[backslash-f]

Personal CloudKit collections currently require the host app to resolve accounts, provision manifests, and fetch assets directly. This adds CloudSavePrivateCoordinator and immutable CloudSavePrivateSession handles so the package owns those operations while the host retains its schema, local database, media, and durable ledger.

Conditional first provisioning rereads the server's canonical winner. Known missing or contradictory manifests fail closed during bootstrap and active sync. Retiring sessions drain admitted host callbacks before a replacement reads the same store. Configured-zone network failures retain offline eligibility instead of becoming host-recovery failures. Account transitions fence the old session before cancellation or host notification; temporary unavailability preserves local writes while retiring cloud work. Personal sessions opt out of mutable host rebinding and automatic owned-zone recreation, while existing engine/sharing integrations retain their current policies.

This prepares version 0.3.0 and documents a neutral notebook client. It does not perform the dependent WortJagd integration, migration, cloud deletion, or real Apple TV profile acceptance.

Validation:

• swift test: 87 tests in 15 suites pass, including concurrent creation, lost acknowledgements, repeated notifications during suspended identity resolution, late asset/ledger/materialization results, A → B → A ledger isolation, invalidation before cancellation, temporary-unavailability durability, host-write retirement barriers, active manifest drift/malformed replacement, configured-zone error classification, and privacy-safe logging.
• swift build, strict Swift Format, consumer setup validation, Markdown wrapping check, and git diff --check pass.
• Static-hosting DocC builds with no warnings/errors.
• Evaluated SwiftPM settings preserve Swift 6.4 tools / Swift 6, warnings as errors, and the five required upcoming features for both targets. No dependency graph changes.
• .gitignore exactly matches the shared active patterns. Current package registry has 16 unique canonical emojis; CloudSaveKit remains ☁️ with its own subsystem/category.
• AgentGuidelines 0.0.42 provenance matches central tagged tree 8e755afa7cf7737ff23a5fdeeada1af34ee7cfb2; subtree marked linguist-generated. Review the integration, not the verified subtree contents.

The supported boundary is trusted host schema callbacks and immutable account-scoped stores. Tests use controlled internal transport/engine seams and require no account credentials. Real signed consumer startup, CloudKit delivery, and tvOS profile switching remain consumer acceptance work; unit tests do not establish those outcomes. Pure token/value helpers deliberately emit no lifecycle noise.

Reasoning Relay exact-base/head review is pending; keep this PR Draft until it reports no P0/P1 findings and explicitly approves the current pair. Package publication follows the approved merge under the owner's existing release authorization.

[backslash-f]

Reasoning Relay reviewed base 37a299090b02696607b6714f32ccfe264a8f433b / head 5e616d7e10873c2f37cea38cc5e8b29323dfbe98 and returned CHANGES_REQUIRED with three P1 findings. Receipt: 8aea77b0bb8b497eee58d33696ceb4445c5d7f6e61cd00c1b9fde39b7d3132a6 (delegation del_385a9a0a-77c1-4433-ac6c-fc67e808aa2f).

Remediated in da4d4500685cd3298105e79b22d0f50a62de9868:

1. Account and session gates now atomically count admitted host callbacks. Account reconciliation chains retirement barriers before issuing a verified token, including rapid A → B → A transitions. Session invalidation/suspension waits for host callbacks independently of CloudKit cancellation. Recovery integration explicitly awaits retirement before rereading the checkpoint.
2. The bootstrap retains the pure manifest decoder and canonical identity. Active fetched batches and exact manifest reads reject changed/malformed identities before domain apply or further sending; unchanged initial delivery remains valid.
3. Configured-zone failures retain their underlying transport error for personal sessions while the generic engine preserves its existing error contract. Freshness and not-started failures have separate normalized cases; network failures remain eligible for a safely initialized offline cache.

Validation: 87 tests in 15 suites, strict Swift Format, build, warning-free static DocC, consumer setup, Markdown wrapping, and diff checks pass. Race tests use deterministic suspension and callback-drain observations. Opaque checkpoint-write ordering is modeled at the exact callback lease boundary used by client.persist; tests do not manufacture Apple serialization internals or claim live CloudKit evidence.

The new engine event policy is exercised through its shared manifest/error policy functions and configured-zone fetch coordinator; signed engine startup remains a consumer gate. No manual Codex review was requested. A delta-scoped Relay review of this new head is required before merge.

[backslash-f]

Reasoning Relay delta review: APPROVED with no unresolved P0/P1 findings and explicit OK to merge this exact package head.

• PR: Add verified private CloudKit sessions for 0.3.0 #16
• Base: 37a2990
• Head: da4d450
• Delegation: del_914372be-287f-4d01-9531-866869f5b285
• Response hash: 37f5216e3bb01243a90db607faa38b6224dd49ba2e2fa13e411954a1587ca83a
• Payload hash: 0304a49deca6a3234015b9fff5c128c1d2c11fe49376e5df65e0fd455cc59de5

The reviewer verified all three prior P1 remediations and green CI run 40752574056. Local validation remains 87 tests across 15 suites plus strict formatting, build, DocC, consumer and wrapping checks.

DEFER-P2: pruning obsolete fetch-generation errors could bound retained diagnostic memory during repeated failures. This optional improvement does not block the package release and is outside this approved source head.

Current GitHub reviews, review threads and reactions are empty. Automatic Codex configuration is unknown with no current-head execution evidence; no manual Codex review was requested. The owner authorized the package release and merge after approval and green CI. This approval covers CloudSaveKit only; WortJagd's integration and owner-coordinated Apple TV acceptance remain separate gates.