.unreadableInARow += 1;
-        if (await writeRefused(record, write?.operation ?? "put", write?.schemaId ?? "", write?.recordKey ?? "", null, null)) return;
+        if (decoded !== undefined && !write) {
-        reportError(error);
+          // It decodes but is no message the parser takes (an unknown schemaVersion, a non-map) and is no write the
-        sendSchemaMessage(record, cultNetMessageInvalidError("message", "CultMesh RUDP document server could not read the write."));
+          // authority could judge: answered and counted like any other unreadable frame.
+          reportError(error);
+          sendSchemaMessage(record, cultNetMessageInvalidError("message", "CultMesh RUDP document server could not read the message."));
+        } else if (!await writeRefused(record, write?.operation ?? "put", write?.schemaId ?? "", write?.recordKey ?? "", null, null)) {
+          reportError(error);
+          sendSchemaMessage(record, cultNetMessageInvalidError("message", "CultMesh RUDP document server could not read the write."));
+        }
+        if (record.unreadableInARow >= CULTMESH_RUDP_DOCUMENT_SERVER_MAX_CONSECUTIVE_REFUSED_FRAMES) endCappedSession(record);
         return;
       }
+      record.unreadableInARow = 0;
+      if (message.schemaVersion !== "cultnet.document_delete.v0") record.refusedDeletesInARow = 0;
       switch (message.schemaVersion) {
         case "cultnet.snapshot_request.v0": {
           if (!options.getCache) {
@@ -5744,7 +5834,12 @@ export class CultMesh {
           }
           return;
         case "cultnet.document_delete.v0": {
-          if (await writeRefused(record, "delete", message.schemaId, message.recordKey, null, null)) return;
+          if (await writeRefused(record, "delete", message.schemaId, message.recordKey, null, null)) {
+            record.refusedDeletesInARow += 1;
+            if (record.refusedDeletesInARow >= CULTMESH_RUDP_DOCUMENT_SERVER_MAX_CONSECUTIVE_REFUSED_FRAMES) endCappedSession(record);
+            return;
+          }
+          record.refusedDeletesInARow = 0;
           if (!options.onDocumentDeleteRaw) {
             sendSchemaMessage(record, cultNetTextError("CultMesh RUDP document server has no delete handler."));
             return;
@@ -5895,6 +5990,17 @@ export class CultMesh {
       sendRudpDatagram(socket, goodbye, record.remote.port, record.remote.address, () => {});
     }
 
+    /**
+     * A session that reached the cap of consecutive refused frames: its last refusal went out like any reply
+     * (reliable, so a lost datagram is resent), and the session ends once the peer has acknowledged every reply or
+     * the grace runs out. The resend timer ends it.
+     */
+    function endCappedSession(record: SessionRecord): void {
+      const key = `${record.remote.address}:${record.remote.port}`;
+      if (sessions.get(key) !== record) return;
+      record.endingDeadlineMs ??= Date.now() + CULTMESH_RUDP_DOCUMENT_SERVER_CAPPED_ANSWER_GRACE_MS;
+    }
+
     /** The session owes its peer a packet that can never be sent as built. */
     function endUnsendableSession(record: SessionRecord, error: Error): void {
       if (record.unsendable) return;
@@ -6028,6 +6134,11 @@ export class CultMesh {
               closeSession(record);
               continue;
             }
+            if (record.endingDeadlineMs !== undefined
+              && (record.session.outstandingReliablePacketCount === 0 || nowMs >= record.endingDeadlineMs)) {
+              endRefusedSession(key, record);
+              continue;
+            }
             for (const packet of record.session.dueResends(nowMs)) {
               sendPacket(record, packet);
             }
@@ -6105,25 +6216,88 @@ export class CultMesh {
     recordKey: string,
     value: CultCacheDocumentValue<TDefinition>,
     options: CultMeshRudpDocumentPublishOptions = {},
-  ): Promise<void> {
+  ): Promise<"admitted" | "sent"> {
     requireNonEmpty(runtimeId, "runtimeId");
     requireNonEmpty(recordKey, "recordKey");
+    if (options.sendOnly && options.writeReceipts) throw new TypeError("sendOnly and writeReceipts cannot be combined.");
     const registry = new CultNetDocumentRegistry([binding]);
+    const messageId = options.messageId ?? `${runtimeId}:${binding.definition.type}:${recordKey}`;
+    // Built before any connection and outside every try: a put that cannot be built is the caller's error, with its cause.
+    const put = registry.createRawDocumentPutMessage(
+      binding,
+      messageId,
+      recordKey,
+      value,
+      {
+        sourceRuntimeId: options.sourceRuntimeId ?? runtimeId,
+        sourceAgentId: options.sourceAgentId,
+        sourceRole: options.sourceRole,
+        tags: options.tags,
+      },
+    );
     const peer = await CultMesh.createRudpPeer(runtimeId, connectionId, endpoint, options);
     try {
-      peer.send(registry.createRawDocumentPutMessage(
+      if (options.sendOnly) {
-        binding,
+        try {
-        options.messageId ?? `${runtimeId}:${binding.definition.type}:${recordKey}`,
+          peer.send(put);
-        recordKey,
+          await peer.flush(options.flushTimeoutMs ?? 30_000);
-        value,
+        } catch {
-        {
+          throw new CultMeshRudpWriteUnconfirmedError(messageId, "local_send_failed");
-          sourceRuntimeId: options.sourceRuntimeId ?? runtimeId,
+        }
-          sourceAgentId: options.sourceAgentId,
+        return "sent";
-          sourceRole: options.sourceRole,
+      }
-          tags: options.tags,
+      // A transport ack is not admission: the put completes on its result frame, and the WriteTracker alone decides
-        },
+      // how it settles (write-receipt.md, "Client rules"). This function only maps the settlement to resolve/throw.
-      ));
+      let receiptCapable = false;
-      await peer.flush(options.flushTimeoutMs ?? 30_000);
+      let tracker: WriteTracker | undefined;
+      let settlement: WriteSettlement | undefined;
+      let wake: (() => void) | undefined;
+      let serverHello: (() => void) | undefined;
+      peer.on("message", (message: CultNetMessage) => {
+        if (message.schemaVersion === "cultnet.hello.v0") {
+          receiptCapable = helloAdvertisesWriteReceipts(message);
+          serverHello?.();
+        } else {
+          tracker?.frame(message, Date.now());
+        }
+      });
+      peer.on("close", () => tracker?.sessionEnd(Date.now()));
+      if (options.writeReceipts) {
+        const answered = new Promise<void>((resolve) => { serverHello = resolve; });
+        peer.sendHello({
+          schemaVersion: "cultnet.hello.v0", runtimeId, runtimeKind: "cultmesh-ts",
+          supportedMessageVersions: [...CULTNET_WRITE_RECEIPT_MESSAGE_VERSIONS],
+        });
+        let helloTimer: NodeJS.Timeout | undefined;
+        await Promise.race([answered, new Promise<void>((resolve) => { helloTimer = setTimeout(resolve, options.helloWaitMs ?? 500); })]);
+        clearTimeout(helloTimer);
+      }
+      const writeTracker = new WriteTracker({
+        windowMs: options.resultWindowMs ?? resultWindowMs(receiptCapable),
+        onSettle: (_id, result) => { settlement = result; wake?.(); },
+      });
+      tracker = writeTracker;
+      writeTracker.send(messageId, Date.now());
+      try {
+        peer.send(put);
+        // The flush may not outlast the result window: a send nobody acknowledged by then is a local send failure.
+        const windowRemaining = writeTracker.nextDeadlineMs(Date.now()) ?? 0;
+        await peer.flush(Math.min(options.flushTimeoutMs ?? 30_000, Math.max(windowRemaining, 1)));
+      } catch {
+        // Our own send failed or was never acknowledged: the put may or may not have left. Never a refusal.
+        writeTracker.sendFailed(messageId, Date.now());
+      }
+      while (!settlement) {
+        const remaining = writeTracker.nextDeadlineMs(Date.now()) ?? 0;
+        await new Promise<void>((resolve) => {
+          const timer = setTimeout(resolve, remaining);
+          wake = () => { clearTimeout(timer); resolve(); };
+        });
+        writeTracker.tick(Date.now());
+      }
+      if (settlement.outcome === "refused") throw new CultMeshRudpWriteRefusedError(settlement.response);
+      if (settlement.outcome === "unconfirmed") throw new CultMeshRudpWriteUnconfirmedError(messageId, settlement.reason);
+      return "admitted";
     } finally {
       peer.close();
     }
@@ -6142,6 +6316,7 @@ export class CultMesh {
       const receipt = new Promise<CultCacheDocumentValue<TReceiptDefinition>>((resolve, reject) => {
         const timeout = setTimeout(() => { cleanup(); reject(new Error(`Timed out waiting for RUDP application receipt for ${recordKey}.`)); }, options.receiptTimeoutMs ?? 5_000);
         const onMessage = (message: CultNetMessage): void => {
+          if (message.schemaVersion === "cultnet.error.v0") { cleanup(); reject(new CultMeshRudpWriteRefusedError(message)); return; }
           if (message.schemaVersion !== "cultnet.document_put_raw.v0" || message.messageId !== messageId || message.document.schemaId !== receiptBinding.definition.schemaId) return;
           try {
             const decoded = decodeDocumentPayload(receiptBinding.definition, message.document.payload);

packages/cultmesh-ts/test/client-write-completion.test.ts

@@ -0,0 +1,120 @@
+// Heimdall's invariant: no client may treat a reliable-transport ack as write admission. A put completes only
+// on its result frame (write_not_authorized, or the success reply). Each test serves a client a peer that
+// acknowledges the put and refuses it, the ack arriving before the refusal and after it.
+import assert from "node:assert/strict";
+import { createSocket, type Socket } from "node:dgram";
+import test from "node:test";
+import { z } from "zod";
+import { defineDocumentType } from "@gamecult/cultcache-ts";
+import {
+  CultNetDocumentRegistry,
+  CultNetRudpSession,
+  cultNetWriteNotAuthorizedError,
+  decodeRudpPacket,
+  defineCultNetDocumentBinding,
+  encodeCultNetMessageForWire,
+  encodeRudpPacket,
+} from "@gamecult/cultnet-ts";
+import { encodeWireValue } from "@gamecult/cultnet-ts/wire";
+import { CultMesh, CultMeshGrantAllWrites, CultMeshRudpWriteRefusedError, CultMeshRudpWriteUnconfirmedError } from "../src/index";
+
+const isTheRefusal = (error: unknown): boolean =>
+  error instanceof CultMeshRudpWriteRefusedError && error.code === "write_not_authorized";
+
+const note = defineDocumentType({
+  type: "cultmesh.completion_note",
+  schemaId: "cultmesh.completion_note.v0",
+  schema: z.object({ noteId: z.string(), text: z.string() }),
+  name: "noteId",
+});
+const binding = defineCultNetDocumentBinding({ definition: note });
+const sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));
+
+type Order = "ack-then-refusal" | "refusal-then-ack";
+
+/** A peer that acknowledges every reliable put and refuses it with write_not_authorized, in the given order. */
+async function refusingPeer(connectionId: number, order: Order) {
+  const socket: Socket = createSocket("udp4");
+  await new Promise<void>((resolve) => socket.bind(0, "127.0.0.1", resolve));
+  const session = new CultNetRudpSession({ connectionId, resendDelayMs: 50 });
+  const timers = new Set<NodeJS.Timeout>();
+  let closed = false;
+  const send = (packet: Parameters<typeof encodeRudpPacket>[0], port: number, address: string) => {
+    if (!closed) socket.send(encodeRudpPacket(packet), port, address);
+  };
+  const later = (action: () => void) => { const timer = setTimeout(() => { timers.delete(timer); action(); }, 120); timers.add(timer); };
+  socket.on("message", (wire, remote) => {
+    const packet = decodeRudpPacket(wire);
+    const now = Date.now();
+    if (packet.packetType === "connect") {
+      send(session.acceptConnect(packet, now), remote.port, remote.address);
+      return;
+    }
+    const result = session.receive(packet, now);
+    if (result.reply) send(result.reply, remote.port, remote.address);
+    for (const frame of result.delivered) {
+      if (frame.channelId !== "schema") continue;
+      const ack = session.createAckForReceived(packet.sequence);
+      const refusal = session.sendMany(
+        "schema",
+        encodeWireValue(encodeCultNetMessageForWire(cultNetWriteNotAuthorizedError("tests:completion:a"), "cultnet.schema.v0")),
+        { reliable: true, ordered: true, nowMs: now },
+      );
+      if (order === "ack-then-refusal") {
+        send(ack, remote.port, remote.address);
+        later(() => refusal.forEach((p) => send(p, remote.port, remote.address)));
+      } else {
+        // The refusal carries no acknowledgement of its own; the ack follows it.
+        refusal.forEach((p) => send({ ...p, ack: 0, ackMask: 0 }, remote.port, remote.address));
+        later(() => send(ack, remote.port, remote.address));
+      }
+    }
+    if (packet.reliable) send(session.createAckForReceived(packet.sequence), remote.port, remote.address);
+  });
+  return { endpoint: `rudp://127.0.0.1:${socket.address().port}`, close: () => { closed = true; timers.forEach(clearTimeout); socket.close(); } };
+}
+
+const orders: Order[] = ["ack-then-refusal", "refusal-then-ack"];
+let nextConnection = 0x10205000;
+
+for (const order of orders) {
+  test(`publishRudpDocumentOnce does not complete on the ack of a refused put (${order})`, async () => {
+    const peer = await refusingPeer(nextConnection, order);
+    try {
+      await assert.rejects(
+        CultMesh.publishRudpDocumentOnce("completion-once", nextConnection++, peer.endpoint, binding, "tests:completion:a", { noteId: "a", text: "x" }, { resendDelayMs: 50, resendPollMs: 5, flushTimeoutMs: 2_000 }),
+        isTheRefusal,
+      );
+    } finally { peer.close(); }
+  });
+
+  test(`publishRudpDocumentAndWaitForReceipt reports a refused put as refused, never as success (${order})`, async () => {
+    const peer = await refusingPeer(nextConnection, order);
+    try {
+      await assert.rejects(
+        CultMesh.publishRudpDocumentAndWaitForReceipt("completion-receipt", nextConnection++, peer.endpoint, binding, "tests:completion:a", { noteId: "a", text: "x" }, binding, { resendDelayMs: 50, resendPollMs: 5, receiptTimeoutMs: 800 }),
+        isTheRefusal,
+      );
+    } finally { peer.close(); }
+    await sleep(10);
+  });
+}
+
+test("a put the server applied but did not answer is unconfirmed, never published", async () => {
+  const connectionId = nextConnection++;
+  const puts: string[] = [];
+  const server = CultMesh.createRudpDocumentServer("completion-admit", connectionId, {
+    documents: new CultNetDocumentRegistry([binding]),
+    writeAuthority: new CultMeshGrantAllWrites(),
+    bindHost: "127.0.0.1", bindPort: 0, resendDelayMs: 50, resendPollMs: 5,
+    onDocumentPutRaw: (put) => { puts.push(put.recordKey); },
+  });
+  await server.start();
+  try {
+    await assert.rejects(
+      CultMesh.publishRudpDocumentOnce("completion-admit-client", connectionId, `rudp://127.0.0.1:${server.bind.port}`, binding, "tests:completion:a", { noteId: "a", text: "x" }, { resendDelayMs: 50, resendPollMs: 5, resultWindowMs: 200 }),
+      (error: unknown) => error instanceof CultMeshRudpWriteUnconfirmedError && error.reason === "window_elapsed",
+    );
+    assert.deepEqual(puts, ["tests:completion:a"], "the server did apply it; this server just does not answer");
+  } finally { server.close(); }
+});

packages/cultmesh-ts/test/cultmesh.test.ts

@@ -21,7 +21,7 @@ import {
   type CultNetMessage,
   type CultNetSnapshotResponseRawMessage,
 } from "@gamecult/cultnet-ts";
-import { CultMesh, CultMeshGrantAllWrites, CultMeshRudpUnservableDocumentError } from "../src/index";
+import { CultMesh, CultMeshGrantAllWrites, CultMeshRudpUnservableDocumentError, CultMeshRudpWriteUnconfirmedError } from "../src/index";
 
 // A record's payload as the bytes a peer would put on the wire.
 const payloadOf = (value: unknown) => documentPayloadFromBytes(encodeWireValue(value));
@@ -2968,25 +2968,30 @@ test("CultMesh TS publishes one registered document to a RUDP catalog", async ()
 
   try {
     await server.start();
-    await CultMesh.publishRudpDocumentOnce(
+    // This server answers a put with nothing, so the writer cannot know the put landed: unconfirmed, though it did.
-      "cultmesh-ts-muninn",
+    await assert.rejects(
-      connectionId,
+      CultMesh.publishRudpDocumentOnce(
-      `rudp://127.0.0.1:${server.bind.port}`,
+        "cultmesh-ts-muninn",
-      defineCultNetDocumentBinding({ definition: noteDocument }),
+        connectionId,
-      "note:odin",
+        `rudp://127.0.0.1:${server.bind.port}`,
-      {
+        defineCultNetDocumentBinding({ definition: noteDocument }),
-        noteId: "note:odin",
+        "note:odin",
-        body: "pay respects once",
+        {
-      },
+          noteId: "note:odin",
-      {
+          body: "pay respects once",
-        resendDelayMs: 25,
+        },
-        resendPollMs: 5,
+        {
-        maxFragmentBytes: 1024,
+          resendDelayMs: 25,
-        maxPendingReliablePackets: 16,
+          resendPollMs: 5,
-        connectTimeoutMs: 1_000,
+          maxFragmentBytes: 1024,
-        flushTimeoutMs: 25,
+          maxPendingReliablePackets: 16,
-        sourceRole: "test-provider",
+          connectTimeoutMs: 1_000,
-      },
+          flushTimeoutMs: 25,
+          resultWindowMs: 100,
+          sourceRole: "test-provider",
+        },
+      ),
+      (error: unknown) => error instanceof CultMeshRudpWriteUnconfirmedError && error.reason === "window_elapsed",
     );
 
     await waitFor(() => received !== undefined, "published RUDP document");

packages/cultmesh-ts/test/interop/write-receipt-interop.test.ts

@@ -0,0 +1,434 @@
+// The TypeScript write-receipt client (cultnet-ts WriteTracker and decoder, cultmesh-ts one-shot writer) against the two real
+// receipt servers over loopback, as child processes on ephemeral ports:
+//
+//   rust    packages/cultmesh-rs/examples/receipt_interop_server.rs, the RUDP document server, reached over RUDP.
+//   csharp  tests/GameCult.Networking.InteropPeer `receipt-serve`, CultNetDatabaseServer on Server (LiteNetLib). TypeScript has no
+//           LiteNetLib client, so a second child, `receipt-relay`, carries bytes between the test and the server (4-byte
+//           big-endian length, then the CultNet frame: CultNetPeer's own stream framing). It decodes and judges nothing.
+//
+// Every scenario runs against both targets; its outcome is read from the WriteTracker (admitted, refused, unconfirmed), and the
+// server's own stdout facts say what was committed. Contract: contracts/cultnet/interop/write-receipt.md and its vectors.
+//
+// Needs cargo and dotnet; run it with `npm run test:interop` in packages/cultmesh-ts (CARGO and DOTNET override the commands;
+// RECEIPT_INTEROP_PREBUILT=1 skips the two builds).
+import assert from "node:assert/strict";
+import { execFile, spawn, spawnSync, type ChildProcess } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { Duplex } from "node:stream";
+import { after, before, beforeEach, describe, test } from "node:test";
+import { promisify } from "node:util";
+import { encode } from "@msgpack/msgpack";
+import { z } from "zod";
+import { defineDocumentType } from "@gamecult/cultcache-ts";
+import {
+  CULTNET_WRITE_RECEIPT_MESSAGE_VERSIONS,
+  CultNetPeer,
+  WriteTracker,
+  defineCultNetDocumentBinding,
+  helloAdvertisesWriteReceipts,
+  resultWindowMs,
+  type CultNetErrorV1Message,
+  type CultNetHelloMessage,
+  type CultNetMessage,
+  type WriteSettlement,
+} from "@gamecult/cultnet-ts";
+import { CultMesh, CultMeshRudpWriteRefusedError, CultMeshRudpWriteUnconfirmedError } from "../../src/index";
+
+const execFileAsync = promisify(execFile);
+// dist-test/test/interop -> the repository root
+const repoRoot = resolve(__dirname, "..", "..", "..", "..", "..");
+const cargo = process.env.CARGO ?? "cargo";
+const dotnet = process.env.DOTNET ?? "dotnet";
+const rustManifestDir = join(repoRoot, "packages", "cultmesh-rs");
+const csharpProject = join(repoRoot, "tests", "GameCult.Networking.InteropPeer", "GameCult.Networking.InteropPeer.csproj");
+const csharpDll = join(repoRoot, "bin", "GameCult.Networking.InteropPeer", "Debug", "net10.0", "GameCult.Networking.InteropPeer.dll");
+// Set when the server binaries were built beforehand (the builds themselves cannot start under a tight address-space cap).
+const prebuilt = process.env.RECEIPT_INTEROP_PREBUILT === "1";
+const vectors = JSON.parse(readFileSync(join(repoRoot, "contracts", "cultnet", "interop", "write-receipt-vectors.json"), "utf8"));
+
+const SCHEMA_ID = "receipt.interop_note.v1";
+const UNREADABLE = "message_invalid: the message could not be read";
+const sleep = (ms: number) => new Promise<void>((done) => setTimeout(done, ms));
+
+async function waitFor(predicate: () => boolean, what: string, ms = 5_000): Promise<void> {
+  const startedAt = Date.now();
+  while (!predicate()) {
+    if (Date.now() - startedAt > ms) throw new Error(`timed out waiting for ${what}`);
+    await sleep(5);
+  }
+}
+
+// ---- the servers -------------------------------------------------------------------------------------------------------
+
+interface Fact { event: string; recordKey?: string; messageId?: string; [key: string]: unknown }
+
+/** A running server child and the JSON facts it prints on stdout. */
+class ServerProcess {
+  readonly facts: Fact[] = [];
+  stderr = "";
+  port = 0;
+  constructor(readonly child: ChildProcess) {
+    let pending = "";
+    child.stdout!.on("data", (chunk: Buffer) => {
+      pending += chunk.toString("utf8");
+      for (let at = pending.indexOf("\n"); at >= 0; at = pending.indexOf("\n")) {
+        const line = pending.slice(0, at).trim();
+        pending = pending.slice(at + 1);
+        if (line) this.facts.push(JSON.parse(line) as Fact);
+      }
+    });
+    child.stderr!.on("data", (chunk: Buffer) => { this.stderr += chunk.toString("utf8"); });
+  }
+  /** How many times `event` was printed for `recordKey`. */
+  count(event: string, recordKey: string): number {
+    return this.facts.filter((fact) => fact.event === event && fact.recordKey === recordKey).length;
+  }
+  async stop(): Promise<void> {
+    this.child.stdin!.end();
+    await new Promise<void>((done) => {
+      const killer = setTimeout(() => this.child.kill("SIGKILL"), 5_000);
+      this.child.once("exit", () => { clearTimeout(killer); done(); });
+      if (this.child.exitCode !== null) done();
+    });
+  }
+}
+
+async function launch(command: string, args: string[]): Promise<ServerProcess> {
+  const server = new ServerProcess(spawn(command, args, { stdio: ["pipe", "pipe", "pipe"] }));
+  await waitFor(() => server.facts.some((fact) => fact.event === "listening") || server.child.exitCode !== null, "the server to listen", 60_000);
+  const listening = server.facts.find((fact) => fact.event === "listening");
+  if (!listening) throw new Error(`the server exited before listening:\n${server.stderr}`);
+  server.port = listening.port as number;
+  return server;
+}
+
+/** One connection to a server: the peer that speaks CultNet, and how to close it. */
+interface Connection { peer: CultNetPeer; close(): void }
+
+interface Target {
+  name: string;
+  /** Shard fields the server's database requires on a write, if any. */
+  shard?: { shardId: string; shardEpoch: number };
+  /** A document payload this target's store reads. */
+  payload(text: string): Uint8Array;
+  start(): Promise<ServerProcess>;
+  connect(server: ServerProcess): Promise<Connection>;
+}
+
+let nextConnectionId = 0x20206000;
+
+const rust: Target = {
+  name: "rust",
+  payload: (text) => encode({ text }),
+  async start() {
+    if (!prebuilt) await execFileAsync(cargo, ["build", "--example", "receipt_interop_server", "--message-format", "short"], { cwd: rustManifestDir });
+    const metadata = spawnSync(cargo, ["metadata", "--format-version", "1", "--no-deps"], { cwd: rustManifestDir, encoding: "utf8" });
+    if (metadata.status !== 0) throw new Error(`cargo metadata failed: ${metadata.stderr}`);
+    const exe = join(JSON.parse(metadata.stdout).target_directory, "debug", "examples", `receipt_interop_server${process.platform === "win32" ? ".exe" : ""}`);
+    return launch(exe, []);
+  },
+  async connect(server) {
+    const peer = await CultMesh.createRudpPeer("receipt-interop", nextConnectionId++, { host: "127.0.0.1", port: server.port, uri: `rudp://127.0.0.1:${server.port}` });
+    return { peer, close: () => peer.close() };
+  },
+};
+
+// The C# server admits 30 connection requests per IP per minute (Server.MaxConnectionAttemptsPerMinute) and answers the rest with
+// no hello. Every scenario wants a fresh session, so before each C# test the harness waits until the last minute holds at most
+// CONNECTIONS_PER_MINUTE connections, leaving room for the two a test may open. The server's limit stays as it is.
+const CONNECTIONS_PER_MINUTE = 24;
+const connectedAt: number[] = [];
+async function awaitConnectionBudget(): Promise<void> {
+  for (;;) {
+    const now = Date.now();
+    while (connectedAt.length > 0 && now - connectedAt[0] >= 61_000) connectedAt.shift();
+    if (connectedAt.length <= CONNECTIONS_PER_MINUTE) return;
+    await sleep(connectedAt[0] + 61_000 - now);
+  }
+}
+
+const csharp: Target = {
+  name: "csharp",
+  shard: { shardId: "receipt-interop-shard", shardEpoch: 1 },
+  payload: (text) => encode([text]),
+  async start() {
+    if (!prebuilt) await execFileAsync(dotnet, ["build", csharpProject, "-nologo", "-v", "q"], { cwd: repoRoot, maxBuffer: 64 * 1024 * 1024 });
+    return launch(dotnet, [csharpDll, "receipt-serve"]);
+  },
+  async connect(server) {
+    connectedAt.push(Date.now());
+    const relay = spawn(dotnet, [csharpDll, "receipt-relay", "--port", String(server.port)], { stdio: ["pipe", "pipe", "ignore"] });
+    const peer = new CultNetPeer(Duplex.from({ readable: relay.stdout!, writable: relay.stdin! }), { wireContract: "cultnet.schema.v0" });
+    return { peer, close: () => { relay.stdin!.end(); relay.kill(); } };
+  },
+};
+
+// ---- a client session: one connection, the frames it saw, one WriteTracker per write -----------------------------------------
+
+class Session {
+  readonly frames: CultNetMessage[] = [];
+  readonly invalid: Error[] = [];
+  private readonly trackers = new Set<WriteTracker>();
+  private serverReceipts = false;
+  private constructor(readonly target: Target, private readonly connection: Connection) {
+    connection.peer.on("message", (message: CultNetMessage) => {
+      if (message.schemaVersion === "cultnet.hello.v0") this.serverReceipts = helloAdvertisesWriteReceipts(message);
+      this.frames.push(message);
+      for (const tracker of this.trackers) tracker.frame(message, Date.now());
+    });
+    connection.peer.on("invalidMessage", (error: Error) => this.invalid.push(error));
+    connection.peer.on("close", () => { for (const tracker of this.trackers) tracker.sessionEnd(Date.now()); });
+  }
+
+  static async open(target: Target, server: ServerProcess): Promise<Session> {
+    return new Session(target, await target.connect(server));
+  }
+
+  /** Declares the receipt capability and waits for the server's own hello. */
+  async hello(versions: readonly string[] = CULTNET_WRITE_RECEIPT_MESSAGE_VERSIONS): Promise<CultNetHelloMessage> {
+    this.connection.peer.sendHello({ schemaVersion: "cultnet.hello.v0", runtimeId: "receipt-interop", runtimeKind: "cultmesh-ts", supportedMessageVersions: [...versions] });
+    await waitFor(() => this.frames.some((frame) => frame.schemaVersion === "cultnet.hello.v0"), "the server's hello");
+    return this.frames.find((frame) => frame.schemaVersion === "cultnet.hello.v0") as CultNetHelloMessage;
+  }
+
+  put(messageId: string, recordKey: string, text: string, document: Record<string, unknown> = {}): CultNetMessage {
+    return this.shard({
+      schemaVersion: "cultnet.document_put_raw.v0",
+      messageId,
+      document: {
+        schemaId: SCHEMA_ID, recordKey, storedAt: new Date().toISOString(), payloadEncoding: "messagepack",
+        payload: this.target.payload(text), ...document,
+      },
+    });
+  }
+
+  delete(messageId: string, recordKey: string): CultNetMessage {
+    return this.shard({ schemaVersion: "cultnet.document_delete.v0", messageId, schemaId: SCHEMA_ID, recordKey });
+  }
+
+  private shard(message: unknown): CultNetMessage {
+    return { ...(message as object), ...this.target.shard } as CultNetMessage;
+  }
+
+  /**
+   * Sends one write and settles it with its own tracker, windowed by what the server advertised (5000 ms against a receipt
+   * server, 500 ms otherwise). Only the tracker decides the outcome.
+   */
+  async write(message: CultNetMessage): Promise<WriteSettlement> {
+    const messageId = (message as { messageId: string }).messageId;
+    const tracker = new WriteTracker({ windowMs: resultWindowMs(this.serverReceipts) });
+    this.trackers.add(tracker);
+    tracker.send(messageId, Date.now());
+    this.connection.peer.send(message);
+    for (;;) {
+      tracker.tick(Date.now());
+      const state = tracker.state(messageId)!;
+      if (state.outcome !== "pending") return state;
+      await sleep(Math.min(20, tracker.nextDeadlineMs(Date.now()) ?? 20));
+    }
+  }
+
+  /** Frames of `schemaVersion` that name `messageId`. */
+  answers(messageId: string, schemaVersion: string): CultNetMessage[] {
+    return this.frames.filter((frame) => frame.schemaVersion === schemaVersion && (frame as { messageId?: string }).messageId === messageId);
+  }
+
+  close(): void { this.connection.close(); }
+}
+
+function refusal(settlement: WriteSettlement): CultNetErrorV1Message {
+  assert.equal(settlement.outcome, "refused", JSON.stringify(settlement));
+  return (settlement as Extract<WriteSettlement, { outcome: "refused" }>).response as CultNetErrorV1Message;
+}
+
+// ---- the scenarios, run against each server -----------------------------------------------------------------------------------
+
+for (const target of [rust, csharp]) {
+  describe(`write receipt, TypeScript client against the real ${target.name} server`, () => {
+    let server: ServerProcess;
+    let session: Session | undefined;
+    before(async () => { server = await target.start(); }, { timeout: 180_000 });
+    after(async () => { session?.close(); await server?.stop(); });
+    beforeEach(async () => { if (target === csharp) await awaitConnectionBudget(); }, { timeout: 90_000 });
+
+    /** A fresh receipt session (hello sent, the server's hello read) for a scenario. */
+    async function receiptSession(): Promise<Session> {
+      session?.close();
+      session = await Session.open(target, server);
+      const hello = await session.hello();
+      assert.ok(helloAdvertisesWriteReceipts(hello), "the server's hello lists both receipt frames");
+      return session;
+    }
+
+    test("hello listing both frames: the server answers with its own hello listing both, then a put is receipted after it", { timeout: 30_000 }, async () => {
+      const s = await receiptSession();
+      assert.equal(s.frames[0].schemaVersion, "cultnet.hello.v0");
+      const settlement = await s.write(s.put("hello-1", "hello:a", "one"));
+      assert.deepEqual(settlement, { outcome: "admitted" });
+      assert.deepEqual(s.frames.map((frame) => frame.schemaVersion), ["cultnet.hello.v0", "cultnet.write_admitted.v0"]);
+    });
+
+    test("a hello listing only one of the two frames does not opt in: no receipt, and the put is applied", { timeout: 30_000 }, async () => {
+      for (const listed of CULTNET_WRITE_RECEIPT_MESSAGE_VERSIONS) {
+        session?.close();
+        session = await Session.open(target, server);
+        session.hello([listed]).catch(() => undefined); // a server may stay silent to a hello that does not opt in
+        await sleep(300);
+        const settlement = await session.write(session.put(`half-${listed}`, `half:${listed}`, "one"));
+        assert.deepEqual(settlement, { outcome: "unconfirmed", reason: "window_elapsed" }, `listing only ${listed}`);
+        assert.ok(!session.frames.some((frame) => frame.schemaVersion === "cultnet.write_admitted.v0" || frame.schemaVersion === "cultnet.error.v1"));
+        await waitFor(() => server.count("applied", `half:${listed}`) === 1, "the put to be applied");
+      }
+    });
+
+    test("put admitted: the receipt echoes the write and the store has it once", { timeout: 30_000 }, async () => {
+      const s = await receiptSession();
+      const settlement = await s.write(s.put("put-1", "put:a", "one"));
+      assert.deepEqual(settlement, { outcome: "admitted" });
+      assert.deepEqual(s.answers("put-1", "cultnet.write_admitted.v0"), [
+        { schemaVersion: "cultnet.write_admitted.v0", messageId: "put-1", operation: "put", schemaId: SCHEMA_ID, recordKey: "put:a" },
+      ]);
+      await waitFor(() => server.count("applied", "put:a") === 1, "the put to be applied");
+    });
+
+    // The Rust RUDP document server has no delete: its sink only accepts documents, and every delete on a receipt session is
+    // answered with a refusal (rudp_document_server.rs, deletes_on_a_receipt_session_are_refused_one_by_one). The spec
+    // (Server rules 1 to 3) has a delete admitted and receipted like a put.
+    test("delete admitted: the receipt says operation delete and the store drops the record", {
+      timeout: 30_000,
+      todo: target.name === "rust" ? "the Rust RUDP document server refuses every delete; there is no delete port in CultMeshRudpRawDocumentSink" : false,
+    }, async () => {
+      const s = await receiptSession();
+      assert.deepEqual(await s.write(s.put("del-put", "del:a", "one")), { outcome: "admitted" });
+      assert.deepEqual(await s.write(s.delete("del-1", "del:a")), { outcome: "admitted" });
+      assert.deepEqual(s.answers("del-1", "cultnet.write_admitted.v0"), [
+        { schemaVersion: "cultnet.write_admitted.v0", messageId: "del-1", operation: "delete", schemaId: SCHEMA_ID, recordKey: "del:a" },
+      ]);
+      await waitFor(() => server.count("removed", "del:a") === 1, "the delete to be applied");
+    });
+
+    test("refused write: an error.v1 carrying the write's id, and nothing is applied", { timeout: 30_000 }, async () => {
+      const s = await receiptSession();
+      const response = refusal(await s.write(s.put("deny-1", "refuse:a", "one")));
+      assert.equal(response.schemaVersion, "cultnet.error.v1");
+      assert.equal(response.messageId, "deny-1");
+      assert.equal(response.code, "write_not_authorized");
+      // The session is kept: the next write on it is admitted.
+      assert.deepEqual(await s.write(s.put("deny-2", "deny:b", "one")), { outcome: "admitted" });
+      assert.equal(server.count("applied", "refuse:a"), 0);
+    });
+
+    test("resend of the same id and content on the same session: re-receipted, applied once", { timeout: 30_000 }, async () => {
+      const s = await receiptSession();
+      assert.deepEqual(await s.write(s.put("resend-1", "resend:a", "one")), { outcome: "admitted" });
+      assert.deepEqual(await s.write(s.put("resend-1", "resend:a", "one")), { outcome: "admitted" });
+      const receipts = s.answers("resend-1", "cultnet.write_admitted.v0");
+      assert.equal(receipts.length, 2);
+      assert.deepEqual(receipts[0], receipts[1]);
+      await sleep(200); // a second application would be printed by now
+      assert.equal(server.count("applied", "resend:a"), 1);
+    });
+
+    test("same id with different content: message_invalid naming the id, never a receipt, the first write untouched", { timeout: 30_000 }, async () => {
+      const s = await receiptSession();
+      assert.deepEqual(await s.write(s.put("clash-1", "clash:a", "one")), { outcome: "admitted" });
+      const response = refusal(await s.write(s.put("clash-1", "clash:a", "other")));
+      assert.equal(response.code, "message_invalid");
+      assert.equal(response.messageId, "clash-1");
+      assert.equal(response.details?.field, "messageId");
+      assert.equal(s.answers("clash-1", "cultnet.write_admitted.v0").length, 1, "no receipt for the changed write");
+      await sleep(200);
+      assert.equal(server.count("applied", "clash:a"), 1);
+    });
+
+    // Each case of the vectors' blankFields section: a document that names nothing is refused as an unreadable frame, with the
+    // write's id and the fixed text, and never applied; a document that is merely missing optional fields is admitted.
+    for (const blank of vectors.blankFields.cases as { name: string; set: Record<string, unknown>; outcome: "admitted" | "refused" }[]) {
+      test(`blank-field vector ${blank.name}: ${blank.outcome}`, { timeout: 30_000 }, async () => {
+        const s = await receiptSession();
+        const { payloadHex, ...fields } = blank.set;
+        // A case that sets recordKey replaces the harness key, so the store is read under the key the server actually saw.
+        const recordKey = typeof fields.recordKey === "string" ? fields.recordKey : `blank:${blank.name}`;
+        const message = s.put(`blank-${blank.name}`, recordKey, "one", fields);
+        const sent = (message as unknown as { document: Record<string, unknown> }).document;
+        for (const [key, value] of Object.entries(fields)) if (value === null) delete sent[key]; // nil means absent on the wire here
+        if (payloadHex === "") sent.payload = new Uint8Array();
+        const settlement = await s.write(message);
+        if (blank.outcome === "admitted") {
+          assert.deepEqual(settlement, { outcome: "admitted" });
+          await waitFor(() => server.count("applied", recordKey) === 1, "the put to be applied");
+          return;
+        }
+        const response = refusal(settlement);
+        assert.equal(response.code, "message_invalid");
+        assert.equal(response.error, UNREADABLE);
+        assert.equal(response.details?.field, "message");
+        assert.equal(response.messageId, `blank-${blank.name}`);
+        await sleep(200);
+        assert.equal(server.count("applied", recordKey), 0);
+      });
+    }
+
+    test("a delete that names nothing is refused as unreadable with its id", { timeout: 30_000 }, async () => {
+      const s = await receiptSession();
+      const message = s.delete("blank-del", "blank:del");
+      (message as unknown as { schemaId: string }).schemaId = "";
+      const response = refusal(await s.write(message));
+      assert.equal(response.code, "message_invalid");
+      assert.equal(response.error, UNREADABLE);
+      assert.equal(response.details?.field, "message");
+      assert.equal(response.messageId, "blank-del");
+    });
+
+    test("legacy client (no hello): no receipt frames, the write is applied, and its refusal is the old error.v0", { timeout: 30_000 }, async () => {
+      session?.close();
+      session = await Session.open(target, server);
+      assert.deepEqual(await session.write(session.put("legacy-1", "legacy:a", "one")), { outcome: "unconfirmed", reason: "window_elapsed" });
+      await waitFor(() => server.count("applied", "legacy:a") === 1, "the put to be applied");
+      const refused = (await session.write(session.put("legacy-2", "refuse:legacy", "one"))) as Extract<WriteSettlement, { outcome: "refused" }>;
+      assert.equal(refused.outcome, "refused");
+      assert.equal(refused.response.schemaVersion, "cultnet.error.v0");
+      assert.deepEqual(session.frames.map((frame) => frame.schemaVersion), ["cultnet.error.v0"]);
+      assert.equal(session.invalid.length, 0);
+    });
+  });
+}
+
+// ---- the one-shot writer, which is the real cultmesh-ts client path, against the Rust RUDP server ----------------------------
+// (The C# server speaks LiteNetLib, not RUDP: no RUDP client path reaches it.)
+
+describe("write receipt, cultmesh-ts publishRudpDocumentOnce against the real rust server", () => {
+  const note = defineDocumentType({ type: "receipt.interop_note", schemaId: SCHEMA_ID, schema: z.object({ text: z.string() }), name: "text" });
+  const binding = defineCultNetDocumentBinding({ definition: note });
+  let server: ServerProcess;
+  before(async () => { server = await rust.start(); }, { timeout: 180_000 });
+  after(async () => { await server?.stop(); });
+  const endpoint = () => ({ host: "127.0.0.1", port: server.port, uri: `rudp://127.0.0.1:${server.port}` });
+
+  test("writeReceipts: the put resolves admitted on the receipt, after the server applied it", { timeout: 30_000 }, async () => {
+    const outcome = await CultMesh.publishRudpDocumentOnce("receipt-interop", nextConnectionId++, endpoint(), binding, "once:a", { text: "one" }, { writeReceipts: true, messageId: "once-1" });
+    assert.equal(outcome, "admitted");
+    await waitFor(() => server.count("applied", "once:a") === 1, "the put to be applied");
+  });
+
+  test("writeReceipts: a refused put rejects with the server's error.v1 naming the put", { timeout: 30_000 }, async () => {
+    await assert.rejects(
+      CultMesh.publishRudpDocumentOnce("receipt-interop", nextConnectionId++, endpoint(), binding, "refuse:once", { text: "one" }, { writeReceipts: true, messageId: "once-2" }),
+      (error: unknown) => {
+        assert.ok(error instanceof CultMeshRudpWriteRefusedError);
+        assert.equal(error.response.schemaVersion, "cultnet.error.v1");
+        assert.equal((error.response as CultNetErrorV1Message).messageId, "once-2");
+        return true;
+      },
+    );
+  });
+
+  test("without writeReceipts the server stays silent: the put is unconfirmed, not admitted, though the server applied it", { timeout: 30_000 }, async () => {
+    await assert.rejects(
+      CultMesh.publishRudpDocumentOnce("receipt-interop", nextConnectionId++, endpoint(), binding, "once:legacy", { text: "one" }, { messageId: "once-3" }),
+      (error: unknown) => error instanceof CultMeshRudpWriteUnconfirmedError && error.reason === "window_elapsed",
+    );
+    await waitFor(() => server.count("applied", "once:legacy") === 1, "the put to be applied");
+  });
+});

