@llblab/pi-actors 0.58.1 → 0.58.2

package/docs/async-runs.md

@@ -11,13 +11,13 @@ Target contract, not a complete implemented API: [Run supervision and self-conta
 
 ## Creation
 
-`spawn` accepts a Recipe/file or inline command template and optional values, Run id, transport context, and artifact declarations. The runtime resolves the Recipe, validates typed values and current policy placeholders, claims the state directory, creates a new immutable `run_instance_id`, captures process identity, starts the runner, and appends `run.start` Trace.
+`actors_run_spawn` accepts a Recipe/file or inline command template and optional values, Run id, transport context, and artifact declarations. The runtime resolves the Recipe, validates typed values and current policy placeholders, claims the state directory, creates a new immutable `run_instance_id`, captures process identity, starts the runner, and appends `run.start` Trace.
 
 A reused state directory fails while its prior generation remains active. Restart cleanup removes stale terminal state before the new generation starts.
 
 After successful lifecycle-lock release, common startRun registers the exact directory/generation in the existing shared catalog. Explicit compatible singleton attachment also re-registers that same generation without restarting work or resetting its clock; unpublished descendant preparation never enters this path. Registration is a separate effect, not launch/result/terminal authority. Its failure leaves launched work and any committed catalog bytes intact, with no retry, rollback or fabricated result. Successful receipts keep their prior shape. Failure adds `catalog_registration: { state: "unavailable", reason: "catalog_registration_failed" }` to returned metadata and `catalog=unavailable` to compact text. The original error is retained non-enumerably on the direct Kernel return only, not persisted or passed in public tool details. This reports an incomplete registration attempt, not perpetual unreadability: a post-rename error can coexist with committed bytes and a later valid map.
 
-Default compact receipts for `spawn` and asynchronous registered tools report launch facts as bare block YAML with nested observed file locations, without three generic `inspect` next actions. The response keeps one leading separator LF for host invocation spacing; no `---` or whole-object JSON fence is added. A launch receipt is not completion or service-readiness proof; eligible finite outcomes still arrive through the root coordinator completion path. Explicit `spawn verbose=true` keeps full JSON metadata, including its existing expert `next_actions`. Manual inspection and targeted diagnostic guidance remain available; neither a quiet receipt nor metadata alone promises delivery for silent policies.
+Default compact receipts for `actors_run_spawn` and asynchronous registered tools report launch facts as bare block YAML with nested observed file locations, without three generic `actors_inspect` next actions. The response keeps one leading separator LF for host invocation spacing; no `---` or whole-object JSON fence is added. A launch receipt is not completion or service-readiness proof; eligible finite outcomes still arrive through the root coordinator completion path. Explicit `spawn verbose=true` keeps full JSON metadata, including its existing expert `next_actions`. Manual inspection and targeted diagnostic guidance remain available; neither a quiet receipt nor metadata alone promises delivery for silent policies.
 
 ## Identity and Ownership
 
@@ -31,7 +31,7 @@ Each Run persists:
 - captured Recipe/template/values;
 - model and thinking policy provenance.
 
-Inspection, Control, cancellation, kill, retirement, and teardown filter by owner. Public Run-specific `inspect` and `message` also require a current coordinator session whose id exactly matches the persisted non-empty owner; possession of `run:<id>` alone grants no access. Missing coordinator identity, ownerless state, and cross-owner state fail closed. `inspect target=runtime view=runs` returns only the current session's exact-owner inventory and is the supported diagnostic when a remembered Run is inaccessible. Lifecycle mutations additionally revalidate generation, state, and process identity under the canonical lock.
+Inspection, Control, cancellation, kill, retirement, and teardown filter by owner. Public Run-specific `actors_inspect` and `actors_control_apply` also require a current coordinator session whose id exactly matches the persisted non-empty owner; possession of `run:<id>` alone grants no access. Missing coordinator identity, ownerless state, and cross-owner state fail closed. `actors_inspect target=runtime view=runs` returns only the current session's exact-owner inventory and is the supported diagnostic when a remembered Run is inaccessible. Lifecycle mutations additionally revalidate generation, state, and process identity under the canonical lock.
 
 ## State Files
 
@@ -65,7 +65,7 @@ Trace records strict bounded events:
 
 Required fields: `id`, `ts`, `kind`. Optional fields: `summary`, `data`, `level`, `attention`. Trace rejects addressed-envelope fields and malformed or oversized data. It retains a recent suffix within 2,048 events and 4 MiB. When either bound would be exceeded, the canonical lock atomically keeps a newest suffix near the lower targets, the new event, and one cumulative warning-only `runtime.trace_compacted` marker. The marker means older history was discarded; it reports cumulative drop evidence and never requests attention.
 
-Runtime lifecycle, runner progress, command completion, cancellation, kill, parent teardown, and controlled-service observations use Trace. Generic command lifecycle is Trace-only: runner-owned `command.done` records preserve level, captures, session provenance, and execution evidence but never request or project attention, even if malformed legacy evidence carries `steer`. Artifact metadata uses the already prepared bounded declaration-inventory binding/unavailability, never the full declaration map: Trace quotas must not become artifact/workload quotas or turn successful work into failure. This Trace reference alone asserts neither canonical first-result acceptance nor target-body/production authority. No Recipe field configures command-completion delivery. Semantic checkpoints opt in explicitly: `attention: "notify"` is visible status, `attention: "followup"` supplies ordinary checkpoint context, and `attention: "steer"` requests urgent delivery at Pi's next safe assistant/tool boundary. Steer is never inferred from exit status; its exact Run generation and event id enter the bounded owner journal before Pi delivery, recover through owned session evidence, and require exact model-bound context acknowledgment. Presentation appends a generation-fenced non-attention `delivery.steer_presented` Trace marker so historical retained steer events cannot replay after bounded owner receipts rotate. The eventual root terminal remains independently eligible for its completion batch. Bounded reads preserve complete UTF-8 lines and disclose omitted legacy prefixes. `inspect view=trace` reports retained-history completeness and projects events with Controls, owned Pi turns, logs, results, artifacts, and diagnostics newest-first. Equal timestamps use same-source physical order, then fixed source rank and stable id without claiming cross-source causality. Terminal state, `result.json`, `execution.json`, and artifacts remain authoritative even when old Trace has compacted.
+Runtime lifecycle, runner progress, command completion, cancellation, kill, parent teardown, and controlled-service observations use Trace. Generic command lifecycle is Trace-only: runner-owned `command.done` records preserve level, captures, session provenance, and execution evidence but never request or project attention, even if malformed legacy evidence carries `steer`. Artifact metadata uses the already prepared bounded declaration-inventory binding/unavailability, never the full declaration map: Trace quotas must not become artifact/workload quotas or turn successful work into failure. This Trace reference alone asserts neither canonical first-result acceptance nor target-body/production authority. No Recipe field configures command-completion delivery. Semantic checkpoints opt in explicitly: `attention: "notify"` is visible status, `attention: "followup"` supplies ordinary checkpoint context, and `attention: "steer"` requests urgent delivery at Pi's next safe assistant/tool boundary. Steer is never inferred from exit status; its exact Run generation and event id enter the bounded owner journal before Pi delivery, recover through owned session evidence, and require exact model-bound context acknowledgment. Presentation appends a generation-fenced non-attention `delivery.steer_presented` Trace marker so historical retained steer events cannot replay after bounded owner receipts rotate. The eventual root terminal remains independently eligible for its completion batch. Bounded reads preserve complete UTF-8 lines and disclose omitted legacy prefixes. `actors_inspect view=trace` reports retained-history completeness and projects events with Controls, owned Pi turns, logs, results, artifacts, and diagnostics newest-first. Equal timestamps use same-source physical order, then fixed source rank and stable id without claiming cross-source causality. Terminal state, `result.json`, `execution.json`, and artifacts remain authoritative even when old Trace has compacted.
 
 ## Control
 
@@ -92,14 +92,14 @@ The runtime:
 
 Unix services may publish a FIFO; native Windows services publish a Windows named pipe. Native Windows FIFO delivery fails before transport rather than degrading to another protocol. Both transports admit the same portable envelope: action is at most 64 lowercase ASCII characters, serialized JSON input is at most 380 bytes, and the newline-terminated wire record is at most 512 bytes. Invalid envelopes fail before journal admission or transport. Put larger data in a declared artifact/path and send only a bounded reference or instruction through Control.
 
-A service exact-id claims queued or transport-delivered Controls and records handled/failed outcomes through the canonical Control journal authority. Admission performs one locked read, integrity/generation check, terminal-tail compaction, capacity decision, and atomic write. The 65th pending Control and a rewrite exceeding 1 MiB fail as bounded `control_backpressure` before admission; malformed, unreadable, oversized, or stale-generation journals fail with an integrity reason and no rejected record. `inspect view=control` reports pending capacity, saturation, stale work, journal bytes, and diagnostics. Every transition uses the same lock, expected-state fence, 128-terminal compaction, and atomic bounded rewrite; persisted errors truncate inside the string at 4 KiB. Admitted nonterminal Controls never expire automatically. Delivery failure evidence cannot regress a Control already claimed or completed by a fast consumer. Services capture their startup generation, so stale-generation Controls never execute.
+A service exact-id claims queued or transport-delivered Controls and records handled/failed outcomes through the canonical Control journal authority. Admission performs one locked read, integrity/generation check, terminal-tail compaction, capacity decision, and atomic write. The 65th pending Control and a rewrite exceeding 1 MiB fail as bounded `control_backpressure` before admission; malformed, unreadable, oversized, or stale-generation journals fail with an integrity reason and no rejected record. `actors_inspect view=control` reports pending capacity, saturation, stale work, journal bytes, and diagnostics. Every transition uses the same lock, expected-state fence, 128-terminal compaction, and atomic bounded rewrite; persisted errors truncate inside the string at 4 KiB. Admitted nonterminal Controls never expire automatically. Delivery failure evidence cannot regress a Control already claimed or completed by a fast consumer. Services capture their startup generation, so stale-generation Controls never execute.
 
