@llblab/pi-actors 0.56.1 → 0.57.1

package/docs/inspection.md

@@ -12,22 +12,22 @@ The shared compact Run status/default view in [Run supervision](./run-supervisio
 | --- | --- | --- |
 | `run:<id>` | `recipe`, `trace`, `control` | Inspect one accessible Run generation |
 | `runtime` | `status`, `runs`, `triage` | Inspect package policy, owned Run inventory, or aggregate operational pressure |
-| `recipes` | `status`, `summary`, `doctor`, `imports`, `reviews` | Inspect user Recipe discovery, active Skill components, exact resolution, imports, and automatic-review recovery |
+| `recipes` | `status`, `summary`/`registry`, `doctor`, `imports`, `reviews` | Inspect user Recipe discovery, active Skill components, exact resolution, imports, and automatic-review recovery |
 | `tool:<name>` | `status`, `schema` | Inspect persistent-tool activation/usage or its current callable schema |
 
-`verbose=false` normally returns compact text and `verbose=true` returns structured details. `tool:<name> view=schema` is always structured because its callable parameter schema has no useful compact equivalent.
+`verbose=false` normally returns compact YAML and `verbose=true` returns JSON without evaluating the compact formatter. `tool:<name> view=schema` always returns the structured callable definition: bare YAML with native parameter nodes when renderable, otherwise the exact legacy JSON fallback; explicit verbose output stays JSON.
 
-Fresh compact Run/tool/Recipe responses now use flat AX records. Run views retain only the existing run/view header, not a new default Run status or automatic evidence body. Tool status preserves activation/callability/source/usage facts and renders required/optional argument names as real sequences, including a single item; none and unknown remain distinct. Recipe registry retains its original count/current-policy/partial-catalog facts. Focused doctor adds no source exposure: the already-portable source_location is kept whole inside the existing literal renderer, with exact identity/resolution/rejection values and opaque multiline Markdown.
+Fresh compact Run/tool/Recipe responses use bare block-YAML metadata. Run views retain only the existing run/view header, not a new default Run status or automatic evidence body. Tool status preserves activation/callability/source/usage facts and renders required/optional argument names as real sequences, including a single item; none and unknown remain distinct. Selected scalars and complete argument groups fit the 16 KiB compact allowance or carry explicit whole-field/group omission coverage; malformed selected text is unavailable without repair. Recipe registry retains its original count/current-policy/partial-catalog facts. Focused doctor adds no source exposure: the already-portable source_location is kept as a whole quoted scalar or explicitly omitted, with exact identity/resolution/rejection values and opaque multiline Markdown.
 
-Compact text selects at most the first existing hint. Only exact recipes doctor, imports verbose=true or summary verbose=true inspect strings become a typed read-only next node; any other string, including call/spawn/register advice, stays an opaque instruction value without whitespace normalization or command parsing. No hint executes, repairs arguments or grants scope. Full next_actions and all machine fields remain unchanged in details/verbose JSON. No new global output cap, truncated reference, reader or source budget is added. Runtime compact rendering now likewise uses flat fields: status keeps version/schema/review policy, runs keeps the complete exact-owner inventory count, and triage keeps its existing failure/control/backpressure/Trace/attention counts. A240-row controlled owned inventory remains240even with lines=1; verbose navigation remains independent, while triage pending66does not shrink to its40detail rows. There is no new snapshot/default status, duration, source reader/cap or routine next action. The source/installed owners verify this subset, not actual loaded phone/terminal rendering.
+Compact text selects at most the first existing hint. Only exact recipes doctor, imports verbose=true or summary verbose=true inspect strings become a typed read-only next node; any other string, including call/spawn/register advice, stays an opaque instruction value without whitespace normalization or command parsing. No hint executes, repairs arguments or grants scope. Full next_actions and all machine fields remain unchanged in details/verbose JSON. No new global output cap, truncated reference, reader or source budget is added. Runtime compact rendering likewise uses bare YAML fields: status keeps version/schema/review policy, runs keeps the complete exact-owner inventory count, and triage keeps its existing failure/control/backpressure/Trace/attention counts. A240-row controlled owned inventory remains240even with lines=1; verbose navigation remains independent, while triage pending66does not shrink to its40detail rows. There is no new snapshot/default status, duration, source reader/cap or routine next action. The source/installed owners verify this subset, not actual loaded phone/terminal rendering.
 
 ## Locally authored request errors
 
-The ten refusal sites owned by tools-inspect now use flat AX errors for unsupported target/view/Trace source, invalid tool target, misplaced Recipe identity, missing registered tool and unavailable callable schema. Supported target/view/source choices are real lists, including a one-item list where appropriate. target_kind is only the selector family, not proof of owner admission. Request strings and selected activation facts remain opaque values; authored next/tool lines gain no action authority. Missing-tool refusal retains the no-spawn-substitution safety note and its known Recipe doctor next; unavailable schema retains callability/activation defaults and its known tool-status next. Other guards add no routine hint. The compact success hint recognizer remains the same closed three Recipe literals, not a general command parser.
+The ten refusal sites owned by tools-inspect use bare block-YAML errors for unsupported target/view/Trace source, invalid tool target, misplaced Recipe identity, missing registered tool and unavailable callable schema. Supported target/view/source choices are real lists, including a one-item list where appropriate. target_kind is only the selector family, not proof of owner admission. Request strings and selected activation facts remain opaque values; authored next/tool lines gain no action authority. Missing-tool refusal retains the no-spawn-substitution safety note and its known Recipe doctor next; unavailable schema retains callability/activation defaults and its known tool-status next. Other guards add no routine hint. The compact success hint recognizer remains the same closed three Recipe literals, not a general command parser.
 
