Know the destination
A room scope contains the full network, realm, directory and room genesis identity. Public posting requires the room’s current certified owner policy. A PUBLISH advertisement means a peer offers an intake service; it is not permission to post.
Create a fresh author/outbox
Use fresh paths. Initialization couples a new identity with one new room-scoped outbox; an existing or restored key cannot silently start its sequence over.
vhalla public activity replay-init BOOTSTRAP PIN64 JOURNAL NEW_PROFILE
vhalla public activity replay-step BOOTSTRAP PIN64 JOURNAL PROFILE
vhalla public activity init BOOTSTRAP PIN64 JOURNAL NEW_KEY_DIR NEW_OUTBOX ROOM64 --replay-profile PROFILEPROFILE is the path just created as NEW_PROFILE. Initialization saves only verified genesis. Each replay step verifies and saves at most 4,096 bundles with a cooperative 30-second budget; repeat the same step while it reports status more, then create the author after status caught-up-local-journal. JOURNAL supplies independently checked certified policy. The locally authenticated checkpoint preserves verified progress across process restarts; a peer-supplied height or snapshot cannot replace it. Reaching the observed local head does not prove global freshness or posting permission. One bounded decode or filesystem operation is not preempted by the cooperative deadline.
For an existing author, create a separate fresh profile and use activity catch-up BOOTSTRAP PIN64 JOURNAL KEY_DIR OUTBOX ROOM64 --replay-profile PROFILE before any bare replay step. It binds the retained outbox policy head before advancing. See recovery and cache adoption.
Reserve before signing
vhalla public activity queue BOOTSTRAP PIN64 JOURNAL KEY_DIR OUTBOX ROOM64 TEXT_FILE --replay-profile PROFILE
# Sign only the exact retained draft after interruption:
vhalla public activity resume BOOTSTRAP PIN64 JOURNAL KEY_DIR OUTBOX ROOM64 --replay-profile PROFILEText is bounded to 4,096 UTF-8 bytes. reserve saves an unsigned draft without signing; queue also signs it. Neither sends it. A pending draft must not be replaced just because a request or process timed out.
Retain one explicit peer
vhalla public activity peer-add BOOTSTRAP PIN64 NEW_PEER_STATE PEER64 EXACT_HTTPS_ENDPOINT AD_FILEThis command saves a fresh signed READ advertisement, its full peer key, exact endpoint and local clock floor without dialing. The separate peer-session store preserves sequence floors across restart, including newer signed route or capability withdrawals.
Deliver retained bytes
vhalla public activity send BOOTSTRAP PIN64 OUTBOX ROOM64 AUTHOR64 PEER_STATE PEER64 EXACT_HTTPS_ENDPOINTEach call refreshes the selected peer’s signed evidence and attempts at most three retained posts. It records each exact peer receipt before reporting confirmation. Retry preserves signed bytes and continues after the confirmed prefix. One peer’s receipt is not global delivery or an independent validator certificate.
Read a bounded public page
vhalla public activity read BOOTSTRAP PIN64 ROOM64 PEER_STATE PEER64 EXACT_HTTPS_ENDPOINT AFTER_CURSOR NEW_EXPORT_DIRThe export holds at most sixteen signed events plus the exact request, page and peer proof. The cursor is local to that peer. Author signatures and full scope are checked; the export is explicitly not independently admitted room history or a verified complete author chain.
The browser follows the same boundary
Select a pinned network, room, identity and HTTPS peer. Review the composer destination, reserve the draft, sign in the worker and then send from the outbox. Scope changes preserve a draft instead of silently rebinding it. A local outbox item and a peer-retained receipt are distinct states.