julewire-core 1.0.0 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e20df02ec73ceafd282ab52015e46a28f9aa7b1d69461e2622afc301f9e98d40
-  data.tar.gz: 4e12bb12f787534aa5318084f6fa69fc1888590d85874d253c12dbfc6d6701f7
+  metadata.gz: 8dcf4adb34508c1956a296d585981b88af27d8be7d0e63e9a3fe130b2c835f3b
+  data.tar.gz: 66cf51de3387a96f280c23badc8d847b07c53f069bd1aa5bcc7d15f72bfb4cff
 SHA512:
-  metadata.gz: 222e5041e3d984b1e3d50a989c461522cf7622257d1698e7e9fdee9f10f2837537a883fbfe16466ac31abf868558807e1a07642e52c894ac020bf71c628a1896
-  data.tar.gz: 75f19494c48c6d46ae6bdf997db3605abc93323180589804d0e6338e1c7e592cd58150fbef9be4ccb5bfba577fb1086745ee8b779b6588aa7996572a55a5563f
+  metadata.gz: e5f73d78908ae3a654c69f91eb05aa97d804e5ad9d087bb709044b7b8f0273c0babc5b4094096d9136378e7cc43a2ad850766cb8307e7883747408551be87424
+  data.tar.gz: eef32910880411f8760142726eb4453b938f073124688ff992bbf3d59a0c6f9a3f3d70a95a020946015d970e7694ba551785436d9755b0faf215bf599769b47e

data/CHANGELOG.md

@@ -1,5 +1,34 @@
 ## Unreleased
 
+## 1.1.0 - 2026-07-20
+
+- Make carrier extraction status public via `Carrier::Extracted` and rename the
+  convenience reader to `extract_envelope`.
+- Enforce recursive Symbol keys for owned records and protocols; reject invalid
+  processor results and malformed propagation sections instead of normalizing
+  or ignoring them.
+- Require canonical lowercase severity Symbols while retaining case-insensitive
+  String and standard-library Logger integer ingress.
+- Harden bounded serialization, `RecordDraft` isolation/finalization, and
+  processor, summary, and lifecycle failure health; remove reusable bounded
+  transforms and the undocumented `freeze_sections` mode.
+- Remove `Julewire::Testing::Contracts` and `Julewire::Testing::Chaos`; the
+  testing API now contains only capture and null-output observation fixtures.
+- Remove the generic deadline-scheduler SPI; main-process integrations now use
+  only the process-owned shared scheduler, leaving Ractor-safe timeout ownership
+  to the Ractor integration.
+
+## 1.0.1 - 2026-06-25
+
+- Harden bounded traversal, ingress copying, and carrier extraction against
+  noisy or hostile record shapes.
+- Keep normalized record constructors strict: symbol-key contracts validate
+  instead of quietly normalizing pipeline-owned data.
+- Default carrier extraction to the byte cap, report extraction status to
+  integrations, reserve truncation metadata keys at field ingress, and keep
+  custom normalization limits out of the thread-local copier pool.
+- Keep output writes independent from flush/close lifecycle locking.
+
 ## 1.0.0 - 2026-06-21
 
 - Initial release: execution-scoped structured logging, propagation, bounded

data/docs/advanced-configuration.md

@@ -13,7 +13,8 @@ is unsupported. Call `Julewire.configure` again.
 User-supplied destination formatter, encoder, output, and processor instances
 are shared by reference. Processors, formatters, and encoders must be stateless
 or otherwise reentrant; core does not synchronize them. Direct outputs are
-wrapped with a per-destination mutex.
+wrapped with a per-destination write mutex; `flush` may overlap writes, while
+terminal `close` is serialized with writes.
 
 When a reconfigure reuses the same output or destination object, core keeps that
 resource open for the new active pipeline and skips teardown through the old

data/docs/configuration.md

@@ -38,6 +38,10 @@ end
 | `on_failure` | Best-effort callback for contained core failures. |
 | `on_drop` | Best-effort callback for operational drops after a record reaches destination/output handling. |
 
+Severity Symbols must use canonical lowercase values. String configuration
+values are case-insensitive, and standard-library Logger severity integers are
+accepted.
+
 Timeout values must be `nil` or non-negative finite numerics.
 `error_backtrace_lines` must be a non-negative integer.
 