-These new owned error texts share the existing16KiB model-text allowance, including the unchanged public adapter's single leading LF. Fixed compiler facts/lists and safety reserve space; each variable starts with the shorter complete value or omission row, so later admission cannot shrink the baseline and falsely justify an omission. Optional complete next is retained if it fits with that baseline, then whole variable fields are selected in source order. An unfit scalar has field-local state=omitted/reason=response_too_large/shown=0/omitted=1/total=1, never a shortened target or raw/private character count. An unfit action has next_action omission coverage rather than a fake next command. This is a new presentation bound for these local errors only, not an input/source/work quota, successful inspect cap or new machine schema. Direct Error.message stays unprefixed until the existing adapter applies spacing; malformed request strings are not repaired or assigned scalar-completeness proof.
+These new owned error texts share the existing16KiB model-text allowance, including the unchanged public adapter's single leading LF. Fixed compiler facts/lists and safety reserve space; each variable starts with the shorter complete value or omission row, so later admission cannot shrink the baseline and falsely justify an omission. Optional complete next is retained if it fits with that baseline, then whole variable fields are selected in source order. An unfit scalar has field-local state=omitted/reason=response_too_large/shown=0/omitted=1/total=1, never a shortened target or raw/private character count. An unfit action has next_action omission coverage rather than a fake next command. This presentation bound is not an input/source/work quota or new machine schema; successful compact metadata has its own whole-field/group selection described above, while full JSON remains independent. Direct Error.message stays unprefixed until the existing adapter applies spacing; malformed request strings are not repaired or assigned scalar-completeness proof.
 
-Validation order, callbacks/getters/String observations, basic Error type/construction sites and successful details/verbose/schema outputs stay unchanged. No catch-all intercepts dependency/authorization/session exceptions, preserves a guessed source id, exposes private causes or changes old fail-soft catches. Those errors retain their owning behavior rather than being relabeled AX. Recipe discovery/status hooks may already have executed before a later local refusal; this does not certify no effects, handling failure or safe replay. Source/installed whole-owner properties cover all ten branches in both verbose modes, exact byte boundary plus public spacing, whole-value/action omission, original exceptions including primitive/undefined/hostile getters, session-fence precedence and unchanged journals.
+Refusal validation order, callbacks/getters/String observations and basic Error type/construction sites stay unchanged. Machine details and verbose JSON retain their contracts; generated schema text follows the YAML/fallback rule above. No catch-all intercepts dependency/authorization/session exceptions, preserves a guessed source id, exposes private causes or changes old fail-soft catches. Those errors retain their owning behavior rather than being relabeled AX. Recipe discovery/status hooks may already have executed before a later local refusal; this does not certify no effects, handling failure or safe replay. Source/installed whole-owner properties cover all ten branches in both verbose modes, exact byte boundary plus public spacing, whole-value/action omission, original exceptions including primitive/undefined/hostile getters, session-fence precedence and unchanged journals.
 
 ## Run Targets
 
@@ -89,13 +89,14 @@ Controlled partial-preview/Unicode and genuine-private-writer-from-controlled-re
 ```text
 inspect target=recipes view=status
 inspect target=recipes view=summary
+inspect target=recipes view=registry
 inspect target=recipes view=doctor identity=music-player/playback
 inspect target=recipes view=imports verbose=true
 inspect target=recipes view=reviews verbose=true
 ```
 
 - `status` reports registry/watch state, active/shadowed/invalid/disabled user Recipes, active Skill components, drafts, usage, and diagnostics.
-- `summary` returns the compact discovery-oriented projection of the same current context.
+- `summary` returns the compact discovery-oriented projection of the same current context. `registry` is the same inspection path under a second accepted view name: with identical `verbose` and other inputs it returns identical facts, details and rendering, so only `verbose` selects compact text versus structured output. The compact label stays `recipes: registry` for both names.
 - `doctor` diagnoses one canonical `<skill>/<recipe>` identity when `identity` is provided; without an identity it reports registry remediation evidence.
 - `imports` exposes active Skill namespaces and component import inventory for resolution diagnosis.
 - `reviews` exposes bounded automatic draft/tool review state and recovery guidance.