packages/cultmesh-ts/test/remote-write-authority.test.ts

@@ -1,11 +1,13 @@
 // A peer's put or delete is applied only when the server's write authority grants it. Ports the behaviours of
 // cultmesh-py test_remote_write_authority.py (no forwarding: this server does not forward non-primary writes).
 import assert from "node:assert/strict";
+import { createSocket, type Socket } from "node:dgram";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import test from "node:test";
 import { z } from "zod";
 import { documentPayloadFromBytes, defineDocumentType } from "@gamecult/cultcache-ts";
+import { decodeRudpPacket } from "@gamecult/cultnet-ts";
 import { encodeWireValue } from "@gamecult/cultnet-ts/wire";
 import {
   CultNetDocumentRegistry,
@@ -16,6 +18,7 @@ import {
 } from "@gamecult/cultnet-ts";
 import {
   CultMesh,
+  CULTMESH_RUDP_DOCUMENT_SERVER_MAX_CONSECUTIVE_REFUSED_FRAMES,
   CultMeshGrantAllWrites,
   type CultMeshRemoteWriteAuthority,
   type CultMeshRemoteWriteDecision,
@@ -505,3 +508,178 @@ test("a granted peer's unreadable write reaches onError and gets a malformed ref
     } finally { r.close(); }
   }
 });
+
+const CAP = 8; // the cap every runtime shares; the exported constant must stay this number
+
+test("the consecutive-refused-frames cap is the number every runtime shares", () => {
+  assert.equal(CULTMESH_RUDP_DOCUMENT_SERVER_MAX_CONSECUTIVE_REFUSED_FRAMES, CAP);
+});
+
+test("unreadable frames are answered and the session kept until eight in a row; any decoded frame resets the run", async () => {
+  const r = await rawRig(new Recording(grant));
+  try {
+    const batch = async (frames: number) => {
+      for (let i = 0; i < frames; i++) r.send(Uint8Array.from([0xc1]));
+      await sleep(400);
+    };
+    await batch(CAP - 1);
+    assert.equal(r.replies.length, CAP - 1, "each is answered");
+    r.send(encodeWireValue(put(KEY_A)));
+    await sleep(250);
+    assert.deepEqual(r.puts.map((p) => p.recordKey), [KEY_A], "the session was kept through seven");
+    await batch(CAP - 1);
+    assert.equal(r.replies.length, 2 * (CAP - 1), "the valid frame reset the run");
+    r.send(Uint8Array.from([0xc1]));
+    await sleep(300);
+    assert.equal(r.replies.length, 2 * (CAP - 1) + 1, "the eighth consecutive one is answered too");
+    assert.ok(r.replies.every((reply) => (reply as { code?: string }).code === "message_invalid"));
+    // The goodbye reached the peer: its client no longer takes a send.
+    assert.throws(() => r.send(encodeWireValue(put(KEY_B))), /before the session is connected/, "then the session ended");
+    assert.deepEqual(r.puts.map((p) => p.recordKey), [KEY_A]);
+  } finally { r.close(); }
+});
+
+test("deletes the authority refuses are answered and the session kept until eight in a row; any other decoded frame resets the run", async () => {
+  const authority = new Recording((request) => request.recordKey === KEY_B ? { granted: true } : { granted: false });
+  await using(await rig(authority), async (r) => {
+    const refuse = async (deletes: number) => {
+      for (let i = 0; i < deletes; i++) r.peer.send(del(KEY_A));
+      await sleep(400);
+    };
+    await refuse(CAP - 1);
+    assert.equal(r.replies.length, CAP - 1);
+    r.peer.send(del(KEY_B)); // granted: resets the run
+    await sleep(250);
+    assert.deepEqual(r.deletes.map((d) => d.recordKey), [KEY_B]);
+    await refuse(CAP - 1);
+    assert.equal(r.replies.length, 2 * (CAP - 1));
+    r.peer.send(put(KEY_B)); // a decoded non-delete resets too
+    await sleep(250);
+    await refuse(CAP - 1);
+    assert.equal(r.replies.length, 3 * (CAP - 1), "a put reset the run");
+    r.peer.send(del(KEY_A));
+    await sleep(300);
+    assert.equal(r.replies.length, 3 * (CAP - 1) + 1, "the eighth consecutive refused delete is answered too");
+    for (const reply of r.replies) assertRefused(reply, KEY_A);
+    assert.throws(() => r.peer.send(del(KEY_B)), /before the session is connected/, "then the session ended");
+    assert.equal(r.deletes.length, 1);
+  });
+});
+
+test("a frame that decodes but is no message the parser takes is answered, counted, and ended at eight in a row like any unreadable frame", async () => {
+  const r = await rawRig(new Recording(grant));
+  const unknown = () => encodeWireValue({ schemaVersion: "cultnet.not-a-message.v0", messageId: "x" });
+  try {
+    const batch = async (frames: number) => {
+      for (let i = 0; i < frames; i++) r.send(unknown());
+      await sleep(400);
+    };
+    await batch(CAP - 1);
+    assert.equal(r.replies.length, CAP - 1, "each is answered");
+    assert.equal(r.errors.length, CAP - 1, "and reported");
+    r.send(encodeWireValue(put(KEY_A)));
+    await sleep(250);
+    assert.deepEqual(r.puts.map((p) => p.recordKey), [KEY_A], "the session was kept through seven");
+    await batch(CAP - 1);
+    assert.equal(r.replies.length, 2 * (CAP - 1), "the decoded put reset the run");
+    r.send(unknown());
+    await sleep(300);
+    assert.equal(r.replies.length, 2 * (CAP - 1) + 1, "the eighth is answered too");
+    for (const reply of r.replies) {
+      assert.equal((reply as { code?: string }).code, "message_invalid");
+      assert.equal((reply as { details: { field: string } }).details.field, "message");
+    }
+    assert.throws(() => r.send(unknown()), /before the session is connected/, "then the session ended");
+  } finally { r.close(); }
+});
+
+/** A UDP relay between a client and a server that drops the first (or, with `dropEvery`, every) server datagram carrying `payloadContains` once armed. */
+async function lossyRelay(serverPort: number, payloadContains: string, dropEvery = false) {
+  const dropped: unknown[] = [];
+  let armed = false;
+  let clientAddress: { port: number; address: string } | undefined;
+  const toClient: Socket = createSocket("udp4");
+  const toServer: Socket = createSocket("udp4");
+  toServer.on("message", (wire) => {
+    if (!clientAddress) return;
+    if (armed && (dropEvery || dropped.length === 0)) {
+      const packet = decodeRudpPacket(wire);
+      if (packet.packetType === "data" && Buffer.from(packet.payload ?? []).includes(payloadContains)) {
+        dropped.push(packet);
+        return;
+      }
+    }
+    toClient.send(wire, clientAddress.port, clientAddress.address);
+  });
+  toClient.on("message", (wire, remote) => {
+    clientAddress = remote;
+    toServer.send(wire, serverPort, "127.0.0.1");
+  });
+  await new Promise<void>((resolve) => toClient.bind(0, "127.0.0.1", resolve));
+  await new Promise<void>((resolve) => toServer.bind(0, "127.0.0.1", resolve));
+  return {
+    port: toClient.address().port,
+    dropped,
+    arm: () => { armed = true; },
+    close: () => { toClient.close(); toServer.close(); },
+  };
+}
+
+async function cappedOverRelay(dropEvery: boolean, body: (x: { relay: Awaited<ReturnType<typeof lossyRelay>>; client: { send(channel: string, payload: Uint8Array): void }; replies: CultNetMessage[] }) => Promise<void>) {
+  const connectionId = nextConnection++;
+  const server = CultMesh.createRudpDocumentServer("authority-lossy", connectionId, {
+    documents: new CultNetDocumentRegistry([defineCultNetDocumentBinding({ definition: note })]),
+    writeAuthority: new Recording(grant), bindHost: "127.0.0.1", bindPort: 0, resendDelayMs: 25, resendPollMs: 5,
+    onDocumentPutRaw: () => {}, onError: () => {},
+  });
+  await server.start();
+  const relay = await lossyRelay(server.bind.port, "message_invalid", dropEvery);
+  const client = await CultMesh.createRudpClient("lossy", connectionId, `rudp://127.0.0.1:${relay.port}`, { resendDelayMs: 25, resendPollMs: 5 });
+  try {
+    client.connect();
+    const started = Date.now();
+    while (!client.connected) {
+      if (Date.now() - started > 2_000) throw new Error("not connected");
+      await sleep(5);
+    }
+    const replies: CultNetMessage[] = [];
+    new CultNetPeer(client, { wireContract: "cultnet.schema.v0" }).on("message", (m) => replies.push(m));
+    for (let i = 0; i < CAP - 1; i++) client.send("schema", Uint8Array.from([0xc1]));
+    await sleep(300);
+    assert.equal(replies.length, CAP - 1);
+    relay.arm();
+    client.send("schema", Uint8Array.from([0xc1]));
+    await body({ relay, client, replies });
+  } finally { client.close(); server.close(); relay.close(); }
+}
+
+test("the capped frame's answer is resent when its datagram is lost, and the goodbye follows only after it arrived", async () => {
+  await cappedOverRelay(false, async ({ relay, client, replies }) => {
+    await sleep(600);
+    assert.equal(relay.dropped.length, 1, "fixture: the first transmission of the last answer was lost");
+    assert.equal(replies.length, CAP, "the lost answer was resent and arrived");
+    assert.equal((replies[CAP - 1] as { code?: string }).code, "message_invalid");
+    assert.throws(() => client.send("schema", Uint8Array.from([0xc1])), /before the session is connected/, "then the session ended");
+  });
+});
+
+test("a capped session whose answer is never acknowledged still ends, after the grace", async () => {
+  await cappedOverRelay(true, async ({ client, replies }) => {
+    await sleep(1200);
+    assert.equal(replies.length, CAP - 1, "fixture: the last answer never arrives");
+    client.send("schema", Uint8Array.from([0xc1])); // still connected: the server is waiting for the acknowledgement
+    await sleep(1500);
+    assert.throws(() => client.send("schema", Uint8Array.from([0xc1])), /before the session is connected/, "the grace ran out and the goodbye went out");
+  });
+});
+
+test("nothing behind the capped frame is served while its answer is delivered", async () => {
+  const r = await rawRig(new Recording(grant));
+  try {
+    for (let i = 0; i < CAP; i++) r.send(Uint8Array.from([0xc1]));
+    r.send(encodeWireValue(put(KEY_A)));
+    await sleep(500);
+    assert.equal(r.replies.length, CAP);
+    assert.deepEqual(r.puts, [], "the put behind the cap was not served");
+  } finally { r.close(); }
+});

packages/cultmesh-ts/test/write-receipt-client.test.ts

@@ -0,0 +1,243 @@
+// Client side of contracts/cultnet/interop/write-receipt.md in the one-shot writer: with `writeReceipts` the put
+// completes only on a write_admitted carrying its id; a refusal, a silent window and a legacy server each end as the
+// spec says. Each test serves the client a fake RUDP peer that acknowledges the put and answers as scripted.
+import assert from "node:assert/strict";
+import { createSocket, type Socket } from "node:dgram";
+import test from "node:test";
+import { z } from "zod";
+import { defineDocumentType } from "@gamecult/cultcache-ts";
+import {
+  CULTNET_WRITE_RECEIPT_MESSAGE_VERSIONS,
+  CultNetRudpSession,
+  decodeRudpPacket,
+  defineCultNetDocumentBinding,
+  encodeCultNetMessageForWire,
+  encodeRudpPacket,
+  type CultNetMessage,
+} from "@gamecult/cultnet-ts";
+import { decodeWireValue, encodeWireValue } from "@gamecult/cultnet-ts/wire";
+import { CultMesh, CultMeshRudpWriteRefusedError, CultMeshRudpWriteUnconfirmedError } from "../src/index";
+
+const note = defineDocumentType({
+  type: "cultmesh.receipt_note",
+  schemaId: "cultmesh.receipt_note.v0",
+  schema: z.object({ noteId: z.string(), text: z.string() }),
+  name: "noteId",
+});
+const binding = defineCultNetDocumentBinding({ definition: note });
+let nextConnection = 0x10206000;
+
+interface Script {
+  /** Does the server's hello list both receipt frames? */
+  advertise: boolean;
+  /** What the server answers a put with, `delayMs` after it arrives. */
+  answer: "admit" | "refuse" | "wrong-id" | "silence" | "goodbye" | "echo";
+  delayMs?: number;
+  /** Acknowledge the reliable packets it receives? Default true. */
+  ack?: boolean;
+}
+
+async function fakeServer(connectionId: number, script: Script) {
+  const socket: Socket = createSocket("udp4");
+  await new Promise<void>((resolve) => socket.bind(0, "127.0.0.1", resolve));
+  const session = new CultNetRudpSession({ connectionId, resendDelayMs: 50 });
+  const timers = new Set<NodeJS.Timeout>();
+  const seen: string[] = [];
+  let closed = false;
+  const send = (packet: Parameters<typeof encodeRudpPacket>[0], port: number, address: string) => {
+    if (!closed) socket.send(encodeRudpPacket(packet), port, address);
+  };
+  const say = (message: CultNetMessage, port: number, address: string) => {
+    const packets = session.sendMany("schema", encodeWireValue(encodeCultNetMessageForWire(message)), { reliable: true, ordered: true, nowMs: Date.now() });
+    packets.forEach((p) => send(p, port, address));
+  };
+  socket.on("message", (wire, remote) => {
+    const packet = decodeRudpPacket(wire);
+    const now = Date.now();
+    if (packet.packetType === "connect") {
+      send(session.acceptConnect(packet, now), remote.port, remote.address);
+      return;
+    }
+    const result = session.receive(packet, now);
+    if (result.reply) send(result.reply, remote.port, remote.address);
+    for (const frame of result.delivered) {
+      if (frame.channelId !== "schema") continue;
+      const message = decodeWireValue(frame.payload) as { schemaVersion: string; messageId?: string };
+      seen.push(message.schemaVersion);
+      if (message.schemaVersion === "cultnet.hello.v0") {
+        say({
+          schemaVersion: "cultnet.hello.v0", runtimeId: "fake", runtimeKind: "fake",
+          ...(script.advertise ? { supportedMessageVersions: [...CULTNET_WRITE_RECEIPT_MESSAGE_VERSIONS] } : {}),
+        }, remote.port, remote.address);
+        continue;
+      }
+      if (message.schemaVersion !== "cultnet.document_put_raw.v0" || script.answer === "silence") continue;
+      const timer = setTimeout(() => {
+        timers.delete(timer);
+        if (script.answer === "echo") {
+          say({ schemaVersion: "cultnet.document_put_raw.v0", messageId: message.messageId!, document: { schemaId: "cultmesh.receipt_note.v0", recordKey: "tests:receipt:a", storedAt: "t", payloadEncoding: "messagepack", payload: new Uint8Array([1]) } } as unknown as CultNetMessage, remote.port, remote.address);
+        } else if (script.answer === "goodbye") {
+          send(session.endUnsendableSession(new Error("scripted goodbye")), remote.port, remote.address);
+        } else if (script.answer === "refuse") {
+          say({ schemaVersion: "cultnet.error.v1", error: "write_not_authorized", routingHint: null, code: "write_not_authorized", details: null, messageId: message.messageId! }, remote.port, remote.address);
+        } else {
+          const messageId = script.answer === "wrong-id" ? "someone-else" : message.messageId!;
+          say({ schemaVersion: "cultnet.write_admitted.v0", messageId, operation: "put", schemaId: "cultmesh.receipt_note.v0", recordKey: "tests:receipt:a" }, remote.port, remote.address);
+        }
+      }, script.delayMs ?? 20);
+      timers.add(timer);
+    }
+    if (packet.reliable && script.ack !== false) send(session.createAckForReceived(packet.sequence), remote.port, remote.address);
+  });
+  return { endpoint: `rudp://127.0.0.1:${socket.address().port}`, seen, close: () => { closed = true; timers.forEach(clearTimeout); socket.close(); } };
+}
+
+const transport = { resendDelayMs: 50, resendPollMs: 5, flushTimeoutMs: 2_000 };
+const publish = (server: { endpoint: string }, options: Record<string, unknown>) =>
+  CultMesh.publishRudpDocumentOnce("receipt-client", nextConnection++, server.endpoint, binding, "tests:receipt:a", { noteId: "a", text: "x" }, { ...transport, ...options });
+
+test("a receipt-capable server's write_admitted completes the put, past the legacy 500 ms window", async () => {
+  const server = await fakeServer(nextConnection, { advertise: true, answer: "admit", delayMs: 700 });
+  try {
+    await publish(server, { writeReceipts: true });
+    assert.deepEqual(server.seen.slice(0, 2), ["cultnet.hello.v0", "cultnet.document_put_raw.v0"]);
+  } finally { server.close(); }
+});
+
+test("a receipt-capable server's error.v1 refuses the put with its code", async () => {
+  const server = await fakeServer(nextConnection, { advertise: true, answer: "refuse" });
+  try {
+    await assert.rejects(publish(server, { writeReceipts: true }), (error: unknown) =>
+      error instanceof CultMeshRudpWriteRefusedError && error.code === "write_not_authorized" && error.response.schemaVersion === "cultnet.error.v1");
+  } finally { server.close(); }
+});
+
+test("a receipt-capable server that stays silent leaves the put unconfirmed, never published", async () => {
+  const server = await fakeServer(nextConnection, { advertise: true, answer: "silence" });
+  try {
+    await assert.rejects(publish(server, { writeReceipts: true, resultWindowMs: 250 }), (error: unknown) =>
+      error instanceof CultMeshRudpWriteUnconfirmedError && error.reason === "window_elapsed");
+  } finally { server.close(); }
+});
+
+test("a receipt for another id settles nothing", async () => {
+  const server = await fakeServer(nextConnection, { advertise: true, answer: "wrong-id" });
+  try {
+    await assert.rejects(publish(server, { writeReceipts: true, resultWindowMs: 250 }), CultMeshRudpWriteUnconfirmedError);
+  } finally { server.close(); }
+});
+
+test("a server whose hello does not advertise leaves a silent put unconfirmed after the 500 ms window, never published", async () => {
+  const server = await fakeServer(nextConnection, { advertise: false, answer: "silence" });
+  const started = Date.now();
+  try {
+    await assert.rejects(publish(server, { writeReceipts: true }), (error: unknown) =>
+      error instanceof CultMeshRudpWriteUnconfirmedError && error.reason === "window_elapsed");
+    assert.ok(Date.now() - started >= 500, "the legacy window ran from the send");
+  } finally { server.close(); }
+});
+
+test("a session that ends before any result leaves the put unconfirmed (session_ended), against a legacy server too", async () => {
+  for (const advertise of [false, true]) {
+    const server = await fakeServer(nextConnection, { advertise, answer: "goodbye" });
+    try {
+      await assert.rejects(publish(server, { writeReceipts: true, resultWindowMs: 3_000 }), (error: unknown) =>
+        error instanceof CultMeshRudpWriteUnconfirmedError && error.reason === "session_ended");
+    } finally { server.close(); }
+  }
+});
+
+test("a put whose send is never acknowledged is unconfirmed as local_send_failed, not an untyped error", async () => {
+  const server = await fakeServer(nextConnection, { advertise: true, answer: "silence", ack: false });
+  const started = Date.now();
+  try {
+    await assert.rejects(publish(server, { writeReceipts: true, flushTimeoutMs: 300 }), (error: unknown) =>
+      error instanceof CultMeshRudpWriteUnconfirmedError && error.reason === "local_send_failed");
+    assert.ok(Date.now() - started < 2_500, "flushTimeoutMs bounds the send inside the 5 s window");
+  } finally { server.close(); }
+});
+
+test("the flush is bounded by the result window: a send nobody acknowledges is local_send_failed at the window, not at the flush timeout", async () => {
+  const server = await fakeServer(nextConnection, { advertise: true, answer: "silence", ack: false });
+  const started = Date.now();
+  try {
+    await assert.rejects(publish(server, { writeReceipts: true, resultWindowMs: 300, flushTimeoutMs: 20_000 }), (error: unknown) =>
+      error instanceof CultMeshRudpWriteUnconfirmedError && error.reason === "local_send_failed");
+    assert.ok(Date.now() - started < 3_000, "it did not wait out the 20 s flush timeout");
+  } finally { server.close(); }
+});
+
+test("a server that does not advertise receipts and echoes the put's id back has not admitted it", async () => {
+  const server = await fakeServer(nextConnection, { advertise: false, answer: "echo" });
+  try {
+    await assert.rejects(publish(server, { writeReceipts: true, resultWindowMs: 300 }), (error: unknown) =>
+      error instanceof CultMeshRudpWriteUnconfirmedError && error.reason === "window_elapsed");
+  } finally { server.close(); }
+});
+
+test("a silent server never yields admitted, in either mode: the default is unconfirmed, sendOnly is the distinct outcome sent", async () => {
+  const dflt = await fakeServer(nextConnection, { advertise: false, answer: "silence" });
+  try {
+    await assert.rejects(publish(dflt, { resultWindowMs: 200 }), CultMeshRudpWriteUnconfirmedError);
+  } finally { dflt.close(); }
+  const sendOnly = await fakeServer(nextConnection, { advertise: false, answer: "silence" });
+  try {
+    const outcome = await publish(sendOnly, { sendOnly: true });
+    assert.equal(outcome, "sent");
+    assert.notEqual(outcome, "admitted");
+    assert.deepEqual(sendOnly.seen, ["cultnet.document_put_raw.v0"], "sendOnly sends no hello");
+  } finally { sendOnly.close(); }
+});
+
+test("only a write_admitted resolves admitted, and sendOnly does not wait for or act on an answer", async () => {
+  const admitting = await fakeServer(nextConnection, { advertise: true, answer: "admit" });
+  try {
+    assert.equal(await publish(admitting, { writeReceipts: true }), "admitted");
+  } finally { admitting.close(); }
+  const refusing = await fakeServer(nextConnection, { advertise: true, answer: "refuse", delayMs: 1 });
+  try {
+    assert.equal(await publish(refusing, { sendOnly: true }), "sent", "a refusal is not awaited: sendOnly says only that the put was sent");
+  } finally { refusing.close(); }
+});
+
+test("sendOnly fails local_send_failed when the send is never acknowledged", async () => {
+  const server = await fakeServer(nextConnection, { advertise: true, answer: "silence", ack: false });
+  try {
+    await assert.rejects(publish(server, { sendOnly: true, flushTimeoutMs: 300 }), (error: unknown) =>
+      error instanceof CultMeshRudpWriteUnconfirmedError && error.reason === "local_send_failed");
+  } finally { server.close(); }
+});
+
+test("sendOnly keeps the cause of a put that cannot be built: it is not reported as local_send_failed", async () => {
+  const server = await fakeServer(nextConnection, { advertise: false, answer: "silence" });
+  try {
+    await assert.rejects(
+      CultMesh.publishRudpDocumentOnce("receipt-client", nextConnection++, server.endpoint, binding, "tests:receipt:a", { noteId: 1 } as unknown as { noteId: string; text: string }, { ...transport, sendOnly: true }),
+      (error: unknown) => !(error instanceof CultMeshRudpWriteUnconfirmedError) && error instanceof Error,
+    );
+    assert.deepEqual(server.seen, [], "nothing was sent");
+  } finally { server.close(); }
+});
+
+test("the receipt path keeps the cause of a put that cannot be built: it is not reported as local_send_failed", async () => {
+  const server = await fakeServer(nextConnection, { advertise: true, answer: "admit" });
+  try {
+    await assert.rejects(
+      CultMesh.publishRudpDocumentOnce("receipt-client", nextConnection++, server.endpoint, binding, "tests:receipt:a", { noteId: 1 } as unknown as { noteId: string; text: string }, { ...transport, writeReceipts: true }),
+      (error: unknown) => !(error instanceof CultMeshRudpWriteUnconfirmedError) && error instanceof Error,
+    );
+    assert.ok(!server.seen.includes("cultnet.document_put_raw.v0"), "no put was sent");
+  } finally { server.close(); }
+});
+
+test("sendOnly cannot be combined with writeReceipts", async () => {
+  await assert.rejects(publish({ endpoint: "rudp://127.0.0.1:9" }, { sendOnly: true, writeReceipts: true }), TypeError);
+});
+
+test("without writeReceipts no hello is sent and the receipt frames are never asked for", async () => {
+  const server = await fakeServer(nextConnection, { advertise: true, answer: "silence" });
+  try {
+    await assert.rejects(publish(server, { resultWindowMs: 100 }), CultMeshRudpWriteUnconfirmedError);
+    assert.deepEqual(server.seen, ["cultnet.document_put_raw.v0"]);
+  } finally { server.close(); }
+});

packages/cultnet-py/CHANGELOG.md

@@ -2,6 +2,7 @@
 
 ## Unreleased (breaking; version 0.x, so the next minor)
 
+- Decodes the write receipt frames of `contracts/cultnet/interop/write-receipt.md`: `parse_message` validates `cultnet.write_admitted.v0` and `cultnet.error.v1` against their closed schemas (unknown keys, empty or non-string ids, an unknown operation or code are refused; `error.v1` requires `messageId`, string or null; `limit_reached` is `error.v1` only). Added `CULTNET_ERROR_V1_CODES`, `CULTNET_WRITE_RECEIPT_MESSAGE_VERSIONS`, `write_content_hash` and `hello_advertises_write_receipts`; `hello` takes `supported_message_versions`. `tests/test_write_receipt.py` replays the vectors' `contentHash`, `wire` and `schemaInvalid` sections. Not implemented here: the client write tracker (`scenarios`) and the server rules (`dedupe`, `blankFields`); this package has no receipt server and no write client.
 - Added `message_invalid` to `CULTNET_ERROR_CODES` and `message_invalid_error(field, reason)`, byte-identical to the C# `ForMessageInvalid`. `cultmesh-py` refuses a malformed put or delete with it instead of the out-of-schema `malformed_document_put` and `malformed_document_delete`, which are removed.
 - Added `CultNetRudpSocketTransportServer` (`cultnet_py.rudp_server`): one UDP socket serving many RUDP peers, one session per
   remote endpoint, ported from the C# `CultNetRudpSocketTransportServer` and held to its bytes by

packages/cultnet-py/src/cultnet_py/__init__.py

@@ -39,6 +39,8 @@ from .cultmesh_contracts import (
 from .framing import decode_frame, encode_frame, read_frame, write_frame
 from .messages import (
     CULTNET_ERROR_CODES,
+    CULTNET_ERROR_V1_CODES,
+    CULTNET_WRITE_RECEIPT_MESSAGE_VERSIONS,
     CultNetMessage,
     CultNetWitnessArtifactBundle,
     compute_simulation_claim_hash,
@@ -51,7 +53,9 @@ from .messages import (
     error_message,
     message_invalid_error,
     unsupported_schema_version_error,
+    write_content_hash,
     hello,
+    hello_advertises_write_receipts,
     login,
     login_success,
     parse_message,
@@ -176,6 +180,8 @@ __all__ = [
     "verse_catalog_request",
     "verse_from_wire",
     "CULTNET_ERROR_CODES",
+    "CULTNET_ERROR_V1_CODES",
+    "CULTNET_WRITE_RECEIPT_MESSAGE_VERSIONS",
     "CultNetMessage",
     "CultNetWitnessArtifactBundle",
     "CultNetDatabaseSubscription",
@@ -266,6 +272,8 @@ __all__ = [
     "message_invalid_error",
     "unsupported_schema_version_error",
     "hello",
+    "hello_advertises_write_receipts",
+    "write_content_hash",
     "INTEROP_WIRE_CONTRACT",
     "login",
     "login_success",

packages/cultnet-py/src/cultnet_py/client.py

@@ -58,6 +58,7 @@ class CultNetRawClient:
     create_transport: CultNetSchemaTransportFactory | None = None
 
     def send(self, message: CultNetMessage | dict[str, Any]) -> None:
+        """Fire-and-forget: an ack or a return is not admission; read the result frame."""
         wire = message.to_wire() if isinstance(message, CultNetMessage) else message
         with self.open_transport() as transport:
             transport.send("schema", msgpack.packb(wire, use_bin_type=True))
@@ -319,6 +320,7 @@ class CultNetDatabaseSubscription:
                 self._transport = None
 
     def send(self, message: CultNetMessage | dict[str, Any]) -> None:
+        """Fire-and-forget: an ack or a return is not admission; read the result frame."""
         if self._transport is None:
             raise RuntimeError("CultNet database subscription is not open")
         wire = message.to_wire() if isinstance(message, CultNetMessage) else message

packages/cultnet-py/src/cultnet_py/messages.py

@@ -29,7 +29,11 @@ def parse_message(payload: bytes) -> CultNetMessage:
     body = dict(decoded)
     del body["schemaVersion"]
     if schema_version == "cultnet.error.v0":
-        _validate_error_body(body)
+        _validate_error_body(body, "cultnet.error.v0", CULTNET_ERROR_CODES)
+    elif schema_version == "cultnet.error.v1":
+        _validate_error_body(body, "cultnet.error.v1", CULTNET_ERROR_V1_CODES)
+    elif schema_version == "cultnet.write_admitted.v0":
+        _validate_write_admitted_body(body)
     return CultNetMessage(schema_version=schema_version, body=body)
 
 
@@ -47,6 +51,13 @@ CULTNET_ERROR_CODES: tuple[str, ...] = (
     "message_invalid",
 )
 
+# cultnet.error.v1 (contracts/cultnet/interop/cultnet.error.v1.schema.json): v0's codes plus limit_reached.
+CULTNET_ERROR_V1_CODES: tuple[str, ...] = (*CULTNET_ERROR_CODES, "limit_reached")
+
+# The two frames a receipt-capable hello lists in supportedMessageVersions; a peer lists both or neither
+# (contracts/cultnet/interop/write-receipt.md, "Capability: opting in").
+CULTNET_WRITE_RECEIPT_MESSAGE_VERSIONS: tuple[str, ...] = ("cultnet.write_admitted.v0", "cultnet.error.v1")
+
 _ERROR_DETAILS_KEYS = ("field", "value", "asOf", "current")
 
 
@@ -54,16 +65,48 @@ def _is_uint(value: Any) -> bool:
     return isinstance(value, int) and not isinstance(value, bool) and value >= 0
 
