pi-daddy 0.28.0 → 0.32.1

package/contracts/experiment/v1/README.md

@@ -1,164 +0,0 @@
-# P11 fixed-profile experiment controller — partial, local implementation
-
-Existing pi-daddy API, not a service, delegate_all replacement, evaluation engine or P11 completion.
-P15 entry point: `pi-daddy/experiment`; types and pure digest/parser functions also exported at package root.
-
-## Actual boundary
-
-`createExperimentBudget` explicitly creates resource journal **4.0**. Versions1/2/3/defaults and existing
-wait-for-all delegation are unchanged. Older readers reject4.0. `reserveBatch` appends ONE synced record
-under the existing non-expiring resource lock after checking the entire batch against remaining attempts,
-input bytes and active slots. No partial optimistic per-child admission. All2..32 chartered primary/shadow /
-retry slots remain conservatively active, including queued waves/retries. No refund for skip, failure,
-cancellation, timeout or lost acknowledgement. Only original minted live permits settle slots. This is not
-aggregate CPU/memory/PID/money accounting; existing bounded profile preparation probes are separate host
-qualification, not experiment attempts.
-
-`prepareDigestProfile` still performs actual fixed native probes. An opaque prepared profile for this exact
-budget is required; JSON/profile labels cannot launch. The existing digest operation hashes at most16KiB.
-The new v4-only batch route additionally permits an explicitly declared **hold** calibration payload with
-the SAME native namespace/Node permission/prlimit/output/3s timeout/3.5s hard-deadline bounds. Hold never
-produces a successful digest; it exists for owned cancellation/deadline/lifecycle demonstrations. Neither
-operation accepts command/code/env/workspace/provider settings. The existing runDigestProfile request/byte operation stays unchanged. A post-spawn result lacking observed
-exit/signal now conservatively withholds settlement credit; an abort flag alone is not observed cancellation. Base64 argv is NOT secret transport.
-
-## Frozen charter and authority
-
-`ExperimentCharter` / strict `parseExperimentCharter`:
-
-- version `fixed-experiment-v1`, experimentId, orderId, exact budgetDigest and fixed profile
-- common `{sha256,bytes,work,workTextDigest}`; actual common bytes copied/materialized once
-- optional `work` is the actual P05 `bindWorkIntent` binding: pinned P01 file identity, exact selection and
-  priority references. Full source bytes must match workTextDigest and resolve under P01. This is a pinned
-  common-input context, NOT v3 priority scheduling, permission expansion or acceptance.
-- mode `concurrent-shadow` (exact N=2 primary+shadow) or `bounded-waves`
-- deadlineMs1000..30000; variants2..32, entire normalized charter≤48000 bytes
-- each variant: variantId, exact executionId, kind primary/shadow/retry, prior declared parentExecutionId,
-  canonical suffixBase64 and operation digest/hold. The worker hashes common bytes plus that explicit
-  suffix; these are DATA differences, not model/effort/skill differences.
-- configuration `{model:null,effort:null,skills:null}`: unknown remains unknown. Any other value or unknown
-  field refuses, not an invented delivery charter. First variant is the sole digest primary. Later parents
-  must already be declared. Execution/variant IDs are unique within this charter; global host identity and
-  approval namespaces remain host responsibilities, not inferred from names/PIDs/pathnames.
-
-Separately retained `ExperimentAuthority {authorityDigest,charterDigests,cancellationDigests}` approves exact
-whole normalized charters/cancellation requests for the independently retained budget authority. Null,
-unlisted or changed context refuses. P15 MUST establish approvals independently; never populate lists from
-incoming proposals/receipt IDs. These are trusted-host capability declarations, not remote authentication.
-
-P10 freeze/investigation6db7a67 has executionReady:false and cannot be used as a run charter. P12
-0475e1f inspection/blind fixtures are conditional, not live qualification. P13 adoption22606c2 predicates
-are not applied activation. This controller does not turn any of those flags into execution permission.
-
-## Materialization, ownership and API
-
-```ts
-// Host has independently approved the exact charter and retains the resulting physical binding.