 Runtime lifecycle `kill`, retention actions, and review retry/reset remain runtime-owned rather than Recipe-declared. Invoke Run actions through the public tool exactly as follows:
 
 ```text
-message target=run:<id> action=kill
-message target=run:<id> action=archive
-message target=run:<id> action=prune input={"preserve_artifacts":true}
+actors_control_apply target=run:<id> action=kill
+actors_control_apply target=run:<id> action=archive
+actors_control_apply target=run:<id> action=prune input={"preserve_artifacts":true}
 ```
 
 Kill accepts only a running owned generation and is the recovery path for a stuck saturated Run: it bypasses actor-local Control capacity and creates no synthetic Control. Archive and prune accept only terminal owned Runs. Archive moves the entire Run state directory and leaves a tombstone at the original path. Prune removes kernel state and preserves declared existing artifacts only when `preserve_artifacts` is explicitly true, copying them to retained artifact storage first. Same-directory restart clears all generation-local evidence before the new `run_instance_id`.
@@ -163,11 +163,11 @@ One-shot pipelines omit Control and terminate through their command graph.
 ## Inspection
 
 ```text
-inspect target=run:<id> view=recipe
-inspect target=run:<id> view=trace source=lifecycle lines=40
-inspect target=run:<id> view=control
-inspect target=runtime view=runs
-inspect target=runtime view=triage
+actors_inspect target=run:<id> view=recipe
+actors_inspect target=run:<id> view=trace source=lifecycle lines=40
+actors_inspect target=run:<id> view=control
+actors_inspect target=runtime view=runs
+actors_inspect target=runtime view=triage
 ```
 
 Runtime `runs` is the exact-owner inventory; `triage` aggregates failed Runs, Control pressure, incomplete Trace evidence, and attention for that inventory. See [Management Inspection](./inspection.md) for every target/view combination and applicable inputs.

package/docs/capability-memory.md

@@ -18,7 +18,7 @@ The product goal is useful procedural memory with a selective tool interface, no
 
 ## Current Baseline and Its Limits
 
-Current user-root discovery exposes valid enabled direct Recipes by location, while active Skill components already provide reusable capabilities without automatic tool exposure. Ordinary registration supports both execution modes, and public `spawn` accepts ordinary non-singleton Recipes without `async: true`; the flag is not a foreground-only restriction. Inline-template `spawn` capture produces async drafts rather than capturing maintained/file Recipe launches, so a sync-only promotion rule would exclude that capture stream.
+Current user-root discovery exposes valid enabled direct Recipes by location, while active Skill components already provide reusable capabilities without automatic tool exposure. Ordinary registration supports both execution modes, and public `actors_run_spawn` accepts ordinary non-singleton Recipes without `async: true`; the flag is not a foreground-only restriction. Inline-template `actors_run_spawn` capture produces async drafts rather than capturing maintained/file Recipe launches, so a sync-only promotion rule would exclude that capture stream.
 
 Automatic review sees value-free shape, risk labels, launch counts and batch-local content-equality groups, not commands, descriptions, argument names/values, canonical names/paths or accepted outcomes. Its current promote/discard executor preserves captured executable content rather than generalizing a mission. Usage records launches and lineage, not successful task completion. These limits neither authorize bypassing confidentiality nor justify discarding a capability whose usefulness remains unknown.
 
@@ -26,11 +26,11 @@ Automatic review sees value-free shape, risk labels, launch counts and batch-loc
 
 The retained library stays outside nonrecursive tool-root discovery, including on older hosts. Directory separation fails safely where an unknown Recipe opt-out field could be ignored. No new Recipe field or logical-reference namespace is introduced.
 
-Use `inspect target=recipes view=summary` and `verbose=true` for retained paths and diagnostics. The [inspection contract](./inspection.md) owns views and coverage; the [tool registry](./tool-registry.md#retain-a-new-capability-without-tool-exposure) owns the current save/discover/reuse workflow. Inventory is storage evidence, not review, callability or a running Actor, and never initializes an absent library.
+Use `actors_inspect target=recipes view=summary` and `verbose=true` for retained paths and diagnostics. The [inspection contract](./inspection.md) owns views and coverage; the [tool registry](./tool-registry.md#retain-a-new-capability-without-tool-exposure) owns the current save/discover/reuse workflow. Inventory is storage evidence, not review, callability or a running Actor, and never initializes an absent library.
 
 ## Explicit Persistence Contract
 
-The implemented create-only operation is `register_tool expose=false` with a new name and one template/from source. Omitted/true keeps ordinary registration. The [tool registry](./tool-registry.md#retain-a-new-capability-without-tool-exposure) owns supported inputs, source preservation, conflicts, mutation fences and withdrawal limits; this design does not define a second persistence path.
+The implemented create-only operation is `actors_tool_register expose=false` with a new name and one template/from source. Omitted/true keeps ordinary registration. The [tool registry](./tool-registry.md#retain-a-new-capability-without-tool-exposure) owns supported inputs, source preservation, conflicts, mutation fences and withdrawal limits; this design does not define a second persistence path.
 
 The management path is **save deliberately → find through Recipe inspection → reuse the exact Recipe reference → expose explicitly when useful → withdraw only the wrapper when appropriate**. Moving executable sources, converting existing tools/drafts, retained updates/deletion and automatic transitions require separately admitted contracts. Source/package acceptance does not reload an older host or authorize live portfolio changes.
 
@@ -70,7 +70,7 @@ Tool exposure is justified by a stable agent-facing contract, not workload durat
 - **Inputs:** Caller-owned typed arguments and useful parameterization; no accidental commitment to a single captured prompt, temporary file, credential, installation path, or operator-specific mission.
 - **Result:** A clear deliverable and acceptance boundary. For async tools, explicitly distinguish the launch receipt from terminal completion and the requested result.
 - **Effects:** Understandable filesystem/network/service effects, authority requirements, and failure or cancellation limits. Registration does not grant new permissions; launch failure may leave effects, and a stop request is not proof of scope closure.
-- **Leverage:** Meaningful reduction in repeated planning or orchestration compared with existing tools and ordinary Recipe spawning. A generic arbitrary-prompt launcher that merely aliases `spawn` usually adds little.
+- **Leverage:** Meaningful reduction in repeated planning or orchestration compared with existing tools and ordinary Recipe spawning. A generic arbitrary-prompt launcher that merely aliases `actors_run_spawn` usually adds little.
 - **Evidence:** Available validation, actual reuse, outcome acceptance, and uncertainty appropriate to the capability. Do not invent a universal call-count threshold or equate repeated launch attempts with successful reuse.
 
 Examples are illustrative, not new registered tools:
@@ -95,7 +95,7 @@ Evaluate memory quality by useful accepted reuse and reduced reconstruction cost
 Extend existing owners instead of creating a second execution kernel, tool registry, Recipe resolver, or parallel task list:
 
 - **Recipe resolution/discovery:** Preserve exact Skill/file identity, imports, runtime-owned origins, validation, and the distinction between retained definitions and tool candidates. A non-tool library must remain reachable through an admitted existing Recipe execution path.
-- **Registry/runtime:** Own explicit exposure, host activation, withdrawal limitations, and `callable_now` evidence. Existing explicit `register_tool` intent remains valid for sync and async Recipes; the target policy does not silently prohibit either.
+- **Registry/runtime:** Own explicit exposure, host activation, withdrawal limitations, and `callable_now` evidence. Existing explicit `actors_tool_register` intent remains valid for sync and async Recipes; the target policy does not silently prohibit either.
 - **Draft/tool review and transactions:** Own evidence-limited recommendations, immutable captures, CAS, quarantine, journals, recovery, and admission of unchanged content. Retain/defer and withdrawal need explicit replay-safe transitions before changing automatic policy.
 - **Usage/lineage:** Preserve revision and lifetime evidence across retention, exposure, withdrawal, and rollback without counting a migration as a launch or inventing successful outcomes.
 - **Owning Skills:** Explain only implemented operations and approved selection guidance. Do not tell an agent to use a future library path, metadata flag, review action, or public command.
@@ -109,7 +109,7 @@ Existing user tools must not be silently demoted, deleted, renamed, generalized,
 - **Orthogonality:** A useful async capability can be exposed; an unsuitable sync capture is not automatically exposed. Either mode can be retained without becoming a tool.
 - **Evidence limits:** Structurally similar but semantically different Recipes cannot acquire an asserted purpose/usefulness solely from the same review shape. Unavailable semantic evidence stays explicit and can defer a decision without destructive loss.
 - **Identity and replay:** Retain/expose/withdraw/recover preserve source and lineage, reject stale/conflicting plans, and do not create promotion/demotion churn or duplicate executable copies as new capabilities.
-- **Invocation truth:** Explicit sync and async registration still works. Actual tool calls remain distinct from `spawn`; launch, eventual result, singleton attachment, and current callability retain their original meanings.
+- **Invocation truth:** Explicit sync and async registration still works. Actual tool calls remain distinct from `actors_run_spawn`; launch, eventual result, singleton attachment, and current callability retain their original meanings.
 - **Compatibility:** Source and packed-package journeys preserve existing safety and explicit-registration behavior before any automatic-policy migration. No test writes into the operator's registry.
 - **Product evidence:** Controlled evaluation must distinguish accepted useful reuse and selection cost from mere growth in Recipe/tool counts. Until measured, improved "muscle memory" remains a design hypothesis, not a shipped performance claim.
 

package/docs/inspection.md

@@ -1,6 +1,6 @@
 # Management Inspection
 
-The public `inspect` tool exposes four exact target families. Targets are management projections, not interchangeable aliases.
+The public `actors_inspect` tool exposes four exact target families. Targets are management projections, not interchangeable aliases.
 
 The project-wide [Agent Experience (AX) standard](./agent-experience.md) governs the direction of readable inspection text and its relationship to Inspector/agent context. Adoption does not mean current formatters already conform: rollout belongs to BACKLOG. Keep the exact target/view matrix, authorization and structured/verbose machine payloads unchanged; a new list/key-value presentation does not add fields, bodies or permission.
 
