1. The unified object: change_intent

All system changes converge into a single schema in ~/.local/state/metnos/change_intents.sqlite:

id UUID
fingerprint sha256[:32] # deterministic for cross-source dedup
state PROPOSED|ACCEPTED|APPLIED|OBSERVED|FINALIZED|
 STAGED|REJECTED|FAILED|ROLLED_BACK
origin_family telos|introvertiva|synt|multi_tool|canonical|user
origin_module scamper|dedupe|request_new_executor|L1|L2|feedback|...
intent_kind create_executor|extend_executor|dedupe_executors|
 materialize_pipeline|cache_pattern|reject_pattern
intent_target executor name or pattern
intent_summary 1 user-facing sentence
intent_body kind-specific dict (arg_name, tools_sequence,...)
score 0–1 cross-source normalized
confidence 0–1
convergence # of sources proposing equivalent things
decision_* user accept/reject/stage log
applied_effect applied diff + rollback_blob path
observed_metrics grace-period metrics

The fingerprint does NOT include origin_family: this way two different sources proposing equivalent things (e.g. telos:scamper + introvertiva:specialize on the same executor) coalesce into a single record, with convergence bumped.

2. Lifecycle in 5 acts

 +-----------+
 | PROPOSED | ← some source generated it
 +-----------+
 / | \
 / | \
 (user) | (user decides later)
 / | \
 v v v
+----------+ +--------+ +---------+
| ACCEPTED | | STAGED | |REJECTED |
+----------+ +--------+ +---------+
 | (applier daemon)
 v
+----------+ +----------+
| APPLIED | ----> | FAILED | (retry possible)
+----------+ +----------+
 | (observer daemon, default 7d grace period)
 v
+----------+ +-------------+
| OBSERVED | ----> | ROLLED_BACK | (physical, per kind)
+----------+ +-------------+
 |
 v
+-----------+
| FINALIZED | ← consolidated, hidden from default views
+-----------+

From ANY state you can transition to ROLLED_BACK (human-audit escape hatch). From REJECTED you can re-propose (transition back to PROPOSED).

3. The 6 sources as adapters

Historical sources are not deleted: they continue to exist as «input feed» that powers the materializer. Each has an adapter in runtime/change_intent_adapters/ that projects legacy records into ChangeIntent.

Score normalization per family:

• telos: expected_alignment already 0–1
• multi_tool / canonical: uses via log-saturating mid=20 (e.g. uses=20 → score 0.50, uses=100 → 0.83)
• introvertiva: n_seen*0.05 + last_uses*0.005 (historical formula)
• synt: installed=0.8, abandoned=0.3, rejected*=0.05
• user reject_pattern: min(0.9, 0.3 + 0.15*n_rejections)

4. The 3 daemons: materializer, applier, observer

Applier handler per kind:

• create_executor: invokes existing synth_request pipeline (~150s wall). Idempotent: short-circuits if already in catalog.
• extend_executor: change_applier_extend.py. Appends [args.properties.<arg>] section at the end of the TOML manifest, backup pre-modification in ~/.local/share/metnos/rollback_blobs/<sha8>-<name>.toml, re-sign via sign.sign_executor.
• dedupe_executors: alias setup in executor_aliases.json + deprecate the duplicate in executor_stats.db.
• materialize_pipeline: UPDATE multi_tool_paths SET state='active'.
• cache_pattern: UPDATE canonical_query_log SET state='active'.
• reject_pattern: append to ~/.local/share/metnos/rejected_patterns.jsonl (agent_runtime reads as HARD CONSTRAINT for the planner).

Observer checks metrics post-applied_at and applies grace period (default 7 days, env METNOS_CHANGE_GRACE_DAYS). Rollback triggers:

• create/extend_executor: last_call_ok=False with ≥3 calls; deprecated by executor_ager.
• materialize_pipeline / cache_pattern: state drifted to demoted.
• dedupe_executors: alias removed from file.
• reject_pattern: new ✗ feedback post-applied for the same (canonical_query, tools).

Physical rollback delegated to change_rollback.py (per kind: archive synth dir, restore manifest from blob + re-sign, remove alias, demote state, remove jsonl line).

5. End-to-end example: find_recipes

Telos engine SCAMPER suggests: «Extend find_files with kind=recipe to match .md files in ~/Documents/Recipes.»

If instead after apply Roberto presses ✗ in chat on a reply using the new arg, observer sees new_rejects≥2 for the target query and transitions to ROLLED_BACK — physical restore of the manifest from blob.

6. Operational references

• UI: /admin/changes with 9 tabs per state. Default tab=proposed, cap 30 rows (override ?limit=100|500).
• JSON API: same endpoint with header Accept: application/json (no text/html).
• Smoke test: python3 -m pytest runtime/tests/test_change_*.py -v (55 tests).
• Materializer dry-run: python3 -m runtime.jobs.change_intent_materialize (idempotent).
• DB inspection: sqlite3 ~/.local/state/metnos/change_intents.sqlite.
• Audit JSONL: ~/.local/share/metnos/audit/change_{intent_materialize,applier,observer}.jsonl.

— aligned with the code.