 
-def _validate_error_body(body: dict[str, Any]) -> None:
+def _is_name(value: Any) -> bool:
-    """Refuse a cultnet.error.v0 body that is not the full-key shape the schema requires."""
+    return isinstance(value, str) and value != ""
-    expected = ("error", "routingHint", "code", "details")
+
+
+def _validate_write_admitted_body(body: dict[str, Any]) -> None:
+    """Refuse a cultnet.write_admitted.v0 body that is not exactly the five keys of its closed schema."""
+    expected = ("messageId", "operation", "schemaId", "recordKey")
     if set(body) != set(expected):
-        raise ValueError(f"cultnet.error.v0 must carry exactly {list(expected)}, got {sorted(body)}")
+        raise ValueError(f"cultnet.write_admitted.v0 must carry exactly {list(expected)}, got {sorted(body)}")
+    for key in ("messageId", "schemaId", "recordKey"):
+        if not _is_name(body[key]):
+            raise ValueError(f"cultnet.write_admitted.v0 {key} must be a non-empty string")
+    if body["operation"] not in ("put", "delete"):
+        raise ValueError("cultnet.write_admitted.v0 operation must be put or delete")
+
+
+def write_content_hash(operation: str, schema_id: str, record_key: str, payload: bytes | None) -> bytes:
+    """SHA-256 of the MessagePack array [operation, schemaId, recordKey, payload] (write-receipt.md, rule 5).
+
+    payload is the raw document payload, packed as a MessagePack bin for a put and nil for a delete.
+    """
+    return hashlib.sha256(msgpack.packb([operation, schema_id, record_key, payload], use_bin_type=True)).digest()
+
+
+def hello_advertises_write_receipts(hello_message: CultNetMessage) -> bool:
+    """True when a hello lists both receipt frames: the only thing that makes a connection receipt-capable."""
+    listed = hello_message.body.get("supportedMessageVersions")
+    return isinstance(listed, list) and all(version in listed for version in CULTNET_WRITE_RECEIPT_MESSAGE_VERSIONS)
+
+
+def _validate_error_body(body: dict[str, Any], version: str, codes: tuple[str, ...]) -> None:
+    """Refuse a cultnet.error body that is not the full-key shape its closed schema requires."""
+    expected = ("error", "routingHint", "code", "details") + (("messageId",) if version == "cultnet.error.v1" else ())
+    if set(body) != set(expected):
+        raise ValueError(f"{version} must carry exactly {list(expected)}, got {sorted(body)}")
     if not isinstance(body["error"], str) or not body["error"]:
-        raise ValueError("cultnet.error.v0 error must be a non-empty string")
+        raise ValueError(f"{version} error must be a non-empty string")
     code = body["code"]
-    if code is not None and (not isinstance(code, str) or code not in CULTNET_ERROR_CODES):
+    if code is not None and (not isinstance(code, str) or code not in codes):
-        raise ValueError(f"cultnet.error.v0 code {code!r} is not a recognized refusal code")
+        raise ValueError(f"{version} code {code!r} is not a recognized refusal code")
+    if "messageId" in body and body["messageId"] is not None and not _is_name(body["messageId"]):
+        raise ValueError(f"{version} messageId must be a non-empty string or null")
     hint = body["routingHint"]
     if hint is not None:
         if (
@@ -72,17 +115,17 @@ def _validate_error_body(body: dict[str, Any]) -> None:
             or not isinstance(hint["reason"], str)
             or not (hint["shard"] is None or isinstance(hint["shard"], dict))
         ):
-            raise ValueError("cultnet.error.v0 routingHint must be null or {shard, reason}")
+            raise ValueError(f"{version} routingHint must be null or {{shard, reason}}")
     details = body["details"]
     if details is not None:
         if not isinstance(details, dict) or set(details) != set(_ERROR_DETAILS_KEYS):
-            raise ValueError(f"cultnet.error.v0 details must be null or carry exactly {list(_ERROR_DETAILS_KEYS)}")
+            raise ValueError(f"{version} details must be null or carry exactly {list(_ERROR_DETAILS_KEYS)}")
         for key in ("field", "value"):
             if details[key] is not None and not isinstance(details[key], str):
-                raise ValueError(f"cultnet.error.v0 details.{key} must be a string or null")
+                raise ValueError(f"{version} details.{key} must be a string or null")
         for key in ("asOf", "current"):
             if details[key] is not None and not _is_uint(details[key]):
-                raise ValueError(f"cultnet.error.v0 details.{key} must be a non-negative integer or null")
+                raise ValueError(f"{version} details.{key} must be a non-negative integer or null")
 
 
 def hello(
@@ -92,17 +135,18 @@ def hello(
     supported_schema_versions: list[str] | None = None,
     supported_mutation_contracts: list[dict[str, Any]] | None = None,
     transport_profiles: list[dict[str, Any]] | None = None,
+    supported_message_versions: list[str] | None = None,
 ) -> CultNetMessage:
-    return CultNetMessage(
+    body: dict[str, Any] = {
-        "cultnet.hello.v0",
+        "runtimeId": runtime_id,
-        {
+        "supportedWireContracts": supported_wire_contracts or ["cultnet.schema.v0"],
-            "runtimeId": runtime_id,
+        "supportedSchemaVersions": supported_schema_versions or [],
-            "supportedWireContracts": supported_wire_contracts or ["cultnet.schema.v0"],
+        "supportedMutationContracts": supported_mutation_contracts or [],
-            "supportedSchemaVersions": supported_schema_versions or [],
+        "transportProfiles": transport_profiles or [],
-            "supportedMutationContracts": supported_mutation_contracts or [],
+    }
-            "transportProfiles": transport_profiles or [],
+    if supported_message_versions is not None:
-        },
+        body["supportedMessageVersions"] = supported_message_versions
-    )
+    return CultNetMessage("cultnet.hello.v0", body)
 
 
 def login(
@@ -172,7 +216,7 @@ def error_message(
     }
     if details is not None and set(details) - set(_ERROR_DETAILS_KEYS):
         raise ValueError(f"cultnet.error.v0 details has unknown keys {sorted(set(details) - set(_ERROR_DETAILS_KEYS))}")
-    _validate_error_body(body)
+    _validate_error_body(body, "cultnet.error.v0", CULTNET_ERROR_CODES)
     return CultNetMessage("cultnet.error.v0", body)
 
 

packages/cultnet-py/src/cultnet_py/transport.py

@@ -1256,6 +1256,7 @@ class CultNetRudpSocketTransportConnection:
         self._send_packet(self.session.create_connect(_now_ms(), payload))
 
     def send(self, channel_id: str, payload: bytes) -> None:
+        """Fire-and-forget: an ack or a return is not admission; read the result frame."""
         packets = self.session.send_many(
             channel_id,
             payload,
@@ -1567,6 +1568,7 @@ class TcpFramedTransportConnection:
         )
 
     def send(self, channel_id: str, payload: bytes) -> None:
+        """Fire-and-forget: an ack or a return is not admission; read the result frame."""
         if channel_id != "schema":
             raise ValueError(f"tcp_framed transport only supports the schema channel, got {channel_id!r}")
         before = len(payload) + 4

packages/cultnet-py/tests/test_write_receipt.py

@@ -0,0 +1,247 @@
+from __future__ import annotations
+
+import json
+import unittest
+from pathlib import Path
+from typing import Any
+
+import msgpack
+
+from cultnet_py import (
+    CULTNET_ERROR_CODES,
+    CULTNET_ERROR_V1_CODES,
+    CULTNET_WRITE_RECEIPT_MESSAGE_VERSIONS,
+    error_message,
+    hello,
+    hello_advertises_write_receipts,
+    parse_message,
+    write_content_hash,
+)
+
+# Decoder-side conformance with contracts/cultnet/interop/write-receipt-vectors.json: `contentHash`, `wire` and
+# `schemaInvalid`. `dedupe` and `blankFields` are server obligations and `scenarios` is the client write tracker; `counts` is the file's own tally;
+# this runtime has neither a receipt server nor a write client, so it replays none of them.
+_INTEROP = Path(__file__).resolve().parents[3] / "contracts/cultnet/interop"
+_VECTORS = json.loads((_INTEROP / "write-receipt-vectors.json").read_text(encoding="utf-8"))
+_ERROR_V1_SCHEMA = json.loads((_INTEROP / "cultnet.error.v1.schema.json").read_text(encoding="utf-8"))
+
+
+def _pack(wire: dict[str, Any]) -> bytes:
+    return msgpack.packb(wire, use_bin_type=True)
+
+
+def _admitted(**override: Any) -> dict[str, Any]:
+    return {
+        "schemaVersion": "cultnet.write_admitted.v0",
+        "messageId": "put-1",
+        "operation": "put",
+        "schemaId": "note.v0",
+        "recordKey": "note:1",
+        **override,
+    }
+
+
+def _refused(**override: Any) -> dict[str, Any]:
+    return {
+        "schemaVersion": "cultnet.error.v1",
+        "error": "write_not_authorized: no",
+        "routingHint": None,
+        "code": "write_not_authorized",
+        "details": None,
+        "messageId": "put-1",
+        **override,
+    }
+
+
+class WriteReceiptVectorTests(unittest.TestCase):
+    def test_vector_sections_are_the_ones_this_file_accounts_for(self) -> None:
+        self.assertEqual(
+            set(_VECTORS) - {"provenance", "specification"},
+            {"constants", "contentHash", "dedupe", "wire", "blankFields", "schemaInvalid", "scenarios", "counts"},
+        )
+        self.assertEqual(len(_VECTORS["contentHash"]["cases"]), 4)
+        self.assertEqual(len(_VECTORS["wire"]), 7)
+        self.assertEqual(len(_VECTORS["schemaInvalid"]), 7)
+        # The file declares how many of each it holds; a loader that drops entries disagrees with it.
+        counts = _VECTORS["counts"]
+        self.assertEqual(counts["wire"], len(_VECTORS["wire"]))
+        self.assertEqual(counts["schemaInvalid"], len(_VECTORS["schemaInvalid"]))
+        self.assertEqual(counts["contentHashCases"], len(_VECTORS["contentHash"]["cases"]))
+        self.assertEqual(counts["scenarioCases"], len(_VECTORS["scenarios"]["cases"]))
+
+    def test_content_hash_matches_every_vector(self) -> None:
+        for case in _VECTORS["contentHash"]["cases"]:
+            payload = None if case["payloadHex"] is None else bytes.fromhex(case["payloadHex"])
+            digest = write_content_hash(case["operation"], case["schemaId"], case["recordKey"], payload)
+            self.assertEqual(digest.hex(), case["sha256"], case["name"])
+
+    def test_wire_vectors_decode_to_their_fields_in_order_and_reencode_byte_identical(self) -> None:
+        for vector in _VECTORS["wire"]:
+            raw = bytes.fromhex(vector["messagePackHex"])
+            message = parse_message(raw)
+            self.assertEqual(message.to_wire(), vector["message"], vector["name"])
+            self.assertEqual(list(message.to_wire()), list(vector["message"]), vector["name"])
+            self.assertEqual(message.to_bytes(), raw, vector["name"])
+
+    def test_schema_invalid_vectors_are_refused(self) -> None:
+        for vector in _VECTORS["schemaInvalid"]:
+            with self.assertRaises(ValueError, msg=vector["name"]):
+                parse_message(bytes.fromhex(vector["messagePackHex"]))
+
+    def test_a_payload_that_is_not_bytes_changes_the_hash(self) -> None:
+        # The payload is a bin, not an str and not a re-parsed document.
+        as_bin = write_content_hash("put", "note.v0", "note:1", b"\x81\xa2id\xa11")
+        self.assertNotEqual(as_bin, write_content_hash("put", "note.v0", "note:1", None))
+        self.assertEqual(len(as_bin), 32)
+
+
+class ErrorV1Tests(unittest.TestCase):
+    def test_code_set_equals_the_schema_enum_and_v0_is_unchanged(self) -> None:
+        schema_codes = [c for c in _ERROR_V1_SCHEMA["properties"]["code"]["enum"] if c is not None]
+        self.assertEqual(sorted(CULTNET_ERROR_V1_CODES), sorted(schema_codes))
+        self.assertNotIn("limit_reached", CULTNET_ERROR_CODES)
+        self.assertEqual(CULTNET_ERROR_V1_CODES[-1], "limit_reached")
+
+    def test_every_v1_code_decodes_and_an_unknown_one_does_not(self) -> None:
+        for code in CULTNET_ERROR_V1_CODES:
+            self.assertEqual(parse_message(_pack(_refused(code=code))).body["code"], code)
+        parse_message(_pack(_refused(code=None)))
+        with self.assertRaises(ValueError):
+            parse_message(_pack(_refused(code="invented")))
+        with self.assertRaises(ValueError):
+            parse_message(_pack(_refused(code=7)))
+
+    def test_limit_reached_is_v1_only(self) -> None:
+        v0 = {k: v for k, v in _refused(code="limit_reached", schemaVersion="cultnet.error.v0").items() if k != "messageId"}
+        with self.assertRaises(ValueError):
+            parse_message(_pack(v0))
+        with self.assertRaises(ValueError):
+            error_message("x", code="limit_reached")
+
+    def test_message_id_is_required_and_is_a_nonempty_string_or_null(self) -> None:
+        self.assertEqual(parse_message(_pack(_refused(messageId="w-é 1"))).body["messageId"], "w-é 1")
+        self.assertIsNone(parse_message(_pack(_refused(messageId=None))).body["messageId"])
+        omitted = {k: v for k, v in _refused().items() if k != "messageId"}
+        with self.assertRaises(ValueError):
+            parse_message(_pack(omitted))
+        for bad in ("", 5, b"put-1", ["put-1"], True):
+            with self.assertRaises(ValueError, msg=repr(bad)):
+                parse_message(_pack(_refused(messageId=bad)))
+
+    def test_v0_stays_closed_to_message_id(self) -> None:
+        v0 = _refused(schemaVersion="cultnet.error.v0", code="message_invalid")
+        with self.assertRaises(ValueError):
+            parse_message(_pack(v0))
+        del v0["messageId"]
+        self.assertEqual(parse_message(_pack(v0)).schema_version, "cultnet.error.v0")
+
+    def test_v1_is_closed_to_unknown_keys_and_keeps_the_shape_rules_of_v0(self) -> None:
+        for bad in (
+            _refused(extra=1),
+            _refused(error=""),
+            _refused(error=3),
+            _refused(routingHint={"shard": None}),
+            _refused(routingHint={"shard": 1, "reason": "r"}),
+            _refused(routingHint={"shard": None, "reason": 1}),
+            _refused(details={"field": None, "value": None, "asOf": None}),
+            _refused(details={"field": 1, "value": None, "asOf": None, "current": None}),
+            _refused(details={"field": None, "value": None, "asOf": -1, "current": None}),
+            _refused(details={"field": None, "value": None, "asOf": None, "current": True}),
+        ):
+            with self.assertRaises(ValueError, msg=str(bad)):
+                parse_message(_pack(bad))
+        for good in (
+            _refused(routingHint={"shard": None, "reason": "r"}),
+            _refused(details={"field": "messageId", "value": "x", "asOf": 1, "current": 2}),
+        ):
+            parse_message(_pack(good))
+
+    def test_the_refusal_reason_names_its_version(self) -> None:
+        with self.assertRaisesRegex(ValueError, "cultnet.error.v1 code"):
+            parse_message(_pack(_refused(code="invented")))
+        with self.assertRaisesRegex(ValueError, r"routingHint must be null or \{shard, reason\}"):
+            parse_message(_pack(_refused(routingHint={"shard": None})))
+
+
+class RefusalTextTests(unittest.TestCase):
+    """A refusal names its frame version and the rule it broke; a caller reads this text in a log."""
+
+    def assertRefused(self, wire: dict[str, Any], pattern: str) -> None:
+        with self.assertRaisesRegex(ValueError, pattern):
+            parse_message(_pack(wire))
+
+    def test_error_frames_name_their_own_version(self) -> None:
+        v0 = {k: v for k, v in _refused(schemaVersion="cultnet.error.v0").items() if k != "messageId"}
+        self.assertRefused({**v0, "code": "nope"}, r"^cultnet\.error\.v0 code")
+        self.assertRefused({**v0, "extra": 1}, r"^cultnet\.error\.v0 must carry exactly")
+        self.assertRefused(_refused(extra=1), r"^cultnet\.error\.v1 must carry exactly")
+        self.assertRefused(_refused(error=""), r"^cultnet\.error\.v1 error must be")
+        self.assertRefused(_refused(messageId=""), r"^cultnet\.error\.v1 messageId must be")
+        self.assertRefused(_refused(details={"field": None}), r"^cultnet\.error\.v1 details must be null or carry exactly")
+        self.assertRefused(
+            _refused(details={"field": 1, "value": None, "asOf": None, "current": None}), r"^cultnet\.error\.v1 details\.field must be"
+        )
+        self.assertRefused(
+            _refused(details={"field": None, "value": None, "asOf": -1, "current": None}), r"^cultnet\.error\.v1 details\.asOf must be"
+        )
+        with self.assertRaisesRegex(ValueError, r"^cultnet\.error\.v0 code"):
+            error_message("x", code="bogus")
+
+    def test_write_admitted_names_the_broken_rule(self) -> None:
+        self.assertRefused(_admitted(extra=1), r"^cultnet\.write_admitted\.v0 must carry exactly")
+        self.assertRefused(_admitted(recordKey=""), r"^cultnet\.write_admitted\.v0 recordKey must be a non-empty string")
+        self.assertRefused(_admitted(operation="upsert"), r"^cultnet\.write_admitted\.v0 operation must be put or delete$")
+
+
+class WriteAdmittedTests(unittest.TestCase):
+    def test_both_operations_decode(self) -> None:
+        for operation in ("put", "delete"):
+            self.assertEqual(parse_message(_pack(_admitted(operation=operation))).body["operation"], operation)
+
+    def test_every_key_is_required_and_no_other_is_allowed(self) -> None:
+        for key in ("messageId", "operation", "schemaId", "recordKey"):
+            with self.assertRaises(ValueError, msg=key):
+                parse_message(_pack({k: v for k, v in _admitted().items() if k != key}))
+        for extra in ("error", "code", "details"):
+            with self.assertRaises(ValueError, msg=extra):
+                parse_message(_pack(_admitted(**{extra: "x"})))
+
+    def test_each_string_is_nonempty_and_a_string(self) -> None:
+        for key in ("messageId", "schemaId", "recordKey"):
+            for bad in ("", None, 3, b"x"):
+                with self.assertRaises(ValueError, msg=f"{key}={bad!r}"):
+                    parse_message(_pack(_admitted(**{key: bad})))
+
+    def test_operation_is_put_or_delete(self) -> None:
+        for bad in ("upsert", "PUT", "", None, 1):
+            with self.assertRaises(ValueError, msg=repr(bad)):
+                parse_message(_pack(_admitted(operation=bad)))
+
+    def test_message_id_is_echoed_byte_for_byte(self) -> None:
+        self.assertEqual(parse_message(_pack(_admitted(messageId="  w é 1 "))).body["messageId"], "  w é 1 ")
+
+
+class HelloCapabilityTests(unittest.TestCase):
+    def test_capability_needs_both_frames(self) -> None:
+        both = list(CULTNET_WRITE_RECEIPT_MESSAGE_VERSIONS)
+        self.assertEqual(both, ["cultnet.write_admitted.v0", "cultnet.error.v1"])
+        self.assertTrue(hello_advertises_write_receipts(hello(runtime_id="r", supported_message_versions=both)))
+        self.assertTrue(hello_advertises_write_receipts(hello(runtime_id="r", supported_message_versions=[*both, "x"])))
+        self.assertFalse(hello_advertises_write_receipts(hello(runtime_id="r", supported_message_versions=both[:1])))
+        self.assertFalse(hello_advertises_write_receipts(hello(runtime_id="r", supported_message_versions=both[1:])))
+        self.assertFalse(hello_advertises_write_receipts(hello(runtime_id="r", supported_message_versions=[])))
+        self.assertFalse(hello_advertises_write_receipts(hello(runtime_id="r")))
+
+    def test_a_non_list_listing_is_not_a_capability(self) -> None:
+        wire = hello(runtime_id="r").to_wire()
+        wire["supportedMessageVersions"] = "cultnet.write_admitted.v0 cultnet.error.v1"
+        self.assertFalse(hello_advertises_write_receipts(parse_message(_pack(wire))))
+
+    def test_hello_writes_the_listing_only_when_given_and_round_trips(self) -> None:
+        self.assertNotIn("supportedMessageVersions", hello(runtime_id="r").body)
+        listed = hello(runtime_id="r", supported_message_versions=list(CULTNET_WRITE_RECEIPT_MESSAGE_VERSIONS))
+        self.assertEqual(parse_message(listed.to_bytes()), listed)
+
+
+if __name__ == "__main__":
+    unittest.main()

packages/cultnet-rs/src/contracts.rs

@@ -249,6 +249,9 @@ pub enum CultNetErrorCode {
     WriteNotAuthorized,
     UnsupportedSchemaVersion,
     MessageInvalid,
+    /// `cultnet.error.v1` only: the session's remembered-write limit is full. `cultnet.error.v0` neither
+    /// encodes nor decodes it, so its enum stays the schema's.
+    LimitReached,
 }
 
 impl CultNetErrorCode {
@@ -263,6 +266,7 @@ impl CultNetErrorCode {
             Self::WriteNotAuthorized => "write_not_authorized",
             Self::UnsupportedSchemaVersion => "unsupported_schema_version",
             Self::MessageInvalid => "message_invalid",
+            Self::LimitReached => "limit_reached",
         }
     }
 
@@ -277,6 +281,7 @@ impl CultNetErrorCode {
             "write_not_authorized" => Ok(Self::WriteNotAuthorized),
             "unsupported_schema_version" => Ok(Self::UnsupportedSchemaVersion),
             "message_invalid" => Ok(Self::MessageInvalid),
+            "limit_reached" => Ok(Self::LimitReached),
             _ => Err(anyhow!("ErrorMessage.Code is not a recognized cultnet.error.v0 code")),
         }
     }
@@ -359,6 +364,26 @@ pub enum CultNetMessage {
         #[serde(default, skip_serializing_if = "Option::is_none")]
         details: Option<CultNetErrorDetails>,
     },
+    /// `cultnet.error.v1` (contracts/cultnet/interop/write-receipt.md): `cultnet.error.v0` plus the id of the
+    /// request it answers. Sent only to a connection that declared the write-receipt capability.
+    #[serde(skip_deserializing)]
+    #[serde(rename = "cultnet.error.v1", rename_all = "camelCase")]
+    ErrorV1 {
+        error: String,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        code: Option<CultNetErrorCode>,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        details: Option<CultNetErrorDetails>,
+        message_id: Option<String>,
+    },
+    /// `cultnet.write_admitted.v0`: the receipt for one admitted put or delete, sent after its commit point.
+    #[serde(rename = "cultnet.write_admitted.v0", rename_all = "camelCase")]
+    WriteAdmitted {
+        message_id: String,
+        operation: String,
+        schema_id: String,
+        record_key: String,
+    },
     #[serde(rename = "cultnet.sample.change_name.v0", rename_all = "camelCase")]
     SampleChangeName { name: String },
     #[serde(rename = "cultnet.sample.chat.v0", rename_all = "camelCase")]
@@ -543,7 +568,9 @@ pub fn encode_cultnet_message_for_wire(
             | CultNetMessage::SnapshotResponseRawV1 { .. }
             | CultNetMessage::ContentChunkRequest { .. }
             | CultNetMessage::ContentChunkResponse { .. }
-            | CultNetMessage::Error { .. } => encode_raw_cultnet_schema_message(message),
+            | CultNetMessage::Error { .. }
+            | CultNetMessage::ErrorV1 { .. }
+            | CultNetMessage::WriteAdmitted { .. } => encode_raw_cultnet_schema_message(message),
             _ => Ok(cultcache_rs::decode_payload(&rmp_serde::to_vec(
                 &serde_json::to_value(message)?,
             )?)?),
@@ -573,7 +600,8 @@ pub fn decode_cultnet_message_from_slice(
                     | "cultnet.snapshot_response_raw.v0"
                     | "cultmesh.content_chunk_request.v1"
                     | "cultmesh.content_chunk_response.v1"
-                    | "cultnet.error.v0",
+                    | "cultnet.error.v0"
+                    | "cultnet.error.v1",
                 ) => parse_raw_cultnet_schema_message(&wire_value)
                     .with_context(|| received_version_label(&wire_value))?,
                 _ => cultcache_rs::decode_payload::<CultNetMessage>(bytes)
@@ -645,6 +673,20 @@ fn validate_message(message: &CultNetMessage) -> Result<()> {
             require_non_empty(session, "session")?;
         }
         CultNetMessage::Error { error, code: _, details: _ } => require_non_empty(error, "error")?,
+        CultNetMessage::ErrorV1 { error, message_id, .. } => {
+            require_non_empty(error, "error")?;
+            if let Some(message_id) = message_id {
+                require_non_empty(message_id, "messageId")?;
+            }
+        }
+        CultNetMessage::WriteAdmitted { message_id, operation, schema_id, record_key } => {
+            require_non_empty(message_id, "messageId")?;
+            if operation != "put" && operation != "delete" {
+                return Err(anyhow!("operation must be put or delete"));
+            }
+            require_non_empty(schema_id, "schemaId")?;
+            require_non_empty(record_key, "recordKey")?;
+        }
         CultNetMessage::SampleChangeName { name } => require_non_empty(name, "name")?,
         CultNetMessage::SampleChat { text } => require_non_empty(text, "text")?,
         CultNetMessage::DocumentDelete {
@@ -1021,7 +1063,7 @@ fn parse_raw_cultnet_schema_message(input: &rmpv::Value) -> Result<CultNetMessag
                 .to_vec(),
             error: require_legacy_string(get("error"), "error")?,
         }),
-        "cultnet.error.v0" => {
+        "cultnet.error.v0" | "cultnet.error.v1" => {
             let code = get("code")
                 .filter(|value| !value.is_nil())
                 .map(|value| {
@@ -1031,12 +1073,23 @@ fn parse_raw_cultnet_schema_message(input: &rmpv::Value) -> Result<CultNetMessag
                         .and_then(CultNetErrorCode::from_wire_str)
                 })
                 .transpose()?;
+            if schema_version == "cultnet.error.v0" && code == Some(CultNetErrorCode::LimitReached) {
+                return Err(anyhow!("ErrorMessage.Code is not a recognized cultnet.error.v0 code"));
+            }
             let details = require_error_details(get("details"), "ErrorMessage.Details")?;
-            Ok(CultNetMessage::Error {
+            let error = require_legacy_string(get("error"), "ErrorMessage.Error")?;
-                error: require_legacy_string(get("error"), "ErrorMessage.Error")?,
+            if schema_version == "cultnet.error.v1" {
-                code,
+                return Ok(CultNetMessage::ErrorV1 {
-                details,
+                    error,
-            })
+                    code,
+                    details,
+                    message_id: match get("messageId") {
+                        None | Some(rmpv::Value::Nil) => None,
+                        other => Some(require_legacy_string(other, "messageId")?),
+                    },
+                });
+            }
+            Ok(CultNetMessage::Error { error, code, details })
         }
         _ => Err(anyhow!(
             "Unsupported raw cultnet.schema.v0 message"
@@ -1090,7 +1143,18 @@ fn require_legacy_optional_u64(
 }
 
 fn encode_raw_cultnet_schema_message(message: &CultNetMessage) -> Result<rmpv::Value> {
+    if let CultNetMessage::Error { code: Some(CultNetErrorCode::LimitReached), .. } = message {
+        return Err(anyhow!("limit_reached is a cultnet.error.v1 code; cultnet.error.v0 cannot carry it"));
+    }
     Ok(rmpv::Value::Map(match message {
+        // Spec field order (write-receipt.md), not serde_json's sorted map.
+        CultNetMessage::WriteAdmitted { message_id, operation, schema_id, record_key } => vec![
+            (rmpv::Value::from("schemaVersion"), rmpv::Value::from("cultnet.write_admitted.v0")),
+            (rmpv::Value::from("messageId"), rmpv::Value::from(message_id.as_str())),
+            (rmpv::Value::from("operation"), rmpv::Value::from(operation.as_str())),
+            (rmpv::Value::from("schemaId"), rmpv::Value::from(schema_id.as_str())),
+            (rmpv::Value::from("recordKey"), rmpv::Value::from(record_key.as_str())),
+        ],
         CultNetMessage::DocumentPutRaw {
             message_id,
             document,
@@ -1255,6 +1319,36 @@ fn encode_raw_cultnet_schema_message(message: &CultNetMessage) -> Result<rmpv::V
                     .unwrap_or(rmpv::Value::Nil),
             ),
         ],
+        CultNetMessage::ErrorV1 {
+            error,
+            code,
+            details,
+            message_id,
+        } => vec![
+            (rmpv::Value::from("schemaVersion"), rmpv::Value::from("cultnet.error.v1")),
+            (rmpv::Value::from("error"), rmpv::Value::from(error.as_str())),
+            (rmpv::Value::from("routingHint"), rmpv::Value::Nil),
+            (
+                rmpv::Value::from("code"),
+                code.as_ref()
+                    .map(|code| rmpv::Value::from(code.as_wire_str()))
+                    .unwrap_or(rmpv::Value::Nil),
+            ),
+            (
+                rmpv::Value::from("details"),
+                details
+                    .as_ref()
+                    .map(encode_error_details)
+                    .unwrap_or(rmpv::Value::Nil),
+            ),
+            (
+                rmpv::Value::from("messageId"),
+                message_id
+                    .as_deref()
+                    .map(rmpv::Value::from)
+                    .unwrap_or(rmpv::Value::Nil),
+            ),
+        ],
         _ => {
             return Err(anyhow!(
                 "Message is not a raw cultnet.schema.v0 binary replication message"
@@ -1884,3 +1978,71 @@ fn legacy_schema_descriptor(schema: &CultNetSchemaDescriptor) -> Result<rmpv::Va
         ),
     ]))
 }
+
+/// The content hash a write-receipt server binds to a `(actor, messageId)` dedupe key
+/// (contracts/cultnet/interop/write-receipt.md, rule 5): SHA-256 of the MessagePack array
+/// `[operation, schemaId, recordKey, payload]`, `payload` a `bin` for a put and nil for a delete.
+pub fn write_content_hash(
+    operation: &str,
+    schema_id: &str,
+    record_key: &str,
+    payload: Option<&[u8]>,
+) -> Result<[u8; 32]> {
+    use sha2::{Digest, Sha256};
+    let value = rmpv::Value::Array(vec![
+        rmpv::Value::from(operation),
+        rmpv::Value::from(schema_id),
+        rmpv::Value::from(record_key),
+        payload.map_or(rmpv::Value::Nil, |payload| rmpv::Value::Binary(payload.to_vec())),
+    ]);
+    let mut bytes = Vec::new();
+    rmpv::encode::write_value(&mut bytes, &value)?;
+    Ok(Sha256::digest(&bytes).into())
+}
+
+/// SHA-256 of a write's `messageId`: what a receipt server remembers in place of the id itself, so an
+/// entry's memory does not depend on the id's length (write-receipt.md, "What is remembered").
+pub fn message_id_digest(message_id: &str) -> [u8; 32] {
+    use sha2::{Digest, Sha256};
+    Sha256::digest(message_id.as_bytes()).into()
+}
+
+/// The `messageId` of a schema frame that does not decode as a message (write-receipt.md, rule 3: a refusal
+/// carries the write's id whenever the frame is readable enough to find it). `None` when the bytes are not
+/// a MessagePack map or hold no non-empty string `messageId`.
+pub fn readable_message_id(bytes: &[u8]) -> Option<String> {
+    let value = rmpv::decode::read_value(&mut &*bytes).ok()?;
+    let rmpv::Value::Map(entries) = value else {
+        return None;
+    };
+    entries.into_iter().find_map(|(key, value)| match (key.as_str(), value) {
+        (Some("messageId"), rmpv::Value::String(id)) => id.into_str().filter(|id| !id.is_empty()),
+        _ => None,
+    })
+}
+
+/// The first required field (`document`, then `schemaId`) that a put or delete frame lacks or holds as nil
+/// (write-receipt.md, "Required fields"), with the write's operation (`"put"` or `"delete"`). `None` when the
+/// bytes are not such a frame, or both fields are present. A put's `schemaId` is its document's.
+pub fn missing_required_write_field(bytes: &[u8]) -> Option<(&'static str, &'static str)> {
+    let rmpv::Value::Map(entries) = rmpv::decode::read_value(&mut &*bytes).ok()? else {
+        return None;
+    };
+    let field = |entries: &[(rmpv::Value, rmpv::Value)], name: &str| {
+        entries
+            .iter()
+            .find(|(key, _)| key.as_str() == Some(name))
+            .map(|(_, value)| value.clone())
+            .filter(|value| !value.is_nil())
+    };
+    match field(&entries, "schemaVersion")?.as_str()? {
+        "cultnet.document_put_raw.v0" => match field(&entries, "document") {
+            Some(rmpv::Value::Map(document)) => {
+                field(&document, "schemaId").is_none().then_some(("put", "schemaId"))
+            }
+            _ => Some(("put", "document")),
+        },
+        "cultnet.document_delete.v0" => field(&entries, "schemaId").is_none().then_some(("delete", "schemaId")),
+        _ => None,
+    }
+}

packages/cultnet-rs/src/rudp.rs

@@ -468,6 +468,14 @@ impl CultNetRudpSession {
         self.create_disconnect(RUDP_REFUSED_PACKET_REASON.to_vec())
     }
 
+    /// Ends a session because the server itself could not answer a write it owes an answer to (its answer
+    /// could not be encoded, queued or sent). The peer did nothing wrong: this goodbye is not the
+    /// "session refused a packet" of a protocol refusal.
+    pub fn end_local_failure_session(&mut self) -> CultNetRudpPacket {
+        self.reset_peer_state();
+        self.create_disconnect(RUDP_LOCAL_FAILURE_REASON.to_vec())
+    }
+
     /// Ends a session that owes its peer a packet that can never be sent as
     /// built (see `is_permanent_send_error`). Resending it would fail forever,
     /// and dropping it would leave a reliable sequence the peer waits on for
@@ -1269,6 +1277,12 @@ impl CultNetRudpSession {
         }
     }
 
+    /// Whether `receive` has taken this reliable sequence: delivered, held, superseded or a duplicate. A packet
+    /// `receive` refused unremembered (too far ahead, or before the handshake) is not, and its sender resends it.
+    pub fn has_received(&self, sequence: u32) -> bool {
+        self.was_received(sequence)
+    }
+
     /// The one duplicate test: true for a sequence in the window that was
     /// received, for one below the window, and for one at or before the
     /// watermark. The watermark starts at the handshake's seed, so a frame the
@@ -2198,6 +2212,7 @@ impl CultNetRudpSocketTransportConnection {
         self.send_packet(&packet)
     }
 
+    /// Fire-and-forget: an ack or a return is not admission; read the result frame.
     pub fn send(&mut self, channel_id: &str, payload: Vec<u8>) -> Result<()> {
         let options =
             channel_send_options(
@@ -2216,6 +2231,8 @@ impl CultNetRudpSocketTransportConnection {
 
     /// Sends one frame on a reliable channel whose packets cannot expire and
     /// returns the transport receipt used to observe its exact acknowledgement.
+    ///
+    /// Fire-and-forget: an ack or a return is not admission; read the result frame.
     pub fn send_reliable(
         &mut self,
         channel_id: &str,
@@ -2309,6 +2326,9 @@ impl CultNetRudpSocketTransportConnection {
         self.session.outstanding_reliable_packet_count()
     }
 
+    /// Waits until every reliable write is acknowledged by the transport.
+    ///
+    /// Fire-and-forget: an ack or a return is not admission; read the result frame.
     pub fn flush_reliable(&mut self, timeout: Duration) -> Result<()> {
         let original_timeout = self.socket.read_timeout()?;
         let poll_timeout = original_timeout
@@ -2603,6 +2623,8 @@ where
 /// Sent to a peer whose session refused one of its packets, and reported to
 /// the local caller as the disconnect reason.
 const RUDP_REFUSED_PACKET_REASON: &[u8] = b"session refused a packet";
+/// Goodbye reason of a session whose server could not answer a write (`end_local_failure_session`).
+const RUDP_LOCAL_FAILURE_REASON: &[u8] = b"server could not answer a write";
 const SESSION_TIMED_OUT_REASON: &[u8] = b"session timed out";
 /// Prefix of the goodbye reason for a session that owed a packet which can
 /// never be sent; the failure's fixed name (`send_error_code`) follows it.

