@kehto/paja 0.9.0 → 0.11.0

package/README.md

@@ -67,6 +67,34 @@ canonical failure and is not added to Paja's in-memory relay view. Paja's
 scoped-relay hook likewise waits for the backend result and returns `false`
 after denial or transport failure.
 
+## Standard identity and social-cache boundary
+
+A signed-in napplet reads Paja identity and social data only through existing
+`identity.getPublicKey`, `identity.getFollows`, and ordinary kind-0
+`outbox.query` messages. Paja exposes no social namespace, direct networking,
+or signer/key capability for this behavior.
+
+Paja privately validates the active account's replacement kind-3 contact list,
+then warms followed kind-0 profile records through its established outbox router.
+The resulting snapshot is active-account-scoped and memory-only. It is distinct
+from generic simulation cache mode; it is not napplet-owned storage and has no
+durable-cache controls. Captured-key request correlation keeps a follows request
+bound to the account that started it, while generation-safe background writes
+prevent stale-account data from becoming the active snapshot.
+
+A normal query can include matching cached `RelayEventResult` values, but Paja
+retains the base router's query-wide `incomplete` and `error` fields. A cache hit
+does not make a degraded query complete. Profile winner selection, pagination,
+follow mutation, durable-cache management, and per-author completeness are
+outside this behavior.
+
+[NAP-IDENTITY at `6461e4b37c29dc09a20dff35d9515889c4433874`](https://github.com/napplet/naps/blob/6461e4b37c29dc09a20dff35d9515889c4433874/naps/NAP-IDENTITY.md)
+is byte-identical to the recorded `napplet/naps` master document for this phase.
+Pinned [NAP-OUTBOX at `4589a8f9a16d8aa29b3740e2b3b0cdca11e0976e`](https://github.com/napplet/naps/blob/4589a8f9a16d8aa29b3740e2b3b0cdca11e0976e/naps/NAP-OUTBOX.md)
+together with installed `@napplet/nap@0.29.0` types is the PoC contract because
+current master has no NAP-OUTBOX path. Paja therefore makes no current-master
+OUTBOX conformance claim. Blossom behavior remains Phase 103 scope.
+
 The static Paja Runtime build is served at `/web/paja/` in the GitHub Pages
 artifact. It uses the same browser host and service adapters, but loads verified
 napplet HTML from pasted `naddr` or `nevent` pointers with `hmr: none`. Each
@@ -93,17 +121,16 @@ accepted only when it is an installed compatible handler and the invoking sender
 has been explicitly authorized for it. It is not a request to deliver to an
 arbitrary running frame.
 
-When Paja accepts an invocation, it first retains an immutable target delivery,
-then returns the accepted result. Only after that result can it reuse a current
-target or start a cold target. The controller waits for the target generation's
+When Paja receives an invocation, it selects and opens or reuses a verified
+target. The controller waits for the target generation's
 registered `MessageEvent.source` to establish its real `shell.ready` session;
-it checks that generation is still current and sends one target-only
-`intent.deliver`. The invoking source may be torn down after acceptance without
-changing that responsibility. A superseded target/source, failed open/readiness,
-or terminal send is handled by the controller's replacement/retry/terminal
-policy; it never turns into an INC carrier or a delivery acknowledgement.
+it checks that generation is still current, sends one target-only `inc.event`
+with the selected queryless convention, and returns the final handled target
+identity. A superseded target/source, failed open/readiness, or terminal send is
+handled by the controller's replacement/retry/terminal policy and produces a
+canonical failed `IntentResult`.
 
-`@napplet/shim@0.27.0` supplies no generic shell API. Kehto deliberately keeps
+`@napplet/shim@0.29.0` supplies no generic shell API. Kehto deliberately keeps
 its host-owned mandatory `window.napplet.shell` prelude: it installs the live
 receiver before the one bare `shell.ready`, caches the first `shell.init`, and
 provides local `ready()`, `supports()`, read-only `services`, and one-shot