Adds permissioned-space send, listen, recipient marks and history using existing identities and Habitat SAP pinned at 242714e. Only the recipient’s authenticated repository can supply a trusted mark; SAP rows remain pending until that mark is durable. Marking and history share the same record-reading helper while retaining credential locking and validation.
Stacked on reviewed spike #8; companion tests are in #10. Product tip: ac58cf9197b46db2f272495027c25e5f36791732. Configuration and reproduction: docs/SPACE-TRANSPORT.md.
Validation on b1 at combined tests tip e33910dd130bb6eb037562501ef8369d4bbebdf2: all 14 CLI tests, one spike test and both builds passed. Fresh m3simplifier0725 identities passed exact delivery, unrelated filtering, real nonmember refusal, forged-mark refusal, unmarked restart replay, idempotent durable marks, post-mark restart with fresh-message liveness, persisted SAP acknowledgement and history. No tests weakened or skipped. Nix generation 4r2nn49a1jpkm3f2y6p9m9aalnxxp906; reviewed Nix tree 9c76135.
Limits: one listener per agent, two separately supplied OAuth sessions, full scans of small spaces, and at-least-once delivery across a crash before marking. Provisioning stays outside messenger. Human merge only.