packages/cultnet-rs/src/transport.rs

@@ -252,6 +252,7 @@ impl<TStream> TcpFramedTransportConnection<TStream>
 where
     TStream: Write,
 {
+    /// Fire-and-forget: an ack or a return is not admission; read the result frame.
     pub fn send(&mut self, channel_id: &str, payload: &[u8]) -> Result<()> {
         if channel_id != "schema" {
             return Err(anyhow!(

packages/cultnet-rs/tests/write_receipt.rs

@@ -0,0 +1,155 @@
+//! Wire parity with contracts/cultnet/interop/write-receipt-vectors.json: the content hash, and the two new frames.
+
+use cultnet_rs::{
+    CultNetErrorCode, CultNetErrorDetails, CultNetMessage, CultNetWireContract, decode_cultnet_message_from_slice,
+    encode_cultnet_message_to_vec, write_content_hash,
+};
+
+fn hex(bytes: &[u8]) -> String {
+    bytes.iter().map(|byte| format!("{byte:02x}")).collect()
+}
+
+#[test]
+fn the_content_hash_matches_the_spec_vectors() {
+    let a = [0x81, 0xA2, 0x69, 0x64, 0xA1, 0x31];
+    let b = [0x81, 0xA2, 0x69, 0x64, 0xA1, 0x32];
+    let cases = [
+        (write_content_hash("put", "note.v0", "note:1", Some(&a)), "7051c10071123b6ade50fbd5075e3859cae4ea70ce358a24a0b0c6980090e95d"),
+        (write_content_hash("put", "note.v0", "note:1", Some(&b)), "58d3fc6b858d2605a68550c9d4811ccdca6b9db7a0c3bfebf304d279257f6f9f"),
+        (write_content_hash("put", "note.v0", "note:2", Some(&a)), "a248cd920e58d41bc6ccca9e108030b1d491239000047fef088122364a32b6f8"),
+        (write_content_hash("delete", "note.v0", "note:1", None), "232b0f96651b28aa8ab7673a6106944a9f6a8d66852b6e21291a23ed084b8b37"),
+    ];
+    for (hash, expected) in cases {
+        assert_eq!(hex(&hash.unwrap()), expected);
+    }
+}
+
+#[test]
+fn the_new_frames_decode_back_equal() {
+    let admitted = CultNetMessage::WriteAdmitted {
+        message_id: "put-1".into(),
+        operation: "put".into(),
+        schema_id: "note.v0".into(),
+        record_key: "note:1".into(),
+    };
+    let bytes = encode_cultnet_message_to_vec(&admitted, CultNetWireContract::CultNetSchemaV0).unwrap();
+    assert_eq!(
+        decode_cultnet_message_from_slice(&bytes, CultNetWireContract::CultNetSchemaV0).unwrap(),
+        admitted
+    );
+    // error.v1 with a nil id round-trips as nil, and the code enum is v0's.
+    let error = CultNetMessage::ErrorV1 {
+        error: "message_invalid: the message could not be read".into(),
+        code: Some(CultNetErrorCode::MessageInvalid),
+        details: None,
+        message_id: None,
+    };
+    let bytes = encode_cultnet_message_to_vec(&error, CultNetWireContract::CultNetSchemaV0).unwrap();
+    assert_eq!(
+        decode_cultnet_message_from_slice(&bytes, CultNetWireContract::CultNetSchemaV0).unwrap(),
+        error
+    );
+}
+
+fn unhex(text: &str) -> Vec<u8> {
+    (0..text.len()).step_by(2).map(|i| u8::from_str_radix(&text[i..i + 2], 16).unwrap()).collect()
+}
+
+/// The spec's wire vectors (write-receipt-vectors.json `wire`): the bytes decode to the vector's fields, not
+/// merely to something that encodes back to itself.
+#[test]
+fn the_spec_wire_vectors_decode_to_their_expected_fields() {
+    let admitted = decode_cultnet_message_from_slice(
+        &unhex("85AD736368656D6156657273696F6EB963756C746E65742E77726974655F61646D69747465642E7630A96D6573736167654964A57075742D31A96F7065726174696F6EA3707574A8736368656D614964A76E6F74652E7630A97265636F72644B6579A66E6F74653A31"),
+        CultNetWireContract::CultNetSchemaV0,
+    )
+    .unwrap();
+    assert_eq!(
+        admitted,
+        CultNetMessage::WriteAdmitted {
+            message_id: "put-1".into(),
+            operation: "put".into(),
+            schema_id: "note.v0".into(),
+            record_key: "note:1".into(),
+        }
+    );
+    let refused = decode_cultnet_message_from_slice(
+        &unhex("86AD736368656D6156657273696F6EB063756C746E65742E6572726F722E7631A56572726F72D93677726974655F6E6F745F617574686F72697A65643A2074686520636174616C6F6720726566757365642074686520646F63756D656E74AB726F7574696E6748696E74C0A4636F6465B477726974655F6E6F745F617574686F72697A6564A764657461696C7384A56669656C64A97265636F72644B6579A576616C7565A66E6F74653A32A461734F66C0A763757272656E74C0A96D6573736167654964A57075742D32"),
+        CultNetWireContract::CultNetSchemaV0,
+    )
+    .unwrap();
+    let CultNetMessage::ErrorV1 { error, code, details, message_id } = refused else {
+        panic!("expected error.v1");
+    };
+    assert_eq!(error, "write_not_authorized: the catalog refused the document");
+    assert_eq!(code, Some(CultNetErrorCode::WriteNotAuthorized));
+    assert_eq!(message_id.as_deref(), Some("put-2"));
+    let details = details.unwrap();
+    assert_eq!(details.field.as_deref(), Some("recordKey"));
+    assert_eq!(details.value.as_deref(), Some("note:2"));
+    assert_eq!((details.as_of, details.current), (None, None));
+}
+
+/// Spec vector `error_v1_limit_reached`: the bytes the server must send, and what they decode to.
+#[test]
+fn error_v1_limit_reached_is_the_spec_vector() {
+    let vector = "86AD736368656D6156657273696F6EB063756C746E65742E6572726F722E7631A56572726F72D93B6C696D69745F726561636865643A207468652073657373696F6E27732072656D656D62657265642D7772697465206C696D69742069732066756C6CAB726F7574696E6748696E74C0A4636F6465AD6C696D69745F72656163686564A764657461696C7384A56669656C64C0A576616C7565C0A461734F66C0A763757272656E74C0A96D6573736167654964A87075742D31303235";
+    let message = CultNetMessage::ErrorV1 {
+        error: "limit_reached: the session's remembered-write limit is full".into(),
+        code: Some(CultNetErrorCode::LimitReached),
+        details: Some(CultNetErrorDetails::default()),
+        message_id: Some("put-1025".into()),
+    };
+    let bytes = encode_cultnet_message_to_vec(&message, CultNetWireContract::CultNetSchemaV0).unwrap();
+    assert_eq!(bytes, unhex(vector), "encoded bytes must equal the spec vector");
+    let CultNetMessage::ErrorV1 { error, code, details, message_id } =
+        decode_cultnet_message_from_slice(&unhex(vector), CultNetWireContract::CultNetSchemaV0).unwrap()
+    else {
+        panic!("expected error.v1");
+    };
+    assert_eq!(error, "limit_reached: the session's remembered-write limit is full");
+    assert_eq!(code, Some(CultNetErrorCode::LimitReached));
+    assert_eq!(message_id.as_deref(), Some("put-1025"));
+    assert_eq!(details, Some(CultNetErrorDetails::default()));
+}
+
+/// Spec vectors `write_admitted_put` and `write_admitted_delete`: the encoder emits the spec's field order.
+#[test]
+fn write_admitted_encodes_to_the_spec_vector_bytes() {
+    let cases = [
+        ("put-1", "put", "85AD736368656D6156657273696F6EB963756C746E65742E77726974655F61646D69747465642E7630A96D6573736167654964A57075742D31A96F7065726174696F6EA3707574A8736368656D614964A76E6F74652E7630A97265636F72644B6579A66E6F74653A31"),
+        ("del-1", "delete", "85AD736368656D6156657273696F6EB963756C746E65742E77726974655F61646D69747465642E7630A96D6573736167654964A564656C2D31A96F7065726174696F6EA664656C657465A8736368656D614964A76E6F74652E7630A97265636F72644B6579A66E6F74653A31"),
+    ];
+    for (id, operation, vector) in cases {
+        let message = CultNetMessage::WriteAdmitted {
+            message_id: id.into(),
+            operation: operation.into(),
+            schema_id: "note.v0".into(),
+            record_key: "note:1".into(),
+        };
+        let bytes = encode_cultnet_message_to_vec(&message, CultNetWireContract::CultNetSchemaV0).unwrap();
+        assert_eq!(bytes, unhex(vector));
+    }
+}
+
+/// `limit_reached` is in the error.v1 enum only: a v0 error neither encodes nor decodes it.
+#[test]
+fn error_v0_refuses_the_v1_only_limit_reached_code() {
+    let v0 = CultNetMessage::Error {
+        error: "x".into(),
+        code: Some(CultNetErrorCode::LimitReached),
+        details: None,
+    };
+    assert!(encode_cultnet_message_to_vec(&v0, CultNetWireContract::CultNetSchemaV0).is_err());
+    let v1 = CultNetMessage::ErrorV1 {
+        error: "x".into(),
+        code: Some(CultNetErrorCode::LimitReached),
+        details: None,
+        message_id: None,
+    };
+    let v1_bytes = encode_cultnet_message_to_vec(&v1, CultNetWireContract::CultNetSchemaV0).unwrap();
+    let at = v1_bytes.windows(16).position(|w| w == b"cultnet.error.v1").unwrap();
+    let mut as_v0 = v1_bytes.clone();
+    as_v0[at + 15] = b'0';
+    assert!(decode_cultnet_message_from_slice(&as_v0, CultNetWireContract::CultNetSchemaV0).is_err());
+}

packages/cultnet-ts/CHANGELOG.md

@@ -7,6 +7,8 @@ All notable changes to `@gamecult/cultnet-ts` are recorded here, following
 
 ### Added
 
+- `WriteTracker`: a write sent after `sessionEnd` settles unconfirmed `session_ended` when it is sent (it stayed unanswered forever). The replay runner now fails on an event key outside `scenarios.semantics` and on a vector count that differs from the file's `counts`; seven tracker vectors are new. A blank text in a raw frame is Unicode White_Space, not `String.prototype.trim()`.
+- Write receipt, client side (`contracts/cultnet/interop/write-receipt.md`): `cultnet.write_admitted.v0` and `cultnet.error.v1` (v0 plus `messageId`; its closed code set adds `limit_reached`, `CULTNET_ERROR_V1_CODES`) parse and encode, and `CULTNET_WRITE_RECEIPT_MESSAGE_VERSIONS` / `helloAdvertisesWriteReceipts` name the hello capability. `cultnet.error.v0` and its code set are unchanged. `WriteTracker` settles each write as admitted, refused or unconfirmed (windows `RECEIPT_RESULT_WINDOW_MS` 5000 and `LEGACY_RESULT_WINDOW_MS` 500, counted from the send; late answers recorded as `admitted_late` / `refused_late`), and `tools/replay-write-receipt-vectors.mjs` replays the vectors against it (see README, "Write receipt replay runner"). The interop schemas are read from `contracts/cultnet/interop/`.
 - `message_invalid` joins the closed `cultnet.error.v0` code set, with `cultNetMessageInvalidError(field, reason)` (`details.field` names the request field at fault), byte-identical to the C# `ForMessageInvalid`.
 - `cultNetWriteNotAuthorizedError(recordKey, reason?)`: the typed `write_not_authorized` refusal (code and `details.recordKey`), byte-identical to the C# `ForRemoteWriteRefused` vector in `error-vectors.json`. `CultNetDocumentRegistry.canonicalSchemaId(schemaId)` resolves the id a put or delete writes under, for a server's write authority.
 - `cultNetTextError(error)`: the text-only `cultnet.error.v0` refusal, with `routingHint`, `code` and `details` null. The legacy-union error decode uses it, so there is one place that spells the null members.
@@ -16,6 +18,7 @@ All notable changes to `@gamecult/cultnet-ts` are recorded here, following
 
 ### Breaking
 
+- The Idunn runtime presence publisher is send-only (`sendPresenceDocument`): it returns `"sent"` once Odin's transport has acknowledged the put and no longer waits up to 500 ms for a success reply, which was never admission. It rejects `IdunnPresenceRefusedError` for a `cultnet.error.v0`, or a `cultnet.error.v1` naming the put or nothing, that arrives by the ack; a refusal after the ack is not awaited, and no other frame, one carrying the put's id included, counts as success.
 - The package is renamed `cultnet-ts` to `@gamecult/cultnet-ts` (the repo already scopes `@gamecult/cultcache-ts`), so the unscoped name cannot be claimed by someone else. Import from `@gamecult/cultnet-ts` and its subpaths; the API is unchanged.
 - `CultNetErrorMessage` carries `routingHint`, `code` and `details` (null when absent), as the reference writes them and `cultnet.error.schema.json` requires; the interface previously dropped them. New `CultNetErrorCode`, `CultNetErrorDetails` and `CultNetShardRoutingHint` types.
 

packages/cultnet-ts/README.md

@@ -289,6 +289,33 @@ maps them back to the exact C# union payload shape at the wire boundary.
   serve and dial commands also exercise schema-v0 over the shared RUDP socket
   transport and advertise both transport profiles.
 