@@ -117,10 +121,11 @@ processors. Output-specific shape belongs in destination formatters. Processors
 are the mutation stage.
 
 Processors receive the current `Julewire::RecordDraft`. Mutate the draft
-directly. Return `:drop` to stop delivery or a different `Julewire::RecordDraft` to
-replace the current draft; any other return value is ignored. Processors own
-the draft until the final record boundary, so direct mutation is the normal hot
-path:
+directly and return `nil` to keep it. Return `:drop` to stop delivery or a
+different `Julewire::RecordDraft` to replace the current draft. Unsupported
+non-`nil` return values keep the current draft but increment `processor_invalid`
+and record last-failure metadata. Processors own the draft until the final
+record boundary, so direct mutation is the normal hot path:
 
 ```ruby
 class AddTenantLabel
@@ -155,11 +160,13 @@ Processor exceptions use the registration policy:
 | `on_error` | Behavior |
 | --- | --- |
 | `:fail_closed` | Default. Emit a `julewire.processor_error` replacement record and stop the chain. |
-| `:fail_open` | Record the failure, keep the current draft, and continue with later processors. |
+| `:fail_open` | Record the failure and continue only when the current draft still satisfies the owned record contract. |
 | `:drop` | Record the failure and suppress the record. |
 
-Public emit input remains defensive. The final immutable record boundary
-validates the Julewire record shape before destinations see it.
+Public emit input remains defensive. Core validates the draft after every
+processor, so a malformed mutation is attributed and dropped before a later
+processor or destination sees it. The final immutable record boundary still
+validates the Julewire record shape.
 
 Destination-local processors run after the global processor chain and before
 one destination formats the record. Use them for sink-specific policy such as

data/docs/context-and-propagation.md

@@ -225,9 +225,22 @@ Execution metadata is restored as ordinary execution fields. Use
 `Julewire.with_execution(..., fields: { trace_id: "..." })` for custom
 execution fields at the public API boundary.
 
+Direct `Propagation.restore` treats its envelope as public/unowned input:
+String keys are normalized, but `_julewire_truncation` remains reserved and is
+rejected. `Carrier.restore` is the owned decoded-wire path; it preserves
+Julewire-generated truncation metadata while restoring the carrier envelope.
+Bridge code may also call `Propagation.restore(..., owned: true)` for a local
+Julewire-owned envelope. That strict path requires a recursively Symbol-keyed
+Hash and requires every present propagation section to be a Hash; it does not
+replace malformed owned sections with empty hashes.
+
 Propagation serializes values through the core serializer. That means values
 cross a log-safe boundary, not an object-identity boundary.
 
+Carrier JSON decode is a key-normalization boundary: decoded String keys become
+Symbols before restore. Once restored, context and carry are owned Symbol-key
+data; integrations must not add String-key overlays.
+
 Core does not redact propagation envelopes. Do not put secrets in context or
 carry unless your app or processor policy handles them.
 
@@ -241,9 +254,9 @@ Julewire::Core::Propagation.restore(envelope, link_executions: true) do
 end
 ```
 
-Restoring an envelope is an explicit trust decision. Core validates shape, and
-outbound injection can enforce a byte limit, but core does not authenticate who
-wrote the carrier. At untrusted boundaries, extract only the carrier fields you
+Restoring an envelope is an explicit trust decision. Core validates shape and
+caps inbound carrier bytes by default, but core does not authenticate who wrote
+the carrier. At untrusted boundaries, extract only the carrier fields you
 intentionally accept, apply any application spoofing/filter policy first, then
 call `Carrier.restore` on that filtered carrier map.
 