package/docs/output-projection-map.md

@@ -37,23 +37,23 @@ Terminal observation -> frozen completion/attention capture
 
 ### 3. Synchronous Registered Output and Local Usage/Launch Errors
 
-- **Owners:** `tools-spawn.ts:86` `spawnGuardText` / `:106` `runIdFromTarget`; `tools-local.ts:69` `formatRuntimeToolUsageHint`, `:128` `formatRuntimeToolArgumentError`, and execute's `dispatchEntered` cutoff. `lib/execution.ts:1081` `executeRegisteredTool` returns selected `formatted.text` plus machine details at `:1142`.
-- **Current:** Local guards are pseudo-fields; usage guidance mixes prose, JSON call examples and argument lists. `lib/execution-output.ts:91` `formatOutput` and `:112` `formatFailureOutput` own stdout/stderr trim/tail selection, runtime labels and truncation notices.
-- **Target / guard:** Owned guard/guidance facts become YAML. Actual JSON invocation examples remain instructional source; selected command/report JSON remains content. If separately selected body text is present, use a delimited header without changing existing source selection. Do not claim current formatted tails are original complete stdout. After executor entry/async handoff, the local catch preserves its original failure rather than treating wording as a repairable argument error. Host schema/clone/coercion errors may occur before facade guards.
+- **Owners:** `tools-spawn.ts:86` `spawnGuardText` / `:111` `runIdFromTarget`; `tools-local.ts:71` `runtimeToolUsageMetadata`, `:84` `formatRuntimeToolUsageHint`, `:137` `formatRuntimeToolArgumentError`, and execute's `dispatchEntered` cutoff. `lib/execution.ts:1081` `executeRegisteredTool` returns selected `formatted.text` plus machine details at `:1142`.
+- **Current:** Owned guard and usage facts are bare block YAML through the shared `renderYamlMetadata`/`frameMetadataDocument` primitives. Pre-launch spawn guards present `field`/`result`/`accepted_format`/`id_rule` with one whole selected `value` or an explicit `value_omission` record. The pre-dispatch argument-repair error presents `tool`/`required`/`optional` in a closed `---` header, then the original validation prose and the verbatim `JSON.stringify` invocation example at the left margin. `lib/execution-output.ts` `formatFailureOutput` emits `exit_code`/`killed` metadata with a delimited header before the unchanged `stderr:`/`stdout:` bodies, and a failure with no selected stream text stays metadata-only bare YAML instead of an invented body. `formatOutput` still owns trim/tail selection, the truncation notice and full-output temp file; the leading LF remains host invocation spacing.
+- **Target / guard:** Owned guard/guidance facts are YAML. Actual JSON invocation examples remain instructional source and are never parsed or reserialized; the validation prose stays body content. If separately selected body text is present, one delimited header separates it without changing existing source selection. Do not claim current formatted tails are original complete stdout. After executor entry/async handoff, the local catch preserves its original failure rather than treating wording as a repairable argument error. Host schema/clone/coercion errors may occur before facade guards. Exit-status metadata is not a native/closure or signal-authenticity claim, and stream bodies are never parsed back into fields.
 - **Proof owners:** `tests/tools-spawn.test.ts`, `tests/tools-local.test.ts`, `tests/tools.test.ts:304`, `tests/execution-output.test.ts`; packed dispatch-failure preservation at installed `:2656`.
 
 ### 4. Control Receipts and Public Failures
 
-- **Owners:** `lib/tools-message.ts:23` `controlGuardText`, `:66` `compactControlResult`, `:120` `createControlToolDefinition`; conservative actor-local failure catch at `:224`, replacement-state withholding at `:246–248`, verbose JSON at `:258`.
-- **Current:** Pseudo-fields distinguish request, delivery, handling, legacy kill attempt/closure uncertainty and one selected next action. Verbose text is JSON of request/result, also retained separately as machine `details`; exact cause chains stay private.
-- **Target / guard:** Metadata-only receipts/refusals become bare YAML, including native option sequences and nested verbose facts. Preserve whole identity/option bounds and existing caller facts. No private causes, inferred correlation, automatic retry, new recipient lease or no-effects/closure claim follows. Kill/archive/prune/dependency failures remain separately owned and may follow effects.
+- **Owners:** `lib/tools-message.ts` `controlGuardText`, `compactControlResult`, `createControlToolDefinition`; conservative actor-local failure catch, replacement-state withholding and verbose JSON in the same file.
+- **Current:** Receipts, guard refusals and the awaiting-dispatch failure notice are bare block YAML with native option sequences and a typed read-only `next` or one opaque `next.instruction`. Shared `tools-response` selection helpers keep whole selected values or explicit whole-field/sequence omission records under the existing16KiB cap including the public LF. Delivery/handling, legacy kill attempt/closure uncertainty and request distinctions are unchanged. Verbose text is still JSON of request/result, also retained separately as machine `details`; exact cause chains stay private.
+- **Target / guard:** Metadata-only receipts/refusals stay bare YAML, including nested verbose facts when they migrate. Preserve whole identity/option bounds and existing caller facts. No private causes, inferred correlation, automatic retry, new recipient lease or no-effects/closure claim follows. Kill/archive/prune/dependency failures remain separately owned and may follow effects.
 - **Proof owners:** `tests/tools-message.test.ts` guard/host/refusal/privacy/context-change families; `tests/runs-control-delivery.test.ts` and awaited-Control cases in `tests/async-runs.test.ts`. YAML migration does not resolve those authority/transport gates.
 
 ### 5. Inspect: Compact, Verbose and Schema
 
 - **Owners:** `lib/tools-inspect.ts:188` `compactRuntime`, `:201` `formatInspectFailure`, `:508` `inspectRun`, `:597` `inspectTool`, `:637` `compactResult`, execute at `:728`; `tools-response.ts:436` `formatInspectionHint` / `:443` `compactRecipeRegistry`.
-- **Current:** Compact paths use pseudo-fields. **Every verbose view and `tool:* view=schema` even without verbose** selects generated pretty JSON. Compact Run views supply a run/view header, not a newly available body/status snapshot. Recipe/source hints and authored advice have distinct typed versus opaque paths.
-- **Target / guard:** Runtime-generated compact/verbose/JSON-Schema presentation becomes YAML. Underlying `tool.parameters` JSON Schema and machine details do not change. `view=schema` is generated definition metadata, not the literal-source-file exception. Preserve filtering/redaction, partiality, exact portable sources and selected next actions; no new read, default snapshot or timing route is authorized.
+- **Current:** Refusals and compact success paths now render as bare block-YAML documents: the ten locally authored refusals use a field-local whole-field coverage record (`state: omitted`), and compact Run headers, runtime status/runs/triage, tool status and Recipe registry/doctor use native numbers/booleans/sequences with one typed read-only `next` or one opaque `next.instruction`. Opaque identity/source/boundary/advice scalars and complete required/optional argument sequences are whole or explicitly omitted through the shared `selectYamlField`/`growYamlDocument` owner under the same 16 KiB basis. Verbose JSON bypasses compact formatting, and emitter unavailability never becomes undefined text. The always-structured `tool:* view=schema` text is now the same bare block-YAML metadata (native `parameters` nodes, absent fields absent) while its machine `details` object stays unchanged JSON; a pathological schema beyond the shared emitter's execution ceiling keeps the exact legacy JSON text instead of being clipped. Compact Run views supply a run/view header, not a newly available body/status snapshot. Recipe/source hints and authored advice have distinct typed versus opaque paths.
+- **Target / guard:** Remaining runtime-generated compact/verbose/JSON-Schema presentation becomes YAML. Underlying `tool.parameters` JSON Schema and machine details do not change. `view=schema` is generated definition metadata, not the literal-source-file exception. Preserve filtering/redaction, partiality, exact portable sources and selected next actions; no new read, default snapshot or timing route is authorized.
 - **Proof owners:** `tests/tools-inspect.test.ts` refusals, schemas, views, privacy, current-session navigation and failed-priority families; installed inspection contracts at `:2492`.
 
