@llblab/pi-actors 0.56.0 → 0.57.0

package/AGENTS.md

@@ -81,8 +81,8 @@ For ordinary Run-file investigation, follow the accepted [same-session research
 - `runs-retention.ts`: single owner of manual archive/prune and startup Run cleanup. Reuse lifecycle locks and ownership/generation/native/descendant/reuse guards; filesystem age is selection only, unknown PID is never absence. Keep candidate observations fenced across lock acquisition; ordinary temp preparation owns no Run deletion. Preserve manual APIs, TTL and evidence schemas. Automatic refusal/unbound retention does not certify positive native closure or add reporting. Manual retirement preserves an exact single surfaced rejection (including undefined/primitive/AggregateError) and ordered original/formatting/failed-evidence/lifecycle-release causes when multiple stages fail. Its journal appender separately preserves append plus release errors. Keep nested original aggregates intact and cause/errors non-enumerable; record failure text once under guard with compiled fallback, never let formatting mask primary. No synthetic missing id, rollback/retry, new public failure DTO or assumption that a pruned Run-local Trace survives. Queued/handled journal writes and filesystem effects remain independently committed observations; lower-layer already-masked faults are not recoverable by this owner.
 - `runs-artifacts.ts`: captured artifact references, body-free metadata observation and explicit hash manifests. Read-model reference observation never hashes file bodies; anchor relative paths to captured cwd without lexical retargeting of symlink/parent semantics.
 - `execution-sessions.ts`, `trace-projection.ts`, `control-projection.ts`, `recipe-projection.ts`, `session-evidence.ts`: shared bounded/redacted evidence owners. Recipe projection also owns pure captured-sensitive literal masking, explicit original recorded-content policy and exact reference comparison; these functions admit no identity/body/runtime authority. Recipe provenance privacy is shared by Recipe and canonical Trace context projection, stripping private origin fields/tokens without corrupting logical references. Trace coverage accounts for read omissions and malformed evidence.
-- `tools-message.ts`: exact Control facade and its implemented flat AX receipt/error projection. Private local field/next helpers preserve multiline value separators and outer indentation without a new presentation domain. Never duplicate run: in a labeled run value; canonical next-action targets and structured/verbose payloads stay unchanged. Queued/delivered does not certify handling, a legacy kill result leaves termination unconfirmed, and public dispatch errors retain exact private cause with no correlation disclosure. Whole-id omission reserves the complete safety/next record under16KiB; transport/admission/lock/native behavior is untouched.
-- `tools-inspect.ts`: exact `run:<id>`, `runtime`, `recipes`, and `tool:<name>` inspection. Fresh non-runtime compact text uses flat AX records, real required/optional argument sequences (including one item), opaque multiline values and whole literal focused-doctor source_location. Run views retain their compact run/view header only, not a new status/snapshot/body route. Structured/verbose details and tool schema JSON stay exact. Select at most the first existing hint; tools-response:formatInspectionHint recognizes only the three closed read-only recipes doctor/imports/summary literals, otherwise returns opaque instruction content without parsing/normalizing/spawning/registering. Full next_actions remains in details. The runtime compact branch also uses AX fields, selecting only its existing status identity/review facts, full exact-owner inventory length or existing triage pressure/attention counts. Keep full inventory independent of bounded verbose navigation and never derive counts from the40display rows. The successful compact branch adds no reads/caps/default snapshot/clock/source/recipient behavior; A1/B1 integration stays gated. Ten locally authored inspect errors now use private formatInspectFailure with exact existing guards, Error construction sites and dependency evaluation order. target_kind names the selector family, not admitted ownership. Supported values are actual sequences. Only missing-tool/schema errors retain their producer-known read-only next; this does not broaden formatInspectionHint's three-string recognizer. Unmarked helper fields must be bounded compiler literals/lists; every selected variable scalar is explicitly omittable. Seed each variable with its shorter complete value or whole-field omission row; reserve fixed facts/safety and an optional complete next, then admit whole values in source order without later shrinkage under existing16KiB minus the public adapter's one leading LF. An unfit action has next_action omission coverage, not a fake next command; counts are fields/actions, never raw/private character lengths. No clipping/character repair, catch-all, error wrapping, new Error metadata/schema or retries. Uncaught dependency/session/scope throws, existing runtime observation fallback and prior discovery/getter/String side effects remain; do not label all refusals effect-free or all errors AX.
+- `tools-message.ts`: exact Control facade and its implemented bare block-YAML metadata-only receipt/error projection. Private local selection helpers (`controlSelected`, `controlChoices`, `controlNextPart`, `controlDocument`) compose the shared tools-response `selectYamlField`/`growYamlDocument` primitives, keeping whole selected scalars/lists or explicit whole-field/sequence omission records, seeding the shorter complete-or-omitted form and growing by priority under the existing16KiB including the public LF; authored values stay quoted scalar content, never parsed back into fields. Never duplicate run: in a labeled run value; canonical next-action targets stay typed read-only inspect nodes and other advice stays one opaque `next.instruction`, while structured/verbose payloads stay unchanged JSON. Queued/delivered does not certify handling, a legacy kill result leaves termination unconfirmed, and public dispatch errors retain exact private cause with no correlation disclosure. Whole-id omission reserves the complete safety/next record; transport/admission/lock/native behavior is untouched.
+- `tools-inspect.ts`: exact `run:<id>`, `runtime`, `recipes`, and `tool:<name>` inspection. Fresh non-runtime compact text uses bare block-YAML metadata (native numbers/booleans/sequences, real required/optional argument sequences including one item, opaque selected values and one typed read-only `next` or opaque `next.instruction`), with whole-value-or-omission selection through the shared tools-response helpers, including complete required/optional argument-group coverage; verbose JSON must bypass compact formatting, and emitter unavailability must never become undefined text; focused doctor keeps its portable source_location as one whole quoted scalar. Run views retain their compact run/view header only, not a new status/snapshot/body route. Verbose text stays JSON of the unchanged details, while `tool:* view=schema` text is bare block-YAML generated metadata (own defined fields only, native parameter nodes) with the machine `details` object still exact JSON; an over-ceiling schema keeps the exact legacy JSON text rather than a clipped or partly reformatted document. Recipe `summary` and `registry` are one inspection path: the alias normalizes before the existing view guard and downstream projection, so identical `verbose` and other inputs yield identical facts, details and rendering, and the compact label stays `recipes: registry`. Neither name changes inventory, coverage or semantics; only `verbose` selects compact versus full output, and the view parameter description names the actual per-target sequences. Select at most the first existing hint; tools-response:formatInspectionHint recognizes only the three closed read-only recipes doctor/imports/summary literals, otherwise returns opaque instruction content without parsing/normalizing/spawning/registering. Full next_actions remains in details. The runtime compact branch also uses AX fields, selecting only its existing status identity/review facts, full exact-owner inventory length or existing triage pressure/attention counts. Keep full inventory independent of bounded verbose navigation and never derive counts from the40display rows. The successful compact branch adds no reads/caps/default snapshot/clock/source/recipient behavior; A1/B1 integration stays gated. Ten locally authored inspect errors now use private formatInspectFailure rendering bare block-YAML metadata with a field-local whole-field coverage record (state/reason/shown/omitted/total), native supported-value sequences and one typed read-only inspect next (or next_action coverage), under the existing shared budget with the public adapter's leading LF; the retained formatInspectNextAction stays a flat primitive for historical completion text, not a second refusal format. Exact existing guards, Error construction sites and dependency evaluation order remain. target_kind names the selector family, not admitted ownership. Supported values are actual sequences. Only missing-tool/schema errors retain their producer-known read-only next; this does not broaden formatInspectionHint's three-string recognizer. Unmarked helper fields must be bounded compiler literals/lists; every selected variable scalar is explicitly omittable. Seed each variable with its shorter complete value or whole-field omission row; reserve fixed facts/safety and an optional complete next, then admit whole values in source order without later shrinkage under existing16KiB minus the public adapter's one leading LF. An unfit action has next_action omission coverage, not a fake next command; counts are fields/actions, never raw/private character lengths. No clipping/character repair, catch-all, error wrapping, new Error metadata/schema or retries. Uncaught dependency/session/scope throws, existing runtime observation fallback and prior discovery/getter/String side effects remain; do not label all refusals effect-free or all errors AX.
 - `file-state.ts`: canonical generic file-mutation locks and atomic JSON/text writers. withFileMutationLock preserves an exact synchronous callback rejection and a later surfaced release fault as ordered non-enumerable standard AggregateError errors/cause, including undefined/primitive/original aggregates; never coerce/flatten, replay callbacks, roll back bytes or interpret returned thenables. A single callback/release-only rejection and normal return remain exact. Atomic replacement separately preserves a single surfaced native-shaped rejection exactly, including null/undefined; retry-code access is null-safe and guarded. If that access throws, ordered private standard AggregateError errors/cause retains original then observation fault without coercion/flattening; no retry follows failed classification. Keep ordinary EPERM/EBUSY 20-attempt / 19×50ms limits, one onBeforeReplace call and already committed bytes unchanged. This is not writer rollback, fsync or cleanup proof. Acquisition, token/reclaim/lock interval and best-effort removal uncertainty stay separate. No async locking, exhaustive cleanup/native closure, public receipt or recovery of already-masked lower writer causes follows. Controlled release-fault fixtures retain their exact owner/frame and assert no workload/host exit.
 - `state-readers.ts`: resilient JSON/JSONL parsing; strict UTF-8 JSON is opt-in; capped strict reads use available nonblocking/nofollow flags, require a regular opened descriptor and reach the complete declared file, never admit a valid prefix after premature EOF. Legacy degradation stays unchanged; bounded ownership-marker admission also selects strict reading. Execution manifest export/reference admission selects it; malformed bytes must not normalize into admitted source metadata.
 - `runtime-identity.ts`, `runtime-triage.ts`: immutable package/schema identity and pure pending/stale Control classification.
@@ -90,7 +90,7 @@ For ordinary Run-file investigation, follow the accepted [same-session research
 - `tools-spawn.ts`, `tools-register.ts`, `tools-local.ts`: Run creation, persistent capabilities, Recipe-backed tools and compact results. Compact spawn/async-tool launch receipts retain facts, expose actual existing-Run reuse and omit the redundant session-map hint only when the complete direct row is shown; absent/unavailable/omitted rows retain that request. Compact launch metadata uses bare block YAML with nested complete location values; preserve the original JSON details, expert facts, shared bounds and old completion text. Keep one leading result-separator LF for host invocation spacing, outside the pure YAML emitter. Spawn-verbose source selects legacy pretty JSON once after eager compact evaluation, then emits full YAML only from that clone without a new fixed byte/depth cap. Keep original stringify throws outside the projection catch; absent selected JSON, malformed selected keys/strings and recoverable post-selection failures withhold the whole projection with an attributable no-auto-repeat receipt, not repaired values, partial full facts or private causes. Returned details and unrelated JSON helpers stay unchanged; compiled-package and loaded-host adoption remain separate. Do not synthesize routine Run-inspection next actions or unconditional delivery/readiness promises. Preserve existing structured/verbose metadata, expert Inspect access and separately owned targeted diagnostic remediations. Runtime argument-repair guidance is pre-dispatch only: once an executor is entered or arguments are handed to the async launcher, rethrow the exact original value/cause/details even when its text matches validation prefixes. Preparation side effects, dispatch, actuation and closure remain distinct; add no retry and preserve configured execution policy.
 - `inspector.ts`: owned-Run evidence and exact-session/generation-fenced actions through injected canonical control dependencies. `inspector-overlay.ts` and `inspector-command.ts` retain UI/navigation and host command wiring separately. **Actor Inspector** remains the product and command name, not a separate domain.
 - `pi.ts`: Pi SDK envelope boundary. AX completion fallback identity comes from the closed terminal marker for new records or the original headers for retained captures when private details are stripped; keep the original legacy RegExp coercion order, reject noncanonical/indented/broken markers and never acknowledge by body equality; never let authored body labels or Unicode line separators override it. Preserve older header recognition and detailed-envelope precedence. Parsed ids remain hints until exact owned-journal/content admission; they grant no recipient, source or native authority.
