### Reconciliations and holdings records over a return path of a few bytes

- **The compact return profile** ([extensions/bearer-receipts.md](extensions/bearer-receipts.md)
  §13): a reconciliation (§5) and a holdings record ([holdings](extensions/holdings.md) §4) in a
  binary form for a return path whose messages hold few bytes. It names by reference what the
  receiver already holds: the group (8 bytes of SHA-256 over its link hash), the bearer instance
  among that group's (4 bytes over its `bearer_id`) and the signer (8 bytes over its key); it writes
  integers in LEB128 and `issued_at` as seconds. A reference that resolves to no value, or to more
  than one, is refused, never resolved by choosing. A whole reconciliation carries no bitmap and its
  root is the group's; a partial one carries its bitmap, and its root is derived from the object
  receipts the receiver holds.
- **Exact both ways.** A compact record expands, against the receiver's context, to the record's
  own bytes, a claim's canonical form or a holdings record's `WHD1`, which are then verified by
  their own text under the signature the compact record carried: the compact form states nothing of
  its own. A record has one compact form against a context. One that has none (an `issued_at` with a
  fraction or an offset, a group or instance the receiver does not hold, a `leaf_count` not the
  group's, a root its objects do not give, a hybrid claim) is refused `compact_not_encodable` and
  travels in its own form; nothing is sized by a claim's own `leaf_count` before it is found to be
  the group's.
- **Fragments.** A message is the compact record and a 4-byte check, the first bytes of SHA-256 over
  the record, cut into frames under a 3-byte header: the sender's number for the message, the index
  and the count. Reassembly places fragments by index in any order of arrival and holds a fragment
  delivered twice, byte for byte, once. It refuses a fragment malformed, foreign (another number or
  count), repeated (other data at its index) or missing, and, by the check, one reordered or mixed
  in under the same header.
- **DAP reports are never fragmented.** A task's floor is the length of its longest report; a path
  whose frame is below it carries none of the task's reports, and a sink holds them, or gives them to
  a node with a path that carries them, which uploads them unchanged. The floors of
  telemetry-aggregation's measures 1 to 4 are stated (552, 824, 2,664 and 648 bytes) and checked
  against the reports of its corpus.
- **Beside it**: jwp-receipts §2.7 and holdings §1 point to the profile, and the CI's check of each
  feature list alone checks `bearer_receipts,holdings`.
- **The corpus** [`live-conformance/compact-return/`](live-conformance/compact-return/): round trips
  of reconciliations in each signer form and over each bearer class and of holdings records,
  expansions (every form a reader takes, a changed byte refused by the record's own signature, a
  control for each reader rule of both records, references unknown and ambiguous, an instance held
  for other groups only, a holder's key under two `signer_id`s), records with no compact form,
  messages cut into frames of several sizes, and reassemblies with each defect. The reference is the
  `compact_return` module (features `bearer_receipts` and `holdings`); `compact_return_verify.py` is
  a second implementation.