-const binding = await createExperiment({directory, budget, charter, bytes, authority});
-const controller = openExperiment(binding, authority);
-const run = await controller.start(preparedProfile);
-const primary = await run.primary;        // does NOT await shadow, other variants, or judge
-const whole = await run.completion;       // controller-owned lifetime, including cleanup/accounting
-const snapshot = await controller.inspect();
-const readback = await controller.reconcile(); // actual bound journals/artifact bytes, read-only
-const bytes = await controller.readArtifact(executionId); // exact charter member, retained hash checked; detached
-```
-
-Creation uses a new private canonical directory, immutable common.bin, separate hash-named variant
-directories and a pinned synced experiment.jsonl header. The binding records directory/journal dev/inode,
-charter and budget identity; retain it independently. No automatic migration or overwrite. Common bytes /
-optional P01 source are checked before admission and each wave. Workers receive detached private byte
-copies and no production workspace mount, so a shadow cannot overwrite primary data or artifacts.
-
-A durable one-shot claim precedes atomic admission. An admitted journal entry precedes dispatch. The existing
-`MAX_CHILDREN_PER_CALL` cap (currently8) is imported and enforced; larger N uses complete bounded waves.
-Queued slots already count against the TOTAL budget. Explicit retries wait for their declared parent's
-terminal handling, run only on non-success, and otherwise settle cancelled-before-launch. They consume the
-pre-reserved allowance either way; no new retry IDs/variants are invented.
-
-Each actual executor result is synced to its own exclusive result.json before its digest/terminal state is
-appended to the one experiment journal. Original handles own AbortControllers and execution promises.
-`run.started` contains only original fixed-profile spawn/settled-without-spawn observations; those are
-lifecycle facts, not worker/session authority. P02 retention is still optionally used by the real profile
-execution path with exact execution/parent IDs. Resource settlement failures reject even after exit0.
-
-The controller holds all execution promises and waits for launched workers on its completion path. A
-bookkeeping failure aborts remaining owned handles, consumes unused reservations without launching and
-records unknown when possible. Whole-experiment deadline aborts the actual original handles, including
-queued attempts; per-worker native deadlines still apply. Required I/O/settlement failures are not success.
-No caller callback or boolean supplies a cancellation outcome.
-
-## Controller failure versus worker outcome (QUAL001 repair)
-
-`ExperimentView.control` is `not-assessed | failed | unknown`; it never certifies clean controller
-completion from worker states. Existing controller-unknown events now replay as explicit failure even
-when complete result records already exist. Process-local mandatory failures remain visible if recording
-fails; `controller-failure-recording-unacknowledged` is not a successful durability acknowledgement.
-Fresh readers observe retained failure records; absent a record they cannot reconstruct lost process
-state, so control remains not-assessed. Unavailable reads return unknown on settlement paths.
-
-Primary is the ORIGINAL worker/artifact outcome after successful artifact persistence, not a whole-controller
-read or bookkeeping success. It does not wait for a shadow or racing public inspection. Completion and
-boundary carry explicit control failure/unknown; factory wrappers preserve it. Failed pre-dispatch writes
-still consume original unused permits without spawning and settle started waiters. No refunds/relaunch.
-All artifact bytes and charges remain separate from required control append/sync/close/lock-release failure.
-
-## Exact owned cancellation
-
-`ExperimentCancellation {version:'experiment-cancel-v1',requestId,bindingDigest,executionId}` binds one
-immutable target. Approve `experimentCancellationDigest(request)` separately. `controller.cancel(request)`
-records the request before touching its ORIGINAL LIVE AbortController. Exact redelivery only reads back;
-conflicting request IDs refuse. The visible request outcome stays requested-or-unknown until actual result
-bytes and a terminal journal record support observed-cancelled or finished-without-cancel. A request is not
-an acknowledgement of application, and an error after append does not prove no effect.
-
-This supplies the owned fixed-profile cancellation bridge HERE. P05 dispatch-control wire cancellation,
-arbitrary live pi/Herdr atomic targeting and cross-process handle transfer are still unsupported integration
-work. No guessed PID, pane/title/idle flag, terminal typing, worker prompt or extra observer/control RPC.
-
-## Restart, unknown state and limits
-
-Reopening with the exact physical binding can inspect/reconcile actual budget records and immutable artifacts.