 ### 6. Registration, Listing, Deletion and Draft Promotion
@@ -66,14 +66,16 @@ Terminal observation -> frozen completion/attention capture
 ### 7. Registry Refusals and Transaction Diagnostics
 
 - **Owners:** `registry.ts` `assertRegisterToolInputModes` (`:776`), `reservedRegistrationNameText` / `executeRegisterToolUnlocked` (`:827,:840`), `duplicateRegistrationText` (`:374`), `assertTemplateIsNotNestedRecipe` / `getInputTemplate` (`:588,:606`), `normalizeDefaults` / `buildAuthoredRecipe` (`:653,:702`). Selected error formatters are `draftPathFailureText`, `sourceNormalizationFailureText`, `candidateAdmissionFailureText`, `draftRecipeFailureText`, `registrationTransactionFailureText` (`:315,:279,:254,:384,:231`).
-- **Current → target:** Locally selected pseudo-record facts become bare YAML, with opaque selected advice/reasons/diagnostics and complete or explicitly omitted source literals. This is not a global exception wrapper.
+- **Current:** Locally authored mode/name/source/template/draft/transaction refusals are bare block YAML through the shared `tools-response` `selectYamlField`/`growYamlDocument` helpers plus the local document builder: fixed fields stay compiler literals, choice sets stay native sequences, and each opaque selected value is one whole double-quoted scalar or an explicit whole-field omission record, seeded shorter and grown monotonically under the existing16KiB cap including the public LF. Authored text therefore stays scalar content with escaped line breaks rather than becoming metadata. Registry activation/promotion/deletion notice text (`registryNoticeText`) still uses flat report/tool fields and is not part of this refusal migration.
+- **Target / guard:** Opaque selected advice/reasons/diagnostics remain whole or explicitly omitted; a syntax change must not turn authored text into keys or actions. This is not a global exception wrapper.
 - **Guard / proof:** Preserve guard/getter/String/join/Error order, existing diagnostic clipping, source-mode/duplicate predicates, cleanup and post-effect faults. A joined legacy diagnostic/summary is not a newly complete list; do not parse it into one or add raw causes/body/value echoes. Exact cases live in `tests/registry.test.ts` source/defaults/template/path/diagnostic/transaction groups; runtime/source/dependency failures retain their own owners.
 
 ### 8. Registry, Callback, Watcher and Teardown Notices
 
-- **Owners:** `registry.ts:224` `registryNoticeText`; `lib/runtime.ts:96` `notify`, `:189` `formatRecipeToolWarnings`, `:336` `createRecipeToolReloadWatcher`. Runtime callback/steer diagnostics are in `run-ui-runtime.ts:49,151,335,400,692`; watcher/retirement notices in `observability.ts:254,1007,1016`.
-- **Current → target:** Owned pseudo-record reports/category sequences/counts become bare YAML when metadata-only; selected diagnostics stay opaque. Keep the actual `ctx.ui.notify`/forwarding owner: runtime's notifier is `hasUI`-gated, but the reload watcher has direct notify sites. Progress/chrome is separate below.
-- **Guard / proof:** Do not add a model-output cap to uncapped UI text, expose raw causes, change callback/rearm/dedup or read new error properties. Retirement notification is inside the stop path, so notifier failure can follow effects. Steer UI preview versus persisted error bounds remain separate. `tests/runtime.test.ts`, `tests/registry.test.ts:74,113`, callback/teardown cases in `tests/run-ui-runtime.test.ts`, watcher/retirement cases in `tests/observability.test.ts` own these boundaries.
+- **Owners:** `registry.ts` `registryNoticeText`; `lib/runtime.ts` `notify`, `formatRecipeToolWarnings`, `createRecipeToolReloadWatcher`. Runtime callback/steer/teardown notices are in `run-ui-runtime.ts` (`formatSteerDiagnosticMessage`, callback failure, completion recovery, steer recovery, shutdown teardown); watcher/retirement notices in `observability.ts`.
+- **Current:** Runtime callback failure, completion recovery/acceptance, steer admission/delivery/recovery diagnostics and the shutdown teardown report are bare block-YAML metadata with native counters and an explicit receipt/report stage through the shared UI-only `formatYamlNotice` owner. Watcher and retirement notices use it too. These UI projections retain complete well-formed selected fields without borrowing model byte/depth ceilings; malformed selected text is explicitly unavailable. The 240-pair steer preview and its unknown-loss markers are unchanged, as is each existing leading-LF convention. Registry activation/promotion/deletion and startup warnings still use their flat report/category layout.
+- **Target / guard:** Remaining owned pseudo-record reports/category sequences become bare YAML when metadata-only; selected diagnostics stay opaque. Keep the actual `ctx.ui.notify`/forwarding owner: runtime's notifier is `hasUI`-gated, but the reload watcher has direct notify sites. Progress/chrome is separate below.
+- **Guard / proof:** Do not expose raw causes, change callback/rearm/dedup or read new error properties; a notice bound never truncates an identity or a diagnostic mid-value. Retirement notification is inside the stop path, so notifier failure can follow effects. Steer UI preview versus persisted error bounds remain separate. `tests/runtime.test.ts`, `tests/registry.test.ts`, callback/teardown/steer cases in `tests/run-ui-runtime.test.ts`, watcher/retirement cases in `tests/observability.test.ts` own these boundaries.
 