@@ -32,9 +32,9 @@ Refusal validation order, callbacks/getters/String observations and basic Error
 ## Run Targets
 
 ```text
-inspect target=run:demo view=recipe
-inspect target=run:demo view=trace source=lifecycle lines=40
-inspect target=run:demo view=control lines=20
+actors_inspect target=run:demo view=recipe
+actors_inspect target=run:demo view=trace source=lifecycle lines=40
+actors_inspect target=run:demo view=control lines=20
 ```
 
 Run views require a current coordinator session and an exact, non-empty match between that session id and the Run's persisted owner. Possessing a `run:<id>` is not authorization. Missing coordinator identity, ownerless state, and cross-owner state fail closed.
@@ -52,10 +52,10 @@ inspect target=runtime view=runs
 ## Runtime Targets
 
 ```text
-inspect target=runtime view=status
-inspect target=runtime view=runs
-inspect target=runtime view=runs status=failed
-inspect target=runtime view=triage
+actors_inspect target=runtime view=status
+actors_inspect target=runtime view=runs
+actors_inspect target=runtime view=runs status=failed
+actors_inspect target=runtime view=triage
 ```
 
 - `status` reports immutable package/runtime identity, state schema, and current automatic-review policy.
@@ -68,11 +68,11 @@ Runtime inventory never broadens authorization and never returns ownerless or fo
 
 Compact spawn/async-tool receipts include a selected-Run `file_navigation` row: the actual directory/generation and the same nine observed canonical starting slots, without reading a catalog or evidence bodies. Kernel checks current logical session and exact physical identity before projecting files and rechecks the recipient before return. Missing/foreign/changed scope yields bounded unavailability without failing an already committed launch; unavailable slots have no path. Complete rows fit inside the remaining shared 16-KiB compact-card budget or are explicitly omitted, never path-truncated; oversized optional launch fields are labeled omitted while bounded core facts/full expert details are preserved. These are mutable location hints, not a body/privacy/terminal certificate, full session tree or filesystem sandbox. Actual source/npm public launch fixtures check reference identity and visible compact/verbose transport. Two existing real-entrypoint research journeys per layout now ordinary-read metadata selected from actual saved public-spawn and uncataloged SDK async-tool receipts before requesting any fresh map, after the producer host/runners/workloads have exited and the same saved session reopens. Actual bounded read arguments and parsed JSON digests match independent parent metadata; this is ordinary raw-file research, not original publication/privacy certification. Four fork/clone histories retain the locations as data but get no fresh owned branch or metadata selection. The async launch uses the existing controlled Kernel composition, not a claim of root-entrypoint async launching. New terminal packets now freeze current-session exact-generation member location rows before journal admission; source/npm SDK now performs an explicitly requested actual result read selected from that terminal row, with independent generation/owner/parsed-JSON checks and unchanged frozen message across continuation.
 
-Compact launch receipts use bare block-YAML fields and a nested `run_files` value for whole selected observed locations, not a fenced object-JSON dump. Machine details retain their original JSON-compatible values and full spawn-verbose is still JSON. A single leading response LF supplies invocation spacing. A full available row suppresses the redundant map request; otherwise one `next` names tool=inspect, target=runtime, view=runs and verbose=true, with optional current-session investigation intent. This request is neither polling nor a read capability. Older terminal packet versions retain `Files (optional; current session)` followed by `inspect target=runtime view=runs verbose=true`. Fresh AX completion captures use a typed next node without reinterpreting that older handoff grammar; saved versions keep their exact text. Separately, new terminal packets use navigation_handoff=captured_file_locations and freeze a bounded prefix of location observations for their captured completion members, ordered roots before descendants with observed failed child-subtrees first. This is not the complete session map. Whole outcome rows retain precedence in the shared16KiBmessage; references then fit whole or are counted omitted, including uncaptured suffixes. Schema decoding and rendering are source/clock/native-free, and never refresh historical availability. Invoking it admits the actual current logical session at that time. Older absent/current_session_request packet versions retain their exact pending/queued/presented text rather than acquiring references on reload. The new reference marker/data are admitted only for new packets after actual current logical-session checks, never by saved DTOs as authority. The single per-batch hint consumes the shared 16-KiB model budget, not a separate allowance.
+Compact launch receipts use bare block-YAML fields and a nested `run_files` value for whole selected observed locations, not a fenced object-JSON dump. Machine details retain their original JSON-compatible values and full spawn-verbose is still JSON. A single leading response LF supplies invocation spacing. A full available row suppresses the redundant map request; otherwise one `next` names tool=inspect, target=runtime, view=runs and verbose=true, with optional current-session investigation intent. This request is neither polling nor a read capability. Older terminal packet versions retain `Files (optional; current session)` followed by `actors_inspect target=runtime view=runs verbose=true`. Fresh AX completion captures use a typed next node without reinterpreting that older handoff grammar; saved versions keep their exact text. Separately, new terminal packets use navigation_handoff=captured_file_locations and freeze a bounded prefix of location observations for their captured completion members, ordered roots before descendants with observed failed child-subtrees first. This is not the complete session map. Whole outcome rows retain precedence in the shared16KiBmessage; references then fit whole or are counted omitted, including uncaptured suffixes. Schema decoding and rendering are source/clock/native-free, and never refresh historical availability. Invoking it admits the actual current logical session at that time. Older absent/current_session_request packet versions retain their exact pending/queued/presented text rather than acquiring references on reload. The new reference marker/data are admitted only for new packets after actual current logical-session checks, never by saved DTOs as authority. The single per-batch hint consumes the shared 16-KiB model budget, not a separate allowance.
 
-`inspect target=runtime view=runs verbose=true` adds `navigation` alongside the existing `runs`. Kernel uses the actual current logical Pi session, rechecks it before return, and selects only already registered exact-generation directories. The map orders roots before their directly same-session-owned children; it does not follow a foreign-session parent or claim a complete descendant tree. Each row offers the canonical context index/result first, then selected metadata/execution/published-session-catalog/Trace/Control/stream locations with observed sizes and format_hint=json/jsonl/text. The file_inventory_scope=canonical_starting_locations label means these are starting points, not an exhaustive file list. Format hints describe expected layout, not validated syntax/UTF-8 or output completeness; even binary or malformed current bytes can retain a layout hint. Present files remain mutable; missing, nonregular or stale files have no usable location. Whole rows, not path strings, are omitted under the independent 16-KiB map bound, with shown/omitted/total Run-row counts, not file counts. The legacy inventory envelope keeps its existing bounds and behavior; `status` filters inventory, not the navigation branch.
+`actors_inspect target=runtime view=runs verbose=true` adds `navigation` alongside the existing `runs`. Kernel uses the actual current logical Pi session, rechecks it before return, and selects only already registered exact-generation directories. The map orders roots before their directly same-session-owned children; it does not follow a foreign-session parent or claim a complete descendant tree. Each row offers the canonical context index/result first, then selected metadata/execution/published-session-catalog/Trace/Control/stream locations with observed sizes and format_hint=json/jsonl/text. The file_inventory_scope=canonical_starting_locations label means these are starting points, not an exhaustive file list. Format hints describe expected layout, not validated syntax/UTF-8 or output completeness; even binary or malformed current bytes can retain a layout hint. Present files remain mutable; missing, nonregular or stale files have no usable location. Whole rows, not path strings, are omitted under the independent 16-KiB map bound, with shown/omitted/total Run-row counts, not file counts. The legacy inventory envelope keeps its existing bounds and behavior; `status` filters inventory, not the navigation branch.
 
-Both priority orders use only failed rows already observed for that inspection and matching the independently admitted map's exact owner/run/generation/directory. Ordinary inspection preserves latest-registration-first independent roots, while failed subtrees precede healthy/unknown siblings within each root. For a failed investigation use `inspect target=runtime view=runs status=failed verbose=true`: known failed root-subtrees are also stable-partitioned first, preserving recency among peers and always ancestors before descendants. `navigation.priority` reports `root_order=latest_registration|failed_subtrees_first` and `basis=observed_failed_rows`. Missing, stale or unmatched observations remain unranked, not certified successful; no complete failure inventory, terminal/native authority or cross-file atomicity is claimed. Ranking performs no additional status/body/native reads, does not filter map rows, repair/reorder catalog bytes or activate compact/default/automatic maps.
+Both priority orders use only failed rows already observed for that inspection and matching the independently admitted map's exact owner/run/generation/directory. Ordinary inspection preserves latest-registration-first independent roots, while failed subtrees precede healthy/unknown siblings within each root. For a failed investigation use `actors_inspect target=runtime view=runs status=failed verbose=true`: known failed root-subtrees are also stable-partitioned first, preserving recency among peers and always ancestors before descendants. `navigation.priority` reports `root_order=latest_registration|failed_subtrees_first` and `basis=observed_failed_rows`. Missing, stale or unmatched observations remain unranked, not certified successful; no complete failure inventory, terminal/native authority or cross-file atomicity is claimed. Ranking performs no additional status/body/native reads, does not filter map rows, repair/reorder catalog bytes or activate compact/default/automatic maps.
 
 The published_sessions location is the compiler-owned evidence/sessions.json file. Kernel stats its real evidence directory and regular leaf under the admitted Run root, retaining parent/leaf/owner fences; a symlink, nonregular or unrepresentable location has no usable path. This physical location needs no producer key or context-index.json: missing/corrupt/foreign-generation or pending/unavailable semantic-index claims do not gate ordinary research. A present location does not certify catalog schema, body generation, original privacy or historical publication. The map reads neither catalog bodies nor raw session directories.
 
