Take a batch of a shared session's entries
The INWARD half of publishing, served by the organisation’s home and called by a developer’s. It takes redacted entries for one share and is the only way anything of a shared session arrives here. IT IS THIS CONTRACT AND NOT A SECOND PROTOCOL. The organisation’s home is a narya host, so a publish is an operation on the contract this product already serves, authenticated by the same bearer on the same terms as every other. A caller reaches it with the publishing person’s own token: the owner recorded here is that verified actor and never a field in this body. IDEMPOTENT PER ENTRY ID. A sending home cannot tell a delivery whose answer was lost from one that never happened, so it re-offers everything it has not seen acknowledged; an entry id this share already holds is taken as already held rather than written twice. A retry after a partial failure therefore completes rather than duplicating, and it may safely re-send the whole batch. THE FIRST DELIVERY IS WHAT ANNOUNCES THE SHARE. There is no earlier registration and deliberately no second operation for one, which is why the body carries the session the entries came from and the mode the publish is in alongside them. A REVOKED SHARE IS 410 NRY-0031, TERMINALLY. Its entries were deleted at somebody’s request and the row survives only as a tombstone, so work queued before the revocation and offered after it is refused rather than accepted — a delivery that succeeded here would undo a deletion. The refusal is answered identically forever and a caller drops the work rather than retrying it. The redaction happened at the home the entries came from, which is the only place a before exists. Nothing here can widen what was sent, and nothing here is asked to.
Authorizations
Enforced on every transport, with no exempt operation. A person's request — over the default local unix socket exactly as over a TCP listener — must carry a JWT issued by the configured identity provider, which the host verifies itself against that issuer's key set: signature, issuer, expiry, and the person and organisation it names. Requests without a valid one receive 401 NRY-0011. The socket's file permissions are transport and are not an authorisation.
Path Parameters
The share's id, as SessionShare.shareId reports it: 26 characters of RFC 4648 base32 drawn from a cryptographic source, carrying no encoding of anything. It is NOT a uuid and is deliberately unrelated to the session id it was published from — a share id travels, so an id derived from a session would make every leaked link a statement about the machine it came from.
26^[A-Z2-7]{26}$Body
One batch of a shared session crossing to the organisation's home. It carries the share's own facts alongside the entries because the first delivery is what announces the share at the receiving end — there is no earlier registration and no second operation for one. What it does NOT carry is who owns the share or which organisation it belongs to: the owner is the verified actor whose token carried the request, and the organisation is the home that took it.
The session these entries came from, at the home they came from. Provenance only — no session with this id exists at the receiving end, and none is created.
Where the publish stops, so the receiving home's record is honest about whether more is coming.
once, sync The entries of this batch, in the order the conversation happened in. One batch carries everything a drain found owed rather than one entry per request: a chatty session must not become a request per token.
When this share stops, carried so the receiving home stops it by its OWN clock. The sweep that deletes these entries runs there, so a copy that arrived without this would be a conversation whose expiry depended on the publishing machine being switched on. Absent means a share with no expiry, which nothing this product publishes produces.
Who this share is for, as the publishing home holds it: the subjects of the colleagues it names, or ABSENT for the whole organisation — one spelling of "everybody here", matching the publishing home's own record. IT HAS TO TRAVEL, because the READ road is at this end. A copy that arrived without the list would be readable by every member of the organisation however narrowly the person who shared it chose, which is the one direction a targeted share must not be wrong in. It is read on the FIRST delivery, which is what announces the share here; a later batch does not re-open who a share this home already holds is for.
Response
Every entry in the batch is now held for this share — including any this home already had, which is what makes a retry safe.