 ## Captured Delivery and UI
 
@@ -89,10 +91,10 @@ F1.6 source-audit correction: Pi 1.0 native custom-message storage, session reco
 ### 10. Completion Projection, Compiler Frame and Native Renderer
 
 - **Owners:** `run-delivery.ts:1510` `completionRecordRow`, `:1683` `assembleFrontmatter`, `:1886` `projectCompletionRecords`, `:2110` `projectRunCompletionBatchPresentation`, `:2233` `readRunCompletionPresentation`, `:2283` retained projection, `:2328` message formatting. `run-ui-runtime.ts:68` `registerRunCompletionRenderer` is wired at `extension-runtime.ts:122`.
-- **Current:** Headers contain flow-JSON `references`/`run_files`; raw bodies and separate cut/uncertainty markers follow. Omission/inventory service text still uses pseudo-records/JSON. HTML compiler frames/closed completion markers and `details.pi_actors_presentation` bind ranges/hashes. Valid compact views render compiler text separately from native Markdown bodies; expansion/invalid hints expose original text.
-- **Prepared wire core:** `run-delivery.ts` `encodeCompletionYamlCarrier` / `readCompletionYamlCarrier` provide the accepted pure/nondefault mechanics; the prototype encodes and typed native view decodes them. Working source now also has a partial, unverified private candidate capture/layout route and strict-core Pi correlation. Default capture still uses `frontmatter_v2`; compiled/SDK integration and candidate acceptance are not established. They encode one `_completion` packet ID/codec and relative body/marker lengths, then derive dense ranges while decoding. Canonical bare headers are independent YAML fragments separated by codec-owned blank lines, not one mapping or a standard YAML multi-document stream; body-present headers are delimited and raw parts remain opaque. All-omitted is bare service metadata, not a fake Run. Empty selected bodies are distinct from absent bodies; empty-marker-only wrappers are refused. Input uses named top-level result keys with explicit depth/work bounds; fresh source admission and carrier acceptance remain F1.6v-gated, and meaningful service warnings must not be hidden wholesale.
-- **Prepared source projection (nondefault):** `projectRunCompletionYamlPrototype` projects current AX/frontmatter selected snapshots through one shared private fitter; it returns content, a format/digest-only hint and fitting facts, not a newly admitted or relabeled Batch. Frozen budgets/prefixes remain immutable. Canonical header/raw-part costs are measured additively, with unsupported data distinct from byte overflow; final content must agree with the unchanged core encoder/decoder. This prototype API remains data-only and source-class restricted. The partial private captured-layout route reuses internal YAML assembly rather than relabeling an old frozen snapshot; its independent quota/inventory, replay and epoch evidence is still incomplete. Native renderer support is prepared below; actual carrier acceptance remains a separate gate.
-- **Prepared native view (nondefault):** `readRunCompletionPresentation` derives frozen typed segments from the strict core and exact minimal format/digest hint; the registered renderer hides whole decoded reference/location nodes, retains every service fact and renders each body as independent native Markdown with literal Text metadata/markers. Valid-core missing/invalid hints and declared-new malformed content expose original full Text; expansion keeps that same source. Malformed content without a safely readable own new-format declaration retains historical dispatch, not a body-scanning heuristic. Headless widths/padding and old-history preservation are proved. Repo SDK 1.0.0's public `CustomMessageComponent` falls back to one Markdown component when a renderer is absent, returns undefined or throws, joining text-block arrays; a fresh component probe confirms this boundary, not session/interactive dispatch. Preserve that fallback unchanged: full content supplied to Markdown is neither independent-body rendering nor literal-visibility proof. Independent Markdown belongs only to the validated registered compact branch; registered degraded/expanded views keep original Text. Actual source-admitted native storage/context/provider/reopen and loaded terminal/phone behavior remain separate acceptance.
+- **Current:** Fresh ordinary `completion_yaml_files_v1` snapshots use the unchanged strict YAML-core carrier. Header files.groups stores literal roots with relative entries, source bindings and English purposes; read_first is a group/entry pointer. Unknown-base paths stay explicitly as recorded. Native compact presentation exposes those file groups and places omission/inventory facts in the first header, never after the Markdown. Only known character-cut markers remain beside a truncated body. Earlier core-v1 and historical layouts keep their exact projection and hiding/footer behavior.
+- **Prepared wire core:** `run-delivery.ts` `encodeCompletionYamlCarrier` / `readCompletionYamlCarrier` provide the accepted pure/nondefault mechanics; the prototype encodes and typed native view decodes them. Ordinary source/default capture uses the rooted snapshot layout; the earlier core-v1 snapshot and inactive numbered-stream frontmatter_v2 remain separate replay/gated paths. Strict-core Pi correlation and source/packed SDK evidence bind the selected content without granting native or read authority. They encode one `_completion` packet ID/codec and relative body/marker lengths, then derive dense ranges while decoding. Canonical bare headers are independent YAML fragments separated by codec-owned blank lines, not one mapping or a standard YAML multi-document stream; body-present headers are delimited and raw parts remain opaque. All-omitted is bare service metadata, not a fake Run. Empty selected bodies are distinct from absent bodies; empty-marker-only wrappers are refused. Input uses named top-level result keys with explicit depth/work bounds; loaded-host acceptance remains F1.7/U1-gated, and meaningful service warnings must not be hidden wholesale.
+- **Prepared source projection (nondefault):** `projectRunCompletionYamlPrototype` projects current AX/frontmatter selected snapshots through one shared private fitter; it returns content, a format/digest-only hint and fitting facts, not a newly admitted or relabeled Batch. Frozen budgets/prefixes remain immutable. Canonical header/raw-part costs are measured additively, with unsupported data distinct from byte overflow; final content must agree with the unchanged core encoder/decoder. This prototype API remains data-only and source-class restricted. The ordinary rooted capture reuses internal YAML assembly and the same independently measured quotas/inventory rather than relabeling an old frozen snapshot. Native renderer support is prepared below; actual carrier acceptance remains a separate gate.
+- **Native view:** `readRunCompletionPresentation` derives frozen typed segments from the strict core and exact minimal format/digest hint; the registered renderer keeps new rooted file groups and all meaningful service facts in headers, then renders each body as independent native Markdown with literal Text metadata/markers. Retained core-v1 captures keep their earlier reference hiding and service placement. Valid-core missing/invalid hints and declared-new malformed content expose original full Text; expansion keeps that same source. Malformed content without a safely readable own new-format declaration retains historical dispatch, not a body-scanning heuristic. Headless widths/padding and old-history preservation are proved. Repo SDK 1.0.0's public `CustomMessageComponent` falls back to one Markdown component when a renderer is absent, returns undefined or throws, joining text-block arrays; a fresh component probe confirms this boundary, not session/interactive dispatch. Preserve that fallback unchanged: full content supplied to Markdown is neither independent-body rendering nor literal-visibility proof. Independent Markdown belongs only to the validated registered compact branch; registered degraded/expanded views keep original Text. Actual source-admitted native storage/context/provider/reopen and loaded terminal/phone behavior remain separate acceptance.
 - **Selected-source bridge preservation:** A collector-supported legacy artifact declaration containing a lone UTF-16 surrogate is accepted and escaped by the old codec but refused by the pure YAML core; validator support does not assert that its target exists. The private bridge must preserve such known string-valued metadata slots as an explicit `utf16_code_units` mapping of four-hex-digit units, without U+FFFD repair, reference deletion, body encoding or machine/history mutation. Ordinary strings stay strings. Source-family probes reached depth eight and an exact 49,152-byte equal-share packet; these are representative witnesses, not universal compatibility proof. Pure projection/fitting precedes native renderer dispatch. One private optimizer distinguishes unsupported data from byte overflow; no public selector or newly budgeted Batch mislabeled as an old layout. Meaningful service warnings remain visible, and final output must satisfy the unchanged core's whole-packet contract.
 - **Concrete coupling:** `readFrontmatterFrame` (`run-delivery.ts:1628`) validates single-line fields/values and complete ordered coverage. The retained compact branch in `run-ui-runtime.ts` hides only single `references: ` / `run_files: ` lines; the new typed-segment branch handles whole decoded nodes. A serializer-only switch to nested YAML breaks validation or exposes orphaned reference children. Header parsing, whole-node hiding, fitting, hint/frame generation and source/body rendering must move together for new captures.
 - **Target / guard:** Block-YAML metadata with body-dependent delimiters; opaque independent body blocks and exact omission markers. Keep old codecs/bytes/hints, 48 KiB/64 shown/256 captured limits and whole references. The F1.6 necessity audit supports deleting fresh prefix hashes and duplicate coordinate/range tables, not moving the whole payload. The target carries one packet identity and minimal relative opaque-body/marker segments in YAML; absolute ranges are derived. Full admitted-source compatibility and actual carrier acceptance remain unproved, so the current HTML reader/producer are not removed in place. `completionInventoryText` (`:434`) remains machine JSON.
@@ -114,7 +116,7 @@ F1.6 source-audit correction: Pi 1.0 native custom-message storage, session reco
 ### 13. Inspector, Trace and Progress Chrome
 