-- `observability.ts`, `run-ui-runtime.ts`: Trace attention, terminal reconciliation and Pi delivery. Fresh urgent-steer admission uses formatRunSteerMessage's single canonical AX layout only after the retained run/generation/directory/event lookup. Envelope.content is already frozen presentation: replay it directly without a new journal aspect, source refresh or reformatting. Attention and steer have no presentation selector or alternate new-message formatter; deliverRunAttentionNotifications uses the same canonical AX primitives for new notify/followup output. Saved envelope.content remains the compatibility boundary. The two AX checkpoint/reference helpers now have real ordinary/urgent reuse inside observability; keep ordinary first-eight coverage independent of steer's shared16KiB reservation/refusal loop. No ambient ordinary byte cap, event/detail copy, wake change or regeneration of committed content follows. Fresh attention uses shallow typed block-YAML metadata, bare without a body and delimited before an opaque zero-added-indent body. Preserve scalar-aligned500UTF-16 legacy previews, existing ellipsis and unknown local/upstream loss, original stringify/getter faults, whole reference sequences and first-eight slots before malformed filtering. Ordinary notify/followup remains unbounded; urgent steer validates raw essentials before reference reads and fits the complete final YAML/body with later-group omission coverage under16KiB. Serialization stays local to observability, not a new global formatter allowance; selection/read/acceptance authority stays here. Fresh urgent diagnostics also reuse its opaque field primitive: event/attention/stage records distinguish retryable admission, failed send request with unconfirmed delivery/presentation, and queued recovery with its exact evidence status/reason. Do not infer no effect from an exception or turn checkpoint retry into workload replay. Diagnostic display keeps only240pair-aligned raw message units and authored Markdown, with boundary U+2026/[omitted: unknown] for loss and unavailable for malformed text. This current UI projection is separate from unchanged whitespace-normalized/trimmed4096-unit last_error, original Error/cause and frozen envelope.content; create no saved format/aspect, reader, recovery loop or extra source permission. Fresh locally owned runtime notices now use AX fields too: callback failure preserves the original onCallbackError value and opaque diagnostic; completion recovery preserves evidence status/pending phase/reason with no forced send; idle completion delivery is labeled accepted only after the original durable acceptance; teardown counts/whole literal summary path are explicitly report data, not scope closure. Watcher/retirement messages are forwarded unchanged from observability's new AX producer formatting. Watcher messages reuse the already captured detail/recovery strings: never read Error.message twice, add primitive-error coercion, change raw signatures/IDs/ts/dedup/32suffix/rearm policy or regenerate older diagnostic text. Paths stay whole dynamic literals. Retirement notices preserve optional-notify argument short-circuiting, exact error-message observations, attempted/sendStop/cancel/result/failure behavior including notifier throws, and unconfirmed closure. Stop returned and cancellation reported are not native success; fallback reason is stop path failed because the path also contains notifier execution. Do not repair already-discarded lower causes or rewrite result errors from the display. No new clipping, identities, state reads, notifier timing/levels/dedup, retries, error wrappers or native authority. Fresh completion admission creates canonical AX only after existing owner/location rechecks; an already-admitted batch returns untouched, including every older presentation format. Keep active/idle timing, acceptance, exact generation and source admission authority unchanged; fresh completion-prefix allocation follows the run-delivery contract below. Color terminal status only in `ctx.mode === "tui"`; JSON/print/RPC status must not require an initialized terminal theme or disable mandatory completion delivery. Shared ready-forest selection and ambient candidate checks are metadata-only for primary sources. Read/verify a selected primary source only when collecting eligible completion members, retaining exact source owner/generation and refusing capture promotion or lost-source stdout substitution. Unsupported complete raw-stream selections remain explicit or legacy diagnostics, never fabricated primary output; separately admitted executor-final-response text is not complete raw-stream selection.
+- `observability.ts`, `run-ui-runtime.ts`: Trace attention, terminal reconciliation and Pi delivery. Fresh urgent-steer admission uses formatRunSteerMessage's single canonical AX layout only after the retained run/generation/directory/event lookup. Envelope.content is already frozen presentation: replay it directly without a new journal aspect, source refresh or reformatting. Attention and steer have no presentation selector or alternate new-message formatter; deliverRunAttentionNotifications uses the same canonical AX primitives for new notify/followup output. Saved envelope.content remains the compatibility boundary. The two AX checkpoint/reference helpers now have real ordinary/urgent reuse inside observability; keep ordinary first-eight coverage independent of steer's shared16KiB reservation/refusal loop. No ambient ordinary byte cap, event/detail copy, wake change or regeneration of committed content follows. Fresh attention uses shallow typed block-YAML metadata, bare without a body and delimited before an opaque zero-added-indent body. Preserve scalar-aligned500UTF-16 legacy previews, existing ellipsis and unknown local/upstream loss, original stringify/getter faults, whole reference sequences and first-eight slots before malformed filtering. Ordinary notify/followup remains unbounded; urgent steer validates raw essentials before reference reads and fits the complete final YAML/body with later-group omission coverage under16KiB. Serialization stays local to observability, not a new global formatter allowance; selection/read/acceptance authority stays here. Fresh urgent diagnostics also reuse its opaque field primitive: event/attention/stage records distinguish retryable admission, failed send request with unconfirmed delivery/presentation, and queued recovery with its exact evidence status/reason. Do not infer no effect from an exception or turn checkpoint retry into workload replay. Diagnostic display keeps only240pair-aligned raw message units and authored Markdown, with boundary U+2026/[omitted: unknown] for loss and unavailable for malformed text. This current UI projection is separate from unchanged whitespace-normalized/trimmed4096-unit last_error, original Error/cause and frozen envelope.content; create no saved format/aspect, reader, recovery loop or extra source permission. Fresh locally owned runtime notices use tools-response.ts:formatYamlNotice, a UI-only flat-field serializer without the model byte/depth ceilings: retain full well-formed fields, withhold malformed selected text explicitly, and keep existing diagnostic-preview bounds. Callback failure preserves the original onCallbackError value and opaque diagnostic; completion recovery preserves evidence status/pending phase/reason with no forced send; idle completion delivery is labeled accepted only after the original durable acceptance; teardown counts/whole literal summary path are explicitly report data, not scope closure. Watcher/retirement messages are forwarded unchanged from observability's new AX producer formatting. Watcher messages reuse the already captured detail/recovery strings: never read Error.message twice, add primitive-error coercion, change raw signatures/IDs/ts/dedup/32suffix/rearm policy or regenerate older diagnostic text. Paths stay whole dynamic literals. Retirement notices preserve optional-notify argument short-circuiting, exact error-message observations, attempted/sendStop/cancel/result/failure behavior including notifier throws, and unconfirmed closure. Stop returned and cancellation reported are not native success; fallback reason is stop path failed because the path also contains notifier execution. Do not repair already-discarded lower causes or rewrite result errors from the display. No new clipping, identities, state reads, notifier timing/levels/dedup, retries, error wrappers or native authority. Fresh completion admission creates canonical AX only after existing owner/location rechecks; an already-admitted batch returns untouched, including every older presentation format. Keep active/idle timing, acceptance, exact generation and source admission authority unchanged; fresh completion-prefix allocation follows the run-delivery contract below. Color terminal status only in `ctx.mode === "tui"`; JSON/print/RPC status must not require an initialized terminal theme or disable mandatory completion delivery. Shared ready-forest selection and ambient candidate checks are metadata-only for primary sources. Read/verify a selected primary source only when collecting eligible completion members, retaining exact source owner/generation and refusing capture promotion or lost-source stdout substitution. Unsupported complete raw-stream selections remain explicit or legacy diagnostics, never fabricated primary output; separately admitted executor-final-response text is not complete raw-stream selection.
 - `run-delivery.ts`: owner-scoped durable packet/phase persistence and bounded projections. Fresh ordinary source admission captures presentation_format=ax_records, own-data result_layout=completion_yaml_core_v1 and frozen text_budget, with no presentation selector/excerpt_format; direct and ordinary UI admission share this path. The separate inactive numbered-stream capture still inherits frontmatter_v2; do not change the private default globally or relabel retained captures. Preserve all stored encodings/absence and exact replay bytes/hints, including headings_shared_kinds and frontmatter_v1/v2; reject mixed/unknown aspects without invoking accessors. Journals store snapshots, not complete text, so neither an unreleased version nor a schema fix permits rewriting old codecs. The second frontmatter capture layout quotes unknown index as YAML "?"; the first keeps its original bytes, including unquoted ?. Fresh headers begin index, run, state, then admitted kind:primary/diagnostic; meaningful metadata and whole source/generation/location references follow. Display index is not member_index or native identity. Raw admitted Markdown follows the closed YAML at the left margin, without #N heading, result:/preview: wrapper, structural list indentation or whole-body literal fence. Known display loss is [N characters omitted] at the cut; no added ellipsis or body clipping flags/counts in YAML. Preserve structured original coverage facts and unknown upstream/fallback completeness/privacy outside metadata; fallback has no primary kind. Visible text is admitted output/final Actor response or error/failure diagnostics, never command metadata or copied command excerpts. Source text_basis remains technical. No routine group windows/status copies, members wrapper, outer counters, Batch caption or standing full-map instruction appears in new model content; captured facts remain journal data. Material whole-result/reference omission, non-done omitted states and a whole inventory reference remain explicit. A single shown row keeps the same shape even when other results were omitted. Complete model content includes all exact references and only the necessary YAML-core packet identity/relative body-marker lengths, without fresh compiler HTML tails, under49152UTF-8 bytes for up to64candidate rows/256captured members. Equal scalar/CRLF-safe text-prefix shares freeze at admission, including service overhead; no redistribution, fixed16KiB result/2KiB preview cap, source recapture or later reallocation. Preserve every saved16KiB/48KiB allowance. Prefix admission must consider full-list/decimal discontinuities rather than miss fitting rows when omission scaffolding shrinks. Whole text has no display-cut marker when complete; known upstream clipping still forbids a full-original-output claim. The source reader selects at most48KiB from the same verified postprivacy observation; source-binding previews stay160code points. Retain chosen packet prefixes, not64independent48KiB copies. Unfit metadata rows keep bounded inventory recovery. Curate/copy/freeze members, arrays, artifacts and bindings; schema DTOs grant no publication permission and phase changes do not mutate member facts. Preserve generation/parent/source identities, exact ranges/hashes and whole references. The completion-only TUI uses independent native Markdown body components and literal Text header/marker/service components, with no global Markdown patch, source/native IO or scheduling authority. Validated compiler header rows alone may hide whole reference/location data in compact view; authored body lookalikes never disappear. Fresh ordinary hints use completion_yaml_core_v1 plus a whole-content digest; validated core lengths derive block positions. Retained completion_frontmatter_v1 hints keep their SHA-256-bound UTF-16 header/body/marker/service blocks and original compiler frames, dense ordered coverage and scalar/CRLF-safe endpoints. Invalid/missing hints and expansion reveal original full Text. These are display/correlation consistency, not authentication/read/action/acceptance/native authority. Malformed frontmatter-shaped stripped history cannot regain identity from a body Batch label or become absence/retry permission; ordinary thematic-break prose retains its legacy path. Retained pre-record codecs keep host rendering; older record/literal codecs keep exact original hints, dynamic fences, count spelling and separators. Fresh ordinary indices remain packet-local; no default stream activation follows. Fresh UI member locations are observed before journal locks after actual current-session selection/recheck, with captured_file_locations and frozen file_navigation. Data-only decoding does not grant current body/source visibility. Location snapshots retain16KiB, outcomes outrank lower-priority references, and each shown record has a whole location row or explicit omission; wholly omitted records stay inventory-covered. Reload/render/phase recovery never refreshes sources or frozen availability. Old absent/current_session_request captures keep their bytes, and optional full-map research stays a separate current-session action. Source/package checks do not prove the loaded host was reloaded.
 - automatic draft/tool review domains: structurally redacted model review, journaled mutation, lineage, recovery, and explicit retry/reset safety.
 