@@ -87,12 +87,12 @@ Controlled partial-preview/Unicode and genuine-private-writer-from-controlled-re
 ## Recipe Targets
 
 ```text
-inspect target=recipes view=status
-inspect target=recipes view=summary
-inspect target=recipes view=registry
-inspect target=recipes view=doctor identity=music-player/playback
-inspect target=recipes view=imports verbose=true
-inspect target=recipes view=reviews verbose=true
+actors_inspect target=recipes view=status
+actors_inspect target=recipes view=summary
+actors_inspect target=recipes view=registry
+actors_inspect target=recipes view=doctor identity=music-player/playback
+actors_inspect target=recipes view=imports verbose=true
+actors_inspect target=recipes view=reviews verbose=true
 ```
 
 - `status` reports registry/watch state, active/shadowed/invalid/disabled user Recipes, active Skill components, drafts, retained-library definitions, usage, and diagnostics.
@@ -101,15 +101,15 @@ inspect target=recipes view=reviews verbose=true
 - `imports` exposes active Skill namespaces and component import inventory for resolution diagnosis.
 - `reviews` exposes bounded automatic draft/tool review state and recovery guidance.
 
-The compact Recipe catalog adds `retained` as a separate count for direct `.json`/`.md` definitions under `recipes/library`. Details/verbose includes `retained` rows (exact path, source_kind=user_retained_recipe, tool=false, resolved async mode, invalid/disabled state and diagnostics) and `retained_diagnostics`. Both root and library use the active session Skill context. Storage placement does not certify review, current callability or Run state; invalid/disabled definitions remain diagnostic. The missing library is empty, without initialization. Inspection performs no retention write, activation or launch. Valid enabled exact paths remain ordinary explicit-file references for `spawn` or deliberate `register_tool from` specialization. Inspection adds no mutation or logical-reference syntax; use explicit `register_tool expose=false` for supported create-only retention, and see [capability memory](./capability-memory.md#read-only-inventory-checkpoint).
+The compact Recipe catalog adds `retained` as a separate count for direct `.json`/`.md` definitions under `recipes/library`. Details/verbose includes `retained` rows (exact path, source_kind=user_retained_recipe, tool=false, resolved async mode, invalid/disabled state and diagnostics) and `retained_diagnostics`. Both root and library use the active session Skill context. Storage placement does not certify review, current callability or Run state; invalid/disabled definitions remain diagnostic. The missing library is empty, without initialization. Inspection performs no retention write, activation or launch. Valid enabled exact paths remain ordinary explicit-file references for `actors_run_spawn` or deliberate `actors_tool_register from` specialization. Inspection adds no mutation or logical-reference syntax; use explicit `actors_tool_register expose=false` for supported create-only retention, and see [capability memory](./capability-memory.md#read-only-inventory-checkpoint).
 
 `identity` is accepted only with `view=doctor`. Skill inventory is fail-soft diagnostic evidence; exact launch and registration still resolve against the immutable active-session context.
 
 ## Tool Targets
 
 ```text
-inspect target=tool:music_player view=status
-inspect target=tool:music_player view=schema
+actors_inspect target=tool:music_player view=status
+actors_inspect target=tool:music_player view=schema
 ```
 
 - `status` separates persistence, registry admission, host registration, `callable_now`, activation boundary, source identity, and `tool_calls` versus `spawn_calls`.
@@ -119,4 +119,4 @@ A registered tool is a capability definition, not a Run. Tool status cannot subs
 
 ## Boundaries
 
-Inspection is read-only, owner-filtered where Run state is involved, and redacted. Evidence-heavy Run, review, diagnostic, and text projections apply their documented bounds; `runtime view=runs` deliberately returns the complete matching exact-owner inventory. Inspection does not mutate journals, infer authority from displayed data, expose private active-Skill installation paths, or turn retained Trace into an audit archive. Use `message` for admitted runtime or actor-local actions.
+Inspection is read-only, owner-filtered where Run state is involved, and redacted. Evidence-heavy Run, review, diagnostic, and text projections apply their documented bounds; `runtime view=runs` deliberately returns the complete matching exact-owner inventory. Inspection does not mutate journals, infer authority from displayed data, expose private active-Skill installation paths, or turn retained Trace into an audit archive. Use `actors_control_apply` for admitted runtime or actor-local actions.

package/docs/run-supervision.md

@@ -1,12 +1,12 @@
 # Run Supervision and Self-Contained Outcomes
 
-Status: Accepted future supervision contract with separately identified implemented AX/evidence slices; full supervision is not released. Proposed supervision API/policy additions and their examples are not supported by the current release. [BACKLOG.md](../BACKLOG.md) owns the next selective AX/navigation/existing-runtime release and the remaining future work; this document owns behavior and evidence boundaries. The selective release does not activate independent owner-loss supervision, execution deadlines, public completion streams or unapproved source/retention expansion. Native authority, unchanged credentials, the agreed three-platform scope and positive closure requirements remain mandatory for the future feature. MPRIS and removal of `inspect` stay excluded.
+Status: Accepted future supervision contract with separately identified implemented AX/evidence slices; full supervision is not released. Proposed supervision API/policy additions and their examples are not supported by the current release. [BACKLOG.md](../BACKLOG.md) owns the next selective AX/navigation/existing-runtime release and the remaining future work; this document owns behavior and evidence boundaries. The selective release does not activate independent owner-loss supervision, execution deadlines, public completion streams or unapproved source/retention expansion. Native authority, unchanged credentials, the agreed three-platform scope and positive closure requirements remain mandatory for the future feature. MPRIS and removal of `actors_inspect` stay excluded.
 
 ## Goal and Boundaries
 
 A coordinator should receive a finite Run's outcome without polling. Optional periodic diagnostics make overdue work discoverable, and an independent execution deadline can terminate an owned generation. Neither policy is required for ordinary jobs or controlled services.
 
-- Preserve `spawn`, `message`, and `inspect`. Ordinary Run inspection is a manual request for the same compact snapshot used by timed diagnostics, with a readable context index for selective investigation. Retain resolution, activation, Control, and runtime diagnosis; do not remove existing expert routes implicitly.
+- Preserve `actors_run_spawn`, `actors_control_apply`, and `actors_inspect`. Ordinary Run inspection is a manual request for the same compact snapshot used by timed diagnostics, with a readable context index for selective investigation. Retain resolution, activation, Control, and runtime diagnosis; do not remove existing expert routes implicitly.
 - Do not add resumable suspension, checkpoints, automatic restarts/retries, a synchronous wait budget, global supervision defaults, or a new actor type.
 - Do not treat a diagnostic heartbeat as progress, semantic attention, or evidence that a task is healthy.
 - Preserve owner filtering, process-identity proof, lifecycle locks, parent/root delivery lineage, redaction, retention boundaries, and native Pi history.
@@ -148,7 +148,7 @@ Two independent old-layout reds then green properties cover literal/native Text2
 
 ### Recipe Registry Watcher Notification Constants
 
-Only two literal arguments in runtime.ts changed: notifyFailure warning now uses report plus original restart/register_tool advice as opaque instruction; scheduleReload info uses report containing the whole old Recipe tools refreshed from ~/.pi/agent/recipes text. No helper/import/domain/budget, root/state/activation read, automatic action or new actual-root/readiness/closure fact. Watcher calls ctx.ui.notify directly, unlike runtime.notify's hasUI gate; caller/port behavior remains distinct, including hasUI=false with an explicit callback. Parent/root admission, failureNotified/setWatchStatus, notifyAfterReload/latest pending state, timer/unref/load/getResolutionContext, stale-event checks, close/rearm and catch/reportCallbackError/no-throw containment are byte-unchanged outside those constants. A success-notifier fault can leave pending info for a later real event exactly as before; no automatic replay is introduced.
+Only two literal arguments in runtime.ts changed: notifyFailure warning now uses report plus original restart/actors_tool_register advice as opaque instruction; scheduleReload info uses report containing the whole old Recipe tools refreshed from ~/.pi/agent/recipes text. No helper/import/domain/budget, root/state/activation read, automatic action or new actual-root/readiness/closure fact. Watcher calls ctx.ui.notify directly, unlike runtime.notify's hasUI gate; caller/port behavior remains distinct, including hasUI=false with an explicit callback. Parent/root admission, failureNotified/setWatchStatus, notifyAfterReload/latest pending state, timer/unref/load/getResolutionContext, stale-event checks, close/rearm and catch/reportCallbackError/no-throw containment are byte-unchanged outside those constants. A success-notifier fault can leave pending info for a later real event exactly as before; no automatic replay is introduced.
 
 Two independent old-layout reds then greens in tests/runtime.test.ts retain all nine prior cases unchanged. Warning property covers missing parent/root open failure/root or parent error, failed-before-UI dedup, direct UI with either hasUI value, UI/notify-getter/callback faults with exact opaque/undefined/primitive causes, contained secondary observer throws and rearm reset. Refresh property covers active/draft/POSIX-Windows separator/null/mixed latest-pending events, original ctx/resolution and load-before-notify, closed stale callbacks, load/info failures with original secondary-before-primary reporting, and pending info on a later controlled draft event. Native Text checks24/52/90/140 widths; no model16KiB cap or actual root certification. Injected documented watchPath/exists/load/UI ports and real timers are deterministic fixture infrastructure, not independent/native/loaded-host review. Existing real filesystem rearm scenario remains whole and platform-skipped as before.
 
@@ -278,7 +278,7 @@ No transaction, rollback, callback, notifier, source read, lifecycle policy or d
 
 Text remains within16KiB including the existing formatter's leading LF. Whole field/list/action representations start from shorter full-or-omitted seeds and only grow. Fitting complete safety warnings have first priority before name/source/hint and large argument groups. No partial argument/path, fabricated char count, input/work quota or loss repair. Whole-group omission counts selected list entries, including complete large warning labels; malformed/non-text selections are unavailable without another coercion or new source permission. Machine args/defaults/warnings remain unchanged even when compact text omits them.
 