+## Write receipt replay runner
+
+`WriteTracker` is the client half of `contracts/cultnet/interop/write-receipt.md`: a pure state machine on an abstract
+clock that owns one decision, how each sent write settles. `tools/replay-write-receipt-vectors.mjs` replays
+`write-receipt-vectors.json` against it (build first, then `node tools/replay-write-receipt-vectors.mjs`): it prints
+`PASS`/`FAIL` per case and exits nonzero on any failure. Rust and C# port the same runner by implementing this interface
+and replaying the same file.
+
+Tracker interface (times are integer milliseconds on the vector's clock; the constructor takes the window):
+
+| Call | Meaning |
+| --- | --- |
+| `new WriteTracker({ windowMs, onSettle })` | `windowMs` = 5000 when the server's hello lists both `cultnet.write_admitted.v0` and `cultnet.error.v1`, else 500. `onSettle(id, settlement)` fires once per write. |
+| `send(id, atMs)` | A write with that `messageId` was sent. Its window runs from here, not from any transport ack. |
+| `frame(message, atMs)` | A decoded frame arrived. `write_admitted` and `error.v1` settle the write they name; `error.v0`, or `error.v1` with nil `messageId`, refuses a write only when exactly one is unanswered; an id not in flight settles nothing. |
+| `tick(atMs)` | Advance the clock. Every unanswered write with `atMs - sentAt >= windowMs` settles `unconfirmed(window_elapsed)`. `send`, `frame` and `sessionEnd` tick first. |
+| `sessionEnd(atMs)` | Every unanswered write settles `unconfirmed(session_ended)`. |
+| `state(id)` | `pending`, or the settlement plus `recorded`: `admitted_late` / `refused_late`, set by the first answer that arrives after `unconfirmed`. A settlement never changes. |
+
+Runner, per case in `scenarios.cases` (the transport ack is not an input: delivery is not an answer):
+
+1. The fake server states its capability the only way a real one does, in a hello (`server: "receipt"` lists both frames, `"legacy"` lists none); the window comes from that hello and must equal `constants[case.window]`.
+2. Events run in `atMs` order: `send` -> `send(id)`, `frame` -> encode the frame to MessagePack, decode and validate it as the client would, then `frame(message)`, `tick` -> `tick`, `sessionEnd` -> `sessionEnd`, `transportAck` -> nothing.
+3. For each id in `expect`, the settlement given to the caller has the expected `outcome` (and `code` or `reason` when given), `state(id).recorded` equals the expected `recorded` (absent when absent), and nothing settled twice or outside `expect`.
+
+The runner also decodes each `wire[].messagePackHex` and compares the fields and the re-encoded bytes to the vector, and requires every `schemaInvalid[]` frame to be refused by the decoder. `dedupe.cases` and `contentHash` are server vectors and not replayed here.
+
 ## Development
 
 ```bash

packages/cultnet-ts/src/contracts.ts

@@ -9,6 +9,8 @@ import registerSchema from "../contracts/cultnet/cultnet.register.schema.json";
 import verifySchema from "../contracts/cultnet/cultnet.verify.schema.json";
 import loginSuccessSchema from "../contracts/cultnet/cultnet.login-success.schema.json";
 import errorSchema from "../contracts/cultnet/cultnet.error.schema.json";
+import errorV1Schema from "../contracts/cultnet/interop/cultnet.error.v1.schema.json";
+import writeAdmittedSchema from "../contracts/cultnet/interop/cultnet.write-admitted.schema.json";
 import sampleChangeNameSchema from "../contracts/cultnet/cultnet.sample-change-name.schema.json";
 import sampleChatSchema from "../contracts/cultnet/cultnet.sample-chat.schema.json";
 import documentPutSchema from "../contracts/cultnet/cultnet.document-put.schema.json";
@@ -62,6 +64,8 @@ export type CultNetSchemaVersion =
   | "cultnet.verify.v0"
   | "cultnet.login_success.v0"
   | "cultnet.error.v0"
+  | "cultnet.error.v1"
+  | "cultnet.write_admitted.v0"
   | "cultnet.sample.change_name.v0"
   | "cultnet.sample.chat.v0"
   | "cultnet.document_put.v0"
@@ -201,6 +205,11 @@ export const CULTNET_ERROR_CODES = [
 
 export type CultNetErrorCode = (typeof CULTNET_ERROR_CODES)[number];
 
+/** The closed refusal-code set of cultnet.error.v1 (contracts/cultnet/interop/cultnet.error.v1.schema.json): v0's codes plus `limit_reached`. */
+export const CULTNET_ERROR_V1_CODES = [...CULTNET_ERROR_CODES, "limit_reached"] as const;
+
+export type CultNetErrorV1Code = (typeof CULTNET_ERROR_V1_CODES)[number];
+
 /** A refusal that carries text only: `routingHint`, `code` and `details` are written as null, as the reference writes an absent member. */
 export function cultNetTextError(error: string): CultNetErrorMessage {
   return { schemaVersion: "cultnet.error.v0", error, routingHint: null, code: null, details: null };
@@ -255,6 +264,34 @@ export interface CultNetErrorMessage {
   details: CultNetErrorDetails | null;
 }
 
+/**
+ * cultnet.error.v0 plus the `messageId` of the request it answers (nil when no id could be read). Sent only to a
+ * connection whose hello listed both receipt frames (contracts/cultnet/interop/write-receipt.md).
+ */
+export interface CultNetErrorV1Message extends Omit<CultNetErrorMessage, "schemaVersion" | "code"> {
+  schemaVersion: "cultnet.error.v1";
+  code: CultNetErrorV1Code | null;
+  messageId: string | null;
+}
+
+/** The receipt for one admitted put or delete: every key written, the write's `messageId` echoed byte for byte. */
+export interface CultNetWriteAdmittedMessage {
+  schemaVersion: "cultnet.write_admitted.v0";
+  messageId: string;
+  operation: "put" | "delete";
+  schemaId: string;
+  recordKey: string;
+}
+
+/** The two frames a receipt-capable hello lists in `supportedMessageVersions`; a peer lists both or neither. */
+export const CULTNET_WRITE_RECEIPT_MESSAGE_VERSIONS = ["cultnet.write_admitted.v0", "cultnet.error.v1"] as const;
+
+/** True when a hello lists both receipt frames: the only thing that makes a connection receipt-capable. */
+export function helloAdvertisesWriteReceipts(hello: Pick<CultNetHelloMessage, "supportedMessageVersions">): boolean {
+  const listed = hello.supportedMessageVersions ?? [];
+  return CULTNET_WRITE_RECEIPT_MESSAGE_VERSIONS.every((version) => listed.includes(version));
+}
+
 export interface CultNetSampleChangeNameMessage {
   schemaVersion: "cultnet.sample.change_name.v0";
   name: string;
@@ -770,6 +807,8 @@ export interface GhostlightAgentStateDocument {
 
 export type CultNetMessage =
   | CultNetHelloMessage
+  | CultNetErrorV1Message
+  | CultNetWriteAdmittedMessage
   | CultNetLoginMessage
   | CultNetRegisterMessage
   | CultNetVerifyMessage
@@ -812,6 +851,8 @@ const CULTNET_MESSAGE_SCHEMAS = [
   verifySchema,
   loginSuccessSchema,
   errorSchema,
+  errorV1Schema,
+  writeAdmittedSchema,
   sampleChangeNameSchema,
   sampleChatSchema,
   documentPutSchema,
@@ -1381,7 +1422,7 @@ function validateBinaryMessageRoot(
   if (candidate.schemaVersion !== schemaVersion) {
     throw new Error(`Validation failed for ${schemaVersion}: /schemaVersion: must equal ${schemaVersion}`);
   }
-  if (typeof candidate.messageId !== "string" || candidate.messageId.trim().length === 0) {
+  if (typeof candidate.messageId !== "string" || isBlank(candidate.messageId)) {
     throw new Error(`Validation failed for ${schemaVersion}: /messageId: must be a non-empty string`);
   }
 
@@ -1419,8 +1460,13 @@ function validateRawDocumentRecord(
   requireOptionalStringArray(candidate.tags, `${instancePath}/tags`);
 }
 
+/** Blank is empty or only Unicode White_Space (write-receipt.md, rule 5), not `trim()`: JS trims U+FEFF and keeps U+0085. */
+function isBlank(value: string): boolean {
+  return /^\p{White_Space}*$/u.test(value);
+}
+
 function requireNonEmptyString(input: unknown, instancePath: string): void {
-  if (typeof input !== "string" || input.trim().length === 0) {
+  if (typeof input !== "string" || isBlank(input)) {
     throw new Error(`Validation failed for raw CultNet document record: ${instancePath}: must be a non-empty string`);
   }
 }
@@ -1436,7 +1482,7 @@ function requireOptionalStringArray(input: unknown, instancePath: string): void
   if (typeof input === "undefined" || input === null) {
     return;
   }
-  if (!Array.isArray(input) || input.some((item) => typeof item !== "string" || item.trim().length === 0)) {
+  if (!Array.isArray(input) || input.some((item) => typeof item !== "string" || isBlank(item))) {
     throw new Error(`Validation failed for raw CultNet document record: ${instancePath}: must be an array of non-empty strings`);
   }
 }
@@ -1535,6 +1581,8 @@ export const cultNetSchemas = {
   verifySchema,
   loginSuccessSchema,
   errorSchema,
+  errorV1Schema,
+  writeAdmittedSchema,
   sampleChangeNameSchema,
   sampleChatSchema,
   documentPutSchema,

packages/cultnet-ts/src/idunn-odin-presence-publisher.ts

@@ -52,7 +52,7 @@ export function createIdunnRuntimePresencePublisher(
   const publish = async (detail: string) => {
     const signed = signer.sign(detail);
     messageSequence += 1;
-    await publishDocument(endpoint, connectionId, {
+    await sendPresenceDocument(endpoint, connectionId, {
       schemaVersion: "cultnet.document_put_raw.v0",
       messageId: `runtime-presence:${signer.authority.expected.target}:${signer.runtimeInstanceId}:${messageSequence}`,
       document: signed.document,
@@ -86,11 +86,19 @@ export function createIdunnRuntimePresencePublisher(
   };
 }
 
-async function publishDocument(
+/**
+ * Sends one presence put and says only that it was sent (write-receipt.md: the explicit send-only mode). Odin does not
+ * answer a write with a receipt yet, so no frame, whatever id it carries, is admission; this never claims it. It returns
+ * once the transport has acknowledged the put, rejects `IdunnPresenceRefusedError` if a refusal arrives by then, and
+ * rejects if the put is never acknowledged.
+ *
+ * @internal exported for tests
+ */
+export async function sendPresenceDocument(
   endpoint: { host: string; port: number },
   connectionId: number,
   message: Record<string, unknown>,
-): Promise<void> {
+): Promise<"sent"> {
   const socket = dgram.createSocket(endpoint.host.includes(":") ? "udp6" : "udp4");
   await new Promise<void>((resolve, reject) => {
     socket.once("error", reject);
@@ -107,26 +115,34 @@ async function publishDocument(
     const wirePayload = encode(encodeCultNetMessageForWire(message as never, "cultnet.schema.v0"));
     const packets = session.sendMany("schema", wirePayload, { reliable: true, ordered: true, nowMs: Date.now() });
     for (const packet of packets) await sendPacket(socket, endpoint, packet);
-    await receiveUntil(
+    // The transport ack is delivery, not admission. A refusal that arrives by then rejects; no other frame means anything.
-      receiver,
+    const onFrame = (frame: { channelId: string; payload: Uint8Array }) => {
-      session,
+      if (frame.channelId !== "schema") return;
-      endpoint,
+      const response = parseCultNetMessage(decode(frame.payload));
-      () => session.outstandingReliablePacketCount === 0,
+      if (response.schemaVersion === "cultnet.error.v0") throw new IdunnPresenceRefusedError(response);
-      2000,
+      // An error.v1 refuses this put only when it names it (or names nothing).
-      (frame) => {
+      if (response.schemaVersion === "cultnet.error.v1" && (response.messageId === null || response.messageId === message.messageId)) {
-        if (frame.channelId !== "schema") return;
+        throw new IdunnPresenceRefusedError(response);
-        const response = parseCultNetMessage(decode(frame.payload));
+      }
-        if (response.schemaVersion === "cultnet.error.v0") {
+    };
-          throw new Error(`Odin rejected runtime presence: ${response.error}`);
+    await receiveUntil(receiver, session, endpoint, () => session.outstandingReliablePacketCount === 0, 2000, onFrame);
-        }
+    return "sent";
-      },
-    );
   } finally {
     receiver.close();
     socket.close();
   }
 }
 
+/** Odin refused the presence put: the typed `cultnet.error.v0` it answered with. */
+export class IdunnPresenceRefusedError extends Error {
+  readonly code: string | undefined;
+  constructor(readonly response: { error: string; code?: string | null }) {
+    super(`Odin rejected runtime presence: ${response.error}`);
+    this.name = "IdunnPresenceRefusedError";
+    this.code = response.code ?? undefined;
+  }
+}
+
 type PacketReceiver = {
   socket: dgram.Socket;
   next(timeoutMs: number): Promise<CultNetRudpPacket>;

packages/cultnet-ts/src/index.ts

@@ -17,6 +17,12 @@ export {
   type CultNetRawDocumentRecord,
   type CultNetRawPayloadEncoding,
   CULTNET_ERROR_CODES,
+  CULTNET_ERROR_V1_CODES,
+  CULTNET_WRITE_RECEIPT_MESSAGE_VERSIONS,
+  helloAdvertisesWriteReceipts,
+  type CultNetErrorV1Code,
+  type CultNetErrorV1Message,
+  type CultNetWriteAdmittedMessage,
   cultNetTextError,
   cultNetMessageInvalidError,
   cultNetWriteNotAuthorizedError,
@@ -249,3 +255,15 @@ export {
   type IdunnRuntimePresencePublisher,
   type IdunnRuntimePresencePublisherOptions,
 } from "./idunn-odin-presence-publisher";
+
+export {
+  LEGACY_RESULT_WINDOW_MS,
+  RECEIPT_RESULT_WINDOW_MS,
+  WriteTracker,
+  resultWindowMs,
+  type WriteRecorded,
+  type WriteSettlement,
+  type WriteState,
+  type WriteTrackerOptions,
+  type WriteUnconfirmedReason,
+} from "./write-tracker";

packages/cultnet-ts/src/peer.ts

@@ -95,6 +95,10 @@ export class CultNetPeer extends EventEmitter {
     return this.#transport?.profile;
   }
 
+  /**
+   * Fire-and-forget: an ack or a return is not admission; read the result frame (a write is refused with
+   * `cultnet.error.v0`, `write_not_authorized` or `message_invalid`, as a `message` event).
+   */
   send(message: CultNetMessage): void {
     const wireValue = encodeCultNetMessageForWire(message, this.#wireContract);
     const payload = encode(wireValue);
@@ -106,6 +110,7 @@ export class CultNetPeer extends EventEmitter {
     this.#stream?.write(encodeFrame(payload));
   }
 
+  /** Resolves when the transport has acknowledged what was sent. An ack is not admission; read the result frame. */
   async flush(timeoutMs?: number): Promise<void> {
     await this.#transport?.flush?.(timeoutMs);
   }

packages/cultnet-ts/src/write-tracker.ts

@@ -0,0 +1,150 @@
+// The client half of the write receipt (contracts/cultnet/interop/write-receipt.md, "Client rules"): a pure state
+// machine with an abstract clock. It owns exactly one decision, how each sent write settles. Transport, timers and
+// frame decoding belong to the caller; the replay runner (tools/replay-write-receipt-vectors.mjs) drives this same
+// interface from write-receipt-vectors.json.
+
+import type { CultNetErrorMessage, CultNetErrorV1Message, CultNetMessage } from "./contracts";
+
+/** The result window against a server whose hello lists both receipt frames. */
+export const RECEIPT_RESULT_WINDOW_MS = 5000;
+/** The result window against a server whose hello does not list them (or that sent none). */
+export const LEGACY_RESULT_WINDOW_MS = 500;
+
+export function resultWindowMs(serverAdvertisesReceipts: boolean): number {
+  return serverAdvertisesReceipts ? RECEIPT_RESULT_WINDOW_MS : LEGACY_RESULT_WINDOW_MS;
+}
+
+/**
+ * Why nothing settled a write: its window ran out, the session ended first, or the client's own send of it failed (it may or
+ * may not have left the machine, and is never a refusal).
+ */
+export type WriteUnconfirmedReason = "window_elapsed" | "session_ended" | "local_send_failed";
+/** What a late answer is recorded as on a write that already settled unconfirmed. */
+export type WriteRecorded = "admitted_late" | "refused_late";
+
+/** What the caller was told. Settled once; never changed by a later frame. */
+export type WriteSettlement =
+  | { outcome: "admitted" }
+  | { outcome: "refused"; code: string | null; error: string; response: CultNetErrorMessage | CultNetErrorV1Message }
+  | { outcome: "unconfirmed"; reason: WriteUnconfirmedReason };
+
+/** A write's state: unanswered, or its settlement plus (after unconfirmed only) the late answer. */
+export type WriteState =
+  | { outcome: "pending"; recorded?: undefined }
+  | (WriteSettlement & { recorded?: WriteRecorded });
+
+export interface WriteTrackerOptions {
+  /** The result window, from the send. Use `resultWindowMs(serverAdvertisesReceipts)`. */
+  windowMs: number;
+  /** Called once per write, at the moment it settles. */
+  onSettle?: (messageId: string, settlement: WriteSettlement) => void;
+}
+
+interface Entry {
+  sentAtMs: number;
+  state: WriteState;
+}
+
+export class WriteTracker {
+  readonly #windowMs: number;
+  readonly #onSettle?: (messageId: string, settlement: WriteSettlement) => void;
+  readonly #writes = new Map<string, Entry>();
+  #ended = false;
+
+  constructor(options: WriteTrackerOptions) {
+    this.#windowMs = options.windowMs;
+    this.#onSettle = options.onSettle;
+  }
+
+  /** Registers a write sent at `atMs`. A messageId is minted once per session: re-sending a known id is the same write. */
+  send(messageId: string, atMs: number): void {
+    this.tick(atMs);
+    if (this.#writes.has(messageId)) return;
+    const entry: Entry = { sentAtMs: atMs, state: { outcome: "pending" } };
+    this.#writes.set(messageId, entry);
+    // On a session that already ended nothing can answer this write.
+    if (this.#ended) this.#settle(messageId, entry, { outcome: "unconfirmed", reason: "session_ended" });
+  }
+
+  /** Feeds one decoded frame received at `atMs`. Frames that are not answers to a write are ignored. */
+  frame(message: CultNetMessage, atMs: number): void {
+    this.tick(atMs);
+    switch (message.schemaVersion) {
+      case "cultnet.write_admitted.v0":
+        this.#answer(message.messageId, { outcome: "admitted" }, "admitted_late");
+        return;
+      case "cultnet.error.v1":
+        if (message.messageId !== null) {
+          this.#answer(message.messageId, refusalOf(message), "refused_late");
+          return;
+        }
+        break;
+      case "cultnet.error.v0":
+        break;
+      default:
+        return;
+    }
+    // An error that names no write is attributable only when exactly one write is unanswered.
+    const unanswered = [...this.#writes].filter(([, entry]) => entry.state.outcome === "pending");
+    if (unanswered.length === 1) this.#settle(unanswered[0][0], unanswered[0][1], refusalOf(message));
+  }
+
+  /** Advances the clock: every unanswered write whose window, counted from its send, has run settles unconfirmed. */
+  tick(atMs: number): void {
+    for (const [messageId, entry] of this.#writes) {
+      if (entry.state.outcome === "pending" && atMs - entry.sentAtMs >= this.#windowMs) {
+        this.#settle(messageId, entry, { outcome: "unconfirmed", reason: "window_elapsed" });
+      }
+    }
+  }
+
+  /** The session ended: every unanswered write settles unconfirmed, and so does any write sent afterwards. */
+  sessionEnd(atMs: number): void {
+    this.tick(atMs);
+    this.#ended = true;
+    for (const [messageId, entry] of this.#writes) {
+      if (entry.state.outcome === "pending") this.#settle(messageId, entry, { outcome: "unconfirmed", reason: "session_ended" });
+    }
+  }
+
+  /** This client's own send of `messageId` failed: that write settles unconfirmed; the others are untouched. */
+  sendFailed(messageId: string, atMs: number): void {
+    const entry = this.#writes.get(messageId);
+    if (entry?.state.outcome === "pending") this.#settle(messageId, entry, { outcome: "unconfirmed", reason: "local_send_failed" });
+    this.tick(atMs);
+  }
+
+  state(messageId: string): WriteState | undefined {
+    return this.#writes.get(messageId)?.state;
+  }
+
+  /** Milliseconds from `atMs` until the next unanswered write's window runs out; undefined when none is unanswered. */
+  nextDeadlineMs(atMs: number): number | undefined {
+    let next: number | undefined;
+    for (const entry of this.#writes.values()) {
+      if (entry.state.outcome !== "pending") continue;
+      const remaining = Math.max(0, entry.sentAtMs + this.#windowMs - atMs);
+      if (next === undefined || remaining < next) next = remaining;
+    }
+    return next;
+  }
+
+  #answer(messageId: string, settlement: WriteSettlement, late: WriteRecorded): void {
+    const entry = this.#writes.get(messageId);
+    if (!entry) return; // names a write that is not in flight: settles nothing
+    if (entry.state.outcome === "pending") {
+      this.#settle(messageId, entry, settlement);
+    } else if (entry.state.outcome === "unconfirmed" && entry.state.recorded === undefined) {
+      entry.state = { ...entry.state, recorded: late };
+    }
+  }
+
+  #settle(messageId: string, entry: Entry, settlement: WriteSettlement): void {
+    entry.state = settlement;
+    this.#onSettle?.(messageId, settlement);
+  }
+}
+
+function refusalOf(message: CultNetErrorMessage | CultNetErrorV1Message): WriteSettlement {
+  return { outcome: "refused", code: message.code, error: message.error, response: message };
+}

packages/cultnet-ts/test/idunn-odin-presence-send-only.test.ts

@@ -0,0 +1,94 @@
+// The presence publisher is send-only (write-receipt.md): Odin answers no write with a receipt yet, so no frame, whatever
+// id it carries, is admission. Each test serves it a fake Odin that acknowledges the put and answers as scripted.
+import assert from "node:assert/strict";
+import { createSocket, type Socket } from "node:dgram";
+import test from "node:test";
+import { encode, decode } from "@msgpack/msgpack";
+
+import { encodeCultNetMessageForWire, type CultNetMessage } from "../src/contracts";
+import { IdunnPresenceRefusedError, sendPresenceDocument } from "../src/idunn-odin-presence-publisher";
+import { CultNetRudpSession, decodeRudpPacket, encodeRudpPacket } from "../src/rudp";
+
+interface Script {
+  answer: "silence" | "echo" | "admitted" | "refuse-v0" | "refuse-v1-other" | "refuse-v1-same" | "refuse-v1-none";
+  /** Acknowledge the put? Default true. */
+  ack?: boolean;
+}
+
+async function fakeOdin(connectionId: number, script: Script) {
+  const socket: Socket = createSocket("udp4");
+  await new Promise<void>((resolve) => socket.bind(0, "127.0.0.1", resolve));
+  const session = new CultNetRudpSession({ connectionId, resendDelayMs: 50 });
+  const send = (packet: Parameters<typeof encodeRudpPacket>[0], port: number, address: string) => {
+    try { socket.send(encodeRudpPacket(packet), port, address); } catch { /* closed */ }
+  };
+  const say = (message: CultNetMessage, port: number, address: string) => {
+    const packets = session.sendMany("schema", encode(encodeCultNetMessageForWire(message, "cultnet.schema.v0")), { reliable: true, ordered: true, nowMs: Date.now() });
+    packets.forEach((p) => send(p, port, address));
+  };
+  socket.on("message", (wire, remote) => {
+    const packet = decodeRudpPacket(wire);
+    const now = Date.now();
+    if (packet.packetType === "connect") {
+      send(session.acceptConnect(packet, now), remote.port, remote.address);
+      return;
+    }
+    const result = session.receive(packet, now);
+    if (result.reply) send(result.reply, remote.port, remote.address);
+    for (const frame of result.delivered) {
+      if (frame.channelId !== "schema") continue;
+      const put = decode(frame.payload) as { messageId: string; document: unknown };
+      if (script.answer === "echo") say({ schemaVersion: "cultnet.document_put_raw.v0", messageId: put.messageId, document: put.document } as unknown as CultNetMessage, remote.port, remote.address);
+      else if (script.answer === "admitted") say({ schemaVersion: "cultnet.write_admitted.v0", messageId: put.messageId, operation: "put", schemaId: "s", recordKey: "k" }, remote.port, remote.address);
+      else if (script.answer === "refuse-v0") say({ schemaVersion: "cultnet.error.v0", error: "no", routingHint: null, code: "write_not_authorized", details: null }, remote.port, remote.address);
+      else if (script.answer === "refuse-v1-other") say({ schemaVersion: "cultnet.error.v1", error: "no", routingHint: null, code: "write_not_authorized", details: null, messageId: "someone-else" }, remote.port, remote.address);
+      else if (script.answer === "refuse-v1-same") say({ schemaVersion: "cultnet.error.v1", error: "no", routingHint: null, code: "write_not_authorized", details: null, messageId: put.messageId }, remote.port, remote.address);
+      else if (script.answer === "refuse-v1-none") say({ schemaVersion: "cultnet.error.v1", error: "no", routingHint: null, code: "write_not_authorized", details: null, messageId: null }, remote.port, remote.address);
+    }
+    if (packet.reliable && script.ack !== false) send(session.createAckForReceived(packet.sequence), remote.port, remote.address);
+  });
+  return { port: socket.address().port, close: () => socket.close() };
+}
+
+let nextConnection = 0x0d1d1000;
+const put = (id: string) => ({ schemaVersion: "cultnet.document_put_raw.v0", messageId: id, document: { schemaId: "s", recordKey: "k", storedAt: "t", payloadEncoding: "messagepack", payload: new Uint8Array([1]) } });
+const sendTo = (server: { port: number }, id: string, connectionId: number) =>
+  sendPresenceDocument({ host: "127.0.0.1", port: server.port }, connectionId, put(id));
+
+for (const answer of ["silence", "echo", "admitted", "refuse-v1-other"] as const) {
+  test(`a ${answer} Odin yields sent, never admitted: no frame carrying the put's id is success`, async () => {
+    const connectionId = nextConnection++;
+    const server = await fakeOdin(connectionId, { answer });
+    try {
+      const outcome = await sendTo(server, "presence-1", connectionId);
+      assert.equal(outcome, "sent");
+      assert.notEqual(outcome as string, "admitted");
+    } finally { server.close(); }
+  });
+}
+
+test("a refusal that arrives by the transport ack rejects the put", async () => {
+  const connectionId = nextConnection++;
+  const server = await fakeOdin(connectionId, { answer: "refuse-v0" });
+  try {
+    await assert.rejects(sendTo(server, "presence-1", connectionId), IdunnPresenceRefusedError);
+  } finally { server.close(); }
+});
+
+for (const answer of ["refuse-v1-same", "refuse-v1-none"] as const) {
+  test(`an error.v1 refusal that ${answer === "refuse-v1-same" ? "names this put" : "names no put"} rejects the put`, async () => {
+    const connectionId = nextConnection++;
+    const server = await fakeOdin(connectionId, { answer });
+    try {
+      await assert.rejects(sendTo(server, "presence-1", connectionId), IdunnPresenceRefusedError);
+    } finally { server.close(); }
+  });
+}
+
+test("a put the transport never acknowledges is an error, not sent", async () => {
+  const connectionId = nextConnection++;
+  const server = await fakeOdin(connectionId, { answer: "silence", ack: false });
+  try {
+    await assert.rejects(sendTo(server, "presence-1", connectionId), /Timed out/);
+  } finally { server.close(); }
+});

packages/cultnet-ts/test/idunn-runtime-authority.test.ts

@@ -276,9 +276,14 @@ async function startOdinPeer(context: TestContext, endpoint: string) {
     peer.once("error", reject);
     peer.bind(port, "127.0.0.1", resolve);
   });
-  context.after(() => peer.close());
+  // The second packet of a split delivery is a timer; the test's end cancels it rather than racing the closed socket.
+  const timers = new Set<NodeJS.Timeout>();
+  const later = (send: () => void) => { timers.add(setTimeout(send, 120)); };
+  context.after(() => { for (const timer of timers) clearTimeout(timer); peer.close(); });
   const state = {
     reject: false,
+    // How a refusal and the ack of the put reach the publisher: in one packet, or the ack first, or the refusal first.
+    order: "piggyback" as "piggyback" | "ack-then-refusal" | "refusal-then-ack",
     received: [] as Array<{ schemaVersion?: string; document: { payload: DocumentPayload } }>,
     responseAck: undefined as number | undefined,
     failure: undefined as Error | undefined,
@@ -305,7 +310,15 @@ async function startOdinPeer(context: TestContext, endpoint: string) {
       });
       assert.ok(response);
       state.responseAck = response.ack;
-      peer.send(encodeRudpPacket(response), remote.port, remote.address);
+      if (state.reject && state.order === "ack-then-refusal") {
+        peer.send(encodeRudpPacket(serverSession.createAckForReceived(packet.sequence)), remote.port, remote.address);
+        later(() => peer.send(encodeRudpPacket(response), remote.port, remote.address));
+      } else if (state.reject && state.order === "refusal-then-ack") {
+        peer.send(encodeRudpPacket({ ...response, ack: 0, ackMask: 0 }), remote.port, remote.address);
+        later(() => peer.send(encodeRudpPacket(serverSession!.createAckForReceived(packet.sequence)), remote.port, remote.address));
+      } else {
+        peer.send(encodeRudpPacket(response), remote.port, remote.address);
+      }
     } catch (error) {
       state.failure = error as Error;
     }
@@ -332,6 +345,28 @@ test("the Odin publisher publishes the signer's document to the endpoint Expecte
   assert.equal(peer.failure, undefined, peer.failure?.message);
 });
 
+test("the Odin publisher rejects a presence whose refusal arrives before the transport ack", async (context) => {
+  const endpoint = expectedFacts("service").odinEndpoint!;
+  const peer = await startOdinPeer(context, endpoint);
+  peer.reject = true;
+  peer.order = "refusal-then-ack";
+  const signer = signerFor(context, "service");
+  signer.reportHealth("active");
+  const publisher = createIdunnRuntimePresencePublisher({ signer, endpoint });
+  await assert.rejects(publisher.publish("denied presence"), /Odin rejected runtime presence: test admission denied/);
+});
+
+test("the Odin publisher is send-only: a refusal that follows the transport ack is not awaited", async (context) => {
+  const endpoint = expectedFacts("service").odinEndpoint!;
+  const peer = await startOdinPeer(context, endpoint);
+  peer.reject = true;
+  peer.order = "ack-then-refusal";
+  const signer = signerFor(context, "service");
+  signer.reportHealth("active");
+  const publisher = createIdunnRuntimePresencePublisher({ signer, endpoint });
+  await publisher.publish("denied presence");
+});
+
 test("the Odin publisher leaves a capability shortfall to the Rust correlation instead of refusing to publish", async (context) => {
   const endpoint = expectedFacts("service").odinEndpoint!;
   const peer = await startOdinPeer(context, endpoint);

packages/cultnet-ts/test/write-receipt.test.ts

@@ -0,0 +1,282 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, readFileSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import {
+  CULTNET_ERROR_CODES,
+  CULTNET_ERROR_V1_CODES,
+  CULTNET_WRITE_RECEIPT_MESSAGE_VERSIONS,
+  LEGACY_RESULT_WINDOW_MS,
+  RECEIPT_RESULT_WINDOW_MS,
+  WriteTracker,
+  cultNetSchemas,
+  helloAdvertisesWriteReceipts,
+  parseCultNetMessage,
+  resultWindowMs,
+  type CultNetErrorV1Message,
+  type CultNetMessage,
+  type CultNetWriteAdmittedMessage,
+  type WriteSettlement,
+} from "../src";
+
+const admitted = (messageId: string): CultNetWriteAdmittedMessage =>
+  ({ schemaVersion: "cultnet.write_admitted.v0", messageId, operation: "put", schemaId: "note.v0", recordKey: "note:1" });
+const refusedV1 = (messageId: string | null, code: CultNetErrorV1Message["code"] = "write_not_authorized"): CultNetErrorV1Message =>
+  ({ schemaVersion: "cultnet.error.v1", error: "no", routingHint: null, code, details: null, messageId });
+const errorV0 = (): CultNetMessage =>
+  ({ schemaVersion: "cultnet.error.v0", error: "no", routingHint: null, code: "write_not_authorized", details: null });
+
+test("error.v1 accepts every code of its closed enum, limit_reached included, and refuses any other", () => {
+  const schemaCodes = ((cultNetSchemas.errorV1Schema.properties.code as { enum: (string | null)[] }).enum).filter((c) => c !== null);
+  assert.deepEqual([...CULTNET_ERROR_V1_CODES].sort(), [...schemaCodes].sort());
+  for (const code of CULTNET_ERROR_V1_CODES) parseCultNetMessage({ ...refusedV1("w1"), code });
+  assert.throws(() => parseCultNetMessage({ ...refusedV1("w1"), code: "invented" }));
+});
+
+test("error.v1 echoes messageId byte for byte, allows nil, and requires the key", () => {
+  assert.equal((parseCultNetMessage(refusedV1("w-é 1")) as CultNetErrorV1Message).messageId, "w-é 1");
+  assert.equal((parseCultNetMessage(refusedV1(null)) as CultNetErrorV1Message).messageId, null);
+  const { messageId: _omitted, ...withoutId } = refusedV1("w1");
+  assert.throws(() => parseCultNetMessage(withoutId));
+  assert.throws(() => parseCultNetMessage(refusedV1("")));
+});
+
+test("error.v0 is unaffected: still closed, no messageId, no limit_reached", () => {
+  assert.deepEqual([...CULTNET_ERROR_CODES].includes("limit_reached" as never), false);
+  assert.throws(() => parseCultNetMessage({ ...errorV0(), code: "limit_reached" }));
+  assert.throws(() => parseCultNetMessage({ ...errorV0(), messageId: "w1" }));
+  assert.equal(parseCultNetMessage(errorV0()).schemaVersion, "cultnet.error.v0");
+});
+
+test("write_admitted needs all five keys, a known operation and no error key", () => {
+  parseCultNetMessage(admitted("w1"));
+  parseCultNetMessage({ ...admitted("w1"), operation: "delete" });
+  assert.throws(() => parseCultNetMessage({ ...admitted("w1"), operation: "upsert" }));
+  assert.throws(() => parseCultNetMessage({ ...admitted("w1"), error: "nope" }));
+  const { recordKey: _omitted, ...short } = admitted("w1");
+  assert.throws(() => parseCultNetMessage(short));
+});
+
+test("a hello is receipt-capable only when it lists both frames", () => {
+  assert.equal(helloAdvertisesWriteReceipts({ supportedMessageVersions: [...CULTNET_WRITE_RECEIPT_MESSAGE_VERSIONS] }), true);
+  assert.equal(helloAdvertisesWriteReceipts({ supportedMessageVersions: ["cultnet.write_admitted.v0"] }), false);
+  assert.equal(helloAdvertisesWriteReceipts({ supportedMessageVersions: ["cultnet.error.v1"] }), false);
+  assert.equal(helloAdvertisesWriteReceipts({}), false);
+  const hello = parseCultNetMessage({ schemaVersion: "cultnet.hello.v0", runtimeId: "r", runtimeKind: "k", supportedMessageVersions: [...CULTNET_WRITE_RECEIPT_MESSAGE_VERSIONS] });
+  assert.equal(hello.schemaVersion, "cultnet.hello.v0");
+});
+
+test("the window is 5000 ms for a receipt-capable server and 500 ms otherwise", () => {
+  assert.equal(resultWindowMs(true), RECEIPT_RESULT_WINDOW_MS);
+  assert.equal(resultWindowMs(false), LEGACY_RESULT_WINDOW_MS);
+  assert.equal(RECEIPT_RESULT_WINDOW_MS, 5000);
+  assert.equal(LEGACY_RESULT_WINDOW_MS, 500);
+});
+
+function tracker(windowMs = 500) {
+  const told: [string, WriteSettlement][] = [];
+  return { told, t: new WriteTracker({ windowMs, onSettle: (id, s) => told.push([id, s]) }) };
+}
+
+test("tracker: the window is inclusive at exactly windowMs and open one ms before", () => {
+  const { t, told } = tracker();
+  t.send("w1", 100);
+  t.tick(599);
+  assert.equal(t.state("w1")?.outcome, "pending");
+  t.tick(600);
+  assert.deepEqual(told, [["w1", { outcome: "unconfirmed", reason: "window_elapsed" }]]);
+});
+
+test("tracker: each write's window runs from its own send", () => {
+  const { t } = tracker();
+  t.send("w1", 0);
+  t.send("w2", 300);
+  t.tick(500);
+  assert.equal(t.state("w1")?.outcome, "unconfirmed");
+  assert.equal(t.state("w2")?.outcome, "pending");
+});
+
+test("tracker: a frame arriving after the window cannot admit the write; it is recorded late", () => {
+  const { t, told } = tracker();
+  t.send("w1", 0);
+  t.frame(admitted("w1"), 500);
+  assert.deepEqual(t.state("w1"), { outcome: "unconfirmed", reason: "window_elapsed", recorded: "admitted_late" });
+  assert.equal(told.length, 1);
+});
+
+test("tracker: a write settles once; later frames neither change it nor flip a late record", () => {
+  const { t, told } = tracker();
+  t.send("w1", 0);
+  t.frame(refusedV1("w1"), 10);
+  t.frame(admitted("w1"), 20);
+  t.frame(refusedV1("w1", "message_invalid"), 30);
+  t.sessionEnd(40);
+  assert.equal(told.length, 1);
+  assert.deepEqual(told[0][1], { outcome: "refused", code: "write_not_authorized", error: "no", response: refusedV1("w1") });
+  t.send("w2", 100);
+  t.tick(600);
+  t.frame(refusedV1("w2"), 700);
+  t.frame(admitted("w2"), 800);
+  assert.equal(t.state("w2")?.outcome === "unconfirmed" && t.state("w2")?.recorded, "refused_late");
+});
+
+test("tracker: an id-less error refuses the single unanswered write only, counting answered writes out", () => {
+  const { t } = tracker();
+  t.send("w1", 0);
+  t.send("w2", 1);
+  t.frame(admitted("w1"), 5);
+  t.frame(refusedV1(null), 6);
+  assert.equal(t.state("w1")?.outcome, "admitted");
+  assert.equal(t.state("w2")?.outcome, "refused");
+});
+
+test("tracker: an id-less error never reaches a write that already ended unconfirmed", () => {
+  const { t } = tracker();
+  t.send("w1", 0);
+  t.tick(500);
+  t.frame(errorV0(), 501);
+  assert.deepEqual(t.state("w1"), { outcome: "unconfirmed", reason: "window_elapsed" });
+});
+
+test("tracker: sessionEnd settles unanswered writes only, and an expired window keeps its own reason", () => {
+  const { t } = tracker();
+  t.send("w1", 0);
+  t.send("w2", 0);
+  t.send("w3", 400);
+  t.frame(admitted("w2"), 10);
+  t.sessionEnd(600);
+  assert.deepEqual(t.state("w1"), { outcome: "unconfirmed", reason: "window_elapsed" });
+  assert.equal(t.state("w2")?.outcome, "admitted");
+  assert.deepEqual(t.state("w3"), { outcome: "unconfirmed", reason: "session_ended" });
+});
+
+test("tracker: re-sending a known id is the same write and does not restart its window", () => {
+  const { t } = tracker();
+  t.send("w1", 0);
+  t.send("w1", 400);
+  t.tick(500);
+  assert.equal(t.state("w1")?.outcome, "unconfirmed");
+});
+
+test("tracker: a send past another write's window settles that write at once", () => {
+  const { t, told } = tracker();
+  t.send("w1", 0);
+  t.send("w2", 600);
+  assert.deepEqual(told, [["w1", { outcome: "unconfirmed", reason: "window_elapsed" }]]);
+});
+
+test("tracker: only receipt and error frames answer; any other frame naming the id settles nothing", () => {
+  const { t } = tracker();
+  t.send("w1", 0);
+  t.frame({ schemaVersion: "cultnet.hello.v0", runtimeId: "r", runtimeKind: "k" }, 1);
+  t.frame({ schemaVersion: "cultnet.document_put_raw.v0", messageId: "w1" } as unknown as CultNetMessage, 2);
+  assert.equal(t.state("w1")?.outcome, "pending");
+});
+
+test("tracker: nextDeadlineMs reports the nearest unanswered window, none when all settled", () => {
+  const { t } = tracker();
+  assert.equal(t.nextDeadlineMs(0), undefined);
+  t.send("w1", 0);
+  t.send("w2", 100);
+  assert.equal(t.nextDeadlineMs(50), 450);
+  assert.equal(t.nextDeadlineMs(900), 0);
+  t.frame(admitted("w1"), 60);
+  assert.equal(t.nextDeadlineMs(150), 450);
+  t.frame(admitted("w2"), 160);
+  assert.equal(t.nextDeadlineMs(170), undefined);
+});
+
+test("the replay runner passes every vector against this runtime", () => {
+  const script = join(__dirname, "..", "..", "tools", "replay-write-receipt-vectors.mjs");
+  const run = spawnSync(process.execPath, [script], { encoding: "utf8" });
+  assert.equal(run.status, 0, run.stdout + run.stderr);
+  assert.match(run.stdout, /^PASS scenario\/receipt_admits$/m);
+  assert.doesNotMatch(run.stdout, /^FAIL/m);
+});
+
+// A runner that skips what it cannot read passes a file it did not replay. It must fail instead.
+test("the replay runner fails on an unknown event key and on a vector count the file does not declare", () => {
+  const script = join(__dirname, "..", "..", "tools", "replay-write-receipt-vectors.mjs");
+  const vectorsPath = join(__dirname, "..", "..", "..", "..", "contracts", "cultnet", "interop", "write-receipt-vectors.json");
+  const dir = mkdtempSync(join(tmpdir(), "receipt-vectors-"));
+  const runWith = (edit: (vectors: any) => void) => {
+    const vectors = JSON.parse(readFileSync(vectorsPath, "utf8"));
+    edit(vectors);
+    const file = join(dir, "vectors.json");
+    writeFileSync(file, JSON.stringify(vectors));
+    return spawnSync(process.execPath, [script, file], { encoding: "utf8" });
+  };
+  const typo = runWith((v) => { v.scenarios.cases[0].events[0] = { atMs: 0, sendfailed: "w1" }; });
+  assert.equal(typo.status, 1, typo.stdout);
+  assert.match(typo.stdout, /^FAIL scenario\/receipt_admits$/m);
+  const dropped = runWith((v) => { v.scenarios.cases.pop(); });
+  assert.equal(dropped.status, 1, dropped.stdout);
+  assert.match(dropped.stdout, /^FAIL counts$/m);
+  const undeclared = runWith((v) => { v.wire.push(v.wire[0]); });
+  assert.equal(undeclared.status, 1, undeclared.stdout);
+});
+
+test("a write sent after the session ended settles unconfirmed session_ended at once, and the earlier receipt stands", () => {
+  const settled: [string, WriteSettlement][] = [];
+  const tracker = new WriteTracker({ windowMs: 1000, onSettle: (id, settlement) => settled.push([id, settlement]) });
+  tracker.send("w1", 0);
+  tracker.frame(admitted("w1"), 5);
+  tracker.sessionEnd(40);
+  tracker.send("w2", 50);
+  assert.deepEqual(settled, [["w1", { outcome: "admitted" }], ["w2", { outcome: "unconfirmed", reason: "session_ended" }]]);
+});
+
+test("a failed local send settles only that write unconfirmed as local_send_failed, and an answer after it is recorded late", () => {
+  const settled: [string, WriteSettlement][] = [];
+  const tracker = new WriteTracker({ windowMs: 1000, onSettle: (id, settlement) => settled.push([id, settlement]) });
+  tracker.send("w1", 0);
+  tracker.send("w2", 0);
+  tracker.sendFailed("w1", 10);
+  assert.deepEqual(settled, [["w1", { outcome: "unconfirmed", reason: "local_send_failed" }]]);
+  assert.equal(tracker.state("w2")?.outcome, "pending");
+  tracker.frame(admitted("w1"), 20);
+  assert.deepEqual(tracker.state("w1"), { outcome: "unconfirmed", reason: "local_send_failed", recorded: "admitted_late" });
+  tracker.sendFailed("w2", 30);
+  tracker.sendFailed("w2", 31);
+  assert.equal(settled.length, 2, "a write settles once");
+  tracker.sendFailed("unknown", 40);
+  assert.equal(tracker.state("unknown"), undefined);
+});
+
+test("a failed local send advances the clock: other writes whose windows have run settle window_elapsed", () => {
+  const tracker = new WriteTracker({ windowMs: 1000 });
+  tracker.send("w1", 0);
+  tracker.send("w2", 500);
+  tracker.sendFailed("w2", 1200);
+  assert.deepEqual(tracker.state("w1"), { outcome: "unconfirmed", reason: "window_elapsed" });
+  assert.deepEqual(tracker.state("w2"), { outcome: "unconfirmed", reason: "local_send_failed" });
+});
+
+test("a write whose own send failed settles local_send_failed even when its window has also run", () => {
+  const tracker = new WriteTracker({ windowMs: 1000 });
+  tracker.send("w1", 0);
+  tracker.sendFailed("w1", 1000);
+  assert.deepEqual(tracker.state("w1"), { outcome: "unconfirmed", reason: "local_send_failed" });
+});
+
+// Blank is Unicode White_Space (write-receipt.md, rule 5), not what String.prototype.trim() trims: trim() takes U+FEFF and
+// misses U+0085. Every frame decoder that rejects a blank text must agree with the servers that do.
+test("a blank messageId, record key or tag is exactly Unicode White_Space, not trim()", () => {
+  const put = (document: Record<string, unknown>, messageId = "p1") => ({
+    schemaVersion: "cultnet.document_put_raw.v0", messageId,
+    document: { schemaId: "note.v0", recordKey: "note:1", storedAt: "2026-11-08T00:00:00Z", payloadEncoding: "messagepack", payload: Uint8Array.of(0x81, 0xa1, 0x61, 0x01), ...document },
+  });
+  for (const blank of ["\u0085", "  ", "　"]) {
+    assert.throws(() => parseCultNetMessage(put({}, blank)), `messageId ${JSON.stringify(blank)}`);
+    assert.throws(() => parseCultNetMessage(put({ recordKey: blank })), `recordKey ${JSON.stringify(blank)}`);
+    assert.throws(() => parseCultNetMessage(put({ tags: [blank] })), `tag ${JSON.stringify(blank)}`);
+  }
+  for (const named of ["", "​", "\u001c", "᠎"]) {
+    parseCultNetMessage(put({}, named));
+    parseCultNetMessage(put({ recordKey: named }));
+    parseCultNetMessage(put({ tags: [named] }));
+  }
+});

packages/cultnet-ts/tools/replay-write-receipt-vectors.mjs

@@ -0,0 +1,132 @@
+#!/usr/bin/env node
+// Replays contracts/cultnet/interop/write-receipt-vectors.json against this runtime: every `scenarios.cases` event
+// replay through a fake server and the WriteTracker, and every `wire` / `schemaInvalid` frame through the real
+// decoder. Prints PASS/FAIL per case; exit 1 on any failure. Runs against the built package (`npm run build` first).
+//
+//   node tools/replay-write-receipt-vectors.mjs [path/to/write-receipt-vectors.json]
+//
+// The runner interface a port (Rust, C#) must reproduce is documented in README.md, "Write receipt replay runner".
+
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { createRequire } from "node:module";
+
+const require = createRequire(import.meta.url);
+const here = path.dirname(fileURLToPath(import.meta.url));
+const { decode, encode } = require("@msgpack/msgpack");
+const {
+  CULTNET_WRITE_RECEIPT_MESSAGE_VERSIONS, LEGACY_RESULT_WINDOW_MS, RECEIPT_RESULT_WINDOW_MS, WriteTracker,
