Document ephemeral Composer and asynchronous deliveryHEADmain

1 files changed, 20 insertions, 0 deletions

diff --git a/docs/FOG-MESSAGING.md b/docs/FOG-MESSAGING.md
index 69b1ffd..6ac8456 100644
--- a/docs/FOG-MESSAGING.md
+++ b/docs/FOG-MESSAGING.md
@@ -74,6 +74,19 @@ recipient. Fixed envelope size also does not hide timing, polling, retries, or
 conversation activity unless the external traffic profile supplies sufficient
 cover and scheduling.
 
+### 3.1 Asynchronous dead-drop model
+
+`fog-drop` is one cryptographic digital dead drop. `fog-mailbox` and `fog-im`
+use sequences of rotating capability-addressed dead drops in FOG-STORAGE. The
+sender and recipient do not need to be online together, and the recipient
+Composer does not connect directly to a sender or replica.
+
+A blind relay MAY transmit bounded opaque polling work prepared earlier by the
+Composer and queue opaque results for later controlled import. It cannot hold
+mailbox capability roots, derive new semantic operations, decrypt results, or
+turn relay receipt into a message acknowledgment. FOG-MESSAGING is
+asynchronous and does not promise real-time delivery.
+
 ## 4. Protocol Invariants
 
 ### MSG-INV-01: No global contact identifier
@@ -141,6 +154,13 @@ Copying Composer files, restoring a stale backup, or adding a second device
 MUST NOT create two active copies of one ratchet. Restored conversation state
 enters recovery and requires a new authenticated session.
 
+### MSG-INV-11: Ephemeral sessions do not resume
+
+A RAM-only Ephemeral Composer MUST NOT resume an identity, ratchet, voucher,
+capability sequence, deduplication window, acknowledgment stream, or pending
+delivery after shutdown. Continuing `fog-mailbox` and `fog-im` sessions require
+the Persistent Composer state contract defined by `FOG-COMPOSER`.
+
 ## 5. Contact Model
 
 ### 5.1 Pairwise identity