-All14original registry declarations/scenarios/fixtures/assertions/cleanup remain, with only the first approved success-layout assertion changed and the test environment explicitly imported before production. Two new properties first fail on old prose/unbounded group text, then cover unverified/callable/toggling activation×new/update, exact cfg/activation/notify observation order, opaque Unicode/CRLF warning labels and unchanged persisted bytes/details/next_actions. Opaque/undefined/primitive failures from notify, warning read, required-argument Array-subclass join and late activation getter occur after retained persistence with one activation and no new rollback/retry. Exact16384/one-over required and optional groups, non-disclosure of actual default values, warning priority/oversized warning coverage, malformed selected args, dynamically fenced real backtick-bearing source and actual SDK register_tool success normalization are covered. These fixtures register only in temporary recipe roots; they do not invoke a tool or prove real host activation.
+All14original registry declarations/scenarios/fixtures/assertions/cleanup remain, with only the first approved success-layout assertion changed and the test environment explicitly imported before production. Two new properties first fail on old prose/unbounded group text, then cover unverified/callable/toggling activation×new/update, exact cfg/activation/notify observation order, opaque Unicode/CRLF warning labels and unchanged persisted bytes/details/next_actions. Opaque/undefined/primitive failures from notify, warning read, required-argument Array-subclass join and late activation getter occur after retained persistence with one activation and no new rollback/retry. Exact16384/one-over required and optional groups, non-disclosure of actual default values, warning priority/oversized warning coverage, malformed selected args, dynamically fenced real backtick-bearing source and actual SDK actors_tool_register success normalization are covered. These fixtures register only in temporary recipe roots; they do not invoke a tool or prove real host activation.
 
 Actual installed replay now includes the whole16registry owner. Its original sibling-process lock-collision fixture resolves one production module via new URL rather than import syntax; the existing production-only remap now covers that exact reference as well, without copying scenarios or changing child code/assertions/cleanup. This process-lock comparison grants no new Actor/native readiness/exit claim. Original registration-truth/SDK/native fixtures remain intact. Earlier whole2spawn/16Control/21inspection/8response/21overlay/16Inspector and prior owners remain. The source, matrix, SDK and compiled replays are nonadditive. Independent review, loaded terminal/phone, source/recipient/native/clock/default/integrated release gates remain separate.
 
@@ -327,7 +327,7 @@ The exact remaining gate is a reviewed trusted host/recipient-publication contra
 
 ## Exact Launch API
 
-Add two independent optional fields to the root JSON/Markdown Recipe contract and the public `spawn` request:
+Add two independent optional fields to the root JSON/Markdown Recipe contract and the public `actors_run_spawn` request:
 
 - `report_every: Duration | null`: Optional minimum interval between eligible diagnostic deliveries for this generation; at least `1m` (`60000ms`) when enabled. It is disabled by default.
 - `max_runtime: Duration | null`: Maximum admitted execution duration for this generation, followed by runtime-owned termination.
@@ -359,7 +359,7 @@ Planned launch override:
 
 Resolve each field independently: explicit launch value, including `null`, overrides the effective root Recipe; an omitted Recipe field inherits through direct delegation; an unresolved field is disabled. A derived root Recipe's explicit value or `null` overrides the delegated source. There is no implicit interval or deadline.
 
-These are literal Run policy fields, not template flags or inferred placeholders. Do not interpret `values.report_every`, `values.max_runtime`, or similarly named actor arguments as supervision. Do not add reserved arguments to every registered tool. Async registered tools inherit their effective root Recipe policies; per-launch overrides in this increment are exposed through `spawn`. An inline synchronous execution path must reject root supervision fields as `run_supervision_requires_run`, not silently ignore an apparent execution limit. `spawn` always creates a Run and can therefore honor the fields even when the source Recipe is not marked async.
+These are literal Run policy fields, not template flags or inferred placeholders. Do not interpret `values.report_every`, `values.max_runtime`, or similarly named actor arguments as supervision. Do not add reserved arguments to every registered tool. Async registered tools inherit their effective root Recipe policies; per-launch overrides in this increment are exposed through `actors_run_spawn`. An inline synchronous execution path must reject root supervision fields as `run_supervision_requires_run`, not silently ignore an apparent execution limit. `actors_run_spawn` always creates a Run and can therefore honor the fields even when the source Recipe is not marked async.
 
 Named imports and command graph nodes are not Runs: their Recipe-level policies do not establish or reset the enclosing Run's timers. Separately spawned children have independent policies, while an expired parent's owned-tree teardown still applies. Direct Recipe/tool specialization must retain the resolved policy through the existing contract resolver rather than copying its template or rediscovering a different source.
 
@@ -410,7 +410,7 @@ A separate source/packed fixture now composes this private kernel through real p
 
 Participating owners sharing one exact genuine origin in this module/runtime now coordinate through a private weak claim. Activation reserves it before canonical assembly; a contender receives `controller_claimed` while another owner's controller or provisional assembly holds it. Stop alone does not transfer an allocated controller's claim: explicit release/close revokes its callbacks before handover. Failed assembly drops only its own reservation; a late nonholder cleanup cannot erase another owner's claim. The origin's first identity/state/frame binding persists across owner release, preventing copied-state adoption. Handover observes the original elapsed allowance, never a new current-time budget. This is cooperative logical ownership, not proof that an old physical timer was removed, exactly-once due notification across successive controllers or global scope authority. Distinct origins, module instances, processes and unregistered low-level controller constructors are outside that claim. Real launch handoff and controlled assembly/handover witnesses cover this boundary; cross-runtime authority, independent supervision/recovery, ordinary detached-runner frozen timing and public/native acceptance remain open.
 
-A compatible singleton reuse retains its original anchor, deadline, and report schedule. Compare normalized effective policies, so `60s` and `1m` are equivalent; conflicting policies fail closed instead of retiming a live singleton. A genuinely new generation receives new clocks. Running policies are not mutable through `message` in this increment.
+A compatible singleton reuse retains its original anchor, deadline, and report schedule. Compare normalized effective policies, so `60s` and `1m` are equivalent; conflicting policies fail closed instead of retiming a live singleton. A genuinely new generation receives new clocks. Running policies are not mutable through `actors_control_apply` in this increment.
 
 New metadata records `createdAt` and `started_at` from the same generation-admission anchor. The stored supervision fields form a coherent cohort: positive integer milliseconds or explicit null, a canonical ISO start, and exactly the deadline implied by that start and ceiling. Partial, coercible, or contradictory clocks fail closed rather than being repaired. A pre-supervision generation with wholly absent clock fields stays explicitly unconfigured; it can be reused under disabled policies without rewriting its metadata, but cannot acquire a new allowance or today's Recipe policy merely by reattachment.
 
@@ -422,7 +422,7 @@ Intervals are eligibility thresholds, not hard-real-time delivery promises. The
 
 In addition to each Run's interval, the exact top-level coordinator session admits routine diagnostic batches no more often than once per `60000ms`. This is one shared gate for all its Runs and containing trees, not a separate allowance for every Run, child session, or staggered timer. Both floors use `RUN_DIAGNOSTIC_MIN_INTERVAL_MS` from the policy owner; the gate is a delivery ceiling, not an implicit reporting default. It may postpone diagnostics further than their per-Run eligibility.
 
-Advance the shared cooldown only from accepted routine diagnostic delivery, not a proposed packet, ordinary completion, explicit urgent `steer`, or manual `inspect`. An admitted packet with unresolved acceptance retains its one diagnostic admission slot without spawning additional diagnostic packets. Preserve/recover the gate with exact owner and acceptance evidence across busy/idle transitions and reattachment; uncertain timing/acceptance defers routine diagnostics rather than inventing a fresh slot. At the next eligible boundary, merge the latest due snapshots fairly instead of replaying missed intervals. Independent top-level sessions retain independent gates.
+Advance the shared cooldown only from accepted routine diagnostic delivery, not a proposed packet, ordinary completion, explicit urgent `steer`, or manual `actors_inspect`. An admitted packet with unresolved acceptance retains its one diagnostic admission slot without spawning additional diagnostic packets. Preserve/recover the gate with exact owner and acceptance evidence across busy/idle transitions and reattachment; uncertain timing/acceptance defers routine diagnostics rather than inventing a fresh slot. At the next eligible boundary, merge the latest due snapshots fairly instead of replaying missed intervals. Independent top-level sessions retain independent gates.
 
 Terminal outcomes and explicit urgent semantic attention bypass the routine diagnostic cooldown, while retaining their existing safe-boundary, budget, lineage, and exact-acceptance rules. An execution deadline never waits for this gate. Manual inspection neither consumes nor resets it, and ordinary completion delivery never depends on enabling periodic diagnostics or execution limits.
 