@@ -269,13 +282,20 @@ Julewire::Core::Propagation::Carrier.restore(trusted) do
 end
 ```
 
-Use `max_bytes:` when the carrier target has practical size constraints:
+Inbound extraction and restore default to `Carrier::DEFAULT_MAX_BYTES`; pass
+`max_bytes: nil` only for a trusted unbounded carrier. Use `max_bytes:` on
+injection when the carrier target has stricter size constraints:
 
 ```ruby
 headers = Julewire::Core::Propagation::Carrier.inject({}, max_bytes: 8 * 1024)
 # => nil when the serialized carrier is too large; the carrier key is removed
 ```
 
+Integrations that need failure status should call `Carrier.extract_result` and
+inspect its public `Carrier::Extracted` fields: `status`, `reason`, `error`,
+and `envelope`. Use `Carrier.extract_envelope` for convenience-only restore
+paths.
+
 The default carrier key is `"julewire"`. Carriers are intentionally
 provider-neutral: core stores only the Julewire propagation envelope. External
 header conventions stay outside core.
@@ -341,6 +361,8 @@ counters.
 - current fiber context store
 - the old active pipeline/output lifecycle
 - live runtime post-close drop and callback-failure state
+- registered named runtimes and their pipelines when called through the main
+  `Julewire` facade; a later named lookup creates a fresh runtime
 
 `health[:counts]` is different: it is monotonic for the current runtime object
 and survives `reset!`. Use it for process-lifetime runtime lifecycle scrapes.

data/docs/contracts.md

@@ -60,53 +60,18 @@ general application surface:
 - `Julewire::TailSampling` as a destination wrapper for execution-level tail
   sampling.
 - `Julewire::Testing::CaptureDestination`, `Julewire::Testing::NullOutput`,
-  `Julewire::Testing.capture`, `Julewire::Testing.configure_capture_destination`,
-  `Julewire::Testing::Contracts`, `Julewire::Testing::Chaos`, and
-  `Julewire::Testing::Coverage` as extension test support.
+  `Julewire::Testing.capture`, and
+  `Julewire::Testing.configure_capture_destination` as small extension test
+  fixtures.
 - `RuntimeLocator.current.emit_without_level` for host-process integrations
   that already apply their framework's level gate.
 
 Extensions should consume these contracts rather than reaching into pipeline,
 runtime, storage, or destination internals.
 
-Testing support is shipped for integration authors, but helper names may still
-change when the ecosystem cleanup demands it.
-
-`Julewire::Testing::Contracts` currently ships these shared assertions for
-extension and integration gems:
-
-- `assert_julewire_bounded_transform_spi_contract`
-- `assert_julewire_deadline_scheduler_spi_contract`
-- `assert_julewire_destination_contract`
-- `assert_julewire_execution_boundary_contract`
-- `assert_julewire_failure_containment_contract`
-- `assert_julewire_formatter_contract`
-- `assert_julewire_integration_failure_contract`
-- `assert_julewire_integration_health_contract`
-- `assert_julewire_integration_ivar_state_contract`
-- `assert_julewire_integration_payload_contract`
-- `assert_julewire_integration_spi_contract`
-- `assert_julewire_integration_timestamp_contract`
-- `assert_julewire_integration_value_contract`
-- `assert_julewire_processor_contract`
-- `assert_julewire_propagation_contract`
-- `assert_julewire_record_draft_transform_contract`
-- `assert_julewire_record_shape_contract`
-- `assert_julewire_record_source_contract`
-- `assert_julewire_runtime_integration_contract`
-- `assert_julewire_truncation_marker_spi_contract`
-- `assert_julewire_validation_spi_contract`
-
-`Julewire::Testing::Chaos` currently ships containment helpers for extension
-test suites:
-
-- `assert_contained`
-- `assert_core_runtime_containment`
-- `assert_destination_chaos_contract`
-- `assert_discovered_chaos_contracts`
-- `assert_emitter_chaos_contract`
-- `catalog`
-- `raiser`
+Core does not ship an assertion DSL or exception-corpus runner. Integration
+tests exercise their production formatter, destination, processor, subscriber,
+and framework boundary directly.
 
 ## Integration SPI
 
@@ -118,6 +83,8 @@ but they are not intended as general application API:
   integration health and scoped health wrappers.
 - `Julewire::Core::Integration::Facade` for integration-owned emits,
   execution boundaries, field overlays, and summary enrichment.
+- `Julewire::Core::Integration::Protocol` for recursive, non-normalizing
+  validation of Symbol-keyed integration protocol data.