@@ -186,23 +186,23 @@ Inspector Kill confirmation is a compact popup composited over the unchanged Ins
 
 Inspector Kill cancellation is silent: Esc/n or Enter on Cancel only closes the dialog; no cancellation feedback or extra dismissal. Successful callbacks already suppress duplicate success text and invalidate the visible Run status. Preserve that behavior and the original ok/getter/error/generation/once-only semantics; failures/refusals/uncertainty stay visible. This is local Inspector feedback policy, not suppression of other delivery surfaces or native-closure proof.
 
-Inspector feedback displays the whole already-selected message directly in a modal popup: no synthetic i: prefix, i command, secondary reader or extra feedback field wrapper. Preserve authored lines/blanks/indentation/backticks opaquely through existing native-column wrapping. Esc closes the notification and clears transient feedback; only unavoidable overflow scrolls in that same popup with arrows/PgUp/PgDn. Other action/navigation keys cannot reach underlying work. A private feedbackFromAction flag comes only from entering the existing confirmKill callback path, never from message text or proof of actuation; only that path pins closure: unconfirmed and No automatic retry outside the scrollable text. Local guards/cancellation do not gain invented uncertainty receipts. Kill and feedback share a bounded rectangle compositor with terminal-default background resets, not customMessageBg or hard-coded black; selected confirmation buttons retain selectedBg. Preserve the underlying document/Trace/selector rows, stripes, focus and scroll. Cache only the last normal Inspector frame as a transient modal underlay; native column resize must not refresh evidence while a modal is open, and closing resumes the existing invalidation path. The underlay is a captured display, never fresh status/ownership/native proof. Ctrl-C retains global close behavior. Never read raw Error/cause, renew authority or reconstruct normalized180/160-unit tails. Fresh producer formatting is now AX through inspector.ts:formatActorInspectorKillFeedback, a pure selected-value formatter with actual domain/overlay reuse; it grants no source/privacy/work authority. Domain bounded retains String(value ?? empty), whitespace normalization/trim and its180-unit rule (179prefix+boundary ellipsis when clipped); overlay catch retains original Error.message versus primitive String selection, replaceAll,160slice and template coercion. Only split-pair boundaries retract one unit; malformed selected text is unavailable/unknown without fake gap or scalar repair. Dynamic selected previews use a legacy basis note and unknown loss when clipped; compiler refusal literals get no invented legacy loss. Shared action/result/state-or-diagnostic/closure records preserve ok, exact calls/getters/String/throws and success suppression, without recovering hidden lower causes. The popup recognizes only the exact anchored first two AX header lines for display color, retaining legacy-prefix compatibility; never parse body labels into actions/identity. The old195-character test bound described only the old prefixed envelope; enforce its180-unit preview allowance independently from new AX scaffolding. No journal aspect/version or saved packet migration for these fresh UI-only results.
+Inspector feedback displays the whole already-selected message directly in a modal popup: no synthetic i: prefix, i command, secondary reader or extra feedback field wrapper. Preserve authored lines/blanks/indentation/backticks opaquely through existing native-column wrapping. Esc closes the notification and clears transient feedback; only unavoidable overflow scrolls in that same popup with arrows/PgUp/PgDn. Other action/navigation keys cannot reach underlying work. A private feedbackFromAction flag comes only from entering the existing confirmKill callback path, never from message text or proof of actuation; only that path pins closure: unconfirmed and No automatic retry outside the scrollable text. Local guards/cancellation do not gain invented uncertainty receipts. Kill and feedback share a bounded rectangle compositor with terminal-default background resets, not customMessageBg or hard-coded black; selected confirmation buttons retain selectedBg. Preserve the underlying document/Trace/selector rows, stripes, focus and scroll. Cache only the last normal Inspector frame as a transient modal underlay; native column resize must not refresh evidence while a modal is open, and closing resumes the existing invalidation path. The underlay is a captured display, never fresh status/ownership/native proof. Ctrl-C retains global close behavior. Never read raw Error/cause, renew authority or reconstruct normalized180/160-unit tails. Fresh producer formatting is now AX through inspector.ts:formatActorInspectorKillFeedback, a pure selected-value formatter with actual domain/overlay reuse; it grants no source/privacy/work authority. Domain bounded retains String(value ?? empty), whitespace normalization/trim and its180-unit rule (179prefix+boundary ellipsis when clipped); overlay catch retains original Error.message versus primitive String selection, replaceAll,160slice and template coercion. Only split-pair boundaries retract one unit; malformed selected text is unavailable/unknown without fake gap or scalar repair. Dynamic selected previews use a legacy basis note and unknown loss when clipped; compiler refusal literals get no invented legacy loss. Shared action/result/state-or-diagnostic/closure records preserve ok, exact calls/getters/String/throws and success suppression, without recovering hidden lower causes. The popup recognizes only the exact anchored first two AX header lines for display color, retaining legacy-prefix compatibility; never parse body labels into actions/identity. Verified current producer results classify failed/rejected as error and unavailable/state-only as warning, and authored lookalikes stay warning because only the exact leading pair counts; the color grammar is display-only and no action/identity follows from rendered text. The old195-character test bound described only the old prefixed envelope; enforce its180-unit preview allowance independently from new AX scaffolding. No journal aspect/version or saved packet migration for these fresh UI-only results.
 
 Trace table alone now receives actual inner width and projects one physical preview line with native truncateToWidth(..., ellipsis). Its private traceTableLine marks genuine column/CRLF/CR/LF gaps, not source loss, privacy or lifetime counts; full already-projected item/detail remains unchanged. Compact warning fallbacks must retain whole incomplete-history and recorded-not-lifetime/unavailable-rank meaning before optional details, without partial values presented as exact counts. At the24column component floor, Trace incomplete… and # recorded ≠ lifetime / #? unavailable preserve safety; wider captions keep prior wording when it fits. No generic fit/selector/chrome modification, extra banner row, source probe, projection cap/filter/read ordering, source counter/rank/ID or selection/cache/scroll/stripe change. ANSI resets are renderer output: assertion matching uses native stripTerminalSequences rather than assuming ellipsis is the final byte. Never turn display-gap markers into fabricated omitted-character counts or new source-body permission.
 
 Four compiler-owned Control guard errors now use private tools-message.ts:controlGuardText: unsupported runtime action, missing runtime port, unavailable Run generation and undeclared actor-local action. Format only existing caller target/action, fixed result and real supported_actions/available_actions string sequences; no saved status/owner/generation/input/correlation, mutating next or no-effects claim. Keep exact normalizer/access/declaration/dispatch order and original status/getter observations. Preserve the old undeclared join/template evaluation before formatting because its hooks/coercion can throw; its output is not an action parser. Under the shared16KiB including leading LF, whole target and whole option group grow from shorter full-or-omitted seeds, avoiding false overflow from longer omission scaffolds. Counts cover selected fields/list entries, not chars, valid-action proof or private/upstream completeness; malformed selected UTF16 withholds the whole option group without repair. No new catch, Error metadata, cause access, source read, schema or dispatch. Unowned runtime/dependency/session/normalizer/kill/archive/prune errors and awaited-send-only cause boundary remain unchanged. Reuse all14original Control declarations and whole16source/npm owner with exact standard Error/host isError/opaque value/order/budget/legacy-join properties.
 
-Only three local pre-launch spawn guards use tools-spawn.ts:spawnGuardText: unsupported state_dir, as without run: namespace and invalid id spelling. field/value identifies selected caller input, never an admitted Run, generation, launched/no-effects receipt or retry permission. Keep original state_dir/as/startsWith/slice/regexp order, including two as getter reads and target template coercion exactly once on the original error branches. The formatter must not reread input or serialize state_dir values. Whole selected strings and opaque CRLF Markdown fit16KiB including leading LF or have whole-field omission; malformed selected UTF16 is unavailable without repair or char/private-tail counts. Keep all startRun/session/Recipe/draft/navigation/success/verbose/details code outside new catches; the original post-guard launch tail stays byte-equal. Existing tools.test/invocation/SDK native fixtures remain untouched. New tools-spawn.test.ts is the exact library-owner mirror, not a feature-name exception; its two pure-guard properties run in source, explicit conformance and whole installed replay without new native work. Actual host clones arguments and rejects unsupported state_dir by its unchanged schema before execute: do not bypass validation, claim that SDK error is AX, or project direct accessor probes through cloning. Namespace/id guard errors do cross the real host isError boundary. No new module/authority; the earned tools-spawn→limits edge uses the existing shared response cap.
+Only three local pre-launch spawn guards use tools-spawn.ts:spawnGuardText: unsupported state_dir, as without run: namespace and invalid id spelling. field/value identifies selected caller input, never an admitted Run, generation, launched/no-effects receipt or retry permission. Keep original state_dir/as/startsWith/slice/regexp order, including two as getter reads and target template coercion exactly once on the original error branches. The formatter must not reread input or serialize state_dir values. Guard documents are bare block YAML (field/result/accepted_format/id_rule plus one whole selected value); the selected string fits16KiB including leading LF as one quoted scalar or has an explicit whole-field omission record, and malformed selected UTF16 is unavailable without repair or char/private-tail counts. The pre-dispatch argument-repair error keeps owned tool/required/optional facts in a closed `---` header and leaves the original validation prose and verbatim JSON invocation example as unparsed body text under the shared frameMetadataDocument primitive; never parse or reserialize that example, and metadata-only guidance stays bare. Keep all startRun/session/Recipe/draft/navigation/success/verbose/details code outside new catches; the original post-guard launch tail stays byte-equal. Existing tools.test/invocation/SDK native fixtures remain untouched. New tools-spawn.test.ts is the exact library-owner mirror, not a feature-name exception; its two pure-guard properties run in source, explicit conformance and whole installed replay without new native work. Actual host clones arguments and rejects unsupported state_dir by its unchanged schema before execute: do not bypass validation, claim that SDK error is AX, or project direct accessor probes through cloning. Namespace/id guard errors do cross the real host isError boundary. No new module/authority; the earned tools-spawn→limits edge uses the existing shared response cap.
 
