Extract an atomic iOS host-readiness state machine from PR #193

[BunsDev]

Outcome

Deliver the first focused iOS replacement slice from PR #193: host readiness must be atomic, deterministic, and unable to expose a newly fetched workspace as authoritative when authentication, host persistence, snapshot acceptance, or workspace application fails.

Control metadata

• Accountable owner: @BunsDev
• Delivery train: iOS companion / connection correctness
• Priority: P1; first implementation gate in the iOS train
• Parent outcome: Deliver the Psyche Build iOS internal beta and continuity loop #200
• Source material: PR Complete iOS Bonjour host connection flow #193
• Blocks: discovery/reconnect UX, physical same-LAN acceptance, ritual publication/execution, and internal TestFlight

Required state model

• unknown
• discovering
• pairing
• authenticating
• host_committed
• synchronizing
• ready
• degraded
• reconnecting
• revoked

Work

• Extract the smallest current-main readiness core from Complete iOS Bonjour host connection flow #193 rather than rebasing the full branch as one unit.
• Persist authoritative paired-host identity and selected-host state before applying a new host's workspace snapshot.
• Apply the snapshot only after authentication, host commit, decoding/revision validation, and workspace acceptance all succeed.
• Define rollback behavior for transport, authentication, secure-store, decode/revision, and workspace-apply failure.
• Preserve clearly labeled stale/offline state from the previously authoritative host, or no state for a failed new host.
• Prevent concurrent pairing/readiness flows from overwriting committed authority.
• Add deterministic transition and failure-boundary tests.
• Keep Bonjour discovery, selection UI, and physical-device acceptance out of this first PR except for narrow adapters required by the state-machine contract.

Acceptance criteria

• A secure-store failure cannot leave the new workspace visible while readiness reports failure.
• No failure path labels newly fetched state as ready.
• Previously authoritative stale state is visually and semantically distinct from live state.
• Revoked or wrong-host identity fails closed.
• Tests cover every allowed transition and every rollback boundary.
• The focused PR is current with main, reviewable, green, and merged before later iOS capability PRs.

Non-goals

• Merging the complete Complete iOS Bonjour host connection flow #193 branch.
• Treating Bonjour address as durable identity or authority.
• Shipping TestFlight or remote/off-LAN continuity in this slice.
• Adding mobile ritual controls.

Evidence

Link the extraction PR, transition table/tests, exact head SHA, required checks, review findings/resolution, and merged commit.

[BunsDev]

Dependency and extraction update — 2026-08-30

#241 remains the first iOS implementation gate. PR #274's merged shared action store does not satisfy this state-machine outcome, and draft PR #264/#280 must follow it rather than commit host/workspace authority independently.

The focused #241 PR still needs to prove, for every transport/authentication/secure-store/decode-revision/workspace-apply boundary:

• host identity is durably committed before a new snapshot becomes authoritative;
• failed new-host state is absent or clearly separated from previously authoritative stale/offline state;
• concurrent or superseded readiness flows cannot overwrite committed authority;
• revocation/wrong-host identity fails closed;
• rollback is deterministic and does not leave a success-shaped workspace.

After #241 lands, #280 may compose invite redemption and durable credential storage into this state machine. QR/deep-link and discovery UX remain adapters, not identity or authority.