 - `Julewire::Core::Integration::Values::Read` for hash/object value reads
   including `value`, `hash_value`, `nested_value`, `path_value`,
   `first_value`, and `blank?`.
@@ -133,7 +100,10 @@ but they are not intended as general application API:
   snapshots without exposing core's internal health cells.
 - `Julewire::Core::Destinations::WriteStep` for destination-style integrations
   that reuse core's format, encode, bound, write, and counter sequence while
-  keeping their own lifecycle and failure policy.
+  keeping their own lifecycle and failure policy. It returns `true` only when
+  the output accepted the encoded record; handled drops and transform failures
+  return `false` after recording health/loss metadata through the supplied
+  callbacks.
 - `Julewire::Core::CLI::LogFormats` for provider-owned CLI file-tail decoding
   and transcoding formats.
 - `Julewire::Core::Processing.register` for integration-owned processor kinds,
@@ -148,14 +118,13 @@ but they are not intended as general application API:
 - `Julewire::Core.sentinel(:name)` for readable, frozen identity markers when
   an integration needs a private empty or missing-value sentinel.
 - `Julewire::Core.deep_compact_empty` for core-compatible empty-field pruning.
-- `Julewire::Core::Scheduling::DeadlineScheduler` for integration-local timeout callbacks
-  that need Julewire's fork-reset behavior.
 - `Julewire::Core::Scheduling::SharedScheduler` for process-wide main-ractor
   timeouts shared by integrations that should not own separate scheduler
   threads.
 - `Julewire::Core::Validation` for shared option and limit validation.
-- `Julewire::Core::Serialization::BoundedTransform` for processors and integrations that need
-  core-compatible bounded traversal before core serializes the result.
+- `Julewire::Core::Serialization::BoundedTransform.call` for processors and
+  integrations that need core-compatible bounded traversal before core
+  serializes the result.
 - `Julewire::Core::Diagnostics::CallbackNotifier` and
   `Julewire::Core::Diagnostics::FailureSnapshot` for destination-style
   integrations that need core-compatible callback and health failure shape.
@@ -181,6 +150,8 @@ different Ruby isolation boundary:
 - `Julewire::Core::UNSET`, `Julewire::Core.emit_input`, and
   `Julewire::Core::Records::LazyEmitInput` to mirror facade emit semantics
   across an isolation boundary.
+- `Julewire::Core::Records::BuildInput` to canonicalize public emit fields or
+  validate integration-owned record input before strict bridge serialization.
 - `Julewire::Core::Execution::Boundary` for shared execution boundary behavior.
 - `Julewire::Core::ContextStore.current`,
   `Julewire::Core::Fields::ContextProxy`,
@@ -188,13 +159,17 @@ different Ruby isolation boundary:
   `Julewire::Core::Fields::CarryProxy`, and
   `Julewire::Core::Fields::SummaryProxy` for bridge-local field bags.
 - `Julewire::Core::Execution::ScopeSnapshot` for detached execution scope transfer.
+- `emit_integration(record, enforce_level:)` on bridge runtimes for strict
+  integration-owned emits inside the isolation boundary.
 - Parent-runtime hooks: `emit_envelope`, `emit_summary_record`, and `flush`.
   `emit_envelope` accepts detached input, context, carry, attributes, neutral,
-  scope snapshot, and an `enforce_level:` flag.
+  scope snapshot, `enforce_level:`, and `owned:`. Bridges pass `owned: true`
+  only for envelopes that came from Julewire's own wire format.
 
-Bridge runtimes may expose `emit_without_level` when integration code inside
-the bridge has already applied its own level gate. Parent runtime labels,
-processors, destinations, and outputs remain parent-owned.
+Bridge runtimes may expose `emit_without_level` for public bridge-local callers
+that already applied a level gate. Integration code uses `emit_integration` so
+owned data never falls back through public normalization. Parent runtime
+labels, processors, destinations, and outputs remain parent-owned.
 
 ## Internal implementation
 

data/docs/extensions-and-api.md

@@ -29,7 +29,7 @@ Allowed processor returns:
 nil                         # draft was mutated in place or unchanged
 draft                       # explicit draft return
 :drop                       # stop delivery
-anything else               # ignored; current draft continues
+anything else               # current draft continues and health records it
 ```
 