-Successful normal register/update-or-persisted receipt text now belongs to private registry.ts:registrationReceiptText, not a tools-register catch or a new presentation domain. Project only original post-activation tool/outcome/source/callable flag, the originally observed optional display boundary, selected required/optional args, warnings and first existing hint. Source references remain whole dynamically fenced literals, template stays a scalar; lists include singletons and opaque CRLF entries. Invocation advice is opaque instruction, never a parsed/trusted call; only the producer's existing unverified tool-status hint becomes typed read-only next. No new active/persisted/validated/default/body fields are added to compact text. Original warning map/join, outcome/boundary and Schema.formatToolArgs/template observations stay ordered before new formatting because faults can follow persistence/activation/notify. Capture the old optional boundary call in place; never query activation again for copy or repair disagreeing compact/details facts from dynamic getters. Everything in transaction/rollback/notify and details stays unchanged. Under16KiB including the old public LF, shorter full/omitted seeds grow monotonically; reserve fitting complete safety warnings before name/source/hint and large arg groups. Counts cover selected fields/list entries/actions, not raw/private chars; malformed/non-text selected values are unavailable without repair or another coercion. Preserve all14original registry declarations/scenarios/assertions/fixtures/cleanup except one approved layout expectation and pre-import test environment; add2properties and whole16installed replay. The unchanged sibling-process fixture's production new URL reference is remapped alongside direct imports, not its fixture/assertion/cleanup code. Its process-lock comparison is not new Actor/native/host readiness proof. Registry list/delete/draft/errors/notifier text remain separately scoped. The earned registry→tools-response/limits edges reuse existing field/fence/inspect and budget owners without new exports or callbacks.
+Successful normal register/update-or-persisted receipt text now belongs to private registry.ts:registrationReceiptText, not a tools-register catch or a new presentation domain. Project only original post-activation tool/outcome/source/callable flag, the originally observed optional display boundary, selected required/optional args, warnings and first existing hint. Successful normal receipts use bare block YAML. Source references remain exact safely quoted scalar values, template stays a scalar, and argument/warning groups are native sequences including empty argument lists and opaque CRLF entries. The already selected normal callability Boolean stays Boolean; absent warnings stay absent. Invocation advice is opaque instruction, never a parsed/trusted call; only the producer's existing unverified tool-status hint becomes typed read-only next. No new active/persisted/validated/default/body fields are added to compact text. Original warning map/join, outcome/boundary and Schema.formatToolArgs/template observations stay ordered before new formatting because faults can follow persistence/activation/notify. Capture the old optional boundary call in place; never query activation again for copy or repair disagreeing compact/details facts from dynamic getters. Everything in transaction/rollback/notify and details stays unchanged. Under16KiB including the old public LF, shorter full/omitted seeds grow monotonically; reserve fitting complete safety warnings before name/source/hint and large arg groups. Counts cover selected fields/list entries/actions, not raw/private chars; malformed/non-text selected values are unavailable without repair or another coercion. Preserve all14original registry declarations/scenarios/assertions/fixtures/cleanup except one approved layout expectation and pre-import test environment; add2properties and whole16installed replay. The unchanged sibling-process fixture's production new URL reference is remapped alongside direct imports, not its fixture/assertion/cleanup code. Its process-lock comparison is not new Actor/native/host readiness proof. Registry list/delete/draft/errors/notifier text remain separately scoped. The earned registry→tools-response/limits edges reuse the pure YAML emitter and existing budget owner without new exports or callbacks.
 
-Registry list/deletion returned text stays in registry.ts. List only the original in-memory Map keys after the same sort and conditional map/join; capture old compiler-prefixed rows so rendering never coerces raw keys again. The whole selected name group fits16KiB including public LF or is wholly omitted/unavailable with selected-name coverage; do not invent a page/row/work quota or label a withheld group none. Count current selected names, not active/callable/complete-host/lifetime facts or private chars. Multiline names remain opaque and malformed selected text is not repaired. Deletion keeps original lookup→optional file unlink→map deletion→active-set update→notify order and exact partial-effect exceptions; a map miss does not authorize orphan-file deletion/deactivation. Capture the original name template conversion once at the returned-text site, preserving legacy method-bearing identity behavior without source re-coercion. Keep the exact complete-registry reload note as opaque instruction, never a typed action or permission to reload/retry. Details, notifier text, normal registration/draft/transaction/errors and all original source/npm fixtures remain independently owned.
+Registry list/deletion returned text uses bare block YAML in registry.ts. Strip only the captured compiler prefix after the same in-memory Map-key sort and conditional map/join; never coerce raw keys again. Empty selection is a native empty sequence; withheld groups retain explicit scalar omission/unavailability and selected-name coverage. Reuse the shared pure emitter and include YAML escaping, indentation, trailing LF and the public separator LF in the existing cap. Fixed fallback metadata contains only compiler strings and finite array-length counts, not arbitrary inputs or getters. Source conformance does not establish compiled/package/loaded-host acceptance. The whole selected name group fits16KiB including public LF or is wholly omitted/unavailable with selected-name coverage; do not invent a page/row/work quota or label a withheld group none. Count current selected names, not active/callable/complete-host/lifetime facts or private chars. Multiline names remain opaque and malformed selected text is not repaired. Deletion keeps original lookup→optional file unlink→map deletion→active-set update→notify order and exact partial-effect exceptions; a map miss does not authorize orphan-file deletion/deactivation. Capture the original name template conversion once at the returned-text site, preserving legacy method-bearing identity behavior without source re-coercion. Keep the exact complete-registry reload note as opaque instruction, never a typed action or permission to reload/retry. Details, notifier text, normal registration/draft/transaction/errors and all original source/npm fixtures remain independently owned.
 
-Draft promotion returned text projects only original selected name/new-update/source=draft/callable display/first hint, not the normal registration receipt's args/warnings/boundary fields or policy. Preserve name→callable→hint template conversions exactly once at their old site after notify, including String-hint coercion, Symbol rejection and primitive/opaque faults after already committed promotion effects. Never Boolean-normalize a legacy zero/object flag display, infer hint kind from its visible value, reread activation or add ordinary-registration rollback/admission. A closed canonical tool-status hint may be typed; invocation/other advice stays opaque instruction. Whole selected scalar/action fields fit16KiB including existing LF or have field/action omission, with malformed strings unavailable without repair; counts are not hidden chars. Source path/defaults/body/args and details stay undisplayed/unchanged, including dynamic activation disagreement. Preserve original source/npm owners and separate direct nonstandard-port probes from actual SDK DTO/host readiness evidence.
+Draft promotion returned text uses bare block YAML for only original selected name/new-update/source=draft/callable display/first hint, not the normal registration receipt's args/warnings/boundary fields or policy. Its already selected callable display remains a safely quoted string, including "false", "true" and "0", never a reconstructed Boolean. YAML escaping, indentation, trailing LF and the public separator LF count within the existing cap. Preserve name→callable→hint template conversions exactly once at their old site after notify, including String-hint coercion, Symbol rejection and primitive/opaque faults after already committed promotion effects. Never Boolean-normalize a legacy zero/object flag display, infer hint kind from its visible value, reread activation or add ordinary-registration rollback/admission. A closed canonical tool-status hint may be typed; invocation/other advice stays opaque instruction. Whole selected scalar/action fields fit16KiB including existing LF or have field/action omission, with malformed strings unavailable without repair; counts are not hidden chars. Source path/defaults/body/args and details stay undisplayed/unchanged, including dynamic activation disagreement. Preserve original source/npm owners and separate direct nonstandard-port probes from actual SDK DTO/host readiness evidence.
 
 Exactly four assertRegisterToolInputModes errors now use fixed AX compiler strings in place: removed values, invalid/empty from, mixed source modes and from args/async inheritance. Do not add a helper/catch, inspect supplied values or change hasOwn/getter/trim/mode-count/outer-lock observations to format these constants. Replacement/reference/source-mode/inherited-field choices are actual lists; original repair advice is opaque instruction, never typed mutating retry or no-effects proof. The same non-empty-from legacy sentence also exists in normalizeFromReference: keep that owner separate and use a unique guard context for edits. SDK clone/coercion/validation stays outside these local refusals: removed values/object-valued from may fail before execute, while numeric from is cloned/coerced to a string and an unnamed request can retain its old listing result. Do not force every wrong-typed host input through the direct guard, spoof schema or infer original caller types from post-validation params. Direct descriptor/getter/fallible-trim failures remain exact. All successful receipts and other registry errors/notices stay independently closed.
 