@@ -756,7 +756,7 @@ Add a Run-only `status` view and make it the default when `view` is omitted:
 {"target":"run:review"}
 ```
 
-`inspect target=run:review view=status` is equivalent. Compact text is the default; `verbose: true` returns the same bounded snapshot as JSON, not extra logs or a complete raw Run dump in content/details. Snapshot view rejects inapplicable `lines`, `source`, `identity`, and runtime inventory `status` filters instead of silently ignoring them. Other target families still require their existing explicit views. Existing explicit expert Run views remain available in this increment; they are not the ordinary status path and must not be invoked automatically to expand a compact snapshot.
+`actors_inspect target=run:review view=status` is equivalent. Compact text is the default; `verbose: true` returns the same bounded snapshot as JSON, not extra logs or a complete raw Run dump in content/details. Snapshot view rejects inapplicable `lines`, `source`, `identity`, and runtime inventory `status` filters instead of silently ignoring them. Other target families still require their existing explicit views. Existing explicit expert Run views remain available in this increment; they are not the ordinary status path and must not be invoked automatically to expand a compact snapshot.
 
 Snapshot inspection is read-only: it cannot reset clocks, change report eligibility, acknowledge a pending automatic diagnostic/completion, signal processes, scan directories, or load role bodies beyond bounded identity/index metadata. The payload is refreshed for the manual call; equality with a timed report means the same schema and authoritative facts at the same observation, not reuse of a stale cached heartbeat. Manual responses remain ordinary tool evidence; latest-only folding applies to the separate automatic diagnostic stream, not to arbitrary tool results.
 
@@ -836,7 +836,7 @@ This proves explicit SDK research after actual producer/holder loss through both
 
 The published_sessions starting link uses observeRunContextExportLocation in the existing runs-context-index owner. It resolves only the fixed compiler role through runContextExportPath, independently admits exact Run/generation/root/owner, stats the real evidence directory and regular leaf without opening/reading the role body or semantic index, and retains owner/parent/leaf change checks through final map return. Missing parents/leaves are missing; symlinks/nonregular/unrepresentable locations stay unavailable without usable paths. A changed available role fence refuses the map. Semantic-index absence/corruption/foreign generation or pending/unavailable/publication flags cannot become an original-producer gate for ordinary physical-file research. Presence is not role-schema/body-generation, privacy, historical-publication or completeness certification. The private issuer/body/privacy/publication requirements remain separate and unchanged. Their shared directory-change predicate now also rechecks real-directory/non-symlink type rather than relying on dev/ino agreement alone; a deterministic reused-id/changed-type metadata counterexample failed before this correction. This is a checked-boundary witness, not a reproduced public OS escape. No raw-session scan, eager nested preview read or arbitrary reference follow is introduced.
 
-Only inspect target=runtime view=runs verbose=true adds this map. The adapter obtains and rechecks the real current Pi session; caller owner fields do not select it. Missing/corrupt catalogs return explicit catalog_unavailable while preserving catalog bytes and independent legacy inventory. Compact/default/automatic map delivery remains unchanged; the separate launch-registration effect above is now active. Legacy inventory/status keeps its separate scans/probes; the new map itself performs neither. Source/npm-packed SDK tool-adapter fixtures load/read the active Actors Skill, receive the map in model context and use ordinary read on its first result. A second captured host opens the same saved session after the first host closes and is freshly ESRCH-confirmed; a new session sees only its own branch, and corruption remains unavailable without repair. Two layouts use four fixture hosts, eight SDK journeys, six ordinary mapped-result reads, four ordinary controlled session-catalog reads and four selected controlled-preview reads, with zero Actor workloads or original producer keys. The fixture catalog and two preview files follow the existing publication layouts but contain explicit controlled assistant-text markers; they are not real publisher/issuer output. Each positive journey selects only the first available preview through its known contained relative path, checks the saved Run/generation/command/id and partial coverage, compares exact UTF-8 byte count and Unicode point/count/omission data, and keeps primary_text=not_exported and history_complete=false as recorded labels rather than certification. Real SDK read-start events match the expected exact path sequence; no unselected preview/raw Actor transcript is requested, and its body marker stays out of model context. Parent validation reads both fixture preview files only to compare snapshots and metadata; catalog/selected/unselected bytes remain unchanged and the semantic index stays absent. This proves a controlled-layout ordinary selected-read journey, not original privacy/publication, source clipping behavior or a filesystem sandbox. The fixture deliberately retains running registration/metadata status while recording controlled code0/code7 results; done/failed inventory filters must use the current status owner in both indexed and corrupt-index fallback paths, without changing catalog bytes. Metadata directories/results are controlled fixtures, not genuine launched Runs or producer-exit/terminal/native truth. Parent/child frames, full stdio/actual close and fresh ESRCH before successful deletion are checked; failures retain state.
+Only actors_inspect target=runtime view=runs verbose=true adds this map. The adapter obtains and rechecks the real current Pi session; caller owner fields do not select it. Missing/corrupt catalogs return explicit catalog_unavailable while preserving catalog bytes and independent legacy inventory. Compact/default/automatic map delivery remains unchanged; the separate launch-registration effect above is now active. Legacy inventory/status keeps its separate scans/probes; the new map itself performs neither. Source/npm-packed SDK tool-adapter fixtures load/read the active Actors Skill, receive the map in model context and use ordinary read on its first result. A second captured host opens the same saved session after the first host closes and is freshly ESRCH-confirmed; a new session sees only its own branch, and corruption remains unavailable without repair. Two layouts use four fixture hosts, eight SDK journeys, six ordinary mapped-result reads, four ordinary controlled session-catalog reads and four selected controlled-preview reads, with zero Actor workloads or original producer keys. The fixture catalog and two preview files follow the existing publication layouts but contain explicit controlled assistant-text markers; they are not real publisher/issuer output. Each positive journey selects only the first available preview through its known contained relative path, checks the saved Run/generation/command/id and partial coverage, compares exact UTF-8 byte count and Unicode point/count/omission data, and keeps primary_text=not_exported and history_complete=false as recorded labels rather than certification. Real SDK read-start events match the expected exact path sequence; no unselected preview/raw Actor transcript is requested, and its body marker stays out of model context. Parent validation reads both fixture preview files only to compare snapshots and metadata; catalog/selected/unselected bytes remain unchanged and the semantic index stays absent. This proves a controlled-layout ordinary selected-read journey, not original privacy/publication, source clipping behavior or a filesystem sandbox. The fixture deliberately retains running registration/metadata status while recording controlled code0/code7 results; done/failed inventory filters must use the current status owner in both indexed and corrupt-index fallback paths, without changing catalog bytes. Metadata directories/results are controlled fixtures, not genuine launched Runs or producer-exit/terminal/native truth. Parent/child frames, full stdio/actual close and fresh ESRCH before successful deletion are checked; failures retain state.
 
 **Private-publication saved-session handoff and restart acceptance.** The existing source/npm-packed context-private-evidence fixture now creates a real saved SDK SessionManager identity before Kernel producer admission, persists its actual id/file/cwd before assertions/conversation writes, and stores one explicit controlled bootstrap user message. This is not an original prompted AgentSession/Actor workload. Its already exercised genuine private session writer publishes the existing controlled recorded-session preview; the fixture immediately retains catalog/preview id/path/byte/SHA-256 data bound to its captured producer frame and checks unchanged bytes after later privacy/index-refusal cases. Those data cannot recreate issuer/privacy/native authority. It explicitly registers that exact metadata root before exit with cached status=unknown (not work/native truth), and confirms one visible starting-map row even with the existing long generation. This is fixture preparation, not ordinary read backfill or a real public Run launch. Parent capture now writes the exact positive producer frame before assertions/await and stores Buffer/base64 stdout/stderr plus actual close/completeness as context-private-stdio-v2 before decoding. It checks parent/child/raw frames, real main/ten case metadata files, saved SDK header/message, catalog row and published file hashes before fresh captured-host ESRCH admits successful cleanup. Failures retain state and preserve primary/persistence/proof errors. Per layout there remain 15 genuine private issuer admissions, 10 controlled identity frames, 12 controlled session selections and zero Actor workloads; a saved session identity is not a native member. The fresh-process phase below now consumes this handoff after holder exit. Historical v1 stdio evidence is neither rewritten nor promoted to v2 proof.
 
@@ -846,7 +846,7 @@ Source assessment keeps genuine Actor-session ordinary research independent from
 
 **Genuine Actor-session recorded-source acceptance.** The existing source/npm coordinator fixture adds one public Run through the real package entrypoint and the SDK1.0 installed pi executable, not a renamed script. Its explicitly loaded finite deterministic provider emits one assistant response without network/model judgment or tools. The normal runner supplies the managed session directory and records the actual JSONL reference in execution.json; command/native/root code0 and natural acceptance are checked separately from process exit. A distinct real saved coordinator owns this Run, preserving the original eight-row research map: the first combined nine-row attempt exposed honest 16-KiB omission rather than a product failure. The CLI session has its own distinct v3 id; parent independently verifies header/cwd, actual startup session-file/PID frame, user prompt, assistant row and exact recorded path/UTF-8 bytes. Readiness is recorded by the controlled provider after CLI imports and before its gated response, not authenticated spawning-member evidence. After holder and all25captured runner/workload PIDs are freshly ESRCH-confirmed, a separate SDK host reopens that owning saved coordinator. Real entrypoint inspection yields only its owned Run; ordinary read paths are exactly Skill/result/execution/recorded-session, with the last read selecting one actual assistant JSONL line by offset/limit1. SDK read-start arguments and the independently captured raw line/hash correspond. Existing other-session/fork/clone/live-switch maps exclude this foreign-owned root. All103known catalog/Run/source/catalog-absence snapshots per layout match after research. No session preview catalog is created, and canonical primary text remains selection_not_supported. Fresh ESRCH for all27captured PIDs immediately precedes successful cleanup; failed evidence stays retained. The complete current two-layout composition has20Runs/20runners/30finite workloads/two holders/two fresh readers,42research journeys (16adapter/26actual-entrypoint),28mapped-result reads,26selected command captures and two bounded raw-session-row reads. Counts describe one accepted invocation, not sums across red/focused/final runs. This proves genuine Pi-recorded source investigation, not curated original privacy, authenticated membership, exhaustive closure or automatic publication.
 
-**Earlier approved request-only navigation handoff (owner decision, 2026-10-25).** This remains the discovery aid and older formatting version; the actual-reference implementation and A2 exit above supersede treating this hint alone as completion. Compact spawn/async-tool receipts and newly admitted completion batches offer one optional current-session file-map command: inspect target=runtime view=runs verbose=true. This is the adopted minimal handoff, not an automatically embedded path map or a new mandatory reader. Existing expert launch next_actions remain and gain the same navigation request. A shared pure formatter emits compiler-owned text only; it reads no Run files, catalog, clock or Pi context and cannot grant another logical session's scope. Actual invocation remains the existing Kernel route, which rechecks the live logical session and exact admitted roots/generations. The request is not routine completion/status polling and does not auto-run. New completion batches record navigation_handoff=current_session_request as formatting data only, with strict decoding; legacy absence stays absent across pending/queued/presented reload and phases so prior accepted/proposed message text is not retrofitted or replayed. In those retained handoff packets, the one per-batch request consumes their original shared16KiB render budget and inventory/omission selection; no separate allowance, member-path disclosure or capability reconstruction is introduced. Current explicit-manual result/capture/recorded-session/published-preview, partial coverage/Unicode, containment/source-loss, dual-order/whole-row omission and restart/replacement/isolation evidence remains separate. Reference-only navigation needs no elapsed time/native authority; snapshot/status/timed joins still retain A1/B1's clock/lifetime gates, enforcement retains C and release retains D. Full-map embedding, body publication, periodic reporting and default snapshot switching are not adopted by this handoff.
+**Earlier approved request-only navigation handoff (owner decision, 2026-10-25).** This remains the discovery aid and older formatting version; the actual-reference implementation and A2 exit above supersede treating this hint alone as completion. Compact spawn/async-tool receipts and newly admitted completion batches offer one optional current-session file-map command: actors_inspect target=runtime view=runs verbose=true. This is the adopted minimal handoff, not an automatically embedded path map or a new mandatory reader. Existing expert launch next_actions remain and gain the same navigation request. A shared pure formatter emits compiler-owned text only; it reads no Run files, catalog, clock or Pi context and cannot grant another logical session's scope. Actual invocation remains the existing Kernel route, which rechecks the live logical session and exact admitted roots/generations. The request is not routine completion/status polling and does not auto-run. New completion batches record navigation_handoff=current_session_request as formatting data only, with strict decoding; legacy absence stays absent across pending/queued/presented reload and phases so prior accepted/proposed message text is not retrofitted or replayed. In those retained handoff packets, the one per-batch request consumes their original shared16KiB render budget and inventory/omission selection; no separate allowance, member-path disclosure or capability reconstruction is introduced. Current explicit-manual result/capture/recorded-session/published-preview, partial coverage/Unicode, containment/source-loss, dual-order/whole-row omission and restart/replacement/isolation evidence remains separate. Reference-only navigation needs no elapsed time/native authority; snapshot/status/timed joins still retain A1/B1's clock/lifetime gates, enforcement retains C and release retains D. Full-map embedding, body publication, periodic reporting and default snapshot switching are not adopted by this handoff.
 
 #### Existing Derived Role Exports
 
@@ -1296,7 +1296,7 @@ Private readonly `readRunSessionContextPreview(stateDir, expected, exportId)` no
 
 Private `readRunStreamSource(stateDir, expected, stream)` now admits one fixed canonical runner `stdout` or `stderr` as **kernel-only projection input**, not a readable/model-facing context view. It freshly admits exact published Run/generation/optional owner through the context-identity owner, then uses `readExecutionRunnerStreamText` over the same checked regular-file descriptor machinery as session input. The lower layout owner accepts only root `stdout.log`/`stderr.log` for `runner_stream`, never a capture/session/evidence path; metadata observation stays body-free and file-size-quota-free. The separate text input is capped at 4 MiB, refuses known oversize before opening/allocation/body read, strictly rejects malformed UTF-8, preserves an actual runner-stream BOM and closes the descriptor before returning. Existing session decoding remains unchanged. Empty existing text is distinguishable from missing/unreadable/nonregular source; denied or failed cleanup never yields success or a read retry. Root/marker/Run metadata and source descriptor/path changes invalidate the entire input, including through its returned `unchanged()` callback, without adopting a newer generation. Returned `bytes_total` is current physical source size, not saved/observed command-capture agreement or completeness proof. The raw text is deliberately labeled `visibility: "kernel_only"`, `source_scope: "canonical_runner_stream"`, `capture_completeness: "not_asserted"`; these labels are not visibility permissions or body-authenticity certificates. Do not serialize this input as model/tool evidence: a separately owned fixed privacy/visibility projection must precede any view publication. The canonical runner stdout is already formatted by `executeRegisteredTool` and may be clipped; stderr also carries runner error/log text. Neither is an authoritative complete accepted answer or primary-result capture, nor a safe shortcut to raw Pi JSONL/provider payloads. This input port performs no export/index/status/ACK/clock mutation, directory discovery, process probe, producer reconstruction or native actuation. The input allowance is observational, not a workload/file-content quota or a model-output budget. Stronger curated stream privacy/view/index publication and runtime refresh remain separate unadopted integration work, not prerequisites for accepted A2 ordinary research or a mandatory custom reader. A3 must independently retain authorized complete primary sources before formatting.
 
-The runtime/export owner prepares authorized views and atomically replaces each file and the bounded index independently of inspection; publish a reference only after its export is readable. This is not a cross-file atomic snapshot: mutable live views can advance between index and file reads, and historical excerpts still require stable captures. A missing view is marked unavailable/pending/not-applicable, not fabricated as an empty file. Before following a role, verify the index and evidence generation against the snapshot; replacement/pruning is unavailable evidence, never permission to inspect a newer generation. Context means retained authorized evidence, not a promise to reconstruct discarded history. Manual reads select a role and a bounded range using its format/size/coverage metadata; they do not require `inspect` to return the value or load every role.
+The runtime/export owner prepares authorized views and atomically replaces each file and the bounded index independently of inspection; publish a reference only after its export is readable. This is not a cross-file atomic snapshot: mutable live views can advance between index and file reads, and historical excerpts still require stable captures. A missing view is marked unavailable/pending/not-applicable, not fabricated as an empty file. Before following a role, verify the index and evidence generation against the snapshot; replacement/pruning is unavailable evidence, never permission to inspect a newer generation. Context means retained authorized evidence, not a promise to reconstruct discarded history. Manual reads select a role and a bounded range using its format/size/coverage metadata; they do not require `actors_inspect` to return the value or load every role.
 
 ## Latest-Only Delivery and Context
 
@@ -1315,7 +1315,7 @@ Snapshot production, packet acceptance, and model projection are separate respon
 
 ## Generation-Fenced Manual Kill
 
-Extend the public `message` envelope with top-level `run_instance_id`. It is required for `action: "kill"`; the launch response, compact inspection, or diagnostic supplies it:
+Extend the public `actors_control_apply` envelope with top-level `run_instance_id`. It is required for `action: "kill"`; the launch response, compact inspection, or diagnostic supplies it:
 