 - **Owners:** `inspector-command.ts:13` command/UI entry; `inspector.ts:100,120,128` selected kill feedback and owner/generation action; `inspector-overlay.ts:411,467,490,640` kill/confirmation/popup recognition and `:743,804,826,896,919,935,945` list/detail/document projections. `trace-projection.ts:196,243,293` supplies observed Trace/Control/agent data; session privacy remains in `session-evidence.ts`. `observability.ts:935,947` → `run-ui-runtime.ts:504` owns animated status.
-- **Current:** Literal semantic documents use pseudo-records/nested sequences with ephemeral compiler-label provenance, selected text uses native wrapping, and popup coloring recognizes current anchored AX feedback. Trace previews retain existing normalization/160-unit selection and unknown-loss semantics. Stripes, ranks, paging, focus, animation and modal choice labels are UI chrome, not model serialization.
+- **Current:** Literal semantic documents use pseudo-records/nested sequences with ephemeral compiler-label provenance, selected text uses native wrapping, and popup coloring recognizes current anchored AX feedback. Verified against every current Kill producer result: failed/rejected render as error, unavailable (state-only) as warning, and authored text that merely contains those header lines stays warning because only the exact leading pair counts. Trace previews retain existing normalization/160-unit selection and unknown-loss semantics. Stripes, ranks, paging, focus, animation and modal choice labels are UI chrome, not model serialization.
 - **Target / guard:** Owned document metadata is a YAML migration owner; do not interpret source lines as metadata or turn all chrome into YAML. Preserve original selected body/preview basis, columns/separators, safety/choices, frozen underlay and once-only generation action. A syntax change must update anchored feedback recognition without granting source labels meaning.
 - **Proof owners:** `tests/inspector.test.ts`, `tests/inspector-overlay.test.ts` documents/wrapping/Trace gaps/modal/safety families, `tests/trace-projection.test.ts`, session privacy and run-ui callback-animation tests. Headless/source tests do not prove actual terminal/phone rendering.
 