-Duplicate start cannot re-execute a recorded claim—even if admission, launch or acknowledgement is unknown.
-An open controller without the original handles reports uncompleted old work UNKNOWN, never idle/completed.
-No old active slot is reclaimed/refunded or silently relaunched. Missing/mismatched artifacts cannot support
-terminal success. Reconciliation is deliberately read-only: orphan permits, complete unreceipted artifacts,
-non-expiring crash locks and torn files require separately governed recovery, not guessed completion or
-truncation. A durable cancellation request without an owned handle stays unknown, not applied.
-
-The immutable input/artifact representation is not storage quota enforcement. Canonical private single-link /
-nofollow bounded files, hash-linked bounded journal, fsync and non-expiring lock defend ordinary faults;
-hostile same-UID races, rollback, blocked filesystem I/O and full-controller-crash cleanup remain unqualified.
-Limits:256KiB journal,260 lines,64 explicit cancellation requests,32 variants,16KiB per input/result read,
-fixed400-line module ceiling. Admission may conservatively reserve more slots than concurrently running
-workers. Global admission beyond this exact budget, arbitrary pi/bash/model isolation, model/effort/skill
-variants, judgments/efficacy/casting, aggregate CPU/memory/PID/money and automatic adoption remain unsupported.
-
-`ExperimentView` version experiment-view-v1 reports explicit identities, states, artifact digests backed by
-actual bytes, accounting, cancellations, diagnostics, unknown configuration, snapshot-unknown freshness and
-acceptance:not-assessed. Runtime completion is NOT approval, causality, cheapest-eligible qualification or
-routing/adoption authority. Primary and shadow are concurrent only in concurrent-shadow mode; larger waves
-are labelled bounded-waves, not a simultaneous N-way experiment or later replay masquerading as shadow.
-
-## Preserved native865 vs1316 failure: distinct repair
-
-P08's earlier failure is retained, not erased by later passes. A deterministic native test now explicitly
-captures+drains the earlier file, appends an actual SessionManager entry, then finishes: terminal+verified
-still names the earlier stable-format snapshot and coverage.complete remains false. A second ordered final
-observation+drain retains the appended bytes. No arbitrary sleeps or rerun-until-green is used to establish
-that distinction.
-
-The old governed-process oracle polled terminal/verified, which was NOT a native observation quiescence
-barrier. `drainExecutionRetention(originalStatus)` now exposes the existing admitted-observation drain through
-an original-live-status WeakMap capability. Copied/wire receipt-shaped statuses reject. The real governed
-process test uses that drain before final-byte equality, without changing capture semantics, producer
-completeness, native branch rules or asynchronous worker-control separation. Drain is not fsync, a future
-producer barrier, authentication or proof of full-session completeness. No capture-loss/completeness repair
-is claimed where the demonstrated violation was the asynchronous final-byte oracle.
-
-A separate selected-run failure exposed P01's recursive readdir oracle following an intentional self-link
-with different traversal depths. A bounded no-follow physical inventory plus positive byte-change sentinel
-replaces only that test oracle; original alias refusal and zero-mutating-call assertions remain unchanged.
-
-Local source/tests and isolated compiled paths are measurements, not installed/live qualification or full
-P11 acceptance. See ADR-0051. Stop for independent overall review and next ready P15/P17D clause.

package/contracts/factory-order/v1/README.md

@@ -1,151 +0,0 @@
-# P15 — bounded fixed-profile factory orders and applied policy changes
-
-Local supported slice, not full factory/model qualification. Public API: `pi-daddy/factory-order` and root
-exports. This compiles into the ACTUAL existing P11 controller, not a scheduler service or model planner.
-
-## Charter, intent and resource boundary
-
-`FactoryOrderCharter` / `parseFactoryOrder` / `factoryOrderDigest` bind version factory-order-v1, orderId,
-canonical new directory, exact v4 budget, P01 WorkIntentBinding and full source hash, scope digest, common
-base64 bytes, deadline1000..30000ms, current policy revision/candidate digest and1..16 nodes. Each node pins
-one exact selected P01 obligation, dependencies,1..3 named attempts, expected SHA256 and optional reserved
-product decision/owner. Every selected obligation is covered exactly once, required P01 obligation
-prerequisites cannot be omitted, cycles/missing dependencies reject. Charter≤48000 bytes, total attempts≤32,
-each expanded input≤16KiB. Scope is the exact P01 selected snapshot digest, not a pathname/logical name.