-Three ordinary executeRegisterToolUnlocked guards now project name/source AX errors only: invalid normalized name (no new raw echo), reserved name (original selected template conversion exactly once) and a new registration missing every source. Preserve all name/has/normalize/reserved-set/resolution/template/authoritative-map/blocker order and exact unowned faults; existing dependency blocker text is not a locally authored constant to restyle. Empty name stays listing and existing-tool update can still reuse its source. Reserved display uses one whole selected scalar within16KiB including old public LF, or field omission/unavailability without repair/char-tail inference; preserve legacy method-bearing identity conversions rather than re-normalizing the display. Missing-source choices are a real list and old repair advice is opaque instruction. No new catch, source/body/activation probe, registry policy, overwrite/retry authority, machine field or operation. Keep successful and other-error branches closed; compare guards against real SDK clone/coercion/schema separately from direct accessors. Both duplicate-registration refusals now reuse private duplicateRegistrationText for only the old selected name display, fixed result and exact opaque Use update=true to overwrite advice. Preserve ordinary authoritative-file/current-Map versus draft current-Map/exists short-circuit predicates, blocker-before-update and original five legacy name normalization/path/display conversions. No body/source/metadata reread, policy merge, update/overwrite/retry permission, blanket catch or no-effects receipt follows. Three template-shape constants now identify template/result: nested Recipe-shaped object with old opaque correction, empty sequence and unsupported type with real string/object/sequence choices. Only strings changed; preserve typeof/Array/key/getter/trim/reference/expand order, both helper call paths and external errors. Front null/empty deletion, undefined inheritance, later authoring null/required checks and host coercion remain distinct. A changing-getter draft probe is direct preservation evidence, not a cloneable two-source SDK contract. Four authored validation constants now identify defaults/description/template with only fixed field/result: non-object defaults, missing command-template description, null at authoring and missing final template. Preserve original args→from→description→defaults→retained-template order and all normalization/caller predicates. No new body/value echo/coercion, global null/source rule or wrapper; front deletion, inherited source, Schema argument diagnostics and observation faults retain their owners. Direct controlled method/getter probes are not SDK DTOs; host may reject defaults before execute and route missing/front-null requests through earlier source/deletion behavior. The delegated-source runtime-owned-default refusal now projects only the original first selected key plus fixed defaults/result and exact old correction as opaque instruction. Object.keys/find and the private eight-name membership stay unchanged; do not list all names, inspect values for copy, optimize rejection before normalizeDefaults finishes, or generalize the guard to command templates. Native keys are finite ASCII so full output is provably bounded without a new helper/quota/omission policy; original copy/accessor faults and command-template later stages remain. Both assertDraftPath refusals now reuse private draftPathFailureText with only the already captured allowed_root or resolved path as a whole literal field; never echo the refused caller path in the root error. Preserve original getRecipeRoot/resolve/relative/equality/dot-prefix/exists order and existing Error/formatter sites; this does not repair containment, add probes or prove absence/native closure. Full scalar references fit16KiB including LF, else whole-reference omission/unavailability without repair/count inference; keep old inspect-summary advice opaque and unchanged, not upgraded into a new listing guarantee. Only the public from-normalization catch wrapper now uses sourceNormalizationFailureText for old displayed source, selected reason, opaque legacy active_skills_summary and opaque doctor instruction. Inner normalizeFromReference errors and catch extent stay unchanged; preserve Error.message.trim versus String(error), source/reason/summary/advice left-to-right template conversions, and both canonical doctor regex/identity conversions. Never repair display/hint disagreement or undefined display, parse summary commas into a complete list, reread metadata/private causes or skip fallible old evaluations to fit budget. Whole fields grow from shorter full/omitted seeds under16KiB including LF; malformed selections unavailable without repair/char-tail inference. Normal-registration candidate-admission refusal now uses candidateAdmissionFailureText only for its two existing requestedSource truthy/falsy branches. Preserve real admitUserRecipe/validated/tool/diagnostics join and pre-Error sourceDiagnostic construction order; a truthy display object rendering empty is not the falsy branch. Joined diagnostics/legacy summary stay opaque, with original4096-UTF16 admission cap and possible malformed clipping unchanged. Fitting diagnostics get budget priority; no new body/cause read, full-list inference, catch/policy/rollback/readiness or automatic retry. Tests must use actual admission results, serialize/restore any targeted join/global Error instrumentation and settle before cleanup; never fabricate results or weaken schema for fixtures. Two draft invalid-Recipe errors now use private draftRecipeFailureText only for old selected raw reason or joined candidate diagnostics; no new path/body. Keep readRawRecipeConfig then diagnoseRawRecipeConfigFailure as separate calls, reason truthiness/once-only coercion and draft Error lookup before join (unlike normal candidate pre-Error construction). Undefined reason stays absent; a truthy object displaying empty remains a present empty reason. Whole opaque value fits16KiB/LF or is omitted/unavailable; candidate4096UTF16 legacy selection stays unchanged. Real fs/metadata faults and actual admission results must remain, with serialized restored builtins/ESM bindings and no normal/draft policy merge. Only outer post-cleanup transaction error text now uses registrationTransactionFailureText for old stage, resolution_generation, legacy active_skills_summary and surfaced error, with original template conversions at the same Error/formatter site. Cleanup/persisted bytes/unlink/Map/reactivation/setActive and their exact failures remain unwrapped; formatting faults can follow all those effects. Resolution generation is not Run/live epoch/correlation. Error.message is not newly trimmed or causes disclosed. Whole opaque values grow from shorter representations within16KiB/LF, prioritizing fitting surfaced error; legacy inner rollback/advice text remains content, not a fresh rollback/readiness/retry guarantee. Three registry notification arguments now use private registryNoticeText for only original report identity/selected name. report means compiler notice, not proved callable/host removal. Keep callback lookup/name interpolation once and callback type/position/post-effect exceptions unchanged; no activation/metadata reread or model16KiB quota. Actual runtime.notify retains hasUI gate, TUI ThemedText→native Text renders literal multiline and RPC forwards message fire-and-forget. Full well-formed values remain unbounded as before; malformed selected name unavailable without repair/hidden char counts. Loaded colored terminal/phone remains separate from native headless width tests. Runtime Recipe watcher warning/refresh messages now use report and opaque instruction constants only. Preserve direct ctx.ui.notify without adding hasUI gating, all dedup/timer/load/callback ordering and exact contained errors; old reported default root is not a freshly verified location. Runtime startup-warning AX projection preserves original classification/filter/map/push/join/template coercion before projecting known compiler warning slots into category sequences. Captured slot ranges are not authored-label parsing; old compiler layout bytes are discarded only after original join/coercion. Reuse unbounded formatMarkdownField for opaque multiline entries; malformed selected warning unavailable without repair/count guesses, doctor advice opaque. Do not add hasUI short-circuit before formatting or reconstruct missing causes/metadata.
+Three ordinary executeRegisterToolUnlocked guards now project name/source AX errors only: invalid normalized name (no new raw echo), reserved name (original selected template conversion exactly once) and a new registration missing every source. Preserve all name/has/normalize/reserved-set/resolution/template/authoritative-map/blocker order and exact unowned faults; existing dependency blocker text is not a locally authored constant to restyle. Empty name stays listing and existing-tool update can still reuse its source. Reserved display uses one whole selected scalar within16KiB including old public LF, or field omission/unavailability without repair/char-tail inference; preserve legacy method-bearing identity conversions rather than re-normalizing the display. Missing-source choices are a real list and old repair advice is opaque instruction. No new catch, source/body/activation probe, registry policy, overwrite/retry authority, machine field or operation. Keep successful and other-error branches closed; compare guards against real SDK clone/coercion/schema separately from direct accessors. Both duplicate-registration refusals now reuse private duplicateRegistrationText for only the old selected name display, fixed result and exact opaque Use update=true to overwrite advice. Preserve ordinary authoritative-file/current-Map versus draft current-Map/exists short-circuit predicates, blocker-before-update and original five legacy name normalization/path/display conversions. No body/source/metadata reread, policy merge, update/overwrite/retry permission, blanket catch or no-effects receipt follows. Three template-shape constants now identify template/result: nested Recipe-shaped object with old opaque correction, empty sequence and unsupported type with real string/object/sequence choices. Only strings changed; preserve typeof/Array/key/getter/trim/reference/expand order, both helper call paths and external errors. Front null/empty deletion, undefined inheritance, later authoring null/required checks and host coercion remain distinct. A changing-getter draft probe is direct preservation evidence, not a cloneable two-source SDK contract. Four authored validation constants now identify defaults/description/template with only fixed field/result: non-object defaults, missing command-template description, null at authoring and missing final template. Preserve original args→from→description→defaults→retained-template order and all normalization/caller predicates. No new body/value echo/coercion, global null/source rule or wrapper; front deletion, inherited source, Schema argument diagnostics and observation faults retain their owners. Direct controlled method/getter probes are not SDK DTOs; host may reject defaults before execute and route missing/front-null requests through earlier source/deletion behavior. The delegated-source runtime-owned-default refusal now projects only the original first selected key plus fixed defaults/result and exact old correction as opaque instruction. Object.keys/find and the private eight-name membership stay unchanged; do not list all names, inspect values for copy, optimize rejection before normalizeDefaults finishes, or generalize the guard to command templates. Native keys are finite ASCII so full output is provably bounded without a new helper/quota/omission policy; original copy/accessor faults and command-template later stages remain. Both assertDraftPath refusals now reuse private draftPathFailureText with only the already captured allowed_root or resolved path as a whole literal field; never echo the refused caller path in the root error. Preserve original getRecipeRoot/resolve/relative/equality/dot-prefix/exists order and existing Error/formatter sites; this does not repair containment, add probes or prove absence/native closure. Full scalar references fit16KiB including LF, else whole-reference omission/unavailability without repair/count inference; keep old inspect-summary advice opaque and unchanged, not upgraded into a new listing guarantee. Only the public from-normalization catch wrapper now uses sourceNormalizationFailureText for old displayed source, selected reason, opaque legacy active_skills_summary and opaque doctor instruction. Inner normalizeFromReference errors and catch extent stay unchanged; preserve Error.message.trim versus String(error), source/reason/summary/advice left-to-right template conversions, and both canonical doctor regex/identity conversions. Never repair display/hint disagreement or undefined display, parse summary commas into a complete list, reread metadata/private causes or skip fallible old evaluations to fit budget. Whole fields grow from shorter full/omitted seeds under16KiB including LF; malformed selections unavailable without repair/char-tail inference. Normal-registration candidate-admission refusal now uses candidateAdmissionFailureText only for its two existing requestedSource truthy/falsy branches. Preserve real admitUserRecipe/validated/tool/diagnostics join and pre-Error sourceDiagnostic construction order; a truthy display object rendering empty is not the falsy branch. Joined diagnostics/legacy summary stay opaque, with original4096-UTF16 admission cap and possible malformed clipping unchanged. Fitting diagnostics get budget priority; no new body/cause read, full-list inference, catch/policy/rollback/readiness or automatic retry. Tests must use actual admission results, serialize/restore any targeted join/global Error instrumentation and settle before cleanup; never fabricate results or weaken schema for fixtures. Two draft invalid-Recipe errors now use private draftRecipeFailureText only for old selected raw reason or joined candidate diagnostics; no new path/body. Keep readRawRecipeConfig then diagnoseRawRecipeConfigFailure as separate calls, reason truthiness/once-only coercion and draft Error lookup before join (unlike normal candidate pre-Error construction). Undefined reason stays absent; a truthy object displaying empty remains a present empty reason. Whole opaque value fits16KiB/LF or is omitted/unavailable; candidate4096UTF16 legacy selection stays unchanged. Real fs/metadata faults and actual admission results must remain, with serialized restored builtins/ESM bindings and no normal/draft policy merge. Only outer post-cleanup transaction error text now uses registrationTransactionFailureText for old stage, resolution_generation, legacy active_skills_summary and surfaced error, with original template conversions at the same Error/formatter site. Cleanup/persisted bytes/unlink/Map/reactivation/setActive and their exact failures remain unwrapped; formatting faults can follow all those effects. Resolution generation is not Run/live epoch/correlation. Error.message is not newly trimmed or causes disclosed. Whole opaque values grow from shorter representations within16KiB/LF, prioritizing fitting surfaced error; legacy inner rollback/advice text remains content, not a fresh rollback/readiness/retry guarantee. All locally authored mode/name/source/template/draft/transaction refusals in this paragraph are now bare block-YAML metadata documents rendered by private registry.ts:registryMetadataText/registrySelected/growRegistryDocument: fixed fields and choice sequences stay compiler literals/lists, every opaque selected value is one whole double-quoted scalar or an explicit whole-field omission record, seeds are the shorter complete-or-omitted form grown monotonically by priority under the unchanged16KiB including the one public LF, and authored text stays scalar content with escaped line breaks rather than becoming keys/actions. Keep the guard/getter/coercion/join/Error order, predicates, clipping and post-effect faults recorded above; only presentation changed. Three registry notification arguments now use private registryNoticeText for only original report identity/selected name, still flat report/tool fields outside this refusal migration. report means compiler notice, not proved callable/host removal. Keep callback lookup/name interpolation once and callback type/position/post-effect exceptions unchanged; no activation/metadata reread or model16KiB quota. Actual runtime.notify retains hasUI gate, TUI ThemedText→native Text renders literal multiline and RPC forwards message fire-and-forget. Full well-formed values remain unbounded as before; malformed selected name unavailable without repair/hidden char counts. Loaded colored terminal/phone remains separate from native headless width tests. Runtime Recipe watcher warning/refresh messages now use report and opaque instruction constants only. Preserve direct ctx.ui.notify without adding hasUI gating, all dedup/timer/load/callback ordering and exact contained errors; old reported default root is not a freshly verified location. Runtime startup-warning AX projection preserves original classification/filter/map/push/join/template coercion before projecting known compiler warning slots into category sequences. Captured slot ranges are not authored-label parsing; old compiler layout bytes are discarded only after original join/coercion. Reuse unbounded formatMarkdownField for opaque multiline entries; malformed selected warning unavailable without repair/count guesses, doctor advice opaque. Do not add hasUI short-circuit before formatting or reconstruct missing causes/metadata.
 