 ```json
 {
@@ -1335,9 +1335,9 @@ A winning manual stop claim produces terminal status `killed` with reason `manua
 
 ## Self-Contained Automatic Outcomes
 
-Normal finite roots deliver their outcome through the existing active/idle completion path without an `inspect` round trip. Services need not terminate to stay usable; periodic diagnostics are optional, and normal service Control semantics remain unchanged. Existing silent policies, exact root ownership, and containing-tree eligibility remain authoritative.
+Normal finite roots deliver their outcome through the existing active/idle completion path without an `actors_inspect` round trip. Services need not terminate to stay usable; periodic diagnostics are optional, and normal service Control semantics remain unchanged. Existing silent policies, exact root ownership, and containing-tree eligibility remain authoritative.
 
-Keep generation, terminal status, compact summary, and declared artifacts. Add the distinct `timed_out` reason/deadline evidence and label output from interrupted work `partial: true`. Display clipping is not task partiality. Compact public-spawn and asynchronous registered-tool launch receipts now omit the three generic `inspect` calls while preserving launch facts. Explicit verbose public spawn retains existing full JSON metadata, including expert `next_actions`; meaningful diagnosis may still recommend the appropriate public inspection route. Quiet compact text adds no unconditional completion/readiness promise and does not change silent or service policy.
+Keep generation, terminal status, compact summary, and declared artifacts. Add the distinct `timed_out` reason/deadline evidence and label output from interrupted work `partial: true`. Display clipping is not task partiality. Compact public-spawn and asynchronous registered-tool launch receipts now omit the three generic `actors_inspect` calls while preserving launch facts. Explicit verbose public spawn retains existing full JSON metadata, including expert `next_actions`; meaningful diagnosis may still recommend the appropriate public inspection route. Quiet compact text adds no unconditional completion/readiness promise and does not change silent or service policy.
 
 ### Private Kernel Contract: Primary Command Text Publication
 
@@ -1458,11 +1458,11 @@ Packet admission curates and copies the binding, freezes its nested source/range
 
 The shared operator/model Markdown projection uses literal dynamically fenced previews without whitespace, CRLF, BOM or backtick normalization. It keeps exact shown/total/omitted code-point counts, the half-open UTF-8 range, redaction/clipping distinction and full source/generation/digest reference. Markup delimiters are presentation, not source code points. Existing 64-row/16-KiB model and 256-member/1-MiB journal bounds remain; overflow omits whole rendered rows with explicit retained-member counts, not untracked edits inside excerpts or source paths. Newly admitted row-overflow packets also retain a [scoped captured-member inventory](coordinator-delivery.md#captured-member-inventory) and budget its complete reference before rows. That source lists all captured identities/statuses/lineage and existing primary bindings only; private locations, diagnostics and artifact inventories are not included. Source/journal publication remain separate effects, and phase transitions/rendering never reread or repair the source. Legacy missing references are explicit. Owning properties and a bounded linked source/packed six-composition byte-overflow witness are verified; broader omitted-available-primary/row-limit journeys and artifact/summary/error inventories remain open. Schema parsing and rendering rely only on admitted packet data; they do not authorize new publication or raw/sibling discovery.
 
-The source and installed-tarball SDK fixture now joins the initial case in one chain: a model-issued public `spawn` launches a real bare Node command, the runner publishes its first canonical binding, the root coordinator supplies one automatic batch to the next model context, and ordinary bounded file reads recover the complete exported 128-KiB memory-input or 2-MiB capture-input source from the **reference parsed from that model context**. Tools mode proves actual `stdout_truncated` execution metadata, complete source recovery and redaction in the prefix no longer held in memory; final-answer mode retains complete-memory coverage. It checks the source/generation/hash against the accepted binding, exact preview/range/count agreement, strict UTF-8 and redaction. The fixture uses no private kernel publication, producer admission, source-reader or SDK helper API and invokes no status-polling tool or native completion-send queue.
+The source and installed-tarball SDK fixture now joins the initial case in one chain: a model-issued public `actors_run_spawn` launches a real bare Node command, the runner publishes its first canonical binding, the root coordinator supplies one automatic batch to the next model context, and ordinary bounded file reads recover the complete exported 128-KiB memory-input or 2-MiB capture-input source from the **reference parsed from that model context**. Tools mode proves actual `stdout_truncated` execution metadata, complete source recovery and redaction in the prefix no longer held in memory; final-answer mode retains complete-memory coverage. It checks the source/generation/hash against the accepted binding, exact preview/range/count agreement, strict UTF-8 and redaction. The fixture uses no private kernel publication, producer admission, source-reader or SDK helper API and invokes no status-polling tool or native completion-send queue.
 