 Mutate the draft for ordinary enrichment:
@@ -46,6 +46,12 @@ primary processor API:
 draft.fetch(:context).fetch(:account)[:id] = "changed"
 ```
 
+Draft data is already normalized. Processors must use Symbol keys for every
+new or replacement hash key; processors are not a String-key normalization
+boundary. Core validates the current draft after every processor. Invalid data
+is attributed to the processor that produced it, reported, and dropped before a
+later processor can observe it.
+
 Use transform helpers when replacing values or sections. They invalidate cached
 records and keep execution lineage when execution identity is unchanged:
 
@@ -54,6 +60,11 @@ draft.transform_field!(:severity) { :warn }
 draft.transform_section!(:payload) { |payload| payload.merge(sampled: true) }
 ```
 
+Transform identifiers are strict Symbols. `transform_field!` accepts only
+known record fields, and `transform_section!` accepts only documented Hash
+sections. These processor-owned helpers do not normalize String identifiers or
+create ad hoc top-level fields.
+
 Use `transform_record!` for whole-record replacement transforms:
 
 ```ruby
@@ -95,6 +106,9 @@ config.processors.use Julewire::Match.new do
 end
 ```
 
+`Match` condition keys are Symbol keys. A condition whose pattern is `nil`
+matches a present field with a nil value; it does not match a missing field.
+
 For deterministic head sampling, use the registered `:sampling` processor:
 
 ```ruby
@@ -115,13 +129,14 @@ The default is `on_error: :fail_closed`: core attempts to emit a minimal
 `julewire.processor_error` record, the original record is not delivered, and
 later processors are not run. Use `on_error: :fail_open` for non-critical
 enrichment processors that should record the failure, keep the current draft,
-and continue. Use `on_error: :drop` when a failing processor should suppress
-the record. `on_error:` is a registry option, not a processor constructor
-keyword.
+and continue, provided the draft still satisfies the owned record contract.
+Fail-open never forwards malformed data. Use `on_error: :drop` when a failing
+processor should suppress the record. `on_error:` is a registry option, not a
+processor constructor keyword.
 
-Non-raising draft corruption is detected at the final immutable
-`Julewire::Record` boundary and contained as an `emit_record` failure
-without per-processor attribution.
+Non-raising draft corruption is detected immediately after the processor and
+reported as `:processor_data` or `:destination_processor_data` before the
+record is dropped.
 
 Processors can inspect execution lineage before the default formatter strips it
 from public output. Promote only the pieces you want to expose:
@@ -162,10 +177,12 @@ Application emit input crosses a few small objects before it becomes a draft:
 | Facade merge | `Core.emit_input` | Combine positional input and keyword fields without normalizing app objects. |
 | Lazy block | `Records::LazyEmitInput` | Keep block-built payloads lazy until the level gate passes and preserve eager severity helpers. |
 | Threshold peek | `Records::RawInput` | Read severity, source, and event from raw input without building a record. |
-| Draft build | `Draft::BuildInput` | Split raw input into normalized top-level fields plus payload. |
+| Draft build | `Records::BuildInput` | Split public input into known top-level fields plus payload, or validate strict owned input. |
 
-This split keeps below-threshold eager input and lazy blocks cheap while the
-final immutable `Record` boundary still validates the full shape.
+This split keeps below-threshold eager input and lazy blocks cheap. Owned
+integration input is validated before processors, each processor result is
+validated before the next processor, and the immutable `Record` boundary keeps
+the destination contract explicit.
 
 ## Formatters
 
@@ -300,11 +317,11 @@ health
 ```
 
 Output lifecycle hooks are sync and local. Runtime timeouts provide one carried
-deadline while core walks destinations, but plain outputs do not receive the
-timeout value and core cannot interrupt blocking raw outputs. After the first
-attempted resource, exhausted deadlines skip later resources. Custom
-destinations own async drain, retry, reopen targets, rotation, and
-timeout-aware shutdown.
+deadline while core walks destinations. Plain outputs receive the timeout only
+when their lifecycle method accepts `timeout:` or `**kwargs`; core still cannot
+interrupt blocking raw output code. After the first attempted resource,
+exhausted deadlines skip later resources. Custom destinations own async drain,
+retry, reopen targets, rotation, and timeout-aware shutdown.
 