 Public first-layer UX/AX must serve both audiences from the same facts: understandable progress for the human, compressed decision context for the agent, and only a relevant drill-down when needed. Do not substitute a raw dump, add blanket fields/hints, coerce status objects into text, or promise later delivery that is not established. Delivery is not handling; a legacy kill attempt is not full-scope closure. Keep raw detail explicit and recipient-scoped at every level, including details/verbose; an identity-change refusal must not publish the replacement's status. Preserve original action/refusal facts and underlying uncertainty; separate presentation/curation fixes from lifecycle/native authority. Actor-local delivery_failed may coexist with recorded handled state; retirement exceptions may follow a move/removal. Missing Trace/correlation proves no inaction. Preserve causal/correlation evidence in its existing owner before public failure projection; do not build one generic recovery/receipt domain or release a transport-spanning lifecycle lock without equivalent generation/endpoint fencing. runs-control-delivery now retains surfaced primary failures in standard non-enumerable cause and combines later failed-status recording in ordered AggregateError.errors with only genuinely returned admitted control id/generation. Endpoint-not-ready, post-send delivered-record failure and unprintable failure text retain their distinct causes. FIFO write/close faults preserve both failures and already-written bytes, not rollback. Raw chains stay Kernel-local; ordinary serialization does not publish them. After actor-local dispatch, tools-message wraps any rejection in a bounded conservative Error, preserving the exact thrown value in non-enumerable cause without coercing it. Keep the original request target/action only (whole target or explicit omission under 16 KiB), report delivery/handling/effects uncertainty and no automatic replay, and point to fresh owned inventory. Captured admission ids/generation are deliberately not copied into that public error, including verbose: an old context or error DTO does not prove current reply scope. Do not add a second lifetime registry or weaken error semantics to publish correlation. Admission or lower-owner/facade release failures without a returned record must not gain invented correlation. The selected delivery/facade/retirement/locked-mutation/replacement boundaries preserve surfaced original/later faults; that does not recover errors already discarded below them or close B2's separate awaited-transport gate.
 

package/BACKLOG.md

@@ -4,38 +4,21 @@ Canonical open work: `BACKLOG.md`. Contracts and durable constraints live in `AG
 
 Task IDs name bounded work, not execution order. The operator authorizes autonomous selection and execution of open pi-actors work in Grow Loop: choose dependency-ready high-value cohorts across this backlog without repeated routine permission questions. Dependencies, factual acceptance and specific safety/authority boundaries remain explicit; a gated task is not completed merely because another cohort can proceed. Completing a child does not complete its checkpoint.
 
-## 1. Release 0.56.0 — external convergence
-
-Outcome: Recover the failed immutable-tag validation without silently changing release identity. [PR#137](https://github.com/llblab/pi-actors/pull/137) is merged; `v0.56.0` remains at `48cd1348730f8d4ae8b19ea52dc1fd61ae017622`, whose tree passed all eleven PR checks. The [tag-owned Release run](https://github.com/llblab/pi-actors/actions/runs/42440646237) subsequently failed Windows `owners-a` at the snapshot canonical-facts test. Passing PR checks did not replace this mandatory tag gate. The operator explicitly authorized a correction PR through `dev → main` and conditional replacement of this failed unpublished tag after fresh corrected-main CI and a complete zero-publication/consumption audit. This is not permission for an unchanged rerun, main rewrite or manual publication.
-
-### R2 — Immutable publication completion
-
-Exit: Exact intended package, immutable tag and GitHub Release converge through the existing automation. A pushed tag is not a published/verified release.
-
-- [ ] **R2.3 — Validate and deliver release recovery.** Review the controlled busy-lifetime fixture correction in `tests/run-ui-runtime.test.ts`, then obtain fresh current-head full-matrix acceptance through [PR#138](https://github.com/llblab/pi-actors/pull/138), including Windows installed compiled SDK lifecycle/numbered-history. Keep production behavior, all existing assertions, deadlines, cleanup guards, versions and workflows unchanged. Preserve the existing tag until corrected protected-main CI and the immediately refreshed complete zero-publication/consumption audit pass. Then use only the operator-authorized exact leased failed-unpublished-tag replacement protocol; never rewrite main, rerun unchanged work for luck or publish manually.
-- [ ] **R2.4 — Verify external convergence.** After owning automation succeeds, confirm exact npm version/gitHead/package, immutable tag, published stable GitHub Release/latest and successful owning workflow identities. Visibility retries verify existing state; they never republish. Remove this release checkpoint only after both R2 exit conditions pass.
-
 ## Next bounded work
 
-- **Release:** Review and deliver the SDK busy-lifetime fixture correction through PR#138, obtain fresh current-head Windows/full-matrix acceptance, then finish the guarded R2 audit/tag-replacement/publication sequence. Do not move the existing tag early or compete with publication.
-- **Local implementation:** F1.3b is the next concrete projection cohort; success/list/delete/draft receipts still need migration. F1.3c, F1.3s and F1.4i remain separate attributable owners, not proof that all AX output already conforms. N1.4c also permits unrouted deterministic preparation within its reviewed contract.
+- **Separate remaining owners:** F1.7 (one rollout candidate) remains the last open F1 owner; the migrated surfaces do not by themselves prove the loaded rollout or registry notice layout. Registry activation/promotion/deletion notice text stays outside the completed refusal migration. Inspector popup color recognition is verified against current producer results; a later feedback syntax change must update that anchored recognition with it.
 - **Explicit gates:** U1 requires authorized loaded-host observation/reload; N1.2p needs actual Windows profile evidence, N1.3 an asset-distribution decision, and N1.6 separate activation admission. Original-clock/native-scope, macOS research and composition decisions retain their own B/C/T gates. Existing release permission does not adopt them.
 - **Evidence reuse:** Reuse the accepted three-OS SOURCE/PACKED quit witnesses for B2.4; extend only the missing descendants/triggers/same-ID/crash cases. N1.9 stays a gated unresolved risk, not an instruction to repeat the completed ownership inquiry.
 
-## 2. Uniform runtime presentation — adopted, rollout pending
+## 2. Uniform runtime presentation — adopted, expectations owned; acceptance pending
 
-Outcome: JSON structured inputs, block-YAML runtime-output metadata and unchanged selected authored text/Markdown, as defined by [the AX contract](docs/agent-experience.md#json-input-yaml-output-opaque-content). This includes tool/spawn receipts, not only Actor results. Rollout remains partial; this checkpoint does not imply uniform emitter conformance, native continuation, package publication or a loaded-host change. Existing machine/input/source/history contracts remain separate.
+Outcome: JSON structured inputs, block-YAML runtime-output metadata and unchanged selected authored text/Markdown, as defined by [the AX contract](docs/agent-experience.md#json-input-yaml-output-opaque-content). This includes tool/spawn receipts, not only Actor results. Owned projections are migrated; this checkpoint does not imply loaded-host acceptance, native continuation, package publication or a service-carrier change. Registry notice text and runtime startup warnings retain their earlier flat layout. Existing machine/input/source/history contracts remain separate.
 
 ### F1 — One readable output contract
 
 Exit: New owned runtime projections use YAML without pseudo-records or serialized JSON objects: bare when metadata-only, `---`-delimited headers only when a separate text body follows. Literal content, meaning, source/privacy bounds and saved messages remain intact. Service-carrier adoption has its own evidence gate; do not delete current framing to simulate completion.
 
-- [ ] **F1.3b — Migrate successful registry projections.** Convert registration/update, listing/deletion and draft-promotion receipts with their distinct selected facts, safety-warning priority and whole-value bounds. A separate selected body alone requires a delimited header. Preserve post-effect/coercion/transaction/callability truth and unchanged details. Verify: registry success/list/delete/draft owners and source/packed parity.
-- [ ] **F1.3c — Migrate registry-owned refusals.** Convert only locally authored mode/name/source/template/draft/transaction refusal projections. Keep original getter/coercion/fault order, private causes, opaque advice and whole-source limits; do not wrap host/dependency exceptions or infer no effects/retry. Verify: corresponding registry guard/failure properties and applicable packed witnesses.
-- [ ] **F1.3s — Separate synchronous tool metadata from selected output.** Migrate owned usage/guard/exit-label facts without parsing or reserializing stdout/stderr/report bodies or JSON invocation examples. Keep existing trim/tail/loss basis, exact executor failures and the pre-dispatch repair cutoff. Metadata plus selected text uses a delimited header; metadata-only output stays bare. Verify: tools-local/execution-output/spawn guards and packed dispatch-failure owners.
-- [ ] **F1.4 — Migrate inspection, Control and runtime notices.** Render selected structured/verbose metadata as YAML, including generated JSON Schema views; retain literal sources. Reconcile emitter execution/depth ceilings with actual caller budgets without narrowing public allowances. Preserve error/cause, request/delivery/handling/effects/closure distinctions and recipient fences. Verify: affected Control/inspect/runtime/notification owner properties.
-- [ ] **F1.4i — Verify remaining Inspector feedback recognition.** Check anchored feedback recognition against current AX guard/error output and correct only evidenced gaps. Preserve reviewed generic block-YAML and independent native Markdown, zero added body indentation, exact selected text and own undefined fields, source labels, native columns/wrapping, chronology/identity, chrome, frozen underlay and once-only generation actions. Verify: affected guard/modal properties and compiled parity. Loaded acceptance stays with U1.3/U1.5; no duplicate renderer migration or implicit host reload.
-- [ ] **F1.7 — Accept one rollout candidate.** Verify exactly one visual blank line between host invocation/arguments and each result/error without altering selected bodies. Independently verify no runtime-owned JSON/pseudo-record escape remains in the selected rollout, with history/literal-body invariance, source/compiled/package/Skill parity and permitted terminal/phone acceptance. Keep current capture codec facts and new target distinct; no unrun live/native claim or automatic default activation.
+- [ ] **F1.7 — Accept the rollout on a loaded host.** Source/headless audit is done: one shared framing owner keeps exactly one host-separation blank line on migrated paths, no runtime-authored object dump or pseudo-record remains in the migrated set, history/literal bodies are unchanged, and source/compiled/package parity passes. Remainder is the permitted loaded terminal/phone observation of one rollout candidate, which needs the same separate authorization as U1; keep capture codecs and live claims distinct and claim no automatic default activation.
 