 Both layouts exercise a complete tool batch and completion during a final-answer request. Tools mode uses a fixture-only producer-exit barrier before returning the unchanged public reply; final mode returns that reply immediately, holds the command behind a bounded fixture gate until the next model request, and then verifies the completion continuation after that final answer. Both retain one agent run/one accepted batch; requests are respectively two and three. Capture the public receipt's PID/state/generation immediately, require fresh ESRCH for producer exit before cleanup, and retain durable launch/capture uncertainty if exit cannot be proved. These fixture gates/waits are not product deadlines, independent supervision or whole-scope closure proof.
 
-A third source/packed SDK mode proves bounded captured-member overflow recovery through six real public `spawn` calls, one per model request. A shared fixture gate holds output until all PID/state/generation receipts are durably captured; release on the final-answer request produces one automatic batch and one continuation in the same agent run, without status-tool polling or native send queues. Six literal Unicode command-metadata rows exceed 16 KiB, so the model context carries the exact inventory reference and omission count. Ordinary bounded file reads verify the inventory's full hash/bytes, all six natural Run identities/generations/statuses, captured order and exclusion of private locations/diagnostic excerpts/bodies. Captured diagnostic references are retained separately and recovered in full, even for omitted rows. These compositions keep explicit `not_selected` primary bindings: this is not primary-source authorization for composition outputs. Each layout uses eight model requests, six public spawn calls and one accepted batch; fresh producer ESRCH remains mandatory before fixture cleanup. Completion order is not launch order. This witness covers byte-budget member omission with composition primary explicitly unavailable, not all row-limit/primary/artifact/summary/error cases.
+A third source/packed SDK mode proves bounded captured-member overflow recovery through six real public `actors_run_spawn` calls, one per model request. A shared fixture gate holds output until all PID/state/generation receipts are durably captured; release on the final-answer request produces one automatic batch and one continuation in the same agent run, without status-tool polling or native send queues. Six literal Unicode command-metadata rows exceed 16 KiB, so the model context carries the exact inventory reference and omission count. Ordinary bounded file reads verify the inventory's full hash/bytes, all six natural Run identities/generations/statuses, captured order and exclusion of private locations/diagnostic excerpts/bodies. Captured diagnostic references are retained separately and recovered in full, even for omitted rows. These compositions keep explicit `not_selected` primary bindings: this is not primary-source authorization for composition outputs. Each layout uses eight model requests, six public spawn calls and one accepted batch; fresh producer ESRCH remains mandatory before fixture cleanup. Completion order is not launch order. This witness covers byte-budget member omission with composition primary explicitly unavailable, not all row-limit/primary/artifact/summary/error cases.
 
 A fourth source/packed SDK mode now proves **omitted available primary** recovery with six real bare one-attempt command launches, eight model requests, one accepted automatic batch and no status-polling tools/native send queue. Each emits >2 MiB of strictly valid UTF-8; actual execution metadata confirms memory-tail truncation, while the genuine observed-stream/durable-capture path retains the complete fixed-privacy source within the unchanged 4-MiB allowance. Long Unicode positional command metadata forces the shared projected-row byte budget independently of full-output size; compact primary previews stay 160 code points. One inventory reference parsed from actual model context fixes all six captured identities/generations/statuses/primary bindings. Ordinary <=8192-byte reads validate full source SHA-256/UTF-8 bytes/code-point totals/preview ranges/shown-omitted counts, BOM/CRLF/backticks/Unicode tail and full prefix/tail secret redaction. Every source is recovered, including positively counted omitted members; displayed primary refs agree with displayed rows. Identical content hashes across Runs do not collapse source/generation identity. Metadata references remain separately verified and no unsupported composition scope is added. Those four modes cover eight layout scenarios/28 real public producers with the same immediate durable PID/state/generation capture and fresh ESRCH cleanup proof. This closes that bounded byte-overflow witness only, not all selection/failure/summary/artifact cases, manual visual/external-model/native or integrated release acceptance.
 
@@ -1526,7 +1526,7 @@ The source must exist and retain the complete exported result before clipping. I
 
 Artifact bodies are not automatically all inlined. Export a bounded manifest of names, authorized source references, media types, availability, and byte sizes where known; optional text previews use the same descriptor. Binary files remain references. Reuse existing digests when available rather than requiring an implicit full scan of every large artifact. Any mutable external artifact reference must be identified as mutable and cannot serve as the retained original of an embedded excerpt without an owned stable capture.
 
-The shared packet budget covers metadata and previews together. If artifact entries, summaries/errors, or terminal rows are omitted, disclose counts and a readable generation-bound manifest/result-index source for the omitted evidence. Summary/error clipping must likewise retain a source. Every overflow path must be usable with normal authorized file-reading tools; `inspect` cannot be the only way to recover an automatically omitted result.
+The shared packet budget covers metadata and previews together. If artifact entries, summaries/errors, or terminal rows are omitted, disclose counts and a readable generation-bound manifest/result-index source for the omitted evidence. Summary/error clipping must likewise retain a source. Every overflow path must be usable with normal authorized file-reading tools; `actors_inspect` cannot be the only way to recover an automatically omitted result.
 
 ### Visible Truncation Contract (UX/AX)
 
@@ -1553,7 +1553,7 @@ Full text: <readable retained exported result>
 
 - Recipe resolution owns literal-field validation, direct-delegation inheritance, normalization, and effective-policy capture. Run creation owns the start anchor and singleton comparison.
 - Runtime lifecycle supervision owns due times, exact-generation stop claims, process/tree proof, and terminal truth. Presentation code must not signal processes directly.
-- Observation owns the shared manual/timed snapshot and declared result/capture evidence. The export owner publishes the readable context index through existing privacy/ownership projections; `inspect` only reads it. Delivery owns frozen packets, bounds, acceptance, and recovery; context projection owns automatic diagnostic supersession only.
+- Observation owns the shared manual/timed snapshot and declared result/capture evidence. The export owner publishes the readable context index through existing privacy/ownership projections; `actors_inspect` only reads it. Delivery owns frozen packets, bounds, acceptance, and recovery; context projection owns automatic diagnostic supersession only.
 - `index.ts` remains wiring. Reuse canonical locks, process verification, journal/capture authorities, and public Pi ports; keep the local module graph acyclic.
 - Implementation must update owning Skills, current API references, source/packed contracts, and error guidance when the new behavior actually exists. Do not present unsupported additions as current behavior or use live stores as validation fixtures.
 
@@ -1600,7 +1600,7 @@ The [canonical backlog](../BACKLOG.md) keeps A/B/C independently actionable wher
 - **SUP-11 — Honest excerpts:** Verify UTF-8 ranges, full/empty/large results, byte and Unicode code-point counts, redaction-relative metadata, missing/incomplete captures, unavailable old generations, and independent task partiality. Never substitute newer bytes or invent source availability.
   - Evidence: U/I/P UTF-8/Unicode/redaction properties, full/empty/large inputs, multistage previews and unavailable generations/captures.
   - Publication blocker: Wrong accounting, newer-byte substitution, an unreadable/unretained promised source or incomplete capture presented as complete.
-- **SUP-12 — Recoverable overflow:** Large/binary/many artifacts and omitted terminal rows retain a readable manifest/index with omission counts under the shared context budget. Reading published evidence does not require `inspect` or raw-registry access.
+- **SUP-12 — Recoverable overflow:** Large/binary/many artifacts and omitted terminal rows retain a readable manifest/index with omission counts under the shared context budget. Reading published evidence does not require `actors_inspect` or raw-registry access.
   - Evidence: U/I/P many outcomes/artifacts, large/binary references and bounded packet overflow with selective readable recovery.
   - Publication blocker: Silent omissions, unrecoverable entries, raw-registry dependence or unbounded/binary bodies in model context.
 - **SUP-13 — Public delivery journey:** Real source and packed SDK fixtures prove one active-boundary update after the entire tool batch, idle batching, root/child lineage, silent-policy preservation, no periodic wakeup when disabled, no native-steer synthesis, and independent urgent semantic attention. Assertions must witness provider callback completion outside the callback.
@@ -1619,4 +1619,4 @@ The [canonical backlog](../BACKLOG.md) keeps A/B/C independently actionable wher
   - Evidence: U/I/P staggered due times, exact floor, unresolved acceptance, busy/idle/recovery, independent roots and bypass neutrality.
   - Publication blocker: Per-Run frequency bypass, cooldown from proposals, manual/terminal/urgent gate changes, catch-up bursts or diagnostic wakeups while disabled.
 
-Use existing Recipe/reference, tool/Control, async-run, observability, delivery, session-evidence, inspect/security, and agent-journey test families. Runtime implementation closes only after focused witnesses plus the normal product validation, source/packed parity, and canonical ABCd context checks. Version preparation and external publication belong to the applicable scoped candidate checkpoint in BACKLOG.md, not implementation progress alone; follow the [release contract](./releasing.md). Removing `inspect` and implementing MPRIS remain outside the authorized scope.
+Use existing Recipe/reference, tool/Control, async-run, observability, delivery, session-evidence, inspect/security, and agent-journey test families. Runtime implementation closes only after focused witnesses plus the normal product validation, source/packed parity, and canonical ABCd context checks. Version preparation and external publication belong to the applicable scoped candidate checkpoint in BACKLOG.md, not implementation progress alone; follow the [release contract](./releasing.md). Removing `actors_inspect` and implementing MPRIS remain outside the authorized scope.