-
-Only the probed fixed digest/hold profile is supported. A candidate FixedPolicy binds a canonical byte
-suffix, acceptance-policy digest, grants:[], effects:['fixed-digest'], model:null, effort:null, skills:[].
-Other configurations/effects refuse; offline SHA work is not model/skill work. The exact frozen charter is
-independently approved by the host; a model may propose data but no model participates in eligibility,
-resource arithmetic, permission, objective outcome, product choice or activation.
-
-The compiler emits explicit **fixed-experiment-v2** with an order-schedule-v1 payload. P11 v1 semantics and
-existing delegate_all remain unchanged; old experiment readers reject v2. P01 work bytes/selection and
-permitted read effects are revalidated. P11 pre-reserves ALL node/recovery attempts and queued slots in one
-synced resource-v4 batch before any worker launch. Runtime input is common bytes + pinned policy suffix +
-explicit attempt suffix. No extra attempts, implicit grant expansion or optimistic per-child budget checks.
-Existing per-call cap bounds actual running attempts. Queued/recovery slots are conservative active charges;
-skip/failure/cancel/exhaustion never refunds cumulative use.
-
-## Actual controller API
-
-```ts
-const registry = await createFactoryRegistry({directory, authorityId, scopeDigest, baseline});
-// Privileged one-time host initialization, like budget creation; not a model/wire authority loader.
-await createFactoryOrder(registry, exactCharter, independentAuthority);
-const order = await openFactoryOrder(registry, orderId, independentAuthority);
-const before = await order.inspect();       // no models, worker writes or dispatch
-const run = await order.advance(preparedProfile);
-const boundary = await run.boundary;        // automatic eligible work drained; returns reserved decisions
-await order.decide(exactDecision, newlySuppliedHostAuthority);
-const final = await run.completion;         // owns all workers, accounting and remaining reservations
-const bytes = await order.readArtifact(exactExecutionId);
-```
-
-Objective success requires actual hash-backed P11 artifact bytes and the expected result digest under the
-frozen policy, not exit0 alone. Objective failure may consume only the next pre-reserved node attempt.
-Dependencies require satisfied predecessor nodes. A reserved decision additionally requires a full exact
-factory-decision-v1 request, independently approved digest, designated owner, current evidence digest and
-binding. Approve/reject is a recorded product choice, never inferred from stdout/model labels. Duplicate
-choices read back; conflicts, stale evidence and missing authority refuse. Decision digest covers requestId,
-bindingDigest, nodeId, evidenceDigest, authorityId and choice. Evidence identity includes policy, node,
-winning execution and artifact. No implicit decision changes or acceptance inheritance.
-
-Controller `control:failed|unknown` and diagnostics propagate through inspect/boundary/completion,
-including when later reads find complete worker results. These outcomes disable dispatch and require
-stakeholder action; retained objective artifacts are not erased. `not-assessed` does not certify the absence
-of a lost unrecorded controller failure. A primary worker result is not controller completion authority.
-
-Status returns nodes/obligation refs, objective state, next structural action, policy pin, accounting and
-explicit dispatchAuthorized. An eligible graph action is not permission when dispatchAuthorized:false.
-No provider is called; modelTransport is not-used-fixed-profile. Public inspect/reconcile are read-only and
-never wake/dispatch. Control eligibility instead takes the existing experiment lock and explicit resource
-controlSnapshot lock, avoiding a racing read-only observer snapshot as a control oracle. Required logging /
-accounting remains on the fail-closed path; optional P02 observation is still asynchronous.
-
-`order.cancel(exactExperimentCancellation, hostAuthority)` uses the ORIGINAL P11 handle and newly supplied
-exact cancellation approvals. No new reader can signal guessed PID/pane/idle state. The ordinary bounded
-profile deadline also owns queued/active lifetimes. Boundary resolves early only for a reserved decision;
-completion includes all launched work and cleanup. Storage failures after start yield explicit unknown
-rather than an unhandled background execution promise or fabricated success.