package/docs/windows-process-observation.md

@@ -156,7 +156,7 @@ The native producer now has one unrouted source owner at `native/windows-mi/wind
 
 The complete private adapter will return validated legacy-shaped property rows and a closed acquisition outcome, never expected identities, verifier decisions, Run metadata or lifecycle capabilities. Its implemented observation stage retains typed timestamp components and raw optional-field facts explicitly as `decoded_unadmitted`, with no date-to-legacy promotion, process invocation, asset loading or profile-admission port. Initial raw-null refusal belongs before normalization; native producer properties and the asset/invocation seam are separate slices. This stage alone cannot supply a process identity or establish freshness. Scalar and shared profiles stay distinct; shared rows require unique exact selected-PID correlation regardless of result order. Preserve the consumed string/optional normalization above, including `.trim()` and UTF-16 code units, lone surrogates and non-BMP pairs. Unexpected MI types, missing required properties and unsupported representations make the entire optimized observation unusable; no stronger path lookup, argv reconstruction or identity-format migration is permitted.
 
-The same private owner separately implements `decodeProvenanceBinding` for an already parsed, flat JSON-value fragment with exactly `source_sha256`, `executable_sha256`, `executable_bytes`, `originating_source_commit` and `originating_build_job`. Complete lowercase ASCII hash/commit lexemes, positive safe-integer byte counts and exact positive decimal-string job identifiers decode into fresh primitive claims labeled `decoded_binding_unadmitted`; malformed fragments return only `unusable/invalid_binding`. Source and installed compiled properties cover those boundaries, including final line terminators and copy independence. This is not a complete manifest, trusted descriptor, byte reader or asset verifier: it checks no file/hash, authentic origin, compiler, dependency or profile and grants no execution permission. Full-manifest format/resource bounds, trusted exact-byte selection, fixed asset lookup and invocation remain separate preparation work; arbitrary executable JavaScript objects are outside this JSON-value contract.
+The same private owner separately implements `decodeProvenanceBinding` for an already parsed, flat JSON-value fragment with exactly `source_sha256`, `executable_sha256`, `executable_bytes`, `originating_source_commit` and `originating_build_job`. Complete lowercase ASCII hash/commit lexemes, positive safe-integer byte counts and exact positive decimal-string job identifiers decode into fresh primitive claims labeled `decoded_binding_unadmitted`; malformed fragments return only `unusable/invalid_binding`. Source and installed compiled properties cover those boundaries, including final line terminators and copy independence. That fragment alone is not a complete manifest, trusted descriptor, byte reader or asset verifier: it checks no file/hash, authentic origin, compiler, dependency or profile and grants no execution permission; arbitrary executable JavaScript objects are outside this JSON-value contract. The same private owner now also carries the unrouted acquisition preparation: `readHelperManifest` (complete-manifest reader bounded at 32 KiB, one strict UTF-8 JSON document, exact reviewed key set, closed version/architecture/protocol/profile lexemes, positive safe-integer byte count capped at 8 MiB, bounded ASCII compiler/SDK/build-argument/dependency lexemes) returning fresh `manifest_unadmitted` claims; `resolveHelperAsset` (fixed versioned `native/windows-mi/win32-x64/<helper-version>/` lookup derived only from this module's own `lib/`/`dist/lib/` URL, refusing non-win32-x64 targets, non-semver versions and any other module path, with no cwd, PATH or caller location search); `loadHelperAsset` (injected bounded reader with a one-byte overflow probe for the complete manifest, exact declared executable size including its own one-byte growth probe, then exact SHA-256 equality, else a closed unusable reason); and `helperInvocation` (a shell-free `{command, args, options}` spec with the selected executable as `command` and only the profile/PIDs as `args` (the executable is not repeated as an argument), with `shell:false`/`windowsHide:true`, no spawn, retry, fallback or policy bypass). All of it stays unrouted: `runs-process.ts` keeps the shipped PowerShell acquisition, no package asset exists, and the raw-null refusal plus unsupported UTC-profile admission are unchanged.
 
 Do not promote the prototype's broad `candidateDate` range wholesale. The initial candidate is UTC-only; production eligibility requires a positively recognized environment/representation profile and real PowerShell serialization witnesses, including precision boundaries. An MI timestamp's zero offset alone, a runner label, a local JavaScript timezone or equality with an expected identity is not that predicate. The first experiment did not record a complete environment-admission witness. Establish the exact native environment/version facts and executable predicate in the broader differential before claiming a supported optimized profile; until that predicate is evidenced, keep profile admission unsupported. Non-UTC/historical profiles remain baseline-only unless separately admitted.
 
