Document ephemeral Composer and asynchronous deliveryHEADmain

1 files changed, 19 insertions, 0 deletions

diff --git a/docs/FOG-ARCHITECTURE.md b/docs/FOG-ARCHITECTURE.md
index 9060c7c..c6ae166 100644
--- a/docs/FOG-ARCHITECTURE.md
+++ b/docs/FOG-ARCHITECTURE.md
@@ -224,6 +224,13 @@ It MUST NOT:
 modules over shared messaging and storage protocol libraries. They are not
 independent network daemons in the initial architecture.
 
+The rootless Podman `network=none` Composer remains a functional fixture, not
+a claim-bearing endpoint profile. A non-active Ephemeral Composer may keep
+bounded runtime state only in RAM for one-shot drops and explicitly
+non-resumable sessions. Continuing mailbox and conversation state requires a
+Persistent Composer vault. The MicroVM and Portable profiles retain their
+separate host and physical assumptions.
+
 Threats addressed: `TM-ENDPOINT-01`, `TM-ENDPOINT-02`, `TM-ENDPOINT-03`,
 `TM-APP-01`, `TM-CRYPTO-01`, `TM-PKI-02`.
 
@@ -678,6 +685,18 @@ to a stable global username. It MUST NOT become a durable provider mailbox.
 Exact queueing, polling, retransmission, acknowledgment, and SURB behavior is
 defined by the packet, wire, messaging, and storage specifications.
 
+The Composer MAY prepare a bounded batch of future opaque polling operations
+that the relay transmits later according to the authenticated schedule. The
+relay cannot derive replacement capability state, invent semantic polling
+operations, or decrypt returned storage results. When the prepared batch is
+exhausted, only a later Composer export can replenish it.
+
+FOG retrieval is therefore asynchronous. `fog-drop` is one cryptographic
+digital dead drop; `fog-mailbox` and `fog-im` operate over sequences of
+rotating capability-addressed dead drops. Replica persistence, relay receipt,
+Composer authenticated commit, and human reading are distinct events. No core
+component promises real-time delivery.
+
 Empty reads, hits, misses, replies, retries, and acknowledgments MUST fit the
 same declared external traffic classes. A relay MUST continue its configured
 cover and retrieval schedule independently of whether the Composer has a real