-
-### Failure/escape matrix
-
-| Observation | Deterministic action |
-| --- | --- |
-| Exact objective passes, no reserved decision | Satisfy this node under frozen order policy; dependent nodes eligible |
-| Expected objective failure | Next explicitly pre-reserved node recovery only |
-| Recovery exhausted | Stop affected branch; stakeholder action; independent nodes continue |
-| Missing/corrupt artifact or unknown old execution | Unknown branch/dependents pause; no replay/refund; independent eligible nodes may continue |
-| Reserved product decision | Return decision-required at boundary; wait for exact independent choice or deadline |
-| Rejected decision | Branch/dependents stop; independent nodes continue |
-| Scope/source/effect drift | Stakeholder/new charter; no silently broadened scope/effects |
-| Total admission exhausted | No node launch; no optimistic partial admission |
-| Shared journal/ownership/accounting failure | Fail closed, abort original owned handles, drain launched tasks, unknown if evidence cannot be retained |
-| Duplicate/restart/lost acknowledgement | Read actual pinned state; never create another attempt/materialization to guess what happened |
-
-Unused reservations settle without launching at final bounded termination; attempts/bytes remain charged.
-No generic P01 work-acceptance event is synthesized: the view keeps acceptance:not-assessed. Satisfied means
-this explicitly authorized objective/decision policy, not full task, skill, evaluation or factory acceptance.
-
-Rollback restores the exact previous activation stack, including repeated candidate digests. A restored
-nonbaseline policy retains its adoption ID, current authority/facts and expiry revalidation for new orders;
-only the original baseline has null activation. Previously recorded bug-shaped order pins with null adoption
-for a restored nonbaseline candidate now refuse replay. No silent migration or acceptance transfer.
-
-## Applied adoption, subsequent-order pins and rollback
-
-Exact pure upstream source `22606c21adb118b9ae395fe93a197609a63e05e3:packages/core/src/adoption.ts` is vendored
-unchanged in src/vendor/adoption.ts; adoption-pin.json records its hash. Its predicates are CONDITIONAL,
-not an activation service or authenticated authority. No model evaluation is performed here.
-
-FactoryAuthority is separately retained host input: id, exact order/decision/activation/migration digests,
-optional exact cancellation digests, independent P13 adoption/rollback authority and eligibility facts keyed
-uniquely by binding ID. Duplicate conflicting fact keys reject. Do not populate these lists/facts from an
-incoming proposal or a successful P11 result. This slice uses one explicitly configured host authority ID;
-remote identity/approval-service integration remains a host responsibility, not a signature claim.
-
-`openFactoryRegistry(binding).activate(request, authority)` validates the exact candidate/scope/experiment /
-assessment policy and receipt through the pinned predicates AGAIN under the existing bounded control lock.
-The whole factory-activation-v1 request is also approved, including expected current revision/candidate.
-Wrong/stale/expired/forged receipts, changed scope, false eligibility and missing authority cannot activate.
-The exact rollback candidate must be the currently active candidate. Applied change is a synced journal
-transition, not a caller boolean. New matching order creation revalidates current eligibility/expiry; all
-existing orders retain their immutable candidate/revision, intent, grants, model/effort/skill and policy pins.
-The new byte policy actually changes subsequent fixed-worker inputs/artifacts; it is not metadata-only.
-
-`registry.rollback(exactP13RollbackRequest, authority)` revalidates current active adoption/candidate/scope
-and separately approved rollback against the pinned predicate, then appends the actual restore transition.
-It returns application:applied only after required persistence. The upstream predicate's not-performed
-result is not confused with that application. Changed newer policy cannot be overwritten by stale rollback.
-Existing orders remain pinned. No automatic rollback from one failure, no grant expansion.
