[scbrown]

A long scheduled execution blocks a synchronous receiver. Add a bounded asynchronous receiver plus a native emitter-envelope adapter. Delivery remains pending until the existing signed receiver has persisted and published the actual terminal outcome; duplicate in-flight delivery starts one execution.

The envelope adapter pins the emitter, routing recipient and receiver scope. It reads the UTC slot from the canonical reversible run identifier and verifies the exact re-encoded binding. Delivery timestamps and generation cannot select a different slot. Foreign scopes, commands in extra fields, malformed metadata, duplicate JSON keys, boolean timestamps and oversized/deeply nested bindings refuse before execution admission. Context variables cross the worker boundary.

This draft is stacked on the existing process-port branch from #26. Its proposal is only the two subsequent receiver commits; it does not request a second review of #26. Retarget to current main after the parent lands, then use complete fresh CI and the normal source review/admission path. No release or runtime activation.

Validation: full 277 tests plus 25 subtests passed; a final focused run passed all 32 envelope controls including the additional deeply nested input case. Both HOME guards reported 157 watched paths and five resources untouched. Ruff, offline wheel build, isolated wheel imports and terminal replay passed. The existing async receiver controls also cover publication retries and recreated receivers without repeating a claimed child.

Demo: native emitter recording, timing, and reproducer. Actual observe/outbox, worker thread and SQLite slot ledger; signing callbacks are fixtures. Before source1d929153 the envelope adapter is absent with the async receiver positive; candidate0b4a0eb5 emits one durable row, handles two attempts while the callback is blocked without a receipt, then publishes a held outcome before receipt. Source-level evidence, not installed or natural-run acceptance. Replay requires downloading the two terminal files and using scriptreplay; inline playback is not claimed.

Capacity includes completed work awaiting receipt. The owner drains workers outside the event loop; callbacks must enforce admitted runtime/output limits. Pending deliveries use the existing retry backoff and count as delivery failures in existing metrics. Threads remain in the service cgroup. A generic sink factory, validated catalogue projection, fixed-command executor and production configuration are still required. Existing claims and outboxes must survive rollback; UNKNOWN never authorizes child replay.

Bead: aegis-6vf

Overlap preflight: 61aa6522601fe9257b1b292a4192bdfde4b79277100848b7fd4613b9657f4ca6

• PR feat: package Chaski with releases, docs and event verification #14 @ 3cb9699: independent — Historical packaging proposal14 remains untouched. Current published package contract and dependency pins are retained; this new delta only adds the two receiver modules to its module list, with no packaging-policy absorption.
• PR chore(main): release 0.2.0 #25 @ 456df27: independent — Release proposal25 changes version/changelog. This receiver delta does not change version or release workflows, tags or publication; the release proposal remains separate.
• PR feat(receiver): bridge signed phases through the fixed Shuttle CLI #26 @ 88edbde: independent — The explicit base is exactly the existing process-port branch/head26, so all parent content is already in the base and excluded from this proposal delta. New receiver/envelope source has separate tests/demo. Parent review/admission remains required before retargeting/landing; no second review or competing patch of26 is requested.

[scbrown]

Folded into #31 (aegis-6vf, operator ruling: no stacked drafts). #31's head bfd3d44 contains this branch's commits plus main; review and merge happen there.