+  encodeCultNetMessageForWire, helloAdvertisesWriteReceipts, parseCultNetMessage, resultWindowMs,
+} = require(path.join(here, "..", "dist", "index.js"));
+
+const vectorsPath = process.argv[2] ?? path.join(here, "..", "..", "..", "contracts", "cultnet", "interop", "write-receipt-vectors.json");
+const vectors = JSON.parse(readFileSync(vectorsPath, "utf8"));
+
+// The event actions scenarios.semantics names; anything else is refused, not skipped.
+const EVENT_KEYS = ["send", "frame", "tick", "sessionEnd", "sendFailed", "transportAck"];
+
+const results = [];
+const check = (name, run) => {
+  try {
+    const problems = run();
+    results.push({ name, problems });
+  } catch (error) {
+    results.push({ name, problems: [`threw: ${error instanceof Error ? error.message : String(error)}`] });
+  }
+};
+const bytesOf = (hex) => Uint8Array.from(Buffer.from(hex, "hex"));
+const hexOf = (bytes) => Buffer.from(bytes).toString("hex").toUpperCase();
+// A frame reaches the client as bytes: the fake server encodes it, the client decodes and validates it.
+const delivered = (frame) => parseCultNetMessage(decode(encode(frame)));
+
+check("constants", () => [
+  ...(vectors.constants.RECEIPT_RESULT_WINDOW_MS === RECEIPT_RESULT_WINDOW_MS ? [] : [`RECEIPT window ${RECEIPT_RESULT_WINDOW_MS} != ${vectors.constants.RECEIPT_RESULT_WINDOW_MS}`]),
+  ...(vectors.constants.LEGACY_RESULT_WINDOW_MS === LEGACY_RESULT_WINDOW_MS ? [] : [`LEGACY window ${LEGACY_RESULT_WINDOW_MS} != ${vectors.constants.LEGACY_RESULT_WINDOW_MS}`]),
+]);
+
+for (const vector of vectors.wire) {
+  check(`wire/${vector.name}`, () => {
+    const problems = [];
+    const parsed = parseCultNetMessage(decode(bytesOf(vector.messagePackHex)));
+    if (JSON.stringify(sorted(parsed)) !== JSON.stringify(sorted(vector.message))) problems.push(`decoded ${JSON.stringify(parsed)} != ${JSON.stringify(vector.message)}`);
+    const reencoded = hexOf(encode(encodeCultNetMessageForWire(parsed)));
+    if (reencoded !== vector.messagePackHex.toUpperCase()) problems.push(`re-encoded bytes ${reencoded} != captured ${vector.messagePackHex}`);
+    return problems;
+  });
+}
+
+for (const vector of vectors.schemaInvalid) {
+  check(`schemaInvalid/${vector.name}`, () => {
+    try {
+      parseCultNetMessage(decode(bytesOf(vector.messagePackHex)));
+    } catch {
+      return [];
+    }
+    return [`accepted a frame that must be refused (${vector.why})`];
+  });
+}
+
+for (const scenario of vectors.scenarios.cases) {
+  check(`scenario/${scenario.name}`, () => {
+    // The fake server states its capability the only way a real one does: in its hello.
+    const serverHello = { schemaVersion: "cultnet.hello.v0", runtimeId: "fake-server", runtimeKind: "fake",
+      ...(scenario.server === "receipt" ? { supportedMessageVersions: [...CULTNET_WRITE_RECEIPT_MESSAGE_VERSIONS] } : {}) };
+    const windowMs = resultWindowMs(helloAdvertisesWriteReceipts(serverHello));
+    const problems = [];
+    if (windowMs !== vectors.constants[scenario.window]) problems.push(`window ${windowMs} != ${scenario.window}`);
+
+    const told = new Map(); // what the caller was told, at settle time
+    const tracker = new WriteTracker({ windowMs, onSettle: (id, settlement) => {
+      if (told.has(id)) problems.push(`${id} settled twice`);
+      told.set(id, settlement);
+    } });
+    for (const event of [...scenario.events].sort((a, b) => a.atMs - b.atMs)) {
+      const actions = Object.keys(event).filter((key) => key !== "atMs");
+      if (actions.length !== 1 || !EVENT_KEYS.includes(actions[0])) { problems.push(`event at ${event.atMs} has keys [${actions}], wanted atMs and exactly one of ${EVENT_KEYS}`); continue; }
+      if ("send" in event) tracker.send(event.send, event.atMs);
+      else if ("frame" in event) tracker.frame(delivered(event.frame), event.atMs);
+      else if ("tick" in event) tracker.tick(event.atMs);
+      else if ("sessionEnd" in event) tracker.sessionEnd(event.atMs);
+      else if ("sendFailed" in event) tracker.sendFailed(event.sendFailed, event.atMs);
+      // transportAck: delivery is not an answer; the tracker has no such input and must not need one.
+    }
+    for (const [id, want] of Object.entries(scenario.expect)) {
+      const got = told.get(id);
+      if (!got) { problems.push(`${id}: never settled, wanted ${want.outcome}`); continue; }
+      if (got.outcome !== want.outcome) problems.push(`${id}: told ${got.outcome}, wanted ${want.outcome}`);
+      if (want.code !== undefined && got.code !== want.code) problems.push(`${id}: code ${got.code}, wanted ${want.code}`);
+      if (want.reason !== undefined && got.reason !== want.reason) problems.push(`${id}: reason ${got.reason}, wanted ${want.reason}`);
+      const recorded = tracker.state(id)?.recorded;
+      if (recorded !== want.recorded) problems.push(`${id}: recorded ${recorded}, wanted ${want.recorded}`);
+    }
+    for (const id of told.keys()) if (!(id in scenario.expect)) problems.push(`${id}: settled but the scenario expects nothing for it`);
+    return problems;
+  });
+}
+
+// A runner that read fewer vectors than the file declares has silently skipped some. (contentHash is not replayed here.)
+check("counts", () => {
+  const ran = (prefix) => results.filter((r) => r.name.startsWith(prefix)).length;
+  const loaded = { wire: vectors.wire.length, schemaInvalid: vectors.schemaInvalid.length, scenarioCases: vectors.scenarios.cases.length };
+  const executed = { wire: ran("wire/"), schemaInvalid: ran("schemaInvalid/"), scenarioCases: ran("scenario/") };
+  return Object.keys(executed)
+    .filter((key) => loaded[key] !== vectors.counts[key] || executed[key] !== vectors.counts[key])
+    .map((key) => `${key}: declared ${vectors.counts[key]}, loaded ${loaded[key]}, ran ${executed[key]}`);
+});
+
+function sorted(value) {
+  if (Array.isArray(value)) return value.map(sorted);
+  if (value && typeof value === "object") return Object.fromEntries(Object.keys(value).sort().map((k) => [k, sorted(value[k])]));
+  return value;
+}
+
+let failed = 0;
+for (const { name, problems } of results) {
+  if (problems.length === 0) { console.log(`PASS ${name}`); continue; }
+  failed++;
+  console.log(`FAIL ${name}`);
+  for (const problem of problems) console.log(`     ${problem}`);
+}
+console.log(`${results.length - failed}/${results.length} passed`);
+process.exit(failed === 0 ? 0 : 1);

src/GameCult.Mesh/CultMeshClient.cs

@@ -44,6 +44,12 @@ namespace GameCult.Mesh
 
         /// <summary>Gets or sets the deadline for one correlated typed operation response.</summary>
         public TimeSpan OperationResponseTimeout { get; set; } = TimeSpan.FromSeconds(10);
+
+        /// <summary>
+        /// Gets or sets how long after a submitted document the provider's refusal may still arrive. The provider
+        /// sends no success frame for an admitted submission, so this window bounds <c>SubmitDocumentAsync</c>.
+        /// </summary>
+        public TimeSpan SubmitResultWindow { get; set; } = CultNetWriteCompletion.DefaultResultWindow;
     }
 
     /// <summary>
@@ -149,6 +155,7 @@ namespace GameCult.Mesh
         private readonly CultMeshSessionManager _sessions;
         private readonly TimeSpan _subscriptionResponseTimeout;
         private readonly TimeSpan _operationResponseTimeout;
+        private readonly TimeSpan _submitResultWindow;
         private readonly ConcurrentDictionary<string, SharedResource> _documents = new(StringComparer.Ordinal);
         private readonly ConcurrentDictionary<string, SharedResource> _collections = new(StringComparer.Ordinal);
         private bool _disposed;
@@ -191,6 +198,7 @@ namespace GameCult.Mesh
                 options.Sessions);
             _subscriptionResponseTimeout = options.SubscriptionResponseTimeout;
             _operationResponseTimeout = options.OperationResponseTimeout;
+            _submitResultWindow = options.SubmitResultWindow;
         }
 
         /// <summary>Connects to one stable Verse/provider target using one application protocol.</summary>
@@ -319,7 +327,10 @@ namespace GameCult.Mesh
 
         /// <summary>
         /// Submits one typed document to a provider by stable identity. Submission is uncommitted input;
-        /// only a provider-authored receipt or resulting state can establish acceptance.
+        /// only a provider-authored receipt or resulting state can establish acceptance. The task completes on
+        /// the provider's result frame: a refusal (<c>write_not_authorized</c>, <c>message_invalid</c>, ...) throws
+        /// <see cref="CultNetWriteRefusedException"/>, and a submission not refused within
+        /// <see cref="CultMeshClientOptions.SubmitResultWindow"/> completes.
         /// </summary>
         public async Task SubmitDocumentAsync<TDocument>(
             CultMeshSessionTarget target,
@@ -351,7 +362,11 @@ namespace GameCult.Mesh
             var session = await ConnectAsync(target, CultMeshProtocols.Documents, cancellationToken)
                 .ConfigureAwait(false);
             cancellationToken.ThrowIfCancellationRequested();
-            session.OpenSchemaClient().SendCultNet(message);
+            await CultNetWriteCompletion.SendAndAwaitResultAsync(
+                refuse => session.OnCultNet(refuse),
+                () => session.SendCultNet(message),
+                _submitResultWindow,
+                cancellationToken).ConfigureAwait(false);
         }
 
         /// <summary>

src/GameCult.Mesh/CultMeshSessions.cs

@@ -352,6 +352,7 @@ namespace GameCult.Mesh
         internal long PhysicalGeneration => Interlocked.Read(ref _physicalGeneration);
         public Observable<CultMeshSessionState> WatchState() => _states;
         public ICultNetSchemaClient OpenSchemaClient() => new SessionSchemaClient(this);
+        /// <summary>Fire-and-forget: an ack or a return is not admission; read the result frame.</summary>
         public void SendCultNet<T>(T message) where T : ICultNetSchemaMessage => Channel.SendCultNet(message);
         public IDisposable OnCultNet<T>(Action<T> callback) where T : ICultNetSchemaMessage
         {

src/GameCult.Networking/CultNetDatabase.cs

@@ -1017,6 +1017,8 @@ namespace GameCult.Networking
         /// <summary>
         /// Applies a raw document mutation after checking shard authority. This is the host's own door (and replication's):
         /// it asks no remote write authority. A peer's put goes through <see cref="CultNetDatabaseServer"/>, which does.
+        /// Returning normally means the put is committed and visible to readers: a receipt-capable peer is told
+        /// <c>write_admitted</c> on the strength of it, so a write that has only been queued must not return.
         /// </summary>
         /// <exception cref="CultNetUnownedSchemaException">No shard owns the schema and key; nothing was written.</exception>
         /// <exception cref="CultNetShardLogException">The change committed and was published, but the shard log could not record it.</exception>
@@ -1047,6 +1049,7 @@ namespace GameCult.Networking
         /// <summary>
         /// Applies a raw document delete after checking shard authority. This is the host's own door: it asks no remote
         /// write authority. A peer's delete goes through <see cref="CultNetDatabaseServer"/>, which does.
+        /// Returning normally means the delete is committed and visible to readers (see <see cref="ApplyPutAsync(CultNetDocumentPutRawMessage)"/>).
         /// </summary>
         /// <exception cref="CultNetUnownedSchemaException">No shard owns the schema and key; nothing was written.</exception>
         /// <exception cref="CultNetShardLogException">The change committed and was published, but the shard log could not record it.</exception>

src/GameCult.Networking/CultNetDatabaseServer.cs

@@ -22,6 +22,7 @@ namespace GameCult.Networking
         private readonly Func<CultNetSnapshotRequestV1Message, CultNetServerPeer, Task> _snapshotHandlerV1;
         private readonly Func<CultNetDocumentPutRawMessage, CultNetServerPeer, Task> _putHandler;
         private readonly Func<CultNetDocumentDeleteMessage, CultNetServerPeer, Task> _deleteHandler;
+        private readonly Func<CultNetHelloMessage, CultNetServerPeer, Task> _helloHandler;
         private readonly Func<CultNetShardCatalogRequestMessage, CultNetServerPeer, Task> _shardCatalogHandler;
         private readonly Func<CultNetShardLogRequestMessage, CultNetServerPeer, Task> _shardLogHandler;
         private readonly Func<CultNetDatabaseSubscribeMessage, CultNetServerPeer, Task> _subscribeHandler;
@@ -45,6 +46,7 @@ namespace GameCult.Networking
             _snapshotHandlerV1 = HandleSnapshotRequestV1Async;
             _putHandler = HandlePutAsync;
             _deleteHandler = HandleDeleteAsync;
+            _helloHandler = HandleHelloAsync;
             _shardCatalogHandler = HandleShardCatalogRequestAsync;
             _shardLogHandler = HandleShardLogRequestAsync;
             _subscribeHandler = HandleSubscribeAsync;
@@ -55,6 +57,7 @@ namespace GameCult.Networking
             _server.OnCultNet(_snapshotHandlerV1);
             _server.OnCultNet(_putHandler);
             _server.OnCultNet(_deleteHandler);
+            _server.OnCultNet(_helloHandler);
             _server.OnCultNet(_shardCatalogHandler);
             _server.OnCultNet(_shardLogHandler);
             _server.OnCultNet(_subscribeHandler);
@@ -217,6 +220,7 @@ namespace GameCult.Networking
             _server.RemoveCultNetMessageListener<CultNetSnapshotRequestV1Message>(_snapshotHandlerV1);
             _server.RemoveCultNetMessageListener<CultNetDocumentPutRawMessage>(_putHandler);
             _server.RemoveCultNetMessageListener<CultNetDocumentDeleteMessage>(_deleteHandler);
+            _server.RemoveCultNetMessageListener<CultNetHelloMessage>(_helloHandler);
             _server.RemoveCultNetMessageListener<CultNetShardCatalogRequestMessage>(_shardCatalogHandler);
             _server.RemoveCultNetMessageListener<CultNetShardLogRequestMessage>(_shardLogHandler);
             _server.RemoveCultNetMessageListener<CultNetDatabaseSubscribeMessage>(_subscribeHandler);
@@ -262,7 +266,7 @@ namespace GameCult.Networking
             catch (Exception ex)
             {
                 _server.Logger.LogError($"CultNet snapshot v1 request failed: {ex.Message}");
-                peer.SendCultNet(new CultNetErrorMessage { Error = ex.Message });
+                peer.SendCultNet(new CultNetErrorMessage { Error = "the snapshot request could not be answered" });
             }
 
             return Task.CompletedTask;
@@ -282,7 +286,8 @@ namespace GameCult.Networking
             }
             catch (Exception ex)
             {
-                peer.SendCultNet(new CultNetErrorMessage { Error = ex.Message });
+                _server.Logger.LogError($"CultNet shard log request failed: {ex.Message}");
+                peer.SendCultNet(new CultNetErrorMessage { Error = "the shard log request could not be answered" });
             }
 
             return Task.CompletedTask;
@@ -323,74 +328,273 @@ namespace GameCult.Networking
             };
         }
 
-        private async Task HandlePutAsync(CultNetDocumentPutRawMessage message, CultNetServerPeer peer)
+        // A hello decides the connection's write framing if it is the first thing to (write-receipt.md, "Capability"). The
+        // server answers a receipt-capable hello with its own, so the client can tell a receipt server from a legacy one.
+        private Task HandleHelloAsync(CultNetHelloMessage hello, CultNetServerPeer peer)
+        {
+            if (peer.Transport != null && peer.Transport.SettleWriteFraming(hello))
+            {
+                Answer(peer, new CultNetHelloMessage
+                {
+                    RuntimeId = "gamecult-networking-database-server",
+                    RuntimeKind = "dotnet",
+                    SupportedMessageVersions = [CultNetSchemaVersions.WriteAdmitted, CultNetSchemaVersions.ErrorV1]
+                });
+            }
+
+            return Task.CompletedTask;
+        }
+
+        // The write's receipt state, or null when its connection did not opt in (it is then answered exactly as before).
+        private CultNetReceiptedWrite? BeginReceipted(
+            CultNetServerPeer peer,
+            string operation,
+            string? messageId,
+            string? schemaId,
+            string? recordKey,
+            byte[]? payload)
+        {
+            var transport = peer.Transport;
+            if (transport == null) return null;
+            transport.SettleWriteFraming(null);
+            var session = transport.WriteReceipts;
+            return session == null
+                ? null
+                : new CultNetReceiptedWrite(session, message => Answer(peer, message), operation, messageId, schemaId, recordKey, payload);
+        }
+
+        // Every frame a write can be answered with. Mock point for tests: the answer leaves through the peer's transport. An
+        // answer that cannot be queued ends the connection: the peer settles its write as session_ended, never as silence.
+        private void Answer(CultNetServerPeer peer, ICultNetSchemaMessage message)
         {
             try
             {
-                await _database.ApplyPutAsync(message, Authorize(peer, CultNetRemoteWriteOperation.Put, message.ShardId, message.ShardEpoch))
+                Send(peer, message);
-                    .ConfigureAwait(false);
+            }
+            catch (Exception ex)
+            {
+                _server.Logger.LogWarning($"CultNet write answer could not be sent; ending the connection: {ex.Message}");
+                peer.Transport?.End();
+            }
+        }
+
+        private static void Send(CultNetServerPeer peer, ICultNetSchemaMessage message)
+        {
+            switch (message)
+            {
+                case CultNetWriteAdmittedMessage admitted: peer.SendCultNet(admitted); break;
+                case CultNetErrorV1Message error: peer.SendCultNet(error); break;
+                case CultNetErrorMessage error: peer.SendCultNet(error); break;
+                case CultNetHelloMessage hello: peer.SendCultNet(hello); break;
+                default: throw new ArgumentException($"{message.GetType().Name} is not a write answer.", nameof(message));
+            }
+        }
+
+        // A write that names nothing is refused as a frame that does not read, exactly as the Rust server's decoder refuses it
+        // (write-receipt.md, "Required fields"), never handed to the store: a blank schemaId, recordKey or storedAt, an empty
+        // payload, and a source id or tag that is present but blank.
+        private static bool IsUnreadableWriteTarget(string? schemaId, string? recordKey) =>
+            IsBlank(schemaId) || IsBlank(recordKey);
+
+        private static bool IsUnreadableDocument(CultNetRawDocumentRecord document) =>
+            IsUnreadableWriteTarget(document.SchemaId, document.RecordKey)
+            || IsBlank(document.StoredAt)
+            || document.Payload == null || document.Payload.Length == 0
+            || IsPresentButBlank(document.SourceRuntimeId)
+            || IsPresentButBlank(document.SourceAgentId)
+            || IsPresentButBlank(document.SourceRole)
+            || document.Tags != null && document.Tags.Any(IsBlank);
+
+        private static bool IsPresentButBlank(string? value) => value != null && IsBlank(value);
+
+        // Blank is the Unicode White_Space property, listed here and in write-receipt.md, not char.IsWhiteSpace: the platform's
+        // own test follows its Unicode tables (and has put U+180E in the set), the spec's does not move. A null is not text.
+        private static bool IsBlank(string? value) => value == null || value.All(IsWhiteSpaceCodePoint);
+
+        private static bool IsWhiteSpaceCodePoint(char c) =>
+            c is (>= '\u0009' and <= '\u000D') or '\u0020' or '\u0085' or '\u00A0' or '\u1680'
+                or (>= '\u2000' and <= '\u200A') or '\u2028' or '\u2029' or '\u202F' or '\u205F' or '\u3000';
+
+        // A refusal: error.v1 carrying the write's id for a receipt-capable connection, the v0 error for any other.
+        private static void Refuse(CultNetServerPeer peer, CultNetReceiptedWrite? write, CultNetErrorMessage error)
+        {
+            if (write != null) write.Refused(error);
+            else peer.SendCultNet(error);
+        }
+
+        // Rule 6: a forward is answered with what the primary answered, under the original id. A refusal the primary sent is
+        // relayed; silence or any other failure relays nothing, so the client settles it unconfirmed.
+        private void RelayForwardFailure(CultNetReceiptedWrite write, Exception failure)
+        {
+            if (failure is CultNetWriteRefusedException refused)
+            {
+                write.Refused(refused.Refusal);
+                return;
+            }
+
+            _server.Logger.LogWarning($"CultNet forwarded write was not answered by its primary: {failure.Message}");
+            // Only a forward that provably never left (not sent) may be forwarded again. Every other failure, silence or not, is
+            // unconfirmed: the primary may have applied it, so the id is never forwarded again on this session.
+            if (failure is CultNetWriteNotSentException) write.NotSent();
+            else write.LeftSilent();
+        }
+
+        private async Task HandlePutAsync(CultNetDocumentPutRawMessage message, CultNetServerPeer peer)
+        {
+            var write = BeginReceipted(peer, "put", message.MessageId, message.Document?.SchemaId, message.Document?.RecordKey, message.Document?.Payload);
+            var idRefusal = write?.IdRefusal;
+            if (idRefusal != null)
+            {
+                write!.Refused(idRefusal);
+                return;
+            }
+
+            var missing = message.Document == null ? "document" : message.Document.SchemaId == null ? "schemaId" : null;
+            if (missing != null)
+            {
+                Refuse(peer, write, CultNetErrorMessage.ForMessageInvalid(missing, $"{missing} is required"));
+                return;
+            }
+
+            if (IsUnreadableDocument(message.Document!))
+            {
+                Refuse(peer, write, CultNetErrorMessage.ForUnreadableMessage());
+                return;
+            }
+
+            if (write != null && !write.Begin()) return;
+
+            var authorize = Authorize(peer, CultNetRemoteWriteOperation.Put, message.ShardId, message.ShardEpoch);
+            try
+            {
+                await _database.ApplyPutAsync(message, authorize).ConfigureAwait(false);
+                write?.Admitted();
             }
             catch (CultNetRemoteWriteRefusedException ex)
             {
                 _server.Logger.LogWarning($"CultNet raw put refused: {ex.Message}");
-                peer.SendCultNet(CultNetErrorMessage.ForRemoteWriteRefused(ex.Request, ex.Reason));
+                Refuse(peer, write, CultNetErrorMessage.ForRemoteWriteRefused(ex.Request, ex.Reason));
             }
             catch (CultNetShardAuthorityException ex)
             {
-                if (!await TryForwardPutAsync(ex, message).ConfigureAwait(false))
+                bool forwarded;
+                try
+                {
+                    forwarded = await TryForwardPutAsync(ex, message).ConfigureAwait(false);
+                }
+                catch (CultNetWriteUnconfirmedException) when (write == null)
+                {
+                    // A peer that did not opt in is told nothing of a forward its primary left unanswered.
+                    return;
+                }
+                catch (Exception failure) when (write != null)
+                {
+                    RelayForwardFailure(write, failure);
+                    return;
+                }
+
+                if (forwarded)
+                {
+                    write?.Admitted();
+                }
+                else
                 {
                     _server.Logger.LogError($"CultNet raw put authority failed: {ex.Message}");
-                    peer.SendCultNet(CreateRoutingError(ex));
+                    Refuse(peer, write, CreateRoutingError(ex));
                 }
             }
             catch (CultNetUnownedSchemaException ex)
             {
                 _server.Logger.LogWarning($"CultNet raw put refused: {ex.Message}");
-                peer.SendCultNet(CultNetErrorMessage.ForUnownedSchema(ex));
+                Refuse(peer, write, CultNetErrorMessage.ForUnownedSchema(ex));
             }
             catch (Exception ex) when (CommittedWithLogFailure(ex))
             {
                 // The write committed and was published; only its shard log failed, so the peer is not told it was refused.
                 _server.Logger.LogWarning($"CultNet raw put committed but its shard log failed: {ex.Message}");
+                write?.Admitted();
             }
             catch (Exception ex)
             {
                 _server.Logger.LogError($"CultNet raw put failed: {ex.Message}");
-                peer.SendCultNet(new CultNetErrorMessage { Error = ex.Message });
+                Refuse(peer, write, new CultNetErrorMessage { Error = CultNetWriteReceiptSession.WriteFailedText });
             }
         }
 
         private async Task HandleDeleteAsync(CultNetDocumentDeleteMessage message, CultNetServerPeer peer)
         {
+            var write = BeginReceipted(peer, "delete", message.MessageId, message.SchemaId, message.RecordKey, null);
+            var idRefusal = write?.IdRefusal;
+            if (idRefusal != null)
+            {
+                write!.Refused(idRefusal);
+                return;
+            }
+
+            if (message.SchemaId == null)
+            {
+                Refuse(peer, write, CultNetErrorMessage.ForMessageInvalid("schemaId", "schemaId is required"));
+                return;
+            }
+
+            if (IsUnreadableWriteTarget(message.SchemaId, message.RecordKey))
+            {
+                Refuse(peer, write, CultNetErrorMessage.ForUnreadableMessage());
+                return;
+            }
+
+            if (write != null && !write.Begin()) return;
+
+            var authorize = Authorize(peer, CultNetRemoteWriteOperation.Delete, message.ShardId, message.ShardEpoch);
             try
             {
-                await _database.ApplyDeleteAsync(message, Authorize(peer, CultNetRemoteWriteOperation.Delete, message.ShardId, message.ShardEpoch))
+                await _database.ApplyDeleteAsync(message, authorize).ConfigureAwait(false);
-                    .ConfigureAwait(false);
+                write?.Admitted();
             }
             catch (CultNetRemoteWriteRefusedException ex)
             {
                 _server.Logger.LogWarning($"CultNet raw delete refused: {ex.Message}");
-                peer.SendCultNet(CultNetErrorMessage.ForRemoteWriteRefused(ex.Request, ex.Reason));
+                Refuse(peer, write, CultNetErrorMessage.ForRemoteWriteRefused(ex.Request, ex.Reason));
             }
             catch (CultNetShardAuthorityException ex)
             {
-                if (!await TryForwardDeleteAsync(ex, message).ConfigureAwait(false))
+                bool forwarded;
+                try
                 {
-                    peer.SendCultNet(CreateRoutingError(ex));
+                    forwarded = await TryForwardDeleteAsync(ex, message).ConfigureAwait(false);
+                }
+                catch (CultNetWriteUnconfirmedException) when (write == null)
+                {
+                    return;
+                }
+                catch (Exception failure) when (write != null)
+                {
+                    RelayForwardFailure(write, failure);
+                    return;
+                }
+
+                if (forwarded)
+                {
+                    write?.Admitted();
+                }
+                else
+                {
+                    Refuse(peer, write, CreateRoutingError(ex));
                 }
             }
             catch (CultNetUnownedSchemaException ex)
             {
                 _server.Logger.LogWarning($"CultNet raw delete refused: {ex.Message}");
-                peer.SendCultNet(CultNetErrorMessage.ForUnownedSchema(ex));
+                Refuse(peer, write, CultNetErrorMessage.ForUnownedSchema(ex));
             }
             catch (Exception ex) when (CommittedWithLogFailure(ex))
             {
                 _server.Logger.LogWarning($"CultNet raw delete committed but its shard log failed: {ex.Message}");
+                write?.Admitted();
             }
             catch (Exception ex)
             {
-                peer.SendCultNet(new CultNetErrorMessage { Error = ex.Message });
+                Refuse(peer, write, new CultNetErrorMessage { Error = CultNetWriteReceiptSession.WriteFailedText });
             }
         }
 
@@ -588,7 +792,7 @@ namespace GameCult.Networking
                 var refusedKey = change.GetType().GetProperty("Key")?.GetValue(change) is CultRecordKey changed ? changed.Value : string.Empty;
                 lock (refused)
                     refused.Add(refusedKey);
-                sendError(new CultNetErrorMessage { Error = refusal.Message });
+                sendError(new CultNetErrorMessage { Error = "the record is a variant CultNet cannot carry" });
                 return null;
             }
 
@@ -666,11 +870,14 @@ namespace GameCult.Networking
             exception is CultNetShardLogException ||
             exception is AggregateException aggregate && aggregate.Flatten().InnerExceptions.Any(inner => inner is CultNetShardLogException);
 
+        // Fixed text: the routing refusal never carries an exception's own message (the shard and reason travel in the hint).
+        internal const string RoutingRefusalText = "the write belongs to another shard primary";
+
         private static CultNetErrorMessage CreateRoutingError(CultNetShardAuthorityException exception)
         {
             return new CultNetErrorMessage
             {
-                Error = exception.Message,
+                Error = RoutingRefusalText,
                 RoutingHint = new CultNetShardRoutingHint
                 {
                     Reason = exception.Reason,

src/GameCult.Networking/CultNetRudpSchemaServer.cs

@@ -126,6 +126,12 @@ namespace GameCult.Networking
         /// </summary>
         public const int MaxConsecutiveRefusedFrames = 8;
 
+        /// <summary>
+        /// How long a session whose capped frame was answered waits for the peer to acknowledge the answer
+        /// before it ends anyway.
+        /// </summary>
+        internal const long CappedAnswerGraceMs = 2000;
+
         /// <summary>
         /// Gets or sets the logger used by the server. R-AM: the dispatch backstop in DispatchAsync
         /// logs every untyped fault through this instead of swallowing it silently.
@@ -310,6 +316,9 @@ namespace GameCult.Networking
         {
             if (!string.Equals(delivered.Frame.ChannelId, "schema", StringComparison.Ordinal))
                 return false;
+            // The capped frame was answered: nothing after it is served while the answer is delivered.
+            if (delivered.Peer.EndingReason != null)
+                return false;
 
             // A peer's message that cannot be decoded (malformed bytes, an unknown schemaVersion) or
             // handled ends that peer's session, never the poll: the drain goes on serving every other
@@ -337,8 +346,10 @@ namespace GameCult.Networking
                     Logger.LogError($"CultNet RUDP schema server could not decode a peer's message ({ex.GetType().Name}); it was refused and that peer's session kept.");
                     return false;
                 }
-                var ended = _transport.EndPeerSession(delivered.Peer, CultNetRudpSession.RefusedPacketReason);
+                // The answer was sent reliably: the session ends once the peer has acknowledged it (a lost
-                Logger.LogError($"CultNet RUDP schema server could not decode a peer's message ({ex.GetType().Name}); {SessionOutcome(ended)}");
+                // datagram is resent first), or after the grace.
+                _transport.EndPeerSessionWhenAnswered(delivered.Peer, CultNetRudpSession.RefusedPacketReason, CappedAnswerGraceMs);
+                Logger.LogError($"CultNet RUDP schema server could not decode a peer's message ({ex.GetType().Name}); that peer's session ends once its answer is acknowledged.");
                 return false;
             }
             _undecodableFramesInARow.GetOrCreateValue(delivered.Peer).Value = 0;

src/GameCult.Networking/CultNetSchemaClient.cs

@@ -26,7 +26,9 @@ namespace GameCult.Networking
         void Connect(string host, int port);
 
         /// <summary>
-        /// Sends one schema-v0 message through the transport.
+        /// Sends one schema-v0 message through the transport. Fire-and-forget: an ack or a return is not admission;
+        /// read the result frame (<see cref="CultNetWriteCompletion"/>). Throws <see cref="CultNetWriteNotSentException"/> only
+        /// when it can prove no byte was written; any other exception leaves the send ambiguous and a forwarded write unconfirmed.
         /// </summary>
         void SendCultNet<T>(T message)
             where T : ICultNetSchemaMessage;

src/GameCult.Networking/CultNetSchemaMessageSerialization.cs

@@ -53,6 +53,8 @@ namespace GameCult.Networking
                 CultNetSchemaVersions.Verify => Deserialize<CultNetVerifyMessage>(payload),
                 CultNetSchemaVersions.LoginSuccess => Deserialize<CultNetLoginSuccessMessage>(payload),
                 CultNetSchemaVersions.Error => Deserialize<CultNetErrorMessage>(payload),
+                CultNetSchemaVersions.ErrorV1 => Deserialize<CultNetErrorV1Message>(payload),
+                CultNetSchemaVersions.WriteAdmitted => Deserialize<CultNetWriteAdmittedMessage>(payload),
                 CultNetSchemaVersions.SampleChangeName => Deserialize<CultNetSampleChangeNameMessage>(payload),
                 CultNetSchemaVersions.SampleChat => Deserialize<CultNetSampleChatMessage>(payload),
                 CultNetSchemaVersions.OperationRequest => Deserialize<CultNetOperationRequestMessage>(payload),

src/GameCult.Networking/CultNetSchemaMessages.cs

@@ -48,6 +48,14 @@ namespace GameCult.Networking
         /// </summary>
         public const string Error = "cultnet.error.v0";
         /// <summary>
+        /// error v1 contract identifier: error v0 plus the id of the request it answers (write-receipt.md).
+        /// </summary>
+        public const string ErrorV1 = "cultnet.error.v1";
+        /// <summary>
+        /// write admitted receipt contract identifier (write-receipt.md).
+        /// </summary>
+        public const string WriteAdmitted = "cultnet.write_admitted.v0";
+        /// <summary>
         /// sample change name contract identifier.
         /// </summary>
         public const string SampleChangeName = "cultnet.sample.change_name.v0";
@@ -538,7 +546,7 @@ namespace GameCult.Networking
         public static CultNetErrorMessage ForUnownedSchema(CultNetUnownedSchemaException ex) =>
             new CultNetErrorMessage
             {
-                Error = $"unowned_schema: {ex.Message}",
+                Error = "unowned_schema: no shard owns the schema and key",
                 Code = "unowned_schema",
                 Details = new CultNetErrorDetails { Field = "schemaId", Value = ex.SchemaId }
             };
@@ -579,6 +587,13 @@ namespace GameCult.Networking
                 Details = new CultNetErrorDetails { Field = field }
             };
 
+        /// <summary>
+        /// The refusal of a frame that does not read, or whose write names nothing (write-receipt.md, Fixed texts):
+        /// <c>message_invalid</c>, details <c>{ field: "message" }</c>, and the one fixed text. A decoder's own text never reaches the wire.
+        /// </summary>
+        public static CultNetErrorMessage ForUnreadableMessage() =>
+            ForMessageInvalid("message", "the message could not be read");
+
         /// <summary>
         /// Builds the wire error for a cursor refusal (R-N): code <c>cursor_stale</c> with details
         /// <c>{ asOf, current }</c>, or code <c>cursor_invalid</c> with no details.
@@ -621,6 +636,80 @@ namespace GameCult.Networking
             };
     }
 
+    /// <summary>
+    /// <c>cultnet.error.v1</c> (contracts/cultnet/interop/write-receipt.md): the v0 error plus <see cref="MessageId"/>,
+    /// the id of the request it answers. Sent only to a connection that declared the write-receipt capability.
+    /// </summary>
+    [MessagePackObject]
+    public class CultNetErrorV1Message : ICultNetSchemaMessage
+    {
+        /// <summary>Gets or sets the schema version.</summary>
+        [Key("schemaVersion")] public string SchemaVersion { get; set; } = CultNetSchemaVersions.ErrorV1;
+        /// <summary>Gets or sets the error.</summary>
+        [Key("error")] public string Error { get; set; } = string.Empty;
+        /// <summary>Gets or sets optional shard routing details for authority failures.</summary>
+        [Key("routingHint")] public CultNetShardRoutingHint? RoutingHint { get; set; }
+        /// <summary>Gets or sets the machine-readable refusal code (the v0 enum).</summary>
+        [Key("code")] public string? Code { get; set; }
+        /// <summary>Gets or sets the code-specific structured detail.</summary>
+        [Key("details")] public CultNetErrorDetails? Details { get; set; }
+        /// <summary>Gets or sets the id of the request this answers; null only when no id could be read.</summary>
+        [Key("messageId")] public string? MessageId { get; set; }
+
+        /// <summary>Builds the v1 form of <paramref name="error"/> answering <paramref name="messageId"/>.</summary>
+        public static CultNetErrorV1Message From(CultNetErrorMessage error, string? messageId)
+        {
+            if (error == null) throw new ArgumentNullException(nameof(error));
+            return new CultNetErrorV1Message
+            {
+                Error = error.Error,
+                RoutingHint = error.RoutingHint,
+                Code = error.Code,
+                Details = error.Details,
+                MessageId = string.IsNullOrEmpty(messageId) ? null : messageId
+            };
+        }
+
+        /// <summary>
+        /// The refusal of a write a session has no room to remember (write-receipt.md, rule 5): code <c>limit_reached</c>,
+        /// details present and all nil. Exists only as error.v1; v0 has no such code.
+        /// </summary>
+        public static CultNetErrorV1Message LimitReached(string? messageId) => new CultNetErrorV1Message
+        {
+            Error = "limit_reached: the session's remembered-write limit is full",
+            Code = "limit_reached",
+            Details = new CultNetErrorDetails(),
+            MessageId = string.IsNullOrEmpty(messageId) ? null : messageId
+        };
+
+        /// <summary>Gets the v0 form, dropping the id.</summary>
+        public CultNetErrorMessage ToV0() => new CultNetErrorMessage
+        {
+            Error = Error,
+            RoutingHint = RoutingHint,
+            Code = Code,
+            Details = Details
+        };
+    }
+
+    /// <summary>
+    /// <c>cultnet.write_admitted.v0</c>: the receipt for one admitted put or delete, sent after its commit point.
+    /// </summary>
+    [MessagePackObject]
+    public class CultNetWriteAdmittedMessage : ICultNetSchemaMessage
+    {
+        /// <summary>Gets or sets the schema version.</summary>
+        [Key("schemaVersion")] public string SchemaVersion { get; set; } = CultNetSchemaVersions.WriteAdmitted;
+        /// <summary>Gets or sets the messageId of the admitted write, echoed.</summary>
+        [Key("messageId")] public string MessageId { get; set; } = string.Empty;
+        /// <summary>Gets or sets <c>put</c> or <c>delete</c>.</summary>
+        [Key("operation")] public string Operation { get; set; } = string.Empty;
+        /// <summary>Gets or sets the schemaId of the admitted write, echoed.</summary>
+        [Key("schemaId")] public string SchemaId { get; set; } = string.Empty;
+        /// <summary>Gets or sets the recordKey of the admitted write, echoed.</summary>
+        [Key("recordKey")] public string RecordKey { get; set; } = string.Empty;
+    }
+
     /// <summary>
     /// Code-specific structured detail carried on <see cref="CultNetErrorMessage"/> (R-N). Fields are
     /// populated only for the code that defines them; every field is otherwise omitted (nil on the wire).

src/GameCult.Networking/CultNetShardWriteForwarding.cs

@@ -10,12 +10,16 @@ namespace GameCult.Networking
     public interface ICultNetShardWriteForwarder
     {
         /// <summary>
-        /// Forwards a raw document put to the shard owner.
+        /// Forwards a raw document put to the shard owner. Completes only when the owner answered that it admitted the write;
+        /// throws <see cref="CultNetWriteRefusedException"/> when it refused, <see cref="CultNetWriteNotSentException"/> when
+        /// nothing could have reached it (the only failure after which the id may be forwarded again), and any other exception
+        /// when the frame may have gone out and was not answered (unconfirmed, including <see cref="CultNetWriteUnconfirmedException"/>). The server relays to the original peer exactly what the owner answered.
         /// </summary>
         Task ForwardPutAsync(CultNetShardDescriptor shard, CultNetDocumentPutRawMessage message);
 
         /// <summary>
-        /// Forwards a raw document delete to the shard owner.
+        /// Forwards a raw document delete to the shard owner; completes, refuses and goes unconfirmed as
+        /// <see cref="ForwardPutAsync"/> does.
         /// </summary>
         Task ForwardDeleteAsync(CultNetShardDescriptor shard, CultNetDocumentDeleteMessage message);
     }
@@ -68,6 +72,14 @@ namespace GameCult.Networking
         /// rudp:// endpoints use the C# RUDP schema client and cultnet:// endpoints use LiteNetLib.
         /// </summary>
         public Func<ICultNetSchemaClient>? CreateClient { get; set; }
+
+        /// <summary>
+        /// Gets or sets how long the primary has to answer a forwarded write (from the send). Its receipt completes the forward,
+        /// its refusal fails it with <see cref="CultNetWriteRefusedException"/>, and silence fails it with
+        /// <see cref="CultNetWriteUnconfirmedException"/>. Defaults to <see cref="CultNetWriteCompletion.ReceiptResultWindow"/>; a
+        /// primary that predates write receipts never answers, so forwarding to one is unconfirmed after this window.
+        /// </summary>
+        public TimeSpan ResultWindow { get; set; } = CultNetWriteCompletion.ReceiptResultWindow;
     }
 
     /// <summary>
@@ -85,24 +97,30 @@ namespace GameCult.Networking
             _options = options ?? new CultNetSchemaWriteForwarderOptions();
         }
 
-        /// <inheritdoc />
+        /// <summary>
+        /// Forwards a put under its original message id and completes on the primary's result frame: a receipt returns, a refusal
+        /// throws <see cref="CultNetWriteRefusedException"/> and silence throws <see cref="CultNetWriteUnconfirmedException"/>.
+        /// </summary>
         public async Task ForwardPutAsync(CultNetShardDescriptor shard, CultNetDocumentPutRawMessage message)
         {
             if (message == null) throw new ArgumentNullException(nameof(message));
-            var endpoint = ResolvePrimaryEndpoint(shard);
+            if (shard == null) throw new ArgumentNullException(nameof(shard));
             message.ShardId ??= shard.ShardId;
             message.ShardEpoch ??= shard.Epoch;
-            await SendAsync(endpoint, message).ConfigureAwait(false);
+            await SendAsync(shard, message, message.MessageId).ConfigureAwait(false);
         }
 
-        /// <inheritdoc />
+        /// <summary>
+        /// Forwards a delete under its original message id; completes, refuses and goes unconfirmed as
+        /// <see cref="ForwardPutAsync"/> does.
+        /// </summary>
         public async Task ForwardDeleteAsync(CultNetShardDescriptor shard, CultNetDocumentDeleteMessage message)
         {
             if (message == null) throw new ArgumentNullException(nameof(message));
-            var endpoint = ResolvePrimaryEndpoint(shard);
+            if (shard == null) throw new ArgumentNullException(nameof(shard));
             message.ShardId ??= shard.ShardId;
             message.ShardEpoch ??= shard.Epoch;
-            await SendAsync(endpoint, message).ConfigureAwait(false);
+            await SendAsync(shard, message, message.MessageId).ConfigureAwait(false);
         }
 
         /// <summary>
@@ -126,13 +144,51 @@ namespace GameCult.Networking
             return (uri.Host, uri.IsDefaultPort ? 3075 : uri.Port);
         }
 
-        private async Task SendAsync<T>(string endpoint, T message) where T : ICultNetSchemaMessage
