Build a break timer that speaks Intermezzo.

• Start events are normally sent 0.5 seconds ahead so all screens can schedule the same instant.
• Send a full settings map when a connection becomes ready; send changed entries after local edits.
• Convert every settings modifiedAt to local time. Per key, strictly newer wins. Unknown or invalid values are ignored without replacing the local stamp.
• Applying remote settings, sessions, schedules, or postpones must never rebroadcast the same change.
• Adopt a peer schedule only when it is in the future, your client is currently counting down, and it is earlier than yours by more than about one second.
• Send schedules on connection, foreground refresh, and local schedule changes.

The original kinds—event, timeReq, and timeResp—stop after the frozen nine fields. Every other known kind appends its kind name as field ten. session and schedule stop there.

For settings, append one field per entry sorted by setting name. Render each as name=value@modifiedAt, again with exactly six decimals:

…|responder|settings|chimeTheme=bells@1752170000.250000|workIntervalMinutes=20@1752170003.000000

Unknown kinds must be ignored, never treated as events. A missing, malformed, or incorrect tag means the entire message is dropped.

• Broadcast to every currently ready socket. There is no queue, acknowledgement, or retry.
• Duplicate delivery is normal because peers often have two sockets and Apple clients may also receive through iCloud.
• Make event handling idempotent: scheduling the same fire instant twice must be harmless.
• Drop a start only when its converted fire time plus duration is already past.
• Drop a postpone or schedule when its converted date is not in the future.
• On failure, redial after about two seconds while advertised; also reconcile on wake and about every two minutes.

The host advertises _intermezzo-pair._tcp only while its code is visible. The TXT record contains id and name. Framing is newline-delimited JSON. Pairing messages have no auth field because the shared key does not exist yet.

1. Joiner chooses sid and ephemeral scalar ya, derives the code-dependent generator, calculates Ya, and sends hello.
2. Host derives the same generator, chooses yb, calculates Yb, sends response, and derives the intermediate session key. Abort on a low-order point.
3. Joiner derives the same intermediate key and sends the confirmation value.
4. Host compares in constant time. On success it seals the 32-byte fleet key and sends key; on mismatch it sends fail. Either result burns the code.
5. Joiner opens the box, requires 32 plaintext bytes, and pins the recovered key. Opening the box authenticates the host.

Use draft-irtf-cfrg-cpace, ciphersuite CPACE-X25519-SHA512. The joiner is always initiator A, the host responder B, and transcript ordering is transcript_ir.

ISK = SHA-512(
  lv_cat(DSI_ISK, sid, K)
  || lv_cat(Ya, ADa)
  || lv_cat(Yb, ADb)
)

# HKDF-SHA256, empty salt, 32-byte output
confirm_info = "intermezzo.pair.v1.confirm.initiator"
seal_info    = "intermezzo.pair.v1.seal"

• Generate all six digits uniformly with rejection sampling and preserve leading zeroes.
• Expire after 120 seconds and stop advertising.
• Success or wrong code burns the code. Issue a fresh code after failure; stop after five failures until the host user restarts.
• QR payload: intermezzo://pair?c=482913&d=<device-id>. Never put the permanent fleet key in the QR.
• A pasted or code-paired key is pinned. Automatic cloud key merging must never replace it; a later explicit pairing may.
• There is no key rotation in v1.

Apple clients also store an unpinned key under intermezzo.sync.key.v1. If two unpinned Apple devices generated different values, the lexicographically smaller base64 text wins. Third-party clients do not need this iCloud behavior.