Class DemoRunCapability

Captures server authority once; callers cannot choose another scope at issuance.

Issues a short-lived, visitor-and-address-bound start nonce; no run or spend is admitted yet.

Consumes exactly once and reserves the remaining connected-time allowance. The host uses operationId as the prepared manager request's idempotency key. Browser retries never recover through a nonce.

Trusted preparation/recovery only, never a browser route. Binds one manager run and rotates the hash on response-loss recovery. Must run under the same host owner lock as cleanup and dispatch. The host checks the remaining stopAt deadline before scheduling; issuance never extends it.

Mediates one bounded read/delivery, including every streamed event. Call assertCurrent immediately before writing output. Never retain the binding or enqueue a send after the callback returns. Transport adapters must positively cancel blocked output before releasing their transaction.

Records revocation first; returns a receipt only when idempotent cleanup is acknowledged.

Host-authenticated page-away or admission-failure cleanup, also valid before run binding.

Recovers pending intents and enforces the captured run, control and credential deadlines.

Never serializes server dependencies or authority rows.