 Plain output writes are successful when `write` returns without raising and does
 not return `false`. A plain `false` is treated as a rejected write. A rejection
@@ -324,7 +341,7 @@ parts with important ownership or boundary rules.
 `EncodingSanitizer.call` repairs strings into valid UTF-8. It is intentionally
 string-only; passing other objects is a type error.
 
-`FieldSet` is the public helper for integration-owned field hashes. Its
+`FieldSet` is the public helper for defensive field hashes. Its
 documented surface is:
 
 - `coerce`
@@ -336,8 +353,11 @@ documented surface is:
 
 `coerce`, `merge`, and `merge!` normalize string keys to symbols and
 defensive-copy values before inserting them, so later caller mutation does not
-mutate core field containers. Use symbol keys after that boundary. `VALUE_KEY`
-is the key used when non-hash field input is wrapped instead of dropped.
+mutate core field containers. They are public-ingress helpers, not repairs for
+integration-owned or cross-gem protocol data. Use `Integration::Protocol` to
+validate owned data and keep Symbol keys after the ingress boundary.
+`VALUE_KEY` is the key used when non-hash field input is wrapped instead of
+dropped.
 
 Other `FieldSet` singleton helpers are core-internal implementation support and
 are not part of the extension contract.
@@ -349,13 +369,17 @@ Encoders and transport boundaries that need pure log-safe data should use
 `Serializer.call` there.
 
 `RecordFieldTransform` walks core's normalized record containers with
-`BoundedTransform`. It owns record-shape policy only; processors supply the
+`BoundedTransform.call`. It owns record-shape policy only; processors supply the
 actual filtering or replacement policy.
 
 `Carrier` serializes propagation envelopes into flat string carriers for
 external boundaries. It is provider-neutral and does not parse or synthesize
 external headers. Use `max_bytes:` to leave a carrier unchanged and return
 `nil` when the serialized envelope is too large for the target boundary.
+Use `Carrier.extract_result` from integrations that need health/status detail.
+It returns a `Carrier::Extracted` value with `status`, `reason`, `error`, and
+`envelope`. Use `Carrier.extract_envelope` only when a best-effort envelope hash
+is enough.
 
 `Julewire::RecordDraft.build` is the raw-input construction path used by core and
 integration code. `Julewire::RecordDraft#to_record` freezes the final normalized data into
@@ -363,6 +387,12 @@ an immutable `Record` for formatters and destinations. `Record` is not a raw
 input builder; it is the read-only destination boundary. Use
 `Record.from_normalized_hash` only when an extension already owns a complete
 symbol-key normalized record hash and needs the immutable destination shape.
+That path validates the strict internal contract; it does not clean up
+JSON-style or user-input hashes. Use `RecordDraft.build` at raw boundaries.
+
+Summary finalizer failure callbacks receive the contained error plus
+`phase: :summary_finish` or `phase: :summary_emit`, so integration callbacks
+should accept keyword metadata.
 
 ## Public Facade
 
@@ -374,12 +404,15 @@ Integrations that keep process-local state can register a reset hook with
 component: :component_name) { ... }`. The hook runs after core has refreshed its
 own process-local state and after the active pipeline has forwarded
 `after_fork!` to destinations.
+Both hook names are strict integration identifiers: pass non-empty Symbols.
+String or non-Symbol names raise at registration and are never normalized.
 
 `Julewire.observe_self!(runtime_name = :default, target: :meta)` starts a
 `Julewire::Core::Diagnostics::MetaObserver`. The observer samples one runtime's
 health and emits health-change records into another named runtime. Pass
 `start: false` and call `sample!` manually when deterministic polling is
-preferred.
+preferred. Call `observer.stop!` to cancel scheduled sampling when the
+observer is no longer needed.
 
 Framework and provider adapters may also use the core integration SPI. The
 `Julewire::Core::Integration` namespace is split by concern:
@@ -416,13 +449,25 @@ procs; return a normalized value or raise.
 
