unii: Phase 0/1 memory engine + oracle cross-check (#74) + libcurl adapter wired behind host/network (#75)

[pyrex41]

What this adds

Everything is under unii/. Files outside unii/ are unchanged from the pinned base commit fc97577 (shen-lua 0.11.1, Shen 42); the build and a test both check this. Do not merge to main yet.

This PR also merges two parallel branches:

• PR Add independent Unii memory verification oracle #74 (cursor/unii-memory-oracle-13bb): an independent Lua oracle with golden fixtures, in unii/eval/.
• PR Phase 0 HTTP adapter spike (libcurl multi) #75 (cursor/phase0-http-adapter-88ec): a libcurl HTTP adapter, in unii/host/network/.

Shen rules (unii/core/). A pure, typechecked rule bundle loaded under (tc +). It has no clock, files, network, randomness, eval or /. It covers:

• node keys and zoom addresses;
• exact leaves under a 512-byte cap;
• lossless sibling joins;
• deterministic summary jobs with a lead window and an inflight cap;
• rounds of up to 5 tries that keep the shortest summary within the cap (new this round);
• an uncertain effect state with provisional lines, and operator retry that grants a fresh round (new this round);
• an exact due-score merge order;
• 64k/128k byte hysteresis;
• canonical rendering with byte accounting;
• executable invariants.

Lua host (unii/host/). It provides:

• the tagged boundary codec and schema checks;
• a framed, fsynced, flock-owned journal;
• a single-writer supervisor with exact replay;
• the CLI;
• providers/chat_completions.lua, an OpenAI-compatible summarizer whose prompt is provisional and labelled as such;
• a mock network with the real adapter's interface.

Reuben's decisions (this round)

All six are recorded in unii/docs/contracts/decisions.md (R1–R6) and implemented with tests. Engine and oracle agree on all of them.

#	Decision	Implementation
R1	Strict 512-byte cap; up to 5 tries; keep the shortest valid result (earliest try on ties); never accept an over-cap result	Every try in a round runs. The shortest fit is kept as the job's candidate and committed at the end of the round; with no fit, the job blocks. The next try gets a hint: retry-seek-shorter N, retry-too-long N or retry-after-failure.
R2	Uncertain jobs must not stall memory	An uncertain leaf gets a provisional line: its best candidate if it has one, otherwise its raw message. The line covers the leaf, so coverage, readiness and the view keep moving. It is never joined or merged. The real summary later replaces it in place (view-replaced). An uncertain merge job leaves its children in place, and other pairs merge around them. The job is still never re-sent automatically.
R3	No escaping of | or %; tabs become one space	Already the behavior; now recorded.
R4	Operator retry grants one fresh round of 5 tries; block again if all fail	unii.fresh-round. The best candidate from earlier rounds carries over.
R5	A stream without [DONE] is uncertain	models.classify. The supervisor sends the new summary-uncertain event, and uncertain is no longer a failure class.
R6	<chat> wrapper bytes stay out of the view budget	Already the behavior; now recorded.

The oracle gained summary_rounds. test_oracle drives the engine and the oracle through 2,000 random outcome sequences and compares the final state:

• committed: the same try, the same bytes, and the rendered text;
• running: the same try;
• blocked or uncertain: the provisional line.

The test was checked by temporarily flipping the oracle's tie rule; the comparison fails on case 12. The golden fixtures did not change (--check reports no differences).

Interpretations to confirm (listed in decisions.md):

• Cost. Every round runs all 5 tries, so a summary costs up to 5 calls.
• Permanent failures. A permanent failure ends the round early and commits the best candidate if there is one.
• Uncertain parks even with a candidate. An uncertain try parks the job even when an earlier try already fits. That candidate is shown provisionally, so an uncertain outcome never commits automatically.
• Raw provisional lines can be long. A raw provisional line can exceed 512 bytes, up to chunk_max.
• The provisional line stays. If the job later blocks, its provisional line remains.

Engine and oracle cross-check (earlier round)

Question	Result
KB or KiB	1,000 bytes on both sides
Threshold equality	Enter batch mode above high; leave it at or below low
Line budget	Equal at all 20,001 rows
Tie-break	Leftmost pair wins
Delimiter escaping	Reconciled: line breaks and controls become one space; nothing is escaped. Confirmed by Reuben (R3).
Message ceiling	Engine fixed: the highest node level is 30
View bytes	Lines only. Confirmed by Reuben (R6).

Real adapter behind host/network

• An adapter uncertain outcome, a cancel after send, a 2xx stream without [DONE], and a command recovered after a crash with a dispatch record but no outcome all become summary-uncertain. None of them is re-sent automatically.
• unii retry --job J performs an operator retry.
• --network real --url --model selects the adapter; the mock stays the default for tests and the CLI.
• The host/storage.lua interface is unchanged.

The real adapter has been run only against its local test server. No real model provider has been called.

Verification

Suite	Result
luajit unii/test/run.lua	93 passed, 0 failed, 0 skipped
luajit unii/test/network/run.lua	18 passed, 1 skipped (the real-provider smoke test, which needs an API key)
luajit unii/eval/oracle/spec.lua	15 of 15
generate_fixtures.lua --check	ok, fixtures unchanged

Gaps

These are listed in HANDOFF.md:

• Not built: turns, the final prompts, tools, timers and backoff, epoch changes, message chunking, and Phase 2 storage. Phase 2 storage is on a teammate's branch, PR unii: add Phase 2 durable storage and checkpoint replay #77.
• Memory: the journal is read into RAM.
• Platforms: only Linux x86_64 has been run.
• Shen workaround: the pinned runtime fails on datatype rules with six or more premises, so records are nested to avoid it.

  

[pyrex41]

Superseded: unii moved to its own repo, https://github.com/pyrex41/unii (history preserved). Closing.