+        // The write frame has not been handed to the transport until this returns: any failure here is CultNetWriteNotSentException,
+        // the one failure the caller may retry under the same id.
+        private async Task<ICultNetSchemaClient> ConnectBeforeSendAsync(CultNetShardDescriptor shard, string messageId)
         {
-            var (host, port) = ParseEndpoint(endpoint);
+            ICultNetSchemaClient? client = null;
-            using var client = CreateClient(endpoint);
+            try
-            client.Connect(host, port);
+            {
-            await WaitForConnectionAsync(client, endpoint).ConfigureAwait(false);
+                var endpoint = ResolvePrimaryEndpoint(shard);
-            client.SendCultNet(message);
+                var (host, port) = ParseEndpoint(endpoint);
+                client = CreateClient(endpoint);
+                client.Connect(host, port);
+                await WaitForConnectionAsync(client, endpoint).ConfigureAwait(false);
+                // The hello comes first on the ordered schema channel: it opts this connection in to the primary's receipts.
+                client.SendCultNet(new CultNetHelloMessage
+                {
+                    RuntimeId = "gamecult-networking-shard-forwarder",
+                    RuntimeKind = "dotnet",
+                    SupportedMessageVersions = [CultNetSchemaVersions.WriteAdmitted, CultNetSchemaVersions.ErrorV1]
+                });
+                return client;
+            }
+            catch (Exception failure)
+            {
+                client?.Dispose();
+                if (failure is CultNetWriteNotSentException) throw;
+                throw new CultNetWriteNotSentException(messageId, failure);
+            }
+        }
+
+        private async Task SendAsync<T>(CultNetShardDescriptor shard, T message, string messageId) where T : ICultNetSchemaMessage
+        {
+            using var client = await ConnectBeforeSendAsync(shard, messageId).ConfigureAwait(false);
+            // From the write's send on, every failure (timeout, reset, silence, an exception from the send itself) propagates as it
+            // is: the frame may have gone out, so the caller treats it as unconfirmed.
+            await CultNetWriteCompletion.SendAndAwaitReceiptAsync(
+                (admitted, refuse, refuseV1) =>
+                {
+                    client.OnCultNet(admitted);
+                    client.OnCultNet(refuse);
+                    client.OnCultNet(refuseV1);
+                    return null;
+                },
+                () => client.SendCultNet(message),
+                messageId,
+                _options.ResultWindow).ConfigureAwait(false);
         }
 
         private ICultNetSchemaClient CreateClient(string endpoint)

src/GameCult.Networking/CultNetTransport.cs

@@ -2759,6 +2759,11 @@ namespace GameCult.Networking
         // under SessionGate by whichever thread's send found the failure; the polling thread reads
         // it when it retires the peer.
         internal byte[]? UnsendableReason { get; set; }
+
+        // Set once the peer's capped frame has been answered: the session ends with this reason when the
+        // peer has acknowledged every answer, or at the deadline. Under SessionGate.
+        internal byte[]? EndingReason { get; set; }
+        internal long EndingDeadlineMs { get; set; }
     }
 
     /// <summary>
@@ -2928,6 +2933,7 @@ namespace GameCult.Networking
         public bool TryReceiveOnce(out CultNetRudpSocketServerFrame? delivered)
         {
             RetireUnsendablePeers();
+            EndAnsweredPeers();
             if (_deliveredFrames.Count > 0)
             {
                 delivered = _deliveredFrames.Dequeue();
@@ -3146,6 +3152,7 @@ namespace GameCult.Networking
         public void PollResends()
         {
             RetireUnsendablePeers();
+            EndAnsweredPeers();
             if (_socket.Poll(0, SelectMode.SelectRead))
                 return;
             foreach (var peer in _peers.Values.ToArray())
@@ -3244,6 +3251,44 @@ namespace GameCult.Networking
             return true;
         }
 
+        // Polling thread only. The application answered a peer's capped frame: the answer is reliable, so a
+        // lost datagram is resent, and the session ends with `reason` once the peer has acknowledged every
+        // answer or `graceMs` have passed (EndAnsweredPeers). Frames of the peer still queued are not delivered.
+        internal void EndPeerSessionWhenAnswered(CultNetRudpSocketServerPeer peer, byte[] reason, long graceMs)
+        {
+            if (peer == null) throw new ArgumentNullException(nameof(peer));
+            if (reason == null) throw new ArgumentNullException(nameof(reason));
+            lock (peer.SessionGate)
+            {
+                if (peer.Session.Ended || peer.EndingReason != null)
+                    return;
+                peer.EndingReason = reason;
+                peer.EndingDeadlineMs = NowMs() + graceMs;
+            }
+            var kept = _deliveredFrames.Where(frame => !ReferenceEquals(frame.Peer, peer)).ToArray();
+            _deliveredFrames.Clear();
+            foreach (var frame in kept)
+                _deliveredFrames.Enqueue(frame);
+        }
+
+        // Polling thread only.
+        private void EndAnsweredPeers()
+        {
+            foreach (var peer in _peers.Values.ToArray())
+            {
+                byte[]? reason;
+                lock (peer.SessionGate)
+                {
+                    reason = peer.EndingReason != null
+                        && (peer.Session.OutstandingReliablePacketCount == 0 || NowMs() >= peer.EndingDeadlineMs)
+                        ? peer.EndingReason
+                        : null;
+                }
+                if (reason != null)
+                    EndPeerSession(peer, reason);
+            }
+        }
+
         // Polling thread only. A peer a new Connect already replaced was reported then, and its key now
         // names the peer that replaced it.
         private void RetireUnsendablePeers()
@@ -3488,7 +3533,8 @@ namespace GameCult.Networking
     /// </summary>
     public sealed class LiteNetLibTransportConnection
     {
-        private readonly NetPeer? _peer;
+        private readonly Action<byte[]>? _deliver;
+        private readonly Action? _end;
         private readonly CultNetTransportStats _stats = new CultNetTransportStats();
 
         /// <summary>
@@ -3496,10 +3542,99 @@ namespace GameCult.Networking
         /// </summary>
         public LiteNetLibTransportConnection(NetPeer peer, CultNetTransportProfile? profile = null)
         {
-            _peer = peer ?? throw new ArgumentNullException(nameof(peer));
+            if (peer == null) throw new ArgumentNullException(nameof(peer));
+            _deliver = payload => peer.Send(payload, DeliveryMethod.ReliableOrdered);
+            _end = peer.Disconnect;
             Profile = profile ?? CultNetTransportProfiles.CreateLiteNetLib("csharp-litenetlib-peer");
         }
 
+        // The mock point for what leaves the connection: the peer's reliable ordered send.
+        internal LiteNetLibTransportConnection(Action<byte[]> deliver, Action? end = null)
+        {
+            _deliver = deliver ?? throw new ArgumentNullException(nameof(deliver));
+            _end = end;
+            Profile = CultNetTransportProfiles.CreateLiteNetLib("csharp-litenetlib-peer");
+        }
+
+        /// <summary>
+        /// Ends the connection. A write that can be neither answered nor refused is answered by this goodbye: the peer sees
+        /// its session end and settles the write as unconfirmed (<c>session_ended</c>), never as silence.
+        /// </summary>
+        internal void End() => _end?.Invoke();
+
+        /// <summary>
+        /// Answers a schema frame that did not decode with a <c>message_invalid</c> error.v1 naming its id when it holds one;
+        /// when that answer cannot be sent the connection ends instead.
+        /// </summary>
+        internal void AnswerUnreadableSchemaFrame(byte[] payload)
+        {
+            try
+            {
+                SendSchema(CultNetErrorV1Message.From(
+                    CultNetErrorMessage.ForUnreadableMessage(),
+                    CultNetReadableMessageId.From(payload)));
+            }
+            catch (Exception)
+            {
+                End();
+            }
+        }
+
+        /// <summary>
+        /// A put or delete that arrived on an unreliable or sequenced channel of a receipt session (write-receipt.md, Reliable channel only):
+        /// answered <c>message_invalid</c>, details <c>channel</c>, fixed text, carrying the write's id, and not applied. True when
+        /// the frame was such a write and has been answered here.
+        /// </summary>
+        internal bool RefuseUnreliableWrite(ICultNetSchemaMessage message, DeliveryMethod method)
+        {
+            if (WriteReceipts == null) return false;
+            if (method is DeliveryMethod.ReliableOrdered or DeliveryMethod.ReliableUnordered) return false;
+            var messageId = message switch
+            {
+                CultNetDocumentPutRawMessage put => put.MessageId,
+                CultNetDocumentDeleteMessage delete => delete.MessageId,
+                _ => null
+            };
+            if (messageId == null && message is not (CultNetDocumentPutRawMessage or CultNetDocumentDeleteMessage)) return false;
+            try
+            {
+                SendSchema(CultNetErrorV1Message.From(
+                    CultNetErrorMessage.ForMessageInvalid("channel", "receipt sessions require the reliable channel"), messageId));
+            }
+            catch (Exception)
+            {
+                End();
+            }
+
+            return true;
+        }
+
+        private readonly object _writeFramingGate = new();
+        private bool _writeFramingSettled;
+
+        /// <summary>
+        /// The write-receipt state of a connection that opted in (write-receipt.md); null for every other connection, which is
+        /// answered exactly as before.
+        /// </summary>
+        internal CultNetWriteReceiptSession? WriteReceipts { get; private set; }
+
+        /// <summary>
+        /// Decides this connection's write framing once: by its first hello, or by its first write if no hello came first. A
+        /// later hello changes nothing. The capability changes framing only; it never authorizes. Returns true when this call
+        /// opted the connection in.
+        /// </summary>
+        internal bool SettleWriteFraming(CultNetHelloMessage? hello)
+        {
+            lock (_writeFramingGate)
+            {
+                if (_writeFramingSettled) return false;
+                _writeFramingSettled = true;
+                if (hello == null || !CultNetWriteReceiptCapability.Declares(hello)) return false;
+                WriteReceipts = new CultNetWriteReceiptSession();
+                return true;
+            }
+        }
+
         /// <summary>
         /// Initializes a receive-only channel-aware adapter for LiteNetLib payload classification.
         /// </summary>
@@ -3535,14 +3670,14 @@ namespace GameCult.Networking
         public void Send(string channelId, byte[] payload)
         {
             if (payload == null) throw new ArgumentNullException(nameof(payload));
-            if (_peer == null) throw new InvalidOperationException("A LiteNetLib peer is required to send through this transport.");
+            if (_deliver == null) throw new InvalidOperationException("A LiteNetLib peer is required to send through this transport.");
             if (!string.Equals(channelId, "schema", StringComparison.Ordinal)
                 && !string.Equals(channelId, "legacy", StringComparison.Ordinal))
             {
                 throw new InvalidOperationException($"litenetlib transport only supports schema and legacy channels, got \"{channelId}\".");
             }
 
-            _peer.Send(payload, DeliveryMethod.ReliableOrdered);
+            _deliver(payload);
             _stats.BytesSent += payload.Length;
             _stats.FramesSent++;
         }

src/GameCult.Networking/CultNetWriteCompletion.cs

@@ -0,0 +1,141 @@
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace GameCult.Networking
+{
+    /// <summary>
+    /// A peer refused a write: the typed <c>cultnet.error.v0</c> it answered with.
+    /// </summary>
+    public sealed class CultNetWriteRefusedException : Exception
+    {
+        /// <summary>Creates the exception from the refusal frame.</summary>
+        public CultNetWriteRefusedException(CultNetErrorMessage refusal)
+            : base(refusal?.Error ?? throw new ArgumentNullException(nameof(refusal)))
+        {
+            Code = refusal.Code;
+            Refusal = refusal;
+        }
+
+        /// <summary>Gets the machine-readable refusal code, e.g. <c>write_not_authorized</c> or <c>message_invalid</c>.</summary>
+        public string? Code { get; }
+
+        /// <summary>Gets the refusal frame as received.</summary>
+        public CultNetErrorMessage Refusal { get; }
+    }
+
+    /// <summary>
+    /// A write nothing answered within its window: neither admitted nor refused (write-receipt.md, "unconfirmed").
+    /// </summary>
+    public sealed class CultNetWriteUnconfirmedException : Exception
+    {
+        /// <summary>Creates the exception for the write <paramref name="messageId"/>.</summary>
+        public CultNetWriteUnconfirmedException(string messageId)
+            : base($"No admission or refusal arrived for write '{messageId}'.")
+        {
+            MessageId = messageId;
+        }
+
+        /// <summary>Gets the id of the unconfirmed write.</summary>
+        public string MessageId { get; }
+    }
+
+    /// <summary>
+    /// A forwarded write that provably never left this process: the connection failed, or the send failed before any byte was
+    /// written. It is the only forwarding failure after which the same id may be forwarded again. A send port that cannot prove
+    /// nothing was written must not throw this; every other failure of a forward is unconfirmed.
+    /// </summary>
+    public sealed class CultNetWriteNotSentException : Exception
+    {
+        /// <summary>Creates the exception for the write <paramref name="messageId"/>; <paramref name="cause"/> is for logs only.</summary>
+        public CultNetWriteNotSentException(string messageId, Exception? cause = null)
+            : base($"Write '{messageId}' was not sent.", cause)
+        {
+            MessageId = messageId;
+        }
+
+        /// <summary>Gets the id of the write that was not sent.</summary>
+        public string MessageId { get; }
+    }
+
+    /// <summary>
+    /// Completes a write on the peer's result frame, never on a send's return or a transport acknowledgement:
+    /// an ack proves delivery, not admission.
+    /// </summary>
+    public static class CultNetWriteCompletion
+    {
+        /// <summary>How long after a send a refusal may still arrive when the caller names no window.</summary>
+        public static readonly TimeSpan DefaultResultWindow = TimeSpan.FromMilliseconds(500);
+
+        /// <summary>How long a receipt-capable peer has to answer a write (write-receipt.md, <c>RECEIPT_RESULT_WINDOW_MS</c>).</summary>
+        public static readonly TimeSpan ReceiptResultWindow = TimeSpan.FromMilliseconds(5000);
+
+        /// <summary>
+        /// Sends one write to a receipt-capable peer and waits <paramref name="resultWindow"/> for its answer: a
+        /// <c>write_admitted</c> naming <paramref name="messageId"/> returns, an <c>error.v1</c> naming it throws
+        /// <see cref="CultNetWriteRefusedException"/>, and an id-less error (v0, or v1 with no id) is attributed to this write
+        /// because it is the only one in flight on the connection. Silence throws <see cref="CultNetWriteUnconfirmedException"/>.
+        /// </summary>
+        public static async Task SendAndAwaitReceiptAsync(
+            Func<Action<CultNetWriteAdmittedMessage>, Action<CultNetErrorMessage>, Action<CultNetErrorV1Message>, IDisposable?> subscribe,
+            Action send,
+            string messageId,
+            TimeSpan resultWindow,
+            CancellationToken cancellationToken = default)
+        {
+            if (subscribe == null) throw new ArgumentNullException(nameof(subscribe));
+            if (send == null) throw new ArgumentNullException(nameof(send));
+            var answer = new TaskCompletionSource<CultNetErrorMessage?>(TaskCreationOptions.RunContinuationsAsynchronously);
+            using var registration = subscribe(
+                admitted =>
+                {
+                    if (string.Equals(admitted.MessageId, messageId, StringComparison.Ordinal)) answer.TrySetResult(null);
+                },
+                error => answer.TrySetResult(error),
+                error =>
+                {
+                    if (error.MessageId == null || string.Equals(error.MessageId, messageId, StringComparison.Ordinal))
+                        answer.TrySetResult(error.ToV0());
+                });
+            send();
+            var window = Task.Delay(resultWindow, cancellationToken);
+            await Task.WhenAny(answer.Task, window).ConfigureAwait(false);
+            if (!answer.Task.IsCompleted)
+            {
+                await window.ConfigureAwait(false);
+                throw new CultNetWriteUnconfirmedException(messageId);
+            }
+
+            var refusal = await answer.Task.ConfigureAwait(false);
+            if (refusal != null) throw new CultNetWriteRefusedException(refusal);
+        }
+
+        /// <summary>
+        /// Sends one write and waits <paramref name="resultWindow"/> for the peer's answer. A refusal frame rejects with
+        /// <see cref="CultNetWriteRefusedException"/> whatever its order against the transport acknowledgement. A peer
+        /// that admits a write sends no success frame, so the end of the window is the interim bound on a refusal
+        /// (until peers send one); the error frame carries no message id, so any refusal inside the window is this
+        /// write's.
+        /// </summary>
+        /// <param name="subscribe">Registers the refusal handler and returns its registration; called before the send.</param>
+        /// <param name="send">Sends the write.</param>
+        /// <param name="resultWindow">How long a refusal may take to arrive.</param>
+        /// <param name="cancellationToken">Cancels the wait.</param>
+        public static async Task SendAndAwaitResultAsync(
+            Func<Action<CultNetErrorMessage>, IDisposable?> subscribe,
+            Action send,
+            TimeSpan resultWindow,
+            CancellationToken cancellationToken = default)
+        {
+            if (subscribe == null) throw new ArgumentNullException(nameof(subscribe));
+            if (send == null) throw new ArgumentNullException(nameof(send));
+            var refused = new TaskCompletionSource<CultNetErrorMessage>(TaskCreationOptions.RunContinuationsAsynchronously);
+            using var registration = subscribe(error => refused.TrySetResult(error));
+            send();
+            var window = Task.Delay(resultWindow, cancellationToken);
+            await Task.WhenAny(refused.Task, window).ConfigureAwait(false);
+            if (refused.Task.IsCompleted) throw new CultNetWriteRefusedException(await refused.Task.ConfigureAwait(false));
+            await window.ConfigureAwait(false);
+        }
+    }
+}

src/GameCult.Networking/CultNetWriteReceipts.cs

@@ -0,0 +1,396 @@
+using System;
+using System.Collections.Generic;
+using System.Security.Cryptography;
+using GameCult.Caching;
+using MessagePack;
+
+namespace GameCult.Networking
+{
+    /// <summary>
+    /// The content hash a write-receipt server binds to a (peer, messageId) dedupe key
+    /// (contracts/cultnet/interop/write-receipt.md, rule 5).
+    /// </summary>
+    public static class CultNetWriteContentHash
+    {
+        /// <summary>
+        /// SHA-256 of the MessagePack array <c>[operation, schemaId, recordKey, payload]</c>, <c>payload</c> a <c>bin</c>
+        /// for a put and nil for a delete.
+        /// </summary>
+        public static byte[] Compute(string operation, string schemaId, string recordKey, byte[]? payload)
+        {
+            var buffer = new System.Buffers.ArrayBufferWriter<byte>();
+            var writer = new MessagePackWriter(buffer);
+            writer.WriteArrayHeader(4);
+            writer.Write(operation);
+            writer.Write(schemaId);
+            writer.Write(recordKey);
+            if (payload == null) writer.WriteNil();
+            else writer.Write(payload);
+            writer.Flush();
+            using var sha = SHA256.Create();
+            return sha.ComputeHash(buffer.WrittenSpan.ToArray());
+        }
+    }
+
+    /// <summary>
+    /// Whether a peer's hello opted in to write receipts: it lists both <c>cultnet.write_admitted.v0</c> and
+    /// <c>cultnet.error.v1</c>. The capability changes framing only; it never authorizes.
+    /// </summary>
+    internal static class CultNetWriteReceiptCapability
+    {
+        public static bool Declares(CultNetHelloMessage hello)
+        {
+            var versions = hello.SupportedMessageVersions;
+            return versions != null
+                   && Array.IndexOf(versions, CultNetSchemaVersions.WriteAdmitted) >= 0
+                   && Array.IndexOf(versions, CultNetSchemaVersions.ErrorV1) >= 0;
+        }
+    }
+
+    /// <summary>A SHA-256 digest held by value: the fixed-size stand-in for an id or a content hash.</summary>
+    internal readonly struct CultNetDigest : IEquatable<CultNetDigest>
+    {
+        private readonly ulong _a, _b, _c, _d;
+
+        private CultNetDigest(ulong a, ulong b, ulong c, ulong d) { _a = a; _b = b; _c = c; _d = d; }
+
+        public static CultNetDigest Of(byte[] bytes)
+        {
+            using var sha = SHA256.Create();
+            var hash = sha.ComputeHash(bytes);
+            return new CultNetDigest(
+                BitConverter.ToUInt64(hash, 0), BitConverter.ToUInt64(hash, 8),
+                BitConverter.ToUInt64(hash, 16), BitConverter.ToUInt64(hash, 24));
+        }
+
+        public bool Equals(CultNetDigest other) => _a == other._a && _b == other._b && _c == other._c && _d == other._d;
+        public override bool Equals(object? obj) => obj is CultNetDigest other && Equals(other);
+        public override int GetHashCode() => unchecked((int)_a ^ (int)(_a >> 32));
+        public static bool operator ==(CultNetDigest left, CultNetDigest right) => left.Equals(right);
+        public static bool operator !=(CultNetDigest left, CultNetDigest right) => !left.Equals(right);
+    }
+
+    /// <summary>
+    /// What a session keeps of a refusal (write-receipt.md, What is remembered): its code, the field its details name, and its
+    /// routing hint (a shard descriptor the server owns). Never the write's strings or an authority's reason: the replay is built
+    /// from fixed text and the fields of the resend, which carries the same content.
+    /// </summary>
+    internal readonly struct CultNetRememberedRefusal
+    {
+        public string? Code { get; }
+        public bool HasDetails { get; }
+        public string? Field { get; }
+        public CultNetShardRoutingHint? Hint { get; }
+
+        public CultNetRememberedRefusal(string? code, bool hasDetails, string? field, CultNetShardRoutingHint? hint)
+        {
+            Code = code; HasDetails = hasDetails; Field = field; Hint = hint;
+        }
+
+        public static CultNetRememberedRefusal Of(CultNetErrorMessage error) =>
+            new(error.Code, error.Details != null, error.Details?.Field, error.RoutingHint);
+
+        private static string? NullIfEmpty(string value) => value.Length == 0 ? null : value;
+
+        /// <summary>The refusal, in fixed text, naming the write's own record key or schema id where its details do.</summary>
+        public CultNetErrorMessage ToError(string schemaId, string recordKey) => new()
+        {
+            Error = Code switch
+            {
+                "unowned_schema" => "unowned_schema: no shard owns the schema and key",
+                null => Hint != null ? CultNetDatabaseServer.RoutingRefusalText : CultNetWriteReceiptSession.WriteFailedText,
+                _ => Code
+            },
+            Code = Code,
+            RoutingHint = Hint,
+            Details = HasDetails
+                ? new CultNetErrorDetails
+                {
+                    Field = Field,
+                    Value = Field switch { "recordKey" => NullIfEmpty(recordKey), "schemaId" => NullIfEmpty(schemaId), _ => null }
+                }
+                : null
+        };
+    }
+
+    /// <summary>
+    /// One receipt-capable peer's writes: message id to content hash and the answer given, refusals included, so a resend of the
+    /// same content is answered again without being decided again and the same id with other content is refused. Ids and content
+    /// hashes are held as fixed-size digests; the answer is held as its kind (and, for a refusal, its code and the field its details name),
+    /// never the strings of the write.
+    /// </summary>
+    internal sealed class CultNetWriteReceiptSession
+    {
+        /// <summary>The most writes a peer is remembered for, refused ones included; a peer at the limit has new writes refused.</summary>
+        internal const int MaxRememberedWrites = 1024;
+
+        /// <summary>The most ids refused at the limit that are remembered, so their resend is judged the same way.</summary>
+        internal const int MaxRememberedLimitRefusals = 1024;
+
+        /// <summary>The longest messageId a write may carry, in UTF-8 bytes (write-receipt.md, Id size).</summary>
+        internal const int MaxMessageIdBytes = 256;
+
+        /// <summary>What a write is refused with when it failed for a reason no typed refusal names. Never an exception's own text.</summary>
+        internal const string WriteFailedText = "the write could not be applied";
+
+        private readonly object _gate = new();
+        private readonly Dictionary<CultNetDigest, Entry> _writes = new();
+        private readonly Dictionary<CultNetDigest, CultNetDigest> _limitRefusals = new();
+
+        private sealed class Entry
+        {
+            public Entry(CultNetDigest hash) { Hash = hash; }
+            public CultNetDigest Hash { get; set; }
+            public bool Abandoned { get; set; }
+            public bool Admitted { get; set; }
+            public CultNetRememberedRefusal? Refusal { get; set; }
+        }
+
+        public enum Begin { New, ReplayAdmitted, ReplayRefusal, Unanswered, DifferentContent, Full }
+
+        private static CultNetDigest IdDigest(string messageId) => CultNetDigest.Of(System.Text.Encoding.UTF8.GetBytes(messageId));
+
+        /// <summary>
+        /// Looks <paramref name="messageId"/> up first. An id not seen is claimed for this content (<see cref="Begin.New"/>);
+        /// otherwise the outcome says what already holds it, and <paramref name="refusal"/> is the refusal to repeat.
+        /// </summary>
+        public Begin TryBegin(string messageId, byte[] hash, out CultNetRememberedRefusal? refusal)
+        {
+            var id = IdDigest(messageId);
+            var content = CultNetDigest.Of(hash);
+            lock (_gate)
+            {
+                refusal = null;
+                if (_writes.TryGetValue(id, out var entry))
+                {
+                    if (entry.Abandoned)
+                    {
+                        // Not sent, so judged afresh in the slot it already holds; no slot is ever freed.
+                        entry.Abandoned = false;
+                        entry.Hash = content;
+                        return Begin.New;
+                    }
+
+                    if (entry.Hash != content) return Begin.DifferentContent;
+                    if (entry.Admitted) return Begin.ReplayAdmitted;
+                    if (entry.Refusal != null)
+                    {
+                        refusal = entry.Refusal;
+                        return Begin.ReplayRefusal;
+                    }
+
+                    // No answer yet: the first attempt is still being applied, or its primary left it unanswered for good.
+                    return Begin.Unanswered;
+                }
+
+                if (_writes.Count >= MaxRememberedWrites)
+                {
+                    if (_limitRefusals.TryGetValue(id, out var refused)) return refused == content ? Begin.Full : Begin.DifferentContent;
+                    if (_limitRefusals.Count < MaxRememberedLimitRefusals) _limitRefusals[id] = content;
+                    return Begin.Full;
+                }
+
+                _writes[id] = new Entry(content);
+                return Begin.New;
+            }
+        }
+
+        /// <summary>The write was admitted: remember it so a resend repeats the receipt.</summary>
+        public void Admitted(string messageId)
+        {
+            lock (_gate)
+            {
+                if (_writes.TryGetValue(IdDigest(messageId), out var entry)) entry.Admitted = true;
+            }
+        }
+
+        /// <summary>The write was refused: remember the refusal so a resend repeats it.</summary>
+        public void Refused(string messageId, CultNetRememberedRefusal refusal)
+        {
+            lock (_gate)
+            {
+                if (_writes.TryGetValue(IdDigest(messageId), out var entry)) entry.Refusal = refusal;
+            }
+        }
+
+        /// <summary>
+        /// The write never reached anyone who could have applied it: a repeat is judged afresh. The entry keeps its slot, so
+        /// forgetting a write never makes room for an id that was refused at the limit.
+        /// </summary>
+        public void Abandoned(string messageId)
+        {
+            lock (_gate)
+            {
+                if (_writes.TryGetValue(IdDigest(messageId), out var entry)) entry.Abandoned = true;
+            }
+        }
+    }
+
+    /// <summary>
+    /// The messageId of a schema frame that does not decode (write-receipt.md, rule 3: a refusal carries the write's id whenever
+    /// the frame is readable enough to find it).
+    /// </summary>
+    internal static class CultNetReadableMessageId
+    {
+        /// <summary>The frame's top-level string <c>messageId</c>, or null when the bytes are not a map holding one.</summary>
+        public static string? From(byte[] payload)
+        {
+            try
+            {
+                var reader = new MessagePackReader(payload);
+                var entries = reader.ReadMapHeader();
+                for (var index = 0; index < entries; index++)
+                {
+                    var key = reader.NextMessagePackType == MessagePackType.String ? reader.ReadString() : null;
+                    if (key == "messageId" && reader.NextMessagePackType == MessagePackType.String)
+                    {
+                        var id = reader.ReadString();
+                        return string.IsNullOrEmpty(id) ? null : id;
+                    }
+
+                    if (key == null) reader.Skip();
+                    reader.Skip();
+                }
+            }
+            catch (Exception)
+            {
+                // Not a readable map: no id.
+            }
+
+            return null;
+        }
+    }
+
+    /// <summary>
+    /// One write on a receipt-capable connection: its dedupe claim and its single answer (write-receipt.md, rules 1 to 5).
+    /// </summary>
+    internal sealed class CultNetReceiptedWrite
+    {
+        private readonly CultNetWriteReceiptSession _session;
+        private readonly Action<ICultNetSchemaMessage> _send;
+        private readonly string _operation;
+        private readonly string _messageId;
+        private readonly string _schemaId;
+        private readonly string _recordKey;
+        private readonly byte[]? _payload;
+        private bool _claimed;
+        private bool _answered;
+
+        public CultNetReceiptedWrite(
+            CultNetWriteReceiptSession session,
+            Action<ICultNetSchemaMessage> send,
+            string operation,
+            string? messageId,
+            string? schemaId,
+            string? recordKey,
+            byte[]? payload)
+        {
+            _session = session;
+            _send = send;
+            _operation = operation;
+            _messageId = messageId ?? string.Empty;
+            _schemaId = schemaId ?? string.Empty;
+            _recordKey = recordKey ?? string.Empty;
+            _payload = payload;
+        }
+
+        /// <summary>
+        /// Looks the write's id up before anything else is decided (rule 5). True when the id is new and the write should go on
+        /// to authorization and the commit; false when it was answered here (a replay, a reused id, a full table) or is owed no
+        /// further answer (still in flight, or left silent by its primary).
+        /// </summary>
+        public bool Begin()
+        {
+            var outcome = _session.TryBegin(_messageId, CultNetWriteContentHash.Compute(_operation, _schemaId, _recordKey, _payload), out var refusal);
+            switch (outcome)
+            {
+                case CultNetWriteReceiptSession.Begin.New:
+                    _claimed = true;
+                    return true;
+                case CultNetWriteReceiptSession.Begin.ReplayAdmitted:
+                    _answered = true;
+                    _send(AdmittedReceipt());
+                    return false;
+                case CultNetWriteReceiptSession.Begin.ReplayRefusal:
+                    _answered = true;
+                    _send(CultNetErrorV1Message.From(refusal!.Value.ToError(_schemaId, _recordKey), _messageId));
+                    return false;
+                case CultNetWriteReceiptSession.Begin.Unanswered:
+                    // The first attempt is still being applied and will answer this id, or its primary left it unanswered:
+                    // then the claim stays, so the id is never sent again on this session, and the write stays unconfirmed.
+                    _answered = true;
+                    return false;
+                case CultNetWriteReceiptSession.Begin.DifferentContent:
+                    Refused(CultNetErrorMessage.ForMessageInvalid("messageId", "the message id was already used for different content"));
+                    return false;
+                default:
+                    _answered = true;
+                    _send(CultNetErrorV1Message.LimitReached(_messageId));
+                    return false;
+            }
+        }
+
+        private CultNetWriteAdmittedMessage AdmittedReceipt() => new()
+        {
+            MessageId = _messageId,
+            Operation = _operation,
+            SchemaId = _schemaId,
+            RecordKey = _recordKey
+        };
+
+        /// <summary>The write committed: remember the receipt and send it.</summary>
+        public void Admitted()
+        {
+            if (_answered) return;
+            _answered = true;
+            if (_claimed) _session.Admitted(_messageId);
+            _send(AdmittedReceipt());
+        }
+
+        /// <summary>The write was refused: remember the refusal (a resend repeats it) and send its one error.v1.</summary>
+        public void Refused(CultNetErrorMessage error)
+        {
+            if (_answered) return;
+            _answered = true;
+            if (_claimed)
+            {
+                // A remembered refusal is answered from what is remembered, so the replay is the refusal again.
+                var kept = CultNetRememberedRefusal.Of(error);
+                _session.Refused(_messageId, kept);
+                error = kept.ToError(_schemaId, _recordKey);
+            }
+
+            _send(CultNetErrorV1Message.From(error, _messageId));
+        }
+
+        /// <summary>
+        /// A forward that may have reached its primary and is unconfirmed (silence, reset, timeout, an ambiguous send): no answer is
+        /// owed or possible, and the claim stays so the id is never forwarded again on this session. Sends nothing.
+        /// </summary>
+        public void LeftSilent()
+        {
+            if (_answered) return;
+            _answered = true;
+        }
+
+        /// <summary>A forward that was provably not sent (connect failed, or the send failed before any byte was written): forget the claim, send nothing.</summary>
+        public void NotSent()
+        {
+            if (_answered) return;
+            _answered = true;
+            if (_claimed) _session.Abandoned(_messageId);
+            _claimed = false;
+        }
+
+        /// <summary>
+        /// Why the write's id cannot be used at all, before anything is remembered: it is missing (refused with no id) or longer
+        /// than <see cref="CultNetWriteReceiptSession.MaxMessageIdBytes"/> UTF-8 bytes. Null when the id is usable.
+        /// </summary>
+        public CultNetErrorMessage? IdRefusal =>
+            _messageId.Length == 0
+                ? CultNetErrorMessage.ForMessageInvalid("messageId", "a write needs a messageId")
+                : System.Text.Encoding.UTF8.GetByteCount(_messageId) > CultNetWriteReceiptSession.MaxMessageIdBytes
+                    ? CultNetErrorMessage.ForMessageInvalid("messageId", "messageId exceeds 256 bytes")
+                    : null;
+    }
+}

src/GameCult.Networking/Server.cs

@@ -23,7 +23,7 @@ namespace GameCult.Networking
         private const string EmailPattern =
             @"^([0-9a-zA-Z]([\+\-_\.][0-9a-zA-Z]+)*)+@(([0-9a-zA-Z][-\w]*[0-9a-zA-Z]*\.)+[a-zA-Z0-9]{2,17})$";
         private const string UsernamePattern = @"^[A-Za-z0-9]+(?:[ _-][A-Za-z0-9]+)*$";
-        private const int ServerPort = 3075;
+        private const int DefaultPort = 3075;
         private const float SessionTimeoutSeconds = 1800; // 30 minutes
         private const float SessionRefreshThresholdSeconds = 300; // 5 minutes
         private const int MaxConnectionAttemptsPerMinute = 30;
@@ -63,6 +63,12 @@ namespace GameCult.Networking
         /// </summary>
         public bool LogSensitivePayloads { get; set; }
 
+        /// <summary>
+        /// Gets or sets the UDP port <see cref="Start"/> binds (default 3075; 0 asks the OS for a free one). After
+        /// <see cref="Start"/> it holds the port actually bound.
+        /// </summary>
+        public int Port { get; set; } = DefaultPort;
+
         private float Time => (float)(_timer?.Elapsed.TotalSeconds ?? 0d);
 
         /// <summary>
@@ -74,7 +80,7 @@ namespace GameCult.Networking
             {
                 TransportId = "litenetlib-server",
                 Host = "0.0.0.0",
-                Port = ServerPort
+                Port = Port
             });
 
         /// <summary>
@@ -357,7 +363,8 @@ namespace GameCult.Networking
                 UnsyncedEvents = true,
                 NatPunchEnabled = true
             };
-            _netManager.Start(ServerPort);
+            _netManager.Start(Port);
+            Port = _netManager.LocalPort;
 
             listener.NetworkErrorEvent += (point, code) => Logger.LogInfo($"{point.Address}: Error {code}");
 
@@ -408,11 +415,25 @@ namespace GameCult.Networking
                     {
                         var cultNetMessage = LiteNetLibTransportConnection.DecodeSchema(frame);
                         Logger.LogDebug($"Received CultNet schema message {cultNetMessage.SchemaVersion}");
+                        if (transport.RefuseUnreliableWrite(cultNetMessage, method)) return;
                         await HandleCultNetSchemaMessageAsync(peer, user, cultNetMessage).ConfigureAwait(false);
                         return;
                     }
 
-                    var message = LiteNetLibTransportConnection.DecodeLegacy(frame);
+                    Message message;
+                    try
+                    {
+                        message = LiteNetLibTransportConnection.DecodeLegacy(frame);
+                    }
+                    catch (Exception ex) when (transport.WriteReceipts != null)
+                    {
+                        // A frame that decodes on neither channel is classed legacy, so this is where an unreadable frame lands.
+                        // A receipt-capable peer is told which frame was unreadable (by its id, if the frame still holds one).
+                        Logger.LogWarning($"CultNet frame unreadable: {ex.Message}");
+                        transport.AnswerUnreadableSchemaFrame(frame.Payload);
+                        return;
+                    }
+
                     if (LogSensitivePayloads)
                     {
                         Logger.LogDebug($"Received message: {MessagePackSerializer.ConvertToJson(new ReadOnlyMemory<byte>(frame.Payload))}");
@@ -507,7 +528,7 @@ namespace GameCult.Networking
                 }
             });
 
-            Logger.LogInfo($"Server started on port {ServerPort}.");
+            Logger.LogInfo($"Server started on port {Port}.");
         }
 
         private async Task HandleCultNetSchemaMessageAsync(NetPeer peer, User user, ICultNetSchemaMessage message)

tests/GameCult.Mesh.Tests/CultMeshClientTests.cs

@@ -291,6 +291,51 @@ public sealed class CultMeshClientTests
         submitted.Document.SourceRole.Should().Be("pilot");
     }
 
+    [TestCase("write_not_authorized", 0)]
+    [TestCase("message_invalid", 0)]
+    [TestCase("write_not_authorized", 150)]
+    public async Task SubmitDocument_ARefusalRejectsWithTheTypedError_WhateverItsOrderAgainstTheSend(string code, int delayMs)
+    {
+        var connector = new DocumentConnector
+        {
+            RefuseSubmissionsWith = code,
+            RefusalDelay = TimeSpan.FromMilliseconds(delayMs)
+        };
+        using var mesh = new CultMeshClient(new CultMeshClientOptions
+        {
+            RendezvousEndpoints = new[] { "rudp://odin:3076" },
+            Discovery = new CultMeshVerseDiscoveryClientOptions { CreateClient = () => new RendezvousClient() },
+            Sessions = CultMeshTestTrust.LocalSessions,
+            Connectors = new[] { connector }
+        });
+        var request = new ClientTestDocument { Id = "command:1", Text = "move" };
+
+        var act = () => mesh.SubmitDocumentAsync(Target, request.Id, request, "pilot-one", "pilot");
+
+        (await act.Should().ThrowAsync<CultNetWriteRefusedException>()).Which.Code.Should().Be(code);
+    }
+
+    [Test]
+    public async Task SubmitDocument_CompletesOnlyAfterTheResultWindow_NotOnTheSendReturning()
+    {
+        var connector = new DocumentConnector();
+        using var mesh = new CultMeshClient(new CultMeshClientOptions
+        {
+            RendezvousEndpoints = new[] { "rudp://odin:3076" },
+            Discovery = new CultMeshVerseDiscoveryClientOptions { CreateClient = () => new RendezvousClient() },
+            Sessions = CultMeshTestTrust.LocalSessions,
+            Connectors = new[] { connector },
+            SubmitResultWindow = TimeSpan.FromMilliseconds(400)
+        });
+        var request = new ClientTestDocument { Id = "command:1", Text = "move" };
+        await mesh.ConnectAsync(Target, CultMeshProtocols.Documents);
+        var started = DateTime.UtcNow;
+
+        await mesh.SubmitDocumentAsync(Target, request.Id, request, "pilot-one", "pilot");
+
+        (DateTime.UtcNow - started).Should().BeGreaterThanOrEqualTo(TimeSpan.FromMilliseconds(380));
+    }
+
     [Test]
     public async Task InvokeOperation_CorrelatesProviderReceiptThroughStableIdentitySession()
     {
@@ -496,6 +541,8 @@ public sealed class CultMeshClientTests
         public bool SuppressFirstSnapshot { get; set; }
         public bool SuppressFirstSubscriptionSnapshot { get; set; }
         public bool RejectOperations { get; set; }
+        public string? RefuseSubmissionsWith { get; set; }
+        public TimeSpan RefusalDelay { get; set; }
         public bool FailFirstOperationBeforeResponse { get; set; }
         public string ResponseSourceRuntimeId { get; set; } = "aetheria-daemon";
         public string ConnectorId => "document-test";
@@ -515,6 +562,8 @@ public sealed class CultMeshClientTests
                 rejectOperations: RejectOperations,
                 failOperationBeforeResponse: FailFirstOperationBeforeResponse && Clients.Count == 0,
                 responseSourceRuntimeId: ResponseSourceRuntimeId);
+            client.RefuseSubmissionsWith = RefuseSubmissionsWith;
+            client.RefusalDelay = RefusalDelay;
             Clients.Add(client);
             return Task.FromResult<ICultNetSchemaClient>(client);
         }
@@ -522,6 +571,9 @@ public sealed class CultMeshClientTests
 
     private sealed class DocumentClient : ICultNetSchemaClient, ICultNetSchemaClientHealth, ICultMeshVerifiedSchemaClient
     {
+        private readonly List<Action<CultNetErrorMessage>> _errors = new();