 ### U1 — Loaded UI/AX acceptance
 
@@ -189,7 +172,6 @@ Exit: A separately admitted optimized shipping path preserves identity/status/au
 
 - [ ] **N1.2p — Establish UTC-profile admission.** Record actual native environment/version facts and real PowerShell precision-boundary witnesses, then define/test the exact initial admission predicate. MI offset zero, runner labels, JavaScript timezone or expected-identity equality are insufficient. Keep unproved date/provider partitions unsupported. Verify: Windows differential and separately disclosed controlled formatter witnesses.
 - [ ] **N1.3 — Decide native executable distribution.** Obtain an explicit decision on reviewed unsigned Windows x64 repository/npm assets with manifest-bound provenance and baseline fallback. Recommendation: committed prebuilts, no install-time compilation/download. This decision does not approve default activation. Verify: source/build/artifact/architecture/dependency and execution-policy review.
-- [ ] **N1.4c — Complete asset-verified acquisition preparation.** Add the bounded complete-manifest reader, trusted exact-byte selection, fixed versioned package-relative asset verification/lookup and shell-free invocation seam under the reviewed contract. Preserve raw-null refusal and unsupported UTC admission until N1.2p; comparison/status/fences remain in their owners. No production routing or binary inventory change without their separate gates. Verify: mirrored asset/acquisition/fallback ports and source/compiled parity.
 - [ ] **N1.5 — Bind the exact candidate asset.** After N1.3, retain reviewed Windows build bytes and manifest, verify source/artifact hashes and toolchain provenance, and make offline build/prepack copy-and-verify assets for source and compiled lookup. Ordinary users need no compiler, new runtime, download or privilege. Unsupported architecture and missing/corrupt/policy-blocked assets must not bypass policy or repair a mismatch. Verify: source/packed asset parity and differential against those exact bytes.
 - [ ] **N1.6 — Review and integrate acquisition routing.** Gate on N1.2p/N1.4c/N1.5 and explicit activation admission. Change only the fresh scalar/shared acquisition seam; keep liveness, public status/error precedence, original-frame fallback, publication/Control/snapshot/teardown checks and callback fences. Never fall back through a supported identity mismatch or replacement. Verify: process/status/observability/results/Control owners and independent review.
 - [ ] **N1.7 — Close real SDK/native convergence.** Run the full source-and-packed journeys through the integrated shipping path and obtain the complete three-OS/three-shard matrix plus audit. Keep 87 planned genuine Runs/layout, nine modes, both 40-spawn cohorts, workload 300 s/10 ms, SDK watchdog 900 s Windows/300 s elsewhere, operator-admitted five-second completion-boundary ESRCH settlement after canonical work readiness and separate ten-second original-close acceptance. Other existing eight-second settlement policies remain unchanged. No extra skips, forced exits, signals, fabricated birth/absence or deadline resets/inflation.
@@ -201,7 +183,6 @@ Shared N1 constraints: Retain uncertain roots; fresh ESRCH immediately precedes
 
 Exit: Any later cleanup is independently justified and validated against its own tree. The immutable 0.56.0 tag is not a cleanup branch; source/packed presentation and release-narrative acceptance are already covered by the accepted release tree.
 
-- [ ] **R1.1 — Inventory retained inactive foundations before a removal decision.** Identify packaged but unactivated supervision/stream/native-adapter owners, their actual consumers and interleaved safety guards. Produce a reachability/package inventory that distinguishes reviewed runtime dependencies from optional foundations; remove nothing merely by filename or because its default path is off. Default supervision and public completion streams remain disabled. Verify: source/compiled/default-wiring and npm-inventory audit; use existing build/package evidence where inputs are unchanged.
 - [ ] **R1.2 — Remove temporary diagnostics after native acceptance.** Gate on N1.7; remove only proven temporary/redundant instrumentation, preserve owned regressions, then refresh invalidated focused checks and final candidate-bound packaging/native evidence. A dirty status note or earlier executable result is not final-tarball proof.
 
 ## Evidence and scope notes

package/CHANGELOG.md

@@ -4,6 +4,19 @@
 
 ## Unreleased
 
+## 0.57.0: YAML Runtime Output
+
+- `Control and Inspection`: Compact Control receipts and inspect views/refusals use block YAML with native lists, whole-value omissions and conservative delivery/handling facts. Generated tool schemas use YAML when renderable, retaining the legacy JSON fallback and explicit verbose JSON. Recipe view=registry aliases summary. Large argument groups and next actions stay bounded without breaking verbose inspection.
+- `Registry Refusals`: Locally authored registration mode/name/source/template/draft/transaction errors now use bare YAML. Selected values stay whole or explicitly omitted/unavailable; prior correction advice stays content, not permission to retry. Guard/coercion ordering, original faults and post-effect uncertainty remain unchanged.
+- `Execution Guidance`: Command failures separate exit_code/killed metadata from selected stderr/stdout; empty-stream failures stay metadata-only. Argument-repair guidance uses a bounded YAML usage header, with whole argument-group omissions when needed, followed by the original validation prose and verbatim JSON example. Stream tail/spill behavior and post-dispatch error identity remain unchanged.
+- `UI Notices`: Callback, completion recovery, steer diagnostic, teardown, watcher and retirement reports use block YAML. Full well-formed UI diagnostics remain uncapped rather than borrowing the model-output budget; malformed selected text is explicitly unavailable. Existing preview limits, deduplication, callback errors and closure uncertainty remain.
+- `Windows Preparation`: Adds an unrouted bounded helper-manifest reader, versioned package-relative lookup, executable size/SHA-256 verification and shell-free invocation spec. Complete manifest reads detect overflow, and arguments match the native helper CLI. PowerShell remains the production backend; no binary is shipped, approved or activated.
+- `Compatibility`: Machine details, verbose JSON and retained history keep their contracts. Metadata-only output is bare YAML; a separate selected body follows a closed header. Registry activation notices and startup warnings retain their earlier layout. Loaded terminal/phone acceptance remains pending; no host reload, public-stream or supervision activation is implied.
+
+## 0.56.1: YAML Registry Receipts
+
+- `Registry Receipts`: Successful registration/update, listing/deletion and draft-promotion replies now use bare block YAML with native lists, whole-value omissions and exact opaque scalars within the existing16KiB limit. Complete warnings retain priority. Normal callability stays Boolean; draft preserves its selected string display. Getter/coercion and partial-effect behavior, machine details, notices and saved messages stay unchanged. No input migration, automatic reload or retry is introduced.
+
 ## 0.56.0: AX, File Navigation and Runtime Safety
 
 - `AX Records`: Compact spawn/async-tool receipts, full spawn metadata and fresh attention use block YAML with opaque selected content and whole reference sequences. Metadata-only replies stay bare; bodies follow closed headers without added outer indent. Ordinary attention remains unbounded; urgent complete-message fitting keeps16KiB and later-group coverage. Other surfaces retain flat records during rollout. Source/activation contracts, machine details and saved text stay unchanged.

