Runtime and ownership contract

All PAPER calls except getVersion, getModVersion, and isReady are game-thread-only. Result-returning functions use WrongThread; older bool/count queries fail closed. Do not call the provider from workers, render/physics callbacks, arbitrary destructors or static teardown.

Callback lifetime

PAPER event callbacks run on its owner thread. The callback pointer and event pointer are valid only during that call. Copy values, not pointers. FrameComplete is the coherent point for querying related frame snapshots.

Owner lifetime

Consumer registration creates an owner token tied to a provider generation. Unregistration removes callbacks, leases and authority owned by that token. World/provider resets also invalidate old generations; reconnect instead of reusing retained tokens.

Leases

Animation authority accepts zero for persistent-until-clear ownership, or a bounded frame lease up to 1200. Prefer renewable short leases for temporary coordination.

Development capture never accepts a persistent request. Its lease must be 1–1200 frames and the user's configuration remains the permission ceiling.

Cleanup

On the game thread: clear development capture and authority, unregister event callbacks, unregister the owner, then discard every retained sequence and provider-derived cache.