+        public string? RefuseSubmissionsWith { get; set; }
+        public TimeSpan RefusalDelay { get; set; }
         private readonly List<Action<CultNetSnapshotResponseRawMessage>> _snapshots = new();
         private readonly List<Action<CultNetOperationResponseMessage>> _operationResponses = new();
         private readonly CultNetDocumentRegistry _documents;
@@ -558,6 +610,15 @@ public sealed class CultMeshClientTests
             if (message is CultNetDocumentPutRawMessage submitted)
             {
                 Submitted.Add(submitted);
+                if (RefuseSubmissionsWith != null)
+                {
+                    var refusal = new CultNetErrorMessage { Error = "not allowed", Code = RefuseSubmissionsWith };
+                    // A refusal that follows the send's return (and any transport ack) must still reject the submit.
+                    Task.Delay(RefusalDelay).ContinueWith(_ =>
+                    {
+                        foreach (var handler in _errors.ToArray()) handler(refusal);
+                    });
+                }
                 return;
             }
             if (message is CultNetOperationRequestMessage operation)
@@ -642,6 +703,8 @@ public sealed class CultMeshClientTests
                 _snapshots.Add(response => callback((T)(object)response));
             if (typeof(T) == typeof(CultNetOperationResponseMessage))
                 _operationResponses.Add(response => callback((T)(object)response));
+            if (typeof(T) == typeof(CultNetErrorMessage))
+                _errors.Add(error => callback((T)(object)error));
         }
         public void Dispose() { }
         public void Fail(Exception error) => _failure.TrySetResult(error);

tests/GameCult.Networking.InteropPeer/Program.cs

@@ -25,7 +25,7 @@ static async Task<int> ProgramMainAsync(string[] args)
     {
         if (args.Length == 0)
         {
-            throw new InvalidOperationException("Expected mode: serve | probe | dial | rudp-serve-once | rudp-dial-once | rudp-serve-message-once | rudp-dial-message-once | quic-realtime-serve");
+            throw new InvalidOperationException("Expected mode: serve | probe | dial | rudp-serve-once | rudp-dial-once | rudp-serve-message-once | rudp-dial-message-once | quic-realtime-serve | receipt-serve | receipt-relay");
         }
 
         var mode = args[0];
@@ -53,6 +53,12 @@ static async Task<int> ProgramMainAsync(string[] args)
             case "rudp-dial-message-once":
                 RudpDialMessageOnce(options);
                 return 0;
+            case "receipt-serve":
+                await GameCult.Networking.InteropPeer.ReceiptHarness.ServeAsync();
+                return 0;
+            case "receipt-relay":
+                await GameCult.Networking.InteropPeer.ReceiptHarness.RelayAsync(int.Parse(options["port"], CultureInfo.InvariantCulture));
+                return 0;
             case "quic-realtime-serve":
                 await QuicRealtimeServeAsync(ParseQuicRealtimeServeConfig(options));
                 return 0;

tests/GameCult.Networking.InteropPeer/ReceiptHarness.cs

@@ -0,0 +1,120 @@
+using System;
+using System.IO;
+using System.Text.Json;
+using System.Threading;
+using System.Threading.Tasks;
+using GameCult.Caching;
+using GameCult.Networking;
+using LiteNetLib;
+using R3;
+
+// The real C# receipt server (CultNetDatabaseServer on Server) and the one transport shim the TypeScript client needs to reach it,
+// for the cross-runtime write-receipt interop harness (packages/cultmesh-ts/test/interop/write-receipt-interop.test.ts).
+// TypeScript has no LiteNetLib client, so the shim moves bytes and nothing else: each CultNet frame is a LiteNetLib reliable
+// ordered payload, and on the pipe it is a 4-byte big-endian length followed by the frame.
+namespace GameCult.Networking.InteropPeer
+{
+    // CompatibleSchemaIds are the names the spec's blankFields vectors admit (U+200B, U+001C, and a name padded with NBSP and EM SPACE):
+    // a name is any string that is not blank, so the store must hold a record put under one of them.
+    [CultDocument("receipt.interop_note", ReceiptHarness.SchemaId, CompatibleSchemaIds = ["\u200b", "\u001c", "\u00a0a\u2003"])]
+    [MessagePack.MessagePackObject]
+    public sealed class ReceiptInteropNote
+    {
+        [MessagePack.Key(0)]
+        public string Text { get; set; } = string.Empty;
+    }
+
+    internal static class ReceiptHarness
+    {
+        public const string SchemaId = "receipt.interop_note.v1";
+        public const string ShardId = "receipt-interop-shard";
+        // A record key with this prefix is refused by the authority: how the harness asks for a refused write.
+        public const string RefusedPrefix = "refuse:";
+
+        private sealed class Authority : ICultNetRemoteWriteAuthority
+        {
+            public CultNetRemoteWriteDecision Decide(CultNetRemoteWriteRequest request) =>
+                request.RecordKey.ToString().StartsWith(RefusedPrefix, StringComparison.Ordinal)
+                    ? CultNetRemoteWriteDecision.Refuse("denied")
+                    : CultNetRemoteWriteDecision.Grant();
+        }
+
+        private static void Emit(object fact)
+        {
+            lock (Console.Out) Console.Out.WriteLine(JsonSerializer.Serialize(fact));
+        }
+
+        // stdout: {"event":"listening","port":N} then {"event":"applied"|"removed","recordKey":"..."} per committed change; runs until stdin closes.
+        public static async Task ServeAsync()
+        {
+            var cache = new CultCache();
+            var database = new CultNetDatabase(cache, new CultNetDatabaseOptions
+            {
+                Shards = [new CultNetShardDescriptor(ShardId, "primary", epoch: 1, isPrimary: true, schemaIds: [SchemaId])]
+            });
+            using var server = new Server(cache, ServerSecurityOptions.Development()) { Port = 0 };
+            using var databaseServer = new CultNetDatabaseServer(server, database, new CultNetDatabaseServerOptions
+            {
+                RemoteWriteAuthority = new Authority()
+            });
+            using var watch = cache.Watch<ReceiptInteropNote>().Subscribe(change =>
+                Emit(new { @event = change.Kind == CultCacheDocumentChangeKind.Removed ? "removed" : "applied", recordKey = change.Key.ToString() }));
+            server.Start();
+            Emit(new { @event = "listening", port = server.Port, shardId = ShardId, schemaId = SchemaId });
+            await Task.Run(() => Console.In.ReadToEnd());
+        }
+
+        // Connects to the server on `port` and relays frames between stdin/stdout and the connection; exits when either ends.
+        public static async Task RelayAsync(int port)
+        {
+            var listener = new EventBasedNetListener();
+            var connected = new TaskCompletionSource<bool>(TaskCreationOptions.RunContinuationsAsynchronously);
+            var ended = new TaskCompletionSource<bool>(TaskCreationOptions.RunContinuationsAsynchronously);
+            var output = Console.OpenStandardOutput();
+            var gate = new object();
+            listener.PeerConnectedEvent += _ => connected.TrySetResult(true);
+            listener.PeerDisconnectedEvent += (_, _) => ended.TrySetResult(true);
+            listener.NetworkReceiveEvent += (_, reader, _, _) =>
+            {
+                var frame = reader.GetRemainingBytes();
+                var header = new byte[] { (byte)(frame.Length >> 24), (byte)(frame.Length >> 16), (byte)(frame.Length >> 8), (byte)frame.Length };
+                lock (gate)
+                {
+                    output.Write(header);
+                    output.Write(frame);
+                    output.Flush();
+                }
+            };
+            var manager = new NetManager(listener) { UnsyncedEvents = true };
+            manager.Start(0);
+            var peer = manager.Connect("127.0.0.1", port, ServerSecurityOptions.Development().ConnectionKey);
+            if (await Task.WhenAny(connected.Task, Task.Delay(TimeSpan.FromSeconds(10))) != connected.Task)
+                throw new InvalidOperationException("the relay did not connect");
+            var input = Console.OpenStandardInput();
+            var pump = Task.Run(() =>
+            {
+                var header = new byte[4];
+                while (ReadExactly(input, header))
+                {
+                    var frame = new byte[(header[0] << 24) | (header[1] << 16) | (header[2] << 8) | header[3]];
+                    if (!ReadExactly(input, frame)) break;
+                    peer.Send(frame, DeliveryMethod.ReliableOrdered);
+                }
+            });
+            await Task.WhenAny(pump, ended.Task);
+            manager.Stop();
+        }
+
+        private static bool ReadExactly(Stream stream, byte[] buffer)
+        {
+            var read = 0;
+            while (read < buffer.Length)
+            {
+                var count = stream.Read(buffer, read, buffer.Length - read);
+                if (count <= 0) return false;
+                read += count;
+            }
+            return true;
+        }
+    }
+}

tests/GameCult.Networking.Tests/CultNetClientWriteCompletionTests.cs

@@ -0,0 +1,100 @@
+#nullable enable
+using System;
+using System.Collections.Concurrent;
+using System.Net;
+using System.Net.Sockets;
+using System.Threading;
+using System.Threading.Tasks;
+using NUnit.Framework;
+
+namespace GameCult.Networking.Tests
+{
+    /// <summary>
+    /// Heimdall's invariant: no client treats a reliable-transport ack as write admission. A put completes
+    /// only on its result frame (write_not_authorized, or the success reply). The C# schema client has no
+    /// completion call: SendCultNet returns once the put is queued, and the outcome reaches the caller only
+    /// as the result frame, through OnCultNet. These tests serve it a peer that acknowledges the put and
+    /// refuses it, the ack before the refusal and after it, and require the refusal to arrive as the outcome.
+    /// </summary>
+    public class CultNetClientWriteCompletionTests
+    {
+        private const uint ConnectionId = 0x10203197;
+
+        // Acknowledges the first reliable schema frame it receives and answers it with write_not_authorized,
+        // the second packet 150 ms after the first. The refusal carries no acknowledgement of its own.
+        private static Task RefusingPeer(Socket socket, bool refusalFirst, CancellationToken stop)
+        {
+            return Task.Run(() =>
+            {
+                var session = new CultNetRudpSession(new CultNetRudpSessionOptions { ConnectionId = ConnectionId, ResendDelayMs = 25 });
+                var buffer = new byte[65535];
+                EndPoint from = new IPEndPoint(IPAddress.Any, 0);
+                var answered = false;
+                while (!stop.IsCancellationRequested)
+                {
+                    if (!socket.Poll(10_000, SelectMode.SelectRead))
+                        continue;
+                    var received = socket.ReceiveFrom(buffer, ref from);
+                    var packet = CultNetRudpPacketCodec.Decode(buffer.AsSpan(0, received).ToArray());
+                    void Send(CultNetRudpPacket p) => socket.SendTo(CultNetRudpPacketCodec.Encode(p), from);
+                    if (packet.PacketType == CultNetRudpPacketType.Connect)
+                    {
+                        Send(session.AcceptConnect(packet));
+                        continue;
+                    }
+                    var result = session.Receive(packet, 1);
+                    if (result.Reply != null)
+                        Send(result.Reply);
+                    if (answered || result.Delivered.Count == 0)
+                        continue;
+                    answered = true;
+                    var ack = session.CreateAckForReceived(packet.Sequence);
+                    var refusal = session.Send("schema", CultNetSchemaMessageSerialization.Serialize(new CultNetErrorMessage
+                    {
+                        Error = "write_not_authorized: the catalog refused the document",
+                        Code = "write_not_authorized"
+                    }), new CultNetRudpSendOptions { Reliable = true, Ordered = true });
+                    refusal.Ack = 0;
+                    refusal.AckMask = 0;
+                    if (refusalFirst)
+                    {
+                        Send(refusal);
+                        Thread.Sleep(150);
+                        Send(ack);
+                    }
+                    else
+                    {
+                        Send(ack);
+                        Thread.Sleep(150);
+                        Send(refusal);
+                    }
+                }
+            });
+        }
+
+        [TestCase(false, TestName = "AckThenRefusal")]
+        [TestCase(true, TestName = "RefusalThenAck")]
+        public async Task ARefusedPutIsReportedRefusedWhateverTheOrderOfItsAck(bool refusalFirst)
+        {
+            using var serverSocket = new Socket(AddressFamily.InterNetwork, SocketType.Dgram, ProtocolType.Udp);
+            serverSocket.Bind(new IPEndPoint(IPAddress.Loopback, 0));
+            using var stop = new CancellationTokenSource();
+            var peer = RefusingPeer(serverSocket, refusalFirst, stop.Token);
+            using var client = new RudpCultNetSchemaClient("completion", ConnectionId);
+            var outcomes = new BlockingCollection<CultNetErrorMessage>();
+            client.OnCultNet<CultNetErrorMessage>(outcomes.Add);
+            client.Connect("127.0.0.1", ((IPEndPoint)serverSocket.LocalEndPoint!).Port);
+            var deadline = DateTime.UtcNow.AddSeconds(3);
+            while (!client.Connected && DateTime.UtcNow < deadline)
+                await Task.Delay(5);
+            Assert.That(client.Connected, "fixture: the client connected");
+
+            client.SendCultNet(new CultNetDocumentPutRawMessage { MessageId = "completion" });
+
+            Assert.That(outcomes.TryTake(out var refusal, 3000), Is.True, "the result frame reached the caller");
+            Assert.That(refusal!.Code, Is.EqualTo("write_not_authorized"));
+            stop.Cancel();
+            await peer;
+        }
+    }
+}

tests/GameCult.Networking.Tests/CultNetDocumentRegistryVariantTests.cs

@@ -418,6 +418,7 @@ namespace GameCult.Networking.Tests
                 CultNetDatabaseChangeKind.Added, VariantKey, schemaId, database.Shards[0], cache.Get<VariantWireFixture>(VariantKey)!, previousDocument: null);
             Assert.That(Deliver(databaseServer, added, selection, refused, errors), Is.Null);
             Assert.That(errors, Has.Count.EqualTo(1));
+            Assert.That(errors[0].Error, Is.EqualTo("the record is a variant CultNet cannot carry"));
 
             var removed = new CultNetDatabaseChange<VariantWireFixture>(
                 CultNetDatabaseChangeKind.Removed, VariantKey, schemaId, database.Shards[0], document: null, previousDocument: cache.Get<VariantWireFixture>(VariantKey)!);

tests/GameCult.Networking.Tests/CultNetRudpSchemaServerPeerInputTests.cs

@@ -178,6 +178,46 @@ namespace GameCult.Networking.Tests
             Assert.That(scene.Logger.Errors, Has.Count.EqualTo(1));
         }
 
+        // The RUDP schema server implements no receipt rules, so it must not advertise them (write-receipt.md, Capability and the
+        // conformance table): whatever hello it sends lists neither frame.
+        [Test]
+        public async Task TheRudpSchemaServerNeverAdvertisesTheReceiptFrames()
+        {
+            using var server = new RudpCultNetSchemaServer(new RudpCultNetSchemaServerOptions
+            {
+                RuntimeId = "csharp-rudp-no-receipts",
+                ConnectionId = ConnectionId
+            });
+            var client = await Connect(server);
+            try
+            {
+                SendSchema(server, client, CultNetSchemaMessageSerialization.Serialize(new CultNetHelloMessage
+                {
+                    RuntimeId = "receipt-client",
+                    RuntimeKind = "test",
+                    SupportedMessageVersions = [CultNetSchemaVersions.WriteAdmitted, CultNetSchemaVersions.ErrorV1]
+                }));
+                await server.PollAvailableAsync(16);
+
+                var hellos = new List<CultNetHelloMessage>();
+                foreach (var packet in Drain(client.Socket))
+                    foreach (var frame in client.Session.Receive(packet, 1).Delivered)
+                        if (CultNetSchemaMessageSerialization.Deserialize(frame.Payload) is CultNetHelloMessage hello)
+                            hellos.Add(hello);
+
+                foreach (var hello in hellos)
+                {
+                    var listed = hello.SupportedMessageVersions ?? Array.Empty<string>();
+                    Assert.That(listed, Has.None.EqualTo(CultNetSchemaVersions.WriteAdmitted));
+                    Assert.That(listed, Has.None.EqualTo(CultNetSchemaVersions.ErrorV1));
+                }
+            }
+            finally
+            {
+                client.Socket.Dispose();
+            }
+        }
+
         private static List<CultNetErrorMessage> ErrorsReceivedBy(Client client)
         {
             var errors = new List<CultNetErrorMessage>();
@@ -191,6 +231,95 @@ namespace GameCult.Networking.Tests
             return errors;
         }
 
+        // The bad peer acknowledges what it received and the server polls on.
+        private static async Task Acknowledge(Scene scene)
+        {
+            scene.Bad.Socket.SendTo(CultNetRudpPacketCodec.Encode(scene.Bad.Session.CreateAck()), scene.Server.LocalEndPoint);
+            await scene.Server.PollAvailableAsync(16);
+        }
+
+        // The bad peer has sent seven undecodable frames (BadThenGood sent the first), each answered.
+        private static async Task<Scene> AtTheCap()
+        {
+            var scene = await BadThenGood(Malformed());
+            await scene.Server.PollAvailableAsync(16);
+            ErrorsReceivedBy(scene.Bad);
+            for (var i = 0; i < 6; i++)
+            {
+                SendSchema(scene.Server, scene.Bad, Malformed());
+                await scene.Server.PollAvailableAsync(16);
+                ErrorsReceivedBy(scene.Bad);
+            }
+            Assert.That(scene.Ended, Is.Empty);
+            return scene;
+        }
+
+        // The capped frame's answer is lost on the wire: the server resends it, and the goodbye follows only
+        // once the peer has acknowledged it.
+        [Test]
+        public async Task ALostCappedAnswerIsResentAndTheGoodbyeWaitsForItsAcknowledgement()
+        {
+            using var scene = await AtTheCap();
+            SendSchema(scene.Server, scene.Bad, Malformed());
+            await scene.Server.PollAvailableAsync(16);
+
+            var lost = Drain(scene.Bad.Socket);
+            Assert.That(lost.Where(p => p.PacketType == CultNetRudpPacketType.Data), Is.Not.Empty, "fixture: the answer was sent and is lost here");
+            Assert.That(lost.Select(p => p.PacketType), Has.None.EqualTo(CultNetRudpPacketType.Disconnect), "no goodbye before the answer is acknowledged");
+            Assert.That(scene.Ended, Is.Empty);
+
+            var resent = new List<CultNetRudpPacket>();
+            for (var attempt = 0; attempt < 40 && resent.Count == 0; attempt++)
+            {
+                await Task.Delay(50);
+                scene.Server.PollResends();
+                resent = Drain(scene.Bad.Socket);
+            }
+            Assert.That(resent.Select(p => p.PacketType), Has.None.EqualTo(CultNetRudpPacketType.Disconnect), "still no goodbye");
+            var answers = new List<CultNetErrorMessage>();
+            foreach (var packet in resent)
+                foreach (var frame in scene.Bad.Session.Receive(packet, 1).Delivered)
+                    if (CultNetSchemaMessageSerialization.Deserialize(frame.Payload) is CultNetErrorMessage error)
+                        answers.Add(error);
+            Assert.That(answers.Select(e => e.Code), Is.EqualTo(new[] { "message_invalid" }), "the lost answer arrived by resend");
+            Assert.That(scene.Ended, Is.Empty);
+
+            await Acknowledge(scene);
+            Assert.That(scene.Ended, Is.EqualTo(new[] { scene.Bad.EndPoint }), "acknowledged: the session ends");
+            Assert.That(Drain(scene.Bad.Socket).Select(p => p.PacketType), Has.Some.EqualTo(CultNetRudpPacketType.Disconnect));
+        }
+
+        // A peer that never acknowledges the answer is not kept for ever: the session ends after the grace.
+        [Test]
+        public async Task ACappedSessionWhoseAnswerIsNeverAcknowledgedEndsAfterTheGrace()
+        {
+            using var scene = await AtTheCap();
+            SendSchema(scene.Server, scene.Bad, Malformed());
+            await scene.Server.PollAvailableAsync(16);
+            Drain(scene.Bad.Socket);
+
+            await Task.Delay(1500); // the grace is two seconds
+            scene.Server.PollResends();
+            Assert.That(scene.Ended, Is.Empty, "inside the grace");
+            await Task.Delay(700);
+            scene.Server.PollResends();
+            Assert.That(scene.Ended, Is.EqualTo(new[] { scene.Bad.EndPoint }), "the grace ran out");
+        }
+
+        // Nothing behind the capped frame is served while its answer is delivered.
+        [Test]
+        public async Task NothingBehindTheCappedFrameIsServed()
+        {
+            using var scene = await AtTheCap();
+            SendSchema(scene.Server, scene.Bad, Malformed());
+            SendSchema(scene.Server, scene.Bad, CultNetSchemaMessageSerialization.Serialize(
+                new CultNetShardCatalogRequestMessage { MessageId = "behind-the-cap" }));
+            await scene.Server.PollAvailableAsync(16);
+            await scene.Server.PollAvailableAsync(16);
+
+            Assert.That(scene.Served.Select(s => s.MessageId), Does.Not.Contain("behind-the-cap"));
+        }
+
         // The numbers are the shared cross-runtime cap, spelled out so changing the constant fails here.
         [Test]
         public async Task EightConsecutiveUndecodableFramesEndTheSessionAfterTheEighthIsAnswered()
@@ -221,6 +350,8 @@ namespace GameCult.Networking.Tests
 
             await Refuse(1);
             Assert.That(ErrorsReceivedBy(scene.Bad).Select(e => e.Code), Is.EqualTo(new[] { "message_invalid" }), "the eighth is answered too");
+            Assert.That(scene.Ended, Is.Empty, "the session ends once the answer is acknowledged");
+            await Acknowledge(scene);
             Assert.That(scene.Ended, Is.EqualTo(new[] { scene.Bad.EndPoint }));
             Assert.That(scene.Server.Peers.Select(peer => peer.RemoteEndPoint), Is.EqualTo(new[] { scene.Good.EndPoint }));
         }

tests/GameCult.Networking.Tests/CultNetWriteReceiptLoopbackTests.cs

@@ -0,0 +1,290 @@
+#nullable enable
+using System;
+using System.Collections.Concurrent;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using GameCult.Caching;
+using LiteNetLib;
+using NUnit.Framework;
+using static GameCult.Networking.Tests.NetworkingTests;
+
+namespace GameCult.Networking.Tests
+{
+    // The receipt server on a real socket: Server.Start on an ephemeral loopback port and real LiteNetLib clients. The
+    // handler-level tests (CultNetWriteReceiptServerTests) hand frames to the handlers; only a running server decides what
+    // a frame that does not decode is answered with.
+    public sealed class CultNetWriteReceiptLoopbackTests
+    {
+        private static readonly TimeSpan Cap = TimeSpan.FromSeconds(10);
+        private static readonly CultRecordKey KeyA = new("tests:loopback:a");
+        private static readonly CultRecordKey KeyB = new("tests:loopback:b");
+        private const string ShardId = "loopback-shard";
+
+        private sealed class Client : IDisposable
+        {
+            private readonly NetManager _manager;
+            private readonly NetPeer _peer;
+            private readonly BlockingCollection<ICultNetSchemaMessage> _received = new();
+            public int Closed;
+
+            public Client(int port, string key)
+            {
+                var listener = new EventBasedNetListener();
+                var connected = new TaskCompletionSource<bool>(TaskCreationOptions.RunContinuationsAsynchronously);
+                var decoder = new LiteNetLibTransportConnection();
+                listener.PeerConnectedEvent += _ => connected.TrySetResult(true);
+                listener.PeerDisconnectedEvent += (_, _) => Interlocked.Increment(ref Closed);
+                listener.NetworkReceiveEvent += (_, reader, _, _) =>
+                    _received.Add(LiteNetLibTransportConnection.DecodeSchema(decoder.Receive(reader.GetRemainingBytes())));
+                _manager = new NetManager(listener) { UnsyncedEvents = true };
+                _manager.Start(0);
+                _peer = _manager.Connect("127.0.0.1", port, key);
+                if (!connected.Task.Wait(Cap)) Assert.Fail("the client did not connect");
+            }
+
+            public void Send<T>(T message) where T : ICultNetSchemaMessage =>
+                _peer.Send(CultNetSchemaMessageSerialization.Serialize(message), DeliveryMethod.ReliableOrdered);
+
+            public void SendUnreliable<T>(T message) where T : ICultNetSchemaMessage =>
+                _peer.Send(CultNetSchemaMessageSerialization.Serialize(message), DeliveryMethod.Unreliable);
+
+            public void Send<T>(T message, DeliveryMethod method) where T : ICultNetSchemaMessage =>
+                _peer.Send(CultNetSchemaMessageSerialization.Serialize(message), method);
+
+            public void SendRaw(byte[] bytes) => _peer.Send(bytes, DeliveryMethod.ReliableOrdered);
+
+            public T Next<T>() where T : ICultNetSchemaMessage
+            {
+                if (!_received.TryTake(out var message, Cap)) Assert.Fail($"no {typeof(T).Name} arrived within {Cap}");
+                Assert.That(message, Is.InstanceOf<T>());
+                return (T)message!;
+            }
+
+            public void ExpectNothingMore(string because)
+            {
+                // A reliable ordered channel: anything the server sent before the probe's answer has already arrived.
+                Assert.That(_received.Count, Is.Zero, because);
+            }
+
+            public void Dispose()
+            {
+                _manager.Stop();
+                _received.Dispose();
+            }
+        }
+
+        private sealed class Authority : ICultNetRemoteWriteAuthority
+        {
+            public CultNetRemoteWriteDecision Decide(CultNetRemoteWriteRequest request) =>
+                request.RecordKey.Equals(KeyB) ? CultNetRemoteWriteDecision.Refuse("denied") : CultNetRemoteWriteDecision.Grant();
+        }
+
+        private sealed class Running : IDisposable
+        {
+            public Server Server = null!;
+            public CultCache Cache = null!;
+            public CultNetDatabase Database = null!;
+            public string SchemaId = string.Empty;
+            private CultNetDatabaseServer _databaseServer = null!;
+
+            public static Running Start()
+            {
+                var cache = new CultCache();
+                var schemaId = cache.Registry.GetRequired<NetworkSchemaNote>().SchemaId;
+                var database = new CultNetDatabase(cache, new CultNetDatabaseOptions
+                {
+                    Shards = [new CultNetShardDescriptor(ShardId, "primary", epoch: 1, isPrimary: true, schemaIds: [schemaId])]
+                });
+                var server = new Server(cache, ServerSecurityOptions.Development()) { Port = 0 };
+                var databaseServer = new CultNetDatabaseServer(server, database, new CultNetDatabaseServerOptions
+                {
+                    RemoteWriteAuthority = new Authority()
+                });
+                server.Start();
+                return new Running { Server = server, Cache = cache, Database = database, SchemaId = schemaId, _databaseServer = databaseServer };
+            }
+
+            public Client Connect() => new(Server.Port, ServerSecurityOptions.Development().ConnectionKey);
+
+            public CultNetDocumentPutRawMessage PutOf(string id, CultRecordKey key, string text)
+            {
+                var message = Database.Documents.CreateRawDocumentPutMessage(id, new CultRecordHandle<NetworkSchemaNote>(key),
+                    new NetworkSchemaNote { Schema = "tests.networking_note.v1", Text = text });
+                message.ShardId = ShardId;
+                message.ShardEpoch = 1;
+                return message;
+            }
+
+            public void Dispose()
+            {
+                _databaseServer.Dispose();
+                Server.Dispose();
+            }
+        }
+
+        private static CultNetHelloMessage HelloOf(params string[] versions) =>
+            new() { RuntimeId = "loopback-client", RuntimeKind = "test", SupportedMessageVersions = versions };
+
+        private static readonly string[] BothFrames = [CultNetSchemaVersions.WriteAdmitted, CultNetSchemaVersions.ErrorV1];
+
+        [Test]
+        public void StartBindsTheRequestedPortAndReportsTheOneBound()
+        {
+            using var running = Running.Start();
+            Assert.That(running.Server.Port, Is.Not.Zero.And.Not.EqualTo(3075));
+        }
+
+        // contracts/cultnet/interop/write-receipt-vectors.json, error_v1_unreadable_frame_has_null_message_id: code
+        // message_invalid, details.field "message", messageId null.
+        [TestCase(new byte[] { 0xC1 }, TestName = "AnUnreadableFrameFromAReceiptPeerIsAnsweredWithMessageInvalidAndNoId_NeverUsedByte")]
+        [TestCase(new byte[] { 0x92, 0x01, 0x02 }, TestName = "AnUnreadableFrameFromAReceiptPeerIsAnsweredWithMessageInvalidAndNoId_NotAMap")]
+        public void AnUnreadableFrameFromAReceiptPeerIsAnsweredWithMessageInvalidAndNoId(byte[] garbage)
+        {
+            using var running = Running.Start();
+            using var client = running.Connect();
+            client.Send(HelloOf(BothFrames));
+            client.Next<CultNetHelloMessage>();
+
+            client.SendRaw(garbage);
+
+            var error = client.Next<CultNetErrorV1Message>();
+            Assert.That(error.Code, Is.EqualTo("message_invalid"));
+            Assert.That(error.Details!.Field, Is.EqualTo("message"));
+            Assert.That(error.MessageId, Is.Null);
+        }
+
+        [Test]
+        public async Task AReceiptPeerIsStillServedAfterAnUnreadableFrameAndALegacyPeerIsAnsweredAsBefore()
+        {
+            using var running = Running.Start();
+            using var receipt = running.Connect();
+            receipt.Send(HelloOf(BothFrames));
+            receipt.Next<CultNetHelloMessage>();
+            receipt.SendRaw(new byte[] { 0xC1 });
+            receipt.Next<CultNetErrorV1Message>();
+
+            receipt.Send(running.PutOf("r1", KeyA, "one"));
+            Assert.That(receipt.Next<CultNetWriteAdmittedMessage>().MessageId, Is.EqualTo("r1"));
+
+            using var legacy = running.Connect();
+            legacy.Send(HelloOf()); // a hello that lists neither frame is answered with nothing
+            legacy.SendRaw(new byte[] { 0xC1 }); // unanswered: were it answered, error.v1 would arrive ahead of the refusal
+            legacy.Send(running.PutOf("l1", KeyB, "two"));
+            var refusal = legacy.Next<CultNetErrorMessage>();
+            Assert.That(refusal, Is.TypeOf<CultNetErrorMessage>());
+            Assert.That(refusal.Code, Is.EqualTo("write_not_authorized"));
+            legacy.Send(running.PutOf("l2", KeyA, "three"));
+            await WaitFor(() => running.Cache.Get<NetworkSchemaNote>(KeyA)?.Text == "three");
+            legacy.ExpectNothingMore("a legacy peer is never sent a receipt or error.v1");
+            Assert.That(running.Cache.Get<NetworkSchemaNote>(KeyB), Is.Null);
+        }
+
+        // write-receipt.md, Reliable channel only: a write on an unreliable channel of a receipt session is refused
+        // message_invalid, details.field "channel", fixed text, carrying the write's id; it is not applied.
+        [Test]
+        public async Task AWriteOnAnUnreliableChannelOfAReceiptPeerIsRefusedAndNotApplied()
+        {
+            using var running = Running.Start();
+            using var client = running.Connect();
+            client.Send(HelloOf(BothFrames));
+            client.Next<CultNetHelloMessage>();
+
+            client.SendUnreliable(running.PutOf("u1", KeyA, "lost"));
+
+            var error = client.Next<CultNetErrorV1Message>();
+            Assert.That(error.Code, Is.EqualTo("message_invalid"));
+            Assert.That(error.Details!.Field, Is.EqualTo("channel"));
+            Assert.That(error.Error, Is.EqualTo("message_invalid: receipt sessions require the reliable channel"));
+            Assert.That(error.MessageId, Is.EqualTo("u1"));
+
+            // The session goes on, and the same id on the reliable channel is a new write, not a replayed refusal.
+            client.Send(running.PutOf("u1", KeyA, "kept"));
+            Assert.That(client.Next<CultNetWriteAdmittedMessage>().MessageId, Is.EqualTo("u1"));
+            await WaitFor(() => running.Cache.Get<NetworkSchemaNote>(KeyA)?.Text == "kept");
+        }
+
+        // write-receipt.md, Reliable channel only: reliable and not sequenced. Reliable ordered and unordered qualify; reliable
+        // sequenced does not, and nor does any unreliable method.
+        [TestCase(DeliveryMethod.ReliableSequenced, true)]
+        [TestCase(DeliveryMethod.Sequenced, true)]
+        [TestCase(DeliveryMethod.Unreliable, true)]
+        [TestCase(DeliveryMethod.ReliableUnordered, false)]
+        [TestCase(DeliveryMethod.ReliableOrdered, false)]
+        public async Task OnlyAReliableNonSequencedChannelCarriesAWriteOfAReceiptPeer(DeliveryMethod method, bool refused)
+        {
+            using var running = Running.Start();
+            using var client = running.Connect();
+            client.Send(HelloOf(BothFrames));
+            client.Next<CultNetHelloMessage>();
+
+            client.Send(running.PutOf("c1", KeyA, "text"), method);
+
+            if (refused)
+            {
+                var error = client.Next<CultNetErrorV1Message>();
+                Assert.That(error.Details!.Field, Is.EqualTo("channel"));
+                Assert.That(error.MessageId, Is.EqualTo("c1"));
+                Assert.That(running.Cache.Get<NetworkSchemaNote>(KeyA), Is.Null);
+            }
+            else
+            {
+                Assert.That(client.Next<CultNetWriteAdmittedMessage>().MessageId, Is.EqualTo("c1"));
+                await WaitFor(() => running.Cache.Get<NetworkSchemaNote>(KeyA)?.Text == "text");
+            }
+        }
+
+        [Test]
+        public void ADeleteOnAnUnreliableChannelOfAReceiptPeerIsRefusedWithItsId()
+        {
+            using var running = Running.Start();
+            using var client = running.Connect();
+            client.Send(HelloOf(BothFrames));
+            client.Next<CultNetHelloMessage>();
+
+            client.SendUnreliable(new CultNetDocumentDeleteMessage
+            {
+                MessageId = "ud1", SchemaId = running.SchemaId, RecordKey = KeyA.Value, ShardId = ShardId, ShardEpoch = 1
+            });
+
+            var error = client.Next<CultNetErrorV1Message>();
+            Assert.That(error.Code, Is.EqualTo("message_invalid"));
+            Assert.That(error.Details!.Field, Is.EqualTo("channel"));
+            Assert.That(error.MessageId, Is.EqualTo("ud1"));
+        }
+
+        [Test]
+        public async Task OnlyWritesAreRefusedOnTheUnreliableChannelAndALegacyPeerIsLeftAsBefore()
+        {
+            using var running = Running.Start();
+            using var receipt = running.Connect();
+            receipt.Send(HelloOf(BothFrames));
+            receipt.Next<CultNetHelloMessage>();
+            receipt.SendUnreliable(HelloOf(BothFrames)); // not a write: answered with nothing on the unreliable channel
+            receipt.Send(running.PutOf("r1", KeyA, "one"));
+            Assert.That(receipt.Next<CultNetWriteAdmittedMessage>().MessageId, Is.EqualTo("r1"), "nothing else was sent ahead of the receipt");
+            receipt.Send(running.PutOf("r2", KeyA, "two"));
+            Assert.That(receipt.Next<CultNetWriteAdmittedMessage>().MessageId, Is.EqualTo("r2"));
+            receipt.ExpectNothingMore("the unreliable hello was answered with nothing");
+
+            using var legacy = running.Connect();
+            legacy.Send(HelloOf());
+            legacy.SendUnreliable(running.PutOf("l1", KeyB, "two")); // refused by the authority, answered as v0 as before
+            Assert.That(legacy.Next<CultNetErrorMessage>().Code, Is.EqualTo("write_not_authorized"));
+            legacy.SendUnreliable(running.PutOf("l2", KeyA, "three"));
+            await WaitFor(() => running.Cache.Get<NetworkSchemaNote>(KeyA)?.Text == "three");
+            legacy.ExpectNothingMore("a legacy peer is never sent a receipt, error.v1 or a channel refusal");
+        }
+
+        private static async Task WaitFor(Func<bool> condition)
+        {
+            var deadline = DateTime.UtcNow + Cap;
+            while (!condition())
+            {
+                if (DateTime.UtcNow > deadline) Assert.Fail("the condition did not hold within the cap");
+                await Task.Delay(5);
+            }
+        }
+    }
+}

tests/GameCult.Networking.Tests/NetworkingTests.cs

@@ -5189,7 +5189,9 @@ namespace GameCult.Networking.Tests
         [Test]
         public async Task CultNetSchemaWriteForwarder_Uses_SchemaClientPort()
         {
-            var fake = new CapturingSchemaClient(_ => null);
+            var fake = new CapturingSchemaClient(message => message is CultNetDocumentDeleteMessage delete
+                ? new CultNetWriteAdmittedMessage { MessageId = delete.MessageId, Operation = "delete", SchemaId = delete.SchemaId, RecordKey = delete.RecordKey }
+                : null);
             var forwarder = new CultNetSchemaWriteForwarder(new CultNetSchemaWriteForwarderOptions
             {
                 CreateClient = () => fake
@@ -5203,16 +5205,107 @@ namespace GameCult.Networking.Tests
 
             await forwarder.ForwardDeleteAsync(shard, new CultNetDocumentDeleteMessage
             {
+                MessageId = "fwd-del",
                 SchemaId = "note.v0",
                 RecordKey = "note:1"
             });
 
-            var sent = (CultNetDocumentDeleteMessage)fake.SentMessages.Single();
+            var hello = (CultNetHelloMessage)fake.SentMessages[0];
+            Assert.That(hello.SupportedMessageVersions, Is.EquivalentTo(new[] { CultNetSchemaVersions.WriteAdmitted, CultNetSchemaVersions.ErrorV1 }),
+                "the hello opts the forwarding connection in before the write");
+            var sent = (CultNetDocumentDeleteMessage)fake.SentMessages[1];
+            Assert.That(sent.MessageId, Is.EqualTo("fwd-del"), "the write goes under its original id");
             Assert.That(fake.ConnectedHost, Is.EqualTo("primary.example.test"));
             Assert.That(sent.ShardId, Is.EqualTo("notes"));
             Assert.That(sent.ShardEpoch, Is.EqualTo(3));
         }
 
+        [TestCase("write_not_authorized", 0)]
+        [TestCase("message_invalid", 0)]
+        [TestCase("write_not_authorized", 150)]
+        public void CultNetSchemaWriteForwarder_RejectsWithTheTypedRefusal_WhateverItsOrderAgainstTheSend(string code, int delayMs)
+        {
+            var fake = new CapturingSchemaClient(_ => null);
+            var forwarder = new CultNetSchemaWriteForwarder(new CultNetSchemaWriteForwarderOptions
+            {
+                CreateClient = () => fake,
+                ResultWindow = TimeSpan.FromSeconds(2)
+            });
+            var shard = new CultNetShardDescriptor(
+                "notes", "primary", 3, isPrimary: false,
+                primaryEndpoints: ["cultnet://primary.example.test:4075"]);
+            fake.OnSend = () =>
+            {
+                var refusal = new CultNetErrorMessage { Error = "refused", Code = code };
+                if (delayMs == 0) fake.Deliver(refusal);
+                else Task.Delay(delayMs).ContinueWith(_ => fake.Deliver(refusal));
+            };
+
+            var put = Assert.ThrowsAsync<CultNetWriteRefusedException>(() => forwarder.ForwardPutAsync(shard, new CultNetDocumentPutRawMessage()));
+            Assert.That(put!.Code, Is.EqualTo(code));
+            var delete = Assert.ThrowsAsync<CultNetWriteRefusedException>(() => forwarder.ForwardDeleteAsync(shard, new CultNetDocumentDeleteMessage { SchemaId = "note.v0", RecordKey = "note:1" }));
+            Assert.That(delete!.Code, Is.EqualTo(code));
+        }
+
+        [Test]
+        public void CultNetSchemaWriteForwarder_SilenceIsUnconfirmedNotSuccess()
+        {
+            var fake = new CapturingSchemaClient(_ => null);
+            var forwarder = new CultNetSchemaWriteForwarder(new CultNetSchemaWriteForwarderOptions
+            {
+                CreateClient = () => fake,
+                ResultWindow = TimeSpan.FromMilliseconds(400)
+            });
+            var shard = new CultNetShardDescriptor(
+                "notes", "primary", 3, isPrimary: false,
+                primaryEndpoints: ["cultnet://primary.example.test:4075"]);
+            var started = DateTime.UtcNow;
+
+            var unconfirmed = Assert.ThrowsAsync<CultNetWriteUnconfirmedException>(() =>
+                forwarder.ForwardDeleteAsync(shard, new CultNetDocumentDeleteMessage { MessageId = "fwd-del", SchemaId = "note.v0", RecordKey = "note:1" }));
+
+            Assert.That(unconfirmed!.MessageId, Is.EqualTo("fwd-del"));
+            Assert.That(DateTime.UtcNow - started, Is.GreaterThanOrEqualTo(TimeSpan.FromMilliseconds(380)));
+        }
+
+        [Test]
+        public void CultNetSchemaWriteForwarder_AnswersNamingAnotherWriteSettleNothing()
+        {
+            var fake = new CapturingSchemaClient(_ => null);
+            var forwarder = new CultNetSchemaWriteForwarder(new CultNetSchemaWriteForwarderOptions
+            {
+                CreateClient = () => fake,
+                ResultWindow = TimeSpan.FromMilliseconds(300)
+            });
+            var shard = new CultNetShardDescriptor(
+                "notes", "primary", 3, isPrimary: false,
+                primaryEndpoints: ["cultnet://primary.example.test:4075"]);
+            fake.OnSend = () =>
+            {
+                fake.Deliver(new CultNetWriteAdmittedMessage { MessageId = "someone-else", Operation = "delete", SchemaId = "note.v0", RecordKey = "note:1" });
+                fake.Deliver(new CultNetErrorV1Message { Error = "refused", Code = "write_not_authorized", MessageId = "someone-else" });
+            };
+
+            Assert.ThrowsAsync<CultNetWriteUnconfirmedException>(() =>
+                forwarder.ForwardDeleteAsync(shard, new CultNetDocumentDeleteMessage { MessageId = "fwd-del", SchemaId = "note.v0", RecordKey = "note:1" }));
+        }
+
+        [Test]
+        public void CultNetSchemaWriteForwarder_RejectsWithTheErrorV1NamingItsWrite()
+        {
+            var fake = new CapturingSchemaClient(_ => null);
+            var forwarder = new CultNetSchemaWriteForwarder(new CultNetSchemaWriteForwarderOptions { CreateClient = () => fake });
+            var shard = new CultNetShardDescriptor(
+                "notes", "primary", 3, isPrimary: false,
+                primaryEndpoints: ["cultnet://primary.example.test:4075"]);
+            fake.OnSend = () => fake.Deliver(new CultNetErrorV1Message { Error = "refused", Code = "write_not_authorized", MessageId = "fwd-del" });
+
+            var refused = Assert.ThrowsAsync<CultNetWriteRefusedException>(() =>
+                forwarder.ForwardDeleteAsync(shard, new CultNetDocumentDeleteMessage { MessageId = "fwd-del", SchemaId = "note.v0", RecordKey = "note:1" }));
+
+            Assert.That(refused!.Code, Is.EqualTo("write_not_authorized"));
+        }
+
         [Test]
         public void CultMeshVerseCatalog_Finds_CompatibleTransferTargets()
         {
@@ -7458,6 +7551,14 @@ namespace GameCult.Networking.Tests
                 _respond = respond;
             }
 
+            public Action? OnSend { get; set; }
+
+            public void Deliver(ICultNetSchemaMessage message)
+            {
+                if (!_handlers.TryGetValue(message.GetType(), out var handlers)) return;
+                foreach (var handler in handlers.ToArray()) handler.DynamicInvoke(message);
+            }
+
             public bool Connected { get; private set; }
             public string? ConnectedHost { get; private set; }
             public int ConnectedPort { get; private set; }
@@ -7474,6 +7575,7 @@ namespace GameCult.Networking.Tests
                 where T : ICultNetSchemaMessage
             {
                 SentMessages.Add(message);
+                OnSend?.Invoke();
                 var response = _respond(message);
                 if (response == null)
                 {