package/README.md

@@ -92,10 +92,13 @@ inspect target=runtime view=status
 inspect target=runtime view=runs status=failed
 inspect target=runtime view=triage
 inspect target=recipes view=status
+inspect target=recipes view=summary
 inspect target=recipes view=doctor identity=music-player/playback
 inspect target=tool:my_tool view=status
 ```
 
+Recipe `summary` and `registry` are the same inspection path; only `verbose` selects compact text versus structured details. Recipe and tool views are listed above; `inspect` parameter help and unsupported-view refusals name the actual accepted view sequences.
+
 A Run exposes exactly `recipe`, `trace`, and `control` views. Run-specific `inspect` and `message` require a current coordinator session whose id exactly matches the persisted non-empty Run owner; possessing `run:<id>` alone is not authorization. Missing-session, ownerless, and cross-owner access fails closed. Use `inspect target=runtime view=runs` for the current session's exact-owner inventory. See the complete [management inspection matrix](./docs/inspection.md).
 
 ### `register_tool`
@@ -163,9 +166,9 @@ Generic command lifecycle is Trace-only: runner-owned `command.done` records pre
 
 Ordinary finite Runs project terminal results through one root-coordinator completion scheduler. Nested actors inherit durable parent-generation lineage: their own Pi sessions never emit completion turns, and their results wait for the complete containing top-level tree. While the root Pi is active, the next completed `turn_end` boundary snapshots all ready trees into one immutable bounded batch, appends one visible custom message after the full tool batch, and requests one next model step. This overlay uses boundary entries, not Pi's native steering or follow-up queue, so the model can integrate fresh results before its current run settles. Already-idle Pi retains a short debounce and one automatic follow-up wake. The operator and model receive the same parent-child tree with bounded actor outputs. Proposed boundary entries stay pending until exact model context or bounded active-session evidence proves acceptance; an idle send finalizes on successful Pi acceptance without requiring a later context callback. Sequence, parallel, repeat, and imported branches remain internal, while separately launched Runs retain exact independent generations. Silent Runs and synchronous stop acknowledgments remain non-projecting.
 
-Unreleased UX/AX subset: completions share48KiB UTF-8 including service fields, divided equally between up to64 candidate results: nearly48KiB for one,24KiB each for two,16KiB each for three. Whole admitted text fitting its share is result; otherwise preview carries the safe prefix and exact omitted count, without a fixed16KiB result/2KiB preview cap. Completions show admitted work output or the bounded executor-selected final Actor response, never command metadata. Saved packets keep their original budget/text; source-backed prefix selection occurs only at fresh admission, not replay/render. Direct Pi text-print answers and successful composition/retry responses use the original producer privacy; observed upstream clipping stays explicit and is not confused with preview loss. Ordinary completions can carry retained primary-text, artifact-declaration inventory and diagnostic-metadata references. Follow the exact reference for clipped or omitted evidence; it records capture-time identity/hash/counts, not perpetual readability. Artifact inventories list declarations only, not proof that target files exist or were produced, and do not grant body-read permission. Diagnostic excerpts identify the selected field with literal UTF-8/Unicode counts; their source contains recorded command/error/failure-reason metadata, not complete primary output. Source loss is explicit and never replaced by guessed legacy bodies or paths. See [Run supervision](docs/run-supervision.md) for implemented boundaries and remaining acceptance gates.
+Implemented UX/AX subset: completions share48KiB UTF-8 including service fields, divided equally between up to64 candidate results: nearly48KiB for one,24KiB each for two,16KiB each for three. Whole admitted text fitting its share is result; otherwise preview carries the safe prefix and exact omitted count, without a fixed16KiB result/2KiB preview cap. Completions show admitted work output or the bounded executor-selected final Actor response, never command metadata. Saved packets keep their original budget/text; source-backed prefix selection occurs only at fresh admission, not replay/render. Direct Pi text-print answers and successful composition/retry responses use the original producer privacy; observed upstream clipping stays explicit and is not confused with preview loss. Ordinary completions can carry retained primary-text, artifact-declaration inventory and diagnostic-metadata references. Follow the exact reference for clipped or omitted evidence; it records capture-time identity/hash/counts, not perpetual readability. Artifact inventories list declarations only, not proof that target files exist or were produced, and do not grant body-read permission. Diagnostic excerpts identify the selected field with literal UTF-8/Unicode counts; their source contains recorded command/error/failure-reason metadata, not complete primary output. Source loss is explicit and never replaced by guessed legacy bodies or paths. See [Run supervision](docs/run-supervision.md) for implemented boundaries and remaining acceptance gates.
 
-Unreleased A2 subset: `inspect target=runtime view=runs verbose=true` now adds a bounded [root-first file map](docs/run-supervision.md#same-session-file-investigation) for the actual session's already cataloged directories. Follow selected locations with ordinary tools, without an original producer key. Source/npm-packed SDK fixtures resume the same saved session in a new process after real Run producers and their coordinator host have exited, then read the actual result and select recorded stdout via the mapped execution manifest with ordinary tools; another session gets no inherited branch. The read-only map exposes canonical starting-location coverage and expected format hints, not a full file inventory or format/completeness validation. Its published_sessions link locates the fixed role catalog physically under the owned Run root, even without a semantic index or producer key; this does not certify its body or historical publication. SDK checks select one controlled partial preview and also read an actual private-writer preview after its holder exits and the same saved session opens in another process. Exact tool-read paths and final byte/absence snapshots are checked, including selected-preview loss errors without cached/raw fallback; the private publisher uses controlled recorded-session sources, not genuine Actor conversations. A finite public spawn and later same-saved-session research also pass through real source/npm entrypoints, without replacement tools or copied lifecycle wiring. Corrupt catalogs stay unavailable without repair. Inventory filters observe current Run status, not the registration-time cache. Ordinary maps retain root-group recency with known failed children first; add status=failed to the verbose request for observed failed-subtree-first ordering across roots without filtering the full owned map or adding reads. Priority is partial observed data, not terminal authority. Launches and compatible singleton attachments now register after lifecycle release; catalog failure returns `catalog=unavailable` without failing or retrying the launched work. SDK fork/clone preserves inherited history but gives the new logical session no fresh map branch. Compact launch receipts now include exact-generation current-session starting locations without evidence-body or catalog reads, or explicit unavailability/whole-row omission. New completion batches freeze bounded same-session location rows at admission and render them after outcomes within the shared budget, alongside the optional current-session map command. Legacy absent/request-only packets retain their text; source/npm SDK verifies an explicitly requested result read from a terminal row. This closes representative navigation acceptance, not the release. Neither captured locations nor the request execute inspection automatically or grant copied/forked history fresh ownership. Legacy batches keep their original text; no full map is embedded into immutable outcomes. Compact/default inspection, curated previews and timing/work/native authority are unchanged.
+Implemented A2 subset: `inspect target=runtime view=runs verbose=true` now adds a bounded [root-first file map](docs/run-supervision.md#same-session-file-investigation) for the actual session's already cataloged directories. Follow selected locations with ordinary tools, without an original producer key. Source/npm-packed SDK fixtures resume the same saved session in a new process after real Run producers and their coordinator host have exited, then read the actual result and select recorded stdout via the mapped execution manifest with ordinary tools; another session gets no inherited branch. The read-only map exposes canonical starting-location coverage and expected format hints, not a full file inventory or format/completeness validation. Its published_sessions link locates the fixed role catalog physically under the owned Run root, even without a semantic index or producer key; this does not certify its body or historical publication. SDK checks select one controlled partial preview and also read an actual private-writer preview after its holder exits and the same saved session opens in another process. Exact tool-read paths and final byte/absence snapshots are checked, including selected-preview loss errors without cached/raw fallback; the private publisher uses controlled recorded-session sources, not genuine Actor conversations. A finite public spawn and later same-saved-session research also pass through real source/npm entrypoints, without replacement tools or copied lifecycle wiring. Corrupt catalogs stay unavailable without repair. Inventory filters observe current Run status, not the registration-time cache. Ordinary maps retain root-group recency with known failed children first; add status=failed to the verbose request for observed failed-subtree-first ordering across roots without filtering the full owned map or adding reads. Priority is partial observed data, not terminal authority. Launches and compatible singleton attachments now register after lifecycle release; catalog failure returns `catalog=unavailable` without failing or retrying the launched work. SDK fork/clone preserves inherited history but gives the new logical session no fresh map branch. Compact launch receipts now include exact-generation current-session starting locations without evidence-body or catalog reads, or explicit unavailability/whole-row omission. New completion batches freeze bounded same-session location rows at admission and render them after outcomes within the shared budget, alongside the optional current-session map command. Legacy absent/request-only packets retain their text; source/npm SDK verifies an explicitly requested result read from a terminal row. This closes representative navigation acceptance, not the release. Neither captured locations nor the request execute inspection automatically or grant copied/forked history fresh ownership. Legacy batches keep their original text; no full map is embedded into immutable outcomes. Compact/default inspection, curated previews and timing/work/native authority are unchanged.
 
 Compact spawn/asynchronous-tool launch receipts use bare block YAML with nested file-location data and identify an existing Run reuse instead of implying another launch. Full `spawn verbose=true` metadata remains JSON during the staged rollout; private details and input schemas keep their machine formats. When a complete direct file-location row is shown, it replaces the redundant session-wide map hint; missing, unavailable or omitted rows retain that optional investigation command. Exact references, expert details, shared bounds and saved completion-packet text are preserved.
 

package/dist/lib/execution-output.js

@@ -8,6 +8,7 @@ import { join } from "node:path";
 import { sanitizeFilePart } from "./identity.js";
 import * as Limits from "./limits.js";
 import * as Paths from "./paths.js";
+import * as ToolsResponse from "./tools-response.js";
 export function writeFullOutput(toolName, stream, content) {
     try {
         const outputRoot = join(Paths.getExtensionTmpDir(), "outputs");
@@ -80,10 +81,20 @@ export function formatOutput(toolName, stream, content) {
     };
 }
 export function formatFailureOutput(toolName, code, killed, stdout, stderr) {
-    const parts = [`Exit code ${code}${killed ? " (killed)" : ""}`];
+    const parts = [];
     if (stderr.trim())
         parts.push(`stderr:\n${stderr.trimEnd()}`);
     if (stdout.trim())
         parts.push(`stdout:\n${stdout.trimEnd()}`);
-    return formatOutput(toolName, "error", parts.join("\n\n"));
+    // Compiler-owned exit status is far below the shared metadata bound.
+    const header = ToolsResponse.renderYamlMetadata({ exit_code: code, killed }, Limits.RUN_DELIVERY_MODEL_MAX_BYTES).text;
+    // A failure with no selected stream text stays metadata-only bare YAML; no filler body is invented.
+    if (parts.length === 0)
+        return { text: formatToolText(ToolsResponse.frameMetadataDocument(header)), truncated: false };
+    // The existing formatter keeps trim/tail/temp-file/loss basis; only the exit label moves into YAML.
+    const formatted = formatOutput(toolName, "error", parts.join("\n\n"));
+    return {
+        ...formatted,
+        text: formatToolText(ToolsResponse.frameMetadataDocument(header, formatted.text.replace(/^\n+/u, ""))),
+    };
 }

package/dist/lib/observability.js

@@ -12,7 +12,7 @@ import * as RunsTrace from "./runs-trace.js";
 import { readRunCompletionTextSource, readRunResultArtifactInventory, readRunResultDiagnosticOutcome } from "./runs-context-exports.js";
 import { readJsonlFileResilient } from "./state-readers.js";
 import { Document } from "yaml";
-import { formatLiteralBlock, formatMarkdownField } from "./tools-response.js";
+import { formatYamlNotice } from "./tools-response.js";
 export function createRunUiObservationState() {
     return {
         attentionEventIds: new Map(),
@@ -103,13 +103,12 @@ export function createRunStateWatcher(input) {
         const recovery = code === "rearmed"
             ? "; terminal watch acceleration restored"
             : "; terminal reconciliation remains active and watcher rearm will retry";
+        // Captured detail/recovery strings are reused as-is; only the projection becomes bare block YAML.
         diagnostics.push({
             code,
             id: ++diagnosticId,
-            message: [formatMarkdownField("watcher", code), formatMarkdownField("scope", scope),
-                formatMarkdownField("path", formatLiteralBlock(path)),
-                ...(detail ? [formatMarkdownField("diagnostic", detail.slice(2))] : []),
-                formatMarkdownField("recovery", recovery.slice(2))].join("\n"),
+            message: formatYamlNotice({ watcher: code, scope, path,
+                ...(detail ? { diagnostic: detail.slice(2) } : {}), recovery: recovery.slice(2) }),
             path,
             scope,
             ts: new Date().toISOString(),
@@ -673,15 +672,11 @@ export function findRunRetirementCandidates(summary) {
     }));
 }
 function formatRunRetirementNotice(run, action, message = "") {
-    const fields = [formatMarkdownField("run", run.startsWith("run:") ? run.slice(4) : run), formatMarkdownField("retirement", action)];
-    if (action === "stop")
-        fields.push(formatMarkdownField("result", "request returned"), formatMarkdownField("reason", "child runs reached terminal state"));
-    else if (action === "cancel")
-        fields.push(formatMarkdownField("result", "cancellation reported"), formatMarkdownField("reason", "stop path failed"));
-    else
-        fields.push(formatMarkdownField("result", action === "skip" ? "skipped" : "failed"), formatMarkdownField("diagnostic", message));
-    fields.push(formatMarkdownField("closure", "unconfirmed"));
-    return fields.join("\n");
+    return formatYamlNotice({ run: run.startsWith("run:") ? run.slice(4) : run, retirement: action,
+        ...(action === "stop" ? { result: "request returned", reason: "child runs reached terminal state" }
+            : action === "cancel" ? { result: "cancellation reported", reason: "stop path failed" }
+                : { result: action === "skip" ? "skipped" : "failed", diagnostic: message }),
+        closure: "unconfirmed" });
 }
 export async function executeRunRetirements(summary, options) {
     const results = [];