 Runtime access:
 
+- `Integration::Protocol.validate_symbol_keys(value)` for recursive validation
+  of integration-owned data before it crosses an internal gem, thread, or
+  Ractor protocol boundary. It returns the same value and raises `TypeError`
+  for every non-Symbol hash key; it never normalizes protocol data. Validation
+  is iterative and continues beyond the later copy/serialization depth bound.
+- `Integration::Protocol.validate_symbol_hash(value)` additionally requires the
+  owned section itself to be a `Hash`. Direct integration SPI rejects malformed
+  sections immediately. Runtime emit boundaries contain, report, and drop that
+  failure instead of emitting a record with silently removed data.
 - `Integration::Facade.with_execution` for framework integrations that
   build fresh execution attributes and want the same execution boundary as
   `Julewire.with_execution` without copying already-owned attribute hashes.
 - `Integration::Facade.emit` for framework/provider integrations that
   emit already-normalized, adapter-owned record hashes. This is not the
   app-facing `Julewire.emit` input path; integrations should pass explicit
-  record keys such as `:event`, `:source`, `:payload`, and `:attributes`.
+  Symbol record keys such as `:event`, `:source`, `:payload`, and
+  `:attributes`. Every nested hash key must also be a Symbol; this API does
+  not normalize String keys. Custom fields belong inside a documented record
+  section; unknown top-level fields are rejected rather than ignored.
 
 Owned field overlays:
 
@@ -431,7 +476,10 @@ Owned field overlays:
   hashes around callback, request, or message processing.
 - `Integration::Facade.add_context`, `add_carry`, `add_attributes`, and
   `add_neutral` for already-normalized, adapter-owned field hashes added to the
-  current execution or ambient context.
+  current execution or ambient context. Every nested hash key must be a Symbol;
+  these owned overlays do not normalize String keys. Non-Hash values are
+  contract errors and are never silently ignored, including when no execution
+  scope is active.
   `add_carry` and `add_neutral` are deliberate symmetry points for integrations
   that need ambient propagation or formatter-coordination fields outside a
   scoped callback.
@@ -459,9 +507,9 @@ methods or indexed access.
 
 Bounded transforms:
 
-- `Julewire::Core::Serialization::BoundedTransform` when a processor or adapter needs a bounded
-  walk with core-compatible depth, array, hash, string, cycle, and truncation
-  behavior.
+- `Julewire::Core::Serialization::BoundedTransform.call` when a processor or
+  adapter needs a bounded walk with core-compatible depth, array, hash, string,
+  cycle, and truncation behavior.
   It can insert `_julewire_truncation` metadata before the final encoder sees
   the payload.
 - `Julewire::Serializer.truncation_metadata` and serializer truncation
@@ -472,67 +520,16 @@ This SPI is documented support for integration gems, but not a compatibility
 freeze. It may change when the ecosystem gets cleaner. `contracts.md` is the
 source of truth for the current tier inventory.
 
-## Extension Contract Tests
-
-Extensions can require `julewire/core/testing` for small test primitives:
-
-- `Julewire::Testing::CaptureDestination`
-- `Julewire::Testing::NullOutput`
-- `Julewire::Testing.configure_capture_destination`
-- `Julewire::Testing::Chaos`
-- `Julewire::Testing::Contracts`
-- `Julewire::Testing::Coverage`
-
-These helpers are shipped support for Julewire extension and integration gems,
-not runtime application API.
-
-`Julewire::Testing::Chaos.assert_contained(test_context) { |error| ... }`
-runs a small `StandardError` corpus through containment checks. Use it for
-extension paths that promise to absorb formatter, processor, destination, or
-subscriber failures.
-`Julewire::Testing::Chaos.assert_core_runtime_containment(test_context)` runs
-the same corpus through core's curated runtime containment surfaces: processors,
-formatters, encoders, outputs, callbacks, and lifecycle hooks.
-`Julewire::Testing::Chaos.assert_destination_chaos_contract(...)` runs the
-same corpus through a destination's formatter, encoder, output or transport,
-and callback containment paths using destination builders supplied by the
-extension test.
-`Julewire::Testing::Chaos.assert_emitter_chaos_contract(...)` runs the same
-corpus through a subscriber/listener-style entrypoint while the extension test
-keeps ownership of framework-shaped failing inputs.
-`Julewire::Testing::Chaos.catalog { ... }` builds a deterministic component
-catalog, and `assert_discovered_chaos_contracts(...)` runs the corpus through
-registered processor, formatter, encoder, destination, subscriber, and listener
-entries. Use it when an extension can describe its containment surfaces without
-reflecting over framework internals.
-`Julewire::Testing::Chaos.raiser(error)` builds a callable that raises the
-supplied error.
-
-`Julewire::Testing::Contracts` contains shared extension assertions.
-`contracts.md` owns the current helper inventory.
-
-Contract helper tiers:
-
-- Component contracts (`processor`, `formatter`, `destination`,
-  `record_draft`, record shape/source) are the documented extension test surface.
-- Runtime, execution, propagation, integration, validation, truncation, bounded
-  transform, and scheduler contracts are integration SPI tests.
-- Chaos helpers are shipped support for containment checks. They are intended
-  for extension/integration test suites, not app runtime code.
-
-The runtime integration helper emits one point record inside an execution,
-adds context, carry, and summary data, flushes, and asserts that destination
-health is visible. Extensions provide their own output decoder and record paths,
-because formatters may move Julewire fields into a different output shape.
-
-`Julewire::Testing::Coverage` is shipped test support for Julewire
-extension gems. It only requires SimpleCov when `Coverage.start!` runs with
-`COVERAGE` set, so runtime users do not load coverage dependencies.
-
-The execution-boundary helper gives integration and propagation extensions the
-same probe data and lets the extension run it through its own unit of work. The
-failure-containment helper verifies that extension failures do not escape
-application calls and that health reports degradation.
+## Extension Tests
+
+Extensions can require `julewire/core/testing` for four small observation
+fixtures: `Julewire::Testing::CaptureDestination`,
+`Julewire::Testing::NullOutput`, `Julewire::Testing.capture`, and
+`Julewire::Testing.configure_capture_destination`.
+
+Core does not ship an assertion DSL or failure-corpus harness. Integration gems
+test their production formatter, destination, processor, subscriber, and
+framework boundary directly.
 
 ## Internal or Advanced
 
@@ -556,7 +553,8 @@ building another internal record.
 
 `Julewire::Core::RuntimeLocator.current=` is an advanced runtime hook for bridge
 code. A bridge runtime must support the child-side facade methods it exposes and
-the parent-side bridge calls it forwards: `emit_envelope`,
+the facade reset hook `reset_facade!`, strict `emit_integration`, plus the
+parent-side bridge calls it forwards: `emit_envelope`,
 `emit_summary_record`, and `flush`. It is deliberately duck-typed; incompatible
 runtimes fail when called, so application code should not replace it casually.
 
@@ -564,4 +562,5 @@ runtimes fail when called, so application code should not replace it casually.
 
 Core exposes the bridge SPI runtime envelope hook used by bridge code. The hook
 accepts detached input, context, attributes, carry, neutral data, and a scope
-snapshot, then routes them through the active pipeline.
+snapshot, then routes them through the active pipeline. Bridge code may pass
+`owned: true` only for data decoded from Julewire-owned wire formats.

data/docs/health-schema.md

@@ -3,6 +3,12 @@
 `Julewire.health` is an in-process operational snapshot. It is useful for
 metrics, smoke checks, and debug pages. It is not a delivery receipt.
 
+Counters and diagnostic references are updated atomically. A health read is
+not a transaction across those independent values: during a concurrent update,
+one snapshot may combine adjacent observations (for example, a new count with
+the preceding failure reference). Counters remain exact, and later reads
+converge on the latest diagnostic state.
+
 ## Stable Fields
 
 These fields are intended for integration dashboards and contract tests:
@@ -59,9 +65,13 @@ reset on reconfigure. Top-level `generation` increments when configuration
 installs a new pipeline.
 `pipeline.counts[:processor_dropped]` counts intentional processor drops such
 as sampling decisions; processor failures are counted separately under
-`pipeline.counts[:processor_error]`.
+`pipeline.counts[:processor_error]`. Unsupported processor return values keep
+the current draft and increment `pipeline.counts[:processor_invalid]`.
+Malformed processor-owned draft data also increments `processor_invalid`; core
+stops the chain and counts the resulting loss under `processor_dropped`.
 Destination-local processors report the same `processor_dropped` and
-`processor_error` counters under that destination's `counts`.
+`processor_error`/`processor_invalid` counters under that destination's
+`counts`.
 
 `status` fields describe current health for the active runtime generation.
 Runtime, pipeline, and destination failure counters plus `last_failure` /