@@ -217,7 +217,7 @@ Deterministic ports and native producer properties separately cover PID boundari
 
 ### Preparation, shipping and activation boundaries
 
-The dependency-ready preparation is the unrouted private adapter/codec, mirrored properties, promoted native source and reviewed candidate artifact build/retention path. Keep the package's binary inventory unchanged until asset ownership is approved. No global SDK spawn interceptor or research-marker layer is justified by this integration question.
+The dependency-ready preparation is the unrouted private adapter/codec and acquisition seam (manifest reader, exact-byte verifier, fixed versioned lookup, shell-free invocation spec), mirrored properties, promoted native source and reviewed candidate artifact build/retention path. Keep the package's binary inventory unchanged until asset ownership is approved. No global SDK spawn interceptor or research-marker layer is justified by this integration question.
 
 Before shipping assets, independently review codec/fallback, native resource closure and provenance/distribution, then verify source/dist lookup, offline normal build/prepack, package inventory and exact shipping-byte differential. Before default activation, separately admit the routing change and pass unchanged source-and-packed genuine SDK/native validation through the actual shipping path. The fixed Run layout, workloads, watchdogs, settlement/close/research boundaries, privacy/history/budgets and independently fresh checks remain those of the existing contract; standalone helper latency does not prove recovered SDK settlement.
 

package/lib/execution-output.ts

@@ -10,6 +10,7 @@ import { join } from "node:path";
 import { sanitizeFilePart } from "./identity.ts";
 import * as Limits from "./limits.ts";
 import * as Paths from "./paths.ts";
+import * as ToolsResponse from "./tools-response.ts";
 
 export interface FormattedOutput {
   text: string;
@@ -116,8 +117,18 @@ export function formatFailureOutput(
   stdout: string,
   stderr: string,
 ): FormattedOutput {
-  const parts = [`Exit code ${code}${killed ? " (killed)" : ""}`];
+  const parts: string[] = [];
   if (stderr.trim()) parts.push(`stderr:\n${stderr.trimEnd()}`);
   if (stdout.trim()) parts.push(`stdout:\n${stdout.trimEnd()}`);
-  return formatOutput(toolName, "error", parts.join("\n\n"));
+  // Compiler-owned exit status is far below the shared metadata bound.
+  const header = (ToolsResponse.renderYamlMetadata({ exit_code: code, killed }, Limits.RUN_DELIVERY_MODEL_MAX_BYTES) as
+    Extract<ToolsResponse.YamlMetadataRendering, { state: "available" }>).text;
+  // A failure with no selected stream text stays metadata-only bare YAML; no filler body is invented.
+  if (parts.length === 0) return { text: formatToolText(ToolsResponse.frameMetadataDocument(header)), truncated: false };
+  // The existing formatter keeps trim/tail/temp-file/loss basis; only the exit label moves into YAML.
+  const formatted = formatOutput(toolName, "error", parts.join("\n\n"));
+  return {
+    ...formatted,
+    text: formatToolText(ToolsResponse.frameMetadataDocument(header, formatted.text.replace(/^\n+/u, ""))),
+  };
 }

package/lib/observability.ts

@@ -32,7 +32,7 @@ import { readRunCompletionTextSource, readRunResultArtifactInventory, readRunRes
 import type { RunPrimaryTextBinding } from "./runs-outcomes.ts";
 import { readJsonlFileResilient } from "./state-readers.ts";
 import { Document } from "yaml";
-import { formatLiteralBlock, formatMarkdownField } from "./tools-response.ts";
+import { formatYamlNotice } from "./tools-response.ts";
 
 export type RunObservedStatus =
   | "running"
@@ -290,13 +290,12 @@ export function createRunStateWatcher(input: {
       code === "rearmed"
         ? "; terminal watch acceleration restored"
         : "; terminal reconciliation remains active and watcher rearm will retry";
+    // Captured detail/recovery strings are reused as-is; only the projection becomes bare block YAML.
     diagnostics.push({
       code,
       id: ++diagnosticId,
-      message: [formatMarkdownField("watcher", code), formatMarkdownField("scope", scope),
-        formatMarkdownField("path", formatLiteralBlock(path)),
-        ...(detail ? [formatMarkdownField("diagnostic", detail.slice(2))] : []),
-        formatMarkdownField("recovery", recovery.slice(2))].join("\n"),
+      message: formatYamlNotice({ watcher: code, scope, path,
+        ...(detail ? { diagnostic: detail.slice(2) } : {}), recovery: recovery.slice(2) }),
       path,
       scope,
       ts: new Date().toISOString(),
@@ -1006,12 +1005,11 @@ export function findRunRetirementCandidates(
 }
 
 function formatRunRetirementNotice(run: string, action: RunRetirementExecution["action"], message = ""): string {
-  const fields = [formatMarkdownField("run", run.startsWith("run:") ? run.slice(4) : run), formatMarkdownField("retirement", action)];
-  if (action === "stop") fields.push(formatMarkdownField("result", "request returned"), formatMarkdownField("reason", "child runs reached terminal state"));
-  else if (action === "cancel") fields.push(formatMarkdownField("result", "cancellation reported"), formatMarkdownField("reason", "stop path failed"));
-  else fields.push(formatMarkdownField("result", action === "skip" ? "skipped" : "failed"), formatMarkdownField("diagnostic", message));
-  fields.push(formatMarkdownField("closure", "unconfirmed"));
-  return fields.join("\n");
+  return formatYamlNotice({ run: run.startsWith("run:") ? run.slice(4) : run, retirement: action,
+    ...(action === "stop" ? { result: "request returned", reason: "child runs reached terminal state" }
+      : action === "cancel" ? { result: "cancellation reported", reason: "stop path failed" }
+        : { result: action === "skip" ? "skipped" : "failed", diagnostic: message }),
+    closure: "unconfirmed" });
 }
 
 export async function executeRunRetirements(