[scbrown]

A pinned declaration catalogue can now produce the current eligible UTC slot and next check, and a fixed trusted child command can return an explicit outcome through a bounded descriptor. Missing identities refuse before altering the outbox; exit zero without a valid result remains unknown. Hold and failure stay distinct, and durable receiver replay does not execute the child twice.

This draft is stacked on #28 at 0b4a0eb, which itself depends on #26. Neither parent proposal is duplicated or changed. Parent landing, retargeting/current CI, normal risk classification and one independent post-green review remain required. No runtime activation, release, signing key, schedule, credential or cron change is included.

The projection supports fixed elapsed intervals with explicit activation cutoff, never historical catch-up. The executor fixes argv, cwd, explicit environment and descriptor variable locally. It validates actual process exit plus bounded JSON, drains/discards bounded logs, times out ordinary process groups, and retains unknown execution rather than retrying. It does not provide immutable artifact admission, kernel containment, parent-session survival or signed outcome metadata; those remain surrounding receiver/supervisor responsibilities.

Validation:49 executor and 49 projection focused tests; full 376 tests plus 25subtests pass. Exhaustive exit-code/JSON-order invariants, actual temporary subprocesses, timeout cleanup and durable no-repeat cases. Watched HOME/resource surfaces unchanged; this is not a general hermeticity certification. Ruff, isolated wheel imports and exact committed source/wheel bytes pass.

Demo: on head f4a755d, run python scripts/demo-scheduled-projection.py and python scripts/demo-fixed-outcome-executor.py. Relative to base 0b4a0eb both modules were absent while receiver identity control remained present; candidate projection emits 2 slots from 3 observations and retains the outbox on missing identity. Actual isolated child processes show succeeded (0), hold (0), failed (7), and unknown on missing result. These are source fixtures, not installed service acceptance. Download and replay the small retained recordings with scriptreplay: projection output, timing; executor output, timing. Playback verified locally; small sanitized fixtures retained in established docs/demos directory.

Tracks aegis-6vf.

Bead: aegis-6vf

Overlap preflight: 39adef7e7e971d7933e3cb072bbef5a9d2588bdddd85f2689cafbd10dd7c792a

• PR feat: package Chaski with releases, docs and event verification #14 @ 3cb9699: independent — Historical packaging proposal14 remains untouched; this delta only adds the projection and fixed executor to the existing module list, retaining all dependency/build/publication policy.
• PR chore(main): release 0.2.0 #25 @ 456df27: independent — Release proposal25 changes version/changelog. This receiver delta does not change version or release workflows, tags or publication; the release proposal remains separate.
• PR feat(receiver): bridge signed phases through the fixed Shuttle CLI #26 @ 88edbde: independent — Parent26 is already an ancestor of explicit base28; its entire process-port proposal is excluded from this delta. Existing review/admission remains owned separately, with no duplicate reviewer or competing patch.
• PR Deliver signed scheduled work asynchronously with pinned emitter envelopes #28 @ 0b4a0eb: independent — Explicit base is exactly existing draft28. Its async receiver and pinned envelope content are excluded. This child adds pure schedule projection and bounded fixed executor; parent admission and subsequent retargeting/current CI remain required.

[scbrown]

Folded into #31 (aegis-6vf, operator ruling: no stacked drafts). #31's head bfd3d44 contains this branch's commits plus main; review and merge happen there.