-
-## Explicit migration and durable receipts
-
-`migrateFactoryOrder(registry, request, authority)` requires exact factory-migration-v1 approval plus both
-source and successor order approvals. Only an UNSTARTED original P11 controller may be superseded, checked
-under its own lock—not from PID/idle/finished metadata. A durable request precedes the source's actual
-order-migrated barrier; all future starts of that source refuse. A separately materialized matching-scope
-successor receives current approved policy. The applied migration receipt lists renewed obligation refs,
-grantExpansion:false and acceptanceTransfer:none. Any original claim, including completed work, yields an
-explicit refused-active receipt; active/history-bearing migration is NOT supported. Cross-scope migration
-requires separately governed new registry/order authority, not this exception.
-
-A lost acknowledgement/partial materialization can leave pending-or-unknown and a blocked old order. Exact
-redelivery only reads; it does not repeat source migration, creation or execution. No rollback/truncation /
-lock reclamation or inference from an orphan artifact. Full-controller-crash recovery remains separate.
-
-## Persistence and qualification limits
-
-Registry is an operational policy/order-pin journal INSIDE pi-daddy, not a dashboard learning-decision store.
-New private canonical directory, pinned directory/file dev/inode, nofollow single-link bounded files,
-non-expiring lock, chained records and required sync/close/directory sync. Limits512KiB/256 records/64KiB
-record/32 pinned orders. Physical experiment materialization is validated against its earlier compiled pin.
-Readbacks check actual journals/artifacts; missing/corrupt/torn data does not silently reset state.
-
-Host initialization/declarations are conditional authority, not authentication, rollback resistance or hostile
-same-UID containment. Filesystem stalls, aggregate CPU/memory/PID/money/disk guarantees, live pi/Herdr atomic
-steering, arbitrary model/skill variants, calibrated evaluation/adoption eligibility, installed/live demos,
-active-order migration and full P15/factory acceptance remain unqualified. Existing P11/P06 bounds and P08
-pause limits remain. Native865-vs1316 original evidence and original-live observation-drain diagnosis are
-preserved; draining is not full-session completeness or fsync.

package/contracts/factory-order/v1/adoption-pin.json

@@ -1,8 +0,0 @@
-{
-  "repository": "https://github.com/mojomanyana/skill-harness",
-  "commit": "22606c21adb118b9ae395fe93a197609a63e05e3",
-  "source": "packages/core/src/adoption.ts",
-  "target": "src/vendor/adoption.ts",
-  "sha256": "dd3adae2c8283620ffc12d52baa570ba802ca96e208b0209520295a6979e9d02",
-  "meaning": "exact pure conditional predicates, not authentication or activation"
-}

package/contracts/intent-control/v1/README.md

@@ -1,135 +0,0 @@
-# P05 actual intent application adapter — contract for P08/P11/P15
-
-Local implemented continuation after reviewed 785f7e6, not yet cleared for publication or formal acceptance.
-The earlier dispatch-v1 matrix describes that earlier protocol; omitted repository adapters were not a
-permanent external blocker. This adapter performs actual P01 appends, selected-intent changes and explicit
-scheduling changes. It does not send worker messages or infer general live-pi safe boundaries.
-
-## Supported effects and exact boundaries
-
-| Action | Actual effect | Bounds |
-| --- | --- | --- |
-| revise-scope | Rebuild/validate supplied P01 revision/snapshot events with existing builders; append missing immutable events; commit exact resulting selected snapshot in controller receipt | Next scope revision and exact predecessors; same entity set, owner, scope ID, parent/dependency entity topology, exact policy refs; no permission expansion |
-| reprioritize | Persist complete explicit `{obligation, rank}` policy for exact selected obligations; real subsequent v3 reservations enforce it | No work append or selection change; lower rank first, ties by canonical full obligation reference, never incoming array order |
-| select-alternative | Validate an already recorded exact P01 snapshot and select it in the authoritative controller receipt | No append; same entity/owner/topology/policy/non-expansion checks; not a latest/last/first snapshot election |
-| busy request | Record approved request references and keep pending-or-unknown; admission barrier blocks new reservations | Application only under the existing budget lock after all original reservations settle; dispatch and intent pending requests exclude each other |
-| fixed-profile execution | Actual `runDigestProfile` reservation carries exact selection, controller revision and scheduled obligation | v3 primary, once-per-selection/obligation dispatch only; original attempt/input/concurrency charges and opaque native profile unchanged |
-
-Adding/removing entities, policy changes, topology expansion, unbound effects and v3 retry/shadow scheduling
-are outside this deliberately bounded policy, not proved impossible external primitives. v1/v2 resource
-routes retain their previous features and wire semantics. Scope revision, intent-controller revision and
-legacy dispatch revision are three different values; none is work acceptance.
-
-## One intent source; explicit v3 header
-
-`bindWorkIntent` validates actual owned regular work-v4 bytes and the exact initial selection/priorities.
-Its physical path/device/inode plus optional protected grant-ledger path are retained in an independently
-held **v3.0 resource budget binding** created with `createIntentBudget`. Work file and parent must be private,
-canonical/owned; symlinks/replacement/hardlinks/partial bytes fail. No discovery or authority file is loaded.
-The existing pinned `budget.jsonl` stores only references and operational selections/priorities, never a
-second copy of revision contents or granted permissions. Work-v4 remains the sole authoritative intent
-content. No dashboard database, mutable approval list, package install or source-store upgrade is created.
-
-No silent conversion: `createResourceBudget` remains v1.0; `createDispatchBudget` remains v2.0. Older readers
-reject v3. The existing reservation journal gains `intent-request` and `intent-apply` only under the v3
-header. It holds at most 32 intent requests/applications in addition to existing bounded records (2369
-lines / 2 MiB total). The separate work ledger keeps existing P01 byte/record bounds.
-
-## API / complete-change authorization
-
-```ts
-import { bindWorkIntent, createIntentBudget, openResourceBudget, runDigestProfile } from 'pi-daddy';
-import { parseIntentRequest } from 'pi-daddy/intent-control';
-const work = await bindWorkIntent({ path, grantLedgerPath, selection: initialSelection, priorities });
-const binding = await createIntentBudget({ directory, authorityDigest, limits }, work);
-const budget = openResourceBudget(binding);
-const controller = budget.intentControls(independentHostDeclarations); // null defaults denied
-const request = parseIntentRequest(originalRequestBytes);
-const result = await controller.request(request);
-const status = await controller.inspect(); // no lock files, writes or reconciliation
-const reconciled = await controller.reconcile(request); // complete original request, exact digest/ID
-// Existing prepared digest profile must belong to this same binding.
-if (!status.nextObligation) throw new Error('no currently admissible scheduled obligation');
-await runDigestProfile(profile, { attempt, bytes, intent: {
-  selection: status.selection, revision: status.revision, obligation: status.nextObligation
-} });
-```
-
-The caller must check a non-null next obligation and separately satisfy any applicable host workflow gates.
-P04 can consume the resulting exact `status.selection` as `workContext.selectedSnapshot`, with independently
-verified P01 acceptance authority if available. The adapter never constructs that acceptance authority.
-
-`IntentRequest` (`intent-request-v1`) binds exact resource binding digest, expected controller revision,
-expected current snapshot AND event identity, action, target selection, complete proposed event bytes and
-complete explicit priorities. Independent host declarations authorize its **whole normalized digest**,
-not just a request ID/action/target. Request metadata contains no approval field. Host declarations must be
-independently established, not mechanically copied from wire claims. The library does not authenticate a
-remote caller or confer trust on receipt-shaped JSON. No approval/effect callback is accepted.
-
-The strict parser enforces duplicate members, exact numeric tokens, closed shape, 48 KiB, at most 16 proposed
-revision/snapshot events, 32 exact obligation priorities, 64 selected non-scope revisions and safe bounded
-IDs/ranks. `request.schema.json` is a standalone decoded-shape schema; its embedded `work_*` definitions are
-exact P01 definitions with local reference prefixes, compared to the original by tests. Shape validation
-is not authority, digest, graph, availability, non-expansion or application validation. Events must match
-actual P01 builder output, and cannot smuggle unselected revisions/snapshots or acceptance/occurrence events.
-
-## Application, acknowledgement and reconciliation
-
-Approval validates current selected P01 closure, full proposed closure, exact predecessors and non-expansion
-under the budget transaction. The request receipt records immutable request digest, exact old/new selections,
-proposed event references, priorities, decision and pending-or-unknown application state. Approval advances
-only the intent-controller revision. A stale expected revision/selection or missing approval cannot overwrite
-it. Unknown authority, stale and busy refusals remain recorded immutable decisions, not implicit retries.
-
-At verified **reservation** quiescence, the adapter revalidates actual source bytes and uses the new explicit
-`appendWorkLedgerEventOnce` seam. It shares P01's protected destination checks, terminal-LF admission and
-non-expiring work-file lock. Only this opt-in seam skips exact event ID/digest redelivery and fsyncs; ordinary
-`appendWorkLedgerEvent` still preserves duplicate deliveries. Contradictory same-ID data rejects. The
-adapter revalidates resulting actual P01 bytes before appending the application receipt and switching selected
-intent/priorities. It does not fabricate application from a callback, timestamp, idle flag or acknowledgement.
-
-A complete work append followed by controller receipt failure remains **pending-or-unknown**, with old
-controller selection until an actual application receipt exists. Exact duplicate request delivery is readback
-only. Explicit reconciliation requires the same entire authorized original request and ID/digest; it skips
-already retained exact events, appends only missing events, fsyncs retained bytes again, and records one
-application. No duplicate intent effects, alternate store, truncation or automatic repair. Preserve the
-immutable original request: the controller receipt intentionally stores references rather than missing
-revision contents. Losing that proposal is not permission to invent replacements.
-
-An I/O error is never proof nothing happened: even an application receipt may have been completely written
-before sync/close failure. Caller acknowledgement is unknown until exact bound readback/reconciliation;
-readback is not crash durability or remote/live-worker authentication. Torn bytes stop admission. A real
-controller crash can leave non-expiring budget/work locks and outstanding permits: status stays read-only,
-and reconciliation refuses rather than inferring ownership loss from PID/age. Safe lock/orphan recovery
-needs separately governed work; it is not supplied here.
-
-`IntentSnapshot` version `intent-controller-snapshot-v1` exposes exact selected references, controller
-revision, explicit priorities and immutable decision/application/outcome records. `resultSelection` is null
-until applied, then records the exact resulting selection; outcomes distinguish selection-applied,
-priority-applied, pending-or-unknown and refused. `intent-ready` is readiness of
-this intent layer, **not** an unpaused dispatcher or accepted work; inspection also reports dispatch pause
-and a next obligation only when relevant barriers allow it. Freshness stays snapshot-unknown; acceptance is
-not-assessed. Scheduling consumption means once dispatched/charged, never completed or accepted. Dependencies
-are retained P01 intent relationships, not newly invented acceptance/dispatch prerequisite semantics.
-
-## Remaining boundaries, honestly classified
-
-- **Implemented here:** bounded scope successor application, concrete priority enforcement and recorded
-  alternative selection through real P01/control/reservation/profile seams. Models remain unnecessary.
-- **Owned fixed-profile cancellation adapter not implemented here:** the existing caller-held AbortSignal
-  can cancel its own invocation. A durable request-ID-to-live-owned-handle/application acknowledgement bridge
-  is still repository implementation work, not proof of a missing kernel primitive. No such acknowledgement
-  is invented, and cancellation remains distinct from steering.
-- **General live pi/Herdr steering remains genuinely unqualified:** no verified atomic session/target/safe-
-  boundary transport was established. No terminal typing, worker/status prompts or PID/title/idle guesses.
-- **Scope of boundary:** quiescence of this exact budget, not global process silence. Historical/untracked
-  executions keep their old exact work bindings; this does not steer or rebind them. Coordinated controller
-  writers share the budget lock; direct conflicting work writes invalidate selection/admission rather than
-  being silently accepted. Malicious same-UID races/rollback and full-controller-crash cleanup remain excluded.
-- P02 native bytes/branch gaps, P04 live freshness and P06 arbitrary pi/bash/shared-write/global resource
-  containment limitations remain. No source result closes overall review or formal acceptance.
-
-Ordinary owned tests cover actual appends/selection/P04 projection, unchanged permission bytes, real native
-priority enforcement, stale/default-denied authority, busy settlement, exact duplicate/cross-process delivery,
-complete-append/failed-receipt and multi-record reconciliation, torn/substituted files, a real controller exit
-with retained locks, and read-only status. Fixtures are not live pi